Function at 0x10052eb9
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x140
mov eax, 0x1008b49f
call fcn.1005e07b
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x140], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005374a
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1005374a
push esi
call fcn.1005da98
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10053733
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe0], 0x69595145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xdc], 0x6a6b6a4f
push eax
xor eax, eax
mov dword [ebp - 0xd8], 0x71776749
push eax
sub esp, 0xc
mov dword [ebp - 0xd4], 0x43594349
mov ecx, esp
mov dword [ebp - 0xd0], 0x354d694a
mov dword [ebp - 0xcc], 0x685a3345
mov dword [ebp - 0xc8], 0x37646e66
push dword [ebp - 0x13c]
mov dword [ebp - 0xc4], 0x3864435a
mov dword [ebp - 0xc0], 0x6b554247
mov dword [ebp - 0xbc], 0x6d49544b
mov dword [ebp - 0xb8], 0x4145694c
mov dword [ebp - 0xb4], 0x2b49534c
mov dword [ebp - 0xb0], 0x7455434c
mov dword [ebp - 0xac], 0x47555242
mov dword [ebp - 0xa8], 0x66496743
mov dword [ebp - 0xa4], 0x6c687747
mov dword [ebp - 0xa0], 0x794a4144
mov dword [ebp - 0x9c], 0x34596841
mov dword [ebp - 0x98], 0x6c4d4166
mov dword [ebp - 0x94], 0x4a6f7a4a
mov dword [ebp - 0x90], 0x554d4449
mov dword [ebp - 0x8c], 0x7263794a
mov dword [ebp - 0x88], 0x75784249
mov dword [ebp - 0x84], 0x6e515865
mov dword [ebp - 0x80], 0x56514849
mov dword [ebp - 0x7c], 0x47496759
mov dword [ebp - 0x78], 0x35457747
mov dword [ebp - 0x74], 0x57734342
mov dword [ebp - 0x70], 0x4873414c
mov dword [ebp - 0x6c], 0x61736e63
mov dword [ebp - 0x68], 0x4a454746
mov dword [ebp - 0x64], 0x63513243
mov dword [ebp - 0x60], 0x4a49414e
mov dword [ebp - 0x5c], 0x4b417a4b
mov dword [ebp - 0x58], 0x6b776e41
mov dword [ebp - 0x54], 0x6c565443
mov dword [ebp - 0x50], 0x53387944
mov dword [ebp - 0x4c], 0x68357747
mov dword [ebp - 0x48], 0x64493349
mov dword [ebp - 0x44], 0x6a677a61
mov dword [ebp - 0x40], 0x73454246
mov dword [ebp - 0x3c], 0x4d49794f
mov dword [ebp - 0x38], 0x6d4d5344
mov dword [ebp - 0x34], 0x7641584e
mov dword [ebp - 0x30], 0x30495350
mov dword [ebp - 0x2c], 0x4141674e
mov dword [ebp - 0x28], 0x69424141
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.1004ef92
lea eax, [ebp - 0x14c]
push eax
call fcn.1005204d
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x140], ecx
mov ecx, eax
call fcn.1005b800
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10053117
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x1005311b
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14c]
call fcn.1005b682
cmp byte [ebp - 0x1d], 0
jne 0x100532f1
lea eax, [ebp - 0x14]
mov dword [ebp - 0xbc], 0x69595145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xb8], 0x6a6b6a4f
push eax
xor eax, eax
mov dword [ebp - 0xb4], 0x71776749
push eax
sub esp, 0xc
mov dword [ebp - 0xb0], 0x43594349
mov ecx, esp
mov dword [ebp - 0xac], 0x354d694a
mov dword [ebp - 0xa8], 0x6c5a3345
mov dword [ebp - 0xa4], 0x37356e66
push dword [ebp - 0x13c]
mov dword [ebp - 0xa0], 0x75554859
mov dword [ebp - 0x9c], 0x6b554247
mov dword [ebp - 0x98], 0x6d49544b
mov dword [ebp - 0x94], 0x4145694c
mov dword [ebp - 0x90], 0x2b49534c
mov dword [ebp - 0x8c], 0x7455434c
mov dword [ebp - 0x88], 0x6b494148
mov dword [ebp - 0x84], 0x34415843
mov dword [ebp - 0x80], 0x30457850
mov dword [ebp - 0x7c], 0x42595142
mov dword [ebp - 0x78], 0x42416743
mov dword [ebp - 0x74], 0x6c70514b
mov dword [ebp - 0x70], 0x71517744
mov dword [ebp - 0x6c], 0x685a5250
mov dword [ebp - 0x68], 0x6f637a66
mov dword [ebp - 0x64], 0x3538794a
mov dword [ebp - 0x60], 0x2b385150
mov dword [ebp - 0x5c], 0x6b496a50
mov dword [ebp - 0x58], 0x7a386748
mov dword [ebp - 0x54], 0x2b397a65
mov dword [ebp - 0x50], 0x686b6748
mov dword [ebp - 0x4c], 0x4f774466
mov dword [ebp - 0x48], 0x6e495746
mov dword [ebp - 0x44], 0x67526844
mov dword [ebp - 0x40], 0x3770774a
mov dword [ebp - 0x3c], 0x32737949
mov dword [ebp - 0x38], 0x7968774c
mov dword [ebp - 0x34], 0x65636e4b
mov dword [ebp - 0x30], 0x6e466959
mov dword [ebp - 0x2c], 0x396f7a4b
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x4153
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.1004ef92
lea eax, [ebp - 0x14c]
push eax
call fcn.1005204d
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x140], 2
call fcn.1005b800
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100532d8
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x100532dc
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14c]
call fcn.1005b682
cmp byte [ebp - 0x1d], 0
je 0x10053303
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.100580ee
jmp 0x10053733
lea eax, [ebp - 0x14]
mov dword [ebp - 0x138], 0x64775145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x134], 0x58386a66
push eax
xor eax, eax
mov dword [ebp - 0x130], 0x6d675245
push eax
sub esp, 0xc
mov dword [ebp - 0x12c], 0x496b774b
mov ecx, esp
mov dword [ebp - 0x128], 0x62515142
mov dword [ebp - 0x124], 0x7364684f
mov dword [ebp - 0x120], 0x45675842
mov dword [ebp - 0x11c], 0x6355544b
mov dword [ebp - 0x118], 0x53636a4a
mov dword [ebp - 0x114], 0x63456943
mov dword [ebp - 0x110], 0x6b78514e
mov dword [ebp - 0x10c], 0x68637847
mov dword [ebp - 0x108], 0x7a55524c
mov dword [ebp - 0x104], 0x6b346944
mov dword [ebp - 0x100], 0x4f597766
mov dword [ebp - 0xfc], 0x6c677741
mov dword [ebp - 0xf8], 0x344d4142
mov dword [ebp - 0xf4], 0x6f776a4a
mov dword [ebp - 0xf0], 0x2b6b414e
mov dword [ebp - 0xec], 0x68557a4e
mov dword [ebp - 0xe8], 0x77306a41
mov dword [ebp - 0xe4], 0x34346a4d
mov dword [ebp - 0xe0], 0x67415146
mov dword [ebp - 0xdc], 0x64776747
mov dword [ebp - 0xd8], 0x4d777847
mov dword [ebp - 0xd4], 0x2b634166
mov dword [ebp - 0xd0], 0x3751524a
mov dword [ebp - 0xcc], 0x32637759
mov dword [ebp - 0xc8], 0x4a736941
mov dword [ebp - 0xc4], 0x62634341
mov dword [ebp - 0xc0], 0x6130324b
mov dword [ebp - 0xbc], 0x466b4744
mov dword [ebp - 0xb8], 0x7467684b
mov dword [ebp - 0xb4], 0x7863524a
mov dword [ebp - 0xb0], 0x6d4a7844
mov dword [ebp - 0xac], 0x6e35414f
mov dword [ebp - 0xa8], 0x36596842
mov dword [ebp - 0xa4], 0x49494249
mov dword [ebp - 0xa0], 0x4d77534b
mov dword [ebp - 0x9c], 0x6b525447
mov dword [ebp - 0x98], 0x61517846
mov dword [ebp - 0x94], 0x4d4d514f
mov dword [ebp - 0x90], 0x374a7a4c
mov dword [ebp - 0x8c], 0x47556747
mov dword [ebp - 0x88], 0x636b514c
mov dword [ebp - 0x84], 0x5a554245
mov dword [ebp - 0x80], 0x6b734841
mov dword [ebp - 0x7c], 0x7249514b
mov dword [ebp - 0x78], 0x5177684b
mov dword [ebp - 0x74], 0x67395744
mov dword [ebp - 0x70], 0x6445574e
mov dword [ebp - 0x6c], 0x63674345
mov dword [ebp - 0x68], 0x4b6f7864
mov dword [ebp - 0x64], 0x47554348
mov dword [ebp - 0x60], 0x384d7942
mov dword [ebp - 0x5c], 0x61516a4e
mov dword [ebp - 0x58], 0x5a6f5443
mov dword [ebp - 0x54], 0x6451335a
mov dword [ebp - 0x50], 0x6c314163
mov dword [ebp - 0x4c], 0x6d74784d
mov dword [ebp - 0x48], 0x424d5166
mov dword [ebp - 0x44], 0x75736a42
mov dword [ebp - 0x40], 0x5a307a63
mov dword [ebp - 0x3c], 0x6a496e4f
mov dword [ebp - 0x38], 0x596b414d
mov dword [ebp - 0x34], 0x52634165
mov dword [ebp - 0x30], 0x73675247
mov dword [ebp - 0x2c], 0x75304442
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x7779
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push dword [ebp - 0x13c]
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.1004ef92
lea eax, [ebp - 0x14c]
push eax
call fcn.1005204d
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x140], 4
call fcn.1005b800
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100535d9
cmp dword [ebp - 0x14], 0
jne 0x100535e0
mov byte [ebp - 0x13c], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14c]
call fcn.1005b682
cmp byte [ebp - 0x13c], 0
je 0x10053733
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x10053733
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0x8c], 0x34464461
push eax
sub esp, 0xc
mov dword [ebp - 0x88], 0x6a525462
mov ecx, esp
mov dword [ebp - 0x84], 0x74354359
mov dword [ebp - 0x80], 0x67635361
mov dword [ebp - 0x7c], 0x3731784c
push dword [ebp - 0x13c]
mov dword [ebp - 0x78], 0x4130514a
mov dword [ebp - 0x74], 0x714d474a
mov dword [ebp - 0x70], 0x716f4347
mov dword [ebp - 0x6c], 0x3463534e
mov dword [ebp - 0x68], 0x5751524c
mov dword [ebp - 0x64], 0x3730694b
mov dword [ebp - 0x60], 0x3445684a
mov dword [ebp - 0x5c], 0x7738484c
mov dword [ebp - 0x58], 0x4573334c
mov dword [ebp - 0x54], 0x6e635343
mov dword [ebp - 0x50], 0x7a41774e
mov dword [ebp - 0x4c], 0x73455244
mov dword [ebp - 0x48], 0x6173534e
mov dword [ebp - 0x44], 0x5945694b
mov dword [ebp - 0x40], 0x45736e49
mov dword [ebp - 0x3c], 0x2b384243
mov dword [ebp - 0x38], 0x6c45424d
mov dword [ebp - 0x34], 0x306b4144
mov dword [ebp - 0x30], 0x6359524c
mov dword [ebp - 0x2c], 0x41554449
mov dword [ebp - 0x28], 0x2f414141
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.1004ef92
lea eax, [ebp - 0x14c]
push eax
call fcn.1005204d
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1005b800
push eax
push ebx
call fcn.100519fb
add esp, 0x18
lea ecx, [ebp - 0x14c]
call fcn.1005b682
cmp dword [ebp - 0x18], 0
je 0x10053743
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1005daa1
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10055fc0
call fcn.1005e025
ret