Function at 0x10010837
Capabilities:
Check if file exists
Get common file path
Get startup folder
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c4
call fcn.10018f80
mov eax, dword [0x1002b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x109c], ebx
mov dword [ebp - 0x109c], ebp
push 1
push dword [ebp - 0x109c]
push str.int___cdecl_IsLaunchWhenStartup_void_
call fcn.1000b484
mov esi, eax
add esp, 0xc
mov eax, 0x10022ab0
cmp esi, ebx
jne 0x10010881
mov esi, eax
push ebx
push ebx
push ebx
push ebx
push eax
push 0x10022a80
push esi
lea ecx, [ebp - 0x10c4]
call fcn.1000a370
cmp esi, ebx
jne 0x1001089d
push ebp
pop ebp
push 6
pop ecx
mov esi, 0x10022a64
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
push 0x18
lea eax, [ebp - 0x228]
push eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
call esi
mov edi, dword [sym.imp.MSVCR90.dll_wcscat]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x10a0], eax
cmp eax, ebx
jne 0x10010da2
push 0x208
lea eax, [ebp - 0x228]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 7
lea eax, [ebp - 0x228]
push eax
push ebx
call esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x10a0], eax
cmp eax, ebx
jne 0x10010da2
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
lea ecx, [ebp - 0x10ac]
mov dword [ebp - 0x10ac], ebx
mov dword [ebp - 0x10a8], ebx
call fcn.100013fe
test eax, eax
jne 0x10010d97
push 0x206
mov word [ebp - 0x638], ax
lea eax, [ebp - 0x636]
push ebx
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
mov edi, 0x40e
push edi
mov word [ebp - 0x1060], ax
lea eax, [ebp - 0x105e]
push ebx
push eax
call sub.MSVCR90.dll_memset
lea eax, [ebp - 0x638]
push eax
push 0x100209cc
call sym.XmpSetupHelper.dll_GetXmpPath
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x20
push str.ProgramXMP.exe
lea eax, [ebp - 0x638]
push eax
call esi
xor eax, eax
push edi
mov word [ebp - 0xa48], ax
lea eax, [ebp - 0xa46]
push ebx
push eax
call sub.MSVCR90.dll_memset
lea eax, [ebp - 0xa48]
push 0x1001d410
push eax
call sym.XmpSetupHelper.dll_GetProfileFolder
add esp, 0x14
push str.CoreProgramxmp.exe
lea eax, [ebp - 0xa48]
push eax
call esi
mov ebx, dword [sym.imp.MSVCR90.dll_wcslen]
lea eax, [ebp - 0x638]
push eax
mov dword [ebp - 0x10a4], 0x208
call ebx
pop ecx
test eax, eax
ja 0x10010a2f
lea eax, [ebp - 0xa48]
push eax
call ebx
pop ecx
test eax, eax
jbe 0x10010d97
lea eax, [ebp - 0x10a4]
push eax
lea eax, [ebp - 0x1060]
push eax
push 0x100229b4
lea ecx, [ebp - 0x10ac]
call fcn.10001433
test eax, eax
jne 0x10010d97
lea eax, [ebp - 0x1060]
push eax
call ebx
pop ecx
mov ecx, dword [ebp - 0x10a4]
mov edi, eax
mov eax, 0x81
cmp ecx, eax
ja 0x10010d59
cmp edi, eax
ja 0x10010d59
dec ecx
dec eax
cmp ecx, eax
ja 0x10010d97
dec edi
cmp edi, eax
ja 0x10010d97
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x1098]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
xor esi, esi
cmp word [ebp - 0x1060], 0x22
lea ecx, [ebp - 0x1098]
jne 0x10010ac0
inc esi
push esi
push 0x22
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_first_of_wchar_t__unsigned_int_const]
jmp 0x10010acc
push esi
push 0x100229ac
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1098]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
mov esi, 0x10022984
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x10010b31
push 1
sub esp, 0x1c
lea eax, [ebp - 0x107c]
mov ecx, esp
mov dword [ebp - 0x10a4], esp
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push str._XmpSetup__tstrPathInData_:
push 0
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.10001786
mov ecx, eax
call fcn.1000a33f
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0xc50], ax
lea eax, [ebp - 0xc4e]
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
push edi
push eax
mov word [ebp - 0x430], ax
lea eax, [ebp - 0x42e]
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [ebp - 0x1078]
add esp, 0x18
cmp dword [ebp - 0x1064], 8
jae 0x10010b7c
lea eax, [ebp - 0x1078]
mov edi, 0x104
push edi
push eax
lea eax, [ebp - 0xc50]
push eax
call dword [sym.imp.MSVCR90.dll_wcsncpy]
mov eax, dword [ebp - 0x1078]
add esp, 0xc
cmp dword [ebp - 0x1064], 8
jae 0x10010ba8
lea eax, [ebp - 0x1078]
push edi
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.MSVCR90.dll_wcsncpy]
add esp, 0xc
push edi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x430]
push eax
call ebx
pop ecx
jmp 0x10010be5
xor ecx, ecx
mov word [ebp + eax*2 - 0x430], cx
dec eax
cmp word [ebp + eax*2 - 0x430], 0x20
je 0x10010bdb
mov edi, dword [sym.imp.MSVCR90.dll__wcslwr]
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x638]
push eax
call edi
lea eax, [ebp - 0xa48]
push eax
call edi
lea eax, [ebp - 0x638]
push eax
call ebx
mov edi, dword [sym.imp.MSVCR90.dll__wcsnicmp]
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
add esp, 0x1c
test eax, eax
je 0x10010c5a
lea eax, [ebp - 0xa48]
push eax
call ebx
push eax
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
add esp, 0x10
test eax, eax
jne 0x10010c64
mov dword [ebp - 0x10a0], 1
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x10010c9c
push 1
lea eax, [ebp - 0x430]
push eax
push str._XmpSetup___szPathInData_long_:
push 0
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x10010cee
push 1
lea eax, [ebp - 0xa48]
push eax
push str._xmp.exe:
lea eax, [ebp - 0x638]
push eax
push str.XMP.exe_path:
push 0
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x10010d3f
push 1
push dword [ebp - 0x10a0]
lea eax, [ebp - 0x1060]
push str._autoRun_:
push eax
push str.reg_data_:
push 0
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.1000152a
mov ecx, eax
call fcn.1000a33f
lea ecx, [ebp - 0x107c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x1098]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x10010d97
xor ebx, ebx
mov esi, 0x10022984
inc ebx
push esi
mov dword [ebp - 0x10a0], ebx
call fcn.10005425
pop ecx
test eax, eax
jne 0x10010d97
push ebx
push edi
push str.the_Value_in_Reg._is_longer_than_129__length
push eax
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.1000bba2
mov ecx, eax
call fcn.10001626
mov ecx, eax
call fcn.1000a33f
lea ecx, [ebp - 0x10ac]
call fcn.10001395
lea ecx, [ebp - 0x10c4]
call fcn.1000be71
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018dd2
leave
ret