Function at 0x404630
Capabilities:
Create process on windows
Get common file path
Read .ini file

Disassembly:
sub esp, 0x67c
lea eax, [esp + 0x210]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x220]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x21f], 0x5c
je 0x404699
mov edi, 0x11b3d54
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x220]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x11b3d44
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x220]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0x698]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp + 0x258]
push 0x12c
push esi
push 0x19d1318
push 0x11b3d3c
push 0x11b3d34
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp + 0x78c]
mov eax, 0x400
mov dword [esp + 0x34], edx
mov edx, 2
lea edi, [ebp + 0x798]
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x88], eax
lea ecx, [ebp + 0x384]
lea edx, [ebp + 0x790]
lea edi, [ebp + 0xba0]
lea eax, [ebp + 0x784]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x70], edi
mov dword [esp + 0x98], eax
mov ecx, 1
xor ebx, ebx
mov edx, 3
lea edi, [ebp + 0x7a0]
lea eax, [ebp + 0x788]
mov dword [esp + 0x18], 0x11b3d28
mov dword [esp + 0x1c], 3
mov dword [esp + 0x28], 0x11b3d00
mov dword [esp + 0x2c], 0x11b3cf8
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x11b3ce0
mov dword [esp + 0x40], 0x11b3cd8
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 0x11b3cbc
mov dword [esp + 0x54], 0x11b3cb4
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], 0x11b3c98
mov dword [esp + 0x68], 0x11b3c90
mov dword [esp + 0x6c], edx
mov dword [esp + 0x78], 0x11b3c70
mov dword [esp + 0x7c], 0x11b3c64
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], edi
mov dword [esp + 0x8c], 0x11b3c48
mov dword [esp + 0x90], 0x11b3c3c
mov dword [esp + 0x94], ecx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], 0x11b3c08
mov dword [esp + 0xa4], 0x11b3c00
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], eax
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xf8], ecx
lea ecx, [ebp + 0xfa4]
lea eax, [ebp + 0xfb0]
mov dword [esp + 0xfc], ecx
xor ecx, ecx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0x148], ecx
lea eax, [ebp + 0xfa0]
mov dword [esp + 0x14c], ecx
mov dword [esp + 0xe8], eax
lea eax, [ebp + 0xfac]
mov dword [esp + 0x150], ecx
mov dword [esp + 0x110], eax
mov dword [esp + 0x154], ecx
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x159]
mov byte [esp + 0x158], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x134], edx
lea edx, [esp + 0x324]
stosb byte es:[edi], al
lea eax, [esp + 0x424]
push edx
push eax
mov eax, dword [esp + 0x69c]
lea ecx, [esp + 0x594]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [eax]
push edx
push ecx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], 0x11b3bdc
mov dword [esp + 0xcc], 0x11b3bd4
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], 0x11b3bbc
mov dword [esp + 0xe0], 0x11b3bac
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], 0x11b3b80
mov dword [esp + 0xf4], 0x11b3b74
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], 0x11b3b40
mov dword [esp + 0x108], 0x11b3b34
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], 0x11b3afc
mov dword [esp + 0x11c], 0x11b3af4
mov dword [esp + 0x120], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], 0x11b3abc
mov dword [esp + 0x130], 0x11b3ab4
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], 0x19d1530
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], 0x11b3a9c
mov dword [esp + 0x144], 0x11b3a98
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], 0x12c
mov dword [esp + 0x154], 0x11b3a80
mov dword [esp + 0x158], ebx
call dword [sym.imp.MSVCRT.dll__splitpath]
lea edi, [esp + 0x438]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x338]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6a8]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x6a8]
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.0040c750
add esp, 0x20
test eax, eax
je 0x404c6e
mov eax, dword [esp + 0x690]
cmp eax, 2
jl 0x404c6e
cmp eax, 3
jg 0x404c6e
cmp dword [0x19d1528], ebx
jne 0x404b6c
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.MSVCRT.dll_printf]
cmp byte [esi], bl
je 0x404b08
push esi
call fcn.004043e0
add esp, 4
test eax, eax
je 0x404b00
lea eax, [esp + 0x220]
mov dword [0x19d1528], 1
push eax
push esi
push 0x11b3d3c
push 0x11b3d34
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x11b3a50
push 0x11b3a28
call edi
add esp, 8
cmp dword [0x19d1528], ebx
jne 0x404b6c
push ebx
push 0x11b3a20
push 0x11b3d34
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
mov esi, eax
inc esi
cmp esi, 0x1f4
jge 0x404be4
cmp esi, ebx
jle 0x404be4
lea ecx, [esp + 0x528]
push 0xa
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
push eax
push 0x11b3a20
push 0x11b3d34
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov edx, 0x1f4
push 0x11b3a50
sub edx, esi
push edx
push 0x11b3994
call edi
add esp, 0xc
mov eax, dword [esp + 0x694]
mov edi, dword [eax + 4]
cmp byte [edi], bl
je 0x404e98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x690]
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp eax, 3
rep movsb byte es:[edi], byte [esi]
jne 0x404c10
mov eax, dword [esp + 0x694]
or ecx, 0xffffffff
lea edx, [ebp + 0x12c]
mov edi, dword [eax + 8]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x67c
ret
push 0x11b3914
call edi
add esp, 4
push 1
push ebx
push ebx
push 0x11b38fc
push 0x11b38f4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x67c
ret
lea ecx, [esp + 0x58c]
lea edx, [esp + 0x424]
push ecx
lea eax, [esp + 0x328]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__splitpath]
lea edx, [esp + 0x438]
push 0x11b38ec
lea eax, [esp + 0x33c]
push edx
lea ecx, [esp + 0x2c]
push eax
add ebp, 0x12c
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x67c
ret
mov eax, dword [0x19d1528]
mov esi, dword [sym.imp.MSVCRT.dll_printf]
cmp eax, ebx
jne 0x404cc4
mov edi, dword [esp + 0x14]
cmp byte [edi], bl
je 0x404cc4
push edi
call fcn.004043e0
add esp, 4
test eax, eax
je 0x404cc4
lea edx, [esp + 0x220]
mov dword [0x19d1528], 1
push edx
push edi
push 0x11b3d3c
push 0x11b3d34
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x11b3a50
push 0x11b3a28
call esi
add esp, 8
push 0x11b3a50
push 0x11b38dc
call esi
push 0x11b387c
call esi
push 0x11b3834
call esi
push 0x11b3818
call esi
push 0x11b37f8
call esi
push 0x11b37d8
call esi
push 0x11b37bc
call esi
lea eax, [esp + 0x38]
push eax
push 0x11b37a4
push 0x11b3d34
call fcn.0040c830
push 0x11b3798
call esi
lea ecx, [esp + 0x188]
push ecx
push 0x11b3778
call esi
lea edx, [esp + 0x190]
push edx
push 0x11b3758
call esi
add esp, 0x40
lea eax, [esp + 0x158]
push eax
push 0x11b3738
call esi
lea ecx, [esp + 0x160]
push ecx
push 0x11b3718
call esi
lea edx, [esp + 0x168]
push edx
push 0x11b36f8
call esi
lea eax, [esp + 0x170]
push eax
push 0x11b36e0
call esi
lea ecx, [esp + 0x178]
push ecx
push 0x11b36b8
call esi
lea edx, [esp + 0x180]
push edx
push 0x11b3680
call esi
lea eax, [esp + 0x188]
push eax
push 0x11b3654
call esi
lea ecx, [esp + 0x190]
push ecx
push 0x11b3628
call esi
add esp, 0x40
lea edx, [esp + 0x158]
push edx
push 0x11b35f4
call esi
lea eax, [esp + 0x160]
push eax
push 0x11b35b8
call esi
lea ecx, [esp + 0x168]
push ecx
push 0x11b3598
call esi
lea edx, [esp + 0x170]
push edx
push 0x11b3570
call esi
lea eax, [esp + 0x178]
push eax
push 0x11b3550
call esi
lea ecx, [esp + 0x180]
push ecx
push 0x11b3530
call esi
lea edx, [esp + 0x188]
push edx
push 0x11b3514
call esi
lea eax, [esp + 0x190]
push eax
push 0x11b34f0
call esi
add esp, 0x40
lea ecx, [esp + 0x158]
push ecx
push 0x11b34d8
call esi
lea edx, [esp + 0x160]
push edx
push 0x11b34a4
call esi
lea eax, [esp + 0x168]
push eax
push 0x11b35b8
call esi
lea ecx, [esp + 0x170]
push ecx
push 0x11b3470
call esi
lea edx, [esp + 0x178]
push edx
push 0x11b3434
call esi
lea eax, [esp + 0x180]
push eax
push 0x11b33cc
call esi
lea ecx, [esp + 0x188]
push ecx
push 0x11b3360
call esi
add esp, 0x38
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x67c
ret