joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002888
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x390
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x380], rax
and qword [r8], 0
mov rdi, r8
movsxd rbx, edx
mov r14, rcx
cmp ebx, 6
ja 0x140002a9b
mov rax, qword [rcx + rbx*8]
mov rbp, rbx
test rax, rax
je 0x1400028da
mov qword [r8], rax
xor eax, eax
jmp 0x140002aa0
mov r12d, 0x400
mov ecx, r12d
call fcn.140009584
mov r8d, r12d
mov qword [rdi], rax
xor edx, edx
mov rcx, rax
call fcn.14000aca0
lea r13, [0x140029588]
test ebx, ebx
je 0x140002a5d
sub ebx, 1
je 0x140002a55
sub ebx, 1
je 0x140002a4d
sub ebx, 1
je 0x140002a36
sub ebx, 1
je 0x140002a2e
sub ebx, 1
je 0x140002942
cmp ebx, 1
jne 0x140002a8c
lea r8d, [rbx + 0x29]
jmp 0x140002a63
mov ebx, 0x104
lea rcx, [rsp + 0x50]
mov r8d, ebx
xor edx, edx
call fcn.14000aca0
mov r8d, ebx
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140002a8c
mov r8d, ebx
lea rcx, [rsp + 0x160]
xor edx, edx
call fcn.14000aca0
mov r8d, ebx
lea rcx, [rsp + 0x270]
xor edx, edx
call fcn.14000aca0
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x270]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x160]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x28], 0
mov r8d, ebx
mov qword [rsp + 0x20], rbx
call fcn.14000ee4c
mov rcx, qword [rdi]
lea r8, [rsp + 0x160]
mov rdx, r12
call fcn.14000e858
mov rcx, qword [rdi]
lea r8, [rsp + 0x270]
mov rdx, r12
call fcn.14000e858
cmp dword [r14 + 0x38], 1
lea rax, [0x1400295a0]
mov rcx, qword [rdi]
lea r8, str.RoomConnector
cmovne r8, rax
mov rdx, r12
call fcn.14000e858
mov rcx, qword [rdi]
mov r8, r13
mov rdx, r12
call fcn.14000e858
mov rax, qword [rdi]
mov qword [r14 + rbp*8], rax
jmp 0x1400028d3
mov r8d, 0x20
jmp 0x140002a63
mov rdx, qword [rdi]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
setne bl
jmp 0x140002a84
mov r8d, 0x26
jmp 0x140002a63
mov r8d, 0x1c
jmp 0x140002a63
mov r8d, 0x1a
mov rdx, qword [rdi]
mov r9d, 1
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov rcx, qword [rdi]
mov r8, r13
mov rdx, r12
mov ebx, eax
call fcn.14000e858
test ebx, ebx
jne 0x1400029f2
mov rcx, qword [rdi]
call fcn.14000929c
mov eax, 3
jmp 0x140002aa0
mov eax, 1
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.140009240
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x390
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140002ac8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x430
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140002b56
test rdx, rdx
je 0x140002b56
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call fcn.14000aca0
mov r8, rdi
lea rcx, [rsp + 0x20]
mov edi, 0x3ff
mov edx, edi
call fcn.14000e7f8
lea r8, [0x140029588]
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14000e858
mov r8, rbx
lea rcx, [rsp + 0x20]
mov edx, edi
call fcn.14000e858
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140002b56
mov eax, 1
jmp 0x140002b58
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140009240
mov rbx, qword [rsp + 0x450]
add rsp, 0x430
pop rdi
ret
Function at 0x140002b7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rbp + 0x440], rax
xor r15d, r15d
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140002cda
test rbx, rbx
je 0x140002cda
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x400
call fcn.14000aca0
mov r8, rsi
lea rcx, [rbp + 0x40]
mov esi, 0x3ff
mov edx, esi
call fcn.14000e7f8
mov r8, rbx
lea rcx, [rbp + 0x40]
mov edx, esi
call fcn.14000e858
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140002cda
test al, 0x10
je 0x140002cda
cmp dword [r14 + 0x38], 1
lea rcx, [rbp + 0x40]
jne 0x140002d05
lea rdx, str.RoomConnector.exe
call fcn.140002ac8
lea rdx, str.gateway_conf_client.dll
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.140002ac8
lea rdx, str.gmcm.dll
mov r14d, eax
lea rcx, [rbp + 0x40]
call fcn.140002ac8
lea rdx, str.gviper.dll
lea rcx, [rbp + 0x40]
mov esi, eax
call fcn.140002ac8
test ebx, ebx
je 0x140002cda
test r14d, r14d
je 0x140002cda
test esi, esi
je 0x140002cda
test eax, eax
je 0x140002cda
mov ebx, 0x104
mov dword [rbp + 0x38], r15d
mov r8d, ebx
mov qword [rbp + 0x2e], r15
xor edx, edx
mov byte [rbp + 0x2c], r15b
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], r15
call fcn.14000aca0
mov edx, ebx
mov dword [rsp + 0x24], 1
lea rcx, [rbp + 0x40]
call fcn.14000e14c
inc rax
cmp rax, rbx
jae 0x140002d80
lea r8, [rbp + 0x40]
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.14000e7f8
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140003140
mov eax, 1
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140009240
mov rbx, qword [rsp + 0x580]
add rsp, 0x550
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp dword [r14 + 0x38], 2
jne 0x140002d43
lea rdx, str.Controller.exe
call fcn.140002ac8
lea rdx, str.Cmmlib.dll
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.140002ac8
lea rdx, str.zrc_sdk.dll
mov esi, eax
lea rcx, [rbp + 0x40]
call fcn.140002ac8
test ebx, ebx
jmp 0x140002c6f
lea rdx, str.Zoom.exe
call fcn.140002ac8
lea rdx, str.zChatApp.dll
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.140002ac8
lea rdx, str.zVideoApp.dll
mov r14d, eax
lea rcx, [rbp + 0x40]
call fcn.140002ac8
lea rdx, str.Cmmlib.dll
jmp 0x140002c5d
xor eax, eax
jmp 0x140002cdf
Function at 0x1400048b8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov edi, 1
cmp dword [rcx + 0x28], ebp
jne 0x140004a56
lea rcx, [0x14002ada0]
call fcn.14000384c
test rax, rax
je 0x14000490d
xor edx, edx
lea rcx, str.wininet.dll
mov r8d, 0x800
call qword [0x140022570]
mov rsi, rax
test rax, rax
jne 0x140004946
lea rcx, [0x14002ad90]
call fcn.14000384c
test rax, rax
jne 0x140004931
lea ecx, [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rbx + 0x28], edi
xor eax, eax
jmp 0x140004ab1
lea rcx, str.wininet.dll
call qword [0x140022570]
mov rsi, rax
test rax, rax
je 0x140004927
lea rdx, str.InternetTimeFromSystemTime
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpQueryInfoA
mov rcx, rsi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetConnectA
mov rcx, rsi
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCrackUrlA
mov rcx, rsi
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rsi
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpOpenRequestA
mov rcx, rsi
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetErrorDlg
mov rcx, rsi
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetSetCookieA
mov rcx, rsi
mov qword [rbx + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpAddRequestHeadersA
mov rcx, rsi
mov qword [rbx + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.HttpSendRequestA
mov rcx, rsi
mov qword [rbx + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenA
mov rcx, rsi
mov qword [rbx + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rsi
mov qword [rbx + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetTimeToSystemTime
mov rcx, rsi
mov qword [rbx + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x90], rax
mov dword [rbx + 0x28], edi
cmp qword [rbx + 0x30], rbp
je 0x140004aad
cmp qword [rbx + 0x38], rbp
je 0x140004aad
cmp qword [rbx + 0x40], rbp
je 0x140004aad
cmp qword [rbx + 0x48], rbp
je 0x140004aad
cmp qword [rbx + 0x50], rbp
je 0x140004aad
cmp qword [rbx + 0x58], rbp
je 0x140004aad
cmp qword [rbx + 0x60], rbp
je 0x140004aad
cmp qword [rbx + 0x68], rbp
je 0x140004aad
cmp qword [rbx + 0x70], rbp
je 0x140004aad
cmp qword [rbx + 0x78], rbp
je 0x140004aad
cmp qword [rbx + 0x80], rbp
je 0x140004aad
cmp qword [rbx + 0x88], rbp
je 0x140004aad
cmp qword [rbx + 0x90], rbp
jne 0x140004aaf
mov edi, ebp
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004fc8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x10], 0
lea rax, [rbp + 0x10]
and qword [rbp - 0x10], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov ebx, r9d
mov qword [rsp + 0x20], rax
mov rdi, r8
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400050c1
mov rcx, qword [rbp + 0x10]
lea rax, [rbp - 0x10]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ZoomUMX
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400050a3
and dword [rbp + 0x30], eax
lea r9, [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLocation
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400050a3
mov eax, dword [rbp + 0x30]
dec eax
cmp eax, 1
ja 0x1400050a3
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140005090
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000509f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400050c3
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400050b2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400050c1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400050d4
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
test r8, r8
je 0x140005162
mov r9d, 1
mov rdx, rbx
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140005162
mov edi, 0x400
lea r8, [0x140029588]
mov edx, edi
mov rcx, rbx
call fcn.14000e858
lea r8, [0x1400295a0]
mov edx, edi
mov rcx, rbx
call fcn.14000e858
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, [0x140029588]
mov edx, edi
mov rcx, rbx
call fcn.14000e858
lea r8, str.ZoomDownload
mov edx, edi
mov rcx, rbx
call fcn.14000e858
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, 1
jmp 0x140005164
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400069e8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x20]
xor eax, eax
mov rsi, rcx
movsxd rdx, dword [r9 + 0xc]
test edx, edx
jle 0x140006a2b
mov rcx, qword [r9]
xor r8d, r8d
add rcx, 0x804
cmp dword [rcx], 0
je 0x140006a2b
inc eax
inc r8
add rcx, 0x80c
cmp r8, rdx
jl 0x140006a15
cmp eax, edx
je 0x140006a8f
cmp eax, 0xffffffff
je 0x140006a8f
test eax, eax
js 0x140006a8f
cmp eax, edx
jge 0x140006a8f
cdqe
imul rcx, rax, 0x80c
mov rax, qword [r9]
lea rdi, [rcx + rax]
mov dword [rcx + rax + 0x804], 1
mov ecx, 0x20
lea rbx, [rdi + 0x400]
call fcn.140009548
lea rcx, [0x14002b460]
mov r8, rax
xor edx, edx
mov qword [rax + 0x10], rcx
lea rcx, [0x140006930]
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x18], rsi
call fcn.140012cdc
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140007030
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.CDownloadDialog::DownloadComplete__success
mov edi, edx
test edx, edx
jne 0x140007051
lea rcx, str.CDownloadDialog::DownloadComplete__fail
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400070ec
movsxd r8, dword [rcx + 0xc]
xor edx, edx
test r8d, r8d
jle 0x140007090
mov rax, qword [rcx]
xor r9d, r9d
add rax, 0x804
cmp dword [rax], 1
je 0x140007090
inc edx
inc r9
add rax, 0x80c
cmp r9, r8
jl 0x14000707b
cmp edx, r8d
je 0x1400070ec
cmp edx, 0xffffffff
je 0x1400070ec
test edi, edi
setne r8b
call fcn.140007478
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x34], eax
mov rax, qword [rbx + 0x20]
movsxd rcx, dword [rax + 0xc]
test ecx, ecx
jle 0x1400070e2
mov rax, qword [rax]
mov r8, rcx
xor edx, edx
lea rcx, [rax + 0x804]
mov eax, dword [rcx]
sub eax, 2
cmp eax, 1
ja 0x1400070f7
inc rdx
add rcx, 0x80c
cmp rdx, r8
jl 0x1400070c9
xor edx, edx
mov rcx, rbx
call fcn.140006aa0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1400070e2
mov rcx, rbx
call fcn.1400069e8
jmp 0x1400070ec
Function at 0x140007478
Capabilities:
Read file on windows

Disassembly:
test edx, edx
js 0x140007716
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1740]
mov eax, 0x1840
call fcn.1400212c0
sub rsp, rax
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rbp + 0x1730], rax
xor r15d, r15d
mov rdi, rcx
cmp edx, dword [rcx + 0xc]
jge 0x1400076f1
movsxd rax, edx
imul rbx, rax, 0x80c
mov rax, qword [rdi]
movzx ecx, r8b
xor ecx, 1
add ecx, 2
mov dword [rbx + rax + 0x804], ecx
mov rsi, qword [rdi]
cmp dword [rbx + rsi + 0x808], 1
jne 0x1400076f1
xor edx, edx
lea rcx, [rbp + 0xf30]
mov r8d, 0x800
call fcn.14000aca0
lea rcx, [rsi + 0x400]
add rcx, rbx
lea rdx, [0x14002b638]
call fcn.14000ef74
mov rsi, rax
test rax, rax
je 0x1400076e3
mov r9, rax
lea edx, [r15 + 1]
mov r8d, 0x800
lea rcx, [rbp + 0xf30]
call fcn.140013048
mov rcx, rsi
mov r14, rax
call fcn.14000f0a4
test r14d, r14d
jle 0x1400076e3
movzx ecx, byte [rbp + 0x172f]
lea rdx, str.Package_url
cmp r14d, 0x800
cmovl ecx, r15d
mov byte [rbp + 0x172f], cl
lea rcx, [rbp + 0xf30]
call fcn.14000b6e8
mov rsi, rax
test rax, rax
je 0x1400076e3
lea rdx, [0x14002b650]
mov rcx, rax
call fcn.14000b6e8
test rax, rax
je 0x1400075a1
mov byte [rax], r15b
mov r14d, 0x400
lea rcx, [rbp + 0x330]
mov r8d, r14d
xor edx, edx
call fcn.14000aca0
mov r8d, r14d
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14000aca0
lea r8, [rbp + 0x330]
call fcn.1400050d4
test al, al
je 0x1400076e3
lea r8, [rbp + 0x330]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14000e858
lea r8, [0x14002ae4c]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14000e858
lea r8, str.Zoom.msi
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14000e858
mov r9d, 0x517500
mov dword [rsp + 0x20], r15d
lea r8, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsi + 0xc]
call fcn.1400072d4
mov r8d, r14d
lea rcx, [rbp + 0x730]
xor edx, edx
call fcn.14000aca0
lea r8, [rbp + 0x330]
mov edx, r14d
lea rcx, [rbp + 0x730]
call fcn.14000e7f8
lea r8, str._Installer.exe
mov edx, r14d
lea rcx, [rbp + 0x730]
call fcn.14000e858
mov r8d, r14d
lea rcx, [rbp + 0xb30]
xor edx, edx
call fcn.14000aca0
lea r8, [rsi + 0xc]
mov edx, r14d
lea rcx, [rbp + 0xb30]
call fcn.14000e7f8
lea rdx, str.Zoom.msi_tatupg
lea rcx, [rbp + 0xb30]
call fcn.14000b6e8
test rax, rax
je 0x1400076f1
lea r8, str.Installer.exe_tatupg
mov edx, 0x16
mov rcx, rax
call fcn.14000e7f8
mov r9d, 0xc3800
mov dword [rsp + 0x20], r15d
lea r8, [rbp + 0x730]
mov rcx, rdi
lea rdx, [rbp + 0xb30]
call fcn.1400072d4
jmp 0x1400076f1
mov rax, qword [rdi]
mov dword [rbx + rax + 0x804], 3
mov rcx, qword [rbp + 0x1730]
xor rcx, rsp
call fcn.140009240
mov rbx, qword [rsp + 0x1880]
add rsp, 0x1840
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007718
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r8
lea rcx, str.WinMain_start__lpCmdLine_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebp, ebp
lea rcx, str.NULL
test rsi, rsi
cmovne rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.WinMain_start__parameter_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.installer.exeInstaller.exepackage.nameZoom.msipackage.versionlatestpackage.size4980kdownloadRoothttps:__www.zoom.us_client
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x478
call fcn.140009548
mov rdi, rax
xor edx, edx
lea rax, vtable.CZpDownloadMgr.0
mov r8d, 0x400
lea rcx, [rdi + 8]
mov qword [rdi], rax
lea rax, vtable.CDownloadDialog.0
mov qword [rcx + 8], rbp
mov qword [rcx], rax
mov dword [rcx + 0x10], ebp
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov dword [rcx + 0x30], ebp
mov dword [rcx + 0x38], 0x131a230
mov qword [0x140033040], rcx
lea rcx, [rdi + 0x62]
mov qword [rdi + 0x48], rbp
mov qword [rdi + 0x50], rbp
mov dword [rdi + 0x58], ebp
mov word [rdi + 0x60], bp
mov qword [rdi + 0x468], rbp
mov byte [rdi + 0x470], bpl
call fcn.14000aca0
lea r8, str.zoom.us_Downloader_Mutex_1.0.0.0
mov qword [0x140033048], rdi
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x14000780e
mov rcx, rax
jmp 0x1400078a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.zoom.us_Downloader_Mutex_1.0.0.0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000789d
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000789d
mov r8, rsi
call fcn.140007d0c
mov rcx, qword [0x140033038]
mov dword [0x140033030], ebp
test rcx, rcx
je 0x140007866
call fcn.140004c20
mov rbx, qword [0x140033048]
test rbx, rbx
je 0x140007887
mov rcx, rbx
call fcn.1400078e8
mov edx, 0x478
mov rcx, rbx
call fcn.14000929c
lea rcx, str.WinMain_end
mov qword [0x140033048], rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1400078ce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.zoom.us_Boot_Downloader
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400078ce
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e9
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008414
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
je 0x140008546
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x64030
call fcn.1400212c0
sub rsp, rax
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x64020], rax
mov rsi, r8
mov rbp, rdx
test r8, r8
je 0x14000851f
lea rcx, str.CZpDownloadMgr::FindParam
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x64000
call fcn.14000aca0
xor r14d, r14d
lea rdi, [rsp + 0x20]
mov al, byte [rsi]
inc rsi
test al, al
je 0x1400084fd
cmp al, 0x25
jne 0x1400084e3
movsx ecx, byte [rsi]
call fcn.14001339c
movsx ecx, byte [rsi + 1]
mov ebx, eax
call fcn.14001339c
add rsi, 2
mov ecx, eax
test bl, bl
je 0x1400084fd
test cl, cl
je 0x1400084fd
cmp bl, 0x39
jle 0x1400084c6
lea eax, [rbx - 0x61]
cmp al, 5
ja 0x1400084f1
sub bl, 7
shl bl, 4
cmp cl, 0x39
jg 0x1400084d2
mov al, 0xd0
jmp 0x1400084db
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1400084f1
mov al, 0xa9
add cl, bl
add cl, al
mov byte [rdi], cl
jmp 0x1400084ee
cmp al, 0x2b
jne 0x1400084ec
mov byte [rdi], 0x20
jmp 0x1400084ee
mov byte [rdi], al
inc rdi
inc r14d
cmp r14d, 0x63fff
jb 0x140008489
lea rcx, [rsp + 0x20]
mov byte [rdi], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r8, [rsp + 0x20]
mov rdx, rbp
lea rcx, [0x140033028]
call fcn.140005170
mov rcx, qword [rsp + 0x64020]
xor rcx, rsp
call fcn.140009240
lea r11, [rsp + 0x64030]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140008c20
Capabilities:
Get common file path
Print debug messages

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x30]
mov rdi, 0xffffffff80000002
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFF66E9F6_83E7_3A3E_AF14_8DE9A809A6A4
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140008cde
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9A25302D_30C0_39D9_BD6F_21E6EC160475
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140008cde
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall1F1C2DFC_2D24_3E06_BCB8_725134ADF989
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140008cde
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9BE518E6_ECC6_35A9_88E4_87755C07200F
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140008d52
mov edi, 0x104
lea rcx, [rsp + 0x180]
mov r8d, edi
xor edx, edx
call fcn.14000aca0
mov edx, edi
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140008d52
lea r8, str.winsxsx86_microsoft.vc90.crt_
mov edx, edi
lea rcx, [rsp + 0x180]
call fcn.14000e858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140008d52
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, str._CZpDownloadMgr::NeedDownloadVCRed__return_true
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x140008d61
lea rcx, str._CZpDownloadMgr::NeedDownloadVCRed__return_false
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140009240
add rsp, 0x2a0
pop rdi
ret