Function at 0x100cd81
Capabilities:
Copy file
Delete registry value
Get common file path
Persist via app paths registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x147c
call fcn.0100e440
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x1478], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x147c], eax
mov dword [ebp - 0x1470], ecx
mov dword [ebp - 0x1474], ebx
cmp eax, ebx
je 0x100cfec
xor ecx, ecx
cmp cx, word [eax]
je 0x100cfec
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100cfec
mov edi, 0x900
push edi
push ebx
push ebx
push 0x10014fc
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100cc02
lea eax, [ebp - 0x210]
push eax
push 0x1003afc
push edi
push ebx
push ebx
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.01011c3f
lea eax, [ebp - 0x210]
push eax
push 0x1003adc
push edi
push ebx
push ebx
lea eax, [ebp - 0xa40]
push esi
push eax
call fcn.01011c3f
add esp, 0x38
lea eax, [ebp - 0x41c]
push eax
call fcn.01010f56
test eax, eax
jne 0x100ce90
push dword [ebp - 0x1470]
lea eax, [ebp - 0x41c]
push 0x1003afc
push edi
push ebx
push ebx
push esi
push eax
call fcn.01011c3f
push dword [ebp - 0x1470]
lea eax, [ebp - 0xa40]
push 0x1003adc
push edi
push ebx
push ebx
push esi
push eax
call fcn.01011c3f
add esp, 0x38
push ebx
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100cfe4
push dword [ebp - 0x147c]
lea ecx, [ebp - 0x1468]
call fcn.0100f4f8
lea eax, [ebp - 0x1254]
push eax
lea eax, [ebp - 0x125e]
push eax
push 0x10028fc
push edi
push ebx
push ebx
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.01011c3f
add esp, 0x20
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100cf02
inc eax
jmp 0x100cfee
push edi
push ebx
push ebx
push 0x1001278
push esi
lea eax, [ebp - 0xc4c]
push eax
call fcn.01007439
lea eax, [ebp - 0x146c]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0xc4c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100cfe4
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x628]
push eax
xor edi, edi
inc edi
push edi
push ebx
mov esi, 0x1003acc
push esi
push dword [ebp - 0x146c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100cfd8
push 0x208
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x834]
push eax
push 0xd2
push dword [ebp - 0x1478]
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
lea eax, [ebp - 0x834]
push eax
push 0x1003abc
lea eax, [ebp - 0xa40]
push eax
push ebx
call fcn.010107fe
push esi
push dword [ebp - 0x146c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x1474], edi
push dword [ebp - 0x146c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1474]
jmp 0x100cfee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 0xc