Function at 0x41b320
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Delete file
Enumerate gui resources
Get common file path
Get file attributes
Manipulate console buffer
Read .ini file
Read pipe
Terminate process
Write pipe

Disassembly:
sub esp, 0xc4c
cmp dword [0x2b75b64], 0x422
push ebx
push ebp
push esi
push edi
jne 0x41b3ba
push 0
push 0
push 0
call fcn.0040423d
add esp, 0xc
push 0x403608
push 0
call fcn.0040423d
push 0
call fcn.00404202
add esp, 0xc
push 0
push 0
call fcn.0040395a
push 0
call fcn.00404202
fldz
add esp, 8
fstp dword [esp]
call fcn.00403810
fstp st(0)
push 0x403614
push 0x403618
push 0x44c350
call fcn.0040423d
add esp, 0xc
push 0
call fcn.00403aec
add esp, 4
push 0
push 0
push 0
call fcn.00404171
add esp, 0xc
push 0
push 0
push 0
call fcn.00403eb5
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
xor esi, esi
cmp esi, 0xff2
jne 0x41b3d5
mov eax, 0x38d6
add dword [0x2b75b64], eax
cmp dword [0x2b75b64], 0x534
jne 0x41b3e5
push 0
call edi
inc esi
cmp esi, 0x321aa6
jl 0x41b3c2
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x30]
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov edi, edi
cmp esi, 0x1c275
jge 0x41b40c
push 0
call ebp
cmp esi, 0x1ea070f3
jle 0x41b424
cmp edi, 0xacd436
je 0x41b424
cmp ebx, 0xad1af0c
jne 0x41b42d
inc esi
cmp esi, 0x8c238a18
jb 0x41b400
mov eax, dword [0x2b75b64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
mov edi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_SearchPathA]
mov dword [0x2b75648], eax
mov eax, dword [0x2b75b64]
mov dword [esp + 0x14], 0x962ae8
cmp eax, 3
jne 0x41b47c
lea ecx, [esp + 0x58]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [0x2b75b64]
cmp eax, 0xd
jne 0x41b519
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
push 0
call ebp
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x45c]
push eax
push 0
push 0
push 0
push 0
call ebx
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x64]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
lea edx, [esp + 0x860]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
mov eax, dword [0x2b75b64]
dec dword [esp + 0x14]
jne 0x41b465
xor esi, esi
test eax, eax
je 0x41b559
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 0xfe
jne 0x41b54a
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
call fcn.0041b060
mov eax, dword [0x2b75b64]
inc esi
cmp esi, eax
jb 0x41b535
cmp eax, 0x19c
jne 0x41b599
push 0x403620
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_LoadMenuW]
mov esi, 0x8dc
push 0
push 0
call edi
dec esi
jne 0x41b5a4
mov esi, dword [sym.imp.KERNEL32.dll_AddAtomA]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x25865
mov ebp, 0x15a
cmp dword [0x2b75b64], ebp
jne 0x41b5d5
push 0
call esi
push 0
push 0
call edi
dec ebx
jne 0x41b5c3
mov byte [0x44c350], bl
call fcn.0041aba0
call fcn.0041b2f0
call fcn.0041b040
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esp + 0x14], 0xdd7b3
lea ecx, [ecx]
cmp dword [0x2b75b64], 0x21
jne 0x41b63c
push 0
push 0
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x860]
push ecx
push 0
call edi
lea edx, [esp + 0x24]
push edx
call ebx
push 0
call ebp
dec dword [esp + 0x14]
jne 0x41b610
call fcn.0041b290
cmp dword [0x2b75b64], 0x58c
mov byte [0x44c351], 0x73
jne 0x41b6f5
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [esp + 0x458]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0x403634
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0x30
lea ecx, [esp + 0x2c]
push 0
push ecx
mov dword [esp + 0x30], 0
call fcn.0040acb0
add esp, 0xc
push 0
lea edx, [esp + 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push 0x403650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea eax, [esp + 0x58]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
call fcn.0041b050
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc4c
ret