Function at 0x8443550
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f7daa
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x400], edi
mov dword [edi], 0
mov dword [edi + 4], 0
lea esi, [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [ebp - 0x29c], esi
call fcn.0840e590
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x84435dc
push 0x80004005
call fcn.0840d910
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.0840e590
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x8443608
push 0x80004005
call fcn.0840d910
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 2
call fcn.0840e590
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x8443638
push 0x80004005
call fcn.0840d910
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 3
call fcn.0840e590
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x8443668
push 0x80004005
call fcn.0840d910
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3f0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x240], 0
movdqu xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x244], 0x10402a88
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
movdqu xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 0x10402a88
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x228], 0x10402a88
mov dword [ebp - 0x224], 0
movq qword [ebp - 0x220], xmm0
mov dword [ebp - 0x220], 0x10402a88
mov dword [ebp - 0x21c], 0
movdqu xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x26c], 0
movdqu xmmword [ebp - 0x260], xmm0
mov byte [ebp - 0x268], 0
mov dword [ebp - 0x264], 2
mov dword [ebp - 0x270], 0x10402a70
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
movdqu xmmword [ebp - 0x290], xmm0
mov dword [ebp - 0x28c], 0
movdqu xmmword [ebp - 0x280], xmm0
mov byte [ebp - 0x288], 0
mov dword [ebp - 0x284], 2
mov dword [ebp - 0x290], 0x10402a70
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
lea eax, [ebp - 0x3fc]
mov byte [ebp - 4], 0xa
push eax
push 0x65
mov byte [ebp - 0x29d], 0
call fcn.084648a0
lea eax, [ebp - 0x404]
push eax
push 0x68
call fcn.084648a0
add esp, 0x10
mov dword [ebp - 0x3ec], 0x714d7948
mov dword [ebp - 0x3e8], 0x754d694d
mov dword [ebp - 0x3e4], 0x6c773346
mov dword [ebp - 0x3e0], 0x37416747
mov dword [ebp - 0x3dc], 0x6d736e47
mov dword [ebp - 0x3d8], 0x37304263
mov dword [ebp - 0x3d4], 0x5930424d
mov dword [ebp - 0x3d0], 0x2f30774f
mov dword [ebp - 0x3cc], 0x56736847
mov dword [ebp - 0x3c8], 0x4155534a
mov dword [ebp - 0x3c4], 0x31734461
mov dword [ebp - 0x3c0], 0x4f635842
mov dword [ebp - 0x3bc], 0x68344146
mov dword [ebp - 0x3b8], 0x71775244
mov dword [ebp - 0x3b4], 0x3777544f
mov dword [ebp - 0x3b0], 0x6b675446
mov dword [ebp - 0x3ac], 0x71303348
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x2a1]
mov dword [ebp - 0x3a8], 0x6d4a7842
sub esp, 0xc
mov dword [ebp - 0x3a4], 0x2b67534e
mov ecx, esp
mov dword [ebp - 0x3a0], 0x4151474a
mov dword [ebp - 0x39c], 0x47345162
mov dword [ebp - 0x398], 0x77305249
push dword [ebp - 0x400]
mov dword [ebp - 0x394], 0x34735441
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x390], 0x57415349
mov dword [ebp - 0x38c], 0x326b445a
mov dword [ebp - 0x388], 0x2f70524d
mov dword [ebp - 0x384], 0x41674847
mov dword [ebp - 0x380], 0x55595841
mov dword [ebp - 0x37c], 0x76596a47
mov dword [ebp - 0x378], 0x4e4d6943
mov dword [ebp - 0x374], 0x794d4144
mov dword [ebp - 0x370], 0x51595145
mov dword [ebp - 0x36c], 0x6877534d
mov dword [ebp - 0x368], 0x2f676a41
mov dword [ebp - 0x364], 0x6d6f6841
mov dword [ebp - 0x360], 0x6c775245
mov dword [ebp - 0x35c], 0x4763425a
mov dword [ebp - 0x358], 0x41595241
mov dword [ebp - 0x354], 0x76557950
mov dword [ebp - 0x350], 0x444d514b
mov dword [ebp - 0x34c], 0x31396e44
mov dword [ebp - 0x348], 0x57386d46
mov dword [ebp - 0x344], 0x6b6c6d4a
mov dword [ebp - 0x340], 0x316b6e42
mov dword [ebp - 0x33c], 0x41636750
mov dword [ebp - 0x338], 0x58494345
mov dword [ebp - 0x334], 0x7173424e
mov dword [ebp - 0x330], 0x6349544b
mov dword [ebp - 0x32c], 0x3151544e
mov dword [ebp - 0x328], 0x6f6b524f
mov dword [ebp - 0x324], 0x72305845
mov dword [ebp - 0x320], 0x72305266
mov dword [ebp - 0x31c], 0x6c687941
mov dword [ebp - 0x318], 0x42453345
mov dword [ebp - 0x314], 0x65777a61
mov dword [ebp - 0x310], 0x38556948
mov dword [ebp - 0x30c], 0x6f6b4142
mov dword [ebp - 0x308], 0x3463424b
mov dword [ebp - 0x304], 0x70674346
mov dword [ebp - 0x300], 0x6846684d
mov dword [ebp - 0x2fc], 0x68307a45
mov dword [ebp - 0x2f8], 0x6b674161
mov dword [ebp - 0x2f4], 0x616f694f
mov dword [ebp - 0x2f0], 0x3259414e
mov dword [ebp - 0x2ec], 0x34384448
mov dword [ebp - 0x2e8], 0x4c51514a
mov dword [ebp - 0x2e4], 0x5a6f4250
mov dword [ebp - 0x2e0], 0x4a514441
mov dword [ebp - 0x2dc], 0x464d6849
mov dword [ebp - 0x2d8], 0x7059514e
mov dword [ebp - 0x2d4], 0x306f674e
mov dword [ebp - 0x2d0], 0x4a556e48
mov dword [ebp - 0x2cc], 0x78414344
mov dword [ebp - 0x2c8], 0x32733349
mov dword [ebp - 0x2c4], 0x74705448
mov dword [ebp - 0x2c0], 0x4538524e
mov dword [ebp - 0x2bc], 0x4b634350
mov dword [ebp - 0x2b8], 0x6f305464
mov dword [ebp - 0x2b4], 0x556b7948
mov dword [ebp - 0x2b0], 0x76306741
mov dword [ebp - 0x2ac], 0x31346862
mov dword [ebp - 0x2a8], 0x4141414b
mov word [ebp - 0x2a4], 0x4f41
mov byte [ebp - 0x2a2], 0x73
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.08405280
lea eax, [ebp - 0x414]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov byte [ebp - 4], 0xb
sar eax, 1
jne 0x8443bc5
push str.invalid_vector_T__subscript
call fcn.0847ecf2
push ecx
lea eax, [ebp - 0x3f0]
push eax
call fcn.0844c800
mov eax, dword [ebp - 0x414]
add esp, 0xc
mov byte [ebp - 4], 0xa
test eax, eax
je 0x8443bec
push eax
call fcn.0849b460
add esp, 4
mov esi, dword [ebp - 0x3f0]
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x474]
push eax
call fcn.08479040
add esp, 4
push 0
mov ecx, 1
mov byte [ebp - 4], 0xc
push 0x100000
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x3f4], ecx
lea ecx, [ebp - 0x270]
push eax
call fcn.08447080
test al, al
je 0x8443c8f
lea eax, [ebp - 0x4d4]
push eax
call fcn.0846ec80
add esp, 4
push 0
mov ecx, 3
mov dword [ebp - 4], 0xd
push 0x100000
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x3f4], ecx
lea ecx, [ebp - 0x270]
push eax
call fcn.08447080
mov byte [ebp - 0x291], 1
test al, al
jne 0x8443c96
mov byte [ebp - 0x291], 0
mov eax, dword [ebp - 0x298]
test al, 2
je 0x8443cba
and eax, 0xfffffffd
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x298], eax
call fcn.084451e0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 4], 0xa
test al, 1
je 0x8443cd9
and eax, 0xfffffffe
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x298], eax
call fcn.084451e0
cmp byte [ebp - 0x291], 0
je 0x8443d3f
push 1
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x228]
call fcn.0846cdc0
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x244]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x8443d1b
push eax
lea ecx, [ebp - 0x244]
call fcn.0845f2d0
mov eax, dword [ebp - 0x240]
mov cl, 1
mov dword [ebp - 0x250], 0xc
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], 1
jmp 0x8443d45
mov cl, byte [ebp - 0x29d]
cmp dword [ebp - 0x3f8], 2
jne 0x8444048
xor edx, edx
lea eax, [ebp - 0x250]
push esi
test cl, cl
push 0
cmove eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 8], eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x8443dbe
mov edi, dword [ebp - 0x29c]
mov ecx, edi
call fcn.0840e1d0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x8443da0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x8443da0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.08448bb0
mov edi, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x29c]
push edi
call fcn.08448ad0
push dword [ebp - 0x29c]
call fcn.0844ad10
sub esp, 8
mov dword [ebp - 0x374], 0x6f6f434c
mov ecx, esp
mov dword [ebp - 0x370], 0x51634849
lea eax, [ebp - 0x2a2]
mov dword [ebp - 0x36c], 0x41343263
mov dword [ebp - 0x368], 0x5a6f6a41
push dword [ebp - 0x400]
mov dword [ebp - 0x364], 0x596b6747
push eax
lea eax, [ebp - 0x374]
mov dword [ebp - 0x360], 0x6d455165
mov dword [ebp - 0x35c], 0x6c6b5342
mov dword [ebp - 0x358], 0x3741674d
mov dword [ebp - 0x354], 0x6559424d
mov dword [ebp - 0x350], 0x2f4d7747
mov dword [ebp - 0x34c], 0x666b794e
mov dword [ebp - 0x348], 0x49594848
mov dword [ebp - 0x344], 0x67777842
mov dword [ebp - 0x340], 0x3051434e
mov dword [ebp - 0x33c], 0x43344448
mov dword [ebp - 0x338], 0x61413241
mov dword [ebp - 0x334], 0x686b774b
mov dword [ebp - 0x330], 0x37736742
mov dword [ebp - 0x32c], 0x39316a47
mov dword [ebp - 0x328], 0x68524759
mov dword [ebp - 0x324], 0x6d306e61
mov dword [ebp - 0x320], 0x4e63694f
mov dword [ebp - 0x31c], 0x76417a50
mov dword [ebp - 0x318], 0x72314842
mov dword [ebp - 0x314], 0x76555349
mov dword [ebp - 0x310], 0x6d344246
mov dword [ebp - 0x30c], 0x6230784b
mov dword [ebp - 0x308], 0x38344349
mov dword [ebp - 0x304], 0x42595359
mov dword [ebp - 0x300], 0x5a734248
mov dword [ebp - 0x2fc], 0x78556941
mov dword [ebp - 0x2f8], 0x76685347
mov dword [ebp - 0x2f4], 0x46456a65
mov dword [ebp - 0x2f0], 0x52555145
mov dword [ebp - 0x2ec], 0x3673435a
mov dword [ebp - 0x2e8], 0x6a455744
mov dword [ebp - 0x2e4], 0x6938784a
mov dword [ebp - 0x2e0], 0x70775341
mov dword [ebp - 0x2dc], 0x65456962
mov dword [ebp - 0x2d8], 0x34453341
mov dword [ebp - 0x2d4], 0x7367544e
mov dword [ebp - 0x2d0], 0x6c735241
mov dword [ebp - 0x2cc], 0x536b434a
mov dword [ebp - 0x2c8], 0x37414842
mov dword [ebp - 0x2c4], 0x35596747
mov dword [ebp - 0x2c0], 0x63734145
mov dword [ebp - 0x2bc], 0x6e59414f
mov dword [ebp - 0x2b8], 0x6e705245
mov dword [ebp - 0x2b4], 0x67637744
mov dword [ebp - 0x2b0], 0x3678444a
mov dword [ebp - 0x2ac], 0x704d4362
mov dword [ebp - 0x2a8], 0x41414141
mov word [ebp - 0x2a4], 0x516c
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.08405280
lea eax, [ebp - 0x414]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov byte [ebp - 4], 0xe
sar eax, 1
jne 0x84440b4
push str.invalid_vector_T__subscript
call fcn.0847ecf2
test cl, cl
je 0x8443d6c
cmp dword [esi - 4], 1
jle 0x844406a
push dword [esi - 0xc]
lea ecx, [ebp - 0x3f0]
call fcn.0840e2d0
mov esi, dword [ebp - 0x3f0]
push 0
lea ecx, [ebp - 0x270]
call fcn.084559c0
push eax
push 0
push 0
push 4
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push dword [esi - 8]
push esi
call fcn.0849f12f
add esp, 8
test eax, eax
js 0x84440aa
cmp eax, dword [esi - 8]
jg 0x84440aa
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x8443d6c
push 0x80070057
call fcn.0840d910
push ecx
mov ecx, dword [ebp - 0x29c]
call fcn.08448ad0
mov eax, dword [ebp - 0x414]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x84440d7
push eax
call fcn.0849b460
add esp, 4
lea eax, [ebp - 0x4d4]
push eax
call fcn.08479040
add esp, 4
mov ecx, dword [ebp - 0x298]
or ecx, 4
mov byte [ebp - 4], 0xf
push 0
push 0x101f0000
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x3f4], ecx
lea ecx, [ebp - 0x290]
push eax
call fcn.08447080
test al, al
je 0x844415f
lea eax, [ebp - 0x474]
push eax
call fcn.0846ec80
add esp, 4
mov ecx, dword [ebp - 0x298]
or ecx, 8
mov dword [ebp - 4], 0x10
push 0
push 0x101f0000
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x3f4], ecx
lea ecx, [ebp - 0x290]
push eax
call fcn.08447080
mov byte [ebp - 0x291], 1
test al, al
jne 0x8444166
mov byte [ebp - 0x291], 0
mov eax, dword [ebp - 0x298]
test al, 8
je 0x844418a
and eax, 0xfffffff7
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x298], eax
call fcn.084451e0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 4], 0xa
test al, 4
je 0x84441a0
lea ecx, [ebp - 0x4d4]
call fcn.084451e0
cmp byte [ebp - 0x291], 0
je 0x844426e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x220]
call fcn.0846cdc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x84441f2
push eax
lea ecx, [ebp - 0x230]
call fcn.0845f2d0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x23c], 0xc
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x29c]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x8444248
push dword [ebp - 0x21c]
mov eax, dword [ebp - 0x29c]
push 4
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x844426e
push 0
push 0
push 1
lea eax, [ebp - 0x23c]
push eax
mov eax, dword [ebp - 0x29c]
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x290]
call fcn.08444fe0
lea ecx, [ebp - 0x270]
call fcn.08444fe0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x10402a88
call fcn.0844a430
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], 0x10402a88
call fcn.0844a430
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x230], 0x10402a88
call fcn.0844a430
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], 0x10402a88
call fcn.0844a430
lea edx, [esi - 0x10]
mov byte [ebp - 4], 3
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x84442f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 2
mov ecx, esi
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x8444315
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x3fc]
add edi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x8444336
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret