Function at 0x401000
Capabilities:
Hide graphical window
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.gaelicum
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x400
lea eax, [ebp - 0x4cc]
push 0
push eax
call fcn.00402160
add esp, 0xc
lea eax, [ebp - 0x4cc]
push 0x400
push eax
push 0x410b24
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.kernel32.exe
lea eax, [ebp - 0x4cc]
push 0x400
push eax
call fcn.00403524
add esp, 0xc
lea eax, [ebp - 0x4cc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4010fb
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0xa
push 0
push eax
call fcn.00402160
push 0x63
lea eax, [ebp - 0xcb]
mov byte [ebp - 0xcc], 0xb
push 0
push eax
call fcn.00402160
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x4d0]
add esp, 0x18
push 0
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x4d0]
push eax
push 0x64
lea eax, [ebp - 0xcc]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x413348
push 0x67
push edi
call esi
push 0x64
push 0x413280
push 0x6d
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6b
push edi
mov dword [ebp - 0x500], 0x30
mov dword [ebp - 0x4fc], 3
mov dword [ebp - 0x4f8], 0x4012b0
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0x4ec], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x4e8], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
push dword [ebp - 0x4ec]
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], 6
mov dword [ebp - 0x4dc], 0x6d
mov dword [ebp - 0x4d8], 0x413280
call esi
mov dword [ebp - 0x4d4], eax
lea eax, [ebp - 0x500]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push edi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x413348
push 0x413280
push 0
mov dword [0x413410], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x40128c
push dword [ebp + 0x14]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x51c]
push 0
push eax
call esi
test eax, eax
je 0x401273
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x51c]
push eax
push dword [ebp - 0x4d0]
push dword [ebp - 0x51c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x401260
lea eax, [ebp - 0x51c]
push eax
call edi
lea eax, [ebp - 0x51c]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x51c]
push eax
call esi
test eax, eax
jne 0x401231
mov eax, dword [ebp - 0x514]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401409
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401409
mov esp, ebp
pop ebp
ret 0x10