joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402060
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1790]
mov eax, 0x1810
call fcn.00412f50
mov eax, dword [0x41b044]
xor eax, ebp
mov dword [ebp + 0x178c], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x7c], ebx
test esi, esi
jl 0x4022c4
cmp esi, dword [ebx + 8]
jge 0x4022c4
mov eax, dword [ebx]
imul esi, esi, 0x80c
cmp byte [ebp + 0x1798], 0
je 0x4020b7
mov dword [esi + eax + 0x804], 2
jmp 0x4020c2
mov dword [esi + eax + 0x804], 3
mov eax, dword [ebx]
push edi
lea edi, [esi + eax]
cmp dword [edi + 0x808], 1
jne 0x4022c3
push 0x7ff
lea eax, [ebp - 0x73]
push 0
push eax
mov byte [ebp - 0x74], 0
call fcn.00407320
push 0x417ebc
add edi, 0x400
push edi
call fcn.00407289
add esp, 0x14
mov dword [ebp - 0x78], eax
test eax, eax
je 0x4021ab
push eax
mov edi, 0x800
push edi
lea eax, [ebp - 0x74]
push 1
push eax
call fcn.00407d85
push dword [ebp - 0x78]
mov dword [ebp - 0x80], eax
call fcn.004076f9
add esp, 0x14
cmp dword [ebp - 0x80], 0
jle 0x4021ab
cmp dword [ebp - 0x80], edi
jge 0x40213a
mov byte [ebp + 0x78b], 0
lea eax, [ebp - 0x74]
push str.Package_url
push eax
call fcn.00407090
pop ecx
pop ecx
mov dword [ebp - 0x78], eax
test eax, eax
je 0x4021ab
push 0x417ed0
push eax
call fcn.00407090
pop ecx
pop ecx
test eax, eax
je 0x402165
mov byte [eax], 0
mov ebx, 0x3ff
push ebx
lea eax, [ebp + 0xf8d]
push 0
push eax
mov byte [ebp + 0xf8c], 0
call fcn.00407320
push ebx
lea eax, [ebp + 0x138d]
push 0
push eax
mov byte [ebp + 0x138c], 0
call fcn.00407320
add esp, 0x18
lea edi, [ebp + 0xf8c]
call fcn.004032b9
test al, al
jne 0x4021bd
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebx]
mov dword [esi + eax + 0x804], 3
jmp 0x4022c3
lea eax, [ebp + 0xf8c]
push eax
mov esi, 0x400
lea eax, [ebp + 0x138c]
push esi
push eax
call fcn.004075bd
push 0x417d60
lea eax, [ebp + 0x138c]
push esi
push eax
call fcn.004075bd
push str.Zoom.msi
lea eax, [ebp + 0x138c]
push esi
push eax
call fcn.004075bd
mov eax, dword [ebp - 0x78]
mov edi, dword [ebp - 0x7c]
add esp, 0x24
push 0
push 0x517500
lea ecx, [ebp + 0x138c]
add eax, 0xc
push ecx
push eax
mov dword [ebp - 0x78], eax
call fcn.00401f69
push ebx
xor edi, edi
lea eax, [ebp + 0xb8d]
push edi
push eax
mov byte [ebp + 0xb8c], 0
call fcn.00407320
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp + 0xb8c]
push esi
push eax
call fcn.00407da2
push str._Installer.exe
lea eax, [ebp + 0xb8c]
push esi
push eax
call fcn.004075bd
push ebx
lea eax, [ebp + 0x78d]
push edi
push eax
mov byte [ebp + 0x78c], 0
call fcn.00407320
push dword [ebp - 0x78]
lea eax, [ebp + 0x78c]
push esi
push eax
call fcn.00407da2
lea eax, [ebp + 0x78c]
push str.Zoom.msi_tatupg
push eax
call fcn.00407090
add esp, 0x44
cmp eax, edi
je 0x4022c3
push str.Installer.exe_tatupg
push 0x16
push eax
call fcn.00407da2
add esp, 0xc
push edi
mov edi, dword [ebp - 0x7c]
push 0xc3800
lea eax, [ebp + 0xb8c]
push eax
lea eax, [ebp + 0x78c]
push eax
call fcn.00401f69
pop edi
mov ecx, dword [ebp + 0x178c]
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e30
add ebp, 0x1790
leave
ret 4
Function at 0x402f92
Capabilities:
Get common file path

Disassembly:
push 0x10c
mov eax, 0x415afd
call fcn.00414bf3
xor esi, esi
push 0x800
mov dword [0x41dddc], esi
mov dword [0x41dde0], esi
mov dword [0x41dde4], esi
mov dword [0x41dde8], esi
call fcn.00406eda
pop ecx
mov dword [0x41dddc], eax
cmp eax, esi
je 0x40302a
push 4
push esi
push eax
call fcn.00407320
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x41dddc]
lea eax, [ebp - 0x114]
push esi
push 0x417f30
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x18
call fcn.00408220
pop ecx
mov dword [ebp - 0x118], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x403023
push eax
call fcn.0040242c
jmp 0x403025
xor eax, eax
mov dword [0x41dde8], eax
mov eax, 0x41dddc
call fcn.00414c76
ret

