Function at 0x4e82ec
Capabilities:
Delete file
Delete registry key
Manipulate boot configuration
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x4e82f4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e86fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4e86be
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
lea eax, [ebp - 0x28]
xor edx, edx
mov cl, 1
call fcn.00421218
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x2c]
mov ecx, 0x4e8718
call fcn.00406d58
mov eax, dword [ebp - 0x2c]
mov ecx, 0x4e873c
mov edx, 0x4e8754
call fcn.004da964
lea eax, [ebp - 0x18]
call fcn.0041ccb0
cmp eax, 1
jne 0x4e8462
call fcn.004d8fdc
test al, al
je 0x4e83c3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
call fcn.00411eb8
test al, al
je 0x4e861b
mov eax, dword [ebp - 4]
push dword [eax + 0x474]
push 0x4e8774
push 0x4e8794
push 0x4e87f0
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00406e3c
mov eax, dword [ebp - 0x30]
xor edx, edx
call fcn.004d72d8
jmp 0x4e861b
push 0
lea ecx, [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x34]
mov edx, 0x4e8810
call fcn.00406c98
mov eax, dword [ebp - 0x34]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
lea ecx, [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x38]
mov edx, 0x4e8830
call fcn.00406c98
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x3c]
mov edx, 0x4e8810
call fcn.00406c98
mov eax, dword [ebp - 0x3c]
mov edx, 0x4e8848
pop ecx
call fcn.004dadc4
push 7
lea ecx, [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x40]
mov edx, 0x4e8810
call fcn.00406c98
mov eax, dword [ebp - 0x40]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
jmp 0x4e861b
cmp eax, 2
jne 0x4e861b
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x44]
mov ecx, 0x4e8878
call fcn.00406d58
mov eax, dword [ebp - 0x44]
call fcn.00411eb8
test al, al
je 0x4e8564
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x47c]
mov edx, 0x4e8894
mov eax, 0x4e88b4
call fcn.004d912c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x47c]
call fcn.00411eb8
test al, al
je 0x4e861b
xor eax, eax
push ebp
push 0x4e855d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0x47c]
push 0x4e88d0
mov eax, dword [ebp - 4]
push dword [eax + 0x6b8]
push 0x4e88e8
lea ecx, [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.004ea644
mov eax, dword [ebp - 0x50]
mov edx, 1
call fcn.00411af8
dec eax
lea edx, [ebp - 0x4c]
call fcn.00411860
push dword [ebp - 0x4c]
push 0x4e890c
lea eax, [ebp - 0x48]
mov edx, 6
call fcn.00406e3c
mov eax, dword [ebp - 0x48]
xor edx, edx
call fcn.004d72d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e861b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x47c]
call fcn.00406900
push eax
call sub.kernel32.dll_DeleteFileW
ret
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x478]
mov edx, 0x4e891c
mov eax, 0x4e88b4
call fcn.004d912c
test al, al
je 0x4e861b
xor eax, eax
push ebp
push 0x4e8614
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0x478]
push 0x4e8934
lea ecx, [ebp - 0x64]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 4]
call fcn.004ea644
mov eax, dword [ebp - 0x60]
mov edx, 1
call fcn.00411af8
dec eax
lea edx, [ebp - 0x5c]
call fcn.00411860
push dword [ebp - 0x5c]
push 0x4e8944
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00406e3c
mov eax, dword [ebp - 0x58]
xor edx, edx
call fcn.004d72d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e861b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x478]
call fcn.00406900
push eax
call sub.kernel32.dll_DeleteFileW
ret
lea ecx, [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x68]
mov edx, 0x4e8830
call fcn.00406c98
mov eax, dword [ebp - 0x68]
call fcn.004d70bc
lea ecx, [ebp - 0x6c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x6c]
mov edx, 0x4e8974
call fcn.00406c98
mov eax, dword [ebp - 0x6c]
call fcn.004d70bc
lea ecx, [ebp - 0x70]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e9c78
lea eax, [ebp - 0x70]
mov edx, 0x4e8994
call fcn.00406c98
mov eax, dword [ebp - 0x70]
call fcn.004d70bc
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b8]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b8]
call fcn.004d70f8
push 0x4e89a8
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e86cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8701
lea eax, [ebp - 0x70]
mov edx, 0x12
call fcn.0040686c
lea eax, [ebp - 0x28]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
ret