Function at 0x4c17e2
Capabilities:
Contain obfuscated stackstrings
Create directory

Disassembly:
push pe_nt_image_headers32
mov eax, 0x5abde1
call fcn.00553bf3
mov esi, ecx
mov dword [ebp - 0xf8], esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
call fcn.0045082c
push eax
lea ecx, [ebp - 0x18]
call fcn.004c3be8
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x26]
push ebx
sub esp, 0xc
mov dword [ebp - 0x1c], ebx
mov ecx, esp
mov dword [ebp - 0xd8], 0x4c635748
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd4], 0x694d7848
mov dword [ebp - 0xd0], 0x71736946
push ecx
push eax
push edx
mov dword [ebp - 0xcc], 0x326c5345
mov dword [ebp - 0xc8], 0x384d784a
mov dword [ebp - 0xc4], 0x65454345
mov dword [ebp - 0xc0], 0x65775242
mov dword [ebp - 0xbc], 0x2b68334b
mov dword [ebp - 0xb8], 0x4b496961
mov dword [ebp - 0xb4], 0x63514147
mov dword [ebp - 0xb0], 0x2f747763
mov dword [ebp - 0xac], 0x516f7a4c
mov dword [ebp - 0xa8], 0x75777766
mov dword [ebp - 0xa4], 0x684d4342
mov dword [ebp - 0xa0], 0x6f414443
mov dword [ebp - 0x9c], 0x5545414e
mov dword [ebp - 0x98], 0x68496842
mov dword [ebp - 0x94], 0x4763514b
mov dword [ebp - 0x90], 0x6e304849
mov dword [ebp - 0x8c], 0x47386d42
mov dword [ebp - 0x88], 0x39594745
mov dword [ebp - 0x84], 0x524d474b
mov dword [ebp - 0x80], 0x57554142
mov dword [ebp - 0x7c], 0x4f417743
mov dword [ebp - 0x78], 0x37384249
mov dword [ebp - 0x74], 0x7a774350
mov dword [ebp - 0x70], 0x4859694f
mov dword [ebp - 0x6c], 0x6b345244
mov dword [ebp - 0x68], 0x3530675a
mov dword [ebp - 0x64], 0x59556d66
mov dword [ebp - 0x60], 0x6e6f6863
mov dword [ebp - 0x5c], 0x4c49574f
mov dword [ebp - 0x58], 0x6977434b
mov dword [ebp - 0x54], 0x586f4250
mov dword [ebp - 0x50], 0x2f646d4c
mov dword [ebp - 0x4c], 0x42305444
mov dword [ebp - 0x48], 0x74515444
mov dword [ebp - 0x44], 0x77345247
mov dword [ebp - 0x40], 0x5934444f
mov dword [ebp - 0x3c], 0x4b517a43
mov dword [ebp - 0x38], 0x65594146
mov dword [ebp - 0x34], 0x4751474b
mov dword [ebp - 0x30], 0x78553346
mov dword [ebp - 0x2c], 0x41414141
mov word [ebp - 0x28], 0x4167
call fcn.00450208
lea ecx, [ebp - 0x104]
call fcn.004c35a2
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004ab6d2
push eax
lea ecx, [ebp - 0x1c]
call fcn.004c3491
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 3
call fcn.004ab565
mov dword [ebp - 0x14], ebx
call fcn.0045082c
push eax
lea ecx, [ebp - 0x14]
call fcn.004c3be8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x20]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xf0], 0x46675148
mov ecx, esp
mov dword [ebp - 0xec], 0x4d774243
lea eax, [ebp - 0x21]
mov dword [ebp - 0xe8], 0x6d77774c
lea edx, [ebp - 0xf0]
mov dword [ebp - 0xe4], 0x57676746
push ecx
push eax
push edx
mov dword [ebp - 0xe0], 0x6e787864
mov dword [ebp - 0xdc], 0x38567a4e
mov dword [ebp - 0xd8], 0x34427759
mov dword [ebp - 0xd4], 0x34687850
mov dword [ebp - 0xd0], 0x7449414a
mov dword [ebp - 0xcc], 0x46455166
mov dword [ebp - 0xc8], 0x30634163
mov dword [ebp - 0xc4], 0x524d6847
mov dword [ebp - 0xc0], 0x39386948
mov dword [ebp - 0xbc], 0x4673784b
mov dword [ebp - 0xb8], 0x336f6a4a
mov dword [ebp - 0xb4], 0x794a4849
mov dword [ebp - 0xb0], 0x7641795a
mov dword [ebp - 0xac], 0x6c416743
mov dword [ebp - 0xa8], 0x71344359
mov dword [ebp - 0xa4], 0x69496d50
mov dword [ebp - 0xa0], 0x4b4d684e
mov dword [ebp - 0x9c], 0x35427742
mov dword [ebp - 0x98], 0x32425866
mov dword [ebp - 0x94], 0x5151424b
mov dword [ebp - 0x90], 0x4c305443
mov dword [ebp - 0x8c], 0x6c63484c
mov dword [ebp - 0x88], 0x36514741
mov dword [ebp - 0x84], 0x706f794e
mov dword [ebp - 0x80], 0x6b6f694b
mov dword [ebp - 0x7c], 0x344d514c
mov dword [ebp - 0x78], 0x395a5443
mov dword [ebp - 0x74], 0x37497949
mov dword [ebp - 0x70], 0x6f6f7964
mov dword [ebp - 0x6c], 0x75737859
mov dword [ebp - 0x68], 0x4559574d
mov dword [ebp - 0x64], 0x77677742
mov dword [ebp - 0x60], 0x4d457743
mov dword [ebp - 0x5c], 0x3455674a
mov dword [ebp - 0x58], 0x5073485a
mov dword [ebp - 0x54], 0x78636941
mov dword [ebp - 0x50], 0x5955444a
mov dword [ebp - 0x4c], 0x47735465
mov dword [ebp - 0x48], 0x4d30534f
mov dword [ebp - 0x44], 0x4a63784c
mov dword [ebp - 0x40], 0x7259524c
mov dword [ebp - 0x3c], 0x4e4d784c
mov dword [ebp - 0x38], 0x66513259
mov dword [ebp - 0x34], 0x766f7a43
mov dword [ebp - 0x30], 0x48676a50
mov dword [ebp - 0x2c], 0x686c414a
mov dword [ebp - 0x28], 0x4141514f
mov word [ebp - 0x24], 0x4a41
mov byte [ebp - 0x22], 0x59
call fcn.00450208
lea ecx, [ebp - 0x104]
call fcn.004c35a2
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.004ab6d2
push eax
lea eax, [ebp - 0xf4]
mov ecx, esi
push eax
call fcn.004c22da
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.004c2e65
mov ecx, dword [ebp - 0xf4]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 4
call fcn.004ab565
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
cmp dword [edi - 0xc], ebx
je 0x4c1cb6
cmp dword [esi - 0xc], 0
lea ecx, [ebp - 0x14]
jne 0x4c1c44
lea eax, [ebp - 0x18]
push eax
call fcn.004c2e65
mov esi, dword [ebp - 0x14]
jmp 0x4c1c64
push edi
call fcn.004c3023
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.004c17cb
test eax, eax
jne 0x4c1c64
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4c1ca6
mov ecx, dword [ebp - 0xf8]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0xf4]
push eax
call fcn.004c22da
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004c2e65
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xf4]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
jne 0x4c1c2d
jmp 0x4c1cb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0xb7
cmovne ebx, eax
lea ecx, [esi - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00450c0a
lea ecx, [edi - 0x10]
call fcn.00450c0a
mov eax, ebx
call fcn.00553ba2
ret