Function at 0x10001830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get session user name
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055524
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1a4
mov eax, dword [0x1006e064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1a8], 0
call fcn.10007030
cmp dword [eax + 0x14], 0x10
jb 0x1000188b
mov eax, dword [eax]
push eax
push 0x10065268
push 0x1007384c
call fcn.10001470
mov edx, dword [ebp - 0x34]
add esp, 0xc
cmp edx, 0x10
jb 0x100018d2
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100018c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000211d
push edx
push ecx
call fcn.1002f0b0
add esp, 8
movaps xmm0, xmmword [0x100679e0]
lea edi, [ebp - 0x24]
mov eax, 0x80000002
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x24], xmm0
pop ebx
mov dword [edi], eax
lea eax, [ebp - 0x28]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push str._08X_08X
push eax
call fcn.10001470
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x48], 0
add esp, 0x10
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001930
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.100024f0
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
push eax
push 0x10065268
push 0x10073964
call fcn.10001470
mov edx, dword [ebp - 0x34]
add esp, 0xc
cmp edx, 0x10
jb 0x10001998
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000198e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002122
push edx
push ecx
call fcn.1002f0b0
add esp, 8
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a8], 0x101
push eax
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
test eax, eax
je 0x100019eb
lea ecx, [ebp - 0x1a0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100019d8
sub ecx, edx
lea eax, [ebp - 0x1a0]
push ecx
push eax
jmp 0x100019f2
push 0
push 0x10063fec
lea ecx, [ebp - 0x2c]
call fcn.100024f0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x10065268
push 0x100738a4
call fcn.10001470
mov edx, dword [ebp - 0x18]
add esp, 0xc
cmp edx, 0x10
jb 0x10001a4c
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001a42
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002127
push edx
push ecx
call fcn.1002f0b0
add esp, 8
lea ecx, [ebp - 0x48]
call fcn.10007120
cmp dword [eax + 0x14], 0x10
jb 0x10001a5c
mov eax, dword [eax]
push eax
push 0x10065268
push 0x100738f8
call fcn.10001470
mov edx, dword [ebp - 0x34]
add esp, 0xc
cmp edx, 0x10
jb 0x10001aa3
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001a99
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000212c
push edx
push ecx
call fcn.1002f0b0
add esp, 8
push 0x17
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x48]
push str.wmic_csproduct_get_uuid
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.100024f0
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10006d80
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x10001b18
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001b0e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002131
push edx
push ecx
call fcn.1002f0b0
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x10065268
push 0x1007392c
call fcn.10001470
mov edx, dword [ebp - 0x18]
add esp, 0xc
cmp edx, 0x10
jb 0x10001b6a
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001b60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002136
push edx
push ecx
call fcn.1002f0b0
add esp, 8
lea eax, [ebp - 0x1a4]
mov dword [ebp - 4], 1
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
mov dword [ebp - 0x2c], 0
push 0x80000002
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], 0x40
mov dword [ebp - 0x1b0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x1a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
jne 0x10001c1a
test eax, eax
jne 0x10001c1a
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001c01
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.100024f0
push dword [ebp - 0x1a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x10065268
push 0x100737e0
call fcn.10001470
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x10001c7f
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001c75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000213b
push edx
push ecx
call fcn.1002f0b0
add esp, 8
push 0x18
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x48]
push str.wmic_cpu_get_processorid
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.100024f0
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.10006d80
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x10001ced
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001ce3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002140
push edx
push ecx
call fcn.1002f0b0
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x10065268
push 0x1007399c
call fcn.10001470
mov edx, dword [ebp - 0x18]
add esp, 0xc
cmp edx, 0x10
jb 0x10001d3f
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001d35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002145
push edx
push ecx
call fcn.1002f0b0
add esp, 8
mov edx, str.xxxx____x____x____xxx____xx____xxxxx____xxxx____xxxxxxxxx____xxx
mov ecx, 0x10065290
call fcn.10014490
mov edx, str.xxx____x____xxxxxx____xx_____xx____xxx
mov dword [0x1007229c], eax
mov ecx, 0x1006531c
