Function at 0x402260
Capabilities:
Create process on windows
Enumerate gui resources
Get common file path
Get program files directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
call fcn.00404090
jb 0x402297
nop
nop
mov edi, edi
xchg dl, dl
jae 0x402297
adc ebx, dword [ebx + edx*4 + 0x69]
call fcn.00401a60
test eax, eax
je 0x402459
jb 0x4022bd
mov di, di
nop
nop
nop
jae 0x4022bd
loope 0x402293
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0xb9b8ec44
inc eax
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x25e43], 0xff
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x25f]
mov byte [ebp - 0x260], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x260]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x402459
jp 0x4022fd
push ecx
mov ecx, 0x54689436
pop ecx
jnp 0x4022fd
sub eax, 0x6e
sub al, 0
add byte [ecx + 0x40], bh
call fcn.00404f70
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15b]
mov byte [ebp - 0x15c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
push 3
lea ecx, [ebp - 0x260]
push 0x411400
push ecx
lea edx, [ebp - 0x15c]
push 0x411420
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
add esp, 0x14
mov dword [ebp - 0x14], 0
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov word [ebp - 0x28], ax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], eax
push edx
push edi
or edx, edx
mov dl, ch
cmp edx, ecx
and edx, eax
pop edi
pop edx
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x58]
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x15c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402459
js 0x4023dc
mov edx, edx
jns 0x4023dc
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp dword [eax - 0x48], ebp
or eax, dword [eax]
add bh, bh
salc
push 0xbb8
call esi
mov ecx, dword [ebp - 8]
push ecx
push 0x402150
call ebx
jbe 0x402400
xchg bh, bh
mov ch, ch
xchg cl, cl
ja 0x402400
mov edx, dword [ebp - 0x10]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402422
mov eax, dword [ebp - 0x10]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jl 0x402437
xchg ecx, ecx
xchg ch, ch
jge 0x402437
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x4d8bdf84
hlt
mov ecx, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [ebp - 0x10]
push edx
call edi
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 1
mov dword [ebp - 0x14], eax
jl 0x402371
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret