Function at 0x10011817
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x128
mov eax, 0x10046435
call fcn.1002e5e6
mov ebx, ecx
and dword [ebp - 0x124], 0
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001204d
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x1001204d
push esi
call fcn.1001df68
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10012036
lea eax, [ebp - 0x14]
mov dword [ebp - 0x120], 0x6b736746
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x11c], 0x6934544a
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x118], 0x7841424d
mov ecx, esp
mov dword [ebp - 0x114], 0x4945794a
lea eax, [ebp - 0x21]
mov dword [ebp - 0x110], 0x6a73434a
lea edx, [ebp - 0x120]
mov dword [ebp - 0x10c], 0x684e3246
push ecx
push eax
push edx
mov dword [ebp - 0x108], 0x6b5a5863
mov dword [ebp - 0x104], 0x6b566966
mov dword [ebp - 0x100], 0x72455245
mov dword [ebp - 0xfc], 0x6c776950
mov dword [ebp - 0xf8], 0x4777534b
mov dword [ebp - 0xf4], 0x2f55694d
mov dword [ebp - 0xf0], 0x326b6a50
mov dword [ebp - 0xec], 0x44634143
mov dword [ebp - 0xe8], 0x71305243
mov dword [ebp - 0xe4], 0x7352684d
mov dword [ebp - 0xe0], 0x4245434a
mov dword [ebp - 0xdc], 0x77594166
mov dword [ebp - 0xd8], 0x4e636e43
mov dword [ebp - 0xd4], 0x6873794f
mov dword [ebp - 0xd0], 0x6b314448
mov dword [ebp - 0xcc], 0x67516765
mov dword [ebp - 0xc8], 0x73774347
mov dword [ebp - 0xc4], 0x46454847
mov dword [ebp - 0xc0], 0x686b5150
mov dword [ebp - 0xbc], 0x79413263
mov dword [ebp - 0xb8], 0x44636e49
mov dword [ebp - 0xb4], 0x7767794a
mov dword [ebp - 0xb0], 0x67785147
mov dword [ebp - 0xac], 0x47495459
mov dword [ebp - 0xa8], 0x55776748
mov dword [ebp - 0xa4], 0x3742414d
mov dword [ebp - 0xa0], 0x4a557962
mov dword [ebp - 0x9c], 0x6e735149
mov dword [ebp - 0x98], 0x46674849
mov dword [ebp - 0x94], 0x6c4a694b
mov dword [ebp - 0x90], 0x336b774a
mov dword [ebp - 0x8c], 0x6c677863
mov dword [ebp - 0x88], 0x50635243
mov dword [ebp - 0x84], 0x42414343
mov dword [ebp - 0x80], 0x5473694a
mov dword [ebp - 0x7c], 0x68685445
mov dword [ebp - 0x78], 0x646b4159
mov dword [ebp - 0x74], 0x74556e65
mov dword [ebp - 0x70], 0x6538334a
mov dword [ebp - 0x6c], 0x3863414a
mov dword [ebp - 0x68], 0x46556849
mov dword [ebp - 0x64], 0x57416849
mov dword [ebp - 0x60], 0x446b4247
mov dword [ebp - 0x5c], 0x41496845
mov dword [ebp - 0x58], 0x6d687949
mov dword [ebp - 0x54], 0x30524341
mov dword [ebp - 0x50], 0x74496d47
mov dword [ebp - 0x4c], 0x7155675a
mov dword [ebp - 0x48], 0x6e45794f
mov dword [ebp - 0x44], 0x73555445
mov dword [ebp - 0x40], 0x7456784a
mov dword [ebp - 0x3c], 0x6177514b
mov dword [ebp - 0x38], 0x516f6948
mov dword [ebp - 0x34], 0x6d42774b
mov dword [ebp - 0x30], 0x6878574f
mov dword [ebp - 0x2c], 0x70417a44
mov dword [ebp - 0x28], 0x41414159
mov word [ebp - 0x24], 0x4a41
mov byte [ebp - 0x22], 0x51
call fcn.1001986e
lea ecx, [ebp - 0x134]
call fcn.10011111
add esp, 0xc
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov ecx, eax
call fcn.100199e0
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
push eax
push edi
call esi
test eax, eax
je 0x10011b14
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10011b18
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.1001994c
cmp byte [ebp - 0x1d], 0
jne 0x10011d44
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe8], 0x6b736746
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xe4], 0x6934544a
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xe0], 0x7841424d
mov ecx, esp
mov dword [ebp - 0xdc], 0x4945794a
lea eax, [ebp - 0x24]
mov dword [ebp - 0xd8], 0x6a73434a
lea edx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 0x6c4e3246
push ecx
push eax
push edx
mov dword [ebp - 0xd0], 0x6b395863
mov dword [ebp - 0xcc], 0x32636e65
mov dword [ebp - 0xc8], 0x72455245
mov dword [ebp - 0xc4], 0x6c776950
mov dword [ebp - 0xc0], 0x4777534b
mov dword [ebp - 0xbc], 0x2f55694d
mov dword [ebp - 0xb8], 0x326b6a50
mov dword [ebp - 0xb4], 0x45737766
mov dword [ebp - 0xb0], 0x34397a49
mov dword [ebp - 0xac], 0x746f5742
mov dword [ebp - 0xa8], 0x38777a64
mov dword [ebp - 0xa4], 0x6842334d
mov dword [ebp - 0xa0], 0x4467434f
