Function at 0x497dc0
Capabilities:
Clear file content
Create directory
Create process on windows
Enumerate files on windows
Get common file path
Get disk information
Get disk size
Get file attributes
Get file system object information
Set file attributes
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.RPCRT4.dll_NdrClientInitializeNew]
push 0
push 0
push 0
call dword [sym.imp.RPCRT4.dll_NdrComplexArrayFree]
push 0
push 0
push 0
call dword [sym.imp.RPCRT4.dll_NdrComplexArrayBufferSize]
push 0
push 0
push 0
call sub.RPCRT4.dll_NdrClientCall2
add esp, 0xc
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.RPCRT4.dll_NdrClientInitialize]
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, 0x508820
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.WS2_32.dll_WSAConnect]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.WININET.dll_InternetErrorDlg]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileW]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.SETUPAPI.dll_SetupGetBinaryField]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoW]
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [sym.imp.IMAGEHLP.dll_MapFileAndCheckSumW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, dword [sym.imp.IMAGEHLP.dll_MapFileAndCheckSumA]
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [ebp - 4]
or edx, eax
mov dword [ebp - 4], edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [ebp - 4]
or ecx, eax
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
mov edx, dword [ebp - 4]
or edx, eax
mov dword [ebp - 4], edx
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
or ecx, eax
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [ebp - 4]
or edx, eax
mov dword [ebp - 4], edx
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp loc.0223f891