Function at 0x10003410
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x7c
push ebx
push esi
push edi
cmp eax, 1
jne 0x10003e76
push 0xa
call fcn.1000aa6a
add esp, 4
mov dword [0x10022c60], eax
test eax, eax
je 0x1000344b
mov ecx, 0xa
lea ecx, [ecx]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10003440
push 0x1000000
push 0
push 0x10022a28
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x104
push 0x10022820
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1000348f
push 0x10
push str.LumaCEG_Plugin__LumaCEG_Plugin_x86.dll_
push str.Unable_to_get_dll_path_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x5c
push 0x10022820
call fcn.10005cdb
add esp, 8
test eax, eax
je 0x100034a7
xor ecx, ecx
mov word [eax], cx
push 0x10022820
push 0x104
push 0x10022a50
call fcn.10008023
push str.LumaCEGPlugin.ini
push 0x104
push 0x10022a50
call fcn.10008087
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10022a50
call ebx
cmp eax, 0xffffffff
jne 0x1000350f
push 0x10
push str.LumaCEG_Plugin__LumaCEG_Plugin_x86.dll_
push str.Unable_to_open_LumaCEGPlugin.ini_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20a
call fcn.10004464
push 0x208
mov esi, eax
push 0
push esi
mov dword [ebp + 0xc], esi
call fcn.10006060
push 0x10022a50
push 0x104
push esi
mov byte [esi + 0x208], 0
call fcn.10008023
add esp, 0x1c
test eax, eax
jne 0x10003557
mov byte [esi + 0x208], 1
cmp byte [esi + 0x208], 0
jne 0x10003581
push 0x20a
push esi
mov byte [esi + 0x208], 0
call fcn.100047ae
add esp, 8
mov byte [0x1002281b], 0
jmp 0x10003609
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1000a4bc
push esi
push 1
push str.LogFile
push 0x1001e8d4
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100035e0
call fcn.1000a4bc
cmp dword [eax], 0
jne 0x100035e0
push 0x20a
push esi
mov byte [esi + 0x208], 0
call fcn.100047ae
add esp, 8
cmp edi, 1
je 0x100035f5
mov byte [0x1002281b], 0
jmp 0x10003609
push 0x20a
push esi
mov byte [esi + 0x208], 0
call fcn.100047ae
add esp, 8
push str.LumaCEG_Started__Patching..._n_n
mov byte [0x1002281b], 1
call fcn.100026e0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0x800
push 0
push 0x1001e8fc
call esi
push 0x800
push 0
push str.Advapi32.dll
mov edi, eax
call esi
mov esi, eax
push 0x1001e918
mov dword [ebp - 0x38], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x3c], eax
test edi, edi
jne 0x10003661
push edi
push str.LumaCEG_Plugin__LumaCEG_Plugin_x86.dll_
push str.Ole32.dll__0
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
jne 0x10003682
push esi
push str.LumaCEG_Plugin__LumaCEG_Plugin_x86.dll_
push str.Advapi32.dll__0
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.10001d70
cmp dword [0x10022810], 0
jne 0x10003e4e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10022810], eax
xor ecx, ecx
mov edx, 0x1002280c
xchg dword [edx], ecx
test eax, eax
je 0x10003e57
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100036d6
mov dword [ebp + 0xc], 0xb
jmp 0x100036ff
push 0x1001e9a4
push eax
call esi
test eax, eax
jne 0x100036eb
mov dword [ebp + 0xc], 0xc
jmp 0x100036ff
push 0x10022a44
mov edx, 0x10002850
mov ecx, eax
call fcn.10001dc0
mov dword [ebp + 0xc], eax
mov ecx, dword [sym.imp.KERNEL32.dll_CreateEventA]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x40], eax
call edi
test eax, eax
jne 0x10003721
mov dword [ebp + 8], 0xb
jmp 0x1000374a
push 0x1001e9b4
push eax
call esi
test eax, eax
jne 0x10003736
mov dword [ebp + 8], 0xc
jmp 0x1000374a
push 0x10022a4c
mov edx, 0x10002930
mov ecx, eax
call fcn.10001dc0
mov dword [ebp + 8], eax
mov ecx, ebx
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x44], eax
call edi
test eax, eax
jne 0x10003768
mov dword [ebp - 4], 0xb
jmp 0x10003791
push 0x1001e9c0
push eax
call esi
test eax, eax
jne 0x1000377d
mov dword [ebp - 4], 0xc
jmp 0x10003791
push 0x10022e74
mov edx, 0x10002a60
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 4], eax
mov ecx, dword [sym.imp.KERNEL32.dll_OpenFileById]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x48], eax
call edi
test eax, eax
jne 0x100037b3
mov dword [ebp - 8], 0xb
jmp 0x100037dc
push 0x1001e9d0
push eax
call esi
test eax, eax
jne 0x100037c8
mov dword [ebp - 8], 0xc
jmp 0x100037dc
push 0x10022c64
mov edx, 0x10002ab0
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 8], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x4c], eax
call edi
test eax, eax
jne 0x100037fe
mov dword [ebp - 0xc], 0xb
jmp 0x10003827
push 0x1001e9e4
push eax
call esi
test eax, eax
jne 0x10003813
mov dword [ebp - 0xc], 0xc
jmp 0x10003827
push 0x10022a48
mov edx, 0x10002cf0
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0xc], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x50], eax
call edi
test eax, eax
jne 0x10003849
mov dword [ebp - 0x10], 0xb
jmp 0x10003872
push 0x1001ea00
push eax
call esi
test eax, eax
jne 0x1000385e
mov dword [ebp - 0x10], 0xc
jmp 0x10003872
push 0x10022e78
mov edx, 0x10002e60
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x10], eax
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x54], eax
call edi
test eax, eax
jne 0x10003894
mov dword [ebp - 0x14], 0xb
jmp 0x100038bd
push 0x1001ea0c
push eax
call esi
test eax, eax
jne 0x100038a9
mov dword [ebp - 0x14], 0xc
jmp 0x100038bd
push 0x10022c5c
mov edx, 0x10003050
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x14], eax
mov ecx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x58], eax
call edi
test eax, eax
jne 0x100038df
mov dword [ebp - 0x18], 0xb
jmp 0x10003908
push 0x1001ea18
push eax
call esi
test eax, eax
jne 0x100038f4
mov dword [ebp - 0x18], 0xc
jmp 0x10003908
push 0x10022e70
mov edx, 0x100030d0
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x18], eax
mov ecx, dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x5c], eax
call edi
test eax, eax
jne 0x1000392a
mov dword [ebp - 0x1c], 0xb
jmp 0x10003953
push 0x1001ea30
push eax
call esi
test eax, eax
jne 0x1000393f
mov dword [ebp - 0x1c], 0xc
jmp 0x10003953
push 0x10022e90
mov edx, 0x10003350
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x1c], eax
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10002270
push str.Ole32.dll
mov dword [ebp - 0x60], eax
call edi
test eax, eax
jne 0x10003975
mov dword [ebp - 0x20], 0xb
jmp 0x1000399e
push 0x1001ea3c
push eax
call esi
test eax, eax
jne 0x1000398a
mov dword [ebp - 0x20], 0xc
jmp 0x1000399e
push 0x10022a40
mov edx, 0x10002b40
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x20], eax
mov ecx, dword [sym.imp.ole32.dll_StringFromGUID2]
call fcn.10002270
push 0x1001de50
mov dword [ebp - 0x64], eax
call edi
test eax, eax
jne 0x100039c0
mov dword [ebp - 0x24], 0xb
jmp 0x100039e9
push 0x1001ea60
push eax
call esi
test eax, eax
jne 0x100039d5
mov dword [ebp - 0x24], 0xc
jmp 0x100039e9
push 0x10022e7c
mov edx, 0x10002b90
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x24], eax
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call fcn.10002270
push 0x1001de50
mov dword [ebp - 0x68], eax
call edi
test eax, eax
jne 0x10003a0b
mov dword [ebp - 0x28], 0xb
jmp 0x10003a34
push 0x1001ea70
push eax
call esi
test eax, eax
jne 0x10003a20
mov dword [ebp - 0x28], 0xc
jmp 0x10003a34
push 0x10022e84
mov edx, 0x10002c60
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x28], eax
mov ecx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.10002270
push 0x1001de50
mov dword [ebp - 0x6c], eax
call edi
test eax, eax
jne 0x10003a56
mov dword [ebp - 0x2c], 0xb
jmp 0x10003a7f
push str.SystemFunction036
push eax
call esi
test eax, eax
jne 0x10003a6b
mov dword [ebp - 0x2c], 0xc
jmp 0x10003a7f
push 0x10022e80
mov edx, 0x100032b0
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x2c], eax
push str.SystemFunction036
push dword [ebp - 0x38]
call esi
mov ecx, eax
call fcn.10002270
push 0x1001de50
mov dword [ebp - 0x70], eax
call edi
test eax, eax
jne 0x10003aa7
mov dword [ebp - 0x30], 0xb
jmp 0x10003ad0
push 0x1001ea98
push eax
call esi
test eax, eax
jne 0x10003abc
mov dword [ebp - 0x30], 0xc
jmp 0x10003ad0
push 0x10022e8c
mov edx, 0x100033c0
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x30], eax
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10002270
push str.ntdll.dll
mov dword [ebp - 0x74], eax
call edi
test eax, eax
jne 0x10003af2
mov dword [ebp - 0x34], 0xb
jmp 0x10003b1b
push str.NtCreateFile
push eax
call esi
test eax, eax
jne 0x10003b07
mov dword [ebp - 0x34], 0xc
jmp 0x10003b1b
push 0x10022e9c
mov edx, 0x100032f0
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x3c]
push str.NtCreateFile
push ebx
call esi
mov ecx, eax
call fcn.10002270
push str.ntdll.dll
mov dword [ebp - 0x78], eax
call edi
test eax, eax
jne 0x10003b44
mov dword [ebp - 0x38], 0xb
jmp 0x10003b6d
push str.NtQueryInformationFile
push eax
call esi
test eax, eax
jne 0x10003b59
mov dword [ebp - 0x38], 0xc
jmp 0x10003b6d
push 0x10022c58
mov edx, 0x10003100
mov ecx, eax
call fcn.10001dc0
mov dword [ebp - 0x38], eax
push str.NtQueryInformationFile
push ebx
call esi
mov ecx, eax
call fcn.10002270
push str.ntdll.dll
mov dword [ebp - 0x7c], eax
call edi
test eax, eax
jne 0x10003b8f
lea ebx, [eax + 0xb]
jmp 0x10003bb3
push str.NtQueryDirectoryFile
push eax
call esi
test eax, eax
jne 0x10003ba0
lea ebx, [eax + 0xc]
jmp 0x10003bb3
push 0x10022e98
mov edx, 0x10003180
mov ecx, eax
call fcn.10001dc0
mov ebx, eax
push str.NtQueryDirectoryFile
push dword [ebp - 0x3c]
call esi
mov ecx, eax
call fcn.10002270
push str.kernel32.dll
mov dword [ebp - 0x3c], eax
call edi
test eax, eax
jne 0x10003bd7
lea esi, [eax + 0xb]
jmp 0x10003bfb
push 0x1001eaf8
push eax
call esi
test eax, eax
jne 0x10003be8
lea esi, [eax + 0xc]
jmp 0x10003bfb
push 0x10022e94
mov edx, 0x100028d0
mov ecx, eax
call fcn.10001dc0
mov esi, eax
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.10002270
cmp byte [0x1002281b], 1
mov edi, eax
jne 0x10004079
mov ecx, dword [ebp - 0x40]
call fcn.100023b0
mov ecx, dword [ebp + 0xc]
push eax
call fcn.100023b0
push eax
push str.CreateEventA_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x44]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp + 8]
push eax
call fcn.100023b0
push eax
push str.CreateFileW_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 4]
push eax
call fcn.100023b0
push eax
push str.OpenFileById_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 8]
push eax
call fcn.100023b0
push eax
push str.GetFullPathNameW_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x50]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0xc]
push eax
call fcn.100023b0
push eax
push str.GetFileInformationByHandle_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x54]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x10]
push eax
call fcn.100023b0
push eax
push str.lstrcmpiW_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x58]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x14]
push eax
call fcn.100023b0
push eax
push str.lstrlenW_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x5c]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x18]
push eax
call fcn.100023b0
push eax
push str.CompareStringOrdinal_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x60]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.100023b0
push eax
push str.CloseHandle_Hook______s______s_n
call fcn.100026e0
add esp, 0xc
mov ecx, dword [ebp - 0x64]
call fcn.100023b0
mov ecx, dword [ebp - 0x20]
push eax
call fcn.100023b0
push eax
push str.StringFromGUID2_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x68]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x24]
push eax
call fcn.100023b0
push eax
push str.RegOpenKeyExW_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x6c]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x28]
push eax
call fcn.100023b0
push eax
push str.RegQueryValueExW_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x70]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x2c]
push eax
call fcn.100023b0
push eax
push str.SystemFunction036_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x74]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x30]
push eax
call fcn.100023b0
push eax
push str.RegCloseKey_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x78]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x34]
push eax
call fcn.100023b0
push eax
push str.NtCreateFile_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x7c]
add esp, 0xc
call fcn.100023b0
mov ecx, dword [ebp - 0x38]
push eax
call fcn.100023b0
push eax
push str.NtQueryInformationFile_Hook______s______s_n
call fcn.100026e0
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
call fcn.100023b0
push eax
mov ecx, ebx
call fcn.100023b0
push eax
push str.NtQueryDirectoryFile_Hook______s______s_n
call fcn.100026e0
add esp, 0xc
mov ecx, edi
call fcn.100023b0
push eax
mov ecx, esi
call fcn.100023b0
push eax
push str.CreateFileA_Hook______s______s_n_n
call fcn.100026e0
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov ecx, 0x1002280c
xchg dword [ecx], eax
push 0
push str.LumaCEG_Plugin__LumaCEG_Plugin_x86.dll_
push str.Unable_to_initialize_MinHook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x10004079
cmp byte [0x1002281b], 1
jne 0x10003e94
push str.Shutting_down_LumaCEG..._n
call fcn.100026e0
add esp, 4
call fcn.10001d70
cmp dword [0x10022810], 0
je 0x10003ea9
xor ecx, ecx
call fcn.10001ca0
xor eax, eax
mov ebx, 0x1002280c
xchg dword [ebx], eax
mov ecx, dword [sym.imp.KERNEL32.dll_CreateEventA]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileW]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_OpenFileById]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
call fcn.100020c0
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100020c0
mov ecx, dword [sym.imp.ole32.dll_StringFromGUID2]
call fcn.100020c0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call fcn.100020c0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.100020c0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SystemFunction036
push 0x1001de50
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov ecx, eax
call fcn.100020c0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100020c0
push str.NtCreateFile
push str.ntdll.dll
call edi
push eax
call esi
mov ecx, eax
call fcn.100020c0
push str.NtQueryInformationFile
push str.ntdll.dll
call edi
push eax
call esi
mov ecx, eax
call fcn.100020c0
push str.NtQueryDirectoryFile
push str.ntdll.dll
call edi
push eax
call esi
mov ecx, eax
call fcn.100020c0
call fcn.10001d70
cmp dword [0x10022810], 0
je 0x10004075
xor ecx, ecx
call fcn.10001ca0
test eax, eax
jne 0x10004075
mov eax, dword [0x10022808]
mov dword [0x10022808], 0
test eax, eax
je 0x10004002
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ebx, [ebx]
mov esi, dword [eax]
push 0x8000
push 0
push eax
call edi
mov eax, esi
test esi, esi
jne 0x10003ff0
push dword [0x10022ea0]
push 0
push dword [0x10022810]
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov edx, dword [0x10022ea0]
cmp eax, 0xffffffff
je 0x10004032
test eax, eax
je 0x10004032
mov ecx, edx
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x10004027
push edx
push 0
push dword [0x10022810]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [0x10022810]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x10022810], 0
mov dword [0x10022ea0], 0
mov dword [0x10022ea4], 0
mov dword [0x10022ea8], 0
xor eax, eax
xchg dword [ebx], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc