Function at 0x5298a0
Capabilities:
Allocate or change rwx memory
Copy file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x98]
lea edx, [ecx + eax + 0xca]
and edx, 0xad
and edx, dword [ebp - 0x100]
mov dword [ebp - 0x64], edx
movzx esi, word [ebp - 0x2c]
movzx eax, word [ebp - 0x68]
push eax
movzx ecx, byte [ebp - 0x28]
push ecx
call fcn.0052b4c0
add eax, 0xa6
and esi, eax
movzx edx, byte [ebp - 0xa8]
add edx, dword [ebp - 0xd4]
sub edx, dword [ebp - 0x24]
add edx, 4
or esi, edx
mov dword [ebp - 0x60], esi
push 0x40
push 0x1000
push 0x7d21f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax - 0x55]
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0x88], 0x4ee840
push 0
push 0
call sub.KERNEL32.dll_Module32FirstW
movzx ecx, byte [ebp - 0xde]
cmp eax, ecx
je 0x529980
cmp dword [ebp - 0x100], 0x92
je 0x529980
mov edx, dword [ebp - 0xb0]
push edx
movzx eax, word [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call fcn.00529720
movzx eax, al
movzx ecx, byte [ebp - 0xbe]
add eax, ecx
mov byte [ebp - 0xdd], al
jmp 0x5299bc
movzx edx, word [ebp - 0x8c]
mov ebx, dword [ebp - 0x28]
sub ebx, edx
mov eax, dword [ebp - 8]
push eax
call fcn.0051a8d0
movzx ecx, ax
sub ebx, ecx
mov edx, dword [ebp - 0xd0]
push edx
movzx eax, byte [ebp - 0x82]
push eax
call fcn.0052b4c0
add ebx, eax
movzx ecx, word [ebp - 0xdc]
add ebx, ecx
mov byte [ebp - 0x2d], bl
movzx edx, word [ebp - 0xbc]
mov eax, 0x63
sub eax, edx
mov byte [ebp - 0xa9], al
mov ecx, dword [ebp - 0xfc]
add ecx, 0xfa
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xd4], 0
cmp dword [ebp - 0x98], 0xf7
je 0x529a17
cmp dword [ebp - 0x100], 0x1a
jne 0x529a17
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x94]
add edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x88]
shr edx, cl
mov dword [ebp - 0x48], edx
jmp 0x529a46
movzx esi, word [ebp - 0x104]
movzx eax, word [ebp - 0xec]
add esi, eax
and esi, dword [ebp - 0x48]
and esi, dword [ebp - 0x44]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + eax + 0x44]
and esi, edx
mov dword [ebp - 0xe8], esi
cmp dword [ebp - 0x48], 0
jne 0x529a55
cmp dword [ebp - 0x100], 0
je 0x529a67
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x64]
lea edx, [ecx + eax - 0xed]
mov dword [ebp - 0x28], edx
jmp 0x529a86
mov eax, dword [ebp - 0xfc]
sub eax, 0x12
movzx ecx, word [ebp - 0xec]
add ecx, dword [ebp - 0x88]
or eax, ecx
mov word [ebp - 0xd8], ax
mov edx, dword [ebp - 0xe4]
sub edx, dword [ebp - 0xd4]
movzx eax, word [ebp - 0x80]
add edx, eax
or edx, dword [ebp - 0x10]
or edx, dword [ebp - 4]
mov word [ebp - 0x108], dx
mov dword [ebp - 0x44], 0xbc011016
movzx ecx, byte [ebp - 0xb]
add ecx, dword [ebp - 0xb0]
and ecx, 0x72
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x34], 0xab3d20a2
mov ebx, dword [ebp - 0x34]
add ebx, dword [ebp - 0x88]
add ebx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, byte [ebp - 9]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00529720
movzx eax, al
and ebx, eax
or ebx, dword [ebp - 0x38]
movzx ecx, word [ebp - 0xc4]
and ecx, dword [ebp - 4]
or ebx, ecx
mov byte [ebp - 0x1e], bl
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xfc]
or edx, eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0xd0], 0x7b2a9196
movzx ecx, word [ebp - 0x7c]
movzx edx, word [ebp - 0x104]
add ecx, edx
movzx eax, word [ebp - 0x1c]
lea ecx, [ecx + eax + 8]
movzx edx, byte [ebp - 0xb]
sub ecx, edx
mov dword [ebp - 0x98], ecx
movzx eax, byte [ebp - 0xaa]
cmp eax, 0xff
jne 0x529ba9
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x100]
push edx
movzx eax, word [ebp - 0x8c]
push eax
movzx ecx, word [ebp - 0xdc]
push ecx
call fcn.00529720
movzx edx, al
cmp dword [ebp - 0xb0], edx
je 0x529ba9
mov eax, dword [ebp - 0x100]
push eax
movzx ecx, byte [ebp - 0xe4]
push ecx
call fcn.0052b4c0
mov edx, dword [ebp - 0x48]
sub edx, eax
movzx eax, word [ebp - 0xa0]
lea ecx, [edx + eax + 0x1de]
mov dword [ebp - 0x74], ecx
jmp 0x529bef
movzx edx, word [ebp - 0x104]
mov esi, 0xb7
sub esi, edx
movzx eax, byte [ebp - 0xb]
sub esi, eax
movzx ecx, word [ebp - 0xf4]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
call fcn.0052b4c0
add eax, dword [ebp - 0x100]
movzx ecx, byte [ebp - 0x1d]
add eax, ecx
and esi, eax
movzx edx, byte [ebp - 0x82]
and esi, edx
movzx eax, word [ebp - 0x50]
and esi, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x10], 0
jne 0x529c19
cmp dword [ebp - 4], 0x61
je 0x529c19
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0xfc]
sub ecx, 0x32
and eax, ecx
mov dword [ebp - 0x28], eax
jmp 0x529c2f
movzx edx, byte [ebp - 0xc9]
push edx
call fcn.0051a8d0
movzx eax, ax
add eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0x118]
sub edx, 0x18
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 0x86
ja case.0x529c64.1
mov eax, dword [ebp - 0x118]
movzx ecx, byte [eax + 0x52a058]
jmp dword [ecx*4 + 0x52a044]
mov esi, dword [ebp - 0x88]
sub esi, dword [ebp - 0x64]
add esi, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x74]
push edx
movzx eax, byte [ebp - 0x100]
push eax
call fcn.0052b4c0
add esi, eax
sub esi, dword [ebp - 0xb4]
sub esi, dword [ebp - 0xe8]
add esi, dword [ebp - 0x110]
mov dword [ebp - 0x100], esi
jmp 0x529d39
mov ecx, 0xffffff9e
sub ecx, dword [ebp - 0x100]
sub ecx, dword [ebp - 0x44]
add ecx, 0x73
mov dword [ebp - 0x98], ecx
jmp 0x529d39
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0xd0]
sub edx, dword [ebp - 0xe4]
sub edx, 0x152
and eax, edx
mov dword [ebp - 0xb4], eax
jmp 0x529d39
movzx ecx, word [ebp - 0xdc]
mov eax, dword [ebp - 8]
shl eax, cl
or eax, 0x8f
mov word [ebp - 0x7c], ax
jmp 0x529d39
movzx ecx, word [ebp - 0xa0]
push ecx
movzx edx, byte [ebp - 8]
push edx
call fcn.0052b4c0
mov ecx, dword [ebp - 0x94]
lea edx, [eax + ecx + 0x34]
movzx eax, word [ebp - 0x78]
lea ecx, [edx + eax - 0x4d]
and ecx, dword [ebp - 0x28]
movzx edx, byte [ebp - 0xf5]
and ecx, edx
mov word [ebp - 0xd8], cx
mov dword [ebp - 0x48], 0xf8f7ee07
mov esi, dword [ebp - 0x28]
sub esi, 0xa8
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0051a8d0
movzx ecx, ax
sub esi, ecx
add esi, dword [ebp - 0x110]
sub esi, dword [ebp - 0xe8]
add esi, 0x68
mov word [ebp - 0xbc], si
mov dx, word [ebp - 0xd0]
mov word [ebp - 0x58], dx
mov dword [ebp - 0xb0], 0x5d5714f7
movzx eax, word [ebp - 0x14]
sub eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xd0]
sub ecx, 0x48
sub ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x64]
and eax, ecx
mov word [ebp - 0xf4], ax
mov dword [ebp - 0xd4], 0
jmp 0x529dbf
mov edx, dword [ebp - 0xd4]
add edx, 1
mov dword [ebp - 0xd4], edx
cmp dword [ebp - 0xd4], 0x142a
jae 0x52a031
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x60]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x70]
add eax, 0xfb
and eax, dword [ebp - 0xb4]
or eax, dword [ebp - 0xe8]
mov dword [ebp - 0x24], eax
movzx ecx, byte [ebp - 0xb]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0xfc]
sub edx, dword [ebp - 0xfc]
sub edx, dword [ebp - 0xe4]
add edx, 0x150
sub edx, dword [ebp - 0x100]
add edx, dword [ebp - 0x94]
mov word [ebp - 0x108], dx
mov eax, dword [ebp - 0x44]
xor eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
movzx esi, word [ebp - 0x104]
and esi, 0x13
mov ecx, dword [ebp - 0x38]
push ecx
movzx edx, byte [ebp - 0x28]
push edx
call fcn.0052b4c0
sub eax, 0x50
sub eax, dword [ebp - 4]
or esi, eax
mov eax, dword [ebp - 0x94]
add eax, 0xc3
or esi, eax
mov dword [ebp - 0xb4], esi
cmp dword [ebp - 0xe8], 0
jne 0x529e7b
cmp dword [ebp - 0x10], 0
je 0x529ebf
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x74]
lea ebx, [edx + ecx + 0xc0]
sub ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x74]
push eax
call fcn.0051a8d0
movzx esi, ax
movzx ecx, word [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0xe4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
call fcn.00529720
movzx edx, al
sub esi, edx
or ebx, esi
mov byte [ebp - 0x2d], bl
jmp 0x529ecb
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xb4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xd0]
add ecx, dword [ebp - 0xb0]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0x44]
add edx, 0xa5
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x34]
xor eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
xor ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x34], ecx
mov edx, 0xa8
sub edx, dword [ebp - 0x64]
and edx, 0x60
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xfc]
and eax, 0xa7
and eax, 0x36
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x110]
push edx
movzx eax, byte [ebp - 0x1d]
push eax
mov ecx, dword [ebp - 0x100]
push ecx
call fcn.00529720
movzx edx, al
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
sar edx, cl
movzx eax, word [ebp - 0xf4]
and eax, dword [ebp - 0x70]
or edx, eax
mov dword [ebp - 0x70], edx
mov ecx, dword [ebp - 0xb0]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0xe8]
movzx eax, word [ebp - 0xa0]
mov ecx, dword [ebp - 0xe4]
sub ecx, dword [ebp - 0x110]
and eax, ecx
or edx, eax
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0xb0]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x110]
push edx
movzx eax, byte [ebp - 0xe8]
push eax
call fcn.0052b4c0
add eax, dword [ebp - 8]
or eax, 0xc9
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xd0]
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x94]
movzx eax, word [ebp - 0x3c]
add edx, eax
movzx ecx, byte [ebp - 0x8d]
sub edx, ecx
mov byte [ebp - 0xa5], dl
mov dword [ebp - 0xe8], 0x10
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + edx*4]
xor ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xfc]
mov dword [eax + edx*4], ecx
jmp 0x529db0
mov eax, dword [ebp - 0xfc]
add eax, 0x3a00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret