Function at 0x469dc9
Capabilities:
Compare security identifiers
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Query or enumerate registry value
Set current directory
Terminate thread
Write clipboard data

Disassembly:
push 0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_SetClassLongW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
or dword [esp], eax
call dword [sym.imp.USER32.dll_GetMessagePos]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push ecx
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp]
or ecx, eax
push ecx
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov ecx, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov edx, dword [sym.imp.USER32.dll_CheckDlgButton]
or eax, ecx
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp]
push 0
or ecx, eax
mov eax, dword [0x50b768]
push 0
push ecx
push eax
push eax
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp]
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov ecx, dword [esp]
push 0x4db4a0
or ecx, eax
push ecx
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
or dword [esp], eax
mov eax, dword [0x50b768]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [esp]
or ecx, eax
mov dword [esp], ecx
push ecx
mov ecx, dword [0x50b768]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edx, eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
or edx, eax
mov eax, dword [esp]
or eax, edx
lea ecx, [esp]
mov dword [esp], eax
push eax
lea eax, [esp + 4]
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push 0
push ecx
push ecx
push 0
push ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
or eax, edx
mov edx, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
or eax, ecx
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
or eax, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x30], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSid]
mov ecx, dword [esp]
lea edx, [esp]
or ecx, eax
push edx
lea eax, [esp + 4]
push 0
push eax
lea edx, [esp + 0xc]
push 0
push edx
push 0
push ecx
push 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
or eax, edx
mov edx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameW]
or eax, ecx
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
mov edx, dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
or eax, edx
mov edx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
or eax, ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
or eax, edx
mov edx, dword [esp]
or eax, ecx
or edx, eax
mov eax, dword [0x4db324]
push eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
push ecx
push 0
push 0
push 0
mov dword [esp + 0x20], ecx
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov edx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or eax, ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameA]
or eax, edx
mov edx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or eax, ecx
mov ecx, dword [esp]
or eax, edx
or ecx, eax
mov dword [esp], ecx
mov ecx, dword [0x4db324]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, eax
mov eax, dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
or edx, eax
mov eax, dword [esp]
or eax, edx
pop ecx
ret