Function at 0x4cf1a0
Capabilities:
Create directory
Create process on windows
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4feb9b
mov eax, dword fs:[0]
push eax
mov eax, 0xa278
call fcn.004f18a0
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str._get_pnp_publicName_
push str.Driver
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xa188], eax
call fcn.004a5390
xor eax, eax
push 0x3f
xor edi, edi
lea ecx, [ebp - 0x6b]
push edi
push ecx
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0xa17d], al
mov byte [ebp - 0x6c], al
call fcn.004e7d90
add esp, 0x14
push edi
push str.c:_temp
call fcn.004e5d05
add esp, 8
cmp eax, 0xffffffff
jne 0x4cf24d
push edi
push 0x529b64
mov byte [ebp - 0xa17e], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4cf254
mov byte [ebp - 0xa17e], 1
push 0x38
lea edx, [ebp - 0xa1c8]
push edi
push edx
call fcn.004e7d90
add esp, 0xc
lea eax, [ebp - 0xa1cc]
push eax
mov dword [ebp - 0xa1cc], 0x3c
mov dword [ebp - 0xa1c8], 0x40
mov dword [ebp - 0xa1c4], edi
mov dword [ebp - 0xa1c0], edi
mov dword [ebp - 0xa1bc], str.cmd.exe
mov dword [ebp - 0xa1b8], str._c_PnPutil.exe__e___c:_tempPnPlist.tmp
mov dword [ebp - 0xa1b4], 0x529b64
mov dword [ebp - 0xa1b0], edi
mov dword [ebp - 0xa1ac], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0xa194]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x4cf4c1
push edi
push str.c:_tempPnPlist.tmp
call fcn.004e5d05
add esp, 8
test eax, eax
jne 0x4cf4c1
push 0xa000
lea edx, [ebp - 0xa17b]
push edi
push edx
mov byte [ebp - 0xa17c], al
call fcn.004e7d90
add esp, 0xc
lea eax, [ebp - 0xa284]
push eax
call fcn.004cffc0
mov eax, str.c:_tempPnPlist.tmp
lea esi, [ebp - 0xa284]
mov dword [ebp - 4], edi
call fcn.004d0190
mov ecx, dword [ebp - 0xa284]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0xa278], 6
je 0x4cf36c
lea ecx, [ebp - 0xa214]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
call fcn.004d00c0
lea eax, [ebp - 0xa214]
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004f80ba
add esp, 4
jmp 0x4cf4c3
push edi
push 0xa001
lea ecx, [ebp - 0xa17c]
push ecx
lea edx, [ebp - 0xa284]
push edx
call fcn.004cfb10
lea esi, [ebp - 0xa284]
call fcn.004d01e0
lea eax, [ebp - 0xa17c]
push str.SunMoon
push eax
call fcn.004e4260
add esp, 8
cmp eax, edi
je 0x4cf492
push 0x2c
add eax, 0xffffffd4
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.004e42f0
add esp, 0xc
lea edx, [ebp - 0x6c]
push 0x529c34
push edx
call fcn.004e4260
add esp, 8
cmp eax, edi
je 0x4cf47c
push 0xa
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004e42f0
lea eax, [ebp - 0x20]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cf3f0
sub eax, edx
add eax, 0xfffffff8
cmp eax, 2
ja 0x4cf47c
mov al, 0x66
cmp byte [ebp - 0x19], al
jne 0x4cf44a
mov byte [ebp - 0x18], cl
cmp byte [ebp - 0x17], al
jne 0x4cf414
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x20]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cf420
sub eax, edx
sub eax, 8
je 0x4cf461
dec eax
je 0x4cf45b
dec eax
je 0x4cf455
lea eax, [ebp - 0xa284]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
call fcn.004cf180
jmp 0x4cf4c3
cmp byte [ebp - 0x18], al
jne 0x4cf40b
mov byte [ebp - 0x17], 0
jmp 0x4cf414
cmp byte [ebp - 0x1a], 0x2e
jmp 0x4cf465
cmp byte [ebp - 0x1b], 0x2e
jmp 0x4cf465
cmp byte [ebp - 0x1c], 0x2e
lea eax, [ebp - 0xa284]
sete bl
mov dword [ebp - 4], 0xffffffff
call fcn.004cf180
jmp 0x4cf4c3
lea eax, [ebp - 0xa284]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
call fcn.004cf180
jmp 0x4cf4c3
lea ecx, [ebp - 0xa214]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
call fcn.004d00c0
lea ecx, [ebp - 0xa214]
push ecx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004f80ba
add esp, 4
jmp 0x4cf4c3
xor bl, bl
cmp byte [ebp - 0xa17e], 0
jne 0x4cf4da
push edi
push str.rd_c:_temp__Q__S
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4cf4e5
push str.c:_tempPnPlist.tmp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp bl, 1
jne 0x4cf50b
mov edx, dword [ebp - 0xa188]
lea eax, [ebp - 0x20]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4cf4f7
push str._get_publicName_by_enum_success_
jmp 0x4cf672
push 0x103
lea edx, [ebp - 0x173]
push edi
push edx
mov dword [ebp - 0xa184], edi
call fcn.004e7d90
mov ecx, 9
mov esi, str.SystemCurrentControlSetServicesSmrf
lea edi, [ebp - 0x174]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
lea eax, [ebp - 0xa184]
push eax
push 0x20019
push 0
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x174]
push ecx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xa18c], 0x104
mov dword [ebp - 0xa190], 1
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf61b
lea edx, [ebp - 0xa18c]
push edx
mov edx, dword [ebp - 0xa184]
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0xa190]
push ecx
push 0
push str.PublicName
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4cf61b
lea eax, [ebp - 0x174]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cf5b0
sub eax, edx
add eax, 0xfffffff8
cmp eax, 2
ja 0x4cf61b
xor eax, eax
mov cl, byte [ebp + eax - 0x174]
mov byte [ebp + eax - 0x2c], cl
inc eax
test cl, cl
jne 0x4cf5c3
lea eax, [ebp - 0x2c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cf5e0
sub eax, edx
sub eax, 8
je 0x4cf60e
dec eax
je 0x4cf601
dec eax
jne 0x4cf622
cmp byte [ebp - 0x26], 0x2e
sete byte [ebp - 0xa17d]
jmp 0x4cf622
cmp byte [ebp - 0x27], 0x2e
sete byte [ebp - 0xa17d]
jmp 0x4cf622
cmp byte [ebp - 0x28], 0x2e
sete byte [ebp - 0xa17d]
jmp 0x4cf622
mov byte [ebp - 0xa17d], 0
mov eax, dword [ebp - 0xa184]
test eax, eax
je 0x4cf633
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0xa17d], 0
jne 0x4cf656
push str._get_publicName_fail_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a5390
add esp, 8
xor al, al
jmp 0x4cf685
mov edx, dword [ebp - 0xa188]
lea eax, [ebp - 0x2c]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4cf663
push str._get_publicName_by_Reg_success_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a5390
mov al, 1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret