Function at 0x403e70
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10060
call fcn.004219e0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0x14]
mov dword [ebp - 0x1005c], edx
mov dword [ebp - 0x10058], eax
push edi
test esi, esi
je 0x403ea9
cmp byte [ecx + 0x36], 0
je 0x403eba
cmp byte [ecx + 0x39], 0
mov esi, str.pythonw.exe
mov eax, str.python.exe
cmove esi, eax
lea eax, [ebp - 0x1004c]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x404176
mov edi, dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombineEx]
lea eax, [ebp - 0x1004c]
push 1
push str.MicrosoftWindowsApps
push eax
push 0x8000
push eax
call edi
test eax, eax
js 0x404176
push 1
push ebx
lea eax, [ebp - 0x1004c]
push eax
push 0x8000
push eax
call edi
test eax, eax
js 0x404176
push 1
push esi
lea eax, [ebp - 0x1004c]
push eax
push 0x8000
push eax
call edi
test eax, eax
js 0x404176
lea eax, [ebp - 0x1004c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403f57
mov eax, 0x67
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004064d4
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10058]
lea eax, [ebp - 0x4c]
push 0x20
push eax
call fcn.00414ce8
add esp, 0xc
call fcn.004012e0
mov esi, 0xaa64
cmp ax, si
jne 0x403f8d
push str._arm64
lea eax, [ebp - 0x4c]
push 0x20
push eax
call fcn.00414d4c
add esp, 0xc
lea edx, [ebp - 0x4c]
mov ecx, str.PythonCore
call fcn.00403010
mov edi, eax
test edi, edi
jne 0x403fb4
lea eax, [edi + 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004064d4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
call fcn.004012e0
mov ecx, 0x8664
cmp ax, cx
jne 0x404015
lea esi, [edi + 0x24]
test esi, esi
je 0x404070
push 0x7fff
push str.64bit
call fcn.00409a84
mov dword [ebp - 0x10050], eax
inc eax
mov dword [ebp - 0x10054], eax
lea ecx, [eax + eax]
push ecx
call fcn.0041530e
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x404070
push dword [ebp - 0x10050]
push str.64bit
push dword [ebp - 0x10054]
jmp 0x404065
call fcn.004012e0
cmp ax, si
jne 0x404070
lea esi, [edi + 0x24]
test esi, esi
je 0x404070
push 0x7fff
push str.ARM64
call fcn.00409a84
mov dword [ebp - 0x10054], eax
inc eax
mov dword [ebp - 0x10050], eax
lea ecx, [eax + eax]
push ecx
call fcn.0041530e
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x404070
push dword [ebp - 0x10054]
push str.ARM64
push dword [ebp - 0x10050]
push ebx
call fcn.004153e7
mov dword [esi], ebx
add esp, 0x10
lea esi, [edi + 0x1c]
test esi, esi
je 0x4040c5
lea eax, [ebp - 0x1004c]
push 0x7fff
push eax
call fcn.00409a84
mov dword [ebp - 0x10054], eax
inc eax
mov dword [ebp - 0x10050], eax
lea ecx, [eax + eax]
push ecx
call fcn.0041530e
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4040c5
push dword [ebp - 0x10054]
lea eax, [ebp - 0x1004c]
push eax
push dword [ebp - 0x10050]
push ebx
call fcn.004153e7
add esp, 0x10
mov dword [esi], ebx
push dword [ebp - 0x10058]
lea eax, [ebp - 0x1004c]
push str.Python__s__Store_
push 0x8000
push eax
call fcn.00401080
add esp, 0x10
test eax, eax
je 0x40413d
lea esi, [edi + 0x28]
test esi, esi
je 0x40413d
lea eax, [ebp - 0x1004c]
push 0x7fff
push eax
call fcn.00409a84
mov dword [ebp - 0x10054], eax
inc eax
mov dword [ebp - 0x10050], eax
lea ecx, [eax + eax]
push ecx
call fcn.0041530e
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40413d
push dword [ebp - 0x10054]
lea eax, [ebp - 0x1004c]
push eax
push dword [ebp - 0x10050]
push ebx
call fcn.004153e7
add esp, 0x10
mov dword [esi], ebx
mov ecx, dword [ebp - 0x1005c]
xor edx, edx
push edi
call fcn.004032d0
mov esi, eax
add esp, 4
test esi, esi
je 0x404163
mov ecx, edi
call fcn.00403120
xor eax, eax
cmp esi, 0x6e
cmove esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004064d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 0x6d
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004064d4
mov esp, ebp
pop ebp
ret