Function at 0x1006c62
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Get installed programs
Persist via application shimming
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc6c
mov eax, dword [0x101203c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xc4c], eax
xor eax, eax
cmp dword [ebp + 0xc], ebx
lea edi, [ebp - 0xc50]
mov dword [ebp - 0xc54], ebx
mov dword [ebp - 0xc58], esi
mov dword [ebp - 0xc44], ebx
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xc40], 1
stosd dword es:[edi], eax
jne 0x1006cdb
lea eax, [ebp - 0xc6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0xc50], eax
cmp esi, ebx
je 0x1007012
cmp dword [ebp - 0xc4c], ebx
je 0x1007012
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x204]
push esi
rep stosd dword es:[edi], eax
call fcn.01004ee3
cmp eax, ebx
jne 0x1006d17
push 0x3e9
call fcn.01004c0f
jmp 0x10073d5
push eax
lea eax, [ebp - 0xc2c]
push eax
call fcn.01007ff2
lea eax, [ebp - 0xc2c]
push 0x10020f0
push eax
call fcn.010081ca
add esp, 0x10
test eax, eax
jne 0x1006d4b
push 0x3ed
call fcn.01004b65
jmp 0x10073d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1006d71
push esi
call fcn.01004f08
test eax, eax
je 0x1006d71
cmp dword [ebp + 0xc], ebx
jne 0x1006d9c
push esi
push 0x3ee
jmp 0x10074c4
cmp dword [ebp + 0xc], 1
jne 0x1006d82
push esi
push 0x3ef
jmp 0x10074c4
cmp dword [ebp + 0xc], ebx
jne 0x1006d9c
push dword [ebp - 0xc4c]
push esi
call fcn.010053bb
test eax, eax
jne 0x1006dc4
jmp 0x10073d6
cmp dword [ebp + 0xc], 2
jne 0x1006db6
push dword [ebp - 0xc4c]
call fcn.01004ee3
test eax, eax
jne 0x1006dc4
jmp 0x1006d08
push esi
push dword [ebp - 0xc4c]
call fcn.01007ff2
pop ecx
pop ecx
lea eax, [ebp - 0xc3c]
push eax
push esi
call fcn.01004fb9
test eax, eax
jne 0x1006de0
mov dword [ebp - 0xc40], ebx
jmp 0x100747b
lea eax, [ebp - 0xc3c]
push eax
call fcn.010050ce
test eax, eax
jne 0x1006d3c
lea eax, [ebp - 0xc64]
push eax
lea eax, [ebp - 0xc3c]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
jl 0x1006dd5
movzx eax, word [ebp - 0xc64]
mov esi, dword [ebp - 0xc60]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea edi, [ebp - 0x40c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
shr eax, 1
rep movsb byte es:[edi], byte [esi]
mov word [ebp + eax*2 - 0x40c], bx
lea eax, [ebp - 0xc64]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp + 0xc], ebx
jne 0x1006ee8
push ebx
lea eax, [ebp - 0xc48]
push eax
push ebx
call fcn.01004d3c
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0xf003f
or eax, esi
push eax
push ebx
push ebx
push ebx
push 0x1002078
push 0x80000002
call edi
cmp eax, ebx
je 0x1006e9c
cmp eax, 5
jne 0x1006e8d
push 0x3f0
jmp 0x1006d41
push 0x1002078
push 0x3f1
jmp 0x10073cf
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc48]
push eax
push ebx
mov dword [ebp - 0xc48], ebx
call fcn.01004d3c
or eax, esi
push eax
push ebx
push ebx
push ebx
mov esi, 0x10013a8
push esi
push 0x80000002
call edi
test eax, eax
je 0x1006ed6
push esi
jmp 0x1006e92
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc48], ebx
push ebx
push dword [ebp - 0xc58]
call fcn.0100eb87
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0xc44], esi
jne 0x1006f10
push dword [ebp - 0xc58]
push 0x3ea
jmp 0x100721b
push 0x7001
push ebx
push esi
call fcn.0100e5ad
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xc5c], edi
jne 0x1006f38
push dword [ebp - 0xc58]
push 0x3eb
jmp 0x100721b
push 0x6001
push edi
push esi
call fcn.0100e5ad
cmp eax, ebx
je 0x1006f53
push eax
push esi
call fcn.0100e539
cmp eax, ebx
jne 0x1006f59
lea eax, [ebp - 0xc2c]
push 0x100
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.010082c1
add esp, 0xc
push 0x7007
push edi
push dword [ebp - 0xc44]
mov word [ebp - 6], bx
call fcn.0100e5ad
mov esi, eax
cmp esi, ebx
je 0x1007087
push 0x6001
push esi
push dword [ebp - 0xc44]
call fcn.0100e5ad
cmp eax, ebx
jne 0x1006fbe
push 0x3f2
call fcn.01004b65
cmp dword [ebp + 0xc], 2
pop ecx
mov dword [ebp - 0xc40], ebx
jne 0x1007018
jmp 0x1007065
push eax
push dword [ebp - 0xc44]
call fcn.0100e539
mov edi, eax
cmp edi, ebx
jne 0x1006fd7
push 0x3f3
jmp 0x1006fa7
push 0x7016
push esi
push dword [ebp - 0xc44]
call fcn.0100e5ad
cmp dword [ebp + 0xc], ebx
push ebx
push dword [ebp - 0xc50]
push dword [ebp - 0xc54]
jne 0x1007054
push eax
push dword [ebp - 0xc44]
lea eax, [ebp - 0x40c]
push eax
push edi
call fcn.010058f2
test eax, eax
jne 0x1007065
mov dword [ebp - 0xc40], ebx
cmp dword [ebp - 0xc44], ebx
je 0x100702b
push dword [ebp - 0xc44]
call fcn.0100df85
cmp dword [ebp - 0xc48], ebx
pop edi
pop esi
pop ebx
je 0x1007042
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc40]
call fcn.01007b7f
leave
ret 0xc
lea eax, [ebp - 0x40c]
push eax
push edi
call fcn.01005aed
test eax, eax
je 0x1007018
push esi
push dword [ebp - 0xc5c]
push dword [ebp - 0xc44]
call fcn.0100e5f5
mov esi, eax
cmp esi, ebx
jne 0x1006f8d
mov edi, dword [ebp - 0xc5c]
push 0x700b
push edi
push dword [ebp - 0xc44]
call fcn.0100e5ad
jmp 0x100712e
push 0x6001
push esi
push dword [ebp - 0xc44]
call fcn.0100e5ad
cmp eax, ebx
jne 0x10070cf
push 0x3f2
call fcn.01004b65
cmp dword [ebp + 0xc], 2
pop ecx
mov dword [ebp - 0xc40], ebx
jne 0x1007018
jmp 0x1007121
push eax
push dword [ebp - 0xc44]
call fcn.0100e539
cmp eax, ebx
jne 0x10070e6
push 0x3f3
jmp 0x10070b7
cmp dword [ebp + 0xc], ebx
push 1
push dword [ebp - 0xc50]
lea ecx, [ebp - 0x40c]
push dword [ebp - 0xc54]
jne 0x1007112
push ebx
push ebx
push ecx
push eax
call fcn.010058f2
test eax, eax
je 0x1007012
jmp 0x1007121
push ecx
push eax
call fcn.01005aed
test eax, eax
je 0x1007018
push esi
push edi
push dword [ebp - 0xc44]
call fcn.0100e5f5
mov esi, eax
cmp esi, ebx
jne 0x100709d
push dword [ebp + 0xc]
lea eax, [ebp - 0x40c]
push dword [ebp - 0xc50]
push dword [ebp - 0xc54]
push eax
push edi
push dword [ebp - 0xc44]
call fcn.01006aef
test eax, eax
je 0x1007012
push dword [ebp - 0xc44]
call fcn.0100df85
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0xc44], ebx
jne 0x10071b0
push ebx
push 0x1012f40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push dword [ebp - 0xc4c]
push dword [ebp - 0xc58]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100722b
push dword [ebp - 0xc4c]
push 0x3f9
jmp 0x10073cf
push 0x80
push dword [ebp - 0xc4c]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0xc4c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10071e9
push dword [ebp - 0xc4c]
push 0x3fa
call fcn.01004b65
pop ecx
pop ecx
mov dword [ebp - 0xc40], ebx
lea eax, [ebp - 0xc48]
push eax
call fcn.01004d3c
or eax, 0xf003f
push eax
push ebx
mov esi, 0x1002008
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10073e1
push esi
push 0x3f6
call fcn.01004b65
mov dword [ebp - 0xc40], ebx
jmp 0x1007479
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, 0x104
push edi
lea eax, [ebp - 0x614]
push eax
mov word [ebp - 0x614], bx
call esi
lea eax, [ebp - 0x614]
push 0x1001fdc
push eax
call fcn.01007fbf
pop ecx
pop ecx
lea eax, [ebp - 0x614]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1007290
push edi
lea eax, [ebp - 0x614]
push eax
mov word [ebp - 0x614], bx
call esi
lea eax, [ebp - 0x614]
push 0x1001fb0
push eax
call fcn.01007fbf
pop ecx
pop ecx
lea eax, [ebp - 0x81c]
push 0x1002008
push eax
call fcn.01007ff2
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.01007fbf
lea eax, [ebp - 0x81c]
push 0x10012ac
push eax
call fcn.01007fbf
add esp, 0x18
push ebx
lea eax, [ebp - 0xc48]
push eax
push ebx
call fcn.01004d3c
or eax, 0xf003f
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x81c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1007301
lea eax, [ebp - 0x81c]
push eax
jmp 0x1006e92
lea eax, [ebp - 0x204]
push eax
call fcn.010080f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push ebx
push 0x1001f98
push dword [ebp - 0xc48]
call esi
test eax, eax
je 0x1007345
lea eax, [ebp - 0x81c]
push eax
push 0x3f4
jmp 0x10073cf
push dword [ebp - 0xc4c]
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0xa24]
push 0x1001f80
push eax
call fcn.0100837f
lea eax, [ebp - 0xa24]
push eax
call fcn.010080f4
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa24]
push eax
push 1
push ebx
push 0x1001f60
push dword [ebp - 0xc48]
call esi
test eax, eax
jne 0x1007334
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc54]
push eax
push 0x10000
push dword [ebp - 0xc4c]
mov dword [ebp - 0xc48], ebx
call fcn.0100f6b1
test eax, eax
lea eax, [ebp - 0x204]
push eax
jne 0x10074bf
push 0x409
call fcn.01004b65
pop ecx
pop ecx
mov dword [ebp - 0xc40], ebx
jmp 0x100702b
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xa24]
push eax
call fcn.01007ff2
lea eax, [ebp - 0xa24]
push 0x10012ac
push eax
call fcn.01007fbf
add esp, 0x10
lea eax, [ebp - 0xa24]
push eax
push dword [ebp - 0xc48]
call fcn.01005402
test eax, eax
je 0x1007433
push esi
lea eax, [ebp - 0x40c]
push eax
push 0x3f7
call fcn.01004b65
add esp, 0xc
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc3c]
push eax
mov dword [ebp - 0xc48], ebx
call fcn.0100fc71
test eax, eax
jne 0x1007468
lea eax, [ebp - 0x204]
push eax
push 0x40a
call fcn.01004b65
pop ecx
pop ecx
lea eax, [ebp - 0x204]
push eax
push 0x3fc
call fcn.01004c0f
pop ecx
pop ecx
cmp dword [ebp + 0xc], ebx
je 0x1007018
cmp dword [ebp - 0xc44], ebx
je 0x100749d
push dword [ebp - 0xc44]
call fcn.0100df85
mov dword [ebp - 0xc44], ebx
push 0x80
push dword [ebp - 0xc4c]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0xc4c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1007018
push 0x3fb
call fcn.01004c0f
pop ecx
pop ecx
jmp 0x100702b