Function at 0x10019560
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100291bb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push ebx
push esi
push edi
mov eax, dword [0x10040bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10019ca6
mov eax, dword [ebp + 8]
mov dword [0x10041158], eax
call sym.G.dll_Zmso
cmp dword [0x10041020], 1
jne 0x100195b0
call fcn.10024180
cmp dword [0x10041084], 0
jne 0x100195c2
cmp dword [0x1004108c], 1
jne 0x100195c7
call fcn.100108b0
cmp dword [0x10041064], 1
jne 0x100195d5
call fcn.1000c5f0
cmp dword [0x10041090], 1
jne 0x100195e3
call fcn.1000c6f0
cmp dword [0x10041030], 1
jne 0x100195fe
push 0
push 0
push 0x1001c930
call dword [sym.imp.ucrtbased.dll__beginthread]
add esp, 0xc
cmp dword [0x10041084], 1
jne 0x1001960c
call fcn.1000d8e0
cmp dword [0x1004108c], 0
je 0x1001961f
call fcn.1000d300
call fcn.1000c310
cmp dword [0x10041098], 1
jne 0x1001962d
call fcn.1001a610
cmp dword [0x1004109c], 1
jne 0x1001963b
call fcn.1001ab90
cmp dword [0x100410d0], 1
jne 0x10019649
call fcn.10027480
cmp dword [0x1004107c], 1
jne 0x10019657
call fcn.1000f860
cmp dword [0x100410c4], 1
jne 0x10019665
call fcn.10017280
cmp dword [0x100410bc], 1
jne 0x1001967c
cmp dword [0x1004102c], 0
jne 0x1001967c
call fcn.100108f0
cmp dword [0x1004100c], 1
mov edi, dword [sym.imp.ucrtbased.dll_malloc]
jne 0x10019b05
mov dword [ebp + 0xc], 0x10031b60
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x100196e5
mov eax, dword [ebx + 0xf]
inc eax
push eax
call edi
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100196d9
sub esi, edi
nop
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100196c0
mov byte [eax + edi], 0
mov esi, edi
mov edi, dword [sym.imp.ucrtbased.dll_malloc]
push 0x1000cfc0
push esi
push dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.100045b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp + 0xc], 0x10031c28
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019750
mov eax, dword [ebx + 0xf]
inc eax
push eax
call edi
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1001974a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019731
mov byte [eax + edi], 0
mov esi, edi
push 0x1000cfc0
push esi
push dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.100045b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [0x1004106c], 1
jne 0x1001988a
mov dword [ebp + 0xc], 0x10031bac
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x100197cf
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100197c9
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100197b0
mov byte [eax + edi], 0
mov esi, edi
push 1
push 0x40
push 8
push esi
lea ecx, [ebp - 0x174]
call fcn.10004a10
mov dword [ebp + 0xc], 0x10031c78
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x1001983f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019839
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019820
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0x174]
push esi
push eax
call fcn.100045b0
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.100054f0
test eax, eax
jne 0x10019878
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10005000
cmp dword [0x1004107c], 1
jne 0x10019afa
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
mov dword [ebp + 0xc], 0x10031bd4
add esp, 8
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp + 8], eax
cmp byte [ebx + 0x13], 0
je 0x10019904
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100198fe
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100198e5
mov byte [eax + edi], 0
mov esi, edi
push 1
push 0x40
push 8
push esi
lea ecx, [ebp - 0xc4]
call fcn.10004a10
mov dword [ebp + 0xc], str.A__XE
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x10019970
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1001996a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019951
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.100045b0
push dword [ebp + 8]
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.100045b0
mov dword [ebp + 0xc], 0x10031d28
add esp, 0x14
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x100199ef
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100199e9
sub esi, edi
nop word [eax + eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x100199d0
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.100045b0
mov dword [ebp + 0xc], 0x10031bec
add esp, 8
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019a52
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019a4c
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019a33
mov byte [eax + edi], 0
mov esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.100045b0
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.100054f0
test eax, eax
jne 0x10019a8b
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp + 0xc], 0x10031cfc
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019adf
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019ad9
sub esi, edi
nop
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019ac0
mov byte [eax + edi], 0
mov esi, edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xffffffff
call fcn.10005000
mov edi, dword [sym.imp.ucrtbased.dll_malloc]
jmp 0x10019be5
cmp dword [0x1004101c], 1
jne 0x10019b13
call fcn.1001bba0
cmp dword [0x10041068], 1
jne 0x10019b21
call fcn.100188b0
cmp dword [0x100410b8], 1
jne 0x10019b2f
call fcn.10018a30
cmp dword [0x10041024], 1
jne 0x10019b3d
call fcn.100267b0
cmp dword [0x100410a0], 1
jne 0x10019b4b
call fcn.1001e590
cmp dword [0x10041028], 1
jne 0x10019b59
call fcn.100105e0
cmp dword [0x100410ac], 1
jne 0x10019b67
call fcn.1001d750
cmp dword [0x100410a4], 1
jne 0x10019b75
call fcn.10010d60
cmp dword [0x100410a8], 1
jne 0x10019b83
call fcn.10006570
cmp dword [0x100410b0], 1
jne 0x10019b91
call fcn.100051c0
cmp dword [0x10041060], 1
jne 0x10019b9f
call fcn.1001e4c0
cmp dword [0x10041078], 1
jne 0x10019bad
call fcn.100257d0
cmp dword [0x10041054], 1
jne 0x10019bbb
call fcn.10024250
cmp dword [0x100410c0], 1
jne 0x10019bc9
call fcn.10026120
cmp dword [0x100410b4], 1
jne 0x10019bd7
call fcn.1000b550
cmp dword [0x10041074], 1
jne 0x10019be5
call fcn.100153c0
cmp dword [0x10041014], 1
jne 0x10019bf3
call fcn.10023c60
cmp dword [0x10041018], 1
jne 0x10019c01
call fcn.10027460
cmp dword [0x100410c8], 1
jne 0x10019c0f
call fcn.100108c0
cmp dword [0x1004102c], 1
jne 0x10019c2b
cmp dword [0x1004100c], 0
jne 0x10019c2b
call fcn.10026a70
call fcn.10026a90
cmp dword [0x1004105c], 1
jne 0x10019c40
push dword [0x10040fe4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x10041058], 1
jne 0x10019ca6
mov dword [ebp + 0xc], 0x10031dac
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10019c9f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call edi
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10019c99
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp edx, eax
jb 0x10019c80
mov byte [edi + eax], 0
mov esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc