Function at 0x451e20
Capabilities:
Contain obfuscated stackstrings
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac94b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x630
mov eax, dword [0x4d3804]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 6]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax + 0xa]
mov dword [ebp - 0x28], edx
push 0x42
push 0
lea eax, [ebp - 0x7c]
push eax
call fcn.0047ca40
add esp, 0xc
push 0x22a
push 0
lea ecx, [ebp - 0x2dc]
push ecx
call fcn.0047ca40
add esp, 0xc
mov dword [ebp - 0x2dc], 0x2a
mov dword [ebp - 0x2d8], 0x54004e
mov dword [ebp - 0x2d4], 0x530046
mov dword [ebp - 0x2c4], 0xe
mov dword [ebp - 0x2c0], 0x3a003a
mov word [ebp - 0x2bc], 0x24
mov dword [ebp - 0x2ba], 0x410044
mov dword [ebp - 0x2b6], 0x410054
mov dword [ebp - 0x2ae], 0x550047
mov dword [ebp - 0x2aa], 0x450052
mov dword [ebp - 0x29a], 0x1f0
mov dword [ebp - 0x28e], 0x10100000
mov dword [ebp - 0x28a], 0x1010b
mov ecx, dword [ebp + 0xc]
call fcn.00401c90
push eax
push str._s._EFS
lea edx, [ebp - 0x5ec]
push edx
call fcn.0047df2a
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x5ec]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00408620
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xa0]
push eax
call fcn.00466bf0
add esp, 8
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], edx
mov ecx, dword [ebp - 0xac]
or ecx, dword [ebp - 0xa8]
je 0x451fb0
cmp dword [ebp - 0xac], 0xffffffff
jne 0x451fd7
cmp dword [ebp - 0xa8], 0xffffffff
jne 0x451fd7
mov dword [ebp - 0x614], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401c70
mov eax, dword [ebp - 0x614]
jmp 0x4525ae
push 0
push 0
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00466cf0
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00406ad0
mov byte [ebp - 4], 1
push 0x10000
lea ecx, [ebp - 0x20]
call fcn.00406b20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x452058
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 0xac]
push edx
call fcn.00466d50
add esp, 8
mov dword [ebp - 0x618], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00406b00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401c70
mov eax, dword [ebp - 0x618]
jmp 0x4525ae
lea eax, [ebp - 0x14]
push eax
push 0x42
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00466ca0
add esp, 0x14
push 0
push 0
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00466cf0
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x4a]
add ecx, 0x32
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00466ca0
add esp, 0x14
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x4a]
add eax, 0x32
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xac]
push eax
call fcn.00466c50
add esp, 0x14
push 0
push 0x10000
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0047de80
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x24]
push eax
push 0x2a
lea ecx, [ebp - 0x2dc]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xac]
push eax
call fcn.00466c50
add esp, 0x14
mov dword [ebp - 0x5f0], 0
jmp 0x452121
mov ecx, dword [ebp - 0x5f0]
add ecx, 1
mov dword [ebp - 0x5f0], ecx
mov edx, dword [ebp - 0x5f0]
cmp edx, dword [ebp - 0x80]
jge 0x4521d8
mov eax, dword [ebp - 0x29a]
add eax, 0x10010
mov dword [ebp - 0x2b2], eax
mov dword [ebp - 0x292], 0x10000
mov dword [ebp - 0x296], 0x10000
mov dword [ebp - 0x286], 0x10000
mov cx, word [ebp - 0x5f0]
mov word [ebp - 0x2a0], cx
lea edx, [ebp - 0x24]
push edx
push 0x200
lea eax, [ebp - 0x2b2]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 0xac]
push edx
call fcn.00466c50
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push 0x10000
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00466ca0
add esp, 0x14
lea ecx, [ebp - 0x24]
push ecx
push 0x10000
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.00466c50
add esp, 0x14
jmp 0x452112
push 0
push 0x10000
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0047ddc0
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], edx
mov ecx, dword [ebp - 0x630]
or ecx, dword [ebp - 0x62c]
je 0x452349
mov dx, word [ebp - 0x80]
mov word [ebp - 0x2a0], dx
push 0
push 0x10000
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0047ddc0
mov dword [ebp - 0x292], eax
mov edx, dword [ebp - 0x292]
mov dword [ebp - 0x296], edx
push 0
push 0x10000
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0047ddc0
mov dword [ebp - 0x286], eax
mov edx, dword [ebp - 0x286]
mov dword [ebp - 0x638], edx
mov dword [ebp - 0x634], 0
fild qword [ebp - 0x638]
fdiv qword [0x4b79d0]
fstp qword [ebp - 0x5fc]
fld qword [ebp - 0x5fc]
call fcn.0047cc94
mov dword [ebp - 0x63c], eax
fild dword [ebp - 0x63c]
fld qword [ebp - 0x5fc]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4522b5
fld qword [ebp - 0x5fc]
fadd qword [0x4b79d8]
fstp qword [ebp - 0x5fc]
fld qword [ebp - 0x5fc]
call fcn.0047cc94
shl eax, 9
mov dword [ebp - 0x286], eax
mov eax, dword [ebp - 0x29a]
mov ecx, dword [ebp - 0x286]
lea edx, [ecx + eax + 0x10]
mov dword [ebp - 0x2b2], edx
lea eax, [ebp - 0x24]
push eax
push 0x200
lea ecx, [ebp - 0x2b2]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xac]
push eax
call fcn.00466c50
add esp, 0x14
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x286]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00466ca0
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x286]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.00466c50
add esp, 0x14
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xac]
push eax
call fcn.00466d50
add esp, 8
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00466d50
add esp, 8
cmp dword [0x5715b4], 0
je 0x452580
cmp dword [0x5715b8], 0
je 0x452580
cmp dword [0x5715c0], 0
je 0x452580
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0
je 0x4523cd
cmp dword [ebp - 0x600], 0xffffffff
jne 0x45240f
mov ecx, dword [ebp + 0xc]
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x61c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00406b00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401c70
mov eax, dword [ebp - 0x61c]
jmp 0x4525ae
lea ecx, [ebp - 0x608]
push ecx
push 1
mov ecx, dword [ebp + 0xc]
call fcn.00401c90
push eax
call dword [0x5715b4]
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0
jne 0x452573
mov edx, dword [ebp - 0x608]
push edx
mov eax, dword [ebp - 0x600]
push eax
push 0x4525d0
call dword [0x5715c0]
mov dword [ebp - 0x604], eax
mov ecx, dword [ebp - 0x608]
push ecx
call dword [0x5715b8]
cmp dword [ebp - 0x604], 0
jne 0x452555
mov edx, dword [ebp - 0x600]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp + 0xc]
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
je 0x452525
cmp dword [ebp - 0x60c], 0xffffffff
je 0x452525
mov ecx, dword [ebp - 0x60c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x1e]
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x610]
and ecx, 0xfffffffd
mov dword [ebp - 0x610], ecx
mov edx, dword [ebp - 0x610]
and edx, 0xffffffbf
mov dword [ebp - 0x610], edx
mov eax, dword [ebp - 0x610]
and eax, 0xfffff7ff
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x610]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x620], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00406b00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401c70
mov eax, dword [ebp - 0x620]
jmp 0x4525ae
mov edx, dword [ebp - 0x600]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x452580
mov eax, dword [ebp - 0x600]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x624], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00406b00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401c70
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x84]
call fcn.0047bda9
mov esp, ebp
pop ebp
ret 0x10