Function at 0x4ed750
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b1083
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x5f4748]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x5f4748]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0xc]
and dword [esp + 0x264], 0
call fcn.0045082c
push eax
lea ecx, [esp + 0x268]
call fcn.004c3be8
and dword [esp + 0x278], 0
lea ecx, [esp + 0x260]
push dword [esi]
call fcn.004c2861
mov byte [esp + 0x278], 1
lea ecx, [esp + 0x264]
push dword [eax]
push dword [edi]
call fcn.0052fd0b
mov byte [esp + 0x278], 0
mov ecx, dword [esp + 0x260]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov esi, dword [esp + 0x264]
mov ecx, esi
call fcn.0052f739
test eax, eax
je 0x4edf0b
and dword [esp + 0x25c], 0
lea ecx, [esp + 0x25c]
push esi
call fcn.004c3491
mov byte [esp + 0x278], 2
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x4edc67
push 0
sub esp, 0xc
mov dword [esp + 0x12c], 0x364a6d48
mov dword [esp + 0x130], 0x4d45434a
lea edx, [esp + 0x12c]
mov dword [esp + 0x134], 0x78355243
lea eax, [esp + 0x25c]
mov dword [esp + 0x138], 0x6c417866
mov ecx, esp
mov dword [esp + 0x13c], 0x4367574d
mov dword [esp + 0x140], 0x47496e45
mov dword [esp + 0x144], 0x35516845
mov dword [esp + 0x148], 0x3738784f
mov dword [esp + 0x14c], 0x666f5459
mov dword [esp + 0x150], 0x3749534f
mov dword [esp + 0x154], 0x39424765
mov dword [esp + 0x158], 0x586f544f
mov dword [esp + 0x15c], 0x4e38534a
mov dword [esp + 0x160], 0x4a6b414a
mov dword [esp + 0x164], 0x69674365
mov dword [esp + 0x168], 0x4b59784e
mov dword [esp + 0x16c], 0x50515241
mov dword [esp + 0x170], 0x4438584c
mov dword [esp + 0x174], 0x42346750
mov dword [esp + 0x178], 0x44554249
mov dword [esp + 0x17c], 0x2f77524d
mov dword [esp + 0x180], 0x65676a43
mov dword [esp + 0x184], 0x73775745
mov dword [esp + 0x188], 0x52595842
mov dword [esp + 0x18c], 0x564d6d4a
mov dword [esp + 0x190], 0x32514450
mov dword [esp + 0x194], 0x69346749
mov dword [esp + 0x198], 0x4e49784a
mov dword [esp + 0x19c], 0x6945694f
mov dword [esp + 0x1a0], 0x58344266
mov dword [esp + 0x1a4], 0x66634465
mov dword [esp + 0x1a8], 0x77315141
mov dword [esp + 0x1ac], 0x396b794c
mov dword [esp + 0x1b0], 0x786b5347
mov dword [esp + 0x1b4], 0x6a55514c
mov dword [esp + 0x1b8], 0x32565366
mov dword [esp + 0x1bc], 0x676b684a
mov dword [esp + 0x1c0], 0x53414765
mov dword [esp + 0x1c4], 0x3830514b
mov dword [esp + 0x1c8], 0x666f6a47
mov dword [esp + 0x1cc], 0x74514343
mov dword [esp + 0x1d0], 0x6d4d684f
mov dword [esp + 0x1d4], 0x7a687746
mov dword [esp + 0x1d8], 0x30677966
mov dword [esp + 0x1dc], 0x58676843
mov dword [esp + 0x1e0], 0x424d4345
mov dword [esp + 0x1e4], 0x39417a43
mov dword [esp + 0x1e8], 0x39386946
mov dword [esp + 0x1ec], 0x6b494346
mov dword [esp + 0x1f0], 0x674e6966
mov dword [esp + 0x1f4], 0x52414441
mov dword [esp + 0x1f8], 0x5649674b
mov dword [esp + 0x1fc], 0x43674350
mov dword [esp + 0x200], 0x3649684e
mov dword [esp + 0x204], 0x69414764
mov dword [esp + 0x208], 0x63414448
mov dword [esp + 0x20c], 0x5a34794f
mov dword [esp + 0x210], 0x36384141
mov dword [esp + 0x214], 0x716f4250
mov dword [esp + 0x218], 0x344a4341
mov dword [esp + 0x21c], 0x55554144
mov dword [esp + 0x220], 0x4d6f4265
mov dword [esp + 0x224], 0x53597843
mov dword [esp + 0x228], 0x6f496e47
mov dword [esp + 0x22c], 0x774d4243
mov dword [esp + 0x230], 0x395a5842
mov dword [esp + 0x234], 0x7630674f
mov dword [esp + 0x238], 0x5045534b
mov dword [esp + 0x23c], 0x7a645346
mov dword [esp + 0x240], 0x675a6750
mov dword [esp + 0x244], 0x72677942
mov dword [esp + 0x248], 0x6d635147
mov dword [esp + 0x24c], 0x6c385148
mov dword [esp + 0x250], 0x45514465
mov dword [esp + 0x254], 0x416b794b
mov dword [esp + 0x258], 0x65444141
push ecx
push eax
push edx
call fcn.00450208
lea ecx, [esp + 0x260]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x27c], 3
call fcn.004ab6d2
push eax
lea ecx, [esp + 0x14]
call fcn.004d9264
mov byte [esp + 0x278], 4
lea eax, [esp + 0x18]
push 3
push dword [ebx]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.004c2028
lea eax, [esp + 0x10]
mov byte [esp + 0x278], 5
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24c]
push eax
call fcn.004d935b
pop ecx
mov byte [esp + 0x278], 6
mov eax, dword [eax]
test eax, eax
je 0x4edc0b
mov eax, dword [eax]
jmp 0x4edc0d
xor eax, eax
push eax
lea ecx, [esp + 0x260]
call fcn.004c3023
mov ecx, dword [esp + 0x24c]
test ecx, ecx
je 0x4edc32
call fcn.004acada
and dword [esp + 0x24c], 0
lea eax, [esp + 0x18]
cmp dword [esp + 0x14], eax
je 0x4edc46
push dword [esp + 0x14]
call fcn.0054e49f
pop ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4edc53
call fcn.004acada
lea ecx, [esp + 0x250]
mov byte [esp + 0x278], 2
call fcn.004ab565
push 0
sub esp, 0xc
mov dword [esp + 0x24], 0x674d444c
mov ecx, esp
mov dword [esp + 0x28], 0x6b517a4a
lea eax, [esp + 0xdb]
mov dword [esp + 0x2c], 0x71565450
lea edx, [esp + 0x24]
mov dword [esp + 0x30], 0x7445444a
push ecx
push eax
push edx
mov dword [esp + 0x40], 0x72347a4c
mov dword [esp + 0x44], 0x73735245
mov dword [esp + 0x48], 0x4c30784e
mov dword [esp + 0x4c], 0x39704866
mov dword [esp + 0x50], 0x536b7850
mov dword [esp + 0x54], 0x58596d44
mov dword [esp + 0x58], 0x4e556a43
mov dword [esp + 0x5c], 0x524d4442
mov dword [esp + 0x60], 0x64517a65
mov dword [esp + 0x64], 0x454d4142
mov dword [esp + 0x68], 0x675a6745
mov dword [esp + 0x6c], 0x71775849
mov dword [esp + 0x70], 0x385a434f
mov dword [esp + 0x74], 0x35346846
mov dword [esp + 0x78], 0x42557a4e
mov dword [esp + 0x7c], 0x33456744
mov dword [esp + 0x80], 0x34777a42
mov dword [esp + 0x84], 0x4e307a47
mov dword [esp + 0x88], 0x5567414b
mov dword [esp + 0x8c], 0x4541544a
mov dword [esp + 0x90], 0x31515144
mov dword [esp + 0x94], 0x77315863
mov dword [esp + 0x98], 0x4749794f
mov dword [esp + 0x9c], 0x79457942
mov dword [esp + 0xa0], 0x50306e41
mov dword [esp + 0xa4], 0x50737850
mov dword [esp + 0xa8], 0x3238484d
mov dword [esp + 0xac], 0x79417866
mov dword [esp + 0xb0], 0x3152534a
mov dword [esp + 0xb4], 0x30494450
mov dword [esp + 0xb8], 0x6d565763
mov dword [esp + 0xbc], 0x694d5341
mov dword [esp + 0xc0], 0x6559684e
mov dword [esp + 0xc4], 0x374d6743
mov dword [esp + 0xc8], 0x4634785a
mov dword [esp + 0xcc], 0x6e386748
mov dword [esp + 0xd0], 0x4a34784b
mov dword [esp + 0xd4], 0x306b5266
mov dword [esp + 0xd8], 0x41635245
mov dword [esp + 0xdc], 0x4663534c
mov dword [esp + 0xe0], 0x4141514c
mov word [esp + 0xe4], 0x4841
mov byte [esp + 0xe6], 0x67
call fcn.00450208
lea ecx, [esp + 0x260]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x27c], 7
call fcn.004ab6d2
push eax
lea ecx, [esp + 0x260]
call fcn.004c3023
lea ecx, [esp + 0x250]
mov byte [esp + 0x278], 2
call fcn.004ab565
and dword [esp + 0x260], 0
lea eax, [esp + 0x18]
push 3
push dword [esp + 0x260]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.004c2180
mov byte [esp + 0x278], 8
lea ecx, [esp + 0x260]
push dword [esp + 0x14]
call fcn.004c2785
lea eax, [esp + 0x18]
cmp dword [esp + 0x14], eax
je 0x4eded3
push dword [esp + 0x14]
call fcn.0054e49f
pop ecx
push dword [esp + 0x25c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x260]
mov edi, eax
neg edi
sbb edi, edi
lea ecx, [ecx - 0x10]
neg edi
call fcn.00450c0a
mov ecx, dword [esp + 0x25c]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
jmp 0x4edff1
push 0
sub esp, 0xc
mov dword [esp + 0x24], 0x38457a62
mov ecx, esp
mov dword [esp + 0x28], 0x3073684e
lea eax, [esp + 0x68]
mov dword [esp + 0x2c], 0x53734348
lea edx, [esp + 0x24]
mov dword [esp + 0x30], 0x5845444f
push ecx
push eax
push edx
mov dword [esp + 0x40], 0x6977334c
mov dword [esp + 0x44], 0x77554849
mov dword [esp + 0x48], 0x6249794d
mov dword [esp + 0x4c], 0x396b7844
mov dword [esp + 0x50], 0x4e516942
mov dword [esp + 0x54], 0x50593266
mov dword [esp + 0x58], 0x37784446
mov dword [esp + 0x5c], 0x73733248
mov dword [esp + 0x60], 0x68387964
mov dword [esp + 0x64], 0x55305366
mov dword [esp + 0x68], 0x686b6a4a
mov dword [esp + 0x6c], 0x41636742
mov dword [esp + 0x70], 0x72414141
call fcn.00450208
lea ecx, [esp + 0x260]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x27c], 9
call fcn.004ab6d2
push eax
lea ecx, [esp + 0x268]
call fcn.00521136
lea ecx, [esp + 0x250]
call fcn.004ab565
mov esi, dword [esp + 0x264]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00450c0a
mov eax, edi
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0054d1e7
mov esp, ebp
pop ebp
ret