Function at 0x1000a350
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get session user name
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060f0d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2bc
mov eax, dword [0x1007e064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
mov dword [ebp - 0x2c0], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], 0x68
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2a8]
sub ecx, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x2b0]
mov dword [0x10082330], ecx
mov dword [0x10082334], eax
jmp 0x1000a3f7
lea ecx, [ebp - 0x250]
call fcn.10011d70
cmp dword [eax + 0x14], 0x10
jb 0x1000a40a
mov eax, dword [eax]
push eax
push 0x10071428
push 0x10082448
call fcn.100089b0
mov edx, dword [ebp - 0x23c]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a457
mov ecx, dword [ebp - 0x250]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a44d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae5f
push edx
push ecx
call fcn.100395b2
add esp, 8
movaps xmm0, xmmword [0x100777c0]
lea edi, [ebp - 0x230]
mov eax, 0x80000002
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x230], xmm0
pop ebx
mov dword [edi], eax
lea eax, [ebp - 0x234]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
push str._08X_08X
push eax
call fcn.100089b0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x250], 0
add esp, 0x10
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a4d0
sub ecx, edx
lea eax, [ebp - 0x234]
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.1000cb50
cmp dword [ebp - 0x23c], 0x10
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push eax
push 0x10071428
push 0x10082560
call fcn.100089b0
mov edx, dword [ebp - 0x23c]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a54d
mov ecx, dword [ebp - 0x250]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a543
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae64
push edx
push ecx
call fcn.100395b2
add esp, 8
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x2c0], 0x101
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
test eax, eax
je 0x1000a5a9
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a596
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
jmp 0x1000a5b0
push 0
push 0x10070127
lea ecx, [ebp - 0x238]
call fcn.1000cb50
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
push 0x10071428
push 0x100824a0
call fcn.100089b0
mov edx, dword [ebp - 0x224]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a61c
mov ecx, dword [ebp - 0x238]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a612
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae69
push edx
push ecx
call fcn.100395b2
add esp, 8
lea ecx, [ebp - 0x250]
call fcn.10011e60
cmp dword [eax + 0x14], 0x10
jb 0x1000a62f
mov eax, dword [eax]
push eax
push 0x10071428
push 0x100824f4
call fcn.100089b0
mov edx, dword [ebp - 0x23c]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a67c
mov ecx, dword [ebp - 0x250]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a672
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae6e
push edx
push ecx
call fcn.100395b2
add esp, 8
push 0x17
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x250]
push str.wmic_csproduct_get_uuid
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cb50
lea edx, [ebp - 0x250]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.10011b20
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x23c]
cmp edx, 0x10
jb 0x1000a70c
mov ecx, dword [ebp - 0x250]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a702
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae73
push edx
push ecx
call fcn.100395b2
add esp, 8
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
push 0x10071428
push 0x10082528
call fcn.100089b0
mov edx, dword [ebp - 0x224]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a76d
mov ecx, dword [ebp - 0x238]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a763
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae78
push edx
push ecx
call fcn.100395b2
add esp, 8
lea eax, [ebp - 0x2bc]
mov dword [ebp - 4], 1
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
mov dword [ebp - 0x238], 0
push 0x80000002
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
mov dword [ebp - 0x2c0], 0xf
mov dword [ebp - 0x2c4], 0x40
mov dword [ebp - 0x2c8], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x2bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
jne 0x1000a82c
test eax, eax
jne 0x1000a82c
lea ecx, [ebp - 0x290]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a810
sub ecx, edx
lea eax, [ebp - 0x290]
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.1000cb50
push dword [ebp - 0x2bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
push 0x10071428
push 0x100823c4
call fcn.100089b0
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
mov edx, dword [ebp - 0x224]
cmp edx, 0x10
jb 0x1000a8a0
mov ecx, dword [ebp - 0x238]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a896
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae7d
push edx
push ecx
call fcn.100395b2
add esp, 8
push 0x18
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x250]
push str.wmic_cpu_get_processorid
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cb50
lea edx, [ebp - 0x250]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.10011b20
mov edx, dword [ebp - 0x23c]
cmp edx, 0x10
jb 0x1000a929
mov ecx, dword [ebp - 0x250]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a91f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae82
push edx
push ecx
call fcn.100395b2
add esp, 8
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
push 0x10071428
push 0x1008259c
call fcn.100089b0
mov edx, dword [ebp - 0x224]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a98a
mov ecx, dword [ebp - 0x238]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a980
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ae87
push edx
push ecx
call fcn.100395b2
add esp, 8
jmp 0x1000a99c
mov edx, str.xxxx____x____x____xxx____xx____xxxxx____xxxx____xxxxxxxxx____xxx
mov ecx, 0x10071480
call fcn.1001e200
mov edx, str.xxx____x____xxxxxx____xx_____xx____xxx
mov dword [0x100822dc], eax
mov ecx, 0x1007150c
call fcn.1001e200
mov edx, str.xxx____xxxxx____xxxx____x____x____x____xx____xx____xx
mov dword [0x100822d0], eax
mov ecx, 0x1007155c
call fcn.1001e200
mov edx, str.xxxxxxxxx
mov dword [0x10082300], eax
mov ecx, 0x100715cc
call fcn.1001e200
mov edx, str.xxxxxx____xxxxxxxxx____xxxxx
mov dword [0x100822fc], eax
mov ecx, 0x100715e4
call fcn.1001e200
mov edx, str.xxx____xxxxx____xxxx____xxx____x____xx____xxxxxxxxx____xx____xx____xxxx____x
mov dword [0x100822ec], eax
mov ecx, 0x10071628
call fcn.1001e200
mov edx, str.xxxxx____x____xxxxxxxxxxxx
mov dword [0x10082304], eax
mov ecx, 0x100716c8
call fcn.1001e200
mov dword [0x100822d8], eax
test eax, eax
jne 0x1000aa40
mov edx, str.xxxxx____x____xxxxxxxxxxxxx
mov ecx, 0x10071700
call fcn.1001e200
mov dword [0x100822d8], eax
call fcn.10021310
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.100217e0
push fcn.10009de0
push 0x100822dc
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x10009f50
push 0x100822d0
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x1000a010
push 0x10082300
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x1000a0c0
push 0x100822fc
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x1000a1d0
push 0x100822ec
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x10009d40
push 0x100825d0
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x1000a280
push 0x1007eae4
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x1000a1f0
push 0x10082304
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
call fcn.10021310
call esi
push eax
call fcn.100217e0
push 0x1000a210
push 0x100822d8
call fcn.10020da0
call fcn.10021370
test eax, eax
jne 0x1000ae5a
mov eax, dword [0x10082330]
mov ecx, 0x400
mov edi, dword [0x10082334]
cmp eax, ecx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
cmovl eax, ecx
mov ecx, 0x300
push eax
cmp edi, ecx
mov dword [0x10082330], eax
lea eax, [ebp - 0x220]
cmovl edi, ecx
push 0x100775e8
push eax
mov dword [0x10082334], edi
call esi
add esp, 0xc
lea eax, [ebp - 0x120]
push edi
push 0x100775e8
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x220]
add esp, 0xc
push str..._ini_GameSetup.ini
push eax
push str.ScrWidth
push str.ScreenMode
call esi
push str..._ini_GameSetup.ini
lea eax, [ebp - 0x120]
push eax
push str.ScrHeight
push str.ScreenMode
call esi
push str..._ini_GameSetup.ini
push 0x1007765c
push 0x10077660
push str.ScreenMode
call esi
push str..._ini_GameSetup.ini
push 0x10077678
push 0x1007767c
push str.ScreenMode
call esi
jmp 0x1000ac7f
mov edi, dword [0x100825d4]
lea ecx, [ebp - 0x2bc]
mov eax, dword [0x100a37ac]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ecx
push 0x40
push edi
push eax
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2bc], 0
call esi
push 0
push edi
push str.qVKrXjHZYhRPqGsw
push dword [ebp - 0x2c0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x2bc]
push edi
push dword [ebp - 0x2c0]
call esi
jmp 0x1000acf0
cmp dword [0x1007eb5c], 1
jne 0x1000ad26
xorps xmm0, xmm0
lea edx, [ebp - 0x250]
sub esp, 8
movq qword [ebp - 0x240], xmm0
movups xmmword [ebp - 0x250], xmm0
call fcn.10013af0
add esp, 8
mov dword [0x1007eb5c], 0
jmp 0x1000ad38
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10081b10]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100b7fb0]
cmp eax, dword [ecx + 4]
jle 0x1000ad95
push 0x100b7fb0
call fcn.10039192
add esp, 4
cmp dword [0x100b7fb0], 0xffffffff
jne 0x1000ad95
call fcn.100227a5
push 0
push 0x989680
push edx
push eax
call fcn.100606e0
push 0x100b7fb0
mov dword [0x100b7fa8], eax
mov dword [0x100b7fac], edx
call fcn.10039148
add esp, 4
push 0x58
lea eax, [ebp - 0x2a8]
push 0
push eax
call fcn.1003b1c0
mov ecx, dword [0x100b7fac]
add esp, 0xc
mov eax, dword [0x100b7fa8]
xorps xmm0, xmm0
mov dword [ebp - 0x29c], ecx
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x2a8], str.Play_2_Win
mov dword [ebp - 0x2a4], str.Version:_5517
mov dword [ebp - 0x2a0], eax
movlpd qword [ebp - 0x298], xmm0
mov dword [ebp - 0x290], 0x100719d8
mov dword [ebp - 0x28c], str.Thunder_Conquer
mov dword [ebp - 0x27c], str.Website
mov dword [ebp - 0x278], str.http:__thunder_co.servegame.com
mov dword [ebp - 0x274], str.Facebook
mov dword [ebp - 0x270], str.https:__www.facebook.com_groups_797841362562698
call fcn.10014130
call fcn.10042283
jmp 0x1000ae3c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10039070
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1000f170
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
call fcn.10041b5d
int3