Function at 0x1008eaa
Capabilities:
Delete file
Get common file path
Persist via run registry key
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb04
mov eax, dword [0x100bffc]
push ebx
push esi
push edi
mov edi, 0xf003f
push edi
xor ebx, ebx
inc ebx
push ebx
mov esi, 0x80000002
push esi
push 0x10039b8
lea ecx, [ebp - 0xae8]
mov dword [ebp - 4], eax
call fcn.01008062
push edi
push ebx
push esi
push 0x1003920
lea ecx, [ebp - 0xab0]
call fcn.01008062
push edi
push ebx
push esi
push 0x1003610
lea ecx, [ebp - 0xb04]
call fcn.01008062
push edi
push ebx
push esi
push 0x10034d8
lea ecx, [ebp - 0xacc]
call fcn.01008062
push edi
push ebx
push esi
push 0x1003580
lea ecx, [ebp - 0xa78]
call fcn.01008062
push edi
push ebx
push 0x80000003
push 0x10013ac
lea ecx, [ebp - 0xa94]
call fcn.01008062
push edi
xor ebx, ebx
push ebx
push esi
push 0x1003870
lea ecx, [ebp - 0xa5c]
call fcn.01008062
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push 0x17
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1008f90
push 0x1003a3c
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.01008940
lea eax, [ebp - 0x61c]
push eax
call fcn.01008979
push 0x18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x1008fb2
lea ecx, [ebp - 0xa94]
push ecx
mov ecx, eax
call fcn.01007f9f
mov dword [ebp - 0xa30], eax
jmp 0x1008fb8
mov dword [ebp - 0xa30], ebx
mov eax, dword [ebp - 0xa30]
test eax, eax
mov ebx, 0x208
je 0x1009159
and dword [ebp - 0xa3c], 0
cmp dword [eax + 8], 0
jbe 0x100914c
mov eax, dword [ebp - 0xa30]
mov esi, dword [eax + 0xc]
test esi, esi
je 0x100912a
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x100385c
push esi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
je 0x100912a
push 0x1003520
push esi
push 0x1003850
lea eax, [ebp - 0x414]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x18
test eax, eax
je 0x1009051
push edi
push 1
push 0x80000003
lea ecx, [ebp - 0x414]
push ecx
mov ecx, eax
call fcn.01008062
mov dword [ebp - 0xa38], eax
jmp 0x1009058
and dword [ebp - 0xa38], 0
push 0x10034d8
push esi
push 0x1003850
lea eax, [ebp - 0x414]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x18
test eax, eax
je 0x100909d
push edi
push 1
push 0x80000003
lea ecx, [ebp - 0x414]
push ecx
mov ecx, eax
call fcn.01008062
mov dword [ebp - 0xa34], eax
jmp 0x10090a4
and dword [ebp - 0xa34], 0
mov ecx, dword [ebp - 0xa38]
test ecx, ecx
je 0x1009119
cmp dword [ebp - 0xa34], 0
je 0x100910c
mov esi, 0x1003824
push esi
call fcn.010080b8
test eax, eax
mov dword [ebp - 0xa40], eax
je 0x10090fc
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x10090fc
mov ecx, dword [ebp - 0xa38]
push esi
call fcn.01007f1e
push dword [ebp - 0xa40]
mov ecx, dword [ebp - 0xa34]
push 0x1003834
call fcn.01007e9e
jmp 0x100910c
mov ecx, dword [ebp - 0xa34]
push 0x1003834
call fcn.01007f1e
mov ecx, dword [ebp - 0xa38]
push 1
call fcn.0100886c
mov ecx, dword [ebp - 0xa34]
test ecx, ecx
je 0x100912a
push 1
call fcn.0100886c
mov esi, dword [ebp - 0xa30]
mov ecx, esi
call fcn.0100815a
inc dword [ebp - 0xa3c]
mov eax, dword [ebp - 0xa3c]
cmp eax, dword [esi + 8]
jb 0x1008fdc
mov ecx, dword [ebp - 0xa30]
push 1
call fcn.01008892
push 0x10013ac
lea ecx, [ebp - 0xb04]
call fcn.010080b8
mov esi, eax
test esi, esi
je 0x1009184
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x1009184
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
push 0
push 0x1003808
lea ecx, [ebp - 0xa78]
call fcn.01007ee3
push 4
push 0
push 0x10037f4
lea ecx, [ebp - 0xab0]
call fcn.01007ee3
push 0x10037d4
lea ecx, [ebp - 0xae8]
call fcn.010080b8
mov esi, eax
test esi, esi
je 0x10091f6
push 0x10037a8
lea ecx, [ebp - 0xacc]
call fcn.010080b8
push esi
push 0x1003758
lea eax, [ebp - 0xa2c]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x100374c
push esi
lea ecx, [ebp - 0xa5c]
call fcn.010080b8
mov edi, eax
test edi, edi
je 0x1009255
cmp word [edi], 0x7b
jne 0x1009255
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x206
pop ecx
jae 0x1009255
and word [ebp - 0x412], 0
push ebx
push edi
lea eax, [ebp - 0x414]
push eax
mov word [ebp - 0x414], 0x21
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
lea eax, [ebp - 0x414]
push eax
push esi
lea ecx, [ebp - 0xa5c]
call fcn.01007e9e
call fcn.010085c1
lea ecx, [ebp - 0xa5c]
call fcn.0100809c
lea ecx, [ebp - 0xa94]
call fcn.0100809c
lea ecx, [ebp - 0xa78]
call fcn.0100809c
lea ecx, [ebp - 0xacc]
call fcn.0100809c
lea ecx, [ebp - 0xb04]
call fcn.0100809c
lea ecx, [ebp - 0xab0]
call fcn.0100809c
lea ecx, [ebp - 0xae8]
call fcn.0100809c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009336
leave
ret