Function at 0x4056a0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x670
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x66c], eax
cmp dword [0x42404c], 0
push ebp
mov ebp, dword [esp + 0x678]
push edi
mov dword [esp + 0xc], ebp
je 0x40586b
mov edi, dword [esp + 0x680]
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
cmp edi, 0x1388
jl 0x4050b6
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop
cmp edi, 0x1770
jg 0x4050b2
push 0x104
lea eax, [esp + 0x478]
mov esi, 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x474]
push eax
call fcn.0040b2c1
add esp, 4
lea eax, [esp + 0x1c]
push eax
push str..scr
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
je 0x404f60
push 0
lea eax, [esp + 0x270]
mov esi, 0x1389
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, esi
je 0x404fff
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x404f59
push 0
lea eax, [esp + 0x270]
inc esi
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp esi, edi
je 0x404f33
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404f02
jmp 0x404f59
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42456c]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x474]
push eax
call fcn.0040b2c1
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x20]
add esp, 4
push eax
push str..scr
call ebp
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x404e80
mov ebp, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x26c]
push 0
push eax
push 0x104
lea eax, [esp + 0x54]
inc esi
push eax
call ebp
cmp esi, edi
jne 0x40502a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42456c]
call ebx
add edi, 0xfffffb28
cmp edi, 0x13
ja case.0x405308.10030
jmp dword [edi*4 + 0x4059dc]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4050a3
nop dword [eax]
push 0
lea eax, [esp + 0x270]
inc esi
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call ebp
cmp esi, edi
je 0x40507d
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405040
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x404fe9
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42456c]
call ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x404fe9
mov ebp, dword [esp + 0x14]
cmp edi, 0x2724
jg 0x4052fd
je 0x4052da
cmp edi, 0x4d7
jg 0x404fe9
je 0x4050f4
cmp edi, 0x12c
jne case.0x405308.10030
push 0
push 0
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x405308.10030
push 1
push 0
push 0
push str.control.exe
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 0
push 0x4072c0
push dword [0x42456c]
push str.DLGG
push dword [0x4241ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x405308.10030
push 1
push str.control__name_Microsoft.AdministrativeTools
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x405308.10030
push 1
push str.control__name_Microsoft.DeviceManager
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x405308.10030
push 1
push str.control__name_Microsoft.WindowsFirewall
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x405308.10030
push 5
push 0
push 0
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 1
push 0
push 0
push str.msinfo32.exe
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 1
push 0
push 0
push str.msconfig.exe
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 1
push 0
push 0
push str.cleanmgr.exe
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 5
push 0
push 0
push str.dfrgui.exe
push str.open
push dword [0x42456c]
call ebx
cmp eax, 2
jne case.0x405308.10030
push 5
push 0
push 0
push str.dfrg.msc
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 5
push 0
push 0
push str.services.msc
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 5
push 0
push 0
push str.compmgmt.msc
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 5
push 0
push 0
push str.gpedit.msc
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push str.sysdm.cpl
call fcn.004047a0
jmp 0x4052e1
push str.desk.cpl
call fcn.004047a0
jmp 0x4052e1
push str.timedate.cpl
call fcn.004047a0
jmp 0x4052e1
push str.mmsys.cpl
call fcn.004047a0
jmp 0x4052e1
push str.appwiz.cpl
call fcn.004047a0
jmp 0x4052e1
push str.ncpa.cpl
call fcn.004047a0
jmp 0x4052e1
push str.powercfg.cpl
call fcn.004047a0
jmp 0x4052e1
call fcn.00402f00
push 5
push 0x4188b4
push 0x4189f0
jmp 0x40580a
push 0xa
call fcn.00404320
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
add edi, 0xffffd8db
cmp edi, 0x3d
ja case.0x405308.10030
jmp dword [edi*4 + 0x405a2c]
push 1
push 0
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push str.Hide1
push 0x275c
call fcn.00405e30
add esp, 8
call fcn.00404640
jmp case.0x405308.10030
push str.Hide2
push 0x275d
call fcn.00405e30
add esp, 8
call fcn.00404640
jmp case.0x405308.10030
push str.Hide3
push 0x275e
call fcn.00405e30
add esp, 8
call fcn.00404640
jmp case.0x405308.10030
push str.Hide4
push 0x275f
call fcn.00405e30
add esp, 8
call fcn.00404640
jmp case.0x405308.10030
push str.Hide5
push 0x2760
call fcn.00405e30
add esp, 8
call fcn.00404640
jmp case.0x405308.10030
push 0
push 0x403ae0
push dword [0x42456c]
push str.DLGRBIN
push dword [0x4241ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x405308.10030
push str.RecycleAuto
push 0x2751
call fcn.00405e30
add esp, 8
call fcn.004070e0
jmp case.0x405308.10030
push 0
push 0
push ebp
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
jmp case.0x405308.10030
push 1
push 0xf
push 0x423c38
push ebp
call fcn.00401149
jmp case.0x405308.10030
push 4
push 0xf
push 0x423c38
push ebp
call fcn.00401149
jmp case.0x405308.10030
push 3
push 0xf
push 0x423c38
push ebp
call fcn.00401149
jmp case.0x405308.10030
push 5
push 0x4188b4
push 0x4188b4
push str.http:__www.wintools.net
push str.open
push ebp
call ebx
jmp case.0x405308.10030
push 5
push 0x4188b4
push 0x4188b4
push str.mailto:ramsaver_wintools.net
push str.open
push ebp
call ebx
jmp case.0x405308.10030
push 0x423418
push 0x418924
jmp 0x40549b
push 0x423418
push 0x418944
jmp 0x40549b
push 0x423418
push 0x418948
push 0x418928
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.00407000
jmp case.0x405308.10030
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, 0x91a2b3c5
mov ebx, edx
shr ebx, 6
mul ebx
mov ecx, ebx
mov edi, edx
shr edi, 0xb
imul eax, edi, 0xe10
sub ecx, eax
mov eax, 0x88888889
mul ecx
mov eax, edi
shl eax, 4
mov esi, edx
shr esi, 5
sub eax, edi
lea eax, [esi + eax*4]
mov ecx, eax
shl ecx, 4
sub ecx, eax
shl ecx, 2
sub ebx, ecx
push ebx
push esi
push edi
push 0x4191c8
call fcn.004044b0
add esp, 4
push eax
lea eax, [esp + 0x27c]
push 0x64
push eax
call fcn.00408280
add esp, 0x18
push ebx
push esi
push edi
push 0x4191d0
call fcn.004044b0
add esp, 4
push eax
lea eax, [esp + 0x2c]
push 0x104
push eax
call fcn.00408280
add esp, 0x18
lea eax, [esp + 0x26c]
push eax
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x30
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x405308.10030
push 0x41894c
push 0x2744
call fcn.00405e30
add esp, 8
call fcn.00407200
jmp case.0x405308.10030
push str.MonCPU
push 0x2761
call fcn.00405e30
add esp, 8
call fcn.00407140
jmp case.0x405308.10030
call fcn.00403f00
jmp case.0x405308.10030
call fcn.00406f90
jmp case.0x405308.10030
push 0
call fcn.00405b30
jmp 0x4052e1
push 2
call fcn.00405b30
jmp 0x4052e1
push 6
call fcn.00405b30
jmp 0x4052e1
push 5
call fcn.00405b30
jmp 0x4052e1
push 1
call fcn.00405b30
jmp 0x4052e1
push str.CDROM
push 0x2740
call fcn.00405e30
add esp, 8
jmp case.0x405308.10030
push str.Noicons
push 0x2741
call fcn.00405e30
add esp, 8
call fcn.00404600
jmp case.0x405308.10030
push str.Nosaver
push 0x273f
call fcn.00405e30
add esp, 8
call fcn.00405e80
jmp case.0x405308.10030
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x405308.10030
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x405308.10030
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.0x405308.10030
xor eax, eax
mov dword [esp + 0x10], 0
push 0x206
push eax
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SOFTWAREWINTOOLSNET
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40571d
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.Path
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4189d0
call fcn.004044b0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 4
push eax
lea eax, [esp + 0x20]
push eax
call esi
push 0x4189d8
call fcn.004044b0
add esp, 4
push eax
lea eax, [esp + 0x270]
push eax
call esi
push 5
push 0x4188b4
push 0x4188b4
lea eax, [esp + 0x480]
push eax
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push 5
push 0x4188b4
push 0x4188b4
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push 0x418924
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push 0x418944
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push 0x418948
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push str.34567
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push 0x4189e4
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push 0x4189e8
jmp 0x40580a
call fcn.00402f00
push 5
push 0x4188b4
push 0x4189ec
push 0x423a30
push str.open
push dword [0x42456c]
call ebx
jmp case.0x405308.10030
push ebp
call fcn.00403f70
jmp 0x4052e1
push 0x14
jmp 0x4052dc
push 0x1e
jmp 0x4052dc
push 0x28
jmp 0x4052dc
push 0x32
jmp 0x4052dc
push 0x3c
jmp 0x4052dc
push 0x46
jmp 0x4052dc
push 0x50
jmp 0x4052dc
push 0x5a
jmp 0x4052dc
push 0x64
jmp 0x4052dc
mov eax, dword [esp + 0x680]
cmp eax, 0x2736
jg 0x40594c
je 0x405918
sub eax, 0x12c
je 0x4058f4
sub eax, 0x2605
je 0x4058ce
sub eax, 4
jne 0x405958
push 5
push 0x4188b4
push 0x4188b4
push str.mailto:ramsaver_wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
push 1
push 0xf
push 0x423c38
push ebp
call fcn.00401149
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
push 0
push 0
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
push 5
push 0x4188b4
push 0x4188b4
push str.http:__www.wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
sub eax, 0x274d
je 0x4059b3
sub eax, 1
je 0x40598d
push 0
push 0x4072c0
push dword [0x42456c]
push str.DLGG
push dword [0x4241ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
push 3
push 0xf
push 0x423c38
push ebp
call fcn.00401149
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret
push 4
push 0xf
push 0x423c38
push ebp
call fcn.00401149
mov ecx, dword [esp + 0x674]
pop edi
pop ebp
xor ecx, esp
call fcn.004082ae
add esp, 0x670
ret