joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043f2c
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
and dword [rcx], 0
mov dword [rcx + 4], 1
lea rdi, [rcx + 8]
and qword [rdi], 0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbx], eax
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140043fb6
cmp eax, 0x80010106
je 0x140043fb6
mov r9d, 0xf1
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstallerWinFWUtil_Win7.cpp
mov edx, 2
lea rcx, [rsp + 0x40]
call fcn.14000e798
nop
lea rdx, str._CZoomFirewallUtil::CZoomFirewallUtil__CoCreateInstance_failed:
lea rcx, [0x1400ba0c0]
call fcn.140007bcc
mov rcx, rax
mov edx, dword [rbx]
call fcn.140021e48
nop
lea rcx, [rsp + 0x40]
call fcn.14000e9c4
and dword [rbx + 4], 0
cmp dword [rbx + 4], 0
je 0x14004402a
mov qword [rsp + 0x20], rdi
lea r9, [0x1400a3700]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400a3740]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
jns 0x14004402a
mov r9d, 0x102
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstallerWinFWUtil_Win7.cpp
mov edx, 2
lea rcx, [rsp + 0x40]
call fcn.14000e798
nop
lea rdx, str._CZoomFirewallUtil::CZoomFirewallUtil__CoCreateInstance_failed:
lea rcx, [0x1400ba0c0]
call fcn.140007bcc
mov rcx, rax
mov edx, edi
call fcn.140021e48
nop
lea rcx, [rsp + 0x40]
call fcn.14000e9c4
and dword [rbx + 4], 0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140049438
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rdx
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call fcn.14007c680
or rdi, 0xffffffffffffffff
test rbp, rbp
je 0x14004958e
mov rcx, rbp
call fcn.1400583bc
test rax, rax
je 0x14004958e
lea r8, [0x14009fe60]
mov rcx, rbp
call fcn.140049228
mov rsi, rax
test rax, rax
jne 0x1400494ba
lea ecx, [rdi + 0xf]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14004957e
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140049576
test byte [rsp + 0x20], 0x10
je 0x140049506
lea rdx, [0x14009fe64]
lea rcx, [rsp + 0x4c]
call fcn.1400580fc
test eax, eax
je 0x140049560
lea rdx, [0x14009e73c]
lea rcx, [rsp + 0x4c]
call fcn.1400580fc
test eax, eax
je 0x140049560
lea r8, [rsp + 0x4c]
mov rcx, rbp
call fcn.140049228
mov rbx, rax
test rax, rax
je 0x140049560
test byte [rsp + 0x20], 0x10
mov rcx, rax
je 0x140049547
call fcn.140034c0c
test eax, eax
jne 0x14004953c
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call fcn.140049438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140049558
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rax, r14
call qword [case.0x14002e391.0]
mov rcx, rbx
call fcn.1400044d8
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400494d5
mov rcx, rsi
call fcn.1400044d8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x14004959b
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140077b20
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400495c4
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x1400495e5
lea ecx, [rdi + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140049621
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400495f6
mov eax, 1
jmp 0x140049621
mov rcx, rdi
call fcn.140034c0c
test eax, eax
jne 0x140049611
lea rdx, [0x140034c50]
mov rcx, rdi
call fcn.140049438
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400496f4
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x202
call fcn.14007c680
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x100
call fcn.14004962c
test eax, eax
je 0x14004978c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14004978c
mov rax, qword [0x1400bb9a0]
lea r9, [rsp + 0x38]
mov r8d, 1
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [case.0x14002e391.0]
test eax, eax
jne 0x14004978c
mov rcx, qword [rsp + 0x38]
mov rax, qword [0x1400bb990]
cmp dword [rcx + 0x14], 2
sete bl
call qword [case.0x14002e391.0]
mov al, bl
jmp 0x14004978e
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140077b20
add rsp, 0x260
pop rbx
ret

Function at 0x140049ca4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14002c29c
nop
lea rdx, [0x14009a660]
lea rcx, [rsp + 0x20]
call fcn.14002c734
mov rcx, rbx
call fcn.14002c554
lea rcx, [rsp + 0x20]
test al, al
je 0x140049d00
lea rdx, str.Zoom.lnk
call fcn.14002c734
jmp 0x140049d08
mov rdx, rbx
call fcn.14002c70c
lea rcx, [rsp + 0x20]
call fcn.14002c3d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x20]
call fcn.14002c340
mov al, bl
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140077b20
add rsp, 0x140
pop rbx
ret

Function at 0x14004a09c
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push rbx
sub rsp, 0x440
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
test rcx, rcx
je 0x14004a165
call fcn.1400583bc
test rax, rax
je 0x14004a165
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004a165
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x410
call fcn.14007c680
lea rdx, [rsp + 0x20]
mov ecx, 0x207
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x14009b62c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14004a14f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004a165
lea rbx, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x14004a167
mov al, 1
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140077b20
add rsp, 0x440
pop rbx
ret
Function at 0x14004a180
Capabilities:
Copy file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14004a301
test rdx, rdx
je 0x14004a301
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14004a1dc
mov al, 1
jmp 0x14004a303
mov r14d, 0x412
lea rcx, [rsp + 0x60]
mov r8d, r14d
xor edx, edx
call fcn.14007c680
mov r8d, r14d
lea rcx, [rbp + 0x380]
xor edx, edx
call fcn.14007c680
mov r8, rdi
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.140058758
mov rcx, rdi
call fcn.1400583bc
cdqe
lea rcx, [rax + rax]
cmp rcx, r14
jae 0x14004a32a
lea rax, [rax*2 + 2]
mov word [rsp + rcx + 0x60], si
cmp rax, r14
jae 0x14004a32a
mov r8, rbx
mov word [rsp + rax + 0x60], si
mov edx, 0x208
lea rcx, [rbp + 0x380]
call fcn.140058758
mov rcx, rbx
call fcn.1400583bc
cdqe
lea rcx, [rax + rax]
cmp rcx, r14
jae 0x14004a32a
lea rax, [rax*2 + 2]
mov word [rbp + rcx + 0x380], si
cmp rax, r14
jae 0x14004a32a
mov word [rbp + rax + 0x380], si
lea rcx, [rsp + 0x20]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x38], rax
lea eax, [r14 + 2]
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], 2
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [rsp + 0x44], esi
jne 0x14004a301
test eax, eax
jne 0x14004a301
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14004a301
mov rcx, rdi
call fcn.1400495c4
jmp 0x14004a1d5
xor al, al
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.140077b20
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140077c54
int3
Function at 0x14004a330
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
xor edi, edi
test rcx, rcx
je 0x14004a44c
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004a44c
lea r9, [rbp + 0x28]
mov word [rbp + 0x20], di
lea r8d, [rdi + 2]
mov dword [rbp + 0x28], edi
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x20], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004a443
cmp dword [rbp + 0x28], 2
jne 0x14004a443
mov eax, 0x5a4d
cmp word [rbp + 0x20], ax
jne 0x14004a443
xor r9d, r9d
lea edx, [rdi + 0x3c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 2]
mov rcx, rbx
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004a443
cmp dword [rbp + 0x28], 2
jne 0x14004a443
movzx edx, word [rbp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rbp + 0x28]
mov dword [rbp + 0x30], edi
lea r8d, [rdi + 4]
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004a443
cmp dword [rbp + 0x28], 4
jne 0x14004a443
cmp dword [rbp + 0x30], 0x4550
