Function at 0x4174f0
Capabilities:
Create directory
Query environment variable
Read .ini file
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov byte [ebp - 0x81], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xbc], 0x55a8c
mov eax, 0x3bd39
mov ecx, dword [ebp - 0x10c]
sar eax, cl
and eax, 0x6482c
mov byte [ebp - 0x81], al
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
sub ecx, edx
mov eax, dword [ebp - 0x10c]
lea esi, [ecx + eax + 0x31b80]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
or esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ecx, word [ebp - 0xac]
lea edx, [eax + ecx + 0x6e598]
and edx, dword [ebp - 0x10c]
or esi, edx
mov dword [ebp - 0x10c], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
add eax, 0x5fc60
and eax, 0x7f307
mov dword [ebp - 0x10c], eax
movzx eax, byte [ebp - 0x81]
and eax, 0xfffee6c9
or eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
movzx ecx, ax
or ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x3969e
je 0x417613
cmp dword [ebp - 0x10c], 0
je 0x417613
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x10c]
je 0x417613
cmp dword [ebp - 0x10c], 0x2a80f
jne 0x41764d
movzx eax, byte [ebp - 0x81]
cmp eax, 0x61ddd
jne 0x41764d
mov ecx, dword [ebp - 0x10c]
add ecx, 0x5484
or ecx, 0xaed0
or ecx, 0xffff7673
xor esi, esi
movzx eax, byte [ebp - 0x81]
and eax, 0xfffa4325
cdq
and eax, dword [ebp - 0x70]
and edx, dword [ebp - 0x6c]
or ecx, eax
or esi, edx
mov word [ebp - 0xac], cx
jmp 0x4176aa
movzx esi, word [ebp - 0xac]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
sub esi, eax
add esi, 0x7a7e0
xor edx, edx
sub esi, dword [ebp - 0x70]
sbb edx, dword [ebp - 0x6c]
xor esi, 0x2f1de
xor edx, 0
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
add eax, ecx
xor ecx, ecx
or esi, eax
or edx, ecx
mov eax, 0x11d
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
or esi, eax
or edx, ecx
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x10c], 0x7f008
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x14c], edx
cmp dword [ebp - 0x14c], 0x75
je 0x41772a
cmp dword [ebp - 0x14c], 0xca
je 0x41779a
cmp dword [ebp - 0x14c], 0xdd
je 0x4176ea
jmp 0x4177cf
mov eax, dword [ebp - 0x10c]
add eax, 0x54f37
movzx ecx, byte [ebp - 0x81]
mov edx, dword [ebp - 0x10c]
lea ecx, [edx + ecx + 0x65da1]
sub ecx, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
sub ecx, edx
and eax, ecx
and eax, 0x736ec
mov dword [ebp - 0xbc], eax
jmp 0x417833
movzx esi, byte [ebp - 0x81]
movzx eax, word [ebp - 0xac]
sub esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, 0x6b382
sub ecx, eax
add ecx, 0x4d18
and esi, ecx
and esi, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
mov edi, dword [ebp - 0x10c]
sub edi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ecx, 0x574b5
sub ecx, eax
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
and edi, ecx
or esi, edi
mov dword [ebp - 0xbc], esi
jmp 0x417833
movzx eax, word [ebp - 0xac]
cdq
mov ecx, dword [ebp - 0x70]
sub ecx, eax
mov eax, dword [ebp - 0x6c]
sbb eax, edx
add ecx, 0x37384
adc eax, 0
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
xor esi, esi
or ecx, edx
or eax, esi
mov dword [ebp - 0xbc], ecx
jmp 0x417833
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
mov esi, eax
add esi, 0x5f8d0
movzx eax, byte [ebp - 0x81]
and esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
and esi, eax
or esi, dword [ebp - 0x10c]
push 0
push 0
call sub.KERNEL32.dll_Module32First
mov edi, eax
add edi, 0x89f4f
and edi, 0x48e00
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
and edi, eax
or esi, edi
mov dword [ebp - 0x10c], esi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
lea ecx, [esi + eax - 0x6292d]
or ecx, dword [ebp - 0x10c]
mov word [ebp - 0xac], cx
cmp dword [ebp - 0x70], 0x31857
jne 0x417872
cmp dword [ebp - 0x6c], 0
je 0x417889
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, 0x41b69
jne 0x4178c9
mov esi, dword [ebp - 0x70]
add esi, 0x8448a
mov edi, dword [ebp - 0x6c]
adc edi, 0
or esi, 0x52f2d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
movzx edx, word [ebp - 0xac]
sub eax, edx
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x10c], esi
jmp 0x417942
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
sub eax, dword [ebp - 0x10c]
xor eax, 0x7e810
mov esi, eax
xor edi, edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
sub eax, dword [ebp - 0x10c]
xor edx, edx
mov ecx, dword [ebp - 0x10c]
xor ebx, ebx
add ecx, dword [ebp - 0x70]
adc ebx, dword [ebp - 0x6c]
add ecx, 0x1aa9d
adc ebx, 0
and eax, ecx
and edx, ebx
or esi, eax
or edi, edx
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx - 0x4b6fa]
xor edx, edx
or esi, ecx
or edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
or eax, 0x1305a
mov dword [ebp - 0x10c], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
and eax, 0x278b5
xor edx, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
mov esi, eax
movzx edi, word [ebp - 0xac]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
and edi, eax
movzx eax, word [ebp - 0xac]
add eax, 0x41b58
mov ecx, dword [ebp - 0x10c]
add ecx, 0x1228f
sar eax, cl
and edi, eax
or esi, edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
or esi, ecx
mov dword [ebp - 0x10c], esi
movzx edx, word [ebp - 0xac]
mov eax, 0x1dbf4
sub eax, edx
sub eax, 0xefbd
mov byte [ebp - 0x81], al
movzx ecx, word [ebp - 0xac]
add ecx, dword [ebp - 0x10c]
mov byte [ebp - 0x81], cl
cmp dword [ebp - 0x10c], 0
jne 0x417aad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
cmp esi, eax
jne 0x417aad
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 0x3e5cd
jne 0x417aad
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov esi, eax
sub esi, dword [ebp - 0x10c]
or esi, 0x70c
mov edx, dword [ebp - 0x10c]
sub edx, 0x6f0e1
and edx, 0x3e4d3
or esi, edx
or esi, 0x3992f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
or esi, eax
xor eax, eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x4c609
mov edx, dword [ebp - 0x6c]
adc edx, 0
mov edi, dword [ebp - 0x10c]
xor ebx, ebx
add ecx, edi
adc edx, ebx
sub ecx, 0x2f48e
sbb edx, 0
or esi, ecx
or eax, edx
mov dword [ebp - 0x10c], esi
jmp 0x417aec
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
xor ecx, ecx
sub eax, dword [ebp - 0x70]
sbb ecx, dword [ebp - 0x6c]
and eax, 0x62f63
and ecx, 0
mov edx, 0x5c9bc
sub edx, dword [ebp - 0x10c]
sub edx, 0x7d019
xor esi, esi
and eax, edx
and ecx, esi
or eax, 0x2acb9
mov dword [ebp - 0x10c], eax
mov eax, 0x41961
sub eax, dword [ebp - 0x10c]
or eax, 0x4412f
mov word [ebp - 0xac], ax
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret