Function at 0x403360
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry key
Enumerate files on windows
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x424cc1
push eax
mov dword fs:[0], esp
sub esp, 0x2d4
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [ebp + 0xa4]
xor ebx, ebx
push eax
push ebx
push str.TOOLFLAG
push str.IETOOLBAR
mov dword [ebp + 0xb4], ebx
call edi
cmp eax, ebx
je 0x403412
mov eax, dword [0x42f690]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xa4]
lea ecx, [esp + 0x140]
push eax
push 0x64
push ecx
push str.88888888_8888_8888_8888_888888888888
push str.TOOLKEY
push str.IETOOLBAR
mov dword [esp + 0x304], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x140]
lea ecx, [esp + 0x10]
push edx
call fcn.00419e47
mov eax, dword [esp + 0x10]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2ec], 0xffffffff
call fcn.00419d02
mov eax, dword [ebp + 0xa8]
mov ecx, ebp
push eax
call fcn.00403d60
mov eax, dword [ebp + 0xa4]
push eax
push ebx
push str.FILENUM
push str.FILE
call edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xa4]
push eax
push ebx
push str.FOLDERNUM
push str.FOLDER
call edi
mov esi, eax
mov eax, dword [ebp + 0xa4]
push eax
push ebx
push str.OCXNUM
push 0x42f494
mov dword [esp + 0x30], esi
call edi
mov edx, dword [esp + 0x10]
mov ebx, eax
lea ecx, [ebx + esi]
add ecx, edx
test ecx, ecx
mov dword [ebp + 0xb0], ecx
je 0x403ab8
mov eax, dword [ebp + 0xac]
push 0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv ecx
push eax
mov eax, dword [ebp + 0x78]
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x42f690]
mov dword [esp + 0x14], ecx
xor edi, edi
mov dword [esp + 0x2ec], 1
test ebx, ebx
jle 0x40360d
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 1
push 0
push 0
lea edx, [esp + 0x30]
push 0
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40350c
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea edx, [esp + 0x30]
push 0
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4034df
cmp dword [ebp + 0xb4], 1
je 0x4037a3
push edi
lea eax, [esp + 0x18]
push str.OCX_02d
push eax
call fcn.004192e3
mov eax, dword [ebp + 0xa4]
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x40]
push eax
push 0x100
push ecx
push 0x433528
push edx
push 0x42f494
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x40]
test al, al
je 0x403600
lea eax, [esp + 0x40]
lea ecx, [ebp + 0x98]
push eax
call fcn.00419e47
push 0
mov ecx, ebp
call fcn.0041cae9
lea ecx, [esp + 0x40]
lea edx, [esp + 0x14]
push ecx
push str.regsvr32__s__u___s_
push edx
call fcn.004192e3
mov eax, dword [esp + 0x20]
add esp, 0xc
push 1
push eax
call esi
cmp eax, 0x1f
ja 0x4035c4
lea ecx, [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x42f458
push edx
call fcn.004192e3
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp + 0x1c]
push 0x10
push eax
push ecx
call fcn.00402ab0
add esp, 0x1c
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 0xac]
push 0
inc edx
mov eax, edx
mov dword [ebp + 0xac], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv dword [ebp + 0xb0]
push eax
mov eax, dword [ebp + 0x78]
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
cmp edi, ebx
jl 0x4034c8
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
test eax, eax
jle 0x403758
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
call ebx
test eax, eax
je 0x403663
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
call ebx
test eax, eax
jne 0x40363a
cmp dword [ebp + 0xb4], 1
je 0x4037a3
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push str.FILE_02d
push eax
call fcn.004192e3
mov eax, dword [ebp + 0xa4]
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x40]
push eax
push 0x100
push ecx
push 0x433528
push edx
push str.FILE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, dword [ebp + 0xa4]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x4036db
test cl, cl
je 0x4036d7
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4036db
add eax, 2
add edi, 2
test cl, cl
jne 0x4036b7
xor eax, eax
jmp 0x4036e0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403741
mov al, byte [esp + 0x40]
test al, al
je 0x403741
lea eax, [esp + 0x40]
lea ecx, [ebp + 0x98]
push eax
call fcn.00419e47
push 0
mov ecx, ebp
call fcn.0041cae9
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 0xac]
push 0
inc edx
mov eax, edx
mov dword [ebp + 0xac], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv dword [ebp + 0xb0]
mov edx, dword [ebp + 0x78]
push eax
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x403621
jmp 0x40375e
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call ebx
test eax, eax
je 0x40379a
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call ebx
test eax, eax
jne 0x403771
cmp dword [ebp + 0xb4], 1
jne 0x4037b2
mov dword [ebp + 0xb4], 3
jmp 0x403aa4
lea eax, [esi + esi*4]
lea eax, [eax + eax*4]
lea edi, [eax + eax*4]
shl edi, 1
push edi
call fcn.00419a43
mov ecx, edi
mov edx, eax
mov ebx, ecx
xor eax, eax
mov edi, edx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
lea ebx, [esi - 1]
and ecx, 3
mov dword [esp + 0x20], edx
test ebx, ebx
rep stosb byte es:[edi], al
mov dword [esp + 0x10], ebx
jl 0x40386f
lea eax, [ebx + ebx*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [edx + ecx*2]
mov dword [esp + 0x1c], edx
push ebx
lea eax, [esp + 0x18]
push str.FOLDER_02d
push eax
call fcn.004192e3
mov eax, dword [ebp + 0xa4]
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x40]
push eax
push 0x100
push ecx
push 0x433528
push edx
push str.FOLDER
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
sub eax, 0xfa
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x1c], eax
and ecx, 3
dec ebx
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jge 0x4037ff
mov ebx, dword [esp + 0x10]
mov eax, dword [ebp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
mov dword [esp + 0x18], ebx
jl 0x403a93
mov ecx, dword [esp + 0x20]
lea eax, [ebx + ebx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
mov dword [esp + 0x10], edx
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call esi
test eax, eax
je 0x4038de
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call esi
test eax, eax
jne 0x4038b5
cmp dword [ebp + 0xb4], 1
je 0x4037a3
mov eax, dword [esp + 0x10]
mov edi, 0x433528
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x403918
test cl, cl
je 0x403914
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x403918
add eax, 2
add edi, 2
test cl, cl
jne 0x4038f4
xor eax, eax
jmp 0x40391d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403a78
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
call fcn.00419d2c
push str..
lea ecx, [esp + 0x20]
mov byte [esp + 0x2f0], 2
call fcn.00419f4c
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1a4]
push ecx
push edx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403a63
test byte [esp + 0x1a4], 0x10
je 0x403a02
mov edi, 0x42f434
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x4039a7
test cl, cl
je 0x4039a3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4039a7
add eax, 2
add edi, 2
test cl, cl
jne 0x403983
xor eax, eax
jmp 0x4039ac
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4039e9
mov edi, 0x42f430
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x4039e0
test cl, cl
je 0x4039dc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4039e0
add eax, 2
add edi, 2
test cl, cl
jne 0x4039bc
xor eax, eax
jmp 0x4039e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403a02
lea eax, [esp + 0x1a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403969
jmp 0x403a07
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x403a63
lea ecx, [esp + 0x40]
push ecx
lea ecx, [ebp + 0x98]
call fcn.00419e47
push ebx
mov ecx, ebp
call fcn.0041cae9
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp + 0xac]
push ebx
inc eax
mov dword [ebp + 0xac], eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv dword [ebp + 0xb0]
push eax
mov eax, dword [ebp + 0x78]
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2ec], 1
call fcn.00419d02
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
dec ebx
sub ecx, 0xfa
mov dword [esp + 0x18], ebx
test ebx, ebx
mov dword [esp + 0x10], ecx
jge 0x40389c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403aa4
push eax
call fcn.00419a6c
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2ec], 0xffffffff
call fcn.00419d02
mov ecx, dword [esp + 0x2e4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2e0
ret