Function at 0x45282e
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Delete file
Extract resource via kernel32 functions
Get file attributes
Identify system language via api
Manipulate console buffer
Read .ini file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xd0c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov dword [ebp + 0x6c], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x8c60b4], 0x134
mov ebx, edx
mov dword [ebp - 0x264], eax
jne 0x4528ab
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x401298
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push 0x4012e0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x260]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [0x8c60b4], 0x114e
mov dword [ebp + 0x70], esi
jne 0x4528d4
push 0x40139c
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
lea eax, [ebp - 0xc94]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameW
mov eax, dword [ebx]
mov dword [ebp - 0x270], eax
mov eax, dword [ebx + 4]
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x260], 0x9e3779b9
mov dword [ebp - 0x26c], eax
call fcn.00452821
add dword [ebp + 0x70], 0x54
cmp dword [0x8c60b4], 0xb54
jne 0x452943
lea eax, [ebp - 0x2dc]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
lea eax, [ebp - 0x29c]
push eax
push 0x4013e0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x274], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x25c], 0x20
mov edx, dword [ebp + 0x6c]
lea ecx, [ebp - 0x258]
call fcn.00452816
cmp dword [0x8c60b4], 0x4c3
jne 0x4529a5
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0x401460
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push esi
lea eax, [ebp - 0xc94]
push eax
push 0x401480
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, dword [ebp - 0x274]
add dword [ebp - 0x258], eax
cmp dword [0x8c60b4], 0xfa9
jne 0x4529c7
mov dword [0x85e424], 0xedeb2e40
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x70]
lea ebx, [ecx + eax]
shr eax, 5
mov dword [ebp + 0x74], eax
mov dword [0x85e420], 0x9150ce2e
mov eax, dword [ebp - 0x268]
add dword [ebp + 0x74], eax
cmp dword [0x8c60b4], 0x7b
jne 0x452a2d
push esi
push esi
lea eax, [ebp - 0xc94]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push 0x4014f8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push 0x401548
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x85b1f8], esi
mov dword [ebp - 0xdc], 0x8491f7e
mov dword [ebp - 0x28], 0x23409e45
mov dword [ebp - 0x18c], 0x546684a8
mov dword [ebp - 0xa0], 0x3f378b90
mov dword [ebp - 0x214], 0x26b873dc
mov dword [ebp - 0xd4], 0x358cf5cb
mov dword [ebp + 8], 0x29983644
mov dword [ebp - 0x224], 0x7dc6e5f5
mov dword [ebp - 0x54], 0x3aa9ec81
mov dword [ebp - 0x184], 0x39fd3d19
mov dword [ebp - 0x20c], 0x348f6274
mov dword [ebp - 0x198], 0x6e41c7d3
mov dword [ebp - 0x204], 0x53e187b4
mov dword [ebp - 0x4c], 0xfed61d6
mov dword [ebp - 0x1fc], 0x7ada085d
mov dword [ebp - 4], 0x4a1e8d93
mov dword [ebp - 0xcc], 0x456866b3
mov dword [ebp - 0x98], 0x510c15d
mov dword [ebp + 4], 0xa2eee99
mov dword [ebp - 0x44], 0x778c3974
mov dword [ebp - 0x17c], 0x5a464473
mov dword [ebp - 0x174], 0x685fa3d3
mov dword [ebp - 0x124], 0x6d8c862c
mov dword [ebp - 0x24c], 0x6888eb1
mov dword [ebp - 0x1f4], 0x5090d793
mov dword [ebp - 0x78], 0x4abedd81
mov dword [ebp - 0x48], 0x76ec4423
mov dword [ebp - 0x1f8], 0x15e92005
mov dword [ebp + 0x60], 0x70241620
mov dword [ebp - 0x1ec], 0x131b9522
mov dword [ebp - 0x3c], 0x2942bb1d
mov dword [ebp - 0x244], 0x2523a75b
mov dword [ebp - 0x8c], 0x11d08d33
mov dword [ebp - 0x84], 0x4b222137
mov dword [ebp - 0x20], 0x321ecfe3
mov dword [ebp - 0x1e4], 0x575b796
mov dword [ebp - 0x70], 0x1fffdd6a
mov dword [ebp + 0xc], 0x75faf039
mov dword [ebp - 0x118], 0x15899521
mov dword [ebp + 0x10], 0x1109d039
mov dword [ebp - 0x180], 0x75fcdb38
mov dword [ebp - 0x140], 0x713f7202
mov dword [ebp - 0x68], 0x2a34467c
mov dword [ebp - 0x158], 0x7ab9969b
mov dword [ebp - 0xc4], 0x6e6f4f62
mov dword [ebp - 0x1b8], 0x68a0941f
mov dword [ebp + 0x14], 0x771b8962
mov dword [ebp - 0x11c], 0x708fef37
mov dword [ebp + 0x64], 0xae5cf82
mov dword [ebp - 0x208], 0x5afd073b
mov dword [ebp - 0x200], 0x7da8d542
mov dword [ebp - 0xd8], 0x63059b8b
mov dword [ebp - 0x128], 0x4e282ba7
mov dword [ebp + 0x48], 0x5c4d4cf4
mov dword [ebp - 0x238], 0x1a6faced
mov dword [ebp + 0x18], 0x2a7bc4d0
mov dword [ebp - 0x40], 0x571fe9f2
mov dword [ebp + 0x50], 0x7fb79e3b
mov dword [ebp - 0x90], 0x12911132
mov dword [ebp - 0x1dc], 0x5e46be7b
mov dword [ebp - 0x34], 0x3ab28b4
mov dword [ebp - 0x110], 0x79ed9082
mov dword [ebp - 0x60], 0x51c3c43d
mov dword [ebp - 0x1d0], 0x4ed5ae5f
mov dword [ebp + 0x1c], 0x77ee5c69
mov dword [ebp - 0x108], 0x699e0318
mov dword [ebp - 0x230], 0x6a3df6d9
mov dword [ebp - 0x114], 0x6a68727f
mov dword [ebp - 0x1a8], 0x71a88410
mov dword [ebp - 0x18], 0x72144519
mov dword [ebp - 0x100], 0x7943706e
mov dword [ebp - 0x22c], 0x166ccf3d
mov dword [ebp - 0x1c8], 0x5d7bef27
mov dword [ebp - 0x248], 0x3fb67f18
mov dword [ebp - 0x1d4], 0x687df6e2
mov dword [ebp - 0x10c], 0xb23fdac
mov dword [ebp - 0x190], 0x3c0ec683
mov dword [ebp - 0x168], 0x52c79ee7
mov dword [ebp - 0xf8], 0xea67b34
mov dword [ebp - 0x178], 0x59ee28df
mov dword [ebp - 0x240], 0x2817525b
mov dword [ebp - 0x16c], 0x41ec49cf
mov dword [ebp + 0x24], 0x152f532e
mov dword [ebp - 0x1e8], 0x6bcf2b09
mov dword [ebp - 0x1cc], 0xd0455f
mov dword [ebp + 0x20], 0x113cca32
mov dword [ebp - 0x138], 0x2ca09670
mov dword [ebp - 0xd0], 0x1083bd57
mov dword [ebp - 0x2c], 0x8e56de1
mov dword [ebp + 0x28], 0x357268d5
mov dword [ebp - 0xb8], 0x3f5a247a
mov dword [ebp - 0x120], 0x7a66e545
mov dword [ebp - 0xf0], 0x24e4c52e
mov dword [ebp - 0x1c0], 0x18be6c3e
mov dword [ebp - 0xbc], 0x3db8192e
mov dword [ebp - 0x88], 0x777708fe
mov dword [ebp - 0x10], 0x746719ea
mov dword [ebp - 0x254], 0x70e28784
mov dword [ebp - 0x104], 0x74b1451c
mov dword [ebp - 0x24], 0x1fc38e1c
mov dword [ebp - 0xb0], 0x1a454084
mov dword [ebp - 0x210], 0x6cfab315
mov dword [ebp - 0xb4], 0x5bcca26f
mov dword [ebp - 0x1c4], 0xadc7db7
mov dword [ebp - 0x38], 0x33be3dc9
mov dword [ebp - 0x1bc], 0x218471aa
mov dword [ebp - 0xfc], 0x65649589
mov dword [ebp - 0x1b0], 0x51dad296
mov dword [ebp - 0xe8], 0x3c96d833
mov dword [ebp - 0x234], 0x65f5d1c
mov dword [ebp + 0x58], 0x45644988
mov dword [ebp - 0xf4], 0x69748472
mov dword [ebp - 0x7c], 0x297ecfd3
mov dword [ebp - 0xc8], 0x4f7dbcd7
mov dword [ebp - 0x21c], 0x18561cab
mov dword [ebp - 0x1c], 0x720ef4aa
mov dword [ebp - 0x220], 0x10ed17e7
mov dword [ebp - 0x58], 0x3953200b
mov dword [ebp + 0x2c], 0x5142c32a
mov dword [ebp - 0x30], 0x563d11f2
mov dword [ebp - 0x164], 0x160fd461
mov dword [ebp - 0x1b4], 0x603ca06c
mov dword [ebp - 0x74], 0x13629ac1
mov dword [ebp - 0xac], 0x74093f37
mov dword [ebp + 0x30], 0x679680a8
mov dword [ebp - 0x15c], 0x207d8eeb
mov dword [ebp - 0x1d8], 0xa216c63
mov dword [ebp - 0x6c], 0x2f5adecc
mov dword [ebp - 0xec], 0x44a2df35
mov dword [ebp - 0x1ac], 0x4a3c9e05
mov dword [ebp - 0x1a4], 0x2ac010e7
mov dword [ebp + 0x34], 0x67852e
mov dword [ebp - 0x228], 0x483f468d
mov dword [ebp - 0x130], 0xea69142
mov dword [ebp - 0x154], 0x1b85e6
mov dword [ebp + 0x3c], 0x2e8bf091
mov dword [ebp - 0x150], 0x7accba6a
mov dword [ebp - 0x23c], 0x70b903ac
mov dword [ebp + 0x38], 0x8dfbb34
mov dword [ebp - 0x160], 0x41683a2c
mov dword [ebp - 0x80], 0x1c83fdd3
mov dword [ebp - 0x188], 0x4ad81701
mov dword [ebp - 0xa4], 0x5d5c7f97
mov dword [ebp + 0x44], 0x679ac91e
mov dword [ebp + 0x4c], 0x1899f8c7
mov dword [ebp - 0x14], 0x4b6ad8c
mov dword [ebp - 0x1a0], 0x103e9126
mov dword [ebp - 0x1e0], 0x72b610fa
mov dword [ebp - 0x14c], 0x348041df
mov dword [ebp - 0xc], 0x7cee9c15
mov dword [ebp - 0xe0], 0x18528e3a
mov dword [ebp - 0x144], 0x2d0d3107
mov dword [ebp - 0x64], 0x7b65c550
mov dword [ebp - 0x19c], 0x75ec9eda
mov dword [ebp + 0x40], 0x42646a58
mov dword [ebp - 8], 0x3ddf5eff
mov dword [ebp - 0x9c], 0x36dc2ee9
mov dword [ebp + 0x54], 0x21b2f01a
mov dword [ebp - 0xc0], 0x726bed3c
mov dword [ebp - 0x250], 0x6718329c
mov dword [ebp - 0xa8], 0x8d77509
mov dword [ebp - 0x1f0], 0x56f4f074
mov dword [ebp - 0x50], 0x6b3a3a26
mov dword [ebp - 0x13c], 0x6bee7b34
mov dword [ebp - 0x134], 0x2a76cefe
mov dword [ebp + 0x5c], 0x25736362
mov dword [ebp - 0x12c], 0x5e24fb8f
mov dword [ebp - 0x218], 0x13cc9676
mov dword [ebp - 0x94], 0x145ce368
mov dword [ebp - 0x170], 0x53a4e4aa
mov dword [ebp - 0xe4], 0x180454cc
mov dword [ebp], 0x5abc23bd
mov dword [ebp - 0x148], 0x7a98d7b
mov dword [ebp - 0x194], 0x48a0c18f
mov dword [ebp - 0x5c], 0x6e4572f2
add dword [ebp - 0xdc], 0x467452b4
sub dword [ebp - 0xdc], 0x66708b4c
sub dword [ebp - 0xdc], 0x55fec03d
mov eax, 0x6a8d93fe
mov eax, dword [ebp - 0x258]
xor eax, ebx
xor dword [ebp + 0x74], eax
mov edx, dword [ebp + 0x74]
lea ecx, [ebp - 0x264]
call fcn.00452828
cmp dword [0x8c60b4], 0x426
jne 0x4530ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
lea eax, [ebp - 0x278]
push eax
push esi
lea eax, [ebp - 0x894]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [ebp + 0x68], esi
and eax, 0x4dd0071b
sub dword [ebp + 0x68], 0x2273eb88
mov ebx, 0x3a7cd587
add dword [ebp + 0x68], 0x2273eb8c
mov ebx, dword [ebp - 0x264]
mov ecx, dword [ebp + 0x68]
mov edx, dword [ebp - 0x270]
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x258], eax
call fcn.0045282b
mov edx, dword [ebp - 0x26c]
mov eax, ebx
shr eax, 5
lea ecx, [ebp + 0x74]
mov dword [ebp + 0x74], eax
call fcn.0045282b
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp - 0x258]
lea edx, [eax + ebx]
call fcn.0045281c
xor eax, dword [ebp + 0x74]
mov dword [0x47bb1c], esi
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
sub dword [ebp + 0x6c], eax
cmp dword [0x8c60b4], 0xcb6
jne 0x4531ea
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push esi
push esi
push esi
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
lea eax, [ebp - 0x280]
push eax
push esi
lea eax, [ebp - 0x294]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
lea eax, [ebp - 0x27c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0x494]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push esi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push esi
lea eax, [ebp - 0x894]
push eax
push 0x4014bc
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [ebp - 0x260]
sub dword [ebp + 0x70], eax
dec dword [ebp - 0x25c]
jne 0x45295f
mov eax, dword [ebp + 0x6c]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret