Function at 0x11013a08
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x178
mov eax, 0x1104cd5b
call fcn.1101ecd8
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x174], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x11014665
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x11014665
push esi
call fcn.1101e6e2
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1101464e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x104], 0x7a6f4242
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x100], 0x38776a4a
push eax
xor eax, eax
mov dword [ebp - 0xfc], 0x3734514c
push eax
sub esp, 0xc
mov dword [ebp - 0xf8], 0x4c30794f
mov ecx, esp
mov dword [ebp - 0xf4], 0x6b777a4e
mov dword [ebp - 0xf0], 0x385a3345
mov dword [ebp - 0xec], 0x6b783359
mov dword [ebp - 0xe8], 0x6e5a7a64
mov dword [ebp - 0xe4], 0x6e455145
mov dword [ebp - 0xe0], 0x6b73694f
mov dword [ebp - 0xdc], 0x52307a4f
mov dword [ebp - 0xd8], 0x6863534d
mov dword [ebp - 0xd4], 0x38637949
mov dword [ebp - 0xd0], 0x3078545a
mov dword [ebp - 0xcc], 0x36786942
mov dword [ebp - 0xc8], 0x5977684b
mov dword [ebp - 0xc4], 0x59514342
mov dword [ebp - 0xc0], 0x6b496841
mov dword [ebp - 0xbc], 0x3474514f
mov dword [ebp - 0xb8], 0x36673342
mov dword [ebp - 0xb4], 0x68456a4b
mov dword [ebp - 0xb0], 0x31775741
mov dword [ebp - 0xac], 0x48775448
mov dword [ebp - 0xa8], 0x41415444
mov dword [ebp - 0xa4], 0x49384146
mov dword [ebp - 0xa0], 0x4649584f
mov dword [ebp - 0x9c], 0x4c634342
mov dword [ebp - 0x98], 0x56496a42
mov dword [ebp - 0x94], 0x34415442
mov dword [ebp - 0x90], 0x42597842
mov dword [ebp - 0x8c], 0x6b515364
mov dword [ebp - 0x88], 0x78596941
mov dword [ebp - 0x84], 0x4b305146
mov dword [ebp - 0x80], 0x6b6b334d
mov dword [ebp - 0x7c], 0x6363484f
mov dword [ebp - 0x78], 0x34417a4b
mov dword [ebp - 0x74], 0x62776e4b
mov dword [ebp - 0x70], 0x3155574d
mov dword [ebp - 0x6c], 0x68523265
mov dword [ebp - 0x68], 0x36635245
mov dword [ebp - 0x64], 0x5830534f
mov dword [ebp - 0x60], 0x30737845
mov dword [ebp - 0x5c], 0x68306963
mov dword [ebp - 0x58], 0x4e415850
mov dword [ebp - 0x54], 0x6d6c6943
mov dword [ebp - 0x50], 0x38747750
mov dword [ebp - 0x4c], 0x68566e4f
mov dword [ebp - 0x48], 0x6855324a
mov dword [ebp - 0x44], 0x34394465
mov dword [ebp - 0x40], 0x54554142
mov dword [ebp - 0x3c], 0x33466a43
mov dword [ebp - 0x38], 0x6a744242
mov dword [ebp - 0x34], 0x61737a5a
mov dword [ebp - 0x30], 0x31775846
mov dword [ebp - 0x2c], 0x79647a46
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x4841
mov byte [ebp - 0x22], 0x38
mov byte [ebp - 0x178], al
push dword [ebp - 0x178]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.1100f843
lea eax, [ebp - 0x184]
push eax
call fcn.11012bba
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x178], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x174], ecx
mov ecx, eax
call fcn.1101c5cd
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x11013cd0
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x11013cd4
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x184]
call fcn.1101c44d
cmp byte [ebp - 0x1d], 0
jne 0x11014026
lea eax, [ebp - 0x14]
mov dword [ebp - 0x150], 0x7a6f4242
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14c], 0x38776a4a
mov dword [ebp - 0x148], 0x3734514c
mov dword [ebp - 0x144], 0x4c30794f
mov dword [ebp - 0x140], 0x6b777a4e
mov dword [ebp - 0x13c], 0x345a3345
mov dword [ebp - 0x138], 0x6b563359
mov dword [ebp - 0x134], 0x31513263
mov dword [ebp - 0x130], 0x6e455145
mov dword [ebp - 0x12c], 0x6b73694f
mov dword [ebp - 0x128], 0x52307a4f
mov dword [ebp - 0x124], 0x6863534d
mov dword [ebp - 0x120], 0x38637949
mov dword [ebp - 0x11c], 0x526f5849
mov dword [ebp - 0x118], 0x6177524c
mov dword [ebp - 0x114], 0x6e67674e
mov dword [ebp - 0x110], 0x7a595859
mov dword [ebp - 0x10c], 0x43415444
mov dword [ebp - 0x108], 0x43517850
mov dword [ebp - 0x104], 0x334d4147
mov dword [ebp - 0x100], 0x45634141
mov dword [ebp - 0xfc], 0x39454248
mov dword [ebp - 0xf8], 0x654d4350
mov dword [ebp - 0xf4], 0x70634148
mov dword [ebp - 0xf0], 0x36673247
mov dword [ebp - 0xec], 0x6c56434f
mov dword [ebp - 0xe8], 0x6e51514e
mov dword [ebp - 0xe4], 0x6273774c
mov dword [ebp - 0xe0], 0x43414748
mov dword [ebp - 0xdc], 0x38306a4f
mov dword [ebp - 0xd8], 0x7277584d
mov dword [ebp - 0xd4], 0x6778524c
mov dword [ebp - 0xd0], 0x63384841
mov dword [ebp - 0xcc], 0x326b6a50
mov dword [ebp - 0xc8], 0x34316a61
mov dword [ebp - 0xc4], 0x434d694a
mov dword [ebp - 0xc0], 0x516f524a
mov dword [ebp - 0xbc], 0x6a316744
mov dword [ebp - 0xb8], 0x69425448
mov dword [ebp - 0xb4], 0x6f684842
mov dword [ebp - 0xb0], 0x396f4248
mov dword [ebp - 0xac], 0x5655794e
mov dword [ebp - 0xa8], 0x494d414d
mov dword [ebp - 0xa4], 0x6d736949
mov dword [ebp - 0xa0], 0x6b49524c
mov dword [ebp - 0x9c], 0x784e6a66
mov dword [ebp - 0x98], 0x5473414e
mov dword [ebp - 0x94], 0x45346a41
mov dword [ebp - 0x90], 0x3241694c
mov dword [ebp - 0x8c], 0x55637a46
mov dword [ebp - 0x88], 0x33343346
mov dword [ebp - 0x84], 0x6855695a
mov dword [ebp - 0x80], 0x45734448
mov dword [ebp - 0x7c], 0x364a774d
mov dword [ebp - 0x78], 0x2f564461
mov dword [ebp - 0x74], 0x4b55484f
mov dword [ebp - 0x70], 0x6563694a
mov dword [ebp - 0x6c], 0x50307a63
mov dword [ebp - 0x68], 0x4e306843
mov dword [ebp - 0x64], 0x684d6945
mov dword [ebp - 0x60], 0x72344362
mov dword [ebp - 0x5c], 0x5545514f
mov dword [ebp - 0x58], 0x644d7949
mov dword [ebp - 0x54], 0x5845584d
mov dword [ebp - 0x50], 0x59495249
mov dword [ebp - 0x4c], 0x2b63694b
mov dword [ebp - 0x48], 0x4359684e
mov dword [ebp - 0x44], 0x5a4d5749
mov dword [ebp - 0x40], 0x32675765
mov dword [ebp - 0x3c], 0x4c734845
mov dword [ebp - 0x38], 0x73775361
mov dword [ebp - 0x34], 0x41307a41
mov dword [ebp - 0x30], 0x7170794c
mov dword [ebp - 0x2c], 0x61514147
mov dword [ebp - 0x28], 0x41417761
mov word [ebp - 0x24], 0x4c41
mov byte [ebp - 0x22], 0x67
push eax
xor eax, eax
push eax
sub esp, 0xc
mov byte [ebp - 0x174], al
mov ecx, esp
push dword [ebp - 0x174]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.1100f843
lea eax, [ebp - 0x184]
push eax
call fcn.11012bba
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x174], 2
call fcn.1101c5cd
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1101400d
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x11014011
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x184]
call fcn.1101c44d
cmp byte [ebp - 0x1d], 0
je 0x11014038
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.110190dd
jmp 0x1101464e
mov dword [ebp - 0x170], 0x76514342
mov dword [ebp - 0x16c], 0x6a566949
mov dword [ebp - 0x168], 0x58737942
mov dword [ebp - 0x164], 0x7868684a
mov dword [ebp - 0x160], 0x36497950
mov dword [ebp - 0x15c], 0x78566a4a
mov dword [ebp - 0x158], 0x596b674a
mov dword [ebp - 0x154], 0x31417a45
mov dword [ebp - 0x150], 0x574d444a
mov dword [ebp - 0x14c], 0x6b70484d
mov dword [ebp - 0x148], 0x31786e44
mov dword [ebp - 0x144], 0x55555742
mov dword [ebp - 0x140], 0x6a736748
mov dword [ebp - 0x13c], 0x536b684e
mov dword [ebp - 0x138], 0x3473414d
mov dword [ebp - 0x134], 0x4c553346
mov dword [ebp - 0x130], 0x34774142
mov dword [ebp - 0x12c], 0x54305249
mov dword [ebp - 0x128], 0x536b4242
mov dword [ebp - 0x124], 0x57516947
mov dword [ebp - 0x120], 0x2b356849
mov dword [ebp - 0x11c], 0x61553245
mov dword [ebp - 0x118], 0x6359514a
mov dword [ebp - 0x114], 0x48303341
mov dword [ebp - 0x110], 0x65634462
mov dword [ebp - 0x10c], 0x76554441
mov dword [ebp - 0x108], 0x6a39444e
mov dword [ebp - 0x104], 0x4749424b
mov dword [ebp - 0x100], 0x32637a43
mov dword [ebp - 0xfc], 0x6d63524a
mov dword [ebp - 0xf8], 0x7330484b
mov dword [ebp - 0xf4], 0x4430674e
mov dword [ebp - 0xf0], 0x31346a44
mov dword [ebp - 0xec], 0x4c414246
mov dword [ebp - 0xe8], 0x4d677a50
mov dword [ebp - 0xe4], 0x2f743241
mov dword [ebp - 0xe0], 0x6874534d
mov dword [ebp - 0xdc], 0x784d6843
mov dword [ebp - 0xd8], 0x6567324e
mov dword [ebp - 0xd4], 0x6c64434c
mov dword [ebp - 0xd0], 0x324e7845
mov dword [ebp - 0xcc], 0x34674441
mov dword [ebp - 0xc8], 0x7a6f6a63
mov dword [ebp - 0xc4], 0x37676841
mov dword [ebp - 0xc0], 0x34395346
mov dword [ebp - 0xbc], 0x6b634145
mov dword [ebp - 0xb8], 0x354e4849
mov dword [ebp - 0xb4], 0x6b5a5342
mov dword [ebp - 0xb0], 0x6a4e6750
mov dword [ebp - 0xac], 0x6877544d
mov dword [ebp - 0xa8], 0x6f776a61
mov dword [ebp - 0xa4], 0x6c415745
mov dword [ebp - 0xa0], 0x69415449
mov dword [ebp - 0x9c], 0x7277524a
mov dword [ebp - 0x98], 0x70346846
mov dword [ebp - 0x94], 0x376b4265
mov dword [ebp - 0x90], 0x6e78484a
mov dword [ebp - 0x8c], 0x5355514a
mov dword [ebp - 0x88], 0x454d7948
mov dword [ebp - 0x84], 0x67674465
mov dword [ebp - 0x80], 0x3334784c
mov dword [ebp - 0x7c], 0x6f59424f
mov dword [ebp - 0x78], 0x57734249
mov dword [ebp - 0x74], 0x7a735345
mov dword [ebp - 0x70], 0x4a347748
mov dword [ebp - 0x6c], 0x6b594444
mov dword [ebp - 0x68], 0x48497761
mov dword [ebp - 0x64], 0x6d5a444c
mov dword [ebp - 0x60], 0x2f38444c
mov dword [ebp - 0x5c], 0x4a34424c
mov dword [ebp - 0x58], 0x6645514d
mov dword [ebp - 0x54], 0x69316d4d
mov dword [ebp - 0x50], 0x2f344365
mov dword [ebp - 0x4c], 0x75497950
mov dword [ebp - 0x48], 0x7939674d
mov dword [ebp - 0x44], 0x68495865
mov dword [ebp - 0x40], 0x4d30334b
mov dword [ebp - 0x3c], 0x6d594346
mov dword [ebp - 0x38], 0x424d6765
mov dword [ebp - 0x34], 0x426f5249
mov dword [ebp - 0x30], 0x4a34774c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], 0x6c634442
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], 0x4141774d
push eax
xor eax, eax
mov word [ebp - 0x24], 0x5041
push eax
sub esp, 0xc
mov byte [ebp - 0x22], 0x59
mov ecx, esp
mov byte [ebp - 0x174], al
push dword [ebp - 0x174]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.1100f843
lea eax, [ebp - 0x184]
push eax
call fcn.11012bba
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x174], 4
call fcn.1101c5cd
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x110143a4
cmp dword [ebp - 0x14], 0
jne 0x110143ab
mov byte [ebp - 0x178], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x184]
call fcn.1101c44d
cmp byte [ebp - 0x178], 0
je 0x1101464e
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x1101464e
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0x10c], 0x70315366
push eax
sub esp, 0xc
mov dword [ebp - 0x108], 0x38465463
mov ecx, esp
mov dword [ebp - 0x104], 0x38787962
mov dword [ebp - 0x100], 0x73776963
mov dword [ebp - 0xfc], 0x61384741
mov dword [ebp - 0xf8], 0x4438424f
mov dword [ebp - 0xf4], 0x52774842
mov dword [ebp - 0xf0], 0x32307946
mov dword [ebp - 0xec], 0x59556865
mov dword [ebp - 0xe8], 0x44495741
mov dword [ebp - 0xe4], 0x4b6f6e61
mov dword [ebp - 0xe0], 0x59597943
mov dword [ebp - 0xdc], 0x7838444d
mov dword [ebp - 0xd8], 0x3630584a
mov dword [ebp - 0xd4], 0x456b4745
mov dword [ebp - 0xd0], 0x73384850
mov dword [ebp - 0xcc], 0x6334415a
mov dword [ebp - 0xc8], 0x756c7846
mov dword [ebp - 0xc4], 0x414d534a
mov dword [ebp - 0xc0], 0x6573794d
mov dword [ebp - 0xbc], 0x7a776e49
mov dword [ebp - 0xb8], 0x71465262
mov dword [ebp - 0xb4], 0x49415841
mov dword [ebp - 0xb0], 0x52777842
mov dword [ebp - 0xac], 0x384d6a4d
mov dword [ebp - 0xa8], 0x76496943
mov dword [ebp - 0xa4], 0x31306a5a
mov dword [ebp - 0xa0], 0x324d5445
mov dword [ebp - 0x9c], 0x626b6d65
mov dword [ebp - 0x98], 0x6d6b5250
mov dword [ebp - 0x94], 0x31746a45
mov dword [ebp - 0x90], 0x4e6f7843
mov dword [ebp - 0x8c], 0x67464847
mov dword [ebp - 0x88], 0x3746444e
mov dword [ebp - 0x84], 0x6e384161
mov dword [ebp - 0x80], 0x4b6b6764
mov dword [ebp - 0x7c], 0x79455241
mov dword [ebp - 0x78], 0x7a497763
mov dword [ebp - 0x74], 0x6b417965
mov dword [ebp - 0x70], 0x66557749
mov dword [ebp - 0x6c], 0x6c775444
mov dword [ebp - 0x68], 0x62454159
mov dword [ebp - 0x64], 0x31636966
mov dword [ebp - 0x60], 0x36497942
mov dword [ebp - 0x5c], 0x55675448
mov dword [ebp - 0x58], 0x2f705149
mov dword [ebp - 0x54], 0x6c51694e
mov dword [ebp - 0x50], 0x5a49524d
mov dword [ebp - 0x4c], 0x476b6d65
mov dword [ebp - 0x48], 0x37305848
mov dword [ebp - 0x44], 0x67735862
mov dword [ebp - 0x40], 0x42776845
mov dword [ebp - 0x3c], 0x6749774b
mov dword [ebp - 0x38], 0x3649414f
mov dword [ebp - 0x34], 0x5a777a62
mov dword [ebp - 0x30], 0x44775249
mov dword [ebp - 0x2c], 0x6c454349
mov dword [ebp - 0x28], 0x41415145
mov word [ebp - 0x24], 0x4b41
mov byte [ebp - 0x22], 0x45
mov byte [ebp - 0x178], al
push dword [ebp - 0x178]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.1100f843
lea eax, [ebp - 0x184]
push eax
call fcn.11012bba
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1101c5cd
push eax
push ebx
call fcn.11012566
add esp, 0x18
lea ecx, [ebp - 0x184]
call fcn.1101c44d
cmp dword [ebp - 0x18], 0
je 0x1101465e
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1101e6eb
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.110171a5
call fcn.1101ec82
ret