Function at 0x4962e2
Capabilities:
Enumerate files on windows
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x205a0]
mov eax, 0x205a0
call fcn.004a1280
push 0xffffffffffffffff
push 0x50d205
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp + 0x2059c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
xor eax, eax
cmp dword [0x558d80], 0x40
lea ecx, [ebp - 0x14]
setne al
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
dec eax
and eax, 0x100
inc eax
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x496392
push ebx
push 1
lea ecx, [ebp + 0x205b0]
call fcn.0040184d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2059c]
xor ecx, ebp
call fcn.0049a49b
add ebp, 0x205a0
leave
ret 0x28
xor eax, eax
push 0x1fffe
mov word [ebp + 0x314], ax
lea eax, [ebp + 0x316]
push ebx
push eax
call fcn.0049d740
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x314]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push str.DevicePath
push dword [ebp - 0x14]
mov dword [ebp - 0x34], 0x20000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
test eax, eax
je 0x4963e7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49635d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x314]
push eax
lea ecx, [ebp + 0x2dc]
mov dword [ebp - 0x14], ebx
call fcn.00401685
mov byte [ebp - 4], 1
cmp dword [ebp + 0x2f0], ebx
ja 0x496435
mov byte [ebp - 0xd], bl
push ebx
push 1
lea ecx, [ebp + 0x2dc]
call fcn.0040184d
push ebx
push 1
lea ecx, [ebp + 0x205b0]
call fcn.0040184d
mov al, byte [ebp - 0xd]
jmp 0x49636d
lea ecx, [ebp - 0x50]
call fcn.00479951
push ebx
lea ecx, [ebp + 0x2a4]
xor esi, esi
mov dword [ebp + 0x2bc], 7
call fcn.00401afa
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], 0x3b
push 1
push esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x2dc]
call fcn.00403874
mov edi, eax
sub eax, esi
push eax
push esi
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp + 0x2dc]
call fcn.004037a5
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x2a4]
mov byte [ebp - 4], 4
call fcn.004019f3
push ebx
push 1
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 3
call fcn.0040184d
cmp dword [ebp + 0x2b8], ebx
jbe 0x4964c6
lea eax, [ebp + 0x2a4]
push eax
lea ecx, [ebp - 0x50]
call fcn.00425091
cmp edi, 0xffffffff
jne 0x4964d1
mov edi, dword [ebp + 0x2f0]
lea esi, [edi + 1]
cmp esi, dword [ebp + 0x2f0]
jb 0x496460
xor eax, eax
push 0x3e
mov word [ebp + 0x2051c], ax
lea eax, [ebp + 0x2051e]
push ebx
push eax
mov byte [ebp - 0xd], bl
call fcn.0049d740
xor eax, eax
push 0x3e
mov word [ebp + 0x2055c], ax
lea eax, [ebp + 0x2055e]
push ebx
push eax
call fcn.0049d740
add esp, 0x18
cmp byte [ebp + 0x205cc], bl
je 0x496532
lea eax, [ebp + 0x2051c]
push 0x51f4f4
push eax
call fcn.0040618e
push str.class_ffsubclass_42
jmp 0x496568
movzx edi, word [ebp + 0x205ac]
movzx eax, word [ebp + 0x205a8]
push edi
push eax
mov esi, str.vid__04xpid__04x
lea eax, [ebp + 0x2051c]
push esi
push eax
call fcn.0040618e
mov eax, dword [ebp - 0x20]
add esp, 0x10
cmp byte [eax], bl
je 0x496579
movzx eax, word [ebp + 0x205a8]
push edi
push eax
push esi
lea eax, [ebp + 0x2055c]
push eax
call fcn.0040618e
add esp, 0x10
jmp 0x49658c
lea eax, [ebp + 0x2055c]
push str.class_ffsubclass_42
push eax
call fcn.0040618e
pop ecx
pop ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00425640
push 0x535d58
lea ecx, [ebp + 0x205b0]
call fcn.00403d14
test eax, eax
jne 0x4965cb
push str..inf
lea ecx, [ebp - 0x78]
call fcn.00401685
xor edi, edi
inc edi
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], edi
jmp 0x4965d4
xor edi, edi
lea eax, [ebp + 0x205b0]
inc edi
push eax
lea ecx, [ebp + 0x250]
call fcn.00403757
test byte [ebp - 0x18], 1
mov dword [ebp - 4], 7
je 0x4965f7
push ebx
push edi
lea ecx, [ebp - 0x78]
call fcn.0040184d
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
call fcn.00425640
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.00476e9e
test al, al
jne 0x4968a4
mov esi, 0x538040
xor eax, eax
push 0x206
mov word [ebp + 0x20314], ax
lea eax, [ebp + 0x20316]
push ebx
push eax
call fcn.0049d740
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.0047981f
cmp dword [eax + 0x18], 8
jb 0x496650
mov eax, dword [eax + 4]
jmp 0x496653
add eax, 4
push 0x104
lea ecx, [ebp + 0x20314]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x20314]
push eax
lea ecx, [ebp + 0x26c]
call fcn.00401685
push ebx
lea ecx, [ebp + 0x2c0]
mov dword [ebp + 0x2d8], 7
call fcn.00401afa
push esi
lea eax, [ebp + 0x26c]
push eax
lea eax, [ebp + 0x2f8]
push eax
mov byte [ebp - 4], 9
call fcn.00409dbb
lea ecx, [ebp + 0x250]
push ecx
push eax
lea eax, [ebp + 0x288]
push eax
mov byte [ebp - 4], 0xa
call fcn.0041214a
add esp, 0x18
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x2c0]
mov byte [ebp - 4], 0xb
call fcn.004019f3
push ebx
push edi
lea ecx, [ebp + 0x288]
call fcn.0040184d
push ebx
push edi
lea ecx, [ebp + 0x2f8]
mov byte [ebp - 4], 9
call fcn.0040184d
push 0x250
lea eax, [ebp]
push ebx
push eax
call fcn.0049d740
mov eax, dword [ebp + 0x2c4]
add esp, 0xc
cmp dword [ebp + 0x2d8], 8
jae 0x496719
lea eax, [ebp + 0x2c4]
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x49685b
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp + 0x2f8]
call fcn.00401685
push 0x5384dc
lea ecx, [ebp + 0x2f8]
mov byte [ebp - 4], 0xc
call fcn.00403d14
test eax, eax
je 0x496814
push 0x5384e0
lea ecx, [ebp + 0x2f8]
call fcn.00403d14
test eax, eax
je 0x496814
push esi
lea eax, [ebp + 0x26c]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00409dbb
lea ecx, [ebp + 0x2f8]
push ecx
push eax
lea eax, [ebp + 0x288]
push eax
mov byte [ebp - 4], 0xd
call fcn.0041214a
add esp, 0x18
push ebx
push edi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0xf
call fcn.0040184d
sub esp, 0x1c
lea eax, [ebp + 0x2055c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00401685
sub esp, 0x1c
lea eax, [ebp + 0x2051c]
mov ecx, esp
mov dword [ebp - 0x5c], esp
push eax
mov byte [ebp - 4], 0x10
call fcn.00401685
sub esp, 0x1c
lea eax, [ebp + 0x288]
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
mov byte [ebp - 4], 0x11
call fcn.00403757
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0xf
call fcn.00495fd3
push ebx
lea ecx, [ebp + 0x288]
push edi
cmp al, 1
je 0x49683c
call fcn.0040184d
push ebx
push edi
lea ecx, [ebp + 0x2f8]
mov byte [ebp - 4], 9
call fcn.0040184d
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x496730
jmp 0x496852
mov byte [ebp - 0xd], 1
call fcn.0040184d
push ebx
push edi
lea ecx, [ebp + 0x2f8]
call fcn.0040184d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push edi
lea ecx, [ebp + 0x2c0]
call fcn.0040184d
push ebx
push edi
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 7
call fcn.0040184d
lea ecx, [ebp - 0x28]
call fcn.0049345c
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
call fcn.00425640
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.00476e9e
test al, al
je 0x49661f
push ebx
push edi
lea ecx, [ebp + 0x250]
call fcn.0040184d
push ebx
push edi
lea ecx, [ebp + 0x2a4]
call fcn.0040184d
lea ecx, [ebp - 0x50]
call fcn.00479b67
push dword [ebp - 0x50]
call fcn.0049a490
mov al, byte [ebp - 0xd]
pop ecx
mov byte [ebp - 0xd], al
jmp 0x496411