Function at 0x4f67db
Capabilities:
Create process on windows
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513596
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
mov dword [ebp - 0x2dc], 0
push 0x5a88c0
push 0x5a88d0
push 0x80000002
lea eax, [ebp - 0x2e4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x2e8], eax
mov ecx, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2ec]
push edx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2e4]
call sub.MFC42.DLL_CString::CString
push 0x5a88dc
lea ecx, [ebp - 0x10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f692d
push 0x5b8f1c
lea ecx, [ebp - 0x10]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f692d
lea ecx, [ebp - 0x10]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x90]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x90]
push ecx
push 0x5a88e4
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x190]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4f692d
lea ecx, [ebp - 0x90]
push ecx
push str.Eliminado_Servicio____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5a8928
push 0x5a8938
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b7db4
push str._sDrivers.sys
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4f6960
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0x104
jae 0x4f697b
mov eax, dword [0x5b84b8]
mov byte [ebp + eax - 0x2a4], 0
jmp 0x4f6951
lea ecx, [ebp - 0x2d0]
push ecx
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x2d4], eax
movsx edx, byte [ebp - 0x2a4]
test edx, edx
jne 0x4f69a3
jmp 0x4f6b3b
lea eax, [ebp - 0x2a4]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x13
je 0x4f69ce
cmp dword [ebp - 0x2d8], 0x14
jne 0x4f6b1f
lea ecx, [ebp - 0x2a4]
push ecx
push 0x5b7db4
push str._sDrivers_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5a8968
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jne 0x4f6b0f
push 0x5b6504
call fcn.004aea44
add esp, 4
lea edx, [ebp - 0x2a4]
push edx
push 0x5b7db4
push str.cmd.exe__c__del__sDrivers_s_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea eax, [ebp - 0x2a4]
push eax
push 0x5b7db4
push str._sDrivers_s_____Eliminado_Cutwail_drv__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0
push 0
push str.Eliminado_Cutwail_drv__nReinicie_el_Sistema_para_completar_la_Limpieza.
call sub.MFC42.DLL_AfxMessageBox
call fcn.004ae964
lea ecx, [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x90]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4f6abc
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x2d8]
jge 0x4f6aed
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x90]
cmp eax, 0x2e
jne 0x4f6aeb
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x90], 0
jmp 0x4f6aaf
lea edx, [ebp - 0x90]
push edx
push 0x54
push str.Cutwail_drv_
push str.Software
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4f6b1f
mov eax, dword [ebp - 0x2e0]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x2d4]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4f6993
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret