Function at 0x14013dc0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x1fc
mov eax, 0x1404c4b2
call fcn.1401f08f
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0xbc], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401465d
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1401465d
push esi
call fcn.1401eaac
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14014646
lea eax, [ebp - 0x14]
mov dword [ebp - 0xac], 0x73456743
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xa8], 0x7045434b
push eax
xor eax, eax
mov dword [ebp - 0xa4], 0x75517849
push eax
sub esp, 0xc
mov dword [ebp - 0xa0], 0x596b534e
mov ecx, esp
mov dword [ebp - 0x9c], 0x6d49544c
mov dword [ebp - 0x98], 0x77424747
mov dword [ebp - 0x94], 0x6e564866
push dword [ebp - 0xb8]
mov dword [ebp - 0x90], 0x714e4365
mov dword [ebp - 0x8c], 0x6a494142
mov dword [ebp - 0x88], 0x3534534e
mov dword [ebp - 0x84], 0x4f59534e
mov dword [ebp - 0x80], 0x306f7a50
mov dword [ebp - 0x7c], 0x7030544c
mov dword [ebp - 0x78], 0x34735450
mov dword [ebp - 0x74], 0x36595247
mov dword [ebp - 0x70], 0x424d574e
mov dword [ebp - 0x6c], 0x566b4147
mov dword [ebp - 0x68], 0x4d517a48
mov dword [ebp - 0x64], 0x6838524f
mov dword [ebp - 0x60], 0x64676e4c
mov dword [ebp - 0x5c], 0x43777a5a
mov dword [ebp - 0x58], 0x79705446
mov dword [ebp - 0x54], 0x7a6f784e
mov dword [ebp - 0x50], 0x576f424b
mov dword [ebp - 0x4c], 0x6f4d474e
mov dword [ebp - 0x48], 0x73496850
mov dword [ebp - 0x44], 0x3434584c
mov dword [ebp - 0x40], 0x37674164
mov dword [ebp - 0x3c], 0x49635750
mov dword [ebp - 0x38], 0x41417843
mov dword [ebp - 0x34], 0x2b63524f
mov dword [ebp - 0x30], 0x44494443
mov dword [ebp - 0x2c], 0x4141774b
mov word [ebp - 0x28], 0x4441
mov byte [ebp - 0x26], 0x6f
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.1400fecf
lea eax, [ebp - 0x208]
push eax
call fcn.14012f54
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0xb8], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0xbc], ecx
mov ecx, eax
call fcn.1401c8ad
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14013f9f
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x14013fa3
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x208]
call fcn.1401c72f
cmp byte [ebp - 0x1d], 0
jne 0x1401435f
mov dword [ebp - 0x1fc], 0x73456743
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1f8], 0x7045434b
mov dword [ebp - 0x1f4], 0x75517849
mov dword [ebp - 0x1f0], 0x596b534e
mov dword [ebp - 0x1ec], 0x6d49544c
mov dword [ebp - 0x1e8], 0x30424747
mov dword [ebp - 0x1e4], 0x6e784866
mov dword [ebp - 0x1e0], 0x34454866
mov dword [ebp - 0x1dc], 0x6a494142
mov dword [ebp - 0x1d8], 0x3534534e
mov dword [ebp - 0x1d4], 0x4f59534e
mov dword [ebp - 0x1d0], 0x306f7a50
mov dword [ebp - 0x1cc], 0x7030544c
mov dword [ebp - 0x1c8], 0x5138434c
mov dword [ebp - 0x1c4], 0x6e556743
mov dword [ebp - 0x1c0], 0x44456d4e
mov dword [ebp - 0x1bc], 0x6e594365
mov dword [ebp - 0x1b8], 0x32495866
mov dword [ebp - 0x1b4], 0x6e4a694b
mov dword [ebp - 0x1b0], 0x35385461
mov dword [ebp - 0x1ac], 0x6767424a
mov dword [ebp - 0x1a8], 0x334a4162
mov dword [ebp - 0x1a4], 0x4263534a
mov dword [ebp - 0x1a0], 0x35557961
mov dword [ebp - 0x19c], 0x6d4d6a64
mov dword [ebp - 0x198], 0x49554744
mov dword [ebp - 0x194], 0x416b7749
mov dword [ebp - 0x190], 0x56636849
mov dword [ebp - 0x18c], 0x56495145
mov dword [ebp - 0x188], 0x38353341
mov dword [ebp - 0x184], 0x74593249
mov dword [ebp - 0x180], 0x5049544e
mov dword [ebp - 0x17c], 0x5745414d
mov dword [ebp - 0x178], 0x77677948
mov dword [ebp - 0x174], 0x6167684b
mov dword [ebp - 0x170], 0x5345324c
mov dword [ebp - 0x16c], 0x57676a49
mov dword [ebp - 0x168], 0x66594247
mov dword [ebp - 0x164], 0x5a4d7847
mov dword [ebp - 0x160], 0x68747848
mov dword [ebp - 0x15c], 0x7863784d
mov dword [ebp - 0x158], 0x72556741
mov dword [ebp - 0x154], 0x31394444
mov dword [ebp - 0x150], 0x6c517850
mov dword [ebp - 0x14c], 0x3655574a
mov dword [ebp - 0x148], 0x5841534e
mov dword [ebp - 0x144], 0x6a746866
mov dword [ebp - 0x140], 0x71555350
mov dword [ebp - 0x13c], 0x4a417a4e
mov dword [ebp - 0x138], 0x3956774b
mov dword [ebp - 0x134], 0x35737742
mov dword [ebp - 0x130], 0x47674448
mov dword [ebp - 0x12c], 0x50635141
mov dword [ebp - 0x128], 0x476b4845
mov dword [ebp - 0x124], 0x6d49674e
mov dword [ebp - 0x120], 0x416b5261
mov dword [ebp - 0x11c], 0x466f6741
mov dword [ebp - 0x118], 0x7a595247
mov dword [ebp - 0x114], 0x546f524b
mov dword [ebp - 0x110], 0x76555362
mov dword [ebp - 0x10c], 0x32347a44
mov dword [ebp - 0x108], 0x54306748
mov dword [ebp - 0x104], 0x394d6d64
mov dword [ebp - 0x100], 0x776b684e
mov dword [ebp - 0xfc], 0x38464246
mov dword [ebp - 0xf8], 0x6949694e
mov dword [ebp - 0xf4], 0x62307947
mov dword [ebp - 0xf0], 0x695a4441
mov dword [ebp - 0xec], 0x586b6848
mov dword [ebp - 0xe8], 0x564d414d
mov dword [ebp - 0xe4], 0x43516745
mov dword [ebp - 0xe0], 0x72307a46
mov dword [ebp - 0xdc], 0x715a5150
mov dword [ebp - 0xd8], 0x68317849
mov dword [ebp - 0xd4], 0x5a63784e
mov dword [ebp - 0xd0], 0x33464249
mov dword [ebp - 0xcc], 0x74304146
mov dword [ebp - 0xc8], 0x50674443
mov dword [ebp - 0xc4], 0x41455459
mov dword [ebp - 0xc0], 0x46444141
push eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
push eax
sub esp, 0xc
mov ecx, esp
push dword [ebp - 0xb8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.1400fecf
lea eax, [ebp - 0x208]
push eax
call fcn.14012f54
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0xbc], 2
call fcn.1401c8ad
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14014346
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x1401434a
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x208]
call fcn.1401c72f
cmp byte [ebp - 0x1d], 0
je 0x14014371
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.14018fd9
jmp 0x14014646
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb4], 0x74646843
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xb0], 0x7a416e50
push eax
xor eax, eax
mov dword [ebp - 0xac], 0x6930424d
push eax
sub esp, 0xc
mov dword [ebp - 0xa8], 0x5873694f
mov ecx, esp
mov dword [ebp - 0xa4], 0x35315741
mov dword [ebp - 0xa0], 0x6763434b
mov dword [ebp - 0x9c], 0x59305364
push dword [ebp - 0xb8]
mov dword [ebp - 0x98], 0x34636846
mov dword [ebp - 0x94], 0x6b415259
mov dword [ebp - 0x90], 0x41306849
mov dword [ebp - 0x8c], 0x75387a5a
mov dword [ebp - 0x88], 0x77456946
mov dword [ebp - 0x84], 0x77564763
mov dword [ebp - 0x80], 0x68746762
mov dword [ebp - 0x7c], 0x69414249
mov dword [ebp - 0x78], 0x79525241
mov dword [ebp - 0x74], 0x596b5347
mov dword [ebp - 0x70], 0x54454247
mov dword [ebp - 0x6c], 0x46555341
mov dword [ebp - 0x68], 0x5a4d4347
mov dword [ebp - 0x64], 0x3841774f
mov dword [ebp - 0x60], 0x77455447
mov dword [ebp - 0x5c], 0x4a4d7946
mov dword [ebp - 0x58], 0x6941774f
mov dword [ebp - 0x54], 0x3477524e
mov dword [ebp - 0x50], 0x33786a48
mov dword [ebp - 0x4c], 0x59456948
mov dword [ebp - 0x48], 0x73516842
mov dword [ebp - 0x44], 0x6e513245
mov dword [ebp - 0x40], 0x4f77794c
mov dword [ebp - 0x3c], 0x32736845
mov dword [ebp - 0x38], 0x324d6946
mov dword [ebp - 0x34], 0x6a51544d
mov dword [ebp - 0x30], 0x38596947
mov dword [ebp - 0x2c], 0x646f684b
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x4161
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.1400fecf
lea eax, [ebp - 0x208]
push eax
call fcn.14012f54
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0xbc], 4
call fcn.1401c8ad
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140144fd
cmp dword [ebp - 0x14], 0
jne 0x14014504
mov byte [ebp - 0xb8], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x208]
call fcn.1401c72f
cmp byte [ebp - 0xb8], 0
je 0x14014646
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x14014646
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0x84], 0x325a7a63
push eax
sub esp, 0xc
mov dword [ebp - 0x80], 0x70787966
mov ecx, esp
mov dword [ebp - 0x7c], 0x705a5459
mov dword [ebp - 0x78], 0x47674366
mov dword [ebp - 0x74], 0x72776a64
push dword [ebp - 0xb8]
mov dword [ebp - 0x70], 0x69736a50
mov dword [ebp - 0x6c], 0x636f774a
mov dword [ebp - 0x68], 0x37455459
mov dword [ebp - 0x64], 0x6d706761
mov dword [ebp - 0x60], 0x57386a61
mov dword [ebp - 0x5c], 0x7955474e
mov dword [ebp - 0x58], 0x3331794d
mov dword [ebp - 0x54], 0x464d674c
mov dword [ebp - 0x50], 0x3155674b
mov dword [ebp - 0x4c], 0x3441444d
mov dword [ebp - 0x48], 0x7a5a5146
mov dword [ebp - 0x44], 0x6e385850
mov dword [ebp - 0x40], 0x63455841
mov dword [ebp - 0x3c], 0x62416950
mov dword [ebp - 0x38], 0x71676a4d
mov dword [ebp - 0x34], 0x71736945
mov dword [ebp - 0x30], 0x6c45774f
mov dword [ebp - 0x2c], 0x4141774d
mov word [ebp - 0x28], 0x4441
mov byte [ebp - 0x26], 0x67
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1400fecf
lea eax, [ebp - 0x208]
push eax
call fcn.14012f54
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1401c8ad
push eax
push ebx
call fcn.14012902
add esp, 0x18
lea ecx, [ebp - 0x208]
call fcn.1401c72f
cmp dword [ebp - 0x18], 0
je 0x14014656
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1401eab5
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.14016fdf
call fcn.1401f039
ret