Function at 0x10006987
Capabilities:
Create process on windows
Delete registry value
Get common file path
Set environment variable

Disassembly:
mov eax, 0x1006032b
call fcn.1005fa24
sub esp, 0xe8
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x24], edi
je 0x10006a0c
cmp byte [ebp + 0x10], 0
je 0x100069bf
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x100070dc
xor ebx, ebx
mov dword [esi], ebx
jmp 0x10006a03
push 2
lea ecx, [ebp - 0x7c]
call fcn.10002fdf
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], ebx
push eax
push ebx
mov edx, 0x5e20
lea ecx, [ebp - 0x7c]
call fcn.10009609
lea eax, [ebp - 0x7c]
xor cl, cl
push eax
call fcn.10005884
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
add esp, 0xc
call fcn.1000301b
dec dword [esi]
cmp dword [esi], ebx
jge 0x100069c5
jmp 0x100070dc
mov dword [ebp - 0x18], 0x2f77
xor ebx, ebx
cmp dword [ebp - 0x18], 0x30d7
jle 0x10006abc
push 0x1ae7
push ebx
push ebx
push ebx
push ebx
push 0x1581
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, ebx
xor esi, esi
mov dword [ebp - 0x28], edi
inc esi
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov eax, edi
mov dword [ebp - 0x14], 0x38e
cdq
idiv ecx
mov eax, edx
mov dword [ebp - 0x1c], eax
mov edi, ebx
or eax, edi
lea ecx, [ebp - 0xc4]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006a70
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xc4]
call fcn.1000330e
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, 0x2eca
jl 0x10006a56
inc eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jne 0x10006a54
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x48c8
jl 0x10006a43
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x10b8
jl 0x10006a3e
mov edi, dword [ebp - 0x24]
jmp 0x10006abf
xor esi, esi
inc esi
cmp byte [ebp + 0x18], 0
je 0x10006af8
push ebx
push 0xad2
push 0x155f
push 0x919
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
cmp dword [ebp - 0x18], 0x2d37
jge 0x100070dc
push str.rsodrbc_tqnn_yfhyqbo
call fcn.10048e5f
pop ecx
jmp 0x100070dc
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x18], 0x27d373ee
push 2
call fcn.10002fdf
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], ebx
jmp 0x10006b2c
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x44], 0x7df2f4a8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10006b1e
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0x34]
call fcn.1000b3b9
mov eax, ebx
pop ecx
cmp dword [ebp - 0x40], ebx
je 0x10006b4b
mov eax, esi
mov dword [ebp - 0x18], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0x6f3a
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
setle dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x88]
setle dl
or dword [ebp - 4], 0xffffffff
mov dword [eax + 4], edx
call fcn.1000301b
mov dword [ebp - 0x5c], 0x57fd5464
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x24], 0xffffffff
mov eax, 0xfcf09cc2
mov dword [ebp - 0x24], 0x50ba1bf2
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x58], 0xfffe
call fcn.10007be3
push ecx
lea eax, [ebp - 0x58]
push eax
sub esp, 0xc
call fcn.10006928
movzx eax, word [edi]
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x4b1b
cmp dword [ebp - 0x24], 0x4ed8
jle 0x10006ca4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x28], ebx
cdq
idiv edi
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], 0x6257
mov eax, edi
lea ecx, [ebp - 0xdc]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006c6b
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xdc]
call fcn.1000330e
add edi, dword [ebp - 0x20]
dec dword [ebp - 0x18]
jne 0x10006c51
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x3467
jl 0x10006c3f
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x2521
jl 0x10006c3a
push 2
pop edi
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x38], 0x278fa8f9
push edi
call fcn.10002fdf
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x28], 0xe4e
cmp dword [ebp - 0x28], 0x10c4
jle 0x10006d58
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, ebx
mov dword [ebp - 0x14], ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
add eax, edi
and eax, ecx
lea ecx, [ebp - 0xf4]
xor eax, edx
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006d0f
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xf4]
call fcn.1000330e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp eax, 0x2771
jl 0x10006cf1
inc edi
cmp edi, 0x6b98
jl 0x10006cec
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x6132
jl 0x10006cea
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x1d02
jl 0x10006ce5
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x28], 0xd06
jge 0x10006d6f
push str.mbawzvm_ktosrc_iaf_nwz_glqghxn_lzvjlhtyq_tpop_anqiayyp
call fcn.10048e5f
pop ecx
push 2
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x60], 0x4db5
mov dword [ebp - 0x14], ebx
jmp 0x10006d8d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10006d81
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0xf545
push 4
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x70]
setg dl
xor ecx, ecx
cmp edx, 0xffffffff
pop edi
setne cl
mov dword [eax], ecx
mov dword [ebp - 0x18], 3
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x10006e46
mov dword [ebp - 0x18], 0xf4a0
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x18], 0x6c7f05f4
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x18], 0x11fb8eb5
mov dword [ebp - 0x18], esi
push edi
mov dword [ebp - 0x18], 0x26c4f32b
call fcn.10002fdf
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 5
push 0x4c65
push eax
lea edx, [ebp - 0x94]
xor cl, cl
call fcn.1000a368
pop ecx
lea ecx, [ebp - 0x60]
call fcn.1000a2b3
pop ecx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
call fcn.1000301b
jmp 0x10006e67
push 0x7e48
push 0x683e
push ebx
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x70]
call fcn.10008b23
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.10008448
mov dword [ebp - 0x14], ebx
jmp 0x10006ea0
lea eax, [ebp + 0xb]
mov dword [ebp - 0x64], 0x8f43
mov byte [ebp + 0xb], bl
push eax
call fcn.1000a21b
pop ecx
lea eax, [ebp - 0x38]
push eax
push 0x21a1
push 0x6929
push ecx
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x70]
call fcn.100076c6
add esp, 0x10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10006e6c
lea ecx, [ebp - 0x70]
call fcn.1000301b
cmp dword [ebp - 0x24], 0x4844
jge 0x10006ec1
push str.tmyufazhf_zqmghuhe_bxzxxvrjt_jbvq_idsklvws_imhg_tnsilaas_kloda_wwyibkcjx_qqlwhs_bww_kjfiyaubo
call fcn.10048e5f
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], ebx
jmp 0x10006edb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10006ecd
push 0x69e6
push ecx
lea edx, [ebp - 0x30]
mov ecx, 0x7c58
call fcn.10006966
mov dword [ebp - 0x24], 0x4884
cmp dword [ebp - 0x24], 0x4c68
pop ecx
pop ecx
jle 0x10006f3d
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007cff8
cdq
push edx
push eax
call fcn.10002e68
inc esi
cmp esi, 0x654e
jl 0x10006f09
inc edi
cmp edi, 0x1c4
jl 0x10006f07
push 0x149f
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
inc esi
cmp dword [ebp - 0x30], ebx
je 0x10006f56
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10006f53
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 8
cmp dword [ebp - 0x24], 0x469c
jge 0x10006f7b
mov edx, str.hkvfr_sqrh_xpwjgezjx_kyimohi_gniazjbym_bnccjyv_nbfjb_zxwnegx_feyiteoz_cpglrjp_jisny_motnmkqpd
mov ecx, 0x1007cff8
call fcn.100050b8
or dword [ebp - 4], 0xffffffff
mov edi, ebx
xor dl, dl
mov ecx, 0x3a3d
call fcn.100089c9
mov cl, byte [ebp + edi - 0x3c]
mov dl, 0x32
call fcn.10010565
mov byte [ebp + edi - 0x3c], al
inc edi
cmp edi, 2
jb 0x10006f81
mov dword [ebp - 0x14], ebx
jmp 0x10006fda
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10006fcc
mov dword [ebp - 0x54], ebx
jmp 0x100070c8
push esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x3eb905d0
push eax
push 0x2816
push 0x2b4b
mov dword [ebp - 0x1c], ebx
xor dl, dl
push ebx
mov ecx, 0x30cf
call fcn.1000b47e
add esp, 0x14
mov dword [ebp - 0x2c], ebx
jmp 0x100070bb
mov dword [ebp - 0x14], 0x9dade661
xor edx, edx
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x24], 0xedda5659
mov dword [ebp - 0x1c], 0x1c71
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2c]
add edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x756
push 5
setge cl
imul ecx, edx
pop eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xc07c2076
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x50], 5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jbe 0x10007081
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0x213072c0
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x14]
sub edx, eax
cmp dword [ebp - 0x1c], 6
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 0x2e71
setg dl
xor eax, eax
cmp edx, 0xe213
setg al
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2e
jle 0x10007019
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xc
jl 0x10006fe8
mov ecx, dword [ebp + 0xc]
mov ax, word [ebp - 0x3c]
mov word [ecx], ax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret