Function at 0x43baac
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x15c
mov eax, 0x49075f
call fcn.0045a8ee
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x158], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43c62d
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x43c62d
push esi
call fcn.00457bd7
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43c616
lea eax, [ebp - 0x14]
mov dword [ebp - 0xfc], 0x38384246
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xf8], 0x73677a50
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xf4], 0x7451414e
mov ecx, esp
mov dword [ebp - 0xf0], 0x446b694c
lea eax, [ebp - 0x1d]
mov dword [ebp - 0xec], 0x7063534c
lea edx, [ebp - 0x25]
mov dword [ebp - 0xe8], 0x35564747
push eax
push edx
lea esi, [ebp - 0xfc]
mov dword [ebp - 0xe4], 0x33313364
push esi
mov dword [ebp - 0xe0], 0x6d4a5466
mov dword [ebp - 0xdc], 0x684d6743
mov dword [ebp - 0xd8], 0x6b30434a
mov dword [ebp - 0xd4], 0x65677a4b
mov dword [ebp - 0xd0], 0x784d434b
mov dword [ebp - 0xcc], 0x7130694f
mov dword [ebp - 0xc8], 0x38425164
mov dword [ebp - 0xc4], 0x5663584b
mov dword [ebp - 0xc0], 0x2b514243
mov dword [ebp - 0xbc], 0x2b4a514c
mov dword [ebp - 0xb8], 0x79777a44
mov dword [ebp - 0xb4], 0x53514141
mov dword [ebp - 0xb0], 0x7a344243
mov dword [ebp - 0xac], 0x34343347
mov dword [ebp - 0xa8], 0x554d7950
mov dword [ebp - 0xa4], 0x6473534f
mov dword [ebp - 0xa0], 0x62454147
mov dword [ebp - 0x9c], 0x30684264
mov dword [ebp - 0x98], 0x48345264
mov dword [ebp - 0x94], 0x70417941
mov dword [ebp - 0x90], 0x584d5148
mov dword [ebp - 0x8c], 0x6e397a5a
mov dword [ebp - 0x88], 0x6b734142
mov dword [ebp - 0x84], 0x4e776a4d
mov dword [ebp - 0x80], 0x3467324a
mov dword [ebp - 0x7c], 0x38684348
mov dword [ebp - 0x78], 0x6f73424b
mov dword [ebp - 0x74], 0x4259334c
mov dword [ebp - 0x70], 0x39456864
mov dword [ebp - 0x6c], 0x56556761
mov dword [ebp - 0x68], 0x77674442
mov dword [ebp - 0x64], 0x4b6b6762
mov dword [ebp - 0x60], 0x6e454342
mov dword [ebp - 0x5c], 0x2b676950
mov dword [ebp - 0x58], 0x42553248
mov dword [ebp - 0x54], 0x4b515150
mov dword [ebp - 0x50], 0x6e385348
mov dword [ebp - 0x4c], 0x5159794d
mov dword [ebp - 0x48], 0x30554164
mov dword [ebp - 0x44], 0x3263444e
mov dword [ebp - 0x40], 0x3945524d
mov dword [ebp - 0x3c], 0x3738424f
mov dword [ebp - 0x38], 0x58515345
mov dword [ebp - 0x34], 0x62417742
mov dword [ebp - 0x30], 0x4c736843
mov dword [ebp - 0x2c], 0x41416759
mov word [ebp - 0x28], 0x4841
mov byte [ebp - 0x26], 0x59
call fcn.0040a169
lea eax, [ebp - 0x168]
push eax
call fcn.0042a1df
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x15c], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x158], ecx
mov ecx, eax
call fcn.004103eb
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43bd48
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x43bd4c
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.00455078
cmp byte [ebp - 0x1d], 0
jne 0x43c04d
lea eax, [ebp - 0x14]
mov dword [ebp - 0x138], 0x38384246
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x134], 0x73677a50
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x130], 0x7451414e
lea eax, [ebp - 0x1d]
mov dword [ebp - 0x12c], 0x446b694c
mov ecx, esp
mov dword [ebp - 0x128], 0x7063534c
mov dword [ebp - 0x124], 0x39564747
lea esi, [ebp - 0x138]
mov dword [ebp - 0x120], 0x33523364
lea edx, [ebp - 0x22]
mov dword [ebp - 0x11c], 0x30415765
mov dword [ebp - 0x118], 0x684d6743
mov dword [ebp - 0x114], 0x6b30434a
mov dword [ebp - 0x110], 0x65677a4b
mov dword [ebp - 0x10c], 0x784d434b
mov dword [ebp - 0x108], 0x7130694f
mov dword [ebp - 0x104], 0x65597a4a
mov dword [ebp - 0x100], 0x2b527945
mov dword [ebp - 0xfc], 0x67553244
mov dword [ebp - 0xf8], 0x77466750
mov dword [ebp - 0xf4], 0x51594149
mov dword [ebp - 0xf0], 0x67465448
mov dword [ebp - 0xec], 0x65637748
mov dword [ebp - 0xe8], 0x35687866
mov dword [ebp - 0xe4], 0x33783344
mov dword [ebp - 0xe0], 0x41516949
mov dword [ebp - 0xdc], 0x69775264
mov dword [ebp - 0xd8], 0x706f414d
mov dword [ebp - 0xd4], 0x30454446
mov dword [ebp - 0xd0], 0x33633364
mov dword [ebp - 0xcc], 0x69784266
mov dword [ebp - 0xc8], 0x6630424d
mov dword [ebp - 0xc4], 0x6731424b
mov dword [ebp - 0xc0], 0x6a6f5849
mov dword [ebp - 0xbc], 0x744d4759
mov dword [ebp - 0xb8], 0x43677a61
mov dword [ebp - 0xb4], 0x7970784b
mov dword [ebp - 0xb0], 0x526b6e42
mov dword [ebp - 0xac], 0x43676841
mov dword [ebp - 0xa8], 0x33707946
mov dword [ebp - 0xa4], 0x56495247
mov dword [ebp - 0xa0], 0x2b745445
mov dword [ebp - 0x9c], 0x4a34684f
mov dword [ebp - 0x98], 0x39394444
mov dword [ebp - 0x94], 0x4a415365
mov dword [ebp - 0x90], 0x556b674b
mov dword [ebp - 0x8c], 0x3667674f
mov dword [ebp - 0x88], 0x4e6b534b
mov dword [ebp - 0x84], 0x73554750
mov dword [ebp - 0x80], 0x2b494444
mov dword [ebp - 0x7c], 0x69677842
mov dword [ebp - 0x78], 0x68397847
mov dword [ebp - 0x74], 0x7078444c
mov dword [ebp - 0x70], 0x62515843
mov dword [ebp - 0x6c], 0x64416841
mov dword [ebp - 0x68], 0x49494846
mov dword [ebp - 0x64], 0x774d4341
mov dword [ebp - 0x60], 0x514d4843
mov dword [ebp - 0x5c], 0x446f6764
mov dword [ebp - 0x58], 0x2b51484a
mov dword [ebp - 0x54], 0x6a457965
mov dword [ebp - 0x50], 0x5a55544d
mov dword [ebp - 0x4c], 0x6b4d4350
mov dword [ebp - 0x48], 0x5a674848
mov dword [ebp - 0x44], 0x336f7a4f
mov dword [ebp - 0x40], 0x51383248
mov dword [ebp - 0x3c], 0x37686742
mov dword [ebp - 0x38], 0x7a513342
mov dword [ebp - 0x34], 0x6e384444
mov dword [ebp - 0x30], 0x73414143
mov dword [ebp - 0x2c], 0x46386842
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x5170
push eax
push edx
push esi
call fcn.0040a169
lea eax, [ebp - 0x168]
push eax
call fcn.0042a1df
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x158], 2
call fcn.004103eb
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43c034
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x43c038
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.00455078
cmp byte [ebp - 0x1d], 0
je 0x43c05f
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.0040bd90
jmp 0x43c616
lea eax, [ebp - 0x14]
mov dword [ebp - 0x154], 0x2b344846
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x150], 0x45636843
mov dword [ebp - 0x14c], 0x6341584b
mov dword [ebp - 0x148], 0x6777544d
mov dword [ebp - 0x144], 0x5a38674b
mov dword [ebp - 0x140], 0x42596743
mov dword [ebp - 0x13c], 0x756b6966
mov dword [ebp - 0x138], 0x53416948
mov dword [ebp - 0x134], 0x7156784e
mov dword [ebp - 0x130], 0x57634165
mov dword [ebp - 0x12c], 0x71344450
mov dword [ebp - 0x128], 0x7a414443
mov dword [ebp - 0x124], 0x544d5343
mov dword [ebp - 0x120], 0x796b4842
mov dword [ebp - 0x11c], 0x31354241
mov dword [ebp - 0x118], 0x43596d44
mov dword [ebp - 0x114], 0x6f30444d
mov dword [ebp - 0x110], 0x7630484f
mov dword [ebp - 0x10c], 0x576f7847
mov dword [ebp - 0x108], 0x62737741
mov dword [ebp - 0x104], 0x68597742
mov dword [ebp - 0x100], 0x64455750
mov dword [ebp - 0xfc], 0x634d5250
mov dword [ebp - 0xf8], 0x776f684d
mov dword [ebp - 0xf4], 0x41387763
mov dword [ebp - 0xf0], 0x6c775250
mov dword [ebp - 0xec], 0x2b49774d
mov dword [ebp - 0xe8], 0x6d51434b
mov dword [ebp - 0xe4], 0x596f4448
mov dword [ebp - 0xe0], 0x69306866
mov dword [ebp - 0xdc], 0x654d7747
mov dword [ebp - 0xd8], 0x3663524a
mov dword [ebp - 0xd4], 0x56636a4a
mov dword [ebp - 0xd0], 0x6c6f544a
mov dword [ebp - 0xcc], 0x7845544c
mov dword [ebp - 0xc8], 0x30315363
mov dword [ebp - 0xc4], 0x43347744
mov dword [ebp - 0xc0], 0x6449434d
mov dword [ebp - 0xbc], 0x39344449
mov dword [ebp - 0xb8], 0x6f454343
mov dword [ebp - 0xb4], 0x72346948
mov dword [ebp - 0xb0], 0x424d7841
mov dword [ebp - 0xac], 0x7745534a
mov dword [ebp - 0xa8], 0x706b3347
mov dword [ebp - 0xa4], 0x786c6e47
mov dword [ebp - 0xa0], 0x49514464
mov dword [ebp - 0x9c], 0x30774346
mov dword [ebp - 0x98], 0x4d515450
mov dword [ebp - 0x94], 0x44457942
mov dword [ebp - 0x90], 0x33595243
mov dword [ebp - 0x8c], 0x65734248
mov dword [ebp - 0x88], 0x4f6b4443
mov dword [ebp - 0x84], 0x306f4847
mov dword [ebp - 0x80], 0x2f356747
mov dword [ebp - 0x7c], 0x2b455864
mov dword [ebp - 0x78], 0x35684464
mov dword [ebp - 0x74], 0x4d496a50
mov dword [ebp - 0x70], 0x52555165
mov dword [ebp - 0x6c], 0x346f5159
mov dword [ebp - 0x68], 0x45384846
mov dword [ebp - 0x64], 0x4b4d6743
mov dword [ebp - 0x60], 0x4a515350
mov dword [ebp - 0x5c], 0x384d7961
mov dword [ebp - 0x58], 0x7334584c
mov dword [ebp - 0x54], 0x4b495842
mov dword [ebp - 0x50], 0x41514450
mov dword [ebp - 0x4c], 0x7149514c
mov dword [ebp - 0x48], 0x5349684f
mov dword [ebp - 0x44], 0x566f7848
mov dword [ebp - 0x40], 0x3851674a
mov dword [ebp - 0x3c], 0x4e4d4245
mov dword [ebp - 0x38], 0x49596a49
mov dword [ebp - 0x34], 0x78595448
mov dword [ebp - 0x30], 0x4c34534b
mov dword [ebp - 0x2c], 0x4d6b7847
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x4134
push eax
push 0
sub esp, 0xc
lea eax, [ebp - 0x1d]
mov ecx, esp
lea edx, [ebp - 0x22]
lea esi, [ebp - 0x154]
push eax
push edx
push esi
call fcn.0040a169
lea eax, [ebp - 0x168]
push eax
call fcn.0042a1df
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x158], 4
call fcn.004103eb
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43c370
cmp dword [ebp - 0x14], 0
jne 0x43c377
mov byte [ebp - 0x15c], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.00455078
cmp byte [ebp - 0x15c], 0
je 0x43c616
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x43c616
movzx eax, word [ecx + 0xc]
lea edx, [ebp - 0x25]
push eax
movzx eax, word [ecx + 0xe]
lea esi, [ebp - 0x114]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x114], 0x6d685362
mov ecx, esp
mov dword [ebp - 0x110], 0x73564461
lea eax, [ebp - 0x1d]
mov dword [ebp - 0x10c], 0x715a6964
mov dword [ebp - 0x108], 0x7667795a
push eax
push edx
push esi
mov dword [ebp - 0x104], 0x7a35794f
mov dword [ebp - 0x100], 0x6863414d
mov dword [ebp - 0xfc], 0x7a415363
mov dword [ebp - 0xf8], 0x31674344
mov dword [ebp - 0xf4], 0x3845525a
mov dword [ebp - 0xf0], 0x5663514d
mov dword [ebp - 0xec], 0x51345248
mov dword [ebp - 0xe8], 0x7a52524b
mov dword [ebp - 0xe4], 0x49734359
mov dword [ebp - 0xe0], 0x38417763
mov dword [ebp - 0xdc], 0x2f67414c
mov dword [ebp - 0xd8], 0x4d553244
mov dword [ebp - 0xd4], 0x43306e4d
mov dword [ebp - 0xd0], 0x44597a66
mov dword [ebp - 0xcc], 0x6b456941
mov dword [ebp - 0xc8], 0x5a415865
mov dword [ebp - 0xc4], 0x74456d48
mov dword [ebp - 0xc0], 0x53674259
mov dword [ebp - 0xbc], 0x4d594344
mov dword [ebp - 0xb8], 0x59517843
mov dword [ebp - 0xb4], 0x494d6865
mov dword [ebp - 0xb0], 0x4c384363
mov dword [ebp - 0xac], 0x55776a42
mov dword [ebp - 0xa8], 0x6c6c4241
mov dword [ebp - 0xa4], 0x31417962
mov dword [ebp - 0xa0], 0x39736841
mov dword [ebp - 0x9c], 0x39386749
mov dword [ebp - 0x98], 0x5073784a
mov dword [ebp - 0x94], 0x6f51535a
mov dword [ebp - 0x90], 0x5a416943
mov dword [ebp - 0x8c], 0x794e4242
mov dword [ebp - 0x88], 0x47304766
mov dword [ebp - 0x84], 0x6b384363
mov dword [ebp - 0x80], 0x6c4a7943
mov dword [ebp - 0x7c], 0x6a634245
mov dword [ebp - 0x78], 0x6a424343
mov dword [ebp - 0x74], 0x78354365
mov dword [ebp - 0x70], 0x72734449
mov dword [ebp - 0x6c], 0x6d6f544f
mov dword [ebp - 0x68], 0x45307863
mov dword [ebp - 0x64], 0x436b5442
mov dword [ebp - 0x60], 0x474d7742
mov dword [ebp - 0x5c], 0x64636a61
mov dword [ebp - 0x58], 0x6230784f
mov dword [ebp - 0x54], 0x68456750
mov dword [ebp - 0x50], 0x6f774466
mov dword [ebp - 0x4c], 0x6e34585a
mov dword [ebp - 0x48], 0x4e6f7844
mov dword [ebp - 0x44], 0x6e4d584d
mov dword [ebp - 0x40], 0x4f6f4146
mov dword [ebp - 0x3c], 0x2f556e4a
mov dword [ebp - 0x38], 0x496f7745
mov dword [ebp - 0x34], 0x66306963
mov dword [ebp - 0x30], 0x67317845
mov dword [ebp - 0x2c], 0x4141515a
mov word [ebp - 0x28], 0x4b41
mov byte [ebp - 0x26], 0x51
call fcn.0040a169
lea eax, [ebp - 0x168]
push eax
call fcn.0042a1df
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004103eb
push eax
push ebx
call fcn.00426614
add esp, 0x18
lea ecx, [ebp - 0x168]
call fcn.00455078
cmp dword [ebp - 0x18], 0
je 0x43c626
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0045a60a
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040bc6b
call fcn.0045a89d
ret