Function at 0x45a178
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push 0x34c
mov eax, 0x4b4dae
call fcn.00473acf
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
mov dword [ebp - 0x308], ecx
call esi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x33c]
call fcn.0042d1df
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2f0], esp
push str.rmup.exe
call fcn.00418464
mov byte [ebp - 4], 2
push ecx
mov eax, esp
mov dword [ebp - 0x2f8], esp
push eax
lea ecx, [ebp - 0x340]
call fcn.004330a8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x310]
push eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x340]
call fcn.004330ec
mov byte [ebp - 4], 4
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
mov dword [ebp - 0x2f0], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.00421125
pop ecx
cmp al, bl
jmp 0x45a231
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x45a23d
push 0x64
call esi
push dword [ebp - 0x310]
call edi
test eax, eax
je 0x45a239
lea ecx, [ebp - 0x358]
call fcn.0042d1df
mov byte [ebp - 4], 6
xor edi, edi
inc edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x2f0], esp
push 0x4c63c0
mov byte [ebp - 0x2e9], 1
call fcn.00418464
mov byte [ebp - 4], 7
push SysReAllocStringLen
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x358]
call fcn.00431d68
cmp eax, ebx
je 0x45a55d
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x2f0], esp
push str.UpdateInterval
call fcn.00418464
mov byte [ebp - 4], 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x358]
call fcn.0042d3b0
mov dword [ebp - 0x2f0], eax
cmp eax, ebx
jl 0x45a2cc
cmp eax, 3
jle 0x45a2d2
mov dword [ebp - 0x2f0], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x2f8], esp
push 0x4c2d20
call fcn.00418464
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x304], esp
push str.LastCheckUpdateTime
call fcn.00418464
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x2f4]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x358]
call fcn.00432ae1
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2f4]
cmp dword [eax - 0xc], ebx
je 0x45a54b
push eax
call fcn.00477c9e
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f4]
pop ecx
cmp dword [eax - 4], edi
jle 0x45a355
push dword [eax - 0xc]
lea ecx, [ebp - 0x2f4]
call fcn.0040a631
mov eax, dword [ebp - 0x2f4]
add eax, 0xa
push eax
call fcn.00477c9e
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x2f4]
pop ecx
cmp dword [eax - 4], edi
jle 0x45a384
push dword [eax - 0xc]
lea ecx, [ebp - 0x2f4]
call fcn.0040a631
mov eax, dword [ebp - 0x2f4]
add eax, 0x10
push eax
call fcn.00477c9e
push ebx
mov dword [ebp - 0x304], eax
call fcn.00477234
pop ecx
pop ecx
mov dword [ebp - 0x300], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x2fc], edx
call fcn.00425b36
cmp eax, ebx
je 0x45a3bf
mov esi, dword [eax + 0xc]
jmp 0x45a3c1
xor esi, esi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x300]
call fcn.00425b36
cmp eax, ebx
je 0x45a3da
mov eax, dword [eax + 0x10]
inc eax
jmp 0x45a3dc
xor eax, eax
push 0xffffffffffffffff
push ebx
push ebx
push ebx
push esi
push eax
lea ecx, [ebp - 0x300]
call fcn.00425b8b
push eax
lea ecx, [ebp - 0x324]
call fcn.00425971
mov ecx, dword [eax]
mov dword [ebp - 0x300], ecx
mov eax, dword [eax + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2fc], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x70
call fcn.00477555
mov edi, edx
mov esi, eax
and eax, edi
pop ecx
cmp eax, 0xffffffff
jne 0x45a444
push 0x80070057
call fcn.0040987d
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffff894
cmp eax, 0x44c
ja 0x45a4c8
mov ecx, dword [ebp - 0x30c]
lea eax, [ecx - 1]
cmp eax, 0xb
ja 0x45a4c8
mov eax, dword [ebp - 0x304]
lea edx, [eax - 1]
cmp edx, 0x1e
ja 0x45a4c8
push dword [ebp - 0x2fc]
push dword [ebp - 0x300]
push 0xffffffffffffffff
push ebx
push ebx
push ebx
push eax
push ecx
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x324]
call fcn.00425971
mov ecx, eax
call fcn.00439699
test al, al
je 0x45a4c8
push 0xffffffffffffffff
push ebx
push ebx
push ebx
push dword [ebp - 0x304]
lea ecx, [ebp - 0x324]
push dword [ebp - 0x30c]
push dword [ebp - 0x2f8]
call fcn.00425971
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x2f0]
dec eax
mov byte [ebp - 0x2e9], bl
je 0x45a533
dec eax
je 0x45a509
dec eax
jne 0x45a544
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x2fc]
push ebx
sub eax, esi
push 0xe10
sbb ecx, edi
push ecx
push eax
call fcn.004787a0
cmp edx, ebx
jl 0x45a54b
jg 0x45a544
cmp eax, 0x2d0
jb 0x45a54b
jmp 0x45a544
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x2fc]
push ebx
sub eax, esi
push 0xe10
sbb ecx, edi
push ecx
push eax
call fcn.004787a0
cmp edx, ebx
jl 0x45a54b
jg 0x45a544
cmp eax, 0xa8
jmp 0x45a505
push edi
push esi
lea ecx, [ebp - 0x300]
call fcn.00425b17
test al, al
je 0x45a54b
mov byte [ebp - 0x2e9], 1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2f4]
add ecx, 0xfffffff0
call fcn.00409a10
push dword [ebp - 0x310]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45ac8d
call fcn.004342da
cmp eax, 0x13
jl 0x45a7c4
lea ecx, [ebp - 0x38]
call fcn.0042d1df
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x2f0], esp
mov edi, str.SYSTEMCurrentControlSet_servicesSharedAccessParametersFirewallPolicyFirewallRules
push edi
call fcn.00418464
mov byte [ebp - 4], 0xe
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x38]
call fcn.004501f4
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x2f0], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0xf
push esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x38]
call fcn.00431d68
cmp eax, ebx
je 0x45a7b8
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x38]
call fcn.00450053
xor edi, edi
cmp dword [ebp - 0x318], ebx
jle 0x45a7a9
push ecx
mov ecx, esp
mov dword [ebp - 0x320], esp
push 0x4c2d20
call fcn.00418464
mov byte [ebp - 4], 0x11
cmp edi, ebx
jl 0x45a7d9
cmp edi, dword [ebp - 0x318]
jge 0x45a7d9
mov eax, dword [ebp - 0x31c]
push ecx
lea eax, [eax + edi*4]
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x30c]
push eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x38]
call fcn.00432ae1
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x30c]
call fcn.0044375a
push ebx
push 0x4c9268
lea ecx, [ebp - 0x30c]
call fcn.0042b1b5
mov esi, eax
add esi, 4
js 0x45a78a
push esi
push 0x4c9264
lea ecx, [ebp - 0x30c]
call fcn.0042b1b5
cmp eax, esi
jle 0x45a78a
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x30c]
call fcn.0042b3e2
mov byte [ebp - 4], 0x14
push ecx
lea eax, [ebp - 0x2f8]
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x2f0]
push eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x340]
call fcn.0044aba1
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x2f8]
call fcn.0040aac8
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x2f0]
add ecx, 0xfffffff0
call fcn.00409a10
push dword [ebp - 0x310]
lea ecx, [ebp - 0x2f8]
call fcn.004286e1
test eax, eax
jne 0x45a778
push ebx
push str.actionblock
lea ecx, [ebp - 0x30c]
call fcn.0042b1b5
test eax, eax
js 0x45a778
cmp edi, dword [ebp - 0x318]
jge 0x45a7d9
mov eax, dword [ebp - 0x31c]
push ecx
lea eax, [eax + edi*4]
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x38]
call fcn.0042d2a2
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x2f8]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x30c]
add ecx, 0xfffffff0
call fcn.00409a10
inc edi
cmp edi, dword [ebp - 0x318]
jl 0x45a611
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x31c]
call fcn.0042ecc3
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x38]
call fcn.0042d237
mov eax, dword [ebp - 0x308]
mov eax, dword [eax]
cmp byte [ebp - 0x2e9], bl
jmp 0x45a7e8
push ebx
push ebx
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 1
push ebx
push 0x802
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.winguard.dll
lea ecx, [ebp - 0x20]
call fcn.00418464
mov byte [ebp - 4], 0x1b
push str.winguard.exe
lea ecx, [ebp - 0x1c]
call fcn.00418464
mov byte [ebp - 4], 0x1c
push str.winguard_x64.dll
lea ecx, [ebp - 0x18]
call fcn.00418464
mov byte [ebp - 4], 0x1d
push str.winguard_x64.exe
lea ecx, [ebp - 0x14]
call fcn.00418464
mov byte [ebp - 4], 0x1e
push 4
mov dword [ebp - 0x308], ebx
lea esi, [ebp - 0x20]
pop edi
push ecx
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push esi
call fcn.0040a8a7
mov byte [ebp - 4], 0x1f
push ecx
mov eax, esp
mov dword [ebp - 0x320], esp
push eax
lea ecx, [ebp - 0x340]
call fcn.004330a8
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2f0]
push eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x340]
call fcn.004330ec
mov byte [ebp - 4], 0x21
push ecx
lea eax, [ebp - 0x2f0]
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x21
call fcn.00421125
pop ecx
cmp al, bl
jne 0x45a8cb
mov dword [ebp - 0x308], 1
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x2f0]
add ecx, 0xfffffff0
call fcn.00409a10
add esi, 4
dec edi
jne 0x45a854
cmp dword [ebp - 0x308], ebx
jmp 0x45a946
push ecx
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push str.pcmastersvc.exe
call fcn.00418464
mov byte [ebp - 4], 0x27
push ecx
mov eax, esp
mov dword [ebp - 0x320], esp
push eax
lea ecx, [ebp - 0x340]
call fcn.004330a8
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x304]
push eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x340]
call fcn.004330ec
mov byte [ebp - 4], 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push str.pcmasterpcmastersvc.exe
call fcn.00418464
mov byte [ebp - 4], 0x2a
push ecx
mov eax, esp
mov dword [ebp - 0x320], esp
push eax
lea ecx, [ebp - 0x340]
call fcn.0045046d
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x2f4]
push eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x340]
call fcn.004330ec
mov byte [ebp - 4], 0x2c
push ecx
lea eax, [ebp - 0x2f4]
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x2c
call fcn.00421125
lea eax, [ebp - 0x304]
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2c
call fcn.00421125
pop ecx
mov edi, 0x7d0
cmp al, bl
jmp 0x45aa99
call fcn.004342da
cmp eax, 0x13
jmp 0x45ac53
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x2f4]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x304]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 6
push 0x40a82a
push 4
push 4
lea eax, [ebp - 0x20]
push eax
call fcn.004756df
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x358]
call fcn.0042d237
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x310]
add ecx, 0xfffffff0
call fcn.00409a10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.0042d237
call fcn.00473b52
ret