Function at 0x40273d
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e38
call fcn.00408900
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str._NoRun360SE
push esi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x402b51
mov ebx, dword [sym.imp.MSVCRT.dll__strnicmp]
push 7
push str._demand
push esi
call ebx
add esp, 0xc
test eax, eax
je 0x402b51
and word [ebp - 0xe38], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xe36]
rep stosd dword es:[edi], eax
push 9
push str._SafeMode
push esi
stosw word es:[edi], ax
call ebx
add esp, 0xc
test eax, eax
jne 0x4027da
lea eax, [ebp - 0xe38]
add esi, 0xa
push 0x400
push eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 4], 1
jmp 0x4027f9
lea eax, [ebp - 0xe38]
push 0x400
push eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and word [ebp - 0x42c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
lea eax, [ebp - 0x42c]
push esi
push eax
call fcn.004080bc
pop ecx
lea eax, [ebp - 0x42c]
pop ecx
push 0x40e8d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x42c]
mov ebx, 0x40e8cc
push eax
push 0xffffffffffffffff
mov edi, 0x40e8c4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xffffffff
jne 0x402866
lea eax, [ebp - 0x42c]
push eax
push 0x40e820
jmp 0x402876
test eax, eax
jne 0x40287e
lea eax, [ebp - 0x42c]
push eax
push 0x40e7dc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 4], 0
jne 0x40289e
push 0x4107d8
push 0
push str.AlwaysUseSandBox
push str.Security
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, 0xfff
xor eax, eax
lea edi, [ebp - 0x4e36]
mov word [ebp - 0x4e38], dx
mov dword [ebp - 8], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
call fcn.00408613
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402944
and word [ebp - 0x224], 0
mov edx, 0x82
mov ecx, edx
xor eax, eax
and word [ebp - 0x638], ax
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x636]
rep stosd dword es:[edi], eax
push eax
lea eax, [ebp - 0x224]
push esi
push eax
push ebx
call fcn.00407735
add esp, 0x10
test al, al
je 0x402944
lea eax, [ebp - 0x638]
push esi
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x638]
push 0x4105d0
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x402944
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x402b03
call fcn.00407bc3
test eax, eax
mov dword [ebp - 4], eax
je 0x402a8e
mov ax, word [0x411c2c]
mov ecx, 0x81
mov word [ebp - 0x224], ax
xor eax, eax
lea edi, [ebp - 0x222]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
rep stosd dword es:[edi], eax
test byte [ebp - 4], 3
stosw word es:[edi], ax
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
je 0x402a54
lea eax, [ebp - 0x224]
push esi
push eax
push 0x79
push dword [0x4101b8]
mov dword [ebp - 0xc], 1
call edi
push 0x41
push 0xf
call fcn.004046a7
pop ecx
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push 1
pop ecx
cmp eax, ecx
jne 0x402a54
push dword [sym.imp.MSVCP60.dll_struct_std::nothrow_t_const_std::nothrow]
mov dword [ebp - 8], ecx
push 0x10
call fcn.004088c7
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
je 0x402a01
mov cl, byte [ebp + 0xb]
push 0
mov byte [eax], cl
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
jmp 0x402a05
and dword [ebp + 8], 0
cmp dword [ebp + 8], 0
je 0x402a54
mov eax, dword [0x40e230]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
push 0
mov ecx, 0x410080
push dword [ebp + 8]
push 0x762
call fcn.0040316f
test eax, eax
jne 0x402a54
mov ecx, dword [ebp + 8]
push 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push dword [ebp + 8]
call fcn.004088bc
pop ecx
test byte [ebp - 4], 0xc
je 0x402a8e
lea eax, [ebp - 0x224]
push esi
push eax
push 0x7b
push dword [0x4101b8]
call edi
push 0x40
push 0xf
call fcn.004046a7
pop ecx
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
mov dword [ebp - 0x10], 1
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.00403049
add esp, 0x10
cmp dword [ebp - 4], 0
jne 0x402b51
call fcn.0040268c
call fcn.004040e0
push eax
lea eax, [ebp - 0xe38]
push dword [0x40e228]
push eax
lea eax, [ebp - 0x4e38]
push dword [0x40e224]
push str._s_s__s_u
push 0x1fff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x1c
lea eax, [ebp - 0x4e38]
push 0
push eax
push 0x411200
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00402b58
add esp, 0x10
jmp 0x402b51
lea eax, [ebp - 0xe38]
push eax
push 0x40e870
lea eax, [ebp - 0x4e38]
push 0x1fff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov esi, 0x4105d0
push esi
call fcn.00404789
add esp, 0x14
test eax, eax
je 0x402b51
push 5
lea eax, [ebp - 0x4e38]
push 0
push eax
push esi
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret