Function at 0x528d20
Capabilities:
Create process on windows
Create process suspended
Query or enumerate registry value
Resume thread
Use process replacement

Disassembly:
push 0xffffffffffffffff
push 0x5447ce
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x597c40]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x597c40]
xor eax, esp
push eax
lea eax, [esp + 0x184]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x194]
call fcn.004111a6
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x528d7e
push 0x80004005
call fcn.00401670
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18c], edi
mov byte [esp + 0x1f], 0xeb
call fcn.004111a6
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x528db4
push 0x80004005
call fcn.00401670
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x18c], 1
mov ecx, dword [ebp + 0x20]
push 0xdbba3
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0x1f4
call dword [sym.imp.USER32.dll_KillTimer]
push 0x44
lea esi, [ebp + 0x79ac]
push edi
push esi
call fcn.00506c50
add esp, 0xc
push edi
lea edx, [esp + 0x28]
push edx
push edi
push 0xf003f
push edi
push edi
xor eax, eax
mov dword [esi], 0x44
lea ebx, [ebp + 0x799c]
push edi
mov dword [ebx], eax
mov dword [ebx + 4], eax
push str.SOFTWAREDeathSoftWoWEmuHacker5
mov dword [ebx + 8], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebx + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x50]
push ecx
push edi
push edi
push str.ClientPath
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x5db724]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push esi
push edi
push edi
push 4
mov esi, 1
push esi
push edi
push edi
push edi
lea edx, [esp + 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x528ec0
push edi
push edi
lea eax, [esp + 0x28]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [esp + 0x20]
push 0x40
push str.Launch_WoW_Error
push ecx
mov ecx, ebp
call fcn.00408667
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x79a4]
push eax
mov dword [ebp + 0x1e38], eax
lea eax, [esp + 0x1c]
push 0x57435c
push eax
call fcn.00401750
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [eax - 4], esi
jle 0x528ef9
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401500
mov eax, dword [esp + 0x18]
mov edx, dword [ebp + 0x1d8]
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x143
push edx
call edi
mov eax, dword [ebp + 0x1d8]
push 0
push 0
push 0x14e
push eax
call edi
lea ecx, [esp + 0x2c]
push ecx
call fcn.00536450
mov byte [esp + 0x18c], 2
lea eax, [esp + 0x4c]
mov dword [esp + 0x30], 5
mov dword [esp + 0x40], 2
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x528f50
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x3c]
call fcn.00401e20
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.005360b0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x190], 3
call fcn.00401c40
mov byte [esp + 0x18c], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x528fb1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x4c]
lea edx, [ebp + 0x1ec8]
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, esi
test cl, cl
jne 0x528fc0
mov edi, dword [esp + 0x14]
cmp dword [edi - 4], esi
jle 0x528fe5
mov edx, dword [edi - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
lea edx, [ebp + 0x1ea0]
mov eax, edi
sub edx, edi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, esi
test cl, cl
jne 0x528ff0
cmp dword [edi - 4], esi
jle 0x529011
mov eax, dword [edi - 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.45892BDEDD0AD70AED4CCD22D9FB5984
push edi
call esi
test eax, eax
jne 0x529052
mov ecx, dword [str.3.3.5.12340]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574bc0]
mov dword [ebp + 0x1e40], edx
mov eax, dword [0x574bc4]
mov esi, ebp
mov dword [ebp + 0x1e44], eax
call fcn.00523ba0
jmp 0x5296e5
cmp dword [edi - 4], 1
jle 0x529069
mov ecx, dword [edi - 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
push str.578AEAFA11C431BF0001436B75C5DBC1
push edi
call esi
test eax, eax
jne 0x5290a4
mov edx, dword [str.3.3.3.11723]
mov dword [ebp + 0x1e3c], edx
mov eax, dword [0x574bf0]
mov dword [ebp + 0x1e40], eax
mov ecx, dword [0x574bf4]
mov esi, ebp
mov dword [ebp + 0x1e44], ecx
call fcn.00523980
jmp 0x5296e5
cmp dword [edi - 4], 1
jle 0x5290bb
mov edx, dword [edi - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
push str.44D5E6E780F3E488156CDE6558075E71
push edi
call esi
test eax, eax
jne 0x5290f6
mov eax, dword [str.3.3.3.11685]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574c20]
mov dword [ebp + 0x1e40], ecx
mov edx, dword [0x574c24]
mov esi, ebp
mov dword [ebp + 0x1e44], edx
call fcn.00523760
jmp 0x5296e5
cmp dword [edi - 4], 1
jle 0x52910d
mov eax, dword [edi - 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
push str.0CC1426B1E320F3F1027B930889668FC
push edi
call esi
test eax, eax
jne 0x529148
mov ecx, dword [str.3.3.2.11403]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574c50]
mov dword [ebp + 0x1e40], edx
mov eax, dword [0x574c54]
mov esi, ebp
mov dword [ebp + 0x1e44], eax
call fcn.00523540
jmp 0x5296e5
cmp dword [edi - 4], 1
jle 0x52915f
mov ecx, dword [edi - 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
push str.8639FC2717E6B1E6E99819C72D80EEF6
push edi
call esi
test eax, eax
jne 0x52919a
mov edx, dword [str.3.3.0.11159]
mov dword [ebp + 0x1e3c], edx
mov eax, dword [0x574c80]
mov dword [ebp + 0x1e40], eax
mov ecx, dword [0x574c84]
mov esi, ebp
mov dword [ebp + 0x1e44], ecx
call fcn.00523320
jmp 0x5296e5
cmp dword [edi - 4], 1
jle 0x5291b1
mov edx, dword [edi - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.00401500
mov edi, dword [esp + 0x14]
push str.4D93E14E419CC5B7B831B401ABC09609
push edi
call esi
test eax, eax
jne 0x5291ec
mov eax, dword [str.3.2.2.10505]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574cb0]
mov dword [ebp + 0x1e40], ecx
mov edx, dword [0x574cb4]
mov esi, ebp
mov dword [ebp + 0x1e44], edx
call fcn.00523100
jmp 0x5296e5
push str.8CB8C7223F63E2435F489E0159B68EF3
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529230
mov eax, dword [str.3.2.0.10314]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574ce0]
mov dword [ebp + 0x1e40], ecx
mov edx, dword [0x574ce4]
mov esi, ebp
mov dword [ebp + 0x1e44], edx
call fcn.00522ee0
jmp 0x5296e1
push str.DC1D651F1674FF70F6C2F87EEAA456B0
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529274
mov eax, dword [str.3.2.0.10192]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574d10]
mov dword [ebp + 0x1e40], ecx
mov edx, dword [0x574d14]
mov esi, ebp
mov dword [ebp + 0x1e44], edx
call fcn.00522cc0
jmp 0x5296e1
push str.0A25671CEA143DECBE18926E283BABE0
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x5292c5
mov eax, dword [str.3.1.3.9947]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574d40]
mov dword [ebp + 0x1e40], ecx
mov dx, word [0x574d44]
mov word [ebp + 0x1e44], dx
mov al, byte [0x574d46]
mov esi, ebp
mov byte [ebp + 0x1e46], al
call fcn.00522aa0
jmp 0x5296e1
push str.912C821D729D3537B3B3C559CCD5C7B2
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529317
