Function at 0x100176c0
Capabilities:
Check os version
Create thread
Query or enumerate registry value
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042336
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
push esi
push edi
mov eax, dword [0x1005a050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10017f7b
call sym.OpenGuard.dll_OpenGuard
cmp dword [0x1005f9d0], 1
jne 0x1001781d
push str.lib_ayarlar.txt
call fcn.10024894
push str.libhesap1.txt
call fcn.10024894
push str.libhesap2.txt
call fcn.10024894
push str.libhesap3.txt
call fcn.10024894
push str.libhesap4.txt
call fcn.10024894
push str.liblib.txt
call fcn.10024894
push str.lib_ticaret.txt
call fcn.10024894
push str.libloglar.txt
call fcn.10024894
add esp, 0x18
lea ecx, [ebp - 0x54]
call fcn.1001bdd0
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0
call fcn.1001bef0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5dc
call esi
mov ecx, dword [ebp - 0x50]
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
test ecx, ecx
je 0x100177a6
push ecx
call edi
push 0
mov dword [ebp - 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0x12c
call esi
sub esp, 8
lea ecx, [ebp - 0x38]
call fcn.1001bdd0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.1001bef0
push 0xbb8
call esi
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x100177ee
push eax
call edi
push 0
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [ebp - 0x24]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x38], vtable.CSplash.0
test eax, eax
je 0x10017805
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], vtable.CSplash.0
test eax, eax
je 0x1001781d
push eax
call esi
cmp dword [0x1005fa3c], 1
jne 0x10017876
cmp dword [0x100607ac], 0xb7
jne 0x10017876
mov eax, dword [0x1005fa20]
push 0x200030
push dword [0x1005f99c]
cmp eax, 1
jne 0x1001785c
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10017847
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1005fa14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
jne 0x100178e8
call esi
cmp al, 6
jae 0x10017897
mov dword [0x1005f940], 1
jmp 0x100178e8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100178e8
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100178e3
mov dword [0x1005f938], 1
jmp 0x100178e8
call fcn.100064f0
cmp dword [0x1005fa40], 0
jne 0x1001796c
sub esp, 8
lea ecx, [ebp - 0x10c]
push 1
push dword [0x1005f958]
call fcn.10006600
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x100], 6
je 0x10017950
call esi
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
sbb eax, eax
and eax, ecx
cmp eax, 0x1770
jae 0x10017949
mov dword [0x1005f940], 1
call fcn.10006110
jmp 0x1001795a
call fcn.100064f0
jmp 0x1001795a
mov dword [0x1005f93c], 1
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0xffffffff
call fcn.10006380
cmp dword [0x1005f9e0], 1
jne 0x10017986
push 0
push 0
push 0x1001a790
call fcn.100266f7
add esp, 0xc
cmp dword [0x1005fa3c], 0
je 0x10017a1a
call fcn.10007760
cmp dword [0x1005fa40], 1
jne 0x100179aa
cmp dword [0x1005f93c], 0
je 0x10017a1a
cmp dword [0x1005fa14], 1
jne 0x100179c5
cmp dword [0x1005f940], 0
jne 0x100179c5
cmp dword [0x1005f938], 0
je 0x10017a1a
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push 8
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10017a03
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x14
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10017a11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
je 0x10017f93
cmp dword [0x1005fa48], 1
je 0x10017f98
cmp dword [0x1005fa4c], 1
je 0x10017f9d
cmp dword [0x1005faa4], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10017a54
push 0
push 0
push 0
push 0x1001d440
push 0
push 0
call edi
cmp dword [0x1005f9bc], 1
jne 0x10017be3
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON_
mov ecx, 0x1005eca0
call fcn.10005910
push eax
call fcn.10007870
mov edx, str.All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov ecx, 0x1005eca0
call fcn.10005910
push eax
call fcn.10007870
add esp, 8
cmp dword [0x1005fa1c], 0
jne 0x10017b0d
sub esp, 0xc
lea ecx, [ebp - 0x104]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x104]
call fcn.10005910
lea ecx, [ebp - 0x100]
call fcn.10004900
test eax, eax
jne 0x10017afb
mov eax, dword [ebp - 0x104]
lea ecx, [ebp - 0x104]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005fa2c], 0
jne 0x10017e58
lea eax, [ebp - 0x1c]
push eax
call fcn.1002399f
lea eax, [ebp - 0x1c]
push eax
call fcn.10023c8c
push ecx
push 0x1004f4f0
lea ecx, [ebp - 0x1bc]
mov esi, eax
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1bc]
call fcn.10005910
push esi
call fcn.100246b8
add esp, 4
lea ecx, [ebp - 0x1bc]
mov edx, eax
call fcn.10005910
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
lea ecx, [ebp - 0x1bc]
call fcn.10005910
mov edx, str._n__________________
lea ecx, [ebp - 0x1bc]
call fcn.10005910
lea ecx, [ebp - 0x1b8]
call fcn.10004900
test eax, eax
jne 0x10017bc6
mov eax, dword [ebp - 0x1bc]
lea ecx, [ebp - 0x1bc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004f4f0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x1bc]
call fcn.100030f0
jmp 0x10017e58
cmp dword [0x1005f9cc], 1
jne 0x10017bfd
push 0
push 0
push 0
push 0x10018f80
push 0
push 0
call edi
cmp dword [0x1005fa18], 1
jne 0x10017c17
push 0
push 0
push 0
push 0x10016ef0
push 0
push 0
call edi
cmp dword [0x1005fa8c], 1
jne 0x10017c31
push 0
push 0
push 0
push 0x100172c0
push 0
push 0
call edi
cmp dword [0x1005f9d4], 1
jne 0x10017c4b
push 0
push 0
push 0
push 0x1001cc00
push 0
push 0
call edi
cmp dword [0x1005fa50], 1
jne 0x10017c65
push 0
push 0
push 0
push 0x1001bc40
push 0
push 0
call edi
cmp dword [0x1005f9d8], 1
jne 0x10017c7f
push 0
push 0
push 0
push 0x10008480
push 0
push 0
call edi
cmp dword [0x1005fa80], 1
jne 0x10017c99
push 0
push 0
push 0
push 0x1001acf0
push 0
push 0
call edi
cmp dword [0x1005fa54], 1
jne 0x10017cb3
push 0
push 0
push 0
push 0x1000cf00
push 0
push 0
call edi
cmp dword [0x1005fa5c], 1
jne 0x10017ccd
push 0
push 0
push 0
push 0x1000e320
push 0
push 0
call edi
cmp dword [0x1005fa70], 1
jne 0x10017ce7
push 0
push 0
push 0
push 0x10013ba0
push 0
push 0
call edi
cmp dword [0x1005fa60], 1
jne 0x10017d01
push 0
push 0
push 0
push 0x1000e8e0
push 0
push 0
call edi
cmp dword [0x1005fa58], 1
jne 0x10017d1b
push 0
push 0
push 0
push 0x1000e2d0
push 0
push 0
call edi
cmp dword [0x1005fa64], 1
jne 0x10017d35
push 0
push 0
push 0
push 0x10011740
push 0
push 0
call edi
cmp dword [0x1005fa68], 1
jne 0x10017d4f
push 0
push 0
push 0
push 0x10012dc0
push 0
push 0
call edi
cmp dword [0x1005fa6c], 1
jne 0x10017d7a
push 0
push 0
push 0
push 0x10010370
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10010b40
push 0
push 0
call edi
cmp dword [0x1005fa74], 1
jne 0x10017d94
push 0
push 0
push 0
push 0x10014290
push 0
push 0
call edi
cmp dword [0x1005fa78], 0
jne 0x10017dae
push 0
push 0
push 0
push 0x10014b50
push 0
push 0
call edi
cmp dword [0x1005fa7c], 1
jne 0x10017dc8
push 0
push 0
push 0
push 0x100031f0
push 0
push 0
call edi
cmp dword [0x1005fa84], 1
jne 0x10017de2
push 0
push 0
push 0
push 0x100013e0
push 0
push 0
call edi
cmp dword [0x1005fa10], 1
jne 0x10017df0
call fcn.1001b1a0
cmp dword [0x1005fa28], 0
jne 0x10017e0a
push 0
push 0
push 0
push 0x1001c3d0
push 0
push 0
call edi
cmp dword [0x1005fa94], 1
jne 0x10017e24
push 0
push 0
push 0
push 0x1001c7b0
push 0
push 0
call edi
cmp dword [0x1005fa88], 1
jne 0x10017e3e
push 0
push 0
push 0
push 0x100058c0
push 0
push 0
call edi
cmp dword [0x1005fa24], 1
jne 0x10017e58
push 0
push 0
push 0
push 0x10014ec0
push 0
push 0
call edi
cmp dword [0x1005f9c4], 1
jne 0x10017edd
mov eax, 0x7dbe6ac
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, eax
mov eax, dword [0x1005f9ac]
movups xmm0, xmmword [eax]
mov eax, 0x69216c
mov edx, eax
movups xmmword [ecx], xmm0
mov ecx, dword [0x1005f9b0]
mov dword [eax], 0
mov byte [eax + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
movzx eax, byte [ecx + 4]
xor ecx, ecx
mov byte [edx + 4], al
mov eax, 0x7dbe6c0
mov edx, eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
mov ecx, dword [0x1005f9b4]
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ax, word [ecx + 0xc]
mov word [edx + 0xc], ax
movzx eax, byte [ecx + 0xe]
mov byte [edx + 0xe], al
cmp dword [0x1005f9c8], 1
jne 0x10017ef7
push 0
push 0
push 0
push 0x1001d370
push 0
push 0
call edi
cmp dword [0x1005fa9c], 1
jne 0x10017f20
mov eax, 0x693ff1
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, eax
mov eax, dword [str.Player]
mov dword [ecx], eax
mov ax, word [0x1004fc08]
mov word [ecx + 4], ax
cmp dword [0x1005f9dc], 1
jne 0x10017f54
cmp dword [0x1005f9bc], 0
jne 0x10017f54
push 0
push 0
push 0
push 0x1001ce30
push 0
push 0
call edi
push 0
push 0
push 0
push 0x1001d160
push 0
push 0
call edi
cmp dword [0x1005fa0c], 1
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x10017f6b
push dword [0x1005f994]
call esi
cmp dword [0x1005fa08], 1
jne 0x10017f7b
push 0x10053e50
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.10005e80
call fcn.10017fb0
call fcn.10018100
int3