Function at 0x100001fb0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x670
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rsi, rcx
lea rax, [rsp + 0x150]
mov r13d, 0x104
mov r10, rsi
mov r14, r9
mov r15, r8
sub r10, rax
xor r12d, r12d
mov rdx, r13
lea edi, [r12 + 1]
lea rcx, [rsp + 0x150]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100002028
mov al, byte [r10 + rcx]
cmp al, r12b
je 0x100002028
mov byte [rcx], al
add rcx, rdi
sub rdx, rdi
jne 0x100002009
cmp rdx, r12
jne 0x100002030
sub rcx, rdi
mov byte [rcx], r12b
cmp byte [rsp + 0x150], 0x22
lea rcx, [rsp + 0x30]
jne 0x100002053
lea rax, [rsp + 0x151]
lea rdx, [0x1000015e8]
jmp 0x100002062
lea rax, [rsp + 0x150]
lea rdx, [0x1000015ec]
mov qword [rsp + 0x30], rax
call fcn.100001f14
mov rbx, qword [rsp + 0x30]
mov rbp, rax
cmp rbx, r12
je 0x1000020dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jl 0x1000020dc
mov al, byte [rbx + 1]
mov cl, 0x5c
cmp al, 0x3a
jne 0x100002095
cmp byte [rbx + 2], cl
je 0x10000209d
cmp byte [rbx], cl
jne 0x1000020dc
cmp al, cl
jne 0x1000020dc
lea rax, [rsp + 0x40]
mov r8, rbx
mov rdx, r13
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x1000020cf
mov al, byte [r8 + rcx]
cmp al, r12b
je 0x1000020cf
mov byte [rcx], al
add rcx, rdi
sub rdx, rdi
jne 0x1000020b0
cmp rdx, r12
jne 0x1000020d7
sub rcx, rdi
mov byte [rcx], r12b
jmp 0x10000212d
lea r8, [0x100010670]
lea rax, [rsp + 0x40]
mov rdx, r13
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100002112
mov al, byte [r8 + rcx]
cmp al, r12b
je 0x100002112
mov byte [rcx], al
add rcx, rdi
sub rdx, rdi
jne 0x1000020f3
cmp rdx, r12
jne 0x10000211a
sub rcx, rdi
mov byte [rcx], r12b
lea rcx, [rsp + 0x40]
mov r8, rbx
mov edx, r13d
call fcn.100007fc0
mov edx, 0x2e
mov rcx, rbx
call fcn.1000080dc
or edx, 0xffffffff
cmp rax, r12
je 0x100002397
lea rcx, [0x1000015f0]
mov dword [rsp + 0x28], edx
mov r9d, edx
mov qword [rsp + 0x20], rcx
mov r8, rax
mov edx, edi
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x100002397
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10000236f
shr eax, 4
not eax
and eax, edi
je 0x10000236f
lea rdx, [0x1000015f8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.100001f14
lea rdi, str.DefaultInstall
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp rbx, r12
je 0x1000021f9
mov rax, qword [rsp + 0x30]
cmp byte [rbx], r12b
lea rdx, [0x1000015fc]
cmovne rax, rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.100001f14
mov rbp, qword [rsp + 0x30]
cmp byte [rbp], r12b
je 0x1000021fe
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x1000021fe
mov rbp, qword [rsp + 0x30]
mov r12d, 0x200
mov ecx, 0x40
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x10000222e
and dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x4b5
xor r8d, r8d
jmp 0x100002381
cmp byte [rbp], 0
mov rcx, rdi
lea r9, [rsp + 0x40]
cmovne rcx, rbp
lea rdx, [0x100001600]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r8, [0x1000015b9]
lea rdx, [0x100001608]
mov dword [0x10001048c], eax
lea rax, [rsp + 0x40]
lea rcx, [0x100001618]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov dword [r14], 1
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor r14d, r14d
cmp eax, r14d
jbe 0x10000230a
or dword [0x100010ec4], 4
cmp byte [rbp], r14b
cmovne rdi, rbp
sub rdi, rsi
lea rax, [r13 + 0x7ffffefa]
cmp rax, r14
je 0x1000022c4
mov al, byte [rsi + rdi]
cmp al, r14b
je 0x1000022c4
mov byte [rsi], al
inc rsi
sub r13, 1
jne 0x1000022a5
cmp r13, r14
jne 0x1000022cc
dec rsi
lea rdx, [rsp + 0x40]
mov byte [rsi], r14b
mov rcx, rbx
sub rdx, rbx
lea rax, [r12 + 0x7ffffdfe]
cmp rax, r14
je 0x1000022fa
mov al, byte [rcx + rdx]
cmp al, r14b
je 0x1000022fa
mov byte [rcx], al
inc rcx
sub r12, 1
jne 0x1000022da
cmp r12, r14
jne 0x100002302
dec rcx
mov byte [rcx], r14b
jmp 0x10000253d
and dword [0x100010ec4], 0xfffffffb
cmp word [0x100010490], r14w
jne 0x100002337
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
mov r8d, r13d
lea rsi, [0x100001620]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x10000233e
lea rsi, [0x100001630]
cmp byte [rbp], r14b
lea rax, [rsp + 0x40]
lea r8, str.rundll32.exe__s_InstallHinfSection__s_128__s
cmovne rdi, rbp
mov qword [rsp + 0x28], rax
mov r9, rsi
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.100001ac4
jmp 0x10000253d
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x525
mov dword [rsp + 0x28], r12d
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005574
xor eax, eax
jmp 0x100002545
mov edx, 0x2e
mov rcx, rbx
call fcn.1000080dc
cmp rax, r12
je 0x10000243a
lea rcx, [0x100001640]
or r9d, 0xffffffff
mov r8, rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov ecx, 0x7f
mov edx, edi
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x10000243a
lea rcx, str.Command.com__c__s
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + rax + 8]
movsxd rdi, ecx
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
cmp rax, r12
jne 0x10000241e
xor r9d, r9d
mov edx, 0x4b5
xor r8d, r8d
jmp 0x10000237c
lea r9, [rsp + 0x40]
lea r8, str.Command.com__c__s
mov rdx, rdi
mov rcx, rax
call fcn.100001ac4
jmp 0x10000253d
mov edi, 0x400
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
cmp rax, r12
je 0x10000240e
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000024ea
test al, 0x10
jne 0x1000024ea
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x260]
mov rdx, rdi
sub r8, rax
lea rcx, [rsp + 0x260]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r12
je 0x1000024a8
mov al, byte [rcx + r8]
cmp al, r12b
je 0x1000024a8
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x100002488
cmp rdx, r12
jne 0x1000024b0
dec rcx
mov byte [rcx], r12b
cmp rbp, r12
je 0x100002527
cmp byte [rbp], r12b
je 0x100002527
lea r8, [0x1000015ec]
lea rcx, [rsp + 0x260]
mov rdx, rdi
call fcn.100001a08
lea rcx, [rsp + 0x260]
mov r8, rbp
mov rdx, rdi
call fcn.100001a08
jmp 0x100002527
lea rax, [rsp + 0x260]
lea rcx, [rsp + 0x260]
sub rsi, rax
lea rax, [rdi + 0x7ffffbfe]
cmp rax, r12
je 0x10000251c
mov al, byte [rcx + rsi]
cmp al, r12b
je 0x10000251c
mov byte [rcx], al
inc rcx
sub rdi, 1
jne 0x1000024fd
cmp rdi, r12
jne 0x100002524
dec rcx
mov byte [rcx], r12b
lea rcx, [rsp + 0x260]
mov r8, rbx
mov rdx, rbx
mov byte [rbx], r12b
call fcn.100003278
mov qword [r15], rbx
mov eax, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.10000c9f0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret