Function at 0x10023e40
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x318
mov eax, dword [0x10065040]
xor eax, esp
mov dword [esp + 0x314], eax
push esi
push edi
lea eax, [esp + 0x88]
mov dword [esp + 0x90], 1
push eax
push 0x1006a4c8
lea eax, [esp + 0x98]
mov dword [esp + 0x90], 0x208
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10023ed9
push str.Steam.exe
push 0x104
push 0x1006a4c8
call fcn.10037b81
add esp, 0xc
mov edx, 0x1006a4c8
mov ecx, 0x10069b78
call fcn.10001d80
cmp al, 1
jne 0x10023ed9
mov byte [0x10068485], al
push 0x5c
push 0x10069b78
call fcn.1002f030
add esp, 8
test eax, eax
je 0x10023ef1
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x10068488
call fcn.1002f030
add esp, 8
test eax, eax
je 0x10023f09
xor ecx, ecx
mov word [eax], cx
cmp byte [0x10068485], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [eax]
jne 0x10024586
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x100690d4
call esi
push 0x1000000
push 0
push 0x1006aaf0
call esi
push 0x1000000
push 0
push 0x10069520
call esi
push 0x10023e00
nop dword [eax + eax]
call fcn.100377aa
add esp, 4
push 0x10023e20
call fcn.10037f60
add esp, 4
push 0x104
push 0x10069538
push 0x1005ce64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10069d88
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x100241c8
test eax, eax
je 0x100241c8
push 0x10069538
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10069e98
call fcn.10001320
add esp, 0x14
push 0x10069d88
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10069968
call fcn.100013e0
add esp, 0x14
push 0x10069d88
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10069a70
call fcn.100013e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x50]
add esp, 0x14
mov dword [esp + 0x3c], 0
mov dword [esp + 0x90], 4
mov dword [esp + 0x88], 4
push eax
push 0x20019
push 0
push 0x10069e98
push 0x80000001
call esi
test eax, eax
jne 0x10024086
lea eax, [esp + 0x88]
push eax
push 0x10065ae0
lea eax, [esp + 0x98]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0x20019
push 0
push 0x10069e98
push 0x80000001
mov dword [esp + 0xa4], 4
mov dword [esp + 0x9c], 4
call esi
nop dword [eax]
test eax, eax
jne 0x100240f4
lea eax, [esp + 0x88]
push eax
push 0x10065ae4
lea eax, [esp + 0x98]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0x20019
push 0
push 0x10069e98
push 0x80000001
mov dword [esp + 0xa4], 4
mov dword [esp + 0x9c], 4
call esi
test eax, eax
jne 0x1002415e
lea eax, [esp + 0x88]
push eax
push 0x10065cf0
lea eax, [esp + 0x98]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0x20019
push 0
push 0x10069e98
push 0x80000001
mov dword [esp + 0xa4], 4
mov dword [esp + 0x9c], 4
call esi
test eax, eax
jne 0x100241c8
lea eax, [esp + 0x88]
push eax
push 0x100690f8
lea eax, [esp + 0x98]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10069b78
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10069740
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069740
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x1002421b
push eax
call esi
mov byte [0x10068695], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x1006a6d0
push str.Exe______s_r_n
call fcn.100025a0
add esp, 8
cmp byte [0x10068695], 0
jne 0x10024330
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f340
add esp, 0xc
mov dword [esp + 0x90], 1
lea eax, [esp + 0x88]
mov dword [esp + 0x88], 0x208
push eax
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x98]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10024326
cmp dword [0x10069314], 0
je 0x10024309
mov eax, dword [0x10074f9c]
nop dword [eax]
test eax, eax
je 0x10024309
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x1a
push 0x1005cffc
push eax
mov dword [esp + 0x9c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x10069314]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.1002d706
mov esp, ebp
pop ebp
ret
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x110]
push eax
jmp 0x10024335
push 0x10069b78
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10068068
call fcn.10001320
add esp, 0x14
push 0x10069b78
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x10068698
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068698
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100243af
push eax
call esi
push 0x10068698
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.100025a0
add esp, 8
push 8
push 0
push 0x10068698
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x10068488
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x1006a0b0
call fcn.10001320
add esp, 0x14
push 0x10069538
push 0x10068488
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10068cc0
call fcn.10001320
push 0x10069538
push 0x10068488
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x1006ad20
call fcn.10001320
push 0x10068488
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x100751b0
call fcn.10001320
add esp, 0x44
push 0x10068488
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x10068ab0
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10068ec8
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100688a8
call fcn.10001320
add esp, 0x14
push str.DenuvoActivationBypass.dll
call edi
mov dword [0x10074f80], eax
test eax, eax
jne 0x100244ac
push str.DenuvoOfflineActivationBypass.dll
call edi
mov dword [0x10074f80], eax
test eax, eax
je 0x10024ef6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetDenuvoCallResult
push eax
call esi
push str.GetDenuvoID
push dword [0x10074f80]
mov dword [0x1006ab10], eax
call esi
push str.RequestDenuvoAppTicket
push dword [0x10074f80]
mov dword [0x10069e90], eax
call esi
push str.GetDenuvoAppTicket
push dword [0x10074f80]
mov dword [0x1006ab14], eax
call esi
push str.ShutdownDenuvoDll
push dword [0x10074f80]
mov dword [0x1006995c], eax
call esi
cmp dword [0x1006ab10], 0
mov dword [0x10068480], eax
je 0x1002453b
cmp dword [0x10069e90], 0
je 0x1002453b
cmp dword [0x1006ab14], 0
je 0x1002453b
cmp dword [0x1006995c], 0
je 0x1002453b
test eax, eax
je 0x1002453b
mov byte [0x10068697], 1
jmp 0x10024efc
cmp dword [0x10069314], 0
je 0x10024565
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10024565
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x29
push 0x1005d30c
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10067e5f], 1
jne 0x100245a5
mov byte [0x10067e5e], 1
mov byte [0x10068484], 1
nop dword [eax]
jmp 0x100246bf
push 0x10068488
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x1006af28
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x1006af28
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10024610
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1006af28
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10067e5e], 1
mov byte [0x10068484], 1
jmp 0x100246bf
push 0x1000000
push 0
push 0x100690d4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x10068488
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10068068
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10068ec8
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100688a8
call fcn.10001320
add esp, 0x14
push str.GreenLuma_2024_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x1006a6d0
push str.Exe______s_r_n
call fcn.100025a0
push 0x10023e00
call fcn.100377aa
add esp, 0xc
push 0x10023e20
call fcn.10037f60
add esp, 4
push 0x10068488
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10069318
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10069100
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sAppListAppList.ini
push 0xffffffffffffffff
push 0x104
push 0x10068270
call fcn.10001320
add esp, 0x14
push 0x10068488
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x1006ab18
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068270
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002484e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20a
call fcn.1002d91e
add esp, 4
mov dword [esp + 0x10], eax
push 0x208
push 0
push eax
call fcn.1002f340
mov eax, dword ds:[esp + 0x1c]
add esp, 0xc
push 0x10068270
push 0x104
push eax
mov byte [eax + 0x208], 0
call fcn.10037b1d
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x100247b7
mov byte [eax + 0x208], 1
cmp byte ds:[eax + 0x208], 0
je 0x1002482f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10037ea0
push dword [esp + 0x10]
push 0
push str.NumAppIDs
push str.AppList
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax]
test eax, eax
jne 0x1002482b
call fcn.10037ea0
cmp dword [eax], 0
jne 0x1002482b
mov eax, dword [esp + 0x88]
test eax, eax
mov dword [0x100751ac], eax
mov eax, dword [esp + 0x10]
je 0x10024839
mov byte [0x10067e5d], 1
jmp 0x10024839
mov eax, dword [esp + 0x10]
mov dword [0x100751ac], 0
push 0x20a
push eax
mov byte [eax + 0x208], 0
call fcn.1002dc68
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x1006ab18
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10024886
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1006ab18
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10068484], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069100
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002494e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10068484], 1
nop dword [eax]
je 0x10024b09
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop word [eax + eax]
sub eax, 6
je 0x10024b09
sub eax, 1
jne 0x1002494e
xor edi, edi
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f340
add esp, 0xc
lea eax, [esp + 0x110]
push edi
push 0x10069318
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
add esp, 0x18
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, 0x82
jb 0x100248f0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x10068690], eax
call fcn.100366e5
add esp, 4
push eax
push 0x1005d55c
push 0x1005d560
push 0x1006aaec
call fcn.100365fd
push 1
call fcn.100366e5
add esp, 0x14
push eax
push 0x1005d570
push 0x1005d574
push 0x100690d0
call fcn.100365fd
push 2
call fcn.100366e5
add esp, 0x14
push eax
push 0x1005d570
push 0x1005d574
push 0x1006a8d8
call fcn.100365fd
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.100012a0
add esp, 0x14
push 0
call fcn.100366e5
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.10037d9e
add esp, 0xc
test eax, eax
je 0x10024ad3
nop dword [eax + eax]
lea ecx, [esp + 0xa0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024a20
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x10025fee
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xa8], ax
lea eax, [esp + 0xa8]
push eax
call fcn.1003705b
add esp, 0xc
mov dword [esp + 0x88], eax
call fcn.10037ea0
cmp dword [eax], 0x22
je 0x10025f86
mov eax, dword [esp + 0x88]
test eax, eax
je 0x10024a8b
nop dword [eax]
cmp eax, 0x82
jle 0x10024cae
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movaps xmmword [esp + 0xa4], xmm0
call fcn.100012a0
add esp, 4
push 0
call fcn.100366e5
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.10037d9e
add esp, 0xc
test eax, eax
jne 0x10024a10
cmp dword [0x10069314], 0
nop word [eax + eax]
je 0x10025fce
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10025fce
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x23
push 0x1005d5f0
jmp 0x100242d5
mov dword [esp + 0xc], 0
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f340
add esp, 0xc
lea eax, [esp + 0x110]
push dword [esp + 0xc]
push 0x10069318
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push 0x10055c28
lea eax, [esp + 0x12c]
mov dword [esp + 0x58], 0
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.10037356
add esp, 0x24
test eax, eax
jne 0x10024efc
push dword [esp + 0x3c]
mov dword [esp + 0xd4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xc4]
movaps xmmword [esp + 0xc4], xmm0
push 0x14
push eax
call fcn.10037d93
add esp, 0xc
test eax, eax
je 0x10024c66
push dword [esp + 0x3c]
call fcn.100374f2
add esp, 4
lea eax, [esp + 0xc0]
push 0xa
push 0
push eax
call fcn.10037015
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x88]
mov ecx, dword [ecx*4 + 0x10065ae8]
push eax
lea eax, [esp + 0x94]
mov dword [esp + 0x8c], ecx
push eax
call fcn.10026980
call fcn.10037ea0
cmp dword ds:[eax], 0x22
je 0x10024c1b
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x82
jb 0x10024b11
jmp 0x10024efc
cmp dword [0x10069314], 0
je 0x10024c45
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10024c45
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x16
push 0x1005d518
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10069314], 0
je 0x10024c8e
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10024c8e
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x2b
push 0x1005d494
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0xc], ecx
test eax, eax
jle 0x10024e1c
mov edx, str._nAppID:
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012a0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xf0], xmm0
movq qword [esp + 0x100], xmm0
push 0
call fcn.100366e5
add esp, 4
push eax
lea eax, [esp + 0xe4]
push 0x14
push eax
call fcn.10037d9e
add esp, 0xc
test eax, eax
je 0x10024eaf
lea ecx, [esp + 0xe0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024d20
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x10025fee
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xe8], ax
lea eax, [esp + 0xe8]
push eax
call fcn.1003705b
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x90], eax
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x98]
mov ecx, dword [ecx*4 + 0x10065ae8]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x9c], ecx
push eax
call fcn.10026980
call fcn.10037ea0
cmp dword [eax], 0x22
je 0x10024e6b
push 0
push 0x10069318
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f340
add esp, 0xc
lea eax, [esp + 0x110]
push dword [esp + 0xc]
push 0x10069318
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push dword [esp + 0xa8]
lea eax, [esp + 0x12c]
push 0x10053a64
push eax
call fcn.10002dc0
mov ecx, dword [esp + 0x30]
add esp, 0x24
inc ecx
mov edx, str._nAppID:
mov dword [esp + 0xc], ecx
cmp ecx, dword [esp + 0x88]
jl 0x10024cc1
cmp dword [0x10068690], 1
jne 0x10024efc
mov eax, dword [0x1006aaec]
test eax, eax
je 0x10024e3b
push eax
call fcn.100374f2
add esp, 4
mov eax, dword [0x100690d0]
test eax, eax
je 0x10024e4d
push eax
call fcn.100374f2
add esp, 4
mov eax, dword [0x1006a8d8]
test eax, eax
je 0x10024e5f
push eax
call fcn.100374f2
add esp, 4
nop
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x10024efc
cmp dword [0x10069314], 0
je 0x10024e93
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10024e93
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x16
push 0x1005d738
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10069314], 0
je 0x10024eda
mov eax, dword [0x10074f9c]
nop dword [eax]
test eax, eax
je 0x10024eda
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x23
push 0x1005d6c8
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10074d78
push str.GreenLuma_2024_Dll______s_r_n
call fcn.100025a0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x100751a8], eax
call fcn.100022e0
add esp, 8
call fcn.10028550
cmp dword [0x100753c4], 0
jne 0x10025f36
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100753c4], eax
xor ecx, ecx
mov edx, 0x100753c0
xchg dword [edx], ecx
test eax, eax
je 0x10025f3f
push str.ForzaHorizon4.exe
call edi
push str.ForzaHorizon5.exe
mov dword [esp + 0x8c], eax
call edi
cmp byte [0x10067e5f], 0
mov dword ds:[esp + 0x34], eax
jne 0x100250c8
cmp byte [0x10068485], 0
jne 0x100250d4
cmp dword ds:[esp + 0x88], 0
jne 0x100250ae
test eax, eax
jne 0x100250ae
lea eax, [esp + 0x90]
mov dword [esp + 0x98], 1
push eax
push 0x1006a8e0
lea eax, [esp + 0xa0]
mov dword [esp + 0x98], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1002503b
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.100022e0
add esp, 4
mov ecx, 0x208
mov eax, 0x1006a8e0
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10025010
push 0x10068488
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x1006a8e0
call fcn.10001320
add esp, 0x14
jmp 0x10025048
push str.Got_Steamclient_dll_paths_from_registry_r_n
call fcn.100022e0
add esp, 4
push 8
push 0
push 0x1006a8e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x1006aae8], eax
nop dword [eax]
test eax, eax
jne 0x100250d4
cmp dword [0x10069314], eax
je 0x1002508f
mov eax, dword [0x10074f9c]
test eax, eax
je 0x1002508f
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x20
push 0x1005d970
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10023940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100250d4
push str.steamclient.dll
call edi
mov dword [0x1006aae8], eax
cmp byte [0x10067e5e], 0
nop dword [eax + eax]
jne 0x10025b88
cmp dword [0x1006aae8], 0
je 0x1002532e
push str.Steamclient.dll_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x1006a8e0
push str.Steamclient______s_r_n_r_n
call fcn.100025a0
add esp, 8
push str.steamclient.dll
call edi
test eax, eax
jne 0x10025127
mov dword [esp + 0x3c], 0xb
jmp 0x10025152
push str.CreateInterface
push eax
call esi
test eax, eax
jne 0x1002513d
mov dword [esp + 0x3c], 0xc
jmp 0x10025152
push 0x1006ab08
mov edx, 0x10004280
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x3c], eax
push str.steamclient.dll
call edi
test eax, eax
jne 0x10025167
mov dword [esp + 0x18], 0xb
jmp 0x10025192
push str.Steam_BGetCallback
push eax
call esi
test eax, eax
jne 0x1002517d
mov dword [esp + 0x18], 0xc
jmp 0x10025192
push 0x10069d80
mov edx, 0x10004b00
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x18], eax
push str.steamclient.dll
call edi
test eax, eax
jne 0x100251a7
mov dword [esp + 0xc], 0xb
jmp 0x100251d2
push str.Steam_FreeLastCallback
push eax
call esi
test eax, eax
jne 0x100251bd
mov dword [esp + 0xc], 0xc
jmp 0x100251d2
push 0x10069950
mov edx, 0x10004cc0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0xc], eax
push str.steamclient.dll
call edi
test eax, eax
jne 0x100251e7
mov dword [esp + 0x14], 0xb
jmp 0x10025212
push str.Steam_GetAPICallResult
push eax
call esi
test eax, eax
jne 0x100251fd
mov dword [esp + 0x14], 0xc
jmp 0x10025212
push 0x10068cbc
mov edx, 0x10004d80
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x14], eax
push str.CreateInterface
push dword [0x1006aae8]
call esi
mov edx, 1
mov ecx, eax
call fcn.10028b00
push str.Steam_BGetCallback
push dword [0x1006aae8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028b00
push str.Steam_FreeLastCallback
push dword [0x1006aae8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028b00
push str.Steam_GetAPICallResult
push dword [0x1006aae8]
mov dword ds:[esp + 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028b00
mov ecx, esi
mov dword [esp + 0x98], eax
call fcn.10028c00
mov ecx, dword [esp + 0x3c]
push eax
call fcn.10028c00
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.100022e0
add esp, 0xc
mov ecx, edi
call fcn.10028c00
mov ecx, dword [esp + 0x18]
push eax
call fcn.10028c00
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x9c]
add esp, 0xc
call fcn.10028c00
mov ecx, dword [esp + 0xc]
push eax
call fcn.10028c00
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0xa4]
add esp, 0xc
call fcn.10028c00
mov ecx, dword [esp + 0x14]
push eax
call fcn.10028c00
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.100022e0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
cmp dword [esp + 0x88], 0
jne 0x10025b62
cmp dword [esp + 0x34], 0
jne 0x10025b62
push str.ntdll.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002535f
mov eax, 0xb
jmp 0x10025385
push str.NtCreateUserProcess
push eax
call esi
test eax, eax
jne 0x10025372
mov eax, 0xc
jmp 0x10025385
push 0x10074f8c
mov edx, 0x10003420
mov ecx, eax
call fcn.100286a0
push str.ntdll.dll
mov dword [0x10074f98], eax
call edi
test eax, eax
jne 0x1002539c
mov eax, 0xb
jmp 0x100253c5
push str.NtResumeThread
push eax
call esi
test eax, eax
jne 0x100253af
mov eax, 0xc
jmp 0x100253c5
push 0x10069958
mov edx, 0x100041a0
mov ecx, eax
call fcn.100286a0
push str.ntdll.dll
mov dword [0x10074f84], eax
call edi
test eax, eax
jne 0x100253df
mov dword [esp + 0x24], 0xb
jmp 0x1002540a
push str.LdrLoadDll
push eax
call esi
test eax, eax
jne 0x100253f5
mov dword [esp + 0x24], 0xc
jmp 0x1002540a
push 0x1006a0a8
mov edx, 0x10009180
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x24], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002541f
mov dword [esp + 0x28], 0xb
jmp 0x1002544a
push str.LdrGetDllHandleEx
push eax
call esi
test eax, eax
jne 0x10025435
mov dword [esp + 0x28], 0xc
jmp 0x1002544a
push 0x10074d74
mov edx, 0x10009200
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x28], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002545f
mov dword [esp + 0x2c], 0xb
jmp 0x1002548a
push str.LdrGetDllFullName
push eax
call esi
test eax, eax
jne 0x10025475
mov dword [esp + 0x2c], 0xc
jmp 0x1002548a
push 0x100690ec
mov edx, 0x10009280
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x2c], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002549f
mov dword [esp + 0x30], 0xb
jmp 0x100254ca
push str.LdrGetDllHandleByMapping
push eax
call esi
test eax, eax
jne 0x100254b5
mov dword [esp + 0x30], 0xc
jmp 0x100254ca
push 0x10069b74
mov edx, 0x100092e0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x30], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100254df
mov dword [esp + 0x34], 0xb
jmp 0x1002550a
push str.LdrGetDllHandleByName
push eax
call esi
test eax, eax
jne 0x100254f5
mov dword [esp + 0x34], 0xc
jmp 0x1002550a
push 0x10069a6c
mov edx, 0x10009360
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x34], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x10025522
mov dword [esp + 0x98], 0xb
jmp 0x10025553
push str.LdrQueryProcessModuleInformation
push eax
call esi
test eax, eax
jne 0x1002553b
mov dword [esp + 0x98], 0xc
jmp 0x10025553
push 0x10074d70
mov edx, 0x100093e0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x98], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002556b
mov dword [esp + 0x90], 0xb
jmp 0x1002559c
push str.LdrEnumerateLoadedModules
push eax
call esi
test eax, eax
jne 0x10025584
mov dword [esp + 0x90], 0xc
jmp 0x1002559c
push 0x100688a4
mov edx, 0x10009520
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x90], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100255b4
mov dword [esp + 0x88], 0xb
jmp 0x100255ec
push str.RtlLockModuleSection
push eax
call esi
nop dword [eax]
test eax, eax
jne 0x100255d1
mov dword [esp + 0x88], 0xc
jmp 0x100255ec
push 0x10069308
mov edx, 0x10009580
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x88], eax
push str.kernel32.dll
call edi
test eax, eax
je 0x1002561d
push str.Module32NextW
push eax
call esi
nop
test eax, eax
je 0x1002561d
push 0x10069960
mov edx, 0x100095a0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x18], eax
test eax, eax
je 0x1002565d
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025632
mov dword [esp + 0x18], 0xb
jmp 0x1002565d
push str.Module32NextW
push eax
call esi
test eax, eax
jne 0x10025648
mov dword [esp + 0x18], 0xc
jmp 0x1002565d
push 0x10069960
mov edx, 0x100095a0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x18], eax
push str.KernelBase.dll
call edi
test eax, eax
je 0x100257f7
push str.EnumProcessModules
push eax
call esi
test eax, eax
je 0x100257f7
push 0x1006ab0c
mov edx, 0x10009620
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x100257f7
push str.KernelBase.dll
nop
call edi
test eax, eax
jne 0x100256b0
mov dword [esp + 0x10], 0xb
jmp 0x100256db
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x100256c6
mov dword [esp + 0x10], 0xc
jmp 0x100256db
push 0x1006a2bc
mov edx, 0x10009960
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x10], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x100256f0
mov dword [esp + 0x1c], 0xb
jmp 0x1002571b
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x10025706
mov dword [esp + 0x1c], 0xc
jmp 0x1002571b
push 0x100753bc
mov edx, 0x10009ce0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x1c], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025730
mov dword [esp + 0x20], 0xb
jmp 0x1002575b
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x10025746
mov dword [esp + 0x20], 0xc
jmp 0x1002575b
push 0x1006a0a0
mov edx, 0x10009da0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x20], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025770
mov dword [esp + 0x14], 0xb
jmp 0x1002579b
push 0x1005dba0
push eax
call esi
test eax, eax
jne 0x10025786
mov dword [esp + 0x14], 0xc
jmp 0x1002579b
push 0x100753b8
mov edx, 0x10009e80
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x14], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x100257b8
mov dword [esp + 0xc], 0xb
push str.KernelBase.dll
jmp 0x10025980
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x100257d8
mov dword [esp + 0xc], 0xc
push str.KernelBase.dll
jmp 0x10025980
push 0x10068478
mov edx, 0x10009f40
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0xc], eax
push str.KernelBase.dll
jmp 0x10025980
push str.Psapi.dll
call edi
nop
test eax, eax
jne 0x1002580e
mov dword [esp + 0x3c], 0xb
jmp 0x10025839
push str.EnumProcessModules
push eax
call esi
test eax, eax
jne 0x10025824
mov dword [esp + 0x3c], 0xc
jmp 0x10025839
push 0x1006ab0c
mov edx, 0x10009620
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x3c], eax
push str.Psapi.dll
nop
call edi
test eax, eax
jne 0x10025850
mov dword [esp + 0x10], 0xb
jmp 0x1002587b
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x10025866
mov dword [esp + 0x10], 0xc
jmp 0x1002587b
push 0x1006a2bc
mov edx, 0x10009960
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x10], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10025890
mov dword [esp + 0x1c], 0xb
jmp 0x100258bb
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x100258a6
mov dword [esp + 0x1c], 0xc
jmp 0x100258bb
push 0x100753bc
mov edx, 0x10009ce0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x1c], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x100258d0
mov dword [esp + 0x20], 0xb
jmp 0x100258fb
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x100258e6
mov dword [esp + 0x20], 0xc
jmp 0x100258fb
push 0x1006a0a0
mov edx, 0x10009da0
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x20], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025910
mov dword [esp + 0x14], 0xb
jmp 0x1002593b
push 0x1005dba0
push eax
call esi
test eax, eax
jne 0x10025926
mov dword [esp + 0x14], 0xc
jmp 0x1002593b
push 0x100753b8
mov edx, 0x10009e80
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0x14], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10025950
mov dword [esp + 0xc], 0xb
jmp 0x1002597b
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x10025966
mov dword [esp + 0xc], 0xc
jmp 0x1002597b
push 0x10068478
mov edx, 0x10009f40
mov ecx, eax
call fcn.100286a0
mov dword [esp + 0xc], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x1002598b
lea esi, [eax + 0xb]
jmp 0x100259af
push str.GetMappedFileNameW
push eax
call esi
test eax, eax
jne 0x1002599c
lea esi, [eax + 0xc]
jmp 0x100259af
push 0x100690fc
mov edx, 0x1000a020
mov ecx, eax
call fcn.100286a0
mov esi, eax
mov ecx, dword [0x10074f98]
call fcn.10028c00
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [0x10074f84]
add esp, 8
call fcn.10028c00
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x2c]
add esp, 8
call fcn.10028c00
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.100022e0
mov ecx, dword ds:[esp + 0x30]
add esp, 8
call fcn.10028c00
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x34]
add esp, 8
call fcn.10028c00
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x38]
add esp, 8
call fcn.10028c00
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x3c]
add esp, 8
call fcn.10028c00
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.100022e0
mov ecx, dword ds:[esp + 0xa0]
add esp, 8
call fcn.10028c00
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x98]
add esp, 8
call fcn.10028c00
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x90]
add esp, 8
call fcn.10028c00
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10028c00
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x44]
add esp, 8
call fcn.10028c00
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x18]
add esp, 8
call fcn.10028c00
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10028c00
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x28]
add esp, 8
call fcn.10028c00
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10028c00
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x14]
add esp, 8
call fcn.10028c00
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.100022e0
add esp, 8
mov ecx, esi
call fcn.10028c00
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.100022e0
add esp, 8
mov edx, 1
xor ecx, ecx
call fcn.10028b00
mov ecx, eax
call fcn.10028c00
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.100022e0
add esp, 8
cmp byte [0x10068485], 1
jne 0x10025bfc
cmp byte [0x10067e5f], 1
nop dword [eax]
jne 0x10025bfc
push dword [0x1006aae8]
call dword [0x100688a0]
mov ecx, dword [0x1006aae8]
push str.xxxxxxxxxxxx
push 0x1005c97c
mov edx, dword [eax + 0x50]
call fcn.10001fc0
add esp, 8
mov dword [0x10069e94], eax
test eax, eax
je 0x10025bfc
push 0x1006a0ac
mov edx, 0x10002ec0
mov dword [0x1006a0ac], eax
mov ecx, eax
call fcn.100286a0
mov ecx, dword [0x10069e94]
mov edx, 1
call fcn.10028b00
cmp byte [0x10067e5e], 1
jne 0x10025ce6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x100690f4], eax
nop dword [eax]
test eax, eax
jne 0x10025c6e
cmp dword [0x10069314], eax
je 0x10025c4f
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10025c4f
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x19
push 0x1005de8c
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10023200
push 0
push 0
call esi
test eax, eax
je 0x10025c97
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x10025cf2
cmp dword [0x10069314], 0
nop
je 0x10025cc5
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10025cc5
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x19
push 0x1005dedc
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x10067e5f], 0
jne 0x10025d56
cmp byte [0x10068485], 0
push 0
jne 0x10025d8e
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x10068068
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10025d6c
push 0
lea eax, [esp + 0x8c]
mov dword [esp + 0x8c], 0
push eax
push 1
push 0x1005df2c
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.1002d706
mov esp, ebp
pop ebp
ret
push 0x10
push str.GreenLuma_2024
push 0x1005df30
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x100232c0
push 0
push 0
call esi
nop dword [eax]
test eax, eax
je 0x10025eee
push eax
call edi
push 0
push 0
push 0
push 0x10023780
push 0
push 0
call esi
nop dword [eax]
test eax, eax
je 0x10025eaa
push eax
call edi
xorps xmm0, xmm0
mov dword [esp + 0x40], 0x44
lea eax, [esp + 0x40]
movlpd qword [esp + 0x44], xmm0
push eax
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word ds:[esp + 0x72], 0x10
jb 0x10025d56
mov eax, dword [esp + 0x74]
test eax, eax
je 0x10025d56
lea esi, [eax + 4]
test esi, esi
je 0x10025e3d
mov esi, dword [esi]
jmp 0x10025e50
xor esi, esi
call fcn.10037ea0
mov dword [eax], 0x16
call fcn.10037766
lea eax, [esp + 0x88]
mov dword [esp + 0x88], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, 1
jne 0x10025d56
nop dword [eax]
nop word [eax + eax]
test byte [esp + 0x88], al
je 0x10025d56
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x31c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1002d706
mov esp, ebp
pop ebp
ret
cmp dword [0x10069314], 0
je 0x10025ed2
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10025ed2
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x19
push 0x1005dfac
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error_2
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10069314], 0
je 0x10025f1a
mov eax, dword [0x10074f9c]
nop dword [eax]
test eax, eax
je 0x10025f1a
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x17
push 0x1005df64
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, 0x100753c0
xchg dword [ecx], eax
cmp dword [0x10069314], 0
je 0x10025f67
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10025f67
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x1e
push 0x1005d7d8
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10069314], 0
je 0x10025fae
mov eax, dword [0x10074f9c]
test eax, eax
je 0x10025fae
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x16
push 0x1005d660
jmp 0x100242d5
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002d841
int3