Function at 0x1000d2a0
Capabilities:
Create thread
Send data
Send data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10036be4
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x1004b034]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
cmp byte [0x1015e700], 0
je 0x1000d36f
mov eax, dword [0x1015ec5c]
test eax, eax
jne 0x1000d2fd
mov dword [0x1015eadc], eax
mov dword [0x1015eae0], eax
mov word [0x1015eae4], ax
mov byte [0x1015eae6], al
jmp 0x1000d322
mov ecx, dword [eax]
mov dword [0x1015eadc], ecx
mov edx, dword [eax + 4]
mov dword [0x1015eae0], edx
mov cx, word [eax + 8]
mov word [0x1015eae4], cx
mov dl, byte [eax + 0xa]
mov byte [0x1015eae6], dl
mov eax, dword [0x1015ec60]
test eax, eax
je 0x1000d358
mov eax, dword [eax]
test eax, eax
je 0x1000d358
mov ecx, dword [eax]
mov dword [0x1015eae7], ecx
mov edx, dword [eax + 4]
mov dword [0x1015eaeb], edx
mov cx, word [eax + 8]
mov word [0x1015eaef], cx
mov dl, byte [eax + 0xa]
mov byte [0x1015eaf1], dl
jmp 0x1000d36f
xor eax, eax
mov dword [0x1015eae7], eax
mov dword [0x1015eaeb], eax
mov word [0x1015eaef], ax
mov byte [0x1015eaf1], al
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea ecx, [esp + 0x10]
add esp, 4
push ecx
call dword [sym.imp.MSVCR100.dll__localtime64]
add esp, 4
push pe_nt_image_headers32
push str..Xor_PlusLogsLog.txt
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 8
push str..Xor_PlusLogsLog.txt
lea edx, [esp + 0x1c]
push edx
call fcn.1000d720
lea eax, [esp + 0x14]
push str._nLocal_Time:
push eax
mov dword [esp + 0x180], 0
call fcn.10002ad0
push esi
call dword [sym.imp.MSVCR100.dll_asctime]
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.10002ad0
lea edx, [esp + 0x1c]
push str.Hack_Detect:
push edx
call fcn.10002ad0
mov eax, dword [0x1015e858]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.10002ad0
lea edx, [esp + 0x2c]
push 0x10040638
push edx
call fcn.10002ad0
lea eax, [esp + 0x34]
push str.Full_Path:
push eax
call fcn.10002ad0
mov ecx, dword [0x1015e85c]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.10002ad0
lea eax, [esp + 0x44]
push 0x10040638
push eax
call fcn.10002ad0
lea ecx, [esp + 0x4c]
push str.HardwareID:
push ecx
call fcn.10002ad0
mov edx, dword [0x1015ec10]
add esp, 0x40
push 0x10040638
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call fcn.10002ad0
add esp, 0xc
push eax
call fcn.10002ad0
lea ecx, [esp + 0x1c]
push str.HardwareID_v2:
push ecx
call fcn.10002ad0
mov edx, dword [0x1015ec14]
add esp, 0x10
push 0x10040638
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call fcn.10002ad0
add esp, 0xc
push eax
call fcn.10002ad0
lea ecx, [esp + 0x1c]
push str.Account:
push ecx
call fcn.10002ad0
add esp, 0x10
push 0x10040638
push ecx
lea edx, [esp + 0x1c]
push 0x1015eadc
push edx
call fcn.10002ad0
add esp, 0xc
push eax
call fcn.10002ad0
lea eax, [esp + 0x1c]
push str.Character:
push eax
call fcn.10002ad0
lea ecx, [esp + 0x24]
push 0x1015eae7
push ecx
call fcn.10002ad0
lea edx, [esp + 0x2c]
push str._n___________________________________________________
push edx
call fcn.10002ad0
add esp, 0x20
lea eax, [esp + 0x14]
push eax
call fcn.100079c0
cmp byte [0x1015ec3b], 1
jne 0x1000d562
mov ecx, dword [0x1015ec14]
mov edx, dword [0x1015ec10]
mov eax, dword [0x1015e85c]
push 0x1015eae7
push 0x1015eadc
push ecx
mov ecx, dword [0x1015e858]
push edx
push eax
push ecx
push str._H0a0c0k0___n__s__n__s__n__s__n__s__n__s__n__s
push 0x1015e89c
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x1015f4ac]
add esp, 0x20
push 0
push 0x104
push 0x1015e89c
push edx
call dword [sym.imp.WS2_32.dll_send]
call fcn.10011870
lea eax, [esp + 0xbc]
push eax
mov dword [0x1015e86c], 0
call fcn.10006d50
push 1
mov ecx, str..Xor_PlusSplashXor_hack.bmp
lea esi, [esp + 0xd0]
mov byte [esp + 0x17c], 1
call fcn.10007c30
push 0
test eax, eax
jne 0x1000d5ba
mov ecx, dword [esp + 0xc0]
mov ecx, dword [ecx + 4]
push 2
lea ecx, [esp + ecx + 0xc4]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
jmp 0x1000d5d3
mov edx, dword [esp + 0xc0]
mov ecx, dword [edx + 4]
push 0
lea ecx, [esp + ecx + 0xc4]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 4]
mov ecx, dword [esp + eax + 0xc8]
lea eax, [esp + eax + 0xbc]
and cl, 6
movsx edx, cl
neg edx
sbb edx, edx
push 0
not edx
push 0
push 0
test eax, edx
je 0x1000d617
push 0x100037b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10027200
jmp 0x1000d636
push 0x1000ce00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10009910
cmp byte [0x1015ec55], 0
je 0x1000d644
call fcn.10009910
cmp byte [0x1015ec54], 0
je 0x1000d657
call fcn.10009860
call fcn.10009910
mov ecx, dword [esp + 0xbc]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x124]
mov dword [esp + 8], eax
mov dword [esp + edx + 0xbc], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
lea ecx, [esp + 0xcc]
mov byte [esp + 0x178], 2
call fcn.10006f70
mov byte [esp + 0x178], 0
mov eax, dword [esp + 0xbc]
mov ecx, dword [eax + 4]
mov edx, dword [sym.imp.MSVCP100.dll_const_std::basic_istream_char__struct_std::char_traits_char__::vftable]
mov dword [esp + ecx + 0xbc], edx
lea ecx, [esp + 0x124]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x74]
mov dword [esp + 8], eax
mov dword [esp + edx + 0x14], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
lea ecx, [esp + 0x18]
mov dword [esp + 0x178], 3
call fcn.10006f70
mov dword [esp + 0x178], 0xffffffff
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [sym.imp.MSVCP100.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov dword [esp + ecx + 0x14], edx
lea ecx, [esp + 0x74]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret