Function at 0x1000c237
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push 0xe70
mov eax, 0x1006b46c
call fcn.10043a69
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
push 0x40e
lea eax, [ebp - 0x41e]
push edi
push eax
mov word [ebp - 0x420], di
call fcn.10042010
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.100421ff
add esp, 0x1c
push dword [esi + 0x10085030]
lea eax, [ebp - 0x420]
push eax
call ebx
cmp dword [esi + 0x10085034], edi
je 0x1000c2d7
cmp dword [esi + 0x10085040], edi
je 0x1000c2b5
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.1000f89d
pop ecx
pop ecx
jmp 0x1000c2d7
lea eax, [ebp + 8]
push eax
push edi
push ecx
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0xe7c], esp
push eax
call fcn.1000acc3
call fcn.1000f8d6
add esp, 0xc
add esi, 0x18
cmp esi, 0x378
jb 0x1000c253
push 0x40e
lea eax, [ebp - 0xe4a]
push edi
push eax
mov word [ebp - 0xe4c], di
call fcn.10042010
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0xe4c]
push 0x208
push eax
call fcn.100421ff
add esp, 0x1c
push str.redirect.inf
lea eax, [ebp - 0xe4c]
push eax
call ebx
push 1
lea eax, [ebp - 0xe4c]
push 0x80
push eax
call fcn.1000c112
add esp, 0xc
call fcn.1000122f
test al, al
je 0x1000c35a
call fcn.10001240
test al, al
jne 0x1000c35a
push 1
push dword [ebp + 8]
call fcn.10014a80
pop ecx
pop ecx
call fcn.1000953a
push ecx
mov ecx, esp
mov dword [ebp - 0xe7c], esp
push 0x10070adc
call fcn.1000acc3
call fcn.10006651
mov dword [esp], 0x618
lea eax, [ebp - 0xa3a]
push edi
push eax
mov word [ebp - 0xa3c], di
call fcn.10042010
push dword [ebp + 8]
lea eax, [ebp - 0xa3c]
push str.cmd__c__rmdir__s__q___s__
push eax
mov dword [ebp - 0xe74], edi
call fcn.10043b8d
add esp, 0x18
lea eax, [ebp - 0xe74]
push eax
push 2
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000c516
mov esi, dword [sym.imp.RPCRT4.dll_UuidCreate]
lea eax, [ebp - 0xe5c]
push eax
mov dword [ebp - 0xe78], edi
mov dword [ebp - 0xe70], edi
call esi
mov ebx, dword [sym.imp.ole32.dll_StringFromCLSID]
lea eax, [ebp - 0xe78]
push eax
lea eax, [ebp - 0xe5c]
push eax
call ebx
lea eax, [ebp - 0xe6c]
push eax
call esi
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0xe6c]
push eax
call ebx
cmp dword [ebp - 0xe78], edi
je 0x1000c487
cmp dword [ebp - 0xe70], edi
je 0x1000c487
call dword [0x10086d18]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 0xe78]
lea eax, [ebp - 0xa3c]
push eax
call ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa3c]
push eax
push 1
push edi
push esi
push dword [ebp - 0xe74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe70]
mov esi, str.cmd__c__regsvr32__s_Urlmon.dllregsvr32__s_Actxprxy.dllregsvr32__s_Oleaut32.dllregsvr32__s_Shell32.dll_
push esi
mov dword [ebp - 0xe7c], eax
call ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push edi
push dword [ebp - 0xe7c]
jmp 0x1000c4cc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0xa3c]
push eax
call ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa3c]
push eax
push 1
push edi
push str.remove
push dword [ebp - 0xe74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, str.cmd__c__regsvr32__s_Urlmon.dllregsvr32__s_Actxprxy.dllregsvr32__s_Oleaut32.dllregsvr32__s_Shell32.dll_
push esi
call ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push edi
push str.rereg
push dword [ebp - 0xe74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0xe78], edi
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
je 0x1000c4f4
push dword [ebp - 0xe78]
call esi
mov dword [ebp - 0xe78], edi
cmp dword [ebp - 0xe70], edi
je 0x1000c50a
push dword [ebp - 0xe70]
call esi
mov dword [ebp - 0xe70], edi
push dword [ebp - 0xe74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10001e52
push edi
push 0x10070adc
push str._c__regsvr32__s_Urlmon.dllregsvr32__s_Actxprxy.dllregsvr32__s_Oleaut32.dllregsvr32__s_Shell32.dll_
push str.cmd.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1000285b
call fcn.10043aec
ret