Function at 0x4ed183
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file

Disassembly:
push 0x144
mov eax, 0x5b1002
call fcn.00553bf3
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call fcn.0045082c
push eax
lea ecx, [ebp - 0x14]
call fcn.004c3be8
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x144]
push dword [esi]
call fcn.004c2861
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push dword [eax]
push dword [edi]
call fcn.0052fd0b
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x144]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ed4e3
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x4ed4e3
push ebx
push ebx
sub esp, 0xc
mov dword [ebp - 0x140], 0x35567861
mov ecx, esp
mov dword [ebp - 0x13c], 0x756f674b
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x138], 0x684d5345
mov dword [ebp - 0x134], 0x774e484e
lea edx, [ebp - 0x140]
push ecx
mov dword [ebp - 0x130], 0x695a4347
mov dword [ebp - 0x12c], 0x56454145
mov dword [ebp - 0x128], 0x51674244
mov dword [ebp - 0x124], 0x52594141
mov dword [ebp - 0x120], 0x38354842
mov dword [ebp - 0x11c], 0x344d5145
mov dword [ebp - 0x118], 0x6430414b
mov dword [ebp - 0x114], 0x30524743
mov dword [ebp - 0x110], 0x554d514b
mov dword [ebp - 0x10c], 0x48636847
mov dword [ebp - 0x108], 0x31735263
mov dword [ebp - 0x104], 0x335a7742
mov dword [ebp - 0x100], 0x79424447
mov dword [ebp - 0xfc], 0x2b774165
mov dword [ebp - 0xf8], 0x65736e47
mov dword [ebp - 0xf4], 0x55497746
mov dword [ebp - 0xf0], 0x71556a4a
mov dword [ebp - 0xec], 0x786c4442
mov dword [ebp - 0xe8], 0x39414442
mov dword [ebp - 0xe4], 0x6f416a48
mov dword [ebp - 0xe0], 0x4567474c
mov dword [ebp - 0xdc], 0x50675161
mov dword [ebp - 0xd8], 0x50415444
mov dword [ebp - 0xd4], 0x37396764
mov dword [ebp - 0xd0], 0x2f733342
mov dword [ebp - 0xcc], 0x6c636965
mov dword [ebp - 0xc8], 0x61516741
mov dword [ebp - 0xc4], 0x564d7966
mov dword [ebp - 0xc0], 0x78776743
mov dword [ebp - 0xbc], 0x496f4265
mov dword [ebp - 0xb8], 0x44637863
mov dword [ebp - 0xb4], 0x39455441
mov dword [ebp - 0xb0], 0x73414742
mov dword [ebp - 0xac], 0x36686e4f
mov dword [ebp - 0xa8], 0x4751535a
mov dword [ebp - 0xa4], 0x34636847
mov dword [ebp - 0xa0], 0x4251474f
mov dword [ebp - 0x9c], 0x766f7847
mov dword [ebp - 0x98], 0x704d784a
mov dword [ebp - 0x94], 0x48416764
mov dword [ebp - 0x90], 0x4c307a4d
mov dword [ebp - 0x8c], 0x79314150
mov dword [ebp - 0x88], 0x46345247
mov dword [ebp - 0x84], 0x6534794e
mov dword [ebp - 0x80], 0x424d6961
mov dword [ebp - 0x7c], 0x6c4a7947
mov dword [ebp - 0x78], 0x30496742
mov dword [ebp - 0x74], 0x4a306742
mov dword [ebp - 0x70], 0x384e7759
mov dword [ebp - 0x6c], 0x486b5349
mov dword [ebp - 0x68], 0x38495145
mov dword [ebp - 0x64], 0x5755514c
mov dword [ebp - 0x60], 0x7a73444d
mov dword [ebp - 0x5c], 0x74347966
mov dword [ebp - 0x58], 0x5534515a
mov dword [ebp - 0x54], 0x51555163
mov dword [ebp - 0x50], 0x5245534c
mov dword [ebp - 0x4c], 0x4c385243
mov dword [ebp - 0x48], 0x534d4844
mov dword [ebp - 0x44], 0x33514841
mov dword [ebp - 0x40], 0x44636941
mov dword [ebp - 0x3c], 0x70387946
mov dword [ebp - 0x38], 0x39674444
mov dword [ebp - 0x34], 0x6e41794e
mov dword [ebp - 0x30], 0x6959544a
mov dword [ebp - 0x2c], 0x6845534a
mov dword [ebp - 0x28], 0x626f3243
mov dword [ebp - 0x24], 0x416f4142
mov dword [ebp - 0x20], 0x57444141
push eax
push edx
call fcn.00450208
lea ecx, [ebp - 0x150]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004ab6d2
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.0052c952
pop ecx
lea ecx, [ebp - 0x150]
mov esi, eax
call fcn.004ab565
test esi, esi
mov esi, dword [ebp - 0x14]
sete bl
jmp 0x4ed740
push ebx
sub esp, 0xc
mov dword [ebp - 0x108], 0x38457a62
mov ecx, esp
mov dword [ebp - 0x104], 0x69386e4e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x100], 0x6441524f
lea edx, [ebp - 0x108]
mov dword [ebp - 0xfc], 0x55494442
push ecx
push eax
push edx
mov dword [ebp - 0xf8], 0x6a6c774e
mov dword [ebp - 0xf4], 0x794a334a
mov dword [ebp - 0xf0], 0x35426d50
mov dword [ebp - 0xec], 0x3651484b
mov dword [ebp - 0xe8], 0x7349514d
mov dword [ebp - 0xe4], 0x57555166
mov dword [ebp - 0xe0], 0x55414341
mov dword [ebp - 0xdc], 0x4651444c
mov dword [ebp - 0xd8], 0x54597864
mov dword [ebp - 0xd4], 0x76567a41
mov dword [ebp - 0xd0], 0x69637a4c
mov dword [ebp - 0xcc], 0x426f6749
mov dword [ebp - 0xc8], 0x6b6b5445
mov dword [ebp - 0xc4], 0x6c4a684a
mov dword [ebp - 0xc0], 0x4f776e42
mov dword [ebp - 0xbc], 0x73747a42
mov dword [ebp - 0xb8], 0x2b425745
mov dword [ebp - 0xb4], 0x37594446
mov dword [ebp - 0xb0], 0x6d457859
mov dword [ebp - 0xac], 0x59346950
mov dword [ebp - 0xa8], 0x35415263
mov dword [ebp - 0xa4], 0x7a70534e
mov dword [ebp - 0xa0], 0x3546674d
mov dword [ebp - 0x9c], 0x70594150
mov dword [ebp - 0x98], 0x3655334f
mov dword [ebp - 0x94], 0x6d524150
mov dword [ebp - 0x90], 0x5863694e
mov dword [ebp - 0x8c], 0x6e737a4a
mov dword [ebp - 0x88], 0x32746966
mov dword [ebp - 0x84], 0x71306941
mov dword [ebp - 0x80], 0x554d6842
mov dword [ebp - 0x7c], 0x5230434e
mov dword [ebp - 0x78], 0x7a306759
mov dword [ebp - 0x74], 0x346b534b
mov dword [ebp - 0x70], 0x34307a49
mov dword [ebp - 0x6c], 0x4d55694c
mov dword [ebp - 0x68], 0x4a4d7841
mov dword [ebp - 0x64], 0x4d305265
mov dword [ebp - 0x60], 0x4e67484c
mov dword [ebp - 0x5c], 0x78514449
mov dword [ebp - 0x58], 0x39416741
mov dword [ebp - 0x54], 0x304d5163
mov dword [ebp - 0x50], 0x3677525a
mov dword [ebp - 0x4c], 0x37304242
mov dword [ebp - 0x48], 0x59737a46
mov dword [ebp - 0x44], 0x58556950
mov dword [ebp - 0x40], 0x39684265
mov dword [ebp - 0x3c], 0x446f4165
mov dword [ebp - 0x38], 0x4f6f4166
mov dword [ebp - 0x34], 0x6d514849
mov dword [ebp - 0x30], 0x6a784263
mov dword [ebp - 0x2c], 0x57415843
mov dword [ebp - 0x28], 0x4941435a
mov dword [ebp - 0x24], 0x416b674b
mov dword [ebp - 0x20], 0x70434141
call fcn.00450208
lea ecx, [ebp - 0x150]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004ab6d2
push eax
lea ecx, [ebp - 0x14]
call fcn.00521136
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], bl
call fcn.004ab565
mov esi, dword [ebp - 0x14]
push esi
call edi
test eax, eax
je 0x4ed740
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00450c0a
mov eax, ebx
call fcn.00553ba2
ret