Function at 0x402a38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x402a40
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x402c84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Screen]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TScreen_GetWorkAreaWidth_qqrv
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x58]
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Screen]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TScreen_GetWorkAreaHeight_qqrv
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x5c]
mov dword [ebp - 0xc], eax
push 2
push 0x32
push 0xfa
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call sub.vcl210.bpl__Vcl_Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SetWindowPos
lea edx, [ebp - 0x24]
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TApplication_GetExeName_qqrv
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call sub.rtl210.bpl__System_Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov ecx, 0x402ca0
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
lea edx, [ebp - 0x2c]
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TApplication_GetExeName_qqrv
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call sub.rtl210.bpl__System_Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov ecx, 0x402cd0
call sub.rtl210.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x14
jg 0x402b1d
mov edx, 0x402d0c
mov eax, dword [ebp - 4]
call fcn.004027a0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jle 0x402b07
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TApplication_ProcessMessages_qqrv
xor eax, eax
push ebp
push 0x402c52
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x402b6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x402ba0
lea eax, [ebp - 0x10]
mov edx, 0x402d44
call sub.rtl210.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call sub.dbrtl210.bpl__Data_Db_TDataSet_Close_qqrv
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call sub.adortl210.bpl__Data_Win_Adodb_TADOQuery_GetSQL_qqrv
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call sub.adortl210.bpl__Data_Win_Adodb_TADOQuery_GetSQL_qqrv
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call sub.dbrtl210.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov edx, 0x402de4
call sub.dbrtl210.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0x14]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 0x30]
call sub.rtl210.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov edx, dword [ebp - 0x30]
pop eax
call sub.dbrtl210.bpl__Data_Db_TBlobField_SaveToFile_qqrx20System_UnicodeString
mov eax, dword [sym.imp.vcl210.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl210.bpl__Vcl_Forms_TApplication_ProcessMessages_qqrv
push 1
push 0
push 0
mov eax, dword [ebp - 0x14]
call sub.rtl210.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x402d2c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x402c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c8b
lea eax, [ebp - 0x30]
mov edx, 5
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x18]
mov edx, 3
call sub.rtl210.bpl__System__UStrArrayClr_qqrpvi
ret