Function at 0x401ae8
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebx
pop ebx
push ebp
push esp
pop ebp
sub esp, 0x618
mov eax, dword [0x408004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push ecx
pop ebx
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push edi
push ebx
mov dword [ebp - 0x614], eax
call fcn.00401680
cmp byte [ebp - 0x20c], 0x22
jne 0x401b3b
mov edx, 0x40116c
lea eax, [ebp - 0x20b]
jmp 0x401b46
mov edx, 0x401170
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x610], eax
call fcn.00401a84
mov esi, dword [ebp - 0x610]
mov edi, eax
or esi, esi
je 0x401b9f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b68
sub ecx, edx
cmp ecx, 3
jb 0x401b9f
mov al, byte [esi + 1]
cmp al, 0x3a
jne 0x401b83
cmp byte [esi + 2], 0x5c
je 0x401b8c
cmp byte [esi], 0x5c
jne 0x401b9f
cmp al, 0x5c
jne 0x401b9f
push esi
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.00401680
jmp 0x401bc7
push ecx
push 0x4091e4
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.00401781
push esi
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.0040658a
push 0x2e
pop edx
push esi
pop ecx
call fcn.004066c8
test eax, eax
je 0x401d73
push 0xffffffffffffffff
push 0x401174
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
sub eax, 1
jne 0x401d73
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401d53
shr eax, 4
not eax
and eax, 1
je 0x401d53
mov edx, 0x40117c
mov dword [ebp - 0x610], edi
lea ecx, [ebp - 0x610]
call fcn.00401a84
test eax, eax
je 0x401c50
cmp byte [eax], 0
je 0x401c40
mov dword [ebp - 0x610], eax
mov edx, 0x401180
lea ecx, [ebp - 0x610]
call fcn.00401a84
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
or esi, esi
je 0x401dd4
mov edi, dword [ebp - 0x610]
push edi
pop eax
cmp byte [edi], 0
jne 0x401c79
mov eax, str.DefaultInstall
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x401184
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x409120], eax
mov eax, dword [ebp - 0x614]
mov dword [eax], 1
lea eax, [ebp - 0x108]
push eax
push 8
push esi
push 0x401140
push 0x40118c
push 0x401198
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401cf8
or dword [0x409a34], 4
cmp byte [edi], 0
jne 0x401cd3
mov edi, str.DefaultInstall
push edi
mov edx, 0x104
mov ecx, ebx
call fcn.00401680
lea eax, [ebp - 0x108]
mov edx, 0x200
push eax
push esi
pop ecx
call fcn.00401680
jmp 0x401e89
and dword [0x409a34], 0xfffffffb
cmp word [0x409a40], 0
jne 0x401d23
push 0x104
lea eax, [ebp - 0x108]
mov ebx, 0x4011a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x401d28
mov ebx, 0x4011ac
cmp byte [edi], 0
jne 0x401d32
mov edi, str.DefaultInstall
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
push str.rundll32.exe__s_InstallHinfSection__s_128__s
push 0x200
push esi
call fcn.0040171e
add esp, 0x18
jmp 0x401e89
sub eax, eax
mov edx, 0x525
push eax
push 0x10
push eax
lea eax, [ebp - 0x108]
push eax
sub ecx, ecx
call fcn.004044b9
sub eax, eax
jmp 0x401e94
push 0x2e
pop edx
push esi
pop ecx
call fcn.004066c8
test eax, eax
je 0x401df8
push 0xffffffffffffffff
push 0x4011bc
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
sub eax, 1
jne 0x401df8
mov ebx, str.Command.com__c__s
push ebx
pop ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401da5
sub ecx, edx
lea edx, [ebp - 0x108]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x401db7
sub edx, esi
lea edi, [ecx + 8]
add edi, edx
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
pop esi
test esi, esi
jne 0x401de1
sub eax, eax
mov edx, 0x4b5
push eax
push 0x10
push eax
jmp 0x401d64
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
push esi
call fcn.0040171e
add esp, 0x10
jmp 0x401e89
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
pop esi
test esi, esi
je 0x401dd4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401e67
test al, 0x10
jne 0x401e67
push ecx
lea eax, [ebp - 0x108]
mov ebx, 0x400
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.00401781
or edi, edi
je 0x401e78
cmp byte [edi], 0
je 0x401e78
push 0x401170
mov edx, ebx
lea ecx, [ebp - 0x60c]
call fcn.004016b3
push edi
push ebx
pop edx
lea ecx, [ebp - 0x60c]
call fcn.004016b3
jmp 0x401e78
push ebx
mov edx, 0x400
lea ecx, [ebp - 0x60c]
call fcn.00401680
push esi
mov edx, esi
mov byte [esi], 0
lea ecx, [ebp - 0x60c]
call fcn.00402aac
mov ecx, dword [ebp - 0x618]
xor eax, eax
inc eax
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ce0
mov esp, ebp
pop ebp
ret 8