Function at 0x10009ec4
Capabilities:
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push 0x15c
mov eax, 0x1003a22b
call fcn.10039131
mov esi, 0x104
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x158]
call fcn.1000409e
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], ebx
call fcn.1000a7a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
xor edi, edi
push ebx
inc edi
push edi
call fcn.10003f4a
push 3
pop ebx
mov cl, 0x6d
mov dword [ebp - 0x14c], 0x191d226d
mov word [ebp - 0x148], 0x204
xor eax, eax
mov byte [ebp - 0x146], bl
mov word [ebp - 0x145], 0x2443
mov byte [ebp - 0x143], bl
mov word [ebp - 0x142], 4
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x10009f7a
mov cl, byte [ebp - 0x14c]
jmp 0x10009f65
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x141], 0
push eax
mov edx, 0x1004f3d8
lea ecx, [ebp - 0x130]
call fcn.1000a8a8
cmp dword [ebp - 0x11c], 0x10
lea edx, [ebp - 0x130]
pop ecx
cmovae edx, dword [ebp - 0x130]
mov cl, 0x1d
mov dword [ebp - 0x13c], 0x4945591d
xor eax, eax
mov dword [ebp - 0x138], 0x786d64
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 6
jae 0x10009fda
mov cl, byte [ebp - 0x13c]
jmp 0x10009fc5
push 0x14
pop eax
mov cl, 0x50
mov byte [ebp - 0x147], al
mov byte [ebp - 0x135], 0
xor eax, eax
mov byte [ebp - 0x148], cl
mov dword [ebp - 0x146], 0x20290408
mov word [ebp - 0x142], 0x35
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 6
jae 0x1000a01c
mov cl, byte [ebp - 0x148]
jmp 0x1000a007
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x13b]
push edx
push 0
push eax
lea eax, [ebp - 0x147]
mov byte [ebp - 0x141], 0
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x14c], 0x31330b58
test eax, eax
mov dword [ebp - 0x148], 0x2a193434
lea edx, [ebp - 0x130]
mov word [ebp - 0x144], 0x393d
cmovs eax, ecx
mov byte [ebp - 0x142], 0
cmp eax, edi
mov cl, 0x58
cmovg eax, edi
cmp dword [ebp - 0x11c], 0x10
mov dword [0x10054478], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 9
jae 0x1000a09e
mov cl, byte [ebp - 0x14c]
jmp 0x1000a089
mov byte [ebp - 0x142], 0
mov cl, 0x7e
mov dword [ebp - 0x138], 0xd17337e
xor eax, eax
mov word [ebp - 0x134], 0x1d
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a0d1
mov cl, byte [ebp - 0x138]
jmp 0x1000a0bc
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x150], 0x242f0d4a
test eax, eax
mov dword [ebp - 0x14c], 0x231c2f23
lea edx, [ebp - 0x130]
mov dword [ebp - 0x148], 0x26282339
cmovs eax, ecx
mov word [ebp - 0x144], 0x2f
cmp eax, edi
mov cl, 0x4a
cmovg eax, edi
cmp dword [ebp - 0x11c], 0x10
mov dword [0x1005447c], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xc
jae 0x1000a150
mov cl, byte [ebp - 0x150]
jmp 0x1000a13b
mov byte [ebp - 0x143], 0
mov cl, 0x36
mov dword [ebp - 0x138], 0x455f7b36
xor eax, eax
mov word [ebp - 0x134], 0x55
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a183
mov cl, byte [ebp - 0x138]
jmp 0x1000a16e
push edx
push edi
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x14c], 0xc073062
test eax, eax
mov dword [ebp - 0x148], 0x21100706
lea edx, [ebp - 0x130]
mov byte [ebp - 0x144], bl
cmovs eax, ecx
mov word [ebp - 0x143], 0x712
cmp eax, edi
mov byte [ebp - 0x141], 0
mov cl, 0x62
cmovg eax, edi
cmp dword [ebp - 0x11c], 0x10
mov dword [0x10054480], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000a204
mov cl, byte [ebp - 0x14c]
jmp 0x1000a1ef
mov byte [ebp - 0x141], 0
mov cl, 0x74
mov dword [ebp - 0x138], 0x71d3974
xor eax, eax
mov word [ebp - 0x134], 0x17
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a237
mov cl, byte [ebp - 0x138]
jmp 0x1000a222
push edx
push edi
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
xor ecx, ecx
mov byte [ebp - 0x150], bl
test eax, eax
mov dword [ebp - 0x14f], 0x686d6251
push 0x65
cmovs eax, ecx
mov dword [ebp - 0x14b], 0x46646d6a
cmp eax, edi
mov dword [ebp - 0x145], 0x776066
lea edx, [ebp - 0x130]
cmovg eax, edi
cmp dword [ebp - 0x11c], 0x10
mov dword [0x10054488], eax
cmovae edx, dword [ebp - 0x130]
pop eax
mov byte [ebp - 0x147], al
mov byte [ebp - 0x146], al
xor eax, eax
xor byte [ebp + eax - 0x14f], bl
inc eax
cmp eax, 0xd
jae 0x1000a2bf
mov bl, byte [ebp - 0x150]
jmp 0x1000a2aa
xor ebx, ebx
mov dword [ebp - 0x138], 0x4b517538
mov byte [ebp - 0x142], bl
mov cl, 0x38
mov word [ebp - 0x134], 0x5b
mov eax, ebx
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a2f3
mov cl, byte [ebp - 0x138]
jmp 0x1000a2de
push edx
push edi
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], bl
push eax
lea eax, [ebp - 0x137]
push eax
call esi
xor ecx, ecx
mov word [ebp - 0x14c], 0x3275
test eax, eax
mov byte [ebp - 0x14a], 0x14
push 0x18
cmovs eax, ecx
mov byte [ebp - 0x148], 0x10
cmp eax, edi
mov byte [ebp - 0x146], 0x1c
lea edx, [ebp - 0x130]
mov word [ebp - 0x144], 0x10
cmovg eax, edi
mov cl, 0x75
cmp dword [ebp - 0x11c], 0x10
mov dword [0x1005448c], eax
cmovae edx, dword [ebp - 0x130]
pop eax
push 0x21
pop ebx
mov byte [ebp - 0x149], al
mov byte [ebp - 0x145], al
xor eax, eax
mov byte [ebp - 0x147], bl
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 8
jae 0x1000a388
mov cl, byte [ebp - 0x14c]
jmp 0x1000a373
push 5
mov byte [ebp - 0x137], bl
mov cl, 0x6c
pop ebx
mov byte [ebp - 0x143], 0
xor eax, eax
mov byte [ebp - 0x138], cl
mov byte [ebp - 0x136], bl
mov word [ebp - 0x135], 0xf1f
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a3cd
mov cl, byte [ebp - 0x138]
jmp 0x1000a3b8
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x14f], 0x80426
test eax, eax
mov dword [ebp - 0x14b], 0x4370417
push 0x18
cmovs eax, ecx
mov dword [ebp - 0x147], 0x20b
pop ecx
cmp eax, ecx
lea edx, [ebp - 0x130]
push 0x65
cmovg eax, ecx
cmp dword [ebp - 0x11c], 0x10
pop ecx
cmovae edx, dword [ebp - 0x130]
mov dword [0x10054484], eax
xor eax, eax
mov byte [ebp - 0x150], cl
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xb
jae 0x1000a44d
mov cl, byte [ebp - 0x150]
jmp 0x1000a438
mov byte [ebp - 0x144], 0
mov cl, 0x54
mov dword [ebp - 0x138], 0x273d1954
xor eax, eax
mov word [ebp - 0x134], 0x37
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a480
mov cl, byte [ebp - 0x138]
jmp 0x1000a46b
push edx
push 0
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x140], 0x32271646
test eax, eax
mov dword [ebp - 0x13c], 0x1035292e
push 0x14
cmovs eax, ecx
mov dword [ebp - 0x138], 0x31232f
pop ecx
cmp eax, ecx
lea edx, [ebp - 0x130]
cmovg eax, ecx
cmp dword [ebp - 0x11c], 0x10
mov dword [0x10054490], eax
mov cl, 0x46
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x13f], cl
inc eax
cmp eax, 0xa
jae 0x1000a4f9
mov cl, byte [ebp - 0x140]
jmp 0x1000a4e4
mov byte [ebp - 0x135], 0
mov cl, 0x4f
mov dword [ebp - 0x148], 0x29290a4f
xor eax, eax
mov dword [ebp - 0x144], 0x3b2c2a
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 6
jae 0x1000a52d
mov cl, byte [ebp - 0x148]
jmp 0x1000a518
push edx
push edi
lea eax, [ebp - 0x13f]
mov byte [ebp - 0x141], 0
push eax
lea eax, [ebp - 0x147]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x138], 0x27261253
test eax, eax
mov word [ebp - 0x134], 0x3c
lea edx, [ebp - 0x130]
cmovs eax, ecx
cmp eax, edi
cmovg eax, ecx
cmp dword [ebp - 0x11c], 0x10
mov dword [0x10054494], eax
mov cl, 0x53
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a597
mov cl, byte [ebp - 0x138]
jmp 0x1000a582
push 0x21
pop ecx
mov byte [ebp - 0x133], 0
xor eax, eax
mov byte [ebp - 0x150], cl
mov dword [ebp - 0x14f], 0x42444871
mov dword [ebp - 0x14b], 0x42596444
mov dword [ebp - 0x147], 0x464f4049
mov word [ebp - 0x143], 0x44
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xd
jae 0x1000a5e5
mov cl, byte [ebp - 0x150]
jmp 0x1000a5d0
push edx
push 0
lea eax, [ebp - 0x137]
mov byte [ebp - 0x142], 0
push eax
lea eax, [ebp - 0x14f]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x14b], 0x45495275
test eax, eax
mov dword [ebp - 0x147], 0x48486f4d
push 0x26
cmovs eax, ecx
mov byte [ebp - 0x143], 0
cmp eax, edi
lea edx, [ebp - 0x130]
pop ecx
cmovg eax, edi
mov byte [ebp - 0x14c], cl
cmp dword [ebp - 0x11c], 0x10
mov dword [0x10054498], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 8
jae 0x1000a65f
mov cl, byte [ebp - 0x14c]
jmp 0x1000a64a
mov byte [ebp - 0x143], 0
mov cl, 0x3f
mov dword [ebp - 0x140], 0x5a566f3f
xor eax, eax
mov dword [ebp - 0x13c], 0x477a5a5c
mov dword [ebp - 0x138], 0x515e575c
mov word [ebp - 0x134], 0x5a58
mov byte [ebp - 0x132], 0
xor byte [ebp + eax - 0x13f], cl
inc eax
cmp eax, 0xd
jae 0x1000a6ad
mov cl, byte [ebp - 0x140]
jmp 0x1000a698
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x132], 0
push eax
lea eax, [ebp - 0x13f]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x138], 0x61685e0d
test eax, eax
mov word [ebp - 0x134], 0x61
lea edx, [ebp - 0x130]
cmovs eax, ecx
mov cl, 0xd
cmp eax, edi
cmovg eax, edi
cmp dword [ebp - 0x11c], 0x10
mov dword [0x1005449c], eax
cmovae edx, dword [ebp - 0x130]
xor eax, eax
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000a718
mov cl, byte [ebp - 0x138]
jmp 0x1000a703
xor ecx, ecx
mov byte [ebp - 0x168], bl
mov byte [ebp - 0x133], cl
mov eax, ecx
mov dword [ebp - 0x167], 0x66606c55
mov dword [ebp - 0x163], 0x667d4060
mov dword [ebp - 0x15f], 0x626b646d
mov word [ebp - 0x15b], 0x60
xor byte [ebp + eax - 0x167], bl
inc eax
cmp eax, 0xd
jae 0x1000a764
mov bl, byte [ebp - 0x168]
jmp 0x1000a74f
push edx
push ecx
lea eax, [ebp - 0x137]
mov byte [ebp - 0x15a], cl
push eax
lea eax, [ebp - 0x167]
push eax
call esi
xor ecx, ecx
test eax, eax
push ecx
cmovs eax, ecx
lea ecx, [ebp - 0x130]
cmp eax, edi
push edi
cmovg eax, edi
mov dword [0x100544a0], eax
call fcn.10003f4a
call fcn.100390db
ret