Function at 0x100e9f8
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x102a0ec]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x428], eax
xor edi, edi
lea eax, [ebp - 0x434]
xor ebx, ebx
inc edi
push eax
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x438], edi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, ebx
mov dword [ebp - 0x420], eax
jl 0x100efd7
push esi
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x430], ebx
call fcn.0100e818
test eax, eax
mov esi, 0x104
je 0x100ec13
lea eax, [ebp - 0x424]
push eax
push edi
push ebx
push 0x10017a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100eb07
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
push 0x1002ad8
push dword [ebp - 0x424]
mov dword [ebp - 0x430], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100eaef
cmp dword [ebp - 0x438], edi
jne 0x100eaef
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x100eaef
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], edi
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x418], ebx
jne 0x100ed4c
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100eb3f
push 0x1002a48
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
jne 0x100ec02
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100ebc2
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push esi
lea eax, [ebp - 0x414]
push eax
push 0x9f
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100ebc2
push 0x1002a30
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push 0x10029d8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
jne 0x100ec02
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100ec13
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x10029ac
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x100ec13
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], edi
jmp 0x100ed46
lea eax, [ebp - 0x41c]
push eax
push 0x802e
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
mov dword [ebp - 0x420], eax
jl 0x100ec57
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x41c], ebx
je 0x100ec77
mov eax, dword [ebp - 0x434]
push dword [ebp - 0x41c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x41c], ebx
cmp dword [ebp - 0x420], 0x80070057
jne 0x100ed10
lea eax, [ebp - 0x424]
push eax
push edi
push ebx
push 0x1002928
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ed4c
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
push 0x1002900
push dword [ebp - 0x424]
mov dword [ebp - 0x430], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ed04
cmp dword [ebp - 0x438], edi
jne 0x100ed04
cmp word [ebp - 0x20c], bx
je 0x100ed04
lea eax, [ebp - 0x20c]
push eax
call fcn.01018429
test eax, eax
je 0x100ed04
mov dword [ebp - 0x420], ebx
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x420], ebx
jl 0x100ed4c
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x10028a8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x100ed4c
mov dword [ebp - 0x418], edi
lea eax, [ebp - 0x41c]
push eax
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
mov dword [ebp - 0x420], eax
jl 0x100eeca
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100efeb
lea eax, [ebp - 0x414]
push eax
call fcn.01016cfc
push 0x1002894
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d4ff
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
lea eax, [ebp - 0x414]
push eax
call edi
push 0x1002878
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d4ff
push ebx
lea eax, [ebp - 0x414]
push eax
call edi
mov edi, 0x1002850
push edi
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0100c6ae
push 0x10029ac
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d4ff
cmp dword [ebp - 0x418], ebx
je 0x100eec7
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100eec7
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x100ee6e
cmp dword [ebp - 0x428], ebx
je 0x100ee6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100ee6e
push 3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x418], eax
push edi
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0100c6ae
cmp dword [ebp - 0x428], ebx
je 0x100eec7
cmp dword [ebp - 0x418], ebx
je 0x100eec7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
jmp 0x100eeb6
mov word [eax], bx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x100eec7
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
cmp eax, ebx
pop ecx
pop ecx
jne 0x100eea2
xor edi, edi
inc edi
cmp dword [ebp - 0x41c], ebx
je 0x100eeea
mov eax, dword [ebp - 0x434]
push dword [ebp - 0x41c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x42c], ebx
je 0x100efd6
call fcn.01019582
fcomp qword [0x10026d0]
fnstsw ax
test ah, 5
jp 0x100efd6
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100ef4a
push 0x1002834
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01019a5b
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x100efd6
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1002684
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x100efd6
call fcn.0100df74
test eax, eax
je 0x100efd6
lea eax, [ebp - 0x20c]
push eax
push 0x103
lea eax, [ebp - 0x414]
push eax
call fcn.0100c535
push 0x1002820
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d4ff
push 0xffff
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010189dd
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
pop edi
pop ebx
call fcn.0101672d
leave
ret 4
mov dword [ebp - 0x420], 0x80004005
jmp 0x100eeca