Function at 0x10007450
Capabilities:
Contain obfuscated stackstrings
Copy file
Get common file path
Get startup folder
Write file to startup folder

Disassembly:
push 0xffffffffffffffff
push 0x1000c171
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x968
lea ecx, [esp + 0x20]
call dword [sym.imp.EoRezoTools_17.dll_public:_void___thiscall_CRegistry::constructor_void_]
push 0xa
lea ecx, [esp + 0x38]
mov dword [esp + 0x974], 0
call fcn.1000ab38
push 1
lea eax, [esp + 0x16c]
push 0x1a
push eax
push 0
mov byte [esp + 0x980], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFile::CFile
lea ecx, [esp + 0xc]
mov byte [esp + 0x970], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 4]
mov byte [esp + 0x970], 3
call sub.MFC42.DLL_CString::CString_1
push 0x100120e4
lea ecx, [esp + 8]
mov byte [esp + 0x974], 4
call sub.MFC42.DLL_CString::operator_1
push str.EoRezo
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
lea edx, [esp]
push ecx
push 0x100122b8
push edx
mov byte [esp + 0x97c], 5
call sub.MFC42.DLL_operator_2
push 0x10012150
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x978], 6
push eax
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 4]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x97c], 7
call sub.MFC42.DLL_operator
push str..cfg
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x978], 8
push eax
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
lea ecx, [esp + 0x168]
push ecx
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x97c], 9
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 8]
mov byte [esp + 0x970], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x970], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x970], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov byte [esp + 0x970], 5
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x50]
push eax
push ecx
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
jne 0x10007714
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push str.Software_
push eax
mov byte [esp + 0x97c], 0xa
call sub.MFC42.DLL_operator_2
push 0x10012150
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x97c], 0xb
call sub.MFC42.DLL_operator_1
lea edx, [esp + 4]
mov byte [esp + 0x970], 0xc
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push str.PathInstall
push eax
lea ecx, [esp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0x980], 0xd
call dword [sym.imp.EoRezoTools_17.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x974], 0xe
call sub.MFC42.DLL_CString::operator
lea ecx, [esp]
mov byte [esp + 0x970], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x970], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x970], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x970], 0xa
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 4]
push eax
push ecx
call sub.MFC42.DLL_operator
push str..cfg
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x97c], 0xf
call sub.MFC42.DLL_operator_1
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov byte [esp + 0x970], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x970], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x970], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x970], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x970], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x970], 1
call fcn.1000ac82
lea ecx, [esp + 0x34]
mov byte [esp + 0x970], 0
call sub.MFC42.DLL_CStringList::CStringList
lea ecx, [esp + 0x20]
mov dword [esp + 0x970], 0xffffffff
call dword [sym.imp.EoRezoTools_17.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_]
mov ecx, dword [esp + 0x968]
mov dword fs:[0], ecx
add esp, 0x974
ret