mov ecx, dword [str.3.1.2.9901]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574d70]
mov dword [ebp + 0x1e40], edx
mov ax, word [0x574d74]
mov word [ebp + 0x1e44], ax
mov cl, byte [0x574d76]
mov esi, ebp
mov byte [ebp + 0x1e46], cl
call fcn.00522880
jmp 0x5296e1
push str.A8D141C375FBB75FB061BFC017569C12
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529369
mov edx, dword [str.3.1.1.9835]
mov dword [ebp + 0x1e3c], edx
mov eax, dword [0x574da0]
mov dword [ebp + 0x1e40], eax
mov cx, word [0x574da4]
mov word [ebp + 0x1e44], cx
mov dl, byte [0x574da6]
mov esi, ebp
mov byte [ebp + 0x1e46], dl
call fcn.00522660
jmp 0x5296e1
push str.E111FA98C720853F990AFB7993FBB5E5
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x5293ba
mov eax, dword [str.3.1.1.9806]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574dd0]
mov dword [ebp + 0x1e40], ecx
mov dx, word [0x574dd4]
mov word [ebp + 0x1e44], dx
mov al, byte [0x574dd6]
mov esi, ebp
mov byte [ebp + 0x1e46], al
call fcn.00522660
jmp 0x5296e1
push str.E4CA310E6898A165C7F9225858D89300
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529418
mov ecx, dword [str.3.1.0.0000]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574e00]
mov dword [ebp + 0x1e40], edx
mov ax, word [0x574e04]
mov word [ebp + 0x1e44], ax
mov cl, byte [0x574e06]
push 0
push str.3.1.0
mov byte [ebp + 0x1e46], cl
push str.WEH_is_not_supporting_3.1.0
mov ecx, ebp
call fcn.00408667
jmp 0x5296e1
push str.A2BD5DF2350B99BA3460488C427D5CB1
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x52946a
mov edx, dword [str.3.0.9.9551]
mov dword [ebp + 0x1e3c], edx
mov eax, dword [0x574e60]
mov dword [ebp + 0x1e40], eax
mov cx, word [0x574e64]
mov word [ebp + 0x1e44], cx
mov dl, byte [0x574e66]
mov esi, ebp
mov byte [ebp + 0x1e46], dl
call fcn.00522440
jmp 0x5296e1
push str.BA69976B0E6D889210A2B4CA74CFDC08
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x5294bb
mov eax, dword [str.3.0.8.9506]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574e90]
mov dword [ebp + 0x1e40], ecx
mov dx, word [0x574e94]
mov word [ebp + 0x1e44], dx
mov al, byte [0x574e96]
mov esi, ebp
mov byte [ebp + 0x1e46], al
call fcn.00522220
jmp 0x5296e1
push str.F4A5DE0D638C91FD44F0B22A856E7CFC
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x52950d
mov ecx, dword [str.3.0.8.9464]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574ec0]
mov dword [ebp + 0x1e40], edx
mov ax, word [0x574ec4]
mov word [ebp + 0x1e44], ax
mov cl, byte [0x574ec6]
mov esi, ebp
mov byte [ebp + 0x1e46], cl
call fcn.00522220
jmp 0x5296e1
push str.ff932a383c725805445b889b17d8164b
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x52955f
mov edx, dword [str.3.0.3.9183]
mov dword [ebp + 0x1e3c], edx
mov eax, dword [0x574ef0]
mov dword [ebp + 0x1e40], eax
mov cx, word [0x574ef4]
mov word [ebp + 0x1e44], cx
mov dl, byte [0x574ef6]
mov esi, ebp
mov byte [ebp + 0x1e46], dl
call fcn.00521ff0
jmp 0x5296e1
push str.57c5c03097103e15f9abe2803aebdc3c
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x5295b0
mov eax, dword [str.2.4.3.8606]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574f20]
mov dword [ebp + 0x1e40], ecx
mov dx, word [0x574f24]
mov word [ebp + 0x1e44], dx
mov al, byte [0x574f26]
mov esi, ebp
mov byte [ebp + 0x1e46], al
call fcn.00521dd0
jmp 0x5296e1
push str.e09e17991f77929df8b7c86a6aeabf04
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x5295e4
lea edi, [ebp + 0x1e3c]
mov ecx, 7
mov esi, str.2.4.3.8606___Arigity_Modded.
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, ebp
call fcn.00521dd0
jmp 0x5296e1
push str.4f9d0dbe4934cc0e3b528500f9c16218
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529642
mov ecx, dword [str.2.4.3.8606___WoF.]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574f94]
mov dword [ebp + 0x1e40], edx
mov eax, dword [0x574f98]
mov dword [ebp + 0x1e44], eax
mov ecx, dword [0x574f9c]
mov dword [ebp + 0x1e48], ecx
mov dx, word [0x574fa0]
mov esi, ebp
mov word [ebp + 0x1e4c], dx
call fcn.00521dd0
jmp 0x5296e1
push str.E4A10AB537328CA58588A0A6F18BC4DA
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529690
mov eax, dword [str.4.0.3.8278]
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x574fcc]
mov dword [ebp + 0x1e40], ecx
mov dx, word [0x574fd0]
mov word [ebp + 0x1e44], dx
mov al, byte [0x574fd2]
mov esi, ebp
mov byte [ebp + 0x1e46], al
call fcn.00521c50
jmp 0x5296e1
push str.86E5A20BF676398D4F2A8A7ED3EB4752
lea ecx, [esp + 0x18]
call fcn.00403630
push eax
call esi
test eax, eax
jne 0x529884
mov ecx, dword [str.3.2.2.8089]
mov dword [ebp + 0x1e3c], ecx
mov edx, dword [0x574ffc]
mov dword [ebp + 0x1e40], edx
mov ax, word [0x575000]
mov word [ebp + 0x1e44], ax
mov cl, byte [0x575002]
mov esi, ebp
mov byte [ebp + 0x1e46], cl
call fcn.00521ac0
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.00504b99
add esp, 8
test eax, eax
js 0x52987a
cmp eax, dword [edi - 8]
jg 0x52987a
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
mov edx, dword [ebp + 0x79a4]
push edx
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x5db724], eax
test eax, eax
jne 0x52979d
push str._Failed_to_openprocess.
lea ecx, [ebp + 0x22c]
mov byte [0x5db71d], al
call fcn.0040cce4
lea esi, [esp + 0x2c]
call fcn.00406280
mov byte [esp + 0x18c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52976d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0xfffffff0
mov dword [esp + 0x18c], 0xffffffff
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5298d2
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
jmp 0x5298d2
mov eax, dword [ebp + 0xd08]
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x5297df
mov eax, dword [ebp + 0x1e18]
lea ecx, [esp + 0x20]
push ecx
push 1
lea edx, [esp + 0x27]
push edx
push eax
mov eax, dword [0x5db724]
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str._Process_Open.
lea ecx, [ebp + 0x22c]
call fcn.0040cce4
mov ecx, dword [ebp + 0x79a0]
push ecx
mov byte [0x5db71e], 0
mov byte [0x5db71d], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, ebp
call fcn.005254b0
mov ecx, ebp
call fcn.00524180
mov ecx, ebp
call fcn.00523f70
mov ecx, ebp
call fcn.00524bc0
mov ecx, ebp
call fcn.00524b30
mov ecx, ebp
call fcn.00525540
mov ecx, ebp
call fcn.005251f0
mov ecx, ebp
call fcn.00525e20
mov esi, ebp
call fcn.00523dc0
mov ecx, ebp
call fcn.00524f50
lea esi, [esp + 0x2c]
call fcn.00406280
mov byte [esp + 0x18c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x529761
push 0x80070057
call fcn.00401670
mov eax, dword [str.Unknown]
push 0
mov dword [ebp + 0x1e3c], eax
mov ecx, dword [0x575008]
push 0x57500c
mov dword [ebp + 0x1e40], ecx
push 0x575020
mov ecx, ebp
call fcn.00408667
mov edx, dword [ebx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x2c]
call fcn.00406280
lea ecx, [esp + 0x18]
call fcn.004014c0
lea ecx, [esp + 0x14]
call fcn.004014c0
mov ecx, dword [esp + 0x184]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.00504076
add esp, 0x17c
ret 4