Function at 0x10093f51
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x18c
mov eax, 0x100cd4c2
call fcn.1009f437
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x24], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100948ca
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x100948ca
push esi
call fcn.1009ee41
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100948b3
mov dword [ebp - 0x188], 0x2f4d6743
mov dword [ebp - 0x184], 0x686f544d
mov dword [ebp - 0x180], 0x75517850
mov dword [ebp - 0x17c], 0x5030794a
mov dword [ebp - 0x178], 0x3567534c
mov dword [ebp - 0x174], 0x36465846
mov dword [ebp - 0x170], 0x2b425766
mov dword [ebp - 0x16c], 0x2b5a4465
mov dword [ebp - 0x168], 0x38494247
mov dword [ebp - 0x164], 0x2b59534b
mov dword [ebp - 0x160], 0x6451534e
mov dword [ebp - 0x15c], 0x3845694a
mov dword [ebp - 0x158], 0x7030544d
mov dword [ebp - 0x154], 0x756b514d
mov dword [ebp - 0x150], 0x64514164
mov dword [ebp - 0x14c], 0x4659334d
mov dword [ebp - 0x148], 0x486b4344
mov dword [ebp - 0x144], 0x59554250
mov dword [ebp - 0x140], 0x35457863
mov dword [ebp - 0x13c], 0x4d513366
mov dword [ebp - 0x138], 0x7455574e
mov dword [ebp - 0x134], 0x4d34524f
mov dword [ebp - 0x130], 0x2b455247
mov dword [ebp - 0x12c], 0x7759695a
mov dword [ebp - 0x128], 0x6b59414d
mov dword [ebp - 0x124], 0x37465865
mov dword [ebp - 0x120], 0x64597744
mov dword [ebp - 0x11c], 0x30775447
mov dword [ebp - 0x118], 0x2b56524a
mov dword [ebp - 0x114], 0x4438774a
mov dword [ebp - 0x110], 0x42384442
mov dword [ebp - 0x10c], 0x2f394246
mov dword [ebp - 0x108], 0x4b596a47
mov dword [ebp - 0x104], 0x4d417a4f
mov dword [ebp - 0x100], 0x61306e41
mov dword [ebp - 0xfc], 0x334a7743
mov dword [ebp - 0xf8], 0x33465265
mov dword [ebp - 0xf4], 0x3273684a
mov dword [ebp - 0xf0], 0x2f314163
mov dword [ebp - 0xec], 0x69456843
mov dword [ebp - 0xe8], 0x74494347
mov dword [ebp - 0xe4], 0x39566d4d
mov dword [ebp - 0xe0], 0x656f6749
mov dword [ebp - 0xdc], 0x5577534a
mov dword [ebp - 0xd8], 0x6c676a43
mov dword [ebp - 0xd4], 0x6155584d
mov dword [ebp - 0xd0], 0x684d4166
mov dword [ebp - 0xcc], 0x57455246
mov dword [ebp - 0xc8], 0x4d45484d
mov dword [ebp - 0xc4], 0x47555446
mov dword [ebp - 0xc0], 0x53494259
mov dword [ebp - 0xbc], 0x6a4d4745
mov dword [ebp - 0xb8], 0x54595746
mov dword [ebp - 0xb4], 0x2f557947
mov dword [ebp - 0xb0], 0x7355774a
mov dword [ebp - 0xac], 0x45494343
mov dword [ebp - 0xa8], 0x5577444b
mov dword [ebp - 0xa4], 0x65555741
mov dword [ebp - 0xa0], 0x4e454343
mov dword [ebp - 0x9c], 0x6c385363
mov dword [ebp - 0x98], 0x39686d47
mov dword [ebp - 0x94], 0x31307844
mov dword [ebp - 0x90], 0x786b6861
mov dword [ebp - 0x8c], 0x79385149
mov dword [ebp - 0x88], 0x68787746
mov dword [ebp - 0x84], 0x36687765
mov dword [ebp - 0x80], 0x71385750
mov dword [ebp - 0x7c], 0x74555741
mov dword [ebp - 0x78], 0x47556a50
mov dword [ebp - 0x74], 0x7a396d48
mov dword [ebp - 0x70], 0x4a516d47
mov dword [ebp - 0x6c], 0x32787a4e
mov dword [ebp - 0x68], 0x325a3244
mov dword [ebp - 0x64], 0x316f6944
mov dword [ebp - 0x60], 0x75315344
mov dword [ebp - 0x5c], 0x49735250
mov dword [ebp - 0x58], 0x2f637a41
mov dword [ebp - 0x54], 0x3259524f
mov dword [ebp - 0x50], 0x356f414c
mov dword [ebp - 0x4c], 0x41416943
mov dword [ebp - 0x48], 0x345a5149
lea eax, [ebp - 0x14]
mov dword [ebp - 0x44], 0x2b49784e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x40], 0x52635144
push eax
xor eax, eax
mov dword [ebp - 0x3c], 0x3278674b
push eax
sub esp, 0xc
mov dword [ebp - 0x38], 0x37355449
mov ecx, esp
mov dword [ebp - 0x34], 0x4573774d
mov dword [ebp - 0x30], 0x34555466
mov dword [ebp - 0x2c], 0x41416766
mov word [ebp - 0x28], 0x4e41
mov byte [ebp - 0x26], 0x38
mov byte [ebp - 0x18c], al
push dword [ebp - 0x18c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.1008fc93
lea eax, [ebp - 0x198]
push eax
call fcn.10093029
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18c], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x24], ecx
mov ecx, eax
call fcn.1009cd44
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10094356
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x1009435a
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x198]
call fcn.1009cbc4
cmp byte [ebp - 0x1d], 0
jne 0x1009450c
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb4], 0x2f4d6743
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xb0], 0x686f544d
push eax
xor eax, eax
mov dword [ebp - 0xac], 0x75517850
push eax
sub esp, 0xc
mov dword [ebp - 0xa8], 0x5030794a
mov ecx, esp
mov dword [ebp - 0xa4], 0x3567534c
mov dword [ebp - 0xa0], 0x2b465846
mov dword [ebp - 0x9c], 0x2b6c5766
mov dword [ebp - 0x98], 0x73514766
mov dword [ebp - 0x94], 0x38494247
mov dword [ebp - 0x90], 0x2b59534b
mov dword [ebp - 0x8c], 0x6451534e
mov dword [ebp - 0x88], 0x3845694a
mov dword [ebp - 0x84], 0x7030544d
mov dword [ebp - 0x80], 0x50304849
mov dword [ebp - 0x7c], 0x56734863
mov dword [ebp - 0x78], 0x4130514a
mov dword [ebp - 0x74], 0x72777a50
mov dword [ebp - 0x70], 0x326b6850
mov dword [ebp - 0x6c], 0x4d346944
mov dword [ebp - 0x68], 0x69456a48
mov dword [ebp - 0x64], 0x736f424f
mov dword [ebp - 0x60], 0x2b646d62
mov dword [ebp - 0x5c], 0x56415349
mov dword [ebp - 0x58], 0x30315243
mov dword [ebp - 0x54], 0x6a735344
mov dword [ebp - 0x50], 0x6949434f
mov dword [ebp - 0x4c], 0x30774444
mov dword [ebp - 0x48], 0x4e596d42
mov dword [ebp - 0x44], 0x6e41694c
mov dword [ebp - 0x40], 0x54515443
mov dword [ebp - 0x3c], 0x79457a48
mov dword [ebp - 0x38], 0x64556764
mov dword [ebp - 0x34], 0x6a63784f
mov dword [ebp - 0x30], 0x41346845
mov dword [ebp - 0x2c], 0x2b414141
mov byte [ebp - 0x24], al
push dword [ebp - 0x24]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.1008fc93
lea eax, [ebp - 0x198]
push eax
call fcn.10093029
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], 2
call fcn.1009cd44
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100944f3
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x100944f7
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x198]
call fcn.1009cbc4
cmp byte [ebp - 0x1d], 0
je 0x1009451e
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.10099661
jmp 0x100948b3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x94], 0x54306843
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x90], 0x31494343
push eax
xor eax, eax
mov dword [ebp - 0x8c], 0x4d4d6d47
push eax
sub esp, 0xc
mov dword [ebp - 0x88], 0x6c417a65
mov ecx, esp
mov dword [ebp - 0x84], 0x33556746
mov dword [ebp - 0x80], 0x2f67784d
mov dword [ebp - 0x7c], 0x73777a49
mov dword [ebp - 0x78], 0x37636a43
mov dword [ebp - 0x74], 0x6d734348
mov dword [ebp - 0x70], 0x2f745243
mov dword [ebp - 0x6c], 0x374d774e
mov dword [ebp - 0x68], 0x47593242
mov dword [ebp - 0x64], 0x6c735162
mov dword [ebp - 0x60], 0x54454344
mov dword [ebp - 0x5c], 0x6742774a
mov dword [ebp - 0x58], 0x61494443
mov dword [ebp - 0x54], 0x706b6744
mov dword [ebp - 0x50], 0x35427a48
mov dword [ebp - 0x4c], 0x4b454448
mov dword [ebp - 0x48], 0x2f775145
mov dword [ebp - 0x44], 0x63455449
mov dword [ebp - 0x40], 0x754d6941
mov dword [ebp - 0x3c], 0x33747862
mov dword [ebp - 0x38], 0x2f5a5348
mov dword [ebp - 0x34], 0x45776865
mov dword [ebp - 0x30], 0x6e515348
mov dword [ebp - 0x2c], 0x41414141
mov word [ebp - 0x28], 0x5154
mov byte [ebp - 0x24], al
push dword [ebp - 0x24]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.1008fc93
lea eax, [ebp - 0x198]
push eax
call fcn.10093029
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 4
call fcn.1009cd44
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10094650
cmp dword [ebp - 0x14], 0
jne 0x10094657
mov byte [ebp - 0x18c], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x198]
call fcn.1009cbc4
cmp byte [ebp - 0x18c], 0
je 0x100948b3
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x100948b3
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0xf4], 0x6c527a63
push eax
sub esp, 0xc
mov dword [ebp - 0xf0], 0x68646a5a
mov ecx, esp
mov dword [ebp - 0xec], 0x705a5466
mov dword [ebp - 0xe8], 0x74776962
mov dword [ebp - 0xe4], 0x6b6c7945
mov dword [ebp - 0xe0], 0x4451334a
mov dword [ebp - 0xdc], 0x4a59514e
mov dword [ebp - 0xd8], 0x36355447
mov dword [ebp - 0xd4], 0x6e51794a
mov dword [ebp - 0xd0], 0x66417944
mov dword [ebp - 0xcc], 0x34557759
mov dword [ebp - 0xc8], 0x62735147
mov dword [ebp - 0xc4], 0x79517762
mov dword [ebp - 0xc0], 0x79315242
mov dword [ebp - 0xbc], 0x756f414c
mov dword [ebp - 0xb8], 0x72735142
mov dword [ebp - 0xb4], 0x71673242
mov dword [ebp - 0xb0], 0x3434524b
mov dword [ebp - 0xac], 0x484d6a45
mov dword [ebp - 0xa8], 0x54516e44
mov dword [ebp - 0xa4], 0x5a73784a
mov dword [ebp - 0xa0], 0x2b426942
mov dword [ebp - 0x9c], 0x75496749
mov dword [ebp - 0x98], 0x6359434a
mov dword [ebp - 0x94], 0x4a636746
mov dword [ebp - 0x90], 0x58414843
mov dword [ebp - 0x8c], 0x62734746
mov dword [ebp - 0x88], 0x4b344364
mov dword [ebp - 0x84], 0x57495263
mov dword [ebp - 0x80], 0x35733341
mov dword [ebp - 0x7c], 0x53555147
mov dword [ebp - 0x78], 0x56636762
mov dword [ebp - 0x74], 0x576b6a45
mov dword [ebp - 0x70], 0x30417948
mov dword [ebp - 0x6c], 0x5577584f
mov dword [ebp - 0x68], 0x35644443
mov dword [ebp - 0x64], 0x30385446
mov dword [ebp - 0x60], 0x72515141
mov dword [ebp - 0x5c], 0x736b5166
mov dword [ebp - 0x58], 0x39704248
mov dword [ebp - 0x54], 0x536f5450
mov dword [ebp - 0x50], 0x704d534b
mov dword [ebp - 0x4c], 0x466f7962
mov dword [ebp - 0x48], 0x44347947
mov dword [ebp - 0x44], 0x3745774b
mov dword [ebp - 0x40], 0x58515449
mov dword [ebp - 0x3c], 0x39674465
mov dword [ebp - 0x38], 0x70554349
mov dword [ebp - 0x34], 0x34676843
mov dword [ebp - 0x30], 0x35553342
mov dword [ebp - 0x2c], 0x41414141
mov word [ebp - 0x28], 0x7769
mov byte [ebp - 0x18c], al
push dword [ebp - 0x18c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.1008fc93
lea eax, [ebp - 0x198]
push eax
call fcn.10093029
add esp, 0x10
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.1009cd44
push eax
push ebx
call fcn.100928fb
add esp, 0x18
lea ecx, [ebp - 0x198]
call fcn.1009cbc4
cmp dword [ebp - 0x18], 0
je 0x100948c3
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1009ee4a
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10097310
call fcn.1009f3e1
ret