Function at 0x40ff18
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
dec ecx
jne 0x40ff14
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x410230
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 1
push 0
push 0
lea eax, [ebp - 0x14]
mov ecx, dword [0x41aaf0]
mov edx, 0x410248
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00403a94
push eax
push 0x410250
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
jae 0x40ffa2
push 0x410260
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00405370
push dword [ebp - 0x1c]
push 0x410274
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00406240
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x18]
call fcn.004176d4
xor ebx, ebx
call fcn.0040fda8
test al, al
jne 0x40ffbd
inc ebx
push 0x258
call sub.kernel32.dll_Sleep
cmp bl, 0xa
jb 0x40ffa4
xor esi, esi
cmp bl, 0xa
jb 0x41003d
push 0
push 0x410278
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
jne 0x40ffe4
push 0
push 0x410284
call sub.user32.dll_FindWindowA
mov esi, eax
push esi
call sub.user32.dll_SetForegroundWindow
call fcn.0040fda8
test al, al
jne 0x410033
push 1
push 0
push 0
lea eax, [ebp - 0x24]
mov edx, 0x410248
mov ecx, dword [0x41aaf0]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00403a94
push eax
push 0x410250
push 0
call sub.shell32.dll_ShellExecuteA
push 0x3e8
call sub.kernel32.dll_Sleep
push esi
call sub.user32.dll_SetForegroundWindow
jmp 0x41003d
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x41924c]
push eax
mov ecx, 0x410298
mov edx, 0x4102a8
mov eax, 0x80000002
call fcn.00406714
mov ebx, eax
inc ebx
mov eax, 0x41ab14
mov edx, 0x4102f0
call fcn.00403770
lea eax, [ebp - 0x28]
mov ecx, 0x41034c
mov edx, dword [0x41aadc]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0xc]
call fcn.0040de10
lea eax, [ebp - 0x2c]
mov ecx, 0x410360
mov edx, dword [0x41aadc]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x10]
call fcn.0040de10
push 0x410374
lea edx, [ebp - 0x30]
mov eax, 0x8b
call fcn.00405350
push dword [ebp - 0x30]
push 0x410384
push dword [0x41aaf8]
push 0x410384
push 0x410298
push 0x410390
lea edx, [ebp - 0x34]
xor eax, eax
mov al, bl
call fcn.00405350
push dword [ebp - 0x34]
push 0x410384
push dword [ebp - 0xc]
push 0x410384
push 0x410384
push 0x410384
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 0xe
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x41039c
call fcn.00403770
mov eax, dword [ebp - 8]
call fcn.0040631c
test al, al
jne 0x41012f
mov eax, 0x41040c
call fcn.004176d4
lea edx, [ebp - 0x3c]
mov eax, 0x41041c
call fcn.00404c8c
push dword [ebp - 0x3c]
push 0x410430
push 0x41043c
lea edx, [ebp - 0x40]
mov eax, 0x410448
call fcn.00404c8c
push dword [ebp - 0x40]
push 0x410430
push 0x410454
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.00403954
mov eax, dword [ebp - 0x38]
call fcn.00404d98
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x410274
call fcn.0040631c
mov eax, 0x41ab14
mov edx, 0x410460
call fcn.00403770
push 0
push esi
call sub.user32.dll_EnableWindow
mov eax, 0x4104a4
call fcn.00404d98
push 0x1f4
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x44]
mov eax, 0x4104b8
call fcn.00404c8c
mov eax, dword [ebp - 0x44]
call fcn.00404d98
mov eax, 0x41ab14
mov edx, 0x4104c4
call fcn.00403770
xor eax, eax
mov al, bl
push eax
mov edx, 0x4102a8
mov ecx, 0x410298
mov eax, 0x80000002
call fcn.0040698c
push 0x7530
call sub.kernel32.dll_Sleep
call fcn.004061a4
test al, al
je 0x410215
cmp bl, 3
jbe 0x410215
mov byte [ebp - 1], 1
call fcn.0040abc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410237
lea eax, [ebp - 0x44]
mov edx, 0x10
call fcn.00403740
ret