Function at 0x401f9c
Capabilities:
Create process on windows
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x770
push ebx
push esi
push edi
push str.shortcut.dat
lea eax, [ebp - 0x66c]
push 0x40a650
push eax
call fcn.004011ec
add esp, 0xc
mov esi, 0x104
lea eax, [ebp - 0x464]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [0x40ab7c], 0
jne 0x401ffa
lea eax, [ebp - 0x464]
push str.Start_MenuPrograms
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.004011ec
add esp, 0xc
jmp 0x40206b
lea eax, [ebp - 0x464]
push str.Profiles_
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.004011ec
mov al, byte [0x40ab80]
add esp, 0xc
mov byte [ebp - 0x25c], al
xor eax, eax
push 0x40
lea edi, [ebp - 0x25b]
pop ecx
mov dword [ebp - 8], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.004030c0
lea eax, [ebp - 0x158]
push 0x4093d0
push eax
call fcn.004030c0
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x66c]
push eax
call fcn.00401102
mov ebx, dword [ebp - 0xc]
add esp, 0xc
test ebx, ebx
je 0x402101
lea edi, [ebp - 0x464]
cmp byte [ebx], 0xa
je 0x4020a4
push 1
push ebx
push edi
call fcn.004032b0
add esp, 0xc
inc ebx
inc edi
jmp 0x40208f
mov eax, dword [ebp - 4]
and byte [edi - 1], 0
sub eax, ebx
cmp eax, 2
jge 0x4020c0
push dword [ebp - 0xc]
call fcn.004011bf
pop ecx
jmp 0x402270
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.004011ec
lea eax, [ebp - 0x360]
push esi
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.004032b0
lea eax, [ebp - 0x158]
push eax
call fcn.00401902
add esp, 0x1c
test al, al
jne 0x402108
xor al, al
jmp 0x402272
inc ebx
cmp ebx, dword [ebp - 4]
jae 0x402204
lea ecx, [ebp - 0x360]
mov al, byte [ebx]
cmp al, 0xa
je 0x402129
cmp ebx, dword [ebp - 4]
jae 0x40212c
mov byte [ecx], al
inc ebx
inc ecx
jmp 0x402118
cmp ebx, dword [ebp - 4]
jne 0x402133
and byte [ecx], 0
jmp 0x402137
and byte [ecx - 1], 0
lea eax, [ebp - 0x158]
lea ecx, [ebp - 0x360]
inc ebx
sub eax, ecx
lea edi, [ebp - 0x25c]
lea esi, [ebp - 0x360]
mov dword [ebp - 8], eax
cmp byte [esi], 0x5b
je 0x402171
push 1
push esi
push edi
call fcn.004032b0
mov eax, dword [ebp - 8]
add esp, 0xc
inc edi
inc esi
add eax, esi
cmp edi, eax
jb 0x402155
and byte [edi], 0
inc esi
push esi
call fcn.004031a0
and byte [eax + esi - 1], 0
lea eax, [ebp - 0x568]
mov dword [esp], 0x40a650
push eax
call fcn.004030b0
lea eax, [ebp - 0x568]
push esi
push eax
lea eax, [ebp - 0x568]
push eax
call fcn.004011ec
mov esi, str..lnk
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.004030c0
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x770]
push eax
call fcn.004011ec
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x568]
push eax
call section..text
add esp, 0x34
jmp 0x402109
push dword [ebp - 0xc]
call fcn.004011bf
pop ecx
xor eax, eax
push 0x40
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
pop esi
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x158]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x48], 0x409208
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x402265
lea eax, [ebp - 0x158]
push esi
push eax
push 0x4093a4
push dword [0x409e20]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402270
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret