Function at 0x100001f9c
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x670
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rsi, rcx
lea rax, [rsp + 0x150]
mov r13d, 0x104
mov r10, rsi
mov r14, r9
mov r15, r8
sub r10, rax
xor r12d, r12d
mov rdx, r13
lea edi, [r12 + 1]
lea rcx, [rsp + 0x150]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100002014
mov al, byte [r10 + rcx]
cmp al, r12b
je 0x100002014
mov byte [rcx], al
add rcx, rdi
sub rdx, rdi
jne 0x100001ff5
cmp rdx, r12
jne 0x10000201c
sub rcx, rdi
mov byte [rcx], r12b
cmp byte [rsp + 0x150], 0x22
lea rcx, [rsp + 0x30]
jne 0x10000203f
lea rax, [rsp + 0x151]
lea rdx, [0x1000015e8]
jmp 0x10000204e
lea rax, [rsp + 0x150]
lea rdx, [0x1000015ec]
mov qword [rsp + 0x30], rax
call fcn.100001efc
mov rbx, qword [rsp + 0x30]
cmp rbx, r12
mov rbp, rax
je 0x1000020c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jl 0x1000020c8
mov al, byte [rbx + 1]
mov cl, 0x5c
cmp al, 0x3a
jne 0x100002081
cmp byte [rbx + 2], cl
je 0x100002089
cmp byte [rbx], cl
jne 0x1000020c8
cmp al, cl
jne 0x1000020c8
lea rax, [rsp + 0x40]
mov r8, rbx
mov rdx, r13
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x1000020bb
mov al, byte [rcx + r8]
cmp al, r12b
je 0x1000020bb
mov byte [rcx], al
add rcx, rdi
sub rdx, rdi
jne 0x10000209c
cmp rdx, r12
jne 0x1000020c3
sub rcx, rdi
mov byte [rcx], r12b
jmp 0x100002119
lea r8, [0x100010670]
lea rax, [rsp + 0x40]
mov rdx, r13
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x1000020fe
mov al, byte [rcx + r8]
cmp al, r12b
je 0x1000020fe
mov byte [rcx], al
add rcx, rdi
sub rdx, rdi
jne 0x1000020df
cmp rdx, r12
jne 0x100002106
sub rcx, rdi
mov byte [rcx], r12b
lea rcx, [rsp + 0x40]
mov r8, rbx
mov edx, r13d
call fcn.100007fa4
mov dx, 0x2e
mov rcx, rbx
call fcn.1000080c0
or edx, 0xffffffff
cmp rax, r12
je 0x100002386
lea rcx, [0x1000015f0]
mov dword [rsp + 0x28], edx
mov r9d, edx
mov qword [rsp + 0x20], rcx
mov r8, rax
mov edx, edi
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x100002386
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10000235e
shr eax, 4
not eax
and eax, edi
je 0x10000235e
lea rdx, [0x1000015f8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.100001efc
lea rdi, str.DefaultInstall
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp rbx, r12
je 0x1000021e4
mov rax, qword [rsp + 0x30]
cmp byte [rbx], r12b
lea rdx, [0x1000015fc]
cmovne rax, rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.100001efc
mov rbp, qword [rsp + 0x30]
cmp byte [rbp], r12b
je 0x1000021e9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x1000021e9
mov rbp, qword [rsp + 0x30]
mov r12d, 0x200
mov ecx, 0x40
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbx, rax
jne 0x100002219
and dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x4b5
xor r8d, r8d
jmp 0x100002370
cmp byte [rbp], 0
mov rcx, rdi
lea r9, [rsp + 0x40]
cmovne rcx, rbp
lea rdx, [0x100001600]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r8, [0x1000015b9]
lea rdx, [0x100001608]
mov dword [0x10001048c], eax
lea rax, [rsp + 0x40]
lea rcx, [0x100001618]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov dword [r14], 1
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor r14d, r14d
cmp eax, r14d
jbe 0x1000022f9
or dword [0x100010ec4], 4
cmp byte [rbp], r14b
cmovne rdi, rbp
sub rdi, rsi
lea rax, [r13 + 0x7ffffefa]
cmp rax, r14
je 0x1000022b0
mov al, byte [rsi + rdi]
cmp al, r14b
je 0x1000022b0
mov byte [rsi], al
add rsi, 1
sub r13, 1
jne 0x100002290
cmp r13, r14
jne 0x1000022b9
sub rsi, 1
lea rdx, [rsp + 0x40]
mov byte [rsi], r14b
mov rcx, rbx
sub rdx, rbx
lea rax, [r12 + 0x7ffffdfe]
cmp rax, r14
je 0x1000022e8
mov al, byte [rcx + rdx]
cmp al, r14b
je 0x1000022e8
mov byte [rcx], al
add rcx, 1
sub r12, 1
jne 0x1000022c7
cmp r12, r14
jne 0x1000022f1
sub rcx, 1
mov byte [rcx], r14b
jmp 0x10000252f
and dword [0x100010ec4], 0xfffffffb
cmp word [0x100010490], r14w
jne 0x100002326
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
mov r8d, r13d
lea rsi, [0x100001620]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x10000232d
lea rsi, [0x100001630]
cmp byte [rbp], r14b
lea rax, [rsp + 0x40]
lea r8, str.rundll32.exe__s_InstallHinfSection__s_128__s
cmovne rdi, rbp
mov qword [rsp + 0x28], rax
mov r9, rsi
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.100001aac
jmp 0x10000252f
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x525
mov dword [rsp + 0x28], r12d
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005554
xor eax, eax
jmp 0x100002537
mov dx, 0x2e
mov rcx, rbx
call fcn.1000080c0
cmp rax, r12
je 0x100002428
lea rcx, [0x100001640]
or r9d, 0xffffffff
mov r8, rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov ecx, 0x7f
mov edx, edi
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x100002428
lea rcx, str.Command.com__c__s
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + rax + 8]
movsxd rdi, ecx
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp rax, r12
mov rbx, rax
jne 0x10000240c
xor r9d, r9d
mov edx, 0x4b5
xor r8d, r8d
jmp 0x10000236b
lea r9, [rsp + 0x40]
lea r8, str.Command.com__c__s
mov rdx, rdi
mov rcx, rax
call fcn.100001aac
jmp 0x10000252f
mov edi, 0x400
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp rax, r12
mov rbx, rax
je 0x1000023fc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000024da
test al, 0x10
jne 0x1000024da
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x260]
mov rdx, rdi
sub r8, rax
lea rcx, [rsp + 0x260]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r12
je 0x100002497
mov al, byte [rcx + r8]
cmp al, r12b
je 0x100002497
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x100002476
cmp rdx, r12
jne 0x1000024a0
sub rcx, 1
cmp rbp, r12
mov byte [rcx], r12b
je 0x100002519
cmp byte [rbp], r12b
je 0x100002519
lea r8, [0x1000015ec]
lea rcx, [rsp + 0x260]
mov rdx, rdi
call fcn.100001a08
lea rcx, [rsp + 0x260]
mov r8, rbp
mov rdx, rdi
call fcn.100001a08
jmp 0x100002519
lea rax, [rsp + 0x260]
lea rcx, [rsp + 0x260]
sub rsi, rax
lea rax, [rdi + 0x7ffffbfe]
cmp rax, r12
je 0x10000250d
mov al, byte [rcx + rsi]
cmp al, r12b
je 0x10000250d
mov byte [rcx], al
add rcx, 1
sub rdi, 1
jne 0x1000024ed
cmp rdi, r12
jne 0x100002516
sub rcx, 1
mov byte [rcx], r12b
lea rcx, [rsp + 0x260]
mov r8, rbx
mov rdx, rbx
mov byte [rbx], r12b
call fcn.100003270
mov qword [r15], rbx
mov eax, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.10000c850
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret