Function at 0x100105c0
Capabilities:
Check os version
Create thread
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004049e
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
push esi
push edi
mov eax, dword [0x10053064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10010f83
call sym.HTAnthrax.dll_Lestat
cmp dword [0x100588f8], 1
jne 0x10010746
push str.USER32.DLL
mov dword [ebp - 0x2c], vtable.CSplash.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], str.SPLASH
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10
push 0
push 0
push 0
push str..GameGuard_Protect.bmp
push 0
mov dword [0x10058874], eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10010665
push eax
call esi
mov dword [ebp - 0x18], 0
test edi, edi
je 0x100106ac
lea eax, [ebp - 0x108]
mov dword [ebp - 0x18], edi
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x1001069a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10010691
push eax
call esi
mov dword [ebp - 0x18], 0
jmp 0x100106ac
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x808080
test eax, eax
je 0x100106ed
cmp dword [0x10058874], 0
je 0x100106ed
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [0x10058874]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10015170
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1001072e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], vtable.CSplash.0
test eax, eax
je 0x10010746
push eax
call esi
cmp dword [0x1005894c], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
jne 0x100107b8
call esi
cmp al, 6
jae 0x10010767
mov dword [0x10058860], 1
jmp 0x100107b8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100107b8
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100107b3
mov dword [0x10058858], 1
jmp 0x100107b8
call fcn.10005f00
cmp dword [0x10058978], 1
jne 0x10010903
sub esp, 8
lea ecx, [ebp - 0xf0]
push 1
push dword [0x10058880]
call fcn.10006010
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xe4], 6
je 0x10010888
call esi
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
sbb eax, eax
and eax, ecx
cmp eax, 0x1770
jae 0x10010821
mov dword [0x10058860], 1
call fcn.10005b20
jmp 0x10010826
call fcn.10005f00
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.10002f10
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf4], eax
mov dword [ebp - 4], 2
jmp 0x100108e9
mov dword [ebp + eax - 0xf0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov dword [0x1005885c], 1
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.10002f10
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf4], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], vtable.std::ios_base.0
push eax
call fcn.10017e5a
mov dword [ebp - 4], 0xffffffff
add esp, 4
cmp dword [0x10058908], 1
jne 0x1001091d
push 0
push 0
push 0x100134b0
call fcn.100248cf
add esp, 0xc
cmp dword [0x1005896c], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x1001095f
push 0
push 0
push 0
push 0x10008120
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10007bf0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10007f10
push 0
push 0
call edi
cmp dword [0x10058974], 0
je 0x100109f3
call fcn.100072e0
cmp dword [0x10058978], 1
jne 0x10010983
cmp dword [0x1005885c], 0
je 0x100109f3
cmp dword [0x1005894c], 1
jne 0x1001099e
cmp dword [0x10058860], 0
jne 0x1001099e
cmp dword [0x10058858], 0
je 0x100109f3
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push 8
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100109dc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x14
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x30]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100109ea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
je 0x10010f9b
cmp dword [0x10058980], 1
je 0x10010fa0
cmp dword [0x10058984], 1
je 0x10010fa5
cmp dword [0x100589b8], 1
jne 0x10010a27
push 0
push 0
push 0
push 0x10017800
push 0
push 0
call edi
cmp dword [0x10058964], 1
jne 0x10010a41
push 0
push 0
push 0
push 0x10009210
push 0
push 0
call edi
cmp dword [0x100589ac], 1
jne 0x10010a7c
push 0x1004a5b0
call fcn.1001f52f
push 0x1004a5b4
call fcn.1001f52f
push str.data40.wot
call fcn.1001f52f
add esp, 0xc
push 0
push 0
push 0
push 0x1000d0d0
push 0
push 0
call edi
cmp dword [0x100589a4], 1
jne 0x10010a9f
cmp dword [0x10058904], 0
jne 0x10010a9f
push 0
push 0
push 0
push 0x1000a420
push 0
push 0
call edi
cmp dword [0x100588e4], 1
jne 0x10010d07
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON_
mov ecx, 0x10057ba8
call fcn.100042d0
push eax
call fcn.10007400
mov edx, str.All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov ecx, 0x10057ba8
call fcn.100042d0
push eax
call fcn.10007400
add esp, 8
cmp dword [0x10058954], 1
jne 0x10010bc4
sub esp, 8
lea ecx, [ebp - 0xe8]
push 8
push str.GameGuard_Log.txt
call fcn.100032c0
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xe8]
call fcn.100042d0
lea ecx, [ebp - 0xe4]
call fcn.10003b10
test eax, eax
jne 0x10010b4a
mov eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0xe8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d30
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xec], eax
lea ecx, [ebp - 0xe4]
call fcn.10002f10
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xec], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 6
push eax
mov dword [ebp - 0x80], vtable.std::ios_base.0
call fcn.10017e5a
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10058964], 1
jne 0x10010e9b
lea eax, [ebp - 0x38]
push eax
call fcn.1001e44e
lea eax, [ebp - 0x38]
push eax
call fcn.1001e747
push 8
push 0x10049588
lea ecx, [ebp - 0x1b8]
mov esi, eax
call fcn.100032c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x1b8]
call fcn.100042d0
push esi
call fcn.1001d468
add esp, 4
lea ecx, [ebp - 0x1b8]
mov edx, eax
call fcn.100042d0
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
lea ecx, [ebp - 0x1b8]
call fcn.100042d0
mov edx, str._n__________________
lea ecx, [ebp - 0x1b8]
call fcn.100042d0
lea ecx, [ebp - 0x1b4]
call fcn.10003b10
test eax, eax
jne 0x10010c7c
mov eax, dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1b8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d30
push 2
push 0x10049588
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1bc], eax
lea ecx, [ebp - 0x1b4]
call fcn.10002f10
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1bc], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 4], 8
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10017e5a
add esp, 4
jmp 0x10010e9b
cmp dword [0x100588f4], 1
jne 0x10010d21
push 0
push 0
push 0
push 0x10012370
push 0
push 0
call edi
cmp dword [0x10058950], 1
jne 0x10010d3b
push 0
push 0
push 0
push 0x1000fd20
push 0
push 0
call edi
cmp dword [0x100589a0], 1
jne 0x10010d55
push 0
push 0
push 0
push 0x100104d0
push 0
push 0
call edi
cmp dword [0x100588fc], 1
jne 0x10010d6f
push 0
push 0
push 0
push 0x10016f10
push 0
push 0
call edi
cmp dword [0x10058988], 1
jne 0x10010d89
push 0
push 0
push 0
push 0x10014fc0
push 0
push 0
call edi
cmp dword [0x10058900], 1
jne 0x10010da3
push 0
push 0
push 0
push 0x10009f50
push 0
push 0
call edi
cmp dword [0x10058994], 1
jne 0x10010dbd
push 0
push 0
push 0
push 0x10013bb0
push 0
push 0
call edi
cmp dword [0x1005898c], 1
jne 0x10010dd7
push 0
push 0
push 0
push 0x1000b040
push 0
push 0
call edi
cmp dword [0x10058990], 1
jne 0x10010df1
push 0
push 0
push 0
push 0x10005430
push 0
push 0
call edi
cmp dword [0x10058998], 1
jne 0x10010e0b
push 0
push 0
push 0
push 0x10002310
push 0
push 0
call edi
cmp dword [0x10058948], 1
jne 0x10010e19
call fcn.10014130
cmp dword [0x10058960], 1
jne 0x10010e33
push 0
push 0
push 0
push 0x100164c0
push 0
push 0
call edi
cmp dword [0x1005893c], 1
jne 0x10010e4d
push 0
push 0
push 0
push 0x100157f0
push 0
push 0
call edi
cmp dword [0x100589a8], 1
jne 0x10010e67
push 0
push 0
push 0
push 0x10016980
push 0
push 0
call edi
cmp dword [0x1005899c], 1
jne 0x10010e81
push 0
push 0
push 0
push 0x10005800
push 0
push 0
call edi
cmp dword [0x1005895c], 1
jne 0x10010e9b
push 0
push 0
push 0
push 0x1000b3e0
push 0
push 0
call edi
cmp dword [0x100588ec], 1
jne 0x10010f20
mov eax, 0x7dbe6ac
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, eax
mov eax, dword [0x100588d4]
movups xmm0, xmmword [eax]
mov eax, 0x69216c
mov edx, eax
movups xmmword [ecx], xmm0
mov ecx, dword [0x100588d8]
mov dword [eax], 0
mov byte [eax + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
movzx eax, byte [ecx + 4]
xor ecx, ecx
mov byte [edx + 4], al
mov eax, 0x7dbe6c0
mov edx, eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
mov ecx, dword [0x100588dc]
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ax, word [ecx + 0xc]
mov word [edx + 0xc], ax
movzx eax, byte [ecx + 0xe]
mov byte [edx + 0xe], al
cmp dword [0x100588f0], 1
jne 0x10010f3a
push 0
push 0
push 0
push 0x10017730
push 0
push 0
call edi
cmp dword [0x10058904], 1
jne 0x10010f6e
cmp dword [0x100588e4], 0
jne 0x10010f6e
push 0
push 0
push 0
push 0x100171d0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100174c0
push 0
push 0
call edi
cmp dword [0x10058944], 1
jne 0x10010f83
push dword [0x100588bc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.10005850
call fcn.10010fb0
call fcn.10011100
int3