Function at 0x48dcce
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1864
call sub.ntdll.dll__chkstk
push esi
push edi
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov cl, byte [0x564118]
mov byte [ebp - 0x1860], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x185f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [str._system32]
mov dword [ebp - 0x175c], edx
mov eax, dword [0x544720]
mov dword [ebp - 0x1758], eax
mov cx, word [0x544724]
mov word [ebp - 0x1754], cx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x1752]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str._system32drivers]
mov dword [ebp - 0x1658], edx
mov eax, dword [0x54472c]
mov dword [ebp - 0x1654], eax
mov ecx, dword [0x544730]
mov dword [ebp - 0x1650], ecx
mov edx, dword [0x544734]
mov dword [ebp - 0x164c], edx
mov ax, word [0x544738]
mov word [ebp - 0x1648], ax
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x1646]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [str._system32wbem]
mov dword [ebp - 0x1554], ecx
mov edx, dword [0x544740]
mov dword [ebp - 0x1550], edx
mov eax, dword [0x544744]
mov dword [ebp - 0x154c], eax
mov cx, word [0x544748]
mov word [ebp - 0x1548], cx
mov dl, byte [0x54474a]
mov byte [ebp - 0x1546], dl
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1545]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str._system32wbemxml]
mov dword [ebp - 0x1450], eax
mov ecx, dword [0x544750]
mov dword [ebp - 0x144c], ecx
mov edx, dword [0x544754]
mov dword [ebp - 0x1448], edx
mov eax, dword [0x544758]
mov dword [ebp - 0x1444], eax
mov cx, word [0x54475c]
mov word [ebp - 0x1440], cx
mov dl, byte [0x54475e]
mov byte [ebp - 0x143e], dl
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x143d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str._system32zh_cn]
mov dword [ebp - 0x134c], eax
mov ecx, dword [0x544764]
mov dword [ebp - 0x1348], ecx
mov edx, dword [0x544768]
mov dword [ebp - 0x1344], edx
mov eax, dword [0x54476c]
mov dword [ebp - 0x1340], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x133c]
rep stosd dword es:[edi], eax
mov ecx, dword [str._system32Setup]
mov dword [ebp - 0x1248], ecx
mov edx, dword [0x544774]
mov dword [ebp - 0x1244], edx
mov eax, dword [0x544778]
mov dword [ebp - 0x1240], eax
mov ecx, dword [0x54477c]
mov dword [ebp - 0x123c], ecx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1238]
rep stosd dword es:[edi], eax
mov edx, dword [str._system32usmt]
mov dword [ebp - 0x1144], edx
mov eax, dword [0x544784]
mov dword [ebp - 0x1140], eax
mov ecx, dword [0x544788]
mov dword [ebp - 0x113c], ecx
mov dx, word [0x54478c]
mov word [ebp - 0x1138], dx
mov al, byte [0x54478e]
mov byte [ebp - 0x1136], al
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1135]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, dword [str._system32Com]
mov dword [ebp - 0x1040], ecx
mov edx, dword [0x544794]
mov dword [ebp - 0x103c], edx
mov eax, dword [0x544798]
mov dword [ebp - 0x1038], eax
mov cx, word [0x54479c]
mov word [ebp - 0x1034], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1032]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str._system32_npp]
mov dword [ebp - 0xf3c], edx
mov eax, dword [0x5447a4]
mov dword [ebp - 0xf38], eax
mov ecx, dword [0x5447a8]
mov dword [ebp - 0xf34], ecx
mov dx, word [0x5447ac]
mov word [ebp - 0xf30], dx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0xf2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str._system]
mov dword [ebp - 0xe38], eax
mov ecx, dword [0x5447b4]
mov dword [ebp - 0xe34], ecx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xe30]
rep stosd dword es:[edi], eax
mov edx, dword [0x5447b8]
mov dword [ebp - 0xd34], edx
mov eax, dword [0x5447bc]
mov dword [ebp - 0xd30], eax
mov cx, word [0x5447c0]
mov word [ebp - 0xd2c], cx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0xd2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str.ime]
mov dword [ebp - 0xc30], edx
mov al, byte [0x5447c8]
mov byte [ebp - 0xc2c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xc2b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [str.inf]
mov dword [ebp - 0xb2c], ecx
mov dl, byte [0x5447d0]
mov byte [ebp - 0xb28], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xb27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.ehome]
mov dword [ebp - 0xa28], eax
mov cx, word [0x5447d8]
mov word [ebp - 0xa24], cx
mov dl, byte [0x5447da]
mov byte [ebp - 0xa22], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xa21]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str.PeerNet]
mov dword [ebp - 0x924], eax
mov ecx, dword [0x5447e0]
mov dword [ebp - 0x920], ecx
mov dl, byte [0x5447e4]
mov byte [ebp - 0x91c], dl
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x91b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._twain_32]
mov dword [ebp - 0x820], eax
mov ecx, dword [0x5447ec]
mov dword [ebp - 0x81c], ecx
mov dx, word [0x5447f0]
mov word [ebp - 0x818], dx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.msagent]
mov dword [ebp - 0x71c], eax
mov ecx, dword [0x5447f8]
mov dword [ebp - 0x718], ecx
mov dl, byte [0x5447fc]
mov byte [ebp - 0x714], dl
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x713]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msagentintl]
mov dword [ebp - 0x618], eax
mov ecx, dword [0x544804]
mov dword [ebp - 0x614], ecx
mov edx, dword [0x544808]
mov dword [ebp - 0x610], edx
mov ax, word [0x54480c]
mov word [ebp - 0x60c], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x60a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [str.ie7]
mov dword [ebp - 0x514], ecx
mov dl, byte [0x544814]
mov byte [ebp - 0x510], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x50f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, 0x544818
lea edi, [ebp - 0x410]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3a
xor eax, eax
lea edi, [ebp - 0x3f5]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 7
mov esi, str.pchealthUploadLBBinaries
lea edi, [ebp - 0x30c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3a
xor eax, eax
lea edi, [ebp - 0x2f0]
rep stosd dword es:[edi], eax
mov ax, word [0x544850]
mov word [ebp - 0x208], ax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x1860]
mov dword [ebp - 0x1864], ecx
mov edx, dword [ebp - 0x1864]
movsx eax, byte [edx]
cmp eax, 0x30
jne 0x48e1ef
jmp 0x48e246
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1864]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x544854
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403f10
add esp, 0x18
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x48e22c
mov eax, 1
jmp 0x48e248
mov eax, dword [ebp - 0x1864]
add eax, 0x104
mov dword [ebp - 0x1864], eax
mov ecx, 1
test ecx, ecx
jne 0x48e1df
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret