Function at 0x401180
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x404004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x7f4], edi
call fcn.00401000
cmp eax, 0x6a
jne 0x40177e
push 0x104
lea eax, [ebp - 0x7f0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea eax, [ebp - 0x2dc]
push eax
push 0x104
lea eax, [ebp - 0x7f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [ebp - 0x2dc]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011f0
sub ecx, edx
test ecx, ecx
jle 0x40120f
nop dword [eax]
cmp byte [ebp + ecx - 0x2dc], 0x5c
je 0x40120f
dec ecx
test ecx, ecx
jg 0x401200
inc ecx
cmp ecx, 0x104
jae 0x401add
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x2dc]
push str.bustalk.ini
push 0x104
push eax
mov byte [ebp + ecx - 0x2dc], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x2dc]
add esp, 0xc
push eax
push 0x104
lea eax, [ebp - 0x6ec]
push eax
push 0x403160
push str.ProgramPath
push str.STARTUP
call esi
lea eax, [ebp - 0x2dc]
push eax
push 0x34
lea eax, [ebp - 0x170]
push eax
push 0x403160
push str.Program
push str.STARTUP
call esi
lea eax, [ebp - 0x2dc]
push eax
push 0x104
lea eax, [ebp - 0x3e0]
push eax
push 0x403160
push str.AppPath
push str.STARTUP
call esi
lea eax, [ebp - 0x2dc]
push eax
push 0x34
lea eax, [ebp - 0x38]
push eax
push 0x403160
push str.AppName
push str.STARTUP
call esi
lea eax, [ebp - 0x2dc]
push eax
push 0x34
lea eax, [ebp - 0x1a4]
push eax
push 0x403160
push str.UserName
push str.STARTUP
call esi
lea eax, [ebp - 0x2dc]
push eax
push 0x34
lea eax, [ebp - 0x1d8]
push eax
push 0x403160
push str.Password
push str.STARTUP
call esi
lea eax, [ebp - 0x2dc]
push eax
push 0x104
lea eax, [ebp - 0x4e4]
push eax
push 0x403160
push str.StartupQuery
push str.STARTUP
call esi
lea ecx, [ebp - 0x170]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401340
sub ecx, edx
je 0x401778
lea ecx, [ebp - 0x3e0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401358
sub ecx, edx
je 0x401778
lea ecx, [ebp - 0x38]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401370
sub ecx, edx
je 0x401778
push 0x104
lea eax, [ebp - 0x5e8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x13c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [ebp - 0x6ec]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013b1
sub ecx, edx
je 0x401421
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x5e8]
push 0x104
push eax
call edi
lea ecx, [ebp - 0x5e8]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013e0
sub ecx, edx
cmp byte [ebp + ecx - 0x5e9], 0x5c
je 0x401409
push 0x4031b0
lea eax, [ebp - 0x5e8]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x5e8]
push 0x104
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x3e0]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401430
sub ecx, edx
test ecx, ecx
jle 0x401467
nop dword [eax]
cmp byte [ebp + ecx - 0x3e0], 0x20
je 0x401451
dec ecx
test ecx, ecx
jg 0x401440
jmp 0x401467
push 0x4031b4
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea ecx, [ebp - 0x3e0]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401488
sub ecx, edx
test ecx, ecx
jle 0x4014bc
cmp byte [ebp + ecx - 0x3e0], 0x20
je 0x4014a6
dec ecx
test ecx, ecx
jg 0x401495
jmp 0x4014bc
push 0x4031b4
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0xc
push 0x4031b8
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea ecx, [ebp - 0x38]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014d8
sub ecx, edx
test ecx, ecx
jle 0x401509
cmp byte [ebp + ecx - 0x38], 0x20
je 0x4014f3
dec ecx
test ecx, ecx
jg 0x4014e5
jmp 0x401509
push 0x4031b4
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea ecx, [ebp - 0x38]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401524
sub ecx, edx
test ecx, ecx
jle 0x401555
cmp byte [ebp + ecx - 0x38], 0x20
je 0x40153f
dec ecx
test ecx, ecx
jg 0x401531
jmp 0x401555
push 0x4031b4
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x1a4]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401560
sub ecx, edx
je 0x401596
push 0x4031b8
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0x18
lea ecx, [ebp - 0x1d8]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015a0
sub ecx, edx
je 0x4015d6
push 0x4031b8
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0x18
lea ecx, [ebp - 0x4e4]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015e0
sub ecx, edx
je 0x40169c
push 0x4031b8
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea ecx, [ebp - 0x4e4]
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401610
sub ecx, edx
test ecx, ecx
jle 0x401647
nop dword [eax]
cmp byte [ebp + ecx - 0x4e4], 0x20
je 0x401631
dec ecx
test ecx, ecx
jg 0x401620
jmp 0x401647
push 0x4031b4
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
lea ecx, [ebp - 0x4e4]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401668
sub ecx, edx
test ecx, ecx
jle 0x40169c
cmp byte [ebp + ecx - 0x4e4], 0x20
je 0x401686
dec ecx
test ecx, ecx
jg 0x401675
jmp 0x40169c
push 0x4031b4
lea eax, [ebp - 0x13c]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x5e8]
mov dword [ebp - 0x840], 0x3c
mov dword [ebp - 0x830], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x13c]
movlpd qword [ebp - 0x81c], xmm0
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x840]
push eax
movlpd qword [ebp - 0x814], xmm0
movlpd qword [ebp - 0x80c], xmm0
mov dword [ebp - 0x83c], 0x40
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 5
mov dword [ebp - 0x820], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea eax, [ebp - 0x2dc]
push eax
push 0x7d0
push 0x4031bc
push str.STARTUP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push dword [ebp - 0x808]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
ja 0x401851
je 0x401847
test eax, eax
je 0x40183d
cmp eax, 0x80
jne 0x401778
push str.Wait_abandoned_n
call fcn.00401b00
add esp, 4
mov edi, dword [ebp - 0x7f4]
mov esi, dword [ebp + 8]
cmp esi, 1
jle 0x401a7f
push dword [edi + 4]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push 0x403204
call ebx
add esp, 8
test eax, eax
jne 0x4018a2
mov eax, dword [edi + 8]
mov dword [ebp - 0x7f8], eax
mov eax, dword [0x404384]
mov byte [0x404390], 0
test eax, eax
je 0x401882
mov edx, dword [0x404380]
test edx, edx
je 0x401882
xor esi, esi
cmp dword [eax + 0xc], esi
jbe 0x401882
xor edi, edi
nop dword [eax]
mov cl, byte [edi + edx]
lea ebx, [edi + edx]
test cl, cl
je 0x401811
cmp cl, 0xe
je 0x401811
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x7f8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x401864
mov eax, dword [0x404384]
mov edx, dword [0x404380]
inc esi
add edi, 0x134
cmp esi, dword [eax + 0xc]
jb 0x4017e0
push 0x404390
call fcn.00401b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b30
mov esp, ebp
pop ebp
ret
push str.Wait_object_0_n
jmp 0x401770
push str.Wait_timeout_n
jmp 0x401770
cmp eax, 0xffffffff
jne 0x401778
push str.Wait_failed_n
jmp 0x401770
push 0xff
lea eax, [ebx + 0x35]
push eax
push 0x404390
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [0x40448e], 0
push 0x404390
call fcn.00401b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b30
mov esp, ebp
pop ebp
ret
push dword [edi + 4]
push 0x403208
call ebx
add esp, 8
test eax, eax
jne 0x401a7f
cmp esi, 2
jle 0x401a7f
mov edx, dword [0x404384]
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov dword [ebp - 0x7f4], ecx
mov dword [ebp - 0x7f8], ebx
test edx, edx
jne 0x4018ed
call fcn.00401000
mov edx, dword [0x404384]
mov ecx, dword [ebp - 0x7f4]
test ebx, ebx
je 0x401909
lea esi, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4018f4
sub ebx, esi
cmp ebx, 0x33
jbe 0x40190b
mov ebx, 0x33
jmp 0x40190b
xor ebx, ebx
test ecx, ecx
je 0x40192c
mov edi, ecx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x401914
sub edi, ecx
cmp edi, 0xfe
jbe 0x40192e
mov edi, 0xfe
jmp 0x40192e
xor edi, edi
test edx, edx
je 0x401aca
mov ecx, dword [0x404380]
test ecx, ecx
je 0x401aca
xor eax, eax
mov dword [ebp - 0x7fc], eax
mov dword [ebp - 0x800], eax
cmp dword [edx + 0xc], eax
jbe 0x401aca
xor esi, esi
mov dword [ebp - 0x804], esi
add esi, ecx
mov cl, byte [esi]
test cl, cl
je 0x401993
cmp cl, 0xe
je 0x401993
lea eax, [esi + 1]
push eax
push dword [ebp - 0x7f8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4019d6
mov edx, dword [0x404384]
mov eax, dword [ebp - 0x7fc]
test eax, eax
jne 0x4019aa
mov cl, byte [esi]
test cl, cl
je 0x4019a2
cmp cl, 0xe
jne 0x4019aa
mov eax, esi
mov dword [ebp - 0x7fc], eax
mov ecx, dword [ebp - 0x800]
mov esi, dword [ebp - 0x804]
inc ecx
add esi, 0x134
mov dword [ebp - 0x800], ecx
mov dword [ebp - 0x804], esi
cmp ecx, dword [edx + 0xc]
jae 0x401a1d
mov ecx, dword [0x404380]
jmp 0x401963
mov eax, dword [ebp - 0x7f4]
test eax, eax
je 0x401a07
push edi
push eax
lea eax, [esi + 0x35]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [esi + edi + 0x35], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b30
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi], 0xe
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b30
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x401aca
cmp dword [ebp - 0x7f4], 0
je 0x401aca
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push ebx
push dword [ebp - 0x7f8]
mov byte [eax], 0xd
inc eax
push eax
call esi
mov eax, dword [ebp - 0x7fc]
push edi
push dword [ebp - 0x7f4]
mov byte [eax + ebx + 1], 0
add eax, 0x35
push eax
call esi
mov eax, dword [ebp - 0x7fc]
add esp, 0x18
mov byte [eax + edi + 0x35], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b30
mov esp, ebp
pop ebp
ret
push str.Welcome_to_bustalk._n_nThe_following_parameters_are_supported:_nget_key___to_return_a_value_to_std_out_nset_key_value___to_set_av_value_to_the_bus_n_nYou_can_use___around_any_parmeters_with_space_in_it._n_n
call fcn.00401b00
mov eax, dword [0x404384]
add esp, 4
test eax, eax
je 0x401a9c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x404388]
mov dword [0x404384], 0
mov dword [0x404380], 0
test eax, eax
je 0x401ac0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x404388], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b30
mov esp, ebp
pop ebp
ret
call fcn.00401c60
int3