Function at 0x401869
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
pushfd
popfd
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push ecx
pop eax
mov ebx, 0x104
mov ecx, dword [ebp + 8]
mov edx, ebx
push esi
mov dword [ebp - 0x618], ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x61c], ecx
lea ecx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x614], eax
call fcn.00401405
cmp byte [ebp - 0x20c], 0x22
lea ecx, [ebp - 0x610]
jne 0x4018ca
lea eax, [ebp - 0x20b]
mov edx, 0x4010bc
jmp 0x4018d5
lea eax, [ebp - 0x20c]
mov edx, 0x4010c0
mov dword [ebp - 0x610], eax
call fcn.00401800
mov esi, dword [ebp - 0x610]
push eax
pop edi
test esi, esi
je 0x401925
push esi
pop ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4018f1
sub ecx, edx
cmp ecx, 3
jb 0x401925
mov al, byte [esi + 1]
cmp al, 0x3a
jne 0x40190c
cmp byte [esi + 2], 0x5c
je 0x401915
cmp byte [esi], 0x5c
jne 0x401925
cmp al, 0x5c
jne 0x401925
push esi
push ebx
pop edx
lea ecx, [ebp - 0x108]
call fcn.00401405
jmp 0x401947
push ecx
push 0x409224
push ecx
push ebx
pop edx
lea ecx, [ebp - 0x108]
call fcn.0040150c
push esi
mov edx, ebx
lea ecx, [ebp - 0x108]
call fcn.004062ff
push 0x2e
pop edx
push esi
pop ecx
call fcn.004063cc
mov ebx, dword [sym.imp.KERNEL32.dll_CompareStringA]
test eax, eax
je 0x401b02
push 0xffffffffffffffff
push 0x4010c4
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call ebx
dec eax
dec eax
jne 0x401b02
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401ae2
shr eax, 4
not eax
and eax, 1
je 0x401ae2
mov edx, 0x4010cc
mov dword [ebp - 0x610], edi
lea ecx, [ebp - 0x610]
call fcn.00401800
or eax, eax
je 0x4019d0
cmp byte [eax], 0
je 0x4019c0
mov dword [ebp - 0x610], eax
mov edx, 0x4010d0
lea ecx, [ebp - 0x610]
call fcn.00401800
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
or esi, esi
jne 0x4019f3
xor eax, eax
mov edx, 0x4b5
push eax
push 0x10
push eax
jmp 0x401af3
mov edi, dword [ebp - 0x610]
mov ebx, str.DefaultInstall
mov eax, edi
cmp byte [edi], 0
jne 0x401a07
push ebx
pop eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x4010d4
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x409a84], eax
mov eax, dword [ebp - 0x61c]
mov dword [eax], 1
lea eax, [ebp - 0x108]
push eax
push 8
push esi
push 0x401091
push 0x4010dc
push 0x4010e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401a87
or dword [0x409a74], 4
cmp byte [edi], 0
jne 0x401a5e
mov edi, ebx
mov ecx, dword [ebp - 0x614]
mov edx, 0x104
push edi
call fcn.00401405
lea eax, [ebp - 0x108]
mov edx, 0x200
push eax
push esi
pop ecx
call fcn.00401405
jmp 0x401c08
and dword [0x409a74], 0xfffffffb
cmp word [0x409a80], 0
jne 0x401ab2
push 0x104
lea eax, [ebp - 0x108]
mov ebx, 0x4010f0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x401ab7
mov ebx, 0x4010fc
cmp byte [edi], 0
jne 0x401ac1
mov edi, str.DefaultInstall
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
push str.rundll32.exe__s_InstallHinfSection__s_128__s
push 0x200
push esi
call fcn.004014a4
add esp, 0x18
jmp 0x401c08
xor eax, eax
mov edx, 0x525
push eax
push 0x10
push eax
lea eax, [ebp - 0x108]
push eax
sub ecx, ecx
call fcn.004041b0
sub eax, eax
jmp 0x401c13
push 0x2e
pop edx
mov ecx, esi
call fcn.004063cc
test eax, eax
je 0x401b78
push 0xffffffffffffffff
push 0x40110c
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call ebx
dec eax
dec eax
jne 0x401b78
mov ebx, str.Command.com__c__s
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b2e
sub ecx, edx
lea edx, [ebp - 0x108]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x401b40
sub edx, esi
lea edi, [ecx + 8]
add edi, edx
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4019e3
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
push esi
call fcn.004014a4
add esp, 0x10
jmp 0x401c08
mov ebx, 0x400
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4019e3
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401be7
test al, 0x10
jne 0x401be7
push ecx
lea eax, [ebp - 0x108]
push ebx
pop edx
push eax
push ecx
lea ecx, [ebp - 0x60c]
call fcn.0040150c
test edi, edi
je 0x401bfa
cmp byte [edi], 0
je 0x401bfa
push 0x4010c0
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.0040143d
push edi
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.0040143d
jmp 0x401bfa
push dword [ebp - 0x614]
push ebx
pop edx
lea ecx, [ebp - 0x60c]
call fcn.00401405
push ecx
push esi
pop edx
lea ecx, [ebp - 0x60c]
call 0x402889
mov ecx, dword [ebp - 0x618]
sub eax, eax
inc eax
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004069ed
push ebp
pop esp
pop ebp
ret 8