joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4145b2
Capabilities:
Encode data using base64

Disassembly:
push 0x2c
mov eax, 0x4aaa8d
call fcn.004803aa
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], vtable.Cmm::CStringT_char_.0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp + 8]
push 3
pop ecx
div ecx
lea ecx, [ebp - 0x28]
mov esi, eax
mov edi, edx
xor eax, eax
mov dword [ebp - 0x30], edi
cmp eax, edi
sbb eax, eax
neg eax
add eax, esi
shl eax, 2
push eax
call fcn.004083eb
test ebx, ebx
je 0x41474d
test esi, esi
je 0x4146a0
mov edi, esi
movzx esi, byte [ebx]
lea ecx, [ebp - 0x28]
movzx eax, byte [ebx + 1]
shl eax, 8
shl esi, 0x10
add esi, eax
movzx eax, byte [ebx + 2]
add esi, eax
add ebx, 3
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
mov eax, esi
lea ecx, [ebp - 0x28]
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
mov eax, esi
lea ecx, [ebp - 0x28]
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
and esi, 0x3f
lea ecx, [ebp - 0x28]
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
sub edi, 1
jne 0x414620
mov edi, dword [ebp - 0x30]
sub edi, 1
je 0x41470c
sub edi, 1
jne 0x41474d
movzx esi, byte [ebx]
lea ecx, [ebp - 0x28]
movzx eax, byte [ebx + 1]
shl esi, 8
add esi, eax
shl esi, 8
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
mov eax, esi
lea ecx, [ebp - 0x28]
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
shr esi, 6
lea ecx, [ebp - 0x28]
and esi, 0x3f
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
push 0x3d
push 1
jmp 0x414745
movzx esi, byte [ebx]
lea ecx, [ebp - 0x28]
shl esi, 0x10
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
shr esi, 0xc
lea ecx, [ebp - 0x28]
and esi, 0x3f
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.004088b2
push 0x3d
push 2
lea ecx, [ebp - 0x28]
call fcn.004088b2
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x28]
mov edi, vtable.Cmm::CStringT_char_.0
push eax
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.00406c07
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], edi
call fcn.004081cd
mov eax, esi
call fcn.00480359
ret
Function at 0x414f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x414fb5
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
push sym.ZoomOutlookMAPI.exe_private:_static_unsigned_long_int___stdcall_Cmm::CThread::_ThreadProc_void__
push eax
push eax
call fcn.00488d5c
add esp, 0x18
mov dword [esi], eax
pop esi
pop ebp
ret 4

Function at 0x414fc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x414fe3
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.00488d5c
add esp, 0x18
mov dword [esi], eax
pop esi
pop ebp
ret 8

Function at 0x414ff0
Capabilities:
Suspend thread

Disassembly:
test ecx, ecx
je 0x414ffc
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret

Function at 0x415000
Capabilities:
Resume thread

Disassembly:
test ecx, ecx
je 0x41500c
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x415040
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x415066
cmp dword [esi + 4], 0
je 0x415066
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
and dword [esi], 0
pop esi
ret

Function at 0x415150
Capabilities:
Create thread

Disassembly:
push esi
lock inc dword [ecx + 0xc]
lea esi, [ecx + 4]
test esi, esi
je 0x415175
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push ecx
push sym.ZoomOutlookMAPI.exe_private:_static_unsigned_long_int___stdcall_Cmm::CRefThread::_ThreadProc_void__
push eax
push eax
call fcn.00488d5c
add esp, 0x18
mov dword [esi], eax
pop esi
ret
Function at 0x44f900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x4aedb2
call fcn.00480377
mov edi, dword [ebp + 8]
test edi, edi
je 0x44f981
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x44f981
push dword [0x5913e0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x44f96c
push 8
call fcn.0047f873
mov esi, eax
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 4], eax
push 0x18
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0040b5d6
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push esi
mov dword [esi], eax
push dword [0x5913e0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push eax
mov ecx, esi
call fcn.0045000e
call fcn.00480345
ret

Function at 0x459cdb
Capabilities:
Create pipe

Disassembly:
push 0x68
mov eax, 0x4b00d5
call fcn.004803aa
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00459bce
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], eax
jne 0x459d69
xor ebx, ebx
mov dword [ebp - 0x74], 0xc
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
call fcn.004597a2
test al, al
jne 0x459d2a
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x74]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
test edi, edi
cmove eax, edx
push eax
push 0x1388
mov eax, 0x1000
push eax
push eax
push 1
push ebx
push 0x40080003
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push dword [ebp - 0x70]
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x459d8f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
push ebx
push 0x40110000
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x3c], eax
cmp dword [esi + 0x3c], 0xffffffff
je 0x459df9
cmp byte [esi + 0x1074], 0
jne 0x459df7
lea ecx, [ebp - 0x64]
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_SBIPCMessage_Connect::constructor_void_
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xffffffffffffffff
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x2c], eax
call fcn.0040c180
push ebx
push 0x58462c
push 0x589f5c
push ebx
push eax
mov dword [ebp - 0x68], eax
call fcn.004a9606
add esp, 0x14
test eax, eax
je 0x459de3
push dword [ebp - 0x48]
mov ecx, eax
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CmmInternelMsg::SetMsgType_int_
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0x48]
call fcn.004445d1
lea ecx, [ebp - 0x64]
call sym.ZoomOutlookMAPI.exe_public_virtual:_void___thiscall_Cmm::Archive::CmmMessageTemplate_1_unsigned_int_::destructor_void_
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.0040784f
mov al, bl
call fcn.00480359
ret 0xc
Function at 0x45a04a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x38], bl
je 0x45a0b9
mov byte [edi + 0x38], bl
cmp dword [ebp + 8], ebx
je 0x45a0c2
cmp dword [ebp + 0xc], ebx
je 0x45a0c2
mov edx, dword [edi + 0x54]
mov ecx, edx
mov eax, dword [edi + 0x50]
and edx, 3
shr ecx, 2
dec eax
and ecx, eax
mov eax, dword [edi + 0x4c]
mov eax, dword [eax + ecx*4]
mov esi, dword [eax + edx*4]
test esi, esi
je 0x45a0b9
push ebx
push 0x58462c
push 0x589f5c
push ebx
push esi
call fcn.004a9606
add esp, 0x14
mov ecx, eax
call sym.ZoomOutlookMAPI.exe_public:_bool___thiscall_Cmm::CmmInternelMsg::IsWrittenComplete_void_
test al, al
je 0x45a0b9
sub dword [edi + 0x58], 1
jne 0x45a0af
mov dword [edi + 0x54], ebx
jmp 0x45a0b2
inc dword [edi + 0x54]
push esi
call sym.ZoomOutlookMAPI.exe_void___cdecl_Cmm::CCmmMessageHelper::FreeMsg_class_Cmm::CmmMQ_Msg__
pop ecx
cmp dword [edi + 0x58], ebx
jne 0x45a0d1
mov al, 1
jmp 0x45a0ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp dword [edi + 0x3c], 0xffffffff
je 0x45a0c8
mov edx, dword [edi + 0x54]
mov ecx, edx
mov eax, dword [edi + 0x50]
and edx, 3
shr ecx, 2
dec eax
and ecx, eax
mov eax, dword [edi + 0x4c]
push ebx
push 0x58462c
push 0x589f5c
mov eax, dword [eax + ecx*4]
push ebx
push dword [eax + edx*4]
call fcn.004a9606
mov ebx, eax
lea ecx, [edi + 0x20]
add esp, 0x14
lea eax, [ebp + 0xc]
mov esi, dword [ebx + 4]
add esi, dword [ebx + 0x10]
push ecx
push eax
mov ecx, ebx
call sym.ZoomOutlookMAPI.exe_public:_unsigned_int___thiscall_Cmm::CmmInternelMsg::GetToWrite_void_const
push eax
push esi
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45a14b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x45a0c8
mov ecx, ebx
call sym.ZoomOutlookMAPI.exe_public:_unsigned_int___thiscall_Cmm::CmmInternelMsg::GetToWrite_void_const
mov dword [ebx + 0x10], eax
mov byte [edi + 0x38], 1
jmp 0x45a0be
mov eax, dword [ebp + 0xc]
jmp 0x45a13f
Function at 0x45b8ad
Capabilities:
Create process on windows

Disassembly:
push 0x294
mov eax, 0x4b0380
call fcn.004803aa
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x45ba24
cmp byte [0x5914ec], 0
je 0x45ba24
mov ebx, 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00481b4e
pop ecx
pop ecx
test eax, eax
je 0x45b904
xor ecx, ecx
mov word [eax + 2], cx
push str.debug_message.exe
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00492cf8
add esp, 0xc
lea ecx, [ebp - 0x24c]
push esi
call fcn.00453705
add eax, 4
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 8
jb 0x45b933
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], 7
call fcn.00407f4b
lea ecx, [ebp - 0x248]
mov dword [ebp - method.Cmm::CStringT_wchar_t_.virtual_0], vtable.Cmm::CStringT_wchar_t_.0
call fcn.0040784f
cmp dword [ebp - 0x220], 0
je 0x45ba19
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2a0]
push edi
push eax
call fcn.004821f0
add esp, 0xc
mov dword [ebp - 0x2a0], esi
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x25c]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x2a0]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45b9f3
push 0xffffffffffffffff
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45ba19
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0x40010
cmovae eax, dword [ebp - 0x230]
push str.Fatal_error
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x230]
call fcn.0040784f
call fcn.00480359
ret
Function at 0x45c000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0467
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x58005c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 8]
push eax
call fcn.0045c57a
pop ecx
lea eax, [ebp - 0x28]
lea ebx, [edi + 0xc]
push eax
mov ecx, ebx
call fcn.00407742
mov esi, dword [0x5914f8]
test esi, esi
je 0x45c07c
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi + 0xa0]
push dword [edi + 0xa8]
push dword [edi + 0xa4]
push dword [edi]
call dword [0x4b4460]
call esi
add esp, 0x14
test al, al
jne 0x45c1e6
mov eax, dword [0x5914b4]
push 2
pop esi
cmp eax, esi
je 0x45c094
cmp eax, 3
je 0x45c094
cmp dword [edi], 3
jl 0x45c0d3
jmp 0x45c0a6
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x4d2ec8
push esi
call fcn.0048c228
pop ecx
push eax
call fcn.0045b3e8
push esi
call fcn.0048c228
push eax
call fcn.00489a59
add esp, 0x14
xor edx, edx
xor ecx, ecx
call fcn.0046bc7a
mov eax, dword [0x5914b4]
test eax, eax
je 0x45c187
cmp eax, esi
je 0x45c183
lea ecx, [ebp - 0x59]
call fcn.0045b566
push dword [ebp - 0x18]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
xor esi, esi
mov ecx, 0x5914b8
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.0046c579
test al, al
je 0x45c153
push dword [0x5914e4]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [0x5914dc]
cmovae eax, dword [ebp - 0x40]
push esi
push esi
push dword [0x5914b4]
push eax
call sym.ZoomOutlookMAPI.exe_bool___cdecl_logging::BaseInitLoggingImpl_built_with_NDEBUG_wchar_t_const___enum_logging::LoggingDestination__enum_logging::LogLockingState__enum_logging::OldFileDeletionState__enum_logging::LogEncryptPolicy__unsigned_long_int_
add esp, 0x18
test al, al
je 0x45c153
mov ecx, 0x5914b8
call fcn.0046c386
mov esi, 0x5914b0
mov ecx, esi
call fcn.0046bdc8
test al, al
je 0x45c16e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0046c006
lea ecx, [ebp - 0x40]
call fcn.0040784f
lea ecx, [ebp - 0x59]
call fcn.0045b596
mov eax, dword [0x5914b4]
test eax, eax
jne 0x45c195
lea eax, [ebp - 0x28]
mov ecx, 0x5914b0
push eax
call fcn.0046bf78
cmp dword [edi], 5
je 0x45c1e6
cmp dword [edi], 4
jne 0x45c1e6
cmp dword [0x5914f4], 0
mov ecx, ebx
je 0x45c1cd
lea eax, [ebp - 0x40]
push eax
call fcn.00407742
mov esi, dword [0x5914f4]
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call dword [0x4b4460]
call esi
pop ecx
lea ecx, [ebp - 0x40]
jmp 0x45c1e1
lea eax, [ebp - 0x58]
push eax
call fcn.00407742
lea ecx, [ebp - 0x58]
call fcn.0045b8ad
lea ecx, [ebp - 0x58]
call fcn.004081cd
lea ecx, [ebp - 0x28]
call fcn.004081cd
push dword [edi + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [edi + 8]
call fcn.0045baa8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f860
leave
ret
Function at 0x45c80d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 8
mov esi, edx
mov edi, ecx
call fcn.0047f873
mov ebx, eax
pop ecx
push 0
mov dword [ebx], esi
mov esi, dword [ebp + 8]
test esi, esi
setne cl
xor eax, eax
cmp eax, edi
mov byte [ebx + 4], cl
sbb eax, eax
and eax, 0x10000
push eax
xor eax, eax
cmp eax, edi
push ebx
sbb eax, eax
push 0x45c7e0
and eax, edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x45c865
push 8
push ebx
call fcn.0047faf4
pop ecx
pop ecx
xor al, al
jmp 0x45c876
test esi, esi
je 0x45c86d
mov dword [esi], eax
jmp 0x45c874
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x45c9a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
or dword [esp + 4], 0xffffffff
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x45c9f6
push str.slot_____DWORD_0xFFFFFFFF_
lea edx, [esp + 8]
call fcn.0045c8f9
mov dword [esp + 8], eax
pop ecx
test eax, eax
je 0x45c9f6
lea eax, [esp + 4]
push eax
push 0x12
push str.C:jenkinsworkspaceClientClientWindows_releasecommonclientutility_srcCmmThreadLocal_win.cc
lea ecx, [esp + 0x14]
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_logging::LogMessage::constructor_char_const___int__struct_logging::CheckOpString_const__
lea ecx, [esp + 8]
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_logging::LogMessage::destructor_void_
mov esp, ebp
pop ebp
ret

Function at 0x45fdd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_tinyxml2::XMLDocument::Clear_void_
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0048e1e7
push edi
call fcn.0048b85d
add esp, 0x10
cmp eax, 0xffffffff
jne 0x45fe08
push edi
call fcn.00493e51
pop ecx
test eax, eax
je 0x45fe08
push ebx
push ebx
jmp 0x45fe82
push 2
push ebx
push edi
call fcn.0048e1e7
push edi
call fcn.00493e46
push 0
cdq
push 0
push edi
mov ebx, eax
mov dword [ebp - 4], edx
call fcn.0048e1e7
mov edx, dword [ebp - 4]
mov ecx, ebx
and ecx, edx
add esp, 0x1c
cmp ecx, 0xffffffff
jne 0x45fe3c
push 0
push 0
jmp 0x45fe82
xor ecx, ecx
cmp edx, ecx
ja 0x45fe80
cmp ebx, 0xffffffff
jae 0x45fe80
mov eax, ebx
or eax, edx
jne 0x45fe53
push ecx
push ecx
push 0xd
jmp 0x45fe84
lea eax, [ebx + 1]
push eax
call fcn.004800e5
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call fcn.0048ddd5
add esp, 0x14
cmp eax, ebx
jne 0x45fe36
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call sym.ZoomOutlookMAPI.exe_private:_void___thiscall_tinyxml2::XMLDocument::Parse_void_
jmp 0x45fe8d
push ecx
push ecx
push 5
push esi
call sym.ZoomOutlookMAPI.exe_private:_void___cdecl_tinyxml2::XMLDocument::SetError_enum_tinyxml2::XMLError__int__char_const__
add esp, 0x10
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4603f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x40], 0
je 0x46040e
push dword [ecx + 0x40]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0048c519
add esp, 0x10
jmp 0x460449
push esi
lea esi, [ecx + 0xd0]
mov eax, dword [esi + 0x1c]
mov ecx, esi
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
push eax
call fcn.00452aff
mov ecx, dword [esi + 0x1c]
push edi
push dword [ebp + 8]
lea eax, [ecx + edi]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
lea esi, [ecx - 1]
add esi, eax
push esi
call fcn.00481c60
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
ret 8
Function at 0x464f20
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x4b122d
call fcn.004803aa
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov esi, vtable.Cmm::CStringT_char_.0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
mov dword [ebp - 4], ebx
mov eax, 0x5915b4
cmp dword [0x5915c8], 0x10
cmovae eax, dword [0x5915b4]
push eax
lea eax, [ebp - 0x2c]
push str.CCmmPerfTelemetry::PerfTelemetryTerm_pID:__s
push eax
call sym.ZoomOutlookMAPI.exe_public:_void___cdecl_Cmm::CStringT_char_::Format_char_const__
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [sym.ZoomOutlookMAPI.exe_struct_HINSTANCE____CCmmPerfTelemetry::hPsapi_]
test eax, eax
je 0x464f96
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [sym.ZoomOutlookMAPI.exe_struct_HINSTANCE____CCmmPerfTelemetry::hPsapi_], ebx
call sym.ZoomOutlookMAPI.exe_private:_static_void___cdecl_CCmmPerfTelemetry::CleanUpData_void_
push 0x4c52bf
mov ecx, sym.ZoomOutlookMAPI.exe_class_Cmm::CStringT_char__CCmmPerfTelemetry::pID_
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CStringT_char_::Assign_char_const__
mov dword [sym.ZoomOutlookMAPI.exe_int_CCmmPerfTelemetry::bMetricsInitialzed], ebx
xor al, al
mov dword [sym.ZoomOutlookMAPI.exe_int_CCmmPerfTelemetry::bMetricsEnabled_], ebx
mov ecx, 0x581090
xchg byte [ecx], al
cmp dword [0x5915ac], 0
je 0x464fde
push dword [0x58108c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, sym.ZoomOutlookMAPI.exe_class_Cmm::CThread_CCmmPerfTelemetry::work_thread_
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CThread::Join_void_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
call fcn.004081cd
call fcn.00480359
ret

Function at 0x464ff0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x58005c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x48], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x44]
mov dword [esi], eax
cmp dword [sym.ZoomOutlookMAPI.exe_struct_HINSTANCE____CCmmPerfTelemetry::hPsapi_], 0
je 0x46506f
cmp dword [sym.ZoomOutlookMAPI.exe_int____stdcall___void___struct__PROCESS_MEMORY_COUNTERS___unsigned_long_int__CCmmPerfTelemetry::pfnGetProcessMemoryInfo_], 0
je 0x46506f
push 0x28
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.ZoomOutlookMAPI.exe_int____stdcall___void___struct__PROCESS_MEMORY_COUNTERS___unsigned_long_int__CCmmPerfTelemetry::pfnGetProcessMemoryInfo_]
mov ecx, esi
push eax
call dword [0x4b4460]
call esi
xor esi, esi
test eax, eax
je 0x46506b
push esi
push 0x64
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.00480730
or eax, edx
je 0x46506b
mov esi, dword [ebp - 0x64]
shr esi, 0x14
mov dword [edi], esi
jmp 0x465072
and dword [edi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.0047f860
leave
ret
Function at 0x46c006
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0
je 0x46c055
push ebx
push edi
mov edi, dword [ebp + 8]
push 2
push 0
push 0
push dword [esi + 0x28]
lea ebx, [edi + 0x10]
mov eax, dword [ebx]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [edi + 0x14], 0x10
jb 0x46c038
mov edi, dword [edi]
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx]
push edi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x20], eax
add dword [esi + 0x24], eax
pop edi
pop ebx
pop esi
leave
ret 4