Function at 0x401e80
Capabilities:
Create directory
Create process on windows
Get common file path
Move file
Query environment variable
Read .ini file
Set environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f7e0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x25f4
call fcn.00409000
mov eax, dword [0x42a080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x228]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x331], al
test al, al
jne 0x401ee0
lea edi, [ebp - 0x330]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401f00
mov ecx, 6
lea eax, [ebp - 0x2600]
mov esi, str.TAC2_DATA_tac2config.ini
rep movsd dword es:[edi], dword [esi]
push 0x44
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00409c40
add esp, 0xc
lea eax, [ebp - 0x330]
xorps xmm0, xmm0
movups xmmword [ebp - 0x2500], xmm0
push eax
push 0
push str.LoaderMode
push str.TAC2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, 0x427204
mov dword [ebp - 0x243c], eax
call fcn.00401d30
test eax, eax
jne 0x401f7e
push 0x10
push str.Error
push 0x42721c
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40249e
call fcn.00401dd0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, 0x1ac10
je 0x401fb7
cmp eax, 0x4b000
jb 0x401fb7
push 0x44
push str.Error
push 0x427268
call edi
push eax
call esi
cmp eax, 6
jne 0x40249e
mov ecx, 0x427354
call fcn.00401d30
test eax, eax
jne 0x401fdb
push 0x10
push str.Error
push 0x427368
call edi
push eax
call esi
jmp 0x40249e
mov eax, dword [ebp - 0x243c]
test eax, eax
jne 0x402040
jmp 0x401ff7
lea eax, [ebp - 0x2500]
push 0
push str.TACClient2.dll
push eax
lea eax, [ebp - 0x2600]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0x20
push 0
push 0
push 0
push str.Audition.exe
push 0
call fcn.00406ff0
jmp 0x40203b
jmp 0x40249e
cmp eax, 1
jne 0x40249e
jmp 0x40205b
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.TAC2_BIN
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.0040d843
add esp, 0xc
lea eax, [ebp - 0x120]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0040d10f
add esp, 0xc
lea eax, [ebp - 0x438]
push 0x427254
push 0x104
push eax
call fcn.0040d843
push ecx
lea ecx, [ebp - 0x25b8]
call fcn.00403860
xorps xmm0, xmm0
mov dword [ebp - 0x24f0], 0x4274e0
push ecx
lea eax, [ebp - 0x24ec]
movlpd qword [ebp - 0x2470], xmm0
push eax
lea ecx, [ebp - 0x2488]
movlpd qword [ebp - 0x2468], xmm0
movups xmmword [ebp - 0x2480], xmm0
mov dword [ebp - 0x2460], 0
mov dword [ebp - 0x245c], 0
mov dword [ebp - 0x2458], 0
mov dword [ebp - 0x2450], 0
mov dword [ebp - 0x244c], 0
mov byte [ebp - 0x2448], 0
mov dword [ebp - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x248c], 0x60
call fcn.004048d0
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x24f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x24f4], eax
lea ecx, [ebp - 0x24ec]
call fcn.00404350
cmp dword [ebp - 0x24a0], 0
jne 0x402202
push 0x40
lea eax, [ebp - 0x438]
push 0x22
push eax
call fcn.004055b6
add esp, 0xc
test eax, eax
je 0x402202
push 1
push eax
lea ecx, [ebp - 0x24ec]
call fcn.00404160
mov eax, dword [ebp - 0x24b8]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x243c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x2440]
push eax
call fcn.00404b20
add esp, 4
lea ecx, [ebp - 0x24ec]
push eax
call fcn.00404000
test esi, esi
je 0x40222b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x40222b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
jmp 0x40222b
mov eax, dword [ebp - 0x24f0]
lea ecx, [ebp - 0x24f0]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00401bf0
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x24e4], 6
jne 0x4022df
lea eax, [ebp - 0x25a8]
push eax
lea ecx, [ebp - 0x24f0]
call fcn.004025c0
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x24e4]
shr eax, 2
test al, 1
jne 0x4024c0
lea ecx, [ebp - 0x25a8]
call fcn.00404250
test eax, eax
jne 0x4022a7
mov eax, dword [ebp - 0x25b8]
lea ecx, [ebp - 0x25b8]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00401bf0
lea ecx, [ebp - 0x24ec]
call fcn.00404250
test eax, eax
jne 0x4022df
mov eax, dword [ebp - 0x24f0]
lea ecx, [ebp - 0x24f0]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00401bf0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 8
push str.TaskKeyHookWD.bak
push str.TaskKeyHookWD.dll
call esi
push 0x2000
lea eax, [ebp - 0x2438]
push eax
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x42742c
lea eax, [ebp - 0x2438]
push 0x2000
push eax
call fcn.0040d843
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x2438]
push 0x2000
push eax
call fcn.0040d843
add esp, 0xc
lea eax, [ebp - 0x2438]
push eax
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
lea ecx, [ebp - 0x2500]
push ecx
lea ecx, [ebp - 0x2600]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push eax
push 0x20
push 0
push 0
push 0
push str.Audition.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 8
push str.TaskKeyHookWD.dll
push str.TaskKeyHookWD.bak
call esi
jmp 0x4023ac
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x24f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x24f4], eax
lea ecx, [ebp - 0x24ec]
call fcn.004034f0
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x24f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x24f4], eax
lea eax, [ebp - 0x2488]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00405476
mov eax, dword [ebp - 0x25b8]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x25b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x25bc], eax
lea ecx, [ebp - 0x25a8]
call fcn.004034f0
mov eax, dword [ebp - 0x25b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x25b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x25bc], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x2548]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.00405476
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040813d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
push 0x10
push str.Error
push str.TAC2_Binary_install_failed_
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x24f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x24f4], eax
lea ecx, [ebp - 0x24ec]
call fcn.004034f0
mov eax, dword [ebp - 0x24f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x24f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x24f4], eax
lea eax, [ebp - 0x2488]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00405476
mov eax, dword [ebp - 0x25b8]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x25b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x25bc], eax
lea ecx, [ebp - 0x25a8]
call fcn.004034f0
mov eax, dword [ebp - 0x25b8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x25b8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x25bc], eax
mov dword [ebp - 4], 1
jmp 0x402485