Function at 0x403f70
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10060
call fcn.004220f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0x14]
mov dword [ebp - 0x1005c], edx
mov dword [ebp - 0x10058], eax
push edi
test esi, esi
je 0x403fa9
cmp byte [ecx + 0x36], 0
je 0x403fba
cmp byte [ecx + 0x39], 0
mov esi, str.pythonw.exe
mov eax, str.python.exe
cmove esi, eax
lea eax, [ebp - 0x1004c]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x404287
mov edi, dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombineEx]
lea eax, [ebp - 0x1004c]
push 1
push str.MicrosoftWindowsApps
push eax
push 0x8000
push eax
call edi
test eax, eax
js 0x404264
push 1
push ebx
lea eax, [ebp - 0x1004c]
push eax
push 0x8000
push eax
call edi
test eax, eax
js 0x404264
push 1
push esi
lea eax, [ebp - 0x1004c]
push eax
push 0x8000
push eax
call edi
test eax, eax
js 0x404264
lea eax, [ebp - 0x1004c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404287
push dword [ebp - 0x10058]
lea eax, [ebp - 0x4c]
push 0x20
push eax
call fcn.00414da7
add esp, 0xc
call fcn.004012e0
mov esi, 0xaa64
cmp ax, si
jne 0x40407b
push str._arm64
lea eax, [ebp - 0x4c]
push 0x20
push eax
call fcn.00414e0b
add esp, 0xc
lea edx, [ebp - 0x4c]
mov ecx, str.PythonCore
call fcn.00403110
mov edi, eax
test edi, edi
jne 0x4040a2
lea eax, [edi + 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004065bc
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
call fcn.004012e0
mov ecx, 0x8664
cmp ax, cx
jne 0x404103
lea esi, [edi + 0x24]
test esi, esi
je 0x40415e
push 0x7fff
push str.64bit
call fcn.00409b44
mov dword [ebp - 0x10050], eax
inc eax
mov dword [ebp - 0x10054], eax
lea ecx, [eax + eax]
push ecx
call fcn.004153ae
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40415e
push dword [ebp - 0x10050]
push str.64bit
push dword [ebp - 0x10054]
jmp 0x404153
call fcn.004012e0
cmp ax, si
jne 0x40415e
lea esi, [edi + 0x24]
test esi, esi
je 0x40415e
push 0x7fff
push str.ARM64
call fcn.00409b44
mov dword [ebp - 0x10054], eax
inc eax
mov dword [ebp - 0x10050], eax
lea ecx, [eax + eax]
push ecx
call fcn.004153ae
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40415e
push dword [ebp - 0x10054]
push str.ARM64
push dword [ebp - 0x10050]
push ebx
call fcn.00415487
mov dword [esi], ebx
add esp, 0x10
lea esi, [edi + 0x1c]
test esi, esi
je 0x4041b3
lea eax, [ebp - 0x1004c]
push 0x7fff
push eax
call fcn.00409b44
mov dword [ebp - 0x10054], eax
inc eax
mov dword [ebp - 0x10050], eax
lea ecx, [eax + eax]
push ecx
call fcn.004153ae
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4041b3
push dword [ebp - 0x10054]
lea eax, [ebp - 0x1004c]
push eax
push dword [ebp - 0x10050]
push ebx
call fcn.00415487
add esp, 0x10
mov dword [esi], ebx
push dword [ebp - 0x10058]
lea eax, [ebp - 0x1004c]
push str.Python__s__Store_
push 0x8000
push eax
call fcn.00401080
add esp, 0x10
test eax, eax
je 0x40422b
lea esi, [edi + 0x28]
test esi, esi
je 0x40422b
lea eax, [ebp - 0x1004c]
push 0x7fff
push eax
call fcn.00409b44
mov dword [ebp - 0x10054], eax
inc eax
mov dword [ebp - 0x10050], eax
lea ecx, [eax + eax]
push ecx
call fcn.004153ae
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40422b
push dword [ebp - 0x10054]
lea eax, [ebp - 0x1004c]
push eax
push dword [ebp - 0x10050]
push ebx
call fcn.00415487
add esp, 0x10
mov dword [esi], ebx
mov ecx, dword [ebp - 0x1005c]
xor edx, edx
push edi
call fcn.004033d0
mov esi, eax
add esp, 4
test esi, esi
je 0x404251
mov ecx, edi
call fcn.00403220
xor eax, eax
cmp esi, 0x6e
cmove esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004065bc
mov esp, ebp
pop ebp
ret
push str._Failed_to_construct_App_Execution_Alias_path_n
call fcn.00401130
add esp, 4
mov eax, 0x6d
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004065bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 0x67
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004065bc
mov esp, ebp
pop ebp
ret