Function at 0x4058c0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x670
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x66c], eax
cmp dword [0x42404c], 0
push ebp
mov ebp, dword [esp + 0x678]
push edi
mov dword [esp + 0xc], ebp
je 0x405a8b
mov edi, dword [esp + 0x680]
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
cmp edi, 0x1388
jl 0x4052d6
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop
cmp edi, 0x1770
jg 0x4052d2
push 0x104
lea eax, [esp + 0x478]
mov esi, 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x474]
push eax
call fcn.0040b5c1
add esp, 4
lea eax, [esp + 0x1c]
push eax
push str..scr
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405180
push 0
lea eax, [esp + 0x270]
mov esi, 0x1389
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, esi
je 0x40521f
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x405179
push 0
lea eax, [esp + 0x270]
inc esi
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp esi, edi
je 0x405153
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405122
jmp 0x405179
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42466c]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x474]
push eax
call fcn.0040b5c1
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x20]
add esp, 4
push eax
push str..scr
call ebp
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4050a0
mov ebp, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x26c]
push 0
push eax
push 0x104
lea eax, [esp + 0x54]
inc esi
push eax
call ebp
cmp esi, edi
jne 0x40524a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42466c]
call ebx
add edi, 0xfffffb28
cmp edi, 0x13
ja case.0x405528.10030
jmp dword [edi*4 + 0x405bfc]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4052c3
nop dword [eax]
push 0
lea eax, [esp + 0x270]
inc esi
push eax
push 0x104
lea eax, [esp + 0x54]
push eax
call ebp
cmp esi, edi
je 0x40529d
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405260
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x405209
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x278]
push eax
push str.open
push dword [0x42466c]
call ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x405209
mov ebp, dword [esp + 0x14]
cmp edi, 0x2724
jg 0x40551d
je 0x4054fa
cmp edi, 0x4d7
jg 0x405209
je 0x405314
cmp edi, 0x12c
jne case.0x405528.10030
push 0
push 0
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x405528.10030
push 1
push 0
push 0
push str.control.exe
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 0
push 0x4074f0
push dword [0x42466c]
push str.DLGG
push dword [0x4242ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x405528.10030
push 1
push str.control__name_Microsoft.AdministrativeTools
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x405528.10030
push 1
push str.control__name_Microsoft.DeviceManager
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x405528.10030
push 1
push str.control__name_Microsoft.WindowsFirewall
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x405528.10030
push 5
push 0
push 0
push str.shell:::9C60DE1E_E5FC_40f4_A487_460851A8D915
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 1
push 0
push 0
push str.msinfo32.exe
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 1
push 0
push 0
push str.msconfig.exe
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 1
push 0
push 0
push str.cleanmgr.exe
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 5
push 0
push 0
push str.dfrgui.exe
push str.open
push dword [0x42466c]
call ebx
cmp eax, 2
jne case.0x405528.10030
push 5
push 0
push 0
push str.dfrg.msc
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 5
push 0
push 0
push str.services.msc
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 5
push 0
push 0
push str.compmgmt.msc
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 5
push 0
push 0
push str.gpedit.msc
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push str.sysdm.cpl
call fcn.004049c0
jmp 0x405501
push str.desk.cpl
call fcn.004049c0
jmp 0x405501
push str.timedate.cpl
call fcn.004049c0
jmp 0x405501
push str.mmsys.cpl
call fcn.004049c0
jmp 0x405501
push str.appwiz.cpl
call fcn.004049c0
jmp 0x405501
push str.ncpa.cpl
call fcn.004049c0
jmp 0x405501
push str.powercfg.cpl
call fcn.004049c0
jmp 0x405501
call fcn.00402ff0
push 5
push 0x4188c4
push 0x418a00
jmp 0x405a2a
push 0xa
call fcn.00404510
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
add edi, 0xffffd8db
cmp edi, 0x3d
ja case.0x405528.10030
jmp dword [edi*4 + 0x405c4c]
push 1
push 0
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push str.Hide1
push 0x275c
call fcn.00406050
add esp, 8
call fcn.00404860
jmp case.0x405528.10030
push str.Hide2
push 0x275d
call fcn.00406050
add esp, 8
call fcn.00404860
jmp case.0x405528.10030
push str.Hide3
push 0x275e
call fcn.00406050
add esp, 8
call fcn.00404860
jmp case.0x405528.10030
push str.Hide4
push 0x275f
call fcn.00406050
add esp, 8
call fcn.00404860
jmp case.0x405528.10030
push str.Hide5
push 0x2760
call fcn.00406050
add esp, 8
call fcn.00404860
jmp case.0x405528.10030
push 0
push 0x403ca0
push dword [0x42466c]
push str.DLGRBIN
push dword [0x4242ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x405528.10030
push str.RecycleAuto
push 0x2751
call fcn.00406050
add esp, 8
call fcn.00407310
jmp case.0x405528.10030
push 0
push 0
push ebp
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
jmp case.0x405528.10030
push 1
push 0xf
push 0x423c38
push ebp
call fcn.00401149
jmp case.0x405528.10030
push 4
push 0xf
push 0x423c38
push ebp
call fcn.00401149
jmp case.0x405528.10030
push 3
push 0xf
push 0x423c38
push ebp
call fcn.00401149
jmp case.0x405528.10030
push 5
push 0x4188c4
push 0x4188c4
push str.http:__www.wintools.net
push str.open
push ebp
call ebx
jmp case.0x405528.10030
push 5
push 0x4188c4
push 0x4188c4
push str.mailto:ramsaver_wintools.net
push str.open
push ebp
call ebx
jmp case.0x405528.10030
push 0x423418
push 0x418934
jmp 0x4056bb
push 0x423418
push 0x418954
jmp 0x4056bb
push 0x423418
push 0x418958
push 0x418938
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.00407220
jmp case.0x405528.10030
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, 0x91a2b3c5
mov ebx, edx
shr ebx, 6
mul ebx
mov ecx, ebx
mov edi, edx
shr edi, 0xb
imul eax, edi, 0xe10
sub ecx, eax
mov eax, 0x88888889
mul ecx
mov eax, edi
shl eax, 4
mov esi, edx
shr esi, 5
sub eax, edi
lea eax, [esi + eax*4]
mov ecx, eax
shl ecx, 4
sub ecx, eax
shl ecx, 2
sub ebx, ecx
push ebx
push esi
push edi
push 0x4191dc
call fcn.004046d0
add esp, 4
push eax
lea eax, [esp + 0x27c]
push 0x64
push eax
call fcn.00408580
add esp, 0x18
push ebx
push esi
push edi
push 0x4191e4
call fcn.004046d0
add esp, 4
push eax
lea eax, [esp + 0x2c]
push 0x104
push eax
call fcn.00408580
add esp, 0x18
lea eax, [esp + 0x26c]
push eax
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x30
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x405528.10030
push 0x41895c
push 0x2744
call fcn.00406050
add esp, 8
call fcn.00407430
jmp case.0x405528.10030
push str.MonCPU
push 0x2761
call fcn.00406050
add esp, 8
call fcn.00407370
jmp case.0x405528.10030
call fcn.004040c0
jmp case.0x405528.10030
call fcn.004071b0
jmp case.0x405528.10030
push 0
call fcn.00405d50
jmp 0x405501
push 2
call fcn.00405d50
jmp 0x405501
push 6
call fcn.00405d50
jmp 0x405501
push 5
call fcn.00405d50
jmp 0x405501
push 1
call fcn.00405d50
jmp 0x405501
push str.CDROM
push 0x2740
call fcn.00406050
add esp, 8
jmp case.0x405528.10030
push str.Noicons
push 0x2741
call fcn.00406050
add esp, 8
call fcn.00404820
jmp case.0x405528.10030
push str.Nosaver
push 0x273f
call fcn.00406050
add esp, 8
call fcn.004060a0
jmp case.0x405528.10030
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x405528.10030
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x405528.10030
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.0x405528.10030
xor eax, eax
mov dword [esp + 0x10], 0
push 0x206
push eax
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push eax
call fcn.004094f0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SOFTWAREWINTOOLSNET
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40593d
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.Path
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4189e0
call fcn.004046d0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 4
push eax
lea eax, [esp + 0x20]
push eax
call esi
push 0x4189e8
call fcn.004046d0
add esp, 4
push eax
lea eax, [esp + 0x270]
push eax
call esi
push 5
push 0x4188c4
push 0x4188c4
lea eax, [esp + 0x480]
push eax
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push 5
push 0x4188c4
push 0x4188c4
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push 0x418934
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push 0x418954
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push 0x418958
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push str.34567
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push 0x4189f4
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push 0x4189f8
jmp 0x405a2a
call fcn.00402ff0
push 5
push 0x4188c4
push 0x4189fc
push 0x423a30
push str.open
push dword [0x42466c]
call ebx
jmp case.0x405528.10030
push ebp
call fcn.00404130
jmp 0x405501
push 0x14
jmp 0x4054fc
push 0x1e
jmp 0x4054fc
push 0x28
jmp 0x4054fc
push 0x32
jmp 0x4054fc
push 0x3c
jmp 0x4054fc
push 0x46
jmp 0x4054fc
push 0x50
jmp 0x4054fc
push 0x5a
jmp 0x4054fc
push 0x64
jmp 0x4054fc
mov eax, dword [esp + 0x680]
cmp eax, 0x2736
jg 0x405b6c
je 0x405b38
sub eax, 0x12c
je 0x405b14
sub eax, 0x2605
je 0x405aee
sub eax, 4
jne 0x405b78
push 5
push 0x4188c4
push 0x4188c4
push str.mailto:ramsaver_wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
push 1
push 0xf
push 0x423c38
push ebp
call fcn.00401149
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
push 0
push 0
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
push 5
push 0x4188c4
push 0x4188c4
push str.http:__www.wintools.net
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
sub eax, 0x274d
je 0x405bd3
sub eax, 1
je 0x405bad
push 0
push 0x4074f0
push dword [0x42466c]
push str.DLGG
push dword [0x4242ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
push 3
push 0xf
push 0x423c38
push ebp
call fcn.00401149
pop edi
pop ebp
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret
push 4
push 0xf
push 0x423c38
push ebp
call fcn.00401149
mov ecx, dword [esp + 0x674]
pop edi
pop ebp
xor ecx, esp
call fcn.004085ae
add esp, 0x670
ret