Function at 0x1000ce20
Capabilities:
Create thread
Send data
Send data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036c3e
mov eax, dword fs:[0]
push eax
sub esp, 0x164
push esi
mov eax, dword [0x1004b034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1015e700], 0
je 0x1000cee8
mov eax, dword [0x1015ec5c]
test eax, eax
jne 0x1000ce76
mov dword [0x1015eadc], eax
mov dword [0x1015eae0], eax
mov word [0x1015eae4], ax
mov byte [0x1015eae6], al
jmp 0x1000ce9b
mov ecx, dword [eax]
mov dword [0x1015eadc], ecx
mov edx, dword [eax + 4]
mov dword [0x1015eae0], edx
mov cx, word [eax + 8]
mov word [0x1015eae4], cx
mov dl, byte [eax + 0xa]
mov byte [0x1015eae6], dl
mov eax, dword [0x1015ec60]
test eax, eax
je 0x1000ced1
mov eax, dword [eax]
test eax, eax
je 0x1000ced1
mov ecx, dword [eax]
mov dword [0x1015eae7], ecx
mov edx, dword [eax + 4]
mov dword [0x1015eaeb], edx
mov cx, word [eax + 8]
mov word [0x1015eaef], cx
mov dl, byte [eax + 0xa]
mov byte [0x1015eaf1], dl
jmp 0x1000cee8
xor eax, eax
mov dword [0x1015eae7], eax
mov dword [0x1015eaeb], eax
mov word [0x1015eaef], ax
mov byte [0x1015eaf1], al
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea ecx, [ebp - 0x18]
add esp, 4
push ecx
call dword [sym.imp.MSVCR100.dll__localtime64]
add esp, 4
push 0x80
push str..DataInterface_newui_ctscoreleftl99.OZT
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 8
push str..DataInterface_newui_ctscoreleftl99.OZT
lea edx, [ebp - 0xc0]
push edx
call fcn.1000d720
lea eax, [ebp - 0xc0]
push str._nLocal_Time:
push eax
mov dword [ebp - 4], 0
call fcn.10002ad0
push esi
call dword [sym.imp.MSVCR100.dll_asctime]
add esp, 0xc
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.10002ad0
lea edx, [ebp - 0xc0]
push str.Hack_Detect:
push edx
call fcn.10002ad0
mov eax, dword [0x1015e858]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.10002ad0
lea edx, [ebp - 0xc0]
push 0x10040638
push edx
call fcn.10002ad0
lea eax, [ebp - 0xc0]
push str.Full_Path:
push eax
call fcn.10002ad0
mov ecx, dword [0x1015e85c]
push ecx
lea edx, [ebp - 0xc0]
push edx
call fcn.10002ad0
lea eax, [ebp - 0xc0]
push 0x10040638
push eax
call fcn.10002ad0
lea ecx, [ebp - 0xc0]
push str.HardwareID:
push ecx
call fcn.10002ad0
mov edx, dword [0x1015ec10]
add esp, 0x40
push 0x10040638
push ecx
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.10002ad0
add esp, 0xc
push eax
call fcn.10002ad0
lea ecx, [ebp - 0xc0]
push str.HardwareID_v2:
push ecx
call fcn.10002ad0
mov edx, dword [0x1015ec14]
add esp, 0x10
push 0x10040638
push ecx
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.10002ad0
add esp, 0xc
push eax
call fcn.10002ad0
lea ecx, [ebp - 0xc0]
push str.Account:
push ecx
call fcn.10002ad0
add esp, 0x10
push 0x10040638
push ecx
lea edx, [ebp - 0xc0]
push 0x1015eadc
push edx
call fcn.10002ad0
add esp, 0xc
push eax
call fcn.10002ad0
lea eax, [ebp - 0xc0]
push str.Character:
push eax
call fcn.10002ad0
lea ecx, [ebp - 0xc0]
push 0x1015eae7
push ecx
call fcn.10002ad0
lea edx, [ebp - 0xc0]
push str._n___________________________________________________
push edx
call fcn.10002ad0
add esp, 0x20
lea eax, [ebp - 0xc0]
push eax
call fcn.100079c0
cmp byte [0x1015ec3b], 1
jne 0x1000d0fb
mov ecx, dword [0x1015ec14]
mov edx, dword [0x1015ec10]
mov eax, dword [0x1015e85c]
push 0x1015eae7
push 0x1015eadc
push ecx
mov ecx, dword [0x1015e858]
push edx
push eax
push ecx
push str._H0a0c0k0___n__s__n__s__n__s__n__s__n__s__n__s
push 0x1015e89c
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x1015f4ac]
add esp, 0x20
push 0
push 0x104
push 0x1015e89c
push edx
call dword [sym.imp.WS2_32.dll_send]
call fcn.10010720
cmp dword [0x1015e870], 1
mov dword [0x1015e86c], 0
jne 0x1000d238
lea eax, [ebp - 0x170]
push eax
call fcn.10006d50
push 1
mov ecx, str..Xor_PlusSplashXor_hack.bmp
lea esi, [ebp - 0x160]
mov byte [ebp - 4], 1
call fcn.10007c30
push 0
test eax, eax
jne 0x1000d159
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx + 4]
push 2
lea ecx, [ebp + ecx - 0x170]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
jmp 0x1000d171
mov edx, dword [ebp - 0x170]
mov ecx, dword [edx + 4]
push 0
lea ecx, [ebp + ecx - 0x170]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + eax - 0x164]
lea eax, [ebp + eax - 0x170]
and cl, 6
movsx edx, cl
neg edx
sbb edx, edx
push 0
not edx
push 0
push 0
test eax, edx
je 0x1000d1b4
push 0x100037b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10027200
jmp 0x1000d1e6
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1000ce00
push 0
push 0
call esi
push 0
push 0
push 0
push 0x100037b0
push 0
push 0
call esi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10009910
mov ecx, dword [ebp - 0x170]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10], eax
mov dword [ebp + edx - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 2
call fcn.10006f70
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 4]
mov edx, dword [sym.imp.MSVCP100.dll_const_std::basic_istream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0x170], edx
lea ecx, [ebp - 0x108]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x10], eax
mov dword [ebp + edx - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], 3
call fcn.10006f70
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
mov edx, dword [sym.imp.MSVCP100.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [ebp + ecx - 0xc0], edx
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret