Function at 0x407f94
Capabilities:
Create process on windows
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
lea eax, [ebp - 0x2a0]
push ebx
push esi
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0042d620
add esp, 0xc
mov esi, 0x466ed8
mov ecx, esi
call fcn.00402010
push eax
mov ecx, esi
call fcn.00402018
push eax
push ebx
lea eax, [ebp - 0x2a0]
mov esi, 0x466e90
push eax
push str.exepath
mov ecx, esi
call fcn.00402018
mov edx, eax
call fcn.0040c60c
add esp, 0x14
test al, al
jne 0x408003
push ebx
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00402018
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, 0x466ea8
mov byte [ebp - 1], 1
mov edx, 0x4585e8
mov ecx, ebx
call fcn.00406232
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x408044
push 0x80
mov ecx, ebx
call fcn.00404386
push eax
call esi
push 0x80
lea eax, [ebp - 0x2a0]
push eax
call esi
mov ebx, eax
lea ecx, [ebp - 0x1c]
neg ebx
push str..vbs
sbb bl, bl
call fcn.00412bee
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.00412e4a
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.004074d1
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.004034ef
lea ecx, [ebp - 0x1c]
call fcn.00402081
lea eax, [ebp - 0x94]
push eax
push 0x458674
push 0x4589e0
call fcn.00430f52
pop ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.004034f9
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.004074d1
pop ecx
mov edx, eax
lea ecx, [ebp - 0x7c]
call fcn.00408a18
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004034ef
lea ecx, [ebp - 0x4c]
call fcn.004034ef
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x1c]
call fcn.004034f9
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x34]
call fcn.00408a3c
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004034ef
and bl, byte [ebp - 1]
je 0x40814b
push 0x458a88
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x64]
call fcn.004034f9
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x4c]
call fcn.00408a3c
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.004074d1
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405c18
lea ecx, [ebp - 0x1c]
call fcn.004034ef
lea ecx, [ebp - 0x4c]
call fcn.004034ef
lea ecx, [ebp - 0x64]
call fcn.004034ef
push 0x458ac0
lea eax, [ebp - 0x2a0]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x4c]
call fcn.004034f9
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.004074d1
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.004074d1
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405c18
lea ecx, [ebp - 0x64]
call fcn.004034ef
lea ecx, [ebp - 0x1c]
call fcn.004034ef
lea ecx, [ebp - 0x4c]
call fcn.004034ef
test bl, bl
je 0x4081ac
push str.wend_n
lea ecx, [ebp - 0x34]
call fcn.00405c0f
mov ebx, 0x4585e8
mov esi, 0x466ea8
mov edx, ebx
mov ecx, esi
call fcn.00406232
test al, al
je 0x4081fb
push 0x458ac0
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x1c]
call fcn.00408a60
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.004074d1
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405c18
lea ecx, [ebp - 0x64]
call fcn.004034ef
lea ecx, [ebp - 0x1c]
call fcn.004034ef
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x34]
call fcn.00405c0f
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00404386
push eax
lea ecx, [ebp - 0x34]
call fcn.00402010
mov esi, eax
lea ecx, [ebp - 0x34]
add esi, esi
call fcn.00404386
mov edx, esi
mov ecx, eax
call fcn.004133aa
pop ecx
pop ecx
test al, al
je 0x40824d
push edi
push ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00404386
push eax
push 0x458578
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]