Function at 0x100238c0
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x318
mov eax, dword [0x10064040]
xor eax, esp
mov dword [esp + 0x314], eax
push esi
push edi
lea eax, [esp + 0x90]
mov dword [esp + 0x98], 1
push eax
push 0x100694c0
lea eax, [esp + 0xa0]
mov dword [esp + 0x98], 0x208
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10023959
push str.Steam.exe
push 0x104
push 0x100694c0
call fcn.10037101
add esp, 0xc
mov edx, 0x100694c0
mov ecx, 0x10068b78
call fcn.10001d80
cmp al, 1
jne 0x10023959
mov byte [0x10067485], al
push 0x5c
push 0x10068b78
call fcn.1002e5b0
add esp, 8
test eax, eax
je 0x10023971
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x10067488
call fcn.1002e5b0
add esp, 8
test eax, eax
je 0x10023989
xor ecx, ecx
mov word [eax], cx
cmp byte [0x10067485], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [eax]
jne 0x10023f77
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x100680d4
call esi
push 0x1000000
push 0
push 0x10069aec
call esi
push 0x1000000
push 0
push 0x10068520
call esi
push 0x10023880
nop dword [eax + eax]
call fcn.10036d2a
add esp, 4
push 0x100238a0
call fcn.100374e0
add esp, 4
push 0x104
push 0x10068538
push 0x1005bd64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10068d88
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x10023c48
test eax, eax
je 0x10023c48
push 0x10068538
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10068e90
call fcn.10001320
add esp, 0x14
push 0x10068d88
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10068968
call fcn.100013e0
add esp, 0x14
push 0x10068d88
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10068a70
call fcn.100013e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x58]
add esp, 0x14
mov dword [esp + 0x44], 0
mov dword [esp + 0x98], 4
mov dword [esp + 0x90], 4
push eax
push 0x20019
push 0
push 0x10068e90
push 0x80000001
call esi
test eax, eax
jne 0x10023b06
lea eax, [esp + 0x90]
push eax
push 0x10064ae0
lea eax, [esp + 0xa0]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push 0x20019
push 0
push 0x10068e90
push 0x80000001
mov dword [esp + 0xac], 4
mov dword [esp + 0xa4], 4
call esi
nop dword [eax]
test eax, eax
jne 0x10023b74
lea eax, [esp + 0x90]
push eax
push 0x10064ae4
lea eax, [esp + 0xa0]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push 0x20019
push 0
push 0x10068e90
push 0x80000001
mov dword [esp + 0xac], 4
mov dword [esp + 0xa4], 4
call esi
test eax, eax
jne 0x10023bde
lea eax, [esp + 0x90]
push eax
push 0x10064cf0
lea eax, [esp + 0xa0]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push 0x20019
push 0
push 0x10068e90
push 0x80000001
mov dword [esp + 0xac], 4
mov dword [esp + 0xa4], 4
call esi
test eax, eax
jne 0x10023c48
lea eax, [esp + 0x90]
push eax
push 0x100680f8
lea eax, [esp + 0xa0]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10068b78
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10068740
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068740
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x10023c9b
push eax
call esi
mov byte [0x10067695], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x100696d0
push str.Exe______s_r_n
call fcn.100025a0
add esp, 8
cmp byte [0x10067695], 0
jne 0x10023d50
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002e8c0
add esp, 0xc
mov dword [esp + 0x98], 1
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x208
push eax
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0xa0]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10023d46
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x110]
push eax
jmp 0x10023d55
push 0x10068b78
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10067068
call fcn.10001320
add esp, 0x14
push 0x10068b78
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x10067698
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067698
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023dcf
push eax
call esi
push 0x10067698
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.100025a0
add esp, 8
push 8
push 0
push 0x10067698
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x10067488
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x100690a8
call fcn.10001320
add esp, 0x14
push 0x10068538
push 0x10067488
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10067cc0
call fcn.10001320
push 0x10068538
push 0x10067488
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10069d20
call fcn.10001320
push 0x10067488
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x100741a8
call fcn.10001320
add esp, 0x44
push 0x10067488
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x10067ab0
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10067ec8
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100678a8
call fcn.10001320
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x14
push str.DenuvoActivationBypass.dll
call esi
mov dword [0x10073f7c], eax
test eax, eax
jne 0x10023ed2
push str.DenuvoOfflineActivationBypass.dll
call esi
mov dword [0x10073f7c], eax
test eax, eax
je 0x100247c6
push str.GetDenuvoCallResult
push eax
call edi
push str.GetDenuvoID
push dword [0x10073f7c]
mov dword [0x10069b0c], eax
call edi
push str.RequestDenuvoAppTicket
push dword [0x10073f7c]
mov dword [0x10068e8c], eax
call edi
push str.GetDenuvoAppTicket
push dword [0x10073f7c]
mov dword [0x10069b10], eax
call edi
push str.ShutdownDenuvoDll
push dword [0x10073f7c]
mov dword [0x10068958], eax
call edi
cmp dword [0x10069b0c], 0
mov dword [0x10067480], eax
je 0x10023f5b
cmp dword [0x10068e8c], 0
je 0x10023f5b
cmp dword [0x10069b10], 0
je 0x10023f5b
cmp dword [0x10068958], 0
je 0x10023f5b
test eax, eax
je 0x10023f5b
mov byte [0x10067697], 1
jmp 0x100247c6
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10066e5f], 1
nop
jne 0x10023f95
mov byte [0x10066e5e], 1
mov byte [0x10067484], 1
jmp 0x1002409f
push 0x10067488
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x10069f28
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069f28
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023ff9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069f28
nop
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10066e5e], 1
mov byte [0x10067484], 1
jmp 0x1002409f
push 0x1000000
push 0
push 0x100680d4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x10067488
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10067068
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10067ec8
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100678a8
call fcn.10001320
add esp, 0x14
push str.GreenLuma_2024_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x100696d0
push str.Exe______s_r_n
call fcn.100025a0
push 0x10023880
call fcn.10036d2a
add esp, 0xc
push 0x100238a0
call fcn.100374e0
add esp, 4
push 0x10067488
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10068318
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10068100
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sAppListAppList.ini
push 0xffffffffffffffff
push 0x104
push 0x10067270
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10069b18
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067270
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10024225
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20a
call fcn.1002ce9e
add esp, 4
mov dword [esp + 0x10], eax
push 0x208
push 0
push eax
call fcn.1002e8c0
mov eax, dword ds:[esp + 0x1c]
add esp, 0xc
push 0x10067270
push 0x104
push eax
mov byte [eax + 0x208], 0
call fcn.1003709d
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x10024197
mov byte [eax + 0x208], 1
cmp byte ds:[eax + 0x208], 0
jne 0x100241a6
xor ecx, ecx
jmp 0x100241fa
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10037420
push dword [esp + 0x10]
push 0
push str.NumAppIDs
push str.AppList
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100241ea
nop dword [eax]
call fcn.10037420
cmp dword [eax], 0
je 0x100241f2
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
push 0x20a
push eax
mov dword [0x100741a4], ecx
mov byte [eax + 0x208], 0
call fcn.1002d1e8
add esp, 8
cmp dword [0x100741a4], 0
je 0x10024225
mov byte [0x10066e5d], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069b18
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop
cmp eax, 0xffffffff
je 0x1002425e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069b18
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10067484], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068100
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [eax + eax]
cmp eax, 0xffffffff
je 0x10024317
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10067484], 1
je 0x100244af
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 6
je 0x100244af
sub eax, 1
jne 0x10024317
xor esi, esi
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002e8c0
add esp, 0xc
lea eax, [esp + 0x110]
push esi
push 0x10068318
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
add esp, 0x18
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x82
jb 0x100242c1
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x10067690], eax
call fcn.10035c65
add esp, 4
push eax
push 0x1005c3dc
push 0x1005c3e0
push 0x10069ae8
call fcn.10035b7d
push 1
call fcn.10035c65
add esp, 0x14
push eax
push 0x1005c3f0
push 0x1005c3f4
push 0x100680d0
call fcn.10035b7d
push 2
call fcn.10035c65
add esp, 0x14
push eax
push 0x1005c3f0
push 0x1005c3f4
push 0x100696cc
call fcn.10035b7d
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.100012a0
add esp, 0x14
push 0
call fcn.10035c65
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.1003731e
add esp, 0xc
test eax, eax
je 0x10024493
lea ecx, [esp + 0xa0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100243e0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x100256f2
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xa8], ax
lea eax, [esp + 0xa8]
push eax
call fcn.100365db
add esp, 0xc
mov dword [esp + 0x90], eax
call fcn.10037420
cmp dword [eax], 0x22
je 0x100256d6
mov eax, dword [esp + 0x90]
test eax, eax
je 0x1002444b
nop dword [eax]
cmp eax, 0x82
jle 0x1002460e
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movaps xmmword [esp + 0xa4], xmm0
call fcn.100012a0
add esp, 4
push 0
call fcn.10035c65
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.1003731e
add esp, 0xc
test eax, eax
jne 0x100243d0
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0xc], 0
nop word [eax + eax]
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002e8c0
add esp, 0xc
lea eax, [esp + 0x110]
push dword [esp + 0xc]
push 0x10068318
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push 0x10054bc0
lea eax, [esp + 0x12c]
mov dword [esp + 0x60], 0
push eax
lea eax, [esp + 0x64]
push eax
call fcn.100368d6
add esp, 0x24
test eax, eax
jne 0x100247c6
push dword [esp + 0x44]
mov dword [esp + 0xd4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xc4]
movaps xmmword [esp + 0xc4], xmm0
push 0x14
push eax
call fcn.10037313
add esp, 0xc
test eax, eax
je 0x100245ee
push dword ds:[esp + 0x44]
call fcn.10036a72
add esp, 4
lea eax, [esp + 0xc0]
push 0xa
push 0
push eax
call fcn.10036595
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x94], eax
lea eax, [esp + 0x90]
mov ecx, dword [ecx*4 + 0x10064ae8]
push eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x94], ecx
push eax
call fcn.10025f00
call fcn.10037420
cmp dword [eax], 0x22
je 0x100245d0
mov eax, dword ds:[esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x82
jb 0x100244c0
jmp 0x100247c6
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0xc], ecx
test eax, eax
jle 0x10024776
mov edx, str._nAppID:
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012a0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xf0], xmm0
movq qword [esp + 0x100], xmm0
push 0
call fcn.10035c65
add esp, 4
push eax
lea eax, [esp + 0xe4]
push 0x14
push eax
call fcn.1003731e
add esp, 0xc
test eax, eax
je 0x100248f1
lea ecx, [esp + 0xe0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024680
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x100256f2
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xe8], ax
lea eax, [esp + 0xe8]
push eax
call fcn.100365db
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x98], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
mov ecx, dword [ecx*4 + 0x10064ae8]
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x38], ecx
push eax
call fcn.10025f00
call fcn.10037420
cmp dword [eax], 0x22
je 0x100248d5
push 0
push 0x10068318
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002e8c0
add esp, 0xc
lea eax, [esp + 0x110]
push dword [esp + 0xc]
push 0x10068318
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push dword [esp + 0xb0]
lea eax, [esp + 0x12c]
push 0x10052a54
push eax
call fcn.10002dc0
mov ecx, dword [esp + 0x30]
add esp, 0x24
inc ecx
mov edx, str._nAppID:
mov dword [esp + 0xc], ecx
cmp ecx, dword [esp + 0x90]
jl 0x10024621
cmp dword [0x10067690], 1
jne 0x100247c6
mov eax, dword [0x10069ae8]
test eax, eax
je 0x10024791
push eax
call fcn.10036a72
add esp, 4
mov eax, dword [0x100680d0]
test eax, eax
je 0x100247a8
push eax
call fcn.10036a72
add esp, 4
mov eax, dword [0x100696cc]
test eax, eax
je 0x100247ba
push eax
call fcn.10036a72
add esp, 4
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x10073d70
push str.GreenLuma_2024_Dll______s_r_n
call fcn.100025a0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x100741a0], eax
call fcn.100022e0
add esp, 8
call fcn.10027ad0
cmp dword [0x100743bc], 0
nop dword [eax]
jne 0x100256b1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100743bc], eax
xor ecx, ecx
mov edx, 0x100743b8
xchg dword [edx], ecx
test eax, eax
je 0x100256ba
cmp byte [0x10066e5f], 0
jne 0x10024955
cmp byte [0x10067485], 0
nop dword [eax]
jne 0x1002494e
lea eax, [esp + 0x90]
mov dword [esp + 0x98], 1
push eax
push 0x100698e0
lea eax, [esp + 0xa0]
mov dword [esp + 0x98], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1002490e
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.100022e0
add esp, 4
mov ecx, 0x208
mov eax, 0x100698e0
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100248a7
push 0x10067488
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x100698e0
call fcn.10001320
add esp, 0x14
jmp 0x1002491b
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Got_Steamclient_dll_paths_from_registry_r_n
call fcn.100022e0
add esp, 4
push 8
push 0
push 0x100698e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x100698dc], eax
test eax, eax
jne 0x10024961
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100698dc]
jmp 0x10024961
push str.steamclient.dll
call esi
mov dword [0x100698dc], eax
cmp byte [0x10066e5e], 0
jne 0x100253ee
test eax, eax
je 0x10024bae
push str.Steamclient.dll_is_loaded__r_n
nop dword [eax + eax]
call fcn.100022e0
add esp, 4
push 0x100698e0
push str.Steamclient______s_r_n_r_n
call fcn.100025a0
add esp, 8
push str.steamclient.dll
call esi
test eax, eax
jne 0x100249b0
mov dword [esp + 0x44], 0xb
jmp 0x100249db
push str.CreateInterface
push eax
call edi
test eax, eax
jne 0x100249c6
mov dword [esp + 0x44], 0xc
jmp 0x100249db
push 0x10069b04
mov edx, 0x100041c0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x44], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x100249f0
mov dword [esp + 0x18], 0xb
jmp 0x10024a1b
push str.Steam_BGetCallback
push eax
call edi
test eax, eax
jne 0x10024a06
mov dword [esp + 0x18], 0xc
jmp 0x10024a1b
push 0x10068b74
mov edx, 0x10004a40
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x18], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024a30
mov dword [esp + 0xc], 0xb
jmp 0x10024a5b
push str.Steam_FreeLastCallback
push eax
call edi
test eax, eax
jne 0x10024a46
mov dword [esp + 0xc], 0xc
jmp 0x10024a5b
push 0x1006894c
mov edx, 0x10004c00
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0xc], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024a70
mov dword [esp + 0x14], 0xb
jmp 0x10024a9b
push str.Steam_GetAPICallResult
push eax
call edi
test eax, eax
jne 0x10024a86
mov dword [esp + 0x14], 0xc
jmp 0x10024a9b
push 0x10067cbc
mov edx, 0x10004cc0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x14], eax
push str.CreateInterface
push dword [0x100698dc]
call edi
mov edx, 1
mov ecx, eax
call fcn.10028080
push str.Steam_BGetCallback
push dword [0x100698dc]
mov esi, eax
call edi
mov edx, 1
mov ecx, eax
call fcn.10028080
push str.Steam_FreeLastCallback
push dword [0x100698dc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028080
push str.Steam_GetAPICallResult
push dword [0x100698dc]
mov dword [esp + 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028080
mov ecx, esi
mov dword [esp + 0x98], eax
call fcn.10028180
mov ecx, dword [esp + 0x44]
push eax
call fcn.10028180
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.100022e0
add esp, 0xc
mov ecx, edi
call fcn.10028180
mov ecx, dword [esp + 0x18]
push eax
call fcn.10028180
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x9c]
add esp, 0xc
call fcn.10028180
mov ecx, dword [esp + 0xc]
push eax
call fcn.10028180
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0xa4]
add esp, 0xc
call fcn.10028180
mov ecx, dword [esp + 0x14]
push eax
call fcn.10028180
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.100022e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024bc6
mov eax, 0xb
jmp 0x10024bea
push str.NtCreateUserProcess
push eax
call edi
test eax, eax
jne 0x10024bd9
mov eax, 0xc
jmp 0x10024bea
push 0x10073f88
mov edx, 0x10003380
mov ecx, eax
call fcn.10027c20
push str.ntdll.dll
mov dword [0x10073f94], eax
call esi
test eax, eax
jne 0x10024c02
mov eax, 0xb
jmp 0x10024c26
push str.NtResumeThread
push eax
call edi
test eax, eax
jne 0x10024c15
mov eax, 0xc
jmp 0x10024c26
push 0x10068954
mov edx, 0x100040e0
mov ecx, eax
call fcn.10027c20
push str.ntdll.dll
mov dword [0x10073f80], eax
call esi
test eax, eax
jne 0x10024c42
mov dword ds:[esp + 0x24], 0xb
jmp 0x10024c6d
push str.LdrLoadDll
push eax
call edi
test eax, eax
jne 0x10024c58
mov dword [esp + 0x24], 0xc
jmp 0x10024c6d
push 0x100690a4
mov edx, 0x100090c0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x24], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024c82
mov dword [esp + 0x28], 0xb
jmp 0x10024cad
push str.LdrGetDllHandleEx
push eax
call edi
test eax, eax
jne 0x10024c98
mov dword [esp + 0x28], 0xc
jmp 0x10024cad
push 0x10073f78
mov edx, 0x10009140
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x28], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024cc2
mov dword [esp + 0x2c], 0xb
jmp 0x10024ced
push str.LdrGetDllFullName
push eax
call edi
test eax, eax
jne 0x10024cd8
mov dword [esp + 0x2c], 0xc
jmp 0x10024ced
push 0x100680ec
mov edx, 0x100091c0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x2c], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024d02
mov dword [esp + 0x30], 0xb
jmp 0x10024d2d
push str.LdrGetDllHandleByMapping
push eax
call edi
test eax, eax
jne 0x10024d18
mov dword [esp + 0x30], 0xc
jmp 0x10024d2d
push 0x10068a6c
mov edx, 0x10009220
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x30], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024d42
mov dword [esp + 0x3c], 0xb
jmp 0x10024d6d
push str.LdrGetDllHandleByName
push eax
call edi
test eax, eax
jne 0x10024d58
mov dword [esp + 0x3c], 0xc
jmp 0x10024d6d
push 0x10068964
mov edx, 0x100092a0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x3c], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024d82
mov dword [esp + 0x34], 0xb
jmp 0x10024dad
push str.LdrQueryProcessModuleInformation
push eax
call edi
test eax, eax
jne 0x10024d98
mov dword [esp + 0x34], 0xc
jmp 0x10024dad
push 0x10069b14
mov edx, 0x10009320
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x34], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024dc5
mov dword [esp + 0x98], 0xb
jmp 0x10024df6
push str.LdrEnumerateLoadedModules
push eax
call edi
test eax, eax
jne 0x10024dde
mov dword [esp + 0x98], 0xc
jmp 0x10024df6
push 0x100678a4
mov edx, 0x10009460
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x98], eax
push str.ntdll.dll
call esi
nop dword [eax]
test eax, eax
jne 0x10024e11
mov dword [esp + 0x90], 0xb
jmp 0x10024e42
push str.RtlLockModuleSection
push eax
call edi
test eax, eax
jne 0x10024e2a
mov dword [esp + 0x90], 0xc
jmp 0x10024e42
push 0x10068308
mov edx, 0x100094c0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x90], eax
push str.kernel32.dll
call esi
test eax, eax
je 0x10024e76
push str.Module32NextW
push eax
call edi
test eax, eax
je 0x10024e76
push 0x1006895c
mov edx, 0x100094e0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x18], eax
test eax, eax
je 0x10024eb9
push str.KernelBase.dll
call esi
nop dword [eax]
test eax, eax
jne 0x10024e8e
mov dword [esp + 0x18], 0xb
jmp 0x10024eb9
push str.Module32NextW
push eax
call edi
test eax, eax
jne 0x10024ea4
mov dword [esp + 0x18], 0xc
jmp 0x10024eb9
push 0x1006895c
mov edx, 0x100094e0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x18], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
je 0x10025057
push str.EnumProcessModules
push eax
call edi
test eax, eax
je 0x10025057
push 0x10069b08
mov edx, 0x10009560
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x44], eax
test eax, eax
jne 0x10025057
push str.KernelBase.dll
call esi
nop
test eax, eax
jne 0x10024f0e
mov dword [esp + 0x10], 0xb
jmp 0x10024f39
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x10024f24
mov dword [esp + 0x10], 0xc
jmp 0x10024f39
push 0x100696c8
mov edx, 0x100098a0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x10], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
jne 0x10024f50
mov dword [esp + 0x1c], 0xb
jmp 0x10024f7b
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x10024f66
mov dword [esp + 0x1c], 0xc
jmp 0x10024f7b
push 0x100743b4
mov edx, 0x10009c20
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x1c], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024f90
mov dword [esp + 0x20], 0xb
jmp 0x10024fbb
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x10024fa6
mov dword [esp + 0x20], 0xc
jmp 0x10024fbb
push 0x1006909c
mov edx, 0x10009ce0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x20], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024fd0
mov dword [esp + 0x14], 0xb
jmp 0x10024ffb
push 0x1005c918
push eax
call edi
test eax, eax
jne 0x10024fe6
mov dword [esp + 0x14], 0xc
jmp 0x10024ffb
push 0x100743b0
mov edx, 0x10009dc0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x14], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10025018
mov dword [esp + 0xc], 0xb
push str.KernelBase.dll
jmp 0x100251e0
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x10025038
mov dword [esp + 0xc], 0xc
push str.KernelBase.dll
jmp 0x100251e0
push 0x10067478
mov edx, 0x10009e80
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0xc], eax
push str.KernelBase.dll
jmp 0x100251e0
push str.Psapi.dll
call esi
nop
test eax, eax
jne 0x1002506e
mov dword [esp + 0x44], 0xb
jmp 0x10025099
push str.EnumProcessModules
push eax
call edi
test eax, eax
jne 0x10025084
mov dword [esp + 0x44], 0xc
jmp 0x10025099
push 0x10069b08
mov edx, 0x10009560
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x44], eax
push str.Psapi.dll
nop
call esi
test eax, eax
jne 0x100250b0
mov dword [esp + 0x10], 0xb
jmp 0x100250db
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x100250c6
mov dword [esp + 0x10], 0xc
jmp 0x100250db
push 0x100696c8
mov edx, 0x100098a0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x10], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x100250f0
mov dword [esp + 0x1c], 0xb
jmp 0x1002511b
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x10025106
mov dword [esp + 0x1c], 0xc
jmp 0x1002511b
push 0x100743b4
mov edx, 0x10009c20
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x1c], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10025130
mov dword [esp + 0x20], 0xb
jmp 0x1002515b
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x10025146
mov dword [esp + 0x20], 0xc
jmp 0x1002515b
push 0x1006909c
mov edx, 0x10009ce0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x20], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10025170
mov dword [esp + 0x14], 0xb
jmp 0x1002519b
push 0x1005c918
push eax
call edi
test eax, eax
jne 0x10025186
mov dword [esp + 0x14], 0xc
jmp 0x1002519b
push 0x100743b0
mov edx, 0x10009dc0
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0x14], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x100251b0
mov dword [esp + 0xc], 0xb
jmp 0x100251db
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x100251c6
mov dword [esp + 0xc], 0xc
jmp 0x100251db
push 0x10067478
mov edx, 0x10009e80
mov ecx, eax
call fcn.10027c20
mov dword [esp + 0xc], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x100251eb
lea edi, [eax + 0xb]
jmp 0x1002520f
push str.GetMappedFileNameW
push eax
call edi
test eax, eax
jne 0x100251fc
lea edi, [eax + 0xc]
jmp 0x1002520f
push 0x100680fc
mov edx, 0x10009f60
mov ecx, eax
call fcn.10027c20
mov edi, eax
mov edx, 1
xor ecx, ecx
call fcn.10028080
mov ecx, dword [0x10073f94]
mov esi, eax
call fcn.10028180
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [0x10073f80]
add esp, 8
call fcn.10028180
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x2c]
add esp, 8
call fcn.10028180
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x30]
add esp, 8
call fcn.10028180
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x34]
add esp, 8
call fcn.10028180
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.100022e0
mov ecx, dword ds:[esp + 0x38]
add esp, 8
call fcn.10028180
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x44]
add esp, 8
call fcn.10028180
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x3c]
add esp, 8
call fcn.10028180
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0xa0]
add esp, 8
call fcn.10028180
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x98]
add esp, 8
call fcn.10028180
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10028180
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x4c]
add esp, 8
call fcn.10028180
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x18]
add esp, 8
call fcn.10028180
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10028180
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x28]
add esp, 8
call fcn.10028180
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10028180
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x14]
add esp, 8
call fcn.10028180
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.100022e0
add esp, 8
mov ecx, edi
call fcn.10028180
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.100022e0
add esp, 8
mov ecx, esi
call fcn.10028180
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.100022e0
mov eax, dword [0x100698dc]
add esp, 8
cmp byte [0x10067485], 1
jne 0x10025459
cmp byte [0x10066e5f], 1
jne 0x10025459
push eax
call dword [0x100678a0]
mov ecx, dword [0x100698dc]
push str.xxxxxxxxxxxx
push 0x1005b914
mov edx, dword [eax + 0x50]
call fcn.10001fc0
add esp, 8
mov dword [0x10069098], eax
test eax, eax
je 0x10025459
push 0x100692b0
mov edx, 0x10002ec0
mov dword [0x100692b0], eax
mov ecx, eax
call fcn.10027c20
mov ecx, dword [0x10069098]
mov edx, 1
call fcn.10028080
cmp byte [0x10066e5e], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x100254bf
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x100680f4], eax
nop
test eax, eax
jne 0x1002549f
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10023180
push 0
push 0
call edi
test eax, eax
je 0x10025551
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [0x10066e5f], 0
jne 0x1002569b
cmp byte [0x10067485], 0
push 0
jne 0x10025586
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x10067068
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002556c
push 0
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0
push eax
push 1
push 0x1005cc6c
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.1002cc86
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call esi
jmp 0x100254c5
push 0x10
push str.GreenLuma_2024
push 0x1005cc70
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x10023240
push 0
push 0
call edi
test eax, eax
je 0x100255a8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100255b8
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error
push 0
call esi
push 0
push 0
push 0
push 0x10023720
push 0
push 0
call edi
test eax, eax
je 0x100255d6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100255e6
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error_2
push 0
call esi
xorps xmm0, xmm0
mov dword [esp + 0x48], 0x44
lea eax, [esp + 0x48]
movlpd qword [esp + 0x4c], xmm0
push eax
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
movlpd qword [esp + 0x88], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [esp + 0x7a], 8
jb 0x1002569b
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x1002569b
lea esi, [eax + 4]
test esi, esi
je 0x10025655
mov esi, dword [esi]
jmp 0x10025667
xor esi, esi
call fcn.10037420
mov dword [eax], 0x16
call fcn.10036ce6
lea eax, ds:[esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, 1
jne 0x1002569b
test byte [esp + 0x90], al
je 0x1002569b
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x31c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002cc86
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x100743b8
xchg dword [ecx], eax
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002cdc1
int3