Function at 0x4ebf53
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b0f55
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x5f4748]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f4748]
xor eax, esp
push eax
lea eax, [esp + 0x1c0]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x1a0], eax
mov ebx, dword [0x5fc49c]
mov dword [esp + 0x184], ebx
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x14], 0x2b494349
mov dword [esp + 0x18], 0x69736a49
mov dword [esp + 0x1c], 0x74557a4c
mov dword [esp + 0x20], 0x74785349
mov dword [esp + 0x24], 0x69677a4f
mov dword [esp + 0x28], 0x484d334d
mov dword [esp + 0x2c], 0x53386a4d
mov dword [esp + 0x30], 0x4d497759
mov dword [esp + 0x34], 0x7a746e4e
mov dword [esp + 0x38], 0x78415741
mov dword [esp + 0x3c], 0x6259424b
mov dword [esp + 0x40], 0x47737a65
mov dword [esp + 0x44], 0x314d7848
mov dword [esp + 0x48], 0x37415243
mov dword [esp + 0x4c], 0x67527a64
mov dword [esp + 0x50], 0x6d63534c
mov dword [esp + 0x54], 0x37675149
mov dword [esp + 0x58], 0x39383359
mov dword [esp + 0x5c], 0x5073524e
mov dword [esp + 0x60], 0x50385366
mov dword [esp + 0x64], 0x67495346
mov dword [esp + 0x68], 0x6d637848
mov dword [esp + 0x6c], 0x77345365
mov dword [esp + 0x70], 0x7a675149
mov dword [esp + 0x74], 0x334d3246
mov dword [esp + 0x78], 0x4b456a4c
mov dword [esp + 0x7c], 0x74384448
mov dword [esp + 0x80], 0x42595166
mov dword [esp + 0x84], 0x35426942
mov dword [esp + 0x88], 0x434d6742
mov dword [esp + 0x8c], 0x4b677949
mov dword [esp + 0x90], 0x4f637748
mov dword [esp + 0x94], 0x7967694a
mov dword [esp + 0x98], 0x476b4148
mov dword [esp + 0x9c], 0x72637a63
mov dword [esp + 0xa0], 0x3831434b
mov dword [esp + 0xa4], 0x6b416d45
mov dword [esp + 0xa8], 0x6c557759
mov dword [esp + 0xac], 0x2b595441
mov dword [esp + 0xb0], 0x59455145
mov dword [esp + 0xb4], 0x3839484e
mov dword [esp + 0xb8], 0x774d5150
mov dword [esp + 0xbc], 0x5663794c
mov dword [esp + 0xc0], 0x4e677843
mov dword [esp + 0xc4], 0x78634247
mov dword [esp + 0xc8], 0x79306a43
mov dword [esp + 0xcc], 0x2b745246
mov dword [esp + 0xd0], 0x59513364
mov dword [esp + 0xd4], 0x346b4359
mov dword [esp + 0xd8], 0x3738784a
mov dword [esp + 0xdc], 0x4b497747
mov dword [esp + 0xe0], 0x62455765
mov dword [esp + 0xe4], 0x4e516e41
mov dword [esp + 0xe8], 0x6241414c
mov dword [esp + 0xec], 0x30456742
mov dword [esp + 0xf0], 0x736b7963
mov dword [esp + 0xf4], 0x365a7743
mov dword [esp + 0xf8], 0x4d63444e
mov dword [esp + 0xfc], 0x79464146
mov dword [esp + 0x100], 0x6a4a7a46
mov dword [esp + 0x104], 0x46776a45
mov dword [esp + 0x108], 0x4573434a
mov dword [esp + 0x10c], 0x75775742
mov dword [esp + 0x110], 0x4434674a
mov dword [esp + 0x114], 0x326b4444
mov dword [esp + 0x118], 0x7834534b
mov dword [esp + 0x11c], 0x50677849
mov dword [esp + 0x120], 0x78677a4b
mov dword [esp + 0x124], 0x66517a4e
mov dword [esp + 0x128], 0x5a45424f
mov dword [esp + 0x12c], 0x6a455247
mov dword [esp + 0x130], 0x464d434e
mov dword [esp + 0x134], 0x4451794c
mov dword [esp + 0x138], 0x6167784f
mov dword [esp + 0x13c], 0x3155684c
push eax
sub esp, 0xc
mov dword [esp + 0x150], 0x4d634244
mov ecx, esp
mov dword [esp + 0x154], 0x6e396d47
lea eax, [esp + 0x168]
mov dword [esp + 0x158], 0x78346e49
lea edx, [esp + 0x24]
mov dword [esp + 0x15c], 0x7a676748
push ecx
push eax
push edx
mov dword [esp + 0x16c], 0x4155424d
mov dword [esp + 0x170], 0x67444141
call fcn.00450208
lea ecx, [esp + 0x178]
call fcn.0052fed7
add esp, 0xc
and dword [esp + 0x1cc], 0
mov ecx, eax
call fcn.004ab6d2
push eax
lea ecx, [esp + 0x1b0]
call fcn.004c3491
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c8], 2
call fcn.004ab565
mov eax, dword [esp + 0x1ac]
lea ecx, [esp + 0x19c]
push dword [edi]
and dword [esp + 0x1b8], 0
and dword [esp + 0x1a0], 0
mov dword [esp + 0x1b4], eax
call fcn.004c3491
lea ecx, [esp + 0x19c]
mov byte [esp + 0x1c8], 3
call fcn.00521111
mov ecx, dword [esp + 0x19c]
call fcn.0052f739
test eax, eax
jne 0x4ec3d0
lea ecx, [esp + 0x19c]
call fcn.0052f750
test eax, eax
je 0x4ec3d0
and dword [esp + 0x174], 0
lea eax, [esp + 0x168]
mov dword [esp + 0x16c], 1
mov dword [esp + 0x170], 0x31
mov dword [esp + 0x168], 0x5d0d7c
push 0x5f1974
push eax
call fcn.00553b2b
xor eax, eax
mov ecx, edi
mov dword [esp + 0x198], eax
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
lea eax, [esp + 0x178]
push eax
call fcn.0052103e
mov byte [esp + 0x1c8], 4
lea ecx, [esp + 0x1a8]
push dword [eax]
call fcn.004c3491
mov byte [esp + 0x1c8], 6
mov ecx, dword [esp + 0x178]
add ecx, 0xfffffff0
call fcn.00450c0a
push ecx
mov ecx, esp
mov dword [esp + 0x1a4], esp
push dword [ebx + 8]
call fcn.004c2861
push ecx
mov byte [esp + 0x1d0], 7
mov esi, esp
mov ecx, dword [0x5fc990]
mov dword [esp + 0x184], esp
lea ecx, [ecx - 0x10]
call fcn.004c3829
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x1d0], 8
call fcn.004b07fa
mov ecx, eax
mov byte [esp + 0x1d0], 6
call fcn.004b0841
mov dword [esp + 0x14], 0x61636842
mov dword [esp + 0x18], 0x5041774e
mov dword [esp + 0x1c], 0x30315148
mov dword [esp + 0x20], 0x4955534f
mov dword [esp + 0x24], 0x36734165
mov dword [esp + 0x28], 0x51594164
mov dword [esp + 0x2c], 0x4830795a
mov dword [esp + 0x30], 0x4f38684e
mov dword [esp + 0x34], 0x46774249
mov dword [esp + 0x38], 0x6359574d
mov dword [esp + 0x3c], 0x5a454746
mov dword [esp + 0x40], 0x6b30414e
mov dword [esp + 0x44], 0x79675249
mov dword [esp + 0x48], 0x3445684b
mov dword [esp + 0x4c], 0x5973444f
mov dword [esp + 0x50], 0x78746950
mov dword [esp + 0x54], 0x4c595445
mov dword [esp + 0x58], 0x386f514f
mov dword [esp + 0x5c], 0x69734242
mov dword [esp + 0x60], 0x51417a47
mov dword [esp + 0x64], 0x65634762
mov dword [esp + 0x68], 0x796c5442
mov dword [esp + 0x6c], 0x55415466
mov dword [esp + 0x70], 0x76734241
mov dword [esp + 0x74], 0x6173784d
mov dword [esp + 0x78], 0x4e596741
mov dword [esp + 0x7c], 0x7a46784a
mov dword [esp + 0x80], 0x70634150
mov dword [esp + 0x84], 0x36556961
mov dword [esp + 0x88], 0x79384145
mov dword [esp + 0x8c], 0x346f5764
mov dword [esp + 0x90], 0x6d735165
mov dword [esp + 0x94], 0x30787747
mov dword [esp + 0x98], 0x4b634241
mov dword [esp + 0x9c], 0x6d387847
mov dword [esp + 0xa0], 0x5363514b
mov dword [esp + 0xa4], 0x6e64324f
mov dword [esp + 0xa8], 0x37646a4b
mov dword [esp + 0xac], 0x69595443
mov dword [esp + 0xb0], 0x6251444a
mov dword [esp + 0xb4], 0x41414142
lea eax, [esp + 0x1a4]
mov word [esp + 0xb8], 0x4841
push eax
lea eax, [esp + 0x19c]
mov byte [esp + 0xbe], 0x59
push eax
xor eax, eax
lea edx, [esp + 0x1c]
push eax
push eax
push eax
sub esp, 0xc
lea eax, [esp + 0xdb]
mov ecx, esp
lea esi, [esp + 0x1d0]
push ecx
push eax
push edx
call fcn.00450208
lea ecx, [esp + 0x188]
call fcn.0052fed7
add esp, 0xc
mov byte [esp + 0x1dc], 9
mov ecx, eax
mov dword [esp + 0x1b4], 1
call fcn.004ab6d2
push ecx
mov ecx, esp
mov dword [esp + 0x190], esp
push eax
call fcn.004c3491
push ecx
push esp
mov ecx, ebx
mov dword [esp + 0x1e4], 0xa
call fcn.004eb6dc
xor edx, edx
mov byte [esp + 0x1e0], 9
mov ecx, esi
call fcn.0052d908
add esp, 0x18
test eax, eax
jne 0x4ec6a0
cmp dword [esp + 0x1a4], eax
jbe 0x4ec6a0
mov bl, 1
jmp 0x4ec6a2
xor bl, bl
lea ecx, [esp + 0x168]
mov dword [esp + 0x1c8], 6
call fcn.004ab565
test bl, bl
je 0x4ecc3d
mov dword [esp + 0x14], 0x6e677962
mov dword [esp + 0x18], 0x57776850
mov dword [esp + 0x1c], 0x6e4d7847
mov dword [esp + 0x20], 0x78464844
mov dword [esp + 0x24], 0x6b4e6d4a
mov dword [esp + 0x28], 0x38465846
mov dword [esp + 0x2c], 0x68596844
mov dword [esp + 0x30], 0x3656424a
mov dword [esp + 0x34], 0x6e38794f
mov dword [esp + 0x38], 0x73356d4a
mov dword [esp + 0x3c], 0x764d794f
mov dword [esp + 0x40], 0x7a41534c
mov dword [esp + 0x44], 0x4e55534a
mov dword [esp + 0x48], 0x59636941
mov dword [esp + 0x4c], 0x6a635246
mov dword [esp + 0x50], 0x31644446
mov dword [esp + 0x54], 0x35424244
mov dword [esp + 0x58], 0x63674342
mov dword [esp + 0x5c], 0x38527746
mov dword [esp + 0x60], 0x374d694a
mov dword [esp + 0x64], 0x6f516d43
mov dword [esp + 0x68], 0x54595745
mov dword [esp + 0x6c], 0x7441414f
mov dword [esp + 0x70], 0x304d524f
mov dword [esp + 0x74], 0x5759694b
mov dword [esp + 0x78], 0x4455544e
mov dword [esp + 0x7c], 0x416f4245
mov dword [esp + 0x80], 0x36306e43
mov dword [esp + 0x84], 0x69346e46
mov dword [esp + 0x88], 0x65456d4a
mov dword [esp + 0x8c], 0x3459774d
mov dword [esp + 0x90], 0x50734146
mov dword [esp + 0x94], 0x69516864
mov dword [esp + 0x98], 0x49454342
mov dword [esp + 0x9c], 0x2f4d6943
mov dword [esp + 0xa0], 0x31777945
mov dword [esp + 0xa4], 0x4c555750
mov dword [esp + 0xa8], 0x6b305241
mov dword [esp + 0xac], 0x2f74514d
mov dword [esp + 0xb0], 0x4b455241
mov dword [esp + 0xb4], 0x3955684e
mov dword [esp + 0xb8], 0x65456d46
mov dword [esp + 0xbc], 0x56556a4e
mov dword [esp + 0xc0], 0x344d7a46
mov dword [esp + 0xc4], 0x54456946
mov dword [esp + 0xc8], 0x6e496e4a
mov dword [esp + 0xcc], 0x41635149
mov dword [esp + 0xd0], 0x3978544c
mov dword [esp + 0xd4], 0x36684259
mov dword [esp + 0xd8], 0x5977774a
mov dword [esp + 0xdc], 0x59677741
mov dword [esp + 0xe0], 0x31675141
mov dword [esp + 0xe4], 0x6c67684e
mov dword [esp + 0xe8], 0x32566e4b
mov dword [esp + 0xec], 0x2b41574e
mov dword [esp + 0xf0], 0x316c5145
mov dword [esp + 0xf4], 0x354a4447
mov dword [esp + 0xf8], 0x6449794c
mov dword [esp + 0xfc], 0x50597961
mov dword [esp + 0x100], 0x4b30444a
mov dword [esp + 0x104], 0x7159414b
mov dword [esp + 0x108], 0x73307843
mov dword [esp + 0x10c], 0x53596947
mov dword [esp + 0x110], 0x6a634246
mov dword [esp + 0x114], 0x57595145
mov dword [esp + 0x118], 0x75636749
mov dword [esp + 0x11c], 0x5141514f
mov dword [esp + 0x120], 0x45306846
mov dword [esp + 0x124], 0x47676a45
mov dword [esp + 0x128], 0x63304263
mov dword [esp + 0x12c], 0x61634344
mov dword [esp + 0x130], 0x33306a47
mov dword [esp + 0x134], 0x71347743
mov dword [esp + 0x138], 0x49735145
mov dword [esp + 0x13c], 0x6d34444e
mov dword [esp + 0x140], 0x64516e63
mov dword [esp + 0x144], 0x56345446
mov dword [esp + 0x148], 0x53735143
mov dword [esp + 0x14c], 0x47514844
mov dword [esp + 0x150], 0x48417966
mov dword [esp + 0x154], 0x3451424f
xor esi, esi
mov dword [esp + 0x158], 0x3345444c
push esi
sub esp, 0xc
mov dword [esp + 0x16c], 0x41517850
mov ecx, esp
mov dword [esp + 0x170], 0x30444141
lea eax, [esp + 0x174]
lea edx, [esp + 0x24]
push ecx
push eax
push edx
call fcn.00450208
lea ecx, [esp + 0x178]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x1cc], 0xb
call fcn.004ab6d2
push eax
mov ecx, edi
call fcn.00521136
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c8], 6
call fcn.004ab565
push dword [edi]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x4ecabd
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4ecabd
push dword [esp + 0x198]
call fcn.0054d1e2
xor eax, eax
mov dword [esp + 0x178], esi
inc eax
mov dword [esp + 0x16c], 0x5d0d7c
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
lea eax, [esp + 0x16c]
mov dword [esp], 0x5f1974
jmp 0x4ec3ca
lea eax, [esp + 0x1a0]
mov dword [esp + 0x1a0], esi
push eax
push dword [esp + 0x1a8]
push ecx
mov ecx, dword [edi]
mov esi, esp
sub ecx, 0x10
call fcn.004c3829
mov edx, dword [esp + 0x1a4]
xor ecx, ecx
add eax, 0x10
inc ecx
mov dword [esi], eax
call fcn.0052d7c6
add esp, 0xc
test eax, eax
jne 0x4ecbf5
mov eax, dword [esp + 0x1a0]
cmp eax, dword [esp + 0x1a4]
jne 0x4ecbf5
push dword [esp + 0x198]
call fcn.0054d1e2
mov esi, dword [esp + 0x188]
lea eax, [esp + 0x1a0]
pop ecx
push eax
mov ecx, edi
mov edx, dword [esi + 0xc]
call fcn.004eb226
pop ecx
test eax, eax
je 0x4ecb78
and dword [esp + 0x174], 0
lea eax, [esp + 0x168]
mov dword [esp + 0x16c], 1
mov dword [esp + 0x170], 3
mov dword [esp + 0x168], 0x5d0d7c
push 0x5f1974
jmp 0x4ec3ca
push dword [edi]
call ebx
test eax, eax
je 0x4ecb88
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x1a8]
mov ecx, edi
call fcn.00521136
push dword [edi]
call ebx
test eax, eax
je 0x4ecba2
mov byte [esi + 0x40], 1
mov ecx, dword [esp + 0x1a8]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [esp + 0x19c]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [esp + 0x1ac]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.0054d1e7
mov esp, ebp
pop ebp
ret 4
push dword [esp + 0x198]
call fcn.0054d1e2
and dword [esp + 0x178], 0
lea eax, [esp + 0x16c]
mov dword [esp + 0x170], 1
mov dword [esp + 0x174], 5
mov dword [esp + 0x16c], 0x5d0d7c
mov dword [esp], 0x5f1974
jmp 0x4ec3ca
and dword [esp + 0x194], 0
lea eax, [esp + 0x188]
mov dword [esp + 0x18c], 1
mov dword [esp + 0x190], 8
mov dword [esp + 0x188], 0x5d0d7c
push 0x5f1974
jmp 0x4ec3ca