joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47aefb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 4
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00454bb0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x40a02b
push 1
mov dword [esi], 0
call fcn.004511a2
add esp, 4
mov dword [esi], eax
jmp 0x40a02d
xor esi, esi
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b102
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.004508df
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x40b4d4
mov dword [ebp - 0x18], str.bad_locale_name
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0040b840
push eax
push esi
call fcn.00451277
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40c540
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b2a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.004086e0
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004086e0
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004086e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40c5f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b2db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x10], ebx
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push 0
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
push eax
mov byte [ebx], 0
call fcn.004086e0
push 0xffffffffffffffff
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.004086e0
push 0xffffffffffffffff
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 2
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.004086e0
cmp dword [ebp + 0x1c], 0x10
jb 0x40c69b
push dword [ebp + 8]
call fcn.00454c01
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40e020
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b684
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.orpheus::NosUploadConfig.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 4
push 0x1c
mov dword [esi + 0x34], 0x100000
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 2
call fcn.00454bb0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40e0e9
lea ecx, [ebx + 4]
mov dword [ebx], vtable.orpheus::NosLock.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x40e0eb
xor ebx, ebx
push 0x1b
push str.http:__wanproxy.127.net_lbs
lea ecx, [ebp - 0x28]
mov dword [esi + 0x40], ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004089b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 4]
call fcn.0040e670
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], 0x10
jb 0x40e134
push dword [ebp - 0x28]
call fcn.00454c01
add esp, 4
push 0x1e
push str.http:__wanproxy_hz.127.net_lbs
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004089b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
lea ecx, [esi + 4]
call fcn.0040e670
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], 0x10
jb 0x40e17a
push dword [ebp - 0x28]
call fcn.00454c01
add esp, 4
push 0x1e
push str.http:__wanproxy_bj.127.net_lbs
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004089b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
lea ecx, [esi + 4]
call fcn.0040e670
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], 0x10
jb 0x40e1c0
push dword [ebp - 0x28]
call fcn.00454c01
add esp, 4
push 0x23
push str.http:__wanproxy_oversea.127.net_lbs
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004089b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 8
push eax
lea ecx, [esi + 4]
call fcn.0040e670
cmp dword [ebp - 0x14], 0x10
jb 0x40e202
push dword [ebp - 0x28]
call fcn.00454c01
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414550
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4995b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x4145b4
lea ecx, [ebp - 0xc]
xorps xmm0, xmm0
push ecx
push eax
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x41459f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x24], eax
or eax, 0xffffffff
or edx, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
xor ecx, ebp
or edx, 0xffffffff
pop esi
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
Function at 0x423b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d43c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 4]
mov byte [esi + 8], 0
mov dword [eax], 0
mov dword [esi], vtable.nos_upload::NosLBSIP.0
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x40], 0
mov byte [esi + 0x30], 0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], 0
mov byte [esi + 0x48], 0
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00423c30
mov byte [esi + 8], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4242a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d541
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4995b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 4]
mov byte [esi + 8], 0
mov dword [eax], 0
mov dword [esi], vtable.nos_upload::NosPartUpload.0
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x40], 0
mov byte [esi + 0x30], 0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], 0
mov byte [esi + 0x48], 0
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00424350
mov byte [esi + 8], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4249d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4995b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x424a4e
cmp word [ebp - 0x404], 0
jne 0x424a20
xor ecx, ecx
jmp 0x424a3f
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424a30
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
call fcn.0040c1f0
cmp dword [esi + 0x10], 0
je 0x424a62
push 0x14
push str.NetEaseCloudMusic_
mov ecx, esi
call fcn.004250c0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
Function at 0x425440
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
cmp dword [0x49aaf0], 0xffffffff
push ebx
push esi
push edi
mov esi, ecx
jne 0x425466
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
mov dword [0x49aaf0], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x425567
mov eax, dword [0x49aaf0]
mov esi, dword [ebp - 0x18]
add esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
adc ecx, dword [ebp - 0xc]
cdq
push edx
push eax
push ecx
push esi
call fcn.00459bf0
mov ebx, dword [0x4a0528]
mov esi, eax
mov ecx, ebx
mov edi, edx
or ecx, dword [0x4a052c]
je 0x42554b
mov ecx, dword [0x4a0530]
mov eax, ecx
mov edx, dword [0x4a0534]
or eax, edx
je 0x42554b
mov eax, esi
sub eax, ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, edi
sbb eax, dword [0x4a052c]
sub ebx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
sbb ecx, edx
mov eax, ebx
mov dword [ebp - 4], ecx
or eax, ecx
je 0x425567
mov eax, dword [ebp - 0x20]
push 0
push 0x64
push dword [ebp - 0xc]
mov dword [0x4a0530], eax
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x14]
mov dword [0x4a0528], esi
mov dword [0x4a052c], edi
mov dword [0x4a0534], eax
call fcn.00459420
push 0
push 2
push dword [ebp - 4]
mov edi, eax
mov esi, edx
push ebx
call fcn.0045cfb0
push dword [ebp - 4]
add edi, eax
push ebx
adc esi, edx
push esi
push edi
call fcn.0045cfb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov dword [0x4a0530], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x4a0528], esi
mov dword [0x4a052c], edi
mov dword [0x4a0534], eax
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425ec0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xb4
mov eax, dword [0x4995b0]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x74]
push edi
push eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [esp + 0x7c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x426077
mov eax, dword [esp + 0x7c]
xorps xmm0, xmm0
mov ebx, dword [esp + 0x80]
mov ecx, ebx
and ecx, 0x3fffffff
movsd qword [esp + 0x50], xmm0
movsd qword [esp + 0x48], xmm0
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x48fe00]
mov eax, dword [esp + 0x84]
shrd ebx, eax, 0x1e
shr eax, 0x1e
mulsd xmm1, qword [0x48fd98]
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x88]
mov edi, ebx
mov dword [esp + 0x3c], eax
and ebx, 0x3fffffff
mov eax, dword [esp + 0x8c]
divsd xmm1, qword [0x48fd98]
shrd edi, eax, 0x1e
movsd qword [esp + 0x58], xmm1
mov dword [esp + 0x38], edi
xor edi, edi
shr eax, 0x1e
xor edx, edx
mov dword [esp + 0x40], eax
jne 0x425f9d
test ecx, ecx
je 0x425fbb
shrd ecx, edx, 0x14
shr edx, 0x14
call fcn.0045d36e
movapd xmm1, xmm0
mulsd xmm1, qword [0x48fd80]
movsd qword [esp + 0x50], xmm1
test edi, edi
jne 0x425fc3
test ebx, ebx
je 0x425fe1
shrd ebx, edi, 0x14
shr edi, 0x14
mov ecx, ebx
mov edx, edi
call fcn.0045d36e
mulsd xmm0, qword [0x48fd80]
movsd qword [esp + 0x48], xmm0
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
call fcn.0045d36e
addsd xmm0, qword [esp + 0x48]
mov edx, dword [esp + 0x3c]
sub esp, 8
mov ecx, dword [esp + 0x4c]
movsd qword [esp], xmm0
call fcn.0045d36e
addsd xmm0, qword [esp + 0x58]
sub esp, 0x10
lea eax, [esp + 0x78]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [esp + 0x70]
movsd qword [esp], xmm0
push str.System_memory_usage:__.0f___total_.2fGB__.2fGB_avail_
push eax
call fcn.0044b330
mov edi, eax
add esp, 0x20
cmp esi, edi
je 0x426064
cmp dword [esi + 0x14], 0x10
jb 0x42604b
push dword [esi]
call fcn.00454c01
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.0040c350
cmp dword [esp + 0x74], 0x10
jb 0x426077
push dword [esp + 0x60]
call fcn.00454c01
add esp, 4
mov ecx, dword [esp + 0xbc]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
Function at 0x426480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4995b0]
xor eax, esp
mov dword [esp + 0x10c], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [esp + 8], 0
cmp dword [ecx + 0x10], 0
je 0x426728
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x426728
push ecx
lea ecx, [esp + 0xa4]
call fcn.004483f0
mov edi, dword [esi + 4]
mov esi, dword [esi]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
cmp esi, edi
je 0x4266db
mov edi, edi
mov eax, dword [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [esp + 0x18], ax
lea eax, [esi + 4]
push eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.00408d70
push dword [esp + 0xc]
lea eax, [esp + 0xd4]
push 0x48fa50
push 0x40
push eax
call fcn.00458b44
add esp, 0x10
mov dword [esp + 0x54], 0xf
cmp byte [esp + 0xd0], 0
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jne 0x42655b
xor eax, eax
jmp 0x42656e
lea eax, [esp + 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426565
sub eax, edx
push eax
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0x48]
call fcn.004089b0
push 0x48fb5c
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc4]
push eax
call fcn.0044b0a0
add esp, 0xc
push eax
push 0x48fb60
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.0041d2b0
add esp, 0xc
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00426ad0
add esp, 0xc
push eax
lea eax, [esp + 0x78]
push eax
call fcn.0041d2b0
add esp, 0xc
lea ecx, [esp + 0x28]
push 0xffffffffffffffff
push 0
push eax
call fcn.0040b990
cmp dword [esp + 0x84], 0x10
jb 0x4265f7
push dword [esp + 0x70]
call fcn.00454c01
add esp, 4
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], 0
mov byte [esp + 0x70], 0
jb 0x426625
push dword [esp + 0x58]
call fcn.00454c01
add esp, 4
cmp dword [esp + 0x9c], 0x10
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], 0
mov byte [esp + 0x58], 0
jb 0x426653
push dword [esp + 0x88]
call fcn.00454c01
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], 0
mov byte [esp + 0x88], 0
jb 0x426684
push dword [esp + 0x40]
call fcn.00454c01
add esp, 4
cmp dword [esp + 0xcc], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x4266b2
push dword [esp + 0xb8]
call fcn.00454c01
add esp, 4
cmp dword [esp + 0x24], 8
jb 0x4266c5
push dword [esp + 0x10]
call fcn.00454c01
add esp, 4
add esi, 0x1c
cmp esi, edi
jne 0x4264f0
cmp dword [esp + 0x3c], 0x10
mov eax, dword [esp + 0x28]
jae 0x4266df
lea eax, [esp + 0x28]
push dword [esp + 0x38]
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.0044af50
add esp, 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x426707
push dword [esp + 0x28]
call fcn.00454c01
add esp, 4
lea ecx, [esp + 0xa0]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00408f70
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
Function at 0x426e80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1064
call fcn.0045a220
mov eax, dword [0x4995b0]
xor eax, ebp
mov dword [ebp - 4], eax
movq xmm0, qword [str..old]
mov ax, word [0x48fb78]
push ebx
push esi
push edi
movq qword [ebp - 0x10], xmm0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 8], ax
movlpd qword [ebp - 0x1060], xmm0
call fcn.004483f0
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044b010
add esp, 8
test al, al
je 0x426fef
cmp dword [ebp - 0x105c], 0
jl 0x426fef
jg 0x426eff
cmp dword [ebp - 0x1060], 0x100000
jbe 0x426fef
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040c2f0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004492b0
cmp dword [ebp - 0x44], 8
jb 0x426f2c
push dword [ebp - 0x58]
call fcn.00454c01
add esp, 4
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044b070
lea eax, [ebp - 0x40]
push 0x48fb7c
push eax
call fcn.0044acc0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x426fd9
push 2
push 0xfff80000
push esi
call fcn.0045c1af
add esp, 0xc
test eax, eax
jne 0x426fd0
lea eax, [ebp - 0x28]
push 0x48fb80
push eax
call fcn.0044acc0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x426fd0
nop
push esi
push 0x1000
lea eax, [ebp - 0x1058]
push 1
push eax
call fcn.0045c3f7
push esi
mov edi, eax
call fcn.0045c4c9
add esp, 0x14
test eax, eax
jne 0x426fc7
test edi, edi
je 0x426fba
push ebx
push 1
lea eax, [ebp - 0x1058]
push edi
push eax
call fcn.00458938
add esp, 0x10
push esi
call fcn.0045c4a3
add esp, 4
test eax, eax
je 0x426f80
push ebx
call fcn.004582ba
add esp, 4
push esi
call fcn.004582ba
add esp, 4
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0044a5a0
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.00408f70
lea ecx, [ebp - 0x28]
call fcn.00408f70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
Function at 0x4273b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4995b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4273ef
push esi
push 2
call fcn.0044b8c0
add esp, 8
jmp 0x427480
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
cmp word [ebp - 0x210], ax
jne 0x427419
xor ecx, ecx
jmp 0x427431
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427422
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.0040c1f0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x240]
call fcn.004483f0
push eax
mov ecx, esi
call fcn.00408e90
lea ecx, [ebp - 0x240]
call fcn.00408f70
cmp dword [ebp - 0x214], 8
jb 0x427480
push dword [ebp - 0x228]
call fcn.00454c01
add esp, 4
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], str.NetEaseCloudMusic
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], 0x12
push eax
mov ecx, esi
call fcn.004486f0
push eax
mov ecx, esi
call fcn.00408e90
lea ecx, [ebp - 0x240]
call fcn.00408f70
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00458fb5
mov esp, ebp
pop ebp
ret
Function at 0x428a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x49c1a4
call fcn.00426740
add esp, 4
call fcn.00427f50
push 0
call fcn.00457b6a
pop ebp
ret
Function at 0x4381c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.00442c00

Function at 0x439400
Capabilities:
Connect pipe
Read file on windows

Disassembly:
cmp byte [ecx + 0x88], 0
je 0x439420
push dword [ecx + 0x9c]
mov dword [ecx + 0x84], 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
ret
mov eax, dword [ecx + 0x84]
dec eax
cmp eax, 9
ja case.default.0x43942c
jmp dword [eax*4 + 0x439470]
jmp 0x439610
jmp 0x439670
jmp fcn.00439390
jmp fcn.00439300
jmp fcn.00439960
jmp fcn.00439700
jmp fcn.00439a60
jmp fcn.004399d0
jmp fcn.00439890
jmp 0x4394a0
mov dword [ecx + 0x84], 1
ret
push esi
mov esi, ecx
push dword [esi + 0x9c]
mov dword [esi + 0xcc], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x94], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x4394fd
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x84], 1
pop esi
ret
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
je 0x4394e5
cmp byte [esi + 0x88], 0
jne 0x439537
push dword [esi + 0x9c]
mov dword [esi + 0x84], 2
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x439537
mov dword [esi + 0x84], 1
pop esi
ret
push esi
mov esi, ecx
cmp byte [esi + 0x88], 0
jne 0x439661
mov eax, dword [esi + 0x40]
test eax, eax
je 0x439631
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov dword [esi + 0x40], 0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x439646
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x439661
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x9c], 0
pop esi
ret
push esi
mov esi, ecx
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x4396dd
lea eax, [esi + 0x8c]
push eax
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4396dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x4396b7
cmp eax, 0x3e5
jne 0x4396dd
mov dword [esi + 0x84], 3
pop esi
ret
push dword [esi + 0x9c]
mov dword [esi + 0x84], 4
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x4396f3
mov dword [esi + 0x84], 1
pop esi
ret
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x84], 1
pop esi
ret