Function at 0x1000e3b1
Capabilities:
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push 0x15c
mov eax, 0x100788b5
call fcn.10040a5d
mov esi, 0x104
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.10042b60
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x158]
call fcn.10004181
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], ebx
call fcn.1000ed41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
xor eax, eax
push ebx
inc eax
push eax
call fcn.10004036
push 0x14
pop eax
mov byte [ebp - 0x148], al
mov cl, 0x7d
mov byte [ebp - 0x142], al
mov eax, ebx
mov dword [ebp - 0x14c], 0x90d327d
mov dword [ebp - 0x147], 0x34531312
mov byte [ebp - 0x143], 0x13
mov byte [ebp - 0x141], bl
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000e463
mov cl, byte [ebp - 0x14c]
jmp 0x1000e44e
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x141], bl
push eax
mov edx, 0x100a2e48
lea ecx, [ebp - 0x130]
call fcn.1000d7bd
pop ecx
push 0x10
pop esi
cmp dword [ebp - 0x11c], esi
lea edx, [ebp - 0x130]
mov cl, 0xa
mov dword [ebp - 0x13c], 0x5e524e0a
cmovae edx, dword [ebp - 0x130]
mov eax, ebx
mov dword [ebp - 0x138], 0x6f7a73
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 6
jae 0x1000e4c4
mov cl, byte [ebp - 0x13c]
jmp 0x1000e4af
mov byte [ebp - 0x135], bl
mov cl, 0x79
mov dword [ebp - 0x164], 0x2d213d79
mov eax, ebx
mov dword [ebp - 0x160], 0x1c0900
xor byte [ebp + eax - 0x163], cl
inc eax
cmp eax, 6
jae 0x1000e4f7
mov cl, byte [ebp - 0x164]
jmp 0x1000e4e2
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x13b]
push edx
push ebx
push eax
lea eax, [ebp - 0x163]
mov byte [ebp - 0x15d], bl
push eax
call edi
xor ecx, ecx
mov word [ebp - 0x14c], 0x6235
test eax, eax
mov byte [ebp - 0x14a], 0x5c
push 0x5b
cmovs eax, ecx
mov dword [ebp - 0x147], 0x5a78425a
inc ecx
mov dword [ebp - 0x160], 0x42
cmp eax, ecx
mov word [ebp - 0x142], 0x50
pop ebx
cmovg eax, ecx
mov byte [ebp - 0x149], bl
cmp dword [ebp - 0x11c], esi
lea edx, [ebp - 0x130]
mov dword [0x100aa40c], eax
mov cl, 0x35
cmovae edx, dword [ebp - 0x130]
push 0x51
pop eax
mov byte [ebp - 0x148], al
mov byte [ebp - 0x143], al
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000e598
mov cl, byte [ebp - 0x14c]
jmp 0x1000e583
mov byte [ebp - 0x141], 0
mov cl, 0x68
mov dword [ebp - 0x13c], 0x1a0b3b68
xor eax, eax
mov dword [ebp - 0x138], 0x60d0d
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 6
jae 0x1000e5cc
mov cl, byte [ebp - 0x13c]
jmp 0x1000e5b7
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x135], 0
push eax
lea eax, [ebp - 0x13b]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x14c], 0x191b2370
test eax, eax
mov dword [ebp - 0x148], 0x2311c1c
lea edx, [ebp - 0x130]
mov word [ebp - 0x144], 0x1115
cmovs eax, ecx
mov byte [ebp - 0x142], 0
inc ecx
cmp eax, ecx
cmovg eax, ecx
cmp dword [ebp - 0x11c], esi
mov dword [0x100aa410], eax
mov cl, 0x70
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 9
jae 0x1000e648
mov cl, byte [ebp - 0x14c]
jmp 0x1000e633
mov eax, dword [ebp - 0x160]
mov cl, 0x21
mov byte [ebp - 0x134], al
xor eax, eax
mov byte [ebp - 0x142], 0
mov dword [ebp - 0x138], 0x52486c21
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000e685
mov cl, byte [ebp - 0x138]
jmp 0x1000e670
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call edi
xor ecx, ecx
mov byte [ebp - 0x150], bl
test eax, eax
mov dword [ebp - 0x14f], 0x32353e1c
lea edx, [ebp - 0x130]
mov dword [ebp - 0x14b], 0x28320d3e
cmovs eax, ecx
mov dword [ebp - 0x147], 0x3e373932
inc ecx
mov byte [ebp - 0x143], 0
cmp eax, ecx
cmovg eax, ecx
cmp dword [ebp - 0x11c], esi
mov dword [0x100aa414], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14f], bl
inc eax
cmp eax, 0xc
jae 0x1000e706
mov bl, byte [ebp - 0x150]
jmp 0x1000e6f1
xor ebx, ebx
mov dword [ebp - 0x138], 0x706a4e03
mov byte [ebp - 0x143], bl
mov cl, 3
mov word [ebp - 0x134], 0x60
mov eax, ebx
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000e73a
mov cl, byte [ebp - 0x138]
jmp 0x1000e725
mov byte [ebp - 0x133], bl
lea eax, [ebp - 0x14f]
push edx
xor ebx, ebx
inc ebx
push ebx
push eax
lea eax, [ebp - 0x137]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x14c], 0x272c1b49
test eax, eax
mov dword [ebp - 0x148], 0xa3b2c2d
push 0x10
cmovs eax, ecx
mov dword [ebp - 0x144], 0x2c3928
cmp eax, ebx
lea edx, [ebp - 0x130]
mov cl, 0x49
cmovg eax, ebx
pop ebx
cmp dword [ebp - 0x11c], ebx
mov dword [0x100aa418], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000e7b3
mov cl, byte [ebp - 0x14c]
jmp 0x1000e79e
mov byte [ebp - 0x141], 0
mov cl, 0x33
mov dword [ebp - 0x138], 0x405a7e33
xor eax, eax
mov word [ebp - 0x134], 0x50
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000e7e6
mov cl, byte [ebp - 0x138]
jmp 0x1000e7d1
push edx
xor esi, esi
mov byte [ebp - 0x133], 0
inc esi
lea eax, [ebp - 0x14b]
push esi
push eax
lea eax, [ebp - 0x137]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x150], 0x69665507
test eax, eax
mov dword [ebp - 0x14c], 0x60696e6c
lea edx, [ebp - 0x130]
mov dword [ebp - 0x147], 0x64626161
cmovs eax, ecx
mov word [ebp - 0x143], 0x73
inc ecx
cmp eax, ecx
cmovg eax, ecx
cmp dword [ebp - 0x11c], ebx
mov dword [0x100aa420], eax
mov cl, 7
mov eax, dword [ebp - 0x160]
cmovae edx, dword [ebp - 0x130]
mov byte [ebp - 0x148], al
xor eax, eax
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xd
jae 0x1000e873
mov cl, byte [ebp - 0x150]
jmp 0x1000e85e
mov byte [ebp - 0x142], 0
mov cl, 3
mov dword [ebp - 0x138], 0x706a4e03
xor eax, eax
mov word [ebp - 0x134], 0x60
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000e8a6
mov cl, byte [ebp - 0x138]
jmp 0x1000e891
push edx
xor esi, esi
mov byte [ebp - 0x133], 0
inc esi
lea eax, [ebp - 0x14f]
push esi
push eax
lea eax, [ebp - 0x137]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x14c], 0x3c301651
test eax, eax
mov dword [ebp - 0x148], 0x3c380534
lea edx, [ebp - 0x130]
mov word [ebp - 0x144], 0x34
cmovs eax, ecx
inc ecx
cmp eax, ecx
cmovg eax, ecx
cmp dword [ebp - 0x11c], ebx
mov dword [0x100aa424], eax
mov cl, 0x51
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 8
jae 0x1000e91d
mov cl, byte [ebp - 0x14c]
jmp 0x1000e908
push 0x6a
pop ecx
mov byte [ebp - 0x143], 0
xor eax, eax
mov byte [ebp - 0x138], cl
mov dword [ebp - 0x137], 0x9190327
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000e955
mov cl, byte [ebp - 0x138]
jmp 0x1000e940
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x150], 0x4c406221
test eax, eax
mov dword [ebp - 0x14c], 0x73405344
push 0x18
cmovs eax, ecx
mov dword [ebp - 0x148], 0x44464f40
pop ecx
cmp eax, ecx
mov byte [ebp - 0x144], 0
lea edx, [ebp - 0x130]
cmovg eax, ecx
cmp dword [ebp - 0x11c], ebx
mov dword [0x100aa41c], eax
mov cl, 0x21
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xb
jae 0x1000e9d4
mov cl, byte [ebp - 0x150]
jmp 0x1000e9bf
push 0x64
pop ecx
mov byte [ebp - 0x144], 0
xor eax, eax
mov byte [ebp - 0x138], cl
mov dword [ebp - 0x137], 0x7170d29
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000ea0c
mov cl, byte [ebp - 0x138]
jmp 0x1000e9f7
push edx
push 0
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x14c], 0x52477626
test eax, eax
mov dword [ebp - 0x148], 0x7055494e
push 0x14
cmovs eax, ecx
mov dword [ebp - 0x144], 0x51434f
pop ecx
cmp eax, ecx
lea edx, [ebp - 0x130]
cmovg eax, ecx
cmp dword [ebp - 0x11c], ebx
mov dword [0x100aa428], eax
mov cl, 0x26
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000ea84
mov cl, byte [ebp - 0x14c]
jmp 0x1000ea6f
mov byte [ebp - 0x141], 0
mov cl, 0x58
mov dword [ebp - 0x13c], 0x3e3e1d58
xor eax, eax
mov dword [ebp - 0x138], 0x2c3b3d
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 6
jae 0x1000eab8
mov cl, byte [ebp - 0x13c]
jmp 0x1000eaa3
push edx
xor esi, esi
mov byte [ebp - 0x135], 0
inc esi
lea eax, [ebp - 0x14b]
push esi
push eax
lea eax, [ebp - 0x13b]
push eax
call edi
xor ecx, ecx
mov byte [ebp - 0x137], bl
test eax, eax
mov dword [ebp - 0x136], 0x3e2524
push 0x51
cmovs eax, ecx
cmp eax, esi
pop edx
cmovg eax, ecx
mov byte [ebp - 0x138], dl
cmp dword [ebp - 0x11c], ebx
lea ecx, [ebp - 0x130]
mov dword [0x100aa42c], eax
cmovae ecx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x137], dl
inc eax
cmp eax, 4
jae 0x1000eb28
mov dl, byte [ebp - 0x138]
jmp 0x1000eb13
xor eax, eax
mov byte [ebp - 0x133], 0
push 0x60
inc eax
mov dword [ebp - 0x14f], 0x3050930
pop edx
mov byte [ebp - 0x146], al
xor eax, eax
mov byte [ebp - 0x150], dl
mov dword [ebp - 0x14b], 0x3182505
mov byte [ebp - 0x147], 8
mov dword [ebp - 0x145], 0x5070e
xor byte [ebp + eax - 0x14f], dl
inc eax
cmp eax, 0xd
jae 0x1000eb7d
mov dl, byte [ebp - 0x150]
jmp 0x1000eb68
push ecx
push 0
lea eax, [ebp - 0x137]
mov byte [ebp - 0x142], 0
push eax
lea eax, [ebp - 0x14f]
push eax
call edi
mov edx, dword [ebp - 0x160]
xor ecx, ecx
test eax, eax
mov byte [ebp - 0x14c], dl
mov dword [ebp - 0x14b], 0x212d3611
cmovs eax, ecx
mov dword [ebp - 0x147], 0x2c2c0b29
inc ecx
mov byte [ebp - 0x143], 0
cmp eax, ecx
cmovg eax, ecx
cmp dword [ebp - 0x11c], ebx
lea ecx, [ebp - 0x130]
mov dword [0x100aa430], eax
cmovae ecx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], dl
inc eax
cmp eax, 8
jae 0x1000ebfa
mov dl, byte [ebp - 0x14c]
jmp 0x1000ebe5
push 0x52
pop edx
mov byte [ebp - 0x143], 0
xor eax, eax
mov byte [ebp - 0x140], dl
mov dword [ebp - 0x13f], 0x31373b02
mov dword [ebp - 0x13b], 0x312a1737
mov dword [ebp - 0x137], 0x353c333a
mov word [ebp - 0x133], 0x37
xor byte [ebp + eax - 0x13f], dl
inc eax
cmp eax, 0xd
jae 0x1000ec48
mov dl, byte [ebp - 0x140]
jmp 0x1000ec33
push ecx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x132], 0
push eax
lea eax, [ebp - 0x13f]
push eax
call edi
xor ecx, ecx
mov byte [ebp - 0x138], bl
test eax, eax
mov dword [ebp - 0x137], 0x7c7c7543
mov byte [ebp - 0x133], 0
cmovs eax, ecx
inc ecx
cmp eax, ecx
cmovg eax, ecx
cmp dword [ebp - 0x11c], ebx
lea ecx, [ebp - 0x130]
mov dword [0x100aa434], eax
cmovae ecx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x137], bl
inc eax
cmp eax, 4
jae 0x1000ecb5
mov bl, byte [ebp - 0x138]
jmp 0x1000eca0
push 0x6e
xor ebx, ebx
mov dword [ebp - 0x167], 0xd0b073e
pop edx
mov byte [ebp - 0x133], bl
mov eax, ebx
mov byte [ebp - 0x168], dl
mov dword [ebp - 0x163], 0xd162b0b
mov dword [ebp - 0x15f], 0x9000f06
mov word [ebp - 0x15b], 0xb
xor byte [ebp + eax - 0x167], dl
inc eax
cmp eax, 0xd
jae 0x1000ed04
mov dl, byte [ebp - 0x168]
jmp 0x1000ecef
push ecx
push ebx
lea eax, [ebp - 0x137]
mov byte [ebp - 0x15a], bl
push eax
lea eax, [ebp - 0x167]
push eax
call edi
xor ecx, ecx
test eax, eax
push ebx
cmovs eax, ecx
inc ecx
cmp eax, ecx
push ecx
cmovg eax, ecx
lea ecx, [ebp - 0x130]
mov dword [0x100aa438], eax
call fcn.10004036
call fcn.10040a07
ret