Function at 0x43d040
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60869b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x9c]
push eax
call fcn.00443eb0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x9c]
push ecx
push str.Win32_Process
call fcn.0043cc50
add esp, 8
mov byte [ebp - 0x21], al
test al, al
je 0x43d4f3
mov dword [ebp - 0x28], ebx
mov edx, dword [ebp - 0x8c]
sub edx, dword [ebp - 0x90]
sar edx, 2
cmp ebx, edx
jae 0x43d4f3
mov byte [ebp - 4], 1
lea eax, [ebp - 0x84]
push eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
push ecx
call esi
mov byte [ebp - 4], 3
lea edx, [ebp - 0xac]
push edx
call esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0xbc]
push eax
call esi
mov byte [ebp - 4], 5
mov edi, ebx
lea esi, [ebp - 0x9c]
call fcn.00424a10
mov esi, dword [eax]
lea ecx, [ebp - 0x58]
push ecx
mov edi, 0x6d0df8
call fcn.00433770
mov byte [ebp - 4], 6
or dword [ebp - 0x1c], 1
cmp dword [eax], 0
je 0x43d126
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x43d128
xor eax, eax
mov edx, dword [esi]
push 0
push 0
lea ecx, [ebp - 0x84]
push ecx
push 0
push eax
push esi
mov edx, dword [edx + 0x10]
call edx
test eax, eax
jl 0x43d156
cmp word [ebp - 0x84], 8
jne 0x43d156
cmp dword [ebp - 0x7c], 0
mov byte [ebp - 0x15], 1
jne 0x43d15a
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 5
test byte [ebp - 0x1c], 1
je 0x43d173
and dword [ebp - 0x1c], 0xfffffffe
lea edi, [ebp - 0x58]
call fcn.00433810
cmp byte [ebp - 0x15], 0
je 0x43d499
mov edi, ebx
lea esi, [ebp - 0x9c]
call fcn.00424a10
mov esi, dword [eax]
lea eax, [ebp - 0x60]
push eax
mov edi, str.CommandLine
call fcn.00433770
mov byte [ebp - 4], 7
or dword [ebp - 0x1c], 2
cmp dword [eax], 0
je 0x43d1ad
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x43d1af
xor eax, eax
mov ecx, dword [esi]
push 0
push 0
lea edx, [ebp - 0x74]
push edx
push 0
push eax
push esi
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jl 0x43d1d7
cmp word [ebp - 0x74], 8
jne 0x43d1d7
cmp dword [ebp - 0x6c], 0
mov byte [ebp - 0x15], 1
jne 0x43d1db
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 5
test byte [ebp - 0x1c], 2
je 0x43d1f4
and dword [ebp - 0x1c], 0xfffffffd
lea edi, [ebp - 0x60]
call fcn.00433810
cmp byte [ebp - 0x15], 0
je 0x43d499
mov edi, ebx
lea esi, [ebp - 0x9c]
call fcn.00424a10
mov esi, dword [eax]
lea ecx, [ebp - 0x5c]
push ecx
mov edi, str.ExecutablePath
call fcn.00433770
mov byte [ebp - 4], 8
or dword [ebp - 0x1c], 4
cmp dword [eax], 0
je 0x43d22e
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x43d230
xor eax, eax
mov edx, dword [esi]
push 0
push 0
lea ecx, [ebp - 0xbc]
push ecx
push 0
push eax
push esi
mov edx, dword [edx + 0x10]
call edx
test eax, eax
jl 0x43d261
cmp word [ebp - 0xbc], 8
jne 0x43d261
cmp dword [ebp - 0xb4], 0
mov byte [ebp - 0x15], 1
jne 0x43d265
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 5
test byte [ebp - 0x1c], 4
je 0x43d27e
and dword [ebp - 0x1c], 0xfffffffb
lea edi, [ebp - 0x5c]
call fcn.00433810
cmp byte [ebp - 0x15], 0
je 0x43d499
mov edi, ebx
lea esi, [ebp - 0x9c]
call fcn.00424a10
mov esi, dword [eax]
lea eax, [ebp - 0x64]
push eax
mov edi, str.ProcessId
call fcn.00433770
mov byte [ebp - 4], 9
cmp dword [eax], 0
je 0x43d2b4
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x43d2b6
xor eax, eax
mov ecx, dword [esi]
push 0
push 0
lea edx, [ebp - 0xac]
push edx
push 0
push eax
push esi
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
setge bl
mov byte [ebp - 4], 5
lea edi, [ebp - 0x64]
call fcn.00433810
test bl, bl
je 0x43d496
lea ecx, [ebp - 0x44]
push ecx
call fcn.0043d520
mov bl, 0xa
mov byte [ebp - 4], bl
mov edx, dword [ebp - 0x7c]
lea edi, [ebp - 0x3c]
call fcn.0040bab0
cmp word [ebp - 0xac], 0x13
jne 0x43d314
movzx edx, word [ebp - 0xa4]
mov dword [ebp - 0x44], edx
jmp 0x43d31d
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0xb4]
lea edi, [ebp - 0x2c]
call fcn.0040bab0
mov edx, dword [ebp - 0x6c]
lea edi, [ebp - 0x30]
call fcn.0040bab0
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0043dae0
add esp, 4
mov byte [ebp - 4], 0xb
lea edi, [ebp - 0x34]
call fcn.0040ddb0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
call fcn.0040ba40
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.0040b990
mov byte [ebp - 4], 0xc
lea edi, [ebp - 0x20]
call fcn.0040bd70
lea eax, [ebp - 0x4c]
push eax
call fcn.0040b8d0
mov bl, 0xd
mov byte [ebp - 4], bl
xor ecx, ecx
mov edx, str..exe_
mov esi, edi
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x43d3aa
xor ecx, ecx
mov edx, str..exe
call fcn.004301b0
cmp eax, 0xffffffff
je 0x43d42b
mov ecx, eax
mov edx, 0x6d0be0
lea esi, [ebp - 0x20]
call fcn.004301b0
mov edi, eax
cmp edi, 0xffffffff
je 0x43d42b
mov ecx, edi
mov edx, 0x6cb388
call fcn.004301b0
lea edx, [edi - 1]
cmp eax, 0xffffffff
jne 0x43d402
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx - 0xc]
lea ecx, [eax - 1]
sub ecx, edi
add ecx, 2
lea eax, [ebp - 0x50]
push eax
mov eax, esi
push eax
call fcn.00442c30
mov byte [ebp - 4], 0xe
lea edi, [ebp - 0x38]
call fcn.0040ddb0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x50]
jmp 0x43d426
mov ecx, eax
sub ecx, edi
inc ecx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00442c30
mov byte [ebp - 4], 0xf
lea edi, [ebp - 0x38]
call fcn.0040ddb0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x54]
call fcn.0040ba40
push 0x6d14d0
lea eax, [ebp - 0x38]
call fcn.00425630
mov ebx, eax
mov eax, 0x6d14d0
call fcn.00425690
mov eax, dword [ebp - 0x38]
cmp dword [eax - 0xc], 0
je 0x43d465
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43d465
mov edx, 0x6ca128
lea edi, [ebp - 0x38]
call fcn.0040bab0
lea ecx, [ebp - 0x44]
push ecx
mov ebx, dword [ebp + 8]
call fcn.00443fa0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x4c]
call fcn.0040ba40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call fcn.0040ba40
mov byte [ebp - 4], 5
lea edx, [ebp - 0x44]
push edx
call fcn.0043d5b0
mov ebx, dword [ebp - 0x28]
mov byte [ebp - 4], 4
lea eax, [ebp - 0xbc]
push eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac]
push ecx
call esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x74]
push edx
call esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x84]
push eax
call esi
mov dword [ebp - 4], 0
inc ebx
jmp 0x43d0a1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00444390
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret