Function at 0x1001dcf0
Capabilities:
Create process on windows
Enumerate process modules
Enumerate processes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101548f8
mov eax, dword fs:[0]
push eax
mov eax, 0x18c4
call fcn.100b4660
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x186c], esi
call fcn.100125c0
mov ecx, eax
call fcn.10010110
test eax, eax
je 0x1001e0c3
push 0
push str.hasPlayedOnceGame
push dword [0x101bff8c]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10044e20
add esp, 0x10
or edi, 0xffffffff
cmp eax, 1
jne 0x1001de0a
push str.played
lea ecx, [ebp - 0x1860]
call fcn.1000b130
push str.uninstall
lea ecx, [ebp - 0x1864]
mov dword [ebp - 4], 0
call fcn.1000b130
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1878], esp
mov dword [eax + 0x24], 0
push 0
push 0
push 1
lea eax, [ebp - 0x1860]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1864]
push eax
call fcn.1006f2a0
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10070290
mov edx, dword [ebp - 0x1864]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001dde6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1860]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001de0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.100125c0
mov ecx, eax
call fcn.100100a0
test eax, eax
jne 0x1001df4b
lea ecx, [ebp - 0x1768]
call fcn.10077710
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 3
push 0
push eax
call fcn.100ec480
add esp, 0xc
mov dword [ebp - 0x1860], 1
lea eax, [ebp - 0x1864]
mov dword [ebp - 0x1864], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x1860]
push eax
push str.Setup_Path
push dword [0x101bff8c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001df39
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1001e879
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x185c], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x185c]
call fcn.1001aad0
test al, al
jne 0x1001def2
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ded0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x185c]
call fcn.1000adf0
lea eax, [ebp - 0x185c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x1768]
call fcn.100791d0
lea eax, [ebp - 0x185c]
push eax
lea ecx, [ebp - 0x1768]
call fcn.1007db80
mov edx, dword [ebp - 0x185c]
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1001df39
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1768]
call fcn.10077f00
xor eax, eax
jmp 0x1001e85e
push 2
call fcn.100302a0
lea eax, [ebp - 0x185c]
push eax
call fcn.1001b480
add esp, 4
mov eax, dword [ebp - 0x185c]
mov dword [ebp - 4], 6
cmp dword [eax - 0xc], 0
jne 0x1001df7c
lea edx, [eax - 0x10]
jmp 0x1001e0a3
call fcn.10073040
push str.DLL_7Z
push 0xcb
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
test eax, eax
je 0x1001dfaf
push 1
push dword [ebp - 0x185c]
call fcn.100440d0
add esp, 8
test eax, eax
je 0x1001e09a
xorps xmm0, xmm0
mov dword [ebp - 0x18d0], 0x44
lea eax, [ebp - 0x18d0]
movlpd qword [ebp - 0x18cc], xmm0
push eax
movlpd qword [ebp - 0x18c4], xmm0
movlpd qword [ebp - 0x18bc], xmm0
movlpd qword [ebp - 0x18b4], xmm0
movlpd qword [ebp - 0x18ac], xmm0
movlpd qword [ebp - 0x18a4], xmm0
movlpd qword [ebp - 0x189c], xmm0
movlpd qword [ebp - 0x1894], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov dword [ebp - 0x18a4], 1
push 0x1000
mov word [ebp - 0x18a0], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x1628]
push 0
push eax
movups xmmword [ebp - 0x1888], xmm0
call fcn.100ec480
push esi
push dword [ebp - 0x185c]
lea eax, [ebp - 0x1628]
push 0x10175518
push eax
call fcn.10019b20
add esp, 0x1c
lea eax, [ebp - 0x1888]
push eax
lea eax, [ebp - 0x18d0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1001e09a
push dword [ebp - 0x1884]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1888]
call esi
mov edx, dword [ebp - 0x185c]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1001e0bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x1001e85e
push 1
call fcn.100302a0
lea eax, [ebp - 0x1874]
push eax
call fcn.1001b290
add esp, 4
mov esi, dword [ebp - 0x1874]
or edi, 0xffffffff
mov dword [ebp - 4], 7
cmp dword [esi - 0xc], 0
je 0x1001e52c
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.100ec480
push 0x104
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.1010b4c8
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1001e883
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1864], eax
push dword [0x101bff80]
lea eax, [ebp - 0x1864]
mov byte [ebp - 4], 8
push 0x101735f8
push eax
call fcn.10012500
mov esi, dword [ebp - 0x1864]
lea eax, [ebp - 0x628]
add esp, 0xc
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100ec480
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.100763b0
lea eax, [ebp - 0x185c]
push eax
call fcn.10041ac0
add esp, 0x1c
lea ecx, [ebp - 0x188c]
call fcn.10019b50
push dword [ebp - 0x185c]
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xa
push ecx
push str.installed_ver:__s__new_ver:__s_._n
push eax
call fcn.10019f20
add esp, 0x10
mov byte [ebp - 4], 9
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x1860]
push eax
call fcn.1000b130
lea eax, [ebp - 0x185c]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x1860]
push eax
call fcn.100762a0
mov edx, dword [ebp - 0x1860]
add esp, 8
test eax, eax
mov byte [ebp - 4], 9
mov eax, edi
setns byte [ebp - 0x1855]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001e237
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x1855], 0
je 0x1001e5a2
call fcn.100125c0
mov ecx, eax
call fcn.1000ff60
test eax, eax
jne 0x1001e4f0
call fcn.100125c0
mov ecx, eax
call fcn.100100f0
lea ecx, [ebp - 0x188c]
cmp dword [eax], 0
je 0x1001e28b
call fcn.10019b50
push str.silent_mode__not_allowed_to_overwrite_newer_version.__n
push eax
mov byte [ebp - 4], 0xc
call fcn.10019f20
add esp, 8
jmp 0x1001e6f2
call fcn.10019b50
push str.not_in_silent_mode.__n
push eax
mov byte [ebp - 4], 0xd
call fcn.10019f20
add esp, 8
mov byte [ebp - 4], 9
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x1860]
push eax
call fcn.1000b130
lea eax, [ebp - 0x185c]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x1860]
push eax
call fcn.100762a0
add esp, 8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1860]
mov edi, eax
call fcn.1000b560
test edi, edi
jle 0x1001e45e
lea ecx, [ebp - 0x188c]
call fcn.10019b50
push dword [ebp - 0x1874]
mov byte [ebp - 4], 0xf
push str.Start_game_center:__s.__n
push eax
call fcn.10019f20
add esp, 0xc
mov byte [ebp - 4], 9
lea eax, [ebp - 0x186c]
push eax
call fcn.100125c0
mov ecx, eax
call fcn.1000f3b0
mov edi, dword [str.__from_inst]
mov byte [ebp - 4], 0x10
test edi, edi
jne 0x1001e337
xor ecx, ecx
jmp 0x1001e34f
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e340
sub ecx, edx
sar ecx, 1
mov eax, dword [ebp - 0x186c]
mov edx, edi
sub edx, eax
sar edx, 1
mov dword [ebp - 0x1878], edx
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x1870], edx
test ecx, ecx
js 0x1001e88d
test edi, edi
jne 0x1001e37a
xor edx, edx
jmp 0x1001e38c
push ecx
push edi
call fcn.101090c8
mov edx, eax
add esp, 8
mov eax, dword [ebp - 0x186c]
mov ecx, SysReAllocString
mov dword [ebp - 0x1868], edx
sub ecx, edx
cmp ecx, dword [ebp - 0x1870]
jl 0x1001e897
mov ecx, dword [ebp - 0x1870]
add ecx, edx
mov dword [ebp - 0x1860], ecx
js 0x1001e8a1
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, dword [ebp - 0x1860]
or ecx, edx
jge 0x1001e3e5
push dword [ebp - 0x1860]
lea ecx, [ebp - 0x186c]
call fcn.1000ad50
mov eax, dword [ebp - 0x186c]
mov ecx, dword [ebp - 0x1878]
mov edx, dword [ebp - 0x1870]
cmp ecx, edx
ja 0x1001e3f8
lea edi, [eax + ecx*2]
mov ecx, dword [ebp - 0x1868]
lea eax, [eax + edx*2]
add ecx, ecx
push ecx
push edi
push ecx
push eax
call fcn.1001f2e0
mov eax, dword [ebp - 0x186c]
add esp, 0x10
mov ecx, dword [ebp - 0x1860]
cmp ecx, dword [eax - 8]
jg 0x1001e88d
push 0xffffffffffffffff
xor edx, edx
mov dword [eax - 0xc], ecx
mov eax, dword [ebp - 0x186c]
push edx
push edx
push edx
push 1
mov word [eax + ecx*2], dx
push dword [ebp - 0x186c]
push dword [ebp - 0x1874]
call fcn.10074fc0
lea ecx, [ebp - 0x186c]
call fcn.1000b560
or edi, 0xffffffff
jmp 0x1001e6f2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x1868]
call fcn.1000b130
lea eax, [ebp - 0x185c]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x1868]
push eax
call fcn.100762a0
add esp, 8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1868]
mov edi, eax
call fcn.1000b560
test edi, edi
jne 0x1001e4ed
lea ecx, [ebp - 0x1768]
call fcn.10077710
lea ecx, [ebp - 0x1768]
mov byte [ebp - 4], 0x12
call fcn.1007b000
test eax, eax
jne 0x1001e4e2
push 4
push 0x101756a8
push eax
call fcn.100302f0
cmp eax, 6
jne 0x1001e4e2
lea ecx, [ebp - 0x1768]
call fcn.10077f00
or edi, 0xffffffff
jmp 0x1001e6f2
lea ecx, [ebp - 0x1768]
call fcn.10077f00
or edi, 0xffffffff
mov edx, dword [ebp - 0x185c]
mov eax, edi
mov byte [ebp - 4], 8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001e511
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001e52c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.100125c0
mov ecx, eax
call fcn.100100f0
push dword [eax]
call fcn.100302d0
call fcn.100125c0
mov ecx, eax
call fcn.1000ff00
test eax, eax
je 0x1001e735
mov ecx, 0x101c5f6c
call fcn.100317d0
test eax, eax
jne 0x1001e735
lea ecx, [ebp - 0x188c]
call fcn.10019b50
push str.CheckSingleInstance_failed__exit.__n
push eax
mov byte [ebp - 4], 0x13
call fcn.10019f20
add esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1855]
push 0
call fcn.10019e60
push eax
push 0
call fcn.100302f0
xor esi, esi
jmp 0x1001e83a
mov eax, dword [ebp - 0x1874]
push 0
mov dword [ebp - 0x1870], eax
mov eax, dword [str.YxhGamebox.exe]
push 2
mov dword [ebp - 0x1878], eax
mov byte [ebp - 0x1855], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x1868], eax
cmp eax, 0xffffffff
je 0x1001e4f0
lea ecx, [ebp - 0x1854]
mov dword [ebp - 0x1854], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1001e6b1
mov esi, dword [ebp - 0x1868]
nop dword [eax]
push dword [ebp - 0x1878]
lea eax, [ebp - 0x1830]
push eax
call fcn.1010927f
add esp, 8
test eax, eax
jne 0x1001e693
push dword [ebp - 0x184c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1001e68a
lea eax, [ebp - 0xa50]
mov dword [ebp - 0xa50], 0x428
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1001e683
nop dword [eax]
push dword [ebp - 0x1870]
lea eax, [ebp - 0x830]
push eax
call fcn.1010927f
add esp, 8
test eax, eax
je 0x1001e67c
lea eax, [ebp - 0xa50]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1001e650
jmp 0x1001e683
mov byte [ebp - 0x1855], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x1855], 1
je 0x1001e6a8
lea eax, [ebp - 0x1854]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001e600
mov esi, dword [ebp - 0x1864]
or edi, 0xffffffff
push dword [ebp - 0x1868]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x1855], 0
je 0x1001e4f0
call fcn.100125c0
mov ecx, eax
call fcn.100100f0
cmp dword [eax], 0
jne 0x1001e6f2
push 4
push 0x101756d4
push 0
call fcn.100302f0
cmp eax, 7
jne 0x1001e4f0
mov edx, dword [ebp - 0x185c]
mov eax, edi
mov byte [ebp - 4], 8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001e713
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001e764
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
jmp 0x1001e83a
push str.install
call fcn.1006f2a0
mov ecx, eax
call fcn.100716e0
call fcn.1001b850
test eax, eax
jne 0x1001e76b
mov ecx, 0x101c5f6c
call fcn.10031e20
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x1001e83a
call fcn.1001be90
test eax, eax
jne 0x1001e827
lea ecx, [ebp - 0x1864]
call fcn.1000c820
push 0x101750f8
lea eax, [ebp - 0x1864]
mov byte [ebp - 4], 0x14
push str._sinstall_file_fail
push eax
call fcn.10012500
add esp, 0xc
lea ecx, [ebp - 0x1870]
push str.install_failed
call fcn.1000b130
push str.install
lea ecx, [ebp - 0x1868]
mov byte [ebp - 4], 0x15
call fcn.1000b130
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1878], esp
mov dword [eax + 0x24], 0
push 0
push dword [ebp - 0x1864]
lea eax, [ebp - 0x1870]
mov byte [ebp - 4], 0x17
push 1
push eax
lea eax, [ebp - 0x1868]
push eax
call fcn.1006f2a0
mov ecx, eax
mov byte [ebp - 4], 0x16
call fcn.10070290
lea ecx, [ebp - 0x1868]
call fcn.1000b560
lea ecx, [ebp - 0x1870]
call fcn.1000b560
lea ecx, [ebp - 0x1864]
call fcn.1000b560
xor esi, esi
jmp 0x1001e83a
push dword [ebp + 0x14]
push dword [ebp - 0x186c]
call fcn.1001d940
add esp, 8
mov esi, eax
mov edx, dword [ebp - 0x1874]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1001e85c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80070057
call fcn.10007270
push 0x80070057
call fcn.10007270
push 0x80070057
call fcn.10007270
int3