Function at 0x10024260
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x3ec], ax
lea eax, [ebp - 0x3ea]
push eax
call fcn.1006ff30
add esp, 0xc
lea eax, [ebp - 0x3ec]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x100afc1c
lea eax, [ebp - 0x3ec]
push 0x104
push eax
call fcn.1006e675
push 0x1009be54
lea eax, [ebp - 0x3ec]
push 0x104
push eax
call fcn.1006e675
add esp, 0x18
lea eax, [ebp - 0x3ec]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0xa4
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1e4], 0x6f0073
push 0
push eax
mov dword [ebp - 0x1e0], 0x740066
mov dword [ebp - 0x1dc], 0x64005f
mov dword [ebp - 0x1d8], 0x77006f
mov dword [ebp - 0x1d4], 0x6c006e
mov dword [ebp - 0x1d0], 0x61006f
mov dword [ebp - 0x1cc], 0x2e0064
mov dword [ebp - 0x1c8], 0x6e0069
mov dword [ebp - 0x1c4], 0x69
call fcn.1006ff30
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x3ec]
push 0x104
push eax
call fcn.1006e675
xor eax, eax
mov dword [ebp - 0x11c], 0x6f0063
push 0x56
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
mov dword [ebp - 0x118], 0x66006e
mov dword [ebp - 0x114], 0x670069
call fcn.1006ff30
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0x650079
add esp, 0x24
mov dword [ebp - 0x28], 0x720061
xor eax, eax
movq qword [ebp - 0x12], xmm0
mov word [ebp - 0x24], ax
movdqu xmmword [ebp - 0x22], xmm0
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov dword [ebp - 0x54], 0x6f006d
mov dword [ebp - 0x50], 0x74006e
mov dword [ebp - 0x4c], 0x68
movdqu xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x30], eax
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0xb8], 0x610064
mov dword [ebp - 0xb4], 0x79
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x3ec]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x11c]
push eax
movdqu xmmword [ebp - 0xb0], xmm0
movdqu xmmword [ebp - 0xa0], xmm0
call esi
mov ebx, eax
lea eax, [ebp - 0x3ec]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x3ec]
push eax
push 0
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
mov esi, eax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x3fa], xmm0
mov word [ebp - 0x3fc], ax
mov dword [ebp - 0x3f2], eax
mov word [ebp - 0x3ee], ax
lea eax, [ebp - 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x3fc]
movzx eax, word [ebp - 0x3fa]
imul ecx, edx, 0x64
add ecx, eax
movzx eax, word [ebp - 0x3f6]
imul ecx, ecx, 0x64
add ecx, eax
imul eax, ebx, 0x64
add eax, edi
imul eax, eax, 0x64
add eax, esi
cmp eax, ecx
je 0x100245a0
xor eax, eax
xorps xmm0, xmm0
push edx
mov word [ebp - 0x68], ax
mov word [ebp - 0x56], ax
mov word [ebp - 0x90], ax
mov word [ebp - 0x7e], ax
mov word [ebp - 0x7c], ax
mov word [ebp - 0x6a], ax
lea eax, [ebp - 0x68]
push 0x1009be08
push eax
movdqu xmmword [ebp - 0x66], xmm0
movdqu xmmword [ebp - 0x8e], xmm0
movdqu xmmword [ebp - 0x7a], xmm0
call fcn.10022f40
movzx eax, word [ebp - 0x3fa]
push eax
lea eax, [ebp - 0x90]
push 0x1009be08
push eax
call fcn.10022f40
movzx eax, word [ebp - 0x3f6]
push eax
lea eax, [ebp - 0x7c]
push 0x1009be08
push eax
call fcn.10022f40
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x3ec]
add esp, 0x24
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret