Function at 0x4150fa
Capabilities:
Check mutex on windows
Delete directory
Delete file
Delete registry key
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x46c
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push ebp
push esi
push edi
push str.MUTEX_XREVEAL
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x415175
push ebx
push str.XrevealWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x415175
push 0x24
push ebx
push 0xa6f407ca
mov edx, 0x9d2ecce8
mov ecx, 0xf778d1a4
call fcn.00401534
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x415462
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x268]
push 1
push 0x10
push eax
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x268]
push eax
call ebx
lea esi, [esp + 0x268]
mov edx, 0x8877d2b9
push 0xb3ad19bb
mov ecx, 0xe221cc59
lea esi, [esi + eax*2]
call fcn.00401534
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4151bb
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x268]
push eax
call ebp
push 1
push 0x17
lea eax, [esp + 0x270]
push eax
push 0
call edi
lea eax, [esp + 0x268]
push eax
call ebx
lea esi, [esp + 0x268]
mov edx, 0x45a9bc2c
push 0x7e73772e
mov ecx, 0x2fffa2e8
lea esi, [esi + eax*2]
call fcn.00401534
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x415215
lea eax, [esp + 0x268]
push eax
call ebp
push 0x104
lea eax, [esp + 0x26c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x268]
push 0x5c
push eax
call fcn.004b3fe0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x415371
push 0xc9d37250
mov edx, 0xf209b953
mov ecx, 0x985fa78b
add esi, 2
call fcn.00401534
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x41527a
lea eax, [esp + 0x268]
push eax
call ebp
push 0x4cb72abf
mov edx, 0x776de1bc
mov ecx, 0x1d3bff0e
call fcn.00401534
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4152ac
lea eax, [esp + 0x268]
push eax
call ebp
push 0x3702b175
mov edx, 0xcd87a75
mov ecx, 0x668e64e1
call fcn.00401534
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4152de
and dword [esp + 0x18], 0
lea eax, [esp + 0x1c]
push 0x24c
push 0
push eax
call fcn.004b6030
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415371
lea edi, [esi + 0x12]
lea eax, [esp + 0x44]
sub edi, eax
lea ecx, [esp + 0x44]
movzx eax, word [ecx]
mov word [edi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x41532d
lea eax, [esp + 0x268]
push eax
call ebp
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415329
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov word [esi + 0x12], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x268]
call fcn.0040887f
push 0xb6ffceb4
mov edx, 0x8d2505b3
mov ecx, 0xe7731bc7
mov esi, eax
call fcn.00401534
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x415398
lea eax, [esp + 0x268]
push eax
call ebp
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x268]
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push eax
call fcn.004b4a31
lea esi, [esp + 0x270]
mov edx, 0xd11e5da0
push 0xeac496a5
mov ecx, 0xbb4843e6
add esi, eax
call fcn.00401513
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4153f8
lea eax, [esp + 0x14]
push eax
push 0x2000e
push 0
lea eax, [esp + 0x274]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41543e
push 0x4e8940
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor cl, cl
call fcn.00407fab
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor ecx, ecx
call fcn.00414060
call fcn.00414e9b
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x46c
ret