Function at 0x10023120
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x738
mov eax, dword [0x10064040]
xor eax, esp
mov dword [esp + 0x734], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x32c]
push 0
push eax
call fcn.1002e5e0
add esp, 0xc
mov dword [esp + 0x80], 1
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x208
push eax
lea eax, [esp + 0x32c]
push eax
lea eax, [esp + 0x88]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100231d3
push str.Steam.exe
lea eax, [esp + 0x32c]
push 0x104
push eax
call fcn.10036e21
add esp, 0xc
lea edx, [esp + 0x328]
mov ecx, 0x100689a0
call fcn.10008ce0
cmp al, 1
jne 0x100231d3
mov byte [0x100672b4], al
push 0x5c
push 0x100689a0
call fcn.1002e2d0
add esp, 8
test eax, eax
je 0x100231eb
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x100672b8
call fcn.1002e2d0
add esp, 8
test eax, eax
je 0x10023203
xor ecx, ecx
mov word [eax], cx
cmp byte [0x100672b4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x100237e6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x10067f04
call esi
push 0x1000000
push 0
push 0x10069710
call esi
push 0x1000000
push 0
push 0x10068348
call esi
push 0x100230c0
call fcn.10036a4a
add esp, 4
push 0x100230e0
call fcn.10037200
add esp, 4
push 0x104
push 0x10068360
push 0x1005b884
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10068bb0
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x100234b5
nop dword [eax]
test eax, eax
je 0x100234b5
push 0x10068360
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10068cc0
call fcn.10001320
add esp, 0x14
push 0x10068bb0
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10068790
call fcn.100013e0
add esp, 0x14
push 0x10068bb0
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10068898
call fcn.100013e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x28]
add esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x9c], 4
mov dword [esp + 0x84], 4
push eax
push 0x20019
push 0
push 0x10068cc0
push 0x80000001
call esi
test eax, eax
jne 0x10023378
lea eax, [esp + 0x84]
push eax
push 0x10064ad0
lea eax, [esp + 0xa4]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x20019
push 0
push 0x10068cc0
push 0x80000001
mov dword [esp + 0xbc], 4
mov dword [esp + 0xa8], 4
call esi
test eax, eax
jne 0x100233e6
lea eax, [esp + 0x94]
push eax
push 0x10064ad4
lea eax, [esp + 0xb0]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x20019
push 0
push 0x10068cc0
push 0x80000001
mov dword [esp + 0x8c], 4
mov dword [esp + 0x90], 4
call esi
nop dword [eax]
test eax, eax
jne 0x10023451
lea eax, [esp + 0x7c]
push eax
push 0x10064d24
lea eax, [esp + 0x80]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x20019
push 0
push 0x10068cc0
push 0x80000001
mov dword [esp + 0x84], 4
mov dword [esp + 0x88], 4
call esi
test eax, eax
jne 0x100234b5
lea eax, [esp + 0x74]
push eax
push 0x10067f24
lea eax, [esp + 0x78]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100689a0
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10068568
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10068568
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x10023502
push eax
call esi
mov byte [0x100674c4], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002120
add esp, 4
push 0x100692f0
push str.Exe______s_r_n
call fcn.100023e0
add esp, 8
cmp byte [0x100674c4], 0
jne 0x100235b0
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e5e0
add esp, 0xc
mov dword [esp + 0x68], 1
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], 0x208
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x70]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x100235a6
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x120]
push eax
jmp 0x100235b5
push 0x100689a0
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x100670a0
call fcn.10001320
add esp, 0x14
push 0x100689a0
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x100674c8
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x100674c8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002362f
push eax
call esi
push 0x100674c8
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.100023e0
add esp, 8
push 8
push 0
push 0x100674c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x100672b8
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x10068ed8
call fcn.10001320
add esp, 0x14
push 0x10068360
push 0x100672b8
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10067af0
call fcn.10001320
push 0x10068360
push 0x100672b8
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10069940
call fcn.10001320
push 0x100672b8
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x10073bc0
call fcn.10001320
add esp, 0x44
push 0x100672b8
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x100678e0
call fcn.10001320
add esp, 0x14
push 0x100672b8
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x10067cf8
call fcn.10001320
add esp, 0x14
push 0x100672b8
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100676d8
call fcn.10001320
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x14
push str.DenuvoActivationBypass.dll
call esi
mov dword [0x10073998], eax
mov ecx, eax
test eax, eax
jne 0x10023732
push str.DenuvoOfflineActivationBypass.dll
call esi
mov dword [0x10073998], eax
mov ecx, eax
test ecx, ecx
je 0x10023c79
push str.GetDenuvoCallResult
push eax
call edi
push str.GetDenuvoID
push dword [0x10073998]
mov dword [0x10069730], eax
call edi
push str.RequestDenuvoAppTicket
push dword [0x10073998]
mov dword [0x10068cb8], eax
call edi
push str.GetDenuvoAppTicket
push dword [0x10073998]
mov dword [0x10069734], eax
call edi
push str.ShutdownDenuvoDll
push dword [0x10073998]
mov dword [0x10068784], eax
call edi
cmp dword [0x10069730], 0
mov dword [0x100672b0], eax
je 0x100237c5
cmp dword [0x10068cb8], 0
nop
je 0x100237c5
cmp dword [0x10069734], 0
je 0x100237c5
cmp dword [0x10068784], 0
je 0x100237c5
test eax, eax
je 0x100237c5
mov byte [0x100674c6], 1
nop
jmp 0x10023c79
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10066e96], 1
jne 0x100237ff
mov byte [0x10066e95], 1
mov byte [0x10066e97], 1
jmp 0x10023868
push 0x1000000
push 0
push 0x10067f04
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x100672b8
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x100670a0
call fcn.10001320
add esp, 0x14
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002120
add esp, 4
push 0x100692f0
push str.Exe______s_r_n
call fcn.100023e0
push 0x100230c0
call fcn.10036a4a
add esp, 0xc
push 0x100230e0
call fcn.10037200
add esp, 4
push 0x100672b8
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10068140
call fcn.10001320
add esp, 0x14
push 0x100672b8
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10067f30
call fcn.10001320
add esp, 0x14
push 0x100672b8
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10069738
call fcn.10001320
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10069738
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x10023906
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069738
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10066e97], 1
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10067f30
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100239ce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10066e97], 1
nop dword [eax]
je 0x10023b6f
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop word [eax + eax]
sub eax, 6
je 0x10023b6f
sub eax, 1
jne 0x100239ce
xor esi, esi
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e5e0
add esp, 0xc
lea eax, [esp + 0x120]
push esi
push 0x10068140
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
add esp, 0x18
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x93
jb 0x10023970
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x100674c0], eax
call fcn.10035985
add esp, 4
push eax
push 0x1005be8c
push 0x1005be90
push 0x1006970c
call fcn.1003589d
push 1
call fcn.10035985
add esp, 0x14
push eax
push 0x1005bea0
push 0x1005bea4
push 0x10067f00
call fcn.1003589d
push 2
call fcn.10035985
add esp, 0x14
push eax
push 0x1005bea0
push 0x1005bea4
push 0x100694f8
call fcn.1003589d
xorps xmm0, xmm0
mov dword [esp + 0xd0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_147_:
movaps xmmword [esp + 0xc4], xmm0
call fcn.100012a0
add esp, 0x14
push 0
call fcn.10035985
add esp, 4
push eax
lea eax, [esp + 0xb4]
push 0xa
push eax
call fcn.1003703e
add esp, 0xc
test eax, eax
je 0x10023b53
nop dword [eax + eax]
lea ecx, [esp + 0xb0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023aa0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x10025466
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xb8], ax
lea eax, [esp + 0xb8]
push eax
call fcn.100362fb
add esp, 0xc
mov dword [esp + 0x84], eax
call fcn.10037140
cmp dword [eax], 0x22
je 0x10025446
mov eax, dword [esp + 0x84]
test eax, eax
je 0x10023b0b
nop dword [eax]
cmp eax, 0x93
jle 0x10023dce
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_147_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.100012a0
add esp, 4
push 0
call fcn.10035985
add esp, 4
push eax
lea eax, [esp + 0xb4]
push 0xa
push eax
call fcn.1003703e
add esp, 0xc
test eax, eax
jne 0x10023a90
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
push 0x208
lea eax, [esp + 0x124]
push 0
push eax
call fcn.1002e5e0
add esp, 0xc
lea eax, [esp + 0x120]
push esi
push 0x10068140
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push 0x10054a00
lea eax, [esp + 0x13c]
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x34]
push eax
call fcn.100365f6
add esp, 0x24
test eax, eax
jne 0x10023c73
push dword [esp + 0x14]
mov dword [esp + 0xe4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xd4]
movaps xmmword [esp + 0xd4], xmm0
push 0x14
push eax
call fcn.10037033
add esp, 0xc
test eax, eax
je 0x10023dae
push dword [esp + 0x14]
call fcn.10036792
add esp, 4
lea eax, [esp + 0xd0]
push 0xa
push 0
push eax
call fcn.100362b5
mov ecx, dword [esi*4 + 0x10064ad8]
add esp, 0xc
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov dword [esp + 0x84], ecx
push eax
lea eax, [esp + 0xa0]
push eax
call fcn.10025dc0
call fcn.10037140
cmp dword ds:[eax], 0x22
je 0x10023d8d
inc esi
cmp esi, 0x93
jb 0x10023b71
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x10073790
push str.GreenLuma_2024_Dll______s_r_n
call fcn.100023e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x100739b4], eax
call fcn.10002120
add esp, 8
call fcn.10027970
cmp dword [0x10073dd4], 0
jne 0x1002541e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10073dd4], eax
xor ecx, ecx
mov edx, 0x10073dd0
xchg dword [edx], ecx
test eax, eax
je 0x10025427
cmp byte [0x10066e96], 0
jne 0x10023ff2
lea eax, [esp + 0xa4]
mov dword [esp + 0x8c], 1
push eax
push 0x10069500
lea eax, [esp + 0x94]
mov dword [esp + 0xac], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10023fd4
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.10002120
add esp, 4
mov ecx, 0x208
mov eax, 0x10069500
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10023d50
push 0x100672b8
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x10069500
call fcn.10001320
add esp, 0x14
push 8
push 0
push 0x10069500
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x10023ff9
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [esp + 0x10], ecx
test eax, eax
jle 0x10023f4d
mov edx, str._nAppID:
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012a0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0x100], xmm0
movq qword [esp + 0x110], xmm0
push 0
call fcn.10035985
add esp, 4
push eax
lea eax, [esp + 0xf4]
push 0x14
push eax
call fcn.1003703e
add esp, 0xc
test eax, eax
je 0x10023fb8
lea ecx, [esp + 0xf0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023e40
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x10025466
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xf8], ax
lea eax, [esp + 0xf8]
push eax
call fcn.100362fb
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x9c], eax
mov dword [esp + 0x98], eax
lea eax, [esp + 0x94]
mov ecx, dword [ecx*4 + 0x10064ad8]
push eax
lea eax, [esp + 0xac]
mov dword [esp + 0x98], ecx
push eax
call fcn.10025dc0
call fcn.10037140
cmp dword [eax], 0x22
je 0x10023f9c
push 0
push 0x10068140
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x534]
push 0
push eax
call fcn.1002e5e0
add esp, 0xc
lea eax, [esp + 0x530]
push dword [esp + 0x10]
push 0x10068140
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001320
push dword ds:[esp + 0xb4]
lea eax, [esp + 0x54c]
push 0x1005c040
push eax
call fcn.10002c20
mov ecx, dword ds:[esp + 0x34]
add esp, 0x24
inc ecx
mov edx, str._nAppID:
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x84]
jl 0x10023de1
cmp dword [0x100674c0], 1
jne 0x10023c79
mov eax, dword [0x1006970c]
nop
test eax, eax
je 0x10023f6d
push eax
call fcn.10036792
add esp, 4
mov eax, dword [0x10067f00]
test eax, eax
je 0x10023f7f
push eax
call fcn.10036792
add esp, 4
mov eax, dword [0x100694f8]
test eax, eax
je 0x10023f91
push eax
call fcn.10036792
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x10023c79
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Got_Steamclient_dll_paths_from_registry_r_n
call fcn.10002120
add esp, 4
push 8
push 0
push 0x10069500
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x10023ff9
push str.steamclient.dll
call esi
mov dword [0x10069708], eax
nop
test eax, eax
jne 0x1002401f
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10066e95], 0
jne 0x100250a2
push str.Steamclient.dll_is_loaded__r_n
call fcn.10002120
add esp, 4
push 0x10069500
push str.Steamclient______s_r_n_r_n
call fcn.100023e0
add esp, 8
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024062
mov dword ds:[esp + 0x14], 0xb
jmp 0x1002408d
push str.CreateInterface
push eax
call edi
test eax, eax
jne 0x10024078
mov dword [esp + 0x14], 0xc
jmp 0x1002408d
push 0x10069728
mov edx, 0x10003de0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x14], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x100240a2
mov dword [esp + 0x1c], 0xb
jmp 0x100240cd
push str.Steam_BGetCallback
push eax
call edi
test eax, eax
jne 0x100240b8
mov dword [esp + 0x1c], 0xc
jmp 0x100240cd
push 0x10068ba8
mov edx, 0x10004660
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x1c], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x100240e2
mov dword [esp + 0x10], 0xb
jmp 0x1002410d
push str.Steam_FreeLastCallback
push eax
call edi
test eax, eax
jne 0x100240f8
mov dword [esp + 0x10], 0xc
jmp 0x1002410d
push 0x10068778
mov edx, 0x10004820
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x10], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024122
mov dword [esp + 0x18], 0xb
jmp 0x1002414d
push str.Steam_GetAPICallResult
push eax
call edi
test eax, eax
jne 0x10024138
mov dword [esp + 0x18], 0xc
jmp 0x1002414d
push 0x10067aec
mov edx, 0x100048e0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x18], eax
push str.CreateInterface
push dword [0x10069708]
call edi
mov edx, 1
mov ecx, eax
call fcn.10027f00
push str.Steam_BGetCallback
push dword [0x10069708]
mov esi, eax
call edi
mov edx, 1
mov ecx, eax
call fcn.10027f00
push str.Steam_FreeLastCallback
push dword [0x10069708]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10027f00
push str.Steam_GetAPICallResult
push dword [0x10069708]
mov dword [esp + 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.10027f00
mov ecx, esi
mov dword [esp + 0xa4], eax
call fcn.10028000
mov ecx, dword ds:[esp + 0x14]
push eax
call fcn.10028000
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.10002120
add esp, 0xc
mov ecx, edi
call fcn.10028000
mov ecx, dword ds:[esp + 0x1c]
push eax
call fcn.10028000
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.10002120
mov ecx, dword [esp + 0x98]
add esp, 0xc
call fcn.10028000
mov ecx, dword [esp + 0x10]
push eax
call fcn.10028000
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.10002120
mov ecx, dword ds:[esp + 0xb0]
add esp, 0xc
call fcn.10028000
mov ecx, dword [esp + 0x18]
push eax
call fcn.10028000
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.10002120
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
push str.ntdll.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002427b
mov eax, 0xb
jmp 0x1002429f
push str.NtCreateUserProcess
push eax
call esi
test eax, eax
jne 0x1002428e
mov eax, 0xc
jmp 0x1002429f
push 0x100739a4
mov edx, 0x10003080
mov ecx, eax
call fcn.10027ac0
push str.ntdll.dll
mov dword [0x100739b0], eax
call edi
test eax, eax
jne 0x100242b6
mov eax, 0xb
jmp 0x100242dc
push str.NtResumeThread
push eax
call esi
nop
test eax, eax
jne 0x100242cb
mov eax, 0xc
jmp 0x100242dc
push 0x10068780
mov edx, 0x10003d00
mov ecx, eax
call fcn.10027ac0
push str.ntdll.dll
mov dword [0x1007399c], eax
call edi
test eax, eax
jne 0x100242f6
mov dword [esp + 0x74], 0xb
jmp 0x10024323
push str.LdrLoadDll
push eax
call esi
nop
test eax, eax
jne 0x1002430e
mov dword [esp + 0x74], 0xc
jmp 0x10024323
push 0x10068ed0
mov edx, 0x10008f20
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x74], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x10024338
mov dword [esp + 0x78], 0xb
jmp 0x10024369
push str.LdrGetDllHandleEx
push eax
call esi
test eax, eax
jne 0x10024350
mov dword [esp + 0x78], 0xc
jmp 0x10024369
push 0x1007378c
mov edx, 0x10008fa0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x78], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002437e
mov dword [esp + 0x7c], 0xb
jmp 0x100243a9
push str.LdrGetDllFullName
push eax
call esi
test eax, eax
jne 0x10024394
mov dword [esp + 0x7c], 0xc
jmp 0x100243a9
push 0x10067f1c
mov edx, 0x10009020
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x7c], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100243c2
mov dword ds:[esp + 0xa8], 0xb
jmp 0x100243f3
push str.LdrGetDllHandleByMapping
push eax
call esi
test eax, eax
jne 0x100243db
mov dword [esp + 0xa8], 0xc
jmp 0x100243f3
push 0x1006899c
mov edx, 0x10009080
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0xa8], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002440b
mov dword [esp + 0x94], 0xb
jmp 0x1002443c
push str.LdrGetDllHandleByName
push eax
call esi
test eax, eax
jne 0x10024424
mov dword [esp + 0x94], 0xc
jmp 0x1002443c
push 0x10068894
mov edx, 0x10009100
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x94], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x10024454
mov dword [esp + 0x9c], 0xb
jmp 0x1002448c
push str.LdrQueryProcessModuleInformation
push eax
call esi
nop dword [eax]
test eax, eax
jne 0x10024471
mov dword [esp + 0x9c], 0xc
jmp 0x1002448c
push 0x10073788
mov edx, 0x10009180
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x9c], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100244a4
mov dword [esp + 0x80], 0xb
jmp 0x100244d5
push str.LdrEnumerateLoadedModules
push eax
call esi
test eax, eax
jne 0x100244bd
mov dword [esp + 0x80], 0xc
jmp 0x100244d5
push 0x100676d4
mov edx, 0x100092c0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x80], eax
push str.ntdll.dll
call edi
nop dword [eax]
test eax, eax
jne 0x100244f1
mov dword [esp + 0x84], 0xb
jmp 0x10024522
push str.RtlLockModuleSection
push eax
call esi
test eax, eax
jne 0x1002450a
mov dword [esp + 0x84], 0xc
jmp 0x10024522
push 0x10067f2c
mov edx, 0x10009320
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x84], eax
push str.kernel32.dll
call edi
test eax, eax
je 0x10024556
push str.Module32NextW
push eax
call esi
test eax, eax
je 0x10024556
push 0x10068788
mov edx, 0x10009340
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10024599
push str.KernelBase.dll
call edi
nop dword [eax]
test eax, eax
jne 0x1002456e
mov dword [esp + 0x1c], 0xb
jmp 0x10024599
push str.Module32NextW
push eax
call esi
test eax, eax
jne 0x10024584
mov dword [esp + 0x1c], 0xc
jmp 0x10024599
push 0x10068788
mov edx, 0x10009340
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x1c], eax
push str.KernelBase.dll
nop
call edi
test eax, eax
je 0x10024737
push str.EnumProcessModules
push eax
call esi
test eax, eax
je 0x10024737
push 0x1006972c
mov edx, 0x100093c0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10024737
push str.KernelBase.dll
call edi
nop
test eax, eax
jne 0x100245ee
mov dword [esp + 0x68], 0xb
jmp 0x10024619
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x10024604
mov dword [esp + 0x68], 0xc
jmp 0x10024619
push 0x100690e4
mov edx, 0x10009700
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x68], eax
push str.KernelBase.dll
nop
call edi
test eax, eax
jne 0x10024630
mov dword [esp + 0x6c], 0xb
jmp 0x1002465b
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x10024646
mov dword [esp + 0x6c], 0xc
jmp 0x1002465b
push 0x10073dcc
mov edx, 0x10009a80
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x6c], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10024670
mov dword [esp + 0x70], 0xb
jmp 0x1002469b
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x10024686
mov dword [esp + 0x70], 0xc
jmp 0x1002469b
push 0x10068ec8
mov edx, 0x10009b40
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x70], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x100246b0
mov dword [esp + 0x18], 0xb
jmp 0x100246db
push 0x1005c4e0
push eax
call esi
test eax, eax
jne 0x100246c6
mov dword [esp + 0x18], 0xc
jmp 0x100246db
push 0x10073dc8
mov edx, 0x10009c20
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x18], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x100246f8
mov dword [esp + 0x10], 0xb
push str.KernelBase.dll
jmp 0x100248c0
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x10024718
mov dword [esp + 0x10], 0xc
push str.KernelBase.dll
jmp 0x100248c0
push 0x100672a8
mov edx, 0x10009ce0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x10], eax
push str.KernelBase.dll
jmp 0x100248c0
push str.Psapi.dll
call edi
nop
test eax, eax
jne 0x1002474e
mov dword [esp + 0x14], 0xb
jmp 0x10024779
push str.EnumProcessModules
push eax
call esi
test eax, eax
jne 0x10024764
mov dword [esp + 0x14], 0xc
jmp 0x10024779
push 0x1006972c
mov edx, 0x100093c0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x14], eax
push str.Psapi.dll
nop
call edi
test eax, eax
jne 0x10024790
mov dword [esp + 0x68], 0xb
jmp 0x100247bb
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x100247a6
mov dword [esp + 0x68], 0xc
jmp 0x100247bb
push 0x100690e4
mov edx, 0x10009700
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x68], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x100247d0
mov dword [esp + 0x6c], 0xb
jmp 0x100247fb
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x100247e6
mov dword [esp + 0x6c], 0xc
jmp 0x100247fb
push 0x10073dcc
mov edx, 0x10009a80
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x6c], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10024810
mov dword [esp + 0x70], 0xb
jmp 0x1002483b
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x10024826
mov dword [esp + 0x70], 0xc
jmp 0x1002483b
push 0x10068ec8
mov edx, 0x10009b40
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x70], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10024850
mov dword [esp + 0x18], 0xb
jmp 0x1002487b
push 0x1005c4e0
push eax
call esi
test eax, eax
jne 0x10024866
mov dword [esp + 0x18], 0xc
jmp 0x1002487b
push 0x10073dc8
mov edx, 0x10009c20
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x18], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10024890
mov dword [esp + 0x10], 0xb
jmp 0x100248bb
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x100248a6
mov dword [esp + 0x10], 0xc
jmp 0x100248bb
push 0x100672a8
mov edx, 0x10009ce0
mov ecx, eax
call fcn.10027ac0
mov dword [esp + 0x10], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x100248cb
lea esi, [eax + 0xb]
jmp 0x100248ef
push str.GetMappedFileNameW
push eax
call esi
test eax, eax
jne 0x100248dc
lea esi, [eax + 0xc]
jmp 0x100248ef
push 0x10067f28
mov edx, 0x10009dc0
mov ecx, eax
call fcn.10027ac0
mov esi, eax
mov edx, 1
xor ecx, ecx
call fcn.10027f00
mov ecx, dword [0x100739b0]
mov edi, eax
inc ecx
cmp ecx, 0xd
ja case.default.0x1002490d
jmp dword [ecx*4 + 0x1002546c]
mov ecx, str.MH_UNKNOWN
jmp 0x10024991
mov ecx, str.MH_OK
jmp 0x10024991
mov ecx, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024991
mov ecx, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024991
mov ecx, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024991
mov ecx, str.MH_ERROR_NOT_CREATED
jmp 0x10024991
mov ecx, str.MH_ERROR_ENABLED
jmp 0x10024991
mov ecx, str.MH_ERROR_DISABLED
nop
jmp 0x10024991
mov ecx, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024991
mov ecx, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024991
mov ecx, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024991
mov ecx, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024991
mov ecx, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024991
mov ecx, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024991
mov ecx, str._unknown_
push ecx
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.10002120
mov eax, dword [0x1007399c]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x100249ae
jmp dword [eax*4 + 0x100254a4]
mov eax, str.MH_UNKNOWN
jmp 0x10024a31
mov eax, str.MH_OK
jmp 0x10024a31
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024a31
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024a31
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024a31
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10024a31
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024a31
mov eax, str.MH_ERROR_DISABLED
jmp 0x10024a31
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024a31
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024a31
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024a31
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024a31
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024a31
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024a31
mov eax, str._unknown_
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0x7c]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024a4d
jmp dword [eax*4 + 0x100254dc]
mov eax, str.MH_UNKNOWN
jmp 0x10024ad7
mov eax, str.MH_OK
jmp 0x10024ad7
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024ad7
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024ad7
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024ad7
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10024ad7
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024ad7
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10024ad7
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024ad7
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024ad7
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024ad7
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024ad7
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024ad7
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024ad7
mov eax, str._unknown_
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0x80]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024b00
nop dword [eax]
jmp dword [eax*4 + 0x10025514]
mov eax, str.MH_UNKNOWN
jmp 0x10024b8e
mov eax, str.MH_OK
jmp 0x10024b8e
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024b8e
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024b8e
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024b8e
mov eax, str.MH_ERROR_NOT_CREATED
nop
jmp 0x10024b8e
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024b8e
mov eax, str.MH_ERROR_DISABLED
jmp 0x10024b8e
mov eax, str.MH_ERROR_NOT_EXECUTABLE
nop
jmp 0x10024b8e
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024b8e
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024b8e
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024b8e
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
nop
jmp 0x10024b8e
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024b8e
mov eax, str._unknown_
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0x84]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024bad
jmp dword [eax*4 + 0x1002554c]
mov eax, str.MH_UNKNOWN
jmp 0x10024c37
mov eax, str.MH_OK
jmp 0x10024c37
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024c37
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024c37
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024c37
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10024c37
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024c37
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10024c37
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024c37
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024c37
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024c37
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024c37
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024c37
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024c37
mov eax, str._unknown_
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0xb0]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024c60
nop dword [eax]
jmp dword [eax*4 + 0x10025584]
mov eax, str.MH_UNKNOWN
jmp 0x10024cee
mov eax, str.MH_OK
jmp 0x10024cee
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024cee
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024cee
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024cee
mov eax, str.MH_ERROR_NOT_CREATED
nop
jmp 0x10024cee
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024cee
mov eax, str.MH_ERROR_DISABLED
jmp 0x10024cee
mov eax, str.MH_ERROR_NOT_EXECUTABLE
nop
jmp 0x10024cee
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024cee
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024cee
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024cee
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
nop
jmp 0x10024cee
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024cee
mov eax, str._unknown_
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0x9c]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024d0d
jmp dword [eax*4 + 0x100255bc]
mov eax, str.MH_UNKNOWN
jmp 0x10024d9c
mov eax, str.MH_OK
jmp 0x10024d9c
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024d9c
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024d9c
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024d9c
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10024d9c
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024d9c
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10024d9c
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024d9c
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024d9c
mov eax, str.MH_ERROR_MEMORY_ALLOC
nop
jmp 0x10024d9c
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024d9c
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024d9c
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024d9c
mov eax, str._unknown_
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0xa4]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024dc0
nop dword [eax + eax]
jmp dword [eax*4 + 0x100255f4]
mov eax, str.MH_UNKNOWN
jmp 0x10024e50
mov eax, str.MH_OK
jmp 0x10024e50
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024e50
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024e50
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024e50
mov eax, str.MH_ERROR_NOT_CREATED
nop
jmp 0x10024e50
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024e50
mov eax, str.MH_ERROR_DISABLED
jmp 0x10024e50
mov eax, str.MH_ERROR_NOT_EXECUTABLE
nop
jmp 0x10024e50
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024e50
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024e50
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024e50
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024e50
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024e50
mov eax, str._unknown_
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.10002120
mov eax, dword [esp + 0x88]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024e6f
jmp dword [eax*4 + 0x1002562c]
mov eax, str.MH_UNKNOWN
nop dword [eax + eax]
jmp 0x10024f07
mov eax, str.MH_OK
jmp 0x10024f07
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024f07
mov eax, str.MH_ERROR_NOT_INITIALIZED
nop
jmp 0x10024f07
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10024f07
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10024f07
mov eax, str.MH_ERROR_ENABLED
nop
jmp 0x10024f07
mov eax, str.MH_ERROR_DISABLED
jmp 0x10024f07
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024f07
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
nop
jmp 0x10024f07
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10024f07
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024f07
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024f07
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
nop
jmp 0x10024f07
mov eax, str._unknown_
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.10002120
mov eax, dword ds:[esp + 0x8c]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10024f29
jmp dword [eax*4 + 0x10025664]
mov eax, str.MH_UNKNOWN
jmp 0x10024fbc
mov eax, str.MH_OK
nop
jmp 0x10024fbc
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10024fbc
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10024fbc
mov eax, str.MH_ERROR_ALREADY_CREATED
nop
jmp 0x10024fbc
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10024fbc
mov eax, str.MH_ERROR_ENABLED
jmp 0x10024fbc
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10024fbc
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10024fbc
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10024fbc
mov eax, str.MH_ERROR_MEMORY_ALLOC
nop
jmp 0x10024fbc
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10024fbc
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10024fbc
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10024fbc
mov eax, str._unknown_
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.10002120
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10028000
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.10002120
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10028000
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.10002120
mov ecx, dword ds:[esp + 0x70]
add esp, 8
call fcn.10028000
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.10002120
mov ecx, dword [esp + 0x74]
add esp, 8
call fcn.10028000
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.10002120
mov ecx, dword [esp + 0x78]
add esp, 8
call fcn.10028000
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.10002120
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10028000
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.10002120
mov ecx, dword ds:[esp + 0x18]
add esp, 8
call fcn.10028000
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.10002120
add esp, 8
mov ecx, esi
call fcn.10028000
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.10002120
add esp, 8
mov ecx, edi
call fcn.10028000
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.10002120
mov eax, dword [0x10069708]
add esp, 8
cmp byte [0x100672b4], 1
jne 0x10025213
push eax
call dword [0x100676d0]
mov ecx, dword [0x10069708]
mov edi, eax
push str.xxxxxxxxxxxx
push 0x1005c7dc
mov edx, dword [edi + 0x50]
call fcn.10001d80
add esp, 8
mov dword [0x10068cbc], eax
test eax, eax
je 0x10025144
push str.InternalGetInt_Pattern_found_r_n
call fcn.10002120
mov ecx, dword [0x10068cbc]
add esp, 4
mov edx, 0x10002d00
mov dword [0x10068ed4], ecx
push 0x10068ed4
call fcn.10027ac0
mov ecx, dword [0x10068cbc]
mov edx, 1
mov esi, eax
call fcn.10027f00
mov ecx, eax
call fcn.10028000
push eax
mov ecx, esi
call fcn.10028000
push eax
push str.InternalGetInt_Hook______s______s_r_n_r_n
call fcn.10002120
add esp, 0xc
jmp 0x10025151
push str.InternalGetInt_Pattern__0_r_n_r_n
call fcn.10002120
add esp, 4
cmp byte [0x10066e95], 0
jne 0x10025213
mov esi, dword [edi + 0x50]
mov edx, esi
mov ecx, dword [0x10069708]
push str.xxxxxxxxxxxxx
push 0x1005c864
call fcn.10001d80
mov edi, eax
add esp, 8
test edi, edi
jne 0x100251be
mov ecx, dword [0x10069708]
mov edx, esi
push str.xxxxxxxxxxxxx
push 0x1005c874
call fcn.10001d80
mov edi, eax
add esp, 8
test edi, edi
jne 0x100251be
push str.GetLegacyCDKey_Pattern__0_r_n_r_n
call fcn.10002120
add esp, 4
jmp 0x10025213
push str.GetLegacyCDKey_Pattern_found_r_n
call fcn.10002120
add esp, 4
mov dword [0x100694fc], edi
mov edx, 0x10004aa0
mov ecx, edi
push 0x100694fc
call fcn.10027ac0
mov edx, 1
mov ecx, edi
mov esi, eax
call fcn.10027f00
mov ecx, eax
call fcn.10028000
push eax
mov ecx, esi
call fcn.10028000
push eax
push str.GetLegacyCDKey_Hook______s______s_r_n_r_n
call fcn.10002120
add esp, 0xc
cmp byte [0x10066e95], 1
nop word [eax + eax]
jne 0x1002524f
push 0
push 0
push 0
push 0x10022fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [eax + eax]
test eax, eax
je 0x100252dc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [0x10066e96], 0
nop dword [eax]
jne 0x100252c6
cmp byte [0x100672b4], 0
jne 0x1002530f
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x100670a0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100252f7
push 0
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push 1
push 0x1005c920
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x734]
xor ecx, esp
call fcn.1002cb01
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call edi
jmp 0x10025255
push 0x10
push str.GreenLuma_2024
push 0x1005c924
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x44
lea eax, [esp + 0x20]
movlpd qword [esp + 0x24], xmm0
push eax
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word ds:[esp + 0x52], 8
jb 0x10025406
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10025406
lea esi, [eax + 4]
test esi, esi
je 0x10025385
mov esi, dword ds:[esi]
jmp 0x10025397
xor esi, esi
call fcn.10037140
mov dword [eax], 0x16
call fcn.10036a06
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, 1
jne 0x100253ea
nop word [eax + eax]
test byte [esp + 0x90], al
je 0x100253ea
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x73c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002cb01
mov esp, ebp
pop ebp
ret
push 0x10
push str.GreenLuma_2024
push str.Patching_event_handle_is_invalid_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_patching_event_
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, 0x10073dd0
xchg dword [ecx], eax
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002cc3b
nop
adc al, 0x49
add dl, byte [eax]
push ds
dec ecx
add dl, byte [eax]
sub byte [ecx + 2], cl
adc byte [edx], dh
dec ecx
add dl, byte [eax]
cmp al, 0x49
add dl, byte [eax]
inc esi
dec ecx
add dl, byte [eax]
push eax
dec ecx
add dl, byte [eax]
pop edx
dec ecx
add dl, byte [eax]
bound ecx, qword [ecx + 2]
adc byte [ecx + 73], ch
add dl, byte [eax]
jo 0x100254df
add dl, byte [eax]
ja 0x100254e3
add dl, byte [eax]
jle 0x100254e7
add dl, byte [eax]
test dword [ecx + 2], ecx
adc byte [ebp - 1089469879], dh
dec ecx
add dl, byte [eax]
leave
dec ecx
add dl, byte [eax]
ror dword [ecx + 2], cl
adc ch, bl
dec ecx
add dl, byte [eax]
out 0x49, eax
add dl, byte [eax]
int1
dec ecx
add dl, byte [eax]
sti
dec ecx
add dl, byte [eax]
add cl, byte [edx + 2]
adc byte [ecx], cl
dec edx
add dl, byte [eax]
adc byte [edx + 2], cl
adc byte [edi], dl
dec edx
add dl, byte [eax]
push ds
dec edx
add dl, byte [eax]
and eax, 0x5410024a
dec edx
add dl, byte [eax]
pop esi
dec edx
adc byte [esi + 0x4a], bl
add dl, byte [eax]
push 0x7210024a
dec edx
adc byte [eax + 0x4a], ch
add dl, byte [eax]
jb 0x10025534
adc byte [edx + 0x4a], dh
add dl, byte [eax]
jl 0x10025538
add dl, byte [eax]
xchg byte [edx + 2], cl
adc byte [eax - 1710226870], dl
dec edx
add dl, byte [eax]
movsd dword es:[edi], dword [esi]
dec edx
add dl, byte [eax]
scasd eax, dword es:[edi]
dec edx
add dl, byte [eax]
mov dh, 0x4a
add dl, byte [eax]
mov ebp, 0xc410024a
dec edx
add dl, byte [eax]
retf
pop ecx
dec ebx
add dl, byte [eax]
dec ebx
add dl, byte [eax]
insb byte es:[edi], dx
dec ebx
add dl, byte [eax]
jae 0x1002558d
add dl, byte [eax]
jp 0x10025591
add dl, byte [eax]
or byte [ebx + 2], 0x10
mov ah, 75
add dl, byte [eax]
mov esi, 0xc810024b
dec ebx
add dl, byte [eax]
ror byte [ebx + 2], cl
adc ah, bl
dec ebx
add dl, byte [eax]
out 0x4b, al
add dl, byte [eax]
invalid
dec esp
add dl, byte [eax]
test dword [edx + eax + 0x10], ecx
dec esp
add dl, byte [eax]
invalid