Function at 0x100168a0
Capabilities:
Acquire debug privileges
Check os version
Create thread
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040070
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x10057050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10016e33
call sym.OpenGuard.dll_OpenGuard
cmp dword [0x1005c9c8], 1
jne 0x10016a01
push str.lib_ayarlar.txt
call fcn.10022974
push str.libhesap1.txt
call fcn.10022974
push str.libhesap2.txt
call fcn.10022974
push str.libhesap3.txt
call fcn.10022974
push str.libhesap4.txt
call fcn.10022974
push str.liblib.txt
call fcn.10022974
push str.lib_ticaret.txt
call fcn.10022974
push str.libloglar.txt
call fcn.10022974
add esp, 0x18
lea ecx, [ebp - 0x60]
call fcn.1001a920
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0
call fcn.1001aa40
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5dc
call esi
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x10016986
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x5c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0x12c
call esi
sub esp, 8
lea ecx, [ebp - 0x2c]
call fcn.1001a920
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.1001aa40
push 0xbb8
call esi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100169d2
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x2c], vtable.CSplash.0
test eax, eax
je 0x100169e9
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], vtable.CSplash.0
test eax, eax
je 0x10016a01
push eax
call esi
cmp dword [0x1005ca34], 1
jne 0x10016a5a
cmp dword [0x1005d7a4], 0xb7
jne 0x10016a5a
mov eax, dword [0x1005ca18]
push 0x200030
push dword [0x1005c994]
cmp eax, 1
jne 0x10016a40
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10016a2b
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1005ca0c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
jne 0x10016ac0
call esi
cmp al, 6
jb 0x10016ac0
lea eax, [ebp - 0x38]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10016ac0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10016abb
mov dword [0x1005c938], 1
jmp 0x10016ac0
call fcn.10006090
cmp dword [0x1005ca38], 0
jne 0x10016b33
sub esp, 8
lea ecx, [ebp - 0x118]
push 1
push dword [0x1005c950]
call fcn.100061a0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x10c], 6
je 0x10016b1e
call esi
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
sbb eax, eax
and eax, ecx
cmp eax, 0x1770
jae 0x10016b17
call fcn.10005cb0
jmp 0x10016b28
call fcn.10006090
jmp 0x10016b28
mov dword [0x1005c93c], 1
lea ecx, [ebp - 0x118]
call fcn.10005f20
cmp dword [0x1005c9d8], 1
jne 0x10016b4d
push 0
push 0
push 0x100193a0
call fcn.100244f3
add esp, 0xc
cmp dword [0x1005c9c4], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10016b6d
push 0
push 0
push 0
push 0x10017b90
push 0
push 0
call esi
cmp dword [0x1005ca10], 1
jne 0x10016b87
push 0
push 0
push 0
push 0x10016060
push 0
push 0
call esi
cmp dword [0x1005ca84], 1
jne 0x10016ba1
push 0
push 0
push 0
push 0x100164b0
push 0
push 0
call esi
cmp dword [0x1005c9cc], 1
jne 0x10016bbb
push 0
push 0
push 0
push 0x1001afa0
push 0
push 0
call esi
cmp dword [0x1005ca48], 1
jne 0x10016bd5
push 0
push 0
push 0
push 0x1001a790
push 0
push 0
call esi
cmp dword [0x1005c9d0], 1
jne 0x10016bef
push 0
push 0
push 0
push 0x10007970
push 0
push 0
call esi
cmp dword [0x1005ca78], 1
jne 0x10016c09
push 0
push 0
push 0
push 0x10019900
push 0
push 0
call esi
cmp dword [0x1005ca4c], 1
jne 0x10016c23
push 0
push 0
push 0
push 0x1000c3e0
push 0
push 0
call esi
cmp dword [0x1005ca54], 1
jne 0x10016c3d
push 0
push 0
push 0
push 0x1000d800
push 0
push 0
call esi
cmp dword [0x1005ca68], 1
jne 0x10016c57
push 0
push 0
push 0
push 0x10013030
push 0
push 0
call esi
cmp dword [0x1005ca58], 1
jne 0x10016c71
push 0
push 0
push 0
push 0x1000ddc0
push 0
push 0
call esi
cmp dword [0x1005ca50], 1
jne 0x10016c8b
push 0
push 0
push 0
push 0x1000d7b0
push 0
push 0
call esi
cmp dword [0x1005ca5c], 1
jne 0x10016ca5
push 0
push 0
push 0
push 0x10010c20
push 0
push 0
call esi
cmp dword [0x1005ca60], 1
jne 0x10016cbf
push 0
push 0
push 0
push 0x10012260
push 0
push 0
call esi
cmp dword [0x1005ca64], 1
jne 0x10016cea
push 0
push 0
push 0
push 0x1000f850
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10010020
push 0
push 0
call esi
cmp dword [0x1005ca6c], 1
jne 0x10016d04
push 0
push 0
push 0
push 0x10013720
push 0
push 0
call esi
cmp dword [0x1005ca70], 0
jne 0x10016d1e
push 0
push 0
push 0
push 0x10013fe0
push 0
push 0
call esi
cmp dword [0x1005ca74], 1
jne 0x10016d38
push 0
push 0
push 0
push 0x100031f0
push 0
push 0
call esi
cmp dword [0x1005ca7c], 1
jne 0x10016d52
push 0
push 0
push 0
push 0x100013e0
push 0
push 0
call esi
cmp dword [0x1005ca08], 1
jne 0x10016dd8
lea eax, [ebp - 0x30]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10016dd8
lea eax, [ebp - 0x40]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10016dd8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
push 0
push 0
push 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10016dd8
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10016dd8
push 0
push 0
push 0
push 0x10019d60
push 0
push 0
call esi
cmp dword [0x1005c9d4], 1
jne 0x10016e0c
cmp dword [0x1005c9b4], 0
jne 0x10016e0c
push 0
push 0
push 0
push 0x1001b1c0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1001b4f0
push 0
push 0
call esi
cmp dword [0x1005ca04], 1
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x10016e23
push dword [0x1005c98c]
call esi
cmp dword [0x1005ca00], 1
jne 0x10016e33
push 0x100516c4
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001c32d
mov esp, ebp
pop ebp
ret 0xc