Function at 0x1000b8f8
Capabilities:
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push 0x15c
mov eax, 0x1003e5c6
call fcn.1003d3d1
xor ebx, ebx
lea eax, [ebp - 0x117]
push 0x103
push ebx
push eax
mov byte [ebp - 0x118], bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x158]
call fcn.10003da0
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], ebx
call fcn.1000c22d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.10003b9e
mov cl, 0x40
mov dword [ebp - 0x14c], 0x34300f40
mov dword [ebp - 0x148], 0x6e2e2f29
mov eax, ebx
mov dword [ebp - 0x144], 0x292e09
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000b99c
mov cl, byte [ebp - 0x14c]
jmp 0x1000b987
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x141], bl
push eax
mov edx, 0x10054470
lea ecx, [ebp - 0x130]
call fcn.1000c325
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
pop ecx
cmova edx, dword [ebp - 0x130]
mov cl, 0x57
mov dword [ebp - 0x13c], 0x30f1357
mov eax, ebx
mov dword [ebp - 0x138], 0x32272e
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 6
jae 0x1000b9fb
mov cl, byte [ebp - 0x13c]
jmp 0x1000b9e6
push 0x48
mov byte [ebp - 0x135], bl
mov cl, 0x31
pop ebx
mov dword [ebp - 0x148], 0x65697531
xor eax, eax
mov byte [ebp - 0x144], bl
mov word [ebp - 0x143], 0x5441
mov byte [ebp - 0x141], 0
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 6
jae 0x1000ba3d
mov cl, byte [ebp - 0x148]
jmp 0x1000ba28
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x13b]
push edx
push 0
push eax
lea eax, [ebp - 0x147]
mov byte [ebp - 0x141], 0
push eax
call esi
mov dword [0x10056bbc], eax
test eax, eax
jns 0x1000ba6d
xor eax, eax
mov dword [0x10056bbc], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000ba7a
mov dword [0x10056bbc], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov cl, 0x3f
mov dword [ebp - 0x14c], 0x56546c3f
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x148], 0x4d7e5353
mov word [ebp - 0x144], 0x5e5a
mov byte [ebp - 0x142], 0
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 9
jae 0x1000bacb
mov cl, byte [ebp - 0x14c]
jmp 0x1000bab6
push 4
mov byte [ebp - 0x142], 0
mov cl, 0x3b
mov word [ebp - 0x138], 0x763b
xor eax, eax
mov byte [ebp - 0x136], 0x52
mov byte [ebp - 0x135], bl
mov word [ebp - 0x134], 0x58
pop edi
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, edi
jae 0x1000bb0c
mov cl, byte [ebp - 0x138]
jmp 0x1000baf8
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10056bc0], eax
test eax, eax
jns 0x1000bb36
xor eax, eax
mov dword [0x10056bc0], eax
cmp eax, 1
jle 0x1000bb45
mov dword [0x10056bc0], 1
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov cl, 0x68
mov dword [ebp - 0x150], 0x60d2f68
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x14c], 0x13e0d01
mov dword [ebp - 0x148], 0x40a011b
mov word [ebp - 0x144], 0xd
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xc
jae 0x1000bb99
mov cl, byte [ebp - 0x150]
jmp 0x1000bb84
push 4
mov byte [ebp - 0x143], 0
mov cl, 0x6c
mov dword [ebp - 0x138], 0x1f05216c
xor eax, eax
mov word [ebp - 0x134], 0xf
pop edi
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, edi
jae 0x1000bbce
mov cl, byte [ebp - 0x138]
jmp 0x1000bbba
push edx
push 1
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10056bc4], eax
test eax, eax
jns 0x1000bbf8
xor eax, eax
mov dword [0x10056bc4], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bc05
mov dword [0x10056bc4], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov cl, 0x42
mov dword [ebp - 0x14c], 0x2c271042
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x148], 0x1302726
