Function at 0x4c7a3bd0
Capabilities:
Delete file
Enumerate files on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc9c
push ebx
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x22a]
mov esi, 4
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov word [ebp - 0x22c], di
call sub.msvcrt.dll_memset
push 0x206
lea ecx, [ebp - 0x88a]
push edi
push ecx
mov word [ebp - 0x88c], di
call sub.msvcrt.dll_memset
push 0x206
lea edx, [ebp - 0xc9a]
push edi
push edx
mov word [ebp - 0xc9c], di
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push 0x4c782700
push SysStringLen
lea ebx, [edi + 1]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c7a3c90
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
push edi
push 0x4c7826e4
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4c7a3c86
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x22c]
push eax
call fcn.4c7c2030
test eax, eax
je 0x4c7a3f11
push 0x4c7826dc
push 0x4c7826cc
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x88c]
push 0x4c7826b8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 0x14
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x88c]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4c7a3d16
lea esp, [esp]
cmp word [ebp - 0x450], 0x2e
je 0x4c7a3cfd
add ebx, 1
lea edx, [ebp - 0x47c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4c7a3cf0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x88c]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4c7a3d8a
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [ebp - 0x450], 0x2e
je 0x4c7a3d71
sub ebx, 1
cmp ebx, dword [ebp - 4]
jb 0x4c7a3d71
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0xc9c]
push 0x4c7826ac
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xc9c]
push edx
call edi
lea eax, [ebp - 0x47c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4c7a3d33
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
cmp dword [ebp - 4], edi
je 0x4c7a3f11
push 0x206
lea ecx, [ebp - 0x682]
push edi
push ecx
mov word [ebp - 0x684], di
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push edi
push edi
push 2
push esi
mov dword [ebp - 8], edi
call sub.WINSPOOL.DRV_GetPrinterW
mov eax, dword [ebp - 8]
cmp eax, edi
jbe 0x4c7a3e69
push eax
call fcn.4c7c90be
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4c7a3e69
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push 2
push esi
call sub.WINSPOOL.DRV_GetPrinterW
mov edx, dword [ebx + 4]
push edx
lea eax, [ebp - 0x684]
push 0x4c7826a4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp word [ebp - 0x684], di
lea ecx, [ebp - 0x684]
je 0x4c7a3e60
lea esp, [esp]
movzx eax, word [ecx]
cmp ax, 0x5c
je 0x4c7a3e53
cmp ax, 0x2f
je 0x4c7a3e53
cmp ax, 0x3a
je 0x4c7a3e53
cmp ax, 0x2a
je 0x4c7a3e53
cmp ax, 0x3f
je 0x4c7a3e53
cmp ax, 0x3c
je 0x4c7a3e53
cmp ax, 0x3e
je 0x4c7a3e53
cmp ax, 0x7c
jne 0x4c7a3e58
mov word [ecx], 0x5f
add ecx, 2
cmp word [ecx], di
jne 0x4c7a3e20
push ebx
call fcn.4c7c9088
add esp, 4
push 0x206
lea ecx, [ebp - 0xa92]
push edi
push ecx
mov word [ebp - 0xa94], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x16]
movzx edx, word [ebp - 0x18]
push 0x4c7826dc
lea eax, [ebp - 0x684]
push eax
movzx eax, word [ebp - 0x1a]
push ecx
movzx ecx, word [ebp - 0x1c]
push edx
movzx edx, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x22]
push ecx
movzx ecx, word [ebp - 0x24]
push edx
push eax
push ecx
push 0x4c7826cc
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0xa94]
push 0x4c782658
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0xa94]
push ecx
push 0x4c782638
call fcn.4c7c02b0
add esp, 0x3c
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
lea edx, [ebp - 0xa94]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4c7a3f13
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4