Function at 0x46bfb0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], eax
mov word [ebx], cx
test edi, edi
jne 0x46c165
test byte [eax + 0x28], 0x20
je 0x46c152
mov edx, dword [0x4e6028]
xor eax, eax
test edx, edx
je 0x46c152
mov edi, dword [0x4e6024]
mov esi, dword [ebp + 0xc]
lea ecx, [edi + 0x24]
mov edi, edi
cmp dword [ecx], esi
je 0x46c02f
inc eax
add ecx, 0x2c
cmp eax, edx
jb 0x46c010
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
imul eax, eax, 0x2c
push 5
push dword [eax + edi]
push dword [0x4ea204]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebx, eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push ebx
call edi
mov esi, dword [ebp - 0x210]
push esi
call fcn.0048fb2f
add esp, 4
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x210]
push ecx
push esi
push eax
push ebx
call edi
mov ebx, dword [ebp - 0x21c]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x46c149
mov esi, dword [ebp - 0x214]
cmp dword [esi + 0x320], 0
jne 0x46c0a9
push eax
call fcn.0048faa4
add esp, 4
mov dword [esi + 0x320], eax
push 0x4b00cc
push dword [ebx + 0xc]
call fcn.004913b3
add esp, 8
test eax, eax
je 0x46c0ca
cmp word [eax + 8], 0
je 0x46c0ca
xor ecx, ecx
mov word [eax + 8], cx
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x22
jne 0x46c0d9
add eax, 2
mov dword [ebx + 0xc], eax
push dword [ebx + 0xc]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp - 0x218]
push edi
push esi
call fcn.004911bd
push ebx
call fcn.0048faf7
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
push esi
call ebx
cmp eax, 0xffffffff
jne 0x46c1f5
cmp word [esi], 0x22
je 0x46c12c
push 0x20
push esi
call fcn.0049110f
add esp, 8
test eax, eax
je 0x46c12c
push 0x20
push esi
call fcn.0049110f
add esp, 8
xor ecx, ecx
mov word [eax], cx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x46c1f5
push 0x4b00cc
push edi
push esi
call fcn.00493457
jmp 0x46c1f2
push ebx
call fcn.0048faf7
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
push esi
push ebx
push edi
call fcn.00468430
add esp, 0xc
test al, al
jne 0x46c185
push esi
push ebx
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x46c152
push 0xc
push 0x4bc9cc
push ebx
call fcn.004917b4
add esp, 0xc
test eax, eax
jne 0x46c1d3
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp - 0x20c]
push 0x4c0608
push eax
call fcn.00426350
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 4
push 0x4b0030
push ebx
call fcn.00491219
add esp, 0xc
test eax, eax
jne 0x46c1f5
lea eax, [ebx + 8]
push eax
push esi
push ebx
call fcn.004911bd
add esp, 0xc
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret