Function at 0x46f060
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get file attributes
Get file size
Read file via mapping
Resolve function by parsing pe exports
Set file attributes
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x63eb2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
push ebx
push ebp
push esi
push edi
or ebx, 0xffffffff
push str.shell32.dll
mov dword [esp + 0x18], ebx
call fcn.0044abc0
mov ebp, eax
xor edi, edi
add esp, 4
cmp ebp, edi
je 0x46f242
push str.SHGetFolderPathW
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x46f236
push edi
call dword [0x6fc3fc]
lea eax, [esp + 0x144]
push eax
push edi
push edi
push 0x24
push edi
call esi
cmp eax, edi
jne 0x46f230
lea ecx, [esp + 0x144]
push ecx
call fcn.00609a4e
add esp, 4
cmp word [esp + eax*2 + 0x142], 0x5c
je 0x46f103
lea edx, [esp + 0x144]
push 0x6c91c0
push edx
call fcn.00609a6b
add esp, 8
call fcn.0044bfc0
test eax, eax
je 0x46f11b
lea eax, [esp + 0x144]
push str.Sysnative
push eax
jmp 0x46f128
lea ecx, [esp + 0x144]
push str.System32
push ecx
call fcn.00609a6b
mov edx, 0x129
mov eax, 0x13c
mov word [esp + 0x36], dx
mov word [esp + 0x3e], dx
mov word [esp + 0x30], ax
mov word [esp + 0x38], ax
mov edx, 0x13e
mov eax, 0x13f
add esp, 8
mov word [esp + 0x38], dx
mov word [esp + 0x44], dx
mov word [esp + 0x32], ax
mov word [esp + 0x42], ax
mov word [esp + 0x46], ax
lea edx, [esp + 0x24]
lea eax, [esp + 0x34c]
mov ecx, 0x116
push edx
push eax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], 0x12e
mov word [esp + 0x32], 0x125
mov word [esp + 0x34], 0x138
mov word [esp + 0x3c], cx
mov word [esp + 0x42], 0x12f
mov word [esp + 0x44], cx
mov word [esp + 0x46], 0x12a
mov word [esp + 0x48], 0x123
mov word [esp + 0x50], di
call fcn.00609a95
lea ecx, [esp + 0x354]
push ecx
call fcn.00609a4e
add esp, 0xc
cmp eax, edi
jle 0x46f1f8
lea ecx, [esp + 0x34c]
mov dx, word [ecx]
add ecx, 2
xor dx, 0x4d
sub edx, 0xff
dec eax
mov word [ecx - 2], dx
jne 0x46f1e1
lea eax, [esp + 0x34c]
lea ecx, [esp + 0x144]
push eax
push ecx
call fcn.00609a6b
add esp, 8
lea edx, [esp + 0x144]
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
mov ebx, eax
call dword [0x6fc400]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 0xffffffff
jne 0x46f24c
mov eax, 1
jmp 0x46f92c
lea eax, [esp + 0x8c]
mov dword [esp + 0x4c], 1
push eax
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x94], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x46f283
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46f46d
mov ecx, dword [esp + 0x8c]
push edi
push ebp
push ecx
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x46f46b
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x46f464
lea esi, [ebp + 1]
push esi
mov dword [esp + 0x54], esi
call fcn.00622acb
push esi
mov ebx, eax
call fcn.00622acb
add esp, 8
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x46f455
test eax, eax
je 0x46f455
lea edx, [esp + 0x54]
mov byte [esp + 0x54], 0x21
push edx
mov byte [esp + 0x59], 0x66
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], 0x7b
mov byte [esp + 0x5c], 0x6a
mov byte [esp + 0x5d], 0x7d
mov byte [esp + 0x5e], 0x61
mov byte [esp + 0x5f], 0x6a
mov byte [esp + 0x60], 0x7b
mov byte [esp + 0x61], 0x6b
mov byte [esp + 0x62], 0x60
mov byte [esp + 0x63], 0x78
mov byte [esp + 0x64], 0x61
mov byte [esp + 0x65], 0x63
mov byte [esp + 0x66], 0x60
mov byte [esp + 0x67], 0x6e
mov byte [esp + 0x68], 0x6b
mov byte [esp + 0x69], 0x62
mov byte [esp + 0x6a], 0x6e
mov byte [esp + 0x6b], 0x61
mov byte [esp + 0x6c], 0x6e
mov byte [esp + 0x6d], 0x68
mov byte [esp + 0x6e], 0x6a
mov byte [esp + 0x6f], 0x7d
mov byte [esp + 0x70], 0x21
mov byte [esp + 0x71], 0x6c
mov byte [esp + 0x72], 0x60
mov byte [esp + 0x73], 0x62
mov byte [esp + 0x74], 0
call fcn.005de2e0
mov esi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], 0
mov al, byte [ebx]
test al, al
mov esi, ebx
je 0x46f43e
push 0xa
push esi
call fcn.00609c00
add esp, 8
test eax, eax
je 0x46f3dc
mov ebp, dword [esp + 0x10]
mov edi, eax
sub edi, esi
lea ecx, [edi + 1]
push ecx
push esi
push ebp
call fcn.00609f00
add esp, 0xc
mov byte [edi + ebp + 1], 0
jmp 0x46f3f7
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x10]
lea edx, [edi - 1]
push edx
push esi
push ebp
call fcn.00609f00
add esp, 0xc
mov byte [edi + ebp - 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add esi, ecx
mov al, byte [edi]
cmp al, 0x20
je 0x46f411
cmp al, 9
jne 0x46f414
inc edi
jmp 0x46f407
cmp byte [edi], 0x23
je 0x46f435
push ebp
call fcn.0060c5ef
lea eax, [esp + 0x58]
push eax
push edi
call fcn.00609cc0
add esp, 0xc
test eax, eax
jne 0x46f734
cmp byte [esi], 0
jne 0x46f3b0
mov ebp, dword [esp + 0x10]
push ebx
call fcn.00622af4
push ebp
call fcn.00622af4
mov edi, dword [esp + 0x20]
add esp, 8
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], edi
je 0x46f928
mov eax, dword [esp + 0x45c]
mov esi, 0x6fd324
cmp eax, edi
jne 0x46f493
mov esi, 0x6fd328
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00623b6b
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [esp + 0xa0]
call fcn.00436970
lea ecx, [esp + 0x98]
mov dword [esp + 0x454], edi
call fcn.006226c5
cmp eax, 1
jne 0x46f8d7
lea edx, [esp + 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46f4f4
test al, 1
je 0x46f4f4
xor eax, 1
push eax
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push edi
push 3
push edi
push 3
lea ecx, [esp + 0x158]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x90], edi
je 0x46f874
lea edx, [esp + 0x20]
xor esi, esi
push edx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x46f54b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46f80b
mov eax, dword [esp + 0x20]
push esi
push ebp
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x84], ebx
je 0x46f80b
push 0
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x46f800
lea eax, [ebp + 1]
push eax
mov dword [esp + 0x54], eax
call fcn.00622acb
mov ecx, dword [esp + 0x54]
mov ebx, eax
push ecx
call fcn.00622acb
add esp, 8
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x46f7f2
test eax, eax
je 0x46f7f2
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
mov byte [esp + 0x28], 0x21
mov byte [esp + 0x29], 0x66
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x7b
mov byte [esp + 0x2c], 0x6a
mov byte [esp + 0x2d], 0x7d
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], 0x6a
mov byte [esp + 0x30], 0x7b
mov byte [esp + 0x31], 0x6b
mov byte [esp + 0x32], 0x60
mov byte [esp + 0x33], 0x78
mov byte [esp + 0x34], 0x61
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], 0x60
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x6b
mov byte [esp + 0x39], 0x62
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x6e
mov byte [esp + 0x3d], 0x68
mov byte [esp + 0x3e], 0x6a
mov byte [esp + 0x3f], 0x7d
mov byte [esp + 0x40], 0x21
mov byte [esp + 0x41], 0x6c
mov byte [esp + 0x42], 0x60
mov byte [esp + 0x43], 0x62
mov byte [esp + 0x44], 0
call fcn.005de2e0
lea eax, [esp + 0x78]
mov byte [esp + 0x78], 0x7d
push eax
mov byte [esp + 0x7d], 0x6a
mov byte [esp + 0x7e], 0x68
mov byte [esp + 0x7f], 0x66
mov byte [esp + 0x80], 0x7c
mov byte [esp + 0x81], 0x7b
mov byte [esp + 0x82], 0x6a
mov byte [esp + 0x83], 0x7d
mov byte [esp + 0x84], 0x66
mov byte [esp + 0x85], 0x6b
mov byte [esp + 0x86], 0x62
mov byte [esp + 0x87], 0x21
mov byte [esp + 0x88], 0x6c
mov byte [esp + 0x89], 0x60
mov byte [esp + 0x8a], 0x62
mov byte [esp + 0x8b], 0
call fcn.005de2e0
mov ecx, ebp
mov edi, ebx
mov edx, ecx
add esp, 8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x10], 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], 0
mov al, byte [ebx]
test al, al
mov esi, ebx
je 0x46f7d4
push 0xa
push esi
call fcn.00609c00
add esp, 8
test eax, eax
je 0x46f741
mov ebp, dword [esp + 0x14]
mov edi, eax
sub edi, esi
lea eax, [edi + 1]
push eax
push esi
push ebp
call fcn.00609f00
add esp, 0xc
mov byte [edi + ebp + 1], 0
jmp 0x46f75c
mov dword [esp + 0x20], 1
jmp 0x46f442
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x14]
lea ecx, [edi - 1]
push ecx
push esi
push ebp
call fcn.00609f00
add esp, 0xc
mov byte [edi + ebp - 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add esi, ecx
mov al, byte [edi]
cmp al, 0x20
je 0x46f776
cmp al, 9
jne 0x46f779
inc edi
jmp 0x46f76c
cmp byte [edi], 0x23
je 0x46f7b4
push ebp
call fcn.0060c5ef
lea edx, [esp + 0x28]
push edx
push edi
call fcn.00609cc0
add esp, 0xc
test eax, eax
jne 0x46f7a8
lea edx, [esp + 0x74]
push edx
push edi
call fcn.00609cc0
add esp, 8
test eax, eax
je 0x46f7b4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov byte [ecx + eax], 0x23
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
dec ecx
add eax, ecx
mov dword [esp + 0x10], eax
mov al, byte [esi]
test al, al
jne 0x46f708
push ebx
call fcn.00622af4
mov edx, dword [esp + 0x18]
push edx
call fcn.00622af4
mov edi, dword [esp + 0x98]
mov esi, dword [esp + 0x24]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x84]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test esi, esi
je 0x46f869
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x84]
lea edx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
lea edx, [esp + 0x84]
mov dword [esp + 0x90], eax
push edx
lea eax, [esp + 0x94]
push 0
push eax
push edi
mov dword [esp + 0xa4], ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x46f8db
mov eax, dword [0x6fcacc]
mov dword [esp + 0x4c], 0
test eax, eax
je 0x46f8db
push 0
call dword [0x6fc3fc]
lea ecx, [esp + 0x18]
push ecx
push 0x65a560
push 0x65a580
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.004a4c30
add esp, 0x10
test eax, eax
jne 0x46f8cf
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 0x34]
test eax, eax
jne 0x46f8c5
mov dword [esp + 0x4c], 1
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [0x6fc400]
jmp 0x46f8db
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x140]
mov dword [esp + 0x454], 3
call fcn.00622d8a
lea ecx, [esp + 0xf4]
mov dword [esp + 0x130], 0x657cdc
mov byte [esp + 0x454], 1
call fcn.0062e0bb
lea ecx, [esp + 0x98]
mov dword [esp + 0x454], 0xffffffff
call fcn.00622306
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x448
ret