Function at 0x452a60
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a06bc
mov eax, dword fs:[0]
push eax
sub esp, 0x2e8
mov eax, dword [0x4cc498]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x452af5
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x45305d
xor eax, eax
mov dword [ebp - 0x27c], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 7
lea edx, [ecx + 2]
mov word [ebp - 0x27c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452b25
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x27c]
call fcn.00404580
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 4], 0
call fcn.0044ceb0
mov byte [ebp - 0x234], 0x2e
mov byte [ebp - 0x233], 0
mov byte [ebp - 0x232], 0x28
mov byte [ebp - 0x231], 0x43
mov byte [ebp - 0x230], 0x50
mov byte [ebp - 0x22f], 0x5e
mov byte [ebp - 0x22e], 0x2f
mov byte [ebp - 0x22d], 0x64
mov byte [ebp - 0x22c], 0x4a
mov byte [ebp - 0x22b], 0x2e
mov byte [ebp - 0x22a], 0x2f
mov byte [ebp - 0x229], 0x64
mov byte [ebp - 0x228], 0x64
mov byte [ebp - 0x227], 0x28
mov byte [ebp - 0x226], 0x21
mov byte [ebp - 0x225], 0x78
mov byte [ebp - 0x224], 0x2c
mov byte [ebp - 0x223], 0x2e
mov byte [ebp - 0x222], 0x21
mov byte [ebp - 0x221], 0x2f
mov byte [ebp - 0x220], 0x43
mov byte [ebp - 0x21f], 0x64
mov byte [ebp - 0x21e], 0x28
mov byte [ebp - 0x21d], 0x50
mov byte [ebp - 0x21c], 0x5e
mov byte [ebp - 0x21b], 0
mov al, byte [ebp - 0x234]
mov byte [ebp - 0x21a], 0
cmp byte [ebp - 0x21a], 0
mov byte [ebp - 4], 1
jne 0x452c66
xor ecx, ecx
mov byte [ebp - 0x21a], 1
lea edi, [ecx + 0x7f]
jmp 0x452c40
mov al, byte [ebp + ecx - 0x234]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + ecx - 0x234], dl
inc ecx
cmp ecx, 0x19
jb 0x452c40
cmp dword [ebp - 0x268], 8
lea ecx, [ebp - 0x27c]
mov eax, dword [ebp - 0x26c]
cmovae ecx, dword [ebp - 0x27c]
lea eax, [ecx + eax*2]
push eax
push ecx
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00453ef0
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452ca4
sub ecx, edx
lea eax, [ebp - 0x234]
push ecx
push eax
lea ecx, [ebp - 0x294]
call fcn.004137d0
mov edx, eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
mov ecx, dword [edx]
mov dword [ebp - 0x24c], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x248], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x244], ecx
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x240], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x23c], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x238], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov edx, dword [ebp - 0x280]
mov byte [ebp - 4], 4
cmp edx, 0x10
jb 0x452d66
mov ecx, dword [ebp - 0x294]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x452d5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x452d5c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0049744e
add esp, 8
cmp dword [ebp - 0x238], 0x10
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x284], 0
cmovae eax, dword [ebp - 0x24c]
push eax
mov dword [ebp - 0x280], 0xf
mov byte [ebp - 0x294], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x452da9
test al, 0x10
jne 0x452e81
cmp dword [ebp - 0x238], 0x10
lea eax, [ebp - 0x24c]
push 0
cmovae eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x452e81
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
mov dword [esi + 0x10], eax
mov byte [esi], al
mov edx, dword [ebp - 0x238]
cmp edx, 0x10
jb 0x452e17
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x452e0d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x452e7b
push edx
push ecx
call fcn.0049744e
add esp, 8
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
call fcn.0044d520
mov edx, dword [ebp - 0x268]
cmp edx, 8
jb 0x45305d
mov ecx, dword [ebp - 0x27c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x453053
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x453053
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [ebp - 0x23c]
mov eax, 0x7fffffff
sub eax, ecx
mov dword [ebp - 0x2e8], ecx
cmp eax, 1
jb 0x45307b
cmp dword [ebp - 0x238], 0x10
lea eax, [ebp - 0x24c]
mov edi, 0xf
mov dword [ebp - 0x264], 0
cmovae eax, dword [ebp - 0x24c]
lea ebx, [ebp - 0x264]
mov dword [ebp - 0x2f4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x2f0], eax
cmp eax, edi
jbe 0x452f2e
mov edi, eax
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x452f01
mov edi, 0x7fffffff
jmp 0x452f0b
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040cbb0
mov ecx, dword [ebp - 0x2e8]
mov ebx, eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x264], ebx
push ecx
push dword [ebp - 0x2f4]
mov dword [ebp - 0x254], eax
push ebx
mov dword [ebp - 0x250], edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x2e8]
add esp, 0xc
mov word [ebx + eax], 0x5c
mov eax, dword [ebp - 0x2ec]
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x452f6b
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x264]
call fcn.004137d0
mov dword [esi], 0
mov edx, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov ecx, dword [edx]
mov dword [esi], ecx
mov ecx, dword [edx + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 8]
mov dword [esi + 8], ecx
mov eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [esi + 0x14], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov edx, dword [ebp - 0x250]
cmp edx, 0x10
jb 0x452ffb
mov ecx, dword [ebp - 0x264]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x452ff1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x452e7b
push edx
push ecx
call fcn.0049744e
add esp, 8
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
cmp edx, 0x10
jb 0x452e17
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x452e0d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x452e7b
jmp 0x452e0d
push edx
push ecx
call fcn.0049744e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049745c
mov esp, ebp
pop ebp
ret
call fcn.00401c50
int3