Function at 0x40b2f8
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xca8
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
xor edi, edi
lea eax, [ebp - 0x476]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40b54b
xor eax, eax
push esi
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x26e]
push edi
push eax
call fcn.00421bc0
mov dword [ebp - 0xca8], edi
xor eax, eax
lea edi, [ebp - 0xca4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0xca8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x40b3c8
xor eax, eax
push SetEndOfFile
push eax
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push eax
call fcn.00421bc0
add esp, 0xc
push 0x32
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xca8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x270]
push eax
call edi
jmp 0x40b3e8
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x435dc8
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call fcn.004113e9
test eax, eax
je 0x40b54b
xor eax, eax
push esi
push eax
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x886]
push eax
call fcn.00421bc0
add esp, 0xc
cmp dword [ebx + 0xa4], 8
jb 0x40b420
mov eax, dword [ebx + 0x90]
jmp 0x40b426
lea eax, [ebx + 0x90]
push 0x437474
push eax
lea eax, [ebp - 0x888]
push eax
call edi
lea eax, [ebp - 0x888]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b54b
xor eax, eax
push esi
push eax
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0xc96]
push eax
call fcn.00421bc0
add esp, 0xc
push 0x437474
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0xc98]
push eax
call edi
lea eax, [ebp - 0x888]
push 0
push eax
lea ecx, [ebp - 0xc98]
call fcn.0040e5e1
pop ecx
pop ecx
test eax, eax
je 0x40b54b
call fcn.00410d73
test eax, eax
je 0x40b53a
xor eax, eax
push esi
push eax
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x67e]
push eax
call fcn.00421bc0
add esp, 0xc
cmp dword [ebx + 0xa4], 8
jb 0x40b4cf
mov eax, dword [ebx + 0x90]
jmp 0x40b4d5
lea eax, [ebx + 0x90]
push 0x4374ac
push eax
lea eax, [ebp - 0x680]
push eax
call edi
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b53a
xor eax, eax
push esi
push eax
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0xa8e]
push eax
call fcn.00421bc0
add esp, 0xc
push 0x4374ac
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0xa90]
push eax
call edi
lea eax, [ebp - 0x680]
push 0
push eax
lea ecx, [ebp - 0xa90]
call fcn.0040e5e1
pop ecx
pop ecx
lea ecx, [ebx + 0x268]
lea eax, [ebp - 0x270]
call fcn.00405e78
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041f23c
leave
ret