joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429605
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x484a28
call fcn.004801f0
sub esp, 0x54
push ebx
push esi
push str.Elevate__
push 0x4b5b78
call fcn.0042d068
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040c10b
add esp, 0x10
push str._elevated
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00430b0d
push 0x4b53a4
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call fcn.00430cc5
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00430a4d
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x60], 0x3c
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], str.runas
call fcn.004311c6
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x50], eax
call fcn.004311c6
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x40], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4296f5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x4c7
jne 0x4296d3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00430a4d
xor al, al
jmp 0x42970e
call esi
push eax
lea eax, [ebp - 0x24]
push str.Error__d_in_Elevate__
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00430a4d
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4297fa
Capabilities:
Log keystrokes

Disassembly:
cmp dword [0x4b5390], 0x60000
push ebx
push esi
push edi
jae 0x429818
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4298ba
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call esi
push 0
mov edi, eax
push dword [esp + 0x14]
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push ebx
push edi
call esi
test eax, eax
jne 0x429858
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x4298b3
push eax
push str.SetForegroundWindow__1_Error__d
jmp 0x4298a6
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x429874
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__2_Error__d
jmp 0x4298a6
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x42988c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__3_Error__d
jmp 0x4298a6
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetActiveWindow]
test eax, eax
jne 0x4298b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__4_Error__d
push 0x4b5b78
call fcn.0042d050
add esp, 0xc
xor eax, eax
jmp 0x4298ba
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x42ba56
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 0x1db4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jle 0x42ba7e
mov edx, dword [esp + 8]
push edi
movzx edi, byte [edx]
xor edi, eax
movzx eax, byte [edi + ecx + 0x1cb4]
mov byte [edx], al
inc edx
dec esi
jne 0x42ba6a
pop edi
mov dword [ecx + 0x1db4], eax
pop esi
ret 8

Function at 0x42baab
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push edi
mov edi, ecx
test edx, edx
mov ecx, dword [edi + 0x1db4]
jle 0x42bad8
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx eax, byte [esi]
mov bl, byte [edi + eax + 0x1cb4]
xor bl, cl
mov ecx, eax
mov byte [esi], bl
inc esi
dec edx
jne 0x42bac2
pop esi
pop ebx
mov dword [edi + 0x1db4], ecx
pop edi
ret 8

Function at 0x42bb44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, edx
push esi
shr eax, 2
test eax, eax
jle 0x42bb6d
mov esi, eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ecx]
add ecx, 4
xor dword [eax], edi
add eax, 4
dec esi
jne 0x42bb5d
pop edi
jmp 0x42bb70
mov eax, dword [ebp + 8]
and edx, 3
jle 0x42bb80
mov esi, edx
mov dl, byte [ecx]
xor byte [eax], dl
inc eax
inc ecx
dec esi
jne 0x42bb77
pop esi
pop ebp
ret
Function at 0x42bb83
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0042bd0f
lea edi, [esi + 0x474]
push ebx
mov ecx, esi
call fcn.0042bd3f
mov dword [edi], eax
inc ebx
add edi, 4
cmp ebx, 0x200
jb 0x42bba6
and dword [ebp - 4], 0
lea ebx, [esi + 0x74]
mov edi, 0x100
mov eax, dword [ebp - 4]
mov ecx, esi
add eax, 0x1000
push eax
call fcn.0042bd3f
inc dword [ebp - 4]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebp - 4], edi
jb 0x42bbc8
and dword [ebp - 4], 0
lea ebx, [esi + 0xc74]
mov eax, dword [ebp - 4]
mov ecx, esi
add eax, 0x2000
push eax
call fcn.0042bd3f
inc dword [ebp - 4]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebp - 4], 0x10
jb 0x42bbef
mov ecx, esi
call fcn.0042b739
and dword [esi + 0x1db4], 0
xor eax, eax
or cl, 0xff
sub cl, al
mov byte [ebp + eax - 0x110], cl
inc eax
cmp eax, edi
jb 0x42bc1d
and dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0x14
jge 0x42bc98
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x14
mov dword [ebp - 0x10], eax
jge 0x42bc8f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ebx, edi
movzx eax, byte [eax + ecx]
movzx edx, byte [ecx + edx - 1]
add eax, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ecx - 1]
xor eax, edx
cdq
idiv ebx
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
mov byte [ebp + eax - 0x210], dl
jge 0x42bca1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jl 0x42bc54
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jl 0x42bc46
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jb 0x42bc39
xor eax, eax
mov dword [ebp + 8], eax
movzx ecx, byte [ebp + eax - 0x210]
cmp eax, ecx
je 0x42bccb
lea ecx, [ebp + ecx - 0x110]
lea eax, [ebp + eax - 0x110]
mov bl, byte [ecx]
mov dl, byte [eax]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov byte [ecx], dl
inc eax
cmp eax, edi
mov dword [ebp + 8], eax
jl 0x42bca6
cmp byte [ebp + 0xc], 0
je 0x42bcf2
lea eax, [ebp - 0x110]
push edi
add esi, 0x1cb4
push eax
push esi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x42bd08
xor eax, eax
movzx ecx, byte [ebp + eax - 0x110]
mov byte [ecx + esi + 0x1cb4], al
inc eax
cmp eax, edi
jb 0x42bcf4
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42bf68
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
push dword [esp + 0xc]
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esi], eax
je 0x42bf9b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42bf99
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
mov eax, dword [esi]
pop esi
ret 8
Function at 0x42bf9f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x42bfe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42bfe1
push eax
lea eax, [ebp - 0xc]
push str.ERROR:__d_RLMutexWin::IsExist__
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
xor al, al
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
leave
ret

Function at 0x42c144
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ecx]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
add esp, 0x10
cmp esi, dword [ebp + 0xc]
je 0x42c190
call dword [sym.imp.MSVCRT.dll__errno]
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push esi
push str.RLFile::Read____d__d_error_d
push eax
call fcn.0042c02a
add esp, 0x14
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
leave
ret 8

Function at 0x42c195
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ecx]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fwrite]
mov esi, eax
add esp, 0x10
cmp esi, dword [ebp + 0xc]
je 0x42c1e1
call dword [sym.imp.MSVCRT.dll__errno]
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push esi
push str.RLFile::Write____d__d_error_d
push eax
call fcn.0042c02a
add esp, 0x14
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
leave
ret 8

Function at 0x42c3f8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x42c434
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.RLFileWin::GetSize___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x42c436
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0
push eax
push esi
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42c45c
cmp dword [ebp + 0xc], esi
je 0x42c482
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.RLFileWin::Read___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
leave
ret 8
Function at 0x42c487
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0
push eax
push esi
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42c4ad
cmp dword [ebp + 0xc], esi
je 0x42c4d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.RLFileWin::Write___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
leave
ret 8

Function at 0x42c6e2
Capabilities:
Connect to http server
Create http request

Disassembly:
mov eax, 0x484b8c
call fcn.004801f0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi]
cmp eax, ebx
jne 0x42c777
cmp byte [0x4b5e14], bl
je 0x42c710
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
jmp 0x42c771
cmp word [0x4b5e16], bx
jne 0x42c720
push ebx
push ebx
push ebx
push 1
jmp 0x42c705
lea ecx, [ebp - 0x10]
call fcn.0042f0da
movzx eax, word [0x4b5e16]
push eax
mov ecx, 0x4b5e10
mov dword [ebp - 4], ebx
call fcn.004311c6
push eax
lea eax, [ebp - 0x10]
push str._s:_d
push eax
call fcn.00430647
add esp, 0x10
lea ecx, [ebp - 0x10]
push ebx
push ebx
call fcn.004311c6
push eax
push 3
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [esi], eax
call fcn.0042f3db
mov eax, dword [esi]
cmp eax, ebx
je 0x42c79b
cmp dword [esi + 4], ebx
jne 0x42c831
push 1
push ebx
push 3
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x42c7a9
mov ecx, esi
call fcn.0042c649
xor al, al
jmp 0x42c833
cmp byte [0x4b5e14], bl
push edi
jne 0x42c7bb
cmp word [0x4b5e16], bx
je 0x42c80d
mov edi, 0x4b5e08
mov ecx, edi
call fcn.0042fbb1
test eax, eax
jne 0x42c80d
mov ecx, edi
call fcn.0042fb9f
push eax
mov ecx, edi
call fcn.004311c6
push eax
push 0x2b
mov ecx, esi
call fcn.0042c6a9
mov edi, 0x4b5e04
mov ecx, edi
call fcn.0042fbb1
test eax, eax
jne 0x42c80d
mov ecx, edi
call fcn.0042fb9f
push eax
mov ecx, edi
call fcn.004311c6
push eax
push 0x2c
mov ecx, esi
call fcn.0042c6a9
mov edi, 0xea60
mov ecx, esi
push edi
push 2
call fcn.0042c671
push edi
push 6
mov ecx, esi
call fcn.0042c671
push edi
push 5
mov ecx, esi
call fcn.0042c671
pop edi
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42c876
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 0x128]
push edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x28]
push eax
mov esi, ecx
push dword [ebp + 0xc]
call fcn.0042cbbe
add esp, 0x14
mov ecx, esi
call fcn.0042c843
mov edi, 0x4b5b78
push str.RLHttp::SendRequest__3
push edi
call fcn.0042d068
pop ecx
lea eax, [ebp - 0xa8]
pop ecx
push dword [ebp - 4]
mov ecx, esi
push eax
call fcn.0042c6e2
test al, al
je 0x42c9c9
lea eax, [ebp - 0x28]
xor ebx, ebx
push 0x4a21a0
push eax
mov dword [ebp - 8], ebx
mov dword [ebp + 0xc], 0x4080100
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x42c8fe
mov dword [ebp + 0xc], 0x4881100
mov ecx, 0x4b5e08
call fcn.0042fbb1
test eax, eax
jne 0x42c910
or byte [ebp + 0xe], 0x40
push str.RLHttp::SendRequest__5
push edi
call fcn.0042d068
pop ecx
lea eax, [ebp - 8]
pop ecx
push ebx
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x128]
push dword [esi + 0x14]
push ebx
push eax
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp eax, ebx
mov dword [esi + 8], eax
jne 0x42c94c
mov ecx, esi
call fcn.0042c649
jmp 0x42c9c9
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x42c95b
and dword [ebp + 8], ebx
and dword [ebp + 0xc], ebx
jmp 0x42c96b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
lea ebx, [esi + 0x10]
mov ecx, ebx
call fcn.0042fb9f
push dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push eax
push dword [esi + 8]
push str.RLHttp::SendRequest__8__X__X__X__X
push edi
call fcn.0042d068
add esp, 0x18
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.004311c6
push eax
push dword [esi + 8]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x42c9cd
mov ecx, esi
call fcn.0042c649
push str.RLHttp::SendRequest__8_ERROR
push edi
call fcn.0042d068
pop ecx
pop ecx
mov ecx, esi
call fcn.0042c85f
xor al, al
jmp 0x42c9dc
push str.RLHttp::SendRequest__9
push edi
call fcn.0042d068
pop ecx
mov al, 1
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42c9e3
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov edi, str.S:Ammyy_sourcesRLRLHttp.cpp
cmp dword [esi + 8], 0
jne 0x42ca0d
push 0xde
push edi
lea ecx, [ebp - 0x14]
call fcn.00429ea1
mov ecx, eax
call fcn.00429fad
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
and dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x20000005
push dword [esi + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x42ca4f
push 0xe4
push edi
lea ecx, [ebp - 0x14]
call fcn.00429ea1
mov ecx, eax
call fcn.00429fad
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x42d13c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42d169
mov al, 1
leave
ret 8
cmp eax, 2
jne 0x42d172
xor al, al
jmp 0x42d165
push eax
lea eax, [ebp - 0x10]
push str.RegQueryValueExA___error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x42d192
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [ebp - 4]
mov eax, 0x104
push ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], eax
call fcn.0042f8c8
push eax
push 0
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop esi
jne 0x42d1d6
push dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
call fcn.0042f99e
mov al, 1
leave
ret 8
cmp eax, 2
jne 0x42d1ec
mov ecx, dword [ebp + 0xc]
push 0x4b5350
call fcn.0042f5a5
xor al, al
jmp 0x42d1d2
push eax
lea eax, [ebp - 0x10]
push str.RegQueryValueExA___error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x42d20c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x42d236
xor al, al
leave
ret 4
test eax, eax
jne 0x42d23e
mov al, 1
jmp 0x42d232
push eax
lea eax, [ebp - 0x10]
push str.IsExistW___error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x42d25e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push esi
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], esi
push dword [ebx]
call edi
cmp eax, 2
jne 0x42d290
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
cmp eax, esi
jne 0x42d2f1
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
add ecx, dword [ebp - 4]
push ecx
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 4]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0x18]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x42d2f1
cmp dword [ebp - 4], 0xf4240
jb 0x42d2df
push 0x78
push str.S:Ammyy_sourcesRLRLRegistry.cpp
lea ecx, [ebp - 0xc]
call fcn.00429ea1
mov ecx, eax
call fcn.00429fad
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
add ecx, dword [ebp - 4]
push ecx
mov ecx, esi
call dword [eax + 0x20]
mov al, 1
jmp 0x42d289
push eax
lea eax, [ebp - 0x10]
push str.RegQueryValueExW___error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x42d311
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push dword [ecx + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x14]
push eax
push 3
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
je 0x42d35a
push eax
lea eax, [ebp - 0xc]
push str.RegSetValueExW_REG_BINARY__error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret 8

Function at 0x42d35e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.0042fb9f
mov ecx, dword [ebp + 0xc]
push eax
call fcn.004311c6
push eax
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x42d3ad
push eax
lea eax, [ebp - 0xc]
push str.RegSetValueExA___error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret 8

Function at 0x42d3b1
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x42d3ec
cmp eax, 2
je 0x42d3ec
push eax
lea eax, [ebp - 0xc]
push str.RegDeleteKeyA___error_u
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret
Function at 0x42d421
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
test esi, esi
jne 0x42d46a
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.FindResourceEx___error_d_lpName0x_X
push eax
call fcn.0042c02a
add esp, 0x10
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x42d4a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.SizeofResource___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42d4d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.LoadResource___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x42d505
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.LockResource___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x42eb81
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x484cbf
call fcn.004801f0
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], esi
call fcn.0042f0da
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xe
push dword [edi + 4]
mov dword [ebp - 4], 1
call esi
mov ebx, eax
test ebx, ebx
jbe 0x42ebd7
inc ebx
lea ecx, [ebp - 0x10]
push ebx
call fcn.0042f8c8
push eax
push ebx
push 0xd
push dword [edi + 4]
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0042f99e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0042f0e6
mov dword [ebp - 0x14], 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042f3db
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4