Could you elaborate plz? how is cracking like writing malware? i did it for my job (non harmful "malware" for PoC's). Changing some ASM JMP's or even dll inject doesnt trigger antivir. This tho is fishy. This instantly tries to connect to a hardcoded ip. not even using DNS. and not throught steam (tested in a vm without it). Theres a reason most Crack groups write "Block the games exe in your firewall" and its not only cause of trying to update.... i will analyse this in detail and report back (especially what it tries to todo with the unwanted network connection, pretty sure it is just a Dl&Exec actual malware code). Because it seems it is mapping a buffer in exec space and tries to call the pointer. In the meantime i would definitly count this a "suspicious" malwarelike behavior!