Function at 0x10023d20
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x318
mov eax, dword [0x10064040]
xor eax, esp
mov dword [esp + 0x314], eax
push esi
push edi
lea eax, [esp + 0x88]
mov dword [esp + 0x90], 1
push eax
push 0x100694c8
lea eax, [esp + 0x98]
mov dword [esp + 0x90], 0x208
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10023db9
push str.Steam.exe
push 0x104
push 0x100694c8
call fcn.100379e1
add esp, 0xc
mov edx, 0x100694c8
mov ecx, 0x10068b78
call fcn.10001d80
cmp al, 1
jne 0x10023db9
mov byte [0x10067485], al
push 0x5c
push 0x10068b78
call fcn.1002ee90
add esp, 8
test eax, eax
je 0x10023dd1
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x10067488
call fcn.1002ee90
add esp, 8
test eax, eax
je 0x10023de9
xor ecx, ecx
mov word [eax], cx
cmp byte [0x10067485], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [eax]
jne 0x10024466
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x100680d4
call esi
push 0x1000000
push 0
push 0x10069af0
call esi
push 0x1000000
push 0
push 0x10068520
call esi
push 0x10023ce0
nop dword [eax + eax]
call fcn.1003760a
add esp, 4
push 0x10023d00
call fcn.10037dc0
add esp, 4
push 0x104
push 0x10068538
push 0x1005bdd4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10068d88
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x100240a8
test eax, eax
je 0x100240a8
push 0x10068538
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10068e98
call fcn.10001320
add esp, 0x14
push 0x10068d88
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10068968
call fcn.100013e0
add esp, 0x14
push 0x10068d88
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10068a70
call fcn.100013e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x50]
add esp, 0x14
mov dword [esp + 0x3c], 0
mov dword [esp + 0x90], 4
mov dword [esp + 0x88], 4
push eax
push 0x20019
push 0
push 0x10068e98
push 0x80000001
call esi
test eax, eax
jne 0x10023f66
lea eax, [esp + 0x88]
push eax
push 0x10064ae0
lea eax, [esp + 0x98]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0x20019
push 0
push 0x10068e98
push 0x80000001
mov dword [esp + 0xa4], 4
mov dword [esp + 0x9c], 4
call esi
nop dword [eax]
test eax, eax
jne 0x10023fd4
lea eax, [esp + 0x88]
push eax
push 0x10064ae4
lea eax, [esp + 0x98]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0x20019
push 0
push 0x10068e98
push 0x80000001
mov dword [esp + 0xa4], 4
mov dword [esp + 0x9c], 4
call esi
test eax, eax
jne 0x1002403e
lea eax, [esp + 0x88]
push eax
push 0x10064cf0
lea eax, [esp + 0x98]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0x20019
push 0
push 0x10068e98
push 0x80000001
mov dword [esp + 0xa4], 4
mov dword [esp + 0x9c], 4
call esi
test eax, eax
jne 0x100240a8
lea eax, [esp + 0x88]
push eax
push 0x100680f8
lea eax, [esp + 0x98]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10068b78
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10068740
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068740
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x100240fb
push eax
call esi
mov byte [0x10067695], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x100696d0
push str.Exe______s_r_n
call fcn.100025a0
add esp, 8
cmp byte [0x10067695], 0
jne 0x10024210
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f1a0
add esp, 0xc
mov dword [esp + 0x90], 1
lea eax, [esp + 0x88]
mov dword [esp + 0x88], 0x208
push eax
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x98]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10024206
cmp dword [0x10068314], 0
je 0x100241e9
mov eax, dword [0x10073f9c]
nop dword [eax]
test eax, eax
je 0x100241e9
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x1a
push 0x1005bf6c
push eax
mov dword [esp + 0x9c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x10068314]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.1002d566
mov esp, ebp
pop ebp
ret
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x110]
push eax
jmp 0x10024215
push 0x10068b78
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10067068
call fcn.10001320
add esp, 0x14
push 0x10068b78
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x10067698
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067698
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002428f
push eax
call esi
push 0x10067698
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.100025a0
add esp, 8
push 8
push 0
push 0x10067698
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x10067488
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x100690b0
call fcn.10001320
add esp, 0x14
push 0x10068538
push 0x10067488
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10067cc0
call fcn.10001320
push 0x10068538
push 0x10067488
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10069d20
call fcn.10001320
push 0x10067488
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x100741b0
call fcn.10001320
add esp, 0x44
push 0x10067488
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x10067ab0
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10067ec8
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100678a8
call fcn.10001320
add esp, 0x14
push str.DenuvoActivationBypass.dll
call edi
mov dword [0x10073f80], eax
test eax, eax
jne 0x1002438c
push str.DenuvoOfflineActivationBypass.dll
call edi
mov dword [0x10073f80], eax
test eax, eax
je 0x10024dd6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetDenuvoCallResult
push eax
call esi
push str.GetDenuvoID
push dword [0x10073f80]
mov dword [0x10069b10], eax
call esi
push str.RequestDenuvoAppTicket
push dword [0x10073f80]
mov dword [0x10068e90], eax
call esi
push str.GetDenuvoAppTicket
push dword [0x10073f80]
mov dword [0x10069b14], eax
call esi
push str.ShutdownDenuvoDll
push dword [0x10073f80]
mov dword [0x1006895c], eax
call esi
cmp dword [0x10069b10], 0
mov dword [0x10067480], eax
je 0x1002441b
cmp dword [0x10068e90], 0
je 0x1002441b
cmp dword [0x10069b14], 0
je 0x1002441b
cmp dword [0x1006895c], 0
je 0x1002441b
test eax, eax
je 0x1002441b
mov byte [0x10067697], 1
jmp 0x10024ddc
cmp dword [0x10068314], 0
je 0x10024445
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10024445
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x29
push 0x1005c27c
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10066e5f], 1
jne 0x10024485
mov byte [0x10066e5e], 1
mov byte [0x10067484], 1
nop dword [eax]
jmp 0x1002459f
push 0x10067488
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x10069f28
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069f28
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100244f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069f28
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10066e5e], 1
mov byte [0x10067484], 1
jmp 0x1002459f
push 0x1000000
push 0
push 0x100680d4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x10067488
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10067068
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10067ec8
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100678a8
call fcn.10001320
add esp, 0x14
push str.GreenLuma_2024_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x100696d0
push str.Exe______s_r_n
call fcn.100025a0
push 0x10023ce0
call fcn.1003760a
add esp, 0xc
push 0x10023d00
call fcn.10037dc0
add esp, 4
push 0x10067488
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10068318
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10068100
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sAppListAppList.ini
push 0xffffffffffffffff
push 0x104
push 0x10067270
call fcn.10001320
add esp, 0x14
push 0x10067488
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10069b18
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067270
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002472e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20a
call fcn.1002d77e
add esp, 4
mov dword [esp + 0x10], eax
push 0x208
push 0
push eax
call fcn.1002f1a0
mov eax, dword ds:[esp + 0x1c]
add esp, 0xc
push 0x10067270
push 0x104
push eax
mov byte [eax + 0x208], 0
call fcn.1003797d
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x10024697
mov byte [eax + 0x208], 1
cmp byte ds:[eax + 0x208], 0
je 0x1002470f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10037d00
push dword [esp + 0x10]
push 0
push str.NumAppIDs
push str.AppList
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax]
test eax, eax
jne 0x1002470b
call fcn.10037d00
cmp dword [eax], 0
jne 0x1002470b
mov eax, dword [esp + 0x88]
test eax, eax
mov dword [0x100741ac], eax
mov eax, dword [esp + 0x10]
je 0x10024719
mov byte [0x10066e5d], 1
jmp 0x10024719
mov eax, dword [esp + 0x10]
mov dword [0x100741ac], 0
push 0x20a
push eax
mov byte [eax + 0x208], 0
call fcn.1002dac8
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069b18
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10024766
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069b18
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10067484], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068100
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002482e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10067484], 1
nop dword [eax]
je 0x100249e9
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop word [eax + eax]
sub eax, 6
je 0x100249e9
sub eax, 1
jne 0x1002482e
xor edi, edi
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f1a0
add esp, 0xc
lea eax, [esp + 0x110]
push edi
push 0x10068318
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
add esp, 0x18
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, 0x82
jb 0x100247d0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x10067690], eax
call fcn.10036545
add esp, 4
push eax
push 0x1005c4cc
push 0x1005c4d0
push 0x10069aec
call fcn.1003645d
push 1
call fcn.10036545
add esp, 0x14
push eax
push 0x1005c4e0
push 0x1005c4e4
push 0x100680d0
call fcn.1003645d
push 2
call fcn.10036545
add esp, 0x14
push eax
push 0x1005c4e0
push 0x1005c4e4
push 0x100698d8
call fcn.1003645d
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.100012a0
add esp, 0x14
push 0
call fcn.10036545
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.10037bfe
add esp, 0xc
test eax, eax
je 0x100249b3
nop dword [eax + eax]
lea ecx, [esp + 0xa0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024900
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x10025ece
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xa8], ax
lea eax, [esp + 0xa8]
push eax
call fcn.10036ebb
add esp, 0xc
mov dword [esp + 0x88], eax
call fcn.10037d00
cmp dword [eax], 0x22
je 0x10025e66
mov eax, dword [esp + 0x88]
test eax, eax
je 0x1002496b
nop dword [eax]
cmp eax, 0x82
jle 0x10024b8e
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movaps xmmword [esp + 0xa4], xmm0
call fcn.100012a0
add esp, 4
push 0
call fcn.10036545
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.10037bfe
add esp, 0xc
test eax, eax
jne 0x100248f0
cmp dword [0x10068314], 0
nop word [eax + eax]
je 0x10025eae
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10025eae
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x23
push 0x1005c560
jmp 0x100241b5
mov dword [esp + 0xc], 0
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f1a0
add esp, 0xc
lea eax, [esp + 0x110]
push dword [esp + 0xc]
push 0x10068318
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push 0x10054c28
lea eax, [esp + 0x12c]
mov dword [esp + 0x58], 0
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.100371b6
add esp, 0x24
test eax, eax
jne 0x10024ddc
push dword [esp + 0x3c]
mov dword [esp + 0xd4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xc4]
movaps xmmword [esp + 0xc4], xmm0
push 0x14
push eax
call fcn.10037bf3
add esp, 0xc
test eax, eax
je 0x10024b46
push dword [esp + 0x3c]
call fcn.10037352
add esp, 4
lea eax, [esp + 0xc0]
push 0xa
push 0
push eax
call fcn.10036e75
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x88]
mov ecx, dword [ecx*4 + 0x10064ae8]
push eax
lea eax, [esp + 0x94]
mov dword [esp + 0x8c], ecx
push eax
call fcn.100267c0
call fcn.10037d00
cmp dword ds:[eax], 0x22
je 0x10024afb
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x82
jb 0x100249f1
jmp 0x10024ddc
cmp dword [0x10068314], 0
je 0x10024b25
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10024b25
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x16
push 0x1005c488
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10068314], 0
je 0x10024b6e
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10024b6e
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x2b
push 0x1005c404
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0xc], ecx
test eax, eax
jle 0x10024cfc
mov edx, str._nAppID:
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012a0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xf0], xmm0
movq qword [esp + 0x100], xmm0
push 0
call fcn.10036545
add esp, 4
push eax
lea eax, [esp + 0xe4]
push 0x14
push eax
call fcn.10037bfe
add esp, 0xc
test eax, eax
je 0x10024d8f
lea ecx, [esp + 0xe0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024c00
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x10025ece
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xe8], ax
lea eax, [esp + 0xe8]
push eax
call fcn.10036ebb
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x90], eax
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x98]
mov ecx, dword [ecx*4 + 0x10064ae8]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x9c], ecx
push eax
call fcn.100267c0
call fcn.10037d00
cmp dword [eax], 0x22
je 0x10024d4b
push 0
push 0x10068318
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.1002f1a0
add esp, 0xc
lea eax, [esp + 0x110]
push dword [esp + 0xc]
push 0x10068318
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push dword [esp + 0xa8]
lea eax, [esp + 0x12c]
push 0x10052a64
push eax
call fcn.10002dc0
mov ecx, dword [esp + 0x30]
add esp, 0x24
inc ecx
mov edx, str._nAppID:
mov dword [esp + 0xc], ecx
cmp ecx, dword [esp + 0x88]
jl 0x10024ba1
cmp dword [0x10067690], 1
jne 0x10024ddc
mov eax, dword [0x10069aec]
test eax, eax
je 0x10024d1b
push eax
call fcn.10037352
add esp, 4
mov eax, dword [0x100680d0]
test eax, eax
je 0x10024d2d
push eax
call fcn.10037352
add esp, 4
mov eax, dword [0x100698d8]
test eax, eax
je 0x10024d3f
push eax
call fcn.10037352
add esp, 4
nop
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x10024ddc
cmp dword [0x10068314], 0
je 0x10024d73
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10024d73
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x16
push 0x1005c6a8
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10068314], 0
je 0x10024dba
mov eax, dword [0x10073f9c]
nop dword [eax]
test eax, eax
je 0x10024dba
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x23
push 0x1005c638
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10073d78
push str.GreenLuma_2024_Dll______s_r_n
call fcn.100025a0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x100741a8], eax
call fcn.100022e0
add esp, 8
call fcn.10028390
cmp dword [0x100743c4], 0
jne 0x10025e16
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100743c4], eax
xor ecx, ecx
mov edx, 0x100743c0
xchg dword [edx], ecx
test eax, eax
je 0x10025e1f
push str.ForzaHorizon4.exe
call edi
push str.ForzaHorizon5.exe
mov dword [esp + 0x8c], eax
call edi
cmp byte [0x10066e5f], 0
mov dword ds:[esp + 0x34], eax
jne 0x10024fa8
cmp byte [0x10067485], 0
jne 0x10024fb4
cmp dword ds:[esp + 0x88], 0
jne 0x10024f8e
test eax, eax
jne 0x10024f8e
lea eax, [esp + 0x90]
mov dword [esp + 0x98], 1
push eax
push 0x100698e0
lea eax, [esp + 0xa0]
mov dword [esp + 0x98], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10024f1b
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.100022e0
add esp, 4
mov ecx, 0x208
mov eax, 0x100698e0
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10024ef0
push 0x10067488
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x100698e0
call fcn.10001320
add esp, 0x14
jmp 0x10024f28
push str.Got_Steamclient_dll_paths_from_registry_r_n
call fcn.100022e0
add esp, 4
push 8
push 0
push 0x100698e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10069ae8], eax
nop dword [eax]
test eax, eax
jne 0x10024fb4
cmp dword [0x10068314], eax
je 0x10024f6f
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10024f6f
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x20
push 0x1005c8e0
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10023820
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10024fb4
push str.steamclient.dll
call edi
mov dword [0x10069ae8], eax
cmp byte [0x10066e5e], 0
nop dword [eax + eax]
jne 0x10025a68
cmp dword [0x10069ae8], 0
je 0x1002520e
push str.Steamclient.dll_is_loaded__r_n
call fcn.100022e0
add esp, 4
push 0x100698e0
push str.Steamclient______s_r_n_r_n
call fcn.100025a0
add esp, 8
push str.steamclient.dll
call edi
test eax, eax
jne 0x10025007
mov dword [esp + 0x3c], 0xb
jmp 0x10025032
push str.CreateInterface
push eax
call esi
test eax, eax
jne 0x1002501d
mov dword [esp + 0x3c], 0xc
jmp 0x10025032
push 0x10069b08
mov edx, 0x10004280
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x3c], eax
push str.steamclient.dll
call edi
test eax, eax
jne 0x10025047
mov dword [esp + 0x18], 0xb
jmp 0x10025072
push str.Steam_BGetCallback
push eax
call esi
test eax, eax
jne 0x1002505d
mov dword [esp + 0x18], 0xc
jmp 0x10025072
push 0x10068d80
mov edx, 0x10004b00
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x18], eax
push str.steamclient.dll
call edi
test eax, eax
jne 0x10025087
mov dword [esp + 0xc], 0xb
jmp 0x100250b2
push str.Steam_FreeLastCallback
push eax
call esi
test eax, eax
jne 0x1002509d
mov dword [esp + 0xc], 0xc
jmp 0x100250b2
push 0x10068950
mov edx, 0x10004cc0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0xc], eax
push str.steamclient.dll
call edi
test eax, eax
jne 0x100250c7
mov dword [esp + 0x14], 0xb
jmp 0x100250f2
push str.Steam_GetAPICallResult
push eax
call esi
test eax, eax
jne 0x100250dd
mov dword [esp + 0x14], 0xc
jmp 0x100250f2
push 0x10067cbc
mov edx, 0x10004d80
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x14], eax
push str.CreateInterface
push dword [0x10069ae8]
call esi
mov edx, 1
mov ecx, eax
call fcn.10028940
push str.Steam_BGetCallback
push dword [0x10069ae8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028940
push str.Steam_FreeLastCallback
push dword [0x10069ae8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028940
push str.Steam_GetAPICallResult
push dword [0x10069ae8]
mov dword ds:[esp + 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10028940
mov ecx, esi
mov dword [esp + 0x98], eax
call fcn.10028a40
mov ecx, dword [esp + 0x3c]
push eax
call fcn.10028a40
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.100022e0
add esp, 0xc
mov ecx, edi
call fcn.10028a40
mov ecx, dword [esp + 0x18]
push eax
call fcn.10028a40
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x9c]
add esp, 0xc
call fcn.10028a40
mov ecx, dword [esp + 0xc]
push eax
call fcn.10028a40
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0xa4]
add esp, 0xc
call fcn.10028a40
mov ecx, dword [esp + 0x14]
push eax
call fcn.10028a40
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.100022e0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
cmp dword [esp + 0x88], 0
jne 0x10025a42
cmp dword [esp + 0x34], 0
jne 0x10025a42
push str.ntdll.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002523f
mov eax, 0xb
jmp 0x10025265
push str.NtCreateUserProcess
push eax
call esi
test eax, eax
jne 0x10025252
mov eax, 0xc
jmp 0x10025265
push 0x10073f8c
mov edx, 0x10003420
mov ecx, eax
call fcn.100284e0
push str.ntdll.dll
mov dword [0x10073f98], eax
call edi
test eax, eax
jne 0x1002527c
mov eax, 0xb
jmp 0x100252a5
push str.NtResumeThread
push eax
call esi
test eax, eax
jne 0x1002528f
mov eax, 0xc
jmp 0x100252a5
push 0x10068958
mov edx, 0x100041a0
mov ecx, eax
call fcn.100284e0
push str.ntdll.dll
mov dword [0x10073f84], eax
call edi
test eax, eax
jne 0x100252bf
mov dword [esp + 0x24], 0xb
jmp 0x100252ea
push str.LdrLoadDll
push eax
call esi
test eax, eax
jne 0x100252d5
mov dword [esp + 0x24], 0xc
jmp 0x100252ea
push 0x100690a8
mov edx, 0x10009180
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x24], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100252ff
mov dword [esp + 0x28], 0xb
jmp 0x1002532a
push str.LdrGetDllHandleEx
push eax
call esi
test eax, eax
jne 0x10025315
mov dword [esp + 0x28], 0xc
jmp 0x1002532a
push 0x10073d74
mov edx, 0x10009200
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x28], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002533f
mov dword [esp + 0x2c], 0xb
jmp 0x1002536a
push str.LdrGetDllFullName
push eax
call esi
test eax, eax
jne 0x10025355
mov dword [esp + 0x2c], 0xc
jmp 0x1002536a
push 0x100680ec
mov edx, 0x10009280
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x2c], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002537f
mov dword [esp + 0x30], 0xb
jmp 0x100253aa
push str.LdrGetDllHandleByMapping
push eax
call esi
test eax, eax
jne 0x10025395
mov dword [esp + 0x30], 0xc
jmp 0x100253aa
push 0x10068b74
mov edx, 0x100092e0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x30], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100253bf
mov dword [esp + 0x34], 0xb
jmp 0x100253ea
push str.LdrGetDllHandleByName
push eax
call esi
test eax, eax
jne 0x100253d5
mov dword [esp + 0x34], 0xc
jmp 0x100253ea
push 0x10068a6c
mov edx, 0x10009360
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x34], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x10025402
mov dword [esp + 0x98], 0xb
jmp 0x10025433
push str.LdrQueryProcessModuleInformation
push eax
call esi
test eax, eax
jne 0x1002541b
mov dword [esp + 0x98], 0xc
jmp 0x10025433
push 0x10073d70
mov edx, 0x100093e0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x98], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002544b
mov dword [esp + 0x90], 0xb
jmp 0x1002547c
push str.LdrEnumerateLoadedModules
push eax
call esi
test eax, eax
jne 0x10025464
mov dword [esp + 0x90], 0xc
jmp 0x1002547c
push 0x100678a4
mov edx, 0x10009520
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x90], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x10025494
mov dword [esp + 0x88], 0xb
jmp 0x100254cc
push str.RtlLockModuleSection
push eax
call esi
nop dword [eax]
test eax, eax
jne 0x100254b1
mov dword [esp + 0x88], 0xc
jmp 0x100254cc
push 0x10068308
mov edx, 0x10009580
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x88], eax
push str.kernel32.dll
call edi
test eax, eax
je 0x100254fd
push str.Module32NextW
push eax
call esi
nop
test eax, eax
je 0x100254fd
push 0x10068960
mov edx, 0x100095a0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x18], eax
test eax, eax
je 0x1002553d
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025512
mov dword [esp + 0x18], 0xb
jmp 0x1002553d
push str.Module32NextW
push eax
call esi
test eax, eax
jne 0x10025528
mov dword [esp + 0x18], 0xc
jmp 0x1002553d
push 0x10068960
mov edx, 0x100095a0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x18], eax
push str.KernelBase.dll
call edi
test eax, eax
je 0x100256d7
push str.EnumProcessModules
push eax
call esi
test eax, eax
je 0x100256d7
push 0x10069b0c
mov edx, 0x10009620
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x100256d7
push str.KernelBase.dll
nop
call edi
test eax, eax
jne 0x10025590
mov dword [esp + 0x10], 0xb
jmp 0x100255bb
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x100255a6
mov dword [esp + 0x10], 0xc
jmp 0x100255bb
push 0x100692bc
mov edx, 0x10009960
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x10], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x100255d0
mov dword [esp + 0x1c], 0xb
jmp 0x100255fb
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x100255e6
mov dword [esp + 0x1c], 0xc
jmp 0x100255fb
push 0x100743bc
mov edx, 0x10009ce0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x1c], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025610
mov dword [esp + 0x20], 0xb
jmp 0x1002563b
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x10025626
mov dword [esp + 0x20], 0xc
jmp 0x1002563b
push 0x100690a0
mov edx, 0x10009da0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x20], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025650
mov dword [esp + 0x14], 0xb
jmp 0x1002567b
push 0x1005cb10
push eax
call esi
test eax, eax
jne 0x10025666
mov dword [esp + 0x14], 0xc
jmp 0x1002567b
push 0x100743b8
mov edx, 0x10009e80
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x14], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10025698
mov dword [esp + 0xc], 0xb
push str.KernelBase.dll
jmp 0x10025860
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x100256b8
mov dword [esp + 0xc], 0xc
push str.KernelBase.dll
jmp 0x10025860
push 0x10067478
mov edx, 0x10009f40
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0xc], eax
push str.KernelBase.dll
jmp 0x10025860
push str.Psapi.dll
call edi
nop
test eax, eax
jne 0x100256ee
mov dword [esp + 0x3c], 0xb
jmp 0x10025719
push str.EnumProcessModules
push eax
call esi
test eax, eax
jne 0x10025704
mov dword [esp + 0x3c], 0xc
jmp 0x10025719
push 0x10069b0c
mov edx, 0x10009620
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x3c], eax
push str.Psapi.dll
nop
call edi
test eax, eax
jne 0x10025730
mov dword [esp + 0x10], 0xb
jmp 0x1002575b
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x10025746
mov dword [esp + 0x10], 0xc
jmp 0x1002575b
push 0x100692bc
mov edx, 0x10009960
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x10], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10025770
mov dword [esp + 0x1c], 0xb
jmp 0x1002579b
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x10025786
mov dword [esp + 0x1c], 0xc
jmp 0x1002579b
push 0x100743bc
mov edx, 0x10009ce0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x1c], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x100257b0
mov dword [esp + 0x20], 0xb
jmp 0x100257db
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x100257c6
mov dword [esp + 0x20], 0xc
jmp 0x100257db
push 0x100690a0
mov edx, 0x10009da0
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x20], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x100257f0
mov dword [esp + 0x14], 0xb
jmp 0x1002581b
push 0x1005cb10
push eax
call esi
test eax, eax
jne 0x10025806
mov dword [esp + 0x14], 0xc
jmp 0x1002581b
push 0x100743b8
mov edx, 0x10009e80
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0x14], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10025830
mov dword [esp + 0xc], 0xb
jmp 0x1002585b
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x10025846
mov dword [esp + 0xc], 0xc
jmp 0x1002585b
push 0x10067478
mov edx, 0x10009f40
mov ecx, eax
call fcn.100284e0
mov dword [esp + 0xc], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x1002586b
lea esi, [eax + 0xb]
jmp 0x1002588f
push str.GetMappedFileNameW
push eax
call esi
test eax, eax
jne 0x1002587c
lea esi, [eax + 0xc]
jmp 0x1002588f
push 0x100680fc
mov edx, 0x1000a020
mov ecx, eax
call fcn.100284e0
mov esi, eax
mov ecx, dword [0x10073f98]
call fcn.10028a40
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [0x10073f84]
add esp, 8
call fcn.10028a40
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x2c]
add esp, 8
call fcn.10028a40
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.100022e0
mov ecx, dword ds:[esp + 0x30]
add esp, 8
call fcn.10028a40
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x34]
add esp, 8
call fcn.10028a40
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x38]
add esp, 8
call fcn.10028a40
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x3c]
add esp, 8
call fcn.10028a40
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.100022e0
mov ecx, dword ds:[esp + 0xa0]
add esp, 8
call fcn.10028a40
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x98]
add esp, 8
call fcn.10028a40
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x90]
add esp, 8
call fcn.10028a40
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10028a40
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x44]
add esp, 8
call fcn.10028a40
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x18]
add esp, 8
call fcn.10028a40
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10028a40
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x28]
add esp, 8
call fcn.10028a40
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10028a40
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.100022e0
mov ecx, dword [esp + 0x14]
add esp, 8
call fcn.10028a40
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.100022e0
add esp, 8
mov ecx, esi
call fcn.10028a40
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.100022e0
add esp, 8
mov edx, 1
xor ecx, ecx
call fcn.10028940
mov ecx, eax
call fcn.10028a40
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.100022e0
add esp, 8
cmp byte [0x10067485], 1
jne 0x10025adc
cmp byte [0x10066e5f], 1
nop dword [eax]
jne 0x10025adc
push dword [0x10069ae8]
call dword [0x100678a0]
mov ecx, dword [0x10069ae8]
push str.xxxxxxxxxxxx
push 0x1005b97c
mov edx, dword [eax + 0x50]
call fcn.10001fc0
add esp, 8
mov dword [0x10068e94], eax
test eax, eax
je 0x10025adc
push 0x100690ac
mov edx, 0x10002ec0
mov dword [0x100690ac], eax
mov ecx, eax
call fcn.100284e0
mov ecx, dword [0x10068e94]
mov edx, 1
call fcn.10028940
cmp byte [0x10066e5e], 1
jne 0x10025bc6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x100680f4], eax
nop dword [eax]
test eax, eax
jne 0x10025b4e
cmp dword [0x10068314], eax
je 0x10025b2f
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10025b2f
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x19
push 0x1005cdfc
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10023200
push 0
push 0
call esi
test eax, eax
je 0x10025b77
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x10025bd2
cmp dword [0x10068314], 0
nop
je 0x10025ba5
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10025ba5
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x19
push 0x1005ce4c
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x10066e5f], 0
jne 0x10025c36
cmp byte [0x10067485], 0
push 0
jne 0x10025c6e
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x10067068
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10025c4c
push 0
lea eax, [esp + 0x8c]
mov dword [esp + 0x8c], 0
push eax
push 1
push 0x1005ce9c
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.1002d566
mov esp, ebp
pop ebp
ret
push 0x10
push str.GreenLuma_2024
push 0x1005cea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x100232c0
push 0
push 0
call esi
nop dword [eax]
test eax, eax
je 0x10025dce
push eax
call edi
push 0
push 0
push 0
push 0x10023660
push 0
push 0
call esi
nop dword [eax]
test eax, eax
je 0x10025d8a
push eax
call edi
xorps xmm0, xmm0
mov dword [esp + 0x40], 0x44
lea eax, [esp + 0x40]
movlpd qword [esp + 0x44], xmm0
push eax
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word ds:[esp + 0x72], 0x10
jb 0x10025c36
mov eax, dword [esp + 0x74]
test eax, eax
je 0x10025c36
lea esi, [eax + 4]
test esi, esi
je 0x10025d1d
mov esi, dword [esi]
jmp 0x10025d30
xor esi, esi
call fcn.10037d00
mov dword [eax], 0x16
call fcn.100375c6
lea eax, [esp + 0x88]
mov dword [esp + 0x88], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, 1
jne 0x10025c36
nop dword [eax]
nop word [eax + eax]
test byte [esp + 0x88], al
je 0x10025c36
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x31c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1002d566
mov esp, ebp
pop ebp
ret
cmp dword [0x10068314], 0
je 0x10025db2
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10025db2
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x19
push 0x1005cf1c
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error_2
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10068314], 0
je 0x10025dfa
mov eax, dword [0x10073f9c]
nop dword [eax]
test eax, eax
je 0x10025dfa
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x17
push 0x1005ced4
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, 0x100743c0
xchg dword [ecx], eax
cmp dword [0x10068314], 0
je 0x10025e47
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10025e47
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x1e
push 0x1005c748
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10068314], 0
je 0x10025e8e
mov eax, dword [0x10073f9c]
test eax, eax
je 0x10025e8e
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0x16
push 0x1005c5d0
jmp 0x100241b5
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002d6a1
int3