Function at 0x10088ff
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Persist via default file association registry key
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x230], eax
xor eax, eax
mov byte [ebp - 0x20], 0
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
push esi
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x10165c8
lea eax, [ebp - 0x124]
push eax
call edi
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov eax, dword [0x1016c8c]
dec eax
je 0x10089e2
dec eax
je 0x100887f
and dword [ebp - 0x22c], 0
jmp 0x1008aa7
push 1
push 0x10014d0
call fcn.0100cbd8
mov eax, esi
sub eax, ebx
push eax
push 0x100578c
lea eax, [ebp + ebx - 0x124]
push eax
call edi
push esi
push 0x10166cc
lea eax, [ebp - 0x228]
push eax
call edi
push esi
push 0x1005798
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10059f8
call fcn.0100c74b
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x10088f2
xor eax, eax
cmp word [ebp - 0xc], 5
setne al
lea eax, [eax + eax + 5]
jmp 0x1008977
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10059d0
call fcn.0100c74b
test eax, eax
jne 0x1008953
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push reloc.ADVAPI32.dll_RegQueryValueExA
call fcn.0100c9ff
test eax, eax
jge 0x1008953
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, 0xffffffff
jne 0x1008939
and dword [ebp - 0x22c], 0
jmp 0x100897d
lea eax, [ebp - 0x228]
push eax
call esi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
inc ecx
mov dword [ebp - 0x22c], ecx
jmp 0x100897d
cmp word [ebp - 0xc], 5
jne 0x1008966
mov dword [ebp - 0x22c], 4
jmp 0x100897d
xor eax, eax
cmp word [ebp - 0xc], 4
setne al
lea eax, [eax*4 + 3]
mov dword [ebp - 0x22c], eax
cmp dword [0x1016c80], 0
je 0x1008a93
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
je 0x10089b8
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x124]
push eax
call ebx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x228]
push eax
call esi
cmp eax, 0xffffffff
je 0x1008a93
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x228]
push eax
call ebx
lea eax, [ebp - 0x228]
jmp 0x1008a8c
push 1
push 0x10014b0
call fcn.0100cbd8
sub esi, ebx
push esi
push reloc.ADVAPI32.dll_RegQueryValueExA
lea eax, [ebp + ebx - 0x124]
push eax
call edi
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10059d0
call fcn.0100c74b
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jne 0x1008a4f
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push reloc.ADVAPI32.dll_RegQueryValueExA
call fcn.0100c9ff
test eax, eax
jge 0x1008a4f
lea eax, [ebp - 0x124]
push eax
call esi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x22c], ecx
jmp 0x1008a5e
lea eax, [ebp - 0xc]
push eax
call fcn.0100c53a
mov dword [ebp - 0x22c], eax
cmp dword [0x1016c80], 0
je 0x1008a93
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, 0xffffffff
je 0x1008a93
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x22c]
push 0
push dword [eax*4 + 0x1001420]
call fcn.0100cbd8
cmp byte [ebp - 0x20], 0
je 0x1008ab2
lea eax, [ebp - 0x20]
jmp 0x1008acb
mov eax, dword [ebp - 0x22c]
cmp eax, 5
jbe 0x1008ac4
mov eax, 0x10051cc
jmp 0x1008acb
mov eax, dword [eax*4 + 0x100140c]
push dword [ebp + 0xc]
push eax
push dword [ebp - 0x230]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x22c]
pop edi
pop esi
pop ebx
call fcn.0100d058
leave
ret 8