Function at 0x10001820
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get process heap flags
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1006b018], 1
push esi
push edi
jne 0x100020fd
mov eax, dword [0x100716d8]
mov edx, 0x1006b018
push 0x2a
mov ecx, str.Prodigal_Ran_Online
or dword [eax + 0x3fec], 2
mov dword [eax + 0x4010], 0x43af0000
mov dword [eax + 0x4014], 0x438c0000
mov dword [eax + 0x3ff4], 1
call fcn.1000fd50
add esp, 4
cmp byte [0x10071572], 0
jne 0x10001ba5
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c14]
movss dword [ebp - 8], xmm0
cmp byte [eax + 0xc8], 0
jne 0x100018d7
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
movss xmm0, dword [ebp - 8]
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001912
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x1000194f
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x1000198c
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x100019c9
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001a06
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001a43
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001a80
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001abd
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001afa
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001b37
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001b74
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x43a28000
mov ecx, str.Load_Menu
mov dword [ebp - 0x14], 0x42100000
call fcn.10042d50
add esp, 4
test al, al
je 0x100020f8
call fcn.100013c0
jmp 0x100020f8
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42d00000
mov ecx, str.Misc
mov dword [ebp - 0x14], 0
call fcn.10042d50
mov ecx, dword [0x10071154]
xor edx, edx
movss xmm1, dword [0x10067b50]
add esp, 4
test al, al
xorps xmm0, xmm0
cmovne ecx, edx
mov dword [0x10071154], ecx
call fcn.10015780
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42d00000
mov ecx, str.Visuals
mov dword [ebp - 0x14], 0
call fcn.10042d50
mov ecx, dword [0x10071154]
add esp, 4
movss xmm1, dword [0x10067b50]
test al, al
mov edx, 1
xorps xmm0, xmm0
cmovne ecx, edx
mov dword [0x10071154], ecx
call fcn.10015780
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42d00000
mov ecx, str.Farmer
mov dword [ebp - 0x14], 0
call fcn.10042d50
mov ecx, dword [0x10071154]
add esp, 4
test al, al
mov edx, 2
cmovne ecx, edx
mov dword [0x10071154], ecx
sub ecx, 0
je 0x10001fec
sub ecx, 1
je 0x10001e1a
sub ecx, 1
jne 0x100020f8
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c14]
movss dword [ebp - 8], xmm0
cmp byte [eax + 0xc8], 0
jne 0x10001cc9
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
movss xmm0, dword [ebp - 8]
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001d04
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov edx, 0x10071700
mov ecx, str.AUTO_POTION_Q
call fcn.10044260
mov edx, 0x100716f9
mov ecx, str.AUTO_RESU
call fcn.10044260
mov edx, 0x100716fb
mov ecx, str.FORCE_MAP
call fcn.10044260
push ecx
push 0x10058664
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x3e8
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x10071704
mov edx, 4
mov ecx, str.AUTO_SP_W
call fcn.10046300
add esp, 0x10
mov dword [ebp - 0xc], 0x3e8
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0
mov edx, 4
mov ecx, str.AUTO_MP_E
push 0x10058664
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100716fc
call fcn.10046300
mov ecx, dword [0x100716d8]
add esp, 0x14
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001dd3
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001e10
movss xmm1, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
push str.TAKE_NOTE:_DAPAT_MAY_RESU_ROSA_KAYO_NAKA_EQUIP
jmp 0x100020e1
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c14]
movss dword [ebp - 0xc], xmm0
cmp byte [eax + 0xc8], 0
jne 0x10001e67
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x10001ea2
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
sub esp, 0x10
call fcn.100457c0
mov eax, dword [0x100716f4]
add esp, 0x10
cmp eax, 3
ja case.default.0x10001eb7
jmp dword [eax*4 + 0x1000253c]
mov dword [0x10071708], 0
jmp case.default.0x10001eb7
mov dword [0x10071708], 0x41f00000
jmp case.default.0x10001eb7
mov dword [0x10071708], 0x42700000
jmp case.default.0x10001eb7
mov dword [0x10071708], 0x42f00000
push ecx
push str._.3f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0x3a83126f
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x40000000
push eax
push 0x10071148
mov edx, 8
mov ecx, str.ATTACK_SPEED
call fcn.10046300
add esp, 0x10
mov dword [ebp - 0x10], 0x3a83126f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x40000000
mov edx, 8
mov ecx, str.AS_CUT_SKILL
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071150
call fcn.10046300
add esp, 0x10
mov dword [ebp - 0x10], 0x3a83126f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x41f00000
mov edx, 8
mov ecx, str.LONG_RANGE
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071144
call fcn.10046300
add esp, 0x10
mov dword [ebp - 0x10], 0x43480042
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x442f0000
mov edx, 8
mov ecx, str.DRONE
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10071140
call fcn.10046300
add esp, 0x10
mov dword [ebp - 0x10], 0x42a00083
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x43c80000
mov edx, 8
mov ecx, str.FAST_SCROLL
push str._.3f
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1007114c
call fcn.10046300
add esp, 0x14
jmp 0x100020f8
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
movss xmm0, dword [0x10067c14]
cmp byte [eax + 0xc8], 0
jne 0x1000202f
movaps xmm1, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov edx, 0x100716fa
mov ecx, str.FAST_TELE
call fcn.10044260
mov edx, 0x100716f8
mov ecx, str.REMOVE_FOG
call fcn.10044260
mov edx, 0x10071701
mov ecx, str.WALL_NAME
call fcn.10044260
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x1000209c
movss xmm1, dword [0x10067c14]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
mov ecx, dword [0x100716d8]
mov eax, dword [ecx + 0x3f04]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x3f04]
cmp byte [eax + 0xc8], 0
jne 0x100020dc
movss xmm1, dword [0x10067c14]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.100153c0
push str.F5_SHOW__HIDE
movaps xmm0, xmmword [0x10067f40]
lea eax, [ebp - 0x20]
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.10042730
add esp, 8
call fcn.10012fd0
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x10002117
cmp byte [0x1006b018], 0
sete byte [0x1006b018]
cmp byte [0x10071572], 0
je 0x10002522
cmp byte [0x10071700], 0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10002159
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0xfceb0c
call edi
lea eax, [ebp - 8]
mov byte [0xfceb0c], 3
push eax
push dword [ebp - 8]
push 1
push 0xfceb0c
call edi
cmp byte [0x100716f8], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x100f100
je 0x100021a6
call edi
lea eax, [ebp - 8]
mov dword [0x100f100], 0x461c3c00
push eax
push dword [ebp - 8]
push 4
push 0x100f100
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x100f0d8
call edi
mov dword [0x100f0d8], 0x49657e00
jmp 0x100021db
call edi
lea eax, [ebp - 8]
mov dword [0x100f100], 0x442f0000
push eax
push dword [ebp - 8]
push 4
push 0x100f100
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x100f0d8
call edi
mov dword [0x100f0d8], 0x451c4000
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push 0x100f0d8
call edi
cmp byte [0x100716fa], 0
lea eax, [ebp - 8]
mov esi, dword [0x10071684]
push eax
push 0x40
push 1
push esi
je 0x1000220a
call edi
mov byte [esi], 0xd8
jmp 0x1000220f
call edi
mov byte [esi], 0xd9
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x10071701], 0
lea eax, [ebp - 8]
mov esi, dword [0x100716d0]
push eax
push 0x40
push 1
push esi
je 0x1000225a
call edi
lea eax, [ebp - 8]
mov byte [esi], 0xeb
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov esi, dword [0x100716b0]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov byte [esi], 0xeb
jmp 0x1000227f
call edi
lea eax, [ebp - 8]
mov byte [esi], 0x74
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov esi, dword [0x100716b0]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov byte [esi], 0x74
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x100716f9], 0
mov esi, dword [0x10071680]
je 0x100022ea
lea eax, [esi + 6]
mov dword [0x10071694], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x10001380
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 6
push esi
call edi
mov esi, dword [0x100716b8]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 8]
mov byte [esi], 0x74
push eax
push dword [ebp - 8]
jmp 0x1000232d
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push esi
call edi
mov eax, dword [0x100586b0]
mov dword [esi], eax
mov ax, word [0x100586b4]
mov word [esi + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
mov esi, dword [0x100716b8]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 0x24]
mov byte [esi], 0x75
push eax
push dword [ebp - 0x24]
push 1
push esi
call edi
cmp byte [0x100716fb], 0
mov esi, dword [0x100716c4]
je 0x10002371
lea eax, [esi + 6]
mov dword [0x10071688], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x100013a0
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
jmp 0x10002394
lea eax, [ebp - 0x10]
push eax
push 0x40
push 6
push esi
call edi
mov eax, dword [0x100586b8]
mov dword [esi], eax
mov ax, word [0x100586bc]
mov word [esi + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 6
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
push 0x10071148
push 0xfd2023
push dword [0x100716f0]
call esi
push 0
push 4
push 0x10071140
push 0xfced9c
push dword [0x100716f0]
call esi
push 0
push 4
push 0x1007114c
push 0xfcedac
push dword [0x100716f0]
call esi
push 0
push 4
push 0x10071150
push 0xc
push dword [0x100716f0]
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov dword [ebp - 0x24], 0
push eax
mov eax, dword fs:[0x18]
mov eax, dword ds:[eax + 0x30]
movzx eax, byte ds:[eax + 2]
mov dword [ebp - 0x24], eax
pop eax
cmp dword [ebp - 0x10], 0
jne 0x10002532
cmp dword [ebp - 0x24], 0
jne 0x10002532
mov eax, dword [0x1007168c]
cmp eax, dword [0x10071704]
jae 0x1000246e
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0xfceb0d
call edi
lea eax, [ebp - 8]
mov byte [0xfceb0d], 3
push eax
push dword [ebp - 8]
push 1
push 0xfceb0d
call edi
mov eax, dword [0x100716cc]
cmp eax, dword [0x100716fc]
jae 0x100024a1
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0xfceb0e
call edi
lea eax, [ebp - 0xc]
mov byte [0xfceb0e], 3
push eax
push dword [ebp - 0xc]
push 1
push 0xfceb0e
call edi
movzx eax, word [0x10071570]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push 0x100716cc
push eax
push dword [0x100716f0]
call esi
movzx eax, word [0x1007167c]
push 0
push 4
push 0x1007168c
push eax
push dword [0x100716f0]
call esi
push 0
push 2
push 0x1006b02c
push 0xfced9c
push dword [0x100716f0]
call esi
mov eax, 0xda
cmp word [0x1006b02c], ax
jbe 0x10002522
mov esi, dword [0x100716a0]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
call edi
mov eax, 0x840f
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 2
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10055dc4
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]