Function at 0x10011b10
Capabilities:
Check os version
Create thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10032af6
mov eax, dword fs:[0]
push eax
sub esp, 0x160
push ebx
push esi
push edi
mov eax, dword [0x1003e6c4]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, 1
sub eax, esi
jne 0x100120d7
mov eax, dword [ebp + 8]
mov dword [0x10044570], eax
call sym.Codex.dll_GasMask_5
cmp dword [0x100445f8], esi
jne 0x10011b6c
call fcn.10016860
cmp dword [0x1004465c], 0
jne 0x10011b7d
cmp dword [0x10044664], esi
jne 0x10011b82
call fcn.1000a090
cmp dword [0x1004463c], esi
jne 0x10011ba1
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x10011b9c
mov dword [0x100453a8], esi
jmp 0x10011ba1
call fcn.10005f60
cmp dword [0x10044668], esi
jne 0x10011bae
call fcn.10005fc0
cmp dword [0x10044608], esi
jne 0x10011bc7
push 0
push 0
push 0x10014950
call fcn.1001b55d
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1004465c], esi
jne 0x10011c08
push 0
push 0
push 0
push 0x100085f0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10007a40
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10007f70
push 0
push 0
call edi
cmp dword [0x10044664], 0
je 0x10011c46
call fcn.10007320
cmp dword [0x10044668], esi
jne 0x10011c27
cmp dword [0x100453a0], 0
je 0x10011c46
cmp dword [0x1004463c], esi
jne 0x10011c41
cmp dword [0x100453a8], 0
jne 0x10011c41
cmp dword [0x100453a4], 0
je 0x10011c46
call fcn.10005a00
cmp dword [0x10044670], esi
jne 0x10011c53
call fcn.10012100
cmp dword [0x10044674], esi
jne 0x10011c60
call fcn.10012250
cmp dword [0x100446a8], esi
jne 0x10011c79
push 0
push 0
push 0
push 0x100183c0
push 0
push 0
call edi
cmp dword [0x10044654], esi
jne 0x10011c92
push 0
push 0
push 0
push 0x100095e0
push 0
push 0
call edi
cmp dword [0x1004469c], esi
jne 0x10011c9f
call fcn.1000dcd0
cmp dword [0x10044694], esi
jne 0x10011cc1
cmp dword [0x10044604], 0
jne 0x10011cc1
push 0
push 0
push 0
push 0x1000a550
push 0
push 0
call edi
cmp dword [0x100445e4], esi
jne 0x10011ea5
push str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON_
push 0x10043610
call fcn.10003a90
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.100073f0
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov ecx, dword [eax + esi + 0xc]
xor ebx, ebx
test cl, 6
jne 0x10011d11
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x10011d11
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x10011d32
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x10011d2a
or eax, 4
push 0
push eax
call fcn.10001570
push str.All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
push 0x10043610
call fcn.10003a90
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.100073f0
mov edx, dword [esi]
mov eax, dword [edx + 4]
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x10011d74
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x10011d74
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x10011d95
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x10011d8d
or eax, 4
push 0
push eax
call fcn.10001570
mov ebx, 1
cmp dword [0x10044644], ebx
jne 0x10011df4
push 8
push str.GameGuard_Log.txt
lea edx, [esp + 0xcc]
push edx
call fcn.10001fe0
lea eax, [esp + 0xc4]
push str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
push eax
mov dword [esp + 0x180], 0
call fcn.10003a90
add esp, 8
lea esi, [esp + 0xc4]
call fcn.100021f0
mov eax, esi
mov dword [esp + 0x178], 0xffffffff
call fcn.10001b50
cmp dword [0x10044654], ebx
jne 0x10012029
lea ecx, [esp + 0x14]
push ecx
call fcn.1001a8a0
lea edx, [esp + 0x18]
add esp, 4
push edx
call fcn.1001a747
add esp, 4
push 8
mov esi, eax
push 0x10036584
lea eax, [esp + 0x24]
push eax
call fcn.10001fe0
lea ecx, [esp + 0x1c]
push str._nLocal_Time:
push ecx
mov dword [esp + 0x180], ebx
call fcn.10003a90
push esi
call fcn.1001a090
add esp, 0xc
push eax
lea edx, [esp + 0x20]
push edx
call fcn.10003a90
lea eax, [esp + 0x24]
push str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
push eax
call fcn.10003a90
lea ecx, [esp + 0x2c]
push str._n__________________
push ecx
call fcn.10003a90
add esp, 0x18
lea esi, [esp + 0x1c]
call fcn.100021f0
push 2
push 0x10036584
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
mov dword [esp + 0x178], 0xffffffff
call fcn.10001b50
jmp 0x10012029
cmp dword [0x100445f4], esi
jne 0x10011ebe
push 0
push 0
push 0
push 0x100132c0
push 0
push 0
call edi
cmp dword [0x10044640], esi
jne 0x10011ed7
push 0
push 0
push 0
push 0x100112b0
push 0
push 0
call edi
cmp dword [0x10044690], esi
jne 0x10011ef0
push 0
push 0
push 0
push 0x10011660
push 0
push 0
call edi
cmp dword [0x100445fc], esi
jne 0x10011f09
push 0
push 0
push 0
push 0x10017ba0
push 0
push 0
call edi
cmp dword [0x10044678], esi
jne 0x10011f22
push 0
push 0
push 0
push 0x100163d0
push 0
push 0
call edi
cmp dword [0x10044600], esi
jne 0x10011f3b
push 0
push 0
push 0
push 0x1000a040
push 0
push 0
call edi
cmp dword [0x10044684], esi
jne 0x10011f54
push 0
push 0
push 0
push 0x10014fa0
push 0
push 0
call edi
cmp dword [0x1004467c], esi
jne 0x10011f6d
push 0
push 0
push 0
push 0x1000bee0
push 0
push 0
call edi
cmp dword [0x10044680], esi
jne 0x10011f86
push 0
push 0
push 0
push 0x10005200
push 0
push 0
call edi
cmp dword [0x10044688], esi
jne 0x10011f9f
push 0
push 0
push 0
push 0x10001b70
push 0
push 0
call edi
cmp dword [0x10044638], esi
jne 0x10011fac
call fcn.10015860
cmp dword [0x10044650], esi
jne 0x10011fc5
push 0
push 0
push 0
push 0x10017180
push 0
push 0
call edi
cmp dword [0x1004462c], esi
jne 0x10011fde
push 0
push 0
push 0
push 0x10016cd0
push 0
push 0
call edi
cmp dword [0x10044698], esi
jne 0x10011ff7
push 0
push 0
push 0
push 0x100176b0
push 0
push 0
call edi
cmp dword [0x1004468c], esi
jne 0x10012010
push 0
push 0
push 0
push 0x10005540
push 0
push 0
call edi
cmp dword [0x1004464c], esi
jne 0x10012029
push 0
push 0
push 0
push 0x1000c200
push 0
push 0
call edi
mov ebx, 1
cmp dword [0x100445ec], ebx
jne 0x1001203b
call fcn.10016420
cmp dword [0x100445f0], ebx
jne 0x10012054
push 0
push 0
push 0
push 0x100182b0
push 0
push 0
call edi
cmp dword [0x100446a0], ebx
jne 0x1001207e
mov eax, 0x693ff1
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov word [edx + 4], cx
mov edx, dword [str.Player]
mov dword [eax], edx
mov cx, word [0x10037558]
mov word [eax + 4], cx
cmp dword [0x10044604], ebx
jne 0x100120b1
cmp dword [0x100445e4], 0
jne 0x100120b1
push 0
push 0
push 0
push 0x10017fa0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10018070
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x10044634], ebx
jne 0x100120c8
mov edx, dword [0x100445bc]
push edx
call esi
cmp dword [0x10044630], ebx
jne 0x100120d7
push str.Glow.dll
call esi
mov eax, 1
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc