Function at 0x1000294c
Capabilities:
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push 0x158
mov eax, 0x10009f6d
call fcn.10009d22
xor ebx, ebx
lea eax, [ebp - 0x113]
push 0x103
push ebx
push eax
mov byte [ebp - 0x114], bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x154]
call fcn.1000216b
lea ecx, [ebp - 0x154]
mov dword [ebp - 4], ebx
call fcn.10003255
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.10001f74
mov cl, 0x30
mov dword [ebp - 0x148], 0x44407f30
mov dword [ebp - 0x144], 0x1e5e5f59
mov eax, ebx
mov dword [ebp - 0x140], 0x595e79
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 0xa
jae 0x100029f0
mov cl, byte [ebp - 0x148]
jmp 0x100029db
lea eax, [ebp - 0x147]
mov byte [ebp - 0x13d], bl
push eax
mov edx, 0x1000f450
lea ecx, [ebp - 0x12c]
call fcn.10003306
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
pop ecx
cmova edx, dword [ebp - 0x12c]
mov cl, 0xc
mov dword [ebp - 0x138], 0x5854480c
mov eax, ebx
mov dword [ebp - 0x134], 0x697c75
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 6
jae 0x10002a4f
mov cl, byte [ebp - 0x138]
jmp 0x10002a3a
mov byte [ebp - 0x131], bl
mov cl, 0x68
mov dword [ebp - 0x144], 0x3c302c68
mov eax, ebx
mov dword [ebp - 0x140], 0xd1811
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 6
jae 0x10002a82
mov cl, byte [ebp - 0x144]
jmp 0x10002a6d
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x137]
push edx
push ebx
push eax
lea eax, [ebp - 0x143]
mov byte [ebp - 0x13d], bl
push eax
call edi
mov dword [0x1000fc1c], eax
test eax, eax
jns 0x10002ab0
mov eax, ebx
mov dword [0x1000fc1c], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10002abd
mov dword [0x1000fc1c], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0x52
mov dword [ebp - 0x148], 0x3b390152
cmova edx, dword [ebp - 0x12c]
mov eax, ebx
mov dword [ebp - 0x144], 0x20133e3e
mov word [ebp - 0x140], 0x3337
mov byte [ebp - 0x13e], bl
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 9
jae 0x10002b0d
mov cl, byte [ebp - 0x148]
jmp 0x10002af8
mov byte [ebp - 0x13e], bl
mov cl, 0x1d
mov dword [ebp - 0x134], 0x6e74501d
mov eax, ebx
mov word [ebp - 0x130], 0x7e
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10002b3f
mov cl, byte [ebp - 0x134]
jmp 0x10002b2a
push edx
push ebx
lea eax, [ebp - 0x147]
mov byte [ebp - 0x12f], bl
push eax
lea eax, [ebp - 0x133]
push eax
call edi
mov dword [0x1000fc20], eax
test eax, eax
jns 0x10002b67
mov eax, ebx
mov dword [0x1000fc20], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10002b74
mov dword [0x1000fc20], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0x7e
mov dword [ebp - 0x14c], 0x101b397e
cmova edx, dword [ebp - 0x12c]
mov eax, ebx
mov dword [ebp - 0x148], 0x17281b17
mov dword [ebp - 0x144], 0x121c170d
mov word [ebp - 0x140], 0x1b
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xc
jae 0x10002bc8
mov cl, byte [ebp - 0x14c]
jmp 0x10002bb3
push 0x51
mov byte [ebp - 0x13f], bl
mov cl, 0x38
pop ebx
mov word [ebp - 0x134], 0x7538
xor eax, eax
mov byte [ebp - 0x132], bl
mov word [ebp - 0x131], 0x5b4b
mov byte [ebp - 0x12f], 0
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10002c09
mov cl, byte [ebp - 0x134]
jmp 0x10002bf4
push edx
push 1
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x12f], 0
push eax
lea eax, [ebp - 0x133]
push eax
call edi
mov dword [0x1000fc24], eax
test eax, eax
jns 0x10002c33
xor eax, eax
mov dword [0x1000fc24], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10002c40
mov dword [0x1000fc24], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0x4d
mov dword [ebp - 0x148], 0x23281f4d
cmova edx, dword [ebp - 0x12c]
xor eax, eax
mov dword [ebp - 0x144], 0xe3f2829
mov dword [ebp - 0x140], 0x283d2c
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 0xa
jae 0x10002c8b
mov cl, byte [ebp - 0x148]
jmp 0x10002c76
mov byte [ebp - 0x13d], 0
mov cl, 0x72
mov dword [ebp - 0x134], 0x11b3f72
xor eax, eax
mov word [ebp - 0x130], 0x11
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10002cbe
mov cl, byte [ebp - 0x134]
jmp 0x10002ca9
push edx
push 1
lea eax, [ebp - 0x147]
mov byte [ebp - 0x12f], 0
push eax
lea eax, [ebp - 0x133]
push eax
call edi
mov dword [0x1000fc2c], eax
test eax, eax
jns 0x10002ce8
xor eax, eax
mov dword [0x1000fc2c], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10002cf5
mov dword [0x1000fc2c], ecx
cmp dword [ebp - 0x118], 0xf
lea esi, [ebp - 0x12c]
push 0x53
cmova esi, dword [ebp - 0x12c]
mov cl, 0x38
mov byte [ebp - 0x147], bl
xor ebx, ebx
pop edx
mov dword [ebp - 0x14c], 0x56596a38
mov eax, ebx
mov byte [ebp - 0x148], dl
mov dword [ebp - 0x146], 0x5e7d5f56
mov dword [ebp - 0x142], 0x4c5b5d5e
mov byte [ebp - 0x13e], bl
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xd
jae 0x10002d57
mov cl, byte [ebp - 0x14c]
jmp 0x10002d42
mov byte [ebp - 0x13e], bl
mov eax, ebx
mov byte [ebp - 0x134], dl
mov dword [ebp - 0x133], 0x30203a1e
mov byte [ebp - 0x12f], bl
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10002d8a
mov dl, byte [ebp - 0x134]
jmp 0x10002d75
push esi
push 1
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x12f], bl
push eax
lea eax, [ebp - 0x133]
push eax
call edi
mov dword [0x1000fc30], eax
test eax, eax
jns 0x10002db3
mov eax, ebx
mov dword [0x1000fc30], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10002dc0
mov dword [0x1000fc30], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
push 0x4e
cmova edx, dword [ebp - 0x12c]
mov cl, 0x1a
pop ebx
mov dword [ebp - 0x148], 0x777b5d1a
xor eax, eax
mov byte [ebp - 0x144], 0x7f
mov byte [ebp - 0x143], bl
mov dword [ebp - 0x142], 0x7f7773
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 8
jae 0x10002e11
mov cl, byte [ebp - 0x148]
jmp 0x10002dfc
push 4
mov byte [ebp - 0x13f], 0
mov cl, 0x67
mov dword [ebp - 0x134], 0x140e2a67
xor eax, eax
mov word [ebp - 0x130], 4
pop esi
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, esi
jae 0x10002e46
mov cl, byte [ebp - 0x134]
jmp 0x10002e32
push edx
push 0
lea eax, [ebp - 0x147]
mov byte [ebp - 0x12f], 0
push eax
lea eax, [ebp - 0x133]
push eax
call edi
mov dword [0x1000fc28], eax
test eax, eax
jns 0x10002e70
xor eax, eax
mov dword [0x1000fc28], eax
push 0x18
pop ecx
cmp eax, ecx
jle 0x10002e7d
mov dword [0x1000fc28], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0x41
mov dword [ebp - 0x14c], 0x2c200241
cmova edx, dword [ebp - 0x12c]
xor eax, eax
mov dword [ebp - 0x148], 0x13203324
mov dword [ebp - 0x144], 0x24262f20
mov byte [ebp - 0x140], 0
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xb
jae 0x10002ecf
mov cl, byte [ebp - 0x14c]
jmp 0x10002eba
mov byte [ebp - 0x140], 0
mov cl, 0xf
mov dword [ebp - 0x134], 0x7c66420f
xor eax, eax
mov word [ebp - 0x130], 0x6c
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, esi
jae 0x10002f01
mov cl, byte [ebp - 0x134]
jmp 0x10002eed
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x12f], 0
push eax
lea eax, [ebp - 0x133]
push eax
call edi
mov dword [0x1000fc34], eax
test eax, eax
jns 0x10002f2b
xor eax, eax
mov dword [0x1000fc34], eax
push 0x14
pop ecx
cmp eax, ecx
jle 0x10002f38
mov dword [0x1000fc34], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0x43
mov dword [ebp - 0x13c], 0x37221343
cmova edx, dword [ebp - 0x12c]
xor eax, eax
mov dword [ebp - 0x138], 0x15302c2b
mov dword [ebp - 0x134], 0x34262a
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 0xa
jae 0x10002f83
mov cl, byte [ebp - 0x13c]
jmp 0x10002f6e
mov byte [ebp - 0x131], 0
mov cl, 0x7a
mov dword [ebp - 0x144], 0x1c1c3f7a
xor eax, eax
mov dword [ebp - 0x140], 0xe191f
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 6
jae 0x10002fb7
mov cl, byte [ebp - 0x144]
jmp 0x10002fa2
push edx
push 1
lea eax, [ebp - 0x13b]
mov byte [ebp - 0x13d], 0
push eax
lea eax, [ebp - 0x143]
push eax
call edi
mov dword [0x1000fc38], eax
test eax, eax
jns 0x10002fe1
xor eax, eax
mov dword [0x1000fc38], eax
cmp eax, 1
jle 0x10002fed
and dword [0x1000fc38], 0
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0xc
mov dword [ebp - 0x134], 0x78794d0c
cmova edx, dword [ebp - 0x12c]
xor eax, eax
mov word [ebp - 0x130], 0x63
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, esi
jae 0x1000302c
mov cl, byte [ebp - 0x134]
jmp 0x10003018
push 0x51
pop ecx
mov byte [ebp - 0x12f], 0
xor eax, eax
mov byte [ebp - 0x14c], cl
mov dword [ebp - 0x14b], 0x32343801
mov dword [ebp - 0x147], 0x32291434
mov dword [ebp - 0x143], 0x363f3039
mov word [ebp - 0x13f], 0x34
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xd
jae 0x1000307a
mov cl, byte [ebp - 0x14c]
jmp 0x10003065
push edx
push 0
lea eax, [ebp - 0x133]
mov byte [ebp - 0x13e], 0
push eax
lea eax, [ebp - 0x14b]
push eax
call edi
mov dword [0x1000fc3c], eax
test eax, eax
jns 0x100030a4
xor eax, eax
mov dword [0x1000fc3c], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x100030b1
mov dword [0x1000fc3c], ecx
cmp dword [ebp - 0x118], 0xf
lea edx, [ebp - 0x12c]
mov cl, 0x17
mov dword [ebp - 0x148], 0x78634417
cmova edx, dword [ebp - 0x12c]
xor eax, eax
mov dword [ebp - 0x144], 0x795e7c74
mov word [ebp - 0x140], 0x79
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 8
jae 0x100030fb
mov cl, byte [ebp - 0x148]
jmp 0x100030e6
mov byte [ebp - 0x13f], 0
mov cl, 0x74
mov dword [ebp - 0x13c], 0x111d2474
xor eax, eax
mov dword [ebp - 0x138], 0xc311117
mov dword [ebp - 0x134], 0x1a151c17
mov word [ebp - 0x130], 0x1113
mov byte [ebp - 0x12e], 0
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 0xd
jae 0x10003149
mov cl, byte [ebp - 0x13c]
jmp 0x10003134
push edx
push 0
lea eax, [ebp - 0x147]
mov byte [ebp - 0x12e], 0
push eax
lea eax, [ebp - 0x13b]
push eax
call edi
mov dword [0x1000fc40], eax
test eax, eax
jns 0x10003173
xor eax, eax
mov dword [0x1000fc40], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10003180
mov dword [0x1000fc40], ecx
cmp dword [ebp - 0x118], 0xf
lea ecx, [ebp - 0x12c]
push 0x1d
cmova ecx, dword [ebp - 0x12c]
xor eax, eax
pop edx
mov byte [ebp - 0x134], bl
mov byte [ebp - 0x133], dl
mov dword [ebp - 0x132], 0x22222b
xor byte [ebp + eax - 0x133], bl
inc eax
cmp eax, esi
jae 0x100031c3
mov bl, byte [ebp - 0x134]
jmp 0x100031af
xor ebx, ebx
mov byte [ebp - 0x164], dl
mov byte [ebp - 0x12f], bl
mov eax, ebx
mov dword [ebp - 0x163], 0x7e78744d
mov dword [ebp - 0x15f], 0x7e655878
mov dword [ebp - 0x15b], 0x7a737c75
mov word [ebp - 0x157], 0x78
xor byte [ebp + eax - 0x163], dl
inc eax
cmp eax, 0xd
jae 0x1000320f
mov dl, byte [ebp - 0x164]
jmp 0x100031fa
push ecx
push ebx
lea eax, [ebp - 0x133]
mov byte [ebp - 0x156], bl
push eax
lea eax, [ebp - 0x163]
push eax
call edi
mov dword [0x1000fc44], eax
test eax, eax
jns 0x10003237
mov eax, ebx
mov dword [0x1000fc44], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x10003244
mov dword [0x1000fc44], ecx
lea ecx, [ebp - 0x12c]
call fcn.10001f74
call fcn.10009ce0
ret