Function at 0x1008da9
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Persist via default file association registry key
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x230], eax
xor eax, eax
mov byte [ebp - 0x20], 0
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
push esi
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x10165a8
lea eax, [ebp - 0x124]
push eax
call edi
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov eax, dword [0x1016c6c]
dec eax
je 0x1008e7d
dec eax
je 0x1008d1a
and dword [ebp - 0x22c], 0
jmp 0x1008f42
push 1
push 0x1001500
call fcn.0100d0a2
mov eax, esi
sub eax, ebx
push eax
push 0x1005798
lea eax, [ebp + ebx - 0x124]
push eax
call edi
push esi
push 0x10166ac
lea eax, [ebp - 0x228]
push eax
call edi
push esi
push 0x10057a4
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1005a04
call fcn.0100cc15
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x1008d8d
xor eax, eax
cmp word [ebp - 0xc], 5
setne al
lea eax, [eax + eax + 5]
jmp 0x1008e12
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10059dc
call fcn.0100cc15
test eax, eax
jne 0x1008dee
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push reloc.KERNEL32.dll_GetVersionExA
call fcn.0100cec9
test eax, eax
jge 0x1008dee
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, 0xffffffff
jne 0x1008dd4
and dword [ebp - 0x22c], 0
jmp 0x1008e18
lea eax, [ebp - 0x228]
push eax
call esi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
inc ecx
mov dword [ebp - 0x22c], ecx
jmp 0x1008e18
cmp word [ebp - 0xc], 5
jne 0x1008e01
mov dword [ebp - 0x22c], 4
jmp 0x1008e18
xor eax, eax
cmp word [ebp - 0xc], 4
setne al
lea eax, [eax*4 + 3]
mov dword [ebp - 0x22c], eax
cmp dword [0x1016c60], 0
je 0x1008f2e
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
je 0x1008e53
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x124]
push eax
call ebx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x228]
push eax
call esi
cmp eax, 0xffffffff
je 0x1008f2e
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x228]
push eax
call ebx
lea eax, [ebp - 0x228]
jmp 0x1008f27
push 1
push 0x10014e0
call fcn.0100d0a2
sub esi, ebx
push esi
push reloc.KERNEL32.dll_GetVersionExA
lea eax, [ebp + ebx - 0x124]
push eax
call edi
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10059dc
call fcn.0100cc15
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jne 0x1008eea
push 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push reloc.KERNEL32.dll_GetVersionExA
call fcn.0100cec9
test eax, eax
jge 0x1008eea
lea eax, [ebp - 0x124]
push eax
call esi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x22c], ecx
jmp 0x1008ef9
lea eax, [ebp - 0xc]
push eax
call fcn.0100c9fe
mov dword [ebp - 0x22c], eax
cmp dword [0x1016c60], 0
je 0x1008f2e
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, 0xffffffff
je 0x1008f2e
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x22c]
push 0
push dword [eax*4 + 0x1001450]
call fcn.0100d0a2
cmp byte [ebp - 0x20], 0
je 0x1008f4d
lea eax, [ebp - 0x20]
jmp 0x1008f66
mov eax, dword [ebp - 0x22c]
cmp eax, 5
jbe 0x1008f5f
mov eax, 0x10051d8
jmp 0x1008f66
mov eax, dword [eax*4 + 0x100143c]
push dword [ebp + 0xc]
push eax
push dword [ebp - 0x230]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x22c]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 8