Function at 0x401000
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x334
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x7f02
push edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
mov dword [0x411264], eax
pop ebx
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, dword [esp + 0x348]
mov dword [0x411260], eax
call fcn.0040171d
cmp eax, edi
mov dword [0x411678], eax
je 0x401053
push edi
call fcn.0040182e
pop ecx
mov ax, word [0x410074]
mov esi, 0x104
mov word [esp + 0x10], ax
mov ax, word [0x410070]
push ebx
push esi
mov word [esp + 0x20], ax
call fcn.0040893f
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
mov dword [esp + 0x14], eax
push dword [esp + 0x350]
call ebp
test eax, eax
jl 0x4010b1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x350]
mov al, byte [edi + ecx]
cmp al, 0x20
je 0x4010a6
mov byte [ebx], al
inc ebx
and byte [ebx], 0
push ecx
inc edi
call ebp
cmp edi, eax
jle 0x401092
push 1
pop ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call fcn.00402700
xor ebp, ebp
add esp, 0xc
cmp eax, ebp
je 0x401174
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov cl, byte [eax]
cmp cl, 0x68
je 0x401145
cmp cl, 0x76
jne 0x401159
inc eax
push eax
lea eax, [esp + 0x3c]
push eax
call edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00402700
add esp, 0xc
push eax
lea eax, [esp + 0x244]
push eax
call edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.00402700
add esp, 0xc
push eax
lea eax, [esp + 0x140]
push eax
call edi
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x244]
push eax
call fcn.004027e0
pop ecx
pop ecx
jmp 0x401159
inc eax
push eax
push 0x411574
call fcn.00408820
pop ecx
mov dword [0x41167c], ebx
pop ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00402700
add esp, 0xc
cmp eax, ebp
jne 0x4010d7
cmp dword [esp + 0x14], ebp
je 0x401184
push dword [esp + 0x14]
call fcn.00408910
pop ecx
cmp dword [0x41167c], ebp
jne 0x401196
or dword [esp + 0x24], 0xffffffff
jmp 0x4015b8
mov edi, 0x411268
push esi
push edi
push dword [esp + 0x350]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x33
push esi
push edi
push edi
call fcn.00402450
push edi
push 0x41006c
call fcn.004027e0
push edi
mov edi, 0x411470
push edi
call fcn.00408820
push esi
push edi
call fcn.004023d0
push str.hpfldr.ini
push edi
call fcn.00408830
push str.TEMP
call fcn.0040879b
add esp, 0x34
cmp eax, ebp
je 0x4011fe
mov ebp, 0x41136c
push eax
push ebp
call fcn.00408820
pop ecx
pop ecx
jmp 0x401203
mov ebp, 0x41136c
push ebp
call fcn.00408720
test eax, eax
pop ecx
jne 0x401226
push 0x410054
call fcn.0040879b
test eax, eax
pop ecx
je 0x401226
push eax
push ebp
call fcn.00408820
pop ecx
pop ecx
push ebp
call fcn.00408720
test eax, eax
pop ecx
jne 0x40123e
push str.c:_temp
push ebp
call fcn.00408820
pop ecx
pop ecx
push ebp
call fcn.004023b0
push ebx
push ebp
call fcn.00402210
push ebx
push esi
call fcn.0040893f
push ebx
push esi
mov dword [esp + 0x48], eax
call fcn.0040893f
push ebx
push esi
mov dword [esp + 0x34], eax
call fcn.0040893f
push ebx
push esi
mov ebp, eax
call fcn.0040893f
push ebx
push esi
mov dword [esp + 0x54], eax
call fcn.0040893f
push edi
mov dword [esp + 0x54], eax
call fcn.00402250
push edi
push esi
push ebp
push 1
push 0x411574
call fcn.004021c0
add esp, 0x4c
push ebp
call fcn.00408720
test eax, eax
pop ecx
jbe 0x40118c
push edi
inc ebx
push esi
push ebp
push ebx
push 0x411574
call fcn.004021c0
push ebp
call fcn.00408720
add esp, 0x18
test eax, eax
ja 0x4012a7
push 1
pop ecx
cmp ebx, ecx
je 0x40118c
push 0x64
dec ebx
pop eax
and dword [esp + 0x14], 0
cdq
idiv ebx
push edi
push esi
push ebp
push ecx
push 0x411574
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x3c], eax
call fcn.004021c0
push ebp
call fcn.00408720
add esp, 0x18
mov ebx, 0x401704
test eax, eax
jbe 0x40138e
push ebx
push 7
push esi
push dword [esp + 0x1c]
push 1
push ebp
push 0
call fcn.00401880
push ebx
push 2
push ebp
push 0
call fcn.00401d90
push ebx
push 3
push ebp
push 0
mov dword [esp + 0x6c], eax
call fcn.00401d90
push dword [esp + 0x4c]
mov dword [esp + 0x74], eax
call fcn.00408720
add esp, 0x40
test eax, eax
je 0x40136b
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x18]
call fcn.004015c9
push dword [esp + 0x20]
call fcn.0040182e
mov eax, dword [esp + 0x38]
add esp, 0x10
add dword [esp + 0x14], eax
inc dword [esp + 0x18]
push edi
push esi
push ebp
push dword [esp + 0x24]
push 0x411574
call fcn.004021c0
push ebp
call fcn.00408720
add esp, 0x18
jmp 0x4012fe
cmp dword [esp + 0x10], 0
je 0x40139f
push dword [esp + 0x10]
call fcn.00408910
pop ecx
cmp dword [esp + 0x2c], 0
je 0x4013b0
push dword [esp + 0x2c]
call fcn.00408910
pop ecx
test ebp, ebp
je 0x4013bb
push ebp
call fcn.00408910
pop ecx
cmp dword [esp + 0x20], 0
je 0x4013cc
push dword [esp + 0x20]
call fcn.00408910
pop ecx
cmp dword [esp + 0x1c], 0
je 0x4013dd
push dword [esp + 0x1c]
call fcn.00408910
pop ecx
push 1
push esi
call fcn.0040893f
push 1
push esi
mov dword [esp + 0x20], eax
call fcn.0040893f
add esp, 0x10
mov ebp, eax
mov dword [esp + 0x14], ebp
push edi
push esi
push ebp
push 0x411680
push str.exec
push 0x411574
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push 7
push esi
push dword [esp + 0x1c]
push 1
push ebp
push 0
call fcn.00401880
push 1
push pe_nt_image_headers32
call fcn.0040893f
push dword [esp + 0x34]
mov ebp, eax
call fcn.00408720
add esp, 0x28
test eax, eax
jbe 0x4014f2
push 0x41136c
push ebp
call fcn.00408820
push esi
push ebp
call fcn.004023d0
push dword [esp + 0x20]
push ebp
call fcn.00408830
push 2
push 0
call fcn.004085fc
add esp, 0x20
mov ebx, eax
call fcn.00408410
test ebx, ebx
mov dword [esp + 0x28], eax
je 0x4014c3
push 0x410040
call fcn.00408576
mov al, byte [0x411680]
push 0x40
mov byte [esp + 0x40], al
pop ecx
xor eax, eax
lea edi, [esp + 0x3d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x11
lea eax, [esp + 0x40]
push esi
push eax
push ebp
call fcn.00402450
movsx eax, byte [esp + 0x4c]
push eax
call fcn.004084aa
sub eax, 0x40
push eax
call fcn.00408453
add esp, 0x1c
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [esp + 0x28]
call fcn.00408453
test ebx, ebx
pop ecx
je 0x4014e8
push ebx
call fcn.00408576
push ebx
call fcn.00408910
pop ecx
pop ecx
push 0x64
call fcn.0040182e
pop ecx
jmp 0x401567
push edi
push esi
push dword [esp + 0x1c]
push 0x411680
push str.shell
push 0x411574
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
mov ebx, dword [esp + 0x14]
push 7
push esi
push ebx
push 1
push dword [esp + 0x28]
push 0
call fcn.00401880
push ebx
call fcn.00408720
add esp, 0x20
test eax, eax
jbe 0x401562
mov edi, 0x41136c
push edi
push ebp
call fcn.00408820
push esi
push ebp
call fcn.004023d0
push ebx
push ebp
call fcn.00408830
add esp, 0x18
push 1
push edi
push 0
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4014e8
or dword [esp + 0x24], 0xffffffff
xor esi, esi
cmp ebp, esi
je 0x401574
push ebp
call fcn.00408910
pop ecx
cmp dword [esp + 0x10], esi
je 0x401584
push dword [esp + 0x10]
call fcn.00408910
pop ecx
cmp dword [esp + 0x14], esi
je 0x401594
push dword [esp + 0x14]
call fcn.00408910
pop ecx
push esi
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, dword [0x411264]
cmp eax, esi
je 0x4015ab
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x411678], esi
je 0x4015b8
call fcn.00401816
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x334
ret 0x10