joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f2cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push 0x101
push 0
push edx
push ecx
mov dword [ebp - 8], 0x208
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42f31c
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
cmove esi, dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x42f37f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0045d8a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x42f3f0
lea eax, [ebp - 0x20c]
push eax
call fcn.0043cd78
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040acdb
mov al, 1
jmp 0x42f3f2
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00459996
leave
ret
Function at 0x43000f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x24
mov eax, 0x467ed9
call fcn.00464112
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x43002b
xor al, al
jmp 0x43016b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x430035
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
je 0x430080
push 0x208
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserUtil.cpp
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040c3fa
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
jb 0x43005e
mov esi, dword [esi]
mov edx, str.___HasZoomUnder__Return_false_as_its_a_network_driver:
mov ecx, 0x490320
call fcn.0040b77d
mov edx, esi
mov ecx, eax
call fcn.0040b77d
lea ecx, [ebp - 0x2c]
call fcn.0040c599
jmp 0x430024
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040ad47
xor ebx, ebx
mov edi, 0x4799a0
inc ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b54a
mov edi, str.Zoom
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b54a
mov edi, 0x4799a0
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b54a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4300f2
test al, 0x10
jne 0x4300f4
xor bl, bl
push 0x21f
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserUtil.cpp
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x2c], bl
call fcn.0040c3fa
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 8
jb 0x430117
mov esi, dword [esi]
push dword [ebp - 0x2c]
mov edx, str.___HasZoomUnder__Has_Zoom:
push ecx
mov ecx, 0x490320
call fcn.0040b77d
pop ecx
mov ecx, eax
call fcn.0040a3bc
mov edx, str._for_path:
mov ecx, eax
call fcn.0040b77d
mov edx, esi
mov ecx, eax
call fcn.0040b77d
lea ecx, [ebp - 0x30]
call fcn.0040c599
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x430169
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x28]
call fcn.004036dc
pop ecx
pop ecx
mov al, bl
call fcn.004640cd
ret

Function at 0x430811
Capabilities:
Check mutex on windows

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.zoom.us_Installer_Mutex_1.0.0.0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x430849
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x430849
inc eax
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
Function at 0x430b5a
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x468052
call fcn.004640de
mov esi, ecx
call fcn.00430926
test eax, eax
jne 0x430ba6
push 0xc4
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerSaaSbeeInstaller.cpp
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c3fa
and dword [ebp - 4], 0
mov edx, str._CSaaSbeeInstaller::Init__Fail_to_create_window.
mov ecx, 0x490270
call fcn.004062fc
lea ecx, [ebp - 0x10]
call fcn.0040c599
xor eax, eax
jmp 0x430cb1
push ecx
push ecx
mov ecx, esi
call fcn.00430796
push dword [esi]
lea ecx, [esi + 4]
call fcn.0042382e
push dword [esi]
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0042a3e4
mov ecx, edi
mov dword [esi + 8], edi
call fcn.0042b129
cmp eax, 0x10
je 0x430c5a
mov ecx, edi
call fcn.0042b129
cmp eax, 0x11
je 0x430c5a
mov ecx, edi
call fcn.0042b129
cmp eax, 0x33
je 0x430c5a
mov ecx, edi
call fcn.0042b129
cmp eax, 0x34
je 0x430c5a
mov ecx, edi
call fcn.0042b129
cmp eax, 0x35
je 0x430c5a
mov ecx, esi
call fcn.00430ce9
push dword [esi]
call fcn.00430cbc
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xde
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerSaaSbeeInstaller.cpp
push 0
lea ecx, [ebp - 0x14]
call fcn.0040c3fa
mov dword [ebp - 4], 2
mov edx, str._CSaaSbeeInstaller::Init__Created_window:
push dword [esi]
push ecx
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0042deac
lea ecx, [ebp - 0x14]
jmp 0x430c98
push 0xd6
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerSaaSbeeInstaller.cpp
push 0
lea ecx, [ebp - 0x10]
call fcn.0040c3fa
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0042b129
push eax
push ecx
mov edx, str._CSaaSbeeInstaller::Init__No_UI_for_special_command:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040723d
lea ecx, [ebp - 0x10]
call fcn.0040c599
push 0
push 0x64
push 0x3e8
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
call fcn.004640b8
ret
Function at 0x430f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46807f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1024
call fcn.0045a7e0
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [edi + 4]
mov dword [ebp - 0x1034], edi
test eax, eax
je 0x4310af
mov byte [edi + 8], 1
mov byte [eax], 0
mov eax, dword [edi + 4]
add eax, 4
cmp dword [eax + 0x14], 0x10
jb 0x430fee
mov eax, dword [eax]
push 0x47962c
push eax
lea eax, [ebp - 0x1030]
push eax
call fcn.004415a2
mov eax, dword [ebp - 0x1030]
add esp, 0xc
test eax, eax
je 0x4310a5
and dword [ebp - 4], 0
cmp byte [edi + 9], 0
jne 0x43109a
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push 1
push eax
call fcn.004417cf
add esp, 0x10
test eax, eax
jle 0x43104e
push eax
lea eax, [ebp - 0x1014]
push eax
lea ecx, [edi + 0xc]
call fcn.004169a2
mov eax, dword [ebp - 0x1030]
jmp 0x431015
jne 0x431046
lea ecx, [edi + 0xc]
call fcn.00416a74
lea eax, [ebp - 0x102c]
push eax
lea ecx, [edi + 0xc]
call fcn.00416ae6
mov ebx, eax
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
jb 0x431075
mov ebx, dword [ebx]
mov esi, dword [edi + 4]
push ebx
call fcn.0043d2c0
pop ecx
push eax
push ebx
lea ecx, [esi + 0x34]
call fcn.00406033
lea ecx, [ebp - 0x102c]
call fcn.0040600d
mov eax, dword [ebp - 0x1030]
test eax, eax
je 0x4310a5
push eax
call fcn.0043e251
pop ecx
mov eax, dword [edi + 4]
mov byte [eax], 1
mov byte [edi + 8], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00459996
leave
ret
Function at 0x43180d
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0xc
mov eax, 0x46522b
call fcn.004640de
mov esi, ecx
xor ebx, ebx
mov dword [esi + 4], 1
push 2
lea edi, [esi + 8]
mov dword [esi], ebx
push ebx
mov dword [edi], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [esi], eax
cmp eax, 0x80010106
je 0x431881
test eax, eax
jns 0x431881
push 0xf1
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerWinFWUtil_Win7.cpp
push 2
lea ecx, [ebp - 0x10]
call fcn.0040c3fa
mov dword [ebp - 4], ebx
mov edx, str._CZoomFirewallUtil::CZoomFirewallUtil__CoCreateInstance_failed:
push dword [esi]
push ecx
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c599
mov dword [esi + 4], ebx
cmp dword [esi + 4], ebx
je 0x4318df
push edi
push 0x480dc4
push 1
push ebx
push 0x480e04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x4318df
push 0x102
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerWinFWUtil_Win7.cpp
push 2
lea ecx, [ebp - 0x14]
call fcn.0040c3fa
push edi
push ecx
mov edx, str._CZoomFirewallUtil::CZoomFirewallUtil__CoCreateInstance_failed:
mov dword [ebp - 4], 1
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
lea ecx, [ebp - 0x14]
call fcn.0040c599
mov dword [esi + 4], ebx
mov eax, esi
call fcn.004640b8
ret
Function at 0x435884
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x250
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x260], edx
push 0
push eax
mov esi, ecx
call fcn.0045d8a0
add esp, 0xc
or edi, 0xffffffff
test esi, esi
je 0x4359e1
push esi
call fcn.0043cd78
pop ecx
test eax, eax
je 0x4359e1
push ecx
push 0x47dc78
mov ecx, esi
call fcn.004356e8
mov ebx, eax
mov dword [ebp - 0x268], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x4358fa
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4359d5
lea eax, [ebp - 0x25c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4359ce
mov ebx, esi
test byte [ebp - 0x25c], 0x10
je 0x43594c
lea eax, [ebp - 0x230]
push 0x47dc7c
push eax
call fcn.0043cb55
pop ecx
pop ecx
test eax, eax
je 0x4359b2
lea eax, [ebp - 0x230]
push 0x47c70c
push eax
call fcn.0043cb55
pop ecx
pop ecx
test eax, eax
je 0x4359b2
push ecx
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004356e8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4359b2
test byte [ebp - 0x25c], 0x10
je 0x43598f
mov ecx, esi
call fcn.00427214
test eax, eax
jne 0x435986
mov edx, dword [ebp - 0x260]
mov ecx, esi
push eax
call fcn.00435884
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4359ab
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
push 0
push eax
push esi
call dword [0x46b4a4]
call dword [ebp - 0x260]
mov ecx, esi
call fcn.00426874
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x435915
mov ebx, dword [ebp - 0x268]
mov ecx, ebx
call fcn.00426874
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x4359eb
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459996
leave
ret

Function at 0x435acf
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x202
xor esi, esi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0045d8a0
add esp, 0xc
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x210], 0x100
call fcn.00435a33
test eax, eax
je 0x435b74
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x435b74
lea eax, [ebp - 0x20c]
push eax
push 1
lea eax, [ebp - 0x208]
push eax
push esi
mov esi, dword [0x491640]
mov ecx, esi
call dword [0x46b4a4]
call esi
test eax, eax
jne 0x435b74
mov ecx, dword [ebp - 0x20c]
mov esi, dword [0x491638]
push ebx
push ecx
cmp dword [ecx + 0xc], 2
mov ecx, esi
sete bl
call dword [0x46b4a4]
call esi
mov al, bl
pop ebx
jmp 0x435b76
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00459996
leave
ret
Function at 0x435fb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10c
mov eax, 0x466b77
call fcn.00464112
mov esi, edx
push ecx
lea ecx, [ebp - 0x118]
call fcn.0041fb76
and dword [ebp - 4], 0
lea ecx, [ebp - 0x118]
push 0x4799a0
call fcn.0041fedb
mov ecx, esi
call fcn.0041fd96
lea ecx, [ebp - 0x118]
test al, al
je 0x436006
push str.Zoom.lnk
call fcn.0041fedb
jmp 0x43600c
push esi
call fcn.0041febe
lea ecx, [ebp - 0x118]
call fcn.0041fc80
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x118]
setne bl
call fcn.0041fbe3
mov al, bl
call fcn.004640cd
ret

Function at 0x4362f2
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x4363b2
push esi
call fcn.0043cd78
pop ecx
test eax, eax
je 0x4363b2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4363b2
push 0x410
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045d8a0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
push 0
push 0x47a6bc
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4363a0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4363b2
lea esi, [ebp - 0x414]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x4363b4
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00459996
leave
ret
Function at 0x4363c1
Capabilities:
Copy file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x436527
test esi, esi
je 0x436527
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x436400
mov al, 1
jmp 0x436529
mov ebx, 0x412
lea eax, [ebp - 0x420]
push ebx
push 0
push eax
call fcn.0045d8a0
add esp, 0xc
lea eax, [ebp - 0x838]
push ebx
push 0
push eax
call fcn.0045d8a0
add esp, 0xc
lea eax, [ebp - 0x420]
push edi
push 0x208
push eax
call fcn.0043d0ca
add esp, 0xc
push edi
call fcn.0043cd78
add eax, eax
pop ecx
cmp eax, ebx
jae 0x436538
xor ecx, ecx
mov word [ebp + eax - 0x420], cx
add eax, 2
cmp eax, ebx
jae 0x436538
push esi
mov word [ebp + eax - 0x420], cx
lea eax, [ebp - 0x838]
push 0x208
push eax
call fcn.0043d0ca
add esp, 0xc
push esi
call fcn.0043cd78
add eax, eax
pop ecx
cmp eax, ebx
jae 0x436538
xor ecx, ecx
mov word [ebp + eax - 0x838], cx
add eax, 2
cmp eax, ebx
jae 0x436538
and dword [ebp - 0x858], ecx
xorps xmm0, xmm0
and dword [ebp - 0x83e], ecx
mov word [ebp + eax - 0x838], cx
lea eax, [ebp - 0x420]
mov dword [ebp - 0x850], eax
lea eax, [ebp - 0x838]
mov dword [ebp - 0x84c], eax
lea eax, [ebx + 2]
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x858]
push eax
movlpd qword [ebp - 0x846], xmm0
mov dword [ebp - 0x854], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x846], 0
jne 0x436527
test eax, eax
jne 0x436527
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x436527
push ecx
push ecx
mov ecx, edi
call fcn.004359fa
pop ecx
pop ecx
jmp 0x4363f9
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459996
leave
ret
call fcn.00459ac8
int3
Function at 0x43653e
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
test ecx, ecx
je 0x436612
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x436612
xor eax, eax
mov dword [ebp - 8], edi
push edi
mov word [ebp - 4], ax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43660b
cmp dword [ebp - 8], 2
jne 0x43660b
mov eax, 0x5a4d
cmp word [ebp - 4], ax
jne 0x43660b
push edi
push edi
push 0x3c
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43660b
cmp dword [ebp - 8], 2
jne 0x43660b
movzx eax, word [ebp - 4]
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43660b
cmp dword [ebp - 8], 4
