Function at 0x40ce70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526b77
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x430], ebx
call fcn.0040cb40
mov ecx, eax
test ecx, ecx
je 0x40d30c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], 0
test edi, edi
je 0x40cf6d
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
call fcn.0040d510
test eax, eax
jne 0x40cf1e
call fcn.00434240
test eax, eax
je 0x40cf07
call fcn.0040d460
test eax, eax
jne 0x40cf1e
call fcn.0040d330
mov ecx, dword [str.HardwareProtect.sys]
test eax, eax
cmovne ecx, dword [str.HardwareProtect_x64.sys]
push ecx
jmp 0x40cf24
push dword [0x582058]
push edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cf40
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.0040d780
mov esi, dword [ebp - 0x428]
jmp 0x40d0cb
cmp word [0x5884f0], 0
jne 0x40cfd8
push 0x104
push 0x5884f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5884f0
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.0040d510
test eax, eax
jne 0x40cfc6
call fcn.00434240
test eax, eax
je 0x40cfaf
call fcn.0040d460
test eax, eax
jne 0x40cfc6
call fcn.0040d330
mov ecx, dword [str.HardwareProtect.sys]
test eax, eax
cmovne ecx, dword [str.HardwareProtect_x64.sys]
push ecx
jmp 0x40cfcc
push dword [0x582058]
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x5884f0
call eax
call fcn.0040cb40
mov ecx, eax
test ecx, ecx
je 0x40d316
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
mov eax, 0x5884f0
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x40d016
movzx eax, ax
lea ecx, [ebp - 0x424]
push eax
call fcn.0040d5d0
jmp 0x40d040
mov ecx, 0x5884f0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d020
sub ecx, edx
sar ecx, 1
push ecx
push 0x5884f0
lea ecx, [ebp - 0x424]
call fcn.0040d780
mov eax, dword [ebp - 0x424]
lea ebx, [esi - 0x10]
mov byte [ebp - 4], 2
lea edi, [eax - 0x10]
cmp edi, ebx
je 0x40d0ac
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x40d097
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x40d097
push edi
call fcn.0040c3d0
add esp, 4
mov dword [ebp - 0x434], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x40d08c
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x434]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
jmp 0x40d0ac
push dword [eax - 0xc]
lea ecx, [ebp - 0x428]
push eax
call fcn.0040d780
mov esi, dword [ebp - 0x428]
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40d0c5
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x430]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d2cd
push esi
call fcn.00493dc0
add esp, 4
test eax, eax
je 0x40d2cd
push 0
push 0
push esi
push 1
push ebx
push ebx
call fcn.0040e570
add esp, 0x18
test eax, eax
js 0x40d2cd
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.ldsComputerZ.set
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0040cb40
mov ecx, eax
test ecx, ecx
je 0x40d320
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
mov eax, str.Pdrv
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x424]
test eax, 0xffff0000
jne 0x40d17d
movzx eax, ax
push eax
call fcn.0040d5d0
jmp 0x40d189
push 4
push str.Pdrv
call fcn.0040d780
mov byte [ebp - 4], 4
call fcn.0040d330
test eax, eax
mov edx, str._x86
mov ecx, str._x64
lea eax, [ebp - 0x424]
cmove ecx, edx
push ecx
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.0040bb20
mov edx, dword [ebp - 0x424]
add esp, 0xc
mov byte [ebp - 4], 0
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d1da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [section..data]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d208
test dx, dx
je 0x40d204
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d208
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d1e2
xor eax, eax
jmp 0x40d20d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d28f
mov ecx, str.HardwareProtectLite
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d23e
test dx, dx
je 0x40d23a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d23e
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d218
xor eax, eax
jmp 0x40d243
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d256
lea eax, [ebp - 0x218]
push eax
push ebx
push str.ldslite
jmp 0x40d29c
mov ecx, dword [str.LudashiProtect]
mov eax, ebx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d286
test dx, dx
je 0x40d282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d286
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d260
xor eax, eax
jmp 0x40d28b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d2a8
lea eax, [ebp - 0x218]
push eax
push ebx
push str.ludashi
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x42c]
mov edi, 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d2cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40d2cf
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d2ee
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040ab80
push 0x80004005
call fcn.0040ab80
push 0x80004005
call fcn.0040ab80
int3