Function at 0x404b7c
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file size
Get program files directory
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xe28]
sub esp, 0xea8
mov eax, dword [0x410014]
xor eax, ebp
mov dword [ebp + 0xe24], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00402461
push dword [ebp + 0xe38]
call fcn.0040204f
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
pop ecx
push 0x410250
call esi
cmp eax, 1
jge 0x404e2a
push 0x104
lea eax, [ebp + 0xa14]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0xa14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, 0x206
push edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x80e]
push ebx
push eax
mov word [ebp + 0x80c], bx
call fcn.0040bbf0
lea eax, [ebp + 0x80c]
push eax
push dword [ebp - 0x1c]
call fcn.004022e6
add esp, 0x14
test eax, eax
je 0x404ce3
push edi
lea eax, [ebp + 0xc1e]
push ebx
push eax
mov word [ebp + 0xc1c], bx
call fcn.0040bbf0
add esp, 0xc
lea eax, [ebp + 0x80c]
push eax
call esi
cmp eax, ebx
jle 0x404cb7
mov ecx, eax
and ecx, 0x80000003
jns 0x404c66
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x404cb7
xor edx, edx
xor ecx, ecx
cmp eax, ebx
jle 0x404caf
mov di, word [ebp + ecx*2 + 0x80c]
mov word [ebp + edx*2 + 0xc1c], di
lea edi, [ecx + 1]
inc edx
mov dword [ebp - 0x1c], edi
and edi, 0x80000003
jns 0x404c94
dec edi
or edi, 0xfffffffc
inc edi
jne 0x404ca8
lea edi, [eax - 1]
cmp ecx, edi
jge 0x404ca8
mov word [ebp + edx*2 + 0xc1c], 0x2d
inc edx
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
jl 0x404c70
mov word [ebp + edx*2 + 0xc1c], bx
lea eax, [ebp + 0xc1c]
push eax
call esi
test eax, eax
je 0x404ce3
lea eax, [ebp + 0xc1c]
push eax
push 0x40eb10
push 0x410250
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x404e19
push 0x103
lea eax, [ebp + 0xd21]
push ebx
push eax
mov byte [ebp + 0xd20], bl
call fcn.0040bbf0
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp + 0xa14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x404e19
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 0x2c], ebx
mov eax, 0x19000
mov edi, eax
mov dword [ebp - 0x28], edi
jg 0x404d4f
mov ecx, dword [ebp - 0x30]
jl 0x404d4a
cmp ecx, eax
jae 0x404d4f
mov dword [ebp - 0x28], ecx
mov edi, ecx
push 2
push ebx
mov eax, edi
neg eax
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call fcn.00405fb1
pop ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404e07
cmp dword [ebp - 0x1c], edi
jne 0x404e07
call dword [section..data]
mov edi, str._COOCARECODE_
push edi
mov dword [ebp - 0x3c], eax
call esi
inc eax
cmp eax, 0x3fffffff
jle 0x404da7
xor eax, eax
jmp 0x404dc0
add eax, eax
mov dword [ebp - 0x20], eax
call fcn.0040c020
mov eax, esp
push dword [ebp - 0x3c]
push dword [ebp - 0x20]
push edi
push eax
call fcn.00401f40
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call fcn.00402286
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x20], eax
jl 0x404e07
push edi
call esi
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
push eax
lea eax, [ebp + 0xd20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0xd20]
push eax
push 0x40eae8
push 0x410250
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp - 0x24]
call fcn.00405fb6
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x410250
push 0x40ead8
call fcn.00401548
pop ecx
pop ecx
call fcn.004021fb
mov edi, 0x410458
push edi
lea eax, [ebp + 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.minisetup.ini
lea eax, [ebp + 0x604]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
lea eax, [ebp + 0x604]
push eax
push 0xce
push 0x40e768
call fcn.00401241
add esp, 0x10
test eax, eax
je 0x404ee4
push edi
call fcn.00401795
test eax, eax
pop ecx
je 0x404f25
push 0x40e2ec
push 0x40eaa4
call fcn.00401548
push edi
call fcn.0040191c
add esp, 0xc
test eax, eax
je 0x404f0c
cmp dword [0x410c78], ebx
jne 0x404ee4
mov esi, 0x104
push esi
lea eax, [ebp + 0xa14]
push eax
push 5
push edi
call fcn.0040169c
push esi
lea eax, [ebp + 0x3fc]
push eax
push ebx
push edi
call fcn.0040169c
add esp, 0x20
push 0x40
lea eax, [ebp + 0x3fc]
push eax
lea eax, [ebp + 0xa14]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
lea eax, [ebp + 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x604]
push eax
call fcn.0040109c
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x405328
push edi
call fcn.00401d14
mov dword [esp], 0x40e2ec
push 0x40ea68
call fcn.00401548
pop ecx
pop ecx
push 0x410a70
call esi
cmp eax, 1
jge 0x404f99
lea eax, [ebp + 0xa14]
push eax
push str.path
push 0x40ea60
push edi
call fcn.004013bf
add esp, 0x10
lea eax, [ebp + 0xa14]
push eax
call esi
test eax, eax
je 0x404f7c
push 0x410a70
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp + 0xa14]
push eax
push 0x410a70
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x404f88
push edi
push 0x410a70
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x410a70
push 0x40ea50
call fcn.00401548
pop ecx
pop ecx
push 0x410868
call esi
cmp eax, 1
jge 0x404fcc
push 0x410868
push str.fname
push 0x40ea60
push edi
call fcn.004013bf
push 0x410868
push 0x40ea44
call fcn.00401548
add esp, 0x18
push 0x410660
call esi
cmp eax, 1
jge 0x404fff
push 0x410660
push 0x40ea3c
push 0x40ea60
push edi
call fcn.004013bf
push 0x410660
push 0x40ea30
call fcn.00401548
add esp, 0x18
push ebx
push dword [ebp + 0xe30]
mov ecx, 0x410c7c
push ebx
call fcn.004026f8
mov eax, dword [0x410c78]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0xe3c]
push eax
push dword [ebp + 0xe38]
call fcn.00404af2
pop ecx
pop ecx
mov ecx, 0x410c7c
mov dword [ebp - 0x18], eax
call fcn.004047f7
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x18], ebx
je 0x40509e
cmp dword [0x410c78], ebx
jne 0x40530a
mov esi, 0x104
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call fcn.0040169c
add esp, 0x10
cmp dword [ebp - 0x18], 1
push esi
lea eax, [ebp + 0x3fc]
push eax
jne 0x40507a
push 3
jmp 0x40507c
push 4
push edi
call fcn.0040169c
add esp, 0x10
push 0x40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x3fc]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40530a
push 0x410868
call esi
cmp eax, 1
jge 0x4050ba
push 0x410660
call esi
cmp eax, 1
jl 0x40530a
push 0x208
lea eax, [ebp + 0x80c]
push ebx
push eax
call fcn.0040bbf0
push 0x208
lea eax, [ebp + 0xa14]
push ebx
push eax
call fcn.0040bbf0
add esp, 0x18
push 0x410868
call esi
test eax, eax
push 0x410a70
je 0x405148
lea eax, [ebp + 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x410868
lea eax, [ebp + 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40530a
lea eax, [ebp + 0x80c]
push eax
lea eax, [ebp + 0xa14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0xa14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x405155
lea eax, [ebp + 0xa14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
lea eax, [ebp + 0x1f4]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1f4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp + 0x1f4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x206
lea eax, [ebp + 0xc1e]
push ebx
push eax
mov word [ebp + 0xc1c], bx
call fcn.0040bbf0
add esp, 0xc
lea eax, [ebp + 0x80c]
push eax
lea eax, [ebp + 0xc1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x410660
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
jle 0x4051e3
push 0x40ea2c
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x410660
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x410048
call esi
test eax, eax
jle 0x405218
push 0x40ea20
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x410048
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x40ea1c
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x410250
call esi
test eax, eax
jle 0x40523f
push 0x40ea10
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x410250
lea eax, [ebp + 0xc1c]
push eax
call edi
lea eax, [ebp + 0x1f4]
push eax
call esi
test eax, eax
jle 0x405278
push str.__media_
lea eax, [ebp + 0xc1c]
push eax
call edi
lea eax, [ebp + 0x1f4]
push eax
lea eax, [ebp + 0xc1c]
push eax
call edi
push 0x40ea1c
lea eax, [ebp + 0xc1c]
push eax
call edi
push str.__force
lea eax, [ebp + 0xc1c]
push eax
call edi
lea eax, [ebp + 0xc1c]
push eax
push 0x40e9e4
call fcn.00401548
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0040bbf0
push 0x10
lea eax, [ebp - 0x38]
push ebx
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], 5
call fcn.0040bbf0
add esp, 0x20
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xa14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0xc1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405305
push 0xffffffffffffffff
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov edi, 0x410458
push edi
lea eax, [ebp + 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x604]
push eax
call fcn.0040109c
mov eax, dword [ebp - 0x18]
pop ecx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe24]
xor ecx, ebp
call fcn.0040bbdc
add ebp, 0xe28
leave
ret 0x10