Function at 0x6efbd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6efbdd
xchg dword [ebp - 4], ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6efeeb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x6eff04
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
lea eax, [ebp - 4]
call fcn.006eb774
test al, al
jne 0x6efd33
mov eax, dword [ebx + 0x394]
call fcn.0056819c
mov byte [ebx + 0x3d4], 1
mov eax, dword [0x806ea0]
cmp dword [eax], 0
jne 0x6efc65
mov ecx, ebx
mov dl, 1
mov eax, dword [0x67d0c0]
call sub.vcl120.bpl__Forms_TCustomForm__bctr_qqrp18Classes_TComponent
mov edx, dword [0x806ea0]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov edx, 0x6eff4c
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x6efc7f
cmp byte [ebx + 0x3c8], 0
je 0x6efca4
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov byte [eax + 0x41d], 1
cmp byte [ebx + 0x3c8], 0
je 0x6efca4
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov byte [eax + 0x41e], 1
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov byte [eax + 0x41c], 1
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + pe_nt_image_headers32]
mov byte [ebx + 0x3c8], 0
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2a4]
cmp eax, 1
jne 0x6efcf8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x3c0]
call fcn.006e29e4
mov byte [ebx + 0x3d5], 1
mov eax, ebx
call fcn.006f14f0
jmp 0x6efd12
cmp eax, 7
je 0x6efd0b
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.006ec200
jmp 0x6efd12
mov byte [ebx + 0x3c8], 1
mov eax, dword [ebx + 0x394]
call fcn.0056828c
mov byte [ebx + 0x3d4], 0
mov eax, dword [0x806ea0]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
jmp 0x6efec3
lea eax, [ebp - 0x18]
mov ecx, 0x6eff64
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
je 0x6efda4
push 1
lea eax, [ebp - 0x20]
mov ecx, 0x6eff64
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x1c]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6eff74
lea eax, [ebp - 0x24]
mov ecx, 0x6eff64
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x24]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6eff80
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x6efec3
mov eax, dword [0x806ea0]
cmp dword [eax], 0
jne 0x6efdc4
mov ecx, ebx
mov dl, 1
mov eax, dword [0x67d0c0]
call sub.vcl120.bpl__Forms_TCustomForm__bctr_qqrp18Classes_TComponent
mov edx, dword [0x806ea0]
mov dword [edx], eax
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov byte [eax + 0x41d], 0
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov byte [eax + 0x41c], 1
push 1
push 0x6eff98
push dword [ebp - 8]
push 0x6effbc
lea eax, [ebp - 0x28]
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x28]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [0x806ea0]
mov eax, dword [eax]
call sub.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
mov eax, dword [ebp - 0x2c]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
lea edx, [ebp - 0x34]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
lea eax, [ebp - 0x30]
mov edx, 0x6effcc
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x30]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebx + 0x394]
call fcn.0056819c
mov byte [ebx + 0x3d4], 1
mov eax, dword [0x806ea0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + pe_nt_image_headers32]
mov eax, dword [0x806ea0]
mov eax, dword [eax]
cmp dword [eax + 0x2a4], 1
jne 0x6efea7
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x3c0]
call fcn.006e29e4
mov byte [ebx + 0x3d5], 1
mov eax, ebx
call fcn.006f14f0
mov eax, dword [ebx + 0x394]
call fcn.0056828c
mov byte [ebx + 0x3d4], 0
mov eax, dword [0x806ea0]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6efef2
lea eax, [ebp - 0x34]
mov edx, 0xa
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret