Function at 0x10014300
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
mov edi, ecx
push ecx
mov dword [ebp - 0x18], edi
mov dword [esp], 0x41900000
call fcn.10038c40
add esp, 4
cmp dword [edi + 0xac], 1
push dword [edi + 0xa4]
push 0
jne 0x1001497a
mov eax, dword [edi + 0xe0]
mov dword [ebp - 0x1c], 0x43660000
movss xmm0, dword [eax + 0xd4]
subss xmm0, dword [eax + 0x10]
movss xmm1, dword [eax + 0x18]
lea eax, [ebp - 0x1c]
push eax
push str.Colorsthemechanger
subss xmm1, xmm0
subss xmm1, dword [0x1015c798]
movss dword [ebp - 0x18], xmm1
call fcn.10036e00
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x41200000
push eax
mov dword [ebp - 0x18], 0x41200000
call fcn.10038b60
call fcn.10038780
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0xe4
push eax
push str.Sub_Tabs_Background
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0xd4
push eax
push str.Menu_Background
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0xf4
push eax
push str.Popup_Background
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x104
push eax
push str.Modal_Popup_Background
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
add esp, 0x44
add eax, 0x114
push 0
push eax
push str.Color_Picker_Background
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x364
push eax
push str.Tabs_Background
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x344
push eax
push str.Separator
call fcn.10072cc0
call fcn.10064ba0
push 0xffffffffffffffff
push 0x10157ebd
lea eax, [edi + 0xb4]
push eax
push str.Checboxthemechanger
call fcn.10065a80
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x154
push eax
push str.Checkbox_Hovered
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
add esp, 0x40
add eax, 0x144
push 0
push eax
push str.Checkbox_Active
call fcn.10072cc0
call fcn.10064ba0
push 0
push 0x1015ae80
push 0x10157ebd
push 0x100
push 0xffffff00
lea eax, [edi + 0xb0]
push eax
push str.Sliderthemechanger
call fcn.10070ac0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x254
push eax
push str.Slider
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x284
push eax
push str.Slider_Grabbed
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
add esp, 0x40
add eax, 0x294
push 0
push eax
push str.Slider_Previous
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x264
push eax
push str.Slider_Background
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x274
push eax
push str.Slider_Background_In_Popup
call fcn.10072cc0
call fcn.10064ba0
mov dword [ebp - 0x18], 0
lea eax, [edi + 0xb5]
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x1c]
push 0x10157ebd
push 0x1015bc48
push eax
push str.Multi_Combo
call fcn.1006fac0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x1a4
push eax
push str.Combo_Preview
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
add esp, 0x48
add eax, 0x1c4
push 0
push eax
push str.Combo_Background
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x1d4
push eax
push str.Combo_Element
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x1f4
push eax
push str.Combo_Element_Hovered
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x1e4
push eax
push str.Combo_Element_Active
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x224
push eax
push str.Scrollbar
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x244
push eax
push str.Scrollbar_Grabbed
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
add esp, 0x48
add eax, 0x234
push 0
push eax
push str.Scrollbar_Hovered
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x204
push eax
push str.Scrollbar_Background
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x214
push eax
push str.Scrollbar_Background_In_Combo
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x2d4
push eax
push str.Button1
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x2f4
push eax
push str.Button_Held
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x2e4
push eax
push str.Button_Hovered
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
add esp, 0x48
add eax, 0x304
push 0
push eax
push str.Button_Large
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x354
push eax
push 0x1015bdf4
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x384
push eax
push str.Tab_Selected
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x394
push eax
push str.Tab_Held
call fcn.10072cc0
push 0
mov eax, dword [edi + 0xdc]
add eax, 0x374
push eax
push str.Tab_Hovered
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x3a4
push eax
push str.Tab_Trail
call fcn.10072cc0
add esp, 0x48
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x314
push eax
push str.List_Background
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x324
push eax
push str.List_Hovered
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x334
push eax
push str.List_Selected
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x424
push eax
push str.Group_Button
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x444
push eax
push str.Group_Button_Held
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x434
push eax
push str.Group_Button_Hovered
call fcn.10072cc0
add esp, 0x48
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x454
push eax
push str.Changelog_Button
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x474
push eax
push str.Changelog_Button_Held
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x464
push eax
push str.Changelog_Button_Hovered
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x484
push eax
push str.Discord_Button
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4a4
push eax
push str.Discord_Button_Held
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x494
push eax
push str.Discord_Button_Hovered
call fcn.10072cc0
add esp, 0x48
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4b4
push eax
push str.Theme_Editor_Button
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4d4
push eax
push str.Theme_Editor_Button_Held
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4c4
push eax
push str.Theme_Editor_Button_Hovered
call fcn.10072cc0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4e4
push eax
push str.Theme_Editor_Button_Active
call fcn.10072cc0
call fcn.10064ba0
mov eax, dword [edi + 0xdc]
push 0
add eax, 0x4f4
push eax
push str.Unload_Button
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
push 0
add eax, 0x514
push eax
push str.Unload_Button_Held
call fcn.10072cc0
mov eax, dword ds:[edi + 0xdc]
add esp, 0x48
add eax, 0x504
push 0
push eax
push str.Unload_Button_Hovered
call fcn.10072cc0
add esp, 0xc
call fcn.10064ba0
mov ecx, edi
call fcn.10024740
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x43660000
push eax
push str.Themesthemechanger
mov dword [ebp - 0x10], 0x43680000
call fcn.10036e00
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x41200000
push eax
mov dword [ebp - 0x10], 0x41200000
call fcn.10038b60
call fcn.10038780
add esp, 0x10
mov dword [esp], 0x3f800000
push 0x25
call fcn.10038380
push eax
push 2
call fcn.10037cc0
mov eax, dword [edi + 0xe0]
mov ecx, dword [0x10240b04]
push 0
push 0
movss xmm0, dword [eax + 0xd0]
subss xmm0, dword [eax + 0xc]
movss xmm1, dword [eax + 0x14]
mov eax, dword [ecx + 0x1cdc]
subss xmm1, xmm0
mov byte [eax + 0x8c], 1
mov eax, dword [ecx + 0x1cdc]
subss xmm1, dword [0x1015c7a8]
movss xmm0, dword [eax + 0x18]
lea eax, [ebp - 0x14]
subss xmm0, dword [0x1015c7b0]
push eax
push str.themelist
movss dword [ebp - 0x14], xmm1
movss dword [ebp - 0x10], xmm0
call fcn.10036e00
mov ecx, dword [0x101f9034]
add esp, 0x20
mov byte [ebp - 1], al
mov edx, dword [ecx]
call dword [edx]
mov ecx, dword [0x101f9034]
call fcn.100aa0a0
mov dword [ebp - 0xc], eax
mov esi, dword [eax + 4]
sub esi, dword [eax]
sar esi, 2
cmp byte [ebp - 1], 0
mov dword [ebp - 8], esi
je 0x10014bf7
push ecx
mov dword [esp], 0x3f800000
push 0x27
call fcn.10038380
push eax
push 0x20
call fcn.10037cc0
add esp, 0xc
mov dword [esp], 0x3f800000
push 0x26
call fcn.10038380
push eax
push 0x1f
call fcn.10037cc0
mov eax, dword [ebp - 0xc]
add esp, 0x10
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x10014bea
nop dword [eax]
mov ecx, dword [0x101f9034]
mov esi, dword [edi]
call fcn.100a8760
mov edx, dword [edi]
xorps xmm0, xmm0
cmp eax, dword [esi + 0x30]
mov dword [ebp - 0x28], 0
sete byte [ebp - 1]
mov dword [ebp - 0x24], 0
cmp dword [edx + 0x2c], 0xf
lea ecx, [edx + 0x18]
movq qword [ebp - 0x44], xmm0
jbe 0x10014ae8
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x28]
sub esp, 8
mov dword [ebp - 0x38], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x34], eax
mov eax, esp
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0xc0000000
mov dword [ebp - 0x40], 0x10000008
push 6
mov dword [eax], 2
mov dword [eax + 4], ecx
lea eax, [ebp - 0x5c]
push 0x1015ba98
push eax
call fcn.10021d80
cmp dword ds:[ebp - 0x48], 0xf
lea ecx, [ebp - 0x28]
push ecx
push 0
lea ecx, [ebp - 1]
lea eax, [ebp - 0x5c]
cmova eax, dword [ebp - 0x5c]
push ecx
push eax
call fcn.10075c40
mov ecx, dword [ebp - 0x48]
add esp, 0x24
cmp ecx, 0xf
jbe 0x10014b7c
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10014b72
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10014f53
push ecx
push edx
call fcn.100d656e
add esp, 8
cmp byte [ebp - 1], 0
je 0x10014b92
mov eax, dword [edi]
mov ecx, dword [0x101f9034]
push dword [eax + 0x30]
call fcn.100a8780
mov eax, dword [edi]
mov esi, dword [ebp - 8]
cmp dword [eax + 0x30], 1
jne 0x10014bde
nop dword [eax]
cmp esi, 2
jle 0x10014bde
call fcn.10038b20
fadd dword [0x1015c788]
push ecx
fstp dword [esp]
call fcn.10038be0
call fcn.10038b40
fadd dword [0x1015c77c]
fstp dword [esp]
call fcn.10038c40
add esp, 4
call fcn.10038780
call fcn.10064ba0
call fcn.100388c0
add edi, 4
cmp edi, dword [ebp - 0x10]
jne 0x10014ab0
push 2
call fcn.10037e20
mov edi, dword [ebp - 0x18]
add esp, 4
call fcn.10036ea0
push 1
call fcn.10037e20
mov ecx, dword [0x101f9034]
add esp, 4
call fcn.100a8760
mov edx, eax
lea ecx, [esi - 1]
mov dword [ebp - 0x18], edx
cmp ecx, edx
jge 0x10014c4d
mov ecx, dword [0x101f9034]
call fcn.100b3fa0
mov ecx, dword [0x101f9034]
mov edx, dword [ecx]
call dword [edx]
lea ecx, [esi - 2]
xor eax, eax
test ecx, ecx
cmovns eax, ecx
mov ecx, dword [0x101f9034]
push eax
call fcn.100a8780
mov edx, dword [ebp - 0x18]
mov eax, dword ds:[ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
cmp eax, edx
jbe 0x10014f4e
mov edx, dword [ecx + edx*4]
add edx, 0x34
cmp dword [edx + 0x14], 0xf
jbe 0x10014c76
mov edx, dword [edx]
mov cl, 0xa
mov dword [ebp - 0x2c], 0x6f78490a
mov dword [ebp - 0x28], 0x78657e6b
xor eax, eax
mov dword [ebp - 0x24], 0x792f2a30
mov byte [ebp - 0x20], 0
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xb
jae 0x10014ca2
mov cl, byte [ebp - 0x2c]
jmp 0x10014c93
push edx
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x20], 0
push eax
call fcn.10064e20
add esp, 8
mov ecx, edi
call fcn.10024740
mov eax, dword [edi + 0xe0]
push ecx
mov dword [esp], 0x3f800000
push 2
movss xmm0, dword [eax + 0xd0]
subss xmm0, dword [eax + 0xc]
movss xmm1, dword [eax + 0x14]
subss xmm1, xmm0
subss xmm1, dword [0x1015c790]
movss dword [ebp - 0xc], xmm1
call fcn.10038380
push eax
push 0x2f
call fcn.10037cc0
movss xmm0, dword [ebp - 0xc]
mov al, 0x42
mov byte [ebp - 0x2b], 0x16
mov cl, 0x7e
xor al, byte [ebp - 0x2b]
mov ah, 0x7b
xor cl, byte [ebp - 0x2b]
mov dl, 0x73
mov byte [ebp - 0x2a], al
mov ch, dl
mov byte [ebp - 0x29], cl
mov dh, 0x36
mov cl, byte [ebp - 0x2b]
mov byte [ebp - 1], 0x58
xor dl, cl
mov al, byte [ebp - 1]
xor dh, cl
xor al, cl
mov byte [ebp - 2], 0x77
mov byte [ebp - 0x24], al
mov al, byte [ebp - 2]
xor al, cl
mov byte [ebp - 3], ah
mov byte [ebp - 0x23], al
xor ah, cl
mov al, byte [ebp - 3]
xor al, cl
mov byte [ebp - 4], ch
push 0
mov byte [ebp - 0x22], al
xor ch, cl
mov al, byte [ebp - 4]
mov dword [ebp - 0x18], 0x41f00000
xor al, cl
push dword [ebp - 0x18]
movss dword [ebp - 0x1c], xmm0
push dword [ebp - 0x1c]
mov byte [ebp - 0x27], ah
mov byte [ebp - 0x21], al
lea eax, [edi + 0x60]
push 0x20
push eax
lea eax, [ebp - 0x2a]
mov byte [ebp - 0x20], 0
push eax
mov byte [ebp - 0x28], dl
mov byte [ebp - 0x26], ch
mov byte [ebp - 0x25], dh
mov byte [ebp - 0x20], 0
call fcn.10071fa0
push 1
call fcn.10037e20
add esp, 0x2c
mov dword [ebp - 0x2e], 0x7e69581b
mov cl, 0x1b
mov dword [ebp - 0x2a], 0x3b7e6f7a
mov dword [ebp - 0x26], 0x7a483b3d
mov word [ebp - 0x22], 0x7e6d
mov byte [ebp - 0x20], 0
xor eax, eax
xor byte ds:[ebp + eax - 0x2d], cl
inc eax
cmp eax, 0xd
jae 0x10014dca
mov cl, byte [ebp - 0x2e]
jmp 0x10014db8
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.1006ac40
add esp, 8
mov dword [ebp - 0x2e], 0x41566437
mov cl, 0x37
mov dword [ebp - 0x2a], 0x52641752
mov dword [ebp - 0x26], 0x4354525b
xor eax, eax
mov word [ebp - 0x22], 0x5352
mov byte [ebp - 0x20], 0
nop
xor byte [ebp + eax - 0x2d], cl
inc eax
cmp eax, 0xd
jae 0x10014e0f
mov cl, byte [ebp - 0x2e]
jmp 0x10014e00
push 1
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.1006c2a0
add esp, 0xc
mov dword [ebp - 0x2e], 0x67694a06
mov cl, 6
mov dword [ebp - 0x2a], 0x63552662
mov dword [ebp - 0x26], 0x7265636a
xor eax, eax
mov word [ebp - 0x22], 0x6263
mov byte [ebp - 0x20], 0
nop dword [eax + eax]
xor byte [ebp + eax - 0x2d], cl
inc eax
cmp eax, 0xd
jae 0x10014e5f
mov cl, byte [ebp - 0x2e]
jmp 0x10014e50
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.1006b400
movaps xmm0, xmmword [0x1015c7f0]
add esp, 8
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], 0
xor ecx, ecx
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xf
jb 0x10014e82
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x20], 0
push 1
push eax
call fcn.1006d1c0
add esp, 4
mov dword [esp], 0x3f800000
push 0x24
call fcn.10038380
push eax
push 0x21
call fcn.10037cc0
mov eax, dword fs:[0x2c]
add esp, 0x10
mov ecx, dword [0x1024c214]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x102409c4]
cmp eax, dword [ecx + 4]
jg 0x10014f58
movss xmm0, dword [ebp - 0xc]
xor ecx, ecx
movss dword [ebp - 0x28], xmm0
movaps xmm0, xmmword [0x1015c7c0]
mov dword [ebp - 0x24], 0x41f00000
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x1e0908
nop
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x12
jb 0x10014f00
lea eax, [ebp - 0x28]
mov byte [ebp - 0x31], 0
push eax
lea eax, [ebp - 0x43]
push eax
call fcn.10065660
add esp, 8
test al, al
je 0x10014f3b
push 1
push 0
push 0
push dword [0x102409c0]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
call fcn.10037e20
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100254b0
call fcn.100f9632
push 0x102409c4
nop dword [eax]
call fcn.100d69b1
add esp, 4
cmp dword [0x102409c4], 0xffffffff
jne 0x10014eda
mov ecx, dword [0x101f9034]
nop dword [eax + eax]
call fcn.100b3fc0
cmp dword [eax + 0x14], 0xf
jbe 0x10014f8f
mov eax, dword [eax]
jmp 0x10014f8f
push 0x102409c4
mov dword [0x102409c0], eax
call fcn.100d6960
add esp, 4
jmp 0x10014eda