Function at 0x252a480
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Move file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x218
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 0x214], eax
and dword [esp + 0x1f0], 0
and dword [esp + 0x1f8], 0
push ebx
mov ebx, dword [esp + 0x224]
push ebp
mov ebp, dword [esp + 0x22c]
push esi
push edi
mov dword [esp + 0x210], ebx
mov dword [esp + 0x20c], ebp
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x20c]
call fcn.0247a7b2
and dword [esp + 0x1f8], 0
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x1fc]
call fcn.0247a7ff
and dword [esp + 0x1fc], 0
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x200]
call fcn.0247a7ff
push dword [esp + 0x22c]
lea ecx, [esp + 0x1fc]
call fcn.0247dfa4
push dword [esp + 0x22c]
lea ecx, [esp + 0x200]
call fcn.0247dfa4
mov dword [esp + 0x10], 0x6b635362
mov dword [esp + 0x14], 0x3152684f
mov dword [esp + 0x18], 0x4130684a
mov dword [esp + 0x1c], 0x7345444d
mov dword [esp + 0x20], 0x734a514b
mov dword [esp + 0x24], 0x4c457847
mov dword [esp + 0x28], 0x3835424b
mov dword [esp + 0x2c], 0x3930544f
mov dword [esp + 0x30], 0x76454450
mov dword [esp + 0x34], 0x58415350
mov dword [esp + 0x38], 0x41556a64
mov dword [esp + 0x3c], 0x43635243
mov dword [esp + 0x40], 0x36736749
mov dword [esp + 0x44], 0x676c4442
mov dword [esp + 0x48], 0x6b386742
mov dword [esp + 0x4c], 0x5730424e
mov dword [esp + 0x50], 0x53636745
mov dword [esp + 0x54], 0x59596d4b
mov dword [esp + 0x58], 0x41347a43
mov dword [esp + 0x5c], 0x676f534a
mov dword [esp + 0x60], 0x30425346
mov dword [esp + 0x64], 0x42495361
mov dword [esp + 0x68], 0x5a6b5749
mov dword [esp + 0x6c], 0x71354450
mov dword [esp + 0x70], 0x2b67514a
mov dword [esp + 0x74], 0x3941434c
mov dword [esp + 0x78], 0x626b3244
mov dword [esp + 0x7c], 0x336b6842
mov dword [esp + 0x80], 0x7a38414c
mov dword [esp + 0x84], 0x78494447
mov dword [esp + 0x88], 0x50777a45
mov dword [esp + 0x8c], 0x43457943
mov dword [esp + 0x90], 0x36495144
mov dword [esp + 0x94], 0x7231524f
mov dword [esp + 0x98], 0x73345345
mov dword [esp + 0x9c], 0x49513244
mov dword [esp + 0xa0], 0x4a38574b
mov dword [esp + 0xa4], 0x746c7a48
mov dword [esp + 0xa8], 0x7077544d
mov dword [esp + 0xac], 0x7834774f
mov dword [esp + 0xb0], 0x7931524b
mov dword [esp + 0xb4], 0x30733345
mov dword [esp + 0xb8], 0x54385241
mov dword [esp + 0xbc], 0x78454249
mov dword [esp + 0xc0], 0x30637a47
mov dword [esp + 0xc4], 0x71647a47
mov dword [esp + 0xc8], 0x6249784e
mov dword [esp + 0xcc], 0x5549695a
mov dword [esp + 0xd0], 0x30466a44
mov dword [esp + 0xd4], 0x6b4a7946
mov dword [esp + 0xd8], 0x69497844
xor eax, eax
mov dword [esp + 0xdc], 0x4c634343
push eax
sub esp, 0xc
mov dword [esp + 0xf0], 0x48417764
mov ecx, esp
mov dword [esp + 0xf4], 0x6f564347
mov dword [esp + 0xf8], 0x32636846
mov dword [esp + 0xfc], 0x3841794e
mov dword [esp + 0x100], 0x67677945
mov dword [esp + 0x104], 0x336c6963
mov dword [esp + 0x108], 0x2b345159
mov dword [esp + 0x10c], 0x6c357849
mov dword [esp + 0x110], 0x6345534e
mov dword [esp + 0x114], 0x446b5459
mov dword [esp + 0x118], 0x63737a66
mov dword [esp + 0x11c], 0x30315244
mov dword [esp + 0x120], 0x7a556943
mov dword [esp + 0x124], 0x5845434e
mov dword [esp + 0x128], 0x396f534b
mov dword [esp + 0x12c], 0x56596d48
mov dword [esp + 0x130], 0x58345149
mov dword [esp + 0x134], 0x45307944
mov dword [esp + 0x138], 0x584d424b
mov dword [esp + 0x13c], 0x79744259
mov dword [esp + 0x140], 0x37427866
mov dword [esp + 0x144], 0x76786741
mov dword [esp + 0x148], 0x6e4e6749
mov dword [esp + 0x14c], 0x3130444a
mov dword [esp + 0x150], 0x2f74774b
mov dword [esp + 0x154], 0x765a7748
mov dword [esp + 0x158], 0x6e597850
mov dword [esp + 0x15c], 0x7a595748
mov dword [esp + 0x160], 0x496f5242
mov dword [esp + 0x164], 0x6551415a
mov dword [esp + 0x168], 0x454d534a
mov dword [esp + 0x16c], 0x62735265
mov dword [esp + 0x170], 0x3473694c
mov dword [esp + 0x174], 0x356b6a45
mov dword [esp + 0x178], 0x38454764
mov dword [esp + 0x17c], 0x70676944
mov dword [esp + 0x180], 0x4a4d484d
mov dword [esp + 0x184], 0x58387944
mov dword [esp + 0x188], 0x6649444e
mov dword [esp + 0x18c], 0x4f517942
mov dword [esp + 0x190], 0x3445474a
mov dword [esp + 0x194], 0x52554141
mov dword [esp + 0x198], 0x3955794e
mov dword [esp + 0x19c], 0x3045784d
mov dword [esp + 0x1a0], 0x4e497a4b
mov dword [esp + 0x1a4], 0x4b674346
mov dword [esp + 0x1a8], 0x5841334c
mov dword [esp + 0x1ac], 0x31594366
mov dword [esp + 0x1b0], 0x4a385243
mov dword [esp + 0x1b4], 0x4c634449
mov dword [esp + 0x1b8], 0x4f4d5149
mov dword [esp + 0x1bc], 0x67494244
mov dword [esp + 0x1c0], 0x55414348
mov dword [esp + 0x1c4], 0x5a736e46
mov dword [esp + 0x1c8], 0x2f34444b
mov dword [esp + 0x1cc], 0x5a346a4f
mov dword [esp + 0x1d0], 0x44496861
mov dword [esp + 0x1d4], 0x5738524f
mov dword [esp + 0x1d8], 0x326c6963
mov dword [esp + 0x1dc], 0x516b7a47
mov dword [esp + 0x1e0], 0x6f49534c
mov dword [esp + 0x1e4], 0x42414141
mov word [esp + 0x1e8], 0x7754
mov byte [esp + 0x214], al
push dword [esp + 0x214]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [esp + 0x1ee]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.024799be
lea eax, [esp + 0x224]
push eax
call fcn.024b8ec7
add esp, 0x10
mov ecx, eax
call fcn.02486d33
push eax
lea ecx, [esp + 0x1fc]
call fcn.02529ad3
lea ecx, [esp + 0x214]
call fcn.0247fe92
mov dword [esp + 0x10], 0x6b635362
mov dword [esp + 0x14], 0x33676e4f
mov dword [esp + 0x18], 0x2b6f6a4c
mov dword [esp + 0x1c], 0x2f306765
mov dword [esp + 0x20], 0x34675444
mov dword [esp + 0x24], 0x75497945
mov dword [esp + 0x28], 0x616b684c
mov dword [esp + 0x2c], 0x5859574d
mov dword [esp + 0x30], 0x304d524d
mov dword [esp + 0x34], 0x556b7865
mov dword [esp + 0x38], 0x4d6f694b
mov dword [esp + 0x3c], 0x7355574f
mov dword [esp + 0x40], 0x37634165
mov dword [esp + 0x44], 0x3751534b
mov dword [esp + 0x48], 0x5151534a
mov dword [esp + 0x4c], 0x51305444
mov dword [esp + 0x50], 0x4b6f6d46
mov dword [esp + 0x54], 0x634d4249
mov dword [esp + 0x58], 0x674d334b
mov dword [esp + 0x5c], 0x62346747
mov dword [esp + 0x60], 0x334d524f
mov dword [esp + 0x64], 0x6c556942
mov dword [esp + 0x68], 0x346f7864
mov dword [esp + 0x6c], 0x68776950
mov dword [esp + 0x70], 0x7435524a
mov dword [esp + 0x74], 0x34387841
mov dword [esp + 0x78], 0x6a4d7a44
mov dword [esp + 0x7c], 0x78676e48
mov dword [esp + 0x80], 0x42387941
mov dword [esp + 0x84], 0x61414147
mov dword [esp + 0x88], 0x45775247
mov dword [esp + 0x8c], 0x66454341
mov dword [esp + 0x90], 0x2b74694f
mov dword [esp + 0x94], 0x2b49414a
mov dword [esp + 0x98], 0x7478674c
mov dword [esp + 0x9c], 0x5734524c
mov dword [esp + 0xa0], 0x2f51424b
mov dword [esp + 0xa4], 0x4f4d6941
mov dword [esp + 0xa8], 0x2f564862
mov dword [esp + 0xac], 0x69455142
mov dword [esp + 0xb0], 0x4a555442
mov dword [esp + 0xb4], 0x51517841
mov dword [esp + 0xb8], 0x6c496d44
mov dword [esp + 0xbc], 0x6f46324b
mov dword [esp + 0xc0], 0x74684249
mov dword [esp + 0xc4], 0x765a6944
mov dword [esp + 0xc8], 0x4d6b5747
mov dword [esp + 0xcc], 0x4e6b6865
mov dword [esp + 0xd0], 0x4c457762
mov dword [esp + 0xd4], 0x6b6c4850
mov dword [esp + 0xd8], 0x32466e4e
mov dword [esp + 0xdc], 0x6c455442
mov dword [esp + 0xe0], 0x35355241
mov dword [esp + 0xe4], 0x68414247
mov dword [esp + 0xe8], 0x32677842
mov dword [esp + 0xec], 0x6946474d
mov dword [esp + 0xf0], 0x394a6966
mov dword [esp + 0xf4], 0x59555342
mov dword [esp + 0xf8], 0x706b4164
mov dword [esp + 0xfc], 0x7135515a
mov dword [esp + 0x100], 0x784d5449
mov dword [esp + 0x104], 0x54457759
mov dword [esp + 0x108], 0x71494450
mov dword [esp + 0x10c], 0x54675244
mov dword [esp + 0x110], 0x6c747965
mov dword [esp + 0x114], 0x4e457a47
mov dword [esp + 0x118], 0x5a675344
mov dword [esp + 0x11c], 0x59734265
mov dword [esp + 0x120], 0x32344445
mov dword [esp + 0x124], 0x2f776847
mov dword [esp + 0x128], 0x31307845
mov dword [esp + 0x12c], 0x33397843
mov dword [esp + 0x130], 0x356f5443
xor eax, eax
mov dword [esp + 0x134], 0x53736a4a
push eax
sub esp, 0xc
mov dword [esp + 0x148], 0x39777944
mov ecx, esp
mov dword [esp + 0x14c], 0x7159774c
mov dword [esp + 0x150], 0x70456946
mov dword [esp + 0x154], 0x4c4d514b
mov dword [esp + 0x158], 0x736f6761
mov dword [esp + 0x15c], 0x6839444d
mov dword [esp + 0x160], 0x3867574d
mov dword [esp + 0x164], 0x656b784e
mov dword [esp + 0x168], 0x4b596d43
mov dword [esp + 0x16c], 0x67466d4c
mov dword [esp + 0x170], 0x2f776743
mov dword [esp + 0x174], 0x30494347
mov dword [esp + 0x178], 0x68345442
mov dword [esp + 0x17c], 0x4b456a41
mov dword [esp + 0x180], 0x666f4364
mov dword [esp + 0x184], 0x576b5141
mov dword [esp + 0x188], 0x7434794c
mov dword [esp + 0x18c], 0x2b6b414d
mov dword [esp + 0x190], 0x49344442
mov dword [esp + 0x194], 0x70417a4f
mov dword [esp + 0x198], 0x336f774d
mov dword [esp + 0x19c], 0x70637746
mov dword [esp + 0x1a0], 0x376b5244
mov dword [esp + 0x1a4], 0x5a386a4b
mov dword [esp + 0x1a8], 0x4f635443
mov dword [esp + 0x1ac], 0x64496941
mov dword [esp + 0x1b0], 0x74387864
mov dword [esp + 0x1b4], 0x744d6a46
mov dword [esp + 0x1b8], 0x71774443
mov dword [esp + 0x1bc], 0x4d63784b
mov dword [esp + 0x1c0], 0x2b6f6941
mov dword [esp + 0x1c4], 0x57305242
mov dword [esp + 0x1c8], 0x51737761
mov dword [esp + 0x1cc], 0x5377694f
mov dword [esp + 0x1d0], 0x41734164
mov dword [esp + 0x1d4], 0x69675442
mov dword [esp + 0x1d8], 0x2f737742
mov dword [esp + 0x1dc], 0x50307a4e
mov dword [esp + 0x1e0], 0x72677a4b
mov dword [esp + 0x1e4], 0x4c4d3265
mov dword [esp + 0x1e8], 0x5773794b
mov dword [esp + 0x1ec], 0x55386841
mov dword [esp + 0x1f0], 0x52737a41
mov dword [esp + 0x1f4], 0x6f385166
mov dword [esp + 0x1f8], 0x66384350
mov dword [esp + 0x1fc], 0x45344163
mov dword [esp + 0x200], 0x41417744
mov word [esp + 0x204], 0x5741
mov byte [esp + 0x206], 0x45
mov byte [esp + 0x214], al
push dword [esp + 0x214]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [esp + 0x20b]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.024799be
lea eax, [esp + 0x224]
push eax
call fcn.024b8ec7
add esp, 0x10
mov ecx, eax
call fcn.02486d33
push eax
lea ecx, [esp + 0x200]
call fcn.02529ad3
lea ecx, [esp + 0x214]
call fcn.0247fe92
mov edi, dword [esp + 0x1f8]
push edi
mov byte [ebx], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [esp + 0x1fc]
test eax, eax
jne 0x252afa0
mov bl, 1
jmp 0x252b120
push dword [esp + 0x22c]
mov dword [ebp + 0x78], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x252b010
push dword [esp + 0x22c]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebx], al
test al, al
jne 0x252b009
and dword [esp + 0x220], 0
lea eax, [esp + 0x214]
push eax
mov ecx, ebp
mov dword [esp + 0x21c], 8
mov dword [esp + 0x220], 0xb
mov dword [esp + 0x218], 0x4405804
call fcn.024b51c9
mov bl, byte [ebx]
jmp 0x252b120
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x252b022
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x200]
inc eax
mov bl, 1
push esi
mov dword [esp + 0x204], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x252b04f
push dword [esp + 0x22c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x252b061
push esi
push dword [esp + 0x230]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x252b08b
push dword [esp + 0x22c]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x252b0ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x22c]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc
jmp 0x252b0b9
push dword [esp + 0x22c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x252b0b7
push dword [esp + 0x22c]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x252b087
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x252b110
push 0xd
pop ebp
push 0x3e8
xor bl, bl
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x200]
cmp eax, 5
jl 0x252b029
mov ecx, dword [esp + 0x20c]
lea eax, [esp + 0x214]
and dword [esp + 0x220], 0
push eax
mov dword [esp + 0x21c], 8
mov dword [esp + 0x220], ebp
mov dword [esp + 0x218], 0x4405804
call fcn.024b51c9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x210]
mov byte [eax], bl
lea ecx, [esi - 0x10]
call fcn.0247de5b
lea ecx, [edi - 0x10]
call fcn.0247de5b
mov ecx, dword [esp + 0x208]
add ecx, 0xfffffff0
call fcn.0247de5b
mov ecx, dword [esp + 0x22c]
add ecx, 0xfffffff0
call fcn.0247de5b
mov ecx, dword [esp + 0x224]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0x218
ret