Function at 0x487e8e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1864
call sub.ntdll.dll__chkstk
push esi
push edi
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov cl, byte [0x55b5d8]
mov byte [ebp - 0x1860], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x185f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [str._system32]
mov dword [ebp - 0x175c], edx
mov eax, dword [0x53bc18]
mov dword [ebp - 0x1758], eax
mov cx, word [0x53bc1c]
mov word [ebp - 0x1754], cx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x1752]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str._system32drivers]
mov dword [ebp - 0x1658], edx
mov eax, dword [0x53bc24]
mov dword [ebp - 0x1654], eax
mov ecx, dword [0x53bc28]
mov dword [ebp - 0x1650], ecx
mov edx, dword [0x53bc2c]
mov dword [ebp - 0x164c], edx
mov ax, word [0x53bc30]
mov word [ebp - 0x1648], ax
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x1646]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [str._system32wbem]
mov dword [ebp - 0x1554], ecx
mov edx, dword [0x53bc38]
mov dword [ebp - 0x1550], edx
mov eax, dword [0x53bc3c]
mov dword [ebp - 0x154c], eax
mov cx, word [0x53bc40]
mov word [ebp - 0x1548], cx
mov dl, byte [0x53bc42]
mov byte [ebp - 0x1546], dl
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1545]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str._system32wbemxml]
mov dword [ebp - 0x1450], eax
mov ecx, dword [0x53bc48]
mov dword [ebp - 0x144c], ecx
mov edx, dword [0x53bc4c]
mov dword [ebp - 0x1448], edx
mov eax, dword [0x53bc50]
mov dword [ebp - 0x1444], eax
mov cx, word [0x53bc54]
mov word [ebp - 0x1440], cx
mov dl, byte [0x53bc56]
mov byte [ebp - 0x143e], dl
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x143d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str._system32zh_cn]
mov dword [ebp - 0x134c], eax
mov ecx, dword [0x53bc5c]
mov dword [ebp - 0x1348], ecx
mov edx, dword [0x53bc60]
mov dword [ebp - 0x1344], edx
mov eax, dword [0x53bc64]
mov dword [ebp - 0x1340], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x133c]
rep stosd dword es:[edi], eax
mov ecx, dword [str._system32Setup]
mov dword [ebp - 0x1248], ecx
mov edx, dword [0x53bc6c]
mov dword [ebp - 0x1244], edx
mov eax, dword [0x53bc70]
mov dword [ebp - 0x1240], eax
mov ecx, dword [0x53bc74]
mov dword [ebp - 0x123c], ecx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1238]
rep stosd dword es:[edi], eax
mov edx, dword [str._system32usmt]
mov dword [ebp - 0x1144], edx
mov eax, dword [0x53bc7c]
mov dword [ebp - 0x1140], eax
mov ecx, dword [0x53bc80]
mov dword [ebp - 0x113c], ecx
mov dx, word [0x53bc84]
mov word [ebp - 0x1138], dx
mov al, byte [0x53bc86]
mov byte [ebp - 0x1136], al
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1135]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, dword [str._system32Com]
mov dword [ebp - 0x1040], ecx
mov edx, dword [0x53bc8c]
mov dword [ebp - 0x103c], edx
mov eax, dword [0x53bc90]
mov dword [ebp - 0x1038], eax
mov cx, word [0x53bc94]
mov word [ebp - 0x1034], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x1032]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str._system32_npp]
mov dword [ebp - 0xf3c], edx
mov eax, dword [0x53bc9c]
mov dword [ebp - 0xf38], eax
mov ecx, dword [0x53bca0]
mov dword [ebp - 0xf34], ecx
mov dx, word [0x53bca4]
mov word [ebp - 0xf30], dx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0xf2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str._system]
mov dword [ebp - 0xe38], eax
mov ecx, dword [0x53bcac]
mov dword [ebp - 0xe34], ecx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xe30]
rep stosd dword es:[edi], eax
mov edx, dword [0x53bcb0]
mov dword [ebp - 0xd34], edx
mov eax, dword [0x53bcb4]
mov dword [ebp - 0xd30], eax
mov cx, word [0x53bcb8]
mov word [ebp - 0xd2c], cx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0xd2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str.ime]
mov dword [ebp - 0xc30], edx
mov al, byte [0x53bcc0]
mov byte [ebp - 0xc2c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xc2b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [str.inf]
mov dword [ebp - 0xb2c], ecx
mov dl, byte [0x53bcc8]
mov byte [ebp - 0xb28], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xb27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.ehome]
mov dword [ebp - 0xa28], eax
mov cx, word [0x53bcd0]
mov word [ebp - 0xa24], cx
mov dl, byte [0x53bcd2]
mov byte [ebp - 0xa22], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xa21]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str.PeerNet]
mov dword [ebp - 0x924], eax
mov ecx, dword [0x53bcd8]
mov dword [ebp - 0x920], ecx
mov dl, byte [0x53bcdc]
mov byte [ebp - 0x91c], dl
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x91b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._twain_32]
mov dword [ebp - 0x820], eax
mov ecx, dword [0x53bce4]
mov dword [ebp - 0x81c], ecx
mov dx, word [0x53bce8]
mov word [ebp - 0x818], dx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.msagent]
mov dword [ebp - 0x71c], eax
mov ecx, dword [0x53bcf0]
mov dword [ebp - 0x718], ecx
mov dl, byte [0x53bcf4]
mov byte [ebp - 0x714], dl
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x713]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msagentintl]
mov dword [ebp - 0x618], eax
mov ecx, dword [0x53bcfc]
mov dword [ebp - 0x614], ecx
mov edx, dword [0x53bd00]
mov dword [ebp - 0x610], edx
mov ax, word [0x53bd04]
mov word [ebp - 0x60c], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x60a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [str.ie7]
mov dword [ebp - 0x514], ecx
mov dl, byte [0x53bd0c]
mov byte [ebp - 0x510], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x50f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, 0x53bd10
lea edi, [ebp - 0x410]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3a
xor eax, eax
lea edi, [ebp - 0x3f5]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 7
mov esi, str.pchealthUploadLBBinaries
lea edi, [ebp - 0x30c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3a
xor eax, eax
lea edi, [ebp - 0x2f0]
rep stosd dword es:[edi], eax
mov ax, word [0x53bd48]
mov word [ebp - 0x208], ax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x1860]
mov dword [ebp - 0x1864], ecx
mov edx, dword [ebp - 0x1864]
movsx eax, byte [edx]
cmp eax, 0x30
jne 0x4883af
jmp 0x488406
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1864]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x53bd4c
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403f50
add esp, 0x18
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4883ec
mov eax, 1
jmp 0x488408
mov eax, dword [ebp - 0x1864]
add eax, 0x104
mov dword [ebp - 0x1864], eax
mov ecx, 1
test ecx, ecx
jne 0x48839f
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret