Function at 0x10411aac
Capabilities:
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x20c
mov eax, 0x1044f946
call fcn.1044d171
mov ebx, ecx
and dword [ebp - 0xb8], 0
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.1041a270
test eax, eax
je 0x1041235b
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.10419ced
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x1041235b
push esi
call fcn.10421e67
pop ecx
mov edi, eax
lea ecx, [ebp + 8]
push edi
push esi
push dword [ebp - 0x18]
call fcn.10419c68
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10412344
mov dword [ebp - 0x204], 0x32415244
mov dword [ebp - 0x200], 0x326f434e
mov dword [ebp - 0x1fc], 0x736b674a
mov dword [ebp - 0x1f8], 0x64346950
mov dword [ebp - 0x1f4], 0x744d7a4a
mov dword [ebp - 0x1f0], 0x35565742
mov dword [ebp - 0x1ec], 0x34684865
mov dword [ebp - 0x1e8], 0x335a7a64
mov dword [ebp - 0x1e4], 0x35735243
mov dword [ebp - 0x1e0], 0x7641694c
mov dword [ebp - 0x1dc], 0x55636a4d
mov dword [ebp - 0x1d8], 0x72457a49
mov dword [ebp - 0x1d4], 0x7241434b
mov dword [ebp - 0x1d0], 0x3430524e
mov dword [ebp - 0x1cc], 0x76356a66
mov dword [ebp - 0x1c8], 0x6b4d5159
mov dword [ebp - 0x1c4], 0x41776966
mov dword [ebp - 0x1c0], 0x4b30774f
mov dword [ebp - 0x1bc], 0x2b59514f
mov dword [ebp - 0x1b8], 0x7173684b
mov dword [ebp - 0x1b4], 0x366b4442
mov dword [ebp - 0x1b0], 0x7130434b
mov dword [ebp - 0x1ac], 0x50454362
mov dword [ebp - 0x1a8], 0x736b434b
mov dword [ebp - 0x1a4], 0x466f784d
mov dword [ebp - 0x1a0], 0x384d4741
mov dword [ebp - 0x19c], 0x35774349
mov dword [ebp - 0x198], 0x54636741
mov dword [ebp - 0x194], 0x3764694a
mov dword [ebp - 0x190], 0x6349534e
mov dword [ebp - 0x18c], 0x37464241
mov dword [ebp - 0x188], 0x71516e48
mov dword [ebp - 0x184], 0x6d345342
mov dword [ebp - 0x180], 0x5a454449
mov dword [ebp - 0x17c], 0x42554343
mov dword [ebp - 0x178], 0x64306845
mov dword [ebp - 0x174], 0x65384349
mov dword [ebp - 0x170], 0x7673784f
mov dword [ebp - 0x16c], 0x6d525345
mov dword [ebp - 0x168], 0x76384141
mov dword [ebp - 0x164], 0x426b435a
mov dword [ebp - 0x160], 0x3663484d
mov dword [ebp - 0x15c], 0x2f6f4164
mov dword [ebp - 0x158], 0x5a4d4449
mov dword [ebp - 0x154], 0x4c775250
mov dword [ebp - 0x150], 0x4530514c
mov dword [ebp - 0x14c], 0x78636949
mov dword [ebp - 0x148], 0x78745446
mov dword [ebp - 0x144], 0x79356a48
mov dword [ebp - 0x140], 0x4b347a46
mov dword [ebp - 0x13c], 0x4734694d
mov dword [ebp - 0x138], 0x58636843
mov dword [ebp - 0x134], 0x64675245
mov dword [ebp - 0x130], 0x7967524f
mov dword [ebp - 0x12c], 0x56516a48
mov dword [ebp - 0x128], 0x61674459
mov dword [ebp - 0x124], 0x6c4d534c
mov dword [ebp - 0x120], 0x7178784e
mov dword [ebp - 0x11c], 0x474d434c
mov dword [ebp - 0x118], 0x3155774c
mov dword [ebp - 0x114], 0x4f347748
mov dword [ebp - 0x110], 0x6459534c
mov dword [ebp - 0x10c], 0x55595344
mov dword [ebp - 0x108], 0x7435545a
mov dword [ebp - 0x104], 0x7a34684c
mov dword [ebp - 0x100], 0x6e494243
mov dword [ebp - 0xfc], 0x4a4d6866
mov dword [ebp - 0xf8], 0x6f555147
mov dword [ebp - 0xf4], 0x50416741
mov dword [ebp - 0xf0], 0x794d6845
mov dword [ebp - 0xec], 0x4f6f7a49
mov dword [ebp - 0xe8], 0x6349434a
mov dword [ebp - 0xe4], 0x736b6964
mov dword [ebp - 0xe0], 0x65496747
mov dword [ebp - 0xdc], 0x36774463
mov dword [ebp - 0xd8], 0x31456d4c
mov dword [ebp - 0xd4], 0x6b41534c
mov dword [ebp - 0xd0], 0x30775143
mov dword [ebp - 0xcc], 0x39415344
mov dword [ebp - 0xc8], 0x6f634443
mov dword [ebp - 0xc4], 0x41416750
lea eax, [ebp - 0x14]
mov word [ebp - 0xc0], 0x4d41
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 0xbe], 0x6f
push eax
push 0
lea eax, [ebp - 0xbd]
push eax
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x218]
call fcn.104115b3
sub esp, 0xc
mov ecx, esp
push ecx
push dword [eax + 4]
push dword [eax]
call fcn.1041a126
lea ecx, [ebp - 0x210]
call fcn.104112dd
add esp, 0xc
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], ecx
mov ecx, eax
call fcn.10419eaa
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
push eax
push edi
call esi
test eax, eax
je 0x10411ec6
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10411eca
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x210]
call fcn.10419ee8
cmp byte [ebp - 0x1d], 0
jne 0x10412063
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa4], 0x32415244
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xa0], 0x326f434e
push eax
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x9c], 0x736b674a
push eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x98], 0x64346950
push eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x94], 0x744d7a4a
mov dword [ebp - 0x90], 0x39565742
mov dword [ebp - 0x8c], 0x34464865
mov dword [ebp - 0x88], 0x6c513263
mov dword [ebp - 0x84], 0x35735243
mov dword [ebp - 0x80], 0x7641694c
mov dword [ebp - 0x7c], 0x55636a4d
mov dword [ebp - 0x78], 0x72457a49
mov dword [ebp - 0x74], 0x7241434b
mov dword [ebp - 0x70], 0x63675859
mov dword [ebp - 0x6c], 0x6a596847
mov dword [ebp - 0x68], 0x35704146
mov dword [ebp - 0x64], 0x734d5245
mov dword [ebp - 0x60], 0x4b597a46
mov dword [ebp - 0x5c], 0x694d6e45
mov dword [ebp - 0x58], 0x56675347
mov dword [ebp - 0x54], 0x76566949
mov dword [ebp - 0x50], 0x76747766
mov dword [ebp - 0x4c], 0x31735246
mov dword [ebp - 0x48], 0x65597748
mov dword [ebp - 0x44], 0x496f4247
mov dword [ebp - 0x40], 0x61307a47
mov dword [ebp - 0x3c], 0x41636748
mov dword [ebp - 0x38], 0x334d6942
mov dword [ebp - 0x34], 0x6438784d
mov dword [ebp - 0x30], 0x75777741
mov dword [ebp - 0x2c], 0x36706846
mov dword [ebp - 0x28], 0x4134794b
mov dword [ebp - 0x24], 0x34414141
call fcn.104115b3
sub esp, 0xc
mov ecx, esp
push ecx
push dword [eax + 4]
push dword [eax]
call fcn.1041a126
lea ecx, [ebp - 0x210]
call fcn.104112dd
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [ebp - 0xb8], 2
call fcn.10419eaa
push eax
push edi
call esi
test eax, eax
je 0x1041204a
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x1041204e
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x210]
call fcn.10419ee8
cmp byte [ebp - 0x1d], 0
je 0x10412075
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.1041ac58
jmp 0x10412344
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb4], 0x556f5844
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xb0], 0x6849774b
push eax
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0xac], 0x78457746
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xa8], 0x38557950
push eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0xa4], 0x626f4145
mov dword [ebp - 0xa0], 0x61455445
mov dword [ebp - 0x9c], 0x775a4145
mov dword [ebp - 0x98], 0x704d4442
mov dword [ebp - 0x94], 0x4e4d5441
mov dword [ebp - 0x90], 0x676b6943
mov dword [ebp - 0x8c], 0x72345761
mov dword [ebp - 0x88], 0x56556e63
mov dword [ebp - 0x84], 0x32633349
mov dword [ebp - 0x80], 0x6b384350
mov dword [ebp - 0x7c], 0x67635747
mov dword [ebp - 0x78], 0x4255674b
mov dword [ebp - 0x74], 0x754d6a42
mov dword [ebp - 0x70], 0x4a59784e
mov dword [ebp - 0x6c], 0x7a316859
mov dword [ebp - 0x68], 0x5934534e
mov dword [ebp - 0x64], 0x58555343
mov dword [ebp - 0x60], 0x51737845
mov dword [ebp - 0x5c], 0x77566a4e
mov dword [ebp - 0x58], 0x7a595744
mov dword [ebp - 0x54], 0x76385449
mov dword [ebp - 0x50], 0x47416d61
mov dword [ebp - 0x4c], 0x466b6a42
mov dword [ebp - 0x48], 0x78556845
mov dword [ebp - 0x44], 0x686b6941
mov dword [ebp - 0x40], 0x724e6a49
mov dword [ebp - 0x3c], 0x73636a44
mov dword [ebp - 0x38], 0x72385149
mov dword [ebp - 0x34], 0x32317963
mov dword [ebp - 0x30], 0x676f6747
mov dword [ebp - 0x2c], 0x7a636741
mov dword [ebp - 0x28], 0x41457a49
mov dword [ebp - 0x24], 0x71424141
call fcn.104115b3
sub esp, 0xc
mov ecx, esp
push ecx
push dword [eax + 4]
push dword [eax]
call fcn.1041a126
lea ecx, [ebp - 0x210]
call fcn.104112dd
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [ebp - 0xb8], 4
call fcn.10419eaa
push eax
push edi
call esi
test eax, eax
je 0x10412200
cmp dword [ebp - 0x14], 0
jne 0x10412207
mov byte [ebp - 0xbc], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x210]
call fcn.10419ee8
cmp byte [ebp - 0xbc], 0
je 0x10412344
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x10412344
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
lea ecx, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x21]
mov dword [ebp - 0x80], 0x73644364
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x7c], 0x32647959
push eax
mov dword [ebp - 0x78], 0x7274435a
mov dword [ebp - 0x74], 0x4d387964
mov dword [ebp - 0x70], 0x6d553247
mov dword [ebp - 0x6c], 0x66455361
mov dword [ebp - 0x68], 0x4a515863
mov dword [ebp - 0x64], 0x7155444b
mov dword [ebp - 0x60], 0x46676e4a
mov dword [ebp - 0x5c], 0x4459484e
mov dword [ebp - 0x58], 0x4263444d
mov dword [ebp - 0x54], 0x66635164
mov dword [ebp - 0x50], 0x3851414d
mov dword [ebp - 0x4c], 0x7338425a
mov dword [ebp - 0x48], 0x7555794b
mov dword [ebp - 0x44], 0x31454445
mov dword [ebp - 0x40], 0x39416e47
mov dword [ebp - 0x3c], 0x4d304244
mov dword [ebp - 0x38], 0x684d4465
mov dword [ebp - 0x34], 0x7677674d
mov dword [ebp - 0x30], 0x4e6f7a5a
mov dword [ebp - 0x2c], 0x516f5343
mov dword [ebp - 0x28], 0x41417749
mov word [ebp - 0x24], 0x4441
mov byte [ebp - 0x22], 0x67
call fcn.104115b3
sub esp, 0xc
mov ecx, esp
push ecx
push dword [eax + 4]
push dword [eax]
call fcn.1041a126
lea ecx, [ebp - 0x210]
call fcn.104112dd
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.10419eaa
push eax
push ebx
call fcn.1041efb2
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.10419ee8
cmp dword [ebp - 0x18], 0
je 0x10412354
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.104217da
pop ecx
lea ecx, [ebp + 8]
call fcn.10412369
call fcn.1044d11b
ret