Function at 0x40bc7c
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40fc
call fcn.004170c4
push edi
push esi
push ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x40e8], eax
mov dword [ebp - 0x40e4], edx
add esp, 0xfffffffc
push 0x2000
lea edi, [ebp - 0x2000]
push edi
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0xfffffffc
push 0x40bbcc
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff4
lea eax, [ebp - 0x4000]
mov dword [ebp - 0x40d8], eax
push eax
call fcn.00404a40
add esp, 0x20
add esp, 0xfffffff4
mov edx, dword [ebp - 0x40d8]
push edx
call fcn.0040bb58
mov dword [ebp - 0x40dc], eax
add esp, 0xfffffffc
push 0x10
push 0
lea esi, [ebp - 0x4010]
push esi
call sub.msvcrt.dll_memset
add esp, 0x20
add esp, 0xfffffffc
push 0x44
push 0
lea ebx, [ebp - 0x4060]
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x4060], 0x44
mov dword [ebp - 0x4034], 0x101
mov eax, dword [ebp - 0x40dc]
mov dword [ebp - 0x4020], eax
mov word [ebp - 0x4030], 0
add esp, 0xfffffff8
push esi
push ebx
push 0
push 0
push 0x20
push 1
push 0
push 0
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
test eax, eax
jne 0x40bda0
call sub.KERNEL32.dll_GetLastError
push eax
mov edx, dword [ebp - 0x40d8]
push edx
push edi
push 0x40bbf4
call fcn.00408090
add esp, 0xfffffff4
mov eax, dword [ebp - 0x40dc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x40d8]
push edx
call sub.msvcrt.dll_remove
mov al, 0
jmp 0x40bf34
add esp, 0xfffffff8
push 0xea60
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 0x40d4]
push eax
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_GetExitCodeProcess
push dword [ebp - 0x40d4]
push 0x40bc20
call fcn.00408090
mov eax, dword [ebp - 0x40d4]
add esp, 0x10
cmp eax, 0x103
jne 0x40be08
add esp, 0xfffffff4
push 0x40bc2d
call fcn.00408090
add esp, 0xfffffff8
push 1
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_TerminateProcess
add esp, 0x18
jmp 0x40be2b
test eax, eax
je 0x40be2b
push 0x40bc41
mov eax, dword [ebp - 0x40e8]
mov edx, dword [ebp - 0x40e4]
push edx
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040b730
add esp, 0x10
add esp, 0xfffffff4
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x400c]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x40dc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov byte [ebp - 0x40e9], 0
add esp, 0xc
cmp dword [ebp - 0x40d4], 0
jne 0x40bf1f
add esp, 0xfffffff8
push 0x40bc47
mov edx, dword [ebp - 0x40d8]
push edx
call sub.msvcrt.dll_fopen
mov esi, eax
add esp, 0xfffffffc
push esi
push 0x64
lea ebx, [ebp - 0x40d0]
push ebx
call sub.msvcrt.dll_fgets
add esp, 0x20
test eax, eax
je 0x40bf13
add esp, 0xfffffffc
push 0xe
push 0x40bc4a
push ebx
call sub.msvcrt.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x40beb8
lea edx, [ebp - 0x40c2]
jmp 0x40bed5
add esp, 0xfffffffc
push 0x11
push 0x40bc6a
push ebx
call sub.msvcrt.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x40bf13
lea edx, [ebp - 0x40bf]
mov edi, edx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx - 3]
add esp, 0xfffffffc
push ebx
push edx
mov edx, dword [ebp + 0x14]
push edx
call sub.msvcrt.dll_strncpy
mov eax, dword [ebp + 0x14]
mov byte [ebx + eax], 0
mov byte [ebp - 0x40e9], 1
add esp, 0xfffffff8
push eax
push 0x40bc59
call fcn.00408090
add esp, 0x20
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll_fclose
add esp, 0x10
add esp, 0xfffffff4
lea eax, [ebp - 0x4000]
push eax
call sub.msvcrt.dll_remove
mov al, byte [ebp - 0x40e9]
lea esp, [ebp - 0x4108]
pop ebx
pop esi
pop edi
leave
ret