Function at 0x100a8fb
Capabilities:
Create process on windows
Enumerate files on windows
Query environment variable
Query or enumerate registry value
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x101203c]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
xor esi, esi
push 0x1001488
push 1
push esi
push 0x1001498
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100aa04
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push 0x1001478
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x100a9fb
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x50]
push edx
mov edi, 0x20006
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x100a9f1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push esi
push esi
push 0x1001f50
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x100a9e8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x1005264
push 0x80000001
call edi
test eax, eax
jne 0x100a9df
push ebx
push esi
push esi
lea eax, [ebp - 0x58]
push eax
push esi
mov ebx, 0x100546c
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100a99f
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push eax
call dword [ecx + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10
lea eax, [ebp - 0x28]
push eax
push 3
push esi
push ebx
push dword [ebp - 0x2c]
call edi
push 0x14
lea eax, [ebp - 0x18]
push eax
push esi
push 0x10059d0
call fcn.0100c74b
test eax, eax
je 0x100a90e
push 0x14
lea eax, [ebp - 0x18]
push eax
push 1
push esi
push 0x1005478
push dword [ebp - 0x2c]
call edi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x38]
push eax
call fcn.0100c6e3
test eax, eax
jne 0x100a92e
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.0100c68d
mov ebx, dword [ebp - 0x38]
cmp ebx, esi
jl 0x100a947
push ebx
call fcn.01008ed6
test eax, eax
jne 0x100a944
dec ebx
jns 0x100a935
jmp 0x100a947
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x44]
push eax
push 0x20019
push esi
push 0x1004e5c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a979
push dword [ebp - 0x34]
push dword [ebp - 0x44]
call fcn.0100691f
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x34]
push dword [ebp - 0x54]
call fcn.01008d9c
push 4
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x3c]
push eax
push 4
push esi
push 0x1004f40
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], esi
call edi
jmp 0x100a9de
cmp dword [ebp - 0x58], 4
jne 0x100a9ce
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push eax
call dword [ecx + 0xc]
push 0x10
lea eax, [ebp - 0x28]
push eax
push 3
push esi
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2c]
mov dword [ebp - 0x4c], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x48]
pop esi
call fcn.0100d058
leave
ret