Function at 0x437ca5
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526192
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2c18
call fcn.004f5710
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c18], ecx
mov dword [ebp - 0x2c28], ecx
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x2c10], eax
mov word [ebp - 0x4a8], ax
mov esi, 0x286
push esi
push ebx
lea eax, [ebp - 0x4a6]
push eax
call fcn.004f28b0
xor eax, eax
mov word [ebp - 0x730], ax
push esi
push ebx
lea eax, [ebp - 0x72e]
push eax
call fcn.004f28b0
add esp, 0x18
push 0x104
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 6
pop ecx
mov esi, str.kwatch32.sys
lea edi, [ebp - 0x2bc0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push ebx
lea eax, [ebp - 0x2ba6]
push eax
call fcn.004f28b0
push 6
pop ecx
mov esi, str.kwatch64.sys
lea edi, [ebp - 0x29b8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push ebx
lea eax, [ebp - 0x299e]
push eax
call fcn.004f28b0
push 6
pop ecx
mov esi, str.kavapim.sys
lea edi, [ebp - 0x27b0]
rep movsd dword es:[edi], dword [esi]
push 0x1f0
push ebx
lea eax, [ebp - 0x2798]
push eax
call fcn.004f28b0
push 5
pop ecx
mov esi, str.kavpm.sys
lea edi, [ebp - 0x25a8]
rep movsd dword es:[edi], dword [esi]
push 0x1f4
push ebx
lea eax, [ebp - 0x2594]
push eax
call fcn.004f28b0
push 5
pop ecx
mov esi, str.kavuty.sys
lea edi, [ebp - 0x23a0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f2
push ebx
lea eax, [ebp - 0x238a]
push eax
call fcn.004f28b0
push 5
pop ecx
mov esi, str.kavfm.sys
lea edi, [ebp - 0x2198]
rep movsd dword es:[edi], dword [esi]
push 0x1f4
push ebx
lea eax, [ebp - 0x2184]
push eax
call fcn.004f28b0
add esp, 0x48
push 5
pop ecx
mov esi, str.ksdef.sys
lea edi, [ebp - 0x1f90]
rep movsd dword es:[edi], dword [esi]
push 0x1f4
push ebx
lea eax, [ebp - 0x1f7c]
push eax
call fcn.004f28b0
push 7
pop ecx
mov esi, str.kdekernel.sys
lea edi, [ebp - 0x1d88]
rep movsd dword es:[edi], dword [esi]
push 0x1ec
push ebx
lea eax, [ebp - 0x1d6c]
push eax
call fcn.004f28b0
mov esi, str.bc.sys
lea edi, [ebp - 0x1b80]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1fa
push ebx
lea eax, [ebp - 0x1b72]
push eax
call fcn.004f28b0
push 6
pop ecx
mov esi, str.bootsafe.sys
lea edi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push ebx
lea eax, [ebp - 0x195e]
push eax
call fcn.004f28b0
push 6
pop ecx
mov esi, str.kavbootc.sys
lea edi, [ebp - 0x1770]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push ebx
lea eax, [ebp - 0x1756]
push eax
call fcn.004f28b0
push 7
pop ecx
mov esi, str.kavbootc64.sys
lea edi, [ebp - 0x1568]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ea
push ebx
lea eax, [ebp - 0x154a]
push eax
call fcn.004f28b0
add esp, 0x48
push 6
pop ecx
mov esi, str.kavsafe.sys
lea edi, [ebp - 0x1360]
rep movsd dword es:[edi], dword [esi]
push 0x1f0
push ebx
lea eax, [ebp - 0x1348]
push eax
call fcn.004f28b0
push 6
pop ecx
mov esi, str.kdhacker.sys
lea edi, [ebp - 0x1158]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push ebx
lea eax, [ebp - 0x113e]
push eax
call fcn.004f28b0
push 7
pop ecx
mov esi, str.kdhacker64.sys
lea edi, [ebp - 0xf50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ea
push ebx
lea eax, [ebp - 0xf32]
push eax
call fcn.004f28b0
push 5
pop ecx
mov esi, str.kisknl.sys
lea edi, [ebp - 0xd48]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f2
push ebx
lea eax, [ebp - 0xd32]
push eax
call fcn.004f28b0
push 6
pop ecx
mov esi, str.kisknl64.sys
lea edi, [ebp - 0xb40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push ebx
lea eax, [ebp - 0xb26]
push eax
call fcn.004f28b0
push 5
pop ecx
mov esi, str.ksapi.sys
lea edi, [ebp - 0x938]
rep movsd dword es:[edi], dword [esi]
push 0x1f4
push ebx
lea eax, [ebp - 0x924]
push eax
call fcn.004f28b0
add esp, 0x48
mov esi, ebx
mov dword [ebp - 0x2c20], ebx
cmp esi, 0x12
jae 0x4381ea
mov edi, 0x104
push edi
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.004f8528
add esp, 0xc
imul eax, esi, 0x208
lea eax, [ebp + eax - 0x2bc0]
push eax
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4381de
test al, 0x10
jne 0x4381de
mov dword [ebp - 0x2c14], ebx
mov dword [ebp - 0x2c24], ebx
mov dword [ebp - 0x2c0c], ebx
mov dword [ebp - 0x2c1c], ebx
lea eax, [ebp - 0x2c1c]
push eax
lea eax, [ebp - 0x2c0c]
push eax
lea eax, [ebp - 0x2c24]
push eax
lea edx, [ebp - 0x2c14]
lea ecx, [ebp - 0x4a8]
call fcn.0043732e
add esp, 0xc
cmp eax, 1
jne 0x4381de
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c08]
call fcn.0043820c
mov byte [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push ebx
lea eax, [ebp - 0x21e]
push eax
call fcn.004f28b0
mov ecx, dword [ebp - 0x2c24]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x2c14]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
push edi
lea eax, [ebp - 0x220]
push eax
call fcn.004f8b54
add esp, 0x28
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x2bf0]
call fcn.00417390
mov ecx, dword [ebp - 0x2c1c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x2c0c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
push edi
lea eax, [ebp - 0x220]
push eax
call fcn.004f8b54
add esp, 0x1c
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x2bd8]
call fcn.00417390
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x2c08]
call fcn.00417390
mov edi, dword [ebp - 0x2c18]
mov eax, dword [edi]
mov dword [ebp - 0x2c0c], eax
lea ecx, [ebp - 0x2c08]
push ecx
push dword [eax + 4]
push eax
call fcn.0043ae8f
mov ecx, eax
mov edx, dword [edi + 4]
mov eax, 0x3333332
sub eax, edx
cmp eax, 1
jae 0x438178
push str.list_T__too_long
call fcn.004f03bc
lea eax, [edx + 1]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x2c0c]
mov dword [eax + 4], ecx
mov eax, dword [ecx + 4]
mov dword [eax], ecx
mov dword [ebp - 0x2c10], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2bd8]
call fcn.00417360
lea ecx, [ebp - 0x2bf0]
call fcn.00417360
lea ecx, [ebp - 0x2c08]
call fcn.00417360
or dword [ebp - 4], 0xffffffff
jmp 0x4381de
inc esi
mov dword [ebp - 0x2c20], esi
jmp 0x437fd2
mov eax, dword [ebp - 0x2c10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret