Function at 0x494820
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497ac7
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x4b7de4
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0
call fcn.0040bf20
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], 0
call fcn.00494760
push ecx
lea eax, [ebp - 0x70]
mov dword [ebp - 0x6a], 0x2d323844
mov ecx, esp
mov word [ebp - 0x59], 0x2d44
push eax
mov dword [ebp - 0x56], 0x31443037
mov dword [ebp - 0x6e], 0x35424132
mov word [ebp - 0x5c], 0x3941
mov dword [ebp - 0x4d], 0x7d3739
mov dword [ebp - 0x64], 0x342d3143
mov dword [ebp - 0x51], 0x44353934
mov word [ebp - 0x70], 0x367b
mov byte [ebp - 0x5a], 0x44
mov word [ebp - 0x5f], 0x3343
mov byte [ebp - 0x5d], 0x2d
mov word [ebp - 0x66], 0x4446
mov byte [ebp - 0x57], 0x30
mov byte [ebp - 0x52], 0x44
mov byte [ebp - 0x60], 0x44
mov dword [ebp - 0xe8], 0
call fcn.0040bf20
lea ecx, [ebp - 0xe8]
call fcn.004945a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x9c]
mov ecx, esp
mov dword [ebp - 0x8c], 0x2d434642
push eax
mov dword [ebp - 0x7e], 0x46394230
mov word [ebp - 0x80], 0x4532
mov dword [ebp - 0x79], 0x7d4538
mov dword [ebp - 0x93], 0x4630412d
mov dword [ebp - 0x88], 0x41343738
mov word [ebp - 0x83], 0x3043
mov dword [ebp - 0x97], 0x46453034
mov byte [ebp - 0x81], 0x46
mov byte [ebp - 0x84], 0x2d
mov dword [ebp - 0x9b], 0x41354337
mov byte [ebp - 0x7a], 0x41
mov word [ebp - 0x8e], 0x342d
mov byte [ebp - 0x8f], 0x42
mov byte [ebp - 0x9c], 0x7b
mov dword [ebp - 0xe0], 0
call fcn.0040bf20
lea ecx, [ebp - 0xe0]
call fcn.004945a0
mov byte [ebp - 4], 2
lea eax, [ebp - 0xc8]
mov ecx, esp
mov dword [ebp - 0xc3], 0x37373339
push eax
mov dword [ebp - 0xbb], 0x34342d30
mov dword [ebp - 0xbf], 0x4641362d
mov dword [ebp - 0xad], 0x46333737
mov dword [ebp - 0xb7], 0x382d6234
mov dword [ebp - 0xb1], 0x33412d37
mov dword [ebp - 0xa8], 0x30303232
mov word [ebp - 0xa4], 0x7d45
mov byte [ebp - 0xa2], 0
mov word [ebp - 0xc5], 0x3038
mov byte [ebp - 0xa9], 0x30
mov word [ebp - 0xc8], 0x367b
mov byte [ebp - 0xc6], 0x44
mov word [ebp - 0xb3], 0x3539
mov dword [ebp - 0xdc], 0
call fcn.0040bf20
lea ecx, [ebp - 0xdc]
call fcn.004945a0
add esp, 4
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xdc]
cmp dword [eax - 0xc], 0
jne 0x494ab8
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xdc]
call fcn.004092a0
push ecx
lea eax, [ebp - 0xd4]
mov word [ebp - 0xd3], 0x7828
push eax
lea ecx, [ebp - 0xdc]
mov word [ebp - 0xd0], 0x2936
mov byte [ebp - 0xd4], 0x20
mov byte [ebp - 0xce], 0
mov byte [ebp - 0xd1], 0x38
call fcn.00408e10
test eax, eax
js 0x494ab8
push 0x4b7de4
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xdc]
call fcn.00408f10
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x3d], 0x6f726843
mov dword [ebp - 0x2e], 0x5c6e6f69
mov dword [ebp - 0x43], 0x6c676f6f
mov word [ebp - 0x21], 0x65
mov dword [ebp - 0x26], 0x652e656d
mov dword [ebp - 0x33], 0x6163696c
mov dword [ebp - 0x37], 0x7070415c
mov byte [ebp - 0x22], 0x78
mov word [ebp - 0x3f], 0x5c65
mov dword [ebp - 0x2a], 0x6f726863
mov byte [ebp - 0x2f], 0x74
mov word [ebp - 0x39], 0x656d
mov byte [ebp - 0x44], 0x47
mov word [ebp - 0x19], 0x7325
mov word [ebp - 0x1c], 0x7325
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x1a], 0x5c
mov dword [ebp - 0xd8], 0
call fcn.0040c650
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xe0]
cmp dword [eax - 4], 1
jle 0x494b54
push dword [eax - 0xc]
lea ecx, [ebp - 0xe0]
call fcn.0040c0f0
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.0040ae40
add esp, 0xc
lea ecx, [ebp - 0xe0]
call fcn.00409300
mov esi, dword [ebp - 0xd8]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
call edi
test eax, eax
jne 0x494cc1
mov eax, dword [ebp - 0xdc]
cmp dword [eax - 4], 1
jle 0x494bae
push dword [eax - 0xc]
lea ecx, [ebp - 0xdc]
call fcn.0040c0f0
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.0040ae40
add esp, 0xc
lea ecx, [ebp - 0xdc]
call fcn.00409300
mov esi, dword [ebp - 0xd8]
push esi
call edi
test eax, eax
jne 0x494cc1
mov eax, dword [ebp - 0xe4]
cmp dword [eax - 4], 1
jle 0x494c02
push dword [eax - 0xc]
lea ecx, [ebp - 0xe4]
call fcn.0040c0f0
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.0040ae40
add esp, 0xc
lea ecx, [ebp - 0xe4]
call fcn.00409300
mov esi, dword [ebp - 0xd8]
push esi
call edi
test eax, eax
jne 0x494cc1
mov eax, dword [ebp - 0xe8]
cmp dword [eax - 4], 1
jle 0x494c56
push dword [eax - 0xc]
lea ecx, [ebp - 0xe8]
call fcn.0040c0f0
mov eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.0040ae40
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00409300
mov esi, dword [ebp - 0xd8]
push esi
call edi
test eax, eax
jne 0x494cc1
lea ecx, [ebp - 0xd8]
call fcn.0040c260
lea ecx, [ebp - 0xdc]
call fcn.0040c260
lea ecx, [ebp - 0xe0]
call fcn.0040c260
lea ecx, [ebp - 0xe8]
call fcn.0040c260
lea ecx, [ebp - 0xe4]
call fcn.0040c260
xor al, al
jmp 0x494d09
push esi
push 0x4b7e5c
push ebx
call fcn.0040ae40
add esp, 0xc
lea ecx, [ebp - 0xd8]
call fcn.0040c260
lea ecx, [ebp - 0xdc]
call fcn.0040c260
lea ecx, [ebp - 0xe0]
call fcn.0040c260
lea ecx, [ebp - 0xe8]
call fcn.0040c260
lea ecx, [ebp - 0xe4]
call fcn.0040c260
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret