Function at 0x4a1990
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2bd0
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xbc], ecx
mov esi, ecx
mov dword [ebp - 0xb4], 0
or ebx, 0xffffffff
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a19e0
sub esi, edx
je 0x4a1d36
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4a1d36
call fcn.004a1090
push 0x44
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.004179d0
add esp, 0xc
mov dword [ebp - 0x98], 0
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0
movups xmmword [ebp - 0xb0], xmm0
call fcn.00406360
mov esi, eax
call fcn.0040c560
mov ecx, eax
test ecx, ecx
jne 0x4a1a50
push 0x80004005
call fcn.0040c2a0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4a1a65
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4a1a67
call edx
add eax, 0x10
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0
push 0
push eax
lea edx, [ebp - 0x98]
mov ecx, esi
call fcn.00498ba0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
test al, al
je 0x4a1cb9
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4a1cb9
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0
push ecx
push 1
push 2
push 0
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4a1ca2
push 0
push dword [ebp - 0x98]
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4a1c0d
xor eax, eax
mov dword [ebp - 0x94], 0x44
mov dword [ebp - 0x68], 0x101
xor esi, esi
mov word [ebp - 0x64], ax
nop dword [eax]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0
call fcn.0040bf20
mov byte [ebp - 4], 1
mov edx, 1
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x4a1b51
push 0x104
lea ecx, [ebp - 0x44]
call fcn.0040c200
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push 0
push dword [ebp - 0x9c]
push 0x480
push 0
push 0
push 0
push eax
push dword [ebp - 0xbc]
push dword [ebp - 0xa0]
call dword [0x4cc7c4]
push ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0xb4], eax
call fcn.00409300
push 0xc8
call edi
cmp dword [ebp - 0xb4], 0
lea ecx, [ebp - 0x44]
jne 0x4a1bbc
mov byte [ebp - 4], 0
call fcn.0040c260
inc esi
cmp esi, 0x32
jl 0x4a1b10
jmp 0x4a1bcb
mov ebx, dword [ebp - 0xa8]
mov byte [ebp - 4], 0
call fcn.0040c260
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0xb4], eax
setne al
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x4a1bf4
cmp eax, 0xffffffff
je 0x4a1bf4
push eax
call esi
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x4a1c06
cmp eax, 0xffffffff
je 0x4a1c06
push eax
call esi
push 0x7d0
call edi
cmp dword [ebp - 0x9c], 0
je 0x4a1c8b
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x72657355
push eax
mov dword [ebp - 0x3c], 0x2e766e65
mov dword [ebp - 0x38], 0x6c6c64
mov word [ebp - 0x1d], 0x6f6c
mov word [ebp - 0x2b], 0x796f
mov word [ebp - 0x1a], 0x6b
mov dword [ebp - 0x25], 0x6d6e6f72
mov dword [ebp - 0x30], 0x74736544
mov dword [ebp - 0x29], 0x69766e45
mov dword [ebp - 0x21], 0x42746e65
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x2c], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4a1c8b
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cc7a4], eax
test eax, eax
je 0x4a1c8b
push dword [ebp - 0x9c]
call eax
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x4a1ca2
push eax
call esi
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4a1cb9
push eax
call esi
mov dword [ebp - 0x98], 0
cmp byte [ebp + 8], 0
je 0x4a1ceb
test ebx, ebx
jle 0x4a1ceb
mov ecx, ebx
xor esi, esi
call fcn.004a1900
test eax, eax
je 0x4a1ceb
push 0x3e8
inc esi
call edi
cmp esi, 0x258
jg 0x4a1ceb
mov ecx, ebx
call fcn.004a1900
test eax, eax
jne 0x4a1cd0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4a1d2e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4a1d2a
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb4]
jmp 0x4a1d38
mov ecx, edx
call esi
mov eax, dword [ebp - 0xb4]
jmp 0x4a1d38
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret