Function at 0x406498
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Get file size
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc64
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [0x46221c], 0xa
jne 0x4064bd
jmp 0x406895
cmp dword [0x45e064], 0
jne 0x4064e9
cmp dword [0x45e03c], 0
je 0x4064e4
push str._r_nNO_POWERSHELL__ABORTING_FETCH_LWAUPD
call fcn.00452380
add esp, 4
jmp 0x406895
lea eax, [ebp - 0xc58]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
push 0x200
lea eax, [ebp - 0xc58]
push eax
push str.PSModulePath
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
mov al, byte [ebp - 0xc58]
test eax, eax
jne 0x406552
mov dword [0x45e064], 0
cmp dword [0x45e03c], 0
je 0x40654d
push str._r_nNo_Ps_LWAUPD_Version_Fetch__PS_Not_Installed
call fcn.00452380
add esp, 4
jmp 0x406895
cmp dword [0x45e03c], 0
je 0x406577
push 0
call fcn.00452990
add esp, 4
push eax
push str._n_rStart_PS_LWAUPD_Version_Fetch..._X
call fcn.00452380
add esp, 8
lea eax, [ebp - 0xc58]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0xa58], eax
dec dword [ebp - 0xa58]
mov eax, 0x460f30
mov ecx, 0x460f34
mov edx, dword [ebp - 0xa58]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sLWAUPD.EXE
push 0x2bc
lea eax, [ebp - 0xa54]
push eax
call fcn.00452660
add esp, 0x14
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x798], 0
lea eax, [ebp - 0x798]
push eax
call fcn.00406090
add esp, 4
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0x798]
push eax
push str._spowershell__command___new_object_System.Net.WebClient_.DownloadFile_http:__www.softwaremetering.com_outgoing_LWAUPD.EXE__s__
push 0x384
lea eax, [ebp - 0x58c]
push eax
call fcn.00452660
add esp, 0x14
push str.Initiating_LWAUPD_FETCH
call fcn.004097a0
add esp, 4
push 0
lea eax, [ebp - 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x208], 0
cmp dword [0x4622c8], 0
jne 0x406864
cmp dword [ebp - 0x208], 0x208
jge 0x406864
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x208]
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40685f
mov dword [ebp - 0x590], 0
cmp dword [0x4622c8], 0
jne 0x4066e2
cmp dword [ebp - 0x590], 0xa
jge 0x4066e2
inc dword [ebp - 0x590]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4066b2
cmp dword [0x4622c8], 0
jne 0x40685f
push 0
push 0x80
push 3
push 0
push 0
push bind
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc60], eax
cmp dword [ebp - 0xc60], 0xffffffff
je 0x40685f
push 0
mov eax, dword [ebp - 0xc60]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45e03c], 0
je 0x40676b
lea eax, [ebp - 0xa54]
push eax
mov eax, dword [ebp - 0xc5c]
push eax
push str._r_nFETCHED___d____s_
call fcn.00452380
add esp, 0xc
push str.Successfully_Fetched_LWAUPD.EXE
call fcn.004097a0
add esp, 4
push 0
call fcn.00405922
add esp, 4
cmp eax, 0x333
jne 0x4067ef
lea eax, [ebp - 0xa54]
push eax
call fcn.00405ead
add esp, 4
mov dword [ebp - 0xc64], eax
cmp dword [ebp - 0xc64], 0
jne 0x4067bb
mov dword [ebp - 4], 2
jmp 0x4067ea
mov eax, dword [ebp - 0xc64]
push eax
push str.LWAUPD_BUILD__08X_SUCCESSFULLY_DOWNLOADED
push 0x200
lea eax, [ebp - 0x798]
push eax
call fcn.00452660
add esp, 0x10
lea eax, [ebp - 0x798]
push eax
call fcn.004097a0
add esp, 4
jmp 0x4067f6
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x40685a
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
push eax
push str.LWAUPD_FETCH_DID_NOT_VERIFY__d_
push 0x200
lea eax, [ebp - 0x798]
push eax
call fcn.00452660
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x40684b
lea eax, [ebp - 0x798]
push eax
push 0x461064
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x798]
push eax
call fcn.004097a0
add esp, 4
jmp 0x406895
jmp 0x406664
cmp dword [0x45e03c], 0
je 0x40687e
push str._r_nFETCH_LWAUPD.EXE_FAILED
call fcn.00452380
add esp, 4
push str.LWAUPD_FETCH_FAILED__FILE_NOT_RECEIVED
call fcn.004097a0
add esp, 4
mov dword [0x45e048], 0
pop edi
pop esi
pop ebx
leave
ret