Function at 0x100011c0
Capabilities:
Create process on windows
Get common file path
Get program files directory
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x7d88
call fcn.10002bd0
mov eax, dword [0x1000500c]
xor eax, esp
mov dword [esp + 0x7d84], eax
push esi
push edi
push 0x100
xor esi, esi
lea eax, [esp + 0x274]
xorps xmm0, xmm0
push esi
push eax
movaps xmmword [esp + 0x5c], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.ole32.dll_CoCreateGuid]
nop dword [eax]
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x10001230
inc esi
mov eax, 1
mov word [esp + 0x270], ax
cmp esi, 3
jl 0x10001210
jmp 0x10001287
movzx eax, byte [esp + 0x5f]
push eax
movzx eax, byte [esp + 0x62]
push eax
movzx eax, byte [esp + 0x65]
push eax
movzx eax, byte [esp + 0x68]
push eax
movzx eax, byte [esp + 0x6b]
push eax
movzx eax, byte [esp + 0x6e]
push eax
movzx eax, byte [esp + 0x71]
push eax
movzx eax, byte [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push dword [esp + 0x78]
lea eax, [esp + 0x29c]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push 0x7f
push eax
call fcn.10001030
add esp, 0x38
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x800
lea eax, [esp + reloc.KERNEL32.dll_lstrcatW]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3d88]
push eax
push ecx
call fcn.10001100
add esp, 8
lea eax, [esp + 0x3d88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x100012e3
lea eax, [esp + 0x270]
mov edx, str.SYSTEMCurrentControlSetControlLGDConsentPrompEx
push eax
push str.CLSD_UUIDC_NewYueiot
call fcn.100010a0
add esp, 8
jmp 0x100012f6
lea edx, [esp + 0x3d88]
lea ecx, [esp + 0x270]
call fcn.10001cf0
lea eax, [esp + 0x270]
mov edx, str.SYSTEMCurrentControlSetControlLGDConsentPromp
push eax
push str.CLSD_UUIDC_ProductName
call fcn.100010a0
mov eax, dword [0x10003404]
mov dword [esp + 0x4590], eax
movzx eax, word [0x10003408]
push 0x7fa
mov word [esp + 0x4598], ax
lea eax, [esp + 0x459a]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [esp + 0x1d88], 0x740068
lea eax, [esp + 0x1d90]
mov dword [esp + 0x1d8c], 0x72
push 0x7f8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x2588], 0x74006a
lea eax, [esp + 0x2590]
mov dword [esp + 0x258c], 0x72
push 0x7f8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x2d88], 0x650077
lea eax, [esp + 0x2d90]
mov dword [esp + 0x2d8c], 0x74
push 0x7f8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x3588], 0x740077
lea eax, [esp + 0x3590]
mov dword [esp + 0x358c], 0x65
push 0x7f8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x4d88], 0x37
lea eax, [esp + 0x4d8c]
push 0x7fc
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x5588], 0x38
lea eax, [esp + 0x558c]
push 0x7fc
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x5d88], 0x38
lea eax, [esp + 0x5d8c]
push 0x7fc
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [0x10003414]
mov eax, dword [0x10003444]
add esp, 0xc
mov dword [esp + 0x15e8], eax
movzx eax, word [0x10003448]
movups xmmword [esp + 0x15b8], xmm0
push 0x79a
movups xmm0, xmmword [0x10003424]
mov word [esp + 0x15f0], ax
lea eax, [esp + 0x15f2]
push 0
movups xmmword [esp + 0x15d0], xmm0
movups xmm0, xmmword [0x10003434]
movups xmmword [esp + 0x15e0], xmm0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x15b8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsrev]
movups xmm0, xmmword [str.CSIDL_APPDATA]
mov eax, dword [0x10003464]
add esp, 4
mov dword [esp + 0x798], eax
lea eax, [esp + 0x79c]
movups xmmword [esp + 0x780], xmm0
movq xmm0, qword [0x1000345c]
push 0x1ec
push 0
push eax
movq qword [esp + 0x79c], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x780]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x780]
push 0x10003274
push eax
call edi
movups xmm0, xmmword [str.CSIDL_APPDATA]
mov esi, dword [0x10003464]
lea eax, [esp + 0x38c]
push 0x1ec
movups xmmword [esp + 0x374], xmm0
push 0
movq xmm0, qword [0x1000345c]
push eax
movq qword [esp + 0x38c], xmm0
mov dword [esp + 0x394], esi
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.CSIDL_APPDATA]
add esp, 0xc
mov dword [esp + 0x11c0], esi
lea eax, [esp + 0x11c4]
movups xmmword [esp + 0x11a8], xmm0
movq xmm0, qword [0x1000345c]
push 0x1ec
push 0
push eax
movq qword [esp + 0x11c4], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0x9b0]
movups xmmword [esp + 0x988], xmm0
movups xmm0, xmmword [0x10003478]
push 0x1e0
push 0
movups xmmword [esp + 0x9a0], xmm0
push eax
movq xmm0, qword [0x10003488]
movq qword [esp + 0x9b4], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
mov esi, dword [0x100034c0]
lea eax, [esp + 0xbd0]
add esp, 0xc
mov dword [esp + 0xbc0], esi
movups xmmword [esp + 0xb90], xmm0
movups xmm0, xmmword [0x100034a0]
push 0x1d4
push 0
movups xmmword [esp + 0xba8], xmm0
push eax
movups xmm0, xmmword [0x100034b0]
movups xmmword [esp + 0xbbc], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
movups xmmword [esp + 0x68], xmm0
push 0x1d4
movups xmm0, xmmword [0x100034a0]
lea eax, [esp + 0xa0]
mov dword [esp + 0x9c], esi
push 0
movups xmmword [esp + 0x80], xmm0
push eax
movups xmm0, xmmword [0x100034b0]
movups xmmword [esp + 0x94], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0xfc8]
movups xmmword [esp + 0xfa0], xmm0
movups xmm0, xmmword [0x10003478]
push 0x1e0
push 0
movups xmmword [esp + 0xfb8], xmm0
push eax
movq xmm0, qword [0x10003488]
movq qword [esp + 0xfcc], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0x13d8]
movups xmmword [esp + 0x13b0], xmm0
movups xmm0, xmmword [0x10003478]
push 0x1e0
push 0
movups xmmword [esp + 0x13c8], xmm0
push eax
movq xmm0, qword [0x10003488]
movq qword [esp + 0x13dc], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0x5a8], esi
lea eax, [esp + 0x5ac]
movups xmmword [esp + 0x578], xmm0
movups xmm0, xmmword [0x100034a0]
push 0x1d4
push 0
movups xmmword [esp + 0x590], xmm0
push eax
movups xmm0, xmmword [0x100034b0]
movups xmmword [esp + 0x5a4], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0xdc8], esi
lea eax, [esp + 0xdcc]
movups xmmword [esp + 0xd98], xmm0
movups xmm0, xmmword [0x100034a0]
push 0x1d4
push 0
movups xmmword [esp + 0xdb0], xmm0
push eax
movups xmm0, xmmword [0x100034b0]
movups xmmword [esp + 0xdc4], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [esp + 0x780]
lea ecx, [esp + 0xb90]
call fcn.10001d10
lea edx, [esp + 0x780]
lea ecx, [esp + 0x68]
call fcn.10001d10
lea edx, [esp + 0x780]
lea ecx, [esp + 0x578]
call fcn.10001d10
lea edx, [esp + 0x780]
lea ecx, [esp + 0xd98]
call fcn.10001d10
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x370]
push str.CSIDL_APPDATA
push eax
call esi
test eax, eax
je 0x1000182f
push str.CSIDL_PROGRAM_FILES
lea eax, [esp + 0x98c]
push eax
call esi
test eax, eax
jne 0x10001859
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x370]
push eax
push 0
push 0
push 0x1a
push 0
call esi
lea eax, [esp + 0x988]
push eax
push 0
push 0
push 0x26
push 0
call esi
lea edx, [esp + 0x370]
lea ecx, [esp + 0x11a8]
call fcn.10001d10
push 0x10003274
lea eax, [esp + 0x374]
push eax
call edi
push 0x10003274
lea eax, [esp + 0x98c]
push eax
call edi
lea edx, [esp + 0x988]
lea ecx, [esp + 0xfa0]
call fcn.10001d10
lea edx, [esp + 0x988]
lea ecx, [esp + 0x13b0]
call fcn.10001d10
lea eax, [esp + 0x15b8]
push eax
lea eax, [esp + 0x6c]
push eax
call edi
push str.QKFJSGCGWGRQ
lea eax, [esp + 0x6c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x4590]
push eax
push 0x100034e0
push 0x100034e4
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x1d90]
push eax
push 0x100034f4
push 0x100034f8
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x2590]
push eax
push 0x10003500
push 0x10003504
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x2d90]
push eax
push 0x1000350c
push 0x10003510
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x3590]
push eax
push 0x10003518
push 0x1000351c
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x4d90]
push eax
push 0x10003524
push 0x10003528
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x5590]
push eax
push 0x1000340c
push 0x10003530
push 0x100034ec
call esi
lea eax, [esp + 0x68]
push eax
push 0x64
lea eax, [esp + 0x5d90]
push eax
push 0x10003410
push 0x10003538
push 0x100034ec
call esi
lea eax, [esp + 0x15b8]
push eax
lea eax, [esp + 0x57c]
push eax
call edi
push 0x10003274
lea eax, [esp + 0x57c]
push eax
call edi
lea eax, [esp + 0x1d88]
push eax
lea eax, [esp + 0x57c]
push eax
call edi
push str..exe
lea eax, [esp + 0x57c]
push eax
call edi
lea eax, [esp + 0x15b8]
push eax
lea eax, [esp + 0xd9c]
push eax
call edi
push 0x1000354c
lea eax, [esp + 0xd9c]
push eax
call edi
lea eax, [esp + 0x1d88]
push eax
lea eax, [esp + 0xfa4]
push eax
call edi
push str..exe
lea eax, [esp + 0xfa4]
push eax
call edi
push str.7z.dll
lea eax, [esp + 0x13b4]
push eax
call edi
push 0x800
lea eax, [esp + 0x658c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x4d88]
push str.__aos__y
push eax
push 0x10003580
push 0x10003588
lea eax, [esp + 0x280]
push eax
lea eax, [esp + 0x384]
push eax
push 0x10003588
push 0x1000358c
push 0x10003588
lea eax, [esp + 0x25ac]
push eax
push 0x10003274
lea eax, [esp + 0x15e4]
push eax
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0xbc0]
push eax
push 0x10003588
push 0x10003594
lea eax, [esp + 0x65c4]
push 0x1000359c
push eax
call esi
add esp, 0x44
lea eax, [esp + 0x6d88]
push 0x800
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x5588]
push str.__aos__y
push eax
push 0x10003580
push 0x10003588
lea eax, [esp + 0x15c8]
push eax
lea eax, [esp + 0xba4]
push eax
push 0x10003588
push 0x1000358c
push 0x10003588
lea eax, [esp + 0x2dac]
push eax
push 0x10003274
lea eax, [esp + 0x15e4]
push eax
lea eax, [esp + 0xbc0]
push eax
push 0x10003588
push 0x10003594
lea eax, [esp + 0x6dc4]
push 0x1000359c
push eax
call esi
add esp, 0x44
lea eax, [esp + 0x7588]
push 0x800
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x5d88]
push str.__aos__y
push eax
push 0x10003580
push 0x10003588
lea eax, [esp + 0x11b8]
push eax
push 0x10003588
push 0x1000358c
push 0x10003588
lea eax, [esp + 0x35a8]
push eax
push 0x10003274
lea eax, [esp + 0x15e0]
push eax
lea eax, [esp + 0xbbc]
push eax
push 0x10003588
push 0x10003594
lea eax, [esp + 0x75c0]
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s
push eax
call esi
xorps xmm0, xmm0
mov dword [esp + 0x54], 0x3c
add esp, 0x40
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
lea eax, [esp + 0x578]
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], str.open
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6588]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10001c80
push 0xffffffffffffffff
push dword [esp + 0x50]
call esi
push dword [esp + 0x4c]
call edi
lea eax, [esp + 0x6d88]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10001ca8
push 0xffffffffffffffff
push dword [esp + 0x50]
call esi
push dword [esp + 0x4c]
call edi
lea eax, [esp + 0x7588]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10001cd0
push 0xffffffffffffffff
push dword [esp + 0x50]
call esi
push dword [esp + 0x4c]
call edi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3