Function at 0x100927b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be238
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x100e50d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100d9d78
push 0xe2
mov dword [ebp - 0x220], 0
push dword [0x100f26fc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp dword [0x100f2700], 0
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jne 0x1009281f
push str.Game.dll
call edi
mov dword [0x100f2700], eax
mov dword [0x100f2748], eax
cmp dword [0x100f26f8], 0
jne 0x10092834
push str.Storm.dll
call edi
mov dword [0x100f26f8], eax
push 0x100d7ce4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100f23e4], eax
test eax, eax
je 0x1009284d
call fcn.100458c0
test esi, esi
je 0x1009299e
push esi
push dword [0x100f26fc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1009299e
push esi
push dword [0x100f26fc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x1009299e
push edi
mov dword [0x100f26f0], esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1009299e
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push 0x100d9d80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x100f28d4], eax
cmp eax, 0xffffffff
je 0x1009299e
push 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1009299e
push dword [0x100f28d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x12
push str.WarCraftHelper.mpq
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0xf
mov byte [ebp - 0x270], 0
call fcn.1000ecc0
mov dword [ebp - 4], 0
cmp byte [0x100f22e7], 0
je 0x10092957
cmp dword [ebp - 0x25c], 0x10
lea eax, [ebp - 0x270]
push 0x100f26f4
cmovae eax, dword [ebp - 0x270]
push 0
push dword [0x100e5adc]
push eax
call dword [0x100f2444]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x25c]
cmp edx, 0x10
jb 0x10092998
mov ecx, dword [ebp - 0x270]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009298e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10092d96
push edx
push ecx
call fcn.10097faf
add esp, 8
inc dword [0x100e5adc]
cmp dword [0x100f28e4], 0
jne 0x100929ba
push 0
push 0
call dword [sym.imp.audiere.dll__AdrOpenDevice_8]
mov dword [0x100f28e4], eax
test eax, eax
je 0x100929cb
push 0x10092780
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, dword [0x100f2748]
lea eax, [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add edi, 0x6084c6
push eax
push 0x40
push 2
push edi
call esi
lea eax, [ebp - 0x21c]
mov dword [edi], 0x16c
push eax
push dword [ebp - 0x21c]
push 2
push edi
call esi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp byte [0x100f27aa], 0
jne 0x10092a85
xor esi, esi
push esi
push 1
push 0x100f2aec
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10092a57
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x10092a3f
push 0
jmp 0x10092a41
push 1
call edi
push 0
push 1
push 0x100f2aec
inc esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x10092a36
cmp dword [0x100f2af0], 0
jne 0x10092a71
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100f2af0], eax
push 0
push 0x100f2aec
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [0x100f27aa], 1
call fcn.10028010
cmp dword [0x100f224c], 0
je 0x10092d7b
mov byte [ebp - 0x255], 0
mov byte [ebp - 0x256], 1
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x23c]
mov eax, dword [0x100efe28]
inc eax
mov dword [ebp - 0x22c], 0
push eax
mov dword [ebp - 0x228], 0xf
mov byte [ebp - 0x23c], 0
mov dword [ebp - 0x220], 1
call fcn.100133d0
push 0x100efe18
lea ecx, [ebp - 0x23c]
call fcn.100123a0
push 0x100d73a0
lea ecx, [ebp - 0x23c]
call fcn.10012330
cmp dword [ebp - 0x228], 0x10
lea ecx, [ebp - 0x21c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push ecx
push 0xf003f
push 0
push eax
push closesocket
call esi
test eax, eax
jne 0x10092d45
push 0x100eff20
lea edx, [ebp - 0x23c]
lea ecx, [ebp - 0x254]
call fcn.1001b650
add esp, 4
push 0x100d73a0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10012330
mov dword [ebp - 0x260], 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x25c], 0
push ecx
movups xmm0, xmmword [eax]
push 0xf003f
push 0
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x220], 3
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x260], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x270]
cmp dword [ebp - 0x25c], 0x10
cmovae eax, dword [ebp - 0x270]
push eax
push closesocket
call esi
mov edx, dword [ebp - 0x25c]
mov esi, eax
cmp edx, 0x10
jb 0x10092c1a
mov ecx, dword [ebp - 0x270]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10092c10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10092d9b
push edx
push ecx
call fcn.10097faf
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x240]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0xf
mov byte [ebp - 0x270], 0
cmp edx, 0x10
jb 0x10092c73
mov ecx, dword [ebp - 0x254]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10092c69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10092da0
push edx
push ecx
call fcn.10097faf
add esp, 8
test esi, esi
jne 0x10092d45
push 6
push str.SVSync
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x224], 0x104
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x254], 0
call fcn.1000ecc0
cmp dword [ebp - 0x240], 0x10
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push esi
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push esi
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10092cf6
mov al, byte [ebp - 0x218]
mov byte [ebp - 0x255], 1
mov byte [ebp - 0x256], al
mov edx, dword [ebp - 0x240]
cmp edx, 0x10
jb 0x10092d30
mov ecx, dword [ebp - 0x254]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10092d26
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10092da5
push edx
push ecx
call fcn.10097faf
add esp, 8
cmp byte [ebp - 0x255], 0
je 0x10092d45
movzx ecx, byte [ebp - 0x256]
call fcn.10027560
mov edx, dword [ebp - 0x228]
cmp edx, 0x10
jb 0x10092d7b
mov ecx, dword [ebp - 0x23c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10092d71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10092daa
push edx
push ecx
call fcn.10097faf
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097f9e
mov esp, ebp
pop ebp
ret
call fcn.1009d41c
call fcn.1009d41c
call fcn.1009d41c
call fcn.1009d41c
call fcn.1009d41c
int3