Function at 0x10001740
Capabilities:
Encrypt data using rc4 ksa
Get common file path
Read file on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xebc
mov eax, dword [0x1001f0e0]
xor eax, esp
mov dword [esp + 0xeb8], eax
mov edx, dword [0x10020f68]
mov eax, dword [esp + 0xec0]
mov ecx, dword [esp + 0xed0]
push ebx
mov ebx, dword [esp + 0xed0]
push ebp
mov ebp, dword [esp + 0xed0]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0xed4]
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.1000bad0
add esp, 4
call fcn.1000bae2
cdq
mov ecx, 0xff
idiv ecx
inc esi
cmp esi, 0x200
mov byte [esp + esi + 0x4c7], dl
jl 0x100017a8
push 0x200
lea edx, [esp + 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10018208
lea eax, [esp + 0x2cc]
push 0x200
push eax
call fcn.1000b945
lea ecx, [esp + 0x2d4]
push ecx
lea edx, [esp + 0x8d8]
push 0x200
push edx
call fcn.1000b3fd
lea eax, [esp + 0x2e0]
push eax
lea ecx, [esp + 0xce4]
push 0x200
push ecx
call fcn.1000b3fd
add esp, 0x24
mov eax, 3
mov cl, 0x5c
lea ecx, [ecx]
cmp byte [esp + eax + 0x2c8], cl
je 0x10001843
inc eax
cmp eax, 0x200
jl 0x10001830
jmp 0x1000184b
mov byte [esp + eax + 0x2c9], 0
lea edx, [esp + 0x2c8]
push edx
lea eax, [esp + 0x6cc]
push 0x200
push eax
call fcn.1000b3fd
lea ecx, [esp + 0x2d4]
push ecx
lea edx, [esp + 0xad8]
push 0x200
push edx
call fcn.1000b3fd
push str.fonts_
lea eax, [esp + 0xae4]
push 0x200
push eax
call fcn.1000b945
push edi
lea ecx, [esp + 0x8f0]
push 0x200
push ecx
call fcn.1000b945
push ebp
lea edx, [esp + 0x6fc]
push 0x200
push edx
call fcn.1000b945
push ebx
lea eax, [esp + 0xd08]
push 0x200
push eax
call fcn.1000b945
mov ecx, dword [esp + 0xac]
add esp, 0x48
push ecx
lea edx, [esp + 0xacc]
push 0x200
push edx
call fcn.1000b945
add esp, 0xc
push 4
push 0x1000
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
mov ebp, eax
call fcn.1000b589
push eax
call fcn.1000bad0
add esp, 8
jmp 0x1000191b
jmp 0x10001a25
xor edi, edi
push edi
push 0x8000080
push 3
push edi
push 3
push 0x80000000
lea eax, [esp + 0x8e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001a87
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
inc edi
cmp edi, 3
jg 0x10001c88
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x8e0]
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x10001a52
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
xor edi, edi
push edi
lea edx, [esp + 0x1c]
push edx
push 0x400
push ebp
push esi
call ebx
test eax, eax
jne 0x10001af4
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
inc edi
cmp edi, 3
jg 0x10001af4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x400
push ebp
push esi
call ebx
test eax, eax
je 0x10001ac5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp + 3]
movzx eax, byte [ebp + 0x137]
sub eax, ecx
mov dword [0x10020310], eax
movzx edx, byte [ebp + 0x14b]
movzx ecx, byte [ebp + 3]
imul edx, edx, 0x23
lea ecx, [ecx + ecx*8]
add ecx, ecx
add ecx, ecx
sub edx, ecx
movzx ecx, byte [ebp + 0x155]
add edx, ecx
mov dword [0x10020304], edx
mov cl, byte [ebp + 0xdc]
test cl, cl
je 0x10001b45
mov dword [esp + 0x28], 0xffffffff
mov ebx, dword [esp + 0x14]
add al, 7
mov byte [ebx + 0xb], al
movzx edx, cl
mov ecx, dword [0x10020304]
mov dword [esp + 0x1c], edx
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebx + 0xc], al
mov ecx, dword [0x10020304]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, 0x23
imul dl
sub cl, al
lea eax, [esp + 0x68]
push eax
mov byte [ebx + 0xd], cl
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp dword [0x10020310], 0xbc
jne 0x10001bb7
cmp dword [0x10020304], 0
je 0x10001c43
mov eax, ebx
movzx ecx, byte [eax + 0xb]
mov ebx, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, 0x7d0
add cx, dx
movzx dx, byte [eax + 0xd]
mov word [esp + 0x44], cx
movzx ecx, byte [eax + 0xc]
mov word [esp + 0x46], cx
xor ecx, ecx
mov word [esp + 0x4a], dx
xor edx, edx
mov word [esp + 0x4e], cx
lea ecx, [esp + 0x34]
mov word [esp + 0x50], dx
xor eax, eax
push ecx
lea edx, [esp + 0x6c]
push edx
mov word [esp + 0x54], ax
mov word [esp + 0x5a], ax
call ebx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
push ecx
call ebx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push 0
sub esi, eax
push 0x23c34600
sbb edi, ecx
push edi
push esi
call fcn.1000bb20
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
movzx ecx, byte [ebp + 0xe1]
xor eax, eax
lea ecx, [esp + ecx + 0x4da]
lea esi, [ebp + 7]
jmp 0x10001c60
movzx edx, byte [eax + 0x10020d68]
movzx edi, byte [ecx]
add edx, edi
cmp byte [esi], dl
jne 0x10001c94
inc eax
inc ecx
add esi, 7
cmp eax, 0x11
jl 0x10001c60
mov edi, 0x10020d68
xor eax, eax
lea esi, [ebp + 7]
sub edi, ebx
jmp 0x10001cb4
mov ebx, dword [esp + 0x14]
or edi, 0xffffffff
jmp 0x100020ca
mov edi, 0x10020d68
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
lea esi, [ebp + 7]
sub edi, ebx
jmp 0x10001cb4
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebp + 0xe1]
lea ecx, [ebx + eax]
add edx, eax
mov bl, al
sub bl, byte [esp + edx + 0x4da]
inc eax
sub bl, byte [ecx + edi]
add esi, 7
add bl, byte [esi - 7]
inc bl
cmp eax, 0xa
mov byte [ecx], bl
jl 0x10001cb0
xor ecx, ecx
xor eax, eax
movzx edx, byte [eax + ebp]
inc eax
add ecx, edx
cmp eax, 0x3ff
jl 0x10001ce0
cmp byte [ebp + 0x3ff], cl
je 0x10001cfe
mov dword [esp + 0x10], 0xffffffff
cmp dword [esp + 0x28], 0
jne 0x10001df2
xor eax, eax
lea ecx, [esp + 0x4c8]
mov dl, byte [eax + ebp + 0x3b6]
not dl
mov byte [ecx], dl
inc eax
add ecx, 3
cmp eax, 8
jl 0x10001d12
xor eax, eax
lea ecx, [esp + 0x4c9]
nop
mov dl, byte [eax + ebp + 0x3bf]
not dl
mov byte [ecx], dl
inc eax
add ecx, 3
cmp eax, 9
jl 0x10001d30
xor eax, eax
lea ecx, [esp + 0x4ca]
lea ecx, [ecx]
mov dl, byte [eax + ebp + 0x3c8]
not dl
mov byte [ecx], dl
inc eax
add ecx, 3
cmp eax, 9
jl 0x10001d50
movzx esi, byte [ebp + 0x3be]
mov al, byte [ebp + 0x3d0]
push 0x1c
lea ecx, [esp + 0x4cc]
push ecx
lea edx, [esp + 0x80]
not al
not esi
push edx
mov byte [esp + 0x4ec], al
mov byte [esp + 0x4ef], 0x3d
mov byte [esp + 0x4f0], 0
and esi, 0x7f
call fcn.10001200
movzx eax, byte [esp + 0x84]
sub eax, esi
add eax, 0x30
add esp, 0xc
cmp dword [0x10020310], eax
je 0x10001dc6
mov dword [esp + 0x10], 0xffffffff
movzx ecx, byte [esp + 0x79]
imul ecx, ecx, 0x23
mov eax, 0x30
sub eax, esi
lea edx, [eax + eax*8]
lea eax, [ecx + edx*4]
movzx ecx, byte [esp + 0x7a]
add eax, ecx
cmp dword [0x10020304], eax
je 0x10001df2
mov dword [esp + 0x10], 0xffffffff
cmp dword [esp + 0x30], 0
jl 0x10001e0d
jg 0x10001e05
cmp dword [esp + 0x2c], 0xb40
jbe 0x10001e0d
mov dword [esp + 0x10], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edi, edi
push edi
push 0x8000080
push 3
push edi
push 3
push 0x80000000
lea edx, [esp + 0x6e0]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001e6b
inc edi
cmp edi, 3
jg 0x10001f2c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
lea eax, [esp + 0x6e0]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x10001e36
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call ebx
xor edi, edi
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0x200
lea edx, [esp + 0xd4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10001ee6
push 0
push 0
push 0
push esi
call ebx
inc edi
cmp edi, 3
jg 0x10001ee6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x200
lea ecx, [esp + 0xd4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001eb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
push 0x10
push 0x32
lea edx, [esp + 0x80]
push edx
push 0
push eax
call fcn.1000bab1
add esp, 0x14
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [esp + eax*2 + 0x163]
movsx edx, byte [esp + eax + 0x78]
cmp ecx, edx
jne 0x10001f3d
inc eax
cmp eax, 4
jl 0x10001f10
or ebx, 0xffffffff
jmp 0x10001f44
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 0xffffffff
jmp 0x100020c6
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x24]
push 0x10
push 0x32
lea eax, [esp + 0x80]
push eax
push 0
push ecx
call fcn.1000bab1
add esp, 0x14
xor eax, eax
movzx edx, byte [esp + eax*2 + 0x29a]
movsx ecx, byte [esp + eax + 0x78]
cmp edx, ecx
jne 0x10001f7a
inc eax
cmp eax, 4
jl 0x10001f61
jmp 0x10001f7e
mov dword [esp + 0x10], ebx
movzx edi, byte [esp + 0x1a9]
mov eax, 1
lea esi, [esp + 0xcd]
lea ecx, [ebp + 7]
movzx edx, byte [ecx]
add edx, edi
cmp byte [esi], dl
jne 0x10001fac
inc eax
add ecx, 7
add esi, 5
cmp eax, 0xb
jl 0x10001f95
jmp 0x10001fb0
mov dword [esp + 0x10], ebx
xor eax, eax
lea ecx, [ebp + 0x22b]
jmp 0x10001fc0
movzx esi, byte [ecx]
movzx edx, byte [esp + eax*2 + 0x137]
add esi, edi
cmp edx, esi
jne 0x10001fdc
inc eax
add ecx, 2
cmp eax, 4
jl 0x10001fc0
jmp 0x10001fe0
mov dword [esp + 0x10], ebx
xor eax, eax
lea ecx, [ebp + 0x309]
jmp 0x10001ff0
movzx esi, byte [ecx]
movzx edx, byte [esp + eax*2 + 0x1a6]
add esi, edi
cmp edx, esi
jne 0x1000200c
inc eax
add ecx, 2
cmp eax, 4
jl 0x10001ff0
jmp 0x10002010
mov dword [esp + 0x10], ebx
xor eax, eax
lea ecx, [ebp + 0x378]
jmp 0x10002020
movzx esi, byte [ecx]
movzx edx, byte [esp + eax*2 + 0x215]
add esi, edi
cmp edx, esi
jne 0x1000203c
inc eax
add ecx, 3
cmp eax, 4
jl 0x10002020
jmp 0x10002040
mov dword [esp + 0x10], ebx
xor eax, eax
lea ecx, [ebp + 0x29a]
jmp 0x10002050
movzx esi, byte [ecx]
movzx edx, byte [esp + eax*2 + 0x284]
add esi, edi
cmp edx, esi
jne 0x1000206c
inc eax
add ecx, 2
cmp eax, 4
jl 0x10002050
jmp 0x10002070
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov cl, byte [esp + 0x10]
add byte [ebx + eax], cl
inc eax
cmp eax, 0xa
jl 0x10002076
xor ecx, ecx
xor eax, eax
jmp 0x10002090
movzx edx, byte [esp + eax + 0xc8]
inc eax
add ecx, edx
cmp eax, 0x1ff
jl 0x10002090
cmp byte [esp + 0x2c7], cl
je 0x100020b5
mov dword [esp + 0x10], 0xffffffff
jmp 0x100020c6
cmp dword [esp + 0x10], 0
jne 0x100020c6
mov dword [0x1001f018], 1
mov edi, dword [esp + 0x10]
xor eax, eax
cmp dword [esp + 0x1c], 0xb
sete al
xor ecx, ecx
test edi, edi
sete cl
test ecx, eax
je 0x100020e9
mov dword [0x1001f018], 2
test edi, edi
jne 0x100020fb
mov dword [esp + 0x10], 0xfffffff8
mov edi, dword [esp + 0x10]
jmp 0x1000211e
cmp edi, 0xffffffff
jne 0x1000211e
mov byte [ebx + 0xb], 8
mov byte [ebx + 0xc], 1
mov byte [ebx + 0xd], 1
xor esi, esi
mov edi, edi
call fcn.1000bae2
mov byte [ebx + esi], al
inc esi
cmp esi, 0xa
jl 0x10002110
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov edi, edi
dec byte [ebx + eax]
inc eax
cmp eax, 0xa
jl 0x10002130
cmp edi, 0xffffffff
jne 0x10002159
xor eax, eax
mov dword [ebx + 0xa], eax
mov dword [ebx + 0xe], eax
mov dword [ebx + 0x12], eax
mov dword [ebx + 0x16], eax
mov dword [ebx + 0x1a], eax
mov dword [ebx + 0x1e], eax
mov dword [ebx + 0x22], eax
mov word [ebx + 0x26], ax
mov ecx, dword [esp + 0xec8]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000bb04
add esp, 0xebc
ret