Function at 0x40cfe8
Capabilities:
Create process on windows
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x40cff0
push ebx
push esi
push edi
mov esi, 0x4108fc
mov edi, 0x410658
xor eax, eax
push ebp
push 0x40d44f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x40d427
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004027c0
mov eax, 0xf4240
call fcn.00402838
mov ebx, eax
push dword [esi]
push 0x40d468
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa8]
call fcn.00406b6c
push dword [ebp - 0xa8]
push 0x40d474
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.004036ac
mov eax, dword [ebp - 0xa4]
call fcn.00406d2c
test al, al
jne 0x40d025
mov eax, esi
mov edx, 0x90
call fcn.0040387c
push 0x90
mov eax, dword [esi]
call fcn.004037b0
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x40d0ac
mov eax, dword [esi]
call fcn.004037b0
call fcn.00407020
mov edx, eax
mov eax, esi
call fcn.0040387c
jmp 0x40d0dc
lea edx, [ebp - 0xb0]
xor eax, eax
call fcn.00402768
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.00406e98
mov edx, dword [ebp - 0xac]
mov eax, esi
mov ecx, 0x40d468
call fcn.00403638
push 0x80
mov eax, dword [esi]
call fcn.004037b0
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0x80
push dword [esi]
push 0x40d468
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb8]
call fcn.00406b6c
push dword [ebp - 0xb8]
push 0x40d474
lea eax, [ebp - 0xb4]
mov edx, 4
call fcn.004036ac
mov eax, dword [ebp - 0xb4]
call fcn.004037b0
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [0x40f3f8]
mov byte [eax], 0
lea edx, [ebp - 0xbc]
xor eax, eax
call fcn.00402768
mov edx, dword [ebp - 0xbc]
mov eax, edi
call fcn.00404c6e
mov edx, 1
mov eax, edi
call fcn.00404fe9
call fcn.0040265c
mov eax, edi
call fcn.00404e58
call fcn.0040265c
mov dword [0x410900], eax
mov edx, dword [0x410900]
sub edx, 6
mov eax, edi
call fcn.00405020
call fcn.0040265c
push 0
lea edx, [ebp - 6]
mov ecx, 1
mov eax, edi
call fcn.00404d10
call fcn.0040265c
cmp byte [ebp - 6], 0x57
jne 0x40d211
mov eax, edi
call fcn.00404e14
call fcn.0040265c
mov dword [0x410904], eax
mov edx, dword [0x410904]
mov eax, edi
call fcn.00405020
call fcn.0040265c
push 0
mov ecx, dword [0x410900]
sub ecx, dword [0x410904]
lea edx, [ebp - 5]
mov eax, edi
call fcn.00404d10
call fcn.0040265c
lea eax, [ebp - 0xc0]
lea edx, [ebp - 5]
mov ecx, 5
call fcn.00403478
mov eax, dword [ebp - 0xc0]
call fcn.00406ba0
mov dword [0x410908], eax
jmp 0x40d21e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d431
mov eax, dword [0x40f3f8]
mov byte [eax], 0
lea edx, [ebp - 0xc4]
xor eax, eax
call fcn.00402768
mov edx, dword [ebp - 0xc4]
mov eax, edi
call fcn.00404c6e
mov edx, 1
mov eax, edi
call fcn.00404fe9
call fcn.0040265c
mov eax, dword [0x40f3f8]
mov byte [eax], 2
push dword [esi]
push 0x40d468
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xcc]
call fcn.00406b6c
push dword [ebp - 0xcc]
push 0x40d474
lea eax, [ebp - 0xc8]
mov edx, 4
call fcn.004036ac
mov edx, dword [ebp - 0xc8]
mov eax, 0x4107a4
call fcn.00404c6e
mov edx, 1
mov eax, 0x4107a4
call fcn.00405000
call fcn.0040265c
mov edx, dword [0x410908]
mov eax, edi
call fcn.00405020
call fcn.0040265c
xor edx, edx
mov eax, 0x4107a4
call fcn.00405020
call fcn.0040265c
mov eax, dword [0x40f3f8]
mov byte [eax], 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x90]
mov ecx, 0x80
mov eax, edi
call fcn.00404d10
call fcn.0040265c
mov eax, dword [0x40f3f8]
mov byte [eax], 2
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov eax, 0x4107a4
call fcn.00404d74
call fcn.0040265c
cmp dword [ebp - 0xc], 0
jne 0x40d2d3
mov eax, edi
call fcn.00404dd8
call fcn.0040265c
mov eax, 0x4107a4
call fcn.00404dd8
call fcn.0040265c
push 5
push dword [esi]
push 0x40d468
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd4]
call fcn.00406b6c
push dword [ebp - 0xd4]
push 0x40d474
lea eax, [ebp - 0xd0]
mov edx, 4
call fcn.004036ac
mov eax, dword [ebp - 0xd0]
call fcn.004037b0
push eax
call sub.kernel32.dll_WinExec
mov eax, 0x3e8
call fcn.0040c778
lea eax, [ebp - 0xa0]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowRect
mov ax, word [0x41064e]
cmp ax, 5
jb 0x40d3bf
cmp ax, 0xa
ja 0x40d3bf
push 0x40d47c
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_SetWindowTextA
push dword [esi]
push 0x40d468
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xe0]
call fcn.00406b6c
push dword [ebp - 0xe0]
push 0x40d474
lea eax, [ebp - 0xdc]
mov edx, 4
call fcn.004036ac
mov eax, dword [ebp - 0xdc]
call fcn.004037b0
mov edx, eax
lea eax, [ebp - 0xd8]
call fcn.00403548
mov eax, dword [ebp - 0xd8]
call fcn.00406e30
test al, al
je 0x40d381
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d431
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d456
lea eax, [ebp - 0xe0]
mov edx, 0x10
call fcn.004033b4
ret