Function at 0x42be90
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4698a0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48fac0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov ebp, ecx
push str.COLShadow::AfterLogoffOutlook
push str._____s__IN
call fcn.00409e70
mov ecx, dword [0x4910dc]
xor ebx, ebx
add esp, 8
cmp ecx, ebx
je 0x42beed
mov esi, ecx
call fcn.0042fa00
push esi
call fcn.00437b08
add esp, 4
mov dword [0x4910dc], ebx
mov ecx, dword [0x4910c8]
cmp ecx, ebx
je 0x42bf0d
mov esi, ecx
call fcn.004293b0
push esi
call fcn.00437b08
add esp, 4
mov dword [0x4910c8], ebx
mov ecx, dword [0x4910cc]
cmp ecx, ebx
je 0x42bf2d
mov esi, ecx
call fcn.004293b0
push esi
call fcn.00437b08
add esp, 4
mov dword [0x4910cc], ebx
mov ecx, dword [0x4910d4]
cmp ecx, ebx
je 0x42bf4d
mov esi, ecx
call fcn.0042da80
push esi
call fcn.00437b08
add esp, 4
mov dword [0x4910d4], ebx
push str.Try_to_close_all_the_mutex_handle
call fcn.00409e70
mov eax, dword [0x491130]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push eax
call edi
mov ecx, dword [0x4910f0]
push ecx
call edi
mov edx, dword [0x4910f4]
push edx
call edi
mov eax, dword [0x491134]
push eax
call edi
mov ecx, dword [0x491138]
push ecx
call edi
mov edx, dword [0x49113c]
push edx
call edi
mov eax, dword [0x491140]
push eax
call edi
mov ecx, dword [0x491144]
push ecx
call edi
mov edx, dword [0x491148]
push edx
call edi
mov eax, dword [0x49114c]
push eax
call edi
mov ecx, dword [0x491150]
push ecx
call edi
mov edx, dword [0x4912bc]
movzx eax, byte [ebp + 0x9f]
push edx
push eax
push str.m_bExplorerClose_d_Check_Outlook_process_id:_d
call fcn.00409e70
add esp, 0xc
cmp byte [ebp + 0x9f], bl
je 0x42c165
cmp dword [0x4912bc], ebx
je 0x42c165
mov ecx, dword [0x4910bc]
push ecx
push 0x3c
push str.KillOutlook
push 0x472128
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, 3
jge 0x42c018
mov esi, 3
push esi
push str.____Monitor_Outlook_for__d_sec_s_
call fcn.00409e70
push 0x40
xor eax, eax
lea edx, [esp + 0x40]
push ebx
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.004481f0
add esp, 0x14
mov dword [esp + 0x30], 0x44
call fcn.00437eea
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x42c067
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, dword [0x4912bc]
push ecx
push esi
push str.A930F4D8_6B18_4e1a_BDE5_52B1813627B7
lea edx, [esp + 0x24]
push str.__s__d__u
push edx
mov dword [esp + 0x90], ebx
call fcn.00408b90
push str.TMAS_OLSentry.exe
lea eax, [esp + 0x34]
push 0x4910c0
push eax
call fcn.0040bb70
add esp, 0x20
mov ebp, eax
mov esi, dword [esp + 0x18]
mov ecx, dword [esi - 8]
mov eax, 1
mov byte [esp + 0x7c], al
sub eax, dword [esi - 4]
or ecx, eax
jge 0x42c0d8
push ebx
lea ecx, [esp + 0x1c]
call fcn.00402010
mov esi, dword [esp + 0x18]
mov eax, dword [ebp]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov eax, dword [esp + 0x1c]
sete byte [esp + 0x17]
add eax, 0xfffffff0
mov byte [esp + 0x7c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c11e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x17], bl
je 0x42c133
push str.xxx_Can_not_create_TMAS_OLSentry
call fcn.00409e70
add esp, 4
jmp 0x42c141
mov ecx, dword [esp + 0x20]
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call edi
lea eax, [esi - 0x10]
mov dword [esp + 0x7c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c165
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.COLShadow::AfterLogoffOutlook
push str._____s__OUT
call fcn.00409e70
add esp, 8
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret