Function at 0x402a49
Capabilities:
Check if file exists
Create thread
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
and byte [ebp - 0x1c4], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c3]
rep stosd dword es:[edi], eax
and byte [ebp - 0x14], 0
and byte [ebp - 0x28], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0xc0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebx, dword [ebp + 8]
push str.SCMUpdate.ini
lea eax, [ebx + 0x30c]
push eax
lea eax, [ebp - 0x1c4]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
cmp dword [ebp - 0xb0], 2
jne 0x402b59
cmp byte [ebx], 0
je 0x402b1c
push ebx
push str.SePwld.sys
call fcn.004026cf
push ebx
push str.SePpld.sys
call fcn.004026cf
push ebx
push str.SePprd.sys
call fcn.004026cf
push ebx
push str.SePSed.sys
call fcn.004028a6
push ebx
push str.SePSedNT.sys
call fcn.004028a6
add esp, 0x28
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push esi
push ebx
push 0x4040fb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x40661c], esi
jne 0x402b43
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402b31
xor eax, eax
cmp dword [0x407a28], esi
mov dword [0x40661c], esi
setne al
jmp 0x402c66
lea eax, [ebx + 0x208]
mov edi, 0x406184
push eax
lea eax, [ebp - 0x28]
push 0x14
push eax
push edi
push str.UpDateVer
push 0x40625c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402bae
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x14]
push 0x14
push eax
push edi
push str.UpDateVer
push 0x40625c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x402bb2
and byte [ebp - 0x14], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 0x14], 0
je 0x402b7c
mov eax, edi
lea esi, [ebp - 0x14]
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [eax]
jne 0x402bea
test cl, cl
je 0x402be6
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x402bea
inc esi
inc esi
inc eax
inc eax
test cl, cl
jne 0x402bc8
xor eax, eax
jmp 0x402bef
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402b7c
lea edi, [ebp - 0x28]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x410]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x450]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
pop eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x407a30], eax
je 0x402c66
push dword [ebx + 0xbac]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403536
add esp, 0xc
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret