joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100039c0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x110], eax
push ebp
mov ebp, dword [esp + 0x124]
push 0x3a
push ebp
call fcn.100072f0
add esp, 8
test eax, eax
je 0x10003bcf
push ebx
mov ebx, dword [esp + 0x120]
mov byte [eax], 0
push esi
lea esi, [eax + 1]
test ebx, ebx
je 0x10003a2d
push str.ExportResource
push str.ExportResource
push ebx
call fcn.10004a10
push ebp
push str.ExportResource
push ebx
call fcn.10004a10
push esi
push str.ExportResource
push ebx
call fcn.10004a10
add esp, 0x24
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003a32
sub ecx, edx
je 0x10003bcd
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003a46
sub ecx, edx
je 0x10003bcd
push edi
push esi
call fcn.10007d2b
add esp, 4
movzx eax, ax
push 0x463
push eax
push dword [0x1001dbc8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10003bcc
push edi
push dword [0x1001dbc8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [0x1001dbc8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10003bcc
push 0x103
lea eax, [esp + 0x21]
mov byte [esp + 0x20], 0
push 0
push eax
call fcn.10006cf0
mov ecx, dword [esp + 0x138]
lea edx, [esp + 0x28]
add esp, 0xc
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10003ad7
lea edi, [esp + 0x1c]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10003af0
mov ax, word [0x10014a3c]
mov edx, ebp
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x10003b07
lea edi, [esp + 0x1c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003b15
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x10014a40
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.100075d0
add esp, 8
test eax, eax
je 0x10003b4a
lea eax, [esp + 0x1c]
push eax
call fcn.100031a0
add esp, 4
test ebx, ebx
je 0x10003b61
lea eax, [esp + 0x1c]
push eax
push str.ExportResource
push ebx
call fcn.10004a10
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10003bcc
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push 0
push eax
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x24], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003bc5
cmp dword [esp + 0x14], edi
jne 0x10003bc5
test ebx, ebx
je 0x10003bc5
push str.export_resource_success
push str.ExportResource
push ebx
call fcn.10004a10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x114]
pop ebp
xor ecx, esp
call fcn.10006cd8
add esp, 0x114
ret
Function at 0x10003d20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x10003d35
mov eax, dword [esp + 0x10]
pop edi
add esp, 8
ret
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov byte [esi], 0
mov ecx, dword [0x1001dbcc]
or ecx, 0x20019
push ecx
push 0
push str.SoftwareLogMeInRescueCallingCard
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003d94
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
push eax
push esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0
push str.InstallDir
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10003d94
mov byte [esi], 0
mov eax, esi
pop esi
pop edi
add esp, 8
ret

Function at 0x10003da0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x20019
mov dword [esp + 0xc], 1
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10003de2
mov eax, 1
add esp, 0xc
ret
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x10], edi
push eax
push 0
push 0x100147ac
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10003e49
lea eax, [esp + 8]
mov dword [esp + 8], edi
push eax
push esi
push str.ProgramMenuFolder
push dword [esp + 0x24]
call sub.msi.dll_MsiGetSummaryInformationA
test eax, eax
je 0x10003e3a
pop edi
mov byte [esi], 0
mov eax, 2
pop esi
add esp, 0xc
ret
push 0x100147b8
push edi
push esi
call fcn.10007287
add esp, 0xc
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x10003e60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x20019
mov dword [esp + 0xc], 1
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10003ea2
mov eax, 1
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [ebx + ebx]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.MenuFolder
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x10003f21
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
push esi
push 0x10014804
push edi
call sub.msi.dll_MsiGetSummaryInformationW
test eax, eax
je 0x10003f02
xor eax, eax
pop edi
mov word [esi], ax
mov eax, 2
pop esi
pop ebx
add esp, 0xc
ret
push str.default
push str.GetInstalledStartMenu
push edi
call fcn.10004a10
push 0x10014848
push ebx
push esi
call fcn.100079b3
add esp, 0x18
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str.GetInstalledStartMenu
push edi
call fcn.10004a60
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x10004390
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp], 0
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x20019
mov dword [esp + 0xc], 1
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100043d0
mov eax, 1
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
shl eax, 2
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0
push 0x10014790
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100043c7
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x14]
push str.GetProductName
push dword [esp + 0x18]
call fcn.10004a10
add esp, 0xc
xor eax, eax
add esp, 0xc
ret

Function at 0x10004430
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp], 0
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x20019
mov dword [esp + 0xc], 1
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10004470
mov eax, 1
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
shl eax, 2
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0
push 0x10014608
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004467
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x14]
push str.GetProductName
push dword [esp + 0x18]
call fcn.10004a60
add esp, 0xc
xor eax, eax
add esp, 0xc
ret
Function at 0x100044d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x52c
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x528], eax
mov eax, dword [esp + 0x534]
push edi
mov dword [esp + 0x14], eax
xor edi, edi
mov dword [esp + 8], 0x104
mov byte [eax], 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x328]
push eax
push 0x10014608
push dword [esp + 0x540]
call sub.msi.dll_MsiGetSummaryInformationW
test eax, eax
jne 0x10004659
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push edi
push str.InstallerProducts
push 0x80000000
call ebx
test eax, eax
jne 0x10004658
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004560
push 0x104
lea eax, [esp + 0x28]
push 0
push eax
call fcn.10006cf0
add esp, 0xc
lea ecx, [esp + 0x24]
mov eax, edi
inc edi
push 0x104
push ecx
push eax
push dword [esp + 0x24]
call ebp
test eax, eax
jne 0x10004650
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x10004560
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 1
push eax
lea eax, [esp + 0x12c]
mov dword [esp + 0x18], 0x208
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x10014608
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
test eax, eax
je 0x100045ed
call esi
jmp 0x10004560
call esi
lea eax, [esp + 0x128]
lea ecx, [esp + 0x330]
lea ecx, [ecx]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10004626
test dx, dx
je 0x10004622
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10004626
add ecx, 4
add eax, 4
test dx, dx
jne 0x10004600
xor eax, eax
jmp 0x1000462b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10004560
lea eax, [esp + 0x24]
push eax
push str.InstallerProducts_sSourceList
push dword [esp + 0x550]
push dword [esp + 0x2c]
call fcn.10007bec
add esp, 0x10
push dword [esp + 0x18]
call esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x52c]
pop edi
xor ecx, esp
call fcn.10006cd8
add esp, 0x52c
ret

Function at 0x10004750
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push 0x80000000
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100047ca
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100047c2
lea eax, [ebx + 1]
push eax
push 1
call fcn.10007d48
add esp, 8
mov dword [esp + 0xc], 0
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100047b7
cmp dword [esp + 0xc], ebx
je 0x100047c2
push esi
call fcn.10006b32
add esp, 4
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x100047d0
Capabilities:
Move file
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, dword [esp + 0x220]
push 0x10014288
push 0x1001479c
push esi
call fcn.10004a10
add esp, 0xc
mov dword [esp + 4], 0
lea eax, [esp + 8]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x104
push eax
lea eax, [esp + 0x118]
push eax
push str.CustomActionData
push esi
call sub.msi.dll_MsiGetSummaryInformationA
test eax, eax
jne 0x100049e6
lea eax, [esp + 4]
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x2001f
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100049e6
lea eax, [esp + 8]
mov dword [esp + 8], 0x104
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x100147ac
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10004906
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.10007232
lea ecx, [esp + 0x1c]
add esp, 0xc
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100048b0
sub ecx, edx
cmp byte [esp + ecx + 0xf], 0x5c
jne 0x100048d1
dec ecx
cmp ecx, 0x104
jae 0x10004a00
mov byte [esp + ecx + 0x10], al
lea eax, [esp + 0x10]
push 0x5c
push eax
call fcn.10007610
add esp, 8
test eax, eax
je 0x10004901
push 0x100147b8
mov byte [eax + 1], 0
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.10007287
add esp, 0xc
jmp 0x10004906
mov byte [esp + 0x10], 0
cmp byte [esp + 0x114], 0
je 0x100049dc
cmp byte [esp + 0x10], 0
je 0x100049dc
lea ecx, [esp + 0x10]
lea eax, [esp + 0x114]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10004950
test dl, dl
je 0x1000494c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10004950
add eax, 2
add ecx, 2
test dl, dl
jne 0x10004930
xor eax, eax
jmp 0x10004955
sbb eax, eax
or eax, 1
test eax, eax
je 0x100049dc
push str.MoveStartMenu___rename
push 0x1001479c
push esi
call fcn.10004a10
lea eax, [esp + 0x1c]
push eax
push 0x1001479c
push esi
call fcn.10004a10
lea eax, [esp + 0x12c]
push eax
push 0x1001479c
push esi
call fcn.10004a10
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.10007b29
lea ecx, [esp + 0x140]
add esp, 0x2c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100049b0
sub ecx, edx
lea eax, [ecx + 1]
push eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x118]
push eax
push 1
push 0
push 0x100147ac
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10006cd8
add esp, 0x218
ret 4
call fcn.10006ff8
int3
Function at 0x10004ad0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x10014288
push 0x10014524
push esi
call fcn.10004a10
add esp, 0xc
mov dword [esp + 4], 0x208
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push str.INSTALLDIR
push esi
call sub.msi.dll_MsiGetSummaryInformationA
test eax, eax
jne 0x10004b4e
lea eax, [esp + 8]
push eax
push 0x10014524
push esi
call fcn.10004a10
add esp, 0xc
lea eax, [esp + 8]
push 1
push eax
push 0
push str.readme.txt
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x210]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10006cd8
add esp, 0x210
ret 4

Function at 0x10004d90
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
push 0x10014288
push 0x10014bbc
push dword [esp + 0x124]
call fcn.10004a10
push 0x105
xor esi, esi
mov dword [esp + 0x18], 0
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.10006cf0
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea eax, [esp + 0x24]
add esp, 0x18
push 0x105
push eax
push esi
push 0x80000003
call edi
test eax, eax
jne 0x10004ee1
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004e10
lea eax, [esp + 0x14]
inc esi
push str._Classes
push eax
call fcn.10007750
add esp, 8
test eax, eax
je 0x10004e59
mov ecx, str._Classes
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10004e50
test dl, dl
je 0x10004e4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10004e50
add eax, 2
add ecx, 2
test dl, dl
jne 0x10004e30
xor eax, eax
jmp 0x10004e55
sbb eax, eax
or eax, 1
test eax, eax
je 0x10004eb1
push 0x10014908
lea eax, [esp + 0x18]
push 0x105
push eax
call fcn.10007287
add esp, 0xc
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10004eb1
push str.LogMeInRescueCallingCard
push dword [esp + 0x14]
call ebx
push dword [esp + 0x10]
call ebp
push 0x105
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10006cf0
add esp, 0xc
lea eax, [esp + 0x14]
push 0x105
push eax
push esi
push 0x80000003
call edi
test eax, eax
je 0x10004e10
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10006cd8
add esp, 0x110
ret 4
Function at 0x10004f00
Capabilities:
Delete file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x108], eax
push 0x10014288
push 0x100146e4
push dword [esp + 0x118]
call fcn.10004a10
push 0x103
lea eax, [esp + 0x15]
mov byte [esp + 0x14], 0
push 0
push eax
call fcn.10006cf0
add esp, 0x18
mov dword [esp], 0x104
lea eax, [esp]
push eax
lea eax, [esp + 8]
push eax
push str.MSI_is_copied
push dword [esp + 0x11c]
call sub.msi.dll_MsiGetSummaryInformationA
test eax, eax
jne 0x10004f79
cmp byte [esp + 4], al
je 0x10004f79
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x108]
xor eax, eax
xor ecx, esp
call fcn.10006cd8
add esp, 0x10c
ret 4

Function at 0x10004fa0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10004ff3
push 0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [esp + 0x18]
call fcn.100019b0
add esp, 4
push eax
push dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ecx
ret

Function at 0x100056e0
Capabilities:
Identify system language via api

Disassembly:
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
call fcn.10003f50
add esp, 4
mov edi, eax
push edi
push str.Language
push dword [esp + 0x10]
call sub.msi.dll_MsiSummaryInfoGetPropertyCount
push 0
push 0
push edi
push 0x65
push dword [0x1001dbc8]
mov ecx, 0x1001dbd0
call fcn.10001190
push edi
push str.SetLanguage
push dword [esp + 0x10]
call fcn.10004a60
add esp, 0xc
pop edi
ret
Function at 0x10005770
Capabilities:
Copy file
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x31c
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x318], eax
push edi
mov edi, dword [esp + 0x324]
push 0x10014288
push 0x10014704
push edi
call fcn.10004a10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10005979
push 0x104
lea eax, [esp + 0x14]
push eax
push edi
call fcn.100044d0
add esp, 0xc
cmp byte [esp + 0x10], 0
je 0x10005979
lea eax, [esp + 4]
mov dword [esp + 4], 0x104
push eax
lea eax, [esp + 0x118]
push eax
push str.OriginalDatabase
push edi
call sub.msi.dll_MsiGetSummaryInformationA
test eax, eax
jne 0x10005979
push esi
lea eax, [esp + 0x118]
push 0x5c
push eax
call fcn.10007610
mov esi, eax
add esp, 8
test esi, esi
je 0x10005812
inc esi
jmp 0x10005819
lea esi, [esp + 0x118]
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
lea eax, [esp + 0x20]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005978
lea eax, [esp + 8]
mov dword [esp + 0x10], 1
push eax
lea eax, [esp + 0x220]
mov dword [esp + 0xc], 0x104
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.PackageName
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000596e
lea ecx, [esp + 0x21c]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100058a1
test dl, dl
je 0x1000589d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100058a1
add eax, 2
add ecx, 2
test dl, dl
jne 0x10005881
xor eax, eax
jmp 0x100058a6
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000596e
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100058b3
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.PackageName
push dword [esp + 0x20]
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.10007232
lea eax, [esp + 0x20]
push 0x5c
push eax
call fcn.10007610
add esp, 0x14
test eax, eax
je 0x10005929
mov byte [eax + 1], 0
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.10007287
jmp 0x10005940
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.10007232
add esp, 0xc
lea eax, [esp + 0x14]
push 1
push eax
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x10005978
lea eax, [esp + 0x14]
push eax
push str.MSI_is_copied
push edi
call sub.msi.dll_MsiSummaryInfoGetPropertyA
jmp 0x10005978
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x31c]
xor eax, eax
pop edi
xor ecx, esp
call fcn.10006cd8
add esp, 0x31c
ret 4
Function at 0x10005a70
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x2001f
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10005aa1
xor al, al
pop ecx
ret
mov edx, dword [esp + 8]
mov ecx, edx
push esi
lea esi, [ecx + 1]
jmp 0x10005ab0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005ab0
sub ecx, esi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push 0x10014790
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ecx
ret

Function at 0x10005ae0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
mov eax, dword [0x1001dbcc]
or eax, 0x2001f
push eax
push 0
push str.SoftwareLogMeInRescueCallingCardVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10005b11
xor al, al
pop ecx
ret
mov edx, dword [esp + 8]
mov ecx, edx
push esi
lea esi, [ecx + 2]
jmp 0x10005b20
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005b20
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x10014608
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ecx
ret