Function at 0x408380
Capabilities:
Create mailslot
Read .ini file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x144], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
or eax, 0x69cd2
mov byte [ebp - 0x81], al
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
sub ecx, 0x44
mov dword [ebp - 0x14c], ecx
cmp dword [ebp - 0x14c], 0xb6
ja case.0x408407.1
mov edx, dword [ebp - 0x14c]
movzx eax, byte [edx + 0x408a38]
jmp dword [eax*4 + 0x408a24]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
and eax, 0x37c41
movzx ecx, byte [ebp - 0x81]
mov edx, 0x4a74a
sub edx, ecx
and eax, edx
mov dword [ebp - 0xbc], eax
jmp 0x4085b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor eax, 0x3a6af
mov ebx, eax
xor esi, esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub eax, 0x64de9
xor ecx, ecx
xor eax, dword [ebp - 0x70]
xor ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x10c]
mov edi, dword [ebp - 0x10c]
lea edx, [edi + edx + 0x394c9]
movzx edi, word [ebp - 0xac]
add edx, edi
xor edi, edi
xor eax, edx
xor ecx, edi
or ebx, eax
or esi, ecx
or ebx, 0x24048
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
or ebx, eax
or esi, ecx
mov byte [ebp - 0x81], bl
jmp 0x4085b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov esi, eax
movzx edi, byte [ebp - 0x81]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
sub ebx, eax
and edi, ebx
and edi, 0xb8032
or esi, edi
movzx edi, word [ebp - 0xac]
mov edx, 0x7058e
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
and edi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov ecx, 0x2097d
sub ecx, eax
and edi, ecx
or esi, edi
mov dword [ebp - 0xbc], esi
jmp 0x4085b3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edx, dword [ebp - 0x10c]
lea esi, [eax + edx + 0xaddd]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov edi, eax
and edi, 0x21ec3
mov ebx, dword [ebp - 0x10c]
add ebx, 0x3949a
sub ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
add ebx, eax
and edi, ebx
or esi, edi
mov dword [ebp - 0xbc], esi
jmp 0x4085b3
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x4620b]
mov eax, dword [ebp - 0x10c]
add eax, 0x33cac
or edx, eax
mov ecx, dword [ebp - 0x10c]
and ecx, 0x6a4b1
or edx, ecx
mov dword [ebp - 0x10c], edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
movzx edx, byte [ebp - 0x81]
and eax, edx
movzx ecx, word [ebp - 0xac]
and eax, ecx
xor edx, edx
and eax, dword [ebp - 0x70]
and edx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
sub eax, 0x1191f
or eax, 0xa9815
mov esi, eax
xor edi, edi
mov ebx, dword [ebp - 0x10c]
sub ebx, 0xf881
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
sub ebx, eax
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx eax, ax
sub ebx, eax
xor eax, eax
sub ebx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
xor edx, edx
sub ebx, ecx
sbb eax, edx
push 0
push 0
push 0
push 0
mov dword [ebp - 0x150], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x150]
adc eax, ecx
or esi, ebx
or edi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor edx, edx
or esi, eax
or edi, edx
mov word [ebp - 0xac], si
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
sub ecx, 0xd
mov dword [ebp - 0x154], ecx
cmp dword [ebp - 0x154], 0xc5
ja case.0x4086b5.1
mov edx, dword [ebp - 0x154]
movzx eax, byte [edx + 0x408b08]
jmp dword [eax*4 + 0x408af0]
mov dword [ebp - 0xbc], 0x26f62
jmp 0x40881b
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
mov dword [ebp - 0xbc], ecx
jmp 0x40881b
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
add edx, eax
movzx ecx, word [ebp - 0xac]
add ecx, dword [ebp - 0x10c]
and ecx, 0x46402
or edx, ecx
or edx, 0x3a95f
mov dword [ebp - 0xbc], edx
jmp 0x40881b
mov ebx, dword [ebp - 0x70]
and ebx, 0x1e641
mov esi, dword [ebp - 0x6c]
and esi, 0
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
mov edi, edx
xor eax, eax
movzx ecx, byte [ebp - 0x81]
mov edx, dword [ebp - 0x10c]
lea ecx, [ecx + edx + 0x45eaa]
movzx edx, word [ebp - 0xac]
sub ecx, edx
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x15c], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x15c]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x70]
adc eax, dword [ebp - 0x6c]
and edi, ecx
mov ecx, dword [ebp - 0x158]
and ecx, eax
or ebx, edi
or esi, ecx
mov byte [ebp - 0x81], bl
jmp 0x40881b
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x603c5
sub ecx, dword [ebp - 0x10c]
sub ecx, 0x6f4a2
mov dword [ebp - 0xbc], ecx
jmp 0x40881b
mov edx, dword [ebp - 0x10c]
add edx, 0x2eba8
mov esi, edx
xor edi, edi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
xor ecx, ecx
mov edx, dword [ebp - 0x70]
sub edx, eax
mov eax, dword [ebp - 0x6c]
sbb eax, ecx
and esi, edx
and edi, eax
movzx eax, word [ebp - 0xac]
cdq
and esi, eax
and edi, edx
or esi, 0x2e5b2
mov dword [ebp - 0x10c], esi
movzx esi, byte [ebp - 0x81]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
add eax, 0x4bc6
or esi, eax
mov dword [ebp - 0x10c], esi
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
mov esi, dword [ebp - 0x10c]
sub esi, 0x284c5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
sub esi, eax
or esi, 0x71d51
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
movzx eax, word [ebp - 0xac]
cmp dword [ebp - 0x10c], eax
jne 0x4088a3
cmp dword [ebp - 0x10c], 0x4a915
jne 0x4088a3
cmp dword [ebp - 0x10c], 0
jne 0x4088a3
mov cx, word [ebp - 0x10c]
mov word [ebp - 0xac], cx
jmp 0x4088e4
movzx edx, byte [ebp - 0x81]
mov esi, 0x30168
sub esi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
sub esi, eax
sub esi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [esi + eax - 0x25245]
sub ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x1425a
jne 0x408933
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
cmp dword [ebp - 0x10c], eax
jne 0x408920
cmp dword [ebp - 0x10c], 0
jne 0x408920
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0x60c2f
je 0x408933
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, 0x5595d
jne 0x40894e
movzx edx, byte [ebp - 0x81]
add edx, 0x72ed6
or edx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], edx
jmp 0x40899c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx ecx, word [ebp - 0xac]
and eax, ecx
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
mov ecx, 0x3b215
sub ecx, dword [ebp - 0x10c]
add ecx, 0x4365
sub ecx, dword [ebp - 0x10c]
add ecx, 0x12e97
and edx, ecx
or eax, edx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x10c], 0
jmp 0x4089ba
mov edx, dword [ebp - 0x10c]
add edx, 0x519
mov dword [ebp - 0x10c], edx
cmp dword [ebp - 0x10c], 0xa32
jae 0x408a13
movzx eax, word [ebp - 0xac]
mov esi, 0x741c0
sub esi, eax
sub esi, 0x4f252
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
and esi, eax
movzx ecx, word [ebp - 0xac]
sub ecx, 0x22281
and esi, ecx
xor edx, edx
mov eax, dword [ebp - 0x70]
and eax, 0x3e6a1
mov ecx, dword [ebp - 0x6c]
and ecx, 0
or esi, eax
or edx, ecx
mov dword [ebp - 0xbc], esi
jmp 0x4089a8
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4