Function at 0x100c8c40
Capabilities:
Allocate or change rwx memory
Create thread
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x102150eb]
test eax, eax
je 0x100c8c60
jmp 0x100c971f
mov byte [0x102150eb], 1
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0xd21fff
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100c971f
push 0x101f7280
push 1
push 0x101f7290
push 0x101f729c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x1020f0cc], eax
push 0x101f72a8
push 1
push str.WideScreenScale
push 0x101f72c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x1020f0c8], eax
push str..DataKGDataLocalServerGame.info
mov ecx, 0x10545808
call fcn.10116e40
movzx edx, al
test edx, edx
jne 0x100c8cf6
push 0x10
push 0x101f72f8
push str.ServerGame.info_no_funciona_o_es_invalida_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1023db40
call fcn.1000e1d0
jmp 0x100c971f
push str..DataKGDataLocalEffectGame.info
mov ecx, 0x10545808
call fcn.10116bc0
movzx eax, al
test eax, eax
jne 0x100c8d2f
push 0x10
push 0x101f7350
push str.EffectGame.info_no_funciona_o_es_invalida_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1023db40
call fcn.1000e1d0
jmp 0x100c971f
mov ecx, 0x104fc956
call fcn.1010afe0
cmp dword [0x10545c44], 1
jne 0x100c8d5c
call fcn.1000eb10
push 0
push 0
push 0
push 0x100c8bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x105459dc], 1
jne 0x100c8d6a
call fcn.100c8b70
call fcn.10045170
call fcn.10121970
push 0xa0
push 0xe61144
call fcn.10122950
add esp, 8
push 0xeb
push 0x4d1e69
call fcn.10122950
add esp, 8
push 0xe9
push 0x4d228d
call fcn.10122950
add esp, 8
push 0x8b
push 0x4d228e
call fcn.10122950
add esp, 8
push 0
push 0x4d228f
call fcn.10122950
add esp, 8
push 0
push 0x4d2290
call fcn.10122950
add esp, 8
push 0
push 0x4d2291
call fcn.10122950
add esp, 8
push 0xeb
push 0x4d559c
call fcn.10122950
add esp, 8
push 0xeb
push 0x633f7a
call fcn.10122950
add esp, 8
push 0xeb
push 0x634403
call fcn.10122950
add esp, 8
push 0xeb
push 0x63e6c4
call fcn.10122950
add esp, 8
push 0xeb
push 0x4d2246
call fcn.10122950
add esp, 8
push 0xeb
push 0x501163
call fcn.10122950
add esp, 8
push 0
push 0x40af0a
call fcn.10122950
add esp, 8
push 0x50
push 0x40b4bc
call fcn.10122950
add esp, 8
push 0x50
push 0x40b4c5
call fcn.10122950
add esp, 8
push 0x18
push 0x40b4cf
call fcn.10122950
add esp, 8
push 0
push 0x40af0a
call fcn.10122950
add esp, 8
push 0xeb
push 0x40afd5
call fcn.10122950
add esp, 8
push 0x70
push 0x777fd6
call fcn.10122950
add esp, 8
push 0x17
push 0x777fd7
call fcn.10122950
add esp, 8
push 0x3c
push 0x4ebec7
call fcn.10122950
add esp, 8
push 0x3c
push 0x5c4004
call fcn.10122950
add esp, 8
push 0x3c
push 0x7e40bb
call fcn.10122950
add esp, 8
push 0x3c
push 0x81b546
call fcn.10122950
add esp, 8
push 0x3c
push 0x81b58d
call fcn.10122950
add esp, 8
push 0x3c
push 0x86e284
call fcn.10122950
add esp, 8
push 0x3c
push 0x86e44c
call fcn.10122950
add esp, 8
push 0x3c
push 0x86e573
call fcn.10122950
add esp, 8
push 0x3c
push 0x86f8fc
call fcn.10122950
add esp, 8
push 0xb7
push 0x7da373
call fcn.10122950
add esp, 8
push 0xb7
push 0x7e1c44
call fcn.10122950
add esp, 8
push 0xeb
push 0x52100d
call fcn.10122950
add esp, 8
push 0
push 0x9543c4
call fcn.10122950
add esp, 8
push 0x4d1dc2
push 0x4d1cf0
push 0xe9
call fcn.10122ae0
add esp, 0xc
push 0x1b
push 0x90
push 0xd20170
call fcn.10122bc0
add esp, 0xc
cmp dword [0x10545a88], 0
jne 0x100c8fd9
mov dword [ebp - 0x10], 0xeb
jmp 0x100c8fe0
mov dword [ebp - 0x10], 0x75
movzx ecx, byte [ebp - 0x10]
push ecx
push 0x64cbd1
call fcn.10122950
add esp, 8
movzx edx, byte [0x10545a8c]
push edx
push 0x64cbd0
call fcn.10122950
add esp, 8
movzx eax, byte [0x10545a8c]
push eax
push 0x95ceef
call fcn.10122950
add esp, 8
movzx ecx, byte [0x10545a8c]
push ecx
push 0x95cf14
call fcn.10122950
add esp, 8
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [eax + 0x10545870]
add ecx, 1
push ecx
push 0xe61f68
call fcn.10122950
add esp, 8
mov edx, 1
shl edx, 1
movsx eax, byte [edx + 0x10545870]
add eax, 2
push eax
push 0xe61f69
call fcn.10122950
add esp, 8
mov ecx, 1
imul edx, ecx, 3
movsx eax, byte [edx + 0x10545870]
add eax, 3
push eax
push 0xe61f6a
call fcn.10122950
add esp, 8
mov ecx, 1
imul edx, ecx, 5
movsx eax, byte [edx + 0x10545870]
add eax, 4
push eax
push 0xe61f6b
call fcn.10122950
add esp, 8
mov ecx, 1
imul edx, ecx, 6
movsx eax, byte [edx + 0x10545870]
add eax, 5
push eax
push 0xe61f6c
call fcn.10122950
add esp, 8
movzx ecx, word [0x1054586e]
push ecx
push 0xe609e4
call fcn.101229a0
add esp, 8
cmp dword [0x10545a84], 0x3c
jb 0x100c90f8
mov ecx, 0x1023e4c0
call fcn.10029420
cmp dword [0x10545a84], 0x3c
jae 0x100c9134
push 0x102150e4
push 0x4d9d3b
call fcn.101229f0
add esp, 8
push 0x102150e4
push 0x4dac60
call fcn.101229f0
add esp, 8
push 0xa
push 0x7b55338
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x4d597b
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x4da289
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x4da297
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x4da3a2
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x4da3ce
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x4da3d9
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x63d326
call fcn.101229f0
add esp, 8
push 0x102150e0
push 0x642112
call fcn.101229f0
add esp, 8
push 0x10545889
push 0x4d0e09
call fcn.101229f0
add esp, 8
push 0x105458a9
push 0x4d9f55
call fcn.101229f0
add esp, 8
push 0
push 0x5c914e
call fcn.10122950
add esp, 8
push 0x14
push 0x90
push 0x63e908
call fcn.10122bc0
add esp, 0xc
push 0x20
push 0x1054584d
push 0xe611b2
call fcn.10122b60
add esp, 0xc
push 0x11
push 0x10545878
push 0xe61f70
call fcn.10122b60
add esp, 0xc
push fcn.10117f20
push 0x65fd79
push 0xff
call fcn.10122ae0
add esp, 0xc
push 0x100b2450
push 0x4da280
push 0xe9
call fcn.10122ae0
add esp, 0xc
cmp dword [0x10545a84], 0x3c
jae 0x100c9283
push 0x100b2480
push 0x4da3a1
push 0xe9
call fcn.10122ae0
add esp, 0xc
jmp 0x100c929a
push 0x100b2660
push 0x4da3a1
push 0xe9
call fcn.10122ae0
add esp, 0xc
push 0xc
push 0x4d9d39
call fcn.10122c20
add esp, 8
push 7
push 0x4d9d45
call fcn.10122c20
add esp, 8
push 0xf
push 0x4d9efc
call fcn.10122c20
add esp, 8
cmp dword [0x10545a84], 0x3c
jae 0x100c92df
push 8
push 0x4dac5c
call fcn.10122c20
add esp, 8
push 5
push 0x5451f7
call fcn.10122c20
add esp, 8
push 8
push 0x545230
call fcn.10122c20
add esp, 8
push 8
push 0x5a52e9
call fcn.10122c20
add esp, 8
push 0x102193f8
push 0x6a
mov edx, dword [0x10215a64]
push edx
call fcn.10122dd0
add esp, 0xc
push 0x10219308
push 0x6b
mov eax, dword [0x10215a64]
push eax
call fcn.10122dd0
add esp, 0xc
push 0x102194e8
push 0x6c
mov ecx, dword [0x10215a64]
push ecx
call fcn.10122dd0
add esp, 0xc
mov ecx, 0x1023e4bc
call fcn.1003bb30
mov ecx, 0x1024f441
call fcn.1004d890
mov ecx, 0x1024f464
call fcn.1004d800
lea ecx, [ebp - 9]
call fcn.1006d220
lea ecx, [ebp - 9]
call fcn.10007120
cmp dword [0x10545c70], 1
jne 0x100c938e
mov ecx, 0x10253730
call fcn.1005e210
push 0x100b2aa0
push 0x5b96e8
push 0xe8
call fcn.10122ae0
add esp, 0xc
mov ecx, 0x1023db40
call fcn.1000e2e0
mov ecx, 0x104dfe4c
call fcn.1009ccc0
mov ecx, 0x1024f443
call fcn.1009c330
push str.DataEnc1.dat
mov ecx, 0x104fab50
call fcn.100eaf70
push str.DataDec2.dat
mov ecx, 0x104fab50
call fcn.100eaf90
mov ecx, 0x104fc958
call fcn.100f8d60
mov ecx, 0x105010b8
call fcn.10106a10
mov ecx, 0x10500d1c
call fcn.10103180
mov ecx, 0x104fc954
call fcn.100f8b40
mov ecx, 0x1050106c
call fcn.10102880
mov ecx, 0x104fca14
call fcn.10102ed0
mov ecx, 0x10500cec
call fcn.100fbbe0
mov ecx, 0x105457a4
call fcn.1010c540
mov ecx, 0x1024f444
call fcn.1004d410
mov ecx, 0x1024f650
call fcn.10054780
mov ecx, 0x1020f0ba
call fcn.1008a900
mov ecx, 0x10261170
call fcn.10066b10
mov ecx, 0x104bc508
call fcn.100963b0
mov ecx, 0x104fa7c4
call fcn.100bdbf0
mov dword [0x104e2cec], 1
cmp dword [0x10545c1c], 2
jne 0x100c948a
mov ecx, 0x10296178
call fcn.10088810
mov ecx, 0x1024f4c8
call fcn.10054420
mov ecx, 0x10215af4
call fcn.100f1f00
mov ecx, 0x104fa920
call fcn.100e7730
mov ecx, 0x10214fe0
call fcn.100820a0
cmp dword [0x10545b5c], 1
jne 0x100c94d9
mov ecx, 0x10295ed0
call fcn.1007dd60
mov ecx, 0x104e13dc
call fcn.100b1a30
mov ecx, 0x1028bd10
call fcn.1007a060
cmp dword [0x10545cc0], 1
jne 0x100c94ec
mov ecx, 0x1023db78
call fcn.1000f3d0
cmp dword [0x10545c04], 1
jne 0x100c94ff
mov ecx, 0x102629bc
call fcn.1007f420
cmp dword [0x10545c08], 1
jne 0x100c9512
mov ecx, 0x1020eec5
call fcn.10041b70
cmp dword [0x10545c00], 1
jne 0x100c9525
mov ecx, 0x1023cf6c
call fcn.10009eb0
cmp dword [0x10545bf0], 1
jne 0x100c9533
call fcn.100bc8b0
cmp dword [0x10545bf8], 1
jne 0x100c9546
mov ecx, 0x1023f18c
call fcn.1004cae0
cmp dword [0x10545bd8], 1
jne 0x100c9559
mov ecx, 0x104faa50
call fcn.100e8a60
cmp dword [0x10545bdc], 1
jne 0x100c9567
call fcn.1000cab0
cmp dword [0x10545be4], 1
jne 0x100c957a
mov ecx, 0x10215af6
call fcn.1011d0d0
call fcn.1005cf60
call fcn.100b2850
call fcn.100ba1a0
call fcn.100ba320
call fcn.100f3d50
call fcn.1011b340
mov ecx, 0x10610d48
call fcn.1011f480
cmp dword [0x10545bf4], 1
jne 0x100c95b5
mov ecx, 0x10261180
call fcn.10067350
call fcn.1011c3c0
mov edx, dword [0x10215a64]
push edx
mov ecx, 0x1020f0d0
call fcn.1005e4e0
call fcn.100ba3e0
mov ecx, 0x10217fe0
call fcn.10122180
mov ecx, 0x104e2ce0
call fcn.100b3e90
mov ecx, 0x104b9360
call fcn.1008b2f0
mov ecx, 0x104bc610
call fcn.100985e0
mov ecx, 0x104fa7fc
call fcn.100e96f0
mov ecx, 0x1023cf80
call fcn.1000a050
mov ecx, 0x10545808
call fcn.101170b0
mov ecx, 0x10545808
call fcn.10117100
mov ecx, 0x10545808
call fcn.10117190
mov ecx, 0x10545808
call fcn.101172f0
mov ecx, 0x10545808
call fcn.10117490
mov ecx, 0x10545808
call fcn.10117630
mov ecx, 0x10545808
call fcn.101177d0
mov ecx, 0x10545808
call fcn.10117970
mov ecx, 0x10545808
call fcn.10117b10
mov ecx, 0x10545808
call fcn.10117cb0
mov ecx, 0x1023dc6c
call fcn.1000fd80
mov ecx, 0x104fb3f8
call fcn.100f12be
call fcn.100f1c00
mov ecx, 0x1028b264
call fcn.1006c550
mov ecx, 0x1021ac74
call fcn.10007870
cmp dword [0x10545a60], 1
jne 0x100c96ee
push 0x105459e0
push 0x954149
call fcn.101229f0
add esp, 8
push 0x10545a00
push 0x954116
call fcn.101229f0
add esp, 8
push 0x10545a20
push 0x9540e3
call fcn.101229f0
add esp, 8
push 0x10545a40
push 0x9540ad
call fcn.101229f0
add esp, 8
cmp dword [0x10545af8], 1
jne 0x100c9701
mov ecx, 0x104eada8
call fcn.100bcac0
mov ecx, 0x104dfe4d
call fcn.1009e820
mov ecx, 0x10500ed8
call fcn.100fff50
mov ecx, 0x10500d50
call fcn.100fc300
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret