Function at 0x20001912
Capabilities:
Contain obfuscated stackstrings
Get file size
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
mov edi, edi
nop
mov edi, edi
mov eax, eax
mov edi, edi
nop
mov edi, edi
nop
nop
mov eax, eax
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
nop
mov eax, 0x76726553
mov esi, 0x200061bc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
xor ebx, ebx
push eax
push 0x28
push esi
lea eax, [ebp - 0x18]
push 0x20006018
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x614e7265
push eax
mov dword [ebp - 0x20], 0x656d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x7473614c
mov dword [ebp - 0x14], 0x656d614e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x50], 0x63655c2e
mov dword [ebp - 0x4c], 0x6f685c74
mov dword [ebp - 0x48], 0x692e656d
mov dword [ebp - 0x44], 0x696e
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x694c7265
mov dword [ebp - 0x34], 0x442e7473
mov dword [ebp - 0x30], 0x7461
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
ja 0x200019f2
xor eax, eax
jmp 0x20001b14
lea eax, [ebp - 0x154]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x154]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov byte [eax + 1], bl
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x154]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
mov edi, edi
nop
mov edi, edi
mov eax, eax
mov edi, edi
nop
mov edi, edi
nop
nop
mov eax, eax
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
nop
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [ebp - 0x154]
push 0x80000000
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea edi, [esi + 1]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
push edi
push ebx
push eax
mov dword [ebp - 8], eax
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200061bc
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20001b07
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x2c
push eax
call edi
mov esi, eax
push 0x2c
inc esi
push esi
call edi
push 0x28
push ebx
mov ebx, 0x20006194
mov edi, eax
push ebx
call sub.MSVCRT.dll_memset
sub edi, esi
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x28
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret