Function at 0x10025700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
cmp eax, 1
jne 0x100259a2
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlImageNtHeader
push eax
mov dword [0x100690a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100678a0], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 2
mov dword [0x10067cb8], edi
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10025786
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push 0x10068b78
push dword [ebp - 0x1c]
call ebx
nop dword [eax]
test eax, eax
jne 0x100257bf
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___2_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x100257ee
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x10067488
push edi
call ebx
test eax, eax
jne 0x1002581a
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_dll_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call esi
nop dword [eax]
cmp eax, 0x7a
jne 0x10025846
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_dll_path___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10068b78
push 0x104
push 0x100696d0
call fcn.1003709d
push 0x10067488
push 0x104
push 0x10073d70
call fcn.1003709d
add esp, 0x18
mov edx, str.user32.dll
mov ecx, 0x10073d70
call fcn.10001d80
cmp al, 1
jne 0x10025998
push str.steamclient.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push edi
call dword [0x100678a0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0xc], esi
test edi, edi
je 0x10025909
mov edx, dword [esi + 0x50]
mov ecx, edi
push str.xxx____x____x____
push 0x1005ce60
call fcn.10001fc0
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [0x10073f8c], eax
test eax, eax
je 0x10025909
mov word ds:[ebp - 0x18], 0x18eb
call ebx
push 0
mov esi, eax
lea eax, [ebp - 0x18]
push 2
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0x50]
mov ecx, edi
push str.xx____xx_x
push 0x1005bafc
mov edx, esi
call fcn.10001fc0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10025947
mov dword [ebp - 0x14], 0x188e9
mov word [ebp - 0x10], 0x9000
call ebx
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push 6
push eax
push dword [ebp - 0xc]
jmp 0x1002597e
push str.xx____x______xx_x
push 0x1005bb40
mov edx, esi
mov ecx, edi
call fcn.10001fc0
mov edi, eax
add esp, 8
test edi, edi
je 0x10025991
mov dword [ebp - 0xc], 0x18be9
mov word [ebp - 8], 0x9000
call ebx
push 0
mov esi, eax
lea eax, [ebp - 0xc]
push 6
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov byte [0x10066e5f], 1
xor ecx, ecx
call fcn.100238c0
pop ebx
jmp 0x100259ea
test eax, eax
jne 0x100259ea
cmp byte [0x10066e5e], al
jne 0x100259ea
xor edx, edx
xor ecx, ecx
call fcn.10028080
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateUserProcess
push dword [0x100690a0]
call esi
mov ecx, eax
call fcn.10027f40
push str.NtResumeThread
push dword [0x100690a0]
call esi
mov ecx, eax
call fcn.10027f40
call fcn.10027b20
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002cc86
mov esp, ebp
pop ebp
ret 0xc