Function at 0x46fde0
Capabilities:
Create process on windows
Delete registry value
Persist via run registry key
Print debug messages
Schedule task via schtasks
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b41bc
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x4e5258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x278], ecx
call fcn.0046d760
mov dword [ebp - 0x26c], eax
call fcn.00449340
mov ecx, eax
call fcn.0042e690
movzx eax, al
test eax, eax
je 0x46ffbc
cmp dword [ebp - 0x26c], 3
jl 0x46fef6
push 0x100
push 0
lea ecx, [ebp - 0x110]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x100
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x22c]
call fcn.00436890
mov dword [ebp - 4], 0
push str.cmd.exe__c_schtasks__Create__tn__Pro5___tr
lea ecx, [ebp - 0x22c]
call fcn.00438d10
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00439800
push 0x4c007c
lea ecx, [ebp - 0x22c]
call fcn.00439800
push 0
lea ecx, [ebp - 0x22c]
call fcn.0043d960
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push str.Win10
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x22c]
call fcn.0043d960
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00438400
jmp 0x46ffb7
push str.Win7
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4c00c0
lea ecx, [ebp - 0x244]
call fcn.00436820
lea ecx, [ebp - 0x264]
push ecx
push 0x20106
push 0
lea ecx, [ebp - 0x244]
call fcn.0043d960
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x46ff9f
push 0x104
push 0
lea edx, [ebp - 0x214]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
push ecx
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push 0x4c00f0
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x244]
call fcn.00438400
jmp 0x470042
call fcn.0046d760
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jl 0x46ffdf
push 0
push str.schtasks__delete__TN__Pro5___F
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x470042
push 0x4c0118
lea ecx, [ebp - 0x25c]
call fcn.00436820
lea edx, [ebp - 0x268]
push edx
push 0x20106
push 0
lea ecx, [ebp - 0x25c]
call fcn.0043d960
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47002a
push 0x4c0148
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x25c]
call fcn.00438400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adff8
mov esp, ebp
pop ebp
ret