Function at 0x40e690
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x431078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str.Sub_Main___r_n_r_nSet_objFSO__CreateObject__Scripting.FileSystemObject___r_nSet_objShell__CreateObject__Wscript.Shell___r_n_r_nobjFile__Wscript.ScriptFullName_r_nobjFolder__objFSO.GetParentFolderName_objFile__r_nobjParentFolder__objFSO.GetParentFolderName_objFolder__r_n_r_nobjShell.CurrentDirectory__objParentFolder_r_nobjFSO.DeleteFolder_objFolder__r_n_r_nEnd_Sub_r_n_r_nOn_Error_Resume_Next_r_nMain_r_n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x490], eax
lea eax, [ebp - 0x22c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.del.vbs
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e7e2
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x488]
push str.___SystemRoot__System32WScript.exe___B___s_
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x494]
push 0
push eax
push dword [ebp - 0x490]
push str.Sub_Main___r_n_r_nSet_objFSO__CreateObject__Scripting.FileSystemObject___r_nSet_objShell__CreateObject__Wscript.Shell___r_n_r_nobjFile__Wscript.ScriptFullName_r_nobjFolder__objFSO.GetParentFolderName_objFile__r_nobjParentFolder__objFSO.GetParentFolderName_objFolder__r_n_r_nobjShell.CurrentDirectory__objParentFolder_r_nobjFSO.DeleteFolder_objFolder__r_n_r_nEnd_Sub_r_n_r_nOn_Error_Resume_Next_r_nMain_r_n
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40e7e2
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x494], eax
jne 0x40e7e2
push 0
lea eax, [ebp - 0x48c]
push eax
push 0
push 3
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e7e2
push str.del_vbs_
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx esi, ax
mov edi, esi
movzx eax, si
push eax
lea eax, [ebp - 0x14]
push str._04X
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub eax, 0
jne 0x40e7f5
inc esi
cmp si, di
jne 0x40e7a1
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041345d
mov esp, ebp
pop ebp
ret
sub eax, 2
jne 0x40e7d6
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x488]
push eax
push 1
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x48c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0041345d
mov esp, ebp
pop ebp
ret