Function at 0x24afa66
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x364
mov eax, dword [0x6400104]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, ecx
xor eax, eax
push ebp
mov dword [esp + 0xc], eax
push esi
mov dword [ebx], eax
lea ebp, [ebx + 0x14]
mov dword [ebx + 4], eax
push edi
mov dword [esp + 0x228], ebx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
call fcn.0247d9cc
push eax
mov ecx, ebp
call fcn.0247a7ff
xor esi, esi
mov dword [esp + 0x220], esi
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x224]
call fcn.0247a7ff
mov dword [esp + 0x224], esi
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x228]
call fcn.0247a7ff
mov dword [esp + 0x21c], esi
call fcn.0247d9cc
push eax
lea ecx, [esp + 0x220]
call fcn.0247a7ff
xor eax, eax
lea edi, [esp + 0x31c]
stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x304], ecx
mov edx, 0x4405770
mov dword [esp + 0x2fc], ecx
push 8
stosd dword es:[edi], eax
mov dword [esp + 0x304], edx
mov dword [esp + 0x2fc], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x30c]
mov dword [esp + 0x330], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x320], ecx
mov dword [esp + 0x324], ecx
mov dword [esp + 0x328], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x32c], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0x31c], ecx
lea edi, [esp + 0x334]
mov dword [esp + 0x30c], ecx
mov dword [esp + 0x310], ecx
mov dword [esp + 0x314], ecx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x330]
mov dword [esp + 0x314], edx
call fcn.024aee5c
push 8
pop ecx
xor eax, eax
lea edi, [esp + 0x350]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x350]
call fcn.024aee5c
lea eax, [esp + 0x220]
mov byte [esp + 0x1b], 0
mov dword [esp + 0x14], 0x67
push eax
lea eax, [esp + 0x18]
push eax
call fcn.02527f36
lea eax, [esp + 0x22c]
mov dword [esp + 0x1c], 0x65
push eax
lea eax, [esp + 0x20]
push eax
call fcn.02527f36
add esp, 0x10
mov dword [esp + 0x1c], 0x716b4342
mov dword [esp + 0x20], 0x72637a4d
mov dword [esp + 0x24], 0x36513345
mov dword [esp + 0x28], 0x2b6b6a66
mov dword [esp + 0x2c], 0x6d5a5145
mov dword [esp + 0x30], 0x756c7744
mov dword [esp + 0x34], 0x36317943
mov dword [esp + 0x38], 0x66733347
mov dword [esp + 0x3c], 0x2f38674b
mov dword [esp + 0x40], 0x39494263
mov dword [esp + 0x44], 0x774e6a45
mov dword [esp + 0x48], 0x45456d41
mov dword [esp + 0x4c], 0x2b676a47
mov dword [esp + 0x50], 0x734a6a66
mov dword [esp + 0x54], 0x6c744443
mov dword [esp + 0x58], 0x4441524c
mov dword [esp + 0x5c], 0x35554842
mov dword [esp + 0x60], 0x46774244
mov dword [esp + 0x64], 0x45634350
mov dword [esp + 0x68], 0x71775148
mov dword [esp + 0x6c], 0x79415447
mov dword [esp + 0x70], 0x43416759
mov dword [esp + 0x74], 0x75554450
mov dword [esp + 0x78], 0x53456d47
mov dword [esp + 0x7c], 0x48515145
mov dword [esp + 0x80], 0x4d457a41
mov dword [esp + 0x84], 0x4330324a
mov dword [esp + 0x88], 0x756f524a
mov dword [esp + 0x8c], 0x78344259
mov dword [esp + 0x90], 0x786b5243
mov dword [esp + 0x94], 0x7a34534a
mov dword [esp + 0x98], 0x496b684e
mov dword [esp + 0x9c], 0x774d6944
mov dword [esp + 0xa0], 0x30596d47
mov dword [esp + 0xa4], 0x48595141
mov dword [esp + 0xa8], 0x38556a4b
mov dword [esp + 0xac], 0x3677424e
mov dword [esp + 0xb0], 0x70416745
mov dword [esp + 0xb4], 0x7363774d
mov dword [esp + 0xb8], 0x46777842
mov dword [esp + 0xbc], 0x3051514a
mov dword [esp + 0xc0], 0x4d597746
mov dword [esp + 0xc4], 0x395a474a
mov dword [esp + 0xc8], 0x30686a45
mov dword [esp + 0xcc], 0x5238534d
mov dword [esp + 0xd0], 0x46417949
mov dword [esp + 0xd4], 0x39307a46
mov dword [esp + 0xd8], 0x63347966
mov dword [esp + 0xdc], 0x776f414f
mov dword [esp + 0xe0], 0x34387a43
mov dword [esp + 0xe4], 0x6659584c
mov dword [esp + 0xe8], 0x32413242
mov dword [esp + 0xec], 0x784a4343
mov dword [esp + 0xf0], 0x67303250
mov dword [esp + 0xf4], 0x7741434e
mov dword [esp + 0xf8], 0x6641674a
mov dword [esp + 0xfc], 0x706f534a
mov dword [esp + 0x100], 0x7441414b
mov dword [esp + 0x104], 0x4f515245
mov dword [esp + 0x108], 0x2b38434d
mov dword [esp + 0x10c], 0x79387865
mov dword [esp + 0x110], 0x756f5461
mov dword [esp + 0x114], 0x4f347a50
mov dword [esp + 0x118], 0x644d535a
mov dword [esp + 0x11c], 0x45306743
mov dword [esp + 0x120], 0x2b516846
mov dword [esp + 0x124], 0x68415349
mov dword [esp + 0x128], 0x65386847
mov dword [esp + 0x12c], 0x51515144
mov dword [esp + 0x130], 0x6d787966
mov dword [esp + 0x134], 0x31567864
push dword [esp + 0x220]
xor eax, eax
mov dword [esp + 0x13c], 0x4a49474b
push eax
sub esp, 0xc
mov dword [esp + 0x150], 0x4241524f
mov ecx, esp
mov dword [esp + 0x154], 0x5834414a
mov dword [esp + 0x158], 0x514d584d
mov dword [esp + 0x15c], 0x634d5345
mov dword [esp + 0x160], 0x76735246
mov dword [esp + 0x164], 0x70787965
mov dword [esp + 0x168], 0x67596e61
mov dword [esp + 0x16c], 0x62455266
mov dword [esp + 0x170], 0x7739674b
mov dword [esp + 0x174], 0x4a384150
mov dword [esp + 0x178], 0x41735166
mov dword [esp + 0x17c], 0x72417766
mov dword [esp + 0x180], 0x3341334f
mov dword [esp + 0x184], 0x4d496a45
mov dword [esp + 0x188], 0x38416764
mov dword [esp + 0x18c], 0x76394442
mov dword [esp + 0x190], 0x414d7743
mov dword [esp + 0x194], 0x56343348
mov dword [esp + 0x198], 0x78646763
mov dword [esp + 0x19c], 0x6d344145
mov dword [esp + 0x1a0], 0x784d574c
mov dword [esp + 0x1a4], 0x74735248
mov dword [esp + 0x1a8], 0x4363424c
mov dword [esp + 0x1ac], 0x4f6b444f
mov dword [esp + 0x1b0], 0x4e6b7a4d
mov dword [esp + 0x1b4], 0x444d7a4d
mov dword [esp + 0x1b8], 0x78787850
mov dword [esp + 0x1bc], 0x69774345
mov dword [esp + 0x1c0], 0x2f30694e
mov dword [esp + 0x1c4], 0x32465159
mov dword [esp + 0x1c8], 0x344e6d4a
mov dword [esp + 0x1cc], 0x42454750
mov dword [esp + 0x1d0], 0x5a556e47
mov dword [esp + 0x1d4], 0x39454144
mov dword [esp + 0x1d8], 0x5341574b
mov dword [esp + 0x1dc], 0x5063694c
mov dword [esp + 0x1e0], 0x7a784441
mov dword [esp + 0x1e4], 0x6b317944
mov dword [esp + 0x1e8], 0x39515844
mov dword [esp + 0x1ec], 0x76777945
mov dword [esp + 0x1f0], 0x37637a42
mov dword [esp + 0x1f4], 0x68737a50
mov dword [esp + 0x1f8], 0x3641684c
mov dword [esp + 0x1fc], 0x34554442
mov dword [esp + 0x200], 0x71674741
mov dword [esp + 0x204], 0x75456a4d
mov dword [esp + 0x208], 0x79514145
mov dword [esp + 0x20c], 0x66776e41
mov dword [esp + 0x210], 0x414d7a44
mov dword [esp + 0x214], 0x3377534b
mov dword [esp + 0x218], 0x62674348
mov dword [esp + 0x21c], 0x6659794f
mov dword [esp + 0x220], 0x4d67774a
mov dword [esp + 0x224], 0x62516a43
mov dword [esp + 0x228], 0x416b7a49
mov dword [esp + 0x22c], 0x7a464141
mov byte [esp + 0x28], al
push dword [esp + 0x28]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [esp + 0x234]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.024799be
lea eax, [esp + 0x240]
push eax
call fcn.024b8ec7
add esp, 0x10
mov ecx, eax
call fcn.02486d33
push eax
lea eax, [esp + 0x224]
push eax
call fcn.024cc19d
add esp, 0xc
lea ecx, [esp + 0x22c]
call fcn.0247fe92
mov esi, dword [esp + 0x21c]
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov edi, eax
xor ebx, ebx
lea eax, [esp + 0x29c]
inc ebx
push 0x100000
push eax
call fcn.0253b28c
pop ecx
push eax
lea ecx, [esp + 0x33c]
call fcn.024b300b
test al, al
je 0x24b01fb
push 3
pop ebx
push 0
lea eax, [esp + 0x23c]
push 0x100000
push eax
call fcn.025355c4
pop ecx
push eax
lea ecx, [esp + 0x33c]
call fcn.024b300b
mov byte [esp + 0x13], 1
test al, al
jne 0x24b0200
mov byte [esp + 0x13], 0
test bl, 2
je 0x24b0214
lea ecx, [esp + 0x238]
and ebx, 0xfffffffd
call fcn.024b1b1c
test bl, 1
je 0x24b0228
lea ecx, [esp + 0x298]
and ebx, 0xfffffffe
call fcn.024b1b1c
cmp byte [esp + 0x13], 0
je 0x24b0281
push 1
lea eax, [esp + 0x334]
push eax
lea ecx, [esp + 0x308]
call fcn.02530243
lea eax, [esp + 0x300]
push eax
lea ecx, [esp + 0x32c]
call fcn.024b239b
mov eax, dword [esp + 0x32c]
mov cl, 1
mov dword [esp + 0x31c], 0xc
mov dword [esp + 0x320], eax
mov dword [esp + 0x324], 1
jmp 0x24b0285
mov cl, byte [esp + 0x1b]
cmp edi, 2
jne 0x24b02ae
xor edx, edx
lea eax, [esp + 0x31c]
push esi
test cl, cl
push 0
cmove eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [esp + 0x228]
mov dword [ecx + 8], eax
jmp 0x24b02fa
test cl, cl
je 0x24b02fa
cmp dword [esi - 4], 1
jle 0x24b02ce
push dword [esi - 0xc]
lea ecx, [esp + 0x220]
call fcn.0247d83c
mov esi, dword [esp + 0x21c]
push 0
lea ecx, [esp + 0x334]
call fcn.024e01c0
push eax
push 0
push 0
push 4
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push 0xffffffffffffffff
lea ecx, [esp + 0x220]
call fcn.0252999e
push 0
push ebp
push 0x23
call fcn.024dd915
mov edi, dword [esp + 0x230]
add esp, 0xc
mov ecx, ebp
push edi
call fcn.024b4fd5
push ebp
call fcn.024b7f62
pop ecx
mov dword [esp + 0x1c], 0x6f41794e
mov dword [esp + 0x20], 0x4a6b5149
mov dword [esp + 0x24], 0x69516849
mov dword [esp + 0x28], 0x57496750
mov dword [esp + 0x2c], 0x34634248
mov dword [esp + 0x30], 0x6a55674d
mov dword [esp + 0x34], 0x5059684c
mov dword [esp + 0x38], 0x76346e5a
mov dword [esp + 0x3c], 0x6a735161
mov dword [esp + 0x40], 0x316b7a47
mov dword [esp + 0x44], 0x44306745
mov dword [esp + 0x48], 0x4d45474e
mov dword [esp + 0x4c], 0x72415766
mov dword [esp + 0x50], 0x71345141
mov dword [esp + 0x54], 0x6677434e
mov dword [esp + 0x58], 0x67345145
mov dword [esp + 0x5c], 0x4d597a49
mov dword [esp + 0x60], 0x766b4350
mov dword [esp + 0x64], 0x72384159
mov dword [esp + 0x68], 0x6d774441
mov dword [esp + 0x6c], 0x7735674b
mov dword [esp + 0x70], 0x6d517741
mov dword [esp + 0x74], 0x6b747a65
mov dword [esp + 0x78], 0x31775344
mov dword [esp + 0x7c], 0x6467774f
mov dword [esp + 0x80], 0x2b6f784c
mov dword [esp + 0x84], 0x74307745
mov dword [esp + 0x88], 0x55344365
mov dword [esp + 0x8c], 0x6f4d3361
mov dword [esp + 0x90], 0x6738524d
mov dword [esp + 0x94], 0x6b556a65
mov dword [esp + 0x98], 0x74557a47
mov dword [esp + 0x9c], 0x786f684c
mov dword [esp + 0xa0], 0x33776847
mov dword [esp + 0xa4], 0x5a456865
mov dword [esp + 0xa8], 0x4a456963
mov dword [esp + 0xac], 0x6b776a43
mov dword [esp + 0xb0], 0x57674147
mov dword [esp + 0xb4], 0x30514241
mov dword [esp + 0xb8], 0x37675445
mov dword [esp + 0xbc], 0x6d303346
mov dword [esp + 0xc0], 0x71636749
mov dword [esp + 0xc4], 0x78556d4b
mov dword [esp + 0xc8], 0x75317948
mov dword [esp + 0xcc], 0x34516a4b
mov dword [esp + 0xd0], 0x63737a41
mov dword [esp + 0xd4], 0x6a385449
mov dword [esp + 0xd8], 0x756f6a63
mov dword [esp + 0xdc], 0x2f67674d
mov dword [esp + 0xe0], 0x36776741
mov dword [esp + 0xe4], 0x4338524c
mov dword [esp + 0xe8], 0x74345342
mov dword [esp + 0xec], 0x426f7a46
mov dword [esp + 0xf0], 0x37735441
mov dword [esp + 0xf4], 0x6c30434d
mov dword [esp + 0xf8], 0x7a454247
mov dword [esp + 0xfc], 0x70557a46
mov dword [esp + 0x100], 0x656f6a43
mov dword [esp + 0x104], 0x2b497850
mov dword [esp + 0x108], 0x4545414c
mov dword [esp + 0x10c], 0x316f4142
mov dword [esp + 0x110], 0x42734442
mov dword [esp + 0x114], 0x436b684a
mov dword [esp + 0x118], 0x6541674c
mov dword [esp + 0x11c], 0x6d777946
mov dword [esp + 0x120], 0x6f645264
mov dword [esp + 0x124], 0x4c676d64
mov dword [esp + 0x128], 0x2b6f5266
mov dword [esp + 0x12c], 0x43455341
xor eax, eax
mov dword [esp + 0x130], 0x64344447
push eax
sub esp, 0xc
mov dword [esp + 0x144], 0x7a354143
mov ecx, esp
mov dword [esp + 0x148], 0x44495141
mov dword [esp + 0x14c], 0x394e3246
mov dword [esp + 0x150], 0x75646944
mov dword [esp + 0x154], 0x686c7947
mov dword [esp + 0x158], 0x32307a49
mov dword [esp + 0x15c], 0x42774350
mov dword [esp + 0x160], 0x65674342
mov dword [esp + 0x164], 0x7a49524e
mov dword [esp + 0x168], 0x6e464141
mov dword [esp + 0x16c], 0x54597a65
mov dword [esp + 0x170], 0x6b555759
mov dword [esp + 0x174], 0x77597a49
mov dword [esp + 0x178], 0x724e424f
mov dword [esp + 0x17c], 0x4d55794e
mov dword [esp + 0x180], 0x35307a4e
mov dword [esp + 0x184], 0x53594246
mov dword [esp + 0x188], 0x53777944
mov dword [esp + 0x18c], 0x4677514e
mov dword [esp + 0x190], 0x6a456a4d
mov dword [esp + 0x194], 0x794d6846
mov dword [esp + 0x198], 0x4f384748
mov dword [esp + 0x19c], 0x644d6741
mov dword [esp + 0x1a0], 0x79597846
mov dword [esp + 0x1a4], 0x42775342
mov dword [esp + 0x1a8], 0x32493263
mov dword [esp + 0x1ac], 0x6d455244
mov dword [esp + 0x1b0], 0x6f744247
mov dword [esp + 0x1b4], 0x44416742
mov dword [esp + 0x1b8], 0x6e34525a
mov dword [esp + 0x1bc], 0x4167434e
mov dword [esp + 0x1c0], 0x2f315248
mov dword [esp + 0x1c4], 0x54776a42
mov dword [esp + 0x1c8], 0x774d6d4f
mov dword [esp + 0x1cc], 0x6c4d4448
mov dword [esp + 0x1d0], 0x56306a45
mov dword [esp + 0x1d4], 0x3831324b
mov dword [esp + 0x1d8], 0x59517847
mov dword [esp + 0x1dc], 0x7a34784e
mov dword [esp + 0x1e0], 0x57345247
mov dword [esp + 0x1e4], 0x7073794c
mov dword [esp + 0x1e8], 0x334a5748
mov dword [esp + 0x1ec], 0x6b554442
mov dword [esp + 0x1f0], 0x75317966
mov dword [esp + 0x1f4], 0x6b31774b
mov dword [esp + 0x1f8], 0x726b6841
mov dword [esp + 0x1fc], 0x6c464741
mov dword [esp + 0x200], 0x344d7a4d
mov dword [esp + 0x204], 0x79394350
mov dword [esp + 0x208], 0x68524342
mov dword [esp + 0x20c], 0x316c5342
mov dword [esp + 0x210], 0x2b63534b
mov dword [esp + 0x214], 0x4d59414b
mov dword [esp + 0x218], 0x41415145
mov word [esp + 0x21c], 0x5741
mov byte [esp + 0x21e], 0x34
mov byte [esp + 0x24], al
push dword [esp + 0x24]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [esp + 0x223]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.024799be
lea eax, [esp + 0x23c]
push eax
call fcn.024b8ec7
add esp, 0x10
mov ecx, eax
call fcn.02486d33
push eax
mov ecx, ebp
call fcn.024b4fd5
lea ecx, [esp + 0x22c]
call fcn.0247fe92
push 0
lea eax, [esp + 0x23c]
or ebx, 4
push 0x101f0000
push eax
call fcn.0253b28c
pop ecx
push eax
lea ecx, [esp + 0x35c]
call fcn.024b300b
test al, al
je 0x24b08e4
push 0
lea eax, [esp + 0x29c]
or ebx, 8
push 0x101f0000
push eax
call fcn.025355c4
pop ecx
push eax
lea ecx, [esp + 0x35c]
call fcn.024b300b
mov byte [esp + 0x13], 1
test al, al
jne 0x24b08e9
mov byte [esp + 0x13], 0
test bl, 8
je 0x24b08fd
lea ecx, [esp + 0x298]
and ebx, 0xfffffff7
call fcn.024b1b1c
test bl, 4
je 0x24b090e
lea ecx, [esp + 0x238]
call fcn.024b1b1c
cmp byte [esp + 0x13], 0
je 0x24b09bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
lea eax, [esp + 0x350]
inc ebx
lea ecx, [esp + 0x2f8]
push ebx
push eax
call fcn.02530243
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x318]
call fcn.024b239b
mov eax, dword [esp + 0x318]
mov dword [esp + 0x308], 0xc
mov dword [esp + 0x30c], eax
mov dword [esp + 0x310], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x24b099e
push dword [esp + 0x2fc]
push 4
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x24b09bd
xor ecx, ecx
lea eax, [esp + 0x308]
push ecx
push ecx
push ebx
push eax
push ecx
push ecx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x350]
call fcn.024b1aea
lea ecx, [esp + 0x330]
call fcn.024b1aea
mov ebx, 0x4405770
lea ecx, [esp + 0x2f8]
mov dword [esp + 0x2f8], ebx
call fcn.024b7ab0
lea ecx, [esp + 0x300]
mov dword [esp + 0x300], ebx
call fcn.024b7ab0
lea ecx, [esp + 0x314]
mov dword [esp + 0x314], ebx
call fcn.024b7ab0
lea ecx, [esp + 0x328]
mov dword [esp + 0x328], ebx
call fcn.024b7ab0
lea ecx, [esi - 0x10]
call fcn.0247de5b
lea ecx, [edi - 0x10]
call fcn.0247de5b
mov ecx, dword [esp + 0x220]
lea ecx, [ecx - 0x10]
call fcn.0247de5b
mov ecx, dword [esp + 0x370]
mov eax, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.02585cf8
add esp, 0x364
ret