Function at 0x489680
Capabilities:
Create process on windows
Delete registry value
Persist via run registry key
Print debug messages
Schedule task via schtasks
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b50f2
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x4e5258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], ecx
call fcn.00449340
mov ecx, eax
call fcn.0042e690
mov byte [ebp - 0x25e], al
movzx eax, byte [ebp - 0x25e]
test eax, eax
jne 0x4896d7
mov byte [ebp - 0x25d], 1
jmp 0x4896de
mov byte [ebp - 0x25d], 0
movzx ecx, byte [ebp - 0x25d]
push ecx
call fcn.00449340
mov ecx, eax
call fcn.0042e670
call fcn.00449340
mov ecx, eax
call fcn.0042be80
call fcn.0048a390
mov dword [ebp - 0x270], eax
call fcn.00449340
mov ecx, eax
call fcn.0042e690
movzx edx, al
test edx, edx
je 0x489893
cmp dword [ebp - 0x270], 3
jl 0x4897d8
push 0x100
push 0
lea eax, [ebp - 0x110]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x22c]
call fcn.00436890
mov dword [ebp - 4], 0
push 0x4c1f04
lea ecx, [ebp - 0x22c]
call fcn.00438d10
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x22c]
call fcn.00439800
push str.___sc_ONLOGON__RL_HIGHEST__IT__F
lea ecx, [ebp - 0x22c]
call fcn.00439800
push 0
lea ecx, [ebp - 0x22c]
call fcn.0043d960
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x22c]
call fcn.0043d960
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00438400
jmp 0x48988e
push 0x4c1f5c
lea ecx, [ebp - 0x244]
call fcn.00436820
lea eax, [ebp - 0x268]
push eax
push 0x20106
push 0
lea ecx, [ebp - 0x244]
call fcn.0043d960
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x489876
push 0x104
push 0
lea ecx, [ebp - 0x214]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x4c1f8c
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x244]
call fcn.00438400
jmp 0x489919
call fcn.0048a390
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jl 0x4898b6
push 0
push str.schtasks__delete__TN__Pro5.app___F
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x489919
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x25c]
call fcn.00436820
lea ecx, [ebp - 0x26c]
push ecx
push 0x20106
push 0
lea ecx, [ebp - 0x25c]
call fcn.0043d960
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x489901
push str.Pro5.app
mov edx, dword [ebp - 0x26c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x25c]
call fcn.00438400
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adff8
mov esp, ebp
pop ebp
ret 0x10