Function at 0x40890a
Capabilities:
Check if file exists
Delete file
Get file attributes
Persist via run registry key

Disassembly:
push 0x248
mov eax, 0x40fd7c
call fcn.0040f815
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x230]
push eax
push ecx
push 3
push 0
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
push 0x80000001
mov ecx, edi
call fcn.004063da
mov esi, eax
test esi, esi
je 0x408981
mov eax, dword [0x411038]
cmp eax, 0x411038
je 0x40896d
test byte [eax + 0x1c], 8
je 0x40896d
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.00406a78
test esi, esi
jle 0x40897a
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x408cb0
push ecx
lea ecx, [ebp - 0x254]
call fcn.00409214
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x220]
mov eax, dword [eax]
mov dword [ebp - 0x220], eax
test eax, eax
je 0x4089d4
lea eax, [ebp - 0x220]
push eax
call fcn.004092f1
mov esi, eax
mov ecx, dword [esi]
call fcn.00409976
cmp dword [eax + 0x2c], 1
je 0x4089cb
push dword [esi]
lea ecx, [ebp - 0x254]
call fcn.00409236
cmp dword [ebp - 0x220], 0
jne 0x4089a3
push 0x411278
lea ecx, [ebp - 0x220]
call fcn.004048b7
lea edx, [ebp - 0x254]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00407e6e
mov esi, dword [ebp - 0x220]
push ecx
push esi
push str.Configuration
mov ecx, edi
call fcn.004064f5
mov edi, eax
test edi, edi
je 0x408a4a
mov eax, dword [0x411038]
cmp eax, 0x411038
je 0x408a34
test byte [eax + 0x1c], 8
je 0x408a34
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
pop ecx
call fcn.00406a78
test edi, edi
jle 0x408c9b
movzx edi, di
or edi, 0x80070000
jmp 0x408c9b
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
push 0x20019
push 0x4020c8
push 0x80000001
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 2
call fcn.0040654b
mov edi, eax
test edi, edi
je 0x408ab9
mov eax, dword [0x411038]
cmp eax, 0x411038
je 0x408aa3
test byte [eax + 0x1c], 8
je 0x408aa3
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
pop ecx
call fcn.00406a78
test edi, edi
jle 0x408c86
movzx edi, di
or edi, 0x80070000
jmp 0x408c86
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x230], 0x104
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x40214c
call fcn.0040643c
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00408f37
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x228]
call fcn.00408f37
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00408f37
push 0x17
push 0x40215c
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 5
call fcn.004090a3
push 0xd
push 0x40218c
lea ecx, [ebp - 0x228]
call fcn.004090a3
push 0xe
push 0x4021a8
lea ecx, [ebp - 0x224]
call fcn.004090a3
lea eax, [ebp - 0x220]
mov ecx, ebx
push eax
call fcn.00408ee1
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x411038
cmp eax, 0xffffffff
je 0x408bca
push 4
push 0x4021c8
mov ecx, ebx
call fcn.004090a3
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x411038]
cmp eax, edi
je 0x408bca
test byte [eax + 0x1c], 0x10
je 0x408bca
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.00406a50
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408c12
push 9
push 0x4021d4
mov ecx, ebx
call fcn.004090a3
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x411038]
cmp eax, edi
je 0x408c12
test byte [eax + 0x1c], 0x10
je 0x408c12
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.00406a50
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408c5a
push 0xe
push 0x4021e8
mov ecx, ebx
call fcn.004090a3
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x411038]
cmp eax, edi
je 0x408c5a
test byte [eax + 0x1c], 0x10
je 0x408c5a
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
pop ecx
call fcn.00406a50
mov ecx, dword [ebp - 0x224]
xor edi, edi
lea ecx, [ecx - 0x10]
call fcn.004040cb
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.004040cb
mov ecx, dword [ebp - 0x22c]
lea ecx, [ecx - 0x10]
call fcn.004040cb
cmp dword [ebp - 0x23c], 0
je 0x408c9b
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.004040cb
lea ecx, [ebp - 0x254]
call fcn.00409265
mov eax, edi
call fcn.0040f7b2
ret 0xc