joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ad0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002930
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002930
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140007094]
mov rbx, rcx
test esi, esi
jle 0x140001c70
mov rax, qword [0x140007098]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001b8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001c15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001b70
mov rcx, rbx
call fcn.1400025c0
mov rdi, rax
test rax, rax
je 0x140001c92
mov rax, qword [0x140007098]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002700
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140007098]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001c77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001c0e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001c20
add dword [0x140007094], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140007098]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001ad0
nop dword [rax]
xor esi, esi
jmp 0x140001b98
mov rax, qword [0x140007098]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001ad0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001ad0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002230
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140007100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x14000228c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140002283
test eax, eax
jne 0x140002283
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002268
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400025c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400044c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400025e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400025e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000263d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002634
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400025e0
add rax, 0x28
cmp rax, r9
jne 0x140002620
xor eax, eax
ret

Function at 0x140002640
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400044c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000265f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002668
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000265f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002700
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400044c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000271f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002728
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002248
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov edi, 1
cmp dword [rcx + 0x28], ebp
jne 0x1400023e6
lea rcx, str.LoadLibraryExA
call fcn.1400011c8
test rax, rax
je 0x14000229d
xor edx, edx
lea rcx, str.wininet.dll
mov r8d, 0x800
call qword [0x140026590]
mov rsi, rax
test rax, rax
jne 0x1400022d6
lea rcx, str.LoadLibraryA
call fcn.1400011c8
test rax, rax
jne 0x1400022c1
lea ecx, [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rbx + 0x28], edi
xor eax, eax
jmp 0x140002441
lea rcx, str.wininet.dll
call qword [0x140026590]
mov rsi, rax
test rax, rax
je 0x1400022b7
lea rdx, str.InternetTimeFromSystemTime
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpQueryInfoA
mov rcx, rsi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetConnectA
mov rcx, rsi
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCrackUrlA
mov rcx, rsi
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rsi
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpOpenRequestA
mov rcx, rsi
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetErrorDlg
mov rcx, rsi
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetSetCookieA
mov rcx, rsi
mov qword [rbx + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpAddRequestHeadersA
mov rcx, rsi
mov qword [rbx + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpSendRequestA
mov rcx, rsi
mov qword [rbx + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenA
mov rcx, rsi
mov qword [rbx + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rsi
mov qword [rbx + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetTimeToSystemTime
mov rcx, rsi
mov qword [rbx + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x90], rax
mov dword [rbx + 0x28], edi
cmp qword [rbx + 0x30], rbp
je 0x14000243d
cmp qword [rbx + 0x38], rbp
je 0x14000243d
cmp qword [rbx + 0x40], rbp
je 0x14000243d
cmp qword [rbx + 0x48], rbp
je 0x14000243d
cmp qword [rbx + 0x50], rbp
je 0x14000243d
cmp qword [rbx + 0x58], rbp
je 0x14000243d
cmp qword [rbx + 0x60], rbp
je 0x14000243d
cmp qword [rbx + 0x68], rbp
je 0x14000243d
cmp qword [rbx + 0x70], rbp
je 0x14000243d
cmp qword [rbx + 0x78], rbp
je 0x14000243d
cmp qword [rbx + 0x80], rbp
je 0x14000243d
cmp qword [rbx + 0x88], rbp
je 0x14000243d
cmp qword [rbx + 0x90], rbp
jne 0x14000243f
mov edi, ebp
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x10], 0
lea rax, [rbp + 0x10]
and qword [rbp - 0x10], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov ebx, r9d
mov qword [rsp + 0x20], rax
mov rdi, r8
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002bc9
mov rcx, qword [rbp + 0x10]
lea rax, [rbp - 0x10]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ZoomUMX
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002bab
and dword [rbp + 0x30], eax
lea r9, [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLocation
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002bab
mov eax, dword [rbp + 0x30]
dec eax
cmp eax, 1
ja 0x140002bab
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140002b98
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140002ba7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140002bcb
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140002bba
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140002bc9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140002bdc
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
test r8, r8
je 0x140002c6a
mov r9d, 1
mov rdx, rbx
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140002c6a
mov edi, 0x400
lea r8, [0x14002ee4c]
mov edx, edi
mov rcx, rbx
call fcn.140012b8c
lea r8, [0x14002ee50]
mov edx, edi
mov rcx, rbx
call fcn.140012b8c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, [0x14002ee4c]
mov edx, edi
mov rcx, rbx
call fcn.140012b8c
lea r8, str.ZoomDownload
mov edx, edi
mov rcx, rbx
call fcn.140012b8c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, 1
jmp 0x140002c6c
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004548
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x20]
xor eax, eax
mov rsi, rcx
movsxd rdx, dword [r9 + 0xc]
test edx, edx
jle 0x14000458b
mov rcx, qword [r9]
xor r8d, r8d
add rcx, 0x804
cmp dword [rcx], 0
je 0x14000458b
inc eax
inc r8
add rcx, 0x80c
cmp r8, rdx
jl 0x140004575
cmp eax, edx
je 0x1400045ef
cmp eax, 0xffffffff
je 0x1400045ef
test eax, eax
js 0x1400045ef
cmp eax, edx
jge 0x1400045ef
cdqe
imul rcx, rax, 0x80c
mov rax, qword [r9]
lea rdi, [rcx + rax]
mov dword [rcx + rax + 0x804], 1
mov ecx, 0x20
lea rbx, [rdi + 0x400]
call fcn.14000ada0
lea rcx, [0x14002f3d0]
mov r8, rax
xor edx, edx
mov qword [rax + 0x10], rcx
lea rcx, [0x140004490]
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x18], rsi
call fcn.140013f3c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140004b90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.CDownloadDialog::DownloadComplete__success
mov edi, edx
test edx, edx
jne 0x140004bb1
lea rcx, str.CDownloadDialog::DownloadComplete__fail
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140004c4c
movsxd r8, dword [rcx + 0xc]
xor edx, edx
test r8d, r8d
jle 0x140004bf0
mov rax, qword [rcx]
xor r9d, r9d
add rax, 0x804
cmp dword [rax], 1
je 0x140004bf0
inc edx
inc r9
add rax, 0x80c
cmp r9, r8
jl 0x140004bdb
cmp edx, r8d
je 0x140004c4c
cmp edx, 0xffffffff
je 0x140004c4c
test edi, edi
setne r8b
call fcn.140004fd8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x34], eax
mov rax, qword [rbx + 0x20]
movsxd rcx, dword [rax + 0xc]
test ecx, ecx
jle 0x140004c42
mov rax, qword [rax]
mov r8, rcx
xor edx, edx
lea rcx, [rax + 0x804]
mov eax, dword [rcx]
sub eax, 2
cmp eax, 1
ja 0x140004c57
inc rdx
add rcx, 0x80c
cmp rdx, r8
jl 0x140004c29
xor edx, edx
mov rcx, rbx
call fcn.140004600
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x140004c42
mov rcx, rbx
call fcn.140004548
jmp 0x140004c4c
Function at 0x140004fd8
Capabilities:
Read file on windows

Disassembly:
test edx, edx
js 0x14000525e
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1750]
mov eax, 0x1850
call fcn.140024cb0
sub rsp, rax
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rbp + 0x1740], rax
mov rdi, rcx
cmp edx, dword [rcx + 0xc]
jge 0x140005238
movsxd rax, edx
imul rsi, rax, 0x80c
mov rax, qword [rdi]
movzx ecx, r8b
xor ecx, 1
add ecx, 2
mov dword [rsi + rax + 0x804], ecx
mov rbx, qword [rdi]
cmp dword [rbx + rsi + 0x808], 1
jne 0x140005238
xor edx, edx
lea rcx, [rbp + 0xf30]
mov r8d, 0x801
call fcn.14000bdd0
lea rcx, [rsi + 0x400]
add rcx, rbx
lea rdx, [0x14002f5a8]
call fcn.14000f9bc
mov r14, rax
test rax, rax
je 0x14000522a
mov r9, rax
lea rcx, [rbp + 0xf30]
mov edx, 1
mov r8d, 0x800
call fcn.1400142a8
mov rcx, r14
mov rbx, rax
call fcn.14000faec
test ebx, ebx
jle 0x14000522a
lea rdx, str.Package_url
lea rcx, [rbp + 0xf30]
call fcn.14000bf60
mov rbx, rax
test rax, rax
je 0x14000522a
lea rdx, [0x14002f5c0]
mov rcx, rax
call fcn.14000bf60
test rax, rax
je 0x1400050e8
mov byte [rax], 0
mov r14d, 0x400
lea rcx, [rbp + 0x330]
mov r8d, r14d
xor edx, edx
call fcn.14000bdd0
mov r8d, r14d
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14000bdd0
lea r8, [rbp + 0x330]
call fcn.140002bdc
test al, al
je 0x14000522a
lea r8, [rbp + 0x330]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.140012b8c
lea r8, [0x14002ed54]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.140012b8c
lea r8, str.Zoom.msi
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.140012b8c
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov r9d, 0x517500
lea rdx, [rbx + 0xc]
mov rcx, rdi
call fcn.140004e34
mov r8d, r14d
lea rcx, [rbp + 0x730]
xor edx, edx
call fcn.14000bdd0
lea r8, [rbp + 0x330]
mov edx, r14d
lea rcx, [rbp + 0x730]
call fcn.1400139a8
lea r8, str._Installer.exe
mov edx, r14d
lea rcx, [rbp + 0x730]
call fcn.140012b8c
mov r8d, r14d
lea rcx, [rbp + 0xb30]
xor edx, edx
call fcn.14000bdd0
lea r8, [rbx + 0xc]
mov edx, r14d
lea rcx, [rbp + 0xb30]
call fcn.1400139a8
lea rdx, str.Zoom.msi_tatupg
lea rcx, [rbp + 0xb30]
call fcn.14000bf60
test rax, rax
je 0x140005238
lea r8, str.Installer.exe_tatupg
mov edx, 0x16
mov rcx, rax
call fcn.1400139a8
and dword [rsp + 0x20], 0
lea r8, [rbp + 0x730]
mov r9d, 0xc3800
lea rdx, [rbp + 0xb30]
mov rcx, rdi
call fcn.140004e34
jmp 0x140005238
mov rax, qword [rdi]
mov dword [rax + rsi + 0x804], 3
mov rcx, qword [rbp + 0x1740]
xor rcx, rsp
call fcn.14000ab20
lea r11, [rsp + 0x1850]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140005260
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r8
lea rcx, str.WinMain_start__lpCmdLine_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebp, ebp
lea rcx, str.NULL
test rsi, rsi
cmovne rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.WinMain_start__parameter_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.installer.exeInstaller.exepackage.nameZoom.msipackage.versionlatestpackage.size4980kdownloadRoothttps:__www.zoom.us_client
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x478
call fcn.14000ada0
mov rdi, rax
xor edx, edx
lea rax, vtable.CZpDownloadMgr.0
mov r8d, 0x400
lea rcx, [rdi + 8]
mov qword [rdi], rax
lea rax, vtable.CDownloadDialog.0
mov qword [rcx + 8], rbp
mov qword [rcx], rax
mov dword [rcx + 0x10], ebp
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov dword [rcx + 0x30], ebp
mov dword [rcx + 0x38], 0x131a230
mov qword [0x1400371e0], rcx
lea rcx, [rdi + 0x62]
mov qword [rdi + 0x48], rbp
mov qword [rdi + 0x50], rbp
mov dword [rdi + 0x58], ebp
mov word [rdi + 0x60], bp
mov qword [rdi + 0x468], rbp
mov byte [rdi + 0x470], bpl
call fcn.14000bdd0
lea r8, str.zoom.us_Downloader_Mutex_1.0.0.0
mov qword [0x1400371e8], rdi
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x140005356
mov rcx, rax
jmp 0x1400053e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.zoom.us_Downloader_Mutex_1.0.0.0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400053e5
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400053e5
mov r8, rsi
call fcn.140005854
mov rcx, qword [0x1400371d8]
mov dword [0x1400371d0], ebp
test rcx, rcx
je 0x1400053ae
call fcn.140002714
mov rbx, qword [0x1400371e8]
test rbx, rbx
je 0x1400053cf
mov rcx, rbx
call fcn.140005430
mov edx, 0x478
mov rcx, rbx
call fcn.14000ab40
lea rcx, str.WinMain_end
mov qword [0x1400371e8], rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x140005416
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.zoom.us_Boot_Downloader
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140005416
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e9
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005f64
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
je 0x140006096
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x64030
call fcn.140024cb0
sub rsp, rax
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rsp + 0x64020], rax
mov rsi, r8
mov rbp, rdx
test r8, r8
je 0x14000606f
lea rcx, str.CZpDownloadMgr::FindParam
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x64000
call fcn.14000bdd0
xor r14d, r14d
lea rdi, [rsp + 0x20]
mov al, byte [rsi]
inc rsi
test al, al
je 0x14000604d
cmp al, 0x25
jne 0x140006033
movsx ecx, byte [rsi]
call fcn.140014738
movsx ecx, byte [rsi + 1]
mov ebx, eax
call fcn.140014738
add rsi, 2
mov ecx, eax
test bl, bl
je 0x14000604d
test cl, cl
je 0x14000604d
cmp bl, 0x39
jle 0x140006016
lea eax, [rbx - 0x61]
cmp al, 5
ja 0x140006041
sub bl, 7
shl bl, 4
cmp cl, 0x39
jg 0x140006022
mov al, 0xd0
jmp 0x14000602b
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x140006041
mov al, 0xa9
add cl, bl
add cl, al
mov byte [rdi], cl
jmp 0x14000603e
cmp al, 0x2b
jne 0x14000603c
mov byte [rdi], 0x20
jmp 0x14000603e
mov byte [rdi], al
inc rdi
inc r14d
cmp r14d, 0x63fff
jb 0x140005fd9
lea rcx, [rsp + 0x20]
mov byte [rdi], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r8, [rsp + 0x20]
mov rdx, rbp
lea rcx, [0x1400371c8]
call fcn.140002c78
mov rcx, qword [rsp + 0x64020]
xor rcx, rsp
call fcn.14000ab20
lea r11, [rsp + 0x64030]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140006770
Capabilities:
Get common file path
Print debug messages

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x30]
mov rdi, 0xffffffff80000002
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFF66E9F6_83E7_3A3E_AF14_8DE9A809A6A4
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000682e
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9A25302D_30C0_39D9_BD6F_21E6EC160475
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000682e
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall1F1C2DFC_2D24_3E06_BCB8_725134ADF989
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000682e
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9BE518E6_ECC6_35A9_88E4_87755C07200F
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400068a2
mov edi, 0x104
lea rcx, [rsp + 0x180]
mov r8d, edi
xor edx, edx
call fcn.14000bdd0
mov edx, edi
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1400068a2
lea r8, str.winsxsx86_microsoft.vc90.crt_
mov edx, edi
lea rcx, [rsp + 0x180]
call fcn.140012b8c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x1400068a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, str._CZpDownloadMgr::NeedDownloadVCRed__return_true
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x1400068b1
lea rcx, str._CZpDownloadMgr::NeedDownloadVCRed__return_false
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14000ab20
add rsp, 0x2a0
pop rdi
ret
Function at 0x140009460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea eax, [rcx - 1]
xor ebp, ebp
mov rsi, r8
mov rbx, rdx
mov edi, ecx
test eax, 0xfffffff7
jne 0x140009581
test rdx, rdx
je 0x140009581
mov r9, rdx
nop dword [rax + rax]
movzx eax, word [r9]
add r9, 2
test ax, ax
jne 0x1400094a0
sub r9, rbx
lea rdx, str.http:
sar r9, 1
mov rcx, rdx
dec r9
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x1400094c0
sub rcx, rdx
sar rcx, 1
lea rax, [rcx - 1]
cmp r9, rax
jb 0x14000950e
mov rcx, rdx
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x1400094e0
sub rcx, rdx
sar rcx, 1
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
mov ecx, ebp
sete cl
test ecx, ecx
jne 0x1400096b3
mov rcx, rbx
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140009511
sub rcx, rbx
lea r9, str.https:
sar rcx, 1
lea rdx, [rcx - 1]
mov rcx, r9
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140009531
sub rcx, r9
sar rcx, 1
lea rax, [rcx - 1]
cmp rdx, rax
jb 0x140009581
mov rcx, r9
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140009550
sub rcx, r9
mov rdx, r9
sar rcx, 1
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
mov ecx, ebp
sete cl
test ecx, ecx
jne 0x1400096b3
cmp edi, 3
jne 0x1400095c9
test rbx, rbx
je 0x1400095b2
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1400096b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400095b2
test al, 0x10
je 0x1400096b3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp edi, 2
jne 0x1400095eb
test rbx, rbx
je 0x1400095b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400095b2
test al, 0x10
jne 0x1400096b3
jmp 0x1400095b2
cmp edi, 4
jne 0x14000960b
test rsi, rsi
je 0x1400095b2
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1400096b3
mov rcx, rsi
jmp 0x14000959f
cmp edi, 5
jne 0x14000968e
test rbx, rbx
je 0x1400095b2
mov rcx, rbx
nop dword [rax + rax]
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140009620
sub rcx, rbx
lea r9, str.mailto:
sar rcx, 1
lea rdx, [rcx - 1]
mov rcx, r9
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140009640
sub rcx, r9
sar rcx, 1
lea rax, [rcx - 1]
cmp rdx, rax
jb 0x1400095b2
mov rcx, r9
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140009662
sub rcx, r9
mov rdx, r9
sar rcx, 1
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
sete bpl
test ebp, ebp
jmp 0x1400096ad
lea eax, [rdi - 6]
cmp eax, 2
ja 0x1400095b2
call fcn.140009380
test eax, eax
jne 0x1400096b3
mov rcx, rbx
call fcn.14000a210
test eax, eax
je 0x1400095b2
mov eax, 1
jmp 0x1400095b4