Function at 0x10001040
Capabilities:
Create thread

Disassembly:
mov eax, 0x120c
call fcn.1001a2d0
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x1208], eax
mov eax, dword [esp + 0x1214]
sub eax, 1
push ebx
mov ebx, dword [esp + 0x1214]
jne 0x10001321
push esi
push edi
push 0x1001b8b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10022460], eax
test eax, eax
je 0x100010ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call esi
mov dword [0x10022458], eax
mov eax, dword [0x10022460]
push str.Wow64RevertWow64FsRedirection
push eax
call esi
mov dword [0x1002245c], eax
push 0x10022e28
call fcn.10007090
add esp, 4
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10022e28]
mov byte [eax + 0x10022b00], cl
inc eax
test cl, cl
jne 0x100010c0
mov eax, 0x10022b00
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100010d7
mov ecx, dword [str.LaunchMgr.ini]
mov edx, dword [0x1001b908]
mov dword [eax], ecx
mov ecx, dword [0x1001b90c]
mov dword [eax + 4], edx
mov dx, word [0x1001b910]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
call fcn.10012540
push 0x10023888
push str._SSOFTWAREVB_and_VBA_Program_SettingsSPYWAREPROTECTIONConfig
lea edx, [esp + 0xa1c]
call fcn.10001000
lea eax, [esp + 0x14]
push eax
mov esi, str.LicenseCode
mov edi, 0x1001b9b8
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10016840
add esp, 0xc
test eax, eax
jne 0x10001158
lea ecx, [esp + 0xc]
push ecx
lea edi, [esp + 0xa18]
mov edx, SysStringLen
call fcn.10016840
add esp, 4
push 0
push 0
push 0x104
push 0x10022c08
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.c:zv_npdbk.ini
push 0x10022e28
push str.Path
push str.AppPath
call edi
push 0x800
push 0x10023228
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.c:zv_npdbk.ini
push 0x10023228
push str.ModulePath
push str.AppPath
call edi
push 0x400
push 0x10022468
push 0x10023228
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x100011f1
xor eax, eax
jmp 0x100011e0
mov cl, byte [eax + 0x10022468]
mov byte [eax + 0x10023228], cl
inc eax
test cl, cl
jne 0x100011e0
mov esi, dword [sym.imp.MSVCR90.dll_strrchr]
push 0x5c
push 0x10023228
call esi
add esp, 8
test eax, eax
je 0x10001234
push 0x5c
push 0x10023228
mov byte [eax], 0
call esi
add esp, 8
test eax, eax
je 0x10001234
push str.c:zv_npdbk.ini
push 0x10023228
push str.NPRoot
push str.AppPath
mov byte [eax + 1], 0
call edi
call fcn.10001340
push 0
push 0
push 0
push 0x10007170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.MSVCR90.dll_sprintf]
push 0x10022e28
lea eax, [esp + 0x218]
push str._sZvMon
push eax
call esi
lea ecx, [esp + 0x220]
push ecx
call sym.LaunchMgr.dll_TakeOwnership
push 0x10022e28
lea edx, [esp + 0x228]
push str._sCloudscan
push edx
call esi
lea eax, [esp + 0x230]
push eax
call sym.LaunchMgr.dll_TakeOwnership
push 0x10022e28
lea ecx, [esp + 0x238]
push str._sIDS
push ecx
call esi
lea edx, [esp + 0x240]
push edx
call sym.LaunchMgr.dll_TakeOwnership
push str.c:zvAPCONAC
call sym.LaunchMgr.dll_TakeOwnership
push 0x10022e28
lea eax, [esp + 0x24c]
push str._snwlogs
push eax
call esi
lea ecx, [esp + 0x254]
add esp, 0x40
push ecx
call sym.LaunchMgr.dll_TakeOwnership
push 0x10022e28
lea edx, [esp + 0x21c]
push str._sDOM
push edx
call esi
lea eax, [esp + 0x224]
push eax
call sym.LaunchMgr.dll_TakeOwnership
add esp, 0x14
push str.c:zvLaunchMgr.ini
push 0x1001baa0
push str.DllProcessAttach
push 0x1001bab8
call edi
pop edi
pop esi
mov ecx, dword [esp + 0x120c]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100195d2
add esp, 0x120c
ret 0xc