Function at 0x14013feb
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x200
mov eax, 0x1404c1f5
call fcn.1401edd8
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x19c], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14014aa6
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x14014aa6
push esi
call fcn.1401e7f5
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14014a8f
mov dword [ebp - 0x198], 0x396f7747
mov dword [ebp - 0x194], 0x68734350
mov dword [ebp - 0x190], 0x3851774c
mov dword [ebp - 0x18c], 0x6351694c
mov dword [ebp - 0x188], 0x386f794b
mov dword [ebp - 0x184], 0x314e4846
mov dword [ebp - 0x180], 0x33685765
mov dword [ebp - 0x17c], 0x2f427a59
mov dword [ebp - 0x178], 0x69556843
mov dword [ebp - 0x174], 0x364d444c
mov dword [ebp - 0x170], 0x6630434a
mov dword [ebp - 0x16c], 0x38417a4b
mov dword [ebp - 0x168], 0x37305349
mov dword [ebp - 0x164], 0x7351674d
mov dword [ebp - 0x160], 0x41674442
mov dword [ebp - 0x15c], 0x7a56414f
mov dword [ebp - 0x158], 0x305a6750
mov dword [ebp - 0x154], 0x694d434a
mov dword [ebp - 0x150], 0x4a415441
mov dword [ebp - 0x14c], 0x2f56694b
mov dword [ebp - 0x148], 0x7842324c
mov dword [ebp - 0x144], 0x3842414b
mov dword [ebp - 0x140], 0x7451514c
mov dword [ebp - 0x13c], 0x77497941
mov dword [ebp - 0x138], 0x2f775866
mov dword [ebp - 0x134], 0x786f6965
mov dword [ebp - 0x130], 0x315a6946
mov dword [ebp - 0x12c], 0x484d6d44
mov dword [ebp - 0x128], 0x33456e49
mov dword [ebp - 0x124], 0x47596841
mov dword [ebp - 0x120], 0x6c4d7a41
mov dword [ebp - 0x11c], 0x7251544c
mov dword [ebp - 0x118], 0x54634365
mov dword [ebp - 0x114], 0x5a4d6e45
mov dword [ebp - 0x110], 0x67527a4e
mov dword [ebp - 0x10c], 0x58637946
mov dword [ebp - 0x108], 0x74556d48
mov dword [ebp - 0x104], 0x37514243
mov dword [ebp - 0x100], 0x6e595249
mov dword [ebp - 0xfc], 0x6441574e
mov dword [ebp - 0xf8], 0x724d674a
mov dword [ebp - 0xf4], 0x366f6e64
mov dword [ebp - 0xf0], 0x5877414f
mov dword [ebp - 0xec], 0x76513346
mov dword [ebp - 0xe8], 0x66497964
mov dword [ebp - 0xe4], 0x46637943
mov dword [ebp - 0xe0], 0x6a554341
mov dword [ebp - 0xdc], 0x43516d45
mov dword [ebp - 0xd8], 0x66597a50
mov dword [ebp - 0xd4], 0x36514441
mov dword [ebp - 0xd0], 0x64775750
mov dword [ebp - 0xcc], 0x73556749
mov dword [ebp - 0xc8], 0x4855524d
mov dword [ebp - 0xc4], 0x6952774d
mov dword [ebp - 0xc0], 0x65305149
mov dword [ebp - 0xbc], 0x30555365
mov dword [ebp - 0xb8], 0x39516747
mov dword [ebp - 0xb4], 0x48386842
mov dword [ebp - 0xb0], 0x5667694f
mov dword [ebp - 0xac], 0x614d6a49
mov dword [ebp - 0xa8], 0x576b6949
mov dword [ebp - 0xa4], 0x37637844
mov dword [ebp - 0xa0], 0x47345343
mov dword [ebp - 0x9c], 0x3456684f
mov dword [ebp - 0x98], 0x674a674c
mov dword [ebp - 0x94], 0x67456750
mov dword [ebp - 0x90], 0x65557a43
mov dword [ebp - 0x8c], 0x464d4147
mov dword [ebp - 0x88], 0x454d6848
mov dword [ebp - 0x84], 0x51777a4a
mov dword [ebp - 0x80], 0x48776a61
mov dword [ebp - 0x7c], 0x2f397748
mov dword [ebp - 0x78], 0x694d5247
mov dword [ebp - 0x74], 0x444d3345
mov dword [ebp - 0x70], 0x6b674245
mov dword [ebp - 0x6c], 0x4e387765
mov dword [ebp - 0x68], 0x7a55324f
mov dword [ebp - 0x64], 0x6a416d4f
mov dword [ebp - 0x60], 0x69686d5a
mov dword [ebp - 0x5c], 0x61637943
mov dword [ebp - 0x58], 0x72634445
lea eax, [ebp - 0x14]
mov dword [ebp - 0x54], 0x4677534c
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], 0x6c4a5265
push eax
xor eax, eax
mov dword [ebp - 0x4c], 0x346b7a47
push eax
sub esp, 0xc
mov dword [ebp - 0x48], 0x556b414c
mov ecx, esp
mov dword [ebp - 0x44], 0x76594442
mov dword [ebp - 0x40], 0x4e495248
mov dword [ebp - 0x3c], 0x4e416a45
push dword [ebp - 0x24]
mov dword [ebp - 0x38], 0x39417a50
mov dword [ebp - 0x34], 0x3167544a
mov dword [ebp - 0x30], 0x4667434c
mov dword [ebp - 0x2c], 0x41417743
mov word [ebp - 0x28], 0x4f41
mov byte [ebp - 0x26], 0x73
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.1400fdb1
lea eax, [ebp - 0x20c]
push eax
call fcn.1401317f
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x19c], ecx
mov ecx, eax
call fcn.1401c63f
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14014412
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x14014416
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20c]
call fcn.1401c4c1
cmp byte [ebp - 0x1d], 0
jne 0x140146d6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x11c], 0x396f7747
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x118], 0x68734350
push eax
xor eax, eax
mov dword [ebp - 0x114], 0x3851774c
push eax
sub esp, 0xc
mov dword [ebp - 0x110], 0x6351694c
mov ecx, esp
mov dword [ebp - 0x10c], 0x386f794b
mov dword [ebp - 0x108], 0x784e4846
mov dword [ebp - 0x104], 0x33465765
push dword [ebp - 0x24]
mov dword [ebp - 0x100], 0x7449325a
mov dword [ebp - 0xfc], 0x69556843
mov dword [ebp - 0xf8], 0x364d444c
mov dword [ebp - 0xf4], 0x6630434a
mov dword [ebp - 0xf0], 0x38417a4b
mov dword [ebp - 0xec], 0x37305349
mov dword [ebp - 0xe8], 0x57497742
mov dword [ebp - 0xe4], 0x34736743
mov dword [ebp - 0xe0], 0x7942535a
mov dword [ebp - 0xdc], 0x7946414b
mov dword [ebp - 0xd8], 0x6970774c
mov dword [ebp - 0xd4], 0x31345141
mov dword [ebp - 0xd0], 0x4241414c
mov dword [ebp - 0xcc], 0x396c4764
mov dword [ebp - 0xc8], 0x5a736a48
mov dword [ebp - 0xc4], 0x46635343
mov dword [ebp - 0xc0], 0x48416e44
mov dword [ebp - 0xbc], 0x675a434c
mov dword [ebp - 0xb8], 0x5945694c
mov dword [ebp - 0xb4], 0x7a55444d
mov dword [ebp - 0xb0], 0x3149514a
mov dword [ebp - 0xac], 0x64676d44
mov dword [ebp - 0xa8], 0x71556843
mov dword [ebp - 0xa4], 0x6e554244
mov dword [ebp - 0xa0], 0x364d784c
mov dword [ebp - 0x9c], 0x4d59784b
mov dword [ebp - 0x98], 0x386b5863
mov dword [ebp - 0x94], 0x4b38684e
mov dword [ebp - 0x90], 0x6e774250
mov dword [ebp - 0x8c], 0x73304265
mov dword [ebp - 0x88], 0x344a795a
mov dword [ebp - 0x84], 0x41385445
mov dword [ebp - 0x80], 0x38497a63
mov dword [ebp - 0x7c], 0x35345141
mov dword [ebp - 0x78], 0x46456e66
mov dword [ebp - 0x74], 0x464d4147
mov dword [ebp - 0x70], 0x64674149
mov dword [ebp - 0x6c], 0x41516a44
mov dword [ebp - 0x68], 0x74497744
mov dword [ebp - 0x64], 0x6b775244
mov dword [ebp - 0x60], 0x4a30775a
mov dword [ebp - 0x5c], 0x7a594248
mov dword [ebp - 0x58], 0x66557a4f
mov dword [ebp - 0x54], 0x2b6c324c
mov dword [ebp - 0x50], 0x38305244
mov dword [ebp - 0x4c], 0x4e556e44
mov dword [ebp - 0x48], 0x53775364
mov dword [ebp - 0x44], 0x30597741
mov dword [ebp - 0x40], 0x714d5263
mov dword [ebp - 0x3c], 0x534d444b
mov dword [ebp - 0x38], 0x3459785a
mov dword [ebp - 0x34], 0x59677959
mov dword [ebp - 0x30], 0x38676a49
mov dword [ebp - 0x2c], 0x41415143
mov word [ebp - 0x28], 0x4941
mov byte [ebp - 0x26], 0x34
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.1400fdb1
lea eax, [ebp - 0x20c]
push eax
call fcn.1401317f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x19c], 2
call fcn.1401c63f
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140146bd
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x140146c1
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20c]
call fcn.1401c4c1
cmp byte [ebp - 0x1d], 0
je 0x140146e8
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.14018f8f
jmp 0x14014a8f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x200], 0x49737a47
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1fc], 0x4634514b
push eax
xor eax, eax
mov dword [ebp - 0x1f8], 0x34387746
push eax
sub esp, 0xc
mov dword [ebp - 0x1f4], 0x57635464
mov ecx, esp
mov dword [ebp - 0x1f0], 0x67704245
mov dword [ebp - 0x1ec], 0x51594449
mov dword [ebp - 0x1e8], 0x3268684f
push dword [ebp - 0x24]
mov dword [ebp - 0x1e4], 0x6f4d3250
mov dword [ebp - 0x1e0], 0x65344348
mov dword [ebp - 0x1dc], 0x3151534d
mov dword [ebp - 0x1d8], 0x52734749
mov dword [ebp - 0x1d4], 0x6d514441
mov dword [ebp - 0x1d0], 0x616b6750
mov dword [ebp - 0x1cc], 0x44304146
mov dword [ebp - 0x1c8], 0x6e34434b
mov dword [ebp - 0x1c4], 0x496b5444
mov dword [ebp - 0x1c0], 0x6b597a47
mov dword [ebp - 0x1bc], 0x38646950
mov dword [ebp - 0x1b8], 0x39515147
mov dword [ebp - 0x1b4], 0x634d5142
mov dword [ebp - 0x1b0], 0x63383243
mov dword [ebp - 0x1ac], 0x63597766
mov dword [ebp - 0x1a8], 0x34554147
mov dword [ebp - 0x1a4], 0x4141674a
mov word [ebp - 0x1a0], 0x4541
mov byte [ebp - 0x19e], 0x55
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x19d]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.1400fdb1
lea eax, [ebp - 0x20c]
push eax
call fcn.1401317f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x19c], 4
call fcn.1401c63f
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401484b
cmp dword [ebp - 0x14], 0
jne 0x1401484f
mov byte [ebp - 0x24], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20c]
call fcn.1401c4c1
cmp byte [ebp - 0x24], 0
je 0x14014a8f
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x14014a8f
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0xf0], 0x6e316a59
push eax
sub esp, 0xc
mov dword [ebp - 0xec], 0x685a7961
mov ecx, esp
mov dword [ebp - 0xe8], 0x375a5362
mov dword [ebp - 0xe4], 0x4655795a
mov dword [ebp - 0xe0], 0x32307a63
push dword [ebp - 0x24]
mov dword [ebp - 0xdc], 0x6c51784f
mov dword [ebp - 0xd8], 0x58736944
mov dword [ebp - 0xd4], 0x376f4459
mov dword [ebp - 0xd0], 0x7934434a
mov dword [ebp - 0xcc], 0x63597964
mov dword [ebp - 0xc8], 0x38466a44
mov dword [ebp - 0xc4], 0x35465847
mov dword [ebp - 0xc0], 0x4451794c
mov dword [ebp - 0xbc], 0x53734441
mov dword [ebp - 0xb8], 0x4c4d7950
mov dword [ebp - 0xb4], 0x34674348
mov dword [ebp - 0xb0], 0x31417a4a
mov dword [ebp - 0xac], 0x335a6a4d
mov dword [ebp - 0xa8], 0x7949444a
mov dword [ebp - 0xa4], 0x41516d44
mov dword [ebp - 0xa0], 0x3845674b
mov dword [ebp - 0x9c], 0x3430514c
mov dword [ebp - 0x98], 0x6a4e4845
mov dword [ebp - 0x94], 0x6d705141
mov dword [ebp - 0x90], 0x43595163
mov dword [ebp - 0x8c], 0x6e55585a
mov dword [ebp - 0x88], 0x51674741
mov dword [ebp - 0x84], 0x6f6f784f
mov dword [ebp - 0x80], 0x6e595841
mov dword [ebp - 0x7c], 0x59496749
mov dword [ebp - 0x78], 0x72676842
mov dword [ebp - 0x74], 0x37645466
mov dword [ebp - 0x70], 0x4e4d3350
mov dword [ebp - 0x6c], 0x596f5344
mov dword [ebp - 0x68], 0x4a67334c
mov dword [ebp - 0x64], 0x32596e4d
mov dword [ebp - 0x60], 0x43497745
mov dword [ebp - 0x5c], 0x6d597959
mov dword [ebp - 0x58], 0x4838684c
mov dword [ebp - 0x54], 0x37426746
mov dword [ebp - 0x50], 0x4d77534b
mov dword [ebp - 0x4c], 0x56414344
mov dword [ebp - 0x48], 0x6663424f
mov dword [ebp - 0x44], 0x456b774f
mov dword [ebp - 0x40], 0x6a343341
mov dword [ebp - 0x3c], 0x73356748
mov dword [ebp - 0x38], 0x66417849
mov dword [ebp - 0x34], 0x674d6d4e
mov dword [ebp - 0x30], 0x41734144
mov dword [ebp - 0x2c], 0x48434141
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.1400fdb1
lea eax, [ebp - 0x20c]
push eax
call fcn.1401317f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1401c63f
push eax
push ebx
call fcn.14012b2d
add esp, 0x18
lea ecx, [ebp - 0x20c]
call fcn.1401c4c1
cmp dword [ebp - 0x18], 0
je 0x14014a9f
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1401e7fe
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.140172a0
call fcn.1401ed82
ret