Function at 0x40c2fc
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40fc
call fcn.00417744
push edi
push esi
push ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x40e8], eax
mov dword [ebp - 0x40e4], edx
add esp, 0xfffffffc
push 0x2000
lea edi, [ebp - 0x2000]
push edi
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0xfffffffc
push 0x40c24c
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff4
lea eax, [ebp - 0x4000]
mov dword [ebp - 0x40d8], eax
push eax
call fcn.00404de0
add esp, 0x20
add esp, 0xfffffff4
mov edx, dword [ebp - 0x40d8]
push edx
call fcn.0040c1d8
mov dword [ebp - 0x40dc], eax
add esp, 0xfffffffc
push 0x10
push 0
lea esi, [ebp - 0x4010]
push esi
call sub.msvcrt.dll_memset
add esp, 0x20
add esp, 0xfffffffc
push 0x44
push 0
lea ebx, [ebp - 0x4060]
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x4060], 0x44
mov dword [ebp - 0x4034], 0x101
mov eax, dword [ebp - 0x40dc]
mov dword [ebp - 0x4020], eax
mov word [ebp - 0x4030], 0
add esp, 0xfffffff8
push esi
push ebx
push 0
push 0
push 0x20
push 1
push 0
push 0
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
test eax, eax
jne 0x40c420
call sub.KERNEL32.dll_GetLastError
push eax
mov edx, dword [ebp - 0x40d8]
push edx
push edi
push 0x40c274
call fcn.004086f0
add esp, 0xfffffff4
mov eax, dword [ebp - 0x40dc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x40d8]
push edx
call sub.msvcrt.dll_remove
mov al, 0
jmp 0x40c5b4
add esp, 0xfffffff8
push 0xea60
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 0x40d4]
push eax
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_GetExitCodeProcess
push dword [ebp - 0x40d4]
push 0x40c2a0
call fcn.004086f0
mov eax, dword [ebp - 0x40d4]
add esp, 0x10
cmp eax, 0x103
jne 0x40c488
add esp, 0xfffffff4
push 0x40c2ad
call fcn.004086f0
add esp, 0xfffffff8
push 1
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_TerminateProcess
add esp, 0x18
jmp 0x40c4ab
test eax, eax
je 0x40c4ab
push 0x40c2c1
mov eax, dword [ebp - 0x40e8]
mov edx, dword [ebp - 0x40e4]
push edx
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040bdb0
add esp, 0x10
add esp, 0xfffffff4
push dword [ebp - 0x4010]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x400c]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x40dc]
push eax
call sub.KERNEL32.dll_CloseHandle
mov byte [ebp - 0x40e9], 0
add esp, 0xc
cmp dword [ebp - 0x40d4], 0
jne 0x40c59f
add esp, 0xfffffff8
push 0x40c2c7
mov edx, dword [ebp - 0x40d8]
push edx
call sub.msvcrt.dll_fopen
mov esi, eax
add esp, 0xfffffffc
push esi
push 0x64
lea ebx, [ebp - 0x40d0]
push ebx
call sub.msvcrt.dll_fgets
add esp, 0x20
test eax, eax
je 0x40c593
add esp, 0xfffffffc
push 0xe
push 0x40c2ca
push ebx
call sub.msvcrt.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x40c538
lea edx, [ebp - 0x40c2]
jmp 0x40c555
add esp, 0xfffffffc
push 0x11
push 0x40c2ea
push ebx
call sub.msvcrt.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x40c593
lea edx, [ebp - 0x40bf]
mov edi, edx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx - 3]
add esp, 0xfffffffc
push ebx
push edx
mov edx, dword [ebp + 0x14]
push edx
call sub.msvcrt.dll_strncpy
mov eax, dword [ebp + 0x14]
mov byte [ebx + eax], 0
mov byte [ebp - 0x40e9], 1
add esp, 0xfffffff8
push eax
push 0x40c2d9
call fcn.004086f0
add esp, 0x20
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll_fclose
add esp, 0x10
add esp, 0xfffffff4
lea eax, [ebp - 0x4000]
push eax
call sub.msvcrt.dll_remove
mov al, byte [ebp - 0x40e9]
lea esp, [ebp - 0x4108]
pop ebx
pop esi
pop edi
leave
ret