Function at 0x100007dc0
Capabilities:
Check if file exists
Delete file
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x2b0
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, r9
mov rbx, rdx
mov rcx, qword [0x10000f150]
lea r13, [0x10000f150]
lea r12, [0x100001940]
cmp rcx, r13
je 0x100007e25
test byte [rcx + 0x1c], 8
je 0x100007e25
mov rcx, qword [rcx + 0x10]
mov edx, 0x1e
mov r9, rbx
mov r8, r12
call fcn.100002b98
lea rax, [rsp + 0x80]
xor ebp, ebp
mov r15, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
xor r9d, r9d
mov rdx, r15
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call fcn.100005b98
mov edi, eax
cmp eax, ebp
je 0x100007e9d
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x100007e8b
test byte [rcx + 0x1c], 8
je 0x100007e8b
lea edx, [rbp + 0x1f]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r12
call fcn.100005d94
movzx eax, di
or eax, 0x80070000
cmp edi, ebp
cmovle eax, edi
jmp 0x1000081da
cmp rbx, rbp
jne 0x100007ead
mov ecx, 0x80004005
call fcn.100003a64
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
lea rdx, str.Configuration
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x100007efb
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x100007e8b
test byte [rcx + 0x1c], 8
je 0x100007e8b
mov edx, 0x20
jmp 0x100007e7c
lea rax, [rsp + 0x58]
lea rdx, [0x1000022b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r15
mov rsi, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, ebp
jne 0x100007f47
mov rsi, qword [rsp + 0x58]
mov edi, ebp
mov qword [rsp + 0x68], rsi
cmp edi, ebp
je 0x100007f94
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x100007f71
test byte [rcx + 0x1c], 8
je 0x100007f71
mov rcx, qword [rcx + 0x10]
mov edx, 0x21
mov r9d, edi
mov r8, r12
call fcn.100005d94
movzx ebx, di
or ebx, 0x80070000
cmp edi, ebp
cmovle ebx, edi
cmp rsi, rbp
je 0x100007f8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000081da
lea rcx, [rsp + 0x92]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], bp
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x90]
lea rdx, [0x100002338]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x50], 0x104
call fcn.100003958
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.10000820c
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.10000820c
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.10000820c
lea rdx, [0x100002348]
xor eax, eax
mov rdi, rdx
or rsi, 0xffffffffffffffff
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.1000085c0
lea rdx, [0x100002378]
xor eax, eax
mov rdi, rdx
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.1000085c0
lea rdx, [0x100002398]
xor eax, eax
mov rdi, rdx
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.1000085c0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
mov r15d, 0x400
cmp eax, edi
je 0x1000080d0
lea r8, [0x1000023b8]
mov rdx, r15
mov rcx, rbx
call fcn.100005c34
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x1000080d0
test byte [rcx + 0x1c], 0x10
je 0x1000080d0
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x23]
mov r8, r12
call fcn.100005ccc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x10000811f
lea r8, [0x1000023c8]
mov rdx, r15
mov rcx, rbx
call fcn.100005c34
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x10000811f
test byte [rcx + 0x1c], 0x10
je 0x10000811f
mov rcx, qword [rcx + 0x10]
mov edx, 0x23
mov r8, r12
call fcn.100005ccc
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100008170
lea r8, [0x1000023e0]
mov rdx, r15
mov rcx, rbx
call fcn.100005c34
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x100008170
test byte [rcx + 0x1c], 0x10
je 0x100008170
mov rcx, qword [rcx + 0x10]
mov edx, 0x24
mov r8, r12
call fcn.100005ccc
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, ebp
jg 0x10000818a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x48]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, ebp
jg 0x1000081a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, ebp
jg 0x1000081c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000081d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.10000a940
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret