Function at 0x10033c4f
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x150
mov eax, 0x1006d12e
call fcn.1003f081
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x14c], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10034610
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x10034610
push esi
call fcn.1003ea8b
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100345f9
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc8], 0x69495145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc4], 0x6945694b
push eax
xor eax, eax
mov dword [ebp - 0xc0], 0x6f347849
push eax
sub esp, 0xc
mov dword [ebp - 0xbc], 0x444d6a4c
mov ecx, esp
mov dword [ebp - 0xb8], 0x7555544b
mov dword [ebp - 0xb4], 0x6a525744
mov dword [ebp - 0xb0], 0x67395866
mov dword [ebp - 0xac], 0x35527965
mov dword [ebp - 0xa8], 0x694d6844
mov dword [ebp - 0xa4], 0x37776949
mov dword [ebp - 0xa0], 0x4155694c
mov dword [ebp - 0x9c], 0x2f6f5450
mov dword [ebp - 0x98], 0x7663544c
mov dword [ebp - 0x94], 0x6f595163
mov dword [ebp - 0x90], 0x5373774b
mov dword [ebp - 0x8c], 0x636f7a4a
mov dword [ebp - 0x88], 0x6b347844
mov dword [ebp - 0x84], 0x6f63774f
mov dword [ebp - 0x80], 0x70636842
mov dword [ebp - 0x7c], 0x62735841
mov dword [ebp - 0x78], 0x4473444f
mov dword [ebp - 0x74], 0x67777944
mov dword [ebp - 0x70], 0x4f45524a
mov dword [ebp - 0x6c], 0x6e4d6d4e
mov dword [ebp - 0x68], 0x4f6b7744
mov dword [ebp - 0x64], 0x65417a4e
mov dword [ebp - 0x60], 0x46454264
mov dword [ebp - 0x5c], 0x66734743
mov dword [ebp - 0x58], 0x5355674b
mov dword [ebp - 0x54], 0x58634259
mov dword [ebp - 0x50], 0x6742474c
mov dword [ebp - 0x4c], 0x56775247
mov dword [ebp - 0x48], 0x524d7a4e
mov dword [ebp - 0x44], 0x3434414c
mov dword [ebp - 0x40], 0x6267424a
mov dword [ebp - 0x3c], 0x30305748
mov dword [ebp - 0x38], 0x34736745
mov dword [ebp - 0x34], 0x2f6c514e
mov dword [ebp - 0x30], 0x6a556942
mov dword [ebp - 0x2c], 0x2f704346
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x5155
mov byte [ebp - 0x150], al
push dword [ebp - 0x150]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.1002fda3
lea eax, [ebp - 0x15c]
push eax
call fcn.10032e01
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x150], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x14c], ecx
mov ecx, eax
call fcn.1003c8cd
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10033e7d
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10033e81
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call fcn.1003c74d
cmp byte [ebp - 0x1d], 0
jne 0x100341bf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x148], 0x69495145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x144], 0x6945694b
push eax
xor eax, eax
mov dword [ebp - 0x140], 0x6f347849
mov dword [ebp - 0x13c], 0x444d6a4c
mov dword [ebp - 0x138], 0x7555544b
mov dword [ebp - 0x134], 0x6e525744
mov dword [ebp - 0x130], 0x675a5866
mov dword [ebp - 0x12c], 0x72593366
mov dword [ebp - 0x128], 0x694d6844
mov dword [ebp - 0x124], 0x37776949
mov dword [ebp - 0x120], 0x4155694c
mov dword [ebp - 0x11c], 0x2f6f5450
mov dword [ebp - 0x118], 0x7663544c
mov dword [ebp - 0x114], 0x39384245
mov dword [ebp - 0x110], 0x65596843
mov dword [ebp - 0x10c], 0x31414449
mov dword [ebp - 0x108], 0x664d584f
mov dword [ebp - 0x104], 0x45636849
mov dword [ebp - 0x100], 0x49345748
mov dword [ebp - 0xfc], 0x37464346
mov dword [ebp - 0xf8], 0x55496842
mov dword [ebp - 0xf4], 0x4e417a4e
mov dword [ebp - 0xf0], 0x7a737945
mov dword [ebp - 0xec], 0x36566d4f
mov dword [ebp - 0xe8], 0x48494447
mov dword [ebp - 0xe4], 0x7546414a
mov dword [ebp - 0xe0], 0x39304146
mov dword [ebp - 0xdc], 0x716f6748
mov dword [ebp - 0xd8], 0x6b4a6842
mov dword [ebp - 0xd4], 0x4755514a
mov dword [ebp - 0xd0], 0x6667544a
mov dword [ebp - 0xcc], 0x366f534b
mov dword [ebp - 0xc8], 0x476b544a
mov dword [ebp - 0xc4], 0x2b455246
mov dword [ebp - 0xc0], 0x31735242
mov dword [ebp - 0xbc], 0x6d46784e
mov dword [ebp - 0xb8], 0x65384342
mov dword [ebp - 0xb4], 0x42306947
mov dword [ebp - 0xb0], 0x39596949
mov dword [ebp - 0xac], 0x7249514e
mov dword [ebp - 0xa8], 0x3430684c
mov dword [ebp - 0xa4], 0x63596946
mov dword [ebp - 0xa0], 0x7339444d
mov dword [ebp - 0x9c], 0x65305243
mov dword [ebp - 0x98], 0x4a6b5148
mov dword [ebp - 0x94], 0x2f49775a
mov dword [ebp - 0x90], 0x3638534e
mov dword [ebp - 0x8c], 0x52306748
mov dword [ebp - 0x88], 0x64594242
mov dword [ebp - 0x84], 0x37644346
mov dword [ebp - 0x80], 0x65554346
mov dword [ebp - 0x7c], 0x2f49674f
mov dword [ebp - 0x78], 0x50517841
mov dword [ebp - 0x74], 0x53344147
mov dword [ebp - 0x70], 0x58305244
mov dword [ebp - 0x6c], 0x54306944
mov dword [ebp - 0x68], 0x43453347
mov dword [ebp - 0x64], 0x3435544a
mov dword [ebp - 0x60], 0x6e746a4e
mov dword [ebp - 0x5c], 0x4930524b
mov dword [ebp - 0x58], 0x6745324c
mov dword [ebp - 0x54], 0x666f684e
mov dword [ebp - 0x50], 0x7746574b
mov dword [ebp - 0x4c], 0x2f4e6a65
mov dword [ebp - 0x48], 0x31467a49
mov dword [ebp - 0x44], 0x75347a45
mov dword [ebp - 0x40], 0x6f6c5250
mov dword [ebp - 0x3c], 0x4f777a47
mov dword [ebp - 0x38], 0x5867434e
mov dword [ebp - 0x34], 0x68304341
mov dword [ebp - 0x30], 0x5255524a
mov dword [ebp - 0x2c], 0x4573414c
mov dword [ebp - 0x28], 0x4141414e
mov word [ebp - 0x24], 0x4c41
mov byte [ebp - 0x22], 0x49
push eax
sub esp, 0xc
mov byte [ebp - 0x14c], al
mov ecx, esp
push dword [ebp - 0x14c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.1002fda3
lea eax, [ebp - 0x15c]
push eax
call fcn.10032e01
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14c], 2
call fcn.1003c8cd
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100341a6
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x100341aa
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call fcn.1003c74d
cmp byte [ebp - 0x1d], 0
je 0x100341d1
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.10039102
jmp 0x100345f9
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf8], 0x754d5345
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xf4], 0x4f414446
push eax
xor eax, eax
mov dword [ebp - 0xf0], 0x57674345
push eax
sub esp, 0xc
mov dword [ebp - 0xec], 0x76515149
mov ecx, esp
mov dword [ebp - 0xe8], 0x6d594347
mov dword [ebp - 0xe4], 0x5467524e
mov dword [ebp - 0xe0], 0x58416a48
mov dword [ebp - 0xdc], 0x34425350
mov dword [ebp - 0xd8], 0x6e596a46
mov dword [ebp - 0xd4], 0x33707846
mov dword [ebp - 0xd0], 0x66386844
mov dword [ebp - 0xcc], 0x63555349
mov dword [ebp - 0xc8], 0x4530414c
mov dword [ebp - 0xc4], 0x756f5442
mov dword [ebp - 0xc0], 0x54456763
mov dword [ebp - 0xbc], 0x44304243
mov dword [ebp - 0xb8], 0x71346966
mov dword [ebp - 0xb4], 0x6c4d6a4c
mov dword [ebp - 0xb0], 0x2f634450
mov dword [ebp - 0xac], 0x66347944
mov dword [ebp - 0xa8], 0x79515748
mov dword [ebp - 0xa4], 0x56456a4c
mov dword [ebp - 0xa0], 0x6e496941
mov dword [ebp - 0x9c], 0x76345141
mov dword [ebp - 0x98], 0x6945574c
mov dword [ebp - 0x94], 0x74734443
mov dword [ebp - 0x90], 0x6f525465
mov dword [ebp - 0x8c], 0x2b497a64
mov dword [ebp - 0x88], 0x5a675144
mov dword [ebp - 0x84], 0x2f676a4f
mov dword [ebp - 0x80], 0x6c73694b
mov dword [ebp - 0x7c], 0x2f6f6950
mov dword [ebp - 0x78], 0x72735343
mov dword [ebp - 0x74], 0x7a6c4164
mov dword [ebp - 0x70], 0x5a4d5341
mov dword [ebp - 0x6c], 0x5634684f
mov dword [ebp - 0x68], 0x71736747
mov dword [ebp - 0x64], 0x6c6b7966
mov dword [ebp - 0x60], 0x366b6a61
mov dword [ebp - 0x5c], 0x38784346
mov dword [ebp - 0x58], 0x6b634744
mov dword [ebp - 0x54], 0x36456848
mov dword [ebp - 0x50], 0x62674748
mov dword [ebp - 0x4c], 0x48457965
mov dword [ebp - 0x48], 0x76515741
mov dword [ebp - 0x44], 0x5255515a
mov dword [ebp - 0x40], 0x46635342
mov dword [ebp - 0x3c], 0x344a6e64
mov dword [ebp - 0x38], 0x66556761
mov dword [ebp - 0x34], 0x356b684c
mov dword [ebp - 0x30], 0x6c633242
mov dword [ebp - 0x2c], 0x4f556d49
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x776d
mov byte [ebp - 0x14c], al
push dword [ebp - 0x14c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.1002fda3
lea eax, [ebp - 0x15c]
push eax
call fcn.10032e01
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14c], 4
call fcn.1003c8cd
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1003440d
cmp dword [ebp - 0x14], 0
jne 0x10034414
mov byte [ebp - 0x150], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call fcn.1003c74d
cmp byte [ebp - 0x150], 0
je 0x100345f9
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x100345f9
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0xc0], 0x34564461
push eax
sub esp, 0xc
mov dword [ebp - 0xbc], 0x69785366
mov ecx, esp
mov dword [ebp - 0xb8], 0x76785459
mov dword [ebp - 0xb4], 0x5a497a5a
mov dword [ebp - 0xb0], 0x47496d4d
mov dword [ebp - 0xac], 0x6a31534e
mov dword [ebp - 0xa8], 0x3345774f
mov dword [ebp - 0xa4], 0x7734424c
mov dword [ebp - 0xa0], 0x616b414f
mov dword [ebp - 0x9c], 0x736b784f
mov dword [ebp - 0x98], 0x4f736944
mov dword [ebp - 0x94], 0x6a385461
mov dword [ebp - 0x90], 0x52456d64
mov dword [ebp - 0x8c], 0x69304247
mov dword [ebp - 0x88], 0x6d6b444e
mov dword [ebp - 0x84], 0x55674441
mov dword [ebp - 0x80], 0x62636a4f
mov dword [ebp - 0x7c], 0x345a684c
mov dword [ebp - 0x78], 0x6c427748
mov dword [ebp - 0x74], 0x32425350
mov dword [ebp - 0x70], 0x6349444f
mov dword [ebp - 0x6c], 0x2f355848
mov dword [ebp - 0x68], 0x7a6c444b
mov dword [ebp - 0x64], 0x4434544e
mov dword [ebp - 0x60], 0x34635146
mov dword [ebp - 0x5c], 0x34554246
mov dword [ebp - 0x58], 0x57347966
mov dword [ebp - 0x54], 0x384d4241
mov dword [ebp - 0x50], 0x6e564246
mov dword [ebp - 0x4c], 0x69514347
mov dword [ebp - 0x48], 0x4173514e
mov dword [ebp - 0x44], 0x684e5162
mov dword [ebp - 0x40], 0x30455141
mov dword [ebp - 0x3c], 0x536b6a63
mov dword [ebp - 0x38], 0x466b6a4a
mov dword [ebp - 0x34], 0x41737a48
mov dword [ebp - 0x30], 0x6e776766
mov dword [ebp - 0x2c], 0x68776843
mov dword [ebp - 0x28], 0x41415150
mov word [ebp - 0x24], 0x4741
mov byte [ebp - 0x22], 0x67
mov byte [ebp - 0x150], al
push dword [ebp - 0x150]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.1002fda3
lea eax, [ebp - 0x15c]
push eax
call fcn.10032e01
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1003c8cd
push eax
push ebx
call fcn.100327ad
add esp, 0x18
lea ecx, [ebp - 0x15c]
call fcn.1003c74d
cmp dword [ebp - 0x18], 0
je 0x10034609
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1003ea94
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.100372ea
call fcn.1003f02b
ret