Function at 0x401230
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
push esi
push str._Restart
call edi
add esp, 8
test eax, eax
je 0x401557
push esi
push str._GRestart
call edi
add esp, 8
test eax, eax
je 0x401557
push esi
push str._Chrome
call edi
add esp, 8
test eax, eax
jne 0x4012a2
push 1
push eax
push str.http:__www.wedisk.co.kr__typewedisk
push str.chrome.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._Firefox
call edi
add esp, 8
test eax, eax
jne 0x4012d8
push 1
push eax
push str.http:__www.wedisk.co.kr__typewedisk
push str.firefox.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._Safari
call edi
add esp, 8
test eax, eax
jne 0x40130e
push 1
push eax
push str.http:__www.wedisk.co.kr__typewedisk
push str.Safari.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push 0x4030ec
call edi
add esp, 8
test eax, eax
jne 0x4013b3
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401850
push 0x4031c0
push str._x86_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x4030e0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimRight
push str.Internet_Exploreriexplore.exe
lea ecx, [esp + 0x10]
call fcn.0040183e
push 1
push 0
mov edx, dword [esp + 0x14]
push str.http:__www.wedisk.co.kr__typewedisk
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GChrome
call edi
add esp, 8
test eax, eax
jne 0x4013e9
push 1
push eax
push str.http:__gl.wedisk.co.kr__typewedisk
push str.chrome.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GFirefox
call edi
add esp, 8
test eax, eax
jne 0x40141f
push 1
push eax
push str.http:__gl.wedisk.co.kr__typewedisk
push str.firefox.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GSafari
call edi
add esp, 8
test eax, eax
jne 0x401455
push 1
push eax
push str.http:__gl.wedisk.co.kr__typewedisk
push str.Safari.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._G64
call edi
add esp, 8
test eax, eax
jne 0x4014fa
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401850
push 0x4031c0
push str._x86_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x4030e0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimRight
push str.Internet_Exploreriexplore.exe
lea ecx, [esp + 0x10]
call fcn.0040183e
push 1
push 0
mov edx, dword [esp + 0x14]
push str.http:__gl.wedisk.co.kr__typewedisk
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._Global
call edi
add esp, 8
test eax, eax
push 1
push 0
jne 0x401532
push str.http:__gl.wedisk.co.kr__typewedisk
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push str.http:__www.wedisk.co.kr__typewedisk
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GRestart
xor bl, bl
call edi
add esp, 8
test eax, eax
jne 0x40156a
mov bl, 1
xor edi, edi
push str.PSAPI.DLL
mov dword [0x4031a4], edi
mov dword [0x4031b0], edi
mov dword [0x4031ac], edi
mov dword [0x4031a8], edi
mov dword [0x4031b4], edi
mov dword [0x4031a0], edi
mov dword [0x40319c], edi
mov dword [0x403198], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x4031a4], eax
je 0x4016b2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push eax
call esi
mov dword [0x4031b0], eax
mov eax, dword [0x4031a4]
push str.EnumProcessModules
push eax
call esi
mov ecx, dword [0x4031a4]
push str.GetModuleFileNameExA
push ecx
mov dword [0x4031ac], eax
call esi
mov ecx, dword [0x4031b0]
mov dword [0x4031a8], eax
cmp ecx, edi
je 0x4016b2
cmp dword [0x4031ac], edi
je 0x4016b2
cmp eax, edi
je 0x4016b2
push str.chrome.exe
call section..text
push str.firefox.exe
call section..text
push str.Safari.exe
call section..text
mov eax, dword [0x4031b4]
add esp, 0xc
cmp eax, edi
jle 0x4016b2
cmp dword [0x4031a0], edi
jle 0x40165f
test bl, bl
push 1
push edi
je 0x401653
push str.http:__gl.wedisk.co.kr__typewedisk
push str.chrome.exe
jmp 0x4016a6
push str.http:__www.wedisk.co.kr__typewedisk
push str.chrome.exe
jmp 0x4016a6
cmp dword [0x40319c], edi
jle 0x401686
test bl, bl
push 1
push edi
je 0x40167a
push str.http:__gl.wedisk.co.kr__typewedisk
push str.firefox.exe
jmp 0x4016a6
push str.http:__www.wedisk.co.kr__typewedisk
push str.firefox.exe
jmp 0x4016a6
cmp dword [0x403198], edi
jle 0x4016b2
test bl, bl
push 1
push edi
je 0x40169c
push str.http:__gl.wedisk.co.kr__typewedisk
jmp 0x4016a1
push str.http:__www.wedisk.co.kr__typewedisk
push str.Safari.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10