Function at 0x100059e0
Capabilities:
Check os version
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001de45
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x1002c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10005bf8
call sym.OpenGuard.dll_OpenGuard
cmp dword [0x10031770], 1
jne 0x10005b3b
push str.lib_ayarlar.txt
call fcn.1000c6d5
push str.libhesap1.txt
call fcn.1000c6d5
push str.libhesap2.txt
call fcn.1000c6d5
push str.libhesap3.txt
call fcn.1000c6d5
push str.libhesap4.txt
call fcn.1000c6d5
push str.liblib.txt
call fcn.1000c6d5
push str.lib_ticaret.txt
call fcn.1000c6d5
push str.libloglar.txt
call fcn.1000c6d5
add esp, 0x18
lea ecx, [ebp - 0x4c]
call fcn.10005d70
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0
call fcn.10005e90
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5dc
call esi
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x10005ac0
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0x12c
call esi
sub esp, 8
lea ecx, [ebp - 0x30]
call fcn.10005d70
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.10005e90
push 0xbb8
call esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10005b0c
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x30], vtable.CSplash.0
test eax, eax
je 0x10005b23
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], vtable.CSplash.0
test eax, eax
je 0x10005b3b
push eax
call esi
cmp dword [0x100317dc], 1
jne 0x10005b94
cmp dword [0x100324d8], 0xb7
jne 0x10005b94
mov eax, dword [0x100317c0]
push 0x200030
push dword [0x1003173c]
cmp eax, 1
jne 0x10005b7a
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10005b65
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100317b4], 0
jne 0x10005bf8
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x10005bf8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005bf8
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005bf3
mov dword [0x100316e0], 1
jmp 0x10005bf8
call fcn.10004980
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc