Function at 0x4023b0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7a4
mov ebx, eax
mov al, byte [0x40d96c]
test al, al
mov byte [esp], dl
lea esi, [esp + 4]
je 0x4023ec
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x4023e0
mov edx, 0x40c116
mov eax, ebx
call fcn.00406c94
mov edx, 0x40d96c
mov eax, ebx
call fcn.00406c94
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406ae4
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x402415
lea edx, [ebx + 1]
jmp 0x402417
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x402468
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x402440
jmp 0x402439
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x402439
mov byte [ebx + eax], 0x20
jmp 0x402440
inc eax
cmp byte [ebx + eax], 0
jne 0x402429
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x402455
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x402467
cmp edx, 0x20
jne 0x40245e
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x40246f
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x40241e
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405828
mov edi, eax
test edi, edi
je 0x40249b
mov edx, str..inf
mov eax, edi
call fcn.00406c48
test eax, eax
jne 0x40249b
mov dword [esi + 0xc], 0x40c1e7
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00405d3c
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x4024c3
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00405dd0
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x402506
cmp byte [esp + 1], 0
jne 0x402506
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.00406bc0
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.00406c94
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00405d3c
test al, al
je 0x40260c
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x402530
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x40260c
cmp byte [0x40c044], 0
jne 0x402547
cmp byte [esp], 0
je 0x4025bd
mov ebx, dword [0x40cc94]
test ebx, ebx
je 0x40255b
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x40255f
xor eax, eax
jmp 0x402564
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x402577
push 0
push dword [0x40cc94]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
jmp 0x40259b
push 1
push 0
push 0
push 0
lea edx, [esp + 0x850]
push edx
call sub.USER32.DLL_PeekMessageA
push 0x64
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x402586
test ebx, ebx
je 0x4025bd
push 1
push dword [0x40cc94]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x4025d9
mov edx, str..exe
mov eax, edi
call fcn.00406c48
test eax, eax
je 0x40260c
cmp byte [0x40c044], 0
je 0x4025f4
cmp byte [esp], 0
jne 0x4025f4
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x40260c
cmp byte [esp], 0
je 0x402601
mov ecx, 0xc8
jmp 0x402606
mov ecx, 0x3e8
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x85c
pop edi
pop esi
pop ebx
ret