Function at 0x40202a
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7b72
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2c18
call fcn.00492280
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x2c0c], eax
mov dword [ebp - 0x2c28], eax
xor eax, eax
mov esi, 0x286
xor ebx, ebx
push esi
mov word [ebp - 0x4a8], ax
lea eax, [ebp - 0x4a6]
push ebx
push eax
mov dword [ebp - 0x2c10], ebx
call fcn.004921d0
xor eax, eax
push esi
mov word [ebp - 0x730], ax
lea eax, [ebp - 0x72e]
push ebx
push eax
call fcn.004921d0
add esp, 0x18
lea eax, [ebp - 0x730]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 6
pop ecx
mov esi, str.kwatch32.sys
lea edi, [ebp - 0x2bc0]
rep movsd dword es:[edi], dword [esi]
push 0x1ee
lea eax, [ebp - 0x2ba6]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 6
pop ecx
mov esi, str.kwatch64.sys
lea edi, [ebp - 0x29b8]
rep movsd dword es:[edi], dword [esi]
push 0x1ee
lea eax, [ebp - 0x299e]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 6
pop ecx
push 0x1f0
lea eax, [ebp - 0x2798]
push ebx
mov esi, str.kavapim.sys
lea edi, [ebp - 0x27b0]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004921d0
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x2594]
push ebx
mov esi, str.kavpm.sys
lea edi, [ebp - 0x25a8]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004921d0
push 5
pop ecx
mov esi, str.kavuty.sys
lea edi, [ebp - 0x23a0]
rep movsd dword es:[edi], dword [esi]
push 0x1f2
lea eax, [ebp - 0x238a]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x2184]
push ebx
mov esi, str.kavfm.sys
lea edi, [ebp - 0x2198]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004921d0
add esp, 0x48
lea eax, [ebp - 0x1f7c]
push 5
pop ecx
push 0x1f4
push ebx
mov esi, str.ksdef.sys
lea edi, [ebp - 0x1f90]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004921d0
push 7
pop ecx
push 0x1ec
lea eax, [ebp - 0x1d6c]
push ebx
mov esi, str.kdekernel.sys
lea edi, [ebp - 0x1d88]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004921d0
mov esi, str.bc.sys
lea edi, [ebp - 0x1b80]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fa
lea eax, [ebp - 0x1b72]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 6
pop ecx
mov esi, str.bootsafe.sys
lea edi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
push 0x1ee
lea eax, [ebp - 0x195e]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 6
pop ecx
mov esi, str.kavbootc.sys
lea edi, [ebp - 0x1770]
rep movsd dword es:[edi], dword [esi]
push 0x1ee
lea eax, [ebp - 0x1756]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 7
pop ecx
mov esi, str.kavbootc64.sys
lea edi, [ebp - 0x1568]
rep movsd dword es:[edi], dword [esi]
push 0x1ea
lea eax, [ebp - 0x154a]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
add esp, 0x48
mov esi, str.kavsafe.sys
push 6
pop ecx
lea edi, [ebp - 0x1360]
rep movsd dword es:[edi], dword [esi]
push 0x1f0
lea eax, [ebp - 0x1348]
push ebx
push eax
call fcn.004921d0
push 6
pop ecx
mov esi, str.kdhacker.sys
lea edi, [ebp - 0x1158]
rep movsd dword es:[edi], dword [esi]
push 0x1ee
lea eax, [ebp - 0x113e]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 7
pop ecx
mov esi, str.kdhacker64.sys
lea edi, [ebp - 0xf50]
rep movsd dword es:[edi], dword [esi]
push 0x1ea
lea eax, [ebp - 0xf32]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 5
pop ecx
mov esi, str.kisknl.sys
lea edi, [ebp - 0xd48]
rep movsd dword es:[edi], dword [esi]
push 0x1f2
lea eax, [ebp - 0xd32]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 6
pop ecx
mov esi, str.kisknl64.sys
lea edi, [ebp - 0xb40]
rep movsd dword es:[edi], dword [esi]
push 0x1ee
lea eax, [ebp - 0xb26]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.004921d0
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x924]
push ebx
mov esi, str.ksapi.sys
lea edi, [ebp - 0x938]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004921d0
add esp, 0x48
mov esi, ebx
mov dword [ebp - 0x2c20], ebx
cmp esi, 0x12
jae 0x4025aa
mov edi, 0x104
push edi
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.00495430
mov eax, esi
imul eax, eax, 0x208
add esp, 0xc
lea eax, [ebp + eax - 0x2bc0]
push eax
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40259e
test al, 0x10
jne 0x40259e
lea eax, [ebp - 0x2c14]
push eax
lea eax, [ebp - 0x2c18]
push eax
lea eax, [ebp - 0x2c24]
push eax
lea edx, [ebp - 0x2c1c]
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x2c1c], ebx
mov dword [ebp - 0x2c24], ebx
mov dword [ebp - 0x2c18], ebx
mov dword [ebp - 0x2c14], ebx
call fcn.004018b6
add esp, 0xc
cmp eax, 1
jne 0x40259e
mov dword [ebp - 4], ebx
push 7
pop eax
mov dword [ebp - 0x2bf4], eax
xor ecx, ecx
mov dword [ebp - 0x2bdc], eax
mov dword [ebp - 0x2bc4], eax
xor eax, eax
mov dword [ebp - 0x2bf8], ebx
mov word [ebp - 0x2c08], cx
mov dword [ebp - 0x2be0], ebx
mov word [ebp - 0x2bf0], cx
mov dword [ebp - 0x2bc8], ebx
mov word [ebp - 0x2bd8], ax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
call fcn.004921d0
mov ecx, dword [ebp - 0x2c24]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x2c1c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.0049846e
lea eax, [ebp - 0x220]
push eax
call fcn.00405113
add esp, 0x2c
lea ecx, [ebp - 0x2bf0]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0040509a
mov ecx, dword [ebp - 0x2c14]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x2c18]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.0049846e
lea eax, [ebp - 0x220]
push eax
call fcn.00405113
add esp, 0x20
lea ecx, [ebp - 0x2bd8]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0040509a
lea eax, [ebp - 0x4a8]
push eax
call fcn.00405113
pop ecx
push eax
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x2c08]
call fcn.0040509a
mov edi, dword [ebp - 0x2c0c]
mov edi, dword [edi]
lea eax, [ebp - 0x2c08]
push eax
push dword [edi + 4]
push edi
call fcn.00404c66
mov ecx, dword [ebp - 0x2c0c]
mov edx, eax
mov eax, 0x3333332
sub eax, dword [ecx + 4]
cmp eax, 1
jae 0x40255a
push str.list_T__too_long
call fcn.004b1beb
inc dword [ecx + 4]
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x2c08]
mov dword [eax], edx
mov dword [ebp - 0x2c10], 1
call fcn.004025ca
or dword [ebp - 4], 0xffffffff
jmp 0x40259e
inc esi
mov dword [ebp - 0x2c20], esi
jmp 0x402359
mov eax, dword [ebp - 0x2c10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048f059
leave
ret