Function at 0x10001000
Capabilities:
Create process on windows
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10001227
cmp dword [esi], 0x30
jb 0x10001227
mov eax, dword [esi + 4]
add eax, 0xfffffc18
cmp eax, 7
ja case.0x1000102c.1001
jmp dword [eax*4 + 0x10001238]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100499d4], eax
test eax, eax
je 0x10001093
push 0x100401bc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004a018], eax
test eax, eax
jne case.0x1000102c.1001
push eax
push str.MessageBoxTimeoutA
push str.Message
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [0x100499d4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100499d4], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push str.USER.DLL_load
push str.Message
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 0x18]
push 0xc8
push 0x10049aa0
call fcn.1001d8ff
push str.exeopen.ini
push 0xc8
push 0x10049aa0
call fcn.1001d9c2
push dword [esi + 0x18]
push 0xc8
push 0x100499d8
call fcn.1001d8ff
mov ecx, 0x100499d8
add esp, 0x24
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100010f4
sub ecx, edx
cmp byte [ecx + 0x100499d7], 0x5c
jne case.0x1000102c.1001
dec ecx
cmp ecx, 0xc8
jae 0x10001233
mov byte [ecx + 0x100499d8], al
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 5
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x10049aa0
push 0xbb8
push str.TIMEOUT
push str.EXEPRESS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x10049aa0
push 0x3e7
push 0x10049b68
push 0x10040244
push str.MESSGE
push str.EXEPRESS
mov dword [section..data], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x10049aa0
mov dword [0x100499d0], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x100499d8
push str.explorer.exe__s
push 0xc7
push 0x10049f50
call fcn.10001270
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10049f50
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1004a018]
test ecx, ecx
je 0x100011fe
mov eax, dword [section..data]
test eax, eax
jle 0x100011fe
push eax
push 0
push 0x40000
push dword [esi + 0xc]
push 0x10049b68
push 0
call ecx
mov eax, dword [0x100499d4]
test eax, eax
je 0x1000120e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.10001405
xor edx, dword [eax]
add byte [eax], dl
push ds
adc al, byte [eax]
adc byte [esi], bl
adc al, byte [eax]
adc byte [esi], bl
adc al, byte [eax]
adc byte [edx], dh
adc dword [eax], eax
adc byte [esi], ah
adc dword [eax], eax
adc byte [ecx + 0x1e100010], dh
adc al, byte [eax]
adc ah, cl
int3