Function at 0x40228d
Capabilities:
Create process on windows
Empty the recycle bin
Enumerate files on windows
Get common file path
Open clipboard
Query or enumerate registry value

Disassembly:
sub esp, 0x67c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x674], eax
cmp dword [0x422054], 0
push ebx
push ebp
push esi
push edi
mov esi, edx
mov ebp, ecx
je 0x402a60
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
mov ecx, str.open
cmp esi, 0x1388
jl 0x4024c4
cmp esi, 0x1770
jg 0x4024bf
mov eax, 0x1388
mov dword [esp + 0x18], eax
lea eax, [esp + 0x478]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x478]
push eax
call fcn.00408ea2
pop ecx
lea eax, [esp + 0x20]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4023ce
mov eax, 0x1389
mov dword [esp + 0x18], eax
lea eax, [esp + 0x270]
push edi
push eax
push 0x104
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp esi, 0x1389
jne 0x40238b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
jmp 0x402a4e
inc dword [esp + 0x18]
lea eax, [esp + 0x270]
push edi
push eax
push 0x104
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [esp + 0x18], esi
je 0x4023a0
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402368
jmp 0x4023c4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
push str.open
push dword [0x421b34]
call ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x478]
push eax
call fcn.00408ea2
pop ecx
lea eax, [esp + 0x20]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4022cf
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x270]
push edi
push eax
push 0x104
lea eax, [esp + 0x58]
inc ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp ebp, esi
jne 0x40247a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
push str.open
push dword [0x421b34]
call ebx
mov ecx, str.open
jmp 0x402664
push edi
lea eax, [esp + 0x274]
inc ebp
push eax
push 0x104
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp ebp, esi
je 0x40248f
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40245c
jmp 0x4024b3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
push str.open
push dword [0x421b34]
call ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402452
mov ecx, str.open
mov eax, 0x2735
cmp esi, eax
jg 0x402835
je 0x402822
mov eax, 0x4e8
cmp esi, eax
jg 0x402648
je 0x402636
add eax, 0xfffffff7
cmp esi, eax
jg 0x402590
je 0x40258a
mov eax, 0x4da
cmp esi, eax
jg 0x402553
je 0x40254c
sub esi, 0x12c
je 0x402aef
sub esi, 0x3ab
je 0x40253e
sub esi, 1
je 0x40252f
sub esi, 1
jne case.0x402844.10067
mov ecx, str.desk.cpl
jmp 0x402534
mov ecx, str.sysdm.cpl
call fcn.004021f9
jmp case.0x402844.10067
push 1
push edi
push edi
push str.control.exe
jmp 0x402698
mov ecx, str.timedate.cpl
jmp 0x402534
sub esi, 0x4db
je 0x402583
sub esi, 1
je 0x40257c
sub esi, 1
je 0x402575
sub esi, 1
jne case.0x402844.10067
mov ecx, str.powercfg.cpl
jmp 0x402534
mov ecx, str.ncpa.cpl
jmp 0x402534
mov ecx, str.appwiz.cpl
jmp 0x402534
mov ecx, str.mmsys.cpl
jmp 0x402534
push edi
jmp 0x402a8a
add esi, 0xfffffb20
cmp esi, 7
ja case.0x402844.10067
jmp dword [esi*4 + 0x402b15]
push 1
push edi
push edi
push str.msinfo32.exe
jmp 0x402698
push 1
push edi
push edi
push str.msconfig.exe
jmp 0x402698
push 1
push edi
push edi
push str.cleanmgr.exe
jmp 0x402698
push 5
push edi
push edi
push str.dfrgui.exe
push ecx
push dword [0x421b34]
call ebx
cmp eax, 2
jne case.0x402844.10067
push 5
push edi
push edi
push str.dfrg.msc
jmp 0x402a4e
push 5
push edi
push edi
push str.services.msc
jmp 0x402698
push 5
push edi
push edi
push str.compmgmt.msc
jmp 0x402698
push 5
push edi
push edi
push str.gpedit.msc
jmp 0x402698
call fcn.00404311
push 5
push 0x41c59c
push 0x41c6cc
jmp 0x402a49
push 1
push str.control__name_Microsoft.AdministrativeTools
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x402844.10067
mov eax, 0x272a
cmp esi, eax
jg 0x4026e3
je 0x4026df
add eax, 0xfffffffb
cmp esi, eax
jg 0x4026b4
je 0x4026b0
sub esi, 0x4e9
je 0x4026a7
sub esi, 1
je 0x40269e
sub esi, 1
je 0x40268f
sub esi, 0x2239
jne case.0x402844.10067
push 0xa
pop ecx
call fcn.00404296
jmp case.0x402844.10067
push 5
push edi
push edi
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
push ecx
jmp 0x402a53
push 1
push str.control__name_Microsoft.WindowsFirewall
jmp 0x40263d
push 1
push str.control__name_Microsoft.DeviceManager
jmp 0x40263d
push 0x14
jmp 0x402684
sub esi, 0x2726
je 0x4026db
sub esi, 1
je 0x4026d7
sub esi, 1
je 0x4026d3
sub esi, 1
jne case.0x402844.10067
push 0x3c
jmp 0x402684
push 0x32
jmp 0x402684
push 0x28
jmp 0x402684
push 0x1e
jmp 0x402684
push 0x46
jmp 0x402684
add esi, 0xffffd8d5
cmp esi, 8
ja case.0x402844.10067
jmp dword [esi*4 + 0x402b35]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x402844.10067
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x402844.10067
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.0x402844.10067
xor eax, eax
mov dword [esp + 0x14], edi
push 0x206
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push edi
push eax
call fcn.00407000
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x20019
push edi
push str.SOFTWAREWINTOOLSNET
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4027bf
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x104
push eax
lea eax, [esp + 0x47c]
push eax
lea eax, [esp + 0x24]
push eax
push edi
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x41c6ac
call fcn.004020bf
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x274]
push eax
call esi
mov ecx, 0x41c6b4
call fcn.004020bf
push eax
lea eax, [esp + 0x24]
push eax
call esi
mov eax, 0x41c59c
push 5
push eax
push eax
lea eax, [esp + 0x484]
jmp 0x402362
mov ecx, ebp
call fcn.00405491
jmp case.0x402844.10067
push 0x50
jmp 0x402684
push 0x5a
jmp 0x402684
push 0x64
jmp 0x402684
push 5
mov eax, 0x41c59c
push eax
push eax
push str.mailto:ramsaver_wintools.net
jmp 0x4028d3
add esi, 0xffffd8ca
cmp esi, 0x2c
ja case.0x402844.10067
jmp dword [esi*4 + 0x402b59]
push 1
push edi
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
jmp 0x402698
mov edx, str.Hide1
call fcn.00404330
call fcn.00405350
jmp case.0x402844.10067
mov edx, str.Hide2
jmp 0x402862
mov edx, str.Hide3
jmp 0x402862
mov edx, str.Hide4
jmp 0x402862
mov edx, str.Hide5
jmp 0x402862
push edi
push 0x404e21
push dword [0x421b34]
push str.DLGRBIN
jmp 0x402a9a
mov edx, str.RecycleAuto
call fcn.00404330
call fcn.00405193
jmp case.0x402844.10067
push edi
push edi
push ebp
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
jmp case.0x402844.10067
push 5
mov eax, 0x41c59c
push eax
push eax
push str.http:__www.wintools.net
push ecx
push ebp
jmp 0x402a59
push 0x422a80
push 0x41c60c
push str.Auto
push 0x41c610
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.00404671
jmp case.0x402844.10067
push 0x422a80
push 0x41c620
jmp 0x4028e4
push 0x422a80
push 0x41c624
jmp 0x4028e4
mov ecx, ebp
call fcn.00404599
jmp case.0x402844.10067
mov edx, 0x41c628
call fcn.00404330
call fcn.004044cb
jmp case.0x402844.10067
mov edx, str.MonCPU
call fcn.00404330
call fcn.004044ef
jmp case.0x402844.10067
call fcn.00405506
jmp case.0x402844.10067
call fcn.0040556a
jmp case.0x402844.10067
xor ecx, ecx
call fcn.00404513
jmp case.0x402844.10067
push 2
pop ecx
jmp 0x402960
push 6
jmp 0x40296c
push 5
jmp 0x40296c
xor ecx, ecx
inc ecx
jmp 0x402960
mov edx, str.CDROM
call fcn.00404330
jmp case.0x402844.10067
mov edx, str.Noicons
call fcn.00404330
call fcn.00404397
jmp case.0x402844.10067
mov edx, str.Nosaver
call fcn.00404330
call fcn.00404368
jmp case.0x402844.10067
push 5
mov eax, 0x41c59c
push eax
push eax
push 0x422468
jmp 0x402698
call fcn.00404311
push 5
push 0x41c59c
push 0x41c60c
jmp 0x402a49
call fcn.00404311
push 5
push 0x41c59c
push 0x41c620
jmp 0x402a49
call fcn.00404311
push 5
push 0x41c59c
push 0x41c624
jmp 0x402a49
call fcn.00404311
push 5
push 0x41c59c
push str.34567
jmp 0x402a49
call fcn.00404311
push 5
push 0x41c59c
push 0x41c6c0
jmp 0x402a49
call fcn.00404311
push 5
push 0x41c59c
push 0x41c6c4
jmp 0x402a49
call fcn.00404311
push 5
push 0x41c59c
push 0x41c6c8
push 0x422468
push str.open
push dword [0x421b34]
call ebx
jmp case.0x402844.10067
sub esi, 0x12c
je 0x402aed
sub esi, 0x2605
je case.0x4026f2.10033
sub esi, 4
je 0x402acc
sub esi, 1
je 0x402ab0
sub esi, 0x17
je case.0x402844.10061
sub esi, 1
je case.0x402844.10062
push 0
push 0x404885
push dword [0x421b34]
push str.DLGG
push dword [0x421c38]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x402844.10067
push 3
jmp 0x402ade
push 4
jmp 0x402ade
push 5
mov eax, 0x41c59c
push eax
push eax
push str.http:__www.wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x402844.10067
push 5
mov eax, 0x41c59c
push eax
push eax
push str.mailto:ramsaver_wintools.net
jmp 0x402abe
push 1
push 0xf
push 0x422260
push ebp
call fcn.00401149
jmp case.0x402844.10067
xor edi, edi
push edi
push edi
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x684]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004060ae
add esp, 0x67c
ret