Function at 0x469400
Capabilities:
Check if file exists
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585cfc
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x70], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b8], 0
call fcn.00414e20
lea ecx, [ebp - 0x2c]
call fcn.004197b0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0046a470
mov dword [ebp - 0x68], 1
movzx eax, byte [0x63a453]
test eax, eax
jne 0x469468
call fcn.00465b00
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
push ecx
push 0x58e8e4
push 1
push 0
push 0x58e9b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jge 0x4694d5
mov edx, dword [ebp - 0x5c]
push edx
push 0x5e5090
push str.CReportSystemInfo::GetRunningProgress
call fcn.0040c050
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00419820
mov ecx, dword [ebp - 0x2b8]
or ecx, 1
mov dword [ebp - 0x2b8], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00406130
mov eax, dword [ebp + 8]
jmp 0x469f88
call fcn.00402270
mov dword [ebp - 0x58], eax
push 0x5e5108
lea ecx, [ebp - 0x244]
call fcn.004144e0
mov dword [ebp - 0x2bc], eax
mov edx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c0], edx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x2c0]
call fcn.004145a0
push eax
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x60]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.00414580
lea ecx, [ebp - 0x54]
call fcn.004195d0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x5c], 0
jl 0x469ec2
mov dword [ebp - 0xfc], 0
call fcn.00402270
mov dword [ebp - 0x104], eax
push 0x5e5120
lea ecx, [ebp - 0x248]
call fcn.00414440
mov dword [ebp - 0x2c4], eax
mov edx, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c8], edx
mov byte [ebp - 4], 4
push 0x5e5158
lea ecx, [ebp - 0x24c]
call fcn.00414440
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xfc]
push ecx
push 0
push 0x10
mov ecx, dword [ebp - 0x2c8]
call fcn.004145a0
push eax
mov ecx, dword [ebp - 0x2d0]
call fcn.004145a0
push eax
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
call edx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
call fcn.00414580
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x248]
call fcn.00414580
mov dword [ebp - 0x100], 0
xor eax, eax
mov word [ebp - 0x18c], ax
push 0x7e
push 0
lea ecx, [ebp - 0x18a]
push ecx
call fcn.00562540
add esp, 0xc
xor edx, edx
mov word [ebp - 0xf4], dx
push 0x7e
push 0
lea eax, [ebp - 0xf2]
push eax
call fcn.00562540
add esp, 0xc
cmp dword [ebp - 0x5c], 0
jl 0x469eac
cmp dword [ebp - 0x68], 0
jbe 0x469eac
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x204]
call fcn.004205e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x100]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xfc]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x469e87
cmp dword [ebp - 0x68], 0
jbe 0x469e87
push 0
push 0
lea ecx, [ebp - 0x234]
push ecx
push 0
push 0x5e515c
mov edx, dword [ebp - 0x100]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x100]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x4697a2
movzx eax, word [ebp - 0x234]
cmp eax, 1
je 0x4697a2
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0xf8], ecx
cmp dword [ebp - 0xf8], 0
jne 0x469719
mov dword [ebp - 0x2d4], 0
jmp 0x469783
mov edx, dword [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3fffffff
jle 0x469741
mov dword [ebp - 0x2d8], 0
jmp 0x469777
mov eax, dword [ebp - 0x6c]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x2dc], esp
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x6c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xf8]
push edx
mov eax, dword [ebp - 0x2dc]
push eax
call fcn.004022d0
mov dword [ebp - 0x2d8], eax
mov ecx, dword [ebp - 0x2d8]
mov dword [ebp - 0x2d4], ecx
mov edx, dword [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x204]
call fcn.00405fb0
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea ecx, [ebp - 0x234]
push ecx
push 0
push str.ProcessId
mov edx, dword [ebp - 0x100]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x100]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x4697f7
movzx eax, word [ebp - 0x234]
cmp eax, 1
je 0x4697f7
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x194], ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x224]
call fcn.00405ec0
mov byte [ebp - 4], 7
push 0x5e517c
lea edx, [ebp - 0x204]
push edx
call fcn.00407960
add esp, 8
movzx eax, al
test eax, eax
je 0x46983e
push 0x5e5184
lea ecx, [ebp - 0x224]
call fcn.00405fb0
jmp 0x4698f7
push str.Registry
lea ecx, [ebp - 0x204]
push ecx
call fcn.00407960
add esp, 8
movzx edx, al
test edx, edx
je 0x46986e
push str.C:WindowsSystem32_ntoskrnl.exe
lea ecx, [ebp - 0x224]
call fcn.00405fb0
jmp 0x4698f7
push str.C:WindowsSystem32_
lea ecx, [ebp - 0x268]
call fcn.00405ef0
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x2e4]
push edx
lea eax, [ebp - 0x284]
push eax
call fcn.0041e300
add esp, 0xc
mov dword [ebp - 0x2e8], eax
mov ecx, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x2ec]
push edx
lea ecx, [ebp - 0x224]
call fcn.00405f90
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x284]
call fcn.00405f70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x268]
call fcn.00405f70
mov byte [ebp - 0x235], 1
push 0
push 0
lea eax, [ebp - 0x234]
push eax
push 0
push str.ExecutablePath
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x100]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x208], eax
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x208], 0
jl 0x469a47
movzx edx, word [ebp - 0x234]
cmp edx, 1
je 0x469a47
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jne 0x469970
mov dword [ebp - 0x2f0], 0
jmp 0x4699da
mov ecx, dword [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3fffffff
jle 0x469998
mov dword [ebp - 0x2f4], 0
jmp 0x4699ce
mov eax, dword [ebp - 0x6c]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x2f8], esp
mov edx, dword [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x6c]
shl eax, 1
push eax
mov ecx, dword [ebp - 0xf8]
push ecx
mov edx, dword [ebp - 0x2f8]
push edx
call fcn.004022d0
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f0], eax
mov ecx, dword [ebp - 0x2f0]
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.00405fb0
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x5948ea
lea eax, [ebp - 0x1e8]
push eax
call fcn.00407960
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x469a45
lea ecx, [ebp - 0x224]
call fcn.00406030
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x469a33
mov byte [ebp - 0x235], 0
jmp 0x469a45
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x1e8]
call fcn.00405f90
jmp 0x469a78
lea ecx, [ebp - 0x224]
call fcn.00406030
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x469a66
mov byte [ebp - 0x235], 0
jmp 0x469a78
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00405f90
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
je 0x469dce
push 0x80
push 0
lea edx, [ebp - 0x18c]
push edx
call fcn.00562540
add esp, 0xc
lea ecx, [ebp - 0x1e8]
call fcn.00406030
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x469acb
mov dword [ebp - 0x2fc], 0
jmp 0x469b33
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3fffffff
jle 0x469af3
mov dword [ebp - 0x300], 0
jmp 0x469b27
mov eax, dword [ebp - 0x6c]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x304], esp
mov ecx, dword [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x304]
push ecx
call fcn.00402280
mov dword [ebp - 0x300], eax
mov edx, dword [ebp - 0x300]
mov dword [ebp - 0x2fc], edx
push 0x40
lea eax, [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x2fc]
push ecx
call fcn.00412db0
add esp, 0xc
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x469bfb
lea edx, [ebp - 0x18c]
mov dword [ebp - 0xf8], edx
cmp dword [ebp - 0xf8], 0
jne 0x469b7f
mov dword [ebp - 0x308], 0
jmp 0x469be9
mov eax, dword [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3fffffff
jle 0x469ba7
mov dword [ebp - 0x30c], 0
jmp 0x469bdd
mov eax, dword [ebp - 0x6c]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x310], esp
mov ecx, dword [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x6c]
shl edx, 1
push edx
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0x310]
push ecx
call fcn.004022d0
mov dword [ebp - 0x30c], eax
mov edx, dword [ebp - 0x30c]
mov dword [ebp - 0x308], edx
mov eax, dword [ebp - 0x308]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.00405fb0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80
push 0
lea ecx, [ebp - 0xf4]
push ecx
call fcn.00562540
add esp, 0xc
lea ecx, [ebp - 0x1e8]
call fcn.00406030
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x469c3f
mov dword [ebp - 0x314], 0
jmp 0x469ca7
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3fffffff
jle 0x469c67
mov dword [ebp - 0x318], 0
jmp 0x469c9b
mov eax, dword [ebp - 0x6c]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x31c], esp
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x31c]
push eax
call fcn.00402280
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
mov dword [ebp - 0x314], ecx
push 0x40
lea edx, [ebp - 0xf4]
push edx
mov eax, dword [ebp - 0x314]
push eax
call fcn.00413f30
add esp, 0xc
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x469dce
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xf8], ecx
cmp dword [ebp - 0xf8], 0
jne 0x469cf3
mov dword [ebp - 0x320], 0
jmp 0x469d5d
mov edx, dword [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3fffffff
jle 0x469d1b
mov dword [ebp - 0x324], 0
jmp 0x469d51
mov eax, dword [ebp - 0x6c]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x328], esp
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x6c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xf8]
push edx
mov eax, dword [ebp - 0x328]
push eax
call fcn.004022d0
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x320], ecx
mov edx, dword [ebp - 0x320]
push edx
lea ecx, [ebp - 0x1cc]
call fcn.00405fb0
push 0x55f712
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00405fd0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00406000
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00405fd0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2a4]
push eax
call fcn.00407be0
add esp, 0x20
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x100]
push eax
mov ecx, dword [edx + 8]
call ecx
push 0x5948eb
lea edx, [ebp - 0x1b0]
push edx
call fcn.00407c60
add esp, 8
movzx eax, al
test eax, eax
je 0x469e76
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x469e67
lea edx, [ebp - 0x2b4]
push edx
lea ecx, [ebp - 0x54]
call fcn.00459300
push eax
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x2ac]
push ecx
lea ecx, [ebp - 0x54]
call fcn.0046aa20
mov ecx, eax
call fcn.00460b10
movzx edx, al
test edx, edx
je 0x469e65
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00419920
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x1b0]
push edx
lea ecx, [ebp - 0x54]
call fcn.00419600
mov ecx, eax
call fcn.00405f90
jmp 0x469e76
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00419920
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x224]
call fcn.00405f70
jmp 0x469e98
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x204]
call fcn.004086c0
jmp 0x469eac
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x204]
call fcn.004086c0
jmp 0x46964a
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x469f22
mov edx, dword [ebp - 0x60]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [eax + 8]
call edx
call fcn.00414e20
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
push eax
call fcn.00414de0
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00419820
mov edx, dword [ebp - 0x2b8]
or edx, 1
mov dword [ebp - 0x2b8], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00416d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00406130
mov eax, dword [ebp + 8]
jmp 0x469f88
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x60]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [edx + 8]
call ecx
call fcn.00414e20
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.00414de0
add esp, 4
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00419820
mov ecx, dword [ebp - 0x2b8]
or ecx, 1
mov dword [ebp - 0x2b8], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00416d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00406130
mov eax, dword [ebp + 8]
lea esp, [ebp - 0x32c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x70]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret