Function at 0x413be0
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7e89
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2b8
mov eax, dword [0x6540c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x2bc], 0
call fcn.00414ad0
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x280]
call fcn.00405630
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x224]
cmp ecx, 7
jbe 0x413c98
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413c8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414952
push ecx
push edx
call fcn.00439938
add esp, 8
xor eax, eax
mov dword [ebp - 0x228], 0
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 0x224], 7
call fcn.00414d60
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2b0]
call fcn.00405630
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x254]
cmp ecx, 7
jbe 0x413d16
mov edx, dword [ebp - 0x268]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413d0c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414957
push ecx
push edx
call fcn.00439938
add esp, 8
lea edx, [ebp - 0x280]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x238]
call fcn.00405200
cmp dword [ebp - 0x228], 0
mov edx, 0x5c
mov dword [ebp - 0x2bc], 0x10
jbe 0x413d70
cmp dword [ebp - 0x26c], 7
lea ecx, [ebp - 0x280]
mov eax, dword [ebp - 0x270]
cmova ecx, dword [ebp - 0x280]
cmp dx, word [ecx + eax*2 - 2]
je 0x413d70
push edx
lea ecx, [ebp - 0x238]
call fcn.00409fa0
push 6
push str.TM.exe
lea ecx, [ebp - 0x238]
call fcn.0040a240
mov dword [ebp - 0x288], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x284], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x298], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x288], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x224]
cmp ecx, 7
jbe 0x413e0e
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413e04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41495c
push ecx
push edx
call fcn.00439938
add esp, 8
mov edx, dword [ebp - 0x270]
lea ecx, [ebp - 0x2b0]
xor eax, eax
mov dword [ebp - 0x228], 0
cmp dword [ebp - 0x29c], 7
lea edi, [ebp - 0x280]
mov dword [ebp - 0x224], 7
cmova ecx, dword [ebp - 0x2b0]
cmp dword [ebp - 0x26c], 7
mov word [ebp - 0x238], ax
cmova edi, dword [ebp - 0x280]
cmp edx, dword [ebp - 0x2a0]
jne 0x414012
test edx, edx
je 0x413e85
sub edi, ecx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x414012
add ecx, 2
sub edx, 1
jne 0x413e70
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x240], 0
push 0x646054
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x250], xmm0
call fcn.00402780
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x238]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
push str.TMJiaSu
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x224], 0
call fcn.00402780
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x2bc], 0x22
call fcn.00406320
test al, al
je 0x413f1c
cmp dword [ebp - 0x240], 0
mov byte [ebp - 0x2b1], 1
jne 0x413f23
mov byte [ebp - 0x2b1], 0
mov dword [ebp - 4], 9
mov edi, 0x20
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x2bc], edi
cmp ecx, 7
jbe 0x413f75
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413f6b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
cmp byte [ebp - 0x2b1], 0
je 0x414620
lea edx, [ebp - 0x250]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x268]
call fcn.00405200
mov edi, dword [ebp - 0x258]
mov dword [ebp - 0x2bc], 0xa0
test edi, edi
je 0x414315
cmp dword [ebp - 0x23c], 7
lea ecx, [ebp - 0x250]
mov eax, dword [ebp - 0x240]
mov edx, 0x5c
cmova ecx, dword [ebp - 0x250]
cmp dx, word [ecx + eax*2 - 2]
je 0x414315
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x2c4], edx
cmp edi, edx
jae 0x4141ff
lea eax, [edi + 1]
cmp edx, 7
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x268]
cmova eax, dword [ebp - 0x268]
mov dword [eax + edi*2], 0x5c
jmp 0x414315
cmp dword [ebp - 0x284], 7
lea eax, [ebp - 0x298]
cmova eax, dword [ebp - 0x298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413e85
cmp dword [ebp - 0x26c], 7
lea eax, [ebp - 0x280]
mov edi, dword [ebp - 0x270]
xorps xmm0, xmm0
cmova eax, dword [ebp - 0x280]
mov dword [ebp - 0x2c0], eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp edi, 0x7ffffffe
ja 0x414961
cmp edi, 7
ja 0x41408c
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
jmp 0x4140e3
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x41409f
mov eax, bind
jmp 0x4140a9
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x2b8]
push eax
push esi
call fcn.00402980
mov ecx, eax
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x14], eax
lea eax, [edi*2 + 2]
push eax
push dword [ebp - 0x2c0]
mov dword [esi], ecx
push ecx
call fcn.0048fd10
add esp, 0x14
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x414123
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414119
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x29c]
xor eax, eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
cmp ecx, 7
jbe 0x414180
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414176
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x26c]
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
cmp ecx, 7
jbe 0x4141dd
mov edx, dword [ebp - 0x280]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4141d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004398fa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, bind
sub eax, edi
cmp eax, 1
jb 0x414966
lea ecx, [edi + 1]
or ecx, 7
cmp ecx, 0x7ffffffe
jbe 0x414224
mov ecx, bind
jmp 0x414251
mov eax, edx
shr eax, 1
mov dword [ebp - 0x2b8], eax
mov eax, bind
sub eax, dword [ebp - 0x2b8]
cmp edx, eax
jbe 0x414244
mov ecx, bind
jmp 0x414251
mov eax, dword [ebp - 0x2b8]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], ecx
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00402980
mov ecx, eax
add esp, 8
cmp dword [ebp - 0x2c4], 7
lea eax, [edi + 1]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x254], eax
lea eax, [edi + edi]
lea edi, [ecx + eax]
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2b8], edi
push eax
jbe 0x4142f3
mov edi, dword [ebp - 0x268]
push edi
push ecx
call fcn.0048fd10
mov eax, dword [ebp - 0x2b8]
add esp, 0xc
mov dword [eax], 0x5c
mov eax, dword [ebp - 0x2c4]
lea ecx, [eax*2 + 2]
cmp ecx, 0x1000
jb 0x4142e7
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x41496b
mov edi, edx
push ecx
push edi
call fcn.00439938
add esp, 8
jmp 0x414309
lea eax, [ebp - 0x268]
push eax
push ecx
call fcn.0048fd10
add esp, 0xc
mov dword [edi], 0x5c
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x268], eax
push 6
push str.TM.exe
lea ecx, [ebp - 0x268]
call fcn.0040a240
mov dword [ebp - 0x228], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x224], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
mov edi, 0x60
mov dword [ebp - 0x2bc], edi
movups xmmword [ebp - 0x238], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x228], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x254]
cmp ecx, 7
jbe 0x4143be
mov edx, dword [ebp - 0x268]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4143b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41496b
push ecx
push edx
call fcn.00439938
add esp, 8
cmp dword [ebp - 0x224], 7
lea eax, [ebp - 0x238]
cmova eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4145e0
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, 7
movups xmm0, xmmword [ebp - 0x250]
mov dword [esi + 0x14], 0
mov word [ebp - 0x250], cx
mov ecx, dword [ebp - 0x224]
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x240]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], eax
cmp ecx, eax
jbe 0x41446f
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41445f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414970
push ecx
push edx
call fcn.00439938
mov eax, dword [ebp - 0x23c]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], cx
cmp eax, 7
jbe 0x4144c6
mov edx, dword [ebp - 0x250]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4144bc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414970
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x284]
xor eax, eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
cmp ecx, 7
jbe 0x414523
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414519
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414970
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x29c]
xor eax, eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
cmp ecx, 7
jbe 0x414580
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414576
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414970
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x26c]
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
cmp ecx, 7
jbe 0x4141dd
mov edx, dword [ebp - 0x280]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4141d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414970
jmp 0x4141d3
mov ecx, dword [ebp - 0x224]
cmp ecx, 7
jbe 0x414620
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414616
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414970
push ecx
push edx
call fcn.00439938
add esp, 8
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00490360
add esp, 0xc
lea eax, [ebp - 0x220]
push 0
push 0x2a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41468e
push eax
push 0x26
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41468e
cmp dword [ebp - 0x26c], 7
lea eax, [ebp - 0x280]
push dword [ebp - 0x270]
cmova eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x250]
push eax
call fcn.00403f00
jmp 0x414735
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], 0
movups xmmword [ebp - 0x238], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4146b5
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00402780
mov ecx, dword [ebp - 0x23c]
cmp ecx, 7
jbe 0x414717
mov edx, dword [ebp - 0x250]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41470d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
movups xmm0, xmmword [ebp - 0x238]
movups xmmword [ebp - 0x250], xmm0
movq xmm0, qword [ebp - 0x228]
movq qword [ebp - 0x240], xmm0
push 0xb
push str.TMPlatform
lea ecx, [ebp - 0x250]
call fcn.0040a240
cmp dword [ebp - 0x23c], 7
lea eax, [ebp - 0x250]
cmova eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414811
lea edx, [ebp - 0x250]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x268]
call fcn.00405200
or edi, 0x100
cmp dword [ebp - 0x258], 0
mov dword [ebp - 0x2bc], edi
jbe 0x4147c6
cmp dword [ebp - 0x23c], 7
lea ecx, [ebp - 0x250]
mov eax, dword [ebp - 0x240]
mov edx, 0x5c
cmova ecx, dword [ebp - 0x250]
cmp dx, word [ecx + eax*2 - 2]
je 0x4147c6
push edx
lea ecx, [ebp - 0x268]
call fcn.00409fa0
lea ecx, [ebp - 0x268]
call fcn.00404f90
mov ecx, dword [ebp - 0x254]
cmp ecx, 7
jbe 0x414811
mov edx, dword [ebp - 0x268]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414807
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414975
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x284]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ebp - 0x250]
mov word [ebp - 0x250], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x240]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
cmp ecx, 7
jbe 0x414899
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41488f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x29c]
xor eax, eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
cmp ecx, 7
jbe 0x4148f2
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4148e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41494d
push ecx
push edx
call fcn.00439938
add esp, 8
mov ecx, dword [ebp - 0x26c]
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
cmp ecx, 7
jbe 0x4141dd
mov edx, dword [ebp - 0x280]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4141d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4141d3
call fcn.00494baa
call fcn.00494baa
call fcn.00494baa
call fcn.00494baa
call fcn.004012e0
call fcn.004012e0
call fcn.00494baa
call fcn.00494baa
call fcn.00494baa
int3