Function at 0x408100
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x42e294]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x540], ecx
mov ecx, dword [ebp - 0x540]
add ecx, 0x248
call fcn.00404f60
push eax
mov ecx, dword [ebp - 0x540]
call fcn.004083d0
test eax, eax
jne 0x408151
mov eax, dword [ebp - 0x540]
mov dword [eax + 0x46c], 1
xor eax, eax
jmp 0x4083bc
push 0
mov ecx, dword [ebp - 0x540]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x540]
add edx, 0x368
push edx
call fcn.00406bb0
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x40819b
mov ecx, dword [ebp - 0x540]
call fcn.00408440
mov ecx, dword [ebp - 0x540]
mov dword [ecx + 0x46c], 2
xor eax, eax
jmp 0x4083bc
mov ecx, dword [ebp - 0x540]
call fcn.00408440
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4081d5
mov eax, dword [ebp - 0x540]
mov dword [eax + 0x46c], 3
xor eax, eax
jmp 0x4083bc
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x538]
push edx
call fcn.00412720
add esp, 8
push 0x5c
lea eax, [ebp - 0x218]
push eax
call fcn.00401200
add esp, 8
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
jne 0x408212
xor eax, eax
jmp 0x4083bc
mov ecx, dword [ebp - 0x53c]
mov byte [ecx], 0
push str.MobileCache
lea edx, [ebp - 0x218]
push edx
call fcn.00412730
add esp, 8
lea eax, [ebp - 0x218]
push eax
call fcn.00401250
add esp, 4
test eax, eax
jne 0x408259
mov ecx, dword [ebp - 0x540]
mov dword [ecx + 0x46c], 3
xor eax, eax
jmp 0x4083bc
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x328]
push eax
call fcn.00412720
add esp, 8
push str.UpdateCopy.exe
lea ecx, [ebp - 0x328]
push ecx
call fcn.00412730
add esp, 8
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.00412720
add esp, 8
push str.MobileKugooSetup.exe.bak
lea ecx, [ebp - 0x430]
push ecx
call fcn.00412730
add esp, 8
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4082cf
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4082e6
mov ecx, dword [ebp - 0x540]
mov dword [ecx + 0x46c], 3
xor eax, eax
jmp 0x4083bc
mov dword [ebp - 0x21c], 0
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x430]
push eax
mov ecx, dword [ebp - 0x540]
call fcn.004084a0
test eax, eax
jne 0x408324
mov ecx, dword [ebp - 0x540]
mov dword [ecx + 0x46c], 4
xor eax, eax
jmp 0x4083bc
mov edx, dword [ebp - 0x540]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [edx + 0x874]
je 0x40834c
mov ecx, dword [ebp - 0x540]
mov dword [ecx + 0x46c], 4
xor eax, eax
jmp 0x4083bc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x540]
add edx, 0x474
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 4]
push edx
push str._d_s_s_s
lea eax, [ebp - 0x110]
push eax
call fcn.0041269a
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x328]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x540]
mov dword [eax + 0x46c], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041234d
mov esp, ebp
pop ebp
ret