jne 0x14004a443
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rdi + 1]
jmp 0x14004a44e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x140050200
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rbx, rcx
cmp dword [rcx + 0x448], 0
jne 0x140050296
or ebx, 0xffffffff
mov r8d, ebx
lea rdx, [0x14009b62c]
lea rcx, [rbp + 0x40]
call fcn.14002c244
nop
mov r8d, ebx
lea rdx, str.Operation_type_cannot_be_NONE
lea rcx, [rsp + 0x30]
call fcn.14002c244
nop
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x30]
lea edx, [rbx + 0xd]
mov ecx, 0x2712
call fcn.140048750
nop
lea rcx, [rsp + 0x30]
call fcn.14002c340
nop
lea rcx, [rbp + 0x40]
jmp 0x1400503f3
add rcx, 0x118
call fcn.14002c554
test al, al
jne 0x140050399
lea rcx, [rbx + 8]
call fcn.14002c554
test al, al
jne 0x140050399
lea rdx, [rbx + 0x228]
lea rcx, [rbp + 0x150]
call fcn.14002c29c
nop
lea rdx, [rbx + 8]
lea rcx, [rbp + 0x150]
call fcn.14002c70c
mov ecx, dword [rbx + 0x448]
sub ecx, 1
jne 0x140050390
lea rcx, [rbp + 0x150]
call fcn.14002c3d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140050390
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140050390
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x14002e391.0]
test al, al
jne 0x140050390
or ebx, 0xffffffff
mov r8d, ebx
lea rdx, [0x14009b62c]
lea rcx, [rsp + 0x30]
call fcn.14002c244
nop
mov r8d, ebx
lea rdx, str.DeleteFile_Failed
lea rcx, [rbp + 0x40]
call fcn.14002c244
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x40]
lea edx, [rbx + 0xd]
mov ecx, 0x2717
call fcn.140048750
nop
lea rcx, [rbp + 0x40]
call fcn.14002c340
nop
lea rcx, [rsp + 0x30]
call fcn.14002c340
nop
lea rcx, [rbp + 0x150]
jmp 0x1400503f3
or ebx, 0xffffffff
mov r8d, ebx
lea rdx, [0x14009b62c]
lea rcx, [rsp + 0x30]
call fcn.14002c244
nop
mov r8d, ebx
lea rdx, str.File_ops_src_and_name_cannot_be_empty
lea rcx, [rbp + 0x40]
call fcn.14002c244
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x40]
lea edx, [rbx + 0xd]
mov ecx, 0x2712
call fcn.140048750
nop
lea rcx, [rbp + 0x40]
call fcn.14002c340
nop
lea rcx, [rsp + 0x30]
call fcn.14002c340
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140077b20
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005108c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r14, r8
mov rbx, rcx
xor dil, dil
mov rdx, qword [rcx]
add rdx, 0x118
lea rcx, [rbp + 0x150]
call fcn.14002c29c
nop
mov rdx, qword [rbx]
add rdx, 8
lea rcx, [rbp + 0x150]
call fcn.14002c70c
lea rcx, [rbp + 0x150]
call fcn.14002c3d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or r8d, 0xffffffff
lea rcx, [rsp + 0x30]
cmp eax, 0xffffffff
jne 0x14005116d
lea rdx, [0x14009b62c]
call fcn.14002c244
nop
or r8d, 0xffffffff
lea rdx, str.Failed_to_pass_security_check__File_not_exist
lea rcx, [rbp + 0x40]
call fcn.14002c244
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x40]
mov edx, 6
mov ecx, 0x2713
call fcn.140048750
nop
lea rcx, [rbp + 0x40]
call fcn.14002c340
nop
lea rcx, [rsp + 0x30]
call fcn.14002c340
jmp 0x140051200
mov rdx, r14
call fcn.14002c244
nop
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x150]
call fcn.140051234
mov bl, al
lea rcx, [rsp + 0x30]
call fcn.14002c340
test bl, bl
jne 0x1400511fd
or r8d, 0xffffffff
lea rdx, [0x14009b62c]
lea rcx, [rbp + 0x40]
call fcn.14002c244
nop
or r8d, 0xffffffff
lea rdx, str.Failed_to_pass_security_check
lea rcx, [rsp + 0x30]
call fcn.14002c244
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 6
mov ecx, 0x2713
call fcn.140048750
nop
lea rcx, [rsp + 0x30]
call fcn.14002c340
nop
lea rcx, [rbp + 0x40]
jmp 0x140051163
mov dil, 1
lea rcx, [rbp + 0x150]
call fcn.14002c340
mov al, dil
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140077b20
mov rbx, qword [rsp + 0x398]
add rsp, 0x370
pop r14
pop rdi
pop rbp
ret
Function at 0x1400539b8
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1360]
mov eax, 0x1460
call fcn.140078a70
sub rsp, rax
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rbp + 0x1350], rax
mov rdi, rcx
call fcn.14002c560
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x140053a6b
mov r9d, 0x1bb
lea r8, str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsNoMSIInstallerZoomProductUtil.cpp
lea edx, [rax + 1]
lea rcx, [rsp + 0x28]
call fcn.14000e798
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str._FindRunningInstance__failed_to_enum_processes__error_code:
lea rcx, [0x1400ba0c0]
call fcn.140007bcc
mov rcx, rax
mov edx, ebx
call fcn.140005920
nop
lea rcx, [rsp + 0x28]
call fcn.14000e9c4
xor eax, eax
jmp 0x140053bc8
mov esi, dword [rsp + 0x20]
shr esi, 2
xor r15d, r15d
test esi, esi
je 0x140053bba
lea r12, [rsp + 0x30]
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140053b6e
movups xmm0, xmmword [str._unknown_]
movaps xmmword [rbp + 0xf30], xmm0
mov ebx, dword [0x1400a72d8]
mov dword [rbp + 0xf40], ebx
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rbp + 0xf44]
call fcn.14007c680
movups xmm0, xmmword [str._unknown_]
movaps xmmword [rbp + 0x1140], xmm0
mov dword [rbp + 0x1150], ebx
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rbp + 0x1154]
call fcn.14007c680
lea r9, [rsp + 0x20]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x140053b48
mov r9d, 0x104
lea r8, [rbp + 0xf30]
mov rdx, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
mov r9d, 0x104
lea r8, [rbp + 0x1140]
mov rdx, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 8
lea rdx, [rbp + 0xf30]
lea rcx, str.Zoom.exe
call fcn.140062a1c
test eax, eax
je 0x140053b7f
inc r15d
add r12, 4
cmp r15d, esi
jae 0x140053bba
jmp 0x140053a82
lea rdx, [rbp + 0x1140]
mov rcx, rdi
call fcn.14002c5cc
mov edx, 0x5c
mov rcx, rdi
call fcn.14002ca28
cmp eax, 0xffffffff
jne 0x140053bb0
lea edx, [rax + 0x30]
mov rcx, rdi
call fcn.14002ca28
cmp eax, 0xffffffff
je 0x140053bba
mov edx, eax
mov rcx, rdi
call fcn.14002c7d0
mov rcx, rdi
call fcn.14002c554
movzx eax, al
xor eax, 1
mov rcx, qword [rbp + 0x1350]
xor rcx, rsp
call fcn.140077b20
lea r11, [rsp + 0x1460]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140053e3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b7a38]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
xor ebx, ebx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], rbx
lea rcx, [r11 - 0x38]
call fcn.14000c6ec
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140053e7f
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140008aac
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140053ee8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053f02
call fcn.14002ae70
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140077b20
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.140058c18
int3

Function at 0x1400546e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rcx + 8]
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x1400546a0]
and dword [rsp + 0x20], 0
mov r9, rdx
xor edx, edx
xor ecx, ecx
call fcn.140062b7c
mov qword [rbx], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140054a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x50
test dword [rcx], 0x100
mov r14, rcx
je 0x140054ca9
mov rax, qword [rcx + 0x10]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], rdi
mov byte [rax], 0
xor dword [rcx], 0x100
je 0x140054bf3
mov rbx, qword [rcx + 8]
mov qword [r11 + 0x20], rsi
mov rsi, rbx
cmp rbx, qword [rcx + 0x10]
jae 0x140054beb
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x18], r12
xor r12d, r12d
mov qword [r11 - 0x20], r13
lea r13, str.quot
mov qword [r11 - 0x28], r15
lea r15, [0x14009a390]
nop dword [rax]
mov ecx, dword [r14]
test cl, 2
je 0x140054b23
movzx eax, byte [rbx]
cmp al, 0xd
jne 0x140054b07
cmp byte [rbx + 1], 0xa
mov rax, r12
mov byte [rsi], 0xa
sete al
inc rax
add rbx, rax
jmp 0x140054bc5
cmp al, 0xa
jne 0x140054b23
cmp byte [rbx + 1], 0xd
mov rax, r12
mov byte [rsi], 0xa
sete al
inc rax
add rbx, rax
jmp 0x140054bc5
test cl, 1
je 0x140054bbd
cmp byte [rbx], 0x26
jne 0x140054bbd
cmp byte [rbx + 1], 0x23
jne 0x140054b7d
xor eax, eax
mov dword [rsp + 0x60], r12d
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov word [rsp + 0x28], ax
mov rcx, rbx
call fcn.140054cc0
test rax, rax
je 0x140054bbd
movsxd rdi, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov r8, rdi
mov rcx, rsi
mov rbx, rax
call fcn.14007ca60
jmp 0x140054bca
mov rdi, r13
movsxd r8, dword [rdi + 8]
lea rcx, [rbx + 1]
mov rdx, qword [rdi]
call fcn.140060ed0
test eax, eax
jne 0x140054b9f
movsxd rax, dword [rdi + 8]
cmp byte [rax + rbx + 1], 0x3b
je 0x140054baa
add rdi, 0x10
cmp rdi, r15
jl 0x140054b80
jmp 0x140054bc2
movzx eax, byte [rdi + 0xc]
mov byte [rsi], al
mov eax, dword [rdi + 8]
add eax, 2
cdqe
add rbx, rax
jmp 0x140054bc5
movzx eax, byte [rbx]
mov byte [rsi], al
inc rbx
mov edi, 1
add rsi, rdi
cmp rbx, qword [r14 + 0x10]
jb 0x140054ae0
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov byte [rsi], 0
mov rsi, qword [rsp + 0x78]
test byte [r14], 4
je 0x140054c8d
mov rbx, qword [r14 + 8]
movzx ecx, byte [rbx]
movsx eax, cl
shr eax, 7
test al, 1
jne 0x140054c1c
call fcn.14005e030
test eax, eax
je 0x140054c1c
inc rbx
jmp 0x140054c01
mov qword [r14 + 8], rbx
movzx ecx, byte [rbx]
test cl, cl
je 0x140054c8d
mov rdi, rbx
nop word [rax + rax]
movsx eax, cl
shr eax, 7
test al, 1
jne 0x140054c78
movzx ecx, cl
call fcn.14005e030
test eax, eax
je 0x140054c78
nop word [rax + rax]
movzx ecx, byte [rbx]
movsx eax, cl
shr eax, 7
test al, 1
jne 0x140054c6e
call fcn.14005e030
test eax, eax
je 0x140054c6b
inc rbx
jmp 0x140054c50
movzx ecx, byte [rbx]
test cl, cl
je 0x140054c8a
mov byte [rdi], 0x20
inc rdi
movzx eax, byte [rbx]
inc rbx
mov byte [rdi], al
inc rdi
movzx ecx, byte [rbx]
test cl, cl
jne 0x140054c30
mov byte [rdi], 0
and dword [r14], 0x200
mov rax, qword [r14 + 8]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop r14
ret
mov rax, qword [rcx + 8]
add rsp, 0x50
pop r14
ret
Function at 0x1400570d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140057105
lea r9, str.filename_null_
xor r8d, r8d
lea edx, [rsi + 4]
call fcn.140057260
mov eax, dword [rbx + 0x6c]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 0x40], rdi
call fcn.140056fc0
lea r8, [0x1400a796c]
mov qword [rsp + 0x48], 0
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140062e18
test eax, eax
jne 0x14005722e
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14005722e
mov rcx, rbx
call fcn.140056fc0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.14005f2b4
mov rcx, rdi
call fcn.14005e5b8
cmp eax, 0xffffffff
jne 0x140057174
mov rcx, rdi
call fcn.140062c5c
test eax, eax
jne 0x140057200
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.14005f2b4
mov rcx, rdi
call fcn.140063340
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rsi, rax
call fcn.14005f2b4
cmp rsi, 0xffffffffffffffff
jae 0x140057200
test rsi, rsi
jne 0x1400571aa
lea edx, [rsi + 0xd]
jmp 0x140057205
lea rcx, [rsi + 1]
call fcn.140077e58
mov r9, rdi
mov qword [rbx + 0x98], rax
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.14005efe4
cmp rax, rsi
jne 0x140057200
mov rax, qword [rbx + 0x98]
mov rcx, rbx
mov byte [rsi + rax], 0
call fcn.140057400
mov rcx, rdi
call fcn.14005e3a0
mov eax, dword [rbx + 0x6c]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov edx, 5
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.140057260
mov rcx, rdi
call fcn.14005e3a0
mov eax, dword [rbx + 0x6c]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea r9, str.filename_s
mov rcx, rbx
lea edx, [r8 + 3]
call fcn.140057260
mov eax, dword [rbx + 0x6c]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret