Function at 0x10019600
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029c7b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push ebx
push esi
push edi
mov eax, dword [0x10041bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10019d46
mov eax, dword [ebp + 8]
mov dword [0x10042158], eax
call sym.G.dll_Game_5
cmp dword [0x10042020], 1
jne 0x10019650
call fcn.10024c30
cmp dword [0x10042084], 0
jne 0x10019662
cmp dword [0x1004208c], 1
jne 0x10019667
call fcn.100109a0
cmp dword [0x10042064], 1
jne 0x10019675
call fcn.1000c660
cmp dword [0x10042090], 1
jne 0x10019683
call fcn.1000c730
cmp dword [0x10042030], 1
jne 0x1001969e
push 0
push 0
push 0x1001ca00
call dword [sym.imp.ucrtbased.dll__beginthread]
add esp, 0xc
cmp dword [0x10042084], 1
jne 0x100196ac
call fcn.1000da60
cmp dword [0x1004208c], 0
je 0x100196bf
call fcn.1000d550
call fcn.1000c450
cmp dword [0x10042098], 1
jne 0x100196cd
call fcn.1001a6b0
cmp dword [0x1004209c], 1
jne 0x100196db
call fcn.1001ac30
cmp dword [0x100420d0], 1
jne 0x100196e9
call fcn.10027f40
cmp dword [0x1004207c], 1
jne 0x100196f7
call fcn.1000f8f0
cmp dword [0x100420c4], 1
jne 0x10019705
call fcn.100173f0
cmp dword [0x100420bc], 1
jne 0x1001971c
cmp dword [0x1004202c], 0
jne 0x1001971c
call fcn.100109e0
cmp dword [0x1004200c], 1
mov edi, dword [sym.imp.ucrtbased.dll_malloc]
jne 0x10019ba5
mov dword [ebp + 0xc], 0x10032b40
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019785
mov eax, dword [ebx + 0xf]
inc eax
push eax
call edi
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019779
sub esi, edi
nop
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019760
mov byte [eax + edi], 0
mov esi, edi
mov edi, dword [sym.imp.ucrtbased.dll_malloc]
push 0x1000d0e0
push esi
push dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.100045b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp + 0xc], 0x10032bf0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x100197f0
mov eax, dword [ebx + 0xf]
inc eax
push eax
call edi
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100197ea
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100197d1
mov byte [eax + edi], 0
mov esi, edi
push 0x1000d0e0
push esi
push dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.100045b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [0x1004206c], 1
jne 0x1001992a
mov dword [ebp + 0xc], str.A__XE
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1001986f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019869
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019850
mov byte [eax + edi], 0
mov esi, edi
push 1
push 0x40
push 8
push esi
lea ecx, [ebp - 0x174]
call fcn.10004a20
mov dword [ebp + 0xc], 0x10032c40
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x100198df
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100198d9
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100198c0
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0x174]
push esi
push eax
call fcn.100045b0
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.10005500
test eax, eax
jne 0x10019918
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10005010
cmp dword [0x1004207c], 1
jne 0x10019b9a
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
mov dword [ebp + 0xc], 0x10032bb4
add esp, 8
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp + 8], eax
cmp byte [ebx + 0x13], 0
je 0x100199a4
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1001999e
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019985
mov byte [eax + edi], 0
mov esi, edi
push 1
push 0x40
push 8
push esi
lea ecx, [ebp - 0xc4]
call fcn.10004a20
mov dword [ebp + 0xc], 0x10032bcc
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x10019a10
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019a0a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100199f1
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.100045b0
push dword [ebp + 8]
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.100045b0
mov dword [ebp + 0xc], 0x10032d00
add esp, 0x14
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019a8f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019a89
sub esi, edi
nop word [eax + eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019a70
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.100045b0
mov dword [ebp + 0xc], 0x10032cc4
add esp, 8
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019af2
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019aec
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019ad3
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.100045b0
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.10005500
test eax, eax
jne 0x10019b2b
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp + 0xc], 0x10032d84
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019b7f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019b79
sub esi, edi
nop
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019b60
mov byte [eax + edi], 0
mov esi, edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xffffffff
call fcn.10005010
mov edi, dword [sym.imp.ucrtbased.dll_malloc]
jmp 0x10019c85
cmp dword [0x1004201c], 1
jne 0x10019bb3
call fcn.1001bc80
cmp dword [0x10042068], 1
jne 0x10019bc1
call fcn.10018980
cmp dword [0x100420b8], 1
jne 0x10019bcf
call fcn.10018ad0
cmp dword [0x10042024], 1
jne 0x10019bdd
call fcn.10027270
cmp dword [0x100420a0], 1
jne 0x10019beb
call fcn.1001f080
cmp dword [0x10042028], 1
jne 0x10019bf9
call fcn.10010780
cmp dword [0x100420ac], 1
jne 0x10019c07
call fcn.1001d830
cmp dword [0x100420a4], 1
jne 0x10019c15
call fcn.10010e60
cmp dword [0x100420a8], 1
jne 0x10019c23
call fcn.10006540
cmp dword [0x100420b0], 1
jne 0x10019c31
call fcn.100051d0
cmp dword [0x10042060], 1
jne 0x10019c3f
call fcn.1001efb0
cmp dword [0x10042078], 1
jne 0x10019c4d
call fcn.10026290
cmp dword [0x10042054], 1
jne 0x10019c5b
call fcn.10024d00
cmp dword [0x100420c0], 1
jne 0x10019c69
call fcn.10026be0
cmp dword [0x100420b4], 1
jne 0x10019c77
call fcn.1000b520
cmp dword [0x10042074], 1
jne 0x10019c85
call fcn.100154b0
cmp dword [0x10042014], 1
jne 0x10019c93
call fcn.10024750
cmp dword [0x10042018], 1
jne 0x10019ca1
call fcn.10027f20
cmp dword [0x100420c8], 1
jne 0x10019caf
call fcn.100109b0
cmp dword [0x1004202c], 1
jne 0x10019ccb
cmp dword [0x1004200c], 0
jne 0x10019ccb
call fcn.10027600
call fcn.10027620
cmp dword [0x1004205c], 1
jne 0x10019ce0
push dword [0x10041fe4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x10042058], 1
jne 0x10019d46
mov dword [ebp + 0xc], 0x10032d9c
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019d3f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call edi
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019d39
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019d20
mov byte [edi + eax], 0
mov esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc