Function at 0x40ac30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x498289
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [0x4bc4a0]
push ebx
push ebp
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
je 0x40ac6c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40ac8f
push ebx
push 0x4bc4a8
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [0x4bc4a0], eax
je 0x40ac8f
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x4bc4a0], eax
mov eax, dword [0x4bc4a4]
cmp eax, ebx
je 0x40aca3
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40acc8
push ebx
push 0x4bc510
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [0x4bc4a4], eax
je 0x40accd
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x4bc4a4], eax
jmp 0x40accd
mov eax, dword [0x4bc4a4]
mov edi, dword [esp + 0x7c]
cmp dword [edi], 0x3d
jne 0x40ad05
push ebx
lea eax, [edi + 4]
lea esi, [ebp + 0x52c]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Find]
test eax, eax
mov ecx, esi
jge 0x40acfa
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Empty]
jmp 0x40b10e
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Empty]
mov eax, dword [0x4bc4a4]
cmp dword [0x4bc4a0], ebx
mov esi, dword [esp + 0x84]
jne 0x40aeca
cmp esi, ebx
je 0x40ad2d
cmp eax, ebx
je 0x40ad2d
cmp dword [0x4bc49c], 1
jne 0x40aeca
push ebx
call dword [sym.imp.MSVCR71.dll__time64]
mov esi, eax
mov eax, dword [esp + 0x84]
add esp, 4
test eax, eax
mov ebx, edx
je 0x40ad6f
mov eax, dword [ebp + 0x4bc]
mov edx, dword [ebp + 0x4c0]
mov ecx, esi
sub ecx, eax
mov eax, ebx
sbb eax, edx
mov edx, dword [ebp + 0x4b8]
test edx, edx
je 0x40ad86
test eax, eax
jg 0x40ad86
jl 0x40ad6f
cmp ecx, 0xa
jae 0x40ad86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 0xc
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x28], 0x44
call dword [0x49f754]
mov edx, dword [0x4bd0ec]
mov eax, dword [0x4bc618]
push edx
push eax
lea ecx, [esp + 0x88]
push str._s_s.exe__NULL
push ecx
mov dword [esp + 0x84], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x10
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x400
lea ecx, [esp + 0xa4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x1c]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40ae2a
push eax
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40ae35
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 0x4bc], esi
mov dword [ebp + 0x4b8], 1
mov dword [ebp + 0x4c0], ebx
mov dword [0x4bc4a0], 0
mov esi, 0x12c
push 0xa
dec esi
call edi
mov eax, dword [0x4bc4a0]
test eax, eax
je 0x40ae79
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40ae9d
push 0
push 0x4bc4a8
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [0x4bc4a0], eax
je 0x40aea6
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x4bc4a0], eax
mov eax, dword [0x4bc4a0]
test eax, eax
jne 0x40aeaa
test esi, esi
jg 0x40ae60
lea ecx, [esp + 0x80]
mov dword [esp + 0x74], 0xffffffff
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov esi, dword [esp + 0x84]
mov edi, dword [esp + 0x7c]
test esi, esi
mov ecx, dword [ebp + 0x20]
mov dword [edi + 0x408], ecx
je 0x40aeed
cmp esi, 1
je 0x40afe1
cmp dword [0x4bc49c], 2
je 0x40afe1
mov eax, dword [0x4bc4a0]
test eax, eax
je 0x40afe1
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40afe1
mov edx, dword [esp + 0x7c]
mov eax, dword [edx + 0x404]
mov ebx, 0x40c
cmp eax, ebx
mov edi, 0x6abe51
jne 0x40af55
push ebx
call sub.MFC71.DLL_operator_new_1
add esp, 4
test eax, eax
je 0x40af45
mov ecx, eax
call fcn.00406fe0
mov esi, eax
mov eax, dword [esp + 0x7c]
push eax
mov ecx, esi
call fcn.00406fa0
jmp 0x40af80
mov eax, dword [esp + 0x7c]
xor esi, esi
push eax
mov ecx, esi
call fcn.00406fa0
jmp 0x40af80
mov ebx, 0x610
push ebx
call sub.MFC71.DLL_operator_new_1
add esp, 4
test eax, eax
je 0x40af72
mov ecx, eax
call fcn.004070e0
mov esi, eax
jmp 0x40af74
xor esi, esi
mov ecx, dword [esp + 0x7c]
push ecx
mov ecx, esi
call fcn.00407000
push 0x14
call sub.MFC71.DLL_operator_new_1
add esp, 4
test eax, eax
je 0x40afa2
xor edx, edx
mov ecx, eax
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
jmp 0x40afa4
xor eax, eax
mov edx, dword [0x4bc4a0]
lea ecx, [eax + 8]
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [eax], edx
mov dword [eax + 4], 0x4a
mov dword [ecx + 8], esi
mov ecx, dword [ebp + 0x524]
test ecx, ecx
je 0x40ad6f
push eax
call fcn.0042fe80
mov esi, dword [esp + 0x84]
mov dword [esp + 0x10], 1
cmp esi, 3
je 0x40b000
cmp esi, 1
je 0x40b000
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40b10e
cmp esi, 2
jne 0x40ad6f
cmp dword [0x4bc49c], 1
je 0x40b0fa
mov eax, dword [0x4bc4a4]
test eax, eax
je 0x40b0fa
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40b0fa
mov edx, dword [esp + 0x7c]
mov eax, dword [edx + 0x404]
mov edi, 0x40c
cmp eax, edi
mov ebx, 0x6abe51
jne 0x40b075
push edi
call sub.MFC71.DLL_operator_new_1
add esp, 4
test eax, eax
je 0x40b065
mov ecx, eax
call fcn.00406fe0
mov esi, eax
mov eax, dword [esp + 0x7c]
push eax
mov ecx, esi
call fcn.00406fa0
jmp 0x40b0a0
mov eax, dword [esp + 0x7c]
xor esi, esi
push eax
mov ecx, esi
call fcn.00406fa0
jmp 0x40b0a0
mov edi, 0x610
push edi
call sub.MFC71.DLL_operator_new_1
add esp, 4
test eax, eax
je 0x40b092
mov ecx, eax
call fcn.004070e0
mov esi, eax
jmp 0x40b094
xor esi, esi
mov ecx, dword [esp + 0x7c]
push ecx
mov ecx, esi
call fcn.00407000
push 0x14
call sub.MFC71.DLL_operator_new_1
add esp, 4
test eax, eax
je 0x40b0c2
xor edx, edx
mov ecx, eax
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
jmp 0x40b0c4
xor eax, eax
mov edx, dword [0x4bc4a4]
lea ecx, [eax + 8]
mov dword [ecx], ebx
mov dword [ecx + 4], edi
mov dword [eax], edx
mov dword [eax + 4], 0x4a
mov dword [ecx + 8], esi
mov ecx, dword [ebp + 0x524]
test ecx, ecx
je 0x40ad6f
push eax
call fcn.0042fe80
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40b10e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ad6f
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 0xc