Function at 0x528ea0
Capabilities:
Contain obfuscated stackstrings
Delete file
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x17c]
lea ecx, [ebp - 0x17d]
mov esi, str._r_nkeyval_no_section_r_n___r_nkeyval_e_section_r_n_s__r_nval_no_key_r_n_t__r_n
push ebx
sub ecx, edi
sub esi, ecx
add ecx, 0x45
shr ecx, 2
sub esp, 0x1d8
mov eax, dword [str._r_nkeyval_no_section_r_n___r_nkeyval_e_section_r_n_s__r_nval_no_key_r_n_t__r_n]
mov dword [ebp - 0x1aa], 0xd5d735b
mov dword [ebp - 0x1a6], 0x6d616e0a
mov dword [ebp - 0x17d], eax
mov eax, dword [0x5f3db1]
mov dword [ebp - 0x1a2], 0x763d3165
mov dword [ebp - 0x13c], eax
mov eax, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 0x19e], 0xd316c61
mov dword [ebp - 0x19a], 0x6d616e0a
mov dword [ebp - 0x196], 0xd3d3265
mov dword [ebp - 0x192], 0x6d616e0a
mov dword [ebp - 0x18e], 0xa0d3365
mov dword [ebp - 0x18a], 0x656d616e
mov dword [ebp - 0x186], 0x61763d34
mov dword [ebp - 0x182], 0xa0d346c
mov byte [ebp - 0x17e], 0
rep movsd dword es:[edi], dword [esi]
mov dword [esp], 0x5f3ccc
mov dword [ebp - 0x1bc], eax
call eax
mov eax, dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x5f3ccc
mov dword [ebp - 0x1b8], eax
call eax
sub esp, 0x1c
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0x82
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp + 8], 0x5f3ccc
mov dword [esp + 4], str._cannot_create__s_n
mov dword [esp], eax
call fcn.00527880
cmp ebx, 0xffffffff
je 0x5294b3
lea eax, [ebp - 0x1b0]
mov dword [esp], ebx
lea esi, [ebp - 0x138]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1aa]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_WriteFile]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x2d
mov dword [ebp - 0x1c4], eax
call eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 0x14
mov dword [esp], ebx
mov dword [ebp - 0x1c8], eax
call eax
mov eax, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
sub esp, 4
mov dword [esp + 0x14], 0x5f3ccc
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5f37c0
mov dword [esp + 4], 0
mov dword [esp], 0x5f3cef
mov dword [ebp - 0x1c0], eax
call eax
mov ebx, dword [sym.imp.msvcrt.dll_strlen]
sub esp, 0x18
mov dword [ebp - 0x1b4], eax
mov dword [esp], esi
call ebx
lea edi, [esi + eax + 1]
cmp byte [edi], 0
je 0x5290aa
lea esi, [esi]
mov byte [edi - 1], 0x2c
mov dword [esp], edi
call ebx
lea edi, [edi + eax + 1]
cmp byte [edi], 0
jne 0x529098
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0x8d
xor eax, eax
cmp dword [ebp - 0x1b4], 0x12
je 0x5294e0
mov dword [esp + 0xc], esi
mov ecx, dword [ebp - 0x1b4]
mov dword [esp + 4], str.wrong_keys_returned__d_:__s_n
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.00527880
mov dword [esp + 0xc], 0x5f3ccc
mov dword [esp + 8], 0x5f3d20
mov dword [esp + 4], str.name5
mov dword [esp], 0x5f3cef
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
sub esp, 0x10
mov dword [esp + 0x14], 0x5f3ccc
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5f37c0
mov dword [esp + 4], 0
mov dword [esp], 0x5f3cef
mov eax, dword [ebp - 0x1c0]
call eax
sub esp, 0x18
mov dword [ebp - 0x1b4], eax
mov dword [esp], esi
call ebx
lea edi, [esi + eax + 1]
cmp byte [edi], 0
je 0x529172
lea esi, [esi]
nop
mov byte [edi - 1], 0x2c
mov dword [esp], edi
call ebx
lea edi, [edi + eax + 1]
cmp byte [edi], 0
jne 0x529160
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0x96
xor eax, eax
cmp dword [ebp - 0x1b4], 0x18
je 0x5294c0
mov dword [esp + 0xc], esi
mov ecx, dword [ebp - 0x1b4]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], str.wrong_keys_returned__d_:__s_n
call fcn.00527880
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x5f3ccc
mov eax, dword [ebp - 0x1b8]
call eax
sub esp, 0x1c
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0x9b
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp + 8], 0x5f3ccc
mov dword [esp + 4], str._cannot_create__s_n
mov dword [esp], eax
call fcn.00527880
cmp ebx, 0xffffffff
je 0x5294b3
lea eax, [ebp - 0x1b0]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x17d]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x45
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c4]
call eax
sub esp, 0x14
mov dword [esp], ebx
mov eax, dword [ebp - 0x1c8]
lea ebx, [ebp - 0xd4]
call eax
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
sub esp, 4
mov dword [esp + 0x14], str.._testwine2.ini
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x8501a0
mov dword [esp + 4], 0x5f4ee0
mov dword [esp], 0x8501a0
call edi
mov ecx, dword [0x8f0770]
sub esp, 0x18
mov esi, eax
mov dword [ebp - 0x1b4], ecx
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 0x1b4]
test ecx, ecx
setne cl
movzx ecx, cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x52931e
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0xa3
xor eax, eax
cmp esi, 0xd
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.expected_13__got__u_n
call fcn.00527880
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x5292e8
mov esi, dword [0x8f0770]
call fcn.0057d110
mov dword [ebp - 0x1b4], edi
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
xor ecx, ecx
test esi, esi
setne cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x5293c3
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0xa5
mov eax, ebx
call fcn.00526f50
mov edi, eax
mov eax, 0x5f4ea0
call fcn.00526f50
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], 0x5f4ea0
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], edi
movzx eax, al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5f39e6
call fcn.00527880
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x529360
mov edi, dword [ebp - 0x1b4]
mov dword [esp + 0x14], str.._testwine2.ini
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x8501a0
mov dword [esp + 4], 0x8501a0
mov dword [esp], 0x5f4e9c
call edi
sub esp, 0x18
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0xaa
xor eax, eax
cmp edi, 0xa
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.expected_10__got__u_n
call fcn.00527880
call fcn.0057d110
mov dword [eax], 0x5f3817
mov dword [eax + 4], 0xab
mov eax, ebx
call fcn.00526f50
mov dword [ebp - 0x1b4], eax
mov eax, str.val_no_key
call fcn.00526f50
mov dword [esp + 4], ebx
mov edi, eax
mov dword [esp], str.val_no_key
call dword [sym.imp.kernel32.dll_lstrcmpW]
mov edx, dword [ebp - 0x1b4]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], edx
movzx eax, al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], 0x5f39e6
call fcn.00527880
mov dword [esp], 0x5f3ccc
mov eax, dword [ebp - 0x1bc]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.name1_name2_name4_name5
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strcmp]
test eax, eax
sete al
movzx eax, al
jmp 0x529193
mov dword [esp + 4], str.name1_name2_name4
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strcmp]
test eax, eax
sete al
movzx eax, al
jmp 0x5290cb