Function at 0x403000
Capabilities:
Access peb ldr_data
Get file attributes
Get file size
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x428ee4], eax
mov eax, dword [0x428ee8]
xor edx, edx
mov ecx, 0x6cc1019a
div ecx
xor edx, edx
push str.X_Zpn_T.0WheLT_
push 0x38091fe5
push str._sVC__xwwZt7W_S
push str.c_T2_xxjnw
mov ecx, eax
xor ecx, 0x38
add ecx, 0xfb
mov dword [0x428ee8], ecx
or ecx, 0xf68e0d8e
mov eax, 0xc1
div ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and eax, 0x7d
sub eax, esi
xor eax, 0x7b
mov dword [0x428ee8], eax
call fcn.0040398f
imul eax, eax, 0x58ce78a1
or eax, 0x4d
mov dword [0x428ee8], eax
call fcn.0040399b
imul eax, eax, 0x145a74
or eax, 0x4ad6
mov dword [0x428ee8], eax
call fcn.004039ab
mov dword [0x428ee8], eax
call fcn.004039c1
mov dword [0x428ee8], eax
call fcn.004039d8
mov dword [0x428ee8], eax
call fcn.004039f0
mov dword [0x428ee8], eax
call fcn.004039ff
mov dword [0x428ee8], eax
call fcn.00403a0d
mov dword [0x428ee8], eax
call fcn.00403a34
mov dword [0x428ee8], eax
call fcn.00403a48
call fcn.00403a5f
mov dword [0x428ee8], eax
call fcn.00403a62
mov dword [0x428ee8], eax
call fcn.00403a87
mov ecx, eax
imul ecx, ecx, 0x306f86e7
or ecx, 0x577014ae
mov eax, 0x9b
xor edx, edx
div ecx
and eax, 0x3fab070b
mov dword [0x428ee8], eax
call fcn.00403a9e
mov dword [0x428ee8], eax
call fcn.00403aa9
imul eax, eax, 0x5905
xor edx, edx
mov ecx, 0x4f83e9e3
div ecx
sub edx, 0x32
and edx, 0x6b
imul edx, edx, 0x25
mov dword [0x428ee8], edx
call fcn.00403ab8
mov dword [0x428ee8], eax
call fcn.00403acc
imul eax, eax, 0x2bb83e1b
add eax, 0xf5
xor eax, 0x16
mov dword [0x428ee8], eax
call fcn.00403ad6
mov ecx, eax
or ecx, 0x870422dd
mov eax, 0x5a642
xor edx, edx
div ecx
mov dword [0x428ee8], edx
call fcn.00403ae1
mov dword [0x428ee8], eax
call fcn.00403aea
mov dword [0x428ee8], eax
call fcn.00403af9
xor eax, 0x74e2d62
mov dword [0x428ee8], eax
call fcn.00403b04
mov dword [0x428ee8], eax
call fcn.00403b27
mov ecx, 0x67f7c28d
xor edx, edx
div ecx
mov ecx, 0x1dbc
sub ecx, eax
mov dword [0x428ee8], ecx
call fcn.00403b3e
push 0
push 0xffffffffffffffff
mov dword [0x428ee8], eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and eax, 2
xor eax, 0x1c
lea eax, [eax + esi + 0x13]
and eax, 0x29
add eax, 0x16
xor edx, edx
mov ecx, 0x2b63
div ecx
mov ecx, 0xb9c71434
push 0x54
mov eax, edx
and eax, 0x37
xor edx, edx
div ecx
pop ecx
xor edx, edx
sub ecx, eax
or ecx, 0xfe508628
mov eax, 0x704a
div ecx
mov dword [0x428ee8], eax
call fcn.00403b4d
mov ecx, eax
and ecx, 0x45
or ecx, 0x8a
imul ecx, ecx, 0x31
add ecx, 0x40
or ecx, 0x23a17c75
xor edx, edx
mov eax, 0xa070daf
div ecx
mov dword [0x428ee8], eax
call fcn.00403b7a
xor edx, edx
mov ecx, 0x35555517
div ecx
push 0x77
xor edx, edx
mov ecx, eax
imul ecx, ecx, 0x30
or ecx, 0xaa30c399
pop eax
div ecx
push 0x1b
xor edx, edx
mov ecx, eax
or ecx, 0x25f8e5ff
pop eax
div ecx
mov dword [0x428ee8], eax
call fcn.00403b92
imul eax, eax, 0x113
xor edx, edx
mov ecx, 0x73016c90
div ecx
push 0x69
pop eax
push str.tOTI_q8.3Gh_6GYo6
mov ecx, edx
or ecx, 0x31e6ce83
xor edx, edx
div ecx
mov dword [0x428ee8], eax
imul eax, eax, 0xaa
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x7b5e
xor edx, edx
or esi, 0xac60e8ed
div esi
push 0x15
xor edx, edx
mov ecx, eax
or ecx, 0xe7f2fccf
pop eax
div ecx
xor edx, edx
mov ecx, 0x92085bf7
div ecx
mov dword [0x428ee8], edx
call fcn.00403ba6
mov ecx, eax
push 6
xor edx, edx
or ecx, 0x86747f2
pop eax
div ecx
add edx, 0x4a
mov dword [0x428ee8], edx
call fcn.00403bb7
push str.w___C_fHS_FXdlUU_P4OQj
mov dword [0x428ee8], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [0x428ee8], 0x555b
call fcn.00403bd0
xor edx, edx
mov ecx, 0xfffffdff
div ecx
xor edx, edx
mov ecx, 0xe85ec2df
mov esi, 0xfd59ff2b
div ecx
mov eax, 0x482dfee6
mov ecx, 0x528dc34e
sub eax, edx
xor edx, edx
div ecx
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
or edx, 0xd
mov dword [0x428ee8], edx
mov eax, dword [0x428ee8]
or eax, 0xce
xor edx, edx
div esi
mov eax, edx
mov dword [0x428ee8], eax
imul eax, eax, 0x2bc6ef64
mov ecx, dword [ecx + 0xc]
mov dword [0x428ee8], eax
test ecx, ecx
je 0x403412
mov ebx, 0x428ee0
and eax, 0xa4
xor edx, edx
mov esi, 0xc784126b
div esi
push 0x22
pop eax
mov edi, dword [ecx + 0x18]
mov esi, edx
or esi, 0x8866597f
xor edx, edx
div esi
mov eax, edx
mov dword [0x428ee8], eax
test edi, edi
je 0x403412
xor eax, 0x2182acaf
xor edx, edx
mov esi, 0x161dcfef
div esi
lea esi, [edx + 0xf7]
mov dword [0x428ee8], esi
cmp edi, ebx
ja 0x4033ed
mov eax, dword [ecx + 0x20]
add eax, edi
cmp eax, ebx
ja 0x4034ab
or esi, 0xc7c83d56
mov eax, 0x4626
xor edx, edx
div esi
mov ecx, dword [ecx]
mov dword [0x428ee8], edx
call fcn.00403982
mov dword [0x428ee8], eax
test ecx, ecx
jne 0x403397
xor ecx, ecx
push 0x104
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00403bdb
cmp byte [ebp - 0x104], 0
mov dword [0x428ee8], eax
lea eax, [ebp - 0x104]
je 0x403446
inc eax
cmp byte [eax], 0
jne 0x403440
mov edx, str..txt
sub edx, eax
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
test cl, cl
jne 0x40344d
call fcn.00403bfe
push 0
push 0x80
push 2
push 0
push 1
mov dword [0x428ee8], eax
push 0x40000000
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [0x428ee8]
xor edx, edx
mov ecx, 0x97d6234
div ecx
mov dword [0x428ee0], esi
mov dword [0x428ee8], eax
cmp esi, 0xffffffff
jne 0x4034b2
push 0xad
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, edi
jmp 0x403414
call fcn.00403c09
push esi
mov dword [0x428ee8], eax
call dword [0x428ee4]
call fcn.00403c1b
pop edi
mov dword [0x428ee8], eax
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret