Function at 0x12013449
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x184
mov eax, 0x1204c912
call fcn.1201e877
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x180], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x12013f48
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x12013f48
push esi
call fcn.1201e281
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x12013f31
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe4], 0x34497846
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xe0], 0x726f534f
push eax
xor eax, eax
mov dword [ebp - 0xdc], 0x3851684b
push eax
sub esp, 0xc
mov dword [ebp - 0xd8], 0x64637a4a
mov ecx, esp
mov dword [ebp - 0xd4], 0x69384349
mov dword [ebp - 0xd0], 0x37464847
mov dword [ebp - 0xcc], 0x3735335a
mov dword [ebp - 0xc8], 0x68686a64
mov dword [ebp - 0xc4], 0x716f7844
mov dword [ebp - 0xc0], 0x69347a4e
mov dword [ebp - 0xbc], 0x6155444b
mov dword [ebp - 0xb8], 0x32456a4c
mov dword [ebp - 0xb4], 0x3730444a
mov dword [ebp - 0xb0], 0x744e6748
mov dword [ebp - 0xac], 0x50306843
mov dword [ebp - 0xa8], 0x74676744
mov dword [ebp - 0xa4], 0x2f6c794f
mov dword [ebp - 0xa0], 0x6c313244
mov dword [ebp - 0x9c], 0x7a674841
mov dword [ebp - 0x98], 0x7568524e
mov dword [ebp - 0x94], 0x45736a4a
mov dword [ebp - 0x90], 0x44597749
mov dword [ebp - 0x8c], 0x586f5149
mov dword [ebp - 0x88], 0x734e5447
mov dword [ebp - 0x84], 0x6a384846
mov dword [ebp - 0x80], 0x67415861
mov dword [ebp - 0x7c], 0x76344846
mov dword [ebp - 0x78], 0x5a4d674d
mov dword [ebp - 0x74], 0x496b774b
mov dword [ebp - 0x70], 0x7a596a45
mov dword [ebp - 0x6c], 0x36705348
mov dword [ebp - 0x68], 0x45637765
mov dword [ebp - 0x64], 0x51456a42
mov dword [ebp - 0x60], 0x32736763
mov dword [ebp - 0x5c], 0x41304346
mov dword [ebp - 0x58], 0x49344244
mov dword [ebp - 0x54], 0x37316742
mov dword [ebp - 0x50], 0x6e454263
mov dword [ebp - 0x4c], 0x5251774b
mov dword [ebp - 0x48], 0x764a6d50
mov dword [ebp - 0x44], 0x63306745
mov dword [ebp - 0x40], 0x325a334c
mov dword [ebp - 0x3c], 0x48676941
mov dword [ebp - 0x38], 0x464d3266
mov dword [ebp - 0x34], 0x2b736741
mov dword [ebp - 0x30], 0x3159524d
mov dword [ebp - 0x2c], 0x4167514f
mov dword [ebp - 0x28], 0x6c424141
mov byte [ebp - 0x184], al
push dword [ebp - 0x184]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.1200f5c3
lea eax, [ebp - 0x190]
push eax
call fcn.120125fb
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x184], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x180], ecx
mov ecx, eax
call fcn.1201c145
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x120136b7
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x120136bb
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.1201bfc5
cmp byte [ebp - 0x1d], 0
jne 0x12013a7b
mov dword [ebp - 0x17c], 0x34497846
mov dword [ebp - 0x178], 0x726f534f
mov dword [ebp - 0x174], 0x3851684b
mov dword [ebp - 0x170], 0x64637a4a
mov dword [ebp - 0x16c], 0x69384349
mov dword [ebp - 0x168], 0x2f464847
mov dword [ebp - 0x164], 0x3764335a
mov dword [ebp - 0x160], 0x7a6f6d63
mov dword [ebp - 0x15c], 0x716f7844
mov dword [ebp - 0x158], 0x69347a4e
mov dword [ebp - 0x154], 0x6155444b
mov dword [ebp - 0x150], 0x32456a4c
mov dword [ebp - 0x14c], 0x3730444a
mov dword [ebp - 0x148], 0x31737765
mov dword [ebp - 0x144], 0x58454465
mov dword [ebp - 0x140], 0x5173424d
mov dword [ebp - 0x13c], 0x6d4e4249
mov dword [ebp - 0x138], 0x70415141
mov dword [ebp - 0x134], 0x6473414a
mov dword [ebp - 0x130], 0x656b7a43
mov dword [ebp - 0x12c], 0x45417848
mov dword [ebp - 0x128], 0x77736843
mov dword [ebp - 0x124], 0x54516a45
mov dword [ebp - 0x120], 0x644d4244
mov dword [ebp - 0x11c], 0x50595245
mov dword [ebp - 0x118], 0x6a6b6946
mov dword [ebp - 0x114], 0x784d3349
mov dword [ebp - 0x110], 0x5655674b
mov dword [ebp - 0x10c], 0x6f5a7948
mov dword [ebp - 0x108], 0x75427a62
mov dword [ebp - 0x104], 0x6a6b334f
mov dword [ebp - 0x100], 0x78594150
mov dword [ebp - 0xfc], 0x6c4e794a
mov dword [ebp - 0xf8], 0x66675447
mov dword [ebp - 0xf4], 0x35704450
mov dword [ebp - 0xf0], 0x2b456849
mov dword [ebp - 0xec], 0x49417a59
mov dword [ebp - 0xe8], 0x67315143
mov dword [ebp - 0xe4], 0x39345159
mov dword [ebp - 0xe0], 0x7a774346
mov dword [ebp - 0xdc], 0x6573514c
mov dword [ebp - 0xd8], 0x4a733365
mov dword [ebp - 0xd4], 0x44416847
mov dword [ebp - 0xd0], 0x68597a65
mov dword [ebp - 0xcc], 0x70777765
mov dword [ebp - 0xc8], 0x6959684b
mov dword [ebp - 0xc4], 0x79384147
mov dword [ebp - 0xc0], 0x58555163
mov dword [ebp - 0xbc], 0x52455359
mov dword [ebp - 0xb8], 0x56736961
mov dword [ebp - 0xb4], 0x57455450
mov dword [ebp - 0xb0], 0x56734846
mov dword [ebp - 0xac], 0x6c304149
mov dword [ebp - 0xa8], 0x73684443
mov dword [ebp - 0xa4], 0x554d4447
mov dword [ebp - 0xa0], 0x6e63674a
mov dword [ebp - 0x9c], 0x6c557a4a
mov dword [ebp - 0x98], 0x3877774c
mov dword [ebp - 0x94], 0x65637741
mov dword [ebp - 0x90], 0x344d5448
mov dword [ebp - 0x8c], 0x6473684a
mov dword [ebp - 0x88], 0x7a493341
mov dword [ebp - 0x84], 0x2f4d5249
mov dword [ebp - 0x80], 0x7a6f544a
mov dword [ebp - 0x7c], 0x55775149
mov dword [ebp - 0x78], 0x34596942
mov dword [ebp - 0x74], 0x68556944
mov dword [ebp - 0x70], 0x6b49424d
mov dword [ebp - 0x6c], 0x6f425147
mov dword [ebp - 0x68], 0x596f474b
mov dword [ebp - 0x64], 0x38676748
mov dword [ebp - 0x60], 0x39454347
mov dword [ebp - 0x5c], 0x4d497949
mov dword [ebp - 0x58], 0x6a4d574b
mov dword [ebp - 0x54], 0x6e30334f
mov dword [ebp - 0x50], 0x67596942
mov dword [ebp - 0x4c], 0x79524250
mov dword [ebp - 0x48], 0x396f474c
mov dword [ebp - 0x44], 0x6f4d6949
mov dword [ebp - 0x40], 0x68357943
mov dword [ebp - 0x3c], 0x394d6844
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], 0x4f63674b
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], 0x4d456a47
push eax
xor eax, eax
mov dword [ebp - 0x30], 0x61514142
push eax
sub esp, 0xc
mov dword [ebp - 0x2c], 0x3078444f
mov ecx, esp
mov dword [ebp - 0x28], 0x4141414c
mov word [ebp - 0x24], 0x4e41
mov byte [ebp - 0x22], 0x6b
mov byte [ebp - 0x180], al
push dword [ebp - 0x180]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.1200f5c3
lea eax, [ebp - 0x190]
push eax
call fcn.120125fb
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x180], 2
call fcn.1201c145
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x12013a62
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x12013a66
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.1201bfc5
cmp byte [ebp - 0x1d], 0
je 0x12013a8d
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.120187b5
jmp 0x12013f31
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf4], 0x49597746
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xf0], 0x7842434a
push eax
xor eax, eax
mov dword [ebp - 0xec], 0x44735765
push eax
sub esp, 0xc
mov dword [ebp - 0xe8], 0x37634165
mov ecx, esp
mov dword [ebp - 0xe4], 0x37687941
mov dword [ebp - 0xe0], 0x6a49774e
mov dword [ebp - 0xdc], 0x7430544f
mov dword [ebp - 0xd8], 0x68595444
mov dword [ebp - 0xd4], 0x7138544b
mov dword [ebp - 0xd0], 0x67396d61
mov dword [ebp - 0xcc], 0x30344341
mov dword [ebp - 0xc8], 0x2f513348
mov dword [ebp - 0xc4], 0x76597948
mov dword [ebp - 0xc0], 0x46515466
mov dword [ebp - 0xbc], 0x6773684b
mov dword [ebp - 0xb8], 0x3851524d
mov dword [ebp - 0xb4], 0x6149524e
mov dword [ebp - 0xb0], 0x43737844
mov dword [ebp - 0xac], 0x79596741
mov dword [ebp - 0xa8], 0x49676d47
mov dword [ebp - 0xa4], 0x4f49534c
mov dword [ebp - 0xa0], 0x696f5145
mov dword [ebp - 0x9c], 0x5a63784b
mov dword [ebp - 0x98], 0x6d4d444b
mov dword [ebp - 0x94], 0x2f747750
mov dword [ebp - 0x90], 0x69783249
mov dword [ebp - 0x8c], 0x6834414a
mov dword [ebp - 0x88], 0x674a4146
mov dword [ebp - 0x84], 0x30496e4b
mov dword [ebp - 0x80], 0x4141444c
mov dword [ebp - 0x7c], 0x31645841
mov dword [ebp - 0x78], 0x3951674c
mov dword [ebp - 0x74], 0x6c394849
mov dword [ebp - 0x70], 0x696f574b
mov dword [ebp - 0x6c], 0x6b6f484f
mov dword [ebp - 0x68], 0x66676844
mov dword [ebp - 0x64], 0x70417748
mov dword [ebp - 0x60], 0x5a41514b
mov dword [ebp - 0x5c], 0x3049544e
mov dword [ebp - 0x58], 0x4434514f
mov dword [ebp - 0x54], 0x7634524b
mov dword [ebp - 0x50], 0x70416866
mov dword [ebp - 0x4c], 0x6e493244
mov dword [ebp - 0x48], 0x735a4747
mov dword [ebp - 0x44], 0x355a6742
mov dword [ebp - 0x40], 0x566b6941
mov dword [ebp - 0x3c], 0x65776941
mov dword [ebp - 0x38], 0x57384741
mov dword [ebp - 0x34], 0x75316766
mov dword [ebp - 0x30], 0x6c416843
mov dword [ebp - 0x2c], 0x416f4144
mov dword [ebp - 0x28], 0x58434141
mov byte [ebp - 0x180], al
push dword [ebp - 0x180]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.1200f5c3
lea eax, [ebp - 0x190]
push eax
call fcn.120125fb
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x180], 4
call fcn.1201c145
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x12013cb9
cmp dword [ebp - 0x14], 0
jne 0x12013cc0
mov byte [ebp - 0x184], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.1201bfc5
cmp byte [ebp - 0x184], 0
je 0x12013f31
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x12013f31
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0xfc], 0x69566962
push eax
sub esp, 0xc
mov dword [ebp - 0xf8], 0x72646962
mov ecx, esp
mov dword [ebp - 0xf4], 0x375a4461
mov dword [ebp - 0xf0], 0x4c596a62
mov dword [ebp - 0xec], 0x3474534f
mov dword [ebp - 0xe8], 0x6555534c
mov dword [ebp - 0xe4], 0x68497844
mov dword [ebp - 0xe0], 0x7034434b
mov dword [ebp - 0xdc], 0x67386a42
mov dword [ebp - 0xd8], 0x46773247
mov dword [ebp - 0xd4], 0x72634441
mov dword [ebp - 0xd0], 0x51416e4d
mov dword [ebp - 0xcc], 0x6a745350
mov dword [ebp - 0xc8], 0x54557a63
mov dword [ebp - 0xc4], 0x50455843
mov dword [ebp - 0xc0], 0x7141534e
mov dword [ebp - 0xbc], 0x7a385459
mov dword [ebp - 0xb8], 0x6d51444b
mov dword [ebp - 0xb4], 0x74317741
mov dword [ebp - 0xb0], 0x746f6d4f
mov dword [ebp - 0xac], 0x49633363
mov dword [ebp - 0xa8], 0x4955774c
mov dword [ebp - 0xa4], 0x744a674f
mov dword [ebp - 0xa0], 0x44456866
mov dword [ebp - 0x9c], 0x6e634148
mov dword [ebp - 0x98], 0x346f7743
mov dword [ebp - 0x94], 0x4b63684e
mov dword [ebp - 0x90], 0x55387845
mov dword [ebp - 0x8c], 0x4c6b694a
mov dword [ebp - 0x88], 0x3138694d
mov dword [ebp - 0x84], 0x6d59544a
mov dword [ebp - 0x80], 0x38426847
mov dword [ebp - 0x7c], 0x5338544a
mov dword [ebp - 0x78], 0x666f514b
mov dword [ebp - 0x74], 0x6f4d6743
mov dword [ebp - 0x70], 0x4d634448
mov dword [ebp - 0x6c], 0x5438675a
mov dword [ebp - 0x68], 0x62775341
mov dword [ebp - 0x64], 0x674e6845
mov dword [ebp - 0x60], 0x6e305343
mov dword [ebp - 0x5c], 0x4a304166
mov dword [ebp - 0x58], 0x73774141
mov dword [ebp - 0x54], 0x6663434f
mov dword [ebp - 0x50], 0x6e386847
mov dword [ebp - 0x4c], 0x766b5445
mov dword [ebp - 0x48], 0x34686a43
mov dword [ebp - 0x44], 0x355a6a4d
mov dword [ebp - 0x40], 0x706c7762
mov dword [ebp - 0x3c], 0x4b774341
mov dword [ebp - 0x38], 0x55497862
mov dword [ebp - 0x34], 0x656b6865
mov dword [ebp - 0x30], 0x7759414b
mov dword [ebp - 0x2c], 0x4145474b
mov dword [ebp - 0x28], 0x54434141
mov byte [ebp - 0x184], al
push dword [ebp - 0x184]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.1200f5c3
lea eax, [ebp - 0x190]
push eax
call fcn.120125fb
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1201c145
push eax
push ebx
call fcn.12011fa7
add esp, 0x18
lea ecx, [ebp - 0x190]
call fcn.1201bfc5
cmp dword [ebp - 0x18], 0
je 0x12013f41
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1201e28a
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1201669e
call fcn.1201e821
ret