Function at 0x408901
Capabilities:
Check if file exists
Delete file
Get file attributes
Persist via run registry key

Disassembly:
push 0x248
mov eax, 0x40fd7c
call fcn.0040f815
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x230]
push eax
push ecx
push 3
push 0
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
push 0x80000001
mov ecx, edi
call fcn.004063da
mov esi, eax
test esi, esi
je 0x408978
mov eax, dword [0x411038]
cmp eax, 0x411038
je 0x408964
test byte [eax + 0x1c], 8
je 0x408964
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.00406a6f
test esi, esi
jle 0x408971
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x408ca7
push ecx
lea ecx, [ebp - 0x254]
call fcn.0040920b
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x220]
mov eax, dword [eax]
mov dword [ebp - 0x220], eax
test eax, eax
je 0x4089cb
lea eax, [ebp - 0x220]
push eax
call fcn.004092e8
mov esi, eax
mov ecx, dword [esi]
call fcn.0040996d
cmp dword [eax + 0x2c], 1
je 0x4089c2
push dword [esi]
lea ecx, [ebp - 0x254]
call fcn.0040922d
cmp dword [ebp - 0x220], 0
jne 0x40899a
push 0x411278
lea ecx, [ebp - 0x220]
call fcn.004048b7
lea edx, [ebp - 0x254]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00407e65
mov esi, dword [ebp - 0x220]
push ecx
push esi
push str.Configuration
mov ecx, edi
call fcn.004064f5
mov edi, eax
test edi, edi
je 0x408a41
mov eax, dword [0x411038]
cmp eax, 0x411038
je 0x408a2b
test byte [eax + 0x1c], 8
je 0x408a2b
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
pop ecx
call fcn.00406a6f
test edi, edi
jle 0x408c92
movzx edi, di
or edi, 0x80070000
jmp 0x408c92
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
push 0x20019
push 0x4020c8
push 0x80000001
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 2
call fcn.0040654b
mov edi, eax
test edi, edi
je 0x408ab0
mov eax, dword [0x411038]
cmp eax, 0x411038
je 0x408a9a
test byte [eax + 0x1c], 8
je 0x408a9a
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
pop ecx
call fcn.00406a6f
test edi, edi
jle 0x408c7d
movzx edi, di
or edi, 0x80070000
jmp 0x408c7d
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x230], 0x104
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x40214c
call fcn.0040643c
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00408f2e
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x228]
call fcn.00408f2e
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00408f2e
push 0x17
push 0x40215c
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 5
call fcn.0040909a
push 0xd
push 0x40218c
lea ecx, [ebp - 0x228]
call fcn.0040909a
push 0xe
push 0x4021a8
lea ecx, [ebp - 0x224]
call fcn.0040909a
lea eax, [ebp - 0x220]
mov ecx, ebx
push eax
call fcn.00408ed8
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x411038
cmp eax, 0xffffffff
je 0x408bc1
push 4
push 0x4021c8
mov ecx, ebx
call fcn.0040909a
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x411038]
cmp eax, edi
je 0x408bc1
test byte [eax + 0x1c], 0x10
je 0x408bc1
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.00406a47
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408c09
push 9
push 0x4021d4
mov ecx, ebx
call fcn.0040909a
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x411038]
cmp eax, edi
je 0x408c09
test byte [eax + 0x1c], 0x10
je 0x408c09
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.00406a47
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408c51
push 0xe
push 0x4021e8
mov ecx, ebx
call fcn.0040909a
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x411038]
cmp eax, edi
je 0x408c51
test byte [eax + 0x1c], 0x10
je 0x408c51
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
pop ecx
call fcn.00406a47
mov ecx, dword [ebp - 0x224]
xor edi, edi
lea ecx, [ecx - 0x10]
call fcn.004040cb
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.004040cb
mov ecx, dword [ebp - 0x22c]
lea ecx, [ecx - 0x10]
call fcn.004040cb
cmp dword [ebp - 0x23c], 0
je 0x408c92
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.004040cb
lea ecx, [ebp - 0x254]
call fcn.0040925c
mov eax, edi
call fcn.0040f7b2
ret 0xc