joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4103cf
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a5e3
mov dword [ebp - 0x14], eax
cmp dword [0x710af4], esi
jne 0x4104c2
push 0x800
push esi
push 0x4050fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41044f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4105a2
push esi
push esi
push 0x4050fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4105a2
push 0x405114
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4105a2
push eax
call ebx
push 0x405120
push edi
mov dword [0x710af4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405130
push edi
mov dword [0x710af8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405144
push edi
mov dword [0x710afc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x710b04], eax
test eax, eax
je 0x4104bf
push 0x405160
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x710b00], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4104e7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4104da
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4104fc
push 4
pop eax
jmp 0x4105a4
cmp dword [ebp - 0x14], esi
je 0x4104fc
push dword [0x710af4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4104e1
mov eax, dword [0x710b00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41055a
cmp dword [0x710b04], edi
je 0x41055a
push eax
call ebx
push dword [0x710b04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41055a
test eax, eax
je 0x41055a
call ecx
test eax, eax
je 0x41054f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41054f
test byte [ebp - 8], 1
jne 0x41055a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41058a
mov eax, dword [0x710af8]
cmp eax, edi
je 0x410587
push eax
call ebx
test eax, eax
je 0x410587
call eax
mov esi, eax
test esi, esi
je 0x410587
mov eax, dword [0x710afc]
cmp eax, edi
je 0x410587
push eax
call ebx
test eax, eax
je 0x410587
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x710af4]
call ebx
test eax, eax
je 0x4105a2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4105a4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409c1e
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x162676a5
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1be75ac8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401232
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x43329c]
test ecx, ecx
je 0x401258
call fcn.00405ffd
test al, al
jne 0x40127b
lea eax, [ebp - 0x20c]
push eax
call fcn.00402898
pop ecx
test eax, eax
je 0x40127f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40127f
mov al, 1
jmp 0x401281
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bd28
leave
ret
Function at 0x401f74
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.0040db40
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040db40
add esp, 0x18
lea eax, [ebp - 0x20c]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x425690
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40201e
push esi
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40201e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 4
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.0040bd28
leave
ret

Function at 0x4022ab
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.0040db40
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0040db40
push 1
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push edi
push ebx
call fcn.00402952
add esp, 0x30
test eax, eax
je 0x4023c9
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0040db40
lea eax, [ebp - 0x414]
mov esi, 0x104
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0041404e
push str..tmp
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00413fd9
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call fcn.0040222f
test esi, esi
je 0x4023c5
xor ecx, ecx
inc ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, eax
call fcn.00407ceb
test al, al
jne 0x4023a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x4023d7
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40239c
mov eax, esi
jmp 0x4023d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x40239c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd28
leave
ret
Function at 0x4024e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [0x433294]
call fcn.0040286b
pop ecx
pop ecx
push 0x4256b4
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0040222f
push 1
xor edi, edi
lea ecx, [ebp - 0x40c]
push edi
push edi
push edi
push 1
push ecx
mov ecx, eax
call fcn.00407ceb
test al, al
je 0x4026a5
push esi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0040db40
mov dword [ebp - 0x44c], esi
mov ecx, str.open
mov esi, dword [ebp + 0x14]
mov eax, str.runas
test esi, esi
mov dword [ebp - 0x448], 0x540
push 0x200
cmove eax, ecx
mov dword [ebp - 0x430], 4
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.0040db40
mov eax, dword [ebp + 8]
add esp, 0x18
sub eax, edi
je 0x40260a
sub eax, 1
je 0x4025df
sub eax, 1
je 0x4025d8
sub eax, 1
jne 0x40263d
push str._stop
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.0041404e
add esp, 0xc
jmp 0x40263d
push str._start
jmp 0x4025c2
mov ecx, 0x425b94
test esi, esi
mov eax, str._elevate
cmove eax, ecx
push eax
push str._uninstall
lea eax, [ebp - 0x204]
push str._s__s
push eax
call fcn.00401cd4
add esp, 0x10
jmp 0x40263d
lea eax, [ebp - 0x204]
push str.Zoom
push str._product
test esi, esi
je 0x402625
push str._elevate
jmp 0x40262a
push 0x425b94
push str._install
push str._s__s__s__s
push eax
call fcn.00401cd4
add esp, 0x18
lea eax, [ebp - 0x204]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
mov eax, dword [ebp - 0x42c]
pop esi
je 0x4026a8
cmp eax, 0x20
jle 0x4026a8
cmp dword [ebp + 0x10], edi
je 0x4026a1
push 0x7530
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4026a5
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], edi
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x410]
jmp 0x4026a8
xor eax, eax
jmp 0x4026a8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040bd28
leave
ret

Function at 0x4028e7
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x402918
cmp dword [ebp + 0xc], 0
je 0x402918
push dword [ebp + 8]
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x402918
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402952
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040db40
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0040db40
add esp, 0x18
test edi, edi
je 0x4029cf
xor eax, eax
cmp word [edi], ax
je 0x4029cf
push edi
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0041404e
add esp, 0xc
jmp 0x4029e8
lea eax, [ebp - 0x414]
push eax
xor eax, eax
push eax
call fcn.0040286b
pop ecx
pop ecx
test eax, eax
je 0x402ac3
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test esi, esi
je 0x402a1e
xor eax, eax
cmp word [esi], ax
je 0x402a1e
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041404e
add esp, 0xc
jmp 0x402a4a
lea eax, [ebp - 0x20c]
push eax
call fcn.00402898
pop ecx
test eax, eax
je 0x402ac3
cmp byte [ebp + 0x1c], 0
je 0x402a4a
xor ecx, ecx
lea eax, [ebp - 0x20c]
push ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x402a77
lea ecx, [ebp - 0x414]
push ecx
push 0x104
push eax
call fcn.0041404e
add esp, 0xc
test ebx, ebx
je 0x402a90
lea eax, [ebp - 0x20c]
push eax
push 0x104
push ebx
call fcn.0041404e
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402abe
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040202f
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
jmp 0x402acd
xor eax, eax
inc eax
jmp 0x402acd
push 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd28
leave
ret

Function at 0x402adc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edi
test edx, edx
je 0x402b50
mov ecx, edx
xor edi, edi
push esi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x402afc
sub ecx, esi
sar ecx, 1
pop esi
cmp ecx, 0x102
jge 0x402b50
xor eax, eax
mov dword [ebp - 0xa], edi
mov word [edx + ecx*2 + 2], ax
xorps xmm0, xmm0
mov eax, 0x454
movlpd qword [ebp - 0x12], xmm0
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
jmp 0x402b52
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040bd28
leave
ret
Function at 0x4039a7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
test esi, esi
je 0x403a70
test eax, eax
je 0x403a70
cmp dword [ebp + 0x10], 0
je 0x403a70
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
test eax, eax
je 0x403a6b
push edi
push eax
call fcn.0040bfcd
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x14]
push dword [ebp - 8]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x403a63
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x425e88
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403a63
cmp dword [ebp - 0xc], ebx
je 0x403a63
mov ecx, dword [ebp - 0x10]
cmp dword [ecx], 0xfeef04bd
jne 0x403a63
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._04d
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.004045e2
add esp, 0x1c
mov bl, 1
push edi
call fcn.0040bd39
pop ecx
pop edi
mov al, bl
pop ebx
jmp 0x403a72
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040bd28
leave
ret
Function at 0x403a7f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
test esi, esi
je 0x403c95
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x403c95
xor eax, eax
mov byte [ebp - 0x95], al
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x88]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x94], eax
test eax, eax
je 0x403c95
push edi
push eax
call fcn.0040bfcd
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x94]
push dword [ebp - 0x88]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x403c85
test bl, 1
je 0x403b79
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x425e88
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403b79
cmp dword [ebp - 0x8c], 0
mov esi, dword [ebp - 0x9c]
je 0x403b7f
mov ecx, dword [ebp - 0x90]
cmp dword [ecx], 0xfeef04bd
jne 0x403b7f
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._04d
push 0x40
push esi
call fcn.004045e2
add esp, 0x1c
mov byte [ebp - 0x95], 1
jmp 0x403b7f
mov esi, dword [ebp - 0x9c]
test bl, 2
je 0x403c85
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x94]
push eax
push str.VarFileInfoTranslation
lea ebx, [esi + 0x40]
push edi
mov byte [ebx], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403c85
cmp dword [ebp - 0x8c], 4
jb 0x403c85
mov esi, 0x80
lea eax, [ebp - 0x84]
push esi
push 0
push eax
call fcn.0040db40
mov ecx, dword [ebp - 0x94]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xFileDescription
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.004045e2
add esp, 0x20
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x84]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403c85
mov esi, dword [ebp - 0x8c]
test esi, esi
je 0x403c85
cmp dword [ebp - 0x90], 0
je 0x403c85
mov eax, 0xff
lea ecx, [eax + 1]
cmp esi, ecx
cmovae esi, eax
mov dword [ebp - 0x8c], esi
test esi, esi
je 0x403c7a
test ebx, ebx
jne 0x403c59
call fcn.00414b34
mov dword [eax], 0x16
call fcn.00413f78
mov esi, dword [ebp - 0x8c]
jmp 0x403c7a
cmp esi, ecx
jbe 0x403c6a
call fcn.00414b34
mov dword [eax], 0x22
jmp 0x403c4c
push esi
push dword [ebp - 0x90]
push ebx
call fcn.0040f340
add esp, 0xc
mov ecx, dword [ebp - 0x9c]
mov byte [ecx + esi + 0x40], 0
push edi
call fcn.0040bd39
mov al, byte [ebp - 0x95]
pop ecx
pop edi
jmp 0x403c97
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd28
leave
ret
Function at 0x4042c1
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40437a
xor eax, eax
cmp ax, word [esi]
je 0x40437a
push 0x410
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040db40
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40437a
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404376
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.downlevel
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40437a
mov al, 1
jmp 0x40437c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040bd28
leave
ret

Function at 0x404389
Capabilities:
Enumerate processes
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x33c], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4043c0
xor al, al
jmp 0x4044ac
lea eax, [ebp - 0x338]
mov dword [ebp - 0x338], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4044a3
lea eax, [ebp - 0x314]
push edi
push eax
call fcn.00413384
pop ecx
pop ecx
test eax, eax
jne 0x40448c
push dword [ebp - 0x330]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4044a1
cmp dword [ebp + 0xc], ebx
jl 0x404440
or dword [ebp - 0x10c], 0xffffffff
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x404440
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10c], eax
jne 0x404486
push 0x104
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0040db40
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameA
push 0x3e7
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x33c]
lea eax, [ebp - 0x338]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4043df
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd28
leave
ret
Function at 0x40509b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x425690
mov ecx, esi
lea edi, [ebx + 0x94]
call fcn.00401e8d
test al, al
je 0x405121
push 0x200
xor esi, esi
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.0040db40
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x405129
lea eax, [ebp - 0x204]
mov ecx, edi
push eax
call fcn.00401c3f
push 0x425e88
mov ecx, edi
call fcn.00404ab2
push str.Zoom
mov ecx, edi
call fcn.00404ab2
jmp 0x405129
push esi
mov ecx, edi
call fcn.004049a9
lea esi, [ebx + 0xac]
push edi
mov ecx, esi
call fcn.004049a9
push str.data_
mov ecx, esi
call fcn.00404ab2
push str.Zoom.us.ini
mov ecx, esi
call fcn.00404ab2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd28
leave
ret 4

Function at 0x405c1e
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0
je 0x405c54
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x405c54
mov eax, dword [ebp - 0x10]
jmp 0x405c56
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bd28
leave
ret

Function at 0x405d76
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4310c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0
je 0x405da0
lea eax, [ebp - 0x20]
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x405da0
mov eax, dword [ebp - 0x1c]
jmp 0x405da2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bd28
leave
ret