Function at 0x40d2e9
Capabilities:
Check if file exists
Create process on windows
Delete file
Read .ini file

Disassembly:
mov eax, 0x412bed
call fcn.004114d0
mov eax, 0x2880
call fcn.00411500
mov eax, dword [0x4211a4]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, str.void___cdecl_InstalledOk_wchar_t__
push eax
push 0x418b24
push eax
lea ecx, [ebp - 0x288c]
call fcn.00406666
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2838]
push ebx
push eax
call fcn.0040c300
mov byte [ebp - 4], 1
xor eax, eax
mov edx, 0x81
mov word [ebp - 0x218], bx
mov ecx, edx
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x420], bx
mov ecx, edx
lea edi, [ebp - 0x41e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x830], bx
mov ecx, edx
lea edi, [ebp - 0x82e]
rep stosd dword es:[edi], eax
mov esi, 0x104
push esi
push dword [ebp - 0x2838]
stosw word es:[edi], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x14
push str.InstalledOK.ini
lea eax, [ebp - 0x218]
push eax
call edi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d42e
lea eax, [ebp - 0x218]
push eax
push 1
push str.hiintegrity
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x2834], eax
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x830]
push eax
push str...installedok.dll
push str.path
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x420]
push eax
call edi
jmp 0x40d442
push str...installedok.dll
lea eax, [ebp - 0x420]
push eax
call edi
mov dword [ebp - 0x2834], ebx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d5d2
cmp dword [ebp - 0x2834], ebx
je 0x40d57f
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40d57f
mov word [ebp - 0x628], bx
mov ecx, 0x81
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x628]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [ebp - 0x2830], 0x22
mov ecx, 0x7ff
lea edi, [ebp - 0x282e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x282e]
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
mov esi, dword [sym.imp.MSVCR71.dll_wcscat]
lea eax, [ebp - 0x2830]
push 0x418aa0
push eax
call esi
lea eax, [ebp - 0x2830]
push 0x418a88
push eax
call esi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x2874]
push ebx
push eax
call sub.MSVCR71.dll_memset
lea eax, [ebp - 0x628]
mov dword [ebp - 0x2864], eax
lea eax, [ebp - 0x2830]
mov dword [ebp - 0x2860], eax
add esp, 0x28
lea eax, [ebp - 0x2874]
push eax
mov dword [ebp - 0x2874], esi
mov dword [ebp - 0x2868], str.runas
mov dword [ebp - 0x2858], ebx
mov dword [ebp - 0x2870], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d5b2
push 0xffffffffffffffff
push dword [ebp - 0x283c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2834]
push eax
push dword [ebp - 0x283c]
mov dword [ebp - 0x2834], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x283c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2834], ebx
jmp 0x40d5b0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x40d5b2
push 0x418a70
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40d5b2
push ebx
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
jl 0x40d5d2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
call esi
mov byte [ebp - 4], bl
push dword [ebp - 0x2838]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288c]
call fcn.004068e0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004113e5
leave
ret