joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e85c
Capabilities:
Delete file

Disassembly:
push 0x260
mov eax, 0x4653d5
call fcn.0044584f
mov edi, dword [ebp + 8]
xor eax, eax
cmp edx, 3
sete al
test eax, eax
jne 0x40e8a1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.___________CiscoWebExUpdate_process_start__PID___d___BAD_command_line_arguments______________
push 0
push 8
push str.CiscoWebExUpdate.cpp
push 0x2b
call fcn.0042ab69
add esp, 0x18
or eax, 0xffffffff
jmp 0x40ea64
push 0x104
lea eax, [ebp - 0x21c]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00401720
mov esi, str..tmp
mov dword [ebp - 4], ebx
push esi
call fcn.004012f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x234]
call fcn.00402a5c
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x234]
cmovae ecx, dword [ebp - 0x234]
call fcn.0040b2ae
test eax, eax
je 0x40e91c
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
mov dword [ebp - 0x26c], 0x47f81c
mov esi, ebx
mov dword [ebp - 0x258], ebx
movdqu xmmword [ebp - 0x268], xmm0
mov dword [ebp - 0x254], ebx
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 1
push eax
call fcn.0040e709
push 0x270
call fcn.004428fc
pop ecx
test eax, eax
je 0x40e99e
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [eax + 4], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x20], ecx
xor ecx, ecx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x264], 1
mov word [eax + 0x24], cx
mov word [eax + 0x224], cx
mov dword [eax], vtable.CMainFrame.0
mov dword [eax + 0x268], ebx
mov dword [eax + 0x26c], ebx
jmp 0x40e9a0
mov eax, ebx
mov dword [0x495674], eax
test eax, eax
je 0x40ea01
push edi
push ecx
call fcn.0041410a
test eax, eax
jne 0x40e9b8
mov esi, ebx
jmp 0x40ea06
mov eax, dword [0x495674]
push ebx
mov esi, dword [eax + 4]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x495674]
mov ecx, dword [eax + 0x268]
test ecx, ecx
je 0x40e9e3
call fcn.0041712e
lea ecx, [ebp - 0x26c]
call fcn.0040e4c2
mov ecx, dword [0x495674]
mov esi, eax
test ecx, ecx
je 0x40ea01
mov eax, dword [ecx]
push 1
call dword [eax + 4]
call fcn.0040e75f
cmp dword [ebp - 0x25c], 0
je 0x40ea21
push dword [ebp - 0x25c]
call fcn.0044294d
pop ecx
mov dword [ebp - 0x25c], ebx
cmp dword [ebp - 0x268], 0
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
je 0x40ea48
push dword [ebp - 0x268]
call fcn.0044294d
pop ecx
mov dword [ebp - 0x268], ebx
push ebx
push 1
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
call fcn.00401833
mov eax, esi
call fcn.004457fe
ret
Function at 0x40eaa1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [0x491330]
xor eax, esp
mov dword [esp + 0xdc], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.___________CiscoWebExUpdate_process_start__PID___d____________
xor esi, esi
push esi
push 2
push str.CiscoWebExUpdate.cpp
push 0x54
call fcn.0042ab69
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [0x495678], eax
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 8
push eax
mov dword [esp + 0x18], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub esp, 0xc
call fcn.0040e5e4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push ecx
push ecx
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00409cb1
mov edx, str.___________CiscoWebExUpdate_process_start_with
lea ecx, [esp + 0x28]
call fcn.0040a9e0
xor edi, edi
inc edi
cmp dword [esp + 0xc], edi
jle 0x40eb6d
lea ecx, [esp + 0x28]
call fcn.0040ee17
mov edx, dword [esi + edi*4]
mov ecx, eax
call fcn.0040a9e0
inc edi
cmp edi, dword [esp + 0xc]
jl 0x40eb53
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409d83
cmp dword [eax + 0x14], 8
jb 0x40eb86
mov eax, dword [eax]
push eax
push 0
push 2
push str.CiscoWebExUpdate.cpp
push 0x7a
call fcn.0042ab69
add esp, 0x14
lea ecx, [esp + 0xcc]
push 0
push 1
call fcn.00401833
mov edx, dword [esp + 0xc]
push esi
call fcn.0040e85c
mov edi, eax
pop ecx
test esi, esi
je 0x40ebc2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0040e677
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0042e137
mov ecx, eax
call fcn.0042e0a2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push edi
push str.___________CiscoWebExUpdate_process_exit_with___d___PID___d____________
push 0
push 2
push str.CiscoWebExUpdate.cpp
push 0x88
call fcn.0042ab69
add esp, 0x1c
lea ecx, [esp + 0x18]
call fcn.004094f8
mov ecx, dword [esp + 0xe4]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00441f6f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ff90
Capabilities:
Read file on windows

Disassembly:
push 0x234
mov eax, 0x465543
call fcn.0044584f
mov dword [ebp - 0x240], edx
mov esi, ecx
push str._WebexVersionTag_
lea ecx, [ebp - 0x22c]
call fcn.004016e7
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x14], 8
jb 0x40ffc4
mov esi, dword [esi]
push 0x47fcf0
push esi
call fcn.00442a17
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40fff6
push 2
push edi
push esi
call fcn.00444bf5
push esi
call fcn.00444aae
mov ebx, eax
add esp, 0x10
test ebx, ebx
jns 0x41001c
push esi
call fcn.00442ba7
pop ecx
mov dword [ebp - 0x230], edi
push edi
push 1
lea ecx, [ebp - 0x22c]
call fcn.004017ef
mov eax, dword [ebp - 0x230]
lea esp, [ebp - 0x250]
call fcn.004457fe
ret
push edi
push edi
push esi
call fcn.00444bf5
push ebx
mov dword [ebp - 0x230], edi
call fcn.004413a2
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4101ad
mov eax, dword [ebp - 0x21c]
push esi
push ebx
push 1
push edi
mov dword [ebp - 0x238], eax
call fcn.00444672
add esp, 0x10
cmp ebx, eax
je 0x41006c
push edi
call fcn.004427e1
push esi
call fcn.00442ba7
pop ecx
pop ecx
xor edi, edi
jmp 0x40fff6
and dword [ebp - 0x23c], 0
lea eax, [edi + ebx]
mov edx, edi
cmp edi, eax
jmp 0x4100ca
cmp dword [ebp - 0x218], 0x10
lea eax, [ebp - 0x22c]
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x22c]
mov ecx, ebx
sub ecx, dword [ebp - 0x23c]
push eax
mov eax, dword [ebp - 0x238]
cmp ecx, eax
cmovl eax, ecx
push eax
push edx
call fcn.004014d1
add esp, 0x10
test eax, eax
je 0x4100d7
mov edx, dword [ebp - 0x234]
lea eax, [edi + ebx]
inc edx
inc dword [ebp - 0x23c]
cmp edx, eax
mov dword [ebp - 0x234], edx
jb 0x41007c
jmp 0x4101a6
xor eax, eax
push 0x1fc
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00447ae0
mov ecx, dword [ebp - 0x234]
mov eax, edi
mov edx, dword [ebp - 0x238]
sub eax, ecx
sub eax, edx
add eax, ebx
mov ebx, 0xff
cmp eax, ebx
cmovb ebx, eax
mov dword [ebp - 0x234], ebx
lea ebx, [ecx + edx]
push ebx
push 0
call fcn.00429ff7
add esp, 0x14
test eax, eax
jg 0x410131
and dword [ebp - 0x230], 0
jmp 0x410146
push ebx
push 0
call fcn.00429ff7
pop ecx
pop ecx
call fcn.00448470
mov dword [ebp - 0x230], esp
push dword [ebp - 0x234]
push ebx
push 0
call fcn.00429ff7
shr eax, 1
push eax
push dword [ebp - 0x230]
push ebx
push 0
call fcn.00429fa9
add esp, 0x18
push eax
lea eax, [ebp - 0x214]
push 0xff
push eax
call fcn.00441f7e
lea eax, [ebp - 0x214]
push eax
call fcn.004012f1
mov ecx, dword [ebp - 0x240]
add esp, 0x14
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00401a41
mov dword [ebp - 0x230], 1
push edi
call fcn.004427e1
pop ecx
push esi
call fcn.00442ba7
pop ecx
xor edi, edi
jmp 0x40fffc
Function at 0x411603
Capabilities:
Get file size

Disassembly:
push 4
mov eax, 0x4657c4
call fcn.0044581c
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
xor edi, edi
lea eax, [ebp + 0xc]
push edi
push edi
push 3
push edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x20], 8
push edi
cmovae eax, dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41164b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x20], 8
lea esi, [ebp + 0xc]
lea edx, [ebx + 0xe0]
cmovae esi, dword [ebp + 0xc]
cmp dword [edx + 0x14], 8
jb 0x411664
mov edx, dword [edx]
lea ecx, [ebx + 0x6c]
cmp dword [ecx + 0x14], 8
jb 0x41166f
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x10]
add eax, 0x20
cmp dword [eax + 0x14], 8
jb 0x41167d
mov eax, dword [eax]
push edi
push dword [ebx + 0x64]
push esi
push edx
push ecx
push eax
push str._IsNeedUpdateByCheckingSize____s____s____s____s___SERVER__d_______LOCAL__d_
push 0
push 2
pop esi
push esi
push str.FileListMgr.cpp
push 0x1b9
call fcn.0042ab69
add esp, 0x2c
cmp edi, dword [ebx + 0x64]
jne 0x4116b5
mov eax, dword [ebp - 0x10]
xor esi, esi
cmp dword [eax + 0x100], esi
jne 0x4116b5
inc esi
push 0
push 1
lea ecx, [ebp + 0xc]
call fcn.00401833
mov eax, esi
call fcn.004457ea
ret 0x1c
Function at 0x4148f8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov esi, eax
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.00447ae0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x414951
xor eax, eax
jmp 0x414981
cmp dword [ebp - 0x228], edi
je 0x414974
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x414951
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41494d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441f6f
mov esp, ebp
pop ebp
ret

Function at 0x414991
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
jne 0x4149af
xor eax, eax
jmp 0x414a19
push ebx
push esi
xor esi, esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.00447ae0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x414a17
cmp dword [ebp - 0x228], edi
je 0x414a0b
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4149ef
jmp 0x414a0e
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00441f6f
mov esp, ebp
pop ebp
ret
Function at 0x415b6f
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x180]
test eax, eax
je 0x415b8c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x180], ebx
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x415b99
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], ebx
test ecx, ecx
je 0x415baa
mov eax, dword [ecx]
push 1
call dword [eax + 0x38]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], ebx
test ecx, ecx
je 0x415bba
mov eax, dword [ecx]
push 1
call dword [eax]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esi + 0x14], ebx
cmp dword [esi + 4], ebx
je 0x415bda
lea eax, [esi + 0x98]
cmp dword [eax + 0x14], 8
jb 0x415bd7
mov eax, dword [eax]
push eax
call edi
cmp dword [esi + 0x150], ebx
je 0x415bf3
lea eax, [esi + 0x140]
cmp dword [eax + 0x14], 8
jb 0x415bf0
mov eax, dword [eax]
push eax
call edi
cmp dword [esi + 0x168], ebx
je 0x415c0c
lea eax, [esi + 0x158]
cmp dword [eax + 0x14], 8
jb 0x415c09
mov eax, dword [eax]
push eax
call edi
pop edi
jmp 0x4abcf0
Function at 0x41a35e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x24
mov eax, 0x465849
call fcn.0044584f
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
jne 0x41a37a
xor eax, eax
jmp 0x41a4df
cmp dword [edi + 0x3c], ebx
je 0x41a373
cmp dword [edi + 0x84], ebx
je 0x41a373
push dword [edi]
lea ecx, [ebp - 0x2c]
call fcn.00401720
mov esi, 0x481ce4
mov dword [ebp - 4], ebx
push esi
call fcn.004012f1
pop ecx
push eax
or ebx, 0xffffffff
lea ecx, [ebp - 0x2c]
push ebx
push esi
call fcn.00402904
cmp eax, ebx
je 0x41a3c3
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
xor edx, edx
mov word [ecx + eax*2], dx
push 1
push ebx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x2f
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402904
mov ecx, eax
cmp ecx, ebx
jne 0x41a3fe
push 1
push ebx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x5c
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402904
mov ecx, eax
xor eax, eax
cmp ecx, ebx
cmove ecx, eax
test ecx, ecx
je 0x41a403
inc ecx
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
lea ebx, [edi + 0x44]
cmovae eax, dword [ebp - 0x2c]
lea esi, [eax + ecx*2]
push esi
call fcn.004012f1
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.00401a41
push 1
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x2e
push eax
mov ecx, ebx
call fcn.00404813
cmp eax, 0xffffffff
je 0x41a452
cmp dword [ebx + 0x14], 8
jb 0x41a449
mov ecx, dword [ebx]
jmp 0x41a44b
mov ecx, ebx
push 0x5f
pop edx
mov word [ecx + eax*2], dx
push 0x47b858
call fcn.004012f1
pop ecx
push eax
push 0x47b858
lea ecx, [edi + 0x74]
call fcn.00402a5c
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [edi + 0x74]
call fcn.004029b6
lea esi, [edi + 0x5c]
lea eax, [edi + 0x74]
cmp esi, eax
je 0x41a48e
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00401bb1
mov ebx, 0x47b858
push ebx
call fcn.004012f1
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00402a5c
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x2c]
mov ecx, esi
push eax
call fcn.004029b6
cmp dword [esi + 0x14], 8
jb 0x41a4ba
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a4cf
test al, 0x10
jne 0x41a4cf
xor esi, esi
inc esi
jmp 0x41a4d1
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401833
mov eax, esi
call fcn.004457fe
ret
Function at 0x41a4e5
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x6c], 0
je 0x41a567
call fcn.00401ff1
test eax, eax
je 0x41a50b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.0040278d
test eax, eax
jne 0x41a567
lea eax, [esi + 0x74]
cmp dword [eax + 0x14], 8
jb 0x41a516
mov eax, dword [eax]
push eax
call fcn.0040b2d9
add esi, 0x5c
pop ecx
cmp dword [esi + 0x14], 8
jb 0x41a52a
mov eax, dword [esi]
jmp 0x41a52c
mov eax, esi
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41a56e
cmp dword [esi + 0x14], 8
jb 0x41a544
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Copy_err__d____s_
push 0
push 8
push 0x481ce8
push 0xa5
call fcn.0042ab69
add esp, 0x1c
xor eax, eax
pop esi
pop ebp
ret 4
xor eax, eax
inc eax
jmp 0x41a569

Function at 0x41aa88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
jmp loc.004af5f8
Function at 0x41b73a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x41b75f
xor eax, eax
jmp 0x41b82c
mov ebx, 0x480920
push ebx
push edi
call dword [esi + 0x20]
push eax
push 0xfde9
call fcn.00429f83
pop ecx
pop ecx
test eax, eax
jg 0x41b77e
xor ebx, ebx
jmp 0x41b797
push ebx
push edi
call dword [esi + 0x20]
push eax
push 0xfde9
call fcn.00429f83
pop ecx
pop ecx
call fcn.00448470
mov ebx, esp
push 0x480920
push edi
call dword [esi + 0x20]
push eax
push 0xfde9
call fcn.00429f83
pop ecx
pop ecx
push 0x480920
shr eax, 1
push edi
mov dword [ebp - 0x11c], eax
call dword [esi + 0x20]
test eax, eax
je 0x41b7d4
push dword [ebp - 0x11c]
mov edx, ebx
mov ecx, eax
call fcn.0040b5c3
pop ecx
jmp 0x41b7d6
xor eax, eax
test eax, eax
je 0x41b829
cmp word [eax], 0x39
jne 0x41b829
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x41b829
cmp dword [ebp - 0x110], 0
jne 0x41b829
push str.MTD_win2000__FF__dont_support
push 0
push 1
push str..._atgpcextgpcdldapi.cpp
push 0x143
call fcn.0042ab69
add esp, 0x14
jmp 0x41b758
xor eax, eax
inc eax
lea esp, [ebp - 0x128]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441f6f
mov esp, ebp
pop ebp
ret

Function at 0x41bffc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, 0x206
mov word [ebp - 0x214], ax
push edi
push eax
lea eax, [ebp - 0x212]
push eax
call fcn.00447ae0
xor eax, eax
push edi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.00447ae0
add esp, 0x18
mov ecx, esi
call fcn.0040ac7a
lea eax, [ebp - 0x41c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x214]
push eax
push 0
push 0x482384
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x41c091
push ecx
lea eax, [ebp - 0x214]
push eax
call fcn.0040c066
pop ecx
pop ecx
lea eax, [ebp - 0x214]
mov ecx, esi
push eax
call fcn.0040ac93
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00441f6f
mov esp, ebp
pop ebp
ret 4
Function at 0x41c10e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x64], 0xffffffff
jne 0x41c133
lea eax, [esi + 0x48]
push eax
call fcn.0041c0b1
mov dword [esi + 0x64], eax
xor edi, edi
and dword [ebp - 4], edi
cmp dword [esi + 0x64], 0xffffffff
je 0x41c154
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov eax, dword [ebp + 0xc]
add dword [esi + 0x50], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x41c189
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MTD_Operate_file_fail:_d__URL:__s
push edi
push 8
push 0x482354
push 0x100
call fcn.0042ab69
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41c991
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 0x20]
mov dword [esi + 0x28], 4
push eax
push edi
push esi
push 0x41c982
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x41c9dd
mov dword [esi + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MTD_Create_thread_fail.__d
push edi
push 8
push str..._atgpcextgpcdldbase.cpp
push 0x33
call fcn.0042ab69
add esp, 0x18
xor eax, eax
jmp 0x41c9ef
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x1c]
pop edi
pop esi
ret

Function at 0x41c9f2
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x1c], esi
je 0x41ca82
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x28], 8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x24], 0
je 0x41ca28
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
xor esi, esi
push esi
push 0x12
push edi
call fcn.0041cb5f
push esi
push 0xc8
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x41ca79
push dword [edi + 0x20]
push str.Terminate_thread_without_waiting.__d
push esi
push 8
push str..._atgpcextgpcdldbase.cpp
push 0x4b
call fcn.0042ab69
add esp, 0x18
push esi
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [edi + 0x24], esi
je 0x41ca79
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x24], 0
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
je 0x41ca97
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x24], esi
pop edi
pop esi
ret
Function at 0x41d0ad
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, ecx
call fcn.0041cf32
mov eax, dword [0x495af4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
jne 0x41d0da
or eax, 1
mov dword [0x495af4], eax
call ebx
mov dword [0x495af8], eax
call ebx
sub eax, dword [0x495af8]
cmp eax, 0x2710
jbe 0x41d0fe
mov ecx, edi
call fcn.0041cf92
mov ecx, edi
call fcn.0041d046
call ebx
mov dword [0x495af8], eax
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [edi + 0x20], eax
jle 0x41d191
lea ecx, [edi + 0x18]
push esi
push eax
call fcn.0040aee0
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x41d13b
push str.null_of_thread
push eax
push 4
push str..._atgpcextgpcdldthread.cpp
push 0x145
call fcn.0042ab69
add esp, 0x14
jmp 0x41d181
lea eax, [esi + 4]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x30]
push dword [ebp - 4]
mov esi, dword [esi + 0x34]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x41d166
cmp dword [ebp - 0xc], 0
je 0x41d166
call ebx
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x10]
call fcn.0041d596
call ebx
mov eax, dword [ebp - 8]
lea ecx, [edi + 0x18]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [edi + 0x20]
jl 0x41d110
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dd6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
mov esi, ecx
xor ecx, ecx
push ecx
push str.SoftwareWebex_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ddfa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.GPCDebug
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ddf1
cmp dword [ebp - 8], 4
jne 0x41ddf1
push str.Using_debug_flag:_GPCDebug__in__HKLM__SoftwareWebex_
push eax
push 4
push str..._atgpcextgpcdldthread.cpp
push 0x3af
call fcn.0042ab69
add esp, 0x14
cmp dword [ebp - 0xc], 0
jbe 0x41ddf1
mov dword [esi + 0x58], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x58], 0
jne 0x41de75
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareWebex_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41de75
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.GPCDebug
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41de6c
cmp dword [ebp - 8], 4
jne 0x41de6c
push str.Using_debug_flag:_GPCDebug__in__HKCU__SoftwareWebex_
push eax
push 4
push str..._atgpcextgpcdldthread.cpp
push 0x3c4
call fcn.0042ab69
add esp, 0x14
cmp dword [ebp - 0xc], 0
jbe 0x41de6c
mov dword [esi + 0x58], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret