Function at 0x463600
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get file attributes
Get file size
Read file via mapping
Resolve function by parsing pe exports
Set file attributes
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x61b3cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
push ebx
push ebp
push esi
push edi
or ebx, 0xffffffff
push str.shell32
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
xor edi, edi
cmp ebp, edi
je 0x4637e0
push str.SHGetFolderPathW
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x4637d4
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x144]
push eax
push edi
push edi
push 0x24
push edi
call esi
cmp eax, edi
jne 0x4637ce
lea ecx, [esp + 0x144]
push ecx
call fcn.005e71bf
add esp, 4
cmp word [esp + eax*2 + 0x142], 0x5c
je 0x4636a1
lea edx, [esp + 0x144]
push 0x6a115c
push edx
call fcn.005e735f
add esp, 8
call fcn.004466f0
test eax, eax
je 0x4636b9
lea eax, [esp + 0x144]
push str.Sysnative
push eax
jmp 0x4636c6
lea ecx, [esp + 0x144]
push str.System32
push ecx
call fcn.005e735f
mov edx, 0x129
mov eax, 0x13c
mov word [esp + 0x36], dx
mov word [esp + 0x3e], dx
mov word [esp + 0x30], ax
mov word [esp + 0x38], ax
mov edx, 0x13e
mov eax, 0x13f
add esp, 8
mov word [esp + 0x38], dx
mov word [esp + 0x44], dx
mov word [esp + 0x32], ax
mov word [esp + 0x42], ax
mov word [esp + 0x46], ax
lea edx, [esp + 0x24]
lea eax, [esp + 0x34c]
mov ecx, 0x116
push edx
push eax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], 0x12e
mov word [esp + 0x32], 0x125
mov word [esp + 0x34], 0x138
mov word [esp + 0x3c], cx
mov word [esp + 0x42], 0x12f
mov word [esp + 0x44], cx
mov word [esp + 0x46], 0x12a
mov word [esp + 0x48], 0x123
mov word [esp + 0x50], di
call fcn.005e7389
lea ecx, [esp + 0x354]
push ecx
call fcn.005e71bf
add esp, 0xc
cmp eax, edi
jle 0x463796
lea ecx, [esp + 0x34c]
mov dx, word [ecx]
add ecx, 2
xor dx, 0x4d
sub edx, 0xff
dec eax
mov word [ecx - 2], dx
jne 0x46377f
lea eax, [esp + 0x34c]
lea ecx, [esp + 0x144]
push eax
push ecx
call fcn.005e735f
add esp, 8
lea edx, [esp + 0x144]
push edi
push edi
push 3
push edi
push 3
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 0xffffffff
jne 0x4637ea
mov eax, 1
jmp 0x463eca
lea eax, [esp + 0x8c]
mov dword [esp + 0x4c], 1
push eax
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x94], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x463821
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x463a0b
mov ecx, dword [esp + 0x8c]
push edi
push ebp
push ecx
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x463a09
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x463a02
lea esi, [ebp + 1]
push esi
mov dword [esp + 0x54], esi
call fcn.005ffe3f
push esi
mov ebx, eax
call fcn.005ffe3f
add esp, 8
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x4639f3
test eax, eax
je 0x4639f3
lea edx, [esp + 0x54]
mov byte [esp + 0x54], 0x21
push edx
mov byte [esp + 0x59], 0x66
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], 0x7b
mov byte [esp + 0x5c], 0x6a
mov byte [esp + 0x5d], 0x7d
mov byte [esp + 0x5e], 0x61
mov byte [esp + 0x5f], 0x6a
mov byte [esp + 0x60], 0x7b
mov byte [esp + 0x61], 0x6b
mov byte [esp + 0x62], 0x60
mov byte [esp + 0x63], 0x78
mov byte [esp + 0x64], 0x61
mov byte [esp + 0x65], 0x63
mov byte [esp + 0x66], 0x60
mov byte [esp + 0x67], 0x6e
mov byte [esp + 0x68], 0x6b
mov byte [esp + 0x69], 0x62
mov byte [esp + 0x6a], 0x6e
mov byte [esp + 0x6b], 0x61
mov byte [esp + 0x6c], 0x6e
mov byte [esp + 0x6d], 0x68
mov byte [esp + 0x6e], 0x6a
mov byte [esp + 0x6f], 0x7d
mov byte [esp + 0x70], 0x21
mov byte [esp + 0x71], 0x6c
mov byte [esp + 0x72], 0x60
mov byte [esp + 0x73], 0x62
mov byte [esp + 0x74], 0
call fcn.005beb00
mov esi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], 0
mov al, byte [ebx]
test al, al
mov esi, ebx
je 0x4639dc
push 0xa
push esi
call fcn.005e71f0
add esp, 8
test eax, eax
je 0x46397a
mov ebp, dword [esp + 0x10]
mov edi, eax
sub edi, esi
lea ecx, [edi + 1]
push ecx
push esi
push ebp
call fcn.005e7540
add esp, 0xc
mov byte [edi + ebp + 1], 0
jmp 0x463995
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x10]
lea edx, [edi - 1]
push edx
push esi
push ebp
call fcn.005e7540
add esp, 0xc
mov byte [edi + ebp - 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add esi, ecx
mov al, byte [edi]
cmp al, 0x20
je 0x4639af
cmp al, 9
jne 0x4639b2
inc edi
jmp 0x4639a5
cmp byte [edi], 0x23
je 0x4639d3
push ebp
call fcn.005e993b
lea eax, [esp + 0x58]
push eax
push edi
call fcn.005e72b0
add esp, 0xc
test eax, eax
jne 0x463cd2
cmp byte [esi], 0
jne 0x46394e
mov ebp, dword [esp + 0x10]
push ebx
call fcn.005ffe68
push ebp
call fcn.005ffe68
mov edi, dword [esp + 0x20]
add esp, 8
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], edi
je 0x463ec6
mov eax, dword [esp + 0x45c]
mov esi, 0x6d2abc
cmp eax, edi
jne 0x463a31
mov esi, 0x6d2ac0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.006003a2
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [esp + 0xa0]
call fcn.00431d60
lea ecx, [esp + 0x98]
mov dword [esp + 0x454], edi
call fcn.005ffa36
cmp eax, 1
jne 0x463e75
lea edx, [esp + 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x463a92
test al, 1
je 0x463a92
xor eax, 1
push eax
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push edi
push 3
push edi
push 3
lea ecx, [esp + 0x158]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x90], edi
je 0x463e12
lea edx, [esp + 0x20]
xor esi, esi
push edx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x463ae9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x463da9
mov eax, dword [esp + 0x20]
push esi
push ebp
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x84], ebx
je 0x463da9
push 0
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x463d9e
lea eax, [ebp + 1]
push eax
mov dword [esp + 0x54], eax
call fcn.005ffe3f
mov ecx, dword [esp + 0x54]
mov ebx, eax
push ecx
call fcn.005ffe3f
add esp, 8
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x463d90
test eax, eax
je 0x463d90
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
mov byte [esp + 0x28], 0x21
mov byte [esp + 0x29], 0x66
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x7b
mov byte [esp + 0x2c], 0x6a
mov byte [esp + 0x2d], 0x7d
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], 0x6a
mov byte [esp + 0x30], 0x7b
mov byte [esp + 0x31], 0x6b
mov byte [esp + 0x32], 0x60
mov byte [esp + 0x33], 0x78
mov byte [esp + 0x34], 0x61
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], 0x60
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x6b
mov byte [esp + 0x39], 0x62
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x6e
mov byte [esp + 0x3d], 0x68
mov byte [esp + 0x3e], 0x6a
mov byte [esp + 0x3f], 0x7d
mov byte [esp + 0x40], 0x21
mov byte [esp + 0x41], 0x6c
mov byte [esp + 0x42], 0x60
mov byte [esp + 0x43], 0x62
mov byte [esp + 0x44], 0
call fcn.005beb00
lea eax, [esp + 0x78]
mov byte [esp + 0x78], 0x7d
push eax
mov byte [esp + 0x7d], 0x6a
mov byte [esp + 0x7e], 0x68
mov byte [esp + 0x7f], 0x66
mov byte [esp + 0x80], 0x7c
mov byte [esp + 0x81], 0x7b
mov byte [esp + 0x82], 0x6a
mov byte [esp + 0x83], 0x7d
mov byte [esp + 0x84], 0x66
mov byte [esp + 0x85], 0x6b
mov byte [esp + 0x86], 0x62
mov byte [esp + 0x87], 0x21
mov byte [esp + 0x88], 0x6c
mov byte [esp + 0x89], 0x60
mov byte [esp + 0x8a], 0x62
mov byte [esp + 0x8b], 0
call fcn.005beb00
mov ecx, ebp
mov edi, ebx
mov edx, ecx
add esp, 8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x10], 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], 0
mov al, byte [ebx]
test al, al
mov esi, ebx
je 0x463d72
push 0xa
push esi
call fcn.005e71f0
add esp, 8
test eax, eax
je 0x463cdf
mov ebp, dword [esp + 0x14]
mov edi, eax
sub edi, esi
lea eax, [edi + 1]
push eax
push esi
push ebp
call fcn.005e7540
add esp, 0xc
mov byte [edi + ebp + 1], 0
jmp 0x463cfa
mov dword [esp + 0x20], 1
jmp 0x4639e0
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x14]
lea ecx, [edi - 1]
push ecx
push esi
push ebp
call fcn.005e7540
add esp, 0xc
mov byte [edi + ebp - 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add esi, ecx
mov al, byte [edi]
cmp al, 0x20
je 0x463d14
cmp al, 9
jne 0x463d17
inc edi
jmp 0x463d0a
cmp byte [edi], 0x23
je 0x463d52
push ebp
call fcn.005e993b
lea edx, [esp + 0x28]
push edx
push edi
call fcn.005e72b0
add esp, 0xc
test eax, eax
jne 0x463d46
lea edx, [esp + 0x74]
push edx
push edi
call fcn.005e72b0
add esp, 8
test eax, eax
je 0x463d52
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov byte [ecx + eax], 0x23
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
dec ecx
add eax, ecx
mov dword [esp + 0x10], eax
mov al, byte [esi]
test al, al
jne 0x463ca6
push ebx
call fcn.005ffe68
mov edx, dword [esp + 0x18]
push edx
call fcn.005ffe68
mov edi, dword [esp + 0x98]
mov esi, dword [esp + 0x24]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x84]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test esi, esi
je 0x463e07
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x84]
lea edx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
lea edx, [esp + 0x84]
mov dword [esp + 0x90], eax
push edx
lea eax, [esp + 0x94]
push 0
push eax
push edi
mov dword [esp + 0xa4], ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x463e79
mov eax, dword [0x6d2324]
mov dword [esp + 0x4c], 0
test eax, eax
je 0x463e79
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x18]
push ecx
push 0x635748
push 0x635758
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.00495370
add esp, 0x10
test eax, eax
jne 0x463e6d
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 0x34]
test eax, eax
jne 0x463e63
mov dword [esp + 0x4c], 1
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x463e79
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x140]
mov dword [esp + 0x454], 3
call fcn.00603a3c
lea ecx, [esp + 0xf4]
mov dword [esp + 0x130], 0x632e74
mov byte [esp + 0x454], 1
call fcn.0060b545
lea ecx, [esp + 0x98]
mov dword [esp + 0x454], 0xffffffff
call fcn.005ff677
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x448
ret