Function at 0x1000f7e0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
mov edi, ecx
push ecx
mov dword [ebp - 0x18], edi
mov dword [esp], 0x41900000
call fcn.100351a0
add esp, 4
cmp dword [edi + 0xac], 1
push dword [edi + 0xa4]
push 0
jne 0x1000fe5a
mov eax, dword [edi + 0xe0]
mov dword [ebp - 0x1c], 0x43660000
movss xmm0, dword [eax + 0xd4]
subss xmm0, dword [eax + 0x10]
movss xmm1, dword [eax + 0x18]
lea eax, [ebp - 0x1c]
push eax
push str.Colorsthemechanger
subss xmm1, xmm0
subss xmm1, dword [0x10159740]
movss dword [ebp - 0x18], xmm1
call fcn.10033360
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x41200000
push eax
mov dword [ebp - 0x18], 0x41200000
call fcn.100350c0
call fcn.10034ce0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0xe4
push eax
push str.Sub_Tabs_Background
call fcn.1006f6c0
call fcn.10061660
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0xd4
push eax
push str.Menu_Background
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0xf4
push eax
push str.Popup_Background
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x104
push eax
push str.Modal_Popup_Background
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
add esp, 0x44
add eax, 0x114
push 0
push eax
push str.Color_Picker_Background
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x364
push eax
push str.Tabs_Background
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x344
push eax
push str.Separator
call fcn.1006f6c0
call fcn.10061660
push 0xffffffffffffffff
push 0x10154f94
lea eax, [edi + 0xb4]
push eax
push str.Checboxthemechanger
call fcn.10062540
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x154
push eax
push str.Checkbox_Hovered
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
add esp, 0x40
add eax, 0x144
push 0
push eax
push str.Checkbox_Active
call fcn.1006f6c0
call fcn.10061660
push 0
push 0x10157dd0
push 0x10154f94
push 0x100
push 0xffffff00
lea eax, [edi + 0xb0]
push eax
push str.Sliderthemechanger
call fcn.1006d4e0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x254
push eax
push str.Slider
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x284
push eax
push str.Slider_Grabbed
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
add esp, 0x40
add eax, 0x294
push 0
push eax
push str.Slider_Previous
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x264
push eax
push str.Slider_Background
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x274
push eax
push str.Slider_Background_In_Popup
call fcn.1006f6c0
call fcn.10061660
mov dword [ebp - 0x18], 0
lea eax, [edi + 0xb5]
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x1c]
push 0x10154f94
push 0x10158bd8
push eax
push str.Multi_Combo
call fcn.1006c4e0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x1a4
push eax
push str.Combo_Preview
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
add esp, 0x48
add eax, 0x1c4
push 0
push eax
push str.Combo_Background
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x1d4
push eax
push str.Combo_Element
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x1f4
push eax
push str.Combo_Element_Hovered
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x1e4
push eax
push str.Combo_Element_Active
call fcn.1006f6c0
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x224
push eax
push str.Scrollbar
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x244
push eax
push str.Scrollbar_Grabbed
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
add esp, 0x48
add eax, 0x234
push 0
push eax
push str.Scrollbar_Hovered
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x204
push eax
push str.Scrollbar_Background
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x214
push eax
push str.Scrollbar_Background_In_Combo
call fcn.1006f6c0
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x2d4
push eax
push str.Button1
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x2f4
push eax
push str.Button_Held
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x2e4
push eax
push str.Button_Hovered
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
add esp, 0x48
add eax, 0x304
push 0
push eax
push str.Button_Large
call fcn.1006f6c0
call fcn.10061660
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x354
push eax
push 0x10158d84
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x384
push eax
push str.Tab_Selected
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x394
push eax
push str.Tab_Held
call fcn.1006f6c0
push 0
mov eax, dword [edi + 0xdc]
add eax, 0x374
push eax
push str.Tab_Hovered
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x3a4
push eax
push str.Tab_Trail
call fcn.1006f6c0
add esp, 0x48
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x314
push eax
push str.List_Background
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x324
push eax
push str.List_Hovered
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x334
push eax
push str.List_Selected
call fcn.1006f6c0
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x424
push eax
push str.Group_Button
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x444
push eax
push str.Group_Button_Held
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x434
push eax
push str.Group_Button_Hovered
call fcn.1006f6c0
add esp, 0x48
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x454
push eax
push str.Changelog_Button
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x474
push eax
push str.Changelog_Button_Held
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x464
push eax
push str.Changelog_Button_Hovered
call fcn.1006f6c0
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x484
push eax
push str.Discord_Button
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4a4
push eax
push str.Discord_Button_Held
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x494
push eax
push str.Discord_Button_Hovered
call fcn.1006f6c0
add esp, 0x48
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4b4
push eax
push str.Theme_Editor_Button
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4d4
push eax
push str.Theme_Editor_Button_Held
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4c4
push eax
push str.Theme_Editor_Button_Hovered
call fcn.1006f6c0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4e4
push eax
push str.Theme_Editor_Button_Active
call fcn.1006f6c0
call fcn.10061660
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4f4
push eax
push str.Unload_Button
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x514
push eax
push str.Unload_Button_Held
call fcn.1006f6c0
mov eax, dword ds:[edi + 0xdc]
add esp, 0x48
add eax, 0x504
push 0
push eax
push str.Unload_Button_Hovered
call fcn.1006f6c0
add esp, 0xc
call fcn.10061660
mov ecx, edi
call fcn.10020620
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x43660000
push eax
push str.Themesthemechanger
mov dword [ebp - 0x10], 0x43680000
call fcn.10033360
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x41200000
push eax
mov dword [ebp - 0x10], 0x41200000
call fcn.100350c0
call fcn.10034ce0
add esp, 0x10
mov dword [esp], 0x3f800000
push 0x25
call fcn.100348e0
push eax
push 2
call fcn.10034220
mov eax, dword [edi + 0xe0]
mov ecx, dword [0x1023dad4]
push 0
push 0
movss xmm0, dword [eax + 0xd0]
subss xmm0, dword [eax + 0xc]
movss xmm1, dword [eax + 0x14]
mov eax, dword [ecx + 0x1cdc]
subss xmm1, xmm0
mov byte [eax + 0x8c], 1
mov eax, dword [ecx + 0x1cdc]
subss xmm1, dword [0x10159750]
movss xmm0, dword [eax + 0x18]
lea eax, [ebp - 0x14]
subss xmm0, dword [0x10159758]
push eax
push str.themelist
movss dword [ebp - 0x14], xmm1
movss dword [ebp - 0x10], xmm0
call fcn.10033360
mov ecx, dword [0x101f602c]
add esp, 0x20
mov byte [ebp - 1], al
mov edx, dword [ecx]
call dword [edx]
mov ecx, dword [0x101f602c]
call fcn.100a7140
mov dword [ebp - 0xc], eax
mov esi, dword [eax + 4]
sub esi, dword [eax]
sar esi, 2
cmp byte [ebp - 1], 0
mov dword [ebp - 8], esi
je 0x100100d7
push ecx
mov dword [esp], 0x3f800000
push 0x27
call fcn.100348e0
push eax
push 0x20
call fcn.10034220
add esp, 0xc
mov dword [esp], 0x3f800000
push 0x26
call fcn.100348e0
push eax
push 0x1f
call fcn.10034220
mov eax, dword [ebp - 0xc]
add esp, 0x10
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x100100ca
nop dword [eax]
mov ecx, dword [0x101f602c]
mov esi, dword [edi]
call fcn.100a5820
mov edx, dword [edi]
xorps xmm0, xmm0
cmp eax, dword [esi + 0x30]
mov dword [ebp - 0x28], 0
sete byte [ebp - 1]
mov dword [ebp - 0x24], 0
cmp dword [edx + 0x2c], 0xf
lea ecx, [edx + 0x18]
movq qword [ebp - 0x44], xmm0
jbe 0x1000ffc8
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x28]
sub esp, 8
mov dword [ebp - 0x38], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x34], eax
mov eax, esp
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0xc0000000
mov dword [ebp - 0x40], 0x10000008
push 6
mov dword [eax], 2
mov dword [eax + 4], ecx
lea eax, [ebp - 0x5c]
push 0x10158a28
push eax
call fcn.1001d560
cmp dword ds:[ebp - 0x48], 0xf
lea ecx, [ebp - 0x28]
push ecx
push 0
lea ecx, [ebp - 1]
lea eax, [ebp - 0x5c]
cmova eax, dword [ebp - 0x5c]
push ecx
push eax
call fcn.100725e0
mov ecx, dword [ebp - 0x48]
add esp, 0x24
cmp ecx, 0xf
jbe 0x1001005c
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10010052
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010433
push ecx
push edx
call fcn.100d34fa
add esp, 8
cmp byte [ebp - 1], 0
je 0x10010072
mov eax, dword [edi]
mov ecx, dword [0x101f602c]
push dword [eax + 0x30]
call fcn.100a5840
mov eax, dword [edi]
mov esi, dword [ebp - 8]
cmp dword [eax + 0x30], 1
jne 0x100100be
nop dword [eax]
cmp esi, 2
jle 0x100100be
call fcn.10035080
fadd dword [0x10159730]
push ecx
fstp dword [esp]
call fcn.10035140
call fcn.100350a0
fadd dword [0x10159724]
fstp dword [esp]
call fcn.100351a0
add esp, 4
call fcn.10034ce0
call fcn.10061660
call fcn.10034e20
add edi, 4
cmp edi, dword [ebp - 0x10]
jne 0x1000ff90
push 2
call fcn.10034380
mov edi, dword [ebp - 0x18]
add esp, 4
call fcn.10033400
push 1
call fcn.10034380
mov ecx, dword [0x101f602c]
add esp, 4
call fcn.100a5820
mov edx, eax
lea ecx, [esi - 1]
mov dword [ebp - 0x18], edx
cmp ecx, edx
jge 0x1001012d
mov ecx, dword [0x101f602c]
call fcn.100b1300
mov ecx, dword [0x101f602c]
mov edx, dword [ecx]
call dword [edx]
lea ecx, [esi - 2]
xor eax, eax
test ecx, ecx
cmovns eax, ecx
mov ecx, dword [0x101f602c]
push eax
call fcn.100a5840
mov edx, dword [ebp - 0x18]
mov eax, dword ds:[ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
cmp eax, edx
jbe 0x1001042e
mov edx, dword [ecx + edx*4]
add edx, 0x34
cmp dword [edx + 0x14], 0xf
jbe 0x10010156
mov edx, dword [edx]
mov cl, 0xd
mov dword [ebp - 0x2c], 0x687f4e0d
mov dword [ebp - 0x28], 0x7f62796c
xor eax, eax
mov dword [ebp - 0x24], 0x7e282d37
mov byte [ebp - 0x20], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xb
jae 0x10010182
mov cl, byte [ebp - 0x2c]
jmp 0x10010173
push edx
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x20], 0
push eax
call fcn.100618e0
add esp, 8
mov ecx, edi
call fcn.10020620
mov eax, dword [edi + 0xe0]
push ecx
mov dword [esp], 0x3f800000
push 2
movss xmm0, dword [eax + 0xd0]
subss xmm0, dword [eax + 0xc]
movss xmm1, dword [eax + 0x14]
subss xmm1, xmm0
subss xmm1, dword [0x10159738]
movss dword [ebp - 0xc], xmm1
call fcn.100348e0
push eax
push 0x2f
call fcn.10034220
movss xmm0, dword [ebp - 0xc]
mov al, 9
mov byte [ebp - 0x2b], 0x5d
mov cl, 0x35
xor al, byte [ebp - 0x2b]
mov ah, 0x30
xor cl, byte [ebp - 0x2b]
mov dl, 0x38
mov byte [ebp - 0x2a], al
mov ch, dl
mov byte [ebp - 0x29], cl
mov dh, 0x7d
mov cl, byte [ebp - 0x2b]
mov byte [ebp - 1], 0x13
xor dl, cl
mov al, byte [ebp - 1]
xor dh, cl
xor al, cl
mov byte [ebp - 2], 0x3c
mov byte [ebp - 0x24], al
mov al, byte [ebp - 2]
xor al, cl
mov byte [ebp - 3], ah
mov byte [ebp - 0x23], al
xor ah, cl
mov al, byte [ebp - 3]
xor al, cl
mov byte [ebp - 4], ch
push 0
mov byte [ebp - 0x22], al
xor ch, cl
mov al, byte [ebp - 4]
mov dword [ebp - 0x18], 0x41f00000
xor al, cl
push dword [ebp - 0x18]
movss dword [ebp - 0x1c], xmm0
push dword [ebp - 0x1c]
mov byte [ebp - 0x27], ah
mov byte [ebp - 0x21], al
lea eax, [edi + 0x60]
push 0x20
push eax
lea eax, [ebp - 0x2a]
mov byte [ebp - 0x20], 0
push eax
mov byte [ebp - 0x28], dl
mov byte [ebp - 0x26], ch
mov byte [ebp - 0x25], dh
mov byte [ebp - 0x20], 0
call fcn.1006e9a0
push 1
call fcn.10034380
add esp, 0x2c
mov dword [ebp - 0x2e], 0x57407132
mov cl, 0x32
mov dword [ebp - 0x2a], 0x12574653
mov dword [ebp - 0x26], 0x53611214
mov word [ebp - 0x22], 0x5744
mov byte [ebp - 0x20], 0
xor eax, eax
xor byte ds:[ebp + eax - 0x2d], cl
inc eax
cmp eax, 0xd
jae 0x100102aa
mov cl, byte [ebp - 0x2e]
jmp 0x10010298
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.10067680
add esp, 8
mov dword [ebp - 0x2e], 0x3e291b48
mov cl, 0x48
mov dword [ebp - 0x2a], 0x2d1b682d
mov dword [ebp - 0x26], 0x3c2b2d24
xor eax, eax
mov word [ebp - 0x22], 0x2c2d
mov byte [ebp - 0x20], 0
nop
xor byte [ebp + eax - 0x2d], cl
inc eax
cmp eax, 0xd
jae 0x100102ef
mov cl, byte [ebp - 0x2e]
jmp 0x100102e0
push 1
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.10068ce0
add esp, 0xc
mov dword [ebp - 0x2e], 0x5e50733f
mov cl, 0x3f
mov dword [ebp - 0x2a], 0x5a6c1f5b
mov dword [ebp - 0x26], 0x4b5c5a53
xor eax, eax
mov word [ebp - 0x22], 0x5b5a
mov byte [ebp - 0x20], 0
nop dword [eax + eax]
xor byte [ebp + eax - 0x2d], cl
inc eax
cmp eax, 0xd
jae 0x1001033f
mov cl, byte [ebp - 0x2e]
jmp 0x10010330
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.10067e40
movaps xmm0, xmmword [0x101597a0]
add esp, 8
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], 0
xor ecx, ecx
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xf
jb 0x10010362
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.10069c00
add esp, 4
mov dword [esp], 0x3f800000
push 0x24
call fcn.100348e0
push eax
push 0x21
call fcn.10034220
mov eax, dword fs:[0x2c]
add esp, 0x10
mov ecx, dword [0x1024918c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1023d96c]
cmp eax, dword [ecx + 4]
jg 0x10010438
movss xmm0, dword [ebp - 0xc]
xor ecx, ecx
movss dword [ebp - 0x28], xmm0
movaps xmm0, xmmword [0x10159770]
mov dword [ebp - 0x24], 0x41f00000
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x1e0908
nop
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x12
jb 0x100103e0
lea eax, [ebp - 0x28]
mov byte [ebp - 0x31], 0
push eax
lea eax, [ebp - 0x43]
push eax
call fcn.10062120
add esp, 8
test al, al
je 0x1001041b
push 1
push 0
push 0
push dword [0x1023d968]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
call fcn.10034380
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10021540
call fcn.100f63c2
push 0x1023d96c
nop dword [eax]
call fcn.100d393d
add esp, 4
cmp dword [0x1023d96c], 0xffffffff
jne 0x100103ba
mov ecx, dword [0x101f602c]
nop dword [eax + eax]
call fcn.100b1320
cmp dword [eax + 0x14], 0xf
jbe 0x1001046f
mov eax, dword [eax]
jmp 0x1001046f
push 0x1023d96c
mov dword [0x1023d968], eax
call fcn.100d38ec
add esp, 4
jmp 0x100103ba