Function at 0x100118f0
Capabilities:
Check os version
Create thread
Query or enumerate registry value
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004176e
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
push esi
push edi
mov eax, dword [0x10053064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10012350
call sym.NLGuard.dll_sbajo
cmp dword [0x100589b8], 1
jne 0x10011a76
push str.USER32.DLL
mov dword [ebp - 0x2c], vtable.CSplash.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], str.SPLASH
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10
push 0
push 0
push 0
push str..GameGuard_Protect.bmp
push 0
mov dword [0x10058934], eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10011995
push eax
call esi
mov dword [ebp - 0x18], 0
test edi, edi
je 0x100119dc
lea eax, [ebp - 0x108]
mov dword [ebp - 0x18], edi
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x100119ca
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100119c1
push eax
call esi
mov dword [ebp - 0x18], 0
jmp 0x100119dc
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x808080
test eax, eax
je 0x10011a1d
cmp dword [0x10058934], 0
je 0x10011a1d
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [0x10058934]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10016de0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10011a5e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], vtable.CSplash.0
test eax, eax
je 0x10011a76
push eax
call esi
cmp dword [0x10058a1c], 0
jne 0x10011a88
cmp dword [0x10058a24], 1
jne 0x10011ad8
cmp dword [0x10059760], 0xb7
jne 0x10011ad8
mov eax, dword [0x10058a08]
push 0x200030
push dword [0x10058984]
cmp eax, 1
jne 0x10011abe
push str.SI_Scan_n_nAnti_kill_active__just_one_Game_instance_allowed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10011aa9
push str.SI_Scan_n_nO_Sistema_Anti_kill_permite_apenas_uma_instancia_de_jogo_aberta_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100589fc], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
jne 0x10011b4a
call esi
cmp al, 6
jae 0x10011af9
mov dword [0x10058920], 1
jmp 0x10011b4a
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10011b4a
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.MoveImages
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10011b45
mov dword [0x10058918], 1
jmp 0x10011b4a
call fcn.10006c70
cmp dword [0x10058a28], 1
jne 0x10011c95
sub esp, 8
lea ecx, [ebp - 0xf0]
push 1
push dword [0x10058940]
call fcn.10006d80
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xe4], 6
je 0x10011c1a
call esi
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
sbb eax, eax
and eax, ecx
cmp eax, 0x1770
jae 0x10011bb3
mov dword [0x10058920], 1
call fcn.10006890
jmp 0x10011bb8
call fcn.10006c70
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.10002f40
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf4], eax
mov dword [ebp - 4], 2
jmp 0x10011c7b
mov dword [ebp + eax - 0xf0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov dword [0x1005891c], 1
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.10002f40
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf4], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], vtable.std::ios_base.0
push eax
call fcn.1001913a
mov dword [ebp - 4], 0xffffffff
add esp, 4
cmp dword [0x100589c8], 1
jne 0x10011caf
push 0
push 0
push 0x10015430
call fcn.10025b9f
add esp, 0xc
cmp dword [0x10058a1c], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10011cf1
push 0
push 0
push 0
push 0x10008e90
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10008960
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10008c80
push 0
push 0
call edi
cmp dword [0x10058a24], 0
je 0x10011d85
call fcn.10008050
cmp dword [0x10058a28], 1
jne 0x10011d15
cmp dword [0x1005891c], 0
je 0x10011d85
cmp dword [0x100589fc], 1
jne 0x10011d30
cmp dword [0x10058920], 0
jne 0x10011d30
cmp dword [0x10058918], 0
je 0x10011d85
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push 8
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10011d6e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x14
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x30]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10011d7c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
je 0x10012368
cmp dword [0x10058a30], 1
je 0x1001236d
cmp dword [0x10058a34], 1
je 0x10012372
cmp dword [0x10058a68], 1
jne 0x10011db9
push 0
push 0
push 0
push 0x10018ae0
push 0
push 0
call edi
cmp dword [0x10058a14], 1
jne 0x10011dd3
push 0
push 0
push 0
push 0x10009f70
push 0
push 0
call edi
cmp dword [0x10058a5c], 1
jne 0x10011e0e
push 0x1004b938
call fcn.100207ff
push 0x1004b93c
call fcn.100207ff
push 0x1004b708
call fcn.100207ff
add esp, 0xc
push 0
push 0
push 0
push 0x1000e4a0
push 0
push 0
call edi
cmp dword [0x10058a54], 1
jne 0x10011e31
cmp dword [0x100589c4], 0
jne 0x10011e31
push 0
push 0
push 0
push 0x1000b150
push 0
push 0
call edi
cmp dword [0x100589a4], 1
jne 0x10012099
mov edx, str._Start.cpp___load.PAUSE_ALL_DETECTORS__Turned_ON_
mov ecx, 0x10057c68
call fcn.10004300
push eax
call fcn.10008170
mov edx, str.All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov ecx, 0x10057c68
call fcn.10004300
push eax
call fcn.10008170
add esp, 8
cmp dword [0x10058a04], 1
jne 0x10011f56
sub esp, 8
lea ecx, [ebp - 0xe8]
push 8
push str.GameGuard_Log.txt
call fcn.100032f0
mov edx, str._Start.cpp___load.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xe8]
call fcn.10004300
lea ecx, [ebp - 0xe4]
call fcn.10003b40
test eax, eax
jne 0x10011edc
mov eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0xe8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d60
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xec], eax
lea ecx, [ebp - 0xe4]
call fcn.10002f40
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xec], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 6
push eax
mov dword [ebp - 0x80], vtable.std::ios_base.0
call fcn.1001913a
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10058a14], 1
jne 0x1001222d
lea eax, [ebp - 0x38]
push eax
call fcn.1001f71e
lea eax, [ebp - 0x38]
push eax
call fcn.1001fa17
push 8
push 0x1004a540
lea ecx, [ebp - 0x1b8]
mov esi, eax
call fcn.100032f0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x1b8]
call fcn.10004300
push esi
call fcn.1001e738
add esp, 4
lea ecx, [ebp - 0x1b8]
mov edx, eax
call fcn.10004300
mov edx, str._Start.cpp___load.PAUSE_ALL_DETECTORS__Turned_ON__All_Anti_hack_detectors_and_anti_kill_by_scan_are_PAUSED_
lea ecx, [ebp - 0x1b8]
call fcn.10004300
mov edx, str._n__________________
lea ecx, [ebp - 0x1b8]
call fcn.10004300
lea ecx, [ebp - 0x1b4]
call fcn.10003b40
test eax, eax
jne 0x1001200e
mov eax, dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1b8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d60
push 2
push 0x1004a540
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1bc], eax
lea ecx, [ebp - 0x1b4]
call fcn.10002f40
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1bc], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 4], 8
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1001913a
add esp, 4
jmp 0x1001222d
cmp dword [0x100589b4], 1
jne 0x100120b3
push 0
push 0
push 0
push 0x10013720
push 0
push 0
call edi
cmp dword [0x10058a00], 1
jne 0x100120cd
push 0
push 0
push 0
push 0x100110f0
push 0
push 0
call edi
cmp dword [0x10058a50], 1
jne 0x100120e7
push 0
push 0
push 0
push 0x10011500
push 0
push 0
call edi
cmp dword [0x100589bc], 1
jne 0x10012101
push 0
push 0
push 0
push 0x10018260
push 0
push 0
call edi
cmp dword [0x10058a38], 1
jne 0x1001211b
push 0
push 0
push 0
push 0x10016c30
push 0
push 0
call edi
cmp dword [0x100589c0], 1
jne 0x10012135
push 0
push 0
push 0
push 0x1000ac80
push 0
push 0
call edi
cmp dword [0x10058a44], 1
jne 0x1001214f
push 0
push 0
push 0
push 0x10015ae0
push 0
push 0
call edi
cmp dword [0x10058a3c], 1
jne 0x10012169
push 0
push 0
push 0
push 0x1000c310
push 0
push 0
call edi
cmp dword [0x10058a40], 1
jne 0x10012183
push 0
push 0
push 0
push 0x100061a0
push 0
push 0
call edi
cmp dword [0x10058a48], 1
jne 0x1001219d
push 0
push 0
push 0
push 0x10002340
push 0
push 0
call edi
cmp dword [0x100589f8], 1
jne 0x100121ab
call fcn.10015ff0
cmp dword [0x10058a10], 1
jne 0x100121c5
push 0
push 0
push 0
push 0x10017870
push 0
push 0
call edi
cmp dword [0x100589ec], 1
jne 0x100121df
push 0
push 0
push 0
push 0x10017370
push 0
push 0
call edi
cmp dword [0x10058a58], 1
jne 0x100121f9
push 0
push 0
push 0
push 0x10017d00
push 0
push 0
call edi
cmp dword [0x10058a4c], 1
jne 0x10012213
push 0
push 0
push 0
push 0x10006570
push 0
push 0
call edi
cmp dword [0x10058a0c], 1
jne 0x1001222d
push 0
push 0
push 0
push 0x1000c6b0
push 0
push 0
call edi
cmp dword [0x100589ac], 1
jne 0x100122b2
mov eax, 0x7dbe6ac
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, eax
mov eax, dword [0x10058994]
movups xmm0, xmmword [eax]
mov eax, 0x69216c
mov edx, eax
movups xmmword [ecx], xmm0
mov ecx, dword [0x10058998]
mov dword [eax], 0
mov byte [eax + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
movzx eax, byte [ecx + 4]
xor ecx, ecx
mov byte [edx + 4], al
mov eax, 0x7dbe6c0
mov edx, eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
mov ecx, dword [0x1005899c]
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ax, word [ecx + 0xc]
mov word [edx + 0xc], ax
movzx eax, byte [ecx + 0xe]
mov byte [edx + 0xe], al
cmp dword [0x100589b0], 1
jne 0x100122cc
push 0
push 0
push 0
push 0x10018a10
push 0
push 0
call edi
cmp dword [0x10058a60], 1
jne 0x100122f5
mov eax, 0x693ff1
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, eax
mov eax, dword [str.Player]
mov dword [ecx], eax
mov ax, word [0x1004b488]
mov word [ecx + 4], ax
cmp dword [0x100589c4], 1
jne 0x10012329
cmp dword [0x100589a4], 0
jne 0x10012329
push 0
push 0
push 0
push 0x100184b0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100187a0
push 0
push 0
call edi
cmp dword [0x100589f4], 1
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x10012340
push dword [0x1005897c]
call esi
cmp dword [0x100589f0], 1
jne 0x10012350
push str.Glow.dll
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.100065c0
call fcn.10012380
call fcn.100124d0
int3