Function at 0x10001720
Capabilities:
Check os version
Create thread
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x10018080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x278], ebx
mov dword [esi + 0x264], 0x14
mov dword [esi + 0x2e4], ebx
mov eax, 0xf
mov dword [esi + 0x2e8], eax
mov byte [esi + 0x2d4], bl
mov dword [esi + 0x304], eax
mov dword [esi + 0x300], ebx
mov byte [esi + 0x2f0], bl
mov dword [esi + 0x320], eax
push 0x11c
lea eax, [ebp - 0x328]
mov dword [esi + 0x31c], ebx
push ebx
mov byte [esi + 0x30c], bl
push eax
mov dword [esi], ebx
call fcn.1000a5a0
add esp, 0xc
lea ecx, [ebp - 0x328]
push ecx
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100018a9
cmp dword [ebp - 0x318], 2
jne 0x100018a9
cmp dword [ebp - 0x324], 5
jbe 0x100018a9
lea edx, [ebp - 0x32c]
push edx
push 8
mov dword [ebp - 0x32c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100018a9
mov ecx, dword [ebp - 0x32c]
lea eax, [ebp - 0x330]
push eax
push ebx
push ebx
push 0x19
push ecx
mov dword [ebp - 0x330], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1000189c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000189c
mov edx, dword [ebp - 0x330]
push edi
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1000189b
mov ecx, dword [ebp - 0x330]
mov edx, dword [ebp - 0x32c]
lea eax, [ebp - 0x330]
push eax
push ecx
push edi
push 0x19
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10001894
mov eax, dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx ecx, byte [eax]
mov edx, dword [edi]
dec ecx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov eax, dword [eax]
mov dword [ebp - 0x334], eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x334], 0x4000
je 0x10001a41
call fcn.10003250
push 0x10016040
push eax
mov dword [esi + 0x68c], eax
call fcn.10003530
mov edx, dword [esi + 0x68c]
push 0x10016054
push edx
mov dword [esi + 0x690], eax
call fcn.10003530
mov dword [esi + 0x694], eax
mov eax, dword [esi + 0x68c]
push 0x10016068
push eax
call fcn.10003530
mov ecx, dword [esi + 0x68c]
push 0x1001607c
push ecx
mov dword [esi + 0x698], eax
call fcn.10003530
mov edx, dword [esi + 0x68c]
push 0x10016090
push edx
mov dword [esi + 0x69c], eax
call fcn.10003530
mov dword [esi + 0x6a0], eax
mov eax, dword [esi + 0x68c]
push 0x100160ac
push eax
call fcn.10003530
mov ecx, dword [esi + 0x68c]
push 0x100160c8
push ecx
mov dword [esi + 0x6a4], eax
call fcn.10003530
mov edx, dword [esi + 0x68c]
push 0x100160e0
push edx
mov dword [esi + 0x6a8], eax
call fcn.10003530
add esp, 0x40
push ebx
mov dword [esi + 0x6ac], eax
mov dword [esi + 0x2c0], ebx
mov dword [esi + 0x2c4], ebx
mov byte [esi + 0x7f4], bl
mov dword [esi + 0x6cc], ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x6d0], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi + 0x2c8], bl
mov dword [esi + 0x6c4], ebx
mov dword [esi + 0x6b4], 5
mov dword [esi + 0x6b8], 0x1f4
mov dword [esi + 0x6b0], 1
mov dword [esi + 0x6bc], ebx
mov dword [esi + 0x6c0], 0x18
mov dword [esi + 0x908], ebx
mov dword [esi + 0x90c], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x100160f0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x20c]
call fcn.100025d0
push ebx
push ebx
push esi
push 0x10001b30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push esi
push 0x10001a60
push ebx
push ebx
call fcn.100045f7
add esp, 0x18
mov dword [esi + 0x6c8], eax
mov dword [esi], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.10003802
mov esp, ebp
pop ebp
ret