Function at 0x40d1a0
Capabilities:
Check mutex on windows
Check os version
Create process on windows
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b22c
mov eax, dword fs:[0]
push eax
sub esp, 0x950
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x410]
push 0x400
push 0
push eax
call fcn.0046a2f0
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.HttpServer.ini
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x410]
push eax
push 0x238e
push str.PORT
push str.SETUP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0x49ef1c
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 0xf
mov esi, eax
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
call fcn.004070d0
lea eax, [ebp - 0x840]
cmp esi, 0x238e
jne 0x40d286
push esi
push str.HttpServerMutex
push eax
call fcn.004465a0
add esp, 0xc
mov esi, eax
jmp 0x40d297
push esi
push str.HttpServerMutex__d
push eax
call fcn.004465a0
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x40d2e6
mov eax, dword [ebp - 0x814]
cmp eax, 0x10
jb 0x40d2bf
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.00402390
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 0xf
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x82c]
cmp eax, 0x10
jb 0x40d30b
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.00402390
cmp dword [ebp - 0x814], 0x10
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xd
push str.HttpServer4.0
lea ecx, [ebp - 0x900]
mov dword [ebp - 0x8ec], 0xf
mov esi, eax
mov dword [ebp - 0x8f0], 0
mov byte [ebp - 0x900], 0
call fcn.004070d0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x900]
mov ecx, 0x4ba5e4
push eax
call fcn.00401d80
mov eax, dword [ebp - 0x8ec]
cmp eax, 0x10
jb 0x40d38c
inc eax
lea ecx, [ebp - 0x900]
push eax
push dword [ebp - 0x900]
call fcn.00402390
test esi, esi
je 0x40d3b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d3b3
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
jmp 0x40d6bc
lea eax, [ebp - 0x8e0]
xor edi, edi
push eax
push 8
mov dword [ebp - 0x8e0], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d43f
lea eax, [ebp - 0x8e4]
mov dword [ebp - 0x8e4], edi
push eax
push 4
lea eax, [ebp - 0x8dc]
push eax
push 0x14
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40d40b
cmp dword [ebp - 0x8e4], 4
cmove edi, dword [ebp - 0x8dc]
push dword [ebp - 0x8e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40d43f
sub esp, 0x18
mov ecx, esp
push 0xa
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x49f1c0
mov byte [ecx], 0
call fcn.004070d0
jmp 0x40d47f
lea eax, [ebp - 0x8d8]
mov dword [ebp - 0x8d8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x8c8], 2
jne 0x40d60d
cmp dword [ebp - 0x8d4], 5
jne 0x40d60d
sub esp, 0x18
mov ecx, esp
push str.Windows_XP
call fcn.00406e40
call fcn.004477f0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
push 0x18
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x49f244
mov byte [ecx], 0
call fcn.004070d0
call fcn.004477f0
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
add esp, 0x18
push 0x64
push 0x4ba4e0
push 0x67
push ebx
call esi
push 0x64
push 0x4ba478
push 0x6d
push ebx
call esi
mov ecx, ebx
call fcn.0040d700
sub esp, 0x18
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x49f260
mov byte [ecx], 0
call fcn.004070d0
call fcn.004477f0
add esp, 0x18
mov ecx, ebx
call fcn.0040d780
test eax, eax
je 0x40d6ba
sub esp, 0x18
mov ecx, esp
push 0x10
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x49f270
mov byte [ecx], 0
call fcn.004070d0
call fcn.004477f0
add esp, 0x18
lea eax, [ebp - 0x904]
push eax
push 0
push 0
push 0x40dd20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [0x4ba268], eax
mov ecx, esp
push 0x14
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x49f284
mov byte [ecx], 0
call fcn.004070d0
call fcn.004477f0
add esp, 0x18
call fcn.0040e580
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push 0
push 0
mov dword [ebp - 0x8dc], eax
lea eax, [ebp - 0x920]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40d602
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
nop
lea eax, [ebp - 0x920]
push eax
push dword [ebp - 0x8dc]
push dword [ebp - 0x920]
call ebx
test eax, eax
jne 0x40d5eb
lea eax, [ebp - 0x920]
push eax
call esi
lea eax, [ebp - 0x920]
push eax
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x920]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40d5c0
mov esi, dword [ebp - 0x918]
jmp 0x40d6bc
sub esp, 0x18
mov ecx, esp
push 0x49f1f8
call fcn.00406e40
call fcn.004477f0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0046a2f0
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x3c
lea eax, [ebp - 0x95c]
push 0
push eax
call fcn.0046a2f0
add esp, 0xc
mov dword [ebp - 0x95c], 0x3c
lea eax, [ebp - 0x810]
mov dword [ebp - 0x958], 0x40
mov dword [ebp - 0x94c], eax
lea eax, [ebp - 0x95c]
mov dword [ebp - 0x940], 0xa
push eax
mov dword [ebp - 0x950], str.runas
mov dword [ebp - 0x948], str._adminoption_1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor esi, esi
mov ecx, dword [ebp - 0x814]
cmp ecx, 0x10
jb 0x40d6da
inc ecx
push ecx
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00402390
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a48
mov esp, ebp
pop ebp
ret 0x10