Function at 0x4024c2
Capabilities:
Create process on windows
Delete registry value
Execute command
Persist via run registry key

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x278
mov dword [ebp - 0x244], sym.___gxx_personality_sj0
mov dword [ebp - 0x240], 0x48132e
lea eax, [ebp - 0x23c]
lea ebx, [ebp - 0x18]
mov dword [eax], ebx
mov edx, 0x402e7e
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x25c]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
call dbg.__main
mov dword [ebp - 0x258], 0xffffffff
call dbg.startcheck()
call dbg.RaiseToDebug()
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x48a598
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.YFDaemon.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [esp], str.color_f3
mov dword [ebp - 0x258], 0xffffffff
call sym._system
mov dword [esp], str.title_YF
call sym._system
call dbg.print_main()
mov eax, dword [0x493040]
cmp eax, 2
jne 0x4025ee
call dbg.rc()
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x402e4e
mov eax, dword [0x493040]
cmp eax, 7
jne 0x40260c
mov dword [ebp - 0x258], 0xffffffff
call dbg.emger()
jmp 0x402e4e
mov eax, dword [0x493040]
cmp eax, 9
jne 0x4028f3
mov dword [ebp - 0x258], 0xffffffff
call dbg.user_set_print()
mov eax, dword [0x493050]
cmp eax, 1
jne 0x4026c8
mov dword [esp + 0xc], 0x493080
mov dword [esp + 8], str.YFTrayStartUp
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
call dbg.SetStringReg(HKEY__*, char*, char*, char*)
xor eax, 1
test al, al
je 0x402690
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a62a
mov dword [esp + 4], 0x48a62e
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x4028ee
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x48a62a
mov dword [esp + 4], 0x48a639
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 0x10
jmp 0x402e4e
mov eax, dword [0x493050]
cmp eax, 3
jne 0x402771
mov dword [esp + 0xc], str.NULL
mov dword [esp + 8], str.YFTrayStartUp
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov dword [ebp - 0x258], 0xffffffff
call dbg.SetStringReg(HKEY__*, char*, char*, char*)
xor eax, 1
test al, al
je 0x402739
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a62a
mov dword [esp + 4], 0x48a62e
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x4028ee
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x48a62a
mov dword [esp + 4], 0x48a639
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 0x10
jmp 0x402e4e
mov eax, dword [0x493050]
cmp eax, 2
jne 0x402832
lea eax, [ebp - 0x21c]
mov dword [esp + 4], 0x10
mov dword [esp], str.Set.ini
mov dword [ebp - 0x258], 0xffffffff
mov ecx, eax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
sub esp, 8
lea eax, [ebp - 0x128]
mov dword [esp + 4], 1
mov dword [esp], str.Set.ini
mov dword [ebp - 0x258], 1
mov ecx, eax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
sub esp, 8
lea eax, [ebp - 0x128]
mov dword [esp], 1
mov dword [ebp - 0x258], 2
mov ecx, eax
call method.std::ostream.operator___int_
sub esp, 4
lea eax, [ebp - 0x128]
mov ecx, eax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea eax, [ebp - 0x128]
mov dword [ebp - 0x258], 1
mov ecx, eax
call fcn.00468050
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x258], 0xffffffff
mov ecx, eax
call fcn.00468050
jmp 0x4028ee
mov eax, dword [0x493050]
cmp eax, 4
jne 0x4028ee
lea eax, [ebp - 0x21c]
mov dword [esp + 4], 0x10
mov dword [esp], str.Set.ini
mov dword [ebp - 0x258], 0xffffffff
mov ecx, eax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
sub esp, 8
lea eax, [ebp - 0x128]
mov dword [esp + 4], 1
mov dword [esp], str.Set.ini
mov dword [ebp - 0x258], 3
mov ecx, eax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
sub esp, 8
lea eax, [ebp - 0x128]
mov dword [esp], 0
mov dword [ebp - 0x258], 4
mov ecx, eax
call method.std::ostream.operator___int_
sub esp, 4
lea eax, [ebp - 0x128]
mov ecx, eax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea eax, [ebp - 0x128]
mov dword [ebp - 0x258], 3
mov ecx, eax
call fcn.00468050
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x258], 0xffffffff
mov ecx, eax
call fcn.00468050
jmp 0x402e4e
mov eax, dword [0x493040]
cmp eax, 1
jne 0x402954
mov dword [esp], 0x48a028
mov dword [ebp - 0x258], 0xffffffff
call sym._system
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.virscan.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x24], eax
jmp 0x402e4e
mov eax, dword [0x493040]
cmp eax, 4
jne 0x4029ba
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.taskmg.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 0x18
mov dword [ebp - 0x28], eax
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x402e4e
mov eax, dword [0x493040]
cmp eax, 0xf
jne 0x402a1b
mov dword [esp], 0x48a028
mov dword [ebp - 0x258], 0xffffffff
call sym._system
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.update.vbs
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x2c], eax
jmp 0x402e4e
mov eax, dword [0x493040]
cmp eax, 3
jne 0x402e4e
mov dword [ebp - 0x258], 0xffffffff
call dbg.print_hold_all()
mov eax, dword [0x493044]
cmp eax, 1
jne 0x402a53
mov dword [esp], str.taskmgr
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 2
jne 0x402a78
mov dword [esp], str.start_explorer.exe
mov dword [ebp - 0x258], 0xffffffff
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 3
jne 0x402a9d
mov dword [esp], str.start_cmd.exe
mov dword [ebp - 0x258], 0xffffffff
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 4
jne 0x402ad3
mov dword [esp], 0x48a028
mov dword [ebp - 0x258], 0xffffffff
call sym._system
call dbg.file_new_name()
mov dword [esp], 0x48a028
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 5
jne 0x402af8
mov dword [esp], str.regedit
mov dword [ebp - 0x258], 0xffffffff
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 6
jne 0x402d33
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.DisableTaskmgr
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies_system
mov dword [esp], 0x80000001
mov dword [ebp - 0x258], 0xffffffff
call dbg.SetDwordReg(HKEY__*, char*, char*, unsigned long)
xor eax, 1
test al, al
je 0x402b69
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a6e6
mov dword [esp + 4], 0x48a6ef
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x402d2e
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.DisableCMD
mov dword [esp + 4], str.SoftwarePoliciesMicrosoftWindowsSystem
mov dword [esp], 0x80000001
mov dword [ebp - 0x258], 0xffffffff
call dbg.SetDwordReg(HKEY__*, char*, char*, unsigned long)
xor eax, 1
test al, al
je 0x402bcc
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a6e6
mov dword [esp + 4], 0x48a6ef
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x402d2e
lea eax, [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x402c3d
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a6e6
mov dword [esp + 4], 0x48a6ef
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x402d2e
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.NoControlPanel
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 8
test eax, eax
setne al
test al, al
je 0x402c96
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a6e6
mov dword [esp + 4], 0x48a6ef
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x402d2e
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.DisableRegistryTools
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies_system
mov dword [esp], 0x80000001
mov dword [ebp - 0x258], 0xffffffff
call dbg.SetDwordReg(HKEY__*, char*, char*, unsigned long)
xor eax, 1
test al, al
je 0x402cf6
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x48a6e6
mov dword [esp + 4], 0x48a6ef
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x402d2e
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x48a6e6
mov dword [esp + 4], 0x48a764
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 0x10
jmp 0x402e4e
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 0xa
jne 0x402d58
mov dword [esp], str.start_www.home133.com_config.html
mov dword [ebp - 0x258], 0xffffffff
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 7
jne 0x402d7d
mov dword [esp], str.C:WindowsSystem32msdt.exe___skip_TRUE__path_C:Windowsdiagnostics_system_networking__ep_NetworkDiagnosticsPNI
mov dword [ebp - 0x258], 0xffffffff
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 8
jne 0x402da2
mov dword [esp], str.start_C:WINDOWS_system32driversetchosts
mov dword [ebp - 0x258], 0xffffffff
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 9
jne 0x402e11
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.fixpan.bat
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
mov dword [ebp - 0x258], 0xffffffff
call eax
sub esp, 0x18
mov dword [ebp - 0x30], eax
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp], str.taskkill__im_cmd.exe
call sym._system
jmp 0x402e4e
mov eax, dword [0x493044]
cmp eax, 0xb
jne 0x402e4e
mov dword [esp], str.sfc__scannow
mov dword [ebp - 0x258], 0xffffffff
call sym._system
mov dword [esp], str.pause
call sym._system
mov dword [esp], 0x1f4
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x4025a2