Function at 0x40b8f0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path

Disassembly:
sub esp, 0x2c0
lea eax, [esp + 0x1b8]
push ebx
push esi
push edi
push ebp
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xc0]
lea eax, [esp + 0x1c8]
push ecx
push 0
push 0x44b650
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [0x448dd0]
lea ecx, [esp + 0xc0]
add eax, 0x7644
push eax
push ecx
mov eax, dword [0x448dd0]
push eax
push str._spfedos32.exe__s__s
add eax, 0x77e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x50]
add esp, 0x14
mov eax, dword [0x448d48]
push 0x40
push ecx
push 0x122
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea edi, [esp + 0x7c]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
lea eax, [esp + 0x10]
lea edx, [esp + 0x7c]
push eax
mov dword [esp + 0x8c], ecx
push edx
mov dword [esp + 0x84], 0x44
push 0
mov eax, dword [0x448dd0]
push 0
add eax, 0x77e8
push 0x210
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40ba18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
cmp eax, 0x10b
jne 0x40b9f8
call fcn.0043dd10
push eax
mov eax, dword [0x4493b0]
add eax, 0x101
push eax
push 0
push 0
push 0x26
push 0
call fcn.0043cd20
add esp, 0x18
xor eax, eax
jmp 0x40bc04
call fcn.0043dd10
push eax
push 0
push 0
push 0x331
push 0
call fcn.0043cd20
add esp, 0x14
xor eax, eax
jmp 0x40bc04
mov eax, dword [0x448dd0]
push 1
push 0x12c
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [eax + 0xb68], 1
mov ecx, dword [0x448d60]
push ecx
call esi
push 1
mov ecx, dword [0x448d60]
push 0x12d
push ecx
call esi
push 1
mov eax, dword [0x448d4c]
push 0x12c
push eax
call esi
push 1
mov eax, dword [0x448d4c]
push 0x12d
push eax
xor ebp, ebp
call esi
push 0
push 0xc
call fcn.0043b1e0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x20]
push 1
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40babb
cmp dword [esp + 0x24], 0x12
je 0x40bb5f
lea eax, [esp + 0x20]
push eax
call fcn.0041f3d0
jmp 0x40baf7
mov eax, dword [esp + 0x10]
push 0
push eax
call ebx
test eax, eax
je 0x40baf2
cmp eax, 0x80
je 0x40baf7
cmp eax, 0x102
je 0x40baf7
call edi
push eax
call fcn.0043dd10
push eax
push 0
push 0
push 0x332
push 0
call fcn.0043cd20
add esp, 0x14
mov ebp, 1
test ebp, ebp
je 0x40ba8d
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x448dd0]
mov dword [eax + 0xb68], 0
mov ecx, dword [0x448dc8]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40bb3d
push 1
mov eax, dword [0x448dc8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x448dc8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x448dd0]
test byte [ecx + 0x52ea], 8
je 0x40bb6e
call fcn.0040dbc0
jmp 0x40bb70
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
jmp 0x40bc04
xor eax, eax
test eax, eax
jne 0x40bb78
xor eax, eax
jmp 0x40bb7b
mov eax, dword [eax + 0x18]
mov ecx, dword [0x448dd0]
xor edx, edx
mov dx, word [ecx + 0x52ea]
and edx, 0x10
push edx
push eax
lea eax, [esp + 0xc8]
push eax
call fcn.0040f7a0
mov ecx, dword [0x448dd0]
test byte [ecx + 0x52ea], 1
je 0x40bbb2
push 1
call fcn.0043dc20
push 0
mov eax, dword [0x448d60]
push 0x12c
push eax
call esi
push 0
mov eax, dword [0x448d60]
push 0x12d
push eax
call esi
push 0
mov eax, dword [0x448d4c]
push 0x12c
push eax
call esi
push 0
mov eax, dword [0x448d4c]
push 0x12d
push eax
call esi
push 1
push 0xc
call fcn.0043b1e0
mov eax, dword [esp + 0x2d4]
push eax
call fcn.0040dcf0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c0
ret 4