joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520528
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x4f0053
mov dword [ebp - 0x30], 0x540046
mov dword [ebp - 0x2c], 0x410057
mov dword [ebp - 0x28], 0x450052
mov dword [ebp - 0x24], 0x4c005c
mov dword [ebp - 0x20], 0x640075
mov dword [ebp - 0x1c], 0x730061
mov dword [ebp - 0x18], 0x690068
mov word [ebp - 0x14], ax
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x4316d9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0040ac20
test al, al
jne 0x4316bb
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4316a0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040a4c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3
Function at 0x4317c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52058b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 0x4f0053
mov dword [ebp - 0x90], 0x540046
mov dword [ebp - 0x8c], 0x410057
mov dword [ebp - 0x88], 0x450052
mov dword [ebp - 0x84], 0x4d005c
mov dword [ebp - 0x80], 0x630069
mov dword [ebp - 0x7c], 0x6f0072
mov dword [ebp - 0x78], 0x6f0073
mov dword [ebp - 0x74], 0x740066
mov dword [ebp - 0x70], 0x57005c
mov dword [ebp - 0x6c], 0x6e0069
mov dword [ebp - 0x68], 0x6f0064
mov dword [ebp - 0x64], 0x730077
mov dword [ebp - 0x60], 0x43005c
mov dword [ebp - 0x5c], 0x720075
mov dword [ebp - 0x58], 0x650072
mov dword [ebp - 0x54], 0x74006e
mov dword [ebp - 0x50], 0x650056
mov dword [ebp - 0x4c], 0x730072
mov dword [ebp - 0x48], 0x6f0069
mov dword [ebp - 0x44], 0x5c006e
mov dword [ebp - 0x40], 0x700041
mov dword [ebp - 0x3c], 0x200070
mov dword [ebp - 0x38], 0x610050
mov dword [ebp - 0x34], 0x680074
mov dword [ebp - 0x30], 0x5c0073
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x700070
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x431961
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0040ac20
test al, al
jne 0x431941
lea ecx, [ebp - 0x94]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431923
sub ecx, edx
lea eax, [ebp - 0x94]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040a4c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3
Function at 0x431bb0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52062b
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x29c]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
mov dword [ebp - 0x2a8], 1
xor eax, eax
mov dword [ebp - 0x2a4], 0x104
mov dword [ebp - 0x94], 0x4f0053
mov ebx, 0x77
mov dword [ebp - 0x90], 0x540046
mov dword [ebp - 0x8c], 0x410057
mov dword [ebp - 0x88], 0x450052
mov dword [ebp - 0x84], 0x4d005c
mov dword [ebp - 0x80], 0x630069
mov dword [ebp - 0x7c], 0x6f0072
mov dword [ebp - 0x78], 0x6f0073
mov dword [ebp - 0x74], 0x740066
mov dword [ebp - 0x70], 0x57005c
mov dword [ebp - 0x6c], 0x6e0069
mov dword [ebp - 0x68], 0x6f0064
mov dword [ebp - 0x64], 0x730077
mov dword [ebp - 0x60], 0x43005c
mov dword [ebp - 0x5c], 0x720075
mov dword [ebp - 0x58], 0x650072
mov dword [ebp - 0x54], 0x74006e
mov dword [ebp - 0x50], 0x650056
mov dword [ebp - 0x4c], 0x730072
mov dword [ebp - 0x48], 0x6f0069
mov dword [ebp - 0x44], 0x5c006e
mov dword [ebp - 0x40], 0x700041
mov dword [ebp - 0x3c], 0x200070
mov dword [ebp - 0x38], 0x610050
mov dword [ebp - 0x34], 0x680074
mov dword [ebp - 0x30], 0x5c0073
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x700070
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x431e10
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0040ac20
test al, al
jne 0x431d67
lea eax, [ebp - 0x94]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431d45
sub eax, edx
lea ecx, [ebp - 0x2a0]
sar eax, 1
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0040a4c0
mov esi, dword [ebp - 0x2a0]
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 4], 0xffffffff
push eax
lea eax, [ebp - 0x2a8]
push eax
push 0x535c84
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
setne bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x431db7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x431df4
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431df4
push str.ComputerZ.set
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x29c]
push eax
push 0
push 0
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408b70
int3
Function at 0x432360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5206dd
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x234], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], 0
call fcn.0042c380
mov ecx, eax
call fcn.004212e0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040ad50
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x238], esi
mov dword [ebp - 4], 1
call fcn.0042c380
mov ecx, eax
call fcn.00421750
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040ad50
add eax, 0x10
add esp, 4
mov dword [ebx], eax
cmp dword [eax - 0xc], 0
mov ebx, 1
mov dword [ebp - 0x220], ebx
jne 0x43244f
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x219]
call fcn.00431970
mov ebx, 3
mov dword [ebp - 0x220], ebx
mov eax, dword [eax]
test eax, eax
je 0x43244f
cmp dword [esi - 0xc], 0
jl 0x43244f
push eax
push esi
call fcn.004a9e50
add esp, 8
test eax, eax
je 0x43244f
sub eax, esi
mov byte [ebp - 0x219], 1
sar eax, 1
cmp eax, 0xffffffff
jne 0x432456
mov byte [ebp - 0x219], 0
or edi, 0xffffffff
test bl, 2
je 0x432484
mov edx, dword [ebp - 0x228]
and ebx, 0xfffffffd
mov dword [ebp - 0x220], ebx
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x432484
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x219], 0
je 0x432549
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
mov dword [ebp - 0x22c], 1
lea eax, [ebp - 0x230]
mov dword [ebp - 0x228], 0x104
lea ecx, [ebp - 0x219]
push eax
call fcn.00431600
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x22c]
push ecx
push str.VendorID
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [ebp - 0x230]
test eax, eax
mov eax, edi
sete bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x432516
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x432549
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432523
mov ebx, dword [ebp - 0x224]
lea eax, [ebp - 0x218]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040a4c0
jmp 0x43254f
mov ebx, dword [ebp - 0x224]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x432568
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
Function at 0x434fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520b88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x690062
mov dword [ebp - 0x24], 0x640072
mov dword [ebp - 0x20], 0x700077
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x43504f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x43502b
movzx eax, ax
push eax
call fcn.00409590
jmp 0x435031
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3

Function at 0x435060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], 0x730070
mov dword [ebp - 0x20], 0x760072
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x435116
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x4350f2
movzx eax, ax
push eax
call fcn.00409590
jmp 0x4350f8
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3
Function at 0x435130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520be8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0x4f0053
mov dword [ebp - 0x3c], 0x540046
mov dword [ebp - 0x38], 0x410057
mov dword [ebp - 0x34], 0x450052
mov dword [ebp - 0x30], 0x4c005c
mov dword [ebp - 0x2c], 0x530044
mov dword [ebp - 0x28], 0x610047
mov dword [ebp - 0x24], 0x65006d
mov dword [ebp - 0x20], str._0e
mov dword [ebp - 0x1c], 0x74006e
mov dword [ebp - 0x18], 0x720065
mov word [ebp - 0x14], ax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x435209
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x4351e5
movzx eax, ax
push eax
call fcn.00409590
jmp 0x4351eb
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3

Function at 0x435220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520c18
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x44004c
mov dword [ebp - 0x30], 0x470053
mov dword [ebp - 0x2c], 0x6d0061
mov dword [ebp - 0x28], 0x430065
mov dword [ebp - 0x24], 0x6e0065
mov dword [ebp - 0x20], 0x650074
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x4352e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x4352c1
movzx eax, ax
push eax
call fcn.00409590
jmp 0x4352c7
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3
Function at 0x4352f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520c48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], 0x730070
mov dword [ebp - 0x20], 0x760072
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x4353a6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x435382
movzx eax, ax
push eax
call fcn.00409590
jmp 0x435388
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3

Function at 0x4353c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520c7b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 0x4f0053
mov dword [ebp - 0x90], 0x540046
mov dword [ebp - 0x8c], 0x410057
mov dword [ebp - 0x88], 0x450052
mov dword [ebp - 0x84], 0x4d005c
mov dword [ebp - 0x80], 0x630069
mov dword [ebp - 0x7c], 0x6f0072
mov dword [ebp - 0x78], 0x6f0073
mov dword [ebp - 0x74], 0x740066
mov dword [ebp - 0x70], 0x57005c
mov dword [ebp - 0x6c], 0x6e0069
mov dword [ebp - 0x68], 0x6f0064
mov dword [ebp - 0x64], 0x730077
mov dword [ebp - 0x60], 0x43005c
mov dword [ebp - 0x5c], 0x720075
mov dword [ebp - 0x58], 0x650072
mov dword [ebp - 0x54], 0x74006e
mov dword [ebp - 0x50], 0x650056
mov dword [ebp - 0x4c], 0x730072
mov dword [ebp - 0x48], 0x6f0069
mov dword [ebp - 0x44], 0x5c006e
mov dword [ebp - 0x40], 0x700041
mov dword [ebp - 0x3c], 0x200070
mov dword [ebp - 0x38], 0x610050
mov dword [ebp - 0x34], 0x680074
mov dword [ebp - 0x30], 0x5c0073
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x700070
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x435548
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x435522
movzx eax, ax
push eax
call fcn.00409590
jmp 0x435528
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3
Function at 0x435560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520cb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x690062
mov dword [ebp - 0x24], 0x640072
mov dword [ebp - 0x20], 0x700077
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x43560f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x4355eb
movzx eax, ax
push eax
call fcn.00409590
jmp 0x4355f1
push eax
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3
Function at 0x435da0
Capabilities:
Check if file exists
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0042c380
mov ecx, eax
call fcn.004212e0
call fcn.0042c5a0
mov ecx, eax
call fcn.00434e60
test eax, eax
je 0x435ecb
call fcn.0042c5a0
mov ecx, eax
call fcn.00432e10
test eax, eax
je 0x435ecb
push ebx
push 0
push 0
push esi
push 0x435c70
push 0
push 0
call fcn.004c866c
push 0x208
mov dword [esi + 8], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a99f0
add esp, 0x24
mov dword [ebp - 0x218], 1
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x214], 0x104
lea ecx, [ebp - 0x20d]
push eax
call fcn.004353c0
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0x535c84
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [ebp - 0x21c]
test eax, eax
setne bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435e87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
pop ebx
jne 0x435ecb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435ecb
push str.config.set
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push 0x535c60
push str.games
push str.install_config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00490238
mov esp, ebp
pop ebp
ret
Function at 0x435fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], esi
mov eax, dword [0x57fa34]
mov dword [ebp - 0x3c], 0x6f0053
mov dword [ebp - 0x38], 0x740066
mov dword [ebp - 0x34], 0x610077
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x33005c
mov dword [ebp - 0x28], 0x300036
mov dword [ebp - 0x24], 0x610057
mov dword [ebp - 0x20], str.7_Of
mov dword [ebp - 0x1c], 0x610050
mov dword [ebp - 0x18], 0x650070
mov dword [ebp - 0x14], 0x72
test al, 1
jne 0x43609c
or eax, 1
mov dword [0x57fa34], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x52f780
mov dword [0x57fa28], 0x533980
mov dword [0x57fa2c], eax
mov byte [0x57fa30], 0
call fcn.0049067c
mov eax, dword [0x57fa34]
add esp, 4
test al, 2
jne 0x4360f8
or eax, 2
mov dword [0x57fa38], 0x533998
mov dword [0x57fa34], eax
xor eax, eax
push 0x52f7b0
mov dword [0x57fa3c], 0x57fa28
mov dword [0x57fa4c], 2
mov dword [0x57fa44], 0
mov dword [0x57fa48], 0
mov dword [0x57fa50], eax
mov dword [0x57fa40], 0x57fa38
call fcn.0049067c
add esp, 4
mov eax, dword [0x57fa38]
mov ecx, 0x57fa38
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x436128
movzx ecx, ax
push ecx
mov ecx, esi
call fcn.00409590
jmp 0x436130
push eax
mov ecx, esi
call fcn.0040e660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4

Function at 0x4367d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x690042
mov dword [ebp - 0x28], 0x640072
mov dword [ebp - 0x24], 0x610057
mov dword [ebp - 0x20], str.7_Of
mov dword [ebp - 0x1c], 0x610070
mov dword [ebp - 0x18], 0x650070
mov dword [ebp - 0x14], 0x72
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x4368a9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x436863
movzx eax, ax
mov ecx, esi
push eax
call fcn.00409590
jmp 0x43688b
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436870
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040a4c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408b70
int3