Function at 0x10001b10
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, 0x74
sub esp, 0xac
mov dword [esp + 0x54], 0x656d6974
mov dword [esp + 0x58], 0x54746547
mov dword [esp + 0x5c], 0x656d69
mov dword [esp + 0x7a], 0x656d6974
mov dword [esp + 0x7e], 0x6c6c694b
mov dword [esp + 0x82], 0x6e657645
mov word [esp + 0x86], bx
mov dword [esp + 0x60], 0x656d6974
mov dword [esp + 0x64], 0x45746553
mov dword [esp + 0x68], 0x746e6576
mov byte [esp + 0x6c], 0
mov dword [esp + 0x6d], 0x54746547
mov dword [esp + 0x71], 0x436b6369
mov dword [esp + 0x75], 0x746e756f
mov byte [esp + 0x79], 0
mov dword [esp + 0x88], 0x72657551
mov dword [esp + 0x8c], 0x72655079
mov dword [esp + 0x90], 0x6d726f66
mov dword [esp + 0x94], 0x65636e61
mov dword [esp + 0x98], 0x6e756f43
mov dword [esp + 0x9c], 0x726574
test eax, eax
je 0x10001bde
cmp edx, eax
je 0x10001bf0
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x48]
mov esi, ecx
mov ebx, edx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 4], 4
mov dword [esp], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], eax
call eax
sub esp, 0x10
test eax, eax
je 0x10001bde
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], str.winmm.dll
mov dword [esp + 0x3c], eax
call eax
sub esp, 4
lea edi, [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
sub esp, 8
mov ebp, dword [esp + 0xc0]
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x24]
mov dword [esp + 0x28], 0
and ebp, 2
jne 0x100022e8
mov eax, dword [esp + 0xc0]
and eax, 1
mov dword [esp + 0x24], eax
jne 0x100022b0
mov dword [esp], 0
mov dword [esp + 0x30], edx
call sym._fxCompatPlatformId
mov edx, dword [esp + 0x30]
mov dword [esp + 0x2c], 0
cmp eax, 1
je 0x10002338
lea eax, [esp + 0x4c]
mov dword [esp + 0x30], edx
mov dword [esp], eax
call sym._fxEventHookPtr
mov edx, dword [esp + 0x30]
mov eax, esi
and esi, 0xfffffffc
shr eax, 2
lea edi, [edx + esi]
mov dword [esp + 0x30], edi
test eax, eax
je 0x10001d45
mov edi, dword [esp + 0x38]
mov dword [esp + 0x38], edx
lea esi, [esi]
nop
test edi, edi
je 0x10001f70
cmp dword [ebx], edi
je 0x10001e80
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x100021a0
mov dword [esp + 0x28], 0
test ebp, ebp
je 0x10001e70
cmp dword [ebx], ebp
je 0x10001d78
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x10002090
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x10001f80
mov dword [esp + 0x2c], 0
add ebx, 4
cmp dword [esp + 0x30], ebx
jne 0x10001ce0
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x48]
mov dword [esp + 4], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
call eax
sub esp, 0x10
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sym._HookEntryHook
mov eax, dword [esp + 0x50]
mov dword [ebx], eax
mov dword [esp + 4], 0x10052044
mov dword [esp], 0x10052046
call sym._fopen
mov dword [esp + 4], 0x1005206e
mov esi, eax
lea eax, [esp + 0x60]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fprintf
mov dword [esp], esi
mov ebp, eax
call sym._fclose
add ebp, 1
mov esi, ebp
test ebp, 7
je 0x10001ddb
mov eax, ebp
sar eax, 3
lea esi, [eax*8 + 8]
mov edx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
call edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x60]
mov dword [esp + 4], 0x1005206e
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._sprintf
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x9148
mov dword [esp + 4], 0x8251
mov dword [esp], 0x824b
call sym.qmfxgl32.dll_glDebugMessageInsertARB
sub esp, 0x18
mov edx, dword [esp + 0x3c]
call edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
lea esi, [esi]
lea esi, [esi]
xor ebp, ebp
jmp 0x10001d10
mov dword [esp + 4], edi
mov dword [esp], ebx
call sym._HookEntryHook
mov dword [ebx], sym._TimeHookProc_0
mov dword [esp + 4], 0x10052044
mov dword [esp], 0x10052046
call sym._fopen
mov dword [esp + 4], 0x1005206e
mov esi, eax
lea eax, [esp + 0x54]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fprintf
mov dword [esp], esi
mov edi, eax
call sym._fclose
add edi, 1
mov esi, edi
test edi, 7
je 0x10001ee3
mov eax, edi
sar eax, 3
lea esi, [eax*8 + 8]
mov edx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
call edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x54]
mov dword [esp + 4], 0x1005206e
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._sprintf
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x9148
mov dword [esp + 4], 0x8251
mov dword [esp], 0x824b
call sym.qmfxgl32.dll_glDebugMessageInsertARB
sub esp, 0x18
mov edx, dword [esp + 0x3c]
call edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
nop
xor edi, edi
jmp 0x10001cf0
cmp dword [ebx], eax
jne 0x10001d38
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._HookEntryHook
mov dword [ebx], sym._elapsedTickProc_4
mov dword [esp + 4], 0x10052044
mov dword [esp], 0x10052046
call sym._fopen
mov dword [esp + 4], 0x1005206e
mov esi, eax
lea eax, [esp + 0x88]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fprintf
mov dword [esp], esi
mov dword [esp + 0x2c], eax
call sym._fclose
mov edx, dword [esp + 0x2c]
add edx, 1
mov esi, edx
test dl, 7
je 0x10001ff1
mov eax, edx
sar eax, 3
lea esi, [eax*8 + 8]
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x2c], ecx
call ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x88]
mov dword [esp + 4], 0x1005206e
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._sprintf
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x9148
mov dword [esp + 4], 0x8251
mov dword [esp + 0x10], edx
mov dword [esp], 0x824b
call sym.qmfxgl32.dll_glDebugMessageInsertARB
sub esp, 0x18
mov ecx, dword [esp + 0x2c]
call ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x10001d30
cmp dword [ebx], eax
jne 0x10001d24
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._HookEntryHook
mov dword [ebx], sym._TimeHookProc_0
mov dword [esp + 4], 0x10052044
mov dword [esp], 0x10052046
call sym._fopen
mov dword [esp + 4], 0x1005206e
mov esi, eax
lea eax, [esp + 0x6d]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fprintf
mov dword [esp], esi
mov dword [esp + 0x24], eax
call sym._fclose
mov edx, dword [esp + 0x24]
add edx, 1
mov esi, edx
test dl, 7
je 0x100020fe
mov eax, edx
sar eax, 3
lea esi, [eax*8 + 8]
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x24], ecx
call ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x6d]
mov dword [esp + 4], 0x1005206e
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._sprintf
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x9148
mov dword [esp + 4], 0x8251
mov dword [esp + 0x10], edx
mov dword [esp], 0x824b
call sym.qmfxgl32.dll_glDebugMessageInsertARB
sub esp, 0x18
mov ecx, dword [esp + 0x24]
call ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x10001d1c
cmp dword [ebx], eax
jne 0x10001d04
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._HookEntryHook
mov eax, dword [esp + 0x4c]
mov dword [ebx], eax
mov dword [esp + 4], 0x10052044
mov dword [esp], 0x10052046
call sym._fopen
mov dword [esp + 4], 0x1005206e
mov esi, eax
lea eax, [esp + 0x7a]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fprintf
mov dword [esp], esi
mov dword [esp + 0x28], eax
call sym._fclose
mov edx, dword [esp + 0x28]
add edx, 1
mov esi, edx
test dl, 7
je 0x1000220e
mov eax, edx
sar eax, 3
lea esi, [eax*8 + 8]
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x28], ecx
call ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x7a]
mov dword [esp + 4], 0x1005206e
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._sprintf
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x9148
mov dword [esp + 4], 0x8251
mov dword [esp + 0x10], edx
mov dword [esp], 0x824b
call sym.qmfxgl32.dll_glDebugMessageInsertARB
sub esp, 0x18
mov ecx, dword [esp + 0x28]
call ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x10001cfc
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x3c]
mov dword [esp], 0x10052061
call eax
sub esp, 4
lea ecx, [esp + 0x6d]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
jmp 0x10001c84
mov ebp, dword [esp + 0x3c]
mov dword [esp], str.winmm.dll
call ebp
sub esp, 4
lea ecx, [esp + 0x7a]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
mov dword [esp + 0x28], eax
mov dword [esp], str.winmm.dll
call ebp
sub esp, 4
lea ecx, [esp + 0x60]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
mov ebp, eax
mov edx, dword [esp + 0x24]
jmp 0x10001c70
mov eax, dword [esp + 0x3c]
mov dword [esp], 0x10052061
call eax
sub esp, 4
lea ecx, [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
mov edx, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
jmp 0x10001ca9