Function at 0x10001840
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get process heap flags
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1006b018], 1
push esi
push edi
jne 0x1000212c
mov eax, dword [0x100716dc]
mov edx, 0x1006b018
push 0x2a
mov ecx, str.Prodigal_Ran_Online
or dword [eax + 0x3fec], 2
mov dword [eax + 0x4010], 0x43af0000
mov dword [eax + 0x4014], 0x438c0000
mov dword [eax + 0x3ff4], 1
call fcn.1000fda0
add esp, 4
cmp byte [0x10071572], 0
jne 0x10001bc5
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c3c]
movss dword [ebp - 8], xmm0
cmp byte [eax + 0xc8], 0
jne 0x100018f7
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
movss xmm0, dword [ebp - 8]
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001932
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x1000196f
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x100019ac
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x100019e9
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001a26
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001a63
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001aa0
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001add
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001b1a
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001b57
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001b94
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x43a28000
mov ecx, str.Load_Menu
mov dword [ebp - 0x14], 0x42100000
call fcn.10042d60
add esp, 4
test al, al
je 0x10002127
call fcn.100013c0
jmp 0x10002127
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42d00000
mov ecx, str.Misc
mov dword [ebp - 0x14], 0
call fcn.10042d60
mov ecx, dword [0x10071154]
xor edx, edx
movss xmm1, dword [0x10067b78]
add esp, 4
test al, al
xorps xmm0, xmm0
cmovne ecx, edx
mov dword [0x10071154], ecx
call fcn.100157d0
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42d00000
mov ecx, str.Visuals
mov dword [ebp - 0x14], 0
call fcn.10042d60
mov ecx, dword [0x10071154]
add esp, 4
movss xmm1, dword [0x10067b78]
test al, al
mov edx, 1
xorps xmm0, xmm0
cmovne ecx, edx
mov dword [0x10071154], ecx
call fcn.100157d0
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42d00000
mov ecx, str.Farmer
mov dword [ebp - 0x14], 0
call fcn.10042d60
mov ecx, dword [0x10071154]
add esp, 4
test al, al
mov edx, 2
cmovne ecx, edx
mov dword [0x10071154], ecx
sub ecx, 0
je 0x1000200c
sub ecx, 1
je 0x10001e3a
sub ecx, 1
jne 0x10002127
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c3c]
movss dword [ebp - 8], xmm0
cmp byte [eax + 0xc8], 0
jne 0x10001ce9
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
movss xmm0, dword [ebp - 8]
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001d24
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
mov edx, 0x10071704
mov ecx, str.AUTO_POTION_Q
call fcn.10044270
mov edx, 0x100716fd
mov ecx, str.AUTO_RESU
call fcn.10044270
mov edx, 0x100716ff
mov ecx, str.FORCE_MAP
call fcn.10044270
push ecx
push 0x1005868c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x3e8
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x10071708
mov edx, 4
mov ecx, str.AUTO_SP_W
call fcn.10046310
add esp, 0x10
mov dword [ebp - 0xc], 0x3e8
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0
mov edx, 4
mov ecx, str.AUTO_MP_E
push 0x1005868c
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071700
call fcn.10046310
mov ecx, dword [0x100716dc]
add esp, 0x14
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001df3
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001e30
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
push str.TAKE_NOTE:_DAPAT_MAY_RESU_ROSA_KAYO_NAKA_EQUIP
jmp 0x10002110
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c3c]
movss dword [ebp - 0xc], xmm0
cmp byte [eax + 0xc8], 0
jne 0x10001e87
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001ec2
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
sub esp, 0x10
call fcn.100457d0
mov eax, dword [0x100716f8]
add esp, 0x10
cmp eax, 3
ja case.default.0x10001ed7
jmp dword [eax*4 + 0x1000259c]
mov dword [0x1007170c], 0
jmp case.default.0x10001ed7
mov dword [0x1007170c], 0x41f00000
jmp case.default.0x10001ed7
mov dword [0x1007170c], 0x42700000
jmp case.default.0x10001ed7
mov dword [0x1007170c], 0x42f00000
push ecx
push str._.3f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0x3a83126f
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x40000000
push eax
push 0x10071148
mov edx, 8
mov ecx, str.ATTACK_SPEED
call fcn.10046310
add esp, 0x10
mov dword [ebp - 0x10], 0x3a83126f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x40000000
mov edx, 8
mov ecx, str.AS_CUT_SKILL
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071150
call fcn.10046310
add esp, 0x10
mov dword [ebp - 0x10], 0x3a83126f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x41f00000
mov edx, 8
mov ecx, str.LONG_RANGE
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071144
call fcn.10046310
add esp, 0x10
mov dword [ebp - 0x10], 0x43480042
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x442f0000
mov edx, 8
mov ecx, str.DRONE
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071140
call fcn.10046310
add esp, 0x10
mov dword [ebp - 0x10], 0x42a00083
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x43c80000
mov edx, 8
mov ecx, str.FAST_SCROLL
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1007114c
call fcn.10046310
add esp, 0x14
jmp 0x10002127
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c3c]
cmp byte [eax + 0xc8], 0
jne 0x1000204f
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.10015410
mov edx, 0x10071706
mov ecx, str.ANTI_SILENCE
call fcn.10044270
mov edx, 0x100716fe
mov ecx, str.FAST_TELE
call fcn.10044270
mov edx, 0x100716fc
mov ecx, str.REMOVE_FOG
call fcn.10044270
mov edx, 0x10071705
mov ecx, str.WALL_NAME
call fcn.10044270
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x100020cb
movss xmm1, dword [0x10067c3c]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
mov ecx, dword [0x100716dc]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x1000210b
movss xmm1, dword [0x10067c3c]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10015410
push str.F5_SHOW__HIDE
movaps xmm0, xmmword [0x10067f70]
lea eax, [ebp - 0x20]
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.10042740
add esp, 8
call fcn.10013020
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x10002146
cmp byte [0x1006b018], 0
sete byte [0x1006b018]
cmp byte [0x10071572], 0
je 0x10002581
cmp byte [0x10071704], 0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10002188
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0xfceb0c
call edi
lea eax, [ebp - 8]
mov byte [0xfceb0c], 3
push eax
push dword [ebp - 8]
push 1
push 0xfceb0c
call edi
cmp byte [0x100716fc], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x100f100
je 0x100021d5
call edi
lea eax, [ebp - 8]
mov dword [0x100f100], 0x461c3c00
push eax
push dword [ebp - 8]
push 4
push 0x100f100
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x100f0d8
call edi
mov dword [0x100f0d8], 0x49657e00
jmp 0x1000220a
call edi
lea eax, [ebp - 8]
mov dword [0x100f100], 0x442f0000
push eax
push dword [ebp - 8]
push 4
push 0x100f100
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x100f0d8
call edi
mov dword [0x100f0d8], 0x451c4000
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push 0x100f0d8
call edi
cmp byte [0x100716fe], 0
lea eax, [ebp - 8]
mov esi, dword [0x10071684]
push eax
push 0x40
push 1
push esi
je 0x10002239
call edi
mov byte [esi], 0xd8
jmp 0x1000223e
call edi
mov byte [esi], 0xd9
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x10071705], 0
lea eax, [ebp - 8]
mov esi, dword [0x100716d4]
push eax
push 0x40
push 1
push esi
je 0x10002289
call edi
lea eax, [ebp - 8]
mov byte [esi], 0xeb
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov esi, dword [0x100716b4]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov byte [esi], 0xeb
jmp 0x100022ae
call edi
lea eax, [ebp - 8]
mov byte [esi], 0x74
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov esi, dword [0x100716b4]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov byte [esi], 0x74
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x10071706], 0
lea eax, [ebp - 8]
mov esi, dword [0x10071698]
push eax
push 0x40
push 1
push esi
je 0x100022d9
call edi
mov byte [esi], 0x74
jmp 0x100022de
call edi
mov byte [esi], 0x75
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x100716fd], 0
mov esi, dword [0x10071680]
je 0x10002349
lea eax, [esi + 6]
mov dword [0x10071694], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x10001380
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 6
push esi
call edi
mov esi, dword [0x100716bc]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 8]
mov byte [esi], 0x74
push eax
push dword [ebp - 8]
jmp 0x1000238c
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push esi
call edi
mov eax, dword [0x100586d8]
mov dword [esi], eax
mov ax, word [0x100586dc]
mov word [esi + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
mov esi, dword [0x100716bc]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 0x24]
mov byte [esi], 0x75
push eax
push dword [ebp - 0x24]
push 1
push esi
call edi
cmp byte [0x100716ff], 0
mov esi, dword [0x100716c8]
je 0x100023d0
lea eax, [esi + 6]
mov dword [0x10071688], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x100013a0
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
jmp 0x100023f3
lea eax, [ebp - 0x10]
push eax
push 0x40
push 6
push esi
call edi
mov eax, dword [0x100586e0]
mov dword [esi], eax
mov ax, word [0x100586e4]
mov word [esi + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 6
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
push 0x10071148
push 0xfd2023
push dword [0x100716f4]
call esi
push 0
push 4
push 0x10071140
push 0xfced9c
push dword [0x100716f4]
call esi
push 0
push 4
push 0x1007114c
push 0xfcedac
push dword [0x100716f4]
call esi
push 0
push 4
push 0x10071150
push 0xc
push dword [0x100716f4]
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov dword [ebp - 0x24], 0
push eax
mov eax, dword fs:[0x18]
mov eax, dword ds:[eax + 0x30]
movzx eax, byte ds:[eax + 2]
mov dword [ebp - 0x24], eax
pop eax
cmp dword [ebp - 0x10], 0
jne 0x10002591
cmp dword [ebp - 0x24], 0
jne 0x10002591
mov eax, dword [0x1007168c]
cmp eax, dword [0x10071708]
jae 0x100024cd
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0xfceb0d
call edi
lea eax, [ebp - 8]
mov byte [0xfceb0d], 3
push eax
push dword [ebp - 8]
push 1
push 0xfceb0d
call edi
mov eax, dword [0x100716d0]
cmp eax, dword [0x10071700]
jae 0x10002500
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0xfceb0e
call edi
lea eax, [ebp - 0xc]
mov byte [0xfceb0e], 3
push eax
push dword [ebp - 0xc]
push 1
push 0xfceb0e
call edi
movzx eax, word [0x10071570]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push 0x100716d0
push eax
push dword [0x100716f4]
call esi
movzx eax, word [0x1007167c]
push 0
push 4
push 0x1007168c
push eax
push dword [0x100716f4]
call esi
push 0
push 2
push 0x1006b02c
push 0xfced9c
push dword [0x100716f4]
call esi
mov eax, 0xda
cmp word [0x1006b02c], ax
jbe 0x10002581
mov esi, dword [0x100716a4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
call edi
mov eax, 0x840f
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 2
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10055dc4
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]