Function at 0x402501
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7a4
mov ebx, eax
mov eax, ebx
mov byte [esp], dl
lea esi, [esp + 4]
call fcn.0040f718
cmp eax, 0x3f6
jae 0x40276e
mov al, byte [0x415570]
test al, al
je 0x40254f
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x402543
mov edx, 0x414125
mov eax, ebx
call fcn.0040f86c
mov edx, 0x415570
mov eax, ebx
call fcn.0040f86c
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.0040f698
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x402578
lea edx, [ebx + 1]
jmp 0x40257a
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4025cb
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x4025a3
jmp 0x40259c
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x40259c
mov byte [ebx + eax], 0x20
jmp 0x4025a3
inc eax
cmp byte [ebx + eax], 0
jne 0x40258c
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x4025b8
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4025ca
cmp edx, 0x20
jne 0x4025c1
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x4025d2
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x402581
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405f6c
mov edi, eax
test edi, edi
je 0x4025fe
mov edx, str..inf
mov eax, edi
call fcn.0040f820
test eax, eax
jne 0x4025fe
mov dword [esi + 0xc], 0x4141f6
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00406aec
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x402626
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00406bb8
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x402669
cmp byte [esp + 1], 0
jne 0x402669
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.0040f798
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.0040f86c
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00406aec
test al, al
je 0x40276e
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x402693
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x40276e
cmp byte [0x414044], 0
jne 0x4026aa
cmp byte [esp], 0
je 0x402720
mov ebx, dword [0x4148bc]
test ebx, ebx
je 0x4026be
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x4026c2
xor eax, eax
jmp 0x4026c7
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x4026da
push 0
push dword [0x4148bc]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
jmp 0x4026fe
push 1
push 0
push 0
push 0
lea edx, [esp + 0x850]
push edx
call sub.USER32.DLL_PeekMessageA
push 0x64
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x4026e9
test ebx, ebx
je 0x402720
push 1
push dword [0x4148bc]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x40273c
mov edx, str..exe
mov eax, edi
call fcn.0040f820
test eax, eax
je 0x40276e
cmp byte [0x414044], 0
je 0x402757
cmp byte [esp], 0
jne 0x402757
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x40276e
mov ecx, 0xc8
cmp byte [esp], 0
jne 0x402768
add ecx, 0x320
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x85c
pop edi
pop esi
pop ebx
ret