jne 0x43660b
cmp dword [ebp - 0xc], 0x4550
jne 0x43660b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x436614
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x43bffa
Capabilities:
Terminate process

Disassembly:
push 0x234
mov eax, 0x469bd1
call fcn.00464112
mov edi, ecx
push ecx
push edi
lea ecx, [ebp - 0x240]
call fcn.0042075c
xor ebx, ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], ebx
call fcn.004206c2
mov esi, eax
jmp 0x43c075
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], ebx
push eax
push 0x64
push 0xa
push ebx
push ebx
push 0x11
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [ebp - 0x23c]
test esi, esi
je 0x43c079
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x234]
jae 0x43c079
mov esi, dword [esi + eax*4]
inc eax
mov dword [ebp - 0x230], eax
test esi, esi
jne 0x43c02c
push edi
push 0
xor ebx, ebx
push 0x100001
inc ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x43c11f
push 0x7d0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43c116
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
jne 0x43c116
push 0xffffffffffffffff
push 0x47a6bc
lea ecx, [ebp - 0x11c]
call fcn.0041fb45
push 0xffffffffffffffff
push str._TerminateProcess_Failed_
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.0041fb45
mov esi, eax
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 2
pop edx
mov ecx, 0x32c8
call fcn.00434f23
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.0041fbe3
lea ecx, [ebp - 0x11c]
call fcn.0041fbe3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43c182
push 0xffffffffffffffff
push 0x47a6bc
lea ecx, [ebp - 0x11c]
call fcn.0041fb45
push 0xffffffffffffffff
push str._OpenProcess_Failed_
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 3
call fcn.0041fb45
mov esi, eax
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 2
pop edx
mov ecx, 0x32c8
call fcn.00434f23
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.0041fbe3
lea ecx, [ebp - 0x11c]
call fcn.0041fbe3
lea ecx, [ebp - 0x240]
call fcn.0042077f
mov eax, ebx
call fcn.004640cd
ret
Function at 0x43c195
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469c0b
mov eax, dword fs:[0]
push eax
mov eax, 0x142c
call fcn.0045a7e0
mov eax, dword [0x48e880]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0041fda1
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x1428]
push eax
push 0x1000
lea eax, [ebp - 0x1420]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x43c23f
push 0x14f
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsNoMSIInstallerZoomProductUtil.cpp
push 1
lea ecx, [ebp - 0x1424]
call fcn.0040c3fa
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, str._FindRunningInstance__failed_to_enum_processes__error_code:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x1424]
call fcn.0040c599
xor eax, eax
jmp 0x43c398
mov eax, dword [ebp - 0x1428]
xor ecx, ecx
shr eax, 2
mov dword [ebp - 0x1434], eax
mov dword [ebp - 0x1424], ecx
test eax, eax
je 0x43c38b
push dword [ebp + ecx*4 - 0x1420]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1430], eax
test eax, eax
je 0x43c33d
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x204]
mov esi, str._unknown_
lea edi, [ebp - 0x218]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0045d8a0
add esp, 0xc
lea eax, [ebp - 0x40c]
mov esi, str._unknown_
lea edi, [ebp - 0x420]
push 5
pop ecx
push 0x1f4
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0045d8a0
mov esi, dword [ebp - 0x1430]
lea eax, [ebp - 0x1428]
add esp, 0xc
push eax
push 4
lea eax, [ebp - 0x142c]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x43c31c
mov edi, 0x104
lea eax, [ebp - 0x218]
push edi
push eax
push dword [ebp - 0x142c]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
push edi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x142c]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
lea eax, [ebp - 0x218]
push eax
push str.Zoom.exe
call fcn.0044b0af
add esp, 0xc
test eax, eax
je 0x43c358
mov ecx, dword [ebp - 0x1424]
inc ecx
mov dword [ebp - 0x1424], ecx
cmp ecx, dword [ebp - 0x1434]
jb 0x43c25e
jmp 0x43c38b
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.0041fdf1
push 0x5c
mov ecx, ebx
call fcn.00420100
cmp eax, 0xffffffff
jne 0x43c382
push 0x2f
mov ecx, ebx
call fcn.00420100
cmp eax, 0xffffffff
je 0x43c38b
push ecx
push eax
mov ecx, ebx
call fcn.0041ff5e
mov ecx, ebx
call fcn.0041fd96
movzx eax, al
xor eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459996
leave
ret