Function at 0x462f10
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get file attributes
Get file size
Read file via mapping
Resolve function by parsing pe exports
Set file attributes
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x61a45c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
push ebx
push ebp
push esi
push edi
or ebx, 0xffffffff
push str.shell32
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
xor edi, edi
cmp ebp, edi
je 0x4630f0
push str.SHGetFolderPathW
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x4630e4
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x144]
push eax
push edi
push edi
push 0x24
push edi
call esi
cmp eax, edi
jne 0x4630de
lea ecx, [esp + 0x144]
push ecx
call fcn.005e639f
add esp, 4
cmp word [esp + eax*2 + 0x142], 0x5c
je 0x462fb1
lea edx, [esp + 0x144]
push 0x6a015c
push edx
call fcn.005e653f
add esp, 8
call fcn.00446350
test eax, eax
je 0x462fc9
lea eax, [esp + 0x144]
push str.Sysnative
push eax
jmp 0x462fd6
lea ecx, [esp + 0x144]
push str.System32
push ecx
call fcn.005e653f
mov edx, 0x129
mov eax, 0x13c
mov word [esp + 0x36], dx
mov word [esp + 0x3e], dx
mov word [esp + 0x30], ax
mov word [esp + 0x38], ax
mov edx, 0x13e
mov eax, 0x13f
add esp, 8
mov word [esp + 0x38], dx
mov word [esp + 0x44], dx
mov word [esp + 0x32], ax
mov word [esp + 0x42], ax
mov word [esp + 0x46], ax
lea edx, [esp + 0x24]
lea eax, [esp + 0x34c]
mov ecx, 0x116
push edx
push eax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], 0x12e
mov word [esp + 0x32], 0x125
mov word [esp + 0x34], 0x138
mov word [esp + 0x3c], cx
mov word [esp + 0x42], 0x12f
mov word [esp + 0x44], cx
mov word [esp + 0x46], 0x12a
mov word [esp + 0x48], 0x123
mov word [esp + 0x50], di
call fcn.005e6569
lea ecx, [esp + 0x354]
push ecx
call fcn.005e639f
add esp, 0xc
cmp eax, edi
jle 0x4630a6
lea ecx, [esp + 0x34c]
mov dx, word [ecx]
add ecx, 2
xor dx, 0x4d
sub edx, 0xff
dec eax
mov word [ecx - 2], dx
jne 0x46308f
lea eax, [esp + 0x34c]
lea ecx, [esp + 0x144]
push eax
push ecx
call fcn.005e653f
add esp, 8
lea edx, [esp + 0x144]
push edi
push edi
push 3
push edi
push 3
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 0xffffffff
jne 0x4630fa
mov eax, 1
jmp 0x4637da
lea eax, [esp + 0x8c]
mov dword [esp + 0x4c], 1
push eax
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x94], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x463131
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46331b
mov ecx, dword [esp + 0x8c]
push edi
push ebp
push ecx
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x463319
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x463312
lea esi, [ebp + 1]
push esi
mov dword [esp + 0x54], esi
call fcn.005feedc
push esi
mov ebx, eax
call fcn.005feedc
add esp, 8
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x463303
test eax, eax
je 0x463303
lea edx, [esp + 0x54]
mov byte [esp + 0x54], 0x21
push edx
mov byte [esp + 0x59], 0x66
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], 0x7b
mov byte [esp + 0x5c], 0x6a
mov byte [esp + 0x5d], 0x7d
mov byte [esp + 0x5e], 0x61
mov byte [esp + 0x5f], 0x6a
mov byte [esp + 0x60], 0x7b
mov byte [esp + 0x61], 0x6b
mov byte [esp + 0x62], 0x60
mov byte [esp + 0x63], 0x78
mov byte [esp + 0x64], 0x61
mov byte [esp + 0x65], 0x63
mov byte [esp + 0x66], 0x60
mov byte [esp + 0x67], 0x6e
mov byte [esp + 0x68], 0x6b
mov byte [esp + 0x69], 0x62
mov byte [esp + 0x6a], 0x6e
mov byte [esp + 0x6b], 0x61
mov byte [esp + 0x6c], 0x6e
mov byte [esp + 0x6d], 0x68
mov byte [esp + 0x6e], 0x6a
mov byte [esp + 0x6f], 0x7d
mov byte [esp + 0x70], 0x21
mov byte [esp + 0x71], 0x6c
mov byte [esp + 0x72], 0x60
mov byte [esp + 0x73], 0x62
mov byte [esp + 0x74], 0
call fcn.005bdce0
mov esi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], 0
mov al, byte [ebx]
test al, al
mov esi, ebx
je 0x4632ec
push 0xa
push esi
call fcn.005e63d0
add esp, 8
test eax, eax
je 0x46328a
mov ebp, dword [esp + 0x10]
mov edi, eax
sub edi, esi
lea ecx, [edi + 1]
push ecx
push esi
push ebp
call fcn.005e6720
add esp, 0xc
mov byte [edi + ebp + 1], 0
jmp 0x4632a5
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x10]
lea edx, [edi - 1]
push edx
push esi
push ebp
call fcn.005e6720
add esp, 0xc
mov byte [edi + ebp - 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add esi, ecx
mov al, byte [edi]
cmp al, 0x20
je 0x4632bf
cmp al, 9
jne 0x4632c2
inc edi
jmp 0x4632b5
cmp byte [edi], 0x23
je 0x4632e3
push ebp
call fcn.005e8b1b
lea eax, [esp + 0x58]
push eax
push edi
call fcn.005e6490
add esp, 0xc
test eax, eax
jne 0x4635e2
cmp byte [esi], 0
jne 0x46325e
mov ebp, dword [esp + 0x10]
push ebx
call fcn.005fef05
push ebp
call fcn.005fef05
mov edi, dword [esp + 0x20]
add esp, 8
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], edi
je 0x4637d6
mov eax, dword [esp + 0x45c]
mov esi, 0x6d1a54
cmp eax, edi
jne 0x463341
mov esi, 0x6d1a58
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.005ff43f
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [esp + 0xa0]
call fcn.004319c0
lea ecx, [esp + 0x98]
mov dword [esp + 0x454], edi
call fcn.005fead6
cmp eax, 1
jne 0x463785
lea edx, [esp + 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4633a2
test al, 1
je 0x4633a2
xor eax, 1
push eax
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push edi
push 3
push edi
push 3
lea ecx, [esp + 0x158]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x90], edi
je 0x463722
lea edx, [esp + 0x20]
xor esi, esi
push edx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4633f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4636b9
mov eax, dword [esp + 0x20]
push esi
push ebp
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x84], ebx
je 0x4636b9
push 0
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x4636ae
lea eax, [ebp + 1]
push eax
mov dword [esp + 0x54], eax
call fcn.005feedc
mov ecx, dword [esp + 0x54]
mov ebx, eax
push ecx
call fcn.005feedc
add esp, 8
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x4636a0
test eax, eax
je 0x4636a0
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
mov byte [esp + 0x28], 0x21
mov byte [esp + 0x29], 0x66
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x7b
mov byte [esp + 0x2c], 0x6a
mov byte [esp + 0x2d], 0x7d
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], 0x6a
mov byte [esp + 0x30], 0x7b
mov byte [esp + 0x31], 0x6b
mov byte [esp + 0x32], 0x60
mov byte [esp + 0x33], 0x78
mov byte [esp + 0x34], 0x61
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], 0x60
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x6b
mov byte [esp + 0x39], 0x62
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x6e
mov byte [esp + 0x3d], 0x68
mov byte [esp + 0x3e], 0x6a
mov byte [esp + 0x3f], 0x7d
mov byte [esp + 0x40], 0x21
mov byte [esp + 0x41], 0x6c
mov byte [esp + 0x42], 0x60
mov byte [esp + 0x43], 0x62
mov byte [esp + 0x44], 0
call fcn.005bdce0
lea eax, [esp + 0x78]
mov byte [esp + 0x78], 0x7d
push eax
mov byte [esp + 0x7d], 0x6a
mov byte [esp + 0x7e], 0x68
mov byte [esp + 0x7f], 0x66
mov byte [esp + 0x80], 0x7c
mov byte [esp + 0x81], 0x7b
mov byte [esp + 0x82], 0x6a
mov byte [esp + 0x83], 0x7d
mov byte [esp + 0x84], 0x66
mov byte [esp + 0x85], 0x6b
mov byte [esp + 0x86], 0x62
mov byte [esp + 0x87], 0x21
mov byte [esp + 0x88], 0x6c
mov byte [esp + 0x89], 0x60
mov byte [esp + 0x8a], 0x62
mov byte [esp + 0x8b], 0
call fcn.005bdce0
mov ecx, ebp
mov edi, ebx
mov edx, ecx
add esp, 8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x10], 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], 0
mov al, byte [ebx]
test al, al
mov esi, ebx
je 0x463682
push 0xa
push esi
call fcn.005e63d0
add esp, 8
test eax, eax
je 0x4635ef
mov ebp, dword [esp + 0x14]
mov edi, eax
sub edi, esi
lea eax, [edi + 1]
push eax
push esi
push ebp
call fcn.005e6720
add esp, 0xc
mov byte [edi + ebp + 1], 0
jmp 0x46360a
mov dword [esp + 0x20], 1
jmp 0x4632f0
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x14]
lea ecx, [edi - 1]
push ecx
push esi
push ebp
call fcn.005e6720
add esp, 0xc
mov byte [edi + ebp - 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add esi, ecx
mov al, byte [edi]
cmp al, 0x20
je 0x463624
cmp al, 9
jne 0x463627
inc edi
jmp 0x46361a
cmp byte [edi], 0x23
je 0x463662
push ebp
call fcn.005e8b1b
lea edx, [esp + 0x28]
push edx
push edi
call fcn.005e6490
add esp, 0xc
test eax, eax
jne 0x463656
lea edx, [esp + 0x74]
push edx
push edi
call fcn.005e6490
add esp, 8
test eax, eax
je 0x463662
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov byte [ecx + eax], 0x23
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
dec ecx
add eax, ecx
mov dword [esp + 0x10], eax
mov al, byte [esi]
test al, al
jne 0x4635b6
push ebx
call fcn.005fef05
mov edx, dword [esp + 0x18]
push edx
call fcn.005fef05
mov edi, dword [esp + 0x98]
mov esi, dword [esp + 0x24]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x84]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test esi, esi
je 0x463717
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x84]
lea edx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
lea edx, [esp + 0x84]
mov dword [esp + 0x90], eax
push edx
lea eax, [esp + 0x94]
push 0
push eax
push edi
mov dword [esp + 0xa4], ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x463789
mov eax, dword [0x6d12c4]
mov dword [esp + 0x4c], 0
test eax, eax
je 0x463789
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x18]
push ecx
push 0x634748
push 0x634758
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.00494a30
add esp, 0x10
test eax, eax
jne 0x46377d
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 0x34]
test eax, eax
jne 0x463773
mov dword [esp + 0x4c], 1
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x463789
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x140]
mov dword [esp + 0x454], 3
call fcn.00602ad6
lea ecx, [esp + 0xf4]
mov dword [esp + 0x130], 0x631e74
mov byte [esp + 0x454], 1
call fcn.0060a5e5
lea ecx, [esp + 0x98]
mov dword [esp + 0x454], 0xffffffff
call fcn.005fe717
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x448
ret