Function at 0x4317d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6578
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xb4]
push eax
call fcn.0041d3b0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xb4]
push ecx
push str.Win32_Process
call fcn.004313e0
add esp, 8
mov byte [ebp - 0x21], al
test al, al
je 0x431c6c
mov dword [ebp - 0x28], ebx
mov edx, dword [ebp - 0xa4]
sub edx, dword [ebp - 0xa8]
sar edx, 2
cmp ebx, edx
jae 0x431c6c
mov byte [ebp - 4], 1
lea eax, [ebp - 0x7c]
push eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
push ecx
call esi
mov byte [ebp - 4], 3
lea edx, [ebp - 0x8c]
push edx
call esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
push eax
call esi
mov byte [ebp - 4], 5
mov edi, ebx
lea esi, [ebp - 0xb4]
call fcn.00467500
mov esi, dword [eax]
lea ecx, [ebp - 0x50]
push ecx
mov edi, 0x6998cc
call fcn.00428f00
mov byte [ebp - 4], 6
or dword [ebp - 0x1c], 1
cmp dword [eax], 0
je 0x4318b3
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x4318b5
xor eax, eax
mov edx, dword [esi]
push 0
push 0
lea ecx, [ebp - 0x7c]
push ecx
push 0
push eax
push esi
mov edx, dword [edx + 0x10]
call edx
test eax, eax
jl 0x4318dd
cmp word [ebp - 0x7c], 8
jne 0x4318dd
cmp dword [ebp - 0x74], 0
mov byte [ebp - 0x15], 1
jne 0x4318e1
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 5
test byte [ebp - 0x1c], 1
je 0x4318fa
and dword [ebp - 0x1c], 0xfffffffe
lea edi, [ebp - 0x50]
call fcn.00428fa0
cmp byte [ebp - 0x15], 0
je 0x431c15
mov edi, ebx
lea esi, [ebp - 0xb4]
call fcn.00467500
mov esi, dword [eax]
lea eax, [ebp - 0x58]
push eax
mov edi, str.CommandLine
call fcn.00428f00
mov byte [ebp - 4], 7
or dword [ebp - 0x1c], 2
cmp dword [eax], 0
je 0x431934
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x431936
xor eax, eax
mov ecx, dword [esi]
push 0
push 0
lea edx, [ebp - 0x9c]
push edx
push 0
push eax
push esi
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jl 0x431967
cmp word [ebp - 0x9c], 8
jne 0x431967
cmp dword [ebp - 0x94], 0
mov byte [ebp - 0x15], 1
jne 0x43196b
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 5
test byte [ebp - 0x1c], 2
je 0x431984
and dword [ebp - 0x1c], 0xfffffffd
lea edi, [ebp - 0x58]
call fcn.00428fa0
cmp byte [ebp - 0x15], 0
je 0x431c15
mov edi, ebx
lea esi, [ebp - 0xb4]
call fcn.00467500
mov esi, dword [eax]
lea ecx, [ebp - 0x54]
push ecx
mov edi, str.ExecutablePath
call fcn.00428f00
mov byte [ebp - 4], 8
or dword [ebp - 0x1c], 4
cmp dword [eax], 0
je 0x4319be
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x4319c0
xor eax, eax
mov edx, dword [esi]
push 0
push 0
lea ecx, [ebp - 0x6c]
push ecx
push 0
push eax
push esi
mov edx, dword [edx + 0x10]
call edx
test eax, eax
jl 0x4319e8
cmp word [ebp - 0x6c], 8
jne 0x4319e8
cmp dword [ebp - 0x64], 0
mov byte [ebp - 0x15], 1
jne 0x4319ec
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 5
test byte [ebp - 0x1c], 4
je 0x431a05
and dword [ebp - 0x1c], 0xfffffffb
lea edi, [ebp - 0x54]
call fcn.00428fa0
cmp byte [ebp - 0x15], 0
je 0x431c15
mov edi, ebx
lea esi, [ebp - 0xb4]
call fcn.00467500
mov esi, dword [eax]
lea eax, [ebp - 0x5c]
push eax
mov edi, str.ProcessId
call fcn.00428f00
mov byte [ebp - 4], 9
cmp dword [eax], 0
je 0x431a3b
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x431a3d
xor eax, eax
mov ecx, dword [esi]
push 0
push 0
lea edx, [ebp - 0x8c]
push edx
push 0
push eax
push esi
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
setge bl
mov byte [ebp - 4], 5
lea edi, [ebp - 0x5c]
call fcn.00428fa0
test bl, bl
je 0x431c12
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00431ca0
mov bl, 0xa
mov byte [ebp - 4], bl
mov edx, dword [ebp - 0x74]
lea edi, [ebp - 0x38]
call fcn.0040b9c0
cmp word [ebp - 0x8c], 0x13
jne 0x431a9b
movzx edx, word [ebp - 0x84]
mov dword [ebp - 0x3c], edx
jmp 0x431aa4
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x64]
lea edi, [ebp - 0x2c]
call fcn.0040b9c0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00432250
add esp, 4
mov byte [ebp - 4], 0xb
lea edi, [ebp - 0x30]
call fcn.0040daa0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.0040b950
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x94]
call fcn.0040b8a0
mov byte [ebp - 4], 0xc
lea edi, [ebp - 0x20]
call fcn.0040bc80
lea eax, [ebp - 0x44]
push eax
call fcn.0040b7e0
mov bl, 0xd
mov byte [ebp - 4], bl
xor ecx, ecx
mov edx, str..exe_
mov esi, edi
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x431b26
xor ecx, ecx
mov edx, str..exe
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x431ba7
mov ecx, eax
mov edx, 0x699688
lea esi, [ebp - 0x20]
call fcn.00437bc0
mov edi, eax
cmp edi, 0xffffffff
je 0x431ba7
mov ecx, edi
mov edx, 0x694260
call fcn.00437bc0
lea edx, [edi - 1]
cmp eax, 0xffffffff
jne 0x431b7e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx - 0xc]
lea ecx, [eax - 1]
sub ecx, edi
add ecx, 2
lea eax, [ebp - 0x48]
push eax
mov eax, esi
push eax
call fcn.00437d00
mov byte [ebp - 4], 0xe
lea edi, [ebp - 0x34]
call fcn.0040daa0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
jmp 0x431ba2
mov ecx, eax
sub ecx, edi
inc ecx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00437d00
mov byte [ebp - 4], 0xf
lea edi, [ebp - 0x34]
call fcn.0040daa0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4c]
call fcn.0040b950
push 0x699f28
lea eax, [ebp - 0x34]
call fcn.0041d830
mov ebx, eax
mov eax, 0x699f28
call fcn.0041d890
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x431be1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x431be1
mov edx, 0x692fd0
lea edi, [ebp - 0x34]
call fcn.0040b9c0
lea ecx, [ebp - 0x3c]
push ecx
mov edi, dword [ebp + 8]
call fcn.004387a0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x44]
call fcn.0040b950
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call fcn.0040b950
mov byte [ebp - 4], 5
lea edx, [ebp - 0x3c]
push edx
call fcn.00431d20
mov ebx, dword [ebp - 0x28]
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
push eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
push ecx
call esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x9c]
push edx
call esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x7c]
push eax
call esi
mov dword [ebp - 4], 0
inc ebx
jmp 0x431831
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
push ecx
call fcn.00438a50
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret