Function at 0x404b10
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40670e
mov eax, dword fs:[0]
push eax
mov eax, 0x12b0
call fcn.004062b0
mov eax, dword [0x409018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x12b8]
call fcn.00401290
xor eax, eax
mov dword [ebp - 0x1054], 7
mov dword [ebp - 0x1058], 0
mov word [ebp - 0x1068], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x103c], 7
mov dword [ebp - 0x1040], eax
mov word [ebp - 0x1050], ax
push 0xffe
mov byte [ebp - 4], 1
push eax
mov word [ebp - 0x1038], ax
lea eax, [ebp - 0x1036]
push eax
call sub.MSVCR110.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea eax, [ebp - 0x12b8]
push eax
push 0x800
lea eax, [ebp - 0x1038]
push eax
push 0x407274
push str.HP_Def
push 0x407338
call esi
cmp word [ebp - 0x1038], 0
jne 0x404bdd
xor ecx, ecx
jmp 0x404bf5
lea ecx, [ebp - 0x1038]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404be6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x1068]
call fcn.00401b80
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1038], ax
lea eax, [ebp - 0x1036]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12b8]
push eax
push 0x800
lea eax, [ebp - 0x1038]
push eax
push 0x407274
push str.DS_Def
push 0x407338
call esi
cmp word [ebp - 0x1038], 0
jne 0x404c58
xor ecx, ecx
jmp 0x404c70
lea ecx, [ebp - 0x1038]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c61
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x1050]
call fcn.00401b80
cmp dword [edi + 0x14], 0
lea esi, [edi + 0xc]
jne 0x404c93
mov ecx, esi
call fcn.00402470
mov eax, dword [esi + 8]
test eax, eax
je 0x404d02
push 2
call eax
test al, al
je 0x404d02
push 2
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x1068]
push eax
call fcn.004017c0
mov ecx, esi
call fcn.004024e0
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x1050]
push eax
call fcn.004017c0
push 2
mov ecx, esi
call fcn.00402580
cmp dword [esi + 8], 0
jne 0x404d0f
mov ecx, esi
call fcn.00402470
mov eax, dword [esi + 8]
test eax, eax
je 0x404d7e
push 4
call eax
test al, al
je 0x404d7e
push 4
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x1068]
push eax
call fcn.004017c0
mov ecx, esi
call fcn.004024e0
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x1050]
push eax
call fcn.004017c0
push 4
mov ecx, esi
call fcn.00402580
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
call fcn.004017c0
mov byte [ebp - 4], 2
cmp dword [esi + 0xc], 0
jne 0x404db9
mov ecx, esi
call fcn.00402470
cmp dword [esi + 0xc], 0
mov edi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
je 0x404dec
push 1
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.004017c0
mov eax, dword [esi + 0xc]
call eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
jb 0x404dfe
push dword [ebp - 0x28]
call edi
add esp, 4
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x1050]
push eax
call fcn.004017c0
push 1
mov ecx, esi
call fcn.00402580
xor eax, eax
push eax
xorps xmm0, xmm0
push 0x40726c
mov word [ebp - 0x38], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x38]
push 0x14
push eax
movq qword [ebp - 0x36], xmm0
movq qword [ebp - 0x2e], xmm0
movq qword [ebp - 0x26], xmm0
movq qword [ebp - 0x1e], xmm0
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
lea eax, [ebp - 0x12b8]
push eax
lea eax, [ebp - 0x38]
push eax
push str.Type
push str.Cfig
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x40
lea eax, [ebp - 0x10ac]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1080], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10b0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.ProtectService.exe__stop
xorps xmm0, xmm0
push 0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10b0], 0x44
mov dword [ebp - 0x1084], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404f0d
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x1c]
call esi
jmp 0x404f13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x40
lea eax, [ebp - 0x10ac]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1080], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10b0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.ProtectService.exe__start
xorps xmm0, xmm0
push 0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10b0], 0x44
mov dword [ebp - 0x1084], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404f8d
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x1c]
call esi
jmp 0x404f93
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x103c], 8
jb 0x404fa7
push dword [ebp - 0x1050]
call edi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x1054], 8
mov dword [ebp - 0x103c], 7
mov dword [ebp - 0x1040], 0
mov word [ebp - 0x1050], ax
jb 0x404fd8
push dword [ebp - 0x1068]
call edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004058f7
mov esp, ebp
pop ebp
ret