Function at 0x40b8da
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42acb8
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x18c], ebx
je 0x40be30
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0x14]
mov dword [esp + 0x88], ebx
call sub.MFC42.DLL_CString::CString_4
lea edi, [esi + 0xe5c]
mov byte [esp + 0x88], 1
mov ecx, edi
call fcn.00423770
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.004236b0
mov ecx, edi
mov ebp, eax
call fcn.00423790
mov ecx, edi
mov dword [esp + 0x28], eax
call fcn.004236d0
mov ecx, edi
mov dword [esi + 0xc1c], eax
call fcn.00423690
mov ecx, edi
mov dword [esi + 0xc20], eax
call fcn.004237b0
mov dword [esp + 0x20], eax
mov dword [esi + 0xc0c], eax
cmp dword [esi + 0xc20], ebx
jle 0x40ba47
mov eax, dword [esi + 0xacc]
mov ecx, dword [esi + 0xac4]
sub eax, ecx
sub esp, 8
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fild dword [esp + 0x28]
fmul dword [0x42f740]
fmulp st(1)
fmul dword [0x42f73c]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
call sub.MSVCRT.dll__ftol
mov dword [esi + 0xc0c], eax
mov ecx, dword [esi + 0xacc]
sub ecx, dword [esi + 0xac4]
sub ecx, 0x10
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fild dword [esi + 0xc1c]
fidiv dword [esi + 0xc20]
fmulp st(1)
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
add esp, 8
call sub.MSVCRT.dll__ftol
mov dword [esi + 0xc14], eax
mov eax, dword [esi + 0xc18]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jle 0x40ba53
mov edx, dword [esi + 0xacc]
mov eax, dword [esi + 0xac4]
sub edx, eax
sub esp, 8
sub edx, 0x10
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fild dword [esp + 0x24]
fidiv dword [esi + 0xc20]
fmulp st(1)
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
add esp, 8
call sub.MSVCRT.dll__ftol
mov dword [esi + 0xc14], eax
mov eax, dword [esi + 0xc18]
push eax
mov ecx, edi
call fcn.004236f0
mov dword [esi + 0xc18], ebx
jmp 0x40ba53
mov dword [esi + 0xc14], ebx
mov dword [esi + 0xc0c], ebx
mov ecx, dword [esi + 0xc0c]
mov edx, dword [esi + 0xc14]
push ecx
push edx
lea ecx, [esi + 0xcfc]
call fcn.00425600
mov eax, dword [esp + 0x24]
cmp eax, 0xb
ja case.default.0x40ba79
jmp dword [eax*4 + 0x40be48]
push 0x4376c0
jmp 0x40bbbf
push 0x4375d8
jmp 0x40bbbf
push 0x4376b8
lea ecx, [esp + 0x14]
call fcn.00428ed6
push ebp
lea eax, [esp + 0x18]
push str.__d_KB_S_
push eax
mov dword [esi + 0xc28], ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esi + 0xc2c], 3
jmp case.default.0x40ba79
push 0x437604
lea ecx, [esp + 0x14]
call fcn.00428ed6
mov eax, 1
cmp ebp, ebx
mov dword [esi + 0xc28], eax
mov dword [esi + 0xc2c], eax
je case.default.0x40ba79
push ebp
lea ecx, [esp + 0x18]
push str.__d_KB_S_
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
jmp case.default.0x40ba79
push 0x4376a4
lea ecx, [esp + 0x14]
call fcn.00428ed6
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x14]
push edx
push str.__d___
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esi + 0xc2c], 4
mov dword [esi + 0xc28], ebx
jmp case.default.0x40ba79
push 0x437694
lea ecx, [esp + 0x14]
call fcn.00428ed6
jmp case.default.0x40ba79
push 0x437688
jmp 0x40bbbf
push 0x437680
lea ecx, [esp + 0x14]
call fcn.00428ed6
jmp case.default.0x40ba79
push 0x437678
lea ecx, [esp + 0x14]
call fcn.00428ed6
jmp case.default.0x40ba79
push 0x437668
lea ecx, [esp + 0x14]
call fcn.00428ed6
jmp case.default.0x40ba79
push 0x43765c
lea ecx, [esp + 0x14]
call fcn.00428ed6
push ebp
lea ecx, [esp + 0x18]
push str.__d_KB_S_
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [esi + 0xc2c], 4
jmp case.default.0x40ba79
push 0x437650
lea ecx, [esp + 0x14]
call fcn.00428ed6
mov dword [esi + 0xc14], ebx
mov dword [esi + 0xc10], ebx
mov dword [esi + 0xc28], ebx
mov dword [esi + 0xc2c], 2
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
call fcn.00428f1e
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0xe14]
push eax
call fcn.004283b0
mov ecx, dword [esi + 0xc20]
mov edx, dword [esi + 0xc1c]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0040c180
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x88], 2
push ecx
lea ecx, [esi + 0xdcc]
call fcn.004283b0
mov edx, dword [esi + 0xc1c]
mov eax, dword [esi + 0xc20]
inc edx
cmp edx, eax
jl 0x40bc84
cmp dword [esi + 0xb64], ebx
je 0x40bc84
cmp eax, ebx
je 0x40bc84
mov ecx, dword [esi + 0xb7c]
mov eax, dword [esi + 0xb9c]
inc ecx
cmp ecx, eax
jl 0x40bc73
mov edx, dword [esi + 0xb80]
mov eax, dword [esi + 0xbb0]
inc edx
cmp edx, eax
jge 0x40bc84
mov eax, dword [esi + 0x20]
push ebx
push ebx
push 0x464
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, edi
call fcn.00423650
cmp dword [esi + 0xc10], eax
je 0x40bcb4
cmp dword [esi + 0xc28], ebx
je 0x40bcb4
mov edx, dword [esi + 0x20]
lea ecx, [esi + 0xab4]
push 1
push ecx
push edx
mov dword [esi + 0xc10], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [esi + 0xb6c], ebx
je 0x40bd0a
cmp dword [esi + 0xb60], ebx
je 0x40bd0a
mov eax, dword [esi + 0xc1c]
mov ecx, dword [esi + 0xc20]
add eax, 0xa
cmp eax, ecx
jge 0x40bd0a
mov ecx, dword [esi + 0xb7c]
mov eax, dword [esi + 0xb9c]
inc ecx
cmp ecx, eax
jge 0x40bd0a
mov edx, dword [esi + 0xacc]
mov eax, dword [esi + 0xac4]
sub edx, eax
mov eax, dword [esi + 0xc0c]
add eax, 0xa
cmp eax, edx
jl 0x40bd0a
mov ecx, esi
call fcn.00417d60
mov eax, dword [esi + 0xc2c]
mov ebp, dword [sym.imp.USER32.dll_PostMessageA]
cmp eax, 1
jne 0x40bd7c
mov ecx, dword [esi + 0x854]
mov eax, 1
cmp ecx, eax
jne 0x40bd7c
cmp dword [esi + 0xc1c], 5
jge 0x40bd7c
cmp dword [esi + 0x85c], ebx
jne 0x40bd7c
cmp dword [esi + 0xb9c], ebx
jle 0x40bd7c
push ecx
lea edx, [esi + 0x858]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov dword [esi + 0x85c], eax
call fcn.00428f24
lea ecx, [esi + 0xc7c]
call fcn.004273f0
mov ecx, edi
call fcn.00423610
test eax, eax
jne 0x40bd7c
mov eax, dword [esi + 0x20]
push ebx
push ebx
push 5
push eax
call ebp
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 4]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x437238
call sub.MFC42.DLL_CString::CString_1
mov ecx, edi
call fcn.00404fb0
cmp eax, ebx
jne 0x40bdee
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x40]
mov dword [esp + 0x3c], 0x44
rep stosd dword es:[edi], eax
lea ecx, [esi + 0xbc8]
push str.QvodTerminal.exe
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 0x2c]
mov eax, dword [eax]
lea edx, [esp + 0x3c]
push ecx
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x20]
push ebx
push ebx
push 0x466
push eax
call ebp
lea ecx, [esp + 0x18]
mov byte [esp + 0x88], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x88], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x88], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x80]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x7c
ret