Function at 0x1000b95f
Capabilities:
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push 0x15c
mov eax, 0x1003e8b3
call fcn.1003d701
xor ebx, ebx
lea eax, [ebp - 0x117]
push 0x103
push ebx
push eax
mov byte [ebp - 0x118], bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x158]
call fcn.10003da4
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], ebx
call fcn.1000c2c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.10003ba2
mov cl, 5
mov dword [ebp - 0x14c], 0x71754a05
mov dword [ebp - 0x148], 0x2b6b6a6c
mov eax, ebx
mov dword [ebp - 0x144], 0x6c6b4c
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000ba03
mov cl, byte [ebp - 0x14c]
jmp 0x1000b9ee
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x141], bl
push eax
mov edx, 0x10055470
lea ecx, [ebp - 0x130]
call fcn.1000c3b9
pop ecx
push 0xf
pop edi
cmp dword [ebp - 0x11c], edi
lea edx, [ebp - 0x130]
push 0x3e
cmova edx, dword [ebp - 0x130]
mov cl, 0x7a
pop ebx
mov byte [ebp - 0x13c], cl
xor eax, eax
mov byte [ebp - 0x13b], bl
mov dword [ebp - 0x13a], 0xa032e22
mov word [ebp - 0x136], 0x1f
xor byte [ebp + eax - 0x13b], cl
inc eax
cmp eax, 6
jae 0x1000ba72
mov cl, byte [ebp - 0x13c]
jmp 0x1000ba5d
mov byte [ebp - 0x135], 0
mov cl, 0x18
mov dword [ebp - 0x148], 0x4c405c18
xor eax, eax
mov dword [ebp - 0x144], 0x7d6861
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 6
jae 0x1000baa6
mov cl, byte [ebp - 0x148]
jmp 0x1000ba91
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x13b]
push edx
push 0
push eax
lea eax, [ebp - 0x147]
mov byte [ebp - 0x141], 0
push eax
call esi
mov dword [0x10057bdc], eax
test eax, eax
jns 0x1000bad6
xor eax, eax
mov dword [0x10057bdc], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bae3
mov dword [0x10057bdc], ecx
cmp dword [ebp - 0x11c], edi
lea edx, [ebp - 0x130]
mov cl, 0x17
mov dword [ebp - 0x14c], 0x7e7c4417
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x148], 0x65567b7b
mov word [ebp - 0x144], 0x7672
mov byte [ebp - 0x142], 0
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 9
jae 0x1000bb33
mov cl, byte [ebp - 0x14c]
jmp 0x1000bb1e
mov byte [ebp - 0x142], 0
mov cl, 0x55
mov dword [ebp - 0x138], 0x263c1855
xor eax, eax
mov word [ebp - 0x134], 0x36
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000bb66
mov cl, byte [ebp - 0x138]
jmp 0x1000bb51
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10057be0], eax
test eax, eax
jns 0x1000bb90
xor eax, eax
mov dword [0x10057be0], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bb9d
mov dword [0x10057be0], ecx
cmp dword [ebp - 0x11c], edi
lea edx, [ebp - 0x130]
mov cl, 0x57
mov dword [ebp - 0x150], 0x39321057
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov byte [ebp - 0x14c], bl
mov word [ebp - 0x14b], 0x132
mov byte [ebp - 0x149], bl
mov byte [ebp - 0x148], 0x24
mov byte [ebp - 0x147], bl
mov dword [ebp - 0x146], 0x323b35
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xc
jae 0x1000bbff
mov cl, byte [ebp - 0x150]
jmp 0x1000bbea
push 0x29
pop ebx
mov cl, bl
mov byte [ebp - 0x143], 0
mov byte [ebp - 0x138], cl
xor eax, eax
mov dword [ebp - 0x137], 0x4a5a4064
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000bc39
mov cl, byte [ebp - 0x138]
jmp 0x1000bc24
push edx
push 1
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10057be4], eax
test eax, eax
jns 0x1000bc63
xor eax, eax
mov dword [0x10057be4], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bc70
mov dword [0x10057be4], ecx
cmp dword [ebp - 0x11c], edi
lea edx, [ebp - 0x130]
mov cl, 0x71
mov dword [ebp - 0x14c], 0x1f142371
cmova edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x148], 0x32031415
mov dword [ebp - 0x144], 0x140110
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 0xa
jae 0x1000bcba
mov cl, byte [ebp - 0x14c]
jmp 0x1000bca5
mov byte [ebp - 0x141], 0
mov cl, 0xd
mov dword [ebp - 0x138], 0x7e64400d
xor eax, eax
mov word [ebp - 0x134], 0x6e
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000bced
mov cl, byte [ebp - 0x138]
jmp 0x1000bcd8
push edx
push 1
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10057bec], eax
test eax, eax
jns 0x1000bd17
xor eax, eax
mov dword [0x10057bec], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bd24
mov dword [0x10057bec], ecx
cmp dword [ebp - 0x11c], edi
lea edx, [ebp - 0x130]
mov byte [ebp - 0x149], bl
mov cl, 0x4e
cmova edx, dword [ebp - 0x130]
xor ebx, ebx
push 0xd
mov dword [ebp - 0x150], 0x202f1c4e
mov eax, ebx
mov word [ebp - 0x14c], 0x2725
mov byte [ebp - 0x14a], 0x20
mov dword [ebp - 0x148], 0x2b28280b
mov word [ebp - 0x144], 0x3a2d
mov byte [ebp - 0x142], bl
pop edi
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, edi
jae 0x1000bd8d
mov cl, byte [ebp - 0x150]
jmp 0x1000bd79
mov byte [ebp - 0x142], bl
mov cl, 2
mov dword [ebp - 0x138], 0x716b4f02
mov eax, ebx
mov word [ebp - 0x134], 0x61
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000bdbf
mov cl, byte [ebp - 0x138]
jmp 0x1000bdaa
push edx
push 1
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], bl
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10057bf0], eax
test eax, eax
jns 0x1000bde8
mov eax, ebx
mov dword [0x10057bf0], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000bdf5
mov dword [0x10057bf0], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
push 0x3d
cmova edx, dword [ebp - 0x130]
mov cl, 0x50
pop ebx
mov word [ebp - 0x14c], 0x1750
xor eax, eax
mov byte [ebp - 0x14a], 0x31
mov byte [ebp - 0x149], bl
mov word [ebp - 0x148], 0x435
mov byte [ebp - 0x146], 0x39
mov byte [ebp - 0x145], bl
mov word [ebp - 0x144], 0x35
xor byte [ebp + eax - 0x14b], cl
inc eax
cmp eax, 8
jae 0x1000be5a
mov cl, byte [ebp - 0x14c]
jmp 0x1000be45
mov byte [ebp - 0x143], 0
mov cl, 0x19
mov dword [ebp - 0x138], 0x6a705419
xor eax, eax
mov word [ebp - 0x134], 0x7a
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000be8d
mov cl, byte [ebp - 0x138]
jmp 0x1000be78
push edx
push 0
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10057be8], eax
test eax, eax
jns 0x1000beb7
xor eax, eax
mov dword [0x10057be8], eax
push 0x18
pop ecx
cmp eax, ecx
jle 0x1000bec4
mov dword [0x10057be8], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
push 0x29
cmova edx, dword [ebp - 0x130]
xor eax, eax
pop ecx
mov byte [ebp - 0x150], cl
mov dword [ebp - 0x14f], 0x4c44486a
mov dword [ebp - 0x14b], 0x487b485b
mov dword [ebp - 0x147], 0x4c4e47
xor byte [ebp + eax - 0x14f], cl
inc eax
cmp eax, 0xb
jae 0x1000bf16
mov cl, byte [ebp - 0x150]
jmp 0x1000bf01
mov byte [ebp - 0x144], 0
mov cl, 0x54
mov word [ebp - 0x138], 0x1954
xor eax, eax
mov byte [ebp - 0x136], bl
mov word [ebp - 0x135], 0x3727
mov byte [ebp - 0x133], 0
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000bf55
mov cl, byte [ebp - 0x138]
jmp 0x1000bf40
push edx
push 0
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x133], 0
push eax
lea eax, [ebp - 0x137]
push eax
call esi
mov dword [0x10057bf4], eax
test eax, eax
jns 0x1000bf7f
xor eax, eax
mov dword [0x10057bf4], eax
push 0x14
pop ecx
cmp eax, ecx
jle 0x1000bf8c
mov dword [0x10057bf4], ecx
cmp dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x130]
push 0x71
cmova ecx, dword [ebp - 0x130]
xor eax, eax
pop edx
mov byte [ebp - 0x140], dl
mov dword [ebp - 0x13f], 0x19051021
mov dword [ebp - 0x13b], 0x1827021e
mov word [ebp - 0x137], 0x614
mov byte [ebp - 0x135], 0
xor byte [ebp + eax - 0x13f], dl
inc eax
cmp eax, 0xa
jae 0x1000bfe4
mov dl, byte [ebp - 0x140]
jmp 0x1000bfcf
mov byte [ebp - 0x135], 0
xor eax, eax
mov byte [ebp - 0x148], bl
mov dword [ebp - 0x147], 0x585b5b78
mov word [ebp - 0x143], 0x495e
mov byte [ebp - 0x141], 0
xor byte [ebp + eax - 0x147], bl
inc eax
cmp eax, 6
jae 0x1000c022
mov bl, byte [ebp - 0x148]
jmp 0x1000c00d
push ecx
push 1
lea eax, [ebp - 0x13f]
xor ebx, ebx
push eax
lea eax, [ebp - 0x147]
mov byte [ebp - 0x141], bl
push eax
call esi
mov dword [0x10057bf8], eax
test eax, eax
jns 0x1000c04d
mov eax, ebx
mov dword [0x10057bf8], eax
cmp eax, 1
jle 0x1000c058
mov dword [0x10057bf8], ebx
cmp dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x130]
push 0x2e
cmova ecx, dword [ebp - 0x130]
mov eax, ebx
pop edx
mov byte [ebp - 0x138], dl
mov dword [ebp - 0x137], 0x415a5b6f
mov byte [ebp - 0x133], bl
xor byte [ebp + eax - 0x137], dl
inc eax
cmp eax, 4
jae 0x1000c09c
mov dl, byte [ebp - 0x138]
jmp 0x1000c087
push 0x36
pop edx
mov byte [ebp - 0x133], bl
mov eax, ebx
mov byte [ebp - 0x150], dl
mov dword [ebp - 0x14f], 0x55535f66
mov dword [ebp - 0x14b], 0x554e7353
mov dword [ebp - 0x147], 0x5158575e
mov word [ebp - 0x143], 0x53
xor byte [ebp + eax - 0x14f], dl
inc eax
cmp eax, edi
jae 0x1000c0e8
mov dl, byte [ebp - 0x150]
jmp 0x1000c0d4
push ecx
push ebx
lea eax, [ebp - 0x137]
mov byte [ebp - 0x142], bl
push eax
lea eax, [ebp - 0x14f]
push eax
call esi
mov dword [0x10057bfc], eax
test eax, eax
jns 0x1000c110
mov eax, ebx
mov dword [0x10057bfc], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000c11d
mov dword [0x10057bfc], ecx
cmp dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x130]
push 2
cmova ecx, dword [ebp - 0x130]
mov eax, ebx
pop edx
mov byte [ebp - 0x14c], dl
mov dword [ebp - 0x14b], 0x616d7651
mov dword [ebp - 0x147], 0x6c6c4b69
mov byte [ebp - 0x143], bl
xor byte [ebp + eax - 0x14b], dl
inc eax
cmp eax, 8
jae 0x1000c16b
mov dl, byte [ebp - 0x14c]
jmp 0x1000c156
push 0x27
pop edx
mov byte [ebp - 0x143], bl
mov eax, ebx
mov byte [ebp - 0x140], dl
mov dword [ebp - 0x13f], 0x44424e77
mov dword [ebp - 0x13b], 0x445f6242
mov dword [ebp - 0x137], 0x4049464f
mov word [ebp - 0x133], 0x42
xor byte [ebp + eax - 0x13f], dl
inc eax
cmp eax, edi
jae 0x1000c1b7
mov dl, byte [ebp - 0x140]
jmp 0x1000c1a3
push ecx
push ebx
lea eax, [ebp - 0x14b]
mov byte [ebp - 0x132], bl
push eax
lea eax, [ebp - 0x13f]
push eax
call esi
mov dword [0x10057c00], eax
test eax, eax
jns 0x1000c1df
mov eax, ebx
mov dword [0x10057c00], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000c1ec
mov dword [0x10057c00], ecx
cmp dword [ebp - 0x11c], 0xf
lea edx, [ebp - 0x130]
push 0x3e
cmova edx, dword [ebp - 0x130]
mov eax, ebx
pop ecx
mov byte [ebp - 0x138], cl
mov dword [ebp - 0x137], 0x52525b6d
mov byte [ebp - 0x133], bl
xor byte [ebp + eax - 0x137], cl
inc eax
cmp eax, 4
jae 0x1000c230
mov cl, byte [ebp - 0x138]
jmp 0x1000c21b
mov byte [ebp - 0x133], bl
mov cl, 0x33
mov dword [ebp - 0x168], 0x565a6333
mov eax, ebx
mov dword [ebp - 0x164], 0x4b765650
mov dword [ebp - 0x160], 0x5d525b50
mov word [ebp - 0x15c], 0x5654
mov byte [ebp - 0x15a], bl
xor byte [ebp + eax - 0x167], cl
inc eax
cmp eax, edi
jae 0x1000c27b
mov cl, byte [ebp - 0x168]
jmp 0x1000c267
push edx
push ebx
lea eax, [ebp - 0x137]
mov byte [ebp - 0x15a], bl
push eax
lea eax, [ebp - 0x167]
push eax
call esi
mov dword [0x10057c04], eax
test eax, eax
jns 0x1000c2a3
mov eax, ebx
mov dword [0x10057c04], eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000c2b0
mov dword [0x10057c04], ecx
lea ecx, [ebp - 0x130]
call fcn.10003ba2
call fcn.1003d6bf
ret