Function at 0x120136fb
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x148
mov eax, 0x1204c491
call fcn.1201e3d9
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x144], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1201412b
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1201412b
push esi
call fcn.1201dde3
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x12014114
lea eax, [ebp - 0x14]
mov dword [ebp - 0x120], 0x374d5145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x11c], 0x6877434d
push eax
xor eax, eax
mov dword [ebp - 0x118], 0x6c63684a
push eax
sub esp, 0xc
mov dword [ebp - 0x114], 0x47637a4a
mov ecx, esp
mov dword [ebp - 0x110], 0x374d534b
mov dword [ebp - 0x10c], 0x2f526d43
mov dword [ebp - 0x108], 0x2b6c325a
mov dword [ebp - 0x104], 0x3452695a
mov dword [ebp - 0x100], 0x32554243
mov dword [ebp - 0xfc], 0x764d794a
mov dword [ebp - 0xf8], 0x5a51694c
mov dword [ebp - 0xf4], 0x38637a4a
mov dword [ebp - 0xf0], 0x6934444b
mov dword [ebp - 0xec], 0x5a6b7850
mov dword [ebp - 0xe8], 0x2b594243
mov dword [ebp - 0xe4], 0x3477795a
mov dword [ebp - 0xe0], 0x586f6959
mov dword [ebp - 0xdc], 0x74514347
mov dword [ebp - 0xd8], 0x4f416946
mov dword [ebp - 0xd4], 0x39517949
mov dword [ebp - 0xd0], 0x65557848
mov dword [ebp - 0xcc], 0x47344149
mov dword [ebp - 0xc8], 0x4a595465
mov dword [ebp - 0xc4], 0x35684149
mov dword [ebp - 0xc0], 0x6864444d
mov dword [ebp - 0xbc], 0x7555324a
mov dword [ebp - 0xb8], 0x3941514d
mov dword [ebp - 0xb4], 0x62415148
mov dword [ebp - 0xb0], 0x6963694a
mov dword [ebp - 0xac], 0x43307965
mov dword [ebp - 0xa8], 0x35396a4b
mov dword [ebp - 0xa4], 0x3949444e
mov dword [ebp - 0xa0], 0x55346844
mov dword [ebp - 0x9c], 0x345a674b
mov dword [ebp - 0x98], 0x6a647743
mov dword [ebp - 0x94], 0x354a415a
mov dword [ebp - 0x90], 0x6f676742
mov dword [ebp - 0x8c], 0x4d305147
mov dword [ebp - 0x88], 0x39524847
mov dword [ebp - 0x84], 0x70356a4a
mov dword [ebp - 0x80], 0x33516865
mov dword [ebp - 0x7c], 0x66774163
mov dword [ebp - 0x78], 0x71307a4a
mov dword [ebp - 0x74], 0x38784448
mov dword [ebp - 0x70], 0x6c46424b
mov dword [ebp - 0x6c], 0x2b594359
mov dword [ebp - 0x68], 0x73456862
mov dword [ebp - 0x64], 0x4a777a66
mov dword [ebp - 0x60], 0x69456a59
mov dword [ebp - 0x5c], 0x4b4d784b
mov dword [ebp - 0x58], 0x6c63324e
mov dword [ebp - 0x54], 0x3530434e
mov dword [ebp - 0x50], 0x44634765
mov dword [ebp - 0x4c], 0x57677944
mov dword [ebp - 0x48], 0x4373414d
mov dword [ebp - 0x44], 0x63515150
mov dword [ebp - 0x40], 0x3539424e
mov dword [ebp - 0x3c], 0x5a34484e
mov dword [ebp - 0x38], 0x55594847
mov dword [ebp - 0x34], 0x5463585a
mov dword [ebp - 0x30], 0x6f30684f
mov dword [ebp - 0x2c], 0x34565445
mov dword [ebp - 0x28], 0x41416743
mov word [ebp - 0x24], 0x4a41
mov byte [ebp - 0x22], 0x51
mov byte [ebp - 0x148], al
push dword [ebp - 0x148]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.1200f663
lea eax, [ebp - 0x154]
push eax
call fcn.120128ad
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [ebp - 0x148], ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x144], ecx
mov ecx, eax
call fcn.1201bbec
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x12013a09
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x12013a0d
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.1201ba6c
cmp byte [ebp - 0x1d], 0
jne 0x12013d34
lea eax, [ebp - 0x14]
mov dword [ebp - 0x140], 0x374d5145
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x13c], 0x6877434d
push eax
xor eax, eax
mov dword [ebp - 0x138], 0x6c63684a
push eax
sub esp, 0xc
mov dword [ebp - 0x134], 0x47637a4a
mov ecx, esp
mov dword [ebp - 0x130], 0x374d534b
mov dword [ebp - 0x12c], 0x37526d43
mov dword [ebp - 0x128], 0x2b42325a
mov dword [ebp - 0x124], 0x71596e59
mov dword [ebp - 0x120], 0x32554243
mov dword [ebp - 0x11c], 0x764d794a
mov dword [ebp - 0x118], 0x5a51694c
mov dword [ebp - 0x114], 0x38637a4a
mov dword [ebp - 0x110], 0x6934444b
mov dword [ebp - 0x10c], 0x44514741
mov dword [ebp - 0x108], 0x69497950
mov dword [ebp - 0x104], 0x5a496859
mov dword [ebp - 0x100], 0x33347a44
mov dword [ebp - 0xfc], 0x366c524f
mov dword [ebp - 0xf8], 0x3049694d
mov dword [ebp - 0xf4], 0x37553344
mov dword [ebp - 0xf0], 0x6830424f
mov dword [ebp - 0xec], 0x5a413362
mov dword [ebp - 0xe8], 0x63516a4d
mov dword [ebp - 0xe4], 0x59415142
mov dword [ebp - 0xe0], 0x7431434a
mov dword [ebp - 0xdc], 0x2b746841
mov dword [ebp - 0xd8], 0x36514341
mov dword [ebp - 0xd4], 0x41416761
mov dword [ebp - 0xd0], 0x4d514459
mov dword [ebp - 0xcc], 0x564d7a42
mov dword [ebp - 0xc8], 0x6b675349
mov dword [ebp - 0xc4], 0x3930694d
mov dword [ebp - 0xc0], 0x32416d44
mov dword [ebp - 0xbc], 0x4b4d3244
mov dword [ebp - 0xb8], 0x57516844
mov dword [ebp - 0xb4], 0x41304259
mov dword [ebp - 0xb0], 0x58735259
mov dword [ebp - 0xac], 0x6b554350
mov dword [ebp - 0xa8], 0x7277674f
mov dword [ebp - 0xa4], 0x6a457a46
mov dword [ebp - 0xa0], 0x45554241
mov dword [ebp - 0x9c], 0x71415463
mov dword [ebp - 0x98], 0x39777a41
mov dword [ebp - 0x94], 0x69517a48
mov dword [ebp - 0x90], 0x746f4246
mov dword [ebp - 0x8c], 0x6e30474f
mov dword [ebp - 0x88], 0x71304449
mov dword [ebp - 0x84], 0x6a637a41
mov dword [ebp - 0x80], 0x49456959
mov dword [ebp - 0x7c], 0x52736743
mov dword [ebp - 0x78], 0x2b5a6741
mov dword [ebp - 0x74], 0x2b4d7a65
mov dword [ebp - 0x70], 0x37685442
mov dword [ebp - 0x6c], 0x64677748
mov dword [ebp - 0x68], 0x5238674d
mov dword [ebp - 0x64], 0x7a467946
mov dword [ebp - 0x60], 0x30775450
mov dword [ebp - 0x5c], 0x6e385249
mov dword [ebp - 0x58], 0x4238434c
mov dword [ebp - 0x54], 0x41594441
mov dword [ebp - 0x50], 0x4745524b
mov dword [ebp - 0x4c], 0x33455442
mov dword [ebp - 0x48], 0x6a735347
mov dword [ebp - 0x44], 0x69526d4b
mov dword [ebp - 0x40], 0x5134434b
mov dword [ebp - 0x3c], 0x4a347747
mov dword [ebp - 0x38], 0x2b51574e
mov dword [ebp - 0x34], 0x61595447
mov dword [ebp - 0x30], 0x3938514e
mov dword [ebp - 0x2c], 0x63496e42
mov dword [ebp - 0x28], 0x41735443
mov dword [ebp - 0x24], 0x74434141
mov dword [ecx], eax
mov byte [ebp - 0x144], al
push dword [ebp - 0x144]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.1200f663
lea eax, [ebp - 0x154]
push eax
call fcn.120128ad
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x144], 2
call fcn.1201bbec
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x12013d1b
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x12013d1f
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.1201ba6c
cmp byte [ebp - 0x1d], 0
je 0x12013d46
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.1201880d
jmp 0x12014114
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe4], 0x374a5745
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xe0], 0x43596864
push eax
xor eax, eax
mov dword [ebp - 0xdc], 0x6b455144
push eax
sub esp, 0xc
mov dword [ebp - 0xd8], 0x694e6a4a
mov ecx, esp
mov dword [ebp - 0xd4], 0x6e415446
mov dword [ebp - 0xd0], 0x62556949
mov dword [ebp - 0xcc], 0x3264434e
mov dword [ebp - 0xc8], 0x48555348
mov dword [ebp - 0xc4], 0x48597849
mov dword [ebp - 0xc0], 0x73455166
mov dword [ebp - 0xbc], 0x31775246
mov dword [ebp - 0xb8], 0x32646e65
mov dword [ebp - 0xb4], 0x59345463
mov dword [ebp - 0xb0], 0x5a637766
mov dword [ebp - 0xac], 0x6d4d4164
mov dword [ebp - 0xa8], 0x38555442
mov dword [ebp - 0xa4], 0x46634446
mov dword [ebp - 0xa0], 0x64456941
mov dword [ebp - 0x9c], 0x7a786a44
mov dword [ebp - 0x98], 0x2b59694d
mov dword [ebp - 0x94], 0x355a4442
mov dword [ebp - 0x90], 0x694e334b
mov dword [ebp - 0x8c], 0x3634774a
mov dword [ebp - 0x88], 0x4d417950
mov dword [ebp - 0x84], 0x4767574b
mov dword [ebp - 0x80], 0x42517742
mov dword [ebp - 0x7c], 0x6e55684e
mov dword [ebp - 0x78], 0x6a516943
mov dword [ebp - 0x74], 0x42416a49
mov dword [ebp - 0x70], 0x50496947
mov dword [ebp - 0x6c], 0x584d324f
mov dword [ebp - 0x68], 0x6e45774b
mov dword [ebp - 0x64], 0x6273444b
mov dword [ebp - 0x60], 0x6a347849
mov dword [ebp - 0x5c], 0x6e644246
mov dword [ebp - 0x58], 0x3756794e
mov dword [ebp - 0x54], 0x61514143
mov dword [ebp - 0x50], 0x51384441
mov dword [ebp - 0x4c], 0x76416946
mov dword [ebp - 0x48], 0x76396e4a
mov dword [ebp - 0x44], 0x4c4d6865
mov dword [ebp - 0x40], 0x646f534a
mov dword [ebp - 0x3c], 0x30706863
mov dword [ebp - 0x38], 0x3745514c
mov dword [ebp - 0x34], 0x6834694c
mov dword [ebp - 0x30], 0x364d574a
mov dword [ebp - 0x2c], 0x2f51434f
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x416a
mov byte [ebp - 0x144], al
push dword [ebp - 0x144]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.1200f663
lea eax, [ebp - 0x154]
push eax
call fcn.120128ad
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x144], 4
call fcn.1201bbec
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x12013f50
cmp dword [ebp - 0x14], 0
jne 0x12013f57
mov byte [ebp - 0x148], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.1201ba6c
cmp byte [ebp - 0x148], 0
je 0x12014114
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x12014114
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
xor eax, eax
mov dword [ebp - 0xb0], 0x68524461
push eax
sub esp, 0xc
mov dword [ebp - 0xac], 0x6846795a
mov ecx, esp
mov dword [ebp - 0xa8], 0x6956445a
mov dword [ebp - 0xa4], 0x6a596a62
mov dword [ebp - 0xa0], 0x4763544e
mov dword [ebp - 0x9c], 0x4d49444a
mov dword [ebp - 0x98], 0x5545414e
mov dword [ebp - 0x94], 0x7173534a
mov dword [ebp - 0x90], 0x57774859
mov dword [ebp - 0x8c], 0x55517a47
mov dword [ebp - 0x88], 0x2b517a66
mov dword [ebp - 0x84], 0x7238434f
mov dword [ebp - 0x80], 0x7141474a
mov dword [ebp - 0x7c], 0x3659574c
mov dword [ebp - 0x78], 0x6c5a6761
mov dword [ebp - 0x74], 0x2f6c584a
mov dword [ebp - 0x70], 0x354d774a
mov dword [ebp - 0x6c], 0x6155484b
mov dword [ebp - 0x68], 0x4945695a
mov dword [ebp - 0x64], 0x66307a4c
mov dword [ebp - 0x60], 0x2b686d43
mov dword [ebp - 0x5c], 0x2f386764
mov dword [ebp - 0x58], 0x484d7943
mov dword [ebp - 0x54], 0x43496d5a
mov dword [ebp - 0x50], 0x4c77694d
mov dword [ebp - 0x4c], 0x6a734146
mov dword [ebp - 0x48], 0x57554248
mov dword [ebp - 0x44], 0x6e415250
mov dword [ebp - 0x40], 0x3834534c
mov dword [ebp - 0x3c], 0x76706d45
mov dword [ebp - 0x38], 0x74303341
mov dword [ebp - 0x34], 0x4f49434c
mov dword [ebp - 0x30], 0x31597845
mov dword [ebp - 0x2c], 0x496b4441
mov dword [ebp - 0x28], 0x41416764
mov word [ebp - 0x24], 0x4641
mov byte [ebp - 0x22], 0x77
mov byte [ebp - 0x148], al
push dword [ebp - 0x148]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.1200f663
lea eax, [ebp - 0x154]
push eax
call fcn.120128ad
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1201bbec
push eax
push ebx
call fcn.12012259
add esp, 0x18
lea ecx, [ebp - 0x154]
call fcn.1201ba6c
cmp dword [ebp - 0x18], 0
je 0x12014124
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1201ddec
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1201695d
call fcn.1201e383
ret