Function at 0x4035e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4269cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x994
push ebx
mov ebx, dword [0x4585f0]
xor eax, eax
push ebp
test ebx, ebx
push esi
push edi
setne al
mov dword [0x4581a8], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ecx
mov dword [0x44b340], eax
mov ecx, esp
mov dword [esp + 0x18], esp
push str.protect.ini
call fcn.0041a5cc
lea ecx, [esp + 0x18]
push ecx
call fcn.00405c30
mov edx, dword [eax]
add esp, 8
lea eax, [esp + 0x54c]
push edx
push 0x4581ac
push 0x430274
push eax
call fcn.00407d6b
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.0041a55e
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x54c]
push ecx
lea edx, [esp + 0x150]
push 0x400
push edx
push 0x434b88
push 0x430510
push str.debug
call ebx
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4036bc
lea eax, [esp + 0x14c]
push eax
call fcn.00407ca6
add esp, 4
mov dword [0x458614], eax
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x434b88
push str.switch
push str.debug
call ebx
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40370a
lea eax, [esp + 0x14c]
push eax
call fcn.00407ca6
add esp, 4
mov dword [0x458618], eax
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x434b88
push str.program
push str.process
call ebx
lea ecx, [esp + 0x18]
call fcn.00402140
lea ecx, [esp + 0x18]
mov dword [esp + 0x9ac], 0
call fcn.00402300
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
test eax, eax
je 0x4037bb
mov ebp, 0x44b344
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x4037bb
mov ecx, edi
lea edx, [esp + 0x20]
sub ecx, esi
push ecx
push esi
push edx
call fcn.00408130
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
lea esi, [edi + 1]
push eax
call fcn.00402400
test eax, eax
je 0x403764
mov ecx, dword [esp + 0x10]
mov dword [ebp], eax
inc ecx
add ebp, 4
mov dword [esp + 0x10], ecx
jmp 0x403764
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x878]
push 0x12c
push edx
push 0
mov dword [0x44b4d0], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x403819
lea eax, [esp + 0x878]
push 0x5c
push eax
call fcn.00407b70
mov edi, eax
inc edi
push edi
call fcn.004184eb
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x44b4d4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x434b88
push str.program
push str.process
mov ebp, 1
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.004184eb
lea eax, [esp + 0x150]
add esp, 4
test eax, eax
je 0x4038ac
mov dword [esp + 0x10], 0x44b510
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x4038ac
mov ecx, edi
sub ecx, esi
push ecx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00408130
add esp, 0xc
inc ebp
add esi, 0x3c
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40386e
lea edx, [esp + 0x54c]
lea eax, [esp + 0x14c]
push edx
push 0x400
push eax
push 0x434b88
push str.processname
push str.hideprocess
mov dword [0x44cc44], ebp
call ebx
lea ecx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push ecx
call fcn.004184eb
lea edx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test edx, edx
je 0x403958
mov dword [esp + 0x10], 0x44cc48
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x403958
sub eax, esi
lea ecx, [esp + 0x20]
push eax
push esi
push ecx
call fcn.00408130
add esp, 0xc
lea edx, [esp + 0x20]
lea ecx, [esp + 0x18]
lea esi, [edi + 1]
push edx
call fcn.00402400
test eax, eax
je 0x403904
mov ecx, dword [esp + 0x10]
inc ebp
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 0x10], ecx
jmp 0x403904
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x434b88
push str.processname
mov dword [0x44cdd8], ebp
push str.hideprocess
xor ebp, ebp
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.004184eb
lea eax, [esp + 0x150]
add esp, 4
test eax, eax
je 0x4039ee
mov dword [esp + 0x10], 0x44cddc
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x4039ee
mov ecx, edi
sub ecx, esi
push ecx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00408130
add esp, 0xc
inc ebp
add esi, 0x3c
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x4039b0
lea edx, [esp + 0x54c]
lea eax, [esp + 0x14c]
push edx
push 0x400
push eax
push 0x434b88
push str.name
push str.filename
mov dword [0x44e54c], ebp
call ebx
lea ecx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push ecx
call fcn.004184eb
lea edx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test edx, edx
je 0x403a82
mov dword [esp + 0x10], 0x44e550
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x403a82
sub eax, esi
push eax
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00408130
add esp, 0xc
inc ebp
add esi, 0x3c
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x403a46
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x434b88
push str.name
push str.service
mov dword [0x44fcc0], ebp
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.004184eb
lea ecx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test ecx, ecx
je 0x403b18
mov dword [esp + 0x10], 0x44fcc4
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x403b18
mov edx, edi
sub edx, esi
push edx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00408130
add esp, 0xc
inc ebp
add esi, 0x3c
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x403ada
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x434b88
push str.name
push str.keyname
mov dword [0x451434], ebp
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.004184eb
lea eax, [esp + 0x150]
add esp, 4
xor ebp, ebp
test eax, eax
je 0x403bae
mov dword [esp + 0x10], 0x451438
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x403bae
mov ecx, edi
sub ecx, esi
push ecx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00408130
add esp, 0xc
inc ebp
add esi, 0x3c
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x403b70
lea edx, [esp + 0x54c]
lea eax, [esp + 0x14c]
push edx
push 0x400
push eax
push 0x434b88
push str.name
push str.keyvaluename
mov dword [0x452ba8], ebp
call ebx
lea ecx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push ecx
call fcn.004184eb
lea edx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test edx, edx
je 0x403c42
mov dword [esp + 0x10], 0x452bac
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x403c42
sub eax, esi
push eax
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00408130
add esp, 0xc
inc ebp
add esi, 0x3c
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x403c06
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x434b88
push str.name
push str.invalid
mov dword [0x45431c], ebp
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.004184eb
lea ecx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test ecx, ecx
je 0x403cd3
mov ebx, 0x454320
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov edi, eax
add esp, 8
test edi, edi
je 0x403ccd
mov edx, edi
sub edx, esi
push edx
push esi
push ebx
call fcn.00408130
add esp, 0xc
inc ebp
add ebx, 0x3c
lea esi, [edi + 1]
jmp 0x403c97
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x434b88
push str.name
push str.hookprocess
mov dword [0x455a90], ebp
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.004184eb
lea eax, [esp + 0x150]
add esp, 4
xor ebp, ebp
test eax, eax
je 0x403d9f
mov dword [esp + 0x10], 0x4353ac
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403d99
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x74c]
lea edx, [esp + 0x74c]
rep stosd dword es:[edi], eax
mov ecx, ebx
sub ecx, esi
push ecx
push esi
push edx
call fcn.00408130
mov esi, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x74c]
push eax
push 0x430488
push esi
call fcn.004080be
add esp, 0xc
inc ebp
add esi, 0x258
mov dword [esp + 0x10], esi
lea esi, [ebx + 1]
jmp 0x403d2b
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x434b88
push str.name
push str.unhookprocess
mov dword [0x4353a8], ebp
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.004184eb
lea ecx, [esp + 0x150]
add esp, 4
test ecx, ecx
mov dword [esp + 0x10], 0
je 0x403e5d
mov ebp, 0x455a94
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00407dd0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403e5d
mov edx, ebx
lea eax, [esp + 0x20]
sub edx, esi
push edx
push esi
push eax
call fcn.00408130
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
lea esi, [ebx + 1]
inc ecx
add ebp, 0x64
mov dword [esp + 0x10], ecx
jmp 0x403dfa
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov dword [0x4581a4], eax
mov dword [esp + 0x9ac], 0xffffffff
call fcn.00402170
mov ecx, dword [esp + 0x9a4]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x9a0
ret