Function at 0x402169
Capabilities:
Check os version
Create process on windows
Enumerate files on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
push ebx
sub esp, 0x9b0
push 0x104
mov eax, dword [ebp + 8]
push 0x40a3c0
push 0
mov dword [0x40a5c8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x40a3c0
call sub.msvcrt.dll_wcslen
push 0x4069b4
lea eax, [eax + eax + 0x40a3ba]
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x9a8], eax
push 0x20
push dword [ebp + edi*4 - 0x9ac]
call sub.msvcrt.dll_strchr
pop ebx
pop esi
mov dword [ebp + edi*4 - 0x9a8], eax
test eax, eax
je 0x4021e5
mov byte [eax], 0
inc edi
inc eax
mov dword [ebp + edi*4 - 0x9ac], eax
jmp 0x4021bc
mov dword [ebp - 0x9ac], 0xffffffff
xor esi, esi
mov dword [ebp - 0x9b4], 0
mov dword [ebp - 0x9b0], 0
push str._hide
mov eax, dword [ebp - 0x9b0]
mov ebx, dword [ebp + eax*4 - 0x9a8]
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
je 0x402234
push 0x4069c2
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
jne 0x402243
mov dword [0x40a3b4], 1
jmp 0x402307
push str._quiet
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
je 0x4022fd
push 0x4069cc
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
je 0x4022fd
push str._elevate
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
je 0x402307
push 0x4069d8
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
je 0x402307
push str._config
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
je 0x4022b5
push 0x4069e3
push ebx
call sub.msvcrt.dll_strcmp
pop edx
pop ecx
test eax, eax
jne 0x4022e5
mov dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9b0]
inc eax
cmp edi, eax
jle 0x402307
mov eax, dword [ebp - 0x9b0]
push dword [ebp + eax*4 - 0x9a4]
call sub.msvcrt.dll_atoi
pop ecx
mov dword [ebp - 0x9ac], eax
jmp 0x402307
push str._multi
push ebx
call sub.msvcrt.dll_strcmp
pop ebx
pop edx
test eax, eax
jne 0x402307
mov esi, 1
jmp 0x402307
mov dword [ebp - 0x9b4], 1
inc dword [ebp - 0x9b0]
cmp edi, dword [ebp - 0x9b0]
jne 0x402205
xor eax, eax
mov ecx, 0x45
lea edi, [ebp - 0x980]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x980]
push eax
mov dword [ebp - 0x980], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x97c]
cmp eax, 5
seta byte [0x40a3b1]
jbe 0x4023a7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x66c]
push edx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4023a7
lea eax, [ebp - 0x25c]
push eax
push 4
lea eax, [ebp - 0x464]
push eax
push 0x14
push dword [ebp - 0x66c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4023a7
mov eax, dword [ebp - 0x464]
push dword [ebp - 0x66c]
mov byte [0x40a3b0], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.UpdateSettings
mov ebx, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
call ebx
push str.OpenConfig
mov dword [0x40a3ac], eax
call ebx
push str.CloseConfig
mov dword [0x40a3a8], eax
call ebx
push str.AddTray
mov dword [0x40a3a4], eax
call ebx
push str.HideTray
mov dword [0x40a3a0], eax
call ebx
test esi, esi
mov dword [0x40a39c], eax
jne 0x402484
push 0x40a3c0
push 0
push str.MultipleInstances
push str.Advanced
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x402484
cmp dword [ebp - 0x9b4], 0
jne 0x402996
push 0
push 0x40686a
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
mov ebx, eax
je 0x402484
push 0
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [0x40a3ac]
push eax
call esi
cmp dword [0x40a3b4], 0
je 0x402456
cmp dword [ebp - 0x9ac], 0
mov eax, dword [0x40a3a4]
jne 0x40245b
mov eax, dword [0x40a3a8]
push 0
push dword [ebp - 0x9ac]
push eax
push ebx
call esi
mov eax, dword [0x40a3a0]
cmp dword [0x40a3b4], 0
je 0x40247a
mov eax, dword [0x40a39c]
push 0
push 0
push eax
push ebx
call esi
jmp 0x4024e6
cmp byte [0x40a3b0], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jne 0x4024ed
push 0x40a3c0
push 0
push str.AlwaysElevate
push str.Advanced
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4024ed
push 0x104
lea esi, [ebp - 0x25c]
push esi
push 0
call ebx
mov eax, 0x4069a8
cmp dword [0x40a3b4], 0
jne 0x4024ce
xor eax, eax
push 1
push 0
push eax
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4024ed
xor esi, esi
jmp 0x402996
mov edx, 0x40a240
xor eax, eax
mov edi, edx
mov ecx, 0x57
rep stosd dword es:[edi], eax
lea esi, [ebp - 0x66c]
push 0x14
call sub.msvcrt.dll_malloc
mov edx, dword [str.en_US]
mov dword [0x40a220], 1
mov dword [eax], edx
mov edx, dword [0x4050a4]
mov dword [eax + 0x10], 0
mov dword [0x40a224], eax
mov dword [eax + 4], edx
mov edx, dword [0x4050a8]
mov dword [eax + 8], edx
mov edx, dword [0x4050ac]
mov dword [eax + 0xc], edx
push 0x104
push esi
push 0
call ebx
lea ebx, [ebp - 0x464]
mov eax, esi
call section..text
push str.Lang.ini
push esi
call sub.msvcrt.dll_wcscat
push esi
push ebx
call sub.msvcrt.dll_wcscpy
push ebx
call sub.msvcrt.dll_wcslen
mov ebx, eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x9b4], eax
add esp, 0x18
inc eax
je 0x402766
mov dword [ebp - 0x9b0], 0x14
add ebx, ebx
lea ecx, [ebp + ebx - 0x46e]
mov dword [ebp - 0x9bc], ecx
lea eax, [ebp - 0x230]
push eax
push ecx
inc dword [0x40a220]
call sub.msvcrt.dll_wcscpy
lea edi, [ebp - 0x464]
imul eax, dword [0x40a220], 0x14
lea ebx, [ebp - 0x86c]
push eax
push dword [0x40a224]
call sub.msvcrt.dll_realloc
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
push 0x100
push ebx
push 0x40687a
push str.Code
push section..rdata
mov dword [0x40a224], eax
call esi
push ebx
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp - 0x9b0]
add ecx, dword [0x40a224]
push 2
mov dword [ebp - 0x9b8], ecx
inc eax
push eax
call sub.msvcrt.dll_calloc
mov ecx, dword [ebp - 0x9b8]
mov dword [ecx], eax
push ebx
push eax
call sub.msvcrt.dll_wcscpy
add esp, 0x24
push edi
push 0x100
push ebx
push 0x40687a
push str.LangEnglish
push section..rdata
call esi
push ebx
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp - 0x9b0]
add ecx, dword [0x40a224]
push 2
mov dword [ebp - 0x9b8], ecx
inc eax
push eax
call sub.msvcrt.dll_calloc
mov edx, dword [ebp - 0x9b8]
mov dword [edx + 4], eax
push ebx
push eax
call sub.msvcrt.dll_wcscpy
push edi
push 0x100
push ebx
push 0x40687a
push str.Lang
push section..rdata
call esi
push ebx
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp - 0x9b0]
add ecx, dword [0x40a224]
push 2
mov dword [ebp - 0x9b8], ecx
inc eax
push eax
call sub.msvcrt.dll_calloc
mov ecx, dword [ebp - 0x9b8]
add esp, 0x20
mov dword [ecx + 8], eax
push ebx
push eax
call sub.msvcrt.dll_wcscpy
push edi
push 0x100
push ebx
push 0x40687a
push str.Author
push section..rdata
call esi
push ebx
call sub.msvcrt.dll_wcslen
mov esi, dword [ebp - 0x9b0]
push 2
add esi, dword [0x40a224]
inc eax
push eax
call sub.msvcrt.dll_calloc
mov dword [esi + 0xc], eax
push ebx
push eax
call sub.msvcrt.dll_wcscpy
push edi
call sub.msvcrt.dll_wcslen
mov ebx, dword [ebp - 0x9b0]
add ebx, dword [0x40a224]
add esp, 0x20
add eax, 2
add eax, eax
push eax
call sub.msvcrt.dll_malloc
mov dword [ebx + 0x10], eax
push edi
push eax
call sub.msvcrt.dll_wcscpy
lea edx, [ebp - 0x25c]
push edx
push dword [ebp - 0x9b4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0x9bc]
add dword [ebp - 0x9b0], 0x14
add esp, 0xc
test eax, eax
jne 0x4025a5
push dword [ebp - 0x9b4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x40a3c0
xor esi, esi
push 8
lea ebx, [ebp - 0x25c]
push ebx
push str.en_US
push str.Language
push 0x406b1e
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, dword [0x40a220]
jge 0x4027be
imul edi, esi, 0x14
mov eax, dword [0x40a224]
push dword [eax + edi]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop edx
pop ecx
test eax, eax
jne 0x4027bb
mov eax, dword [0x40a224]
mov eax, dword [eax + edi + 0x10]
call fcn.0040213a
jmp 0x4027be
inc esi
jmp 0x40278b
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x25c], 0x30
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0x401d97
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 6
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0x40686a
mov dword [ebp - 0x230], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0
push dword [ebp - 0x234]
push 0xa8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, dword [sym.imp.USER32.dll_LoadImageA]
push 1
push 0
push 0
push 1
push str.tray_disabled
push dword [0x40a5c8]
mov dword [0x40a22c], eax
call ebx
push 1
push 0
push 0
push 1
push str.tray_enabled
push dword [0x40a5c8]
mov dword [0x40a218], eax
call ebx
cmp dword [0x40a218], 0
mov dword [0x40a21c], eax
je 0x40291b
test eax, eax
je 0x40291b
push 0x40
mov eax, dword [0x40a22c]
push 0x406b49
push 0x40a1c4
mov dword [0x40a020], 0x3b8
mov dword [0x40a028], 0
mov dword [0x40a02c], 7
mov dword [0x40a024], eax
mov dword [0x40a030], 0x401
mov dword [0x40a1c0], 0x2710
call sub.msvcrt.dll_strncpy
push str.TaskbarCreated
mov dword [0x40a204], 4
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x40a018], eax
add esp, 0xc
call fcn.00401b96
call fcn.00401ca5
cmp dword [0x40a3b4], 0
je 0x402946
cmp dword [0x40a228], 0
jne 0x402946
mov dword [0x40a3b4], 0
call fcn.00401b96
cmp dword [ebp - 0x9ac], 0xffffffff
je 0x402969
push 0
push dword [ebp - 0x9ac]
push dword [0x40a3a8]
push dword [0x40a22c]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0
lea ebx, [ebp - 0x464]
push ebx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x402990
push ebx
call dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x402969
mov esi, dword [ebp - 0x45c]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10