joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478c73
Capabilities:
Accept command line arguments

Disassembly:
push 0x9c
mov eax, 0x492588
call fcn.0044c821
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
xor ecx, ecx
push 7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
pop edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x88]
call fcn.00401cc1
mov byte [ebp - 4], 1
call fcn.0047a65d
push eax
lea ecx, [ebp - 0x70]
call fcn.00406222
push 0x37
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x4be17c
call fcn.00408da4
mov esi, eax
push 0x4a9790
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00401d1c
pop ecx
push esi
push eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
push dword [ebp - 0xa4]
call fcn.0040857d
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401c8a
lea ecx, [ebp - 0x58]
call fcn.004015bc
lea ecx, [ebp - 0x40]
call fcn.004015bc
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.004015bc
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push 0x4a2bd0
cmova eax, dword [ebp - 0x28]
push eax
call fcn.00458973
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x478dcc
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x58]
call fcn.0040addd
mov byte [ebp - 4], 5
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 0xf
push esi
push dword [ebp - 0x48]
cmova eax, dword [ebp - 0x58]
push 1
push eax
call fcn.00458c52
push esi
push 1
push 1
push 0x4a97f0
call fcn.00458c52
add esp, 0x20
lea ecx, [ebp - 0x40]
mov edx, 0x4e469c
call fcn.0040addd
cmp dword [ebp - 0x30], 0
je 0x478db5
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
push esi
push dword [ebp - 0x30]
cmova eax, dword [ebp - 0x40]
push 1
push eax
call fcn.00458c52
add esp, 0x10
push esi
call fcn.00458db1
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00402431
lea ecx, [ebp - 0x58]
call fcn.00402431
lea ecx, [ebp - 0x70]
call fcn.004015bc
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0
call fcn.004015bc
call fcn.0047a469
cmp dword [0x4e46f8], edi
mov esi, 0x4e46e4
push ecx
mov eax, esi
mov ecx, esp
cmova eax, dword [0x4e46e4]
push eax
call fcn.00407579
mov ecx, dword [0x4e4998]
call fcn.0047cbcc
pop ecx
test eax, eax
je 0x478e1b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4e46f8], edi
cmova esi, dword [0x4e46e4]
push esi
call fcn.0045e698
cmp dword [ebp - 0x18], 0
pop ecx
je 0x478e61
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
cmova ecx, dword [ebp - 0x28]
call fcn.00409341
test al, al
je 0x478e61
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call fcn.0045e698
pop ecx
mov eax, dword [ebp - 0x14]
cmp eax, edi
jbe 0x478eaf
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ecx
cmp eax, 0x1000
jb 0x478ea6
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0040156c
mov eax, dword [ebp - 0xa8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xa4]
push eax
push ecx
call fcn.0044b96c
pop ecx
pop ecx
call fcn.0044c7d0
ret
Function at 0x4795ee
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push 0x464
mov eax, 0x492731
call fcn.0044c821
mov esi, ecx
mov ecx, dword [esi]
call fcn.0047cabf
mov edx, dword [esi]
lea ecx, [ebp - 0x448]
mov ebx, eax
call fcn.0047cadd
lea eax, [ebp - 0x470]
xor esi, esi
push eax
mov dword [ebp - 4], esi
push ebx
mov dword [ebp - 0x470], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x464], esi
push 0x1c
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x4be17c
call fcn.00408da4
mov ecx, eax
push 7
pop edx
cmp dword [ecx + 0x14], edx
jbe 0x479663
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x468]
je 0x479677
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
lea edi, [ebp - 0x42c]
mov dword [ebp - 0x430], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], edx
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x4796c4
push ecx
lea ecx, [ebp - 0x42c]
call fcn.0040245c
lea eax, [ebp - 0x430]
push eax
push 0x411fb2
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x468]
lea ecx, [ebp - 0x42c]
sub esi, dword [ebp - 0x46c]
sar esi, 2
call fcn.004015bc
lea ecx, [ebp - 0x460]
call fcn.004015bc
cmp esi, 1
jle 0x479790
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.0044dac0
mov esi, dword [ebp - 0x46c]
add esp, 0xc
jmp 0x479782
push 0x200
lea eax, [ebp - 0x410]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x434], 7
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x410]
cmova eax, dword [ebp - 0x448]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x479776
test dx, dx
je 0x479772
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x479776
add ecx, 4
add eax, 4
test dx, dx
jne 0x479750
xor eax, eax
jmp 0x47977b
sbb eax, eax
or eax, 1
test eax, eax
je 0x47978c
add esi, 4
cmp esi, dword [ebp - 0x468]
jne 0x479722
jmp 0x4797a7
mov ebx, dword [esi]
jmp 0x4797a7
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x46c]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x4797a7
mov ebx, dword [ecx]
lea ecx, [ebp - 0x46c]
call fcn.00402fc8
lea ecx, [ebp - 0x448]
call fcn.004015bc
mov eax, ebx
call fcn.0044c7d0
ret
Function at 0x479dda
Capabilities:
Create thread

Disassembly:
push 0x5c
mov eax, 0x49287a
call fcn.0044c88d
cmp byte [0x4e4a55], 0
jne 0x479e57
xor esi, esi
lea eax, [ebp - 0x48]
push eax
push esi
push 0x4e4650
push 0x4035a0
push esi
push esi
mov dword [0x4e49c0], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], esi
call fcn.00480e10
or dword [ebp - 4], 0xffffffff
mov dword [0x4e49c0], eax
jmp 0x479e30
cmp dword [ebp - 0x48], 0
je 0x479e4e
push esi
push esi
push 0x502
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4e49c0], 0
je 0x479e5d
call fcn.0044c7df
ret
lea ecx, [ebp - 0x2c]
call fcn.004022d2
mov dword [ebp - 4], 2
call fcn.00407cbf
test al, al
lea eax, [ebp - 0x44]
je 0x479e9d
push 0x2b
push 0x13
push eax
call fcn.0047935e
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402043
lea ecx, [ebp - 0x44]
call fcn.00402457
lea ecx, [ebp - 0x2c]
call fcn.0047f92b
jmp 0x479eb8
push 0x29
push 0x11
push eax
call fcn.0047935e
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402043
lea ecx, [ebp - 0x44]
call fcn.00402457
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040616a
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x68]
call fcn.004057d1
push 0x4b6844
lea eax, [ebp - 0x68]
push eax
call fcn.0044d4c7
int3

Function at 0x479ee3
Capabilities:
Create thread

Disassembly:
push esi
call fcn.00458fbf
cmp byte [0x4e4a55], 0
mov esi, eax
jne 0x479f40
cmp dword [0x4e49bc], 0
jne 0x479f40
cmp word [0x4e4ad6], 3
push edi
mov edi, 0x4e4ad0
jne 0x479f24
mov ecx, edi
call fcn.00402405
test al, 1
je 0x479f24
mov eax, dword [0x4e4760]
shr eax, 9
test al, 1
je 0x479f3f
push 0x4e49c4
xor eax, eax
push eax
push edi
push 0x4064b1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e49c8], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x47a14a
Capabilities:
Check mutex on windows

Disassembly:
push 0x64
mov eax, 0x49291a
call fcn.0044c821
mov eax, dword [0x4e4760]
shr eax, 0xe
test al, 1
je 0x47a1ed
push 0x4e4668
lea ecx, [ebp - 0x28]
call fcn.00406222
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0x4a97c8
call fcn.00401cc1
push 0x4a9790
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401cc1
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.0040b055
pop ecx
lea ecx, [ebp - 0x58]
call fcn.004015bc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004015bc
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4e49cc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47a1f3
lea ecx, [ebp - 0x28]
call fcn.004015bc
call fcn.0044c7d0
ret
push 0x2e
push 0x29
lea eax, [ebp - 0x70]
push eax
call fcn.0047935e
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0047f92b
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040616a
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x50]
call fcn.004057d1
push 0x4b6844
lea eax, [ebp - 0x50]
push eax
call fcn.0044d4c7
int3

Function at 0x47a65d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4ba080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e4690], 0
push esi
mov esi, 0x4e4680
jne 0x47a778
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.0040245c
cmp dword [0x4e4694], 7
mov eax, esi
cmova eax, dword [0x4e4680]
xor ebx, ebx
push ebx
push eax
call fcn.0045e20f
pop ecx
pop ecx
test eax, eax
je 0x47a6d6
push 0x4a2c5c
mov ecx, esi
call fcn.0040245c
mov ecx, esi
call fcn.0040971b
cmp dword [0x4e4690], ebx
je 0x47a6fb
cmp dword [0x4e4694], 7
mov eax, esi
push ebx
cmova eax, dword [0x4e4680]
push eax
call fcn.0045e20f
pop ecx
pop ecx
test eax, eax
je 0x47a70e
push str.TEMP
call fcn.0045ec63
pop ecx
push eax
mov ecx, esi
call fcn.0040245c
cmp dword [0x4e4690], ebx
je 0x47a733
cmp dword [0x4e4694], 7
mov eax, esi
push ebx
cmova eax, dword [0x4e4680]
push eax
call fcn.0045e20f
pop ecx
pop ecx
test eax, eax
je 0x47a746
push 0x4a97c0
call fcn.0045ec63
pop ecx
push eax
mov ecx, esi
call fcn.0040245c
cmp dword [0x4e4690], ebx
je 0x47a76b
cmp dword [0x4e4694], 7
mov eax, esi
push ebx
cmova eax, dword [0x4e4680]
push eax
call fcn.0045e20f
pop ecx
pop ecx
test eax, eax
je 0x47a777
push 0x4e4650
mov ecx, esi
call fcn.00406258
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044b95e
leave
ret
Function at 0x47eb52
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4ba080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [esi + 0xc], 0x201
jne 0x47ec43
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0044dac0
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb8]
pop edi
cmp eax, dword [ebx + 0xbc]
je 0x47ec46
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x47ec46
and dword [eax], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b95e
leave
ret 0xc

Function at 0x47fc40
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [0x4e4bec], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xfffffffffffffffa
push dword [0x4e4bec]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push eax
push 0x47f960
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
test eax, eax
mov dword [0x4e4bf0], eax
pop esi
setne al
pop ebp
ret 4
Function at 0x48a3e0
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 7
jbe 0x48a3fd
mov eax, dword [esi]
test eax, eax
je 0x48a521
cmp word [eax], 0
je 0x48a521
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48a521
test al, 0x10
jne 0x48a521
cmp dword [esi + 0x14], 7
jbe 0x48a42f
mov esi, dword [esi]
push 0x4a97e8
push esi
call fcn.00458973
mov esi, eax
add esp, 8
test esi, esi
je 0x48a521
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.00461b3b
push 2
push 0
push esi
call fcn.004611bb
lea eax, [esp + 0x24]
push eax
push esi
call fcn.00461b3b
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00461fbc
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x48a518
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.0045f37b
add esp, 0x10
test eax, eax
je 0x48a518
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x48a518
cmp dword [esp + 0x20], 0x48535844
jne 0x48a518
cmp dword [esp + 0x24], 0x28
jne 0x48a518
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.00458db1
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011a1
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401201
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], ebx
cmovne ebx, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040d990
leave
ret

Function at 0x401210
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ecx
call fcn.0040117f
pop ecx
test eax, eax
jne 0x401227
push 0xb
pop eax
jmp 0x401248
call fcn.004010d0
test eax, eax
jne 0x401235
call fcn.004011a1
push 1
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ecx
pop ebp
ret

Function at 0x401313
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x4013a9
xor ebx, ebx
push ebx
push 0x1a
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4013a9
push edi
push 0x411a94
mov edi, 0x104
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x411aa0
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.zoomtest
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop edi
test eax, eax
je 0x4013a9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x4013ab
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d990
leave
ret
Function at 0x4013b9
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0x1a
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40145b
push str.ZoomdataZoom.us.ini
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64i32]
pop ecx
pop ecx
test eax, eax
jne 0x40145b
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push eax
push 8
lea eax, [ebp - 0x14]
push eax
push 0
push str.com.zoom.test.disable_crash_handler
push 0x411b08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40145b
lea eax, [ebp - 0x14]
push 0x411b1c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
neg eax
pop ecx
sbb al, al
pop ecx
inc al
jmp 0x40145d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040d990
leave
ret

Function at 0x401cda
Capabilities:
Enumerate processes

Disassembly:
push 0x294
mov eax, 0x40ed65
call fcn.0040ec98
mov edi, ecx
mov esi, dword [edi]
push dword [esi + 4]
push edi
call fcn.00404742
xor ebx, ebx
mov dword [esi + 4], esi
push ebx
mov dword [esi], esi
mov dword [esi + 8], esi
push 2
mov dword [edi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401d1a
xor eax, eax
jmp 0x401e0e
push 0x228
lea eax, [ebp - 0x284]
mov dword [ebp - 0x288], 0x22c
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x18], ebx
add esp, 0xc
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x288]
mov dword [ebp - 4], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x401df4
mov ebx, dword [ebp - 0x270]
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x28c], ebx
push eax
mov ecx, edi
call fcn.00404e63
mov eax, dword [ebp - 0x290]
cmp byte [eax + 0xd], 0
jne 0x401d95
cmp ebx, dword [eax + 0x10]
jb 0x401d95
cmp eax, dword [edi]
jne 0x401d97
xor ebx, ebx
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x30]
push eax
mov edx, ebx
call fcn.00401ba2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x28]
push eax
call fcn.004040d7
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2a0]
mov ecx, edi
push eax
call fcn.00405219
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00404079
lea eax, [ebp - 0x288]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401d5f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.00404079
xor eax, eax
inc eax
call fcn.0040ec53
ret
Function at 0x40248c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfb4
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4025f5
test edx, edx
je 0x4025f5
test esi, esi
je 0x4025f5
and dword [ebp - 0xfa8], 0
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xfa8]
jne 0x4024cf
sub ecx, ebx
sar ecx, 1
je 0x4025f5
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xfa8]
jne 0x4024ed
sub ecx, ebx
sar ecx, 1
je 0x4025f5
lea eax, [ebp - 0xfa8]
xor ebx, ebx
push eax
push 0x20019
push ebx
push edx
push edi
mov dword [ebp - 0xfa8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4025f5
cmp dword [ebp - 0xfa8], ebx
je 0x4025f5
push 0xfa0
xor edi, edi
lea eax, [ebp - 0xfa4]
push ebx
inc edi
push eax
mov dword [ebp - 0xfb0], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xfac], 0xf9e
lea eax, [ebp - 0xfac]
push eax
lea eax, [ebp - 0xfa4]
push eax
lea eax, [ebp - 0xfb0]
push eax
push ebx
push esi
push dword [ebp - 0xfa8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xfa8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4025f5
cmp dword [ebp - 0xfb0], edi
jne 0x4025f5
lea ecx, [ebp - 0xfa4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4025a5
sub ecx, edx
sar ecx, 1
je 0x4025f5
push 0x25
pop ecx
cmp cx, word [ebp - 0xfa4]
jne 0x4025c6
mov eax, edi
jmp 0x4025f7
lea eax, [ebp - 0xfa4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
lea eax, [ebp - 0xfa4]
je 0x4025f2
push 0x800
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
neg eax
sbb eax, eax
neg eax
jmp 0x4025f7
push ebx
jmp 0x4025e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d990
leave
ret 0xc
Function at 0x402608
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x40275c
test edi, edi
je 0x40275c
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40263b
sub ecx, edx
sar ecx, 1
je 0x40275c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x402655
sub ecx, edx
sar ecx, 1
je 0x40275c
push 0x190
lea eax, [ebp - 0x194]
mov dword [ebp - 0x198], ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x198]
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402743
cmp dword [ebp - 0x198], ebx
je 0x402757
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x19c], 0xc7
push eax
lea eax, [ebp - 0x194]
mov esi, ebx
push eax
push ebx
jmp 0x402733
lea ecx, [ebp - 0x194]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4026dc
sub ecx, edx
sar ecx, 1
je 0x402743
push edi
lea eax, [ebp - 0x194]
push eax
push dword [ebp - 0x198]
call fcn.0040248c
push 0x190
lea eax, [ebp - 0x194]
mov dword [ebp - 0x19c], 0xc7
push ebx
push eax
inc esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x19c]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x194]
push eax
push esi
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4026d3
cmp dword [ebp - 0x198], ebx
je 0x402757
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x40275e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d990
leave
ret 8