Function at 0x1000d0f4
Capabilities:
Create process on windows
Delete file
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2bc
push 0
push 0
dec ecx
jne 0x1000d0fc
push ebx
push esi
push edi
mov eax, 0x1000d030
call fcn.10004ce4
mov edi, 0x1000f834
xor eax, eax
push ebp
push 0x1000d759
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x1000d0d0
call fcn.10003024
mov eax, dword [0x1000e134]
mov byte [eax], 1
push 0x8007
call sub.kernel32.dll_SetErrorMode
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.10005954
mov eax, dword [ebp - 0x14]
mov edx, 0x1000d76c
call fcn.10003a34
jne 0x1000d196
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.10005954
mov edx, dword [ebp - 0x18]
mov eax, 0x10012580
call fcn.100037ac
push 0
push 0
push 0
mov eax, dword [0x10012580]
call fcn.1000390c
push eax
push 0x1000d77c
push 0
call sub.shell32.dll_ShellExecuteW
push 0
call sub.kernel32.dll_ExitProcess_1
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.10005954
mov eax, dword [ebp - 0x1c]
mov edx, 0x1000d78c
call fcn.10003a34
jne 0x1000d1bc
push 0x1770
call sub.kernel32.dll_Sleep
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
lea edx, [ebp - 0x13ac]
xor eax, eax
call fcn.100051e8
push edi
lea esi, [ebp - 0x13ac]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 0x10012580
mov edx, 0x9c8
call fcn.10003be4
mov eax, dword [0x10012580]
call fcn.1000390c
mov edx, edi
mov ecx, 0x1390
call fcn.100050d0
lea ecx, [ebp - 0x13b0]
mov edx, 0x1000d7a0
mov eax, dword [0x10012580]
call fcn.10006234
mov edx, dword [ebp - 0x13b0]
mov eax, 0x10012580
call fcn.100037ac
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [0x10012580]
call fcn.1000390c
mov edx, eax
mov eax, edi
mov ecx, 0x1390
call fcn.100050d0
push edi
mov esi, edi
mov edi, 0x10010dd4
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 0x100432d4
mov edx, 0x1000d7b4
call fcn.100037ac
mov eax, dword [0x100432d4]
call fcn.1000390c
push eax
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyW_1
mov eax, 0x100432d4
lea edx, [edi + 0xfaa]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x100432d4]
push eax
push 2
mov ecx, 0x1000d7e0
mov edx, 0x1000d7b4
mov eax, 0x80000001
call fcn.1000577c
lea eax, [ebp - 0x15c0]
call fcn.10005664
lea edx, [ebp - 0x15c0]
lea eax, [ebp - 0x13b4]
mov ecx, 0x105
call fcn.100038e0
lea eax, [ebp - 0x13b4]
mov edx, 0x1000d7f0
call fcn.10003928
mov eax, dword [ebp - 0x13b4]
call fcn.1000390c
call fcn.10005690
cmp al, 1
jne 0x1000d35a
lea eax, [ebp - 0x15c0]
call fcn.10005664
lea edx, [ebp - 0x15c0]
lea eax, [ebp - 0x15c4]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15c4]
push 0x1000d7f0
lea eax, [ebp - 0x15c8]
lea edx, [edi + 0xfaa]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15c8]
push 0x1000d81c
mov eax, 0x10012584
mov edx, 4
call fcn.100039ec
jmp 0x1000d3b7
lea eax, [ebp - 0x15c0]
call fcn.10005664
lea edx, [ebp - 0x15c0]
lea eax, [ebp - 0x15cc]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15cc]
push dword [0x1000e0f8]
lea eax, [ebp - 0x15d0]
lea edx, [edi + 0xfaa]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15d0]
push 0x1000d81c
mov eax, 0x10012584
mov edx, 4
call fcn.100039ec
mov eax, dword [0x10012584]
call fcn.1000390c
mov ebx, eax
mov eax, ebx
call fcn.10005ca4
test al, al
je 0x1000d483
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesW
mov eax, ebx
mov edx, 0x10012588
call fcn.1000cf04
mov dword [0x100432cc], eax
mov dword [0x100432d0], edx
mov eax, dword [0x10012584]
call fcn.10005f1c
push 0
push 2
mov eax, dword [0x100432cc]
mov edx, dword [0x100432d0]
call fcn.10003fd4
mov edx, eax
mov eax, 0x10012580
call fcn.10003be4
mov eax, dword [0x10012580]
call fcn.1000390c
mov edx, 0x10012588
mov ecx, dword [0x100432cc]
call fcn.100050d0
lea ecx, [ebp - 0x15d4]
mov edx, 0x1000d7a0
mov eax, dword [0x10012580]
call fcn.10006234
mov edx, dword [ebp - 0x15d4]
mov eax, 0x10012580
call fcn.100037ac
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [0x10012580]
call fcn.1000390c
mov edx, eax
mov eax, edi
mov ecx, 0x1390
call fcn.100050d0
cmp dword [edi + 0x1388], 0x1e240
je 0x1000d53a
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
lea edx, [ebp - 0x13ac]
xor eax, eax
call fcn.100051e8
push edi
lea esi, [ebp - 0x13ac]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 0x10012580
mov edx, 0x9c8
call fcn.10003be4
mov eax, dword [0x10012580]
call fcn.1000390c
mov edx, edi
mov ecx, 0x1390
call fcn.100050d0
lea ecx, [ebp - 0x15d8]
mov edx, 0x1000d7a0
mov eax, dword [0x10012580]
call fcn.10006234
mov edx, dword [ebp - 0x15d8]
mov eax, 0x10012580
call fcn.100037ac
mov eax, edi
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [0x10012580]
call fcn.1000390c
mov edx, eax
mov eax, edi
mov ecx, 0x1390
call fcn.100050d0
lea eax, [edi + 0xfaa]
push eax
push 0
push 0
call fcn.10004df0
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000d55f
push 0
call sub.kernel32.dll_ExitProcess_1
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [edi + 0xfa8], 1
jne 0x1000d5d8
lea eax, [edi + 0x109e]
push eax
push 0
push 0
call fcn.10004df0
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x1000d5d2
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x1000e0f4]
call fcn.1000391c
add eax, eax
push eax
mov eax, dword [0x1000e0f4]
call fcn.1000390c
mov edx, eax
mov eax, 0x10012374
pop ecx
call fcn.100050d0
mov eax, 0x10012374
call fcn.10009950
mov esi, eax
mov ecx, edi
mov edx, 0x1000c9d0
mov eax, esi
call fcn.100098a8
jmp 0x1000d5d8
push ebx
call sub.kernel32.dll_CloseHandle
push 0x20a
push 0x10010bc4
push 0
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x15dc]
lea edx, [edi + 0xbd2]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [ebp - 0x15dc]
mov edx, dword [0x1000e0f0]
call fcn.10003a34
jne 0x1000d616
xor esi, esi
jmp 0x1000d68f
lea eax, [ebp - 0x15e0]
lea edx, [edi + 0xbd2]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [ebp - 0x15e0]
mov edx, dword [0x1000e0ec]
call fcn.10003a34
jne 0x1000d66e
lea eax, [ebp - 0x15c0]
call fcn.100054c4
push edi
lea esi, [ebp - 0x15c0]
mov edi, 0x10012164
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, 0x10012164
call fcn.10009950
mov esi, eax
jmp 0x1000d68f
lea edx, [edi + 0xbd2]
mov eax, 0x10012164
mov ecx, 0x7a
call fcn.100050d0
mov eax, 0x10012164
call fcn.10009950
mov esi, eax
xor eax, eax
mov dword [0x10012370], eax
test esi, esi
jne 0x1000d6ad
mov eax, edi
call fcn.1000b78c
push 0x10010bc4
call fcn.1000c080
mov ecx, 0x10010bc4
mov edx, fcn.1000c080
mov eax, esi
call fcn.100098a8
mov ebx, eax
test ebx, ebx
jne 0x1000d6e8
mov eax, dword [0x1000e0fc]
mov eax, dword [eax]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
mov eax, 0x10012164
call fcn.10009950
mov esi, eax
push 0x1f4
call sub.kernel32.dll_Sleep
inc dword [0x10012370]
test ebx, ebx
jne 0x1000d6fb
cmp dword [0x10012370], 7
jl 0x1000d6ad
mov eax, edi
call fcn.1000b78c
test ebx, ebx
jne 0x1000d71e
mov eax, dword [0x1000e0fc]
mov eax, dword [eax]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
push 0x10010bc4
call fcn.1000c080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000d760
lea eax, [ebp - 0x15e0]
mov edx, 8
call fcn.10003788
lea eax, [ebp - 0x13b4]
mov edx, 2
call fcn.10003788
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.10003788
ret