Function at 0x100239a0
Capabilities:
Create directory
Create thread
Delete file
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Read .ini file
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bb1a
mov eax, dword fs:[0]
push eax
sub esp, 0x4f0
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x474]
mov dword [ebp - 0x478], 1
push eax
push 0x100690d8
lea eax, [ebp - 0x478]
mov dword [ebp - 0x474], 0x208
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push 0x208
mov esi, eax
lea eax, [ebp - 0x470]
push 0
push eax
call fcn.1002eee0
add esp, 0xc
test esi, esi
jne 0x10023aa6
push 0x100690d8
lea eax, ds:[ebp - 0x470]
push 0x104
push eax
call fcn.100376bd
push str.Steam.exe
push 0x104
push 0x100690d8
call fcn.10037721
add esp, 0x18
mov edx, 0x100690d8
mov ecx, 0x10068790
call fcn.10001dc0
cmp al, 1
jne 0x10023aa6
cmp byte [0x10066e87], 0
mov byte [0x100672a5], al
jne 0x10023aa6
push str._appcachepackageinfo.vdf
lea eax, [ebp - 0x470]
push 0x104
push eax
call fcn.10037721
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
push 0x10068790
call fcn.1002ebd0
add esp, 8
test eax, eax
je 0x10023abe
xor ecx, ecx
mov word [eax], cx
push 0x5c
push 0x100672a8
call fcn.1002ebd0
add esp, 8
test eax, eax
je 0x10023ad6
xor ecx, ecx
mov word [eax], cx
cmp byte [0x100672a5], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x10024106
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x1000000
push 0
push 0x10067cec
call esi
push 0x1000000
push 0
push 0x10069704
call esi
push 0x1000000
push 0
push 0x10068138
call esi
push 0x10023940
call fcn.1003734a
push 0x10023960
call fcn.10037b00
add esp, 8
push 0x104
push 0x10068150
push 0x1005bf78
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x100689a0
push str.SteamAppId
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test esi, esi
je 0x10023d96
test eax, eax
je 0x10023d96
push 0x10068150
push str.SoftwareGL2024AppID_s
push 0xffffffffffffffff
push 0x104
push 0x10068aa8
call fcn.10001360
push 0x100689a0
push str.SoftwareGL2024AppID_sStats
push 0xffffffffffffffff
push 0x104
push 0x10068580
call fcn.10001440
push 0x100689a0
push str.SoftwareGL2024AppID_sAchievements
push 0xffffffffffffffff
push 0x104
push 0x10068688
call fcn.10001440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x480]
add esp, 0x3c
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x478], 4
mov dword [ebp - 0x474], 4
push eax
push 0x20019
push 0
push 0x10068aa8
push 0x80000001
call esi
test eax, eax
jne 0x10023c3e
lea eax, [ebp - 0x474]
push eax
push 0x10064ae0
lea eax, [ebp - 0x478]
push eax
push 0
push str.StatsLimit
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], 0
push eax
push 0x20019
push 0
push 0x10068aa8
push 0x80000001
mov dword [ebp - 0x478], 4
mov dword [ebp - 0x474], 4
call esi
test eax, eax
jne 0x10023cb2
lea eax, ds:[ebp - 0x474]
push eax
push 0x10064ae4
lea eax, [ebp - 0x478]
push eax
push 0
push str.AchievementsLimit
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], 0
push eax
push 0x20019
push 0
push 0x10068aa8
push 0x80000001
mov dword [ebp - 0x478], 4
mov dword [ebp - 0x474], 4
call esi
test eax, eax
jne 0x10023d26
lea eax, [ebp - 0x474]
push eax
push 0x10064d18
lea eax, [ebp - 0x478]
push eax
push 0
push str.SkipStatsAndAchievements
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword ds:[ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], 0
push eax
push 0x20019
push 0
push 0x10068aa8
push 0x80000001
mov dword [ebp - 0x478], 4
mov dword [ebp - 0x474], 4
call esi
nop
test eax, eax
jne 0x10023d96
lea eax, [ebp - 0x474]
push eax
push 0x10067d10
lea eax, [ebp - 0x478]
push eax
push 0
push str.DisableGL2024ServerTicket
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10068790
push str._sServer.bin
push 0xffffffffffffffff
push 0x104
push 0x10068358
call fcn.10001360
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 0
push 0
push 0x10068358
call esi
cmp eax, 0xffffffff
je 0x10023de3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x100674b5], 1
push str.GreenLuma_2024_is_loaded__r_n
call fcn.10002320
push 0x100692e8
push str.Exe______s_r_n
call fcn.100025e0
add esp, 0xc
cmp byte [0x100674b5], 0
jne 0x10023ee6
push 0x208
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.1002eee0
add esp, 0xc
mov dword [ebp - 0x478], 1
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0x208
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x478]
push eax
push 0x20002
push str.InstallPath
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10023ee6
cmp dword [0x10067f2c], 0
je 0x10023ec9
mov eax, dword [0x10073db8]
test eax, eax
je 0x10023ec9
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x1a
push 0x1005c110
push eax
mov dword [ebp - 0x474], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x10067f2c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
mov ecx, dword ds:[ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d2b1
mov esp, ebp
pop ebp
ret
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_Steam_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10068790
push str._sLumaCEG_Plugin_x86.dll
push 0xffffffffffffffff
push 0x104
push 0x100674b8
call fcn.10001360
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 0
push 0
push 0x100674b8
call esi
nop
cmp eax, 0xffffffff
je 0x10023f4d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100674b8
push str.LumaCEG_Plugin_Dll______s_r_n
call fcn.100025e0
add esp, 8
push 8
push 0
push 0x100674b8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x100672a8
push str._sGreenLuma2024_FilesAchievementUnlocked.wav
push 0xffffffffffffffff
push 0x104
push 0x10068cc0
call fcn.10001360
push 0x10068150
push 0x100672a8
push str._sAppOwnershipTicketsTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10067ae0
call fcn.10001360
push 0x10068150
push 0x100672a8
push str._sEncryptedAppTicketsEncryptedTicket._s
push 0xffffffffffffffff
push 0x104
push 0x10069938
call fcn.10001360
add esp, 0x44
push 0x100672a8
push str._sWhitelist.txt
push 0xffffffffffffffff
push 0x104
push 0x10073dc8
call fcn.10001360
push 0x100672a8
push str._sBlacklist.txt
push 0xffffffffffffffff
push 0x104
push 0x100678d0
call fcn.10001360
push 0x100672a8
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100676c8
call fcn.10001360
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x3c
push str.DenuvoActivationBypass.dll
call esi
mov dword [0x10073b94], eax
test eax, eax
jne 0x10024032
push str.DenuvoOfflineActivationBypass.dll
call esi
mov dword [0x10073b94], eax
test eax, eax
je 0x10024939
push str.GetDenuvoCallResult
push eax
call edi
push str.GetDenuvoID
push dword [0x10073b94]
mov dword [0x10069724], eax
call edi
push str.RequestDenuvoAppTicket
push dword [0x10073b94]
mov dword [0x10068aa4], eax
call edi
push str.GetDenuvoAppTicket
push dword [0x10073b94]
mov dword [0x10069728], eax
call edi
push str.ShutdownDenuvoDll
push dword [0x10073b94]
mov dword [0x10068570], eax
call edi
cmp dword [0x10069724], 0
mov dword [0x100672a0], eax
je 0x100240bb
cmp dword [0x10068aa4], 0
je 0x100240bb
cmp dword [0x10069728], 0
je 0x100240bb
cmp dword [0x10068570], 0
je 0x100240bb
test eax, eax
je 0x100240bb
mov byte [0x100674b7], 1
jmp 0x10024939
cmp dword [0x10067f2c], 0
je 0x100240e5
mov eax, dword [0x10073db8]
test eax, eax
je 0x100240e5
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x29
push 0x1005c3c4
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Failed_to_get_functions_from_bypass_dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10066e87], 1
jne 0x10024125
mov byte [0x10066e86], 1
mov byte [0x100672a4], 1
nop dword [eax]
jmp 0x100241eb
push 0x100672a8
push str._sStealthMode.bin
push 0xffffffffffffffff
push 0x104
push 0x10069b40
call fcn.10001360
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 0
push 0
push 0x10069b40
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1002418d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069b40
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x10066e86], 1
mov byte [0x100672a4], 1
jmp 0x100241eb
push 0x1000000
push 0
push 0x10067cec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0x100672a8
push str._sDenuvoOfflineActivationBypass.dll
push 0xffffffffffffffff
push 0x104
push 0x100676c8
call fcn.10001360
push str.GreenLuma_2024_is_loaded__r_n
nop
call fcn.10002320
push 0x100692e8
push str.Exe______s_r_n
call fcn.100025e0
push 0x10023940
call fcn.1003734a
push 0x10023960
call fcn.10037b00
add esp, 0x28
push 0x100672a8
push str._sAppList_
push 0xffffffffffffffff
push 0x104
push 0x10067f30
call fcn.10001360
push 0x100672a8
push str._sAppList0.txt
push 0xffffffffffffffff
push 0x104
push 0x10067d18
call fcn.10001360
push 0x100672a8
push str._sAppListAppList.ini
push 0xffffffffffffffff
push 0x104
push 0x10067090
call fcn.10001360
push 0x100672a8
push str._sNoQuestion.bin
push 0xffffffffffffffff
push 0x104
push 0x10069730
call fcn.10001360
add esp, 0x50
push 0
push 0x80
push 3
push 0
push 0
push 0
push 0x10067090
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10024391
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.1002d4c9
mov dword [ebp - 0x480], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [eax], xmm0
push 0x208
mov byte [eax + 4], 0
call fcn.1002d821
push 0x208
mov esi, eax
push 0
push esi
call fcn.1002eee0
mov eax, dword [ebp - 0x480]
push 0x10067090
push 0x104
push esi
mov dword [eax], esi
call fcn.100376bd
mov esi, dword [ebp - 0x480]
add esp, 0x20
test eax, eax
jne 0x100242f7
mov byte [esi + 4], 1
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 4], 0
je 0x10024362
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10037a40
mov dword [eax], 0
push dword [esi]
push 0
push str.NumAppIDs
push str.AppList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x474], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10024362
nop dword [eax + eax]
call fcn.10037a40
cmp dword [eax], 0
jne 0x10024362
mov eax, dword [ebp - 0x474]
mov dword [0x10073dc0], eax
test eax, eax
je 0x1002436c
mov byte [0x10066e85], 1
jmp 0x1002436c
mov dword [0x10073dc0], 0
cmp byte [esi + 4], 1
jne 0x10024380
push dword [esi]
mov byte [esi + 4], 0
call fcn.1002d2c4
add esp, 4
push 8
push esi
call fcn.1002d813
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 8
push 0
push 0x80
push 3
push 0
push 0
push 0
push 0x10069730
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100243cd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10069730
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [0x100672a4], 1
push 0
push 0x80
push 3
push 0
push 0
push 0
push 0x10067d18
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10024484
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x100672a4], 1
nop
je 0x100245fd
push 0x24
push str.GreenLuma_2024
push str.Use_saved_AppList_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop word [eax + eax]
sub eax, 6
je 0x100245fd
sub eax, 1
jne 0x10024484
xor esi, esi
push 0x208
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.1002eee0
push esi
push 0x10067f30
push str._s_zu.txt
push 0xffffffffffffffff
lea eax, [ebp - 0x268]
push 0x104
push eax
call fcn.10001360
add esp, 0x24
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x82
jb 0x10024430
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [0x100674b0], eax
call fcn.10036285
push eax
push 0x1005c614
push 0x1005c618
push 0x10069700
call fcn.1003619d
push 1
call fcn.10036285
push eax
push 0x1005c628
push 0x1005c62c
push 0x10067ce8
call fcn.1003619d
push 2
call fcn.10036285
push eax
push 0x1005c628
push 0x1005c62c
push 0x100692e4
call fcn.1003619d
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movups xmmword [ebp - 0x24], xmm0
call fcn.100012b0
add esp, 0x40
push 0
call fcn.10036285
push eax
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.1003793e
add esp, 0x10
test eax, eax
je 0x100245c8
nop
lea ecx, [ebp - 0x24]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024526
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x14
jae 0x10025a6e
xor eax, eax
push 0xa
push eax
mov word [ebp + ecx - 0x24], ax
lea eax, [ebp - 0x24]
push eax
call fcn.10036bfb
add esp, 0xc
mov dword [ebp - 0x474], eax
call fcn.10037a40
cmp dword [eax], 0x22
je 0x10025a06
mov eax, dword [ebp - 0x474]
test eax, eax
je 0x1002458b
nop dword [eax]
cmp eax, 0x82
jle 0x10024798
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.How_many_Games_DLC_would_you_like_to_add___1_130_:
movups xmmword [ebp - 0x24], xmm0
call fcn.100012b0
push 0
call fcn.10036285
push eax
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.1003793e
add esp, 0x14
test eax, eax
jne 0x10024520
cmp dword [0x10067f2c], 0
je 0x10025a4e
mov eax, dword [0x10073db8]
nop word [eax + eax]
test eax, eax
je 0x10025a4e
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x23
push 0x1005c6a8
jmp 0x10023e8c
mov dword [ebp - 0x4c8], 0
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.1002eee0
push dword [ebp - 0x4c8]
lea eax, [ebp - 0x268]
push 0x10067f30
push str._s_zu.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001360
push 0x10054cd0
lea eax, [ebp - 0x268]
mov dword [ebp - 0x480], 0
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.10036ef6
add esp, 0x30
test eax, eax
jne 0x10024939
push dword [ebp - 0x480]
mov dword [ebp - 0x28], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x38]
push 0x14
push eax
movups xmmword [ebp - 0x38], xmm0
call fcn.10037933
add esp, 0xc
test eax, eax
je 0x10024755
push dword [ebp - 0x480]
call fcn.10037092
push 0xa
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.10036bb5
mov ecx, dword ds:[ebp - 0x4c8]
add esp, 0x10
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x47c]
mov ecx, dword [ecx*4 + 0x10064b10]
push eax
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x47c], ecx
push eax
call fcn.10026de0
call fcn.10037a40
cmp dword [eax], 0x22
je 0x10024710
mov eax, dword ds:[ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp eax, 0x82
jb 0x10024610
jmp 0x10024939
cmp dword [0x10067f2c], 0
je 0x10024739
mov eax, dword [0x10073db8]
nop
test eax, eax
je 0x10024739
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x16
push 0x1005c5d0
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.strtol__ERANGE___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10067f2c], 0
je 0x1002477c
mov eax, dword [0x10073db8]
test eax, eax
je 0x1002477c
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x2b
push 0x1005c54c
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppIDs_from_AppList_folder_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [ebp - 0x4c8], ecx
test eax, eax
jle 0x100248f4
mov edx, str._nAppID:
nop dword [eax]
test ecx, ecx
mov eax, str.AppID:
cmove eax, edx
push eax
call fcn.100012b0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x60], xmm0
movups xmmword [ebp - 0x50], xmm0
movq qword [ebp - 0x40], xmm0
call fcn.10036285
push eax
lea eax, [ebp - 0x60]
push 0x14
push eax
call fcn.1003793e
add esp, 0x14
test eax, eax
je 0x10024a8e
lea ecx, [ebp - 0x60]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024800
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x28
jae 0x10025a6e
xor eax, eax
push 0xa
push eax
mov word [ebp + ecx - 0x60], ax
lea eax, [ebp - 0x60]
push eax
call fcn.10036bfb
mov ecx, dword [ebp - 0x4c8]
add esp, 0xc
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x4e0], eax
lea eax, [ebp - 0x4e4]
mov ecx, dword [ecx*4 + 0x10064b10]
push eax
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0x4e4], ecx
push eax
call fcn.10026de0
call fcn.10037a40
cmp dword [eax], 0x22
je 0x10024a45
push 0
push 0x10067f30
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.1002eee0
push dword [ebp - 0x4c8]
lea eax, [ebp - 0x268]
push 0x10067f30
push str._s_u.txt
push 0xffffffffffffffff
push 0x104
push eax
call fcn.10001360
push dword [ebp - 0x478]
lea eax, [ebp - 0x268]
push 0x10052a54
push eax
call fcn.10002e00
mov ecx, dword [ebp - 0x4c8]
add esp, 0x30
inc ecx
mov edx, str._nAppID:
mov dword [ebp - 0x4c8], ecx
cmp ecx, dword [ebp - 0x474]
jl 0x100247b0
cmp dword [0x100674b0], 1
jne 0x10024939
mov eax, dword [0x10069700]
test eax, eax
je 0x1002490f
push eax
call fcn.10037092
add esp, 4
mov eax, dword [0x10067ce8]
test eax, eax
je 0x10024921
push eax
call fcn.10037092
add esp, 4
mov eax, dword [0x100692e4]
test eax, eax
je 0x10024933
push eax
call fcn.10037092
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x10073988
push str.GreenLuma_2024_Dll______s_r_n
call fcn.100025e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID______lu_r_n_r_n
mov dword [0x10073dbc], eax
call fcn.10002320
add esp, 8
call fcn.10027ff0
cmp dword [0x10073fd8], 0
jne 0x100259ae
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10073fd8], eax
xor ecx, ecx
mov edx, 0x10073fd4
xchg dword [edx], ecx
test eax, eax
je 0x100259b7
cmp byte [0x10066e87], 0
jne 0x10024b4d
cmp byte [0x100672a5], 0
jne 0x10024b46
lea eax, [ebp - 0x474]
mov dword [ebp - 0x478], 1
push eax
push 0x100694f8
lea eax, [ebp - 0x478]
mov dword [ebp - 0x474], 0x208
push eax
push 2
push str.SteamClientDll
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10024ad5
push str.Getting_paths_from_registry_failed__using_local_r_n
call fcn.10002320
add esp, 4
mov ecx, 0x208
mov eax, 0x100694f8
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10024a13
push 0x100672a8
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push 0x100694f8
call fcn.10001360
add esp, 0x14
jmp 0x10024ae2
cmp dword [0x10067f2c], 0
je 0x10024a6c
mov eax, dword [0x10073db8]
test eax, eax
je 0x10024a6c
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x16
push 0x1005c7f0
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10067f2c], 0
je 0x10024ab9
mov eax, dword [0x10073db8]
nop dword [eax]
test eax, eax
je 0x10024ab9
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x23
push 0x1005c780
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_AppID_from_console_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Got_Steamclient_dll_paths_from_registry_r_n
call fcn.10002320
add esp, 4
push 8
push 0
push 0x100694f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x100694f4], eax
test eax, eax
jne 0x10024b59
nop word [eax + eax]
cmp dword [0x10067f2c], eax
je 0x10024b26
mov eax, dword [0x10073db8]
test eax, eax
je 0x10024b26
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x20
push 0x1005c9e0
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Unable_to_load_Steamclient.dll_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100694f4]
jmp 0x10024b59
push str.steamclient.dll
call esi
mov dword [0x100694f4], eax
cmp byte [0x10066e86], 0
jne 0x1002569f
test eax, eax
je 0x10024dcb
push str.Steamclient.dll_is_loaded__r_n
call fcn.10002320
push 0x100694f8
push str.Steamclient______s_r_n_r_n
call fcn.100025e0
add esp, 0xc
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024ba2
mov dword ds:[ebp - 0x480], 0xb
jmp 0x10024bd1
push str.CreateInterface
push eax
call edi
test eax, eax
jne 0x10024bba
mov dword [ebp - 0x480], 0xc
jmp 0x10024bd1
push 0x1006971c
mov edx, 0x10004240
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x480], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024be8
mov dword [ebp - 0x4d0], 0xb
jmp 0x10024c19
push str.Steam_BGetCallback
push eax
call edi
test eax, eax
jne 0x10024c02
mov dword ds:[ebp - 0x4d0], 0xc
jmp 0x10024c19
push 0x1006878c
mov edx, 0x10004ac0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d0], eax
push str.steamclient.dll
nop
call esi
test eax, eax
jne 0x10024c32
mov dword [ebp - 0x4c8], 0xb
jmp 0x10024c61
push str.Steam_FreeLastCallback
push eax
call edi
test eax, eax
jne 0x10024c4a
mov dword [ebp - 0x4c8], 0xc
jmp 0x10024c61
push 0x10068568
mov edx, 0x10004c80
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4c8], eax
push str.steamclient.dll
call esi
test eax, eax
jne 0x10024c78
mov dword [ebp - 0x4cc], 0xb
jmp 0x10024cab
push str.Steam_GetAPICallResult
push eax
call edi
test eax, eax
jne 0x10024c92
mov dword [ebp - 0x4cc], 0xc
jmp 0x10024cab
push 0x10067adc
mov edx, 0x10004d40
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4cc], eax
push str.CreateInterface
push dword [0x100694f4]
call edi
mov edx, 1
mov ecx, eax
call fcn.100285a0
push str.Steam_BGetCallback
push dword [0x100694f4]
mov esi, eax
call edi
mov edx, 1
mov ecx, eax
call fcn.100285a0
push str.Steam_FreeLastCallback
push dword [0x100694f4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.100285a0
push str.Steam_GetAPICallResult
push dword [0x100694f4]
mov dword [ebp - 0x478], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov ecx, eax
call fcn.100285a0
mov ecx, esi
mov dword [ebp - 0x4e0], eax
call fcn.100286a0
mov ecx, dword ds:[ebp - 0x480]
push eax
call fcn.100286a0
push eax
push str.CreateInterface_Hook______s______s_r_n
call fcn.10002320
add esp, 0xc
mov ecx, edi
call fcn.100286a0
mov ecx, dword [ebp - 0x4d0]
push eax
call fcn.100286a0
push eax
push str.Steam_BGetCallback_Hook______s______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x478]
add esp, 0xc
call fcn.100286a0
mov ecx, dword [ebp - 0x4c8]
push eax
call fcn.100286a0
push eax
push str.Steam_FreeLastCallback_Hook______s______s_r_n
call fcn.10002320
mov ecx, dword ds:[ebp - 0x4e0]
add esp, 0xc
call fcn.100286a0
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.100286a0
push eax
push str.Steam_GetAPICallResult_Hook______s______s_r_n_r_n
call fcn.10002320
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024ddd
mov eax, 0xb
jmp 0x10024e05
push str.NtCreateUserProcess
push eax
call edi
test eax, eax
jne 0x10024df0
mov eax, 0xc
jmp 0x10024e05
push 0x10073ba0
mov edx, 0x10003480
mov ecx, eax
call fcn.10028140
push str.ntdll.dll
mov dword [0x10073bac], eax
call esi
test eax, eax
jne 0x10024e1c
mov eax, 0xb
jmp 0x10024e45
push str.NtResumeThread
push eax
call edi
test eax, eax
jne 0x10024e2f
mov eax, 0xc
jmp 0x10024e45
push 0x1006856c
mov edx, 0x10004200
mov ecx, eax
call fcn.10028140
push str.ntdll.dll
mov dword [0x10073b98], eax
call esi
test eax, eax
jne 0x10024e62
mov dword ds:[ebp - 0x4e8], 0xb
jmp 0x10024e91
push str.LdrLoadDll
push eax
call edi
test eax, eax
jne 0x10024e7a
mov dword [ebp - 0x4e8], 0xc
jmp 0x10024e91
push 0x10068cbc
mov edx, 0x10009140
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4e8], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024ea8
mov dword [ebp - 0x4ec], 0xb
jmp 0x10024ed9
push str.LdrGetDllHandleEx
push eax
call edi
test eax, eax
jne 0x10024ec2
mov dword ds:[ebp - 0x4ec], 0xc
jmp 0x10024ed9
push 0x10073b90
mov edx, 0x100091c0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4ec], eax
push str.ntdll.dll
nop
call esi
test eax, eax
jne 0x10024ef2
mov dword [ebp - 0x4f0], 0xb
jmp 0x10024f21
push str.LdrGetDllFullName
push eax
call edi
test eax, eax
jne 0x10024f0a
mov dword [ebp - 0x4f0], 0xc
jmp 0x10024f21
push 0x10067d04
mov edx, 0x10009240
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4f0], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024f38
mov dword [ebp - 0x4f4], 0xb
jmp 0x10024f6b
push str.LdrGetDllHandleByMapping
push eax
call edi
test eax, eax
jne 0x10024f52
mov dword [ebp - 0x4f4], 0xc
jmp 0x10024f6b
push 0x10068684
mov edx, 0x100092a0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4f4], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024f82
mov dword [ebp - 0x4f8], 0xb
jmp 0x10024fb1
push str.LdrGetDllHandleByName
push eax
call edi
test eax, eax
jne 0x10024f9a
mov dword [ebp - 0x4f8], 0xc
jmp 0x10024fb1
push 0x1006857c
mov edx, 0x10009320
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4f8], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10024fc8
mov dword [ebp - 0x4e0], 0xb
jmp 0x10024ff9
push str.LdrQueryProcessModuleInformation
push eax
call edi
test eax, eax
jne 0x10024fe2
mov dword ds:[ebp - 0x4e0], 0xc
jmp 0x10024ff9
push 0x1006972c
mov edx, 0x100093a0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4e0], eax
push str.ntdll.dll
nop
call esi
test eax, eax
jne 0x10025012
mov dword [ebp - 0x478], 0xb
jmp 0x10025041
push str.LdrEnumerateLoadedModules
push eax
call edi
test eax, eax
jne 0x1002502a
mov dword [ebp - 0x478], 0xc
jmp 0x10025041
push 0x100676c4
mov edx, 0x100094e0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x478], eax
push str.ntdll.dll
call esi
test eax, eax
jne 0x10025058
mov dword [ebp - 0x474], 0xb
jmp 0x1002508b
push str.RtlLockModuleSection
push eax
call edi
test eax, eax
jne 0x10025072
mov dword [ebp - 0x474], 0xc
jmp 0x1002508b
push 0x10067f20
mov edx, 0x10009540
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x474], eax
push str.kernel32.dll
call esi
test eax, eax
je 0x100250bf
push str.Module32NextW
push eax
call edi
nop
test eax, eax
je 0x100250bf
push 0x10068574
mov edx, 0x10009560
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d0], eax
test eax, eax
je 0x1002510b
push str.KernelBase.dll
call esi
test eax, eax
jne 0x100250d6
mov dword [ebp - 0x4d0], 0xb
jmp 0x1002510b
push str.Module32NextW
push eax
call edi
nop
test eax, eax
jne 0x100250f0
mov dword [ebp - 0x4d0], 0xc
jmp 0x1002510b
push 0x10068574
mov edx, 0x10009560
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d0], eax
push str.KernelBase.dll
call esi
test eax, eax
je 0x100252cb
push str.EnumProcessModules
push eax
call edi
test eax, eax
je 0x100252cb
push 0x10069720
mov edx, 0x100095e0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x480], eax
test eax, eax
jne 0x100252cb
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10025162
mov dword ds:[ebp - 0x4d4], 0xb
jmp 0x10025191
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x1002517a
mov dword [ebp - 0x4d4], 0xc
jmp 0x10025191
push 0x100692e0
mov edx, 0x10009920
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d4], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x100251a8
mov dword [ebp - 0x4d8], 0xb
jmp 0x100251d9
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x100251c2
mov dword ds:[ebp - 0x4d8], 0xc
jmp 0x100251d9
push 0x10073fd0
mov edx, 0x10009ca0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d8], eax
push str.KernelBase.dll
nop
call esi
test eax, eax
jne 0x100251f2
mov dword [ebp - 0x4dc], 0xb
jmp 0x10025221
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x1002520a
mov dword [ebp - 0x4dc], 0xc
jmp 0x10025221
push 0x10068cb4
mov edx, 0x10009d60
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4dc], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10025238
mov dword [ebp - 0x4cc], 0xb
jmp 0x1002526b
push 0x1005cc10
push eax
call edi
test eax, eax
jne 0x10025252
mov dword [ebp - 0x4cc], 0xc
jmp 0x1002526b
push 0x10073dc4
mov edx, 0x10009e40
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4cc], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x1002528a
mov dword [ebp - 0x4c8], 0xb
push str.KernelBase.dll
jmp 0x1002547e
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x100252aa
mov dword [ebp - 0x4c8], 0xc
push str.KernelBase.dll
jmp 0x1002547e
push 0x10067298
mov edx, 0x10009f00
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4c8], eax
push str.KernelBase.dll
jmp 0x1002547e
push str.Psapi.dll
call esi
test eax, eax
jne 0x100252e2
mov dword [ebp - 0x480], 0xb
jmp 0x10025311
push str.EnumProcessModules
push eax
call edi
test eax, eax
jne 0x100252fa
mov dword [ebp - 0x480], 0xc
jmp 0x10025311
push 0x10069720
mov edx, 0x100095e0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x480], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10025328
mov dword [ebp - 0x4d4], 0xb
jmp 0x10025359
push str.EnumProcessModulesEx
push eax
call edi
test eax, eax
jne 0x10025342
mov dword ds:[ebp - 0x4d4], 0xc
jmp 0x10025359
push 0x100692e0
mov edx, 0x10009920
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d4], eax
push str.Psapi.dll
nop
call esi
test eax, eax
jne 0x10025372
mov dword [ebp - 0x4d8], 0xb
jmp 0x100253a1
push str.GetModuleInformation
push eax
call edi
test eax, eax
jne 0x1002538a
mov dword [ebp - 0x4d8], 0xc
jmp 0x100253a1
push 0x10073fd0
mov edx, 0x10009ca0
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4d8], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x100253b8
mov dword [ebp - 0x4dc], 0xb
jmp 0x100253eb
push str.GetModuleBaseNameW
push eax
call edi
test eax, eax
jne 0x100253d2
mov dword [ebp - 0x4dc], 0xc
jmp 0x100253eb
push 0x10068cb4
mov edx, 0x10009d60
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4dc], eax
push str.KernelBase.dll
call esi
test eax, eax
jne 0x10025402
mov dword [ebp - 0x4cc], 0xb
jmp 0x10025431
push 0x1005cc10
push eax
call edi
test eax, eax
jne 0x1002541a
mov dword [ebp - 0x4cc], 0xc
jmp 0x10025431
push 0x10073dc4
mov edx, 0x10009e40
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4cc], eax
push str.Psapi.dll
call esi
test eax, eax
jne 0x10025448
mov dword [ebp - 0x4c8], 0xb
jmp 0x10025479
push str.GetModuleFileNameExW
push eax
call edi
test eax, eax
jne 0x10025462
mov dword ds:[ebp - 0x4c8], 0xc
jmp 0x10025479
push 0x10067298
mov edx, 0x10009f00
mov ecx, eax
call fcn.10028140
mov dword [ebp - 0x4c8], eax
push str.Psapi.dll
nop
call esi
test eax, eax
jne 0x1002548b
lea esi, [eax + 0xb]
jmp 0x100254af
push str.GetMappedFileNameW
push eax
call edi
test eax, eax
jne 0x1002549c
lea esi, [eax + 0xc]
jmp 0x100254af
push 0x10067d14
mov edx, 0x10009fe0
mov ecx, eax
call fcn.10028140
mov esi, eax
mov ecx, dword [0x10073bac]
call fcn.100286a0
push eax
push str.NtCreateUserProcess_Hook______s_r_n
call fcn.10002320
mov ecx, dword [0x10073b98]
add esp, 8
call fcn.100286a0
push eax
push str.NtResumeThread_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4e8]
add esp, 8
call fcn.100286a0
push eax
push str.LdrLoadDll_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4ec]
add esp, 8
call fcn.100286a0
push eax
push str.LdrGetDllHandleEx_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4f0]
add esp, 8
call fcn.100286a0
push eax
push str.LdrGetDllFullName_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4f4]
add esp, 8
call fcn.100286a0
push eax
push str.LdrGetDllHandleByMapping_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4f8]
add esp, 8
call fcn.100286a0
push eax
push str.LdrGetDllHandleByName_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4e0]
add esp, 8
call fcn.100286a0
push eax
push str.LdrQueryProcessModuleInformation_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x478]
add esp, 8
call fcn.100286a0
push eax
push str.LdrEnumerateLoadedModules_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x474]
add esp, 8
call fcn.100286a0
push eax
push str.RtlLockModuleSection_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4d0]
add esp, 8
call fcn.100286a0
push eax
push str.Module32NextW_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x480]
add esp, 8
call fcn.100286a0
push eax
push str.EnumProcessModules_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4d4]
add esp, 8
call fcn.100286a0
push eax
push str.EnumProcessModulesEx_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4d8]
add esp, 8
call fcn.100286a0
push eax
push str.GetModuleInformation_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4dc]
add esp, 8
call fcn.100286a0
push eax
push str.GetModuleBaseNameW_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4cc]
add esp, 8
call fcn.100286a0
push eax
push str.GetModuleFileNameW_Hook______s_r_n
call fcn.10002320
mov ecx, dword [ebp - 0x4c8]
add esp, 8
call fcn.100286a0
push eax
push str.GetModuleFileNameExW_Hook______s_r_n
call fcn.10002320
add esp, 8
mov ecx, esi
call fcn.100286a0
push eax
push str.GetMappedFileNameW_Hook______s_r_n
call fcn.10002320
add esp, 8
mov edx, 1
xor ecx, ecx
call fcn.100285a0
mov ecx, eax
call fcn.100286a0
push eax
push str.Enable_Hooks______s_r_n_r_n
call fcn.10002320
mov eax, dword [0x100694f4]
add esp, 8
cmp byte [0x100672a5], 1
jne 0x10025715
cmp byte [0x10066e87], 1
jne 0x10025715
push eax
call dword [0x100676c0]
mov ecx, dword [0x100694f4]
push str.xxxxxxxxxxxx
push 0x1005ba5c
mov edx, dword [eax + 0x50]
call fcn.10002000
add esp, 8
mov dword [0x10068cb0], eax
test eax, eax
je 0x10025715
push 0x10068ec8
mov edx, 0x10002ec0
mov dword [0x10068ec8], eax
mov ecx, eax
call fcn.10028140
mov ecx, dword [0x10068cb0]
mov edx, 1
call fcn.100285a0
cmp byte [0x10066e86], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x100257f5
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10067d0c], eax
nop dword [eax + eax]
test eax, eax
jne 0x1002578e
cmp dword [0x10067f2c], eax
je 0x1002576e
mov eax, dword [0x10073db8]
test eax, eax
je 0x1002576e
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x19
push 0x1005cefc
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10023200
push 0
push 0
call esi
nop
test eax, eax
je 0x100257b2
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x100257fb
cmp dword [0x10067f2c], 0
je 0x100257d9
mov eax, dword [0x10073db8]
test eax, eax
je 0x100257d9
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x19
push 0x1005cf4c
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Stealth_mode_failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10066e87], 0
jne 0x10025914
cmp byte [0x100672a5], 1
jne 0x10025914
push 0
push 0
push 0
push 0x100232c0
push 0
push 0
call esi
test eax, eax
je 0x10025966
push eax
call edi
push 0
push 0
push 0
push 0x10023780
push 0
push 0
call esi
test eax, eax
je 0x1002591b
push eax
call edi
xorps xmm0, xmm0
mov dword [ebp - 0x4c4], 0x44
lea eax, [ebp - 0x4c4]
movlpd qword [ebp - 0x4c0], xmm0
push eax
movlpd qword [ebp - 0x4b8], xmm0
movlpd qword [ebp - 0x4b0], xmm0
movlpd qword [ebp - 0x4a8], xmm0
movlpd qword [ebp - 0x4a0], xmm0
movlpd qword [ebp - 0x498], xmm0
movlpd qword [ebp - 0x490], xmm0
movlpd qword [ebp - 0x488], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [ebp - 0x492], 0x10
jb 0x10025914
mov eax, dword ds:[ebp - 0x490]
test eax, eax
je 0x10025914
lea esi, [eax + 4]
test esi, esi
je 0x100258d3
mov esi, dword [esi]
jmp 0x100258e5
xor esi, esi
call fcn.10037a40
mov dword [eax], 0x16
call fcn.10037306
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
nop dword [eax]
cmp eax, 1
jne 0x10025914
test byte [ebp - 0x474], al
je 0x10025914
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
jmp 0x10023eab
cmp dword [0x10067f2c], 0
je 0x10025945
mov eax, dword [0x10073db8]
test eax, eax
je 0x10025945
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x19
push 0x1005cfe4
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error_2
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10067f2c], 0
je 0x1002598d
mov eax, dword [0x10073db8]
test eax, eax
je 0x1002598d
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x17
push 0x1005cf9c
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.GreenLuma_Thread_Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, 0x10073fd4
xchg dword [ecx], eax
cmp dword [0x10067f2c], 0
nop
je 0x100259e5
mov eax, dword [0x10073db8]
test eax, eax
je 0x100259e5
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x1e
push 0x1005c890
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.Unable_to_initialize_MinHook_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10067f2c], 0
je 0x10025a2d
mov eax, dword [0x10073db8]
test eax, eax
je 0x10025a2d
push 0
lea ecx, [ebp - 0x474]
push ecx
push 0x16
push 0x1005c718
jmp 0x10023e8c
push 0x10
push str.GreenLuma_2024
push str.wcstol__ERANGE___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.GreenLuma_2024
push str.Failed_to_read_answer_to_question_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1002d3ec
int3