Function at 0x40465c
Capabilities:
Create process on windows
Empty the recycle bin
Enumerate files on windows
Get common file path
Open clipboard
Query or enumerate registry value

Disassembly:
sub esp, 0x670
mov eax, dword [0x421c40]
xor eax, esp
mov dword [esp + 0x66c], eax
cmp dword [0x42304c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x67c]
push esi
push edi
je 0x404e7a
mov esi, dword [esp + 0x688]
xor edi, edi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, str.open
cmp esi, 0x1388
jl 0x40489d
cmp esi, 0x1770
jg 0x404898
mov eax, 0x1388
mov dword [esp + 0x14], eax
lea eax, [esp + 0x474]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x474]
push eax
call fcn.0040a2b1
pop ecx
lea eax, [esp + 0x1c]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4047a7
mov eax, 0x1389
mov dword [esp + 0x14], eax
lea eax, [esp + 0x26c]
push edi
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp esi, 0x1389
jne 0x404764
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x278]
push eax
jmp 0x404e68
inc dword [esp + 0x14]
lea eax, [esp + 0x26c]
push edi
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [esp + 0x14], esi
je 0x404779
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404741
jmp 0x40479d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42356c]
call ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x474]
push eax
call fcn.0040a2b1
pop ecx
lea eax, [esp + 0x1c]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4046a8
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x26c]
push edi
push eax
push 0x104
lea eax, [esp + 0x54]
inc ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp ebp, esi
jne 0x404853
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42356c]
call ebx
mov ecx, str.open
jmp 0x404a3e
push edi
lea eax, [esp + 0x270]
inc ebp
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp ebp, esi
je 0x404868
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404835
jmp 0x40488c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42356c]
call ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40482b
mov ecx, str.open
mov eax, 0x2735
cmp esi, eax
jg 0x404c0f
je 0x404bfc
mov eax, 0x4e8
cmp esi, eax
jg 0x404a22
je 0x404a10
add eax, 0xfffffff7
cmp esi, eax
jg 0x40496a
je 0x404964
mov eax, 0x4da
cmp esi, eax
jg 0x40492d
je 0x404926
sub esi, 0x12c
je 0x404f0e
sub esi, 0x3ab
je 0x404918
sub esi, 1
je 0x404908
sub esi, 1
jne case.0x404c1e.10067
push str.desk.cpl
jmp 0x40490d
push str.sysdm.cpl
call fcn.004042e9
pop ecx
jmp case.0x404c1e.10067
push 1
push edi
push edi
push str.control.exe
jmp 0x404a71
push str.timedate.cpl
jmp 0x40490d
sub esi, 0x4db
je 0x40495d
sub esi, 1
je 0x404956
sub esi, 1
je 0x40494f
sub esi, 1
jne case.0x404c1e.10067
push str.powercfg.cpl
jmp 0x40490d
push str.ncpa.cpl
jmp 0x40490d
push str.appwiz.cpl
jmp 0x40490d
push str.mmsys.cpl
jmp 0x40490d
push edi
jmp 0x404ea9
add esi, 0xfffffb20
cmp esi, 7
ja case.0x404c1e.10067
jmp dword [esi*4 + 0x404f34]
push 1
push edi
push edi
push str.msinfo32.exe
jmp 0x404a71
push 1
push edi
push edi
push str.msconfig.exe
jmp 0x404a71
push 1
push edi
push edi
push str.cleanmgr.exe
jmp 0x404a71
push 5
push edi
push edi
push str.dfrgui.exe
push ecx
push dword [0x42356c]
call ebx
cmp eax, 2
jne case.0x404c1e.10067
push 5
push edi
push edi
push str.dfrg.msc
jmp 0x404e68
push 5
push edi
push edi
push str.services.msc
jmp 0x404a71
push 5
push edi
push edi
push str.compmgmt.msc
jmp 0x404a71
push 5
push edi
push edi
push str.gpedit.msc
jmp 0x404a71
call fcn.00403048
push 5
push 0x4178dc
push 0x417a0c
jmp 0x404e63
push 1
push str.control__name_Microsoft.AdministrativeTools
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x404c1e.10067
mov eax, 0x272a
cmp esi, eax
jg 0x404abc
je 0x404ab8
add eax, 0xfffffffb
cmp esi, eax
jg 0x404a8d
je 0x404a89
sub esi, 0x4e9
je 0x404a80
sub esi, 1
je 0x404a77
sub esi, 1
je 0x404a68
sub esi, 0x2239
jne case.0x404c1e.10067
push 0xa
call fcn.00403e34
jmp 0x404912
push 5
push edi
push edi
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
push ecx
jmp 0x404e6d
push 1
push str.control__name_Microsoft.WindowsFirewall
jmp 0x404a17
push 1
push str.control__name_Microsoft.DeviceManager
jmp 0x404a17
push 0x14
jmp 0x404a5e
sub esi, 0x2726
je 0x404ab4
sub esi, 1
je 0x404ab0
sub esi, 1
je 0x404aac
sub esi, 1
jne case.0x404c1e.10067
push 0x3c
jmp 0x404a5e
push 0x32
jmp 0x404a5e
push 0x28
jmp 0x404a5e
push 0x1e
jmp 0x404a5e
push 0x46
jmp 0x404a5e
add esi, 0xffffd8d5
cmp esi, 8
ja case.0x404c1e.10067
jmp dword [esi*4 + 0x404f54]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x404c1e.10067
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x404c1e.10067
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.0x404c1e.10067
xor eax, eax
mov dword [esp + 0x10], edi
push 0x206
mov word [esp + 0x478], ax
lea eax, [esp + 0x47a]
push edi
push eax
call fcn.004081e0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x20019
push edi
push str.SOFTWAREWINTOOLSNET
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404b98
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x20]
push eax
push edi
push str.Path
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4179ec
call fcn.00403ef3
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
pop ecx
push eax
lea eax, [esp + 0x270]
push eax
call esi
push 0x4179f4
call fcn.00403ef3
pop ecx
push eax
lea eax, [esp + 0x20]
push eax
call esi
mov eax, 0x4178dc
push 5
push eax
push eax
lea eax, [esp + 0x480]
jmp 0x40473b
push ebp
call fcn.00403b67
jmp 0x404912
push 0x50
jmp 0x404a5e
push 0x5a
jmp 0x404a5e
push 0x64
jmp 0x404a5e
push 5
mov eax, 0x4178dc
push eax
push eax
push str.mailto:ramsaver_wintools.net
jmp 0x404ccf
add esi, 0xffffd8ca
cmp esi, 0x2c
ja case.0x404c1e.10067
jmp dword [esi*4 + 0x404f78]
push 1
push edi
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
jmp 0x404a71
push str.Hide1
push 0x275c
call fcn.0040556b
pop ecx
pop ecx
call fcn.00404114
jmp case.0x404c1e.10067
push str.Hide2
push 0x275d
jmp 0x404c41
push str.Hide3
push 0x275e
jmp 0x404c41
push str.Hide4
push 0x275f
jmp 0x404c41
push str.Hide5
push 0x2760
jmp 0x404c41
push edi
push 0x4036cf
push dword [0x42356c]
push str.DLGRBIN
jmp 0x404eb9
push str.RecycleAuto
push 0x2751
call fcn.0040556b
pop ecx
pop ecx
call fcn.004066de
jmp case.0x404c1e.10067
push edi
push edi
push ebp
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
jmp case.0x404c1e.10067
push 5
mov eax, 0x4178dc
push eax
push eax
push str.http:__www.wintools.net
push ecx
push ebp
jmp 0x404e73
push 0x422418
push 0x41794c
push str.Auto
push 0x417950
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.0040662c
jmp case.0x404c1e.10067
push 0x422418
push 0x417960
jmp 0x404ce0
push 0x422418
push 0x417964
jmp 0x404ce0
push ebp
call fcn.00404007
jmp 0x404912
push 0x417968
push 0x2744
call fcn.0040556b
pop ecx
pop ecx
call fcn.00406749
jmp case.0x404c1e.10067
push str.MonCPU
push 0x2761
call fcn.0040556b
pop ecx
pop ecx
call fcn.00406725
jmp case.0x404c1e.10067
call fcn.00403b03
jmp case.0x404c1e.10067
call fcn.004065c8
jmp case.0x404c1e.10067
push edi
call fcn.0040502c
jmp 0x404912
push 2
jmp 0x404d68
push 6
jmp 0x404d68
push 5
jmp 0x404d68
push 1
jmp 0x404d68
push str.CDROM
push 0x2740
call fcn.0040556b
pop ecx
jmp 0x404912
push str.Noicons
push 0x2741
call fcn.0040556b
pop ecx
pop ecx
call fcn.004040e6
jmp case.0x404c1e.10067
push str.Nosaver
push 0x273f
call fcn.0040556b
pop ecx
pop ecx
call fcn.004055a5
jmp case.0x404c1e.10067
push 5
mov eax, 0x4178dc
push eax
push eax
push 0x422a30
jmp 0x404a71
call fcn.00403048
push 5
push 0x4178dc
push 0x41794c
jmp 0x404e63
call fcn.00403048
push 5
push 0x4178dc
push 0x417960
jmp 0x404e63
call fcn.00403048
push 5
push 0x4178dc
push 0x417964
jmp 0x404e63
call fcn.00403048
push 5
push 0x4178dc
push str.34567
jmp 0x404e63
call fcn.00403048
push 5
push 0x4178dc
push 0x417a00
jmp 0x404e63
call fcn.00403048
push 5
push 0x4178dc
push 0x417a04
jmp 0x404e63
call fcn.00403048
push 5
push 0x4178dc
push 0x417a08
push 0x422a30
push str.open
push dword [0x42356c]
call ebx
jmp case.0x404c1e.10067
mov eax, dword [esp + 0x688]
sub eax, 0x12c
je 0x404f0c
sub eax, 0x2605
je case.0x404acb.10033
sub eax, 4
je 0x404eeb
sub eax, 1
je 0x404ecf
sub eax, 0x17
je case.0x404c1e.10061
sub eax, 1
je case.0x404c1e.10062
push 0
push 0x406831
push dword [0x42356c]
push str.DLGG
push dword [0x4231ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x404c1e.10067
push 3
jmp 0x404efd
push 4
jmp 0x404efd
push 5
mov eax, 0x4178dc
push eax
push eax
push str.http:__www.wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x404c1e.10067
push 5
mov eax, 0x4178dc
push eax
push eax
push str.mailto:ramsaver_wintools.net
jmp 0x404edd
push 1
push 0xf
push 0x422c38
push ebp
call fcn.00401149
jmp case.0x404c1e.10067
xor edi, edi
push edi
push edi
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407258
add esp, 0x670
ret