call fcn.10014490
mov edx, str.xxx____xxxxx____xxxx____x____x____x____xx____xx____xx
mov dword [0x10072290], eax
mov ecx, 0x1006536c
call fcn.10014490
mov edx, str.xxxxxxxxx
mov dword [0x100722b8], eax
mov ecx, 0x100653dc
call fcn.10014490
mov edx, str.xxxxxx____xxxxxxxxx____xxxxx
mov dword [0x100722b4], eax
mov ecx, 0x100653f4
call fcn.10014490
mov edx, str.xxx____xxxxx____xxxx____xxx____x____xx____xxxxxxxxx____xx____xx____xxxx____x
mov dword [0x100722a8], eax
mov ecx, 0x10065438
call fcn.10014490
movups xmm0, xmmword [0x100654d8]
mov dword [0x100722dc], eax
lea edx, [ebp - 0x4c]
movzx eax, word [0x100654f0]
lea ecx, [ebp - 0x30]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x18], ax
movq xmm0, qword [0x100654e8]
movzx eax, byte [0x100654f2]
movq qword [ebp - 0x20], xmm0
movups xmm0, xmmword [str.xxxxx____x____xxxxxxxxxxxx]
mov byte [ebp - 0x16], al
movzx eax, word [0x1006550c]
movups xmmword [ebp - 0x4c], xmm0
mov word [ebp - 0x34], ax
movq xmm0, qword [0x10065504]
movzx eax, byte [0x1006550e]
movq qword [ebp - 0x3c], xmm0
mov byte [ebp - 0x32], al
call fcn.10014490
mov dword [0x10072298], eax
test eax, eax
jne 0x10001e75
movups xmm0, xmmword [0x10065510]
mov eax, dword [0x10065528]
lea edx, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x30]
mov eax, dword [0x10065544]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x34], eax
movq xmm0, qword [0x10065520]
movq qword [ebp - 0x20], xmm0
movups xmm0, xmmword [str.xxxxx____x____xxxxxxxxxxxxx]
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [0x1006553c]
movq qword [ebp - 0x3c], xmm0
call fcn.10014490
mov dword [0x10072298], eax
call fcn.10015d20
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.100161f0
push 0x10001510
push 0x1007229c
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x1000214a
call fcn.10015d20
call esi
push eax
call fcn.100161f0
push 0x10001530
push 0x10072290
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x10002163
call fcn.10015d20
call esi
push eax
call fcn.100161f0
push 0x100015d0
push 0x100722b8
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x1000217c
call fcn.10015d20
call esi
push eax
call fcn.100161f0
push 0x10001610
push 0x100722b4
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x10002195
call fcn.10015d20
call esi
push eax
call fcn.100161f0
push 0x10001790
push 0x100722a8
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x100021ae
call fcn.10015d20
call esi
push eax
call fcn.100161f0
push 0x100017c0
push 0x100722dc
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x100021c7
call fcn.10015d20
call esi
push eax
call fcn.100161f0
push 0x100017e0
push 0x10072298
call fcn.100157b0
call fcn.10015d80
test eax, eax
jne 0x100021e0
mov edi, dword [0x100739d0]
lea ecx, [ebp - 0x1a4]
mov eax, dword [0x10094ac0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ecx
push 0x40
push edi
push eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], 0
call esi
push 0
push edi
push str.XXUchihaXXT3AloX
push dword [ebp - 0x1a8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x1a4]
push eax
push dword [ebp - 0x1a4]
push edi
push dword [ebp - 0x1a8]
call esi
cmp dword [0x1006eb54], 1
jne 0x10002026
xorps xmm0, xmm0
lea edx, [ebp - 0x48]
sub esp, 8
movq qword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x48], xmm0
call fcn.10008e00
add esp, 8
mov dword [0x1006eb54], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10071ab8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a9298]
cmp eax, dword [ecx + 4]
jle 0x10002083
push 0x100a9298
call fcn.1002ecc0
add esp, 4
cmp dword [0x100a9298], 0xffffffff
jne 0x10002083
call fcn.1001702c
push 0
push 0x989680
push edx
push eax
call fcn.10054eb0
push 0x100a9298
mov dword [0x100a9290], eax
mov dword [0x100a9294], edx
call fcn.1002ec76
add esp, 4
mov ecx, dword [0x100a9294]
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x8c], ecx
mov word [ebp - 0x53], ax
lea ecx, [ebp - 0x98]
mov byte [ebp - 0x51], al
mov eax, dword [0x100a9290]
movlpd qword [ebp - 0x78], xmm0
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
mov dword [ebp - 0x57], 0
mov dword [ebp - 0x98], str.Play2Win
mov dword [ebp - 0x94], str.Version:_6609
mov dword [ebp - 0x90], eax
movlpd qword [ebp - 0x88], xmm0
mov dword [ebp - 0x80], str.qwee
mov dword [ebp - 0x7c], str.Game_Name
mov byte [ebp - 0x58], 1
call fcn.10009440
call fcn.100389fc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002eba3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
call fcn.10037cd8
push 0
push 0x10065548
push str.SENDMSG_HOOK_Not_Found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
push 0
push 0x10065548
push str.RECVMSG_HOOK_Not_Found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
push 0
push 0x10065548
push str.USER_HOOK_Not_Found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
push 0
push 0x10065548
push str.SERVER_HOOK_Not_Found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
push 0
push 0x10065548
push str.PING_HOOK_Not_Found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
push 0
push 0x10065548
push str.CountClient_HOOK_Not_Found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
push 0
push 0x10065548
push str.Error_Hooking_Pass_Function
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10002830
int3