Function at 0x42fea0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d12c6
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x5035d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x43035d
cmp word [esi], 0
je 0x43035d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43035d
push 0x104
lea ebx, [edi + 0xc]
push ebx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x44c], ebx
push 0x104
push eax
call fcn.004ad44d
push 0x104
push esi
push 0x104
push ebx
call fcn.004ad44d
push 0x5c
push ebx
call fcn.004a5e17
push 0x208
push 0
lea esi, [eax + 2]
lea eax, [ebp - 0x438]
push eax
call fcn.004a4df0
push esi
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.004ad31c
add esp, 0x40
lea ecx, [ebp - 0x444]
xor eax, eax
mov word [esi], ax
mov dword [ebp - 0x440], eax
push ecx
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x444], eax
push ecx
cmp dword [edi + 0x21c], eax
je 0x42ffac
mov dword [ebp - 0x28], 0x6f0063
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], 0x66006e
mov dword [ebp - 0x20], 0x670069
mov dword [ebp - 0x1c], 0x78002e
mov dword [ebp - 0x18], 0x6c006d
mov word [ebp - 0x14], ax
jmp 0x42ffb2
lea ecx, [ebp - 0x438]
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x40]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x430343
cmp dword [ebp - 0x440], 0
je 0x430343
cmp dword [ebp - 0x444], 0
je 0x430343
push 0x24
call fcn.004a1376
add esp, 4
mov dword [ebp - 0x43c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x43000d
mov ecx, eax
call fcn.0045bea0
mov ebx, eax
mov dword [ebp - 0x454], eax
jmp 0x430015
xor ebx, ebx
mov dword [ebp - 0x454], ebx
push 0x70
mov dword [ebp - 4], 0xffffffff
mov dword [ebx + 0x20], edi
call fcn.004a1376
add esp, 4
mov dword [ebp - 0x43c], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x430049
mov ecx, eax
call fcn.00431a30
mov dword [ebp - 0x450], eax
jmp 0x430051
xor ecx, ecx
mov dword [ebp - 0x450], ecx
push dword [ebp - 0x440]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
lea ecx, [esi + 2]
push ecx
call fcn.004a1357
push esi
push dword [ebp - 0x448]
mov dword [ebp - 0x43c], eax
push eax
call fcn.004a4870
mov eax, dword [ebp - 0x43c]
add esp, 0x10
mov word [eax + esi], 0
lea ecx, [eax + 2]
mov esi, dword [ebp - 0x450]
push 0
push ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0xc]
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x4300b7
push eax
call fcn.004a1360
add esp, 4
push dword [ebp - 0x444]
mov eax, dword [edi]
push dword [ebp - 0x440]
push edi
call dword [eax + 0x44]
push str.directui
mov ecx, esi
call fcn.00432d30
mov dword [ebp - 0x458], eax
lea ecx, [ebp - 0x458]
push str.theme
lea eax, [ebp - 0x43c]
push eax
call fcn.00432d00
mov ecx, eax
call fcn.004303b0
push eax
mov ecx, ebx
call fcn.0045cc40
test eax, eax
jne 0x43013b
mov ecx, ebx
call fcn.0045bf40
push 0x24
push ebx
call fcn.004a1326
mov eax, dword [esi]
add esp, 8
mov ecx, esi
push 1
call dword [eax]
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0x104
push dword [ebp - 0x44c]
jmp 0x430355
push 0x28
call fcn.004a1376
add esp, 4
mov dword [ebp - 0x43c], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x430161
mov ecx, eax
call fcn.0045cf90
mov ebx, eax
jmp 0x430163
xor ebx, ebx
mov eax, dword [edi]
lea ecx, [ebp - 0x444]
push ecx
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0xffffffff
push ecx
push str.DirectUI.js
push edi
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0
call dword [eax + 0x40]
mov dword [ebp - 0x43c], eax
test eax, eax
je 0x430300
cmp dword [ebp - 0x444], 0
je 0x430300
mov ecx, dword [ebp - 0x440]
test ecx, ecx
je 0x430300
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
lea ecx, [esi + 0x80]
push ecx
call fcn.004a1357
push esi
push 0
push eax
mov dword [ebp - 0x448], eax
call fcn.004a4df0
mov eax, dword [ebp - 0x448]
push esi
push dword [ebp - 0x43c]
push eax
call fcn.004a4870
mov eax, dword [ebp - 0x448]
add esp, 0x1c
mov word [eax + esi], 0
lea esi, [eax + 2]
push str._r_nCollectGarbage____r_n
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
mov ecx, ebx
call fcn.0045d610
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x430230
push eax
call fcn.004a1360
add esp, 4
push edi
push str.winManager
mov ecx, ebx
call fcn.0045d1b0
mov esi, dword [ebp - 0x454]
mov ecx, ebx
push esi
push str.resManager
call fcn.0045d1b0
mov ecx, dword [edi + 0x214]
test ecx, ecx
je 0x430260
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [edi + 0x224]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x430287
mov ecx, eax
call fcn.0045d100
push 0x28
push dword [ebp - 0x44c]
call fcn.004a1326
add esp, 8
mov eax, dword [edi + 0x218]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x4302ae
mov ecx, eax
call fcn.0045bf40
push 0x24
push dword [ebp - 0x44c]
call fcn.004a1326
add esp, 8
mov ecx, dword [ebp - 0x450]
mov dword [edi + 0x214], ecx
mov dword [edi + 0x218], esi
mov dword [edi + 0x224], ebx
mov ecx, dword [edi + 0x22c]
mov eax, dword [ecx]
mov dword [ebp - 0x43c], eax
cmp eax, ecx
je 0x4302f9
mov ecx, dword [eax + 0x14]
call fcn.0042ca50
lea ecx, [ebp - 0x43c]
call fcn.0040e160
mov eax, dword [ebp - 0x43c]
cmp eax, dword [edi + 0x22c]
jne 0x4302d8
mov eax, 1
jmp 0x43035f
mov esi, dword [ebp - 0x454]
mov ecx, esi
call fcn.0045bf40
push 0x24
push esi
call fcn.004a1326
mov ecx, dword [ebp - 0x450]
add esp, 8
mov eax, dword [ecx]
push 1
call dword [eax]
test ebx, ebx
je 0x43011f
mov ecx, ebx
call fcn.0045d100
push 0x28
push ebx
call fcn.004a1326
add esp, 8
jmp 0x43011f
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0x104
push ebx
call fcn.004ad44d
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1365
mov esp, ebp
pop ebp
ret 8