Function at 0xf33527
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get file attributes
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov byte [ebp - 0x310], 0x6d
mov byte [ebp - 0x30f], 0x69
mov byte [ebp - 0x30e], 0x63
mov byte [ebp - 0x30d], 0x72
mov byte [ebp - 0x30c], 0x6f
mov byte [ebp - 0x30b], 0x63
mov byte [ebp - 0x30a], 0x6f
mov byte [ebp - 0x309], 0x73
mov byte [ebp - 0x308], 0x6d
mov byte [ebp - 0x307], 0
push 0x100
lea eax, [ebp - 0x300]
push eax
push 0xf184f8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0xf33596
jmp 0xf337ae
lea ecx, [ebp - 0x300]
push ecx
call fcn.00f1ac7b
add esp, 4
movsx edx, byte [ebp + eax - 0x301]
cmp edx, 0x5c
je 0xf335c6
push 0xf18508
lea eax, [ebp - 0x300]
push eax
call fcn.00f1aa26
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00f1a2f1
add esp, 4
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x300]
push eax
call fcn.00f1aa26
add esp, 8
lea ecx, [ebp - 0x300]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0xf33612
push 0
lea edx, [ebp - 0x300]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0xf33612
jmp 0xf337ae
push 0xf1850c
lea eax, [ebp - 0x300]
push eax
call fcn.00f1aa26
add esp, 8
mov byte [ebp - 0x100], 0
mov byte [ebp - 0x200], 0
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA_1]
push 0x5c
lea edx, [ebp - 0x100]
push edx
call fcn.00f2fcfc
add esp, 8
test eax, eax
je 0xf33681
push 0x5c
lea eax, [ebp - 0x100]
push eax
call fcn.00f2fcfc
add esp, 8
add eax, 1
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.00f1a9e1
add esp, 8
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x1e0f]
push ecx
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x1e10]
push eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x1e11]
push edx
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x1e14]
push ecx
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x1e13]
push eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x1e12]
push edx
push 0xf18520
lea eax, [ebp - 0x100]
push eax
call dword [fcn.00f47970]
add esp, 0x24
push 0
push 0x80
push 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2901]
push edx
push 3
push 0x40000000
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA_1]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0xffffffff
jne 0xf3371a
jmp 0xf337ae
mov ecx, dword [ebp + 8]
push ecx
call fcn.00f1a4f8
add esp, 4
push 2
push 0
push 0
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer_1]
cmp eax, 0xffffffff
jne 0xf3374d
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
jmp 0xf337ae
push 0
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.00f1ac7b
add esp, 4
push eax
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile_1]
push 0
lea edx, [ebp - 0x304]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00f1ac7b
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile_1]
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov esp, ebp
pop ebp
ret