Function at 0x4cae80
Capabilities:
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb145
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call fcn.00413260
test al, al
je 0x4caec5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3bc]
call fcn.00413260
test al, al
je 0x4caeeb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3bc]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3dc], 0
je 0x4caf1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c0]
call fcn.00413260
test al, al
je 0x4caf1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c0]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e0], 0
je 0x4caf4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.00413260
test al, al
je 0x4caf4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e0], 0
je 0x4caf81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.00413260
test al, al
je 0x4caf81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e4], 0
je 0x4cafb3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.00413260
test al, al
je 0x4cafb3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e8], 0
je 0x4cafe5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.00413260
test al, al
je 0x4cafe5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3ec], 0
je 0x4cb017
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
call fcn.00413260
test al, al
je 0x4cb017
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3f0], 0
je 0x4cb0d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00413260
test al, al
je 0x4cb0d9
mov dword [ebp - 8], 0xa
jmp 0x4cb0a5
dec dword [ebp - 8]
xor eax, eax
push ebp
push 0x4cb07f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4cb160
call fcn.004c684c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb089
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00413260
test al, al
je 0x4cb0a5
push 0x1f4
call sub.KERNEL32.DLL_Sleep
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00413260
test al, al
je 0x4cb0bd
cmp dword [ebp - 8], 0
jg 0x4cb046
push 0x4cb19c
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4cb1d0
mov edx, 0x80000002
mov al, 1
call fcn.004c6e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f4]
call fcn.004085a8
mov esi, eax
test esi, esi
jl 0x4cb12f
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f4]
cmp dword [eax + ebx*4], 0
je 0x4cb12b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov eax, dword [eax + ebx*4]
call fcn.00413260
test al, al
je 0x4cb12b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov eax, dword [eax + ebx*4]
call fcn.00406fd8
push eax
call sub.KERNEL32.DLL_DeleteFileW
inc ebx
dec esi
jne 0x4cb0f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb14c
lea eax, [ebp - 0xc]
call fcn.00406f3c
ret