Function at 0x491151
Capabilities:
Enumerate device drivers on windows
Enumerate process modules
Get process image filename
Query or enumerate registry key
Query or enumerate registry value
Send data
Send file using ftp

Disassembly:
push 8
push 0x4d78a0
call fcn.00430b10
and dword [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_VarDecFromUI1]
call dword [sym.imp.OLEAUT32.dll_VarI4FromUI2]
call dword [sym.imp.OLEAUT32.dll_VarUI2FromUI4]
call dword [sym.imp.OLEAUT32.dll_VarAdd]
call dword [sym.imp.OLEAUT32.dll_VarI2FromCy]
call dword [sym.imp.OLEAUT32.dll_VarUI8FromCy]
call dword [sym.imp.OLEAUT32.dll_VarUI8FromI2]
call dword [sym.imp.OLEAUT32.dll_VarR4FromI2]
call dword [sym.imp.OLEAUT32.dll_VarUI4FromUI2]
call dword [sym.imp.OLEAUT32.dll_VarAbs]
call dword [sym.imp.OLEAUT32.dll_VarI4FromCy]
call dword [sym.imp.OLEAUT32.dll_VarMod]
call dword [sym.imp.OLEAUT32.dll_VarUI1FromUI4]
call dword [sym.imp.OLEAUT32.dll_VarBstrFromR8]
call dword [sym.imp.OLEAUT32.dll_VarDecFromDisp]
call dword [sym.imp.OLEAUT32.dll_VarDecNeg]
call dword [sym.imp.OLEAUT32.dll_VarUI1FromUI8]
call dword [sym.imp.OLEAUT32.dll_VarFormatFromTokens]
call dword [sym.imp.OLEAUT32.dll_SetErrorInfo]
call dword [sym.imp.OLEAUT32.dll_VarR4FromDisp]
call dword [sym.imp.OLEACC.dll_ObjectFromLresult]
call dword [sym.imp.OLEACC.dll_CreateStdAccessibleProxyA]
call dword [sym.imp.OLEACC.dll_WindowFromAccessibleObject]
call dword [sym.imp.OLEACC.dll_CreateStdAccessibleObject]
call dword [sym.imp.OLEACC.dll_AccessibleObjectFromEvent]
call dword [sym.imp.OLEACC.dll_CreateStdAccessibleProxyW]
call dword [sym.imp.OLEACC.dll_AccessibleObjectFromPoint]
call dword [sym.imp.OLEACC.dll_AccessibleObjectFromWindow]
call dword [sym.imp.SHLWAPI.dll_PathSearchAndQualifyA]
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
call dword [sym.imp.SHLWAPI.dll_PathIsSameRootA]
call dword [sym.imp.SHLWAPI.dll_PathMakePrettyW]
call dword [sym.imp.SHLWAPI.dll_SHSkipJunction]
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
call dword [sym.imp.SHLWAPI.dll_IsInternetESCEnabled]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
call dword [sym.imp.SHLWAPI.dll_SHAnsiToAnsi]
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
call dword [sym.imp.SHLWAPI.dll_PathCompactPathA]
call dword [sym.imp.SHLWAPI.dll_StrRChrIA]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
call dword [sym.imp.SHLWAPI.dll_StrFromTimeIntervalW]
call dword [sym.imp.SHLWAPI.dll_UrlIsA]
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
call dword [sym.imp.SHLWAPI.dll_SHRegQueryUSValueA]
call dword [sym.imp.GDI32.dll_SetEnhMetaFileBits]
call dword [sym.imp.GDI32.dll_PatBlt]
call dword [sym.imp.GDI32.dll_GetCharWidthI]
call dword [sym.imp.GDI32.dll_EnumICMProfilesA]
call dword [sym.imp.GDI32.dll_ArcTo]
call dword [sym.imp.GDI32.dll_EnumFontsW]
call dword [sym.imp.GDI32.dll_GetROP2]
call dword [sym.imp.GDI32.dll_PtInRegion]
call dword [sym.imp.GDI32.dll_ExtEscape]
call dword [sym.imp.GDI32.dll_LineTo]
call dword [sym.imp.GDI32.dll_DeleteColorSpace]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
call dword [sym.imp.GDI32.dll_GetStockObject]
call dword [sym.imp.GDI32.dll_UnrealizeObject]
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
call dword [sym.imp.GDI32.dll_RemoveFontMemResourceEx]
call dword [sym.imp.GDI32.dll_CreateDCW]
call dword [sym.imp.GDI32.dll_FixBrushOrgEx]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
call dword [sym.imp.WININET.dll_InternetSetCookieA]
call dword [sym.imp.WININET.dll_InternetGetCookieExW]
call dword [sym.imp.WININET.dll_InternetSetOptionExA]
call dword [sym.imp.WININET.dll_GopherGetLocatorTypeA]
call dword [sym.imp.WININET.dll_InternetCreateUrlA]
call dword [sym.imp.WININET.dll_ReadUrlCacheEntryStream]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryExA]
call dword [sym.imp.WININET.dll_FtpPutFileW]
call dword [sym.imp.WININET.dll_InternetUnlockRequestFile]
call dword [sym.imp.WININET.dll_FtpGetCurrentDirectoryW]
call dword [sym.imp.WININET.dll_InternetWriteFile]
call dword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryStream]
call dword [sym.imp.WININET.dll_InternetTimeFromSystemTimeW]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
call dword [sym.imp.WININET.dll_InternetTimeToSystemTimeW]
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
call dword [sym.imp.WININET.dll_CommitUrlCacheEntryA]
call dword [sym.imp.WININET.dll_FtpPutFileEx]
call dword [sym.imp.WININET.dll_GopherCreateLocatorW]
call dword [sym.imp.PSAPI.DLL_GetWsChangesEx]
call dword [sym.imp.PSAPI.DLL_GetDeviceDriverFileNameA]
call dword [sym.imp.PSAPI.DLL_EnumDeviceDrivers]
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
call dword [sym.imp.PSAPI.DLL_QueryWorkingSet]
call dword [sym.imp.PSAPI.DLL_EmptyWorkingSet]
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
call dword [sym.imp.PSAPI.DLL_GetWsChanges]
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
call dword [sym.imp.PSAPI.DLL_EnumProcessModulesEx]
call dword [sym.imp.PSAPI.DLL_GetPerformanceInfo]
call dword [sym.imp.PSAPI.DLL_EnumPageFilesA]
call dword [sym.imp.PSAPI.DLL_QueryWorkingSetEx]
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
call dword [sym.imp.PSAPI.DLL_EnumPageFilesW]
call dword [sym.imp.PSAPI.DLL_GetProcessMemoryInfo]
call dword [sym.imp.PSAPI.DLL_GetDeviceDriverFileNameW]
call dword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
call dword [sym.imp.COMCTL32.dll_GetEffectiveClientRect]
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
call dword [sym.imp.COMCTL32.dll_DPA_Clone]
call dword [sym.imp.COMCTL32.dll_DPA_Grow]
call dword [sym.imp.COMCTL32.dll_Ordinal_343]
call dword [sym.imp.COMCTL32.dll_DPA_Destroy]
call dword [sym.imp.COMCTL32.dll_UninitializeFlatSB]
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
call dword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
call dword [sym.imp.COMCTL32.dll_LBItemFromPt]
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
call dword [sym.imp.COMCTL32.dll_DPA_DeleteAllPtrs]
call dword [sym.imp.COMCTL32.dll_DSA_InsertItem]
call dword [sym.imp.COMCTL32.dll_FlatSB_GetScrollInfo]
call dword [sym.imp.COMCTL32.dll_Ordinal_347]
call dword [sym.imp.COMCTL32.dll_DPA_GetPtr]
call dword [sym.imp.COMCTL32.dll_ImageList_Merge]
call dword [sym.imp.COMCTL32.dll_InitMUILanguage]
jmp 0x49146a
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret