Function at 0x10004fc0
Capabilities:
Delete file
Get system firmware table
Move file
Swap mouse buttons

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.USER32.dll_CharLowerW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
push 0
call dword [sym.imp.USER32.dll_DdeFreeDataHandle]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PrivateExtractIconsW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeConnect]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollPos]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
call dword [sym.imp.USER32.dll_SwapMouseButton]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
push 0
push dword [ebp - 4]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push str.Y86OJexLSsXcTtH1E1m2Q
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
xor ecx, ecx
lock xadd dword [ecx], eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
push 0
push 0
push str.8kcQDYKj4l43jH7BF5Y
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov esp, ebp
pop ebp
ret