Function at 0x1041327d
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x100
mov eax, 0x1044c4ee
call fcn.1041e43a
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0xfc], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10413aed
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x10413aed
push esi
call fcn.1041de44
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10413ad6
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc8], 0x73494144
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc4], 0x6f386949
push eax
xor eax, eax
mov dword [ebp - 0xc0], 0x7251684a
push eax
sub esp, 0xc
mov dword [ebp - 0xbc], 0x484d4349
mov ecx, esp
mov dword [ebp - 0xb8], 0x716f534c
mov dword [ebp - 0xb4], 0x6c5a3343
mov dword [ebp - 0xb0], 0x35746d64
mov dword [ebp - 0xac], 0x3456435a
mov dword [ebp - 0xa8], 0x32514242
mov dword [ebp - 0xa4], 0x784d7949
mov dword [ebp - 0xa0], 0x4f55794d
mov dword [ebp - 0x9c], 0x3151544e
mov dword [ebp - 0x98], 0x7330444b
mov dword [ebp - 0x94], 0x4d636942
mov dword [ebp - 0x90], 0x4349414b
mov dword [ebp - 0x8c], 0x6c454146
mov dword [ebp - 0x88], 0x75386848
mov dword [ebp - 0x84], 0x4230434b
mov dword [ebp - 0x80], 0x424d5847
mov dword [ebp - 0x7c], 0x78777950
mov dword [ebp - 0x78], 0x5763434e
mov dword [ebp - 0x74], 0x30346e50
mov dword [ebp - 0x70], 0x37567a49
mov dword [ebp - 0x6c], 0x46384165
mov dword [ebp - 0x68], 0x756b414c
mov dword [ebp - 0x64], 0x57774441
mov dword [ebp - 0x60], 0x6a635346
mov dword [ebp - 0x5c], 0x5a384861
mov dword [ebp - 0x58], 0x6855674c
mov dword [ebp - 0x54], 0x57414242
mov dword [ebp - 0x50], 0x57633245
mov dword [ebp - 0x4c], 0x77554346
mov dword [ebp - 0x48], 0x32527a4c
mov dword [ebp - 0x44], 0x36736d47
mov dword [ebp - 0x40], 0x2f6f6a4f
mov dword [ebp - 0x3c], 0x3051694c
mov dword [ebp - 0x38], 0x78316744
mov dword [ebp - 0x34], 0x796b674e
mov dword [ebp - 0x30], 0x53596a43
mov dword [ebp - 0x2c], 0x53515842
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x5155
mov byte [ebp - 0x100], al
push dword [ebp - 0x100]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.1040f456
lea eax, [ebp - 0x10c]
push eax
call fcn.1041242f
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x100], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0xfc], ecx
mov ecx, eax
call fcn.1041baf5
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x104134ab
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x104134af
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.1041b975
cmp byte [ebp - 0x1d], 0
jne 0x1041364f
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa4], 0x73494144
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xa0], 0x6f386949
push eax
xor eax, eax
mov dword [ebp - 0x9c], 0x7251684a
push eax
sub esp, 0xc
mov dword [ebp - 0x98], 0x484d4349
mov ecx, esp
mov dword [ebp - 0x94], 0x716f534c
mov dword [ebp - 0x90], 0x685a3343
mov dword [ebp - 0x8c], 0x354a6d64
mov dword [ebp - 0x88], 0x71634859
mov dword [ebp - 0x84], 0x32514242
mov dword [ebp - 0x80], 0x784d7949
mov dword [ebp - 0x7c], 0x4f55794d
mov dword [ebp - 0x78], 0x3151544e
mov dword [ebp - 0x74], 0x7330444b
mov dword [ebp - 0x70], 0x59457865
mov dword [ebp - 0x6c], 0x526b7747
mov dword [ebp - 0x68], 0x6f677945
mov dword [ebp - 0x64], 0x39684343
mov dword [ebp - 0x60], 0x4a555845
mov dword [ebp - 0x5c], 0x2b455848
mov dword [ebp - 0x58], 0x78596a66
mov dword [ebp - 0x54], 0x38637a4a
mov dword [ebp - 0x50], 0x5a344861
mov dword [ebp - 0x4c], 0x7459794f
mov dword [ebp - 0x48], 0x2f4d584b
mov dword [ebp - 0x44], 0x2f385246
mov dword [ebp - 0x40], 0x6d674142
mov dword [ebp - 0x3c], 0x45597950
mov dword [ebp - 0x38], 0x78397a41
mov dword [ebp - 0x34], 0x4c416a62
mov dword [ebp - 0x30], 0x305a7a4c
mov dword [ebp - 0x2c], 0x4341794a
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x674e
mov byte [ebp - 0xfc], al
push dword [ebp - 0xfc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.1040f456
lea eax, [ebp - 0x10c]
push eax
call fcn.1041242f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0xfc], 2
call fcn.1041baf5
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10413636
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x1041363a
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.1041b975
cmp byte [ebp - 0x1d], 0
je 0x10413661
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.10418341
jmp 0x10413ad6
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe0], 0x616f4444
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xdc], 0x2b78534f
push eax
xor eax, eax
mov dword [ebp - 0xd8], 0x32314142
push eax
sub esp, 0xc
mov dword [ebp - 0xd4], 0x32674164
mov ecx, esp
mov dword [ebp - 0xd0], 0x6f6b5443
mov dword [ebp - 0xcc], 0x3445414f
mov dword [ebp - 0xc8], 0x7173544a
mov dword [ebp - 0xc4], 0x41594449
mov dword [ebp - 0xc0], 0x5545544d
mov dword [ebp - 0xbc], 0x38457766
mov dword [ebp - 0xb8], 0x6f557947
mov dword [ebp - 0xb4], 0x53776859
mov dword [ebp - 0xb0], 0x47775443
mov dword [ebp - 0xac], 0x47515164
mov dword [ebp - 0xa8], 0x6d595343
mov dword [ebp - 0xa4], 0x5141514f
mov dword [ebp - 0xa0], 0x46736a63
mov dword [ebp - 0x9c], 0x75456a59
mov dword [ebp - 0x98], 0x31355245
mov dword [ebp - 0x94], 0x6a4d6849
mov dword [ebp - 0x90], 0x7a595261
mov dword [ebp - 0x8c], 0x7a306745
mov dword [ebp - 0x88], 0x4c594362
mov dword [ebp - 0x84], 0x38355250
mov dword [ebp - 0x80], 0x5467434b
mov dword [ebp - 0x7c], 0x2b344250
mov dword [ebp - 0x78], 0x59454344
mov dword [ebp - 0x74], 0x6a59335a
mov dword [ebp - 0x70], 0x53597a4e
mov dword [ebp - 0x6c], 0x74307a49
mov dword [ebp - 0x68], 0x42514461
mov dword [ebp - 0x64], 0x636f6750
mov dword [ebp - 0x60], 0x3667774b
mov dword [ebp - 0x5c], 0x6a646948
mov dword [ebp - 0x58], 0x73594463
mov dword [ebp - 0x54], 0x77345247
mov dword [ebp - 0x50], 0x3735444d
mov dword [ebp - 0x4c], 0x70497a45
mov dword [ebp - 0x48], 0x39416743
mov dword [ebp - 0x44], 0x516f694f
mov dword [ebp - 0x40], 0x76565159
mov dword [ebp - 0x3c], 0x33357949
mov dword [ebp - 0x38], 0x62514362
mov dword [ebp - 0x34], 0x33347742
mov dword [ebp - 0x30], 0x7551484a
mov dword [ebp - 0x2c], 0x3438684e
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x5169
mov byte [ebp - 0xfc], al
push dword [ebp - 0xfc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.1040f456
lea eax, [ebp - 0x10c]
push eax
call fcn.1041242f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0xfc], 4
call fcn.1041baf5
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10413861
cmp dword [ebp - 0x14], 0
jne 0x10413868
mov byte [ebp - 0x100], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.1041b975
cmp byte [ebp - 0x100], 0
je 0x10413ad6
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x10413ad6
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0xf8], 0x32565464
push eax
sub esp, 0xc
mov dword [ebp - 0xf4], 0x6f4a5364
mov ecx, esp
mov dword [ebp - 0xf0], 0x735a445a
mov dword [ebp - 0xec], 0x58495361
mov dword [ebp - 0xe8], 0x7451774f
mov dword [ebp - 0xe4], 0x67495247
mov dword [ebp - 0xe0], 0x36417a46
mov dword [ebp - 0xdc], 0x7541694f
mov dword [ebp - 0xd8], 0x57416a4d
mov dword [ebp - 0xd4], 0x7a31784f
mov dword [ebp - 0xd0], 0x49415450
mov dword [ebp - 0xcc], 0x2b357a4e
mov dword [ebp - 0xc8], 0x7742794b
mov dword [ebp - 0xc4], 0x37565243
mov dword [ebp - 0xc0], 0x6f355342
mov dword [ebp - 0xbc], 0x2f49774c
mov dword [ebp - 0xb8], 0x45517844
mov dword [ebp - 0xb4], 0x6c745346
mov dword [ebp - 0xb0], 0x48344449
mov dword [ebp - 0xac], 0x676f474e
mov dword [ebp - 0xa8], 0x53635450
mov dword [ebp - 0xa4], 0x6367794d
mov dword [ebp - 0xa0], 0x315a6848
mov dword [ebp - 0x9c], 0x73596865
mov dword [ebp - 0x98], 0x4f736a41
mov dword [ebp - 0x94], 0x51634850
mov dword [ebp - 0x90], 0x44596745
mov dword [ebp - 0x8c], 0x3545514d
mov dword [ebp - 0x88], 0x6f457a47
mov dword [ebp - 0x84], 0x56454848
mov dword [ebp - 0x80], 0x72456743
mov dword [ebp - 0x7c], 0x6b737959
mov dword [ebp - 0x78], 0x37787a47
mov dword [ebp - 0x74], 0x37734743
mov dword [ebp - 0x70], 0x4d496745
mov dword [ebp - 0x6c], 0x2f34514f
mov dword [ebp - 0x68], 0x34356843
mov dword [ebp - 0x64], 0x2f786949
mov dword [ebp - 0x60], 0x68554344
mov dword [ebp - 0x5c], 0x336b4343
mov dword [ebp - 0x58], 0x4d416a59
mov dword [ebp - 0x54], 0x4f45415a
mov dword [ebp - 0x50], 0x7345324d
mov dword [ebp - 0x4c], 0x3477424b
mov dword [ebp - 0x48], 0x6f637965
mov dword [ebp - 0x44], 0x63417748
mov dword [ebp - 0x40], 0x63455243
mov dword [ebp - 0x3c], 0x4f344848
mov dword [ebp - 0x38], 0x39785247
mov dword [ebp - 0x34], 0x4c49584f
mov dword [ebp - 0x30], 0x6549324f
mov dword [ebp - 0x2c], 0x72526850
mov dword [ebp - 0x28], 0x416b6a4c
mov dword [ebp - 0x24], 0x54434141
mov byte [ebp - 0x100], al
push dword [ebp - 0x100]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.1040f456
lea eax, [ebp - 0x10c]
push eax
call fcn.1041242f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1041baf5
push eax
push ebx
call fcn.10411ddb
add esp, 0x18
lea ecx, [ebp - 0x10c]
call fcn.1041b975
cmp dword [ebp - 0x18], 0
je 0x10413ae6
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1041de4d
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10416360
call fcn.1041e3e4
ret