Function at 0x116568dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1176aec4
call fcn.116bf8a0
sub esp, 0x444
push ebx
xor ebx, ebx
cmp dword [0x117bd9c4], ebx
je 0x11656902
mov eax, dword [0x117bd9c0]
jmp 0x11656ac5
push esi
push edi
push 1
mov esi, 0x20019
pop eax
mov dword [0x117bd9c4], eax
mov dword [0x117bd9c0], eax
call fcn.116d2a90
test eax, eax
je 0x11656924
mov esi, 0x20219
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call fcn.11694210
push esi
push str.softwareTECOcular.3Agent
push SysStringLen
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.11694380
test eax, eax
je 0x116569a0
push 4
mov esi, str.RunAs
pop edi
lea ecx, [ebp - 0x18]
push edi
push esi
call fcn.11696850
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
call fcn.11694520
movzx eax, al
cmp eax, ebx
jne 0x11656978
mov dword [0x117bd9c0], ebx
jmp 0x11656998
push 2
pop ecx
cmp eax, ecx
jne 0x11656987
mov dword [0x117bd9c0], ecx
jmp 0x11656998
push 3
pop ecx
cmp eax, ecx
je 0x1165697f
cmp eax, edi
jne 0x11656998
mov dword [0x117bd9c0], edi
lea ecx, [ebp - 0x18]
call fcn.116943d0
mov word [ebp - 0x450], bx
mov ebx, 0x81
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x44e]
mov esi, 0x103
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.1165367d
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.116bff74
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0x10], eax
jne 0x11656ade
mov ecx, ebx
lea edi, [ebp - 0x246]
mov word [ebp - 0x248], ax
push str.wrdlv4.exe
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x450]
mov edi, 0x1178f20c
push eax
push edi
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.116c0020
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x11656aad
and dword [ebp - 0x30], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], str.winrdlv3.exe
mov dword [ebp - 0x28], str.ingress_sdm.exe
mov dword [ebp - 0x24], str.ist.exe
mov dword [ebp - 0x20], str.OGuard.exe
mov dword [ebp - 0x1c], str.rundll32.exe
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x34], 4
lea ebx, [ebp - 0x2c]
push dword [ebx]
lea eax, [ebp - 0x450]
push eax
push edi
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.116c0020
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x11656ad2
inc dword [ebp - 0x10]
add ebx, 4
cmp dword [ebp - 0x10], 5
jb 0x11656a75
mov edx, dword [0x117bd9c0]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov esi, edx
call fcn.11694300
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x40]
jmp 0x11656b77
mov edx, dword [0x117bd9c0]
cmp edx, eax
je 0x11656ab3
mov word [ebp - 0x248], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
push edx
stosw word es:[edi], ax
call fcn.11656b82
pop ecx
mov edi, 0x1178f20c
push eax
lea eax, [ebp - 0x450]
push eax
push edi
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.116c0020
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x11656aad
cmp dword [0x117bd9c0], 1
jne 0x11656b75
lea eax, [ebp - 0x450]
push str.winrdlv3.exe
push eax
push edi
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.116c0020
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call ebx
mov edx, eax
inc edx
neg edx
sbb edx, edx
and edx, 5
jmp 0x11656b77
xor edx, edx
mov dword [0x117bd9c0], edx
jmp 0x11656ab3