Function at 0x10021580
Capabilities:
Create directory
Create thread
Delete file
Get file size
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x938
mov eax, dword [0x1006100c]
xor eax, esp
mov dword [esp + 0x934], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x324]
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
mov dword [esp + 0x94], 1
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x104
push eax
lea eax, [esp + 0x324]
push eax
lea eax, [esp + 0x9c]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10021634
push str.Steam.exe
lea eax, [esp + 0x324]
push 0x104
push eax
call fcn.10034b21
add esp, 0xc
lea edx, [esp + 0x320]
mov ecx, 0x100658a8
call fcn.10008c00
cmp eax, 1
jne 0x10021634
mov byte [0x10063b97], al
push 0x5c
push 0x100658a8
call fcn.1002bfd0
add esp, 8
test eax, eax
je 0x10021651
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x10063fb8
call fcn.1002bfd0
add esp, 8
test eax, eax
je 0x10021669
xor ecx, ecx
mov word [eax], cx
cmp byte [0x10063b97], 0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jne 0x10021a8b
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x10064c04
call esi
push 0x1000000
push 0
push 0x10066870
call esi
push 0x1000000
push 0
push 0x10065048
call esi
push 0x10021540
call fcn.1003474a
add esp, 4
push 0x10021560
call fcn.10034f00
add esp, 4
push 0x104
push 0x10065060
push 0x100593f4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x10065ab8
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x10021906
nop dword [eax]
test eax, eax
je 0x10021906
push 0x10065060
push str.SoftwareGL2023AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10065bc8
call fcn.100012e0
add esp, 0x14
push 0x10065ab8
push str.SoftwareGL2023AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10065490
call fcn.100013a0
add esp, 0x14
push 0x10065ab8
push str.SoftwareGL2023AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x100657a0
call fcn.100013a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, ds:[esp + 0x60]
add esp, 0x14
mov dword [esp + 0x4c], 0
mov dword [esp + 0x74], 4
mov dword [esp + 0x9c], 4
push eax
push 0x20019
push 0
push 0x10065bc8
push 0x80000001
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100217d5
lea eax, [esp + 0x9c]
push eax
push 0x10061a60
lea eax, [esp + 0x7c]
push eax
push 0
push str.StatsLimit
push dword [esp + 0x60]
call edi
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
push eax
push 0x20019
push 0
push 0x10065bc8
push 0x80000001
mov dword [esp + 0x90], 4
mov dword [esp + 0x8c], 4
call esi
test eax, eax
jne 0x10021838
lea eax, [esp + 0x78]
push eax
push 0x10061a64
lea eax, [esp + 0x84]
push eax
push 0
push str.AchievementsLimit
push dword [esp + 0x64]
call edi
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0
push eax
push 0x20019
push 0
push 0x10065bc8
push 0x80000001
mov dword [esp + 0x98], 4
mov dword [esp + 0x94], 4
call esi
test eax, eax
jne 0x1002189e
lea eax, [esp + 0x80]
push eax
push 0x10061a68
lea eax, [esp + 0x8c]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [esp + 0x68]
call edi
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0
push eax
push 0x20019
push 0
push 0x10065bc8
push 0x80000001
mov dword [esp + 0xa0], 4
mov dword [esp + 0x9c], 4
call esi
test eax, eax
jne 0x10021906
lea eax, [esp + 0x88]
push eax
push 0x10064c24
lea eax, [esp + 0x94]
push eax
push 0
push str.DisableGL2023ServerTicket
push dword [esp + 0x6c]
call edi
push dword ds:[esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100658a8
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10065268
call fcn.100012e0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10065268
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x10021959
push eax
call esi
mov byte [0x10063fb7], 1
push str.GreenLuma_2023_is_loaded__r_n
nop
call fcn.10002100
add esp, 4
push 0x10066450
push str.Exe______s_r_n
call fcn.100023c0
add esp, 8
cmp byte [0x10063fb7], 0
jne 0x10021a02
push 0x208
lea eax, [esp + 0x52c]
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
mov dword [esp + 0x60], 1
lea eax, [esp + 0x68]
mov dword [esp + 0x68], 0x104
push eax
lea eax, [esp + 0x52c]
push eax
lea eax, [esp + 0x68]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x100219f6
push 0x10
push str.GreenLuma_2023
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, ds:[esp + 0x528]
push eax
jmp 0x10021a07
push 0x100658a8
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10063da0
call fcn.100012e0
add esp, 0x14
push 0x100658a8
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x100641c8
call fcn.100012e0
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x100641c8
call edi
cmp eax, 0xffffffff
je 0x10021d02
push eax
call esi
push 0x100641c8
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.100023c0
add esp, 8
push 8
push 0
push 0x100641c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x10021d02
push str.appcache_appinfo.vdf
call edi
push str.appcachepackageinfo.vdf
call edi
mov edx, str.User32.dll
mov ecx, 0x10070af8
call fcn.10008c00
cmp eax, 1
jne 0x10021be5
mov byte [0x10063b95], al
mov byte [0x10063b96], al
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.GreenLuma_2023_is_loaded__r_n
call fcn.10002100
add esp, 4
push 0x10066450
push str.Exe______s_r_n
call fcn.100023c0
push 0x10063fb8
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10066898
call fcn.100012e0
add esp, 0x1c
push 0x10063fb8
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10064e40
call fcn.100012e0
add esp, 0x14
push 0x10063fb8
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10064c30
call fcn.100012e0
add esp, 0x14
push 0x100658a8
push str._s_binx64launcher.exe
push 0xffffffffffffffff
push 0x104
push 0x10065598
call fcn.100012e0
add esp, 0x14
cmp byte [0x10063b95], 1
jne 0x10021cb4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x10065598
call esi
mov dword [esp + 0x60], eax
cmp eax, 0xffffffff
je 0x10021c98
lea ecx, [esp + 0x68]
mov dword [esp + 0x68], 0
push ecx
push eax
mov dword [esp + 0x74], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [esp + 0x60]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10021c7c
cmp dword [esp + 0x6c], 0
jl 0x10021cce
jg 0x10021bd7
cmp dword [esp + 0x68], 0x30d40
jbe 0x10021cce
push 0x10066ca8
call edi
nop
jmp 0x10021cce
cmp byte [0x10063b95], 0
jne 0x10021abb
push 0x10063fb8
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x10066ca8
call fcn.100012e0
add esp, 0x14
push 0x10063fb8
push str._sPatchingDone.bin
push 0xffffffffffffffff
push 0x104
push 0x10063da0
call fcn.100012e0
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10066ca8
call esi
cmp eax, 0xffffffff
je 0x10021c65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x10063b95], 1
nop dword [eax]
jmp 0x10021ac1
push 0x1000000
push 0
push 0x10064c04
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
jmp 0x10021ac1
push 0x10
push str.GreenLuma_2023
push str.Failed_to_get_size_of_x64launcher.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2023
push str.Failed_to_open_x64launcher.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10021540
call fcn.1003474a
add esp, 4
push 0x10021560
call fcn.10034f00
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10066898
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10021d02
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10066898
call edi
mov byte [0x10063b96], 1
push 0x10070af8
push str.GreenLuma_2023_Dll______s_r_n
call fcn.100023c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x10070d1c], eax
call fcn.10002100
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
cmp byte [0x10063b97], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jne 0x10022351
push 0
push 0x80
push 3
push 0
push 1
push 0
push 0x10064c30
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10021e08
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10063b96], 1
nop dword [eax]
je 0x10021fa6
push 0x24
push str.GreenLuma_2023
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop word [eax + eax]
sub eax, 6
je 0x10021fa6
sub eax, 1
jne 0x10021e08
xor esi, esi
push 0x208
lea eax, [esp + 0x11c]
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
lea eax, [esp + 0x118]
push esi
push 0x10064e40
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100012e0
add esp, 0x18
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x95
jb 0x10021db0
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x100641c0], eax
call fcn.10033685
add esp, 4
push eax
push 0x10059924
push 0x10059928
push 0x1006686c
call fcn.1003359d
push 1
call fcn.10033685
add esp, 0x14
push eax
push 0x10059938
push 0x1005993c
push 0x10064c00
call fcn.1003359d
push 2
call fcn.10033685
add esp, 0x14
push eax
push 0x10059938
push 0x1005993c
push 0x10066658
call fcn.1003359d
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_149_:
movaps xmmword [esp + 0xb4], xmm0
call fcn.10001260
add esp, 0x14
push 0
call fcn.10033685
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.10034d3e
add esp, 0xc
test eax, eax
je 0x10021f88
nop dword [eax + eax]
lea ecx, [esp + 0xa0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021ed0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x100237ee
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xa8], ax
lea eax, [esp + 0xa8]
push eax
call fcn.10033ffb
add esp, 0xc
mov esi, eax
mov dword [esp + 0x20], esi
call fcn.10034e40
cmp dword ds:[eax], 0x22
je 0x10022335
test esi, esi
je 0x10021f36
cmp esi, 0x95
jbe 0x100221b5
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_149_:
movaps xmmword [esp + 0xa4], xmm0
call fcn.10001260
add esp, 4
push 0
call fcn.10033685
add esp, 4
push eax
lea eax, [esp + 0xa4]
push 0xa
push eax
call fcn.10034d3e
add esp, 0xc
test eax, eax
jne 0x10021ec0
push 0x10
push str.GreenLuma_2023
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
nop dword [eax + eax]
push 0x208
lea eax, [esp + 0x11c]
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
lea eax, [esp + 0x118]
push esi
push 0x10064e40
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100012e0
push 0x100529d8
lea eax, [esp + 0x134]
mov dword [esp + 0x78], 0
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.100342f6
add esp, 0x24
test eax, eax
jne 0x1002208c
push dword [esp + 0x5c]
mov dword [esp + 0xd4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xc4]
movaps xmmword [esp + 0xc4], xmm0
push 0x14
push eax
call fcn.10034d33
add esp, 0xc
test eax, eax
je 0x10022199
push dword [esp + 0x5c]
call fcn.10034492
add esp, 4
lea eax, [esp + 0xc0]
push 0xa
push 0
push eax
call fcn.10033fb5
add esp, 0xc
mov dword [esi*4 + 0x100661f8], eax
call fcn.10034e40
cmp dword [eax], 0x22
je 0x1002217d
inc esi
cmp esi, 0x95
jb 0x10021fb0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.10025690
cmp dword [0x1007113c], 0
nop
jne 0x100237a6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1007113c], eax
xor ecx, ecx
mov edx, 0x10071138
xchg dword [edx], ecx
test eax, eax
je 0x100237af
mov edx, str.User32.dll
mov ecx, 0x10070af8
call fcn.10008c00
test eax, eax
jne 0x10022508
lea eax, [esp + 0x98]
mov dword [esp + 0x64], 1
push eax
push 0x10066660
lea eax, [esp + 0x6c]
mov dword [esp + 0xa0], 0x104
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [eax + eax]
test eax, eax
je 0x100224e9
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.10002100
add esp, 4
mov ecx, 0x208
mov eax, 0x10066660
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10022140
push 0x10063fb8
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x10066660
call fcn.100012e0
add esp, 0x14
push 8
push 0
push 0x10066660
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1002250f
push 0x10
push str.GreenLuma_2023
push str.wcstol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2023
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
cmp dword [esp + 0x20], esi
jbe 0x1002208c
mov ecx, str._nAppID:
nop
test esi, esi
mov eax, str.AppID:
cmove eax, ecx
push eax
call fcn.10001260
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xf0], xmm0
movq qword [esp + 0x100], xmm0
push 0
call fcn.10033685
add esp, 4
push eax
lea eax, [esp + 0xe4]
push 0x14
push eax
call fcn.10034d3e
add esp, 0xc
test eax, eax
je 0x10022319
lea ecx, [esp + 0xe0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022233
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x100237ee
xor eax, eax
push 0xa
push eax
mov word [esp + ecx + 0xe8], ax
lea eax, [esp + 0xe8]
push eax
call fcn.10033ffb
add esp, 0xc
mov dword [esi*4 + 0x100661f8], eax
call fcn.10034e40
cmp dword ds:[eax], 0x22
je 0x100222fd
push 0
push 0x10064e40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x734]
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
lea eax, [esp + 0x730]
push esi
push 0x10064e40
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100012e0
push dword [esi*4 + 0x100661f8]
lea eax, ds:[esp + 0x74c]
push 0x10059ad8
push eax
call fcn.10002c00
inc esi
add esp, 0x24
mov ecx, str._nAppID:
cmp esi, dword [esp + 0x20]
jb 0x100221d0
jmp 0x1002208c
push 0x10
push str.GreenLuma_2023
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2023
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2023
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10063fb8
push str._sGreenLuma2023_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x10065de0
call fcn.100012e0
add esp, 0x14
push 0x10065060
push 0x10063fb8
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x100647f0
call fcn.100012e0
push 0x10065060
push 0x10063fb8
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10066aa0
call fcn.100012e0
push 0x10063fb8
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x10070f28
call fcn.100012e0
add esp, 0x44
push 0x10063fb8
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x100645e0
call fcn.100012e0
add esp, 0x14
push 0x10063fb8
push str._sDenuvoActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100649f8
call fcn.100012e0
add esp, 0x14
push 0x10063fb8
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100643d8
call fcn.100012e0
add esp, 0x14
push str.DenuvoActivationBypass.dll
call esi
mov dword [0x10070d00], eax
test eax, eax
jne 0x1002244c
push str.DenuvoOfflineActivationBypass.dll
call esi
mov dword [0x10070d00], eax
test eax, eax
je 0x10022092
push str.GetDenuvoCallResult
push eax
call edi
push str.GetDenuvoID
push dword [0x10070d00]
mov dword [0x10066890], eax
call edi
push str.RequestDenuvoAppTicket
push dword [0x10070d00]
mov dword [0x10065bc0], eax
call edi
push str.GetDenuvoAppTicket
push dword [0x10070d00]
mov dword [0x10066894], eax
call edi
push str.ShutdownDenuvoDll
push dword [0x10070d00]
mov dword [0x10065484], eax
call edi
cmp dword [0x10066890], 0
mov dword [0x10063fb0], eax
je 0x100237ce
cmp dword [0x10065bc0], 0
je 0x100237ce
cmp dword [0x10066894], 0
je 0x100237ce
cmp dword [0x10065484], 0
je 0x100237ce
test eax, eax
je 0x100237ce
mov byte [0x100641c5], 1
jmp 0x10022092
push str.Got_Steamclient_dll_paths_from_registry_r_n
call fcn.10002100
add esp, 4
push 8
push 0
push 0x10066660
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1002250f
push str.steamclient.dll
call esi
mov dword [0x10066868], eax
test eax, eax
je 0x10023786
push str.Steamclient.dll_is_loaded__r_n
call fcn.10002100
add esp, 4
push 0x10066660
push str.Steamclient______s_r_n_r_n
call fcn.100023c0
add esp, 8
cmp byte [0x10063b95], 0
jne 0x10023429
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002255d
mov dword [esp + 0x1c], 0xb
jmp 0x10022589
push str.CreateInterface
push eax
call edi
test eax, eax
jne 0x10022573
mov dword [esp + 0x1c], 0xc
jmp 0x10022589
push 0x10066888
mov edx, 0x10003da0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x1c], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002259e
mov dword [esp + 0x18], 0xb
jmp 0x100225c9
push str.Steam_BGetCallback
push eax
call edi
test eax, eax
jne 0x100225b4
mov dword [esp + 0x18], 0xc
jmp 0x100225c9
push 0x10065ab0
mov edx, 0x10004580
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x18], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x100225de
mov dword [esp + 0x14], 0xb
jmp 0x10022609
push str.Steam_FreeLastCallback
push eax
call edi
test eax, eax
jne 0x100225f4
mov dword [esp + 0x14], 0xc
jmp 0x10022609
push 0x10065478
mov edx, 0x10004740
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x14], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x1002261e
mov dword [esp + 0x10], 0xb
jmp 0x10022649
push str.Steam_GetAPICallResult
push eax
call edi
test eax, eax
jne 0x10022634
mov dword [esp + 0x10], 0xc
jmp 0x10022649
push 0x100647ec
mov edx, 0x10004800
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x10], eax
push str.CreateInterface
push dword [0x10066868]
call edi
mov ecx, eax
call fcn.10025c00
push str.Steam_BGetCallback
push dword [0x10066868]
mov esi, eax
call edi
mov ecx, eax
call fcn.10025c00
push str.Steam_FreeLastCallback
push dword [0x10066868]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10025c00
push str.Steam_GetAPICallResult
push dword [0x10066868]
mov dword ds:[esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10025c00
mov ecx, esi
mov dword [esp + 0x30], eax
call fcn.10025cc0
mov ecx, dword ds:[esp + 0x1c]
push eax
call fcn.10025cc0
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.10002100
add esp, 0xc
mov ecx, edi
call fcn.10025cc0
mov ecx, dword ds:[esp + 0x18]
push eax
call fcn.10025cc0
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x2c]
add esp, 0xc
call fcn.10025cc0
mov ecx, dword [esp + 0x14]
push eax
call fcn.10025cc0
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x3c]
add esp, 0xc
call fcn.10025cc0
mov ecx, dword [esp + 0x10]
push eax
call fcn.10025cc0
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.10002100
add esp, 0xc
cmp byte [0x10063b95], 0
jne 0x10023429
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10022764
mov eax, 0xb
jmp 0x10022788
push str.NtCreateUserProcess
push eax
call esi
test eax, eax
jne 0x10022777
mov eax, 0xc
jmp 0x10022788
push 0x10070d0c
mov edx, 0x10003040
mov ecx, eax
call fcn.100257e0
push str.ntdll.dll
mov dword [0x10070d18], eax
call edi
test eax, eax
jne 0x1002279f
mov eax, 0xb
jmp 0x100227c5
push str.NtResumeThread
push eax
call esi
test eax, eax
jne 0x100227b2
mov eax, 0xc
jmp 0x100227c5
push 0x10065480
mov edx, 0x10003cc0
mov ecx, eax
call fcn.100257e0
push str.ntdll.dll
mov dword [0x10070d04], eax
call edi
test eax, eax
jne 0x100227df
mov dword [esp + 0x34], 0xb
jmp 0x1002280a
push str.LdrLoadDll
push eax
call esi
test eax, eax
jne 0x100227f5
mov dword [esp + 0x34], 0xc
jmp 0x1002280a
push 0x10065ddc
mov edx, 0x10008e40
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x34], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002281f
mov dword [esp + 0x38], 0xb
jmp 0x1002284a
push str.LdrGetDllHandleEx
push eax
call esi
test eax, eax
jne 0x10022835
mov dword [esp + 0x38], 0xc
jmp 0x1002284a
push 0x10070af4
mov edx, 0x10008ec0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x38], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002285f
mov dword [esp + 0x3c], 0xb
jmp 0x1002288a
push str.LdrGetDllFullName
push eax
call esi
test eax, eax
jne 0x10022875
mov dword [esp + 0x3c], 0xc
jmp 0x1002288a
push 0x10064c1c
mov edx, 0x10008f40
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x3c], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002289f
mov dword [esp + 0x40], 0xb
jmp 0x100228ca
push str.LdrGetDllHandleByMapping
push eax
call esi
test eax, eax
jne 0x100228b5
mov dword [esp + 0x40], 0xc
jmp 0x100228ca
push 0x100658a4
mov edx, 0x10008fa0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x40], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x100228df
mov dword [esp + 0x44], 0xb
jmp 0x1002290a
push str.LdrGetDllHandleByName
push eax
call esi
test eax, eax
jne 0x100228f5
mov dword [esp + 0x44], 0xc
jmp 0x1002290a
push 0x10065594
mov edx, 0x10009020
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x44], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002291f
mov dword [esp + 0x48], 0xb
jmp 0x1002294a
push str.LdrQueryProcessModuleInformation
push eax
call esi
test eax, eax
jne 0x10022935
mov dword [esp + 0x48], 0xc
jmp 0x1002294a
push 0x10070af0
mov edx, 0x100090a0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x48], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002295f
mov dword [esp + 0x30], 0xb
jmp 0x1002298a
push str.LdrEnumerateLoadedModules
push eax
call esi
test eax, eax
jne 0x10022975
mov dword [esp + 0x30], 0xc
jmp 0x1002298a
push 0x100643d4
mov edx, 0x100091e0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x30], eax
push str.ntdll.dll
call edi
test eax, eax
jne 0x1002299f
mov dword [esp + 0x20], 0xb
jmp 0x100229ca
push str.RtlLockModuleSection
push eax
call esi
test eax, eax
jne 0x100229b5
mov dword [esp + 0x20], 0xc
jmp 0x100229ca
push 0x10064c2c
mov edx, 0x10009240
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x20], eax
push str.kernel32.dll
call edi
test eax, eax
je 0x100229fd
push str.Module32NextW
push eax
call esi
nop dword [eax]
test eax, eax
je 0x100229fd
push 0x10065488
mov edx, 0x10009260
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x18], eax
test eax, eax
je 0x10022a3d
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10022a12
mov dword [esp + 0x18], 0xb
jmp 0x10022a3d
push str.Module32NextW
push eax
call esi
test eax, eax
jne 0x10022a28
mov dword [esp + 0x18], 0xc
jmp 0x10022a3d
push 0x10065488
mov edx, 0x10009260
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x18], eax
push str.KernelBase.dll
call edi
test eax, eax
je 0x10022bd7
push str.EnumProcessModules
push eax
call esi
test eax, eax
je 0x10022bd7
push 0x1006688c
mov edx, 0x100092e0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x10022bd7
push str.KernelBase.dll
nop
call edi
test eax, eax
jne 0x10022a90
mov dword [esp + 0x24], 0xb
jmp 0x10022abb
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x10022aa6
mov dword [esp + 0x24], 0xc
jmp 0x10022abb
push 0x1006644c
mov edx, 0x10009620
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x24], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10022ad0
mov dword [esp + 0x28], 0xb
jmp 0x10022afb
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x10022ae6
mov dword [esp + 0x28], 0xc
jmp 0x10022afb
push 0x10071134
mov edx, 0x100099a0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x28], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10022b10
mov dword [esp + 0x2c], 0xb
jmp 0x10022b3b
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x10022b26
mov dword [esp + 0x2c], 0xc
jmp 0x10022b3b
push 0x10065dd4
mov edx, 0x10009a60
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x2c], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10022b50
mov dword [esp + 0x10], 0xb
jmp 0x10022b7b
push 0x1005a1b0
push eax
call esi
test eax, eax
jne 0x10022b66
mov dword [esp + 0x10], 0xc
jmp 0x10022b7b
push 0x10071130
mov edx, 0x10009b40
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x10], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10022b98
mov dword [esp + 0x14], 0xb
push str.KernelBase.dll
jmp 0x10022d60
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x10022bb8
mov dword [esp + 0x14], 0xc
push str.KernelBase.dll
jmp 0x10022d60
push 0x10063fa8
mov edx, 0x10009c00
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x14], eax
push str.KernelBase.dll
jmp 0x10022d60
push str.Psapi.dll
call edi
nop
test eax, eax
jne 0x10022bee
mov dword [esp + 0x1c], 0xb
jmp 0x10022c19
push str.EnumProcessModules
push eax
call esi
test eax, eax
jne 0x10022c04
mov dword [esp + 0x1c], 0xc
jmp 0x10022c19
push 0x1006688c
mov edx, 0x100092e0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x1c], eax
push str.Psapi.dll
nop
call edi
test eax, eax
jne 0x10022c30
mov dword [esp + 0x24], 0xb
jmp 0x10022c5b
push str.EnumProcessModulesEx
push eax
call esi
test eax, eax
jne 0x10022c46
mov dword [esp + 0x24], 0xc
jmp 0x10022c5b
push 0x1006644c
mov edx, 0x10009620
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x24], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10022c70
mov dword [esp + 0x28], 0xb
jmp 0x10022c9b
push str.GetModuleInformation
push eax
call esi
test eax, eax
jne 0x10022c86
mov dword [esp + 0x28], 0xc
jmp 0x10022c9b
push 0x10071134
mov edx, 0x100099a0
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x28], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10022cb0
mov dword [esp + 0x2c], 0xb
jmp 0x10022cdb
push str.GetModuleBaseNameW
push eax
call esi
test eax, eax
jne 0x10022cc6
mov dword [esp + 0x2c], 0xc
jmp 0x10022cdb
push 0x10065dd4
mov edx, 0x10009a60
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x2c], eax
push str.KernelBase.dll
call edi
test eax, eax
jne 0x10022cf0
mov dword [esp + 0x10], 0xb
jmp 0x10022d1b
push 0x1005a1b0
push eax
call esi
test eax, eax
jne 0x10022d06
mov dword [esp + 0x10], 0xc
jmp 0x10022d1b
push 0x10071130
mov edx, 0x10009b40
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x10], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10022d30
mov dword [esp + 0x14], 0xb
jmp 0x10022d5b
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
jne 0x10022d46
mov dword [esp + 0x14], 0xc
jmp 0x10022d5b
push 0x10063fa8
mov edx, 0x10009c00
mov ecx, eax
call fcn.100257e0
mov dword [esp + 0x14], eax
push str.Psapi.dll
call edi
test eax, eax
jne 0x10022d6b
lea esi, [eax + 0xb]
jmp 0x10022d8f
push str.GetMappedFileNameW
push eax
call esi
test eax, eax
jne 0x10022d7c
lea esi, [eax + 0xc]
jmp 0x10022d8f
push 0x10064c28
mov edx, 0x10009ce0
mov ecx, eax
call fcn.100257e0
mov esi, eax
call fcn.10025690
cmp dword [0x1007113c], 0
je 0x10022dab
mov ecx, 1
call fcn.10025600
mov edi, eax
jmp 0x10022db0
mov edi, 2
xor eax, eax
mov ecx, 0x10071138
xchg dword [ecx], eax
mov eax, dword [0x10070d18]
inc eax
cmp eax, 0xd
ja case.default.0x10022dc9
jmp dword [eax*4 + 0x100237f4]
mov eax, str.MH_UNKNOWN
jmp 0x10022e3f
mov eax, str.MH_OK
nop
jmp 0x10022e3f
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10022e3f
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10022e3f
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10022e3f
mov eax, str.MH_ERROR_NOT_CREATED
nop
jmp 0x10022e3f
mov eax, str.MH_ERROR_ENABLED
jmp 0x10022e3f
mov eax, str.MH_ERROR_DISABLED
jmp 0x10022e3f
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10022e3f
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10022e3f
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10022e3f
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10022e3f
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10022e3f
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10022e3f
mov eax, str._unknown_
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.10002100
mov eax, dword [0x10070d04]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10022e60
nop dword [eax]
jmp dword [eax*4 + 0x1002382c]
mov eax, str.MH_UNKNOWN
jmp 0x10022ed8
mov eax, str.MH_OK
jmp 0x10022ed8
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10022ed8
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10022ed8
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10022ed8
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10022ed8
mov eax, str.MH_ERROR_ENABLED
nop
jmp 0x10022ed8
mov eax, str.MH_ERROR_DISABLED
jmp 0x10022ed8
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10022ed8
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10022ed8
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10022ed8
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10022ed8
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10022ed8
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10022ed8
mov eax, str._unknown_
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.10002100
mov eax, dword [esp + 0x3c]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10022ef6
jmp dword [eax*4 + 0x10023864]
mov eax, str.MH_UNKNOWN
jmp 0x10022f71
mov eax, str.MH_OK
jmp 0x10022f71
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10022f71
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10022f71
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10022f71
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10022f71
mov eax, str.MH_ERROR_ENABLED
jmp 0x10022f71
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10022f71
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10022f71
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10022f71
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10022f71
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10022f71
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10022f71
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10022f71
mov eax, str._unknown_
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.10002100
mov eax, dword [esp + 0x40]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10022f8d
jmp dword [eax*4 + 0x1002389c]
mov eax, str.MH_UNKNOWN
jmp 0x10023007
mov eax, str.MH_OK
jmp 0x10023007
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10023007
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10023007
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10023007
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10023007
mov eax, str.MH_ERROR_ENABLED
jmp 0x10023007
mov eax, str.MH_ERROR_DISABLED
jmp 0x10023007
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10023007
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10023007
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10023007
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10023007
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10023007
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10023007
mov eax, str._unknown_
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.10002100
mov eax, dword ds:[esp + 0x44]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10023029
jmp dword [eax*4 + 0x100238d4]
mov eax, str.MH_UNKNOWN
jmp 0x100230aa
mov eax, str.MH_OK
nop
jmp 0x100230aa
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x100230aa
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x100230aa
mov eax, str.MH_ERROR_ALREADY_CREATED
nop
jmp 0x100230aa
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x100230aa
mov eax, str.MH_ERROR_ENABLED
jmp 0x100230aa
mov eax, str.MH_ERROR_DISABLED
jmp 0x100230aa
mov eax, str.MH_ERROR_NOT_EXECUTABLE
nop
jmp 0x100230aa
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x100230aa
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x100230aa
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x100230aa
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x100230aa
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x100230aa
mov eax, str._unknown_
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.10002100
mov eax, dword ds:[esp + 0x48]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x100230c9
jmp dword [eax*4 + 0x1002390c]
mov eax, str.MH_UNKNOWN
jmp 0x1002314a
mov eax, str.MH_OK
nop
jmp 0x1002314a
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x1002314a
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x1002314a
mov eax, str.MH_ERROR_ALREADY_CREATED
nop
jmp 0x1002314a
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x1002314a
mov eax, str.MH_ERROR_ENABLED
jmp 0x1002314a
mov eax, str.MH_ERROR_DISABLED
jmp 0x1002314a
mov eax, str.MH_ERROR_NOT_EXECUTABLE
nop
jmp 0x1002314a
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x1002314a
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x1002314a
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x1002314a
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x1002314a
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x1002314a
mov eax, str._unknown_
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.10002100
mov eax, dword ds:[esp + 0x4c]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x10023169
jmp dword [eax*4 + 0x10023944]
mov eax, str.MH_UNKNOWN
jmp 0x100231ee
mov eax, str.MH_OK
nop
jmp 0x100231ee
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x100231ee
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x100231ee
mov eax, str.MH_ERROR_ALREADY_CREATED
nop
jmp 0x100231ee
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x100231ee
mov eax, str.MH_ERROR_ENABLED
jmp 0x100231ee
mov eax, str.MH_ERROR_DISABLED
jmp 0x100231ee
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x100231ee
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x100231ee
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x100231ee
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x100231ee
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
nop
jmp 0x100231ee
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x100231ee
mov eax, str._unknown_
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.10002100
mov eax, dword [esp + 0x50]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x1002320a
jmp dword [eax*4 + 0x1002397c]
mov eax, str.MH_UNKNOWN
jmp 0x10023291
mov eax, str.MH_OK
jmp 0x10023291
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10023291
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10023291
mov eax, str.MH_ERROR_ALREADY_CREATED
nop
jmp 0x10023291
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10023291
mov eax, str.MH_ERROR_ENABLED
jmp 0x10023291
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10023291
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10023291
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10023291
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10023291
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10023291
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10023291
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10023291
mov eax, str._unknown_
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.10002100
mov eax, dword [esp + 0x38]
add esp, 8
inc eax
cmp eax, 0xd
ja case.default.0x100232ad
jmp dword [eax*4 + 0x100239b4]
mov eax, str.MH_UNKNOWN
jmp 0x10023331
mov eax, str.MH_OK
jmp 0x10023331
mov eax, str.MH_ERROR_ALREADY_INITIALIZED
jmp 0x10023331
mov eax, str.MH_ERROR_NOT_INITIALIZED
jmp 0x10023331
mov eax, str.MH_ERROR_ALREADY_CREATED
jmp 0x10023331
mov eax, str.MH_ERROR_NOT_CREATED
jmp 0x10023331
mov eax, str.MH_ERROR_ENABLED
jmp 0x10023331
mov eax, str.MH_ERROR_DISABLED
nop
jmp 0x10023331
mov eax, str.MH_ERROR_NOT_EXECUTABLE
jmp 0x10023331
mov eax, str.MH_ERROR_UNSUPPORTED_FUNCTION
jmp 0x10023331
mov eax, str.MH_ERROR_MEMORY_ALLOC
jmp 0x10023331
mov eax, str.MH_ERROR_MEMORY_PROTECT
jmp 0x10023331
mov eax, str.MH_ERROR_MODULE_NOT_FOUND
jmp 0x10023331
mov eax, str.MH_ERROR_FUNCTION_NOT_FOUND
jmp 0x10023331
mov eax, str._unknown_
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x28]
add esp, 8
call fcn.10025cc0
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x20]
add esp, 8
call fcn.10025cc0
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x24]
add esp, 8
call fcn.10025cc0
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x2c]
add esp, 8
call fcn.10025cc0
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x30]
add esp, 8
call fcn.10025cc0
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x34]
add esp, 8
call fcn.10025cc0
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x18]
add esp, 8
call fcn.10025cc0
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.10002100
mov ecx, dword [esp + 0x1c]
add esp, 8
call fcn.10025cc0
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.10002100
add esp, 8
mov ecx, esi
call fcn.10025cc0
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.10002100
add esp, 8
mov ecx, edi
call fcn.10025cc0
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.10002100
add esp, 8
cmp byte [0x10063b97], 1
jne 0x10023694
push dword [0x10066868]
nop dword [eax]
call dword [0x100643d0]
mov ecx, dword [0x10066868]
mov edi, eax
push str.xxxxxxxxxxxx
push 0x1005a4ac
mov edx, dword [edi + 0x50]
call fcn.10001d60
add esp, 8
mov dword [0x10065dd0], eax
test eax, eax
je 0x100234ca
push str.InternalGetInt_Pattern_found_r_n
call fcn.10002100
mov ecx, dword [0x10065dd0]
add esp, 4
mov edx, 0x10002ce0
mov dword [0x10065fe8], ecx
push 0x10065fe8
call fcn.100257e0
mov ecx, dword [0x10065dd0]
mov esi, eax
call fcn.10025c00
mov ecx, eax
call fcn.10025cc0
push eax
mov ecx, esi
call fcn.10025cc0
push eax
push str.InternalGetInt_Hook______s______s_r_n_r_n
call fcn.10002100
add esp, 0xc
jmp 0x100234d7
push str.InternalGetInt_Pattern__0_r_n_r_n
call fcn.10002100
add esp, 4
cmp byte [0x10063b95], 0
nop
jne 0x10023593
mov esi, dword ds:[edi + 0x50]
mov edx, esi
mov ecx, dword [0x10066868]
push str.xxxxxxxxxxxxx
push 0x1005a534
call fcn.10001d60
mov edi, eax
add esp, 8
test edi, edi
jne 0x10023545
mov ecx, dword [0x10066868]
mov edx, esi
push str.xxxxxxxxxxxxx
push 0x1005a544
call fcn.10001d60
mov edi, eax
add esp, 8
test edi, edi
jne 0x10023545
push str.GetLegacyCDKey_Pattern__0_r_n_r_n
call fcn.10002100
add esp, 4
jmp 0x10023593
push str.GetLegacyCDKey_Pattern_found_r_n
call fcn.10002100
add esp, 4
mov dword [0x1006665c], edi
mov edx, 0x100049c0
mov ecx, edi
push 0x1006665c
call fcn.100257e0
mov ecx, edi
mov esi, eax
call fcn.10025c00
mov ecx, eax
call fcn.10025cc0
push eax
mov ecx, esi
call fcn.10025cc0
push eax
push str.GetLegacyCDKey_Hook______s______s_r_n_r_n
call fcn.10002100
add esp, 0xc
cmp dword [0x100641c0], 1
nop word [eax + eax]
jne 0x100235e6
mov eax, dword [0x1006686c]
test eax, eax
je 0x100235b8
push eax
call fcn.10034492
add esp, 4
mov eax, dword [0x10064c00]
nop dword [eax]
test eax, eax
je 0x100235cd
push eax
call fcn.10034492
add esp, 4
mov eax, dword [0x10066658]
test eax, eax
je 0x100235df
push eax
call fcn.10034492
add esp, 4
nop
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x208
call fcn.1002ad6f
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.1002c2e0
add esp, 0xc
push 0x100658a8
push str._spackage_beta
push 0xffffffffffffffff
push 0x104
push esi
call fcn.100012e0
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [eax + eax]
cmp eax, 0xffffffff
je 0x10023671
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.You_are_using_Steam_beta_files__GreenLuma_might_not_work_correctly__r_n
call fcn.10002100
add esp, 4
push 0x30
push str.Beta
push str.You_are_using_Steam_beta_files__GreenLuma_might_not_work_correctly_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x208
mov eax, esi
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10023680
push esi
call fcn.1002a815
add esp, 4
cmp byte [0x10063b95], 1
nop dword [eax + eax]
jne 0x100236cf
push 0
push 0
push 0
push 0x10021480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [eax + eax]
test eax, eax
je 0x1002374d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, str.User32.dll
mov ecx, 0x10070af8
nop
call fcn.10008c00
test eax, eax
jne 0x10023737
push eax
push 0x80
push 2
push eax
push 2
push 0x40000000
push 0x10063da0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10023768
push 0
lea eax, [esp + 0x68]
mov dword [esp + 0x68], 0
push eax
push 1
push 0x1005a6f4
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x93c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x10
push str.GreenLuma_2023
push str.Stealth_mode_failed___2_
push 0
call edi
jmp 0x100236d5
push 0x10
push str.GreenLuma_2023
push 0x1005a6f8
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2023
push str.Unable_to_load_Steamclient.dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, 0x10071138
xchg dword [ecx], eax
push 0x10
push str.GreenLuma_2023
push str.Unable_to_initialize_MinHook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2023
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002a93c
nop
shr byte [0x2dda1002], 1
add dl, byte [eax]
in eax, 0x2d
add dl, byte [eax]
in al, dx
sub eax, 770904066
add dl, byte [eax]
cli
sub eax, 771887106
add dl, byte [eax]
or dword [esi], ebp
add dl, byte [eax]
adc byte [esi], ch
add dl, byte [eax]
pop ss
add dl, byte cs:[eax]
push ds
add dl, byte cs:[eax]
and eax, 0x2c10022e
add dl, byte cs:[eax]
xor ebp, dword [esi]
add dl, byte [eax]
add dl, byte cs:[bx + si]
jno 268580960
add dl, byte [eax]
jnp 0x10023864
add dl, byte [eax]
test dword [esi], ebp
add dl, byte [eax]
mov word [esi], gs
add dl, byte [eax]
xchg ebx, eax
add dl, byte cs:[eax]
lcall 0x22e, 0xa210022e
adc byte [ecx - 1341128146], ch
add dl, byte cs:[eax]
mov bh, 0x2e
add dl, byte [eax]
mov esi, 0xc510022e
add dl, byte cs:[eax]
int3
std
add dl, byte cs:[eax]
pop es
das
add dl, byte [eax]
adc dword [edi], ebp
add dl, byte [eax]
sbb ebp, dword [edi]
add dl, byte [eax]
and eax, 0x2c10022f
das
add dl, byte [eax]
xor ebp, dword [edi]
add dl, byte [eax]
cmp ch, byte [edi]
add dl, byte [eax]
inc edx
das
add dl, byte [eax]
dec ecx
das
add dl, byte [eax]
push eax
das
add dl, byte [eax]
push edi
das
add dl, byte [eax]
pop esi
das
add dl, byte [eax]
das
add dl, byte [eax]
xchg esp, eax
das
add dl, byte [eax]
sahf
das
add dl, byte [eax]
test al, 0x2f
add dl, byte [eax]
mov dl, 0x2f
add dl, byte [eax]
mov esp, 0xc310022f
das
add dl, byte [eax]
retf 0x22f