Function at 0x40e6c8
Capabilities:
Create process on windows
Get common file path
Get program files directory
Query environment variable

Disassembly:
sub esp, 0x274
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x26c], eax
mov eax, dword [0x43d1e8]
push ebx
push ebp
mov ebp, edx
push esi
push edi
mov edi, ecx
cmp eax, 0xc
jg 0x40e18d
inc eax
mov dword [0x43d1e8], eax
cmp eax, 0xc
jne 0x40e18d
call fcn.0041448f
mov ebx, dword [esp + 0x288]
mov edx, ebx
movzx esi, bx
shr edx, 0x10
mov ecx, esi
call fcn.00401a3c
mov eax, 0x2723
cmp esi, eax
ja 0x40e7af
je case.0x40e1e1.447
add eax, 0xffffffed
cmp esi, eax
ja 0x40e2dd
je 0x40e2d0
mov eax, 0x252
cmp esi, eax
ja 0x40e201
je 0x40e258
add esi, 0xfffffe46
cmp esi, 8
ja case.0x40e7be.10031
jmp dword [esi*4 + 0x40ec07]
push 1
push 0xf
push 0x443fa8
push dword [0x4443bc]
call fcn.00415653
jmp 0x40ec00
mov eax, 0x2e1
cmp esi, eax
ja 0x40e290
je 0x40ea46
sub esi, 0x253
je 0x40e26f
sub esi, 1
je 0x40e262
sub esi, 3
je 0x40e258
sub esi, 0x6e
je case.0x40e2ec.10013
push dword [esp + 0x28c]
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415746
add esp, 0x274
ret
call fcn.0040b58e
jmp 0x40ec00
push 5
xor ebx, ebx
push ebx
push ebx
push str.http:__www.tweakguide.net
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.http:__www.extradisks.com_purchase_
push str.open
push dword [0x4443bc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40ec00
sub esi, 0x2e2
je 0x40e2b9
sub esi, 1
je 0x40e2af
sub esi, 3
jne case.0x40e7be.10031
push 5
xor ebx, ebx
push ebx
push ebx
push str.taskschd.msc
jmp 0x40e27a
call fcn.00408e0f
jmp 0x40ec00
push 0
push 0x409228
push dword [0x4443bc]
push 0x436ddc
jmp 0x40e7e5
push 5
xor ebx, ebx
push ebx
push ebx
push str.notepad.exe
jmp 0x40e27a
add esi, 0xffffd8ef
cmp esi, 0x11
ja case.0x40e7be.10031
jmp dword [esi*4 + 0x40ec2b]
push 0x208
xor ebx, ebx
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0x10]
push 0x58
pop esi
push esi
push ebx
push eax
call fcn.00416380
mov eax, dword [0x4443c0]
add esp, 0xc
mov dword [esp + 0x18], eax
mov edx, 0x436750
mov eax, dword [0x4443bc]
mov ecx, 0x435f1c
mov dword [esp + 0x10], esi
mov dword [esp + 0x44], 0x881824
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], str.All_Files__._
call fcn.00414a7a
mov dword [esp + 0x40], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x40], 0x436eac
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x58], ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp word [esp + 0x70], bx
je 0x40ec00
push 5
push ebx
lea eax, [esp + 0x78]
push eax
jmp 0x40e2d6
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.win.ini
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
jmp 0x40e390
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._system.ini
jmp 0x40e3af
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xce
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xce
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xce
push dword [0x4443bc]
call edi
push eax
call esi
jmp 0x40ec00
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xcf
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xcf
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xcf
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xd0
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xd0
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xd0
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xd1
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xd1
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xd1
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xd2
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xd2
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xd2
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xd3
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xd3
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xd3
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xd4
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xd4
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xd4
jmp 0x40e424
push 5
xor ebx, ebx
push ebx
push ebx
push str.shell:::ED7BA470_8E54_465E_825C_99712043E01C
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.msinfo32.exe
jmp 0x40e27a
call fcn.00414f7c
push 5
xor ebx, ebx
push ebx
push ebx
push str.msconfig.exe
push str.open
push dword [0x4443bc]
mov esi, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00414fde
jmp 0x40ec00
push 5
xor ebx, ebx
push ebx
push ebx
push str.compmgmt.msc
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.cleanmgr.exe
jmp 0x40e27a
call fcn.00414f7c
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
push 5
push ebx
push ebx
push str.dfrgui.exe
mov esi, str.open
mov ebp, eax
push esi
push ebx
call edi
cmp eax, 2
jne 0x40e6c4
push 5
push ebx
push ebx
push str.dfrg.msc
push esi
push dword [0x4443bc]
call edi
mov ecx, ebp
jmp 0x40e662
xor eax, eax
xor ebx, ebx
push 0x206
mov word [esp + 0x74], ax
lea eax, [esp + 0x76]
push ebx
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0x70]
push 0x104
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x70]
push str.program_filesWindows_DefenderMSASCui.exe
push eax
call ebp
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0x70]
push 5
push ebx
push ebx
push eax
mov esi, str.open
push esi
push dword [0x4443bc]
call edi
cmp eax, 2
jne 0x40ec00
lea eax, [esp + 0x6c]
push eax
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x70]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40ec00
push str.Windows_DefenderMSASCui.exe
lea eax, [esp + 0x74]
push eax
call ebp
push 5
push ebx
push ebx
lea eax, [esp + 0x7c]
push eax
push esi
push dword [0x4443bc]
call edi
cmp eax, 2
jne 0x40ec00
push 5
push ebx
push ebx
push str.wf.msc
push esi
push dword [0x4443bc]
call edi
jmp 0x40ec00
call fcn.00414f7c
push 5
xor ebx, ebx
push ebx
push ebx
push str.rstrui.exe
push str.open
push ebx
jmp 0x40e658
add esi, 0xffffd8dc
cmp esi, 0x23
ja case.0x40e7be.10031
jmp dword [esi*4 + 0x40ec73]
push 0xa
jmp 0x40e1ea
push 9
jmp 0x40e1ea
push 0
push 0x413ce2
push dword [0x4443bc]
push str.NAGSCREEN
push dword [0x4443c0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x40ec00
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0x3e8
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0x3e8
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0x3e8
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0xc6
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0xc6
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0xc6
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0x2e9
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0x2e9
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0x2e9
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0x2ea
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0x2ea
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0x2ea
jmp 0x40e424
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xa000a
push ebp
xor ebx, ebx
push ebx
push 0x202
push 0x2eb
push dword [0x4443bc]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push ebp
push ebx
push 0x201
push 0x2eb
push dword [0x4443bc]
call edi
push eax
call esi
push ebp
push ebx
push 0x202
push 0x2eb
jmp 0x40e424
xor eax, eax
xor ebx, ebx
push 0x206
mov word [esp + 0x74], ax
lea eax, [esp + 0x76]
push ebx
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0x70]
push 0x443990
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.ExtraDisksMount.exe
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov eax, dword [0x4443bc]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x20], eax
mov eax, dword [0x4443c0]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x10]
push eax
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x440
mov dword [esp + 0x20], str.open
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [esp + 0x48], ebx
je 0x40ea46
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004053de
jmp 0x40ec00
xor eax, eax
xor ebx, ebx
push 0x206
mov word [esp + 0x74], ax
lea eax, [esp + 0x76]
push ebx
push eax
call fcn.00416380
add esp, 0xc
lea eax, [esp + 0x70]
push 0x443990
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.ExtraDisksUnmount.exe
jmp 0x40e9c1
push 5
xor ebx, ebx
push ebx
push ebx
push str.regedit.exe
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.services.msc
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.gpedit.msc
jmp 0x40e27a
push 1
push 0x443990
push 0
push str.language.exe
jmp 0x40e27a
mov edx, str.OnTop
mov ecx, 0x2728
call fcn.00415119
call fcn.00415173
jmp 0x40ec00
mov esi, str.Magnet
mov ecx, 0x2729
mov edx, esi
call fcn.00415119
push 0x4443c8
push 0
push esi
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x4443c4], eax
jmp 0x40ec00
mov edx, str.Position
mov ecx, 0x272a
call fcn.00415119
jmp 0x40ec00
push 0
push 0x414661
push dword [0x4443bc]
push 0x43719c
jmp 0x40e7e5
xor ebx, ebx
push ebx
push 0x191
push 0x111
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40ec00
push 5
xor ebx, ebx
push ebx
push ebx
push 0x4371d8
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.powershell
jmp 0x40e27a
mov edx, 0x4357e4
mov ecx, str.FLDR
call fcn.00414a7a
push eax
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x70]
mov edx, 0x4371f8
push 0x24
push eax
mov ecx, 0x437200
call fcn.00414a7a
push eax
push dword [0x4443bc]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40ec00
call fcn.00415031
jmp 0x40ec00
push 5
xor ebx, ebx
push ebx
push ebx
push str.http:__www.extrasubst.com
jmp 0x40e27a
push 5
xor ebx, ebx
push ebx
push ebx
push str.mailto:support_extrasubst.com_subjectReport_about_ExtraSubst
jmp 0x40e27a
push 0
push 0x40baf7
push edi
push 0x67
jmp 0x40e7e5
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
jmp 0x40e23f