Function at 0x6fc640
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
xor ebx, ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp + 8]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6fc941
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
mov edx, dword [ebp + 8]
mov ecx, 0xff
call sub.rtl260.bpl__System__UStrToString_qqrp29System__SmallString_uc_i255__x20System_UnicodeStringi
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x12f]
mov cl, 0xfa
call sub.rtl260.bpl__System__PStrNCpy_qqrp29System__SmallString_uc_i255__t1uc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xfb
lea eax, [ebp - 0x12f]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp + 8]
call sub.rtl260.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
call sub.rtl260.bpl__System__UStrLen_qqrx20System_UnicodeString
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp + 8]
call sub.rtl260.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.user32.dll_FindWindowW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jae 0x6fc86a
mov eax, dword [ebp - 0x18]
mov edx, 0x6fc95c
call sub.rtl260.bpl__System__UStrEqual_qqrv
je 0x6fc75e
mov eax, dword [ebp - 0x18]
mov edx, 0x6fc96c
call sub.rtl260.bpl__System__UStrEqual_qqrv
jne 0x6fc887
lea edx, [ebp - 0x248]
mov eax, dword [sym.imp.vcl260.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl260.bpl__Vcl_Forms_TApplication_GetExeName_qqrv
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call sub.rtl260.bpl__System_Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov dl, 1
mov eax, dword [ebp - 0x14]
call sub.rtl260.bpl__System_Sysutils_FileExists_qqrx20System_UnicodeStringo
test al, al
je 0x6fc83f
lea eax, [ebp - 0x24]
mov edx, dword [0x730f6c]
mov edx, dword [edx]
call sub.rtl260.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 0x24]
call sub.rtl260.bpl__System_UTF8Encode_qqrx31System__AnsiStringT_us_i65535__
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 0x28]
call sub.rtl260.bpl__System__WStrFromLStr_qqrr17System_WideStringx27System__AnsiStringT_us_i0__
push 0
push 0
mov eax, dword [ebp - 0x28]
call sub.rtl260.bpl__System__WStrToPWChar_qqrx17System_WideString
push eax
mov eax, dword [ebp - 0x14]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6fc970
push 0
call sub.shell32.dll_ShellExecuteW
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.user32.dll_FindWindowW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x6fc8db
lea eax, [ebp - 0x34]
push eax
mov eax, dword [sym.imp.vcl260.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
push 0x4a
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageW
jmp 0x6fc887
push 0
lea eax, [ebp - 0x250]
mov ecx, 0x6fc988
mov edx, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x250]
mov cx, word [0x6fc9b4]
xor edx, edx
call sub.vcl260.bpl__Vcl_Dialogs_MessageDlg_qqrx20System_UnicodeString26System_Uitypes_TMsgDlgType53System__Set_25System_Uitypes_TM
jmp 0x6fc8db
lea eax, [ebp - 0x34]
push eax
mov eax, dword [sym.imp.vcl260.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
push 0x4a
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageW
mov eax, dword [ebp - 0x18]
mov edx, 0x6fc96c
call sub.rtl260.bpl__System__UStrEqual_qqrv
jne 0x6fc8db
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindowRect
push 0
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x13c]
push eax
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x13c]
push eax
mov eax, dword [ebp - 0x140]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetWindowPos
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6fc948
lea eax, [ebp - 0x250]
call sub.rtl260.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x24c]
call sub.rtl260.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x248]
mov edx, 2
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x28]
call sub.rtl260.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 0x24]
call sub.rtl260.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x1c]
mov edx, 3
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp + 8]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret