Function at 0x1021328e
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x1d8
mov eax, 0x1024b798
call fcn.1021e371
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x164], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10213d95
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x10213d95
push esi
call fcn.1021dd8e
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10213d7e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x120], 0x75594243
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x11c], 0x2b737a4e
push eax
xor eax, eax
mov dword [ebp - 0x118], 0x7738674e
push eax
sub esp, 0xc
mov dword [ebp - 0x114], 0x516b4349
mov ecx, esp
mov dword [ebp - 0x110], 0x724d6949
mov dword [ebp - 0x10c], 0x33354842
mov dword [ebp - 0x108], 0x6d746d63
push dword [ebp - 0x160]
mov dword [ebp - 0x104], 0x7a5a545a
mov dword [ebp - 0x100], 0x31677748
mov dword [ebp - 0xfc], 0x6e45444f
mov dword [ebp - 0xf8], 0x4d457a4e
mov dword [ebp - 0xf4], 0x6a414349
mov dword [ebp - 0xf0], 0x3359434f
mov dword [ebp - 0xec], 0x76417950
mov dword [ebp - 0xe8], 0x42774850
mov dword [ebp - 0xe4], 0x7a6c6949
mov dword [ebp - 0xe0], 0x366f774a
mov dword [ebp - 0xdc], 0x4c596844
mov dword [ebp - 0xd8], 0x69596a42
mov dword [ebp - 0xd4], 0x2b73544f
mov dword [ebp - 0xd0], 0x5059524d
mov dword [ebp - 0xcc], 0x59415444
mov dword [ebp - 0xc8], 0x34454447
mov dword [ebp - 0xc4], 0x765a5441
mov dword [ebp - 0xc0], 0x2b77674b
mov dword [ebp - 0xbc], 0x31385159
mov dword [ebp - 0xb8], 0x37467965
mov dword [ebp - 0xb4], 0x3559414d
mov dword [ebp - 0xb0], 0x536b5364
mov dword [ebp - 0xac], 0x6e52694f
mov dword [ebp - 0xa8], 0x51497a59
mov dword [ebp - 0xa4], 0x3249774d
mov dword [ebp - 0xa0], 0x324d7945
mov dword [ebp - 0x9c], 0x58383366
mov dword [ebp - 0x98], 0x44455842
mov dword [ebp - 0x94], 0x56777a44
mov dword [ebp - 0x90], 0x2f457964
mov dword [ebp - 0x8c], 0x78514341
mov dword [ebp - 0x88], 0x3334674f
mov dword [ebp - 0x84], 0x43635247
mov dword [ebp - 0x80], 0x624d6844
mov dword [ebp - 0x7c], 0x54517944
mov dword [ebp - 0x78], 0x2b6f3345
mov dword [ebp - 0x74], 0x746f444f
mov dword [ebp - 0x70], 0x7749694a
mov dword [ebp - 0x6c], 0x63387a4e
mov dword [ebp - 0x68], 0x6d636a4b
mov dword [ebp - 0x64], 0x78394243
mov dword [ebp - 0x60], 0x58306943
mov dword [ebp - 0x5c], 0x52515142
mov dword [ebp - 0x58], 0x49514845
mov dword [ebp - 0x54], 0x6a6f5741
mov dword [ebp - 0x50], 0x78517741
mov dword [ebp - 0x4c], 0x7159534e
mov dword [ebp - 0x48], 0x6c6f4243
mov dword [ebp - 0x44], 0x36356e61
mov dword [ebp - 0x40], 0x676f5244
mov dword [ebp - 0x3c], 0x47304141
mov dword [ebp - 0x38], 0x4d30514a
mov dword [ebp - 0x34], 0x614d7850
mov dword [ebp - 0x30], 0x6559335a
mov dword [ebp - 0x2c], 0x2f6f6d41
mov dword [ebp - 0x28], 0x41417741
mov word [ebp - 0x24], 0x4a41
mov byte [ebp - 0x22], 0x51
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.1020f1e0
lea eax, [ebp - 0x1e4]
push eax
call fcn.10212422
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x160], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x164], ecx
mov ecx, eax
call fcn.1021ba00
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10213596
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x1021359a
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1e4]
call fcn.1021b882
cmp byte [ebp - 0x1d], 0
jne 0x10213878
lea eax, [ebp - 0x14]
mov dword [ebp - 0x124], 0x75594243
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x120], 0x2b737a4e
push eax
xor eax, eax
mov dword [ebp - 0x11c], 0x7738674e
push eax
sub esp, 0xc
mov dword [ebp - 0x118], 0x516b4349
mov ecx, esp
mov dword [ebp - 0x114], 0x724d6949
mov dword [ebp - 0x110], 0x7a354842
mov dword [ebp - 0x10c], 0x6d4a6d63
push dword [ebp - 0x160]
mov dword [ebp - 0x108], 0x68515759
mov dword [ebp - 0x104], 0x31677748
mov dword [ebp - 0x100], 0x6e45444f
mov dword [ebp - 0xfc], 0x4d457a4e
mov dword [ebp - 0xf8], 0x6a414349
mov dword [ebp - 0xf4], 0x3359434f
mov dword [ebp - 0xf0], 0x62307748
mov dword [ebp - 0xec], 0x50304147
mov dword [ebp - 0xe8], 0x7730684b
mov dword [ebp - 0xe4], 0x306f6947
mov dword [ebp - 0xe0], 0x556b4841
mov dword [ebp - 0xdc], 0x6a4d6841
mov dword [ebp - 0xd8], 0x6c785759
mov dword [ebp - 0xd4], 0x6477514a
mov dword [ebp - 0xd0], 0x6f525163
mov dword [ebp - 0xcc], 0x39385448
mov dword [ebp - 0xc8], 0x4e6b5450
mov dword [ebp - 0xc4], 0x4c304466
mov dword [ebp - 0xc0], 0x47594461
mov dword [ebp - 0xbc], 0x374a5146
mov dword [ebp - 0xb8], 0x46415446
mov dword [ebp - 0xb4], 0x7938784e
mov dword [ebp - 0xb0], 0x366f4148
mov dword [ebp - 0xac], 0x74597841
mov dword [ebp - 0xa8], 0x664d474b
mov dword [ebp - 0xa4], 0x62347741
mov dword [ebp - 0xa0], 0x70736746
mov dword [ebp - 0x9c], 0x6a41784a
mov dword [ebp - 0x98], 0x55514348
mov dword [ebp - 0x94], 0x61597944
mov dword [ebp - 0x90], 0x7459675a
mov dword [ebp - 0x8c], 0x52305464
mov dword [ebp - 0x88], 0x51636848
mov dword [ebp - 0x84], 0x73465142
mov dword [ebp - 0x80], 0x57457964
mov dword [ebp - 0x7c], 0x776f7741
mov dword [ebp - 0x78], 0x44496941
mov dword [ebp - 0x74], 0x7a4a514b
mov dword [ebp - 0x70], 0x35457847
mov dword [ebp - 0x6c], 0x4349694b
mov dword [ebp - 0x68], 0x58457a48
mov dword [ebp - 0x64], 0x49387a47
mov dword [ebp - 0x60], 0x4b776a59
mov dword [ebp - 0x5c], 0x7668474d
mov dword [ebp - 0x58], 0x546f4263
mov dword [ebp - 0x54], 0x73354350
mov dword [ebp - 0x50], 0x4a6b424b
mov dword [ebp - 0x4c], 0x576f6847
mov dword [ebp - 0x48], 0x6b38434e
mov dword [ebp - 0x44], 0x7873444c
mov dword [ebp - 0x40], 0x4b55424b
mov dword [ebp - 0x3c], 0x3930674b
mov dword [ebp - 0x38], 0x6c45694a
mov dword [ebp - 0x34], 0x3051775a
mov dword [ebp - 0x30], 0x5a304243
mov dword [ebp - 0x2c], 0x71514761