Function at 0x4030bb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
mov edi, 0x20019
push edi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call esi
test eax, eax
je 0x4030f4
xor al, al
jmp 0x403174
lea eax, [ebp - 8]
push eax
push edi
push ebx
push str.ATTMeetings
push dword [ebp - 4]
call esi
test eax, eax
jne 0x40313c
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push ebx
push str.InstallLocation
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40313c
cmp dword [ebp - 0xc], 1
je 0x403158
cmp dword [ebp - 0xc], 2
je 0x403158
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x40314c
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], ebx
je 0x4030ed
push dword [ebp - 8]
call esi
jmp 0x4030ed
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x403168
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], ebx
je 0x403172
push dword [ebp - 8]
call esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40317b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x415b39
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x41b044]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x4031c7
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 4], ebx
jne 0x403201
push 0x20
call fcn.00408220
mov edi, eax
pop ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x38], ebx
cmp edi, ebx
je 0x4031f3
push 0x1c
push ebx
push edi
mov dword [edi + 0x1c], ebx
call fcn.00407320
add esp, 0xc
jmp 0x4031f5
xor edi, edi
or dword [esp + 0x38], 0xffffffff
mov dword [esi + 4], edi
cmp edi, ebx
je 0x4031b0
lea eax, [esp + 0x14]
push eax
call fcn.0040242c
push dword [ebp + 8]
mov dword [esp + 0x3c], 1
call fcn.004030bb
mov edi, 0x110
test al, al
je 0x403278
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push dword [esi + 4]
mov edx, 0x417cc6
call fcn.004046f8
test eax, eax
je 0x403278
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
mov ecx, edi
cdq
idiv ecx
test eax, eax
je 0x403278
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._CPluginImpHelper::GetInstallPath__Get_Install_Path:
call esi
push dword [ebp + 8]
call esi
mov bl, 1
or dword [esp + 0x38], 0xffffffff
lea eax, [esp + 0x14]
push eax
call fcn.00402689
mov al, bl
jmp 0x4031b2
lea eax, [esp + 0x14]
push eax
push dword [esi + 4]
call fcn.004049c1
test eax, eax
je 0x403262
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cdq
idiv edi
cmp eax, ebx
je 0x403262
ja 0x40329f
call fcn.00408178
mov eax, dword [esp + 0x20]
add eax, 8
push eax
push 0x400
push dword [ebp + 8]
call fcn.00407da2
add esp, 0xc
jmp 0x403260

Function at 0x4032b9
Capabilities:
Create directory
Get common file path

Disassembly:
push 1
push 0x1a
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4032cd
xor al, al
ret
push ebx
push ebp
push esi
mov ebp, 0x417e70
push ebp
mov esi, 0x400
push esi
push edi
call fcn.004075bd
push str.ATTMeetings
push esi
push edi
call fcn.004075bd
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x18
push 0
push edi
call ebx
push ebp
push esi
push edi
call fcn.004075bd
push str.ZoomDownload
push esi
push edi
call fcn.004075bd
add esp, 0x18
push 0
push edi
call ebx
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x40383f
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xd0
mov eax, dword [0x41b044]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
xor ebx, ebx
mov byte [edi], 1
mov byte [eax], bl
mov esi, 0x9c
push esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
push ebx
mov byte [ecx], bl
push eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], edx
mov byte [edx], bl
call fcn.00407320
add esp, 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x4038a8
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x94
call esi
test eax, eax
jne 0x4038a8
xor al, al
jmp 0x403903
mov eax, dword [ebp - 0x1c]
sub eax, ebx
je 0x4038d9
dec eax
je 0x4038d9
dec eax
jne 0x4038db
cmp dword [ebp - 0x28], 6
jb 0x4038c5
cmp dword [ebp - 0x24], ebx
jne 0x4038db
mov eax, dword [ebp - 0x38]
jmp 0x4038ce
cmp dword [ebp - 0x28], 5
jne 0x4038d3
mov eax, dword [ebp - 0x34]
mov byte [eax], 1
jmp 0x4038db
cmp dword [ebp - 0x28], 4
ja 0x4038db
mov byte [edi], bl
push 0x24
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.00407320
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x5c], 9
jne 0x403901
mov eax, dword [ebp - 0x30]
mov byte [eax], 1
mov al, 1
mov ecx, dword [ebp + 0x70]
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e30
add ebp, 0x74
leave
ret 4

Function at 0x403f40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x41b044]
xor eax, esp
mov dword [esp + 0x250], eax
push esi
push 0x103
lea eax, [esp + 0x14d]
push 0
push eax
mov byte [esp + 0x154], 0
call fcn.00407320
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x403f96
xor al, al
jmp 0x403fcd
push str.winsxsx86_microsoft.vc90.crt_
lea eax, [esp + 0x14c]
push esi
push eax
call fcn.004075bd
add esp, 0xc
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403f92
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x254]
pop esi
xor ecx, esp
call fcn.00406e30
mov esp, ebp
pop ebp
ret
Function at 0x40445e
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x29c]
sub esp, 0x31c
mov eax, dword [0x41b044]
xor eax, ebp
mov dword [ebp + 0x298], eax
mov eax, dword [ebp + 0x2a4]
and dword [esi], 0
push ebx
mov ebx, ecx
push edi
mov dword [ebp - 0x80], eax
cmp ebx, 6
ja 0x40464c
lea eax, [eax + ebx*4]
mov dword [ebp - 0x7c], eax
mov eax, dword [eax]
test eax, eax
je 0x4044a7
mov dword [esi], eax
xor eax, eax
jmp 0x40464f
mov edi, 0x400
push edi
call fcn.00406eda
pop ecx
mov dword [esi], eax
test eax, eax
jne 0x4044c1
push 2
pop eax
jmp 0x40464f
push edi
push 0
push eax
call fcn.00407320
mov eax, ebx
add esp, 0xc
sub eax, 0
mov ebx, 0x417e70
je 0x4045f2
dec eax
je 0x4045ec
dec eax
je 0x4045e6
dec eax
je 0x4045ce
dec eax
je 0x4045c8
dec eax
je 0x40450c
dec eax
jne 0x404615
push 1
push 0x2a
jmp 0x4045f6
push 0x103
lea eax, [ebp - 0x73]
push 0
push eax
mov byte [ebp - 0x74], 0
call fcn.00407320
add esp, 0xc
push 0x104
lea eax, [ebp - 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x404615
push 0x103
lea eax, [ebp + 0x91]
push 0
push eax
mov byte [ebp + 0x90], 0
call fcn.00407320
push 0x103
lea eax, [ebp + 0x195]
push 0
push eax
mov byte [ebp + 0x194], 0
call fcn.00407320
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, 0x104
push eax
lea ecx, [ebp + 0x194]
push ecx
push eax
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00408b1b
lea eax, [ebp + 0x90]
push eax
push edi
push dword [esi]
call fcn.004075bd
add esp, 0x48
lea eax, [ebp + 0x194]
push eax
push edi
push dword [esi]
call fcn.004075bd
add esp, 0xc
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x1c], 1
jne 0x404624
push str.RoomConnector
jmp 0x404629
push 1
push 0x20
jmp 0x4045f6
push dword [esi]
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x78], eax
jmp 0x40460f
push 1
push 0x26
jmp 0x4045f6
push 1
push 0x1c
jmp 0x4045f6
push 1
push 0x1a
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebx
push edi
push dword [esi]
mov dword [ebp - 0x78], eax
call fcn.004075bd
add esp, 0xc
cmp dword [ebp - 0x78], 0
jne 0x4045b8
push dword [esi]
call fcn.0040739a
pop ecx
push 3
jmp 0x4044bb
push str.ATTMeetings
push edi
push dword [esi]
call fcn.004075bd
add esp, 0xc
push ebx
push edi
push dword [esi]
call fcn.004075bd
mov eax, dword [esi]
mov ecx, dword [ebp - 0x7c]
add esp, 0xc
mov dword [ecx], eax
jmp 0x4044a0
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x298]
pop edi
xor ecx, ebp
pop ebx
call fcn.00406e30
add ebp, 0x29c
leave
ret 4
Function at 0x404668
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x41b044]
xor eax, ebp
mov dword [ebp - 4], eax
test edi, edi
je 0x4046ea
test ebx, ebx
je 0x4046ea
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00407320
push edi
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.00407da2
push 0x417e70
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.004075bd
push ebx
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.004075bd
add esp, 0x30
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop esi
mov eax, ecx
jmp 0x4046ec
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406e30
leave
ret
Function at 0x4046f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
mov eax, dword [0x41b044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
push edi
mov esi, edx
mov dword [ebp - 0x524], eax
test ebx, ebx
je 0x4048cd
test esi, esi
je 0x4048cd
mov edi, 0x3ff
push edi
lea eax, [ebp - 0x407]
push 0
push eax
mov byte [ebp - 0x408], 0
call fcn.00407320
add esp, 0xc
push ebx
lea eax, [ebp - 0x408]
push edi
push eax
call fcn.00407da2
add esp, 0xc
push esi
lea eax, [ebp - 0x408]
push edi
push eax
call fcn.004075bd
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4048cd
test al, 0x10
je 0x4048cd
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 1
lea edi, [ebp - 0x408]
jne 0x4047ec
mov ebx, str.RoomConnector.exe
call fcn.00404668
mov ebx, str.gateway_conf_client.dll
mov esi, eax
call fcn.00404668
mov ebx, str.gmcm.dll
mov dword [ebp - 0x520], eax
call fcn.00404668
mov ebx, str.gviper.dll
mov dword [ebp - 0x51c], eax
call fcn.00404668
xor ecx, ecx
cmp esi, ecx
je 0x4048cd
cmp dword [ebp - 0x520], ecx
je 0x4048cd
cmp dword [ebp - 0x51c], ecx
jmp 0x404856
mov ebx, str.OfficeAtHandMeetings.exe
call fcn.00404668
mov esi, eax
test esi, esi
jne 0x40480e
mov ebx, str.Zoom.exe
lea edi, [ebp - 0x408]
call fcn.00404668
mov esi, eax
mov ebx, str.zChatApp.dll
lea edi, [ebp - 0x408]
call fcn.00404668
mov ebx, str.zVideoApp.dll
mov dword [ebp - 0x51c], eax
call fcn.00404668
mov ebx, str.Cmmlib.dll
mov dword [ebp - 0x520], eax
call fcn.00404668
xor ecx, ecx
cmp esi, ecx
je 0x4048cd
cmp dword [ebp - 0x51c], ecx
je 0x4048cd
cmp dword [ebp - 0x520], ecx
je 0x4048cd
cmp eax, ecx
je 0x4048cd
mov edi, 0x104
push edi
push ecx
lea eax, [ebp - 0x510]
push eax
mov dword [ebp - 0x518], ecx
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x40c], ecx
call fcn.00407320
lea eax, [ebp - 0x408]
add esp, 0xc
push eax
mov dword [ebp - 0x514], 1
call fcn.00407f90
inc eax
cmp eax, edi
pop ecx
jl 0x4048a4
xor eax, eax
jmp 0x4048d0
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x510]
push edi
push eax
call fcn.00407da2
mov esi, dword [ebp - 0x524]
add esp, 0xc
lea eax, [ebp - 0x518]
push eax
call fcn.00404a1e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e30
leave
ret 8
Function at 0x404fdc
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x204
mov eax, dword [0x41b044]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x68
push dword [esi + 0xc]
call ebp
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0
mov ebx, 0x80
push ebx
push dword [esi + 4]
call edi
push 0x67
push dword [esi + 0xc]
call ebp
push eax
push 1
push ebx
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push dword [esi + 4]
call ebx
mov ebp, eax
test ebp, ebp
je 0x40506b
push 0x1ff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.00407320
lea eax, [esp + 0x18]
push eax
push 0x6c
call fcn.004043d5
add esp, 0x14
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x3e9
push dword [esi + 4]
call ebx
xor ebx, ebx
cmp eax, ebx
je 0x4050ad
push 0x64
push ebx
push 0x406
push eax
call edi
push ebx
push 0x64
push 0x2710
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push esi
call fcn.0040576e
cmp dword [esi + 4], ebx
je 0x4050ad
cmp dword [esi + 0x10], ebx
je 0x4050ad
push esi
call fcn.00405128
mov ecx, dword [esp + 0x20c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406e30
add esp, 0x204
ret

Function at 0x405128
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x10]
push esi
mov esi, dword [eax + 8]
xor edx, edx
test esi, esi
jle 0x405151
mov ecx, dword [eax]
add ecx, 0x804
cmp dword [ecx], 0
je 0x405151
inc edx
add ecx, 0x80c
cmp edx, esi
jl 0x405141
cmp edx, esi
jne 0x405158
or edx, 0xffffffff
cmp edx, 0xffffffff
je 0x4051cc
test edx, edx
jl 0x4051cc
cmp edx, esi
jge 0x4051cc
mov esi, dword [eax]
mov ecx, edx
imul ecx, ecx, 0x80c
add esi, ecx
cmp edx, dword [eax + 8]
push ebx
lea ebx, [esi + 0x400]
jge 0x40518a
mov eax, dword [eax]
mov dword [eax + ecx + 0x804], 1
push 0x10
call fcn.00408220
pop ecx
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x4051a4
push edi
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, ecx
pop edi
test eax, eax
je 0x4051cb
mov ecx, dword [esp + 0xc]
push eax
push 0
push 0x4050c5
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0x418384
mov dword [eax + 0xc], ecx
call fcn.00408e1b
add esp, 0xc
pop ebx
pop esi
ret 4
Function at 0x4056b4
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov esi, ecx
test ebx, ebx
je 0x4056c8
push str.CDownloadDialog::DownloadComplete__success
jmp 0x4056cd
push str.CDownloadDialog::DownloadComplete__fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x405731
mov ecx, edi
call fcn.004022dd
cmp eax, 0xffffffff
je 0x405731
test ebx, ebx
setne cl
movzx ecx, cl
push ecx
mov ecx, eax
mov edx, edi
call fcn.00402060
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 8]
xor edx, edx
test ecx, ecx
jle 0x40572a
mov eax, dword [eax]
add eax, 0x804
mov edi, dword [eax]
cmp edi, 2
je 0x405720
cmp edi, 3
jne 0x405737
inc edx
add eax, 0x80c
cmp edx, ecx
jl 0x405714
push 0
call fcn.004051d0
pop edi
pop esi
pop ebx
ret 4
test ebx, ebx
je 0x40572a
push esi
call fcn.00405128
jmp 0x405731

Function at 0x405885
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.WinMain_start__lpCmdLine_is:
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x4058a5
mov eax, str.NULL
push eax
call esi
push str.WinMain_start__parameter_is:
call esi
push str.package.nameZoom.msipackage.versionlatestpackage.size12753kdownloadRoothttps:__ringcentral_officeathand_att.zoom.us_clientactionjoinbrowserchromeconfidXOuRU23iS2SDE_2BMOfExb9Q_3D_3Dconfno1469282687zc0mcv0.92.11227.0929stafalseinstaller.exeInstaller.exe
call esi
push 0x460
call fcn.00408220
pop ecx
cmp eax, edi
je 0x4058d1
mov ecx, dword [esp + 0xc]
push eax
call fcn.004059b9
jmp 0x4058d3
xor eax, eax
push str.ATT_Downloader_Mutex_1.0.0.0_by_Zoom
push edi
push 0x1f0001
mov dword [0x41ddd8], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
je 0x4058f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4058ff
call fcn.00406daf
test eax, eax
jne 0x40591f
push edi
push str.ATT_Boot_Downloader_by_Zoom
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x40596e
push edi
push edi
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40596e
mov ecx, dword [esp + 0x14]
call fcn.00405e75
mov eax, dword [0x41dddc]
cmp eax, edi
je 0x40593e
push eax
call fcn.0040739a
pop ecx
mov dword [0x41dddc], edi
mov eax, dword [0x41dde8]
mov dword [0x41dde4], edi
cmp eax, edi
je 0x405952
call fcn.0040250b
mov eax, dword [0x41ddd8]
cmp eax, edi
je 0x405961
push eax
call fcn.00405975
push str.WinMain_end
mov dword [0x41ddd8], edi
call esi
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x406557
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41b044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test ebx, ebx
je 0x4065d4
test edi, edi
je 0x4065d4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.CZpDownloadMgr::FindParam
call esi
push ebx
call esi
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.00407320
add esp, 0xc
lea eax, [ebp - 0x804]
mov ecx, edi
call fcn.004064b2
test al, al
je 0x4065c5
lea eax, [ebp - 0x804]
push eax
call esi
lea edi, [ebp - 0x804]
jmp 0x4065c8
push edi
call esi
push ebx
mov esi, 0x41dddc
call fcn.0040331e
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00406e30
leave
ret