Function at 0x100b5bf6
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x100ed3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x248], 0x77
mov word [ebp - 0x246], 0x64
mov word [ebp - 0x244], 0x74
mov word [ebp - 0x242], 0x68
mov word [ebp - 0x240], 0x65
mov word [ebp - 0x23e], 0x6c
mov word [ebp - 0x23c], 0x70
mov word [ebp - 0x23a], 0x65
mov word [ebp - 0x238], 0x72
mov word [ebp - 0x236], 0x2e
mov word [ebp - 0x234], 0x64
mov word [ebp - 0x232], 0x6c
mov word [ebp - 0x230], 0x6c
and word [ebp - 0x22e], 0
mov word [ebp - 0x22c], 0x69
mov word [ebp - 0x22a], 0x4e
mov word [ebp - 0x228], 0x65
mov word [ebp - 0x226], 0x74
mov word [ebp - 0x224], 0x53
mov word [ebp - 0x222], 0x61
mov word [ebp - 0x220], 0x66
mov word [ebp - 0x21e], 0x65
mov word [ebp - 0x21c], 0x2e
mov word [ebp - 0x21a], 0x64
mov word [ebp - 0x218], 0x6c
mov word [ebp - 0x216], 0x6c
and word [ebp - 0x214], 0
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100b5d24
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100b5d24
xor eax, eax
inc eax
jmp 0x100b607f
and word [ebp - 0x668], 0
push 0x206
push 0
lea eax, [ebp - 0x666]
push eax
call fcn.10071b30
add esp, 0xc
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.10071b30
add esp, 0xc
push 0x104
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
and dword [ebp - 0x460], 0
push 0x214
push 0
lea eax, [ebp - 0x45c]
push eax
call fcn.10071b30
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
push 0x100d4bb0
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call fcn.100b5a48
pop ecx
pop ecx
test eax, eax
je 0x100b5f1e
push 0x100d4bc4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x66c], eax
lea eax, [ebp - 0x460]
push eax
call fcn.100b57f6
pop ecx
test eax, eax
je 0x100b5f11
push 4
push 0
push str.NtCreateFile
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.NtOpenFile
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.NtOpenKey
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.NtOpenKeyEx
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.NtQueryAttributesFile
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.ZwCreateFile
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.ZwOpenFile
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.ZwOpenKey
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.ZwOpenKeyEx
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.ZwQueryAttributesFile
push dword [ebp - 0x66c]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
call fcn.100b596b
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.10071b30
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
push 0x100d4c70
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call fcn.100b5a48
pop ecx
pop ecx
test eax, eax
je 0x100b5fed
push 0x100d4c8c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x460]
push eax
call fcn.100b57f6
pop ecx
test eax, eax
je 0x100b5fe0
push 4
push 0
push 0x100d4ca8
push dword [ebp - 0x670]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 0
push str.CreateProcessInternalW
push dword [ebp - 0x670]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
push 4
push 2
push 0x100d4cd0
push dword [ebp - 0x670]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
call fcn.100b596b
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.10071b30
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
push 0x100d4ce4
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call fcn.100b5a48
pop ecx
pop ecx
test eax, eax
je 0x100b607c
push str.AdvApi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x460]
push eax
call fcn.100b57f6
pop ecx
test eax, eax
je 0x100b606f
push 4
push 0
push 0x100d4d1c
push dword [ebp - 0x674]
lea eax, [ebp - 0x460]
push eax
call fcn.100b5a9c
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
call fcn.100b596b
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071b1a
leave
ret