Function at 0x100c8150
Capabilities:
Allocate or change rwx memory
Create thread
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x102140db]
test eax, eax
je 0x100c8170
jmp 0x100c8c2a
mov byte [0x102140db], 1
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0xd21fff
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100c8c2a
push 0x101f618c
push 1
push 0x101f619c
push 0x101f61a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x1020e0bc], eax
push 0x101f61b4
push 1
push str.WideScreenScale
push 0x101f61d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x1020e0b8], eax
push str..DataKGDataLocalServerGame.info
mov ecx, 0x105447e8
call fcn.10116030
movzx edx, al
test edx, edx
jne 0x100c8206
push 0x10
push 0x101f6204
push str.ServerGame.info_no_funciona_o_es_invalida_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1023cb30
call fcn.1000e1d0
jmp 0x100c8c2a
push str..DataKGDataLocalEffectGame.info
mov ecx, 0x105447e8
call fcn.10115db0
movzx eax, al
test eax, eax
jne 0x100c823f
push 0x10
push 0x101f625c
push str.EffectGame.info_no_funciona_o_es_invalida_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1023cb30
call fcn.1000e1d0
jmp 0x100c8c2a
mov ecx, 0x104fa476
call fcn.1010a1c0
cmp dword [0x10544c24], 1
jne 0x100c826c
call fcn.1000eb10
push 0
push 0
push 0
push 0x100c8100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x105449bc], 1
jne 0x100c827a
call fcn.100c8080
call fcn.10120b70
push 0xa0
push 0xe61144
call fcn.10121a70
add esp, 8
push 0xeb
push 0x4d1e69
call fcn.10121a70
add esp, 8
push 0xe9
push 0x4d228d
call fcn.10121a70
add esp, 8
push 0x8b
push 0x4d228e
call fcn.10121a70
add esp, 8
push 0
push 0x4d228f
call fcn.10121a70
add esp, 8
push 0
push 0x4d2290
call fcn.10121a70
add esp, 8
push 0
push 0x4d2291
call fcn.10121a70
add esp, 8
push 0xeb
push 0x4d559c
call fcn.10121a70
add esp, 8
push 0xeb
push 0x633f7a
call fcn.10121a70
add esp, 8
push 0xeb
push 0x634403
call fcn.10121a70
add esp, 8
push 0xeb
push 0x63e6c4
call fcn.10121a70
add esp, 8
push 0xeb
push 0x4d2246
call fcn.10121a70
add esp, 8
push 0xeb
push 0x501163
call fcn.10121a70
add esp, 8
push 0
push 0x40af0a
call fcn.10121a70
add esp, 8
push 0x50
push 0x40b4bc
call fcn.10121a70
add esp, 8
push 0x50
push 0x40b4c5
call fcn.10121a70
add esp, 8
push 0x18
push 0x40b4cf
call fcn.10121a70
add esp, 8
push 0
push 0x40af0a
call fcn.10121a70
add esp, 8
push 0xeb
push 0x40afd5
call fcn.10121a70
add esp, 8
push 0x70
push 0x777fd6
call fcn.10121a70
add esp, 8
push 0x17
push 0x777fd7
call fcn.10121a70
add esp, 8
push 0x3c
push 0x4ebec7
call fcn.10121a70
add esp, 8
push 0x3c
push 0x5c4004
call fcn.10121a70
add esp, 8
push 0x3c
push 0x7e40bb
call fcn.10121a70
add esp, 8
push 0x3c
push 0x81b546
call fcn.10121a70
add esp, 8
push 0x3c
push 0x81b58d
call fcn.10121a70
add esp, 8
push 0x3c
push 0x86e284
call fcn.10121a70
add esp, 8
push 0x3c
push 0x86e44c
call fcn.10121a70
add esp, 8
push 0x3c
push 0x86e573
call fcn.10121a70
add esp, 8
push 0x3c
push 0x86f8fc
call fcn.10121a70
add esp, 8
push 0xb7
push 0x7da373
call fcn.10121a70
add esp, 8
push 0xb7
push 0x7e1c44
call fcn.10121a70
add esp, 8
push 0xeb
push 0x52100d
call fcn.10121a70
add esp, 8
push 0
push 0x9543c4
call fcn.10121a70
add esp, 8
push 0x4d1dc2
push 0x4d1cf0
push 0xe9
call fcn.10121c00
add esp, 0xc
push 0x1b
push 0x90
push 0xd20170
call fcn.10121ce0
add esp, 0xc
cmp dword [0x10544a68], 0
jne 0x100c84e4
mov dword [ebp - 0x10], 0xeb
jmp 0x100c84eb
mov dword [ebp - 0x10], 0x75
movzx ecx, byte [ebp - 0x10]
push ecx
push 0x64cbd1
call fcn.10121a70
add esp, 8
movzx edx, byte [0x10544a6c]
push edx
push 0x64cbd0
call fcn.10121a70
add esp, 8
movzx eax, byte [0x10544a6c]
push eax
push 0x95ceef
call fcn.10121a70
add esp, 8
movzx ecx, byte [0x10544a6c]
push ecx
push 0x95cf14
call fcn.10121a70
add esp, 8
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [eax + 0x10544850]
add ecx, 1
push ecx
push 0xe61f68
call fcn.10121a70
add esp, 8
mov edx, 1
shl edx, 1
movsx eax, byte [edx + 0x10544850]
add eax, 2
push eax
push 0xe61f69
call fcn.10121a70
add esp, 8
mov ecx, 1
imul edx, ecx, 3
movsx eax, byte [edx + 0x10544850]
add eax, 3
push eax
push 0xe61f6a
call fcn.10121a70
add esp, 8
mov ecx, 1
imul edx, ecx, 5
movsx eax, byte [edx + 0x10544850]
add eax, 4
push eax
push 0xe61f6b
call fcn.10121a70
add esp, 8
mov ecx, 1
imul edx, ecx, 6
movsx eax, byte [edx + 0x10544850]
add eax, 5
push eax
push 0xe61f6c
call fcn.10121a70
add esp, 8
movzx ecx, word [0x1054484e]
push ecx
push 0xe609e4
call fcn.10121ac0
add esp, 8
cmp dword [0x10544a64], 0x3c
jb 0x100c8603
mov ecx, 0x1023d4b0
call fcn.10029420
cmp dword [0x10544a64], 0x3c
jae 0x100c863f
push 0x102140d4
push 0x4d9d3b
call fcn.10121b10
add esp, 8
push 0x102140d4
push 0x4dac60
call fcn.10121b10
add esp, 8
push 0xa
push 0x7b55338
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x4d597b
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x4da289
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x4da297
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x4da3a2
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x4da3ce
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x4da3d9
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x63d326
call fcn.10121b10
add esp, 8
push 0x102140d0
push 0x642112
call fcn.10121b10
add esp, 8
push 0x10544869
push 0x4d0e09
call fcn.10121b10
add esp, 8
push 0x10544889
push 0x4d9f55
call fcn.10121b10
add esp, 8
push 0
push 0x5c914e
call fcn.10121a70
add esp, 8
push 0x14
push 0x90
push 0x63e908
call fcn.10121ce0
add esp, 0xc
push 0x20
push 0x1054482d
push 0xe611b2
call fcn.10121c80
add esp, 0xc
push 0x11
push 0x10544858
push 0xe61f70
call fcn.10121c80
add esp, 0xc
push fcn.10117110
push 0x65fd79
push 0xff
call fcn.10121c00
add esp, 0xc
push 0x100b1970
push 0x4da280
push 0xe9
call fcn.10121c00
add esp, 0xc
cmp dword [0x10544a64], 0x3c
jae 0x100c878e
push 0x100b19a0
push 0x4da3a1
push 0xe9
call fcn.10121c00
add esp, 0xc
jmp 0x100c87a5
push 0x100b1b80
push 0x4da3a1
push 0xe9
call fcn.10121c00
add esp, 0xc
push 0xc
push 0x4d9d39
call fcn.10121d40
add esp, 8
push 7
push 0x4d9d45
call fcn.10121d40
add esp, 8
push 0xf
push 0x4d9efc
call fcn.10121d40
add esp, 8
cmp dword [0x10544a64], 0x3c
jae 0x100c87ea
push 8
push 0x4dac5c
call fcn.10121d40
add esp, 8
push 5
push 0x5451f7
call fcn.10121d40
add esp, 8
push 8
push 0x545230
call fcn.10121d40
add esp, 8
push 8
push 0x5a52e9
call fcn.10121d40
add esp, 8
push 0x102183e8
push 0x6a
mov edx, dword [0x10214a54]
push edx
call fcn.10121ef0
add esp, 0xc
push 0x102182f8
push 0x6b
mov eax, dword [0x10214a54]
push eax
call fcn.10121ef0
add esp, 0xc
push 0x102184d8
push 0x6c
mov ecx, dword [0x10214a54]
push ecx
call fcn.10121ef0
add esp, 0xc
mov ecx, 0x1023d4ac
call fcn.1003bb30
mov ecx, 0x1024e431
call fcn.1004d420
mov ecx, 0x1024e454
call fcn.1004d390
lea ecx, [ebp - 9]
call fcn.1006cd40
lea ecx, [ebp - 9]
call fcn.10007120
cmp dword [0x10544c50], 1
jne 0x100c8899
mov ecx, 0x10252720
call fcn.1005dd40
push 0x100b1fc0
push 0x5b96e8
push 0xe8
call fcn.10121c00
add esp, 0xc
mov ecx, 0x1023cb30
call fcn.1000e2e0
mov ecx, 0x104dee30
call fcn.1009c240
mov ecx, 0x1024e433
call fcn.1009b8d0
push str.DataEnc1.dat
mov ecx, 0x104f9b00
call fcn.100ea190
push str.DataDec2.dat
mov ecx, 0x104f9b00
call fcn.100ea1b0
mov ecx, 0x104fb970
call fcn.100f7f60
mov ecx, 0x1050009c
call fcn.10105bf0
mov ecx, 0x104fba2c
call fcn.10102360
mov ecx, 0x104fa474
call fcn.100f7d40
mov ecx, 0x10500054
call fcn.10101a60
mov ecx, 0x104fb93c
call fcn.101020b0
mov ecx, 0x104ffd04
call fcn.100fade0
mov ecx, 0x105000dc
call fcn.1010b720
mov ecx, 0x1024e434
call fcn.1004cfa0
mov ecx, 0x1024e640
call fcn.10054300
mov ecx, 0x1020e0aa
call fcn.10089ff0
mov ecx, 0x10260160
call fcn.10066640
mov ecx, 0x104bb4e8
call fcn.10095a90
mov ecx, 0x104f979c
call fcn.100bd120
mov dword [0x104e1cb4], 1
cmp dword [0x10544bfc], 2
jne 0x100c8995
mov ecx, 0x10295158
call fcn.10087f00
mov ecx, 0x1024e4b8
call fcn.10053fa0
mov ecx, 0x10214ae4
call fcn.100f1110
mov ecx, 0x104f98d0
call fcn.100e6950
mov ecx, 0x10213fd0
call fcn.10081770
cmp dword [0x10544b3c], 1
jne 0x100c89e4
mov ecx, 0x10294ec0
call fcn.1007d440
mov ecx, 0x104e04a4
call fcn.100b0fc0
mov ecx, 0x1028ad00
call fcn.10079aa0
cmp dword [0x10544ca0], 1
jne 0x100c89f7
mov ecx, 0x1023cb68
call fcn.1000f3d0
cmp dword [0x10544be4], 1
jne 0x100c8a0a
mov ecx, 0x102619ac
call fcn.1007eb00
cmp dword [0x10544be8], 1
jne 0x100c8a1d
mov ecx, 0x1020deb5
call fcn.10041b70
cmp dword [0x10544be0], 1
jne 0x100c8a30
mov ecx, 0x1023bf5c
call fcn.10009eb0
cmp dword [0x10544bd0], 1
jne 0x100c8a3e
call fcn.100bbdf0
cmp dword [0x10544bd8], 1
jne 0x100c8a51
mov ecx, 0x1023e17c
call fcn.1004c670
cmp dword [0x10544bb8], 1
jne 0x100c8a64
mov ecx, 0x104f9a00
call fcn.100e7c80
cmp dword [0x10544bbc], 1
jne 0x100c8a72
call fcn.1000cab0
cmp dword [0x10544bc4], 1
jne 0x100c8a85
mov ecx, 0x10214ae6
call fcn.1011c2d0
call fcn.1005ca90
call fcn.100b1d70
call fcn.100b96e0
call fcn.100b9860
call fcn.100f2f50
call fcn.1011a540
mov ecx, 0x1060fd28
call fcn.1011e680
cmp dword [0x10544bd4], 1
jne 0x100c8ac0
mov ecx, 0x10260170
call fcn.10066e80
call fcn.1011b5c0
mov edx, dword [0x10214a54]
push edx
mov ecx, 0x1020e0c0
call fcn.1005e010
call fcn.100b9920
mov ecx, 0x10216fd0
call fcn.10121380
mov ecx, 0x104e1ca8
call fcn.100b33c0
mov ecx, 0x104b8340
call fcn.1008a9e0
mov ecx, 0x104bb608
call fcn.10097c40
mov ecx, 0x104f98bc
call fcn.100e8910
mov ecx, 0x1023bf70
call fcn.1000a050
mov ecx, 0x105447e8
call fcn.101162a0
mov ecx, 0x105447e8
call fcn.101162f0
mov ecx, 0x105447e8
call fcn.10116380
mov ecx, 0x105447e8
call fcn.101164e0
mov ecx, 0x105447e8
call fcn.10116680
mov ecx, 0x105447e8
call fcn.10116820
mov ecx, 0x105447e8
call fcn.101169c0
mov ecx, 0x105447e8
call fcn.10116b60
mov ecx, 0x105447e8
call fcn.10116d00
mov ecx, 0x105447e8
call fcn.10116ea0
mov ecx, 0x1023cc5c
call fcn.1000fd80
mov ecx, 0x104fa3a8
call fcn.100f04ce
call fcn.100f0e10
mov ecx, 0x1028a254
call fcn.1006c070
mov ecx, 0x10219c64
call fcn.10007870
cmp dword [0x10544a40], 1
jne 0x100c8bf9
push 0x105449c0
push 0x954149
call fcn.10121b10
add esp, 8
push 0x105449e0
push 0x954116
call fcn.10121b10
add esp, 8
push 0x10544a00
push 0x9540e3
call fcn.10121b10
add esp, 8
push 0x10544a20
push 0x9540ad
call fcn.10121b10
add esp, 8
cmp dword [0x10544ad8], 1
jne 0x100c8c0c
mov ecx, 0x104e9d80
call fcn.100bc000
mov ecx, 0x104dee31
call fcn.1009dda0
mov ecx, 0x104ffec0
call fcn.100ff130
mov ecx, 0x104ffd68
call fcn.100fb500
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret