Function at 0x401bd3
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x408004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 0xc]
push ebx
push ecx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x614], eax
call fcn.00401846
cmp byte [ebp - 0x20c], 0x22
jne 0x401c28
mov edx, 0x401184
lea eax, [ebp - 0x20b]
jmp 0x401c33
mov edx, 0x401188
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x610], eax
call fcn.00401b6b
mov esi, dword [ebp - 0x610]
mov edi, eax
test esi, esi
je 0x401c8e
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401c55
sub ecx, edx
cmp ecx, 3
jb 0x401c8e
mov al, byte [esi + 1]
cmp al, 0x3a
jne 0x401c70
cmp byte [esi + 2], 0x5c
je 0x401c79
cmp byte [esi], 0x5c
jne 0x401c8e
cmp al, 0x5c
jne 0x401c8e
push ecx
push esi
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.00401846
jmp 0x401cb6
push ecx
push 0x4091e4
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.00401846
push esi
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.00406836
push 0x2e
pop edx
mov ecx, esi
call fcn.00406995
test eax, eax
je 0x401e64
push 0xffffffffffffffff
push 0x40118c
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
sub eax, 1
jne 0x401e64
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401e44
shr eax, 4
not eax
test eax, 1
je 0x401e44
mov edx, 0x401194
mov dword [ebp - 0x610], edi
lea ecx, [ebp - 0x610]
call fcn.00401b6b
test eax, eax
je 0x401d41
cmp byte [eax], 0
je 0x401d31
mov dword [ebp - 0x610], eax
mov edx, 0x401198
lea ecx, [ebp - 0x610]
call fcn.00401b6b
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x401ec5
mov edi, dword [ebp - 0x610]
mov eax, edi
cmp byte [edi], 0
jne 0x401d6a
mov eax, str.DefaultInstall
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x40119c
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x409120], eax
mov eax, dword [ebp - 0x614]
mov dword [eax], 1
lea eax, [ebp - 0x108]
push eax
push 8
push esi
push 0x401158
push 0x4011a4
push 0x4011b0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401de9
or dword [0x409a34], 4
cmp byte [edi], 0
jne 0x401dc4
mov edi, str.DefaultInstall
push edi
mov edx, 0x104
mov ecx, ebx
call fcn.00401740
lea eax, [ebp - 0x108]
mov edx, 0x200
push eax
mov ecx, esi
call fcn.00401740
jmp 0x401f79
and dword [0x409a34], 0xfffffffb
cmp word [0x409a40], 0
jne 0x401e14
push 0x104
lea eax, [ebp - 0x108]
mov ebx, 0x4011b8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x401e19
mov ebx, 0x4011c4
cmp byte [edi], 0
jne 0x401e23
mov edi, str.DefaultInstall
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
push str.rundll32.exe__s_InstallHinfSection__s_128__s
push 0x200
push esi
call fcn.004017e1
add esp, 0x18
jmp 0x401f79
xor eax, eax
mov edx, 0x525
push eax
push 0x10
push eax
lea eax, [ebp - 0x108]
push eax
xor ecx, ecx
call fcn.004046c7
xor eax, eax
jmp 0x401f84
push 0x2e
pop edx
mov ecx, esi
call fcn.00406995
test eax, eax
je 0x401ee9
push 0xffffffffffffffff
push 0x4011d4
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
sub eax, 1
jne 0x401ee9
mov ebx, str.Command.com__c__s
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e96
sub ecx, edx
lea edx, [ebp - 0x108]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x401ea8
sub edx, esi
lea edi, [ecx + 8]
add edi, edx
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x401ed2
xor eax, eax
mov edx, 0x4b5
push eax
push 0x10
push eax
jmp 0x401e55
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
push esi
call fcn.004017e1
add esp, 0x10
jmp 0x401f79
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x401ec5
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401f58
test al, 0x10
jne 0x401f58
push ecx
lea eax, [ebp - 0x108]
mov ebx, 0x400
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.00401846
test edi, edi
je 0x401f6b
cmp byte [edi], 0
je 0x401f6b
push 0x401188
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.00401773
push edi
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.00401773
jmp 0x401f6b
push ecx
push ebx
push ecx
mov edx, 0x400
lea ecx, [ebp - 0x60c]
call fcn.00401846
push ecx
mov edx, esi
lea ecx, [ebp - 0x60c]
call fcn.00402c30
mov ecx, dword [ebp - 0x618]
xor eax, eax
inc eax
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ff0
leave
ret 8