Function at 0x1000d07c
Capabilities:
Create process on windows
Delete file
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffa2c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x15d4], eax
mov dword [ebp - 0x15d0], eax
mov dword [ebp - 0x15cc], eax
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x13b4], eax
mov dword [ebp - 0x15c4], eax
mov dword [ebp - 0x13b0], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x1000cff0
call fcn.10004ce4
mov edi, 0x1000f81c
xor eax, eax
push ebp
push 0x1000d663
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x1000d060
call fcn.10003024
mov eax, dword [0x1000e128]
mov byte [eax], 1
push 0x8007
call sub.kernel32.dll_SetErrorMode
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.10005954
mov eax, dword [ebp - 0x14]
mov edx, 0x1000d678
call fcn.10003a34
jne 0x1000d154
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.10005954
mov edx, dword [ebp - 0x18]
mov eax, 0x10012568
call fcn.100037ac
push 0
push 0
push 0
mov eax, dword [0x10012568]
call fcn.1000390c
push eax
push 0x1000d688
push 0
call sub.shell32.dll_ShellExecuteW
push 0
call sub.kernel32.dll_ExitProcess_1
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.10005954
mov eax, dword [ebp - 0x1c]
mov edx, 0x1000d698
call fcn.10003a34
jne 0x1000d17a
push 0x1770
call sub.kernel32.dll_Sleep
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
lea edx, [ebp - 0x13ac]
xor eax, eax
call fcn.100051e8
push edi
lea esi, [ebp - 0x13ac]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 0x10012568
mov edx, 0x9c8
call fcn.10003be4
mov eax, dword [0x10012568]
call fcn.1000390c
mov edx, edi
mov ecx, 0x1390
call fcn.100050d0
lea ecx, [ebp - 0x13b0]
mov edx, 0x1000d6ac
mov eax, dword [0x10012568]
call fcn.10006234
mov edx, dword [ebp - 0x13b0]
mov eax, 0x10012568
call fcn.100037ac
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [0x10012568]
call fcn.1000390c
mov edx, eax
mov eax, edi
mov ecx, 0x1390
call fcn.100050d0
push edi
mov esi, edi
mov edi, 0x10010dbc
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 0x100432bc
mov edx, 0x1000d6c0
call fcn.100037ac
mov eax, dword [0x100432bc]
call fcn.1000390c
push eax
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyW_1
mov eax, 0x100432bc
lea edx, [edi + 0xfaa]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x100432bc]
push eax
push 2
mov ecx, 0x1000d6ec
mov edx, 0x1000d6c0
mov eax, 0x80000001
call fcn.1000577c
lea eax, [ebp - 0x15c0]
call fcn.10005664
lea edx, [ebp - 0x15c0]
lea eax, [ebp - 0x13b4]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x13b4]
push 0x1000d6fc
lea eax, [ebp - 0x15c4]
lea edx, [edi + 0xfaa]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15c4]
push 0x1000d704
mov eax, 0x1001256c
mov edx, 4
call fcn.100039ec
mov eax, dword [0x1001256c]
call fcn.1000390c
mov ebx, eax
mov eax, ebx
call fcn.10005ca4
test al, al
je 0x1000d350
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesW
mov eax, ebx
mov edx, 0x10012570
call fcn.1000cecc
mov dword [0x100432b4], eax
mov dword [0x100432b8], edx
mov eax, dword [0x1001256c]
call fcn.10005f1c
push 0
push 2
mov eax, dword [0x100432b4]
mov edx, dword [0x100432b8]
call fcn.10003fd4
mov edx, eax
mov eax, 0x10012568
call fcn.10003be4
mov eax, dword [0x10012568]
call fcn.1000390c
mov edx, 0x10012570
mov ecx, dword [0x100432b4]
call fcn.100050d0
lea ecx, [ebp - 0x15c8]
mov edx, 0x1000d6ac
mov eax, dword [0x10012568]
call fcn.10006234
mov edx, dword [ebp - 0x15c8]
mov eax, 0x10012568
call fcn.100037ac
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [0x10012568]
call fcn.1000390c
mov edx, eax
mov eax, edi
mov ecx, 0x1390
call fcn.100050d0
cmp dword [edi + 0x1388], 0x1e240
je 0x1000d444
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
lea edx, [ebp - 0x13ac]
xor eax, eax
call fcn.100051e8
push edi
lea esi, [ebp - 0x13ac]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 0x10012568
mov edx, 0x9c8
call fcn.10003be4
mov eax, dword [0x10012568]
call fcn.1000390c
mov edx, edi
mov ecx, 0x1390
call fcn.100050d0
lea ecx, [ebp - 0x15cc]
mov edx, 0x1000d6ac
mov eax, dword [0x10012568]
call fcn.10006234
mov edx, dword [ebp - 0x15cc]
mov eax, 0x10012568
call fcn.100037ac
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [0x10012568]
call fcn.1000390c
mov edx, eax
mov eax, edi
mov ecx, 0x1390
call fcn.100050d0
lea eax, [edi + 0xfaa]
push eax
push 0
push 0
call fcn.10004df0
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000d469
push 0
call sub.kernel32.dll_ExitProcess_1
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [edi + 0xfa8], 1
jne 0x1000d4e2
lea eax, [edi + 0x109e]
push eax
push 0
push 0
call fcn.10004df0
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x1000d4dc
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x1000e0f4]
call fcn.1000391c
add eax, eax
push eax
mov eax, dword [0x1000e0f4]
call fcn.1000390c
mov edx, eax
mov eax, 0x1001235c
pop ecx
call fcn.100050d0
mov eax, 0x1001235c
call fcn.1000a02c
mov esi, eax
mov ecx, edi
mov edx, 0x1000c998
mov eax, esi
call fcn.10009f84
jmp 0x1000d4e2
push ebx
call sub.kernel32.dll_CloseHandle
push 0x20a
push 0x10010bac
push 0
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x15d0]
lea edx, [edi + 0xbd2]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [ebp - 0x15d0]
mov edx, dword [0x1000e0f0]
call fcn.10003a34
jne 0x1000d520
xor esi, esi
jmp 0x1000d599
lea eax, [ebp - 0x15d4]
lea edx, [edi + 0xbd2]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [ebp - 0x15d4]
mov edx, dword [0x1000e0ec]
call fcn.10003a34
jne 0x1000d578
lea eax, [ebp - 0x15c0]
call fcn.100054c4
push edi
lea esi, [ebp - 0x15c0]
mov edi, 0x1001214c
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, 0x1001214c
call fcn.1000a02c
mov esi, eax
jmp 0x1000d599
lea edx, [edi + 0xbd2]
mov eax, 0x1001214c
mov ecx, 0x7a
call fcn.100050d0
mov eax, 0x1001214c
call fcn.1000a02c
mov esi, eax
xor eax, eax
mov dword [0x10012358], eax
test esi, esi
jne 0x1000d5b7
mov eax, edi
call fcn.1000b9c8
push 0x10010bac
call fcn.1000bf18
mov ecx, 0x10010bac
mov edx, fcn.1000bf18
mov eax, esi
call fcn.10009f84
mov ebx, eax
test ebx, ebx
jne 0x1000d5f2
mov eax, dword [0x1000e0f8]
mov eax, dword [eax]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
mov eax, 0x1001214c
call fcn.1000a02c
mov esi, eax
push 0x1f4
call sub.kernel32.dll_Sleep
inc dword [0x10012358]
test ebx, ebx
jne 0x1000d605
cmp dword [0x10012358], 7
jl 0x1000d5b7
mov eax, edi
call fcn.1000b9c8
test ebx, ebx
jne 0x1000d628
mov eax, dword [0x1000e0f8]
mov eax, dword [eax]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
push 0x10010bac
call fcn.1000bf18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000d66a
lea eax, [ebp - 0x15d4]
mov edx, 5
call fcn.10003788
lea eax, [ebp - 0x13b4]
mov edx, 2
call fcn.10003788
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.10003788
ret