joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e4c0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43e5b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.00404300
cmp eax, 2
jl 0x43e59e
mov eax, ebx
call fcn.00408074
test al, al
je 0x43e59e
lea ecx, [ebp - 8]
mov edx, 0x43e5d4
mov eax, ebx
call fcn.0043e438
xor eax, eax
push ebp
push 0x43e594
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00404500
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43e58a
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00408134
mov eax, dword [ebp - 0xc]
call fcn.00404300
mov edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
call fcn.00404558
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e59e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e5c0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404064
ret

Function at 0x43e6e4
Capabilities:
Delete file
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43e7dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x43e7bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404500
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43e785
lea edx, [ebp - 8]
mov eax, 0xa
call fcn.0043d50c
mov eax, dword [ebp - 8]
call fcn.00404300
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
call fcn.00404558
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
call fcn.00404500
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x43e7b3
mov eax, esi
call fcn.00404500
push eax
call sub.kernel32.dll_GetFileAttributesA
mov edi, eax
mov eax, edi
and eax, 2
test al, al
je 0x43e7b3
mov eax, esi
call fcn.00404500
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e7c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e7e4
lea eax, [ebp - 8]
call fcn.00404040
ret

Function at 0x43e8ec
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.00404040
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x43e91a
mov edx, ebx
lea eax, [esp + 4]
call fcn.00408378
add esp, 0x18
pop ebx
ret
Function at 0x43f1b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43f24e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404040
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00406620
test eax, eax
je 0x43f235
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004042b0
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040c2e4
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.00404094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f255
lea eax, [ebp - 0x110]
call fcn.00404040
ret

Function at 0x43f2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f338
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004042b0
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c2e4
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00404094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f33f
lea eax, [ebp - 0x10c]
call fcn.00404040
ret

Function at 0x43f344
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f3be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404040
mov eax, dword [ebp - 4]
call fcn.00404300
mov esi, eax
test esi, esi
jle 0x43f3a8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404228
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404308
inc dword [ebp - 8]
dec esi
jne 0x43f381
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f3c5
lea eax, [ebp - 0xc]
call fcn.00404040
ret

Function at 0x43f890
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.00402cc4
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00402cc4
mov dword [esp], 0x44
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x20
push 0
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x43f8ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43fa52
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, edi
call fcn.00404040
lea eax, [ebp - 0x24]
push eax
mov eax, ebx
call fcn.00404500
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43fa2f
mov eax, dword [ebp - 0xc]
call fcn.004026e8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x43fa27
xor eax, eax
push ebp
push 0x43fa1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43fa60
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43fa13
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.00407c0c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.004065c4
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.00407c0c
push 0x43fa84
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x43faa0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004043c0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.0040434c
mov eax, dword [ebp - 0x28]
call fcn.00404500
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43fa13
mov eax, edi
mov edx, dword [ebp - 0x20]
call fcn.00404238
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43fa27
mov eax, dword [ebp - 8]
call fcn.00402708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fa59
lea eax, [ebp - 0x28]
call fcn.00404040
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404064
ret
Function at 0x44042c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4404f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
mov eax, 0x440510
call fcn.0043f344
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404308
mov eax, dword [ebp - 8]
call fcn.00404500
mov esi, eax
xor edx, edx
push ebp
push 0x4404d7
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4404a6
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4404e1
push esi
push 0xffffffffffffffff
push 0
call fcn.00406324
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4404c3
cmp eax, 5
jne 0x4404cd
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4404e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4404fe
lea eax, [ebp - 8]
call fcn.00404040
ret

Function at 0x440518
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44068c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov dword [esi], 0xd8
mov eax, edi
call fcn.00404040
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00404500
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44066e
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440668
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440668
cmp word [ebp - 0x4c], 0x5a4d
jne 0x440668
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440668
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440668
cmp dword [ebp - 0x144], 0x4550
jne 0x440668
mov eax, dword [ebp - 0x13c]
xor eax, 0x50485e00
xor eax, dword [ebp - 0x11c]
movzx edx, word [ebp - 0x13e]
xor eax, edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xd8
jle 0x440635
cmp dword [ebp - 0xc], 0x249f0
jge 0x440635
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov byte [ebp - 1], 1
jmp 0x440668
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0xc]
call fcn.00407af8
mov eax, dword [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, 0x4406a8
call fcn.0043f344
mov edx, dword [ebp - 0x14c]
mov eax, edi
pop ecx
call fcn.0040434c
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440693
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00404064
ret
Function at 0x4406d8
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x440889
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404500
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x44086d
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440867
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440867
cmp word [ebp - 0x4c], 0x5a4d
jne 0x440867
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440867
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440867
cmp dword [ebp - 0x144], 0x4550
jne 0x440867
call sub.kernel32.dll_GetCurrentProcessId
add eax, 0x7c6
mov edx, dword [ebp - 0x11c]
xor edx, 0x50485e00
movzx ecx, word [ebp - 0x13e]
xor edx, ecx
xor edi, edx
xor eax, edi
mov dword [ebp - 0x13c], eax
call fcn.00402ab0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x44080b
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x440867
mov eax, 0x200
call fcn.00402ce4
mov edi, eax
shl edi, 4
test edi, edi
jle 0x440867
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440867
push edi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4406b4]
call fcn.004053c8
add esp, 4
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004065d8
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440890
lea eax, [ebp - 0xc]
mov edx, dword [0x4406b4]
call fcn.004053d4
ret
Function at 0x440ac4
Capabilities:
Encode data using xor
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x440d05
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
call fcn.00404040
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404500
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x440b53
lea eax, [ebp - 0x154]
call fcn.0043f130
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
call fcn.00404094
jmp 0x440cd9
cmp byte [ebp + 0xc], 0
je 0x440b91
call fcn.00402ab0
mov eax, 0x1ff
call fcn.00402ce4
mov edx, eax
inc edx
mov eax, edx
shl eax, 4
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x440aa0]
call fcn.004053c8
add esp, 4
jmp 0x440b94
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x440aa0]
call fcn.004053c8
add esp, 4
mov ecx, edi
mov eax, ebx
dec eax
test eax, eax
jb 0x440bca
inc eax
xor edx, edx
mov bl, byte [ecx]
xor bl, 0xff
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
inc ecx
inc edx
dec eax
jne 0x440bba
xor ebx, ebx
cmp byte [ebp + 0x10], 0
je 0x440c81
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x58]
mov ecx, 0x40
call fcn.004065d0
cmp word [ebp - 0x58], 0x5a4d
jne 0x440c61
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea edx, [eax + edx]
lea eax, [ebp - 0x150]
mov ecx, 0xf8
call fcn.004065d0
cmp dword [ebp - 0x150], 0x4550
jne 0x440c41
cmp word [ebp - 0x138], 0x10b
jb 0x440c41
call fcn.0043eda0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + edx + 8]
lea edx, [ebp - 0x14]
mov ecx, 4
call fcn.004065c8
mov bl, 1
jmp 0x440c83
lea edx, [ebp - 0x158]
mov eax, 0x440d20
call fcn.0043f344
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 8]
call fcn.00404094
jmp 0x440c83
lea edx, [ebp - 0x15c]
mov eax, 0x440d38
call fcn.0043f344
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp + 8]
call fcn.00404094
jmp 0x440c83
mov bl, 1
test bl, bl
je 0x440cd0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x440cb7
mov byte [ebp - 1], 1
jmp 0x440cd0
lea eax, [ebp - 0x160]
call fcn.0043f130
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp + 8]
call fcn.00404094
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440d0c
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00404064
lea eax, [ebp - 0x18]
mov edx, dword [0x440aa0]
call fcn.004053d4
ret
Function at 0x4443a8
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f0
xor eax, eax
push ebp
push 0x444459
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00407890
cmp dword [ebp - 0x28], 0
je 0x44443b
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
je 0x44443b
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404500
push eax
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x44441b
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x44443b
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444460
lea eax, [ebp - 0x28]
call fcn.00404040
lea eax, [ebp - 4]
call fcn.00404040
ret

Function at 0x444bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444c6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404040
mov eax, dword [ebp - 4]
call fcn.00404300
mov esi, eax
test esi, esi
jle 0x444c57
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404228
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404308
inc dword [ebp - 0xc]
dec esi
jne 0x444c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444c74
lea eax, [ebp - 0x10]
call fcn.00404040
ret
Function at 0x447c08
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x447c10
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x447e34
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push esi
call sub.kernel32.dll_GlobalFindAtomA
mov word [0x450da4], ax
cmp word [0x450da4], 0
jne 0x447dfb
call fcn.00402ab0
mov eax, dword [0x44ed08]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
call fcn.00402ce4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov eax, dword [0x44ed08]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.0043e3a4
push dword [ebp - 0x1c]
push 0x447e4c
lea eax, [ebp - 8]
mov edx, 3
call fcn.004043c0
mov eax, dword [ebp - 8]
call fcn.0040821c
test al, al
jne 0x447cb2
lea eax, [ebp - 8]
mov edx, dword [0x44f06c]
mov edx, dword [edx]
call fcn.004040d8
lea edx, [ebp - 0x10]
mov eax, dword [0x44f13c]
mov eax, dword [eax]
call fcn.00408134
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0043d2a4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.004040d8
mov al, byte [0x447e50]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x447e5c
mov edx, 0x447e6c
mov eax, dword [ebp - 0x10]
call fcn.0040cda0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.004040d8
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040434c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404500
mov edi, eax
push edi
mov eax, dword [0x44f13c]
mov eax, dword [eax]
call fcn.00404500
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x447db5
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004406d8
push esi
call sub.kernel32.dll_GlobalAddAtomA
mov word [0x450da4], ax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00408100
mov eax, dword [ebp - 0x28]
call fcn.00404500
push eax
mov eax, edi
xor edx, edx
pop ecx
call fcn.0043f890
test al, al
je 0x447d7d
mov ebx, 1
call fcn.00403ecc
jmp 0x447e0c
lea edx, [ebp - 0x2c]
mov eax, 0x447e7c
call fcn.0043f344
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.0043f130
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00404308
mov eax, dword [ebp - 0x2c]
call fcn.0043f4d8
mov ax, word [0x450da4]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
jmp 0x447e0c
lea edx, [ebp - 0x38]
mov eax, 0x447e94
call fcn.0043f344
push dword [ebp - 0x38]
push dword [ebp - 0xc]
push 0x447eb0
lea eax, [ebp - 0x3c]
call fcn.0043f130
push dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004043c0
mov eax, dword [ebp - 0x34]
call fcn.0043f4d8
mov ax, word [0x450da4]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
jmp 0x447e0c
mov ax, word [0x450da4]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447e3b
lea eax, [ebp - 0x3c]
mov edx, 0xa
call fcn.00404064
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404064
ret
Function at 0x405282
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.WinMain_start__lpCmdLine_is:
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x4052a2
mov eax, str.NULL
push eax
call esi
push str.WinMain_start__parameter_is:
call esi
push str.package.nameZoom.msipackage.versionlatestpackage.size8769kdownloadRoothttps:__launcher.zoom.us_clientactionjoinbrowseredgeconfidgv8p4S8xTbW_2B3JKsNToI6g_3D_3Dconfno7938923739zc0mcv0.92.11227.0929stafalseinstaller.exeInstaller.exe
call esi
push 0x444
call fcn.00407475
pop ecx
cmp eax, edi
je 0x4052ce
mov edx, dword [esp + 0xc]
push eax
call fcn.0040538c
jmp 0x4052d0
xor eax, eax
push str.zoom.us_Downloader_Mutex_1.0.0.0
push edi
push 0x1f0001
mov dword [0x41ddb8], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
je 0x4052f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4052fc
call fcn.00406405
test eax, eax
jne 0x40531c
push edi
push str.zoom.us_Boot_Downloader
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x405341
push edi
push edi
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405341
mov ecx, dword [esp + 0x14]
call fcn.004057bb
mov eax, dword [0x41ddb8]
cmp eax, edi
je 0x405334
push eax
call fcn.00405348
push str.WinMain_end
mov dword [0x41ddb8], edi
call esi
pop edi
xor eax, eax
pop esi
ret 0x10