Function at 0x401000
Capabilities:
Create process on windows
Print debug messages
Read .ini file

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x800
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.00401315
push 0x21c
mov esi, eax
call fcn.00401315
add esp, 8
push 0x105
mov edi, eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401058
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409a38
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4011b0
push str...Restrict.ini
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push ebp
push str.CoreCount
push str.Core
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esp + 0x18], eax
cmp eax, ebp
jne 0x401088
push 0x409a98
jmp 0x4011b1
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push 0x80
push 3
push ebp
push 3
push 0x80000000
push str..ControlDevice
call ebx
test eax, eax
je 0x4010ae
cmp eax, 0xffffffff
jne 0x4010da
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push str..VDISK
call ebx
test eax, eax
je 0x4010d0
cmp eax, 0xffffffff
jne 0x4010da
push str.icafe8
jmp 0x4011b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
jne 0x401112
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409ac4
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4011b7
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push edx
push eax
push 0x409ae0
push esi
call ebx
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
shl edx, cl
test dword [esp + 0x10], edx
je 0x4011a5
xor edx, edx
xor ecx, ecx
lea eax, [edx + 1]
lea ebx, [ebx]
cmp edx, dword [esp + 0x18]
jae 0x401169
mov ebx, dword [esp + 0x14]
test ebx, eax
je 0x401161
or ebp, eax
inc edx
inc ecx
rol eax, 1
cmp ecx, 0x20
jl 0x401150
push ebp
push 0x409b28
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebp
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
jne 0x4011b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409b64
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4011b0
push 0x409b48
push esi
call ebx
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00406050
add esp, 0xc
push edi
push 0x105
push edi
push 0x409b80
xor eax, eax
push str.RunPath
push str.Path
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401241
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x409bb4
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x401255
mov eax, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
push 0x105
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x409bcc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call fcn.004012a0
push esi
call fcn.004012a0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret 0x10