joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4143a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4410de
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x451254]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x444]
mov dword fs:[0], eax
mov ebx, 1
xor ebp, ebp
test byte [0x454184], bl
mov esi, ecx
jne 0x41443b
or dword [0x454184], ebx
mov dword [esp + 0x44c], ebp
call fcn.00415490
mov dword [0x454174], eax
mov byte [eax + 0x2d], bl
mov eax, dword [0x454174]
mov dword [eax + 4], eax
mov eax, dword [0x454174]
mov dword [eax], eax
mov eax, dword [0x454174]
mov dword [eax + 8], eax
push 0x444470
mov dword [0x454178], ebp
call fcn.0042e9ba
add esp, 4
mov dword [esp + 0x44c], 0xffffffff
mov eax, dword [0x454174]
mov dword [esp + 0x20], eax
lea ebx, [esp + 0x454]
lea eax, [esp + 0x24]
call fcn.00414a00
mov edi, eax
mov eax, dword [edi]
cmp eax, ebp
je 0x414463
cmp eax, 0x454170
je 0x414468
call fcn.0042e886
mov ecx, dword [esp + 0x20]
cmp dword [edi + 4], ecx
je 0x414484
lea edx, [esp + 0x454]
call fcn.004148d0
mov ecx, esi
jmp 0x41451f
push 0x40e
lea edx, [esp + 0x32]
push ebp
push edx
mov word [esp + 0x38], bp
call fcn.0042fcc0
mov ecx, dword [esp + 0x460]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push ecx
push ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4144db
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x4144df
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4144db
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
jmp 0x414529
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4144e6
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00401aa0
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x41450f
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edx, [esp + 0x454]
call fcn.004148d0
mov ecx, eax
mov eax, esi
push 0xffffffffffffffff
push ebp
call fcn.004019b0
mov al, 1
mov ecx, dword [esp + 0x444]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0042e4b4
add esp, 0x43c
ret

Function at 0x4146b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x38
lea eax, [esp + 8]
push 0
push eax
call fcn.0042fcc0
add esp, 0xc
mov dword [esp], 0x3c
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x3c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41472c
mov edx, 0x20
cmp edx, dword [esp + 0x20]
sbb eax, eax
neg eax
add esp, 0x3c
ret
xor al, al
add esp, 0x3c
ret
Function at 0x414740
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x443328
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x451254]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push edi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
mov edi, ecx
xor ebp, ebp
push eax
lea ebx, [ebp + 1]
mov eax, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], 0x25
call fcn.00409460
push 0xffffffffffffffff
cmp eax, 0xffffffff
push ebp
mov eax, edi
jne 0x4147b4
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov ecx, esi
mov word [esi + 4], bp
call fcn.004019b0
jmp 0x4148a9
mov ebx, 7
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebp
mov word [esp + 0x24], bp
call fcn.004019b0
mov dword [esp + 0x40], ebp
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
jb 0x4147e2
mov eax, dword [eax]
push ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x41481e
push 0xffffffffffffffff
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push ebp
mov eax, edi
mov ecx, esi
mov word [esi + 4], bp
call fcn.004019b0
cmp dword [esp + 0x30], 8
jb 0x4148a9
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x4148a1
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042da7c
add esp, 4
cmp dword [edi + 0x18], 8
mov ebx, eax
mov eax, dword [esp + 0x10]
jb 0x414848
mov eax, dword [eax]
mov edi, dword [esp + 0x14]
lea ecx, [edi + 1]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
jbe 0x414870
cmp eax, edi
ja 0x414870
lea edx, [esp + 0x18]
push edx
mov edx, ebx
mov word [ebx + eax*2], bp
call fcn.00401980
push ebx
call fcn.0042e757
add esp, 4
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
push ebp
lea eax, [esp + 0x20]
mov ecx, esi
mov word [esi + 4], bp
call fcn.004019b0
cmp dword [esp + 0x30], 8
jb 0x4148a9
mov eax, dword [esp + 0x1c]
push eax
call fcn.0042e0ba
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0042e4b4
add esp, 0x34
ret
Function at 0x415b20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x441958
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x78], 1
cmp dword [esp + 0x94], ebx
mov ebp, 8
jne 0x415b9d
lea eax, [esp + 0x54]
push eax
call fcn.0042b8be
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x88]
mov byte [esp + 0x80], 2
call fcn.004019b0
mov byte [esp + 0x78], 1
cmp dword [esp + 0x6c], ebp
jb 0x415b9d
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0xb0], ebx
jne 0x415bbd
lea edx, [esp + 0x9c]
push edx
lea esi, [esp + 0x84]
call fcn.0042b24c
add esp, 4
push 0x3c
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0042fcc0
add esp, 0xc
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0x540
call fcn.00415d60
test al, al
mov dword [esp + 0x24], 0x447ec4
jne 0x415bfa
mov dword [esp + 0x24], str.open
cmp dword [esp + 0x98], ebp
jb 0x415c10
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x28], ecx
jmp 0x415c1b
lea edx, [esp + 0x84]
mov dword [esp + 0x28], edx
cmp dword [esp + 0xb4], ebp
jb 0x415c31
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
jmp 0x415c3c
lea ecx, [esp + 0xa0]
mov dword [esp + 0x30], ecx
cmp dword [edi + 0x18], ebp
jb 0x415c4a
mov edx, dword [edi + 4]
mov dword [esp + 0x2c], edx
jmp 0x415c51
add edi, 4
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x38], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x415cca
cmp dword [esp + 0x98], ebp
jb 0x415c81
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0xb4], ebp
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], bx
jb 0x415cb4
mov edx, dword [esp + 0xa0]
push edx
call fcn.0042e0ba
add esp, 4
xor al, al
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
mov ecx, dword [esp + 0x50]
cmp ecx, ebx
je 0x415cfe
cmp byte [esp + 0xb8], bl
je 0x415cf7
mov edx, dword [esp + 0xbc]
or eax, 0xffffffff
cmp edx, ebx
jl 0x415ceb
mov eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x98], ebp
jb 0x415d17
mov eax, dword [esp + 0x84]
push eax
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0xb4], ebp
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], bx
jb 0x415d4a
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.0042e0ba
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x416e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x416f17
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x416f17
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x416f17
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x416f17
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x416f10
push edi
push ebx
push eax
call fcn.0042fff0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0xc]
push eax
push 0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x416f10
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416f10
push eax
call fcn.00415ec0
add esp, 4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
je 0x416f09
mov eax, dword [edi + 8]
test eax, eax
mov dword [edi + 8], 0
je 0x416f09
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x417330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x417343
push 0x80004005
call fcn.00401040
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x417350
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x417390
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x451254]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x234]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
test esi, esi
jne 0x4173fe
test ecx, ecx
je 0x4173f0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0x10], ecx
je 0x41740c
test ecx, ecx
je 0x4174b1
push ecx
jmp 0x4174ab
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x3c]
push edx
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
jne 0x41747e
jmp 0x417440
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00417390
mov edi, eax
test edi, edi
jne 0x4174cd
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
je 0x417440
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417495
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4174b1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0042e4b4
add esp, 0x224
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4174dc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4174b3
Function at 0x417990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x442df0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x451254]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x14], eax
call dword [0x451084]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x410]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
push 2
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x417a19
call fcn.00417060
mov esi, eax
jmp 0x417aff
mov edx, dword [ebp - 0x14]
push edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x417a35
call fcn.00417060
jmp 0x417af6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x417a4e
call fcn.00417060
jmp 0x417af6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
mov dword [ebp - 0x14], ebx
jae 0x417a84
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x417a72
lea eax, [ebp]
call fcn.00421920
lea esi, [ebp - 0x1c]
call fcn.00421660
mov eax, 0x8007000e
jmp 0x417b12
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.00421730
mov dword [ebp - 4], 1
jmp 0x417aac
mov esi, dword [ebp]
test esi, esi
jne 0x417aba
mov esi, 0x8007000e
jmp 0x417af8
call dword [0x451084]
mov ecx, dword [ebp - 0x20]
push ebx
push esi
push ebx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x417adb
call fcn.00417060
jmp 0x417af6
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.004186e0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x417b10
lea eax, [ebp]
call fcn.00421920
nop
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0042e4b4
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x423ba0
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x44274d
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x451254]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov esi, 7
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], ebp
mov dword [esp + 0x18], edi
mov word [edi + 4], bp
mov dword [esp + 0x270], ebp
mov dword [edi + 0x34], esi
mov dword [edi + 0x30], ebp
mov word [edi + 0x20], bp
mov dword [edi + 0x50], esi
mov dword [edi + 0x4c], ebp
mov word [edi + 0x3c], bp
mov dword [edi + 0x78], esi
mov dword [edi + 0x74], ebp
mov word [edi + 0x64], bp
mov dword [edi + 0x94], esi
mov dword [edi + 0x90], ebp
mov word [edi + 0x80], bp
mov dword [edi + 0xb0], esi
mov dword [edi + 0xac], ebp
mov word [edi + 0x9c], bp
mov dword [edi + 0xcc], esi
mov dword [edi + 0xc8], ebp
mov word [edi + 0xb8], bp
lea ebx, [edi + 0xd0]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x14], ebp
mov word [ebx + 4], bp
mov dword [edi + 0x108], esi
mov dword [edi + 0x104], ebp
mov word [edi + 0xf4], bp
push ebp
mov byte [esp + 0x274], 8
call fcn.0042e9fb
push eax
call fcn.0042e9cc
add esp, 8
mov dword [edi + 0x54], ebp
mov dword [edi + 0x58], ebp
mov dword [edi + 0x5c], ebp
call fcn.00405850
call fcn.0042b190
cmp dword [edi + 0xe4], ebp
je 0x423d89
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebp
mov word [esp + 0x3c], bp
push 0x208
lea eax, [esp + 0x5a]
push ebp
mov byte [esp + 0x278], 9
push eax
mov word [esp + 0x60], bp
call fcn.0042fcc0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x54]
mov word [esp + 0x25a], bp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x423d00
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x58]
push eax
lea esi, [esp + 0x40]
call fcn.00401aa0
mov ecx, esi
push str.__r_t_n
push ecx
call fcn.0042aa62
add esp, 8
push 9
push str..DESK.log
mov ecx, esi
call fcn.00409640
mov edx, esi
push edx
push ebx
lea ecx, [esp + 0x24]
call fcn.0042ae5f
add esp, 8
push 0xffffffffffffffff
push ebp
mov ecx, ebx
mov byte [esp + 0x278], 0xa
call fcn.004019b0
mov esi, 8
cmp dword [esp + 0x34], esi
jb 0x423d76
mov eax, dword [esp + 0x20]
push eax
call fcn.0042e0ba
add esp, 4
cmp dword [esp + 0x50], esi
jb 0x423d89
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0042e0ba
add esp, 4
mov dword [edi + 0xec], ebp
mov eax, edi
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.0042e4b4
add esp, 0x260
ret
Function at 0x4282b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441561
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
add eax, 0x60
push ebx
mov ecx, edi
mov dword [esp + 0x18], edi
mov word [edi + 4], bx
call fcn.004019b0
mov dword [esp + 0x38], ebx
mov eax, dword [edi + 0x14]
cmp eax, 0xe
mov dword [esp + 0xc], 1
jae 0x42832a
push 1
push 0x448f4c
mov ecx, edi
call fcn.00409640
cmp dword [edi + 0x14], 0xe
jb 0x428316
cmp dword [edi + 0x14], 0xe
jbe 0x428364
push 0xe
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
call fcn.0040b170
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.004019b0
cmp dword [esp + 0x2c], 8
jb 0x428364
mov eax, dword [esp + 0x18]
push eax
call fcn.0042e0ba
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4

Function at 0x428380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441561
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
add eax, 0x7c
push ebx
mov ecx, edi
mov dword [esp + 0x18], edi
mov word [edi + 4], bx
call fcn.004019b0
mov dword [esp + 0x38], ebx
mov eax, dword [edi + 0x14]
cmp eax, 0xe
mov dword [esp + 0xc], 1
jae 0x4283fa
push 1
push 0x448f4c
mov ecx, edi
call fcn.00409640
cmp dword [edi + 0x14], 0xe
jb 0x4283e6
cmp dword [edi + 0x14], 0xe
jbe 0x428434
push 0xe
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
call fcn.0040b170
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.004019b0
cmp dword [esp + 0x2c], 8
jb 0x428434
mov eax, dword [esp + 0x18]
push eax
call fcn.0042e0ba
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4
Function at 0x428450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441561
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
add eax, 0x98
push ebx
mov ecx, edi
mov dword [esp + 0x18], edi
mov word [edi + 4], bx
call fcn.004019b0
mov dword [esp + 0x38], ebx
mov eax, dword [edi + 0x14]
cmp eax, 0x20
mov dword [esp + 0xc], 1
jae 0x4284d4
jmp 0x4284c0
push 1
push 0x4484c4
mov ecx, edi
call fcn.00409640
cmp dword [edi + 0x14], 0x20
jb 0x4284c0
cmp dword [edi + 0x14], 0x20
jbe 0x42850e
push 0x20
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
call fcn.0040b170
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.004019b0
cmp dword [esp + 0x2c], 8
jb 0x42850e
mov eax, dword [esp + 0x18]
push eax
call fcn.0042e0ba
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4

Function at 0x428530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441561
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x451254]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
add eax, 0xb4
push ebx
mov ecx, edi
mov dword [esp + 0x18], edi
mov word [edi + 4], bx
call fcn.004019b0
mov dword [esp + 0x38], ebx
mov eax, dword [edi + 0x14]
cmp eax, 0x20
mov dword [esp + 0xc], 1
jae 0x4285b4
jmp 0x4285a0
push 1
push 0x4484c4
mov ecx, edi
call fcn.00409640
cmp dword [edi + 0x14], 0x20
jb 0x4285a0
cmp dword [edi + 0x14], 0x20
jbe 0x4285ee
push 0x20
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
call fcn.0040b170
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.004019b0
cmp dword [esp + 0x2c], 8
jb 0x4285ee
mov eax, dword [esp + 0x18]
push eax
call fcn.0042e0ba
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4