Function at 0x1000f240
Capabilities:
Check os version
Create thread
Query or enumerate registry value
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bf9e
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
push esi
push edi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x1000fafa
call sym.OpenAL64.dll_ZedSystem
cmp dword [0x10056578], 1
jne 0x1000f3bd
push str.USER32.DLL
mov dword [ebp - 0x2c], vtable.CSplash.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], str.SPLASH
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10
push 0
push 0
push 0
push str..GameGuard_gameguard.bmp
push 0
mov dword [0x100564f4], eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000f2e5
push eax
call esi
mov dword [ebp - 0x18], 0
test edi, edi
je 0x1000f323
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], edi
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x1000f317
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000f30e
push eax
call esi
mov dword [ebp - 0x18], 0
jmp 0x1000f323
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x808080
test eax, eax
je 0x1000f364
cmp dword [0x100564f4], 0
je 0x1000f364
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [0x100564f4]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.100138e0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1000f3a5
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], vtable.CSplash.0
test eax, eax
je 0x1000f3bd
push eax
call esi
cmp dword [0x100565dc], 0
jne 0x1000f3cf
cmp dword [0x100565e4], 1
jne 0x1000f41f
cmp dword [0x10057320], 0xb7
jne 0x1000f41f
mov eax, dword [0x100565c8]
push 0x200030
push dword [0x10056544]
cmp eax, 1
jne 0x1000f405
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000f3f0
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100565bc], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
jne 0x1000f491
call esi
cmp al, 6
jae 0x1000f440
mov dword [0x100564e0], 1
jmp 0x1000f491
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000f491
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000f48c
mov dword [0x100564d8], 1
jmp 0x1000f491
call fcn.100058c0
cmp dword [0x100565e8], 1
jne 0x1000f515
sub esp, 8
lea ecx, [ebp - 0x108]
push 1
push dword [0x10056500]
call fcn.100059d0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xfc], 6
je 0x1000f4f9
call esi
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
sbb eax, eax
and eax, ecx
cmp eax, 0x1770
jae 0x1000f4f2
mov dword [0x100564e0], 1
call fcn.100054d0
jmp 0x1000f503
call fcn.100058c0
jmp 0x1000f503
mov dword [0x100564dc], 1
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
call fcn.10005750
cmp dword [0x10056588], 1
jne 0x1000f52f
push 0
push 0
push 0x10012270
call fcn.1001fda2
add esp, 0xc
cmp dword [0x100565dc], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x1000f571
push 0
push 0
push 0
push 0x100076f0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10007300
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100074e0
push 0
push 0
call edi
cmp dword [0x100565e4], 0
je 0x1000f605
call fcn.10006b30
cmp dword [0x100565e8], 1
jne 0x1000f595
cmp dword [0x100564dc], 0
je 0x1000f605
cmp dword [0x100565bc], 1
jne 0x1000f5b0
cmp dword [0x100564e0], 0
jne 0x1000f5b0
cmp dword [0x100564d8], 0
je 0x1000f605
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push 8
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000f5ee
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x14
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x30]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000f5fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
je 0x1000fb12
cmp dword [0x100565f0], 1
je 0x1000fb17
cmp dword [0x100565f4], 1
je 0x1000fb1c
cmp dword [0x10056628], 1
jne 0x1000f639
push 0
push 0
push 0
push 0x100150c0
push 0
push 0
call edi
cmp dword [0x100565d4], 1
jne 0x1000f653
push 0
push 0
push 0
push 0x10008370
push 0
push 0
call edi
cmp dword [0x1005661c], 1
jne 0x1000f68e
push 0x1004a848
call fcn.1001c334
push 0x1004a84c
call fcn.1001c334
push 0x1004a618
call fcn.1001c334
add esp, 0xc
push 0
push 0
push 0
push 0x1000c0c0
push 0
push 0
call edi
cmp dword [0x10056614], 1
jne 0x1000f6b1
cmp dword [0x10056584], 0
jne 0x1000f6b1
push 0
push 0
push 0
push 0x10009290
push 0
push 0
call edi
cmp dword [0x10056564], 1
jne 0x1000f843
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON_
mov ecx, 0x10055830
call fcn.10004190
push eax
call fcn.10006c40
mov edx, str.All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov ecx, 0x10055830
call fcn.10004190
push eax
call fcn.10006c40
add esp, 8
cmp dword [0x100565c4], 1
jne 0x1000f76c
sub esp, 8
lea ecx, [ebp - 0x100]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x100]
call fcn.10004190
lea ecx, [ebp - 0xfc]
call fcn.10003860
test eax, eax
jne 0x1000f75a
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x100]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000f9d7
lea eax, [ebp - 0x38]
push eax
call fcn.1001b31e
lea eax, [ebp - 0x38]
push eax
call fcn.1001b60b
push 8
push 0x1004936c
lea ecx, [ebp - 0x1b8]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x1b8]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0x1b8]
mov edx, eax
call fcn.10004190
mov edx, str._START.cpp___carrega.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
lea ecx, [ebp - 0x1b8]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0x1b8]
call fcn.10004190
lea ecx, [ebp - 0x1b4]
call fcn.10003860
test eax, eax
jne 0x1000f826
mov eax, dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1b8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x1b8]
call fcn.10002040
jmp 0x1000f9d7
cmp dword [0x10056574], 1
jne 0x1000f85d
push 0
push 0
push 0
push 0x10010b00
push 0
push 0
call edi
cmp dword [0x100565c0], 1
jne 0x1000f877
push 0
push 0
push 0
push 0x1000ea30
push 0
push 0
call edi
cmp dword [0x10056610], 1
jne 0x1000f891
push 0
push 0
push 0
push 0x1000ee00
push 0
push 0
call edi
cmp dword [0x1005657c], 1
jne 0x1000f8ab
push 0
push 0
push 0
push 0x100148b0
push 0
push 0
call edi
cmp dword [0x100565f8], 1
jne 0x1000f8c5
push 0
push 0
push 0
push 0x10013730
push 0
push 0
call edi
cmp dword [0x10056580], 1
jne 0x1000f8df
push 0
push 0
push 0
push 0x10008ea0
push 0
push 0
call edi
cmp dword [0x10056604], 1
jne 0x1000f8f9
push 0
push 0
push 0
push 0x10012820
push 0
push 0
call edi
cmp dword [0x100565fc], 1
jne 0x1000f913
push 0
push 0
push 0
push 0x1000a740
push 0
push 0
call edi
cmp dword [0x10056600], 1
jne 0x1000f92d
push 0
push 0
push 0
push 0x10004eb0
push 0
push 0
call edi
cmp dword [0x10056608], 1
jne 0x1000f947
push 0
push 0
push 0
push 0x10002140
push 0
push 0
call edi
cmp dword [0x100565b8], 1
jne 0x1000f955
call fcn.10012c50
cmp dword [0x100565d0], 1
jne 0x1000f96f
push 0
push 0
push 0
push 0x10014180
push 0
push 0
call edi
cmp dword [0x100565ac], 1
jne 0x1000f989
push 0
push 0
push 0
push 0x10013da0
push 0
push 0
call edi
cmp dword [0x10056618], 1
jne 0x1000f9a3
push 0
push 0
push 0
push 0x10014510
push 0
push 0
call edi
cmp dword [0x1005660c], 1
jne 0x1000f9bd
push 0
push 0
push 0
push 0x100051b0
push 0
push 0
call edi
cmp dword [0x100565cc], 1
jne 0x1000f9d7
push 0
push 0
push 0
push 0x1000aa10
push 0
push 0
call edi
cmp dword [0x1005656c], 1
jne 0x1000fa5c
mov eax, 0x7dbe6ac
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, eax
mov eax, dword [0x10056554]
movups xmm0, xmmword [eax]
mov eax, 0x69216c
mov edx, eax
movups xmmword [ecx], xmm0
mov ecx, dword [0x10056558]
mov dword [eax], 0
mov byte [eax + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
movzx eax, byte [ecx + 4]
xor ecx, ecx
mov byte [edx + 4], al
mov eax, 0x7dbe6c0
mov edx, eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
mov ecx, dword [0x1005655c]
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ax, word [ecx + 0xc]
mov word [edx + 0xc], ax
movzx eax, byte [ecx + 0xe]
mov byte [edx + 0xe], al
cmp dword [0x10056570], 1
jne 0x1000fa76
push 0
push 0
push 0
push 0x10014ff0
push 0
push 0
call edi
cmp dword [0x10056620], 1
jne 0x1000fa9f
mov eax, 0x693ff1
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, eax
mov eax, dword [str.Player]
mov dword [ecx], eax
mov ax, word [0x10049e80]
mov word [ecx + 4], ax
cmp dword [0x10056584], 1
jne 0x1000fad3
cmp dword [0x10056564], 0
jne 0x1000fad3
push 0
push 0
push 0
push 0x10014af0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10014de0
push 0
push 0
call edi
cmp dword [0x100565b4], 1
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x1000faea
push dword [0x1005653c]
call esi
cmp dword [0x100565b0], 1
jne 0x1000fafa
push str.Glow.dll
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.10005200
call fcn.1000fb30
call fcn.1000fc80
int3