Function at 0x442500
Capabilities:
Delete file
Enumerate files on windows
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb4
mov edi, dword [0x4be784]
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x442778
mov eax, dword [0x4beee0]
mov ax, word [eax]
mov word [edi + 0x1e1c], ax
cmp byte [edi + 0x18d5], 0
je 0x442554
mov eax, dword [0x4bef14]
cmp byte [eax], 2
seta al
and eax, 0x7f
mov edx, dword [0x4bec5c]
mov dx, word [edx]
mov word [edi + eax*2 + 0x17b8], dx
mov eax, dword [0x4be9d4]
mov al, byte [eax + 0xd]
mov byte [edi + 0x190c], al
mov eax, dword [0x4be588]
cmp word [eax], 0
jle 0x44257c
mov eax, dword [0x4be588]
mov ax, word [eax]
mov word [edi + 0x17be], ax
mov eax, dword [0x4be918]
cmp byte [eax], 0
jne 0x44258b
call fcn.004b00c8
mov eax, dword [0x4bef80]
cmp byte [eax], 0
jne 0x442620
mov eax, dword [0x4be3dc]
cmp byte [eax], 0
je 0x4425e6
push esp
mov eax, dword [0x4be88c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
xor eax, eax
mov al, byte [edi + 0x18a0]
imul eax, eax, 0x12c
push eax
mov eax, dword [0x4bea48]
mov eax, dword [eax]
push eax
push 3
push 0
mov eax, dword [0x4beb40]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0x442620
push 0
mov eax, dword [0x4beb40]
mov eax, dword [eax + 0x14]
call fcn.004b1c50
push eax
call sub.kernel32.dll__lcreat
mov ebx, eax
xor eax, eax
mov al, byte [edi + 0x18a0]
imul eax, eax, 0x12c
push eax
mov eax, dword [0x4bea48]
mov eax, dword [eax]
push eax
push ebx
call sub.kernel32.dll__hwrite
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp byte [edi + 0x188d], 2
je 0x442636
cmp byte [edi + 0x18d3], 0
je 0x442778
lea edx, [edi + 0x200]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
push 0x442788
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
jmp 0x442767
lea edx, [edi + 0x200]
mov eax, dword [0x4be538]
call fcn.004b81b0
lea eax, [esp + 0x38]
push eax
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4be538]
mov ecx, 0x10000000
mov edx, 0x80000000
call fcn.004adc9c
mov ebx, eax
push 0
push 0
push 0x110
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 2
mov eax, dword [0x4beed8]
push eax
push ebx
call sub.kernel32.dll__lread
push 1
push 0
mov eax, dword [0x4beed8]
movzx eax, word [eax]
add eax, 0x22
add eax, 4
push eax
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 4
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll__lread
push 1
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll__lread
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp byte [edi + 0x188d], 2
jne 0x442722
mov eax, dword [0x4bee1c]
mov eax, dword [eax]
cmp eax, dword [esp + 4]
jne 0x442722
cmp byte [esp + 8], 1
je 0x442722
cmp byte [esp + 8], 0xf
jne 0x442732
cmp byte [edi + 0x18d3], 0
je 0x442752
cmp byte [esp + 8], 0xf
jne 0x442752
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x4be538]
call fcn.004adcfc
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.004b19b4
lea eax, [esp + 0xc]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x442772
cmp byte [esp + 0x38], 0
jne 0x442672
push esi
call sub.kernel32.dll_FindClose
call fcn.004b027c
add esp, 0x14c
pop edi
pop esi
pop ebx
ret