Function at 0x10023500
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x738
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x734], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x32c]
push 0
push eax
call fcn.1002e180
add esp, 0xc
mov dword [esp + 0x80], 1
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x208
push eax
lea eax, [esp + 0x32c]
push eax
lea eax, [esp + 0x88]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100235b3
push str.Steam.exe
lea eax, [esp + 0x32c]
push 0x104
push eax
call fcn.100369c1
add esp, 0xc
lea edx, [esp + 0x328]
mov ecx, 0x10067968
call fcn.10001d80
cmp al, 1
jne 0x100235b3
mov byte [0x10066274], al
push 0x5c
push 0x10067968
call fcn.1002de70
add esp, 8
test eax, eax
je 0x100235cb
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x10066278
call fcn.1002de70
add esp, 8
test eax, eax
je 0x100235e3
xor ecx, ecx
mov word [eax], cx
cmp byte [0x10066274], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x10023bc6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x10066ec4
call esi
push 0x1000000
push 0
push 0x100686d4
call esi
push 0x1000000
push 0
push 0x10067310
call esi
push 0x100234c0
call fcn.100365ea
add esp, 4
push 0x100234e0
call fcn.10036da0
add esp, 4
push 0x104
push 0x10067328
push 0x1005aafc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10067b78
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x10023895
nop dword [eax]
test eax, eax
je 0x10023895
push 0x10067328
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10067c80
call fcn.10001320
add esp, 0x14
push 0x10067b78
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10067758
call fcn.100013e0
add esp, 0x14
push 0x10067b78
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10067860
call fcn.100013e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x28]
add esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x9c], 4
mov dword [esp + 0x84], 4
push eax
push 0x20019
push 0
push 0x10067c80
push 0x80000001
call esi
test eax, eax
jne 0x10023758
lea eax, [esp + 0x84]
push eax
push 0x10063ad0
lea eax, [esp + 0xa4]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x20019
push 0
push 0x10067c80
push 0x80000001
mov dword [esp + 0xbc], 4
mov dword [esp + 0xa8], 4
call esi
test eax, eax
jne 0x100237c6
lea eax, [esp + 0x94]
push eax
push 0x10063ad4
lea eax, [esp + 0xb0]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x20019
push 0
push 0x10067c80
push 0x80000001
mov dword [esp + 0x8c], 4
mov dword [esp + 0x90], 4
call esi
nop dword [eax]
test eax, eax
jne 0x10023831
lea eax, [esp + 0x7c]
push eax
push 0x10063ce8
lea eax, [esp + 0x80]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x20019
push 0
push 0x10067c80
push 0x80000001
mov dword [esp + 0x84], 4
mov dword [esp + 0x88], 4
call esi
test eax, eax
jne 0x10023895
lea eax, [esp + 0x74]
push eax
push 0x10066ee8
lea eax, [esp + 0x78]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10067968
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10067530
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067530
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x100238e2
push eax
call esi
mov byte [0x10066484], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002360
add esp, 4
push 0x100682b8
push str.Exe______s_r_n
call fcn.10002620
add esp, 8
cmp byte [0x10066484], 0
jne 0x10023990
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e180
add esp, 0xc
mov dword [esp + 0x68], 1
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], 0x208
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x70]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10023986
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x120]
push eax
jmp 0x10023995
push 0x10067968
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10066060
call fcn.10001320
add esp, 0x14
push 0x10067968
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x10066488
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10066488
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023a0f
push eax
call esi
push 0x10066488
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.10002620
add esp, 8
push 8
push 0
push 0x10066488
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x10066278
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x10067e98
call fcn.10001320
add esp, 0x14
push 0x10067328
push 0x10066278
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10066ab0
call fcn.10001320
push 0x10067328
push 0x10066278
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10068908
call fcn.10001320
push 0x10066278
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x10072d90
call fcn.10001320
add esp, 0x44
push 0x10066278
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x100668a0
call fcn.10001320
add esp, 0x14
push 0x10066278
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10066cb8
call fcn.10001320
add esp, 0x14
push 0x10066278
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10066698
call fcn.10001320
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x14
push str.DenuvoActivationBypass.dll
call esi
mov dword [0x10072b64], eax
mov ecx, eax
test eax, eax
jne 0x10023b12
push str.DenuvoOfflineActivationBypass.dll
call esi
mov dword [0x10072b64], eax
mov ecx, eax
test ecx, ecx
je 0x10024313
push str.GetDenuvoCallResult
push eax
call edi
push str.GetDenuvoID
push dword [0x10072b64]
mov dword [0x100686f4], eax
call edi
push str.RequestDenuvoAppTicket
push dword [0x10072b64]
mov dword [0x10067c7c], eax
call edi
push str.GetDenuvoAppTicket
push dword [0x10072b64]
mov dword [0x100686f8], eax
call edi
push str.ShutdownDenuvoDll
push dword [0x10072b64]
mov dword [0x10067748], eax
call edi
cmp dword [0x100686f4], 0
mov dword [0x10066270], eax
je 0x10023ba5
cmp dword [0x10067c7c], 0
nop
je 0x10023ba5
cmp dword [0x100686f8], 0
je 0x10023ba5
cmp dword [0x10067748], 0
je 0x10023ba5
test eax, eax
je 0x10023ba5
mov byte [0x10066486], 1
nop
jmp 0x10024313
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10065e56], 1
jne 0x10023be5
mov byte [0x10065e55], 1
mov byte [0x10065e57], 1
nop dword [eax]
jmp 0x10023cff
push 0x10066278
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x10068b10
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068b10
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023c50
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10068b10
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10065e55], 1
mov byte [0x10065e57], 1
jmp 0x10023cff
push 0x1000000
push 0
push 0x10066ec4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x10066278
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10066060
call fcn.10001320
add esp, 0x14
push 0x10066278
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10066cb8
call fcn.10001320
add esp, 0x14
push 0x10066278
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10066698
call fcn.10001320
add esp, 0x14
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002360
add esp, 4
push 0x100682b8
push str.Exe______s_r_n
call fcn.10002620
push 0x100234c0
call fcn.100365ea
add esp, 0xc
push 0x100234e0
call fcn.10036da0
add esp, 4
push 0x10066278
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10067108
call fcn.10001320
add esp, 0x14
push 0x10066278
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10066ef0
call fcn.10001320
add esp, 0x14
push 0x10066278
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10068700
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068700
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023d91
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10068700
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10065e57], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10066ef0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10023e4e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10065e57], 1
je 0x10023fef
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop dword [eax]
sub eax, 6
je 0x10023fef
sub eax, 1
jne 0x10023e4e
xor esi, esi
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e180
add esp, 0xc
lea eax, [esp + 0x120]
push esi
push 0x10067108
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
add esp, 0x18
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x84
jb 0x10023df0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x10066480], eax
call fcn.10035525
add esp, 4
push eax
push 0x1005b12c
push 0x1005b130
push 0x100686d0
call fcn.1003543d
push 1
call fcn.10035525
add esp, 0x14
push eax
push 0x1005b140
push 0x1005b144
push 0x10066ec0
call fcn.1003543d
push 2
call fcn.10035525
add esp, 0x14
push eax
push 0x1005b140
push 0x1005b144
push 0x100682b4
call fcn.1003543d
xorps xmm0, xmm0
mov dword [esp + 0xd0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_132_:
movaps xmmword [esp + 0xc4], xmm0
call fcn.100012a0
add esp, 0x14
push 0
call fcn.10035525
add esp, 4
push eax
lea eax, [esp + 0xb4]
push 0xa
push eax
call fcn.10036bde
add esp, 0xc
test eax, eax
je 0x10023fd3
nop dword [eax + eax]
lea ecx, [esp + 0xb0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023f20
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x1002524e
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xb8], ax
lea eax, [esp + 0xb8]
push eax
call fcn.10035e9b
add esp, 0xc
mov dword [esp + 0x84], eax
call fcn.10036ce0
cmp dword [eax], 0x22
je 0x10025230
mov eax, dword [esp + 0x84]
test eax, eax
je 0x10023f8b
nop dword [eax]
cmp eax, 0x84
jle 0x1002414e
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_132_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.100012a0
add esp, 4
push 0
call fcn.10035525
add esp, 4
push eax
lea eax, [esp + 0xb4]
push 0xa
push eax
call fcn.10036bde
add esp, 0xc
test eax, eax
jne 0x10023f10
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0
nop word [eax + eax]
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e180
add esp, 0xc
lea eax, [esp + 0x120]
push dword [esp + 0x10]
push 0x10067108
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push 0x10053a68
lea eax, [esp + 0x13c]
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x34]
push eax
call fcn.10036196
add esp, 0x24
test eax, eax
jne 0x10024313
push dword [esp + 0x14]
mov dword [esp + 0xe4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xd4]
movaps xmmword [esp + 0xd4], xmm0
push 0x14
push eax
call fcn.10036bd3
add esp, 0xc
test eax, eax
je 0x1002412e
push dword ds:[esp + 0x14]
call fcn.10036332
add esp, 4
lea eax, [esp + 0xd0]
push 0xa
push 0
push eax
call fcn.10035e55
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov ecx, dword [ecx*4 + 0x10063ad8]
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0x88], ecx
push eax
call fcn.10025960
call fcn.10036ce0
cmp dword [eax], 0x22
je 0x10024110
mov eax, dword ds:[esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x84
jb 0x10024000
jmp 0x10024313
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0x10], ecx
test eax, eax
jle 0x100242cd
mov edx, str._nAppID:
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012a0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0x100], xmm0
movq qword [esp + 0x110], xmm0
push 0
call fcn.10035525
add esp, 4
push eax
lea eax, [esp + 0xf4]
push 0x14
push eax
call fcn.10036bde
add esp, 0xc
test eax, eax
je 0x1002443b
lea ecx, [esp + 0xf0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100241c0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x1002524e
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xf8], ax
lea eax, [esp + 0xf8]
push eax
call fcn.10035e9b
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x9c], eax
mov dword [esp + 0x98], eax
lea eax, [esp + 0x94]
mov ecx, dword [ecx*4 + 0x10063ad8]
push eax
lea eax, [esp + 0xac]
mov dword [esp + 0x98], ecx
push eax
call fcn.10025960
call fcn.10036ce0
cmp dword [eax], 0x22
je 0x1002441f
push 0
push 0x10067108
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x534]
push 0
push eax
call fcn.1002e180
add esp, 0xc
lea eax, [esp + 0x530]
push dword [esp + 0x10]
push 0x10067108
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push dword ds:[esp + 0xb4]
lea eax, [esp + 0x54c]
push 0x1005b2e0
push eax
call fcn.10002e60
mov ecx, dword ds:[esp + 0x34]
add esp, 0x24
inc ecx
mov edx, str._nAppID:
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x84]
jl 0x10024161
cmp dword [0x10066480], 1
jne 0x10024313
mov eax, dword [0x100686d0]
test eax, eax
je 0x100242e8
push eax
call fcn.10036332
add esp, 4
mov eax, dword [0x10066ec0]
test eax, eax
je 0x100242fa
push eax
call fcn.10036332
add esp, 4
mov eax, dword [0x100682b4]
nop
test eax, eax
je 0x1002430d
push eax
call fcn.10036332
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x10072958
push str.GreenLuma_2024_Dll______s_r_n
nop dword [eax]
call fcn.10002620
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x10072d88], eax
call fcn.10002360
add esp, 8
call fcn.10027510
cmp dword [0x10072fa0], 0
jne 0x1002520b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10072fa0], eax
xor ecx, ecx
mov edx, 0x10072f9c
xchg dword [edx], ecx
test eax, eax
je 0x10025214
cmp byte [0x10065e56], 0
nop dword [eax]
jne 0x100244a6
cmp byte [0x10066274], 0
jne 0x1002449f
lea eax, [esp + 0xa4]
mov dword [esp + 0x8c], 1
push eax
push 0x100684c8
lea eax, [esp + 0x94]
mov dword [esp + 0xac], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10024457
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.10002360
add esp, 4
mov ecx, 0x208
mov eax, 0x100684c8
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100243f4
push 0x10066278
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x100684c8
call fcn.10001320
add esp, 0x14
jmp 0x10024468
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Got_Steamclient_dll_paths_from_registry_r_n
nop dword [eax]
call fcn.10002360
add esp, 4
push 8
push 0
push 0x100684c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x100684c4], eax
nop dword [eax]
test eax, eax
jne 0x100244b2
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100684c4]
jmp 0x100244b2
push str.steamclient.dll
call esi
mov dword [0x100684c4], eax
cmp byte [0x10065e55], 0
jne 0x10024f7c
nop
test eax, eax
je 0x10024703
push str.Steamclient.dll_is_loaded__r_n
call fcn.10002360
add esp, 4
push 0x100684c8
push str.Steamclient______s_r_n_r_n
call fcn.10002620
add esp, 8
push str.steamclient.dll
call esi
test eax, eax
jne 0x100244fd
mov dword [esp + 0x14], 0xb
jmp 0x10024529
push str.CreateInterface
push eax
call edi
test eax, eax
jne 0x10024513
mov dword [esp + 0x14], 0xc
jmp 0x10024529
push 0x100686ec
mov edx, 0x10004080
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x14], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002453e
mov dword [esp + 0x1c], 0xb
jmp 0x10024569
push str.Steam_BGetCallback
push eax
call edi
test eax, eax
jne 0x10024554
mov dword [esp + 0x1c], 0xc
jmp 0x10024569
push 0x10067964
mov edx, 0x10004900
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x1c], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002457e
mov dword [esp + 0x10], 0xb
jmp 0x100245a9
push str.Steam_FreeLastCallback
push eax
call edi
test eax, eax
jne 0x10024594
mov dword [esp + 0x10], 0xc
jmp 0x100245a9
push 0x1006773c
mov edx, 0x10004ac0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x10], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x100245be
mov dword [esp + 0x18], 0xb
jmp 0x100245e9
push str.Steam_GetAPICallResult
push eax
call edi
test eax, eax
jne 0x100245d4
mov dword [esp + 0x18], 0xc
jmp 0x100245e9
push 0x10066aac
mov edx, 0x10004b80
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x18], eax
push str.CreateInterface
push dword [0x100684c4]
call edi
mov edx, 1
mov ecx, eax
call fcn.10027aa0
push str.Steam_BGetCallback
push dword [0x100684c4]
mov esi, eax
call edi
mov edx, 1
mov ecx, eax
call fcn.10027aa0
push str.Steam_FreeLastCallback
push dword [0x100684c4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10027aa0
push str.Steam_GetAPICallResult
push dword [0x100684c4]
mov dword [esp + 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10027aa0
mov ecx, esi
mov dword [esp + 0xa4], eax
call fcn.10027ba0
mov ecx, dword ds:[esp + 0x14]
push eax
call fcn.10027ba0
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.10002360
add esp, 0xc
mov ecx, edi
call fcn.10027ba0
mov ecx, dword ds:[esp + 0x1c]
push eax
call fcn.10027ba0
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x98]
add esp, 0xc
call fcn.10027ba0
mov ecx, dword [esp + 0x10]
push eax
call fcn.10027ba0
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.10002360
mov ecx, dword ds:[esp + 0xb0]
add esp, 0xc
call fcn.10027ba0
mov ecx, dword [esp + 0x18]
push eax
call fcn.10027ba0
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.10002360
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call esi
test eax, eax
jne 0x1002471b
mov eax, 0xb
jmp 0x1002473f
push str.NtCreateUserProcess
push eax
call edi
test eax, eax
jne 0x1002472e
mov eax, 0xc
jmp 0x1002473f
push 0x10072b70
mov edx, 0x100032e0
mov ecx, eax
call fcn.10027660
push str.ntdll.dll
mov dword [0x10072b7c], eax
call esi
test eax, eax
jne 0x10024756
mov eax, 0xb
jmp 0x1002477c
push str.NtResumeThread
push eax
call edi
nop
test eax, eax
jne 0x1002476b
mov eax, 0xc
jmp 0x1002477c
push 0x10067744
mov edx, 0x10003fa0
mov ecx, eax
call fcn.10027660
push str.ntdll.dll
mov dword [0x10072b68], eax
call esi
test eax, eax
jne 0x10024796
mov dword [esp + 0x74], 0xb
jmp 0x100247c3
push str.LdrLoadDll
push eax
call edi
nop
test eax, eax
jne 0x100247ae
mov dword [esp + 0x74], 0xc
jmp 0x100247c3
push 0x10067e94
mov edx, 0x10008f80
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x74], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x100247d8
mov dword [esp + 0x78], 0xb
jmp 0x10024809
push str.LdrGetDllHandleEx
push eax
call edi
test eax, eax
jne 0x100247f0
mov dword [esp + 0x78], 0xc
jmp 0x10024809
push 0x10072b60
mov edx, 0x10009000
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x78], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x1002481e
mov dword [esp + 0x7c], 0xb
jmp 0x10024849
push str.LdrGetDllFullName
push eax
call edi
test eax, eax
jne 0x10024834
mov dword [esp + 0x7c], 0xc
jmp 0x10024849
push 0x10066edc
mov edx, 0x10009080
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x7c], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024862
mov dword ds:[esp + 0xa8], 0xb
jmp 0x10024893
push str.LdrGetDllHandleByMapping
push eax
call edi
test eax, eax
jne 0x1002487b
mov dword [esp + 0xa8], 0xc
jmp 0x10024893
push 0x1006785c
mov edx, 0x100090e0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0xa8], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x100248ab
mov dword [esp + 0x94], 0xb
jmp 0x100248dc
push str.LdrGetDllHandleByName
push eax
call edi
test eax, eax
jne 0x100248c4
mov dword [esp + 0x94], 0xc
jmp 0x100248dc
push 0x10067754
mov edx, 0x10009160
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x94], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x100248f4
mov dword [esp + 0x9c], 0xb
jmp 0x1002492c
push str.LdrQueryProcessModuleInformation
push eax
call edi
nop dword [eax]
test eax, eax
jne 0x10024911
mov dword [esp + 0x9c], 0xc
jmp 0x1002492c
push 0x100686fc
mov edx, 0x100091e0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x9c], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024944
mov dword [esp + 0x80], 0xb
jmp 0x10024975
push str.LdrEnumerateLoadedModules
push eax
call edi
test eax, eax
jne 0x1002495d
mov dword [esp + 0x80], 0xc
jmp 0x10024975
push 0x10066694
mov edx, 0x10009320
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x80], eax
push str.ntdll.dll
call esi
nop dword [eax]
test eax, eax
jne 0x10024991
mov dword [esp + 0x84], 0xb
jmp 0x100249c2
push str.RtlLockModuleSection
push eax
call edi
test eax, eax
jne 0x100249aa
mov dword [esp + 0x84], 0xc
jmp 0x100249c2
push 0x100670f8
mov edx, 0x10009380
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x84], eax
push str.kernel32.dll
call esi
test eax, eax
je 0x100249f6
push str.Module32NextW
push eax
call edi
test eax, eax
je 0x100249f6
push 0x1006774c
mov edx, 0x100093a0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10024a39
push str.KernelBase.dll
call esi
nop dword [eax]
test eax, eax
jne 0x10024a0e
mov dword [esp + 0x1c], 0xb
jmp 0x10024a39
push str.Module32NextW
push eax
call edi
test eax, eax
jne 0x10024a24
mov dword [esp + 0x1c], 0xc
jmp 0x10024a39
push 0x1006774c
mov edx, 0x100093a0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x1c], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
je 0x10024bd7
push str.EnumProcessModules
push eax
call edi
test eax, eax
je 0x10024bd7
push 0x100686f0
mov edx, 0x10009420
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10024bd7
push str.KernelBase.dll
call esi
nop
test eax, eax
jne 0x10024a8e
mov dword [esp + 0x68], 0xb
jmp 0x10024ab9
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x10024aa4
mov dword [esp + 0x68], 0xc
jmp 0x10024ab9
push 0x100682b0
mov edx, 0x10009760
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x68], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
jne 0x10024ad0
mov dword [esp + 0x6c], 0xb
jmp 0x10024afb
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x10024ae6
mov dword [esp + 0x6c], 0xc
jmp 0x10024afb
push 0x10072f98
mov edx, 0x10009ae0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x6c], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024b10
mov dword [esp + 0x70], 0xb
jmp 0x10024b3b
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x10024b26
mov dword [esp + 0x70], 0xc
jmp 0x10024b3b
push 0x10067e8c
mov edx, 0x10009ba0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x70], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024b50
mov dword [esp + 0x18], 0xb
jmp 0x10024b7b
push 0x1005b670
push eax
call edi
test eax, eax
jne 0x10024b66
mov dword [esp + 0x18], 0xc
jmp 0x10024b7b
push 0x10072d8c
mov edx, 0x10009c80
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x18], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024b98
mov dword [esp + 0x10], 0xb
push str.KernelBase.dll
jmp 0x10024d60
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x10024bb8
mov dword [esp + 0x10], 0xc
push str.KernelBase.dll
jmp 0x10024d60
push 0x10066268
mov edx, 0x10009d40
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x10], eax
push str.KernelBase.dll
jmp 0x10024d60
push str.Psapi.dll
call esi
nop
test eax, eax
jne 0x10024bee
mov dword [esp + 0x14], 0xb
jmp 0x10024c19
push str.EnumProcessModules
push eax
call edi
test eax, eax
jne 0x10024c04
mov dword [esp + 0x14], 0xc
jmp 0x10024c19
push 0x100686f0
mov edx, 0x10009420
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x14], eax
push str.Psapi.dll
nop
call esi
test eax, eax
jne 0x10024c30
mov dword [esp + 0x68], 0xb
jmp 0x10024c5b
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x10024c46
mov dword [esp + 0x68], 0xc
jmp 0x10024c5b
push 0x100682b0
mov edx, 0x10009760
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x68], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024c70
mov dword [esp + 0x6c], 0xb
jmp 0x10024c9b
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x10024c86
mov dword [esp + 0x6c], 0xc
jmp 0x10024c9b
push 0x10072f98
mov edx, 0x10009ae0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x6c], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024cb0
mov dword [esp + 0x70], 0xb
jmp 0x10024cdb
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x10024cc6
mov dword [esp + 0x70], 0xc
jmp 0x10024cdb
push 0x10067e8c
mov edx, 0x10009ba0
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x70], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10024cf0
mov dword [esp + 0x18], 0xb
jmp 0x10024d1b
push 0x1005b670
push eax
call edi
test eax, eax
jne 0x10024d06
mov dword [esp + 0x18], 0xc
jmp 0x10024d1b
push 0x10072d8c
mov edx, 0x10009c80
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x18], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024d30
mov dword [esp + 0x10], 0xb
jmp 0x10024d5b
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x10024d46
mov dword [esp + 0x10], 0xc
jmp 0x10024d5b
push 0x10066268
mov edx, 0x10009d40
mov ecx, eax
call fcn.10027660
mov dword [esp + 0x10], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10024d6b
lea edi, [eax + 0xb]
jmp 0x10024d8f
push str.GetMappedFileNameW
push eax
call edi
test eax, eax
jne 0x10024d7c
lea edi, [eax + 0xc]
jmp 0x10024d8f
push 0x10066eec
mov edx, 0x10009e20
mov ecx, eax
call fcn.10027660
mov edi, eax
mov edx, 1
xor ecx, ecx
call fcn.10027aa0
mov ecx, dword [0x10072b7c]
mov esi, eax
call fcn.10027ba0
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.10002360
mov ecx, dword [0x10072b68]
add esp, 8
call fcn.10027ba0
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x7c]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x80]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x84]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0xb0]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x9c]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.10002360
mov ecx, dword ds:[esp + 0xa4]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x88]
add esp, 8
call fcn.10027ba0
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x8c]
add esp, 8
call fcn.10027ba0
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10027ba0
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10027ba0
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x70]
add esp, 8
call fcn.10027ba0
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x74]
add esp, 8
call fcn.10027ba0
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x78]
add esp, 8
call fcn.10027ba0
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10027ba0
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.10002360
mov ecx, dword [esp + 0x18]
add esp, 8
call fcn.10027ba0
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.10002360
add esp, 8
mov ecx, edi
call fcn.10027ba0
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.10002360
add esp, 8
mov ecx, esi
call fcn.10027ba0
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.10002360
mov eax, dword [0x100684c4]
add esp, 8
cmp byte [0x10066274], 1
jne 0x10024fee
cmp byte [0x10065e56], 1
jne 0x10024fee
push eax
call dword [0x10066690]
mov ecx, dword [0x100684c4]
push str.xxxxxxxxxxxx
push 0x1005a7f0
mov edx, dword [eax + 0x50]
call fcn.10001fc0
add esp, 8
mov dword [0x10067e88], eax
test eax, eax
je 0x10024fee
push 0x100680a0
mov edx, 0x10002f40
mov dword [0x100680a0], eax
mov ecx, eax
call fcn.10027660
mov ecx, dword [0x10067e88]
mov edx, 1
call fcn.10027aa0
cmp byte [0x10065e55], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [eax + eax]
jne 0x10025058
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10066ee4], eax
test eax, eax
jne 0x10025038
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10023020
push 0
push 0
call edi
test eax, eax
je 0x100250e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [0x10065e56], 0
jne 0x100251f5
cmp byte [0x10066274], 0
push 0
jne 0x1002511d
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x10066060
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10025105
push 0
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push 1
push 0x1005b9c4
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x734]
xor ecx, esp
call fcn.1002c6a1
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call esi
nop
jmp 0x1002505e
push 0x10
push str.GreenLuma_2024
push 0x1005b9c8
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x10023100
push 0
push 0
call edi
test eax, eax
je 0x10025139
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10025149
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error
push 0
call esi
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x44
lea eax, [esp + 0x20]
movlpd qword [esp + 0x24], xmm0
push eax
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [esp + 0x52], 8
jb 0x100251f5
mov eax, dword ds:[esp + 0x54]
test eax, eax
je 0x100251f5
lea esi, [eax + 4]
test esi, esi
je 0x100251b3
mov esi, dword [esi]
jmp 0x100251c5
xor esi, esi
call fcn.10036ce0
mov dword [eax], 0x16
call fcn.100365a6
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
nop
cmp eax, 1
jne 0x100251f5
test byte [esp + 0x90], al
je 0x100251f5
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x73c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002c6a1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x10072f9c
xchg dword [ecx], eax
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002c7db
int3