joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451ebf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x451ee4
cmp eax, edi
jge 0x451edc
mov eax, esi
call fcn.0045187d
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edi, dword [esi + 8]
xor ecx, ecx
test edi, edi
jle 0x451f11
mov eax, dword [esi + 0xc]
push ebx
mov dl, byte [esi + 0xc]
sub edi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, edi
inc ecx
mov dword [esi + 0xc], eax
test ebx, ebx
jg 0x451ef1
mov dword [esi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x451f30
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x451f1e
xor eax, eax
jmp 0x451f26
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x451f14
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x451f62
mov eax, str.zlib_corrupt
call fcn.0044f155
jmp 0x451f9d
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x451f72
mov eax, str.read_past_buffer
jmp 0x451f5b
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x451f87
mov ecx, edi
call fcn.004518b3
test eax, eax
je 0x451f9d
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00411fe0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x459195
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xb8
movsd dword es:[edi], dword [esi]
jnp 0x459136
pop ebp
stosb byte es:[edi], al
adc byte [edi - 0x2d], dh
push esp
sub ah, cl
jno 0x45911b
pop eax
dec edx
fadd qword [eax + 0x68c57825]
imul byte [ecx - 0x11]
invalid
lds ebp, [eax - 0xa]
imul ebp, edi, 0x7f20f862
aam 0x6b
push eax
shr dword [ecx + 0x57], cl
clc
and byte [edi - 0x2c], bh
imul edx, dword [eax - 0x2d], 0x69
push edi
mov dl, 0x56
cld
lea edi, [edi - 0x376d229b]
sbb byte [ecx], 0x2c
jge 0x459107
sub al, 0x7d
rol eax, cl
mov bh, 0xc
daa
sal byte [edi + 0x46d1270c], 0xd8
or al, 0x27
rol dword [esi - 0x28], 1
jnp 0x459131
adc ebp, dword [edx + eax - 0x19]
rep movsb byte es:[edi], byte [esi]
retf
imul ecx, dword [ecx - 0x4d], 0x6777db0a
cdq
pushfd
or byte [0x1f5e3320], ah
xor byte [ecx + eax*2], 0x1a
xchg ebx, eax
sub ecx, 0xfffffff0
lds edi, [edi]
mov ecx, 0x96e73d53
jb 0x459115
in al, 0x84
sbb bh, byte fs:[edi]
aas
push edi
push edi
sbb dword [ebp - 0x56], eax
push es
pop eax
or byte [edi - 0x6f], 0xb3
jne 0x459100
jae 0x459154
mov cl, 0x35
push ebx
stosb byte es:[edi], al
lodsd eax, dword [esi]
lodsb al, byte [esi]
sub dl, ah
loopne 0x459173
push 0x81f8cb19
clc
lds ebx, [ecx - 0x37]
or ecx, dword [eax + ebp*8 + 0x385e58d4]
mov eax, gs
aam 0x58
pop esi
cmp byte [eax], dl
jp 0x4591c1
leave
or dword [ecx], edi
sti
mov word [ebx], ds
leave
bound esp, qword [esi - 0x44e11952]
outsb dx, byte [esi]
invalid

Function at 0x4a3c91
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x4b
mov cl, 0x51
adc dword [ebx - 0x5f], esi
sal byte [edi*2 + 0x5eaec2f7], 0xbf
test edx, 0x6ebf5eae
test edx, 0x6ebf5eae
vpaddusb ymm6, ymm7, ymmword [ebx]
xor byte [esp + esi*4 - 0x3bf2fe73], ch
sbb al, 0xee
outsd dx, dword [esi]
and eax, 0xe4c97a2e
dec edi
sbb byte [ebp - 0xb], bl
jle 0x4a3c87
int1
bound ebp, qword [ebp + 0x5a]
mov word [ebx], ds
sbb eax, esp
int3

Function at 0x4d0b65
Capabilities:
Encode data using xor

Disassembly:
pop ebp
mov ah, 0xe6
xor byte [0x7ccf781d], 0x8c
lds edx, [ebx + 0x5b]
or dword [ebx - 0x11], 0xffffffc6
test eax, 0xebfa317b
fldcw word [ebx + edi*4 - 0x23f9fd8a]
jg 0x4d0b68
add al, byte [eax]
sub al, 0x49
sub al, 0xc1
retf 0x7db4

Function at 0x53562d
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xfb04ccfa
add bh, byte [edi - 0x76]
xchg ebx, eax
mov edx, 0xd320f609
sub byte [edx], dh
popal
sbb ch, byte [ebx + edi + 0x45]
inc ebp
inc ebp
imul ebx, dword [0x687870ae], 0x40c6234f
mov ch, 0xaf
add ah, byte [ebp + 0x8830e21]
xor ah, byte [ebx - 0x2d]
pop ds
dec edi
sub al, 0x52
sal byte [edx - 0x1437916c], 0xfd
inc esi
nop
dec byte [eax]
jbe 0x535619
xor dl, byte [eax]
invalid

Function at 0x539209
Capabilities:
Encode data using xor

Disassembly:
push cs
pop edi
adc al, 0x65
invalid
shl dword [ebx], 0xd
wait
and eax, 0xc256994c
test byte [bp + si], 0xd8
dec ebp
mov al, byte [0x5223d176]
ja 0x5391ed
and cl, byte [ecx + 0x73]
and al, 0xdf
or eax, 0xb6b9b281
invalid
Function at 0x5550d7
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xff77e862]
or esp, ecx
and eax, 0xf22f7b70
pop ecx
shr dword [ebx + 0x16a595e0], cl
or al, dh
sal byte [eax], 1
mov al, byte [0x6dfdd064]
mov es, ecx
sbb dword [edx - 0x6e8e7571], ecx
inc esp
cmp byte [0xd95c2102], al
sub ecx, dword [eax]
inc edx
rcr byte [esi], 1
pop esp
fldcw word [ebx]
or byte [edx - 0x30], al
push ds
pop ecx
mov ecx, 0x836be201
lcall 0x5b64, 0x78d2ee70
pop ebx
ja 0x555133
push edi
lodsd eax, dword [esi]
jnp 0x555113
retf 0x1482
add eax, 0xf8d36f08
outsd dx, dword [esi]
sar eax, cl
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
cmp edi, dword [edi + ecx*2 + 0x72e8b6d1]
fcmovnu st(0), st(4)
dec edi
pop esp
or eax, 0x591640d9
xor byte [ecx], al
xor byte [eax - 0x39], ch
mov ch, 0x64
jo 0x555135
sbb dword [eax + 0x3d797a90], edx
fdiv dword [eax + 0x4d]
lcall 0xa26d, 0xf23b5a96
push ss
pop edi
sbb cl, byte [ebp + 0x6c697afb]
movsb byte es:[edi], byte [esi]
mov es, word [edi - 0x78]
jne 0x555100
cdq
mov al, 0xdc
push 0xffffffffffffffa0
jb 0x555138
invalid

Function at 0x5cf8fd
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
sbb dword [ebx + 0x73], 0xf264ee41
pushfd
invalid

Function at 0x5d9565
Capabilities:
Encode data using xor

Disassembly:
lea edi, [esi]
sbb al, 0xd2
retf 0x5283
push esi
sbb dl, dh
jbe 0x5d94ff
mov bh, 0x10
arpl word [edi - 0x47], bx
test dword [ecx + 0x14e1c283], 0x67a0e12b
insb byte es:[edi], dx
xchg edi, eax
dec ebp
insb byte es:[edi], dx
fidiv dword [ebx]
outsd dx, dword [esi]
xor eax, 0x7540e5a4
salc
and dword [ebp - 0x77], 0xc535070c
test al, 0x55
sbb eax, 0xd0744375
je 0x5d9537
je 0x5d9537
jae 0x5d95af
lea ebp, [edx + ecx*2 + 0x531f3510]
sbb al, 0xf0
mov al, byte es:[0xc6ea4edd]
fisttp qword [esi - 0x16]
invalid
mov ch, 0x7f
test dword [edx + 0x4ddb60cf], edi
push ebx
add eax, 0xf847842a
cmp dword [edi + 0x65], ebp
dec ebp
iretd
sar dword [0xfa498273], 0x49
dec ecx
cwde
fdiv qword [0x23d8626b]
std
daa
jne 0x5d95f7
loop 0x5d95b5
inc edx
sar dword [ecx + edi*4 + 0x22e4cd58], 1
das
add al, 0xb0
popal
adc eax, 0x2c812be4
push ecx
xchg dword [eax + esi*2 + 0x7c], eax
add eax, 0x7642f52c
aas

Function at 0x5dac25
Capabilities:
Encode data using xor

Disassembly:
test esi, ebx
mov dword [0x7fb4e5a2], eax
pop ebp
aam 0x38
xor ebp, ecx
or al, 0xc1
adc dword [ecx + 0x38355104], ebx
cmpsb byte [esi], byte es:[edi]
xor dword [edx - 0x420f9201], edx
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
inc ecx
jg 0x5dac3c
mov dl, 0x61
mov byte [eax - 0x7f7bfffc], dl
enter 0xfffffffffffff0e4, 0xffffffffffffff87
test byte [eax - 0x780f1b38], al
inc ax
and bh, byte [edx + 0x72a00455]
add dword [esi - 0x1eeafb12], 0x11
push eax
mov ebp, 0xa9d42ac0
mov byte [ecx + esi*2 - 0x28], ah
xor dl, ch
jnp 0x5dac4d
mov al, byte [0x415a6a9]
lodsb al, byte [esi]
dec ecx
sbb dword gs:[edi - 0x6e], esp
push edi
inc eax
pop ebx
or al, 0x45
out dx, eax
pop ds
push 0x2f
invalid
Function at 0x5ea549
Capabilities:
Check for software breakpoints

Disassembly:
inc ebx
out 0x13, eax
xchg esp, eax
xor dword [eax - 0x7439f586], 0x8946dc64
and al, 0x88
mov al, byte [0x6330303d]
loope 0x5ea57b
push ebp
xchg ebp, eax
xchg ecx, eax
mov dh, 0x6a
push 0x60509910
pushal
jmp 0xc5b579f1
xor esi, edi
sbb dword [edi], esp
mov edx, 0xf23a21cc
ficomp dword [ebp - 0x30]
cdq
push ecx
adc byte [edx - 0x68316f2b], ah
fisttp word [ecx + 0x50f36827]
adc eax, 0xab293459
jne 0x5ea548
sbb al, 0xa0
insb byte es:[edi], dx
mov ebx, 0xbf817d38
mov dword [edx - 0x310e722c], 0xcbec75a1
nop
add dword [esi + edx], edx
adc eax, 0xb245521b
push ss
jno 0x5ea601
les edi, [edx - 0x42]
inc esi
xor dword [esi], esi
sar dword [ebp + 0x3330055], 1
leave
cmp al, 0xcc
lodsb al, byte fs:[esi]
cmp eax, 0xd5b2ee80
pop ds
sti
and al, 0x41
or eax, 0xb12b6ebc
sbb ch, dh
mov dh, 0x7c
adc dl, al
stc
invalid
imul eax, ecx, 0xc7cad9a9
inc ecx
mov dl, 0x6a
mov eax, 0x2e91c3e5
mov edx, 0x22eebdfb
invalid

Function at 0x60c18d
Capabilities:
Encode data using xor

Disassembly:
dec ecx
cmc
xor al, 0x9a
pop edx
dec ebp
and byte [ebx - 0x27330baa], al
inc ecx
inc ebp
push ss
test eax, 0x84a3559c
rol byte [ebx], 1
mov al, byte [0xeacd33cd]
adc ebp, ebx
shl byte [0xa0eae6a0], 0x90
sbb byte [edx + esi*4 + 0x2f], dh
dec eax
add al, byte [ecx]
xor ch, bh
adc edi, dword [edi - 0x60]
jnp 0x60c172
lea ecx, [esi + 0x7d1b4464]
fidiv dword [esi - 0x3b]
mov al, 0xd7
pop es
or esi, edi
ret
Function at 0x10007b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.10007b09

Function at 0x1002e1cc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x1002e200
mov esi, ecx
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.1002e208
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1002e1f9
mov dword [esi], ebx
call fcn.1014e410
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1002ec58
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x1002eca6
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1002ec80
cmp edx, 1
je 0x1002ecc7
cmp edx, 2
je 0x1002ecbe
cmp edx, 3
jne 0x1002ecd2
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x10045c96
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2d4
mov dword [ebp - 0x2e0], edx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov al, byte [ecx + 0x31d]
test al, 1
jne 0x10045eb0
mov edi, ecx
movzx eax, byte [0x102b433b]
test al, al
jns 0x10045cd2
mov eax, dword [0x102b4334]
test eax, eax
je 0x10045eb0
push 0x102b4330
call fcn.10168750
add esp, 4
test al, al
je 0x10045eb0
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.10208980
add esp, 0xc
mov ecx, esi
push 2
push 0
push 0x102b4330
call fcn.10170bc0
xor eax, eax
dec eax
lea ebx, [ebp - 0x2b0]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, esi
push ebx
call fcn.10170e80
mov ecx, ebx
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x10045d41
mov eax, dword [ebp - 0x2ac]
test eax, eax
mov dword [ebp - 0x2dc], edi
je 0x10045e7e
mov dword [ebp - 0x2d8], 0
lea edi, [ebp - 0x2c8]
lea ebx, [ebp - 0x2bc]
mov esi, ebx
xor eax, eax
dec eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], eax
mov ebx, edi
lea edi, [ebp - 0x2d4]
push edi
call fcn.1014c7f0
mov ecx, edi
mov edi, ebx
push ebx
call fcn.1014d5f0
movzx eax, byte [ebp - 0x2bd]
mov edx, ebx
test al, al
jns 0x10045dad
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c4]
mov ebx, esi
mov ecx, esi
push eax
push edx
call fcn.10167540
cmp byte [ebp - 0x2bd], 0
jns 0x10045dcf
push dword [ebp - 0x2c8]
call fcn.10205096
add esp, 4
lea ecx, [ebp - 0x2d4]
call fcn.1014bf30
mov ecx, ebx
call fcn.10167800
test al, al
je 0x10045e37
cmp byte [ebp - 0x2e0], 0
jne 0x10045e31
lea esi, [ebp - 0x2b0]
push esi
call fcn.1014d680
add esp, 4
test al, al
jne 0x10045e37
mov ecx, esi
push edi
call fcn.1014c7f0
cmp byte [ebp - 0x2bd], 0
mov eax, edi
jns 0x10045e1a
mov eax, dword [ebp - 0x2c8]
push eax
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringW]
call esi
mov ecx, edi
call fcn.1014bf30
push 0x1025b68c
call esi
inc dword [ebp - 0x2d8]
mov ecx, ebx
call fcn.100875b0
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.10170e80
lea ecx, [ebp - 0x2b0]
push ebx
call fcn.1014bfb0
mov ecx, ebx
call fcn.1014bf30
movzx eax, byte [ebp - 0x2a5]
test al, al
jns 0x10045e6e
mov eax, dword [ebp - 0x2ac]
test eax, eax
lea ecx, [ebp - 0x2b0]
jne 0x10045d65
jmp 0x10045e88
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x2b0]
call fcn.1014bf30
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2d8]
mov dword [eax + 0x2bc], ecx
lea ecx, [ebp - 0x2a4]
call fcn.10170d40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
add esp, 0x2d4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10056c52
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov dword [ebp - 0x230], ecx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
dec ebx
lea edi, [ebp - 0x224]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push edi
call fcn.10143515
add esp, 4
lea esi, [ebp - 0x218]
push 0x208
push 0xff
push esi
call fcn.10208980
add esp, 0xc
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0x22c], ebx
call fcn.1014349c
cmp byte [edi + 0xb], 0
jns 0x10056cc2
mov edi, dword [ebp - 0x224]
movzx eax, al
add eax, 0x80000001
lea ecx, [ebp - 0x22c]
push ecx
push 0x20219
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x10056d2c
lea eax, [ebp - 0x228]
push eax
push esi
push ebx
push ebx
push str.EBWebView
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x10056d2c
mov edi, dword [ebp - 0x230]
mov ecx, edi
push esi
call fcn.10036cb0
push edi
call fcn.1002d82c
add esp, 4
mov ebx, eax
cmp byte [ebp - 0x219], 0
jns 0x10056d43
push dword [ebp - 0x224]
call fcn.10205096
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1005b806
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x10d]
shl eax, 3
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [ecx + 0x1c]
call edi
movzx eax, byte [esi + 0x10d]
shl eax, 3
push eax
push dword [esi + 0x108]
call edi
cmp dword [esi + 0x60], 0
je 0x1005b869
mov eax, dword [esi + 0x5c]
mov al, byte [eax + 0x31d]
test al, 1
jne 0x1005b869
mov ecx, dword [esi + 0x60]
movzx eax, byte [esi + 0x10d]
push eax
call fcn.10080670
cmp byte [esi + 0x10d], 0
je 0x1005b869
mov ecx, esi
call fcn.1006053a
pop esi
pop edi
pop ebp
ret 4
Function at 0x1006b142
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test byte [0x102b22ec], 0x19
jne 0x1006b1fd
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006b1d8
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
push str.WebView2_Update_Cancelled
call esi
push 0x1025a4c7
call esi
mov edi, 0x10257354
lea esi, [ebp - 0x20]
mov dword [esi], edi
mov dword [esi + 4], 0x80004004
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.10061b1c
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov dword [esi], edi
mov eax, dword [esi + 8]
test eax, eax
je 0x1006b1bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1006b1ca
push eax
call dword [sym.imp.kernel32.dll_LocalFree]
push 0x1025a39d
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov esi, dword [ebp + 8]
push 3
push 0x80004004
push 0
push ebx
push esi
call fcn.1006b220
add esp, 0x14
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebp - 0x20]
mov dword [edx], 0x80004004
mov ecx, str.WebView2_Update_Cancelled
call fcn.1006aff9
jmp 0x1006b162
Function at 0x1007200a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x38]
test eax, eax
jne 0x1007202c
mov esi, ecx
cmp dword [ecx + 0x10], 0
je 0x1007203e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [0x102b42d0], 0
je 0x10072055
mov eax, dword [0x102b42c8]
test eax, eax
je 0x10072055
xor edi, edi
inc edi
jmp 0x10072066
xor edi, edi
cmp byte [esi + 0x49], 0
je 0x10072066
call fcn.10184190
mov byte [esi + 0x49], 0
movzx eax, byte [esi + 0x37]
test al, al
jns 0x10072071
mov eax, dword [esi + 0x30]
test eax, eax
je 0x10072086
lea eax, [esi + 0x2c]
push eax
call fcn.101686c0
add esp, 4
movzx eax, al
jmp 0x10072088
xor eax, eax
or eax, edi
je 0x100721ae
mov ebx, dword [esi + 0x44]
mov dword [ebp - 0x34], ebx
mov edi, ebx
sar edi, 0x1f
mov ecx, dword [esi + 0x40]
add ecx, edi
adc ebx, edi
xor ecx, edi
mov edx, 0x3e8
mov eax, ecx
mul edx
mov dword [ebp - 0x2c], eax
xor ebx, edi
mov dword [ebp - 0x30], ebx
imul eax, ebx, 0x3e8
add eax, edx
mov dword [ebp - 0x28], eax
xor ebx, ebx
dec ebx
add ebx, 1
mov edx, 0x7fffffff
adc edx, 0
xor eax, eax
mov edi, dword [ebp - 0x2c]
neg edi
mov dword [ebp - 0x24], edi
sbb eax, dword [ebp - 0x28]
cmp dword [ebp - 0x34], 0
mov edi, 0xffffffff
cmovns ebx, edi
mov edi, 0x7fffffff
cmovns edx, edi
cmovns eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
cmovns edi, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edi
mov edi, 0xa5e353f7
cmp edi, ecx
mov ecx, 0x20c49b
sbb ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
cmovb ecx, ebx
mov dword [ebp - 0x24], ecx
mov ebx, eax
cmovb ebx, edx
mov dword [ebp - 0x28], ebx
call fcn.10160ec0
mov dword [ebp - 0x2c], esp
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
sub esp, 0x10
mov edi, esp
mov dword [edi + 0xc], ebx
mov eax, dword [ebp - 0x24]
mov dword [edi + 8], eax
push 0x18
call fcn.1020d865
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x10037bc0
push 0x10072000
call fcn.10145d00
mov dword [ebx + 0x10], 0x10071fc0
mov dword [edi + 4], ebx
lea ebx, [ebp - 0x20]
push 0x1af
push str..._.._edge_embedded_browser_client_win_app_mojo_environment.cc
push str.Uninitialize
push ebx
call fcn.1014e3e0
add esp, 0x10
mov dword [edi], ebx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
call dword [eax]
mov esp, dword [ebp - 0x2c]
mov eax, 0xb49d1fff
cmp eax, dword [ebp - 0x24]
mov eax, 6
sbb eax, dword [ebp - 0x28]
jl 0x1007202c
mov eax, dword [esi + 0x40]
shld dword [esi + 0x44], eax, 1
add eax, eax
mov dword [esi + 0x40], eax
jmp 0x1007202c
mov al, byte [esi + 0x4a]
or al, byte [0x102b4398]
jne 0x1007202c
mov byte [esi + 0x4a], 1
mov dword [0x102b0d34], 0x8000ffff
xor eax, eax
push eax
push eax
push esi
push 0x10071870
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateThread]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1007202c
Function at 0x100732dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x1025cbc6
call fcn.10073992
mov ecx, esi
push str.EBWebViewx86EmbeddedBrowserWebView.dll
call fcn.10073992
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop esi
pop ebp
ret

Function at 0x10073694
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea edi, [ebp - 0x218]
push 0x208
push ebx
push edi
call fcn.10208980
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push edi
push ebx
push 2
push esi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x10073707
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.1007389a
mov eax, dword [edi + 8]
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100768fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov dword [esp + 0x14], edx
mov edi, ecx
mov eax, dword [ecx]
mov ebx, 0x100
cmp eax, ebx
cmova ebx, eax
lea eax, [ebx - 1]
movd xmm0, eax
por xmm0, xmmword [0x1025a6d0]
subsd xmm0, qword [0x10253170]
cvtsd2ss xmm0, xmm0
movss xmm1, dword [0x10245b28]
divss xmm1, xmm0
movss dword [esp + 0x10], xmm1
xor esi, esi
xorps xmm0, xmm0
movss dword [esp + 0x18], xmm0
movd xmm0, esi
por xmm0, xmmword [0x1025a6d0]
subsd xmm0, qword [0x10253170]
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [esp + 0x10]
movaps xmmword [esp + 0x20], xmm0
mov ecx, edi
call fcn.100769d3
movss dword [esp + 4], xmm0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.10076676
fstp dword [esp + 0x1c]
movaps xmm2, xmmword [esp + 0x20]
subss xmm2, dword [esp + 0x1c]
movaps xmm0, xmm2
xorps xmm0, xmmword [0x1025cd20]
movaps xmm1, xmm2
cmpltss xmm1, dword [0x10244ed8]
andps xmm0, xmm1
andnps xmm1, xmm2
orps xmm1, xmm0
movss xmm0, dword [esp + 0x18]
maxss xmm0, xmm1
inc esi
cmp ebx, esi
jne 0x1007694c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret