Function at 0x100234c0
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x738
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x734], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x32c]
push 0
push eax
call fcn.1002e140
add esp, 0xc
mov dword [esp + 0x80], 1
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x208
push eax
lea eax, [esp + 0x32c]
push eax
lea eax, [esp + 0x88]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10023573
push str.Steam.exe
lea eax, [esp + 0x32c]
push 0x104
push eax
call fcn.10036981
add esp, 0xc
lea edx, [esp + 0x328]
mov ecx, 0x100679a0
call fcn.10001d80
cmp al, 1
jne 0x10023573
mov byte [0x100662b4], al
push 0x5c
push 0x100679a0
call fcn.1002de30
add esp, 8
test eax, eax
je 0x1002358b
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x100662b8
call fcn.1002de30
add esp, 8
test eax, eax
je 0x100235a3
xor ecx, ecx
mov word [eax], cx
cmp byte [0x100662b4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x10023b86
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x10066f04
call esi
push 0x1000000
push 0
push 0x10068710
call esi
push 0x1000000
push 0
push 0x10067348
call esi
push 0x10023480
call fcn.100365aa
add esp, 4
push 0x100234a0
call fcn.10036d60
add esp, 4
push 0x104
push 0x10067360
push 0x1005aa94
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10067bb0
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x10023855
nop dword [eax]
test eax, eax
je 0x10023855
push 0x10067360
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10067cc0
call fcn.10001320
add esp, 0x14
push 0x10067bb0
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10067790
call fcn.100013e0
add esp, 0x14
push 0x10067bb0
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10067898
call fcn.100013e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x28]
add esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x9c], 4
mov dword [esp + 0x84], 4
push eax
push 0x20019
push 0
push 0x10067cc0
push 0x80000001
call esi
test eax, eax
jne 0x10023718
lea eax, [esp + 0x84]
push eax
push 0x10063ad0
lea eax, [esp + 0xa4]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x20019
push 0
push 0x10067cc0
push 0x80000001
mov dword [esp + 0xbc], 4
mov dword [esp + 0xa8], 4
call esi
test eax, eax
jne 0x10023786
lea eax, [esp + 0x94]
push eax
push 0x10063ad4
lea eax, [esp + 0xb0]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x20019
push 0
push 0x10067cc0
push 0x80000001
mov dword [esp + 0x8c], 4
mov dword [esp + 0x90], 4
call esi
nop dword [eax]
test eax, eax
jne 0x100237f1
lea eax, [esp + 0x7c]
push eax
push 0x10063d24
lea eax, [esp + 0x80]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x20019
push 0
push 0x10067cc0
push 0x80000001
mov dword [esp + 0x84], 4
mov dword [esp + 0x88], 4
call esi
test eax, eax
jne 0x10023855
lea eax, [esp + 0x74]
push eax
push 0x10066f24
lea eax, [esp + 0x78]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100679a0
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10067568
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067568
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x100238a2
push eax
call esi
mov byte [0x100664c4], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002360
add esp, 4
push 0x100682f0
push str.Exe______s_r_n
call fcn.10002620
add esp, 8
cmp byte [0x100664c4], 0
jne 0x10023950
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e140
add esp, 0xc
mov dword [esp + 0x68], 1
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], 0x208
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x70]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10023946
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x120]
push eax
jmp 0x10023955
push 0x100679a0
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x100660a0
call fcn.10001320
add esp, 0x14
push 0x100679a0
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x100664c8
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x100664c8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100239cf
push eax
call esi
push 0x100664c8
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.10002620
add esp, 8
push 8
push 0
push 0x100664c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x100662b8
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x10067ed8
call fcn.10001320
add esp, 0x14
push 0x10067360
push 0x100662b8
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10066af0
call fcn.10001320
push 0x10067360
push 0x100662b8
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10068940
call fcn.10001320
push 0x100662b8
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x10072dc8
call fcn.10001320
add esp, 0x44
push 0x100662b8
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x100668e0
call fcn.10001320
add esp, 0x14
push 0x100662b8
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10066cf8
call fcn.10001320
add esp, 0x14
push 0x100662b8
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100666d8
call fcn.10001320
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x14
push str.DenuvoActivationBypass.dll
call esi
mov dword [0x10072ba0], eax
mov ecx, eax
test eax, eax
jne 0x10023ad2
push str.DenuvoOfflineActivationBypass.dll
call esi
mov dword [0x10072ba0], eax
mov ecx, eax
test ecx, ecx
je 0x100242d3
push str.GetDenuvoCallResult
push eax
call edi
push str.GetDenuvoID
push dword [0x10072ba0]
mov dword [0x10068730], eax
call edi
push str.RequestDenuvoAppTicket
push dword [0x10072ba0]
mov dword [0x10067cb8], eax
call edi
push str.GetDenuvoAppTicket
push dword [0x10072ba0]
mov dword [0x10068734], eax
call edi
push str.ShutdownDenuvoDll
push dword [0x10072ba0]
mov dword [0x10067784], eax
call edi
cmp dword [0x10068730], 0
mov dword [0x100662b0], eax
je 0x10023b65
cmp dword [0x10067cb8], 0
nop
je 0x10023b65
cmp dword [0x10068734], 0
je 0x10023b65
cmp dword [0x10067784], 0
je 0x10023b65
test eax, eax
je 0x10023b65
mov byte [0x100664c6], 1
nop
jmp 0x100242d3
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10065e96], 1
jne 0x10023ba5
mov byte [0x10065e95], 1
mov byte [0x10065e97], 1
nop dword [eax]
jmp 0x10023cbf
push 0x100662b8
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x10068b48
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068b48
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023c10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10068b48
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10065e95], 1
mov byte [0x10065e97], 1
jmp 0x10023cbf
push 0x1000000
push 0
push 0x10066f04
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x100662b8
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x100660a0
call fcn.10001320
add esp, 0x14
push 0x100662b8
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10066cf8
call fcn.10001320
add esp, 0x14
push 0x100662b8
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100666d8
call fcn.10001320
add esp, 0x14
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002360
add esp, 4
push 0x100682f0
push str.Exe______s_r_n
call fcn.10002620
push 0x10023480
call fcn.100365aa
add esp, 0xc
push 0x100234a0
call fcn.10036d60
add esp, 4
push 0x100662b8
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10067140
call fcn.10001320
add esp, 0x14
push 0x100662b8
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10066f30
call fcn.10001320
add esp, 0x14
push 0x100662b8
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10068738
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068738
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023d51
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10068738
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10065e97], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10066f30
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023e0e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10065e97], 1
je 0x10023faf
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop dword [eax]
sub eax, 6
je 0x10023faf
sub eax, 1
jne 0x10023e0e
xor esi, esi
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e140
add esp, 0xc
lea eax, [esp + 0x120]
push esi
push 0x10067140
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
add esp, 0x18
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x93
jb 0x10023db0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x100664c0], eax
call fcn.100354e5
add esp, 4
push eax
push 0x1005b0c4
push 0x1005b0c8
push 0x1006870c
call fcn.100353fd
push 1
call fcn.100354e5
add esp, 0x14
push eax
push 0x1005b0d8
push 0x1005b0dc
push 0x10066f00
call fcn.100353fd
push 2
call fcn.100354e5
add esp, 0x14
push eax
push 0x1005b0d8
push 0x1005b0dc
push 0x100684f8
call fcn.100353fd
xorps xmm0, xmm0
mov dword [esp + 0xd0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_147_:
movaps xmmword [esp + 0xc4], xmm0
call fcn.100012a0
add esp, 0x14
push 0
call fcn.100354e5
add esp, 4
push eax
lea eax, [esp + 0xb4]
push 0xa
push eax
call fcn.10036b9e
add esp, 0xc
test eax, eax
je 0x10023f93
nop dword [eax + eax]
lea ecx, [esp + 0xb0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023ee0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x100251e6
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xb8], ax
lea eax, [esp + 0xb8]
push eax
call fcn.10035e5b
add esp, 0xc
mov dword [esp + 0x84], eax
call fcn.10036ca0
cmp dword [eax], 0x22
je 0x100251c6
mov eax, dword [esp + 0x84]
test eax, eax
je 0x10023f4b
nop dword [eax]
cmp eax, 0x93
jle 0x1002410e
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_147_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.100012a0
add esp, 4
push 0
call fcn.100354e5
add esp, 4
push eax
lea eax, [esp + 0xb4]
push 0xa
push eax
call fcn.10036b9e
add esp, 0xc
test eax, eax
jne 0x10023ed0
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0
nop word [eax + eax]
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e140
add esp, 0xc
lea eax, [esp + 0x120]
push dword [esp + 0x10]
push 0x10067140
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push 0x10053a00
lea eax, [esp + 0x13c]
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x34]
push eax
call fcn.10036156
add esp, 0x24
test eax, eax
jne 0x100242d3
push dword [esp + 0x14]
mov dword [esp + 0xe4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xd4]
movaps xmmword [esp + 0xd4], xmm0
push 0x14
push eax
call fcn.10036b93
add esp, 0xc
test eax, eax
je 0x100240ee
push dword ds:[esp + 0x14]
call fcn.100362f2
add esp, 4
lea eax, [esp + 0xd0]
push 0xa
push 0
push eax
call fcn.10035e15
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov ecx, dword [ecx*4 + 0x10063ad8]
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0x88], ecx
push eax
call fcn.10025900
call fcn.10036ca0
cmp dword [eax], 0x22
je 0x100240d0
mov eax, dword ds:[esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x93
jb 0x10023fc0
jmp 0x100242d3
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0x10], ecx
test eax, eax
jle 0x1002428d
mov edx, str._nAppID:
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012a0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0x100], xmm0
movq qword [esp + 0x110], xmm0
push 0
call fcn.100354e5
add esp, 4
push eax
lea eax, [esp + 0xf4]
push 0x14
push eax
call fcn.10036b9e
add esp, 0xc
test eax, eax
je 0x100243fb
lea ecx, [esp + 0xf0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024180
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x100251e6
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xf8], ax
lea eax, [esp + 0xf8]
push eax
call fcn.10035e5b
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x9c], eax
mov dword [esp + 0x98], eax
lea eax, [esp + 0x94]
mov ecx, dword [ecx*4 + 0x10063ad8]
push eax
lea eax, [esp + 0xac]
mov dword [esp + 0x98], ecx
push eax
call fcn.10025900
call fcn.10036ca0
cmp dword [eax], 0x22
je 0x100243df
push 0
push 0x10067140
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x534]
push 0
push eax
call fcn.1002e140
add esp, 0xc
lea eax, [esp + 0x530]
push dword [esp + 0x10]
push 0x10067140
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push dword ds:[esp + 0xb4]
lea eax, [esp + 0x54c]
push 0x1005b278
push eax
call fcn.10002e60
mov ecx, dword ds:[esp + 0x34]
add esp, 0x24
inc ecx
mov edx, str._nAppID:
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x84]
jl 0x10024121
cmp dword [0x100664c0], 1
jne 0x100242d3
mov eax, dword [0x1006870c]
test eax, eax
je 0x100242a8
push eax
call fcn.100362f2
add esp, 4
mov eax, dword [0x10066f00]
test eax, eax
je 0x100242ba
push eax
call fcn.100362f2
add esp, 4
mov eax, dword [0x100684f8]
nop
test eax, eax
je 0x100242cd
push eax
call fcn.100362f2
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x10072998
push str.GreenLuma_2024_Dll______s_r_n
nop dword [eax]
call fcn.10002620
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x10072bbc], eax
call fcn.10002360
add esp, 8
call fcn.100274b0
cmp dword [0x10072fdc], 0
jne 0x1002519c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10072fdc], eax
xor ecx, ecx
mov edx, 0x10072fd8
xchg dword [edx], ecx
test eax, eax
je 0x100251a5
cmp byte [0x10065e96], 0
nop dword [eax]
jne 0x10024466
cmp byte [0x100662b4], 0
jne 0x1002445f
lea eax, [esp + 0xa4]
mov dword [esp + 0x8c], 1
push eax
push 0x10068500
lea eax, [esp + 0x94]
mov dword [esp + 0xac], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10024417
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.10002360
add esp, 4
mov ecx, 0x208
mov eax, 0x10068500
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100243b4
push 0x100662b8
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x10068500
call fcn.10001320
add esp, 0x14
jmp 0x10024428
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Got_Steamclient_dll_paths_from_registry_r_n
nop dword [eax]
call fcn.10002360
add esp, 4
push 8
push 0
push 0x10068500
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10068708], eax
nop dword [eax]
test eax, eax
jne 0x10024472
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10068708]
jmp 0x10024472
push str.steamclient.dll
call esi
mov dword [0x10068708], eax
cmp byte [0x10065e95], 0
jne 0x10024f3c
nop
test eax, eax
je 0x100246c3
push str.Steamclient.dll_is_loaded__r_n
call fcn.10002360
add esp, 4
push 0x10068500
push str.Steamclient______s_r_n_r_n
call fcn.10002620
add esp, 8
push str.steamclient.dll
call esi
test eax, eax
jne 0x100244bd
mov dword [esp + 0x14], 0xb
jmp 0x100244e9
push str.CreateInterface
push eax
call edi
test eax, eax
jne 0x100244d3
mov dword [esp + 0x14], 0xc
jmp 0x100244e9
push 0x10068728
mov edx, 0x10004040
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x14], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x100244fe
mov dword [esp + 0x1c], 0xb
jmp 0x10024529
push str.Steam_BGetCallback
push eax
call edi
test eax, eax
jne 0x10024514
mov dword [esp + 0x1c], 0xc
jmp 0x10024529
push 0x10067ba8
mov edx, 0x100048c0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x1c], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002453e
mov dword [esp + 0x10], 0xb
jmp 0x10024569
push str.Steam_FreeLastCallback
push eax
call edi
test eax, eax
jne 0x10024554
mov dword [esp + 0x10], 0xc
jmp 0x10024569
push 0x10067778
mov edx, 0x10004a80
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x10], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002457e
mov dword [esp + 0x18], 0xb
jmp 0x100245a9
push str.Steam_GetAPICallResult
push eax
call edi
test eax, eax
jne 0x10024594
mov dword [esp + 0x18], 0xc
jmp 0x100245a9
push 0x10066aec
mov edx, 0x10004b40
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x18], eax
push str.CreateInterface
push dword [0x10068708]
call edi
mov edx, 1
mov ecx, eax
call fcn.10027a40
push str.Steam_BGetCallback
push dword [0x10068708]
mov esi, eax
call edi
mov edx, 1
mov ecx, eax
call fcn.10027a40
push str.Steam_FreeLastCallback
push dword [0x10068708]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10027a40
push str.Steam_GetAPICallResult
push dword [0x10068708]
mov dword [esp + 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10027a40
mov ecx, esi
mov dword [esp + 0xa4], eax
call fcn.10027b40
mov ecx, dword ds:[esp + 0x14]
push eax
call fcn.10027b40
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.10002360
add esp, 0xc
mov ecx, edi
call fcn.10027b40
mov ecx, dword ds:[esp + 0x1c]
push eax
call fcn.10027b40
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x98]
add esp, 0xc
call fcn.10027b40
mov ecx, dword [esp + 0x10]
push eax
call fcn.10027b40
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.10002360
mov ecx, dword ds:[esp + 0xb0]
add esp, 0xc
call fcn.10027b40
mov ecx, dword [esp + 0x18]
push eax
call fcn.10027b40
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.10002360
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call esi
test eax, eax
jne 0x100246db
mov eax, 0xb
jmp 0x100246ff
push str.NtCreateUserProcess
push eax
call edi
test eax, eax
jne 0x100246ee
mov eax, 0xc
jmp 0x100246ff
push 0x10072bac
mov edx, 0x100032c0
mov ecx, eax
call fcn.10027600
push str.ntdll.dll
mov dword [0x10072bb8], eax
call esi
test eax, eax
jne 0x10024716
mov eax, 0xb
jmp 0x1002473c
push str.NtResumeThread
push eax
call edi
nop
test eax, eax
jne 0x1002472b
mov eax, 0xc
jmp 0x1002473c
push 0x10067780
mov edx, 0x10003f60
mov ecx, eax
call fcn.10027600
push str.ntdll.dll
mov dword [0x10072ba4], eax
call esi
test eax, eax
jne 0x10024756
mov dword [esp + 0x74], 0xb
jmp 0x10024783
push str.LdrLoadDll
push eax
call edi
nop
test eax, eax
jne 0x1002476e
mov dword [esp + 0x74], 0xc
jmp 0x10024783
push 0x10067ed0
mov edx, 0x10008f40
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x74], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024798
mov dword [esp + 0x78], 0xb
jmp 0x100247c9
push str.LdrGetDllHandleEx
push eax
call edi
test eax, eax
jne 0x100247b0
mov dword [esp + 0x78], 0xc
jmp 0x100247c9
push 0x10072994
mov edx, 0x10008fc0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x78], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x100247de
mov dword [esp + 0x7c], 0xb
jmp 0x10024809
push str.LdrGetDllFullName
push eax
call edi
test eax, eax
jne 0x100247f4
mov dword [esp + 0x7c], 0xc
jmp 0x10024809
push 0x10066f1c
mov edx, 0x10009040
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x7c], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024822
mov dword ds:[esp + 0xa8], 0xb
jmp 0x10024853
push str.LdrGetDllHandleByMapping
push eax
call edi
test eax, eax
jne 0x1002483b
mov dword [esp + 0xa8], 0xc
jmp 0x10024853
push 0x1006799c
mov edx, 0x100090a0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0xa8], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x1002486b
mov dword [esp + 0x94], 0xb
jmp 0x1002489c
push str.LdrGetDllHandleByName
push eax
call edi
test eax, eax
jne 0x10024884
mov dword [esp + 0x94], 0xc
jmp 0x1002489c
push 0x10067894
mov edx, 0x10009120
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x94], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x100248b4
mov dword [esp + 0x9c], 0xb
jmp 0x100248ec
push str.LdrQueryProcessModuleInformation
push eax
call edi
nop dword [eax]
test eax, eax
jne 0x100248d1
mov dword [esp + 0x9c], 0xc
jmp 0x100248ec
push 0x10072990
mov edx, 0x100091a0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x9c], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024904
mov dword [esp + 0x80], 0xb
jmp 0x10024935
push str.LdrEnumerateLoadedModules
push eax
call edi
test eax, eax
jne 0x1002491d
mov dword [esp + 0x80], 0xc
jmp 0x10024935
push 0x100666d4
mov edx, 0x100092e0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x80], eax
push str.ntdll.dll
call esi
nop dword [eax]
test eax, eax
jne 0x10024951
mov dword [esp + 0x84], 0xb
jmp 0x10024982
push str.RtlLockModuleSection
push eax
call edi
test eax, eax
jne 0x1002496a
mov dword [esp + 0x84], 0xc
jmp 0x10024982
push 0x10066f2c
mov edx, 0x10009340
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x84], eax
push str.kernel32.dll
call esi
test eax, eax
je 0x100249b6
push str.Module32NextW
push eax
call edi
test eax, eax
je 0x100249b6
push 0x10067788
mov edx, 0x10009360
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x1c], eax
test eax, eax
je 0x100249f9
push str.KernelBase.dll
call esi
nop dword [eax]
test eax, eax
jne 0x100249ce
mov dword [esp + 0x1c], 0xb
jmp 0x100249f9
push str.Module32NextW
push eax
call edi
test eax, eax
jne 0x100249e4
mov dword [esp + 0x1c], 0xc
jmp 0x100249f9
push 0x10067788
mov edx, 0x10009360
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x1c], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
je 0x10024b97
push str.EnumProcessModules
push eax
call edi
test eax, eax
je 0x10024b97
push 0x1006872c
mov edx, 0x100093e0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10024b97
push str.KernelBase.dll
call esi
nop
test eax, eax
jne 0x10024a4e
mov dword [esp + 0x68], 0xb
jmp 0x10024a79
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x10024a64
mov dword [esp + 0x68], 0xc
jmp 0x10024a79
push 0x100680e4
mov edx, 0x10009720
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x68], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
jne 0x10024a90
mov dword [esp + 0x6c], 0xb
jmp 0x10024abb
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x10024aa6
mov dword [esp + 0x6c], 0xc
jmp 0x10024abb
push 0x10072fd4
mov edx, 0x10009aa0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x6c], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024ad0
mov dword [esp + 0x70], 0xb
jmp 0x10024afb
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x10024ae6
mov dword [esp + 0x70], 0xc
jmp 0x10024afb
push 0x10067ec8
mov edx, 0x10009b60
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x70], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024b10
mov dword [esp + 0x18], 0xb
jmp 0x10024b3b
push 0x1005b608
push eax
call edi
test eax, eax
jne 0x10024b26
mov dword [esp + 0x18], 0xc
jmp 0x10024b3b
push 0x10072fd0
mov edx, 0x10009c40
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x18], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024b58
mov dword [esp + 0x10], 0xb
push str.KernelBase.dll
jmp 0x10024d20
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x10024b78
mov dword [esp + 0x10], 0xc
push str.KernelBase.dll
jmp 0x10024d20
push 0x100662a8
mov edx, 0x10009d00
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x10], eax
push str.KernelBase.dll
jmp 0x10024d20
push str.Psapi.dll
call esi
nop
test eax, eax
jne 0x10024bae
mov dword [esp + 0x14], 0xb
jmp 0x10024bd9
push str.EnumProcessModules
push eax
call edi
test eax, eax
jne 0x10024bc4
mov dword [esp + 0x14], 0xc
jmp 0x10024bd9
push 0x1006872c
mov edx, 0x100093e0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x14], eax
push str.Psapi.dll
nop
call esi
test eax, eax
jne 0x10024bf0
mov dword [esp + 0x68], 0xb
jmp 0x10024c1b
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x10024c06
mov dword [esp + 0x68], 0xc
jmp 0x10024c1b
push 0x100680e4
mov edx, 0x10009720
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x68], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024c30
mov dword [esp + 0x6c], 0xb
jmp 0x10024c5b
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x10024c46
mov dword [esp + 0x6c], 0xc
jmp 0x10024c5b
push 0x10072fd4
mov edx, 0x10009aa0
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x6c], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024c70
mov dword [esp + 0x70], 0xb
jmp 0x10024c9b
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x10024c86
mov dword [esp + 0x70], 0xc
jmp 0x10024c9b
push 0x10067ec8
mov edx, 0x10009b60
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x70], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024cb0
mov dword [esp + 0x18], 0xb
jmp 0x10024cdb
push 0x1005b608
push eax
call edi
test eax, eax
jne 0x10024cc6
mov dword [esp + 0x18], 0xc
jmp 0x10024cdb
push 0x10072fd0
mov edx, 0x10009c40
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x18], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024cf0
mov dword [esp + 0x10], 0xb
jmp 0x10024d1b
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x10024d06
mov dword [esp + 0x10], 0xc
jmp 0x10024d1b
push 0x100662a8
mov edx, 0x10009d00
mov ecx, eax
call fcn.10027600
mov dword [esp + 0x10], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024d2b
lea edi, [eax + 0xb]
jmp 0x10024d4f
push str.GetMappedFileNameW
push eax
call edi
test eax, eax
jne 0x10024d3c
lea edi, [eax + 0xc]
jmp 0x10024d4f
push 0x10066f28
mov edx, 0x10009de0
mov ecx, eax
call fcn.10027600
mov edi, eax
mov edx, 1
xor ecx, ecx
call fcn.10027a40
mov ecx, dword [0x10072bb8]
mov esi, eax
call fcn.10027b40
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.10002360
mov ecx, dword [0x10072ba4]
add esp, 8
call fcn.10027b40
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x7c]
add esp, 8
call fcn.10027b40
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x80]
add esp, 8
call fcn.10027b40
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x84]
add esp, 8
call fcn.10027b40
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0xb0]
add esp, 8
call fcn.10027b40
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x9c]
add esp, 8
call fcn.10027b40
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.10002360
mov ecx, dword ds:[esp + 0xa4]
add esp, 8
call fcn.10027b40
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x88]
add esp, 8
call fcn.10027b40
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x8c]
add esp, 8
call fcn.10027b40
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10027b40
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10027b40
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x70]
add esp, 8
call fcn.10027b40
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x74]
add esp, 8
call fcn.10027b40
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x78]
add esp, 8
call fcn.10027b40
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10027b40
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x18]
add esp, 8
call fcn.10027b40
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.10002360
add esp, 8
mov ecx, edi
call fcn.10027b40
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.10002360
add esp, 8
mov ecx, esi
call fcn.10027b40
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.10002360
mov eax, dword [0x10068708]
add esp, 8
cmp byte [0x100662b4], 1
jne 0x10024fae
cmp byte [0x10065e96], 1
jne 0x10024fae
push eax
call dword [0x100666d0]
mov ecx, dword [0x10068708]
push str.xxxxxxxxxxxx
push 0x1005a788
mov edx, dword [eax + 0x50]
call fcn.10001fc0
add esp, 8
mov dword [0x10067cbc], eax
test eax, eax
je 0x10024fae
push 0x10067ed4
mov edx, 0x10002f40
mov dword [0x10067ed4], eax
mov ecx, eax
call fcn.10027600
mov ecx, dword [0x10067cbc]
mov edx, 1
call fcn.10027a40
cmp byte [0x10065e95], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [eax + eax]
jne 0x10024fe6
push 0
push 0
push 0
push 0x10022fe0
push 0
push 0
call esi
test eax, eax
je 0x10025071
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [0x10065e96], 0
jne 0x10025186
cmp byte [0x100662b4], 0
push 0
jne 0x100250a6
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x100660a0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002508c
push 0
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push 1
push 0x1005b928
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x734]
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call edi
jmp 0x10024fec
push 0x10
push str.GreenLuma_2024
push 0x1005b92c
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x100230c0
push 0
push 0
call esi
test eax, eax
je 0x100250c8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100250d8
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error
push 0
call edi
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x44
lea eax, [esp + 0x20]
movlpd qword [esp + 0x24], xmm0
push eax
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [esp + 0x52], 8
jb 0x10025186
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10025186
lea esi, [eax + 4]
test esi, esi
je 0x10025142
mov esi, dword ds:[esi]
jmp 0x10025154
xor esi, esi
call fcn.10036ca0
mov dword [eax], 0x16
call fcn.10036566
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, 1
jne 0x10025186
test byte [esp + 0x90], al
je 0x10025186
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x73c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x10072fd8
xchg dword [ecx], eax
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002c79b
int3