Function at 0x100a4760
Capabilities:
Create thread
Download url
Encode data using xor
Receive data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10103c33
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd8
mov eax, dword [0x1017d040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
xor eax, eax
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x30], eax
xor edi, edi
mov dword [ebp - 4], eax
movq qword [ebp - 0x50], xmm0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc8], eax
xor esi, esi
mov edi, eax
nop
push 0
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0xc8], esi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x34]
cmp edi, dword [ebp - 0x44]
jne 0x100a485d
cmp eax, dword [ebp - 0xdc]
je 0x100a4841
mov dword [eax], esi
add eax, 4
mov dword [ebp - 0x34], eax
jmp 0x100a485d
lea ecx, [ebp - 0xc8]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.100143b0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x34]
test esi, esi
jne 0x100a4800
mov ecx, dword [ebp - 0x38]
mov esi, ecx
mov edi, dword [ebp - 0xcc]
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xcc], ecx
cmp esi, eax
je 0x100a49f8
mov eax, dword [esi]
lea ecx, [ebp - 0xc4]
mov edx, eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xd0], eax
call fcn.100a4490
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc4]
cmp dword [ebp - 0xb0], 0xf
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xb4]
cmova ecx, edx
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xe4], ecx
cmp eax, 0xf
jb 0x100a49a9
add eax, 0xfffffff2
add eax, ecx
mov dword [ebp - 0xe0], eax
sub eax, ecx
push eax
push 0x54
push ecx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100a49a3
mov edx, edi
mov ecx, str.TXGuiFoundation
mov esi, 0xb
nop
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100a4911
add edx, 4
add ecx, 4
sub esi, 4
jae 0x100a4900
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x100a4938
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x100a4938
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x100a4938
cmp esi, 0xffffffff
je 0x100a4934
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x100a4938
xor eax, eax
jmp 0x100a493d
sbb eax, eax
or eax, 1
test eax, eax
je 0x100a495e
mov eax, dword [ebp - 0xe0]
inc edi
sub eax, edi
push eax
push 0x54
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100a48f3
jmp 0x100a499d
sub edi, dword [ebp - 0xe4]
cmp edi, 0xffffffff
je 0x100a499d
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xd8]
je 0x100a4984
mov ecx, dword [ebp - 0xe8]
mov dword [eax], ecx
add eax, 4
mov dword [ebp - 0x4c], eax
jmp 0x100a499d
lea ecx, [ebp - 0xd0]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.100143b0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xd8], eax
mov esi, dword [ebp - 0xcc]
mov edx, dword [ebp - 0xd4]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xb0]
cmp eax, 0xf
jbe 0x100a49e3
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x100a49d9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push ecx
push edx
call fcn.100fec39
add esp, 8
add esi, 4
mov dword [ebp - 0xcc], esi
cmp esi, dword [ebp - 0x34]
jne 0x100a4880
mov edi, dword [ebp - 0x50]
mov esi, edi
cmp esi, dword [ebp - 0x4c]
je 0x100a4a28
nop
push 0
push str.AEngineRenderWindowClass
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [0x101ae500], eax
test eax, eax
jne 0x100a4af7
add esi, 4
cmp esi, dword [ebp - 0x4c]
jne 0x100a4a00
jmp 0x100a4a2d
mov eax, dword [0x101ae500]
test eax, eax
jne 0x100a4af7
push 0x10
push 0x1011425f
push str.Cant_find_gameloop_window__click_OK_to_try_again_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0
test edi, edi
je 0x100a4aaa
mov eax, dword [ebp - 0xd8]
sub eax, edi
sar eax, 2
lea ecx, [eax*4]
mov eax, edi
cmp ecx, 0x1000
jb 0x100a4a8b
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push ecx
push edi
call fcn.100fec39
add esp, 8
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xc8]
test edx, edx
je 0x100a47a1
mov ecx, dword [ebp - 0xdc]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100a4ae8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push ecx
push edx
call fcn.100fec39
add esp, 8
jmp 0x100a47a1
mov byte [ebp - 4], 0
test edi, edi
je 0x100a4b39
mov eax, dword [ebp - 0xd8]
sub eax, edi
sar eax, 2
lea ecx, [eax*4]
mov eax, edi
cmp ecx, 0x1000
jb 0x100a4b2f
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push ecx
push edi
call fcn.100fec39
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xc8]
test edx, edx
je 0x100a4b84
mov eax, dword [ebp - 0xdc]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x100a4b7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push ecx
push edx
call fcn.100fec39
add esp, 8
call fcn.100a8c40
call fcn.100a8c40
mov dword [ebp - 0x44], eax
test eax, eax
jg 0x100a4bae
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100a8c40
mov esi, eax
mov dword [ebp - 0x44], esi
test esi, esi
jle 0x100a4b95
lea eax, [ebp - 0xac]
push eax
push dword [0x101ae500]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x5c]
sub eax, dword [ebp - 0xac]
mov dword [0x101ada0c], eax
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xa8]
mov dword [0x101ada08], eax
mov eax, dword [0x101ae500]
mov dword [0x101ada04], eax
call fcn.100932f0
mov edi, eax
mov dword [ebp - 4], 3
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xa
jb 0x100a4c35
lea eax, [ecx + 0xa]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x100a4c1c
mov eax, dword [edi]
push 0xa
lea esi, [eax + ecx]
push str.FFont.ttf
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xa], 0
jmp 0x100a4c54
push 0xa
push str.FFont.ttf
mov byte [ebp - 0xd0], 0
mov ecx, edi
push dword [ebp - 0xd0]
push 0xa
call fcn.1000a510
mov edi, eax
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x48]
cmp ecx, 0xf
jbe 0x100a4cc5
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100a4cbb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100a4cbb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fec39
add esp, 8
cmp dword [ebp - 0x60], 0xf
lea eax, [ebp - 0x74]
push 0x10172a70
cmova eax, dword [ebp - 0x74]
push eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
je 0x100a4d04
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x100a4ebb
cmp dword [ebp - 0x60], 0xf
lea esi, [ebp - 0x74]
movups xmm0, xmmword [str.XEFCG]
movups xmmword [ebp - 0x9c], xmm0
movups xmm0, xmmword [0x10172b44]
movups xmmword [ebp - 0x8c], xmm0
movq xmm0, qword [0x10172b54]
movq qword [ebp - 0x7c], xmm0
jbe 0x100a4d39
mov esi, dword [ebp - 0x74]
xor edx, edx
cmp dword [0x101ad6e0], 2
mov dword [ebp - 0xc8], edx
jl 0x100a4e70
movaps xmm0, xmmword [str.0000000000000000TG]
xor ecx, ecx
movaps xmm4, xmmword [0x10173610]
movaps xmm3, xmmword [0x10173d70]
movaps xmm5, xmmword [0x10173660]
movaps xmm6, xmmword [0x10173750]
movaps xmmword [ebp - 0x40], xmm0
mov edx, dword [ebp - 0x40]
nop word [eax + eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x9c]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + ecx - 0x9c], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x98]
xorps xmm2, xmm0
movd dword [ebp + ecx - 0x98], xmm2
add ecx, 8
cmp ecx, 0x28
jl 0x100a4d80
jmp 0x100a4ea7
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xc8]
movsx eax, al
mov cl, dl
imul eax, eax, 0x34
sub cl, al
add cl, 0x30
xor byte [ebp + edx - 0x9c], cl
inc edx
mov dword [ebp - 0xc8], edx
cmp edx, 0x28
jl 0x100a4e70
push 0
push 0
push esi
lea eax, [ebp - 0x9c]
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edi, dword [ebp - 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push 0
push 0x1fffff
call esi
push 0x64
mov dword [0x101ada00], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x8c]
call fcn.100a4240
push edi
mov dword [ebp - 0x40], 0x8fe9514
mov dword [ebp - 0x3c], 0x8c5e224
mov dword [ebp - 0x38], 0x8fd0830
mov dword [ebp - 0x34], 0x5bcc908
movups xmm0, xmmword [ebp - 0x40]
push 0
mov byte [ebp - 0x30], 0x52
mov eax, dword [ebp - 0x30]
push 0x1fffff
movups xmmword [0x101ae508], xmm0
mov dword [0x101ae518], eax
call esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x38], xmm0
mov dword [0x101ada00], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 7
push eax
push 1
push ecx
push bind
push 0x50000000
mov edx, 0x40
mov ecx, 0x101ac6b8
call fcn.100a8d70
mov eax, dword [ebp - 0x34]
add esp, 0x14
mov ecx, dword [ebp - 0x38]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x100a4fba
mov esi, dword [ecx]
mov eax, ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, ecx
and edx, 0xfffffffc
cmp edx, 0x1000
jb 0x100a4fae
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push edx
push ecx
call fcn.100fec39
add esp, 8
jmp 0x100a4ff4
mov byte [ebp - 4], 6
test ecx, ecx
je 0x100a4ff2
mov edx, dword [ebp - 0x30]
mov eax, ecx
sub edx, ecx
and edx, 0xfffffffc
cmp edx, 0x1000
jb 0x100a4fe8
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push edx
push ecx
call fcn.100fec39
add esp, 8
xor esi, esi
mov eax, dword [0x101ae510]
push 0
push 0
push 0
push 0x10041070
add eax, esi
mov dword [0x101ad85c], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
mov dword [0x101ad890], eax
call esi
push 0
push 0
push 0
push 0x1003e360
push 0
mov edi, eax
push 0
mov dword [ebp - 0xd0], edi
call esi
push 0
push 0
push 0
push 0x1003e580
push 0
push 0
mov dword [0x101ad9f8], eax
call esi
push 0
push 0
push 0
push 0x1003f3d0
push 0
push 0
mov dword [0x101ad9e8], eax
call esi
push 0
push 0
push 0
push 0x10040f80
push 0
push 0
mov dword [0x101ad9f0], eax
call esi
push 0
push 0
push 0
push 0x10019190
push 0
push 0
mov dword [0x101ad9f4], eax
call esi
push 0
push 0
push 0
push 0x10019180
push 0
push 0
mov dword [0x101ad9ec], eax
call esi
mov dword [0x101ad9fc], eax
mov eax, dword [0x101add40]
cmp eax, dword [0x101add44]
je 0x100a50c9
mov dword [eax], edi
mov ecx, dword [0x101add40]
add ecx, 4
mov dword [0x101add40], ecx
jmp 0x100a50dc
lea ecx, [ebp - 0xd0]
push ecx
push eax
call fcn.1001a250
mov ecx, dword [0x101add40]
cmp ecx, dword [0x101add44]
je 0x100a50fc
mov eax, dword [0x101ad9f8]
mov dword [ecx], eax
mov ecx, dword [0x101add40]
add ecx, 4
mov dword [0x101add40], ecx
jmp 0x100a510d
push 0x101ad9f8
push ecx
call fcn.1001a250
mov ecx, dword [0x101add40]
cmp ecx, dword [0x101add44]
je 0x100a512d
mov eax, dword [0x101ad9e8]
mov dword [ecx], eax
mov ecx, dword [0x101add40]
add ecx, 4
mov dword [0x101add40], ecx
jmp 0x100a513e
push 0x101ad9e8
push ecx
call fcn.1001a250
mov ecx, dword [0x101add40]
cmp ecx, dword [0x101add44]
je 0x100a515e
mov eax, dword [0x101ad9f0]
mov dword [ecx], eax
mov ecx, dword [0x101add40]
add ecx, 4
mov dword [0x101add40], ecx
jmp 0x100a516f
push 0x101ad9f0
push ecx
call fcn.1001a250
mov ecx, dword [0x101add40]
cmp ecx, dword [0x101add44]
je 0x100a518f
mov eax, dword [0x101ad9f4]
mov dword [ecx], eax
mov ecx, dword [0x101add40]
add ecx, 4
mov dword [0x101add40], ecx
jmp 0x100a51a0
push 0x101ad9f4
push ecx
call fcn.1001a250
mov ecx, dword [0x101add40]
cmp ecx, dword [0x101add44]
je 0x100a51c0
mov eax, dword [0x101ad9ec]
mov dword [ecx], eax
mov ecx, dword [0x101add40]
add ecx, 4
mov dword [0x101add40], ecx
jmp 0x100a51d1
push 0x101ad9ec
push ecx
call fcn.1001a250
mov ecx, dword [0x101add40]
cmp ecx, dword [0x101add44]
je 0x100a51e9
mov eax, dword [0x101ad9fc]
mov dword [ecx], eax
add dword [0x101add40], 4
jmp 0x100a51f4
push 0x101ad9fc
push ecx
call fcn.1001a250
call fcn.10097f20
push 0x100a4710
push 0xfffffffffffffffc
push dword [0x101ae500]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 0x78]
mov dword [0x101ae4fc], eax
cmp ecx, 0xf
jbe 0x100a5244
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100a523a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a526a
push ecx
push edx
call fcn.100fec39
add esp, 8
mov ecx, dword [ebp - 0x60]
cmp ecx, 0xf
jbe 0x100a527a
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100a5270
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100a5270
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fec39
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100fe801
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret