Function at 0x104137a9
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x1a0
mov eax, 0x1044d2ff
call fcn.1041f28d
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x19c], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1041461c
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1041461c
push esi
call fcn.1041ec97
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10414605
mov dword [ebp - 0x198], 0x326b7844
mov dword [ebp - 0x194], 0x326f4349
mov dword [ebp - 0x190], 0x7177414a
mov dword [ebp - 0x18c], 0x4b6f534b
mov dword [ebp - 0x188], 0x3349544a
mov dword [ebp - 0x184], 0x68523347
mov dword [ebp - 0x180], 0x35705761
mov dword [ebp - 0x17c], 0x79467a5a
mov dword [ebp - 0x178], 0x38636847
mov dword [ebp - 0x174], 0x2b496a4f
mov dword [ebp - 0x170], 0x5534444d
mov dword [ebp - 0x16c], 0x72457a4e
mov dword [ebp - 0x168], 0x7455694b
mov dword [ebp - 0x164], 0x4a733343
mov dword [ebp - 0x160], 0x4a454250
mov dword [ebp - 0x15c], 0x6774514b
mov dword [ebp - 0x158], 0x6a413246
mov dword [ebp - 0x154], 0x37706a4e
mov dword [ebp - 0x150], 0x6b456e4d
mov dword [ebp - 0x14c], 0x714d6845
mov dword [ebp - 0x148], 0x7877774a
mov dword [ebp - 0x144], 0x6755545a
mov dword [ebp - 0x140], 0x486b334a
mov dword [ebp - 0x13c], 0x6134334e
mov dword [ebp - 0x138], 0x52777845
mov dword [ebp - 0x134], 0x55637a4b
mov dword [ebp - 0x130], 0x75637a4d
mov dword [ebp - 0x12c], 0x77416943
mov dword [ebp - 0x128], 0x5a776745
mov dword [ebp - 0x124], 0x386f4265
mov dword [ebp - 0x120], 0x726f7a4a
mov dword [ebp - 0x11c], 0x4e6b5449
mov dword [ebp - 0x118], 0x75384164
mov dword [ebp - 0x114], 0x75677846
mov dword [ebp - 0x110], 0x7934424b
mov dword [ebp - 0x10c], 0x2f634241
mov dword [ebp - 0x108], 0x71734250
mov dword [ebp - 0x104], 0x7a4d535a
mov dword [ebp - 0x100], 0x4b45534d
mov dword [ebp - 0xfc], 0x7541674d
mov dword [ebp - 0xf8], 0x336c6950
mov dword [ebp - 0xf4], 0x706c5145
mov dword [ebp - 0xf0], 0x7351514d
mov dword [ebp - 0xec], 0x46497746
mov dword [ebp - 0xe8], 0x7339524b
mov dword [ebp - 0xe4], 0x7a417841
mov dword [ebp - 0xe0], 0x6334584d
mov dword [ebp - 0xdc], 0x3652435a
mov dword [ebp - 0xd8], 0x4d514145
mov dword [ebp - 0xd4], 0x556b684e
mov dword [ebp - 0xd0], 0x596f7a4a
mov dword [ebp - 0xcc], 0x79455347
mov dword [ebp - 0xc8], 0x52675347
mov dword [ebp - 0xc4], 0x32386a44
mov dword [ebp - 0xc0], 0x69494365
mov dword [ebp - 0xbc], 0x2f413350
mov dword [ebp - 0xb8], 0x76414441
mov dword [ebp - 0xb4], 0x62675242
mov dword [ebp - 0xb0], 0x3577794b
mov dword [ebp - 0xac], 0x79414442
mov dword [ebp - 0xa8], 0x56776766
mov dword [ebp - 0xa4], 0x30737950
mov dword [ebp - 0xa0], 0x77747a4d
mov dword [ebp - 0x9c], 0x61736a47
mov dword [ebp - 0x98], 0x52596d43
mov dword [ebp - 0x94], 0x47497a46
mov dword [ebp - 0x90], 0x4963474c
mov dword [ebp - 0x8c], 0x4a6b4342
mov dword [ebp - 0x88], 0x3431544e
mov dword [ebp - 0x84], 0x2f344165
mov dword [ebp - 0x80], 0x6a555145
mov dword [ebp - 0x7c], 0x4e495845
mov dword [ebp - 0x78], 0x74345447
mov dword [ebp - 0x74], 0x5a6b6e45
mov dword [ebp - 0x70], 0x35775248
mov dword [ebp - 0x6c], 0x7973534a
mov dword [ebp - 0x68], 0x44416a43
mov dword [ebp - 0x64], 0x6b594146
mov dword [ebp - 0x60], 0x6e417a41
mov dword [ebp - 0x5c], 0x49386d45
mov dword [ebp - 0x58], 0x77746e4b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x54], 0x67314350
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], 0x4f415249
push eax
xor eax, eax
mov dword [ebp - 0x4c], 0x5555784b
push eax
sub esp, 0xc
mov dword [ebp - 0x48], 0x31304448
mov ecx, esp
mov dword [ebp - 0x44], 0x4e496846
mov dword [ebp - 0x40], 0x2f4a4143
mov dword [ebp - 0x3c], 0x3777424a
mov dword [ebp - 0x38], 0x67417961
mov dword [ebp - 0x34], 0x42736a43
mov dword [ebp - 0x30], 0x3070424d
mov dword [ebp - 0x2c], 0x37305342
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x5137
mov byte [ebp - 0x1a0], al
push dword [ebp - 0x1a0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.1040f5b3
lea eax, [ebp - 0x1ac]
push eax
call fcn.1041295b
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x19c], ecx
mov ecx, eax
call fcn.1041cbef
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10413bdf
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10413be3
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.1041ca6f
cmp byte [ebp - 0x1d], 0
jne 0x10413f9f
mov dword [ebp - 0x17c], 0x326b7844
mov dword [ebp - 0x178], 0x326f4349
mov dword [ebp - 0x174], 0x7177414a
mov dword [ebp - 0x170], 0x4b6f534b
mov dword [ebp - 0x16c], 0x3349544a
mov dword [ebp - 0x168], 0x6c523347
mov dword [ebp - 0x164], 0x354e5761
mov dword [ebp - 0x160], 0x674d3259
mov dword [ebp - 0x15c], 0x38636847
mov dword [ebp - 0x158], 0x2b496a4f
mov dword [ebp - 0x154], 0x5534444d
mov dword [ebp - 0x150], 0x72457a4e
mov dword [ebp - 0x14c], 0x7455694b
mov dword [ebp - 0x148], 0x36306a4e
mov dword [ebp - 0x144], 0x30553265
mov dword [ebp - 0x140], 0x6a633343
mov dword [ebp - 0x13c], 0x4363534d
mov dword [ebp - 0x138], 0x576b5350
mov dword [ebp - 0x134], 0x70514141
mov dword [ebp - 0x130], 0x7538544f
mov dword [ebp - 0x12c], 0x33395847
mov dword [ebp - 0x128], 0x38385344
mov dword [ebp - 0x124], 0x61385346
mov dword [ebp - 0x120], 0x56595845
mov dword [ebp - 0x11c], 0x43557950
mov dword [ebp - 0x118], 0x7651684d
mov dword [ebp - 0x114], 0x36595462
mov dword [ebp - 0x110], 0x46736a50
mov dword [ebp - 0x10c], 0x4177774a
mov dword [ebp - 0x108], 0x6245415a
mov dword [ebp - 0x104], 0x56304144
mov dword [ebp - 0x100], 0x31637746
mov dword [ebp - 0xfc], 0x74454163
mov dword [ebp - 0xf8], 0x74774143
mov dword [ebp - 0xf4], 0x316f4447
mov dword [ebp - 0xf0], 0x69354344
mov dword [ebp - 0xec], 0x76514245
mov dword [ebp - 0xe8], 0x784d4745
mov dword [ebp - 0xe4], 0x62776949
mov dword [ebp - 0xe0], 0x7a64534a
mov dword [ebp - 0xdc], 0x7a4d584a
mov dword [ebp - 0xd8], 0x55634149
mov dword [ebp - 0xd4], 0x62345847
mov dword [ebp - 0xd0], 0x63494163
mov dword [ebp - 0xcc], 0x715a4365
mov dword [ebp - 0xc8], 0x53347849
mov dword [ebp - 0xc4], 0x46414344
mov dword [ebp - 0xc0], 0x4b6b7750
mov dword [ebp - 0xbc], 0x4a597961
mov dword [ebp - 0xb8], 0x37594741
mov dword [ebp - 0xb4], 0x7a457759
mov dword [ebp - 0xb0], 0x70355344
mov dword [ebp - 0xac], 0x47773342
mov dword [ebp - 0xa8], 0x7a4a7744
mov dword [ebp - 0xa4], 0x4b41514a
mov dword [ebp - 0xa0], 0x6a4a6e63
mov dword [ebp - 0x9c], 0x736f424c
mov dword [ebp - 0x98], 0x70636d50
mov dword [ebp - 0x94], 0x6234784d
mov dword [ebp - 0x90], 0x38497945
mov dword [ebp - 0x8c], 0x4b304447
mov dword [ebp - 0x88], 0x694d425a
mov dword [ebp - 0x84], 0x796c774c
mov dword [ebp - 0x80], 0x4e6f4341
mov dword [ebp - 0x7c], 0x7531444a
mov dword [ebp - 0x78], 0x6e41684b
mov dword [ebp - 0x74], 0x3946474f
mov dword [ebp - 0x70], 0x78634250
mov dword [ebp - 0x6c], 0x446f434b
mov dword [ebp - 0x68], 0x49557842
mov dword [ebp - 0x64], 0x7838514f
mov dword [ebp - 0x60], 0x7a595444
mov dword [ebp - 0x5c], 0x37595163
mov dword [ebp - 0x58], 0x4f67514b
mov dword [ebp - 0x54], 0x7263534a
mov dword [ebp - 0x50], 0x51554363
mov dword [ebp - 0x4c], 0x7263444d
mov dword [ebp - 0x48], 0x444d434f
mov dword [ebp - 0x44], 0x38633349
mov dword [ebp - 0x40], 0x4b55424e
mov dword [ebp - 0x3c], 0x37315342
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], 0x426f5342
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], 0x6e516942
push eax
xor eax, eax
mov dword [ebp - 0x30], 0x616b6e64
push eax
sub esp, 0xc
mov dword [ebp - 0x2c], 0x5063324a
mov ecx, esp
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x4132
mov byte [ebp - 0x19c], al
push dword [ebp - 0x19c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.1040f5b3
lea eax, [ebp - 0x1ac]
push eax
call fcn.1041295b
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x19c], 2
call fcn.1041cbef
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10413f86
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10413f8a
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.1041ca6f
cmp byte [ebp - 0x1d], 0
je 0x10413fb1
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.104191fd
jmp 0x10414605
lea eax, [ebp - 0x14]
mov dword [ebp - 0x134], 0x78497944
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x130], 0x586f435a
push eax
xor eax, eax
mov dword [ebp - 0x12c], 0x7567694c
push eax
sub esp, 0xc
mov dword [ebp - 0x128], 0x6d4d5348
mov ecx, esp
mov dword [ebp - 0x124], 0x66517947
mov dword [ebp - 0x120], 0x6941514d
mov dword [ebp - 0x11c], 0x6f734364
mov dword [ebp - 0x118], 0x4f514449
mov dword [ebp - 0x114], 0x4434584c
mov dword [ebp - 0x110], 0x3970524f
mov dword [ebp - 0x10c], 0x78345346
mov dword [ebp - 0x108], 0x4845514e
mov dword [ebp - 0x104], 0x4d49584f
mov dword [ebp - 0x100], 0x7063784c
mov dword [ebp - 0xfc], 0x58516d43
mov dword [ebp - 0xf8], 0x4245684a
mov dword [ebp - 0xf4], 0x51516d50
mov dword [ebp - 0xf0], 0x4963324a
mov dword [ebp - 0xec], 0x4138694b
mov dword [ebp - 0xe8], 0x3741775a
mov dword [ebp - 0xe4], 0x70634148
mov dword [ebp - 0xe0], 0x43344748
mov dword [ebp - 0xdc], 0x466b694b
mov dword [ebp - 0xd8], 0x7a745341
mov dword [ebp - 0xd4], 0x3651774a
mov dword [ebp - 0xd0], 0x2b305264
mov dword [ebp - 0xcc], 0x67735141
mov dword [ebp - 0xc8], 0x52385445
mov dword [ebp - 0xc4], 0x2b564241
mov dword [ebp - 0xc0], 0x46515762
mov dword [ebp - 0xbc], 0x72385346
mov dword [ebp - 0xb8], 0x4b497a4d
mov dword [ebp - 0xb4], 0x70775147
mov dword [ebp - 0xb0], 0x576b6743
mov dword [ebp - 0xac], 0x48306763
mov dword [ebp - 0xa8], 0x6c635850
mov dword [ebp - 0xa4], 0x34637850
mov dword [ebp - 0xa0], 0x324a5459
mov dword [ebp - 0x9c], 0x37395345
mov dword [ebp - 0x98], 0x4b77434e
mov dword [ebp - 0x94], 0x676f4459
mov dword [ebp - 0x90], 0x3955334b
mov dword [ebp - 0x8c], 0x53307846
mov dword [ebp - 0x88], 0x776f6e43
mov dword [ebp - 0x84], 0x41496844
mov dword [ebp - 0x80], 0x6a774243
mov dword [ebp - 0x7c], 0x656b7a61
mov dword [ebp - 0x78], 0x6e346a50
mov dword [ebp - 0x74], 0x33687743
mov dword [ebp - 0x70], 0x53596d4f
mov dword [ebp - 0x6c], 0x5777675a
mov dword [ebp - 0x68], 0x3851525a
mov dword [ebp - 0x64], 0x6e384263
mov dword [ebp - 0x60], 0x74635150
mov dword [ebp - 0x5c], 0x67566d4a
mov dword [ebp - 0x58], 0x556f5342
mov dword [ebp - 0x54], 0x6b49474f
mov dword [ebp - 0x50], 0x79426d4e
mov dword [ebp - 0x4c], 0x35527950
mov dword [ebp - 0x48], 0x2b397859
mov dword [ebp - 0x44], 0x6a6f7a46
mov dword [ebp - 0x40], 0x30597849
mov dword [ebp - 0x3c], 0x68497863
mov dword [ebp - 0x38], 0x456f4146
mov dword [ebp - 0x34], 0x7259514a
mov dword [ebp - 0x30], 0x4d556a4b
mov dword [ebp - 0x2c], 0x50595148
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x4179
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov byte [ebp - 0x19c], al
push dword [ebp - 0x19c]
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.1040f5b3
lea eax, [ebp - 0x1ac]
push eax
call fcn.1041295b
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x19c], 4
call fcn.1041cbef
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10414283
cmp dword [ebp - 0x14], 0
jne 0x1041428a
mov byte [ebp - 0x1a0], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.1041ca6f
cmp byte [ebp - 0x1a0], 0
je 0x10414605
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x10414605
mov dword [ebp - 0x164], 0x73356964
mov dword [ebp - 0x160], 0x32647964
mov dword [ebp - 0x15c], 0x7435695a
mov dword [ebp - 0x158], 0x42734359
mov dword [ebp - 0x154], 0x69416944
mov dword [ebp - 0x150], 0x63414142
mov dword [ebp - 0x14c], 0x44304249
mov dword [ebp - 0x148], 0x54735741
mov dword [ebp - 0x144], 0x39384344
mov dword [ebp - 0x140], 0x3652794d
mov dword [ebp - 0x13c], 0x6b417847
mov dword [ebp - 0x138], 0x70493345
mov dword [ebp - 0x134], 0x31394846
mov dword [ebp - 0x130], 0x4a634244
mov dword [ebp - 0x12c], 0x62455343
mov dword [ebp - 0x128], 0x30594246
mov dword [ebp - 0x124], 0x2f516a46
mov dword [ebp - 0x120], 0x36567843
mov dword [ebp - 0x11c], 0x666b6964
mov dword [ebp - 0x118], 0x4a774344
mov dword [ebp - 0x114], 0x6c305241
mov dword [ebp - 0x110], 0x72786961
mov dword [ebp - 0x10c], 0x476b514b
mov dword [ebp - 0x108], 0x52383344
mov dword [ebp - 0x104], 0x656f5249
mov dword [ebp - 0x100], 0x4d6b6d43
mov dword [ebp - 0xfc], 0x54514459
mov dword [ebp - 0xf8], 0x506f4149
mov dword [ebp - 0xf4], 0x3234434b
mov dword [ebp - 0xf0], 0x79746e47
mov dword [ebp - 0xec], 0x49306a4d
mov dword [ebp - 0xe8], 0x54385342
mov dword [ebp - 0xe4], 0x374a584e
mov dword [ebp - 0xe0], 0x4a734341
mov dword [ebp - 0xdc], 0x36635144
mov dword [ebp - 0xd8], 0x37453350
mov dword [ebp - 0xd4], 0x6649444c
mov dword [ebp - 0xd0], 0x34734249
mov dword [ebp - 0xcc], 0x2b4a4250
mov dword [ebp - 0xc8], 0x69386a48
mov dword [ebp - 0xc4], 0x784a485a
mov dword [ebp - 0xc0], 0x64516a4f
mov dword [ebp - 0xbc], 0x754d6e4b
mov dword [ebp - 0xb8], 0x3077424c
mov dword [ebp - 0xb4], 0x4f305742
mov dword [ebp - 0xb0], 0x5059414b
mov dword [ebp - 0xac], 0x3764684c
mov dword [ebp - 0xa8], 0x3252795a
mov dword [ebp - 0xa4], 0x5855774b
mov dword [ebp - 0xa0], 0x376b415a
mov dword [ebp - 0x9c], 0x32706846
mov dword [ebp - 0x98], 0x304d5445
mov dword [ebp - 0x94], 0x364a7942
mov dword [ebp - 0x90], 0x414d4341
mov dword [ebp - 0x8c], 0x494d6d41
mov dword [ebp - 0x88], 0x55346866
mov dword [ebp - 0x84], 0x35465741
mov dword [ebp - 0x80], 0x6c776746
mov dword [ebp - 0x7c], 0x3531524e
mov dword [ebp - 0x78], 0x79524165
mov dword [ebp - 0x74], 0x47594159
mov dword [ebp - 0x70], 0x30517a50
mov dword [ebp - 0x6c], 0x33676749
mov dword [ebp - 0x68], 0x676b6a44
mov dword [ebp - 0x64], 0x7664794d
mov dword [ebp - 0x60], 0x5a596a48
mov dword [ebp - 0x5c], 0x4f384459
mov dword [ebp - 0x58], 0x58557942
mov dword [ebp - 0x54], 0x726f674b
mov dword [ebp - 0x50], 0x44736842
mov dword [ebp - 0x4c], 0x30396841
mov dword [ebp - 0x48], 0x43387750
mov dword [ebp - 0x44], 0x3078414b
mov dword [ebp - 0x40], 0x436f6e44
mov dword [ebp - 0x3c], 0x6864474b
mov dword [ebp - 0x38], 0x53637866
mov dword [ebp - 0x34], 0x516f574b
mov dword [ebp - 0x30], 0x45554146
mov dword [ebp - 0x2c], 0x4c346946
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x6734
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
push eax
sub esp, 0xc
mov byte [ebp - 0x1a0], al
mov ecx, esp
push dword [ebp - 0x1a0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.1040f5b3
lea eax, [ebp - 0x1ac]
push eax
call fcn.1041295b
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1041cbef
push eax
push ebx
call fcn.10412307
add esp, 0x18
lea ecx, [ebp - 0x1ac]
call fcn.1041ca6f
cmp dword [ebp - 0x18], 0
je 0x10414615
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1041eca0
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1041709c
call fcn.1041f237
ret