Function at 0x408854
Capabilities:
Create process on windows
Delete file
Get common file path
Move file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf4
push esi
push edi
mov esi, 0x4be3bc
lea edi, [ebp - 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4be4c0
lea edi, [ebp - 0x208]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4be5c4
lea edi, [ebp - 0x30c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push 0x103
lea eax, [ebp - 0x208]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
call fcn.0040d9b0
push 0x4c2230
call fcn.0040d794
pop ecx
push 0x4c223a
call fcn.0040df9c
pop ecx
mov dl, byte [ebp + 0xc]
test dl, dl
jne 0x40895c
push 0x4c2240
call fcn.0040d794
pop ecx
push 0x4c2251
lea ecx, [ebp - 0x208]
push ecx
push 0x4c224b
lea eax, [ebp - 0x104]
push eax
call fcn.004a16bc
add esp, 0x10
push 0x80
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
push 0x4c225c
call fcn.0040d794
pop ecx
push 0x4c226e
lea eax, [ebp - 0x208]
push eax
push 0x4c2268
lea edx, [ebp - 0x104]
push edx
call fcn.004a16bc
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_DeleteFileA
push 0x4c2283
push str._s__u__s
lea edx, [ebp - 0x30c]
push edx
call fcn.004a16bc
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x30c]
push ecx
push str.regsvr32.exe
push 0x4c228e
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp + 8]
test al, al
je 0x408b63
push 0x4c22ae
lea edx, [ebp - 0x208]
push edx
push 0x4c22a0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004a16bc
add esp, 0x10
push 0x80
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.DLL_MoveFileExA
push str.IgSvc.exe
lea ecx, [ebp - 0x208]
push ecx
push 0x4c22bb
lea eax, [ebp - 0x104]
push eax
call fcn.004a16bc
add esp, 0x10
push 0x80
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_MoveFileExA
push 0x4c22d1
lea eax, [ebp - 0x208]
push eax
push 0x4c22cb
lea edx, [ebp - 0x104]
push edx
call fcn.004a16bc
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_MoveFileExA
push 0x4c22e2
lea edx, [ebp - 0x208]
push edx
push 0x4c22dc
lea ecx, [ebp - 0x104]
push ecx
call fcn.004a16bc
add esp, 0x10
push 0x80
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.DLL_MoveFileExA
push 0x4c22f3
lea ecx, [ebp - 0x208]
push ecx
push 0x4c22ed
lea eax, [ebp - 0x104]
push eax
call fcn.004a16bc
add esp, 0x10
push 0x80
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_MoveFileExA
push 0x4c2305
lea eax, [ebp - 0x208]
push eax
push 0x4c22ff
lea edx, [ebp - 0x104]
push edx
call fcn.004a16bc
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_MoveFileExA
push str.IgIcon.dll
lea edx, [ebp - 0x208]
push edx
push 0x4c230f
lea ecx, [ebp - 0x104]
push ecx
call fcn.004a16bc
add esp, 0x10
push 0x80
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 4
push 0
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.DLL_MoveFileExA
push 0x4c234e
push 0x4c2320
call fcn.0049ac2c
add esp, 8
push 0x4c236f
push 0x4c2356
call fcn.0049ac2c
add esp, 8
push 0x4c2392
push 0x4c2379
call fcn.0049ac2c
add esp, 8
push 0x4c23bb
push 0x4c23a2
call fcn.0049ac2c
add esp, 8
push str.TerminalFlag
push 0x4c23c4
call fcn.0049ac2c
add esp, 8
push 0x4c2403
push 0x4c23ea
call fcn.0049ac2c
add esp, 8
push 0x4c2429
push 0x4c2410
call fcn.0049ac2c
add esp, 8
push 0x4c2452
push 0x4c2439
call fcn.0049ac2c
add esp, 8
push 0x4c2479
push 0x4c2460
call fcn.0049ac2c
add esp, 8
push 0x4c24a0
push 0x4c2487
call fcn.0049ac2c
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret