Function at 0x1008a630
Capabilities:
Create thread
Encode data using xor
Enumerate gui resources
Execute command
Hide graphical window
Log keystrokes via polling
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094af1
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x101a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
mov ecx, dword [0x101a7e38]
call dword [0x10000000]
mov ecx, dword [0x101a7e38]
call dword [0x10000000]
push 0xb0
lea eax, [ebp - 0x100]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea ecx, [ebp - 0x100]
call fcn.1000a4a0
push str.THOR__Cheat
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.Color_F
call ebx
push str.MODE_Con_Cols56_lines16
call ebx
movaps xmm0, xmmword [0x1019bc10]
sub esp, 0x10
movups xmmword [ebp - 0x34], xmm0
mov edx, esp
mov byte [ebp - 0x14], 1
movaps xmm0, xmmword [0x1019b840]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x104], edx
nop
lea eax, [ecx + 0x5f]
xor byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0x1f
jb 0x1008a6f0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x34]
push 0x1f
mov dword [edx], 0
mov ecx, edx
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
push eax
mov byte [edx], 0
call fcn.10002ca0
mov ecx, 4
call fcn.1008a590
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 0x18
mov edx, str.Version_:
call fcn.10013bc0
cmp dword [0x101a6664], 0x10
mov edx, 0x101a6650
push 0x1000c2f0
push dword [0x101a6660]
cmovae edx, dword [0x101a6650]
mov ecx, eax
call fcn.1000de30
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call fcn.1008a1e0
push 0x3e8
call esi
movaps xmm0, xmmword [0x1019bc20]
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x1c], 0x5c081504
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0x7c555a5d
xor ecx, ecx
mov word [ebp - 0x14], 0x100
mov dword [ebp - 0x104], edx
nop word [eax + eax]
lea eax, [ecx + 0x5f]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x18
jb 0x1008a7b0
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x2c]
push 0x18
mov dword [edx], 0
mov ecx, edx
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
push eax
mov byte [edx], 0
call fcn.10002ca0
mov ecx, 4
call fcn.1008a590
add esp, 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
cmp byte [0x101a7e73], 1
jne 0x1008a838
push 4
push str.THOR__HAX
push 0x1019b108
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
movzx ecx, byte [0x101a7e73]
cmp eax, 6
mov edx, 1
cmove ecx, edx
mov byte [0x101a7e73], cl
movaps xmm0, xmmword [0x1019b850]
sub esp, 0x18
movups xmmword [ebp - 0x34], xmm0
mov edx, esp
mov word [ebp - 0x14], 0x100
movaps xmm0, xmmword [0x1019bc30]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x104], edx
lea eax, [ecx + 0x5f]
xor byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0x20
jb 0x1008a861
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x34]
push 0x20
mov dword [edx], 0
mov ecx, edx
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
push eax
mov byte [edx], 0
call fcn.10002ca0
mov ecx, 4
call fcn.1008a590
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
add esp, 0x18
cmp byte [0x101a7e23], 1
jne 0x1008a8f4
push 0
push 0x1008b0a0
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [0x101a7e18]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1008a8d9
push 9
push dword [0x101a7e18]
call esi
push str.AEngineRenderWindow
push str.AEngineRenderWindowClass
push 0
push dword [0x101a7e18]
call ebx
mov dword [0x101a7e18], eax
jmp 0x1008a944
cmp byte [0x101a7e22], 1
jne 0x1008a93f
push 0
push 0x1008b0a0
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [0x101a7e18]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1008a924
push 9
push dword [0x101a7e18]
call esi
push str.TitanOpenglWindow
push str.TitanOpenglWindowClass
push 0
push dword [0x101a7e18]
call ebx
mov dword [0x101a7e18], eax
jmp 0x1008a944
mov eax, dword [0x101a7e18]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push 0x101a7e3c
push eax
call ebx
mov ecx, dword [0x101a7e3c]
test ecx, ecx
js 0x1008a978
mov edx, dword [0x101a7e40]
test edx, edx
js 0x1008a978
cmp dword [0x101a7e44], 0
jl 0x1008a978
cmp dword [0x101a7e48], 0
jge 0x1008a9f0
lea eax, [ebp - 0x24]
push eax
push dword [0x101a7e18]
call ebx
mov eax, dword [0x101a7e48]
mov ecx, dword [0x101a7e40]
sub eax, ecx
mov edx, dword [0x101a7e44]
mov esi, dword [0x101a7e3c]
sub edx, esi
push 3
push eax
push edx
push ecx
push esi
push 0xffffffffffffffff
push dword [0x101a7d80]
mov dword [0x101d9660], edx
mov dword [0x101d9664], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push dword [0x101d9664]
push dword [0x101d9660]
push dword [0x101a7e40]
push dword [0x101a7e3c]
push dword [0x101a7d80]
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [0x101a7e40]
mov ecx, dword [0x101a7e3c]
sub esp, 8
call fcn.10013e00
add esp, 4
call fcn.10011150
mov eax, dword [0x101a7e2c]
add esp, 4
test eax, eax
je 0x1008aa12
inc dword [eax + 0x370]
push 0x3d48
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x105]
add esp, 4
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x110], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1008aa4d
push 0
mov ecx, eax
call fcn.10049340
mov ecx, eax
jmp 0x1008aa4f
xor ecx, ecx
mov byte [ebp - 4], 0
mov eax, dword [0x101a7e2c]
test eax, eax
cmove eax, ecx
mov dword [0x101a7e2c], eax
call fcn.1004fce0
mov ebx, dword [0x101a7e2c]
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov dword [ebp - 0x104], ebx
test ebx, ebx
jne 0x1008aa9d
push 0xd69
push str.C:UsersmimoDesktopDLL___Copydsoundimgui_dockingimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov ebx, dword [0x101a7e2c]
add esp, 0xc
mov dword [ebp - 0x104], ebx
call fcn.10089310
push 0x78
lea eax, [ebp - 0x200]
mov byte [ebx + 0x358], 1
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x78
lea eax, [ebp - 0x188]
mov dword [ebp - 0x1c8], 0x7f7fffff
push 0
mov esi, 0xffff
mov dword [ebp - 0x1bc], 0x3f800000
push eax
mov word [ebp - 0x1b8], si
mov byte [ebp - 0x1f8], 1
call sub.VCRUNTIME140.dll_memset
movss xmm3, dword [0x1019b5f8]
lea eax, [ebp - 0x188]
mov ecx, dword [ebx + 0x98]
add esp, 0x18
mov dword [ebp - 0x174], 3
mov dword [ebp - 0x170], 1
mov dword [ebp - 0x150], 0x7f7fffff
push 0
push eax
push 0xd3e94
push 0x100b9660
mov dword [ebp - 0x144], 0x3f800000
mov word [ebp - 0x140], si
mov byte [ebp - 0x180], 0
mov byte [ebp - 0x1c4], 1
mov byte [ebp - 0x1e4], 1
mov dword [ebp - 0x1ec], 2
mov dword [ebp - 0x1e8], 2
call fcn.10069c30
movss xmm3, dword [0x1019b5f8]
mov esi, eax
push 0x1019b24c
lea eax, [ebp - 0x200]
push eax
push ecx
mov ecx, dword [ebx + 0x98]
push 0x1009afc8
call fcn.10069d50
movss xmm3, dword [0x1019b5e8]
lea eax, [ebp - 0x188]
mov ecx, dword [ebx + 0x98]
push 0
push eax
push 0xd3e94
push 0x100b9660
call fcn.10069c30
mov dword [0x101a7aec], esi
mov esi, dword [0x101a7d80]
push 0x101ddaa0
mov dword [0x101a7ae8], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1008ad3a
push 0x101dda98
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1008ad3a
mov eax, dword [0x101a7e2c]
mov dword [0x101dda88], esi
test eax, eax
jne 0x1008ac1d
push 0xd69
push str.C:UsersmimoDesktopDLL___Copydsoundimgui_dockingimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov eax, dword [0x101a7e2c]
add esp, 0xc
or dword [eax + 0xc], 6
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [eax + 0xe0], esi
xor esi, esi
mov dword [eax + 0xbc], str.imgui_impl_win32
mov dword [eax + 0x34], 9
mov dword [eax + 0x38], 0x25
mov dword [eax + 0x3c], 0x27
mov dword [eax + 0x40], 0x26
mov dword [eax + 0x44], 0x28
mov dword [eax + 0x48], 0x21
mov dword [eax + 0x4c], 0x22
mov dword [eax + 0x50], 0x24
mov dword [eax + 0x54], 0x23
mov dword [eax + 0x58], 0x2d
mov dword [eax + 0x5c], 0x2e
mov dword [eax + 0x60], 8
mov dword [eax + 0x64], 0x20
mov dword [eax + 0x68], 0xd
mov dword [eax + 0x6c], 0x1b
mov dword [eax + 0x70], 0xd
mov dword [eax + 0x74], 0x41
mov dword [eax + 0x78], 0x43
mov dword [eax + 0x7c], 0x56
mov dword [eax + 0x80], 0x58
mov dword [eax + 0x84], 0x59
mov dword [eax + 0x88], 0x5a
mov dword [ebp - 0x28], str.xinput1_4.dll
mov dword [ebp - 0x24], str.xinput1_3.dll
mov dword [ebp - 0x20], str.xinput9_1_0.dll
mov dword [ebp - 0x1c], str.xinput1_2.dll
mov dword [ebp - 0x18], str.xinput1_1.dll
nop
push dword [ebp + esi*4 - 0x28]
call ebx
mov edi, eax
test edi, edi
jne 0x1008ad14
inc esi
cmp esi, 5
jl 0x1008ad00
jmp 0x1008ad34
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push edi
call esi
push str.XInputGetState
push edi
mov dword [0x101dda80], eax
call esi
mov dword [0x101dda84], eax
mov ebx, dword [ebp - 0x104]
movss xmm3, dword [0x1019b5e8]
lea eax, [ebp - 0x188]
mov ecx, dword [ebx + 0x98]
push 0
push eax
push 0xd3e94
push 0x100b9660
call fcn.10069c30
movss xmm3, dword [0x1019b5e0]
mov ecx, dword [ebx + 0x98]
push 0
mov dword [0x101a7ae8], eax
lea eax, [ebp - 0x188]
push eax
push 0xd3e94
push 0x100b9660
call fcn.10069c30
push ecx
mov ecx, dword [ebx + 0x98]
mov dword [0x101a7aec], eax
call fcn.10069ae0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10007480
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0
push 0
push 0
push 0x1003ba50
push 0
push 0
call esi
push eax
call edi
push 0
push 0
push 0
push 0x1008cab0
push 0
push 0
call esi
push eax
call edi
push 0
push 0
push 0
push 0x1008ea40
push 0
push 0
call esi
push eax
mov dword [0x101a7e24], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
push dword [0x101a7d80]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1008ae46
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x101a7e22], 1
jne 0x1008ae7b
push 0
push 0x101907d4
call dword [sym.imp.USER32.dll_FindWindowW]
push str.TitanOpenglWindow
push str.TitanOpenglWindowClass
push 0
push eax
mov dword [0x101a7e18], eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [0x101a7e18], eax
jmp 0x1008ae80
mov eax, dword [0x101a7e18]
test eax, eax
je 0x1008af2a
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sub edx, ebx
mov ecx, dword [ebp - 0x18]
mov dword [0x101a7d84], ebx
mov dword [0x101a7d6c], esi
cmp dword [0x101a7d68], edx
jne 0x1008aec1
mov eax, ecx
sub eax, esi
cmp dword [0x101a7d64], eax
je 0x1008aecf
sub ecx, esi
mov dword [0x101a7d68], edx
mov dword [0x101a7d64], ecx
push 3
push dword [0x101c8fd4]
push dword [0x101d912c]
push esi
push ebx
push 0xffffffffffffffff
push dword [0x101a7d80]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push dword [0x101c8fd4]
push dword [0x101d912c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [0x101a7d80]
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x101a7d70
push dword [0x101a7d80]
call dword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov ebx, dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp byte [0x101a7e94], 0
je 0x1008af37
push 0x11
jmp 0x1008af39
push 0
push dword [0x101a7d80]
call ebx
cmp byte [0x101a4df1], 0
je 0x1008af52
push dword [0x101a7d80]
call esi
push 0x24
call edi
test al, 1
je 0x1008af68
cmp byte [0x101a4d89], 0
sete byte [0x101a4d89]
push 0x23
call edi
test al, 1
je 0x1008af7e
push str.TaskKill__F__IM_appmarket.exe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x2d
call edi
test al, 1
je 0x1008afef
cmp byte [0x101a4039], 1
mov esi, dword [0x101a7d80]
push 0xffffffffffffffec
push esi
jne 0x1008afb5
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x1008afd3
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push esi
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
call esi
cmp byte [0x101a4039], 0
sete byte [0x101a4039]
cmp byte [0x101a4df1], 0
sete byte [0x101a4df1]
push 0x54
call edi
test al, 1
je 0x1008b02d
mov eax, dword [0x101a7e98]
cmp eax, 2
jne 0x1008b00d
mov dword [0x101a7e98], 0
jmp 0x1008b02d
test eax, eax
jne 0x1008b01d
mov dword [0x101a7e98], 1
jmp 0x1008b02d
cmp eax, 1
mov ecx, 2
cmove eax, ecx
mov dword [0x101a7e98], eax
push 0x72
call edi
test al, 1
je 0x1008b069
cmp byte [0x101a7e65], 0
sete al
cmp byte [0x101a7e64], 0
mov byte [0x101a7e65], al
sete byte [0x101a7e64]
cmp byte [0x101a7e7e], 0
sete byte [0x101a7e7e]
test al, al
jne 0x1008b069
call fcn.1008bba0
push 0x74
call edi
test al, 1
je 0x1008b07f
cmp byte [0x101a7e96], 0
sete byte [0x101a7e96]
push 0x24
call edi
test al, 1
je 0x1008ae10
cmp byte [0x101a4d89], 0
sete byte [0x101a4d89]
jmp 0x1008ae10