Function at 0x1001ba80
Capabilities:
Contain obfuscated stackstrings
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009c4b1
mov eax, dword fs:[0]
push eax
sub esp, 0x758
mov eax, dword [0x100c82c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x764], ecx
mov eax, dword [0x100cae28]
test al, 1
jne 0x1001bebd
or eax, 1
mov dword [0x100cae28], eax
mov dword [ebp - 4], 0
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c28b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x758], eax
push str.gighmmpiobklfepjocnamgkkbiglidom
lea ecx, [ebp - 0x758]
mov byte [ebp - 4], 1
call fcn.1000ac10
test al, al
jne 0x1001bb17
push 0x20
push str.gighmmpiobklfepjocnamgkkbiglidom
lea ecx, [ebp - 0x758]
call fcn.1000c450
mov byte [ebp - 4], 2
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c295
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x754], eax
push str.cfhdojbkjhnklbpkdaibdccddilifddb
lea ecx, [ebp - 0x754]
mov byte [ebp - 4], 3
call fcn.1000ac10
test al, al
jne 0x1001bb62
push 0x20
push str.cfhdojbkjhnklbpkdaibdccddilifddb
lea ecx, [ebp - 0x754]
call fcn.1000c450
mov byte [ebp - 4], 4
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c29f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x750], eax
push str.bgnkhhnnamicmpeenaelnjfhikgbkllg
lea ecx, [ebp - 0x750]
mov byte [ebp - 4], 5
call fcn.1000ac10
test al, al
jne 0x1001bbad
push 0x20
push str.bgnkhhnnamicmpeenaelnjfhikgbkllg
lea ecx, [ebp - 0x750]
call fcn.1000c450
mov byte [ebp - 4], 6
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2a9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74c], eax
push str.comfmchjneommdoncjhagbkidolibgil
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 7
call fcn.1000ac10
test al, al
jne 0x1001bbf8
push 0x20
push str.comfmchjneommdoncjhagbkidolibgil
lea ecx, [ebp - 0x74c]
call fcn.1000c450
mov byte [ebp - 4], 8
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2b3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x748], eax
push str.figbiejimdgnhdefdigjmcgfbhppcmlh
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 9
call fcn.1000ac10
test al, al
jne 0x1001bc43
push 0x20
push str.figbiejimdgnhdefdigjmcgfbhppcmlh
lea ecx, [ebp - 0x748]
call fcn.1000c450
mov byte [ebp - 4], 0xa
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x744], eax
push str.jjmnodmnjioloohkajephjnljefnpofk
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 0xb
call fcn.1000ac10
test al, al
jne 0x1001bc8e
push 0x20
push str.jjmnodmnjioloohkajephjnljefnpofk
lea ecx, [ebp - 0x744]
call fcn.1000c450
mov byte [ebp - 4], 0xc
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x740], eax
push str.npdmbbiopnooephgmjlebjgkkhljambm
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0xd
call fcn.1000ac10
test al, al
jne 0x1001bcd9
push 0x20
push str.npdmbbiopnooephgmjlebjgkkhljambm
lea ecx, [ebp - 0x740]
call fcn.1000c450
mov byte [ebp - 4], 0xe
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x73c], eax
push str.khikalbjeipalegfaggfglmbjjnoppdg
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 0xf
call fcn.1000ac10
test al, al
jne 0x1001bd24
push 0x20
push str.khikalbjeipalegfaggfglmbjjnoppdg
lea ecx, [ebp - 0x73c]
call fcn.1000c450
mov byte [ebp - 4], 0x10
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x738], eax
push str.nkfmeecpeiaggnigpidlmbiipcdabifn
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 0x11
call fcn.1000ac10
test al, al
jne 0x1001bd6f
push 0x20
push str.nkfmeecpeiaggnigpidlmbiipcdabifn
lea ecx, [ebp - 0x738]
call fcn.1000c450
mov byte [ebp - 4], 0x12
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x734], eax
push str.ccbfjmejnkjmljidafielfedmeoibnap
lea ecx, [ebp - 0x734]
mov byte [ebp - 4], 0x13
call fcn.1000ac10
test al, al
jne 0x1001bdba
push 0x20
push str.ccbfjmejnkjmljidafielfedmeoibnap
lea ecx, [ebp - 0x734]
call fcn.1000c450
mov byte [ebp - 4], 0x14
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x730], eax
push str.fpdnjdlbdmifoocedhkighhlbchbiikl
lea ecx, [ebp - 0x730]
mov byte [ebp - 4], 0x15
call fcn.1000ac10
test al, al
jne 0x1001be05
push 0x20
push str.fpdnjdlbdmifoocedhkighhlbchbiikl
lea ecx, [ebp - 0x730]
call fcn.1000c450
mov byte [ebp - 4], 0x16
call fcn.1000b620
mov ecx, eax
test ecx, ecx
je 0x1001c2f9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x72c], eax
push str.kebaabphpfemempnnkkghjmjcmdibnka
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0x17
call fcn.1000ac10
test al, al
jne 0x1001be50
push 0x20
push str.kebaabphpfemempnnkkghjmjcmdibnka
lea ecx, [ebp - 0x72c]
call fcn.1000c450
push dword [ebp - 0x764]
lea eax, [ebp - 0x728]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x758]
mov dword [0x100cae1c], 0
push eax
mov ecx, 0x100cae1c
mov dword [0x100cae20], 0
mov dword [0x100cae24], 0
call fcn.100192e0
push fcn.10009ca0
push 0xc
push 4
lea eax, [ebp - 0x758]
mov byte [ebp - 4], 0
push eax
call fcn.10045905
push 0x100a1040
call fcn.10045882
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x208
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.10056110
add esp, 0xc
lea eax, [ebp - 0x71c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, 1
jne 0x1001beff
push str.GoogleChromeUser_DataDefaultExtensions
lea eax, [ebp - 0x71c]
push eax
call esi
push 0x208
lea eax, [ebp - 0x30c]
push 0
push eax
call fcn.10056110
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x760], 1
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x75c], 0x104
push eax
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x88], 0x6f0053
push eax
lea eax, [ebp - 0x760]
mov dword [ebp - 0x84], 0x740066
push eax
push str.InstallLocation
lea eax, [ebp - 0x88]
mov dword [ebp - 0x80], 0x610077
push eax
push 0x80000001
mov dword [ebp - 0x7c], 0x650072
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x6e0055
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x6c0061
mov dword [ebp - 0x24], 0x5c006c
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x730030
mov dword [ebp - 0x18], 0x360065
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x1001c055
lea eax, [ebp - 0x30c]
push eax
call edi
push str.User_DataDefaultExtensions
lea eax, [ebp - 0x30c]
push eax
call esi
push 0x208
lea eax, [ebp - 0x514]
push 0
push eax
call fcn.10056110
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x75c]
add esp, 0xc
mov dword [ebp - 0x760], 1
mov dword [ebp - 0x75c], 0x104
mov dword [ebp - 0x104], 0x6f0053
mov dword [ebp - 0x100], 0x740066
push eax
lea eax, [ebp - 0x514]
mov dword [ebp - 0xfc], 0x610077
push eax
lea eax, [ebp - 0x760]
mov dword [ebp - 0xf8], 0x650072
push eax
push str.InstallLocation
lea eax, [ebp - 0x104]
mov dword [ebp - 0xf4], 0x4d005c
push eax
push 0x80000001
mov dword [ebp - 0xf0], 0x630069
mov dword [ebp - 0xec], 0x6f0072
mov dword [ebp - 0xe8], 0x6f0073
mov dword [ebp - 0xe4], 0x740066
mov dword [ebp - 0xe0], 0x57005c
mov dword [ebp - 0xdc], 0x6e0069
mov dword [ebp - 0xd8], 0x6f0064
mov dword [ebp - 0xd4], 0x730077
mov dword [ebp - 0xd0], 0x43005c
mov dword [ebp - 0xcc], 0x720075
mov dword [ebp - 0xc8], 0x650072
mov dword [ebp - 0xc4], 0x74006e
mov dword [ebp - 0xc0], 0x650056
mov dword [ebp - 0xbc], 0x730072
mov dword [ebp - 0xb8], 0x6f0069
mov dword [ebp - 0xb4], 0x5c006e
mov dword [ebp - 0xb0], 0x6e0055
mov dword [ebp - 0xac], 0x6e0069
mov dword [ebp - 0xa8], 0x740073
mov dword [ebp - 0xa4], 0x6c0061
mov dword [ebp - 0xa0], 0x5c006c
mov dword [ebp - 0x9c], 0x360033
mov dword [ebp - 0x98], 0x430030
mov dword [ebp - 0x94], 0x720068
mov dword [ebp - 0x90], 0x6d006f
mov dword [ebp - 0x8c], 0x65
call ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x1001c204
lea eax, [ebp - 0x514]
push eax
call edi
push str.User_DataDefaultExtensions
lea eax, [ebp - 0x514]
push eax
call esi
lea eax, [ebp - 0x71c]
xor ebx, ebx
mov dword [ebp - 0x728], eax
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x724], eax
lea eax, [ebp - 0x514]
mov dword [ebp - 0x720], eax
mov eax, dword [0x100cae20]
nop
mov esi, dword [0x100cae1c]
cmp esi, eax
je 0x1001c260
mov edi, dword [ebp + ebx*4 - 0x728]
push dword [esi]
mov ecx, dword [ebp - 0x764]
push edi
call fcn.1001c310
cmp eax, 1
je 0x1001c284
mov eax, dword [0x100cae20]
add esi, 4
cmp esi, eax
jne 0x1001c241
inc ebx
cmp ebx, 3
jl 0x1001c230
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045897
mov esp, ebp
pop ebp
ret
mov eax, 1
jmp 0x1001c268
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
push 0x80004005
call fcn.1000abf0
int3