Function at 0x10005600
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x1003a0c0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
mov eax, 0x10005500
push edi
sub eax, 0x4ab266
push 5
mov dword [0x4ab262], eax
call fcn.1000e0bf
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push 5
mov dword [esi], 0x90909090
push 0x4fe95e
mov byte [esi + 4], 0x90
call ebx
test eax, eax
je 0x1000568d
mov eax, dword [esi]
mov ecx, 0x4fe95e
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
mov dword [esp + 0x18], 0
push 5
push ecx
call ebx
test eax, eax
jne 0x10005693
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x10005240
mov dword [esp + 0x20], 0x128
push 0
sub eax, 0x42e8d6
push 2
mov dword [0x42e8d2], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10005784
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
mov ecx, str.MUBZ_HARD_Launcher_1.exe
lea eax, [esp + 0x44]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10005700
test dl, dl
je 0x100056fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10005700
add eax, 2
add ecx, 2
test dl, dl
jne 0x100056e0
xor eax, eax
jmp 0x10005705
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000576d
mov ecx, str.Updater.exe
lea eax, [esp + 0x44]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10005732
test dl, dl
je 0x1000572e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10005732
add eax, 2
add ecx, 2
test dl, dl
jne 0x10005712
xor eax, eax
jmp 0x10005737
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000576d
mov ecx, str.main1.exe
lea eax, [esp + 0x44]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10005764
test dl, dl
je 0x10005760
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10005764
add eax, 2
add ecx, 2
test dl, dl
jne 0x10005744
xor eax, eax
jmp 0x10005769
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10005774
mov byte [0x1003be45], 1
lea eax, [esp + 0x20]
push eax
push esi
call edi
test eax, eax
jne 0x100056d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREWebzenMuConfig
push 0x80000001
mov dword [0x1003ab84], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 4
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000590c
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.MusicOnOFF
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x10005906
cmp dword [esp + 0x14], 1
jne 0x1000590c
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREWebzenMuConfig
push 0x80000001
mov dword [esp + 0x28], 4
call ebx
test eax, eax
jne 0x10005841
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.SoundOnOff
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x1000583b
cmp dword [esp + 0x14], eax
jne 0x10005889
jmp 0x10005841
push dword [esp + 0x10]
call edi
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SOFTWAREWebzenMuConfig
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005883
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 4
push 0
push str.SoundOnOff
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call edi
push 0x10004870
push 0x5218ba
push 0xe9
call fcn.1000c8e0
push 0x10004dc0
push 0x412050
push 0xe9
call fcn.1000c8e0
push 0x10005010
push 0x411fb0
push 0xe9
call fcn.1000c8e0
mov ecx, 0x10005210
mov byte [0x42396a], 0xe8
add esp, 0x24
lea eax, [ecx - 0x42396f]
mov dword [0x42396b], eax
lea eax, [ecx - 0x428836]
mov byte [0x428831], 0xe8
sub ecx, 0x429201
mov dword [0x428832], eax
mov byte [0x4291fc], 0xe8
mov dword [0x4291fd], ecx
jmp 0x1000590c
push dword [esp + 0x10]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str..Settings.ini
push 0
push str.ApplyWindowsScaleSettings
push str.WindowMode
call esi
push str..Settings.ini
push 1
push str.ApplyWindowsScaleSettingsOnWindows7
push str.WindowMode
mov dword [esp + 0x2c], eax
call esi
test eax, eax
jne 0x1000594b
call fcn.10004620
test al, al
jne 0x100059b4
jmp 0x10005959
cmp eax, 1
jne 0x10005959
call fcn.10004620
test al, al
jne 0x100059b9
cmp dword [esp + 0x1c], 0
je 0x100059b4
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
push str.SOFTWAREWebzenMuConfig
push 0x80000001
mov dword [esp + 0x28], 4
call ebx
test eax, eax
jne 0x100059b4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push str.WindowMode
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100059ae
cmp dword [esp + 0x10], eax
jne 0x100059b9
jmp 0x100059b4
push dword [esp + 0x14]
call edi
call fcn.1000c920
mov esi, 0x10003540
mov byte [esp + 0x14], 0xe8
mov dword [esp + 0x10], 0
lea eax, [esi - 0x42930b]
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x429306
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10005a1d
mov eax, dword [esp + 0x14]
mov ecx, 0x429306
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005a23
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esi - 0x42989d]
mov byte [esp + 0x14], 0xe8
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x429898
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10005a82
mov eax, dword [esp + 0x14]
mov ecx, 0x429898
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005a88
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esi - 0x429ba7]
mov byte [esp + 0x14], 0xe8
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x429ba2
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10005ae7
mov eax, dword [esp + 0x14]
mov ecx, 0x429ba2
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005aed
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esi - 0x47aea5]
mov byte [esp + 0x14], 0xe8
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x47aea0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10005b4c
mov eax, dword [esp + 0x14]
mov ecx, 0x47aea0
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005b52
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x10]
mov byte [esp + 0x14], 0xe8
push eax
push 0x40
sub esi, 0x4bc037
mov dword [esp + 0x18], 0
push 5
mov dword [esp + 0x21], esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x4bc032
call esi
test eax, eax
je 0x10005baf
mov eax, dword [esp + 0x14]
mov ecx, 0x4bc032
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10005bb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10003440
push 0x4b8c44
push 0xe8
call fcn.1000c8e0
mov ecx, 0x10003330
push 6
lea eax, [ecx - 0x519092]
mov dword [0x51908e], eax
lea eax, [ecx - 0x4deb6e]
mov dword [0x4deb6a], eax
lea eax, [ecx - 0x4deff7]
mov dword [0x4deff3], eax
sub ecx, 0x4f18cb
mov dword [0x4f18c7], ecx
mov ecx, 0x100033c0
lea eax, [ecx - 0x4ff165]
sub ecx, 0x4ff1f9
mov dword [0x4ff161], eax
mov dword [0x4ff1f5], ecx
call fcn.1000e0bf
mov esi, eax
mov dword [esp + 0x20], 0
add esp, 0x10
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
lea eax, [esp + 0x10]
push eax
push 0x40
push 6
push 0x4e9431
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10005c7d
mov eax, dword [esi]
mov ecx, 0x4e9431
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xe
call fcn.1000e0bf
mov esi, eax
mov dword [esp + 0x14], 0
mov eax, 0x90909090
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov word [esi + 0xc], ax
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xe
push 0x50378c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10005cfd
movq xmm0, qword [esi]
mov ecx, 0x50378c
movq qword [ecx], xmm0
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [ecx + 0xc], ax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 0xe
push ecx
call esi
test eax, eax
jne 0x10005d09
jmp 0x10005d03
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x10003030
mov byte [esp + 0x14], 0xe9
sub eax, 0x50378c
mov dword [esp + 0x10], 0
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x503787
call esi
test eax, eax
je 0x10005d64
mov eax, dword [esp + 0x14]
mov ecx, 0x503787
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10005d6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x100030d0
mov byte [esp + 0x14], 0xe9
sub eax, 0x503d1b
mov dword [esp + 0x10], 0
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x503d16
call esi
test eax, eax
je 0x10005dc5
mov eax, dword [esp + 0x14]
mov ecx, 0x503d16
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x24], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10005dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.10002620
push 0x1003be80
push 0x40
push 0x361097
push 0x401000
call esi
test eax, eax
je 0x10005f0b
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
push str.SOFTWAREWebzenMuConfig
push 0x80000001
mov dword [esp + 0x28], 4
call ebx
test eax, eax
jne 0x10005e4e
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push str.Resolution
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005e48
cmp dword [esp + 0x10], 3
jle 0x10005e4e
mov byte [0x51c296], 0xa0
mov byte [0x51c2a0], 0x20
jmp 0x10005e4e
push dword [esp + 0x14]
call edi
mov byte [0x4b8c1a], 0xe8
mov eax, 0x10003520
sub eax, 0x4b8c1f
mov ecx, 0x90909090
mov dword [0x4b8c1b], eax
mov eax, 0x4904fc
mov byte [0x4904de], 0x90
push str..msv.dll
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
mov eax, 0x4301bd
mov byte [0x4ba888], 0x20
mov byte [0x43019f], 0x90
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
mov eax, 0x432c35
mov byte [0x432bfc], 0x90
mov byte [0x432c21], 0x90
mov dword [eax], ecx
mov word [eax + 4], cx
mov eax, 0x5032a5
mov byte [0x41e3fc], 0xeb
mov byte [0x41e25b], 0x74
mov byte [0x53853b], 0xeb
mov byte [eax], 0x50
mov eax, 0x503384
mov byte [eax], 0x50
mov eax, 0x5033af
mov byte [eax], 0x50
mov eax, 0x503405
mov byte [eax], 0x50
mov eax, 0x503430
mov byte [eax], 0x50
mov eax, 0x5034dd
mov byte [eax], 0x50
mov eax, 0x503508
mov byte [eax], 0x50
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x14c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000db39
mov esp, ebp
pop ebp
ret