Function at 0x402421
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7a4
mov ebx, eax
mov eax, ebx
mov byte [esp], dl
lea esi, [esp + 4]
call fcn.00406bf0
cmp eax, 0x3f6
jae 0x40268e
mov al, byte [0x40d96c]
test al, al
je 0x40246f
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x402463
mov edx, 0x40c116
mov eax, ebx
call fcn.00406d44
mov edx, 0x40d96c
mov eax, ebx
call fcn.00406d44
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406b94
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x402498
lea edx, [ebx + 1]
jmp 0x40249a
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4024eb
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x4024c3
jmp 0x4024bc
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4024bc
mov byte [ebx + eax], 0x20
jmp 0x4024c3
inc eax
cmp byte [ebx + eax], 0
jne 0x4024ac
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x4024d8
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4024ea
cmp edx, 0x20
jne 0x4024e1
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x4024f2
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x4024a1
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.004058e8
mov edi, eax
test edi, edi
je 0x40251e
mov edx, str..inf
mov eax, edi
call fcn.00406cf8
test eax, eax
jne 0x40251e
mov dword [esi + 0xc], 0x40c1e7
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00405dfc
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x402546
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00405e90
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x402589
cmp byte [esp + 1], 0
jne 0x402589
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.00406c70
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.00406d44
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00405dfc
test al, al
je 0x40268e
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4025b3
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x40268e
cmp byte [0x40c044], 0
jne 0x4025ca
cmp byte [esp], 0
je 0x402640
mov ebx, dword [0x40cc94]
test ebx, ebx
je 0x4025de
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x4025e2
xor eax, eax
jmp 0x4025e7
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x4025fa
push 0
push dword [0x40cc94]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
jmp 0x40261e
push 1
push 0
push 0
push 0
lea edx, [esp + 0x850]
push edx
call sub.USER32.DLL_PeekMessageA
push 0x64
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x402609
test ebx, ebx
je 0x402640
push 1
push dword [0x40cc94]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x40265c
mov edx, str..exe
mov eax, edi
call fcn.00406cf8
test eax, eax
je 0x40268e
cmp byte [0x40c044], 0
je 0x402677
cmp byte [esp], 0
jne 0x402677
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x40268e
mov ecx, 0xc8
cmp byte [esp], 0
jne 0x402688
add ecx, 0x320
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x85c
pop edi
pop esi
pop ebx
ret