joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4157b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4662b8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
cmp dword [edi + 0x18], 0
jne 0x415943
lea esi, [esp + 0x48]
call fcn.00415460
push 0x12
push str.dtl_connection.dll
mov eax, esi
mov dword [esp + 0x78], 0
call fcn.0040d290
mov eax, dword [esp + 0x4c]
mov ebx, 0x10
cmp dword [esp + 0x60], ebx
jae 0x41581c
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov eax, dword [esp + 0x4c]
jne 0x41585c
cmp dword [esp + 0x60], ebx
jae 0x415835
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x10]
push str.Unable_to_locate__s
push eax
mov ecx, str...commondtl_access.cpp_114_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea ecx, [esp + 0x10]
push ecx
call fcn.00451e1b
cmp dword [esp + 0x60], ebx
jae 0x415866
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [edi + 0x18], eax
jne 0x4158a9
cmp dword [esp + 0x60], ebx
mov eax, dword [esp + 0x4c]
jae 0x415882
lea eax, [esp + 0x4c]
push eax
lea edx, [esp + 0x10]
push str.LoadLibrary_failed___s_
push edx
mov ecx, str...commondtl_access.cpp_120_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea eax, [esp + 0x10]
push eax
call fcn.00451e1b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DllGetClassObject
push eax
call esi
test eax, eax
mov dword [edi + 0x1c], eax
jne 0x4158f3
cmp dword [esp + 0x60], ebx
mov eax, dword [esp + 0x4c]
jae 0x4158cc
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x10]
push str.GetProcAddress_failed:_DllGetClassObject___s_
push ecx
mov ecx, str...commondtl_access.cpp_126_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea edx, [esp + 0x10]
push edx
call fcn.00451e1b
mov eax, dword [edi + 0x18]
push str.DllCanUnloadNow
push eax
call esi
test eax, eax
mov dword [edi + 0x20], eax
jne 0x41593a
cmp dword [esp + 0x60], ebx
mov eax, dword [esp + 0x4c]
jae 0x415913
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x10]
push str.GetProcAddress_failed:_DllCanUnloadNow___s_
push ecx
mov ecx, str...commondtl_access.cpp_132_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea edx, [esp + 0x10]
push edx
call fcn.00451e1b
lea ecx, [esp + 0x48]
call fcn.00402620
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0044e7cc
add esp, 0x68
ret
Function at 0x4162c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x466273
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x74], eax
push ebp
push esi
push edi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x98]
cmp dword [ebp + 0xc], 0
jne 0x4164a7
lea esi, [esp + 0x10]
call fcn.00415460
push eax
mov edi, str.dtl_messaging.dll
lea esi, [esp + 0x6c]
mov dword [esp + 0x94], 0
call fcn.004164d0
add esp, 4
mov edi, 0x10
mov byte [esp + 0x90], 2
cmp dword [esp + 0x28], edi
jb 0x41634b
mov eax, dword [esp + 0x14]
push eax
call fcn.0044e982
add esp, 4
cmp dword [esp + 0x80], edi
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jae 0x416371
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov eax, dword [esp + 0x6c]
jne 0x4163b4
cmp dword [esp + 0x80], edi
jae 0x41638d
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x30]
push str.Unable_to_locate__s
push ecx
mov ecx, str...commondtl_access.cpp_387_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea edx, [esp + 0x30]
push edx
call fcn.00451e1b
cmp dword [esp + 0x80], edi
jae 0x4163c1
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x416407
cmp dword [esp + 0x80], edi
mov eax, dword [esp + 0x6c]
jae 0x4163e0
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x30]
push str.LoadLibrary_failed___s_
push eax
mov ecx, str...commondtl_access.cpp_393_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea ecx, [esp + 0x30]
push ecx
call fcn.00451e1b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DllGetClassObject
push eax
call esi
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x416454
cmp dword [esp + 0x80], edi
mov eax, dword [esp + 0x6c]
jae 0x41642d
lea eax, [esp + 0x6c]
push eax
lea edx, [esp + 0x30]
push str.GetProcAddress_failed:_DllGetClassObject___s_
push edx
mov ecx, str...commondtl_access.cpp_399_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea eax, [esp + 0x30]
push eax
call fcn.00451e1b
mov ecx, dword [ebp + 0xc]
push str.DllCanUnloadNow
push ecx
call esi
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x41649e
cmp dword [esp + 0x80], edi
mov eax, dword [esp + 0x6c]
jae 0x416477
lea eax, [esp + 0x6c]
push eax
lea edx, [esp + 0x30]
push str.GetProcAddress_failed:_DllCanUnloadNow___s_
push edx
mov ecx, str...commondtl_access.cpp_405_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea eax, [esp + 0x30]
push eax
call fcn.00451e1b
lea ecx, [esp + 0x68]
call fcn.00402620
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0044e7cc
add esp, 0x84
ret 4
Function at 0x4165e0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5a8
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x5a4], eax
push esi
push edi
mov esi, ebx
call fcn.00416580
push str.localhost
lea eax, [esp + 0x1ac]
push 0x400
push eax
call fcn.0044fbc2
lea eax, [esp + 0x1b4]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x416627
sub eax, edx
lea esi, [eax + 1]
push esi
call fcn.0044e554
lea ecx, [esp + 0x1ac]
push ecx
mov edi, eax
push esi
push edi
call fcn.0044fbc2
add esp, 0x10
lea edx, [esp + 0x18]
push edx
push 2
mov dword [ebx], edi
mov dword [ebx + 8], 0
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x416743
push 0x400
lea eax, [esp + 0x1ac]
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x41673e
lea ecx, [esp + 0x1a8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x41673e
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x4166b1
add dword [ebx + 8], 1
add eax, 4
cmp dword [eax], 0
jne 0x4166a5
mov eax, dword [ebx + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044e554
mov dword [ebx + 4], eax
mov esi, dword [esi + 0xc]
mov eax, dword [esi]
add esp, 4
test eax, eax
mov dword [esp + 0x10], esi
je 0x41673e
mov dword [esp + 0xc], 0
mov eax, dword [eax]
push eax
call sub.WS2_32.dll_inet_ntoa
test eax, eax
mov dword [esp + 0x14], eax
je 0x41672b
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4166f8
sub eax, edx
lea edi, [eax + 1]
push edi
call fcn.0044e554
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
push edi
push esi
call fcn.0044fbc2
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x1c]
mov dword [eax + edx], esi
mov esi, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [esi + 4]
add dword [esp + 0xc], 4
add esi, 4
test eax, eax
mov dword [esp + 0x10], esi
jne 0x4166e5
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [esp + 0x5ac]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.0044e7cc
mov esp, ebp
pop ebp
ret

Function at 0x4178b0
Capabilities:
Terminate process

Disassembly:
push str.Starting_Fuse_Service
call fcn.004167d0
mov eax, dword [esp + 8]
add esp, 4
push eax
call fcn.00419250
test al, al
jne 0x4178df
push str.Cannot_start_SOAP_server__exiting
call fcn.004167d0
add esp, 4
push 0
call fcn.0044fb36
push str.Clearing_starting_event...
call fcn.004167d0
mov eax, dword [0x4817b8]
add esp, 4
cmp eax, 0xffffffff
je 0x417923
test eax, eax
je 0x417923
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x417919
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CXHandle::Close___:_CloseHandle_failed_with_error__i._n
call fcn.004167d0
add esp, 8
mov dword [0x4817b8], 0xffffffff
ret
Function at 0x4179a0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x467e58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push str.Sending_command_to_running_Fuse_service
call fcn.004167d0
add esp, 4
call fcn.00408640
test al, al
jne 0x4179ef
push str.Fuse_service_is_not_running__exiting
call fcn.004167d0
add esp, 4
push 0
call fcn.0044fb36
lea edi, [esp + 0x10]
call fcn.00417360
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
test esi, esi
mov edi, str.http:__127.0.0.1:65259_
mov dword [esp + 0x18], edi
je 0x417a29
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x30]
push edi
mov ecx, esi
call fcn.004349b0
add esp, 8
test eax, eax
je 0x417a49
mov eax, str.cm__SendCommand
mov ecx, esi
call fcn.00449a00
push str.Command_sending_failed
call fcn.004167d0
add esp, 4
push 0
call fcn.0044fb36
push str.Command_sent_to_Fuse_service_successfully
call fcn.004167d0
call fcn.0043d630
mov eax, esi
call fcn.0043e200
mov eax, esi
call fcn.0043b820
push esi
call fcn.0044ecaf
add esp, 8
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x419090
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push edi
mov edi, ecx
lea ecx, [esp + 8]
push ecx
push 0
push edi
push 0x419080
push 0
push 0
mov dword [edi + 0x173b8], eax
mov byte [edi + 0x174cc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4190d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateThread_failed__error__i
call fcn.004167d0
add esp, 8
xor al, al
pop edi
ret 4
push ebx
push esi
xor esi, esi
cmp byte [edi + 0x174c9], 0
jne 0x419111
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
cmp byte [edi + 0x174cc], 0
je 0x419111
push 0x32
call ebx
add esi, 1
cmp esi, 0xc8
jg 0x41911d
cmp byte [edi + 0x174c9], 0
je 0x4190f0
mov al, byte [edi + 0x174cc]
pop esi
pop ebx
pop edi
ret 4
pop esi
pop ebx
xor al, al
pop edi
ret 4
Function at 0x423220
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push str.InstPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42327f
mov eax, dword [esp + 8]
cmp eax, 1
je 0x42325d
cmp eax, 2
jne 0x42326f
test esi, esi
mov eax, dword [esp]
je 0x42327b
test eax, eax
je 0x423278
cmp byte [eax + esi - 1], 0
je 0x42327b
mov eax, 0xd
pop ecx
ret 4
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop ecx
ret 4
Function at 0x4239c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x518
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x514], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x115]
push ebx
mov dword [esp + 0x10], ebx
push eax
mov byte [esp + 0x11c], bl
call fcn.00454a00
push 0x103
lea ecx, [esp + 0x325]
push ebx
push ecx
mov byte [esp + 0x32c], bl
call fcn.00454a00
mov eax, dword [0x482ebc]
add esp, 0x18
push 0x104
lea edx, [esp + 0x318]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea ecx, [esp + 0x11]
push ebx
push ecx
mov byte [esp + 0x18], bl
call fcn.00454a00
push 0xff
lea edx, [esp + 0x225]
push ebx
push edx
mov byte [esp + 0x20], bl
mov word [esp + 0x21], bx
mov byte [esp + 0x22c], bl
call fcn.00454a00
push ebx
push ebx
push ebx
push ebx
push 0x100
lea eax, [esp + 0x240]
push eax
push 3
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x34c]
push edx
call fcn.00450381
push ebx
push ebx
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x58]
push 0x104
push edx
call fcn.0045025f
lea eax, [esp + 0x60]
add esp, 0x54
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x423ab0
sub eax, edx
cmp byte [esp + eax + 0xb], 0x5c
je 0x423ad9
push 0x471ae0
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0044f6ff
add esp, 0xc
push str.tsscommunicationstreamapi_msg.dll
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0044f6ff
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call esi
test eax, eax
jne 0x423b8f
push ebx
push ebx
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.0045025f
lea eax, [esp + 0x24]
add esp, 0x18
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x423b30
sub eax, edx
cmp byte [esp + eax + 0xb], 0x5c
je 0x423b59
push 0x471ae0
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0044f6ff
add esp, 0xc
push str..._ta_libs_
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0044f6ff
push str.tsscommunicationstreamapi_msg.dll
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.0044f6ff
add esp, 0x18
lea edx, [esp + 0xc]
push edx
call esi
test eax, eax
je 0x423bab
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x114]
push 0x104
push ecx
call fcn.0044fbc2
add esp, 0xc
jmp 0x423c09
lea edx, [esp + 0x418]
push edx
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str.NokiaTssProduct_API_Libraries_
lea eax, [esp + 0x41c]
push 0x104
push eax
call fcn.0044f6ff
push str.tsscommunicationstreamapi_msg.dll
lea ecx, [esp + 0x428]
push 0x104
push ecx
call fcn.0044f6ff
lea edx, [esp + 0x430]
push edx
lea eax, [esp + 0x12c]
push 0x104
push eax
call fcn.0044fbc2
add esp, 0x24
push edi
lea ecx, [esp + 0x114]
call fcn.0040fb50
mov ecx, dword [esp + 0x51c]
pop esi
pop ebx
xor ecx, esp
mov eax, edi
call fcn.0044e7cc
add esp, 0x518
ret
Function at 0x423c30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x467748
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea edi, [esp + 0xc]
call fcn.004239c0
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push edx
lea ecx, [esp + 0x30]
mov edx, eax
call fcn.004235d0
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423ca8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x423cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x467b5e
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esi], vtable.FuseLib::Communication::CStream.0
xor ebx, ebx
mov dword [esi + 4], vtable.FuseLib::Communication::CGCsDll.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], edi
lea ecx, [esi + 0x6c]
mov eax, edi
mov dword [esp + 0x18], ebx
call fcn.00425380
cmp ebp, ebx
mov byte [esp + 0x18], 1
mov byte [esi + 0x80], bl
mov byte [esi + 0x81], bl
mov dword [esi + 0x8c], ebx
mov eax, 0x1388
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov byte [esi + 0x90], bl
mov byte [esi + 0x91], bl
mov byte [esi + 0x92], bl
mov byte [esi + 0x93], bl
mov byte [esi + 0x94], bl
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], 3
mov dword [esi + 0x9c], edi
mov byte [esi + 0xa0], bl
mov dword [esi + 0xa4], 1
mov dword [esp + 0x24], ebx
je 0x423dd6
mov eax, dword [ebp]
mov edx, dword [eax]
lea ecx, [esp + 0x24]
push ecx
push 0x46fc20
push ebp
call edx
cmp ebp, ebx
setne al
mov byte [esp + 0x18], 2
push eax
call fcn.00425b80
mov ecx, dword [esp + 0x28]
add esp, 4
push ecx
mov ecx, esi
call fcn.00423e50
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x423e0a
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x43b7c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x43b7fe
or eax, 0xffffffff
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0044e7cc
add esp, 0x19c
ret
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov dword [0x483380], 1
xor eax, eax
call fcn.0044e7cc
add esp, 0x19c
ret
Function at 0x444990
Capabilities:
Encode data using base64

Disassembly:
push ecx
test ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov ebx, eax
mov edi, edx
jne 0x4449d2
lea ecx, [ebx + 2]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax*4 + 1]
call fcn.0043d560
mov ecx, eax
test ecx, ecx
jne 0x4449d2
mov dword [edi + 0x16214], 0xf
pop edi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
mov dword [esp + 0xc], ecx
mov byte [ecx], 0
jne 0x4449e4
pop edi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret
cmp ebx, 2
push esi
jle 0x444a53
lea edx, [ebx - 3]
mov eax, 0xaaaaaaab
mul edx
mov edi, edx
shr edi, 1
add edi, 1
lea eax, [edi*4]
sub eax, edi
neg eax
add ebx, eax
jmp 0x444a10
movzx eax, byte [ebp + 2]
xor edx, edx
mov dh, byte [ebp]
mov dl, byte [ebp + 1]
shl edx, 8
or edx, eax
mov esi, edx
mov eax, 4
jmp 0x444a30
mov edx, esi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sub eax, 1
shr esi, 6
test eax, eax
mov byte [eax + ecx], dl
jg 0x444a30
add ecx, 4
add ebp, 3
sub edi, 1
jne 0x444a10
test ebx, ebx
mov byte [ecx], 0
jle 0x444ac4
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x444a7c
mov edx, ebx
mov eax, ebx
movzx edi, byte [ebp]
shl esi, 8
or esi, edi
add ebp, 1
sub edx, 1
jne 0x444a66
cmp ebx, 3
jge 0x444a8d
mov edx, 3
sub edx, eax
add eax, edx
shl esi, 8
sub edx, 1
jne 0x444a85
add eax, 1
test eax, eax
jle 0x444aac
mov edx, esi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sub eax, 1
shr esi, 6
test eax, eax
mov byte [eax + ecx], dl
jg 0x444a94
mov eax, 3
cmp ebx, eax
jge 0x444ac0
mov byte [eax + ecx], 0x3d
sub eax, 1
cmp eax, ebx
jg 0x444ab5
mov byte [ecx + 4], 0
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x445bd0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esi + 0x16214]
cmp eax, 0x3e8
mov ebp, 1
push edi
mov dword [esp + 0x14], eax
mov edi, ebp
jne 0x445bff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret
xor ebx, ebx
mov eax, esi
mov word [esi + 0x155d4], bx
call fcn.00445610
mov eax, dword [esi + 0x3048]
cmp eax, 0xffffffff
je 0x445ca7
lea ecx, [esp + 0x18]
push ecx
push ebx
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x134]
mov dword [esp + 0x138], eax
mov dword [esp + 0x30], eax
push ecx
add eax, 1
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x13c], ebp
mov dword [esp + 0x34], ebp
call sub.WS2_32.dll_select
mov edi, eax
cmp edi, ebx
jle 0x445ca7
mov eax, dword [esi + 0x3048]
lea edx, [esp + 0x20]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x445ca5
mov edx, dword [esi + 0x3048]
lea ecx, [esp + 0x128]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x445ca7
mov ecx, dword [esi + 0x3048]
push 2
push ebp
lea eax, [esi + 0x13184]
push eax
push ecx
call sub.WS2_32.dll_recv
test eax, eax
jge 0x445ca7
xor edi, edi
mov ebp, dword [esp + 0x14]
cmp ebp, 0xffffffff
jne 0x445cc2
cmp dword [esi + 0x2c], ebx
jne 0x445d74
cmp dword [esi + 0x30], ebx
jne 0x445d74
cmp edi, ebx
jle 0x445d74
mov eax, dword [esi + 0x2fac]
cmp eax, ebx
mov dword [esi + 0x16214], ebx
je 0x445ce1
mov ecx, esi
call fcn.00428ed0
mov eax, esi
call fcn.0043cf30
test byte [esi + 4], 8
je 0x445d10
mov eax, esi
call fcn.00444150
call fcn.004267d0
call fcn.004444c0
mov eax, esi
call fcn.00426950
call fcn.00444530
call fcn.00444230
mov eax, dword [esi + 0x3028]
cmp eax, ebx
je 0x445d26
push esi
call eax
add esp, 4
mov dword [esi + 0x16214], eax
push ebp
call fcn.004454f0
add esp, 4
test eax, eax
jne 0x445d7a
mov eax, esi
call fcn.00444150
test eax, eax
jne 0x445d7a
call fcn.004267d0
test eax, eax
jne 0x445d7a
call fcn.004444c0
test eax, eax
jne 0x445d7a
mov eax, esi
call fcn.00426950
test eax, eax
jne 0x445d7a
call fcn.00444530
test eax, eax
jne 0x445d7a
call fcn.00444230
test eax, eax
jne 0x445d7a
mov eax, esi
call fcn.0043da40
mov dword [esi + 0x16214], ebp
call fcn.0043cc70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret
Function at 0x4466f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x148
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x144], eax
push ebp
mov ebp, dword [esp + 0x150]
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x8023
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x4467a8
push esi
push str.NokiaFuse
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea esi, [esp + 0x48]
call fcn.004467e0
test ebp, ebp
pop esi
je 0x44675f
cmp byte [ebp], 0
je 0x44675f
push ebp
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x44]
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
mov byte [edi + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x446778
sub eax, edx
push eax
lea eax, [esp + 0x48]
push eax
mov ecx, edi
call fcn.004028a0
mov ecx, dword [esp + 0x148]
pop ebp
xor ecx, esp
mov eax, edi
call fcn.0044e7cc
add esp, 0x148
ret
push eax
push str.SHGetFolderPath_failed_with_error_0x_08X
call fcn.004167d0
lea ecx, [esp + 0x10]
push str.Cannot_get_app_data_file_location
push ecx
mov ecx, str...commoncommon.cpp_84_
call fcn.00446410
add esp, 0x10
push 0x477dac
lea edx, [esp + 0xc]
push edx
call fcn.00451e1b
int3

Function at 0x4467e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x3c
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
push esi
call edi
test eax, eax
jne 0x446849
push esi
push str.Creating_directory:__s
call fcn.004167d0
add esp, 8
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x44681c
push eax
push str.SHCreateDirectoryEx_failed_with_error__i
call fcn.004167d0
add esp, 8
push esi
call edi
test eax, eax
jne 0x446849
lea eax, [esp + 4]
push str.Cannot_create_directory
push eax
mov ecx, str...commoncommon.cpp_102_
call fcn.00446410
add esp, 8
push 0x477dac
lea ecx, [esp + 8]
push ecx
call fcn.00451e1b
pop edi
add esp, 0x3c
ret