Function at 0x4bd240
Capabilities:
Create process on windows
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0
push edi
call fcn.004e6be2
add esp, 8
test eax, eax
jne 0x4bd26d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x61e]
push ecx
mov word [ebp - 0x620], ax
call fcn.004e8ba0
add esp, 0xc
lea edx, [ebp - 0x82c]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSet_servicesTcpipParameters
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x82c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bd30b
lea eax, [ebp - 0x830]
push eax
mov eax, dword [ebp - 0x82c]
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x834]
push edx
push 0
push str.Domain
push eax
mov dword [ebp - 0x834], 1
mov dword [ebp - 0x830], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x82c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x82c], 0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.004e8ba0
lea eax, [ebp - 0x620]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bd332
sub eax, edx
xor ecx, ecx
sar eax, 1
je 0x4bd3a5
push 0x206
push ecx
lea edx, [ebp - 0x826]
push edx
mov word [ebp - 0x828], cx
call fcn.004e8ba0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x828]
push str.Joined_Domain
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x828]
push edx
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
push edi
lea eax, [ebp - 0x210]
push str.__export__mergedpolicy__cfg__s
push eax
call esi
jmp 0x4bd3c9
push str.Not_Joined_to_a_Domain.
push 0x54a0bc
xor edx, edx
call fcn.004a3a40
push edi
lea ecx, [ebp - 0x210]
push str.__export__cfg__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.004e8ba0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebp - 0x418]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4bd405
mov ecx, 0xb
mov esi, str._system32SecEdit.exe
rep movsd dword es:[edi], dword [esi]
call fcn.004bc0d0
test eax, eax
je 0x4bd481
call fcn.004bde60
test eax, eax
je 0x4bd457
push 0
push 0
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
call fcn.004bdec0
jmp 0x4bd4a2
push str.Secedit_Output_64bit_DisableFsRedirection_Failed_
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
jmp 0x4bd493
push 0
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, 0x20
setg al
pop edi
xor ecx, ebp
pop esi
call fcn.004e4746
mov esp, ebp
pop ebp
ret