Function at 0x401200
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
push esi
push str._Restart
call edi
add esp, 8
test eax, eax
je 0x401527
push esi
push str._GRestart
call edi
add esp, 8
test eax, eax
je 0x401527
push esi
push str._Chrome
call edi
add esp, 8
test eax, eax
jne 0x401272
push 1
push eax
push str.http:__www.filenori.com__connfilenori
push str.chrome.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._Firefox
call edi
add esp, 8
test eax, eax
jne 0x4012a8
push 1
push eax
push str.http:__www.filenori.com__connfilenori
push str.firefox.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._Safari
call edi
add esp, 8
test eax, eax
jne 0x4012de
push 1
push eax
push str.http:__www.filenori.com__connfilenori
push str.Safari.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push 0x4030f0
call edi
add esp, 8
test eax, eax
jne 0x401383
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401820
push 0x4031bc
push str._x86_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x4030e4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimRight
push str.Internet_Exploreriexplore.exe
lea ecx, [esp + 0x10]
call fcn.0040180e
push 1
push 0
mov edx, dword [esp + 0x14]
push str.http:__www.filenori.com__connfilenori
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GChrome
call edi
add esp, 8
test eax, eax
jne 0x4013b9
push 1
push eax
push str.http:__go.filenori.com__connfilenori
push str.chrome.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GFirefox
call edi
add esp, 8
test eax, eax
jne 0x4013ef
push 1
push eax
push str.http:__go.filenori.com__connfilenori
push str.firefox.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GSafari
call edi
add esp, 8
test eax, eax
jne 0x401425
push 1
push eax
push str.http:__go.filenori.com__connfilenori
push str.Safari.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._G64
call edi
add esp, 8
test eax, eax
jne 0x4014ca
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401820
push 0x4031bc
push str._x86_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x4030e4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimRight
push str.Internet_Exploreriexplore.exe
lea ecx, [esp + 0x10]
call fcn.0040180e
push 1
push 0
mov edx, dword [esp + 0x14]
push str.http:__go.filenori.com__connfilenori
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._Global
call edi
add esp, 8
test eax, eax
push 1
push 0
jne 0x401502
push str.http:__go.filenori.com__connfilenori
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push str.http:__www.filenori.com__connfilenori
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
push esi
push str._GRestart
xor bl, bl
call edi
add esp, 8
test eax, eax
jne 0x40153a
mov bl, 1
xor edi, edi
push str.PSAPI.DLL
mov dword [0x4031a4], edi
mov dword [0x4031b0], edi
mov dword [0x4031ac], edi
mov dword [0x4031a8], edi
mov dword [0x4031b4], edi
mov dword [0x4031a0], edi
mov dword [0x40319c], edi
mov dword [0x403198], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x4031a4], eax
je 0x401682
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push eax
call esi
mov dword [0x4031b0], eax
mov eax, dword [0x4031a4]
push str.EnumProcessModules
push eax
call esi
mov ecx, dword [0x4031a4]
push str.GetModuleFileNameExA
push ecx
mov dword [0x4031ac], eax
call esi
mov ecx, dword [0x4031b0]
mov dword [0x4031a8], eax
cmp ecx, edi
je 0x401682
cmp dword [0x4031ac], edi
je 0x401682
cmp eax, edi
je 0x401682
push str.chrome.exe
call section..text
push str.firefox.exe
call section..text
push str.Safari.exe
call section..text
mov eax, dword [0x4031b4]
add esp, 0xc
cmp eax, edi
jle 0x401682
cmp dword [0x4031a0], edi
jle 0x40162f
test bl, bl
push 1
push edi
je 0x401623
push str.http:__go.filenori.com__connfilenori
push str.chrome.exe
jmp 0x401676
push str.http:__www.filenori.com__connfilenori
push str.chrome.exe
jmp 0x401676
cmp dword [0x40319c], edi
jle 0x401656
test bl, bl
push 1
push edi
je 0x40164a
push str.http:__go.filenori.com__connfilenori
push str.firefox.exe
jmp 0x401676
push str.http:__www.filenori.com__connfilenori
push str.firefox.exe
jmp 0x401676
cmp dword [0x403198], edi
jle 0x401682
test bl, bl
push 1
push edi
je 0x40166c
push str.http:__go.filenori.com__connfilenori
jmp 0x401671
push str.http:__www.filenori.com__connfilenori
push str.Safari.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10