joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e6f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x1ec]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x45e897
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x224]
mov eax, dword [ebx + 0x10]
call fcn.0041aa90
cmp byte [ebp + 8], 0
je 0x45e74d
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.0041a960
jmp 0x45e75b
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.0041a960
mov eax, dword [ebx + 0x10]
call fcn.0041aa88
dec eax
jle 0x45e7a1
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.0041a958
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.0041aa88
push eax
push 0x12200
call sub.gdi32.dll_ExtCreatePen
mov edx, eax
mov eax, edi
call fcn.0041aa20
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov bx, 0xffcf
call fcn.00403038
test al, al
je 0x45e7ea
test esi, esi
jne 0x45e7ea
inc dword [ebp - 0xc]
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x45e820
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1ec]
call fcn.0041b564
push eax
call sub.gdi32.dll_PolyPolyline
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x479e67
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x499b9e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x479ebf
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x499bbf
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x479eb5
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x479ec3
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x485ce8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, ebx
je 0x48625d
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.00485a64
xor bh, al
pushfd
movzx eax, word es:[edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00485a64
mov al, byte [0x6645b826]
mov eax, dword [edi + 6]
inc edi
push es
cmp ax, bx
jbe 0x485cbe
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x485cb8
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x485ca9
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00485a64
xchg esi, eax
cmp edi, dword [ecx - 0x57ba72d8]
push eax
call fcn.00485a74
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00485a29
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x485d52
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00485a64
pop ebx
aas
call 0xc08deb72
push eax
call fcn.00485a74
push eax
push esi
push dword [ebp + 8]
call fcn.00485a29
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00485a64
inc eax
mov ah, 0xa2
sub ecx, dword [ebp + 0x5d88e845]
call 0xe9a5e625
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x485e0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00485a74
push eax
push esi
push dword [ebp + 8]
call fcn.00485a29
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00485a74
push eax
push esi
push dword [ebp + 8]
call fcn.00485a29
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00485a74
push eax
push esi
push dword [ebp + 8]
call fcn.00485a29
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00485a64
xor eax, 0x88fb522d
popfd
jl 0x485ee9
invalid
invalid
Function at 0x4860e4
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x486118
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x486113
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
jne 0x4860fd
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x486105
cmp edx, ebx
jne 0x486253
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4860d4
add eax, dword [eax + 4]
jmp 0x4860c1
mov dword [ebp + 0xc], ebx
jmp 0x486123
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x48613b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x486159
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4861b7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x48619e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4861a7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4861b1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x486193
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x48611d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x486204
dec eax
je 0x4861fb
sub eax, 3
je 0x4861f2
mov dword [ebp - 4], 0x40
jmp 0x486221
mov dword [ebp - 4], 4
jmp 0x486207
mov dword [ebp - 4], 0x20
jmp 0x486207
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x486253
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4861d3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00485a64
or dword fs:[eax + 0x6b], edx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x48625f
push 0x8000
push ebx
push esi
call dword [ebp - 8]
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x3648504c
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x9d252fd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40104a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x480ff0
call fcn.0040237e
mov ecx, esi
push str.EBWebViewx86EmbeddedBrowserWebView.dll
call fcn.0040237e
mov ecx, esi
call fcn.0040245e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop esi
pop ebp
ret

Function at 0x401125
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.00402236
mov ecx, esi
push dword [ebp + 8]
call fcn.004022ae
mov ecx, esi
call fcn.0040245e
mov edi, eax
mov ecx, esi
call fcn.0040244a
cmp eax, 3
jb 0x40119b
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x40118b
cmp word [edi + 4], 0x5c
jne 0x40119b
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x40119b
jmp 0x401229
cmp word [edi], 0x5c
jne 0x40119b
cmp ax, 0x5c
je 0x401229
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.004021c4
push edi
push 0
call fcn.00401080
add esp, 8
test eax, eax
js 0x401261
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.0040244a
mov ebx, eax
mov ecx, edi
call fcn.0040245e
mov ecx, esi
push ebx
push eax
call fcn.004022d8
mov ecx, edi
call fcn.0040245e
push 0x5c
push eax
call fcn.0044a07b
add esp, 8
test eax, eax
je 0x401270
mov ebx, eax
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.0040245e
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.0040245e
mov ecx, esi
push ebx
push eax
call fcn.004022d8
mov ecx, esi
push dword [ebp + 8]
call fcn.0040237e
mov ecx, edi
call fcn.004021d6
xor edi, edi
push esi
call fcn.0040104a
add esp, 4
test al, al
jne 0x40127d
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.0040245e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x481056
call edi
mov edi, 0x80070002
jmp 0x40127d
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x401275
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.004021d6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004465ed
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401f4b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov edi, edx
mov esi, ecx
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.00449240
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
sub ecx, edi
push eax
push 0x20219
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x402048
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x24]
push edi
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402046
cmp dword [esp + 0xc], 3
mov ebx, 0
jb 0x402048
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.004022ae
mov ecx, esi
call fcn.0040245e
push 0x5c
push eax
call fcn.0044a07b
add esp, 8
test eax, eax
je 0x402046
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.00401df8
test al, al
je 0x402046
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x402037
push edi
call fcn.004022ae
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00402060
mov ebx, eax
jmp 0x402048
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.004465ed
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402060
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x4813b8]
cmp dword [ecx + eax], edx
ja 0x40207e
jb 0x402089
add eax, 4
cmp eax, 0x10
jne 0x402069
push esi
call fcn.0040104a
add esp, 4
jmp 0x4020a9
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Loader_skipped_an_incompatible_version:
call edi
mov ecx, esi
call fcn.0040245e
push eax
call edi
push 0x48141a
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x40298e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x402a09
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x402a23
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.00402a4d
add esp, 8
test al, al
je 0x402a33
mov eax, dword [esi]
test eax, eax
je 0x402a49
push 0xa
push 0
push eax
call fcn.004561d0
add esp, 0xc
cmp eax, 1
jmp 0x402a27
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004465ed
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00402a4d
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x402a35
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004465ed
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x402a2a

Function at 0x402a4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.00449240
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x402ac4
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.004022ae
mov ecx, edi
call fcn.0040245e
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004465ed
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402b6c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x402bca
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402c3c
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x46e46c]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x402ca7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
xor eax, eax
dec eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.004021c4
push edi
push 1
push 4
push ebx
call fcn.00402ae0
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.0040245e
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x48141a
call ebx
mov ecx, edi
call fcn.004021d6
jmp 0x402cbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x20]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.004021c4
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.00402ae0
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.0040245e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x48141a
call eax
mov ecx, ebx
call fcn.004021d6
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402cbe
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004465ed
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ada0
mov eax, dword fs:[0]
push eax
mov eax, 0x1464
call fcn.00446880
push esi
push edi
mov eax, dword [0x4cc5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x141c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1418], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1420], eax
mov esi, dword [ebp + 0x20]
xor eax, eax
push esi
mov dword [ebp - 4], 0
mov word [ebp - 0x140c], ax
mov byte [ebp - 0x40c], al
call fcn.004060c0
add esp, 4
mov dword [ebp - 0x1414], eax
mov dword [ebp - 0x1470], 3
mov ecx, 1
mov dword [ebp - 0x146c], esi
lock xadd dword [0x4d505c], ecx
inc ecx
mov dword [ebp - 0x1468], ecx
mov ecx, dword [ebp + 0x24]
test ecx, ecx
je 0x4037b4
cmp word [ecx], 0
mov dword [ebp - 0x1464], ecx
jne 0x4037be
mov dword [ebp - 0x1464], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1460], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x1410]
mov dword [ebp - 0x1454], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0x1414]
mov dword [ebp - 0x144c], eax
mov eax, dword [ebp - 0x1418]
mov dword [ebp - 0x145c], eax
mov eax, dword [ebp - 0x141c]
mov dword [ebp - 0x1458], eax
mov eax, dword [ebp - 0x1420]
mov dword [ebp - 0x1428], eax
mov eax, dword [0x4d4fbc]
mov dword [ebp - 0x1424], edi
movq qword [ebp - 0x1438], xmm0
mov dword [ebp - 0x1430], 0
movups xmmword [ebp - 0x1448], xmm0
test eax, eax
je 0x403844
call eax
mov dword [ebp - 0x142c], eax
jmp 0x40384e
mov dword [ebp - 0x142c], 0
mov eax, dword [0x4d4fb4]
test eax, eax
je 0x40386c
push 0x400
lea ecx, [ebp - 0x40c]
push ecx
lea ecx, [ebp - 0x1470]
push ecx
call eax
mov eax, dword [0x4d4fb8]
test eax, eax
je 0x40387e
lea ecx, [ebp - 0x1470]
push ecx
call eax
mov eax, dword [0x4d4ff0]
test eax, eax
je 0x403890
lea ecx, [ebp - 0x1470]
push ecx
call eax
mov eax, dword [ebp - 0x146c]
mov ecx, 0x8000ffff
test eax, eax
cmovns eax, ecx
cmp byte [0x4d5080], 0
mov dword [ebp - 0x146c], eax
jne 0x4038cf
mov eax, dword [0x4d507c]
test eax, eax
je 0x4038bf
call eax
movzx eax, al
jmp 0x4038cb
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
test eax, eax
je 0x4038d8
cmp byte [0x499004], 0
jne 0x4038f9
mov eax, dword [0x4d5078]
test eax, eax
je 0x403952
cmp byte [0x4d5090], 0
jne 0x403952
push 0
push 0
lea ecx, [ebp - 0x1470]
push ecx
call eax
jmp 0x403952
mov eax, dword [0x4d5078]
test eax, eax
je 0x403920
cmp byte [0x4d5090], 0
jne 0x403920
push 0x800
lea ecx, [ebp - 0x140c]
push ecx
lea ecx, [ebp - 0x1470]
push ecx
call eax
cmp word [ebp - 0x140c], 0
jne 0x403945
lea eax, [ebp - 0x1470]
push eax
lea eax, [ebp - 0x140c]
push 0x800
push eax
call fcn.00405420
add esp, 0xc
lea eax, [ebp - 0x140c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x4d5088], 0
je 0x403966
mov eax, dword [0x4d4fc4]
test eax, eax
je 0x403966
call eax
lea eax, [ebp - 0x1470]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004077e0
int3