Function at 0x403000
Capabilities:
Read .ini file
Read file on windows

Disassembly:
sub esp, 0x834
mov eax, dword [ecx]
push ebx
push ebp
push esi
mov dword [esp + 0x30], ecx
mov ecx, dword [ecx + 4]
xor ebp, ebp
cmp dword [0x4a7594], 0x134
push edi
mov esi, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
jne 0x40304a
push ebp
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenEventA]
lea edx, [esp + 0x2c]
push edx
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [0x4a7594], 0x114e
mov dword [esp + 0x18], ebp
jne 0x403062
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], ecx
add dword [esp + 0x18], 0xc6ef3720
cmp dword [0x4a7594], 0xb54
jne 0x403096
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_LocalShrink]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], 0x20
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.00402fe0
cmp dword [0x4a7594], 0x4c3
jne 0x4030e4
push ebp
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push ebp
call dword [sym.imp.KERNEL32.dll_RequestDeviceWakeup]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
cmp dword [0x4a7594], 0xfa9
jne 0x403102
mov dword [0x43943c], 0xedeb2e40
mov ecx, dword [esp + 0x18]
lea edi, [ecx + eax]
shr eax, 5
mov dword [esp + 0x10], eax
mov dword [0x439438], 0x9150ce2e
mov eax, dword [esp + 0x3c]
add dword [esp + 0x10], eax
cmp dword [0x4a7594], 0x912
jne 0x403142
push ebp
push ebp
lea edx, [esp + 0x4c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov dword [0x439400], ebp
xor esi, edi
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
cmp dword [0x4a7594], 0x426
jne 0x403162
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x20], ebp
and eax, 0x4dd0071b
sub dword [esp + 0x20], 0x2273eb88
mov ebx, 0x3a7cd587
add dword [esp + 0x20], 0x2273eb8c
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea edx, [ecx + eax]
mov ecx, dword [esp + 0x20]
mov esi, eax
shl eax, cl
shr esi, 5
add esi, dword [esp + 0x38]
add eax, dword [esp + 0x2c]
mov dword [esp + 0x10], esi
mov ecx, eax
call fcn.00402ff0
xor eax, esi
mov dword [esp + 0x24], eax
mov dword [0x439214], ebp
mov eax, dword [esp + 0x24]
sub dword [esp + 0x14], eax
cmp dword [0x4a7594], 0x1d5
jne 0x4031ed
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push ebp
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push ebp
push ebp
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov edx, 0x9e3779b9
lea ecx, [esp + 0x18]
call fcn.00402fd0
sub dword [esp + 0x28], 1
jne 0x4030b0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
add esp, 0x834
ret