Function at 0x402430
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7a4
mov ebx, eax
mov eax, ebx
mov byte [esp], dl
lea esi, [esp + 4]
call fcn.00406c20
cmp eax, 0x3f6
jae 0x40269e
mov al, byte [0x40d96c]
test al, al
je 0x40247e
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x402472
mov edx, 0x40c116
mov eax, ebx
call fcn.00406d74
mov edx, 0x40d96c
mov eax, ebx
call fcn.00406d74
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406bc4
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x4024a7
lea edx, [ebx + 1]
jmp 0x4024a9
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4024fa
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x4024d2
jmp 0x4024cb
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4024cb
mov byte [ebx + eax], 0x20
jmp 0x4024d2
inc eax
cmp byte [ebx + eax], 0
jne 0x4024bb
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x4024e7
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4024f9
cmp edx, 0x20
jne 0x4024f0
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x402501
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x4024b0
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405908
mov edi, eax
test edi, edi
je 0x40252d
mov edx, str..inf
mov eax, edi
call fcn.00406d28
test eax, eax
jne 0x40252d
mov dword [esi + 0xc], 0x40c1e7
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00405e1c
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x402555
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00405eb0
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x402598
cmp byte [esp + 1], 0
jne 0x402598
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.00406ca0
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.00406d74
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00405e1c
test al, al
je 0x40269e
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4025c2
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x40269e
cmp byte [0x40c044], 0
jne 0x4025d9
cmp byte [esp], 0
je 0x40264f
mov ebx, dword [0x40cc94]
test ebx, ebx
je 0x4025ed
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x4025f1
xor eax, eax
jmp 0x4025f6
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x402609
push 0
push dword [0x40cc94]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
jmp 0x40262d
push 1
push 0
push 0
push 0
lea edx, [esp + 0x850]
push edx
call sub.USER32.DLL_PeekMessageA
push 0x64
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x402618
test ebx, ebx
je 0x40264f
push 1
push dword [0x40cc94]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x40266b
mov edx, str..exe
mov eax, edi
call fcn.00406d28
test eax, eax
je 0x40269e
cmp byte [0x40c044], 0
je 0x402686
cmp byte [esp], 0
jne 0x402686
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x40269e
cmp byte [esp], 0
je 0x402693
mov ecx, 0xc8
jmp 0x402698
mov ecx, 0x3e8
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x85c
pop edi
pop esi
pop ebx
ret