Function at 0x402291
Capabilities:
Create process on windows
Empty the recycle bin
Enumerate files on windows
Get common file path
Open clipboard
Query or enumerate registry value

Disassembly:
sub esp, 0x67c
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x674], eax
cmp dword [0x422014], 0
push ebx
push ebp
push esi
push edi
mov esi, edx
mov ebp, ecx
je 0x402a64
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
mov ecx, str.open
cmp esi, 0x1388
jl 0x4024c8
cmp esi, 0x1770
jg 0x4024c3
mov eax, 0x1388
mov dword [esp + 0x18], eax
lea eax, [esp + 0x478]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x478]
push eax
call fcn.00408e62
pop ecx
lea eax, [esp + 0x20]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4023d2
mov eax, 0x1389
mov dword [esp + 0x18], eax
lea eax, [esp + 0x270]
push edi
push eax
push 0x104
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp esi, 0x1389
jne 0x40238f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
jmp 0x402a52
inc dword [esp + 0x18]
lea eax, [esp + 0x270]
push edi
push eax
push 0x104
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [esp + 0x18], esi
je 0x4023a4
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40236c
jmp 0x4023c8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
push str.open
push dword [0x421af4]
call ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x478]
push eax
call fcn.00408e62
pop ecx
lea eax, [esp + 0x20]
push eax
push str..scr
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4022d3
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x270]
push edi
push eax
push 0x104
lea eax, [esp + 0x58]
inc ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp ebp, esi
jne 0x40247e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
push str.open
push dword [0x421af4]
call ebx
mov ecx, str.open
jmp 0x402668
push edi
lea eax, [esp + 0x274]
inc ebp
push eax
push 0x104
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp ebp, esi
je 0x402493
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402460
jmp 0x4024b7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push edi
lea eax, [esp + 0x27c]
push eax
push str.open
push dword [0x421af4]
call ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402456
mov ecx, str.open
mov eax, 0x2735
cmp esi, eax
jg 0x402839
je 0x402826
mov eax, 0x4e8
cmp esi, eax
jg 0x40264c
je 0x40263a
add eax, 0xfffffff7
cmp esi, eax
jg 0x402594
je 0x40258e
mov eax, 0x4da
cmp esi, eax
jg 0x402557
je 0x402550
sub esi, 0x12c
je 0x402af3
sub esi, 0x3ab
je 0x402542
sub esi, 1
je 0x402533
sub esi, 1
jne case.0x402848.10067
mov ecx, str.desk.cpl
jmp 0x402538
mov ecx, str.sysdm.cpl
call fcn.004021fd
jmp case.0x402848.10067
push 1
push edi
push edi
push str.control.exe
jmp 0x40269c
mov ecx, str.timedate.cpl
jmp 0x402538
sub esi, 0x4db
je 0x402587
sub esi, 1
je 0x402580
sub esi, 1
je 0x402579
sub esi, 1
jne case.0x402848.10067
mov ecx, str.powercfg.cpl
jmp 0x402538
mov ecx, str.ncpa.cpl
jmp 0x402538
mov ecx, str.appwiz.cpl
jmp 0x402538
mov ecx, str.mmsys.cpl
jmp 0x402538
push edi
jmp 0x402a8e
add esi, 0xfffffb20
cmp esi, 7
ja case.0x402848.10067
jmp dword [esi*4 + 0x402b19]
push 1
push edi
push edi
push str.msinfo32.exe
jmp 0x40269c
push 1
push edi
push edi
push str.msconfig.exe
jmp 0x40269c
push 1
push edi
push edi
push str.cleanmgr.exe
jmp 0x40269c
push 5
push edi
push edi
push str.dfrgui.exe
push ecx
push dword [0x421af4]
call ebx
cmp eax, 2
jne case.0x402848.10067
push 5
push edi
push edi
push str.dfrg.msc
jmp 0x402a52
push 5
push edi
push edi
push str.services.msc
jmp 0x40269c
push 5
push edi
push edi
push str.compmgmt.msc
jmp 0x40269c
push 5
push edi
push edi
push str.gpedit.msc
jmp 0x40269c
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c6dc
jmp 0x402a4d
push 1
push str.control__name_Microsoft.AdministrativeTools
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x402848.10067
mov eax, 0x272a
cmp esi, eax
jg 0x4026e7
je 0x4026e3
add eax, 0xfffffffb
cmp esi, eax
jg 0x4026b8
je 0x4026b4
sub esi, 0x4e9
je 0x4026ab
sub esi, 1
je 0x4026a2
sub esi, 1
je 0x402693
sub esi, 0x2239
jne case.0x402848.10067
push 0xa
pop ecx
call fcn.00404252
jmp case.0x402848.10067
push 5
push edi
push edi
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
push ecx
jmp 0x402a57
push 1
push str.control__name_Microsoft.WindowsFirewall
jmp 0x402641
push 1
push str.control__name_Microsoft.DeviceManager
jmp 0x402641
push 0x14
jmp 0x402688
sub esi, 0x2726
je 0x4026df
sub esi, 1
je 0x4026db
sub esi, 1
je 0x4026d7
sub esi, 1
jne case.0x402848.10067
push 0x3c
jmp 0x402688
push 0x32
jmp 0x402688
push 0x28
jmp 0x402688
push 0x1e
jmp 0x402688
push 0x46
jmp 0x402688
add esi, 0xffffd8d5
cmp esi, 8
ja case.0x402848.10067
jmp dword [esi*4 + 0x402b39]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x402848.10067
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x402848.10067
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.0x402848.10067
xor eax, eax
mov dword [esp + 0x14], edi
push 0x206
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push edi
push eax
call fcn.00406fc0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x20019
push edi
push str.SOFTWAREWINTOOLSNET
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4027c3
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x104
push eax
lea eax, [esp + 0x47c]
push eax
lea eax, [esp + 0x24]
push eax
push edi
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x41c6bc
call fcn.004020c3
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x274]
push eax
call esi
mov ecx, 0x41c6c4
call fcn.004020c3
push eax
lea eax, [esp + 0x24]
push eax
call esi
mov eax, 0x41c5ac
push 5
push eax
push eax
lea eax, [esp + 0x484]
jmp 0x402366
mov ecx, ebp
call fcn.0040544f
jmp case.0x402848.10067
push 0x50
jmp 0x402688
push 0x5a
jmp 0x402688
push 0x64
jmp 0x402688
push 5
mov eax, 0x41c5ac
push eax
push eax
push str.mailto:ramsaver_wintools.net
jmp 0x4028d7
add esi, 0xffffd8ca
cmp esi, 0x2c
ja case.0x402848.10067
jmp dword [esi*4 + 0x402b5d]
push 1
push edi
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
jmp 0x40269c
mov edx, str.Hide1
call fcn.004042ec
call fcn.0040530e
jmp case.0x402848.10067
mov edx, str.Hide2
jmp 0x402866
mov edx, str.Hide3
jmp 0x402866
mov edx, str.Hide4
jmp 0x402866
mov edx, str.Hide5
jmp 0x402866
push edi
push 0x404ddf
push dword [0x421af4]
push str.DLGRBIN
jmp 0x402a9e
mov edx, str.RecycleAuto
call fcn.004042ec
call fcn.00405151
jmp case.0x402848.10067
push edi
push edi
push ebp
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
jmp case.0x402848.10067
push 5
mov eax, 0x41c5ac
push eax
push eax
push str.http:__www.wintools.net
push ecx
push ebp
jmp 0x402a5d
push 0x422a40
push 0x41c61c
push str.Auto
push 0x41c620
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.0040462d
jmp case.0x402848.10067
push 0x422a40
push 0x41c630
jmp 0x4028e8
push 0x422a40
push 0x41c634
jmp 0x4028e8
mov ecx, ebp
call fcn.00404555
jmp case.0x402848.10067
mov edx, 0x41c638
call fcn.004042ec
call fcn.00404487
jmp case.0x402848.10067
mov edx, str.MonCPU
call fcn.004042ec
call fcn.004044ab
jmp case.0x402848.10067
call fcn.004054c4
jmp case.0x402848.10067
call fcn.00405528
jmp case.0x402848.10067
xor ecx, ecx
call fcn.004044cf
jmp case.0x402848.10067
push 2
pop ecx
jmp 0x402964
push 6
jmp 0x402970
push 5
jmp 0x402970
xor ecx, ecx
inc ecx
jmp 0x402964
mov edx, str.CDROM
call fcn.004042ec
jmp case.0x402848.10067
mov edx, str.Noicons
call fcn.004042ec
call fcn.00404353
jmp case.0x402848.10067
mov edx, str.Nosaver
call fcn.004042ec
call fcn.00404324
jmp case.0x402848.10067
push 5
mov eax, 0x41c5ac
push eax
push eax
push 0x422428
jmp 0x40269c
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c61c
jmp 0x402a4d
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c630
jmp 0x402a4d
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c634
jmp 0x402a4d
call fcn.004042cd
push 5
push 0x41c5ac
push str.34567
jmp 0x402a4d
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c6d0
jmp 0x402a4d
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c6d4
jmp 0x402a4d
call fcn.004042cd
push 5
push 0x41c5ac
push 0x41c6d8
push 0x422428
push str.open
push dword [0x421af4]
call ebx
jmp case.0x402848.10067
sub esi, 0x12c
je 0x402af1
sub esi, 0x2605
je case.0x4026f6.10033
sub esi, 4
je 0x402ad0
sub esi, 1
je 0x402ab4
sub esi, 0x17
je case.0x402848.10061
sub esi, 1
je case.0x402848.10062
push 0
push 0x404841
push dword [0x421af4]
push str.DLGG
push dword [0x421bf8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x402848.10067
push 3
jmp 0x402ae2
push 4
jmp 0x402ae2
push 5
mov eax, 0x41c5ac
push eax
push eax
push str.http:__www.wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x402848.10067
push 5
mov eax, 0x41c5ac
push eax
push eax
push str.mailto:ramsaver_wintools.net
jmp 0x402ac2
push 1
push 0xf
push 0x422220
push ebp
call fcn.00401149
jmp case.0x402848.10067
xor edi, edi
push edi
push edi
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x684]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040606a
add esp, 0x67c
ret