Function at 0x4a3533
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get file size
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4cfb08
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x517930]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x517930]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, ecx
call fcn.004a1634
push eax
lea ecx, [esp + 0x18]
call fcn.004a10d2
xor ebx, ebx
mov dword [esp + 0x48], ebx
call fcn.004a1634
push eax
lea ecx, [esp + 0x20]
call fcn.004a10d2
push ebx
push ebx
push 3
push ebx
mov byte [esp + 0x58], 1
push ebx
push SysReAllocStringLen
push dword [ebp]
mov dword [esp + 0x44], 0x76697264
mov dword [esp + 0x48], 0x5c737265
mov dword [esp + 0x4c], 0x5c637465
mov dword [esp + 0x50], 0x74736f68
mov word [esp + 0x54], 0x73
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a3803
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004b5495
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4a3803
mov edi, 0x3e8
lea ecx, [esp + 0x1c]
push edi
call fcn.004a1845
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [esp + 0x1c]
push dword [edi - 8]
push edi
call fcn.004b61bd
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004a16ca
mov ecx, dword [ebp]
lea eax, [esp + 0x18]
push eax
push esi
mov edx, ebx
call fcn.004a0f6a
pop ecx
pop ecx
test eax, eax
jne 0x4a364e
push ebx
call fcn.004b5e25
pop ecx
jmp 0x4a3807
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x28]
add eax, ebx
lea edx, [esi + 1]
mov ecx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov al, byte [esi]
inc esi
test al, al
jne 0x4a3665
sub esi, edx
lea eax, [esi - 1]
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.004bad08
add esp, 0xc
test eax, eax
je 0x4a36a7
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
inc ecx
sub eax, esi
mov dword [esp + 0x24], ecx
cmp ecx, eax
jbe 0x4a366e
mov esi, dword [esp + 0x14]
push ebx
call fcn.004b5e25
pop ecx
jmp 0x4a380b
push esi
push dword [0x526078]
push esi
push dword [esp + 0x30]
call fcn.004b5fdb
mov eax, dword [ebp]
add esp, 0x10
cmp dword [eax - 4], 1
jle 0x4a36ce
push dword [eax - 0xc]
mov ecx, ebp
call fcn.004a1735
mov ecx, dword [ebp]
call fcn.004a3915
push dword [esp + 0x18]
mov edx, ebx
mov ecx, ebp
call fcn.004a0efa
pop ecx
test al, al
jne 0x4a3697
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x20
jne 0x4a3755
push str.nib.d
push 0x510d0c
push 0x510d10
push 0x510d14
call fcn.004b7807
push eax
push 0x510ce4
push 0x510d18
push edi
lea eax, [esp + 0x34]
push 0x510d1c
push eax
call fcn.004a6156
push dword [esp + 0x3c]
push dword [ebp]
call fcn.004b7a65
push dword [esp + 0x48]
mov edx, ebx
mov ecx, ebp
call fcn.004a0efa
add esp, 0x34
test al, al
jne 0x4a3753
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4a3755
xor esi, esi
push ebp
lea ecx, [esp + 0x18]
call fcn.004a1034
test esi, esi
je 0x4a3697
mov esi, dword [esp + 0x14]
push 0x5c
push esi
call fcn.004b8333
pop ecx
pop ecx
test eax, eax
jne 0x4a377e
or eax, 0xffffffff
jmp 0x4a3780
sub eax, esi
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.004a57c6
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 2
call fcn.004a1034
mov byte [esp + 0x48], 1
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.004a1719
mov esi, dword [esp + 0x14]
cmp dword [esi - 4], 1
jle 0x4a37c9
push dword [esi - 0xc]
lea ecx, [esp + 0x18]
call fcn.004a1735
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.004a3915
push dword [esp + 0x18]
mov edx, ebx
mov ecx, ebp
call fcn.004a0efa
pop ecx
test al, al
jne 0x4a37ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a37ec
xor eax, eax
cmp dword [esi - 0xc], 4
jl 0x4a369b
test eax, eax
jne 0x4a376b
jmp 0x4a369b
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea ecx, [edi - 0x10]
call fcn.004a1719
lea ecx, [esi - 0x10]
call fcn.004a1719
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004b5580
add esp, 0x38
ret