Function at 0x10007f80
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100b8a28], eax
mov eax, dword [ebp + 0x10]
mov dword [0x100b8a30], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x100b8a2c], eax
lea eax, [ebp - 0x457]
push 0
push eax
mov byte [ebp - 0x458], 0
call fcn.10073290
add esp, 0xc
lea ecx, [ebp - 0x458]
call fcn.10002e20
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100081e2
push ebx
push esi
push edi
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea ecx, [ebp - 0x478]
call fcn.10008c50
lea ecx, [ebp - 0x478]
call fcn.10009320
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
push ecx
lea ecx, [ebp - 0x478]
call fcn.10009380
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x21], 0x33697061
mov dword [ebp - 0x1d], 0x6c642e32
mov word [ebp - 0x24], 0x6441
mov word [ebp - 0x19], 0x6c
mov byte [ebp - 0x22], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100081d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0xe], 0x63697672
mov dword [ebp - 0x14], 0x6e65704f
mov word [ebp - 0xa], 0x4165
mov word [ebp - 0x10], 0x6553
mov byte [ebp - 8], 0
call esi
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x34], 0x72617453
mov dword [ebp - 0x2f], 0x76726553
mov word [ebp - 0x28], 0x41
mov word [ebp - 0x2b], 0x6369
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x30], 0x74
call esi
mov ebx, eax
lea eax, [ebp - 0x44]
push eax
push edi
mov dword [ebp - 0x3e], 0x616e614d
mov dword [ebp - 0x44], 0x6e65704f
mov word [ebp - 0x37], 0x41
mov word [ebp - 0x3a], 0x6567
mov byte [ebp - 0x38], 0x72
mov word [ebp - 0x40], 0x4353
call esi
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x58]
push eax
push edi
mov dword [ebp - 0x55], 0x65537972
mov word [ebp - 0x58], 0x7551
mov dword [ebp - 0x4f], 0x53656369
mov word [ebp - 0x47], 0x73
mov word [ebp - 0x51], 0x7672
mov word [ebp - 0x4a], 0x7461
mov byte [ebp - 0x56], 0x65
mov byte [ebp - 0x48], 0x75
mov byte [ebp - 0x4b], 0x74
call esi
mov edi, dword [ebp - 0x484]
mov ecx, eax
mov dword [ebp - 0x480], ecx
test edi, edi
je 0x100081d4
test ebx, ebx
je 0x100081d4
mov eax, dword [ebp - 0x47c]
test eax, eax
je 0x100081d4
test ecx, ecx
je 0x100081d4
push 0xf003f
push 0
push 0
call eax
mov esi, eax
mov dword [ebp - 0x47c], esi
lea ecx, [ebp - 0x478]
test esi, esi
je 0x100081da
push 0x14
call fcn.10001a10
push eax
push esi
call edi
mov edi, eax
test edi, edi
je 0x100081cd
lea eax, [ebp - 0x474]
push eax
push edi
call dword [ebp - 0x480]
test eax, eax
je 0x100081c6
cmp dword [ebp - 0x470], 1
jne 0x100081c6
mov esi, 0x1388
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push edi
call ebx
test eax, eax
jne 0x100081c0
add esi, 0x1388
cmp esi, 0x61a8
jl 0x100081a0
mov esi, dword [ebp - 0x47c]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x478]
call fcn.10008cc0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret