Function at 0x6d1ad2
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6d8004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push edi
push ebx
mov dword [ebp - 0x614], eax
call fcn.006d1645
cmp byte [ebp - 0x20c], 0x22
lea ecx, [ebp - 0x610]
jne 0x6d1b2b
lea eax, [ebp - 0x20b]
mov edx, 0x6d114c
jmp 0x6d1b36
lea eax, [ebp - 0x20c]
mov edx, 0x6d1150
mov dword [ebp - 0x610], eax
call fcn.006d1a69
mov esi, dword [ebp - 0x610]
mov edi, eax
test esi, esi
je 0x6d1b89
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6d1b52
sub ecx, edx
cmp ecx, 3
jb 0x6d1b89
mov al, byte [esi + 1]
cmp al, 0x3a
jne 0x6d1b6d
cmp byte [esi + 2], 0x5c
je 0x6d1b76
cmp byte [esi], 0x5c
jne 0x6d1b89
cmp al, 0x5c
jne 0x6d1b89
push esi
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.006d1645
jmp 0x6d1bb1
push ecx
push 0x6d91e4
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.006d174e
push esi
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.006d6659
push 0x2e
pop edx
mov ecx, esi
call fcn.006d67af
test eax, eax
je 0x6d1d69
push 0xffffffffffffffff
push 0x6d1154
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
sub eax, 1
jne 0x6d1d69
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6d1d49
shr eax, 4
not eax
and eax, 1
je 0x6d1d49
mov edx, 0x6d115c
mov dword [ebp - 0x610], edi
lea ecx, [ebp - 0x610]
call fcn.006d1a69
test eax, eax
je 0x6d1c3a
cmp byte [eax], 0
je 0x6d1c2a
mov dword [ebp - 0x610], eax
mov edx, 0x6d1160
lea ecx, [ebp - 0x610]
call fcn.006d1a69
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x6d1c5d
xor eax, eax
mov edx, 0x4b5
push eax
push 0x10
push eax
jmp 0x6d1d5a
mov edi, dword [ebp - 0x610]
mov eax, edi
cmp byte [edi], 0
jne 0x6d1c6f
mov eax, str.DefaultInstall
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x6d1164
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x6d9120], eax
mov eax, dword [ebp - 0x614]
mov dword [eax], 1
lea eax, [ebp - 0x108]
push eax
push 8
push esi
push 0x6d1120
push 0x6d116c
push 0x6d1178
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x6d1cee
or dword [0x6d9a34], 4
cmp byte [edi], 0
jne 0x6d1cc9
mov edi, str.DefaultInstall
push edi
mov edx, 0x104
mov ecx, ebx
call fcn.006d1645
lea eax, [ebp - 0x108]
mov edx, 0x200
push eax
mov ecx, esi
call fcn.006d1645
jmp 0x6d1e77
and dword [0x6d9a34], 0xfffffffb
cmp word [0x6d9a40], 0
jne 0x6d1d19
push 0x104
lea eax, [ebp - 0x108]
mov ebx, 0x6d1180
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x6d1d1e
mov ebx, 0x6d118c
cmp byte [edi], 0
jne 0x6d1d28
mov edi, str.DefaultInstall
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
push str.rundll32.exe__s_InstallHinfSection__s_128__s
push 0x200
push esi
call fcn.006d16e6
add esp, 0x18
jmp 0x6d1e77
xor eax, eax
mov edx, 0x525
push eax
push 0x10
push eax
lea eax, [ebp - 0x108]
push eax
xor ecx, ecx
call fcn.006d44d8
xor eax, eax
jmp 0x6d1e82
push 0x2e
pop edx
mov ecx, esi
call fcn.006d67af
test eax, eax
je 0x6d1de5
push 0xffffffffffffffff
push 0x6d119c
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
sub eax, 1
jne 0x6d1de5
mov ebx, str.Command.com__c__s
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6d1d9b
sub ecx, edx
lea edx, [ebp - 0x108]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x6d1dad
sub edx, esi
lea edi, [ecx + 8]
add edi, edx
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x6d1c4d
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
push esi
call fcn.006d16e6
add esp, 0x10
jmp 0x6d1e77
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x6d1c4d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6d1e58
test al, 0x10
jne 0x6d1e58
push ecx
lea eax, [ebp - 0x108]
mov ebx, 0x400
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.006d174e
test edi, edi
je 0x6d1e69
cmp byte [edi], 0
je 0x6d1e69
push 0x6d1150
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.006d167d
push edi
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.006d167d
jmp 0x6d1e69
push ebx
mov edx, 0x400
lea ecx, [ebp - 0x60c]
call fcn.006d1645
push ecx
mov edx, esi
lea ecx, [ebp - 0x60c]
call fcn.006d2ad3
mov ecx, dword [ebp - 0x618]
xor eax, eax
inc eax
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d6e20
mov esp, ebp
pop ebp
ret 8