Function at 0x401130
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x44c
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x149]
mov byte [esp + 0x148], bl
mov byte [esp + 0x44], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x24c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x350], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x351]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x148]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
cmp ecx, 1
jle 0x4011e1
cmp byte [esp + ecx + 0x148], 0x5c
je 0x4011da
dec ecx
cmp ecx, 1
jg 0x4011c8
jmp 0x4011e1
mov byte [esp + ecx + 0x148], bl
lea edi, [esp + 0x148]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0x4c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x150]
rep movsb byte es:[edi], byte [esi]
mov edi, str.main.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x150]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x258]
push 0x104
push ecx
push 0x4068f0
push str.file
push 0x40604c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x254]
lea eax, [esp + 0x4c]
push edx
push eax
lea ecx, [esp + 0x360]
push str._s_s
push ecx
call fcn.00401382
lea edi, [esp + 0x368]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x4c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
pop esi
cmp ecx, 1
pop ebp
jle 0x4012da
cmp byte [esp + ecx + 0x24c], 0x5c
je 0x4012da
dec ecx
cmp ecx, 1
jg 0x4012ca
lea ecx, [esp + ecx + 0x24d]
push ecx
call section..text
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
cmp ecx, 1
jle 0x401312
cmp byte [esp + ecx + 0x44], 0x5c
je 0x40130e
dec ecx
cmp ecx, 1
jg 0x4012ff
jmp 0x401312
mov byte [esp + ecx + 0x44], bl
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x350]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea eax, [esp + 0x44]
push ecx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], 0x40
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
xor eax, eax
pop ebx
add esp, 0x44c
ret 0x10