Function at 0x1050007
Capabilities:
Copy file
Delete file
Move file
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 3
xor edi, edi
push edi
push 0x1015368
push SysStringLen
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
je 0x1050040
push eax
push 0x1018c60
jmp 0x10501f6
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov dword [eax], ecx
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1018c54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x10501f0
cmp dword [ebp - 0xc], 7
jne 0x10501f0
mov esi, 0x104
push esi
mov ebx, 0x1106960
push ebx
push 0x1018c3c
push dword [ebp + 8]
mov byte [0x1106960], 0
call fcn.01070fc9
push esi
push 0x10f6960
push 0x1018c2c
push 0x10f54c0
call fcn.01070fc9
push edi
push 0x10f6960
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x10500c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1018bec
jmp 0x10501f6
push edi
push 0x80000080
push 3
push edi
push 1
push 0x40000000
push 0x10f6960
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x1099768], eax
jne 0x10500fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1018bac
jmp 0x10501f6
push 2
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push 0x10f5820
mov edi, 0x1018b9c
push edi
push 0x10c64c0
call fcn.01070fc9
push esi
push ebx
push edi
push 0x10c6040
call fcn.01070fc9
push 0
push 0x10f5820
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x105014c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1018b50
jmp 0x10501cb
mov eax, dword [ebp + 0x14]
push 8
pop ecx
mov esi, 0x1018b2c
mov edi, 0x1106960
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [eax]
cmp eax, 2
jbe 0x1050170
mov ecx, dword [ebp + 0xc]
lea esi, [eax + ecx - 1]
jmp 0x1050173
mov esi, dword [ebp + 0xc]
mov edx, esi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1050179
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1050188
sub eax, edi
mov byte [eax + esi + 1], cl
lea eax, [ebx + 1]
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x1050198
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
sub ebx, eax
mov eax, dword [esi]
lea eax, [ebx + eax + 1]
push eax
push edi
push 7
push 0
push 0x1018c54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10501d4
push eax
push 0x1018ae8
call fcn.01071ac0
xor edi, edi
jmp 0x10501fb
mov eax, dword [esi]
cmp eax, 2
jbe 0x10501e2
mov byte [eax + edi - 1], 0
jmp 0x10501e5
mov byte [edi], 0
mov dword [ebp - 8], 1
xor edi, edi
jmp 0x105023f
push eax
push 0x1018ab4
call fcn.01071ac0
mov eax, dword [0x1099768]
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x105023f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x1099768], 0xffffffff
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x10f6960
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x105023a
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
cmp dword [ebp - 4], edi
pop edi
pop esi
pop ebx
je 0x1050250
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret 0x10