Function at 0x10001360
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x80c
push ebx
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
mov ecx, 0x27
mov dword [esp + 0x14], eax
lea edi, [esp + 0x578]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x44
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x578]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x57c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.Wow64EnableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
push 0
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x26c]
lea edx, [esp + 0x26c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x370]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x718]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x474]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
mov edi, str.HDAUDIOFUNC_01VEN_1106
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x270]
push ecx
push str.HDAUDIO
push 6
call fcn.10004e60
add esp, 0x10
test eax, eax
je 0x10001482
push 0x10000
push 0
push str.We_cant_find_HD_audio_device
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x80c
ret 0xc
lea edx, [esp + 0x26c]
push edx
call fcn.10001310
mov dword [0x1000f030], eax
call fcn.10004240
push 0xbb8
call fcn.100064c0
lea edi, [esp + 0x274]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x47c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x720]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x47c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffe6
push ecx
lea ecx, [esp + 0x480]
push ecx
push edx
call fcn.10006880
mov ebx, dword [esp + 0x834]
add esp, 0x14
lea eax, [esp + 0x64]
mov byte [esp + 0x4a5], 0
push 0
push 0x25
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x1000152c
lea ecx, [esp + 0x64]
push ecx
push 0x25
call fcn.100059f0
add esp, 8
mov edi, str.Drivers
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x64]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._viahduaa.sys
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x64]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100015bf
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x100015b4
lea edx, [esp + 0x64]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call ebp
push ebx
call fcn.100018e0
push 0x3e8
call fcn.100064c0
or ecx, 0xffffffff
mov edi, 0x10017734
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x370]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x370]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x10018b00
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x370]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.VIAHDAudHDUpDrVista64.exe_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x370]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10017710
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x8000000
push 0
push 0
lea edx, [esp + 0x38c]
push 0
push edx
push 0
call ebp
test eax, eax
push 0
lea eax, [esp + 0x16c]
push 0x26
push eax
push ebx
jne 0x100017a8
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x100016ea
lea ecx, [esp + 0x168]
push ecx
push 0x26
call fcn.100059f0
add esp, 8
or ecx, 0xffffffff
mov edi, 0x10017734
xor eax, eax
lea edx, [esp + 0x614]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x614]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x168]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x614]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.VIAHDASetupHDUpDrVista64.exe_2
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x618]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push edx
push 0
call ebp
test eax, eax
jne 0x100017c4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x80c
ret 0xc
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x100017c4
lea ecx, [esp + 0x168]
push ecx
push 0x26
call fcn.100059f0
add esp, 8
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edi, str.VIAHDASetup
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x168]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x168]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.100064e0
add esp, 8
test eax, eax
je 0x1000183c
lea ecx, [esp + 0x168]
push ecx
call fcn.100056a0
add esp, 4
push str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_Default
push 0x80000002
call fcn.10005180
add esp, 8
test eax, eax
jle 0x10001864
push str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_Default
push 0x80000002
call fcn.10005150
add esp, 8
push str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_Default
push 0x80000001
call fcn.10005180
add esp, 8
test eax, eax
jle 0x1000188c
push str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_Default
push 0x80000001
call fcn.10005150
add esp, 8
lea edx, [esp + 0x26c]
push edx
push str.oem.inf
call fcn.100052b0
lea eax, [esp + 0x274]
push eax
call fcn.10004900
lea ecx, [esp + 0x278]
push ecx
push str.HDAUDIO
call fcn.10005020
call fcn.10004850
push 0x3e8
call fcn.100064c0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80c
ret 0xc