Function at 0x4025c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
add byte [edx + 0x10], ch
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
push ebx
test bl, 0x4d
pop ebx
call fcn.00404410
jbe 0x4025f8
push si
mov si, 0x5c11
pop si
ja 0x4025f8
jo 0x4025a6
push cs
invalid
call fcn.00401d80
test eax, eax
je 0x4027d4
jbe 0x40261f
xchg bh, bh
xchg edi, edi
ja 0x40261f
cmp eax, eax
xchg esp, eax
movsd dword es:[edi], dword [esi]
mov bh, 0xdf
mov ebp, 0x33e181d0
fstp xword [ecx + 0x40]
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x25f]
mov byte [ebp - 0x260], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x260]
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4027d4
jb 0x402670
push esi
mov esi, 0xb484b386
pop esi
jae 0x402670
out 0xbd, eax
retf
call fcn.00402970
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15b]
mov byte [ebp - 0x15c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jp 0x4026a4
push si
pop si
jnp 0x4026a4
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x402696
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx + 0x6a], eax
add ecx, dword [ebp - 0x25f73]
jmp [eax - 0x74]
push 3
lea ecx, [ebp - 0x260]
push 0x40738c
push ecx
lea edx, [ebp - 0x15c]
push 0x4073ac
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
mov dword [ebp - 0x14], ebx
jmp 0x4026ce
xor ebx, ebx
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 8], eax
mov word [ebp - 0x28], bx
mov dword [ebp - 4], eax
jo 0x402710
push esi
mov esi, 0x387ef7e0
pop esi
jno 0x402710
invalid
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x58]
push ecx
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x15c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4027d4
js 0x402742
jns 0x402742
add eax, 0xbb868
add bh, bh
adc eax, sym.imp.KERNEL32.dll_Sleep
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
push ecx
push 0x4024a0
call dword [sym.imp.USER32.dll_EnumWindows]
jl 0x40277d
push dx
mov dx, 0x642f
pop dx
jge 0x40277d
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x40277e
push edx
cmp bh, byte [eax]
mov edx, dword [ebp - 0x10]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40279f
push ebp
invalid
mov eax, dword [ebp - 0x10]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov ecx, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x10]
push edx
call esi
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 1
mov dword [ebp - 0x14], eax
jl 0x4026cc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret