Function at 0x401000
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebp
mov ebp, esp
call sub.user32.dll_CreatePopupMenu
mov dword [0x40479a], eax
mov dword [0x404d53], 0
push str..config.ini
push 0x10
push str.Iconsize
push str.Global
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x404d2c], eax
mov dword [0x404d34], 0x1000
push dword [0x404d34]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x404d14], eax
push str..config.ini
push dword [0x404d34]
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileSectionNamesA
mov edx, dword [0x404d34]
sub edx, 2
cmp eax, edx
jne 0x401090
push dword [0x404d14]
call sub.kernel32.dll_GlobalFree
mov eax, dword [0x404d34]
shl eax, 1
mov dword [0x404d34], eax
jmp 0x401042
push dword [0x404d14]
call fcn.0040200f
or eax, eax
je 0x40140c
mov dword [0x404d30], 0
mov dword [0x404ad0], eax
mov edx, 0x400
imul edx
mov ebx, eax
push ebx
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x404796], eax
mov dword [0x404ad4], 0
mov eax, dword [0x404ad0]
cmp dword [0x404ad4], eax
je 0x40140c
mov eax, dword [0x404ad4]
mov edx, 0x400
imul edx
mov edi, dword [0x404796]
add edi, eax
mov dword [0x404ad8], edi
push str..config.ini
push 0x103
push edi
push 0x4049a1
push str.Path
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileStringA
mov edi, dword [0x404ad8]
add edi, 0x104
push str..config.ini
push 0x103
push edi
push 0x4049a1
push str.FileArg
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileStringA
push str..config.ini
push 0
push str.AutoStart
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileIntA
cmp al, 1
jne 0x40123d
cmp byte [0x404df5], 0
je 0x401196
push dword [0x404d14]
call sub.kernel32.dll_lstrlenA
mov edi, dword [0x404d14]
sub eax, 2
add edi, eax
mov ax, word [0x404df4]
cmp word [edi], ax
jne 0x40123d
push str..config.ini
push 1
push str.AutoStartShowFlag
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileIntA
mov edi, dword [0x404ad8]
mov esi, dword [0x404ad8]
add esi, 0x104
cmp byte [esi], 0x3f
jne 0x4011c9
mov esi, 0
pushal
mov dword [0x40486a], edi
push dword [0x404972]
call sub.kernel32.dll_lstrlenA
mov dword [0x404d28], eax
push dword [0x40486a]
call sub.kernel32.dll_lstrlenA
sub eax, dword [0x404d28]
dec eax
mov dword [0x404d28], eax
mov edi, dword [0x40486a]
add edi, eax
push edi
call sub.user32.dll_CharLowerA
mov edi, dword [0x40486a]
add edi, dword [0x404d28]
push edi
push dword [0x404972]
call sub.kernel32.dll_lstrcmpA
mov dword [0x404d28], eax
popal
cmp dword [0x404d28], 0
je 0x40123d
push eax
push 0
push esi
push edi
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
mov edi, dword [0x404ad8]
add edi, 0x208
push str..config.ini
push 0xec
push edi
push 0x4049a1
push str.Title
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileStringA
push str..config.ini
push 0
push str.IconIndex
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileIntA
mov edi, dword [0x404ad8]
add edi, 0x2f4
mov dword [edi], eax
mov edi, dword [0x404ad8]
add edi, 0x2f8
push str..config.ini
push 0x103
push edi
push 0x4049a1
push str.IconFile
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileStringA
push str..config.ini
push 0
push str.Order
push dword [0x404d14]
call sub.kernel32.dll_GetPrivateProfileIntA
mov edi, dword [0x404ad8]
add edi, 0x3fc
mov dword [edi], eax
push dword [0x4049c4]
push dword [0x404af8]
call sub.gdi32.dll_SelectObject
push eax
mov edi, dword [0x404ad8]
add edi, 0x208
mov dword [ebp - 4], edi
push edi
call sub.kernel32.dll_lstrlenA
push 0x40424e
push eax
push dword [ebp - 4]
push dword [0x404af8]
call sub.gdi32.dll_GetTextExtentPoint32A
mov eax, dword [0x40424e]
cmp dword [0x404d30], eax
jae 0x40132c
mov dword [0x404d30], eax
pop eax
push eax
push dword [0x404af8]
call sub.gdi32.dll_SelectObject
mov ecx, dword [0x404ad4]
mov ebx, 0x100
add ebx, ecx
mov edi, dword [0x404ad8]
add edi, 0x208
pushal
pushf
push 1
call sub.user32.dll_GetSystemMetrics
sub eax, 0x40
xor edx, edx
mov ebx, dword [0x404d2c]
add ebx, 4
idiv ebx
cmp dword [0x404ad4], eax
jbe 0x401399
cmp dword [0x404d4f], 0
jne 0x401399
mov dword [0x404d4b], 0x140
mov dword [0x404d4f], 1
inc dword [0x404d53]
jmp 0x4013d1
mov dword [0x404d4b], 0x100
push eax
mov ebx, eax
mov ecx, dword [0x404ad4]
mov eax, dword [0x404d53]
imul eax, ebx
sub ecx, eax
pop eax
cmp ecx, eax
ja 0x4013c7
mov dword [0x404d4f], 1
jmp 0x4013d1
mov dword [0x404d4f], 0
popf
popal
push edi
push ebx
push dword [0x404d4b]
push dword [0x40479a]
call sub.user32.dll_AppendMenuA
inc dword [0x404ad4]
push dword [0x404d14]
call sub.kernel32.dll_lstrlenA
mov ebx, dword [0x404d14]
add ebx, eax
inc ebx
mov dword [0x404d14], ebx
jmp 0x4010d2
pushal
pushf
push 1
call sub.user32.dll_GetSystemMetrics
sub eax, 0x40
xor edx, edx
mov ebx, dword [0x404d2c]
add ebx, 4
idiv ebx
push eax
mov ebx, eax
mov ecx, dword [0x404ad4]
mov eax, dword [0x404d53]
imul eax, ebx
sub ecx, eax
pop eax
add ecx, 5
cmp ecx, eax
jbe 0x40144d
mov dword [0x404d4b], 0x940
jmp 0x401457
mov dword [0x404d4b], 0x900
popf
popal
push 0
push 0x172
push dword [0x404d4b]
push dword [0x40479a]
call sub.user32.dll_AppendMenuA
jmp 0x4014bd
push 0x404998
push 0x177
push 0x100
push dword [0x40479a]
call sub.user32.dll_AppendMenuA
push 0
push 0x171
push 0x900
push dword [0x40479a]
call sub.user32.dll_AppendMenuA
push 0x4047a3
push 0x170
push 0x100
push dword [0x40479a]
call sub.user32.dll_AppendMenuA
push dword [0x404d14]
call sub.kernel32.dll_GlobalFree
pop ebp
leave
ret 4