Function at 0x10012640
Capabilities:
Check os version
Create thread
Query or enumerate registry value
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100434de
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
push esi
push edi
mov eax, dword [0x10055080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x1001311a
call sym.Codex.dll_RunPS17
cmp dword [0x1005aa58], 1
jne 0x100127c6
push str.USER32.DLL
mov dword [ebp - 0x2c], vtable.CSplash.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], str.SPLASH
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10
push 0
push 0
push 0
push str..GameGuard_Protect.bmp
push 0
mov dword [0x1005a9d4], eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100126e5
push eax
call esi
mov dword [ebp - 0x18], 0
test edi, edi
je 0x1001272c
lea eax, [ebp - 0x108]
mov dword [ebp - 0x18], edi
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x1001271a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10012711
push eax
call esi
mov dword [ebp - 0x18], 0
jmp 0x1001272c
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x808080
test eax, eax
je 0x1001276d
cmp dword [0x1005a9d4], 0
je 0x1001276d
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [0x1005a9d4]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10017c70
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100127ae
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], vtable.CSplash.0
test eax, eax
je 0x100127c6
push eax
call esi
cmp dword [0x1005aabc], 0
jne 0x100127d8
cmp dword [0x1005aac4], 1
jne 0x1001284c
cmp dword [0x1005b800], 0xb7
jne 0x1001284c
push str.GlobalG4ATBCE5_7348_450a_B2YC_CVL5XBF12X3D_SecondInstance
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
je 0x10012845
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10012845
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1005aaa8]
push 0x200030
push dword [0x1005aa24]
sub eax, 1
je 0x10012830
sub eax, 1
jne 0x10012830
push str.HT_SCAN_n_nO_Sistema_Anti_kill_permite_apenas_duas_instancias_de_jogo_abertas_
jmp 0x10012835
push str.HT_SCAN_n_nJust_two_game_instances_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x1005aa9c], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
jne 0x100128be
call esi
cmp al, 6
jae 0x1001286d
mov dword [0x1005a9c0], 1
jmp 0x100128be
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100128be
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100128b9
mov dword [0x1005a9b8], 1
jmp 0x100128be
call fcn.10006ee0
cmp dword [0x1005aac8], 1
jne 0x10012a09
sub esp, 8
lea ecx, [ebp - 0xf0]
push 1
push dword [0x1005a9e0]
call fcn.10006ff0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xe4], 6
je 0x1001298e
call esi
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
sbb eax, eax
and eax, ecx
cmp eax, 0x1770
jae 0x10012927
mov dword [0x1005a9c0], 1
call fcn.10006b00
jmp 0x1001292c
call fcn.10006ee0
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.10002fe0
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf4], eax
mov dword [ebp - 4], 2
jmp 0x100129ef
mov dword [ebp + eax - 0xf0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov dword [0x1005a9bc], 1
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.10002fe0
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf4], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], vtable.std::ios_base.0
push eax
call fcn.1001a02b
mov dword [ebp - 4], 0xffffffff
add esp, 4
cmp dword [0x1005aa68], 1
jne 0x10012a23
push 0
push 0
push 0x10016220
call fcn.100271b9
add esp, 0xc
cmp dword [0x1005aabc], 1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10012ab0
mov edx, str.GameGuard_Protection___called.
mov ecx, 0x10059cc8
call fcn.10004540
push eax
call fcn.10008480
add esp, 4
push 0
push 0
push 0
push 0x100095f0
push 0
push 0
call edi
test eax, eax
je 0x10012a68
push eax
call esi
push 0
push 0
push 0
push 0x10008da0
push 0
push 0
call edi
test eax, eax
je 0x10012a80
push eax
call esi
push 0
push 0
push 0
push 0x100090d0
push 0
push 0
call edi
test eax, eax
je 0x10012a98
push eax
call esi
push 0
push 0
push 0
push 0x100094f0
push 0
push 0
call edi
test eax, eax
je 0x10012ab0
push eax
call esi
cmp dword [0x1005aac4], 0
je 0x10012b4f
call fcn.10008360
cmp dword [0x1005aac8], 1
jne 0x10012ad4
cmp dword [0x1005a9bc], 0
je 0x10012b4f
cmp dword [0x1005aa9c], 1
jne 0x10012aef
cmp dword [0x1005a9c0], 0
jne 0x10012aef
cmp dword [0x1005a9b8], 0
je 0x10012b4f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 0
push eax
push 8
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10012b3b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x14
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ecx, ecx
test eax, eax
cmovne ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10012b45
push eax
call esi
cmp dword [ebp - 0x10], 1
je 0x10013132
cmp dword [0x1005aad0], 1
je 0x10013137
cmp dword [0x1005aad4], 1
je 0x1001313c
cmp dword [0x1005ab08], 1
jne 0x10012b83
push 0
push 0
push 0
push 0x100199d0
push 0
push 0
call edi
cmp dword [0x1005aab4], 1
jne 0x10012b9d
push 0
push 0
push 0
push 0x1000c850
push 0
push 0
call edi
cmp dword [0x1005aafc], 1
jne 0x10012bd8
push 0x1004ddc0
call fcn.10026829
push 0x1004ddc4
call fcn.10026829
push 0x1004db90
call fcn.10026829
add esp, 0xc
push 0
push 0
push 0
push 0x10011230
push 0
push 0
call edi
cmp dword [0x1005aaf4], 1
jne 0x10012bfb
cmp dword [0x1005aa64], 0
jne 0x10012bfb
push 0
push 0
push 0
push 0x1000da80
push 0
push 0
call edi
cmp dword [0x1005aa44], 1
jne 0x10012e63
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON_
mov ecx, 0x10059cc8
call fcn.10004540
push eax
call fcn.10008480
mov edx, str.All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov ecx, 0x10059cc8
call fcn.10004540
push eax
call fcn.10008480
add esp, 8
cmp dword [0x1005aaa4], 1
jne 0x10012d20
sub esp, 8
lea ecx, [ebp - 0xe8]
push 8
push str.GameGuard_Log.txt
call fcn.10003390
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xe8]
call fcn.10004540
lea ecx, [ebp - 0xe4]
call fcn.10003c30
test eax, eax
jne 0x10012ca6
mov eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0xe8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001dd0
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xec], eax
lea ecx, [ebp - 0xe4]
call fcn.10002fe0
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xec], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 6
push eax
mov dword [ebp - 0x80], vtable.std::ios_base.0
call fcn.1001a02b
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1005aab4], 1
jne 0x10012ff7
lea eax, [ebp - 0x38]
push eax
call fcn.10020619
lea eax, [ebp - 0x38]
push eax
call fcn.10020913
push 8
push 0x1004c6a8
lea ecx, [ebp - 0x1b8]
mov esi, eax
call fcn.10003390
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x1b8]
call fcn.10004540
push esi
call fcn.1001f646
add esp, 4
lea ecx, [ebp - 0x1b8]
mov edx, eax
call fcn.10004540
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
lea ecx, [ebp - 0x1b8]
call fcn.10004540
mov edx, str._n__________________
lea ecx, [ebp - 0x1b8]
call fcn.10004540
lea ecx, [ebp - 0x1b4]
call fcn.10003c30
test eax, eax
jne 0x10012dd8
mov eax, dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1b8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001dd0
push 2
push 0x1004c6a8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1bc], eax
lea ecx, [ebp - 0x1b4]
call fcn.10002fe0
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1bc], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 4], 8
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1001a02b
add esp, 4
jmp 0x10012ff7
cmp dword [0x1005aa54], 1
jne 0x10012e7d
push 0
push 0
push 0
push 0x10014510
push 0
push 0
call edi
cmp dword [0x1005aaa0], 1
jne 0x10012e97
push 0
push 0
push 0
push 0x10011dd0
push 0
push 0
call edi
cmp dword [0x1005aaf0], 1
jne 0x10012eb1
push 0
push 0
push 0
push 0x10012240
push 0
push 0
call edi
cmp dword [0x1005aa5c], 1
jne 0x10012ecb
push 0
push 0
push 0
push 0x10019110
push 0
push 0
call edi
cmp dword [0x1005aad8], 1
jne 0x10012ee5
push 0
push 0
push 0
push 0x10017ac0
push 0
push 0
call edi
cmp dword [0x1005aa60], 1
jne 0x10012eff
push 0
push 0
push 0
push 0x1000d5b0
push 0
push 0
call edi
cmp dword [0x1005aae4], 1
jne 0x10012f19
push 0
push 0
push 0
push 0x10016920
push 0
push 0
call edi
cmp dword [0x1005aadc], 1
jne 0x10012f33
push 0
push 0
push 0
push 0x1000f0c0
push 0
push 0
call edi
cmp dword [0x1005aae0], 1
jne 0x10012f4d
push 0
push 0
push 0
push 0x10006410
push 0
push 0
call edi
cmp dword [0x1005aae8], 1
jne 0x10012f67
push 0
push 0
push 0
push 0x100023e0
push 0
push 0
call edi
cmp dword [0x1005aa98], 1
jne 0x10012f75
call fcn.10016e90
cmp dword [0x1005aab0], 1
jne 0x10012f8f
push 0
push 0
push 0
push 0x100186c0
push 0
push 0
call edi
cmp dword [0x1005aa8c], 1
jne 0x10012fa9
push 0
push 0
push 0
push 0x10018210
push 0
push 0
call edi
cmp dword [0x1005aaf8], 1
jne 0x10012fc3
push 0
push 0
push 0
push 0x10018b80
push 0
push 0
call edi
cmp dword [0x1005aaec], 1
jne 0x10012fdd
push 0
push 0
push 0
push 0x100067e0
push 0
push 0
call edi
cmp dword [0x1005aaac], 1
jne 0x10012ff7
push 0
push 0
push 0
push 0x1000f480
push 0
push 0
call edi
cmp dword [0x1005aa4c], 1
jne 0x1001307c
mov eax, 0x7dbe6ac
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, eax
mov eax, dword [0x1005aa34]
movups xmm0, xmmword [eax]
mov eax, 0x69216c
mov edx, eax
movups xmmword [ecx], xmm0
mov ecx, dword [0x1005aa38]
mov dword [eax], 0
mov byte [eax + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
movzx eax, byte [ecx + 4]
xor ecx, ecx
mov byte [edx + 4], al
mov eax, 0x7dbe6c0
mov edx, eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
mov ecx, dword [0x1005aa3c]
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ax, word [ecx + 0xc]
mov word [edx + 0xc], ax
movzx eax, byte [ecx + 0xe]
mov byte [edx + 0xe], al
cmp dword [0x1005aa50], 1
jne 0x10013096
push 0
push 0
push 0
push 0x10019900
push 0
push 0
call edi
cmp dword [0x1005ab00], 1
jne 0x100130bf
mov eax, 0x693ff1
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, eax
mov eax, dword [str.Player]
mov dword [ecx], eax
mov ax, word [0x1004d814]
mov word [ecx + 4], ax
cmp dword [0x1005aa64], 1
jne 0x100130f3
cmp dword [0x1005aa44], 0
jne 0x100130f3
push 0
push 0
push 0
push 0x100193a0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10019690
push 0
push 0
call edi
cmp dword [0x1005aa94], 1
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x1001310a
push dword [0x1005aa1c]
call esi
cmp dword [0x1005aa90], 1
jne 0x1001311a
push str.Glow.dll
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.10006830
call fcn.10013150
call fcn.100132a0
int3