mov dword [ebp - 0x144], 0x273223
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000bc50
mov cl, byte [ebp - 0x14c]
jmp 0x1000bc3b
mov byte [ebp - 0x141], 0
mov cl, 0x3c
mov dword [ebp - 0x138], 0x4f55713c
xor eax, eax
mov word [ebp - 0x134], 0x5f
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, edi
jae 0x1000bc82
mov cl, byte [ebp - 0x138]
jmp 0x1000bc6e
push edx
push 1
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10056bcc], eax
test eax, eax
jns 0x1000bcac
xor eax, eax
mov dword [0x10056bcc], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bcb9
mov dword [0x10056bcc], ecx
cmp dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x150], bl
cmova ecx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x14f], 0x2326291a
mov dword [ebp - 0x14b], 0xd2f2621
mov dword [ebp - 0x147], 0x2b2d2e2e
mov word [ebp - 0x143], 0x3c
xor byte [ebp + eax - 0x14f], bl
inc eax
cmp eax, 0xd
jae 0x1000bd11
mov bl, byte [ebp - 0x150]
jmp 0x1000bcfc
xor ebx, ebx
mov dword [ebp - 0x137], 0x35253f1b
push 0x56
pop edx
mov byte [ebp - 0x142], bl
mov eax, ebx
mov byte [ebp - 0x138], dl
mov byte [ebp - 0x133], bl
xor byte [ebp + eax - 0x137], dl
inc eax
cmp eax, edi
jae 0x1000bd48
mov dl, byte [ebp - 0x138]
jmp 0x1000bd34
push ecx
push 1
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], bl
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10056bd0], eax
test eax, eax
jns 0x1000bd71
mov eax, ebx
mov dword [0x10056bd0], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bd7e
mov dword [0x10056bd0], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
push 0x4e
cmova edx, dword [ebp - 0x130]
mov cl, 0x2b
pop eax
mov byte [ebp - 0x148], al
mov byte [ebp - 0x144], al
mov eax, ebx
mov dword [ebp - 0x14c], 0x464a6c2b
mov word [ebp - 0x147], 0x427f
mov byte [ebp - 0x145], 0x46
mov byte [ebp - 0x143], bl
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 8
jae 0x1000bdda
mov cl, byte [ebp - 0x14c]
jmp 0x1000bdc5
mov byte [ebp - 0x143], bl
mov cl, 0x58
mov dword [ebp - 0x138], 0x2b311558
mov eax, ebx
mov word [ebp - 0x134], 0x3b
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, edi
jae 0x1000be0b
mov cl, byte [ebp - 0x138]
jmp 0x1000bdf7
push edx
push ebx
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], bl
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10056bc8], eax
test eax, eax
jns 0x1000be33
mov eax, ebx
mov dword [0x10056bc8], eax
push 0x18
pop ecx
cmp eax, ecx
jle 0x1000be40
mov dword [0x10056bc8], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov cl, 0x1f
mov dword [ebp - 0x150], 0x727e5c1f
cmova edx, dword [ebp - 0x130]
mov eax, ebx
mov dword [ebp - 0x14c], 0x4d7e6d7a
mov dword [ebp - 0x148], 0x7a78717e
mov byte [ebp - 0x144], bl
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xb
jae 0x1000be91
mov cl, byte [ebp - 0x150]
jmp 0x1000be7c
push 0x76
pop ecx
mov byte [ebp - 0x144], bl
mov eax, ebx
mov byte [ebp - 0x138], cl
mov dword [ebp - 0x137], 0x15051f3b
mov byte [ebp - 0x133], bl
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, edi
jae 0x1000bec6
mov cl, byte [ebp - 0x138]
jmp 0x1000beb2
push edx
push ebx
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], bl
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10056bd4], eax
test eax, eax
jns 0x1000beee
mov eax, ebx
mov dword [0x10056bd4], eax
push 0x14
pop ecx
cmp eax, ecx
jle 0x1000befb
mov dword [0x10056bd4], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
push 0x30
cmova edx, dword [ebp - 0x130]
xor eax, eax
pop ecx
push 0x59
pop ebx
mov byte [ebp - 0x140], cl
mov dword [ebp - 0x13f], 0x58445160
mov word [ebp - 0x13b], 0x435f
mov byte [ebp - 0x139], 0x66
mov byte [ebp - 0x138], bl
mov word [ebp - 0x137], 0x4755
mov byte [ebp - 0x135], 0
xor byte [ebp + eax - 0x13f], cl
inc eax
cmp eax, 0xa
jae 0x1000bf62
mov cl, byte [ebp - 0x140]
jmp 0x1000bf4d
mov byte [ebp - 0x135], 0
mov cl, 0x18
mov dword [ebp - 0x148], 0x7e7e5d18
xor eax, eax
mov dword [ebp - 0x144], 0x6c7b7d
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 6
jae 0x1000bf96
mov cl, byte [ebp - 0x148]
jmp 0x1000bf81
push edx
push 1
lea eax, [ebp - 0x13f]
mov byte [ebp - 0x141], 0
push eax
lea eax, [ebp - 0x147]
push eax
call esi
mov dword [0x10056bd8], eax
test eax, eax
jns 0x1000bfc0
xor eax, eax
mov dword [0x10056bd8], eax
cmp eax, 1
jle 0x1000bfcc
and dword [0x10056bd8], 0
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov byte [ebp - 0x138], bl
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x137], 0x362d2c18
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], bl
inc eax
cmp eax, edi
jae 0x1000c00d
mov bl, byte [ebp - 0x138]
jmp 0x1000bff9
xor ebx, ebx
mov dword [ebp - 0x150], 0x2f231a4a
mov byte [ebp - 0x133], bl
mov cl, 0x4a
mov dword [ebp - 0x14c], 0x320f2f29
mov eax, ebx
mov dword [ebp - 0x148], 0x242b2229
mov word [ebp - 0x144], 0x2f2d
mov byte [ebp - 0x142], bl
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xd
jae 0x1000c05b
mov cl, byte [ebp - 0x150]
jmp 0x1000c046
push edx
push ebx
lea eax, [ebp - 0x137]
mov byte [ebp - 0x142], bl
push eax
lea eax, [ebp - 0x14f]
push eax
call esi
mov dword [0x10056bdc], eax
test eax, eax
jns 0x1000c083
mov eax, ebx
mov dword [0x10056bdc], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000c090
mov dword [0x10056bdc], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov cl, 0x29
mov dword [ebp - 0x14c], 0x465d7a29
cmova edx, dword [ebp - 0x130]
mov eax, ebx
mov dword [ebp - 0x148], 0x4760424a
mov word [ebp - 0x144], 0x47
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 8
jae 0x1000c0da
mov cl, byte [ebp - 0x14c]
jmp 0x1000c0c5
push 0x4e
pop ecx
mov byte [ebp - 0x143], bl
mov eax, ebx
mov byte [ebp - 0x140], cl
mov dword [ebp - 0x13f], 0x2d2b271e
mov dword [ebp - 0x13b], 0x2d360b2b
mov dword [ebp - 0x137], 0x29202f26
mov word [ebp - 0x133], 0x2b
xor byte [ebp + eax - 0x13f], cl
inc eax
cmp eax, 0xd
jae 0x1000c127
mov cl, byte [ebp - 0x140]
jmp 0x1000c112
push edx
push ebx
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x132], bl
push eax
lea eax, [ebp - 0x13f]
push eax
call esi
mov dword [0x10056be0], eax
test eax, eax
jns 0x1000c14f
mov eax, ebx
mov dword [0x10056be0], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000c15c
mov dword [0x10056be0], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
mov cl, 0x5b
mov dword [ebp - 0x138], 0x373e085b
cmova edx, dword [ebp - 0x130]
mov eax, ebx
mov word [ebp - 0x134], 0x37
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, edi
jae 0x1000c19b
mov cl, byte [ebp - 0x138]
jmp 0x1000c187
mov byte [ebp - 0x133], bl
mov cl, 2
mov dword [ebp - 0x168], 0x676b5202
mov eax, ebx
mov dword [ebp - 0x164], 0x7a476761
mov dword [ebp - 0x160], 0x6c636a61
mov word [ebp - 0x15c], 0x6765
mov byte [ebp - 0x15a], bl
xor byte [ebp + eax - 0x167], cl
inc eax
cmp eax, 0xd
jae 0x1000c1e7
mov cl, byte [ebp - 0x168]
jmp 0x1000c1d2
push edx
push ebx
lea eax, [ebp - 0x137]
mov byte [ebp - 0x15a], bl
push eax
lea eax, [ebp - 0x167]
push eax
call esi
mov dword [0x10056be4], eax
test eax, eax
jns 0x1000c20f
mov eax, ebx
mov dword [0x10056be4], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000c21c
mov dword [0x10056be4], ecx
lea ecx, [ebp - 0x130]
call fcn.10003b9e
call fcn.1003d38f
ret