Function at 0x4103f8
Capabilities:
Check if file exists
Create process on windows
Delete file
Read .ini file

Disassembly:
mov eax, 0x4149c9
call fcn.00413240
mov eax, 0x2880
call fcn.00413270
mov eax, dword [0x4241a4]
push ebx
push esi
xor eax, ebp
xor esi, esi
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x2834], esi
mov dword [ebp - 0x2834], ebp
push 1
push dword [ebp - 0x2834]
push str.void___cdecl_InstalledOk_wchar_t__
call fcn.00407881
mov edi, eax
add esp, 0xc
cmp edi, esi
mov eax, 0x41beb0
jne 0x410449
mov edi, eax
push esi
push esi
push esi
push esi
push eax
push 0x41be94
push edi
lea ecx, [ebp - 0x288c]
call fcn.00409792
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x410468
push ebp
pop ebp
lea eax, [ebp - 0x2834]
push eax
call fcn.0040fadd
mov byte [ebp - 4], 1
xor eax, eax
mov ebx, 0x81
mov word [ebp - 0x218], si
mov ecx, ebx
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x420], si
mov ecx, ebx
lea edi, [ebp - 0x41e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x628], si
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
mov esi, 0x104
push esi
push dword [ebp - 0x2834]
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCR71.dll_wcsncpy]
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2838], 1
call edi
add esp, 0x10
push str...InstalledOK.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x410570
lea eax, [ebp - 0x218]
push eax
push 0
push str.hiintegrity
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x628]
push eax
push str...installedok.dll
push str.path
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x410589
push str...installedok.dll
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
and dword [ebp - 0x2838], 0
lea eax, [ebp - 0x420]
push eax
call edi
test eax, eax
je 0x41070e
xor edi, edi
cmp dword [ebp - 0x2838], edi
je 0x4106c3
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x4106c3
mov word [ebp - 0x830], di
mov ecx, ebx
lea edi, [ebp - 0x82e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x830]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [ebp - 0x2830], 0x22
mov ecx, 0x7ff
lea edi, [ebp - 0x282e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x282e]
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
mov esi, dword [sym.imp.MSVCR71.dll_wcscat]
lea eax, [ebp - 0x2830]
push 0x41be08
push eax
call esi
lea eax, [ebp - 0x2830]
push 0x41b878
push eax
call esi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x2874]
push ebx
push eax
call sub.MSVCR71.dll_memset
lea eax, [ebp - 0x830]
mov dword [ebp - 0x2864], eax
lea eax, [ebp - 0x2830]
mov dword [ebp - 0x2860], eax
add esp, 0x28
lea eax, [ebp - 0x2874]
push eax
mov dword [ebp - 0x2874], esi
mov dword [ebp - 0x2868], str.runas
mov dword [ebp - 0x2858], ebx
mov dword [ebp - 0x2870], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4106f6
push 0xffffffffffffffff
push dword [ebp - 0x283c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2838]
push eax
push dword [ebp - 0x283c]
mov dword [ebp - 0x2838], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x283c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2838], ebx
jmp 0x4106f4
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x4106f6
push 0x41b86c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4106f6
push edi
call eax
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, edi
jl 0x41070e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
call esi
mov byte [ebp - 4], 0
push dword [ebp - 0x2834]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288c]
call fcn.00409a0c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413159
leave
ret