mov dword [ebp - 0x28], 0x41414150
mov word [ebp - 0x24], 0x4a41
mov byte [ebp - 0x22], 0x63
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.1020f1e0
lea eax, [ebp - 0x1e4]
push eax
call fcn.10212422
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x164], 2
call fcn.1021ba00
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1021385f
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10213863
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1e4]
call fcn.1021b882
cmp byte [ebp - 0x1d], 0
je 0x1021388a
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.1021861a
jmp 0x10213d7e
mov dword [ebp - 0x15c], 0x7a734143
lea eax, [ebp - 0x14]
mov dword [ebp - 0x158], 0x44594266
mov dword [ebp - 0x154], 0x63775348
mov dword [ebp - 0x150], 0x56385341
mov dword [ebp - 0x14c], 0x51515149
mov dword [ebp - 0x148], 0x3545694e
mov dword [ebp - 0x144], 0x54457741
mov dword [ebp - 0x140], 0x36676a42
mov dword [ebp - 0x13c], 0x54515263
mov dword [ebp - 0x138], 0x65596846
mov dword [ebp - 0x134], 0x7245584c
mov dword [ebp - 0x130], 0x506f414c
mov dword [ebp - 0x12c], 0x76686e4f
mov dword [ebp - 0x128], 0x444d434a
mov dword [ebp - 0x124], 0x31745147
mov dword [ebp - 0x120], 0x32596a50
mov dword [ebp - 0x11c], 0x554d7865
mov dword [ebp - 0x118], 0x6b457946
mov dword [ebp - 0x114], 0x31775763
mov dword [ebp - 0x110], 0x38516942
mov dword [ebp - 0x10c], 0x76684341
mov dword [ebp - 0x108], 0x376f5741
mov dword [ebp - 0x104], 0x75556959
mov dword [ebp - 0x100], 0x74646949
mov dword [ebp - 0xfc], 0x55305248
mov dword [ebp - 0xf8], 0x6c49694f
mov dword [ebp - 0xf4], 0x46515748
mov dword [ebp - 0xf0], 0x67344249
mov dword [ebp - 0xec], 0x67776946
mov dword [ebp - 0xe8], 0x36386759
mov dword [ebp - 0xe4], 0x3377435a
mov dword [ebp - 0xe0], 0x68707741
mov dword [ebp - 0xdc], 0x79415447
mov dword [ebp - 0xd8], 0x30597a45
mov dword [ebp - 0xd4], 0x64307a41
mov dword [ebp - 0xd0], 0x6f6b6750
mov dword [ebp - 0xcc], 0x37414364
mov dword [ebp - 0xc8], 0x48554245
mov dword [ebp - 0xc4], 0x58415346
mov dword [ebp - 0xc0], 0x2f78324d
mov dword [ebp - 0xbc], 0x5277424f
mov dword [ebp - 0xb8], 0x53557942
mov dword [ebp - 0xb4], 0x67517747
mov dword [ebp - 0xb0], 0x3059784b
mov dword [ebp - 0xac], 0x73305364
mov dword [ebp - 0xa8], 0x68736748
mov dword [ebp - 0xa4], 0x55417849
mov dword [ebp - 0xa0], 0x77316748
mov dword [ebp - 0x9c], 0x73735164
mov dword [ebp - 0x98], 0x47676e47
mov dword [ebp - 0x94], 0x70386842
mov dword [ebp - 0x90], 0x6245774a
mov dword [ebp - 0x8c], 0x3068434b
mov dword [ebp - 0x88], 0x71673350
mov dword [ebp - 0x84], 0x476b514c
mov dword [ebp - 0x80], 0x67777744
mov dword [ebp - 0x7c], 0x5a457844
mov dword [ebp - 0x78], 0x4551775a
mov dword [ebp - 0x74], 0x52595449
mov dword [ebp - 0x70], 0x3045515a
mov dword [ebp - 0x6c], 0x62674162
mov dword [ebp - 0x68], 0x6349574e
mov dword [ebp - 0x64], 0x446b7a4e
mov dword [ebp - 0x60], 0x74316966
mov dword [ebp - 0x5c], 0x46634850
mov dword [ebp - 0x58], 0x736f5343
mov dword [ebp - 0x54], 0x314d794e
mov dword [ebp - 0x50], 0x50555259
mov dword [ebp - 0x4c], 0x506f5341
mov dword [ebp - 0x48], 0x39734449
mov dword [ebp - 0x44], 0x35735162
mov dword [ebp - 0x40], 0x36677849
mov dword [ebp - 0x3c], 0x496f4442
mov dword [ebp - 0x38], 0x346f5842
mov dword [ebp - 0x34], 0x64495165
mov dword [ebp - 0x30], 0x76595243
mov dword [ebp - 0x2c], 0x50516843
mov dword [ebp - 0x28], 0x41417748
mov word [ebp - 0x24], 0x4f41
mov byte [ebp - 0x22], 0x63
push eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
push eax
sub esp, 0xc
mov ecx, esp
push dword [ebp - 0x160]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.1020f1e0
lea eax, [ebp - 0x1e4]
push eax
call fcn.10212422
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x164], 4
call fcn.1021ba00
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10213bbe
cmp dword [ebp - 0x14], 0
jne 0x10213bc5
mov byte [ebp - 0x160], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1e4]
call fcn.1021b882
cmp byte [ebp - 0x160], 0
je 0x10213d7e
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x10213d7e
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0x1d8], 0x30465363
push eax
sub esp, 0xc
mov dword [ebp - 0x1d4], 0x2b5a4459
mov ecx, esp
mov dword [ebp - 0x1d0], 0x33314364
mov dword [ebp - 0x1cc], 0x6f685361
mov dword [ebp - 0x1c8], 0x42777741
push dword [ebp - 0x160]
mov dword [ebp - 0x1c4], 0x6338684f
mov dword [ebp - 0x1c0], 0x77635144
mov dword [ebp - 0x1bc], 0x75636d48
mov dword [ebp - 0x1b8], 0x77747a43
mov dword [ebp - 0x1b4], 0x5973785a
mov dword [ebp - 0x1b0], 0x52517959
mov dword [ebp - 0x1ac], 0x70525241
mov dword [ebp - 0x1a8], 0x36415148
mov dword [ebp - 0x1a4], 0x73316750
mov dword [ebp - 0x1a0], 0x65636744
mov dword [ebp - 0x19c], 0x5377434c
mov dword [ebp - 0x198], 0x39454341
mov dword [ebp - 0x194], 0x754e6949
mov dword [ebp - 0x190], 0x52515441
mov dword [ebp - 0x18c], 0x726b5442
mov dword [ebp - 0x188], 0x3430584c
mov dword [ebp - 0x184], 0x6945684a
mov dword [ebp - 0x180], 0x30416a41
mov dword [ebp - 0x17c], 0x636b534a
mov dword [ebp - 0x178], 0x6941784a
mov dword [ebp - 0x174], 0x6e516a50
mov dword [ebp - 0x170], 0x68514244
mov dword [ebp - 0x16c], 0x41555143
mov dword [ebp - 0x168], 0x49424141
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.1020f1e0
lea eax, [ebp - 0x1e4]
push eax
call fcn.10212422
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1021ba00
push eax
push ebx
call fcn.10211dd0
add esp, 0x18
lea ecx, [ebp - 0x1e4]
call fcn.1021b882
cmp dword [ebp - 0x18], 0
je 0x10213d8e
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1021dd97
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10216974
call fcn.1021e31b
ret