mov dword [ebp - 0x9c], 0x6f6f335a
mov dword [ebp - 0x98], 0x70496a45
mov dword [ebp - 0x94], 0x2f45775a
mov dword [ebp - 0x90], 0x49556744
mov dword [ebp - 0x8c], 0x436b4166
mov dword [ebp - 0x88], 0x3042534a
mov dword [ebp - 0x84], 0x6a777749
mov dword [ebp - 0x80], 0x6e314241
mov dword [ebp - 0x7c], 0x4345424d
mov dword [ebp - 0x78], 0x3877774b
mov dword [ebp - 0x74], 0x37345347
mov dword [ebp - 0x70], 0x43634266
mov dword [ebp - 0x6c], 0x6c557750
mov dword [ebp - 0x68], 0x4c557a49
mov dword [ebp - 0x64], 0x4541784a
mov dword [ebp - 0x60], 0x36707742
mov dword [ebp - 0x5c], 0x4d634746
mov dword [ebp - 0x58], 0x7563674e
mov dword [ebp - 0x54], 0x6c67414c
mov dword [ebp - 0x50], 0x58555364
mov dword [ebp - 0x4c], 0x6363424e
mov dword [ebp - 0x48], 0x6e67324c
mov dword [ebp - 0x44], 0x6e557a59
mov dword [ebp - 0x40], 0x30676a46
mov dword [ebp - 0x3c], 0x56676763
mov dword [ebp - 0x38], 0x2f424145
mov dword [ebp - 0x34], 0x6835784a
mov dword [ebp - 0x30], 0x37735463
mov dword [ebp - 0x2c], 0x414d5265
mov dword [ebp - 0x28], 0x6f424141
call fcn.1001986e
lea ecx, [ebp - 0x134]
call fcn.10011111
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [ebp - 0x124], 2
call fcn.100199e0
push eax
push edi
call esi
test eax, eax
je 0x10011d2b
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x10011d2f
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.1001994c
cmp byte [ebp - 0x1d], 0
je 0x10011d56
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.1001966c
jmp 0x10012036
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc8], 0x59416846
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc4], 0x44516d46
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xc0], 0x67777a4f
mov ecx, esp
mov dword [ebp - 0xbc], 0x73687750
lea eax, [ebp - 0x21]
mov dword [ebp - 0xb8], 0x6a6b6a63
lea edx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 0x6673434c
push ecx
push eax
push edx
mov dword [ebp - 0xb0], 0x6a357946
mov dword [ebp - 0xac], 0x5951674f
mov dword [ebp - 0xa8], 0x4a51484c
mov dword [ebp - 0xa4], 0x39386841
mov dword [ebp - 0xa0], 0x64555266
mov dword [ebp - 0x9c], 0x42347759
mov dword [ebp - 0x98], 0x7651684a
mov dword [ebp - 0x94], 0x30773366
mov dword [ebp - 0x90], 0x3639334c
mov dword [ebp - 0x8c], 0x6b735365
mov dword [ebp - 0x88], 0x52515143
mov dword [ebp - 0x84], 0x6d744347
mov dword [ebp - 0x80], 0x654d5248
mov dword [ebp - 0x7c], 0x4b457846
mov dword [ebp - 0x78], 0x33305242
mov dword [ebp - 0x74], 0x544d695a
mov dword [ebp - 0x70], 0x6445694c
mov dword [ebp - 0x6c], 0x67306a49
mov dword [ebp - 0x68], 0x50305866
mov dword [ebp - 0x64], 0x4b456950
mov dword [ebp - 0x60], 0x326f4864
mov dword [ebp - 0x5c], 0x6e45684f
mov dword [ebp - 0x58], 0x6a4d584a
mov dword [ebp - 0x54], 0x6f4e7946
mov dword [ebp - 0x50], 0x37736847
mov dword [ebp - 0x4c], 0x38777a4f
mov dword [ebp - 0x48], 0x39776848
mov dword [ebp - 0x44], 0x76777a4f
mov dword [ebp - 0x40], 0x69775843
mov dword [ebp - 0x3c], 0x76595365
mov dword [ebp - 0x38], 0x74747964
mov dword [ebp - 0x34], 0x4e385443
mov dword [ebp - 0x30], 0x786b5365
mov dword [ebp - 0x2c], 0x50384861
mov dword [ebp - 0x28], 0x41417763
mov word [ebp - 0x24], 0x4841
mov byte [ebp - 0x22], 0x67
call fcn.1001986e
lea ecx, [ebp - 0x134]
call fcn.10011111
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [ebp - 0x124], 4
call fcn.100199e0
push eax
push edi
call esi
test eax, eax
je 0x10011f06
cmp dword [ebp - 0x14], 0
jne 0x10011f0d
mov byte [ebp - 0x128], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.1001994c
cmp byte [ebp - 0x128], 0
je 0x10012036
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x10012036
movzx eax, word [ecx + 0xc]
lea edx, [ebp - 0x80]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x80], 0x2b787a62
mov ecx, esp
mov dword [ebp - 0x7c], 0x694e6a63
lea eax, [ebp - 0x22]
mov dword [ebp - 0x78], 0x324a6a63
mov dword [ebp - 0x74], 0x7a416962
push ecx
push eax
push edx
mov dword [ebp - 0x70], 0x47635447
mov dword [ebp - 0x6c], 0x6e564143
mov dword [ebp - 0x68], 0x5667684e
mov dword [ebp - 0x64], 0x59515350
mov dword [ebp - 0x60], 0x616b6943
mov dword [ebp - 0x5c], 0x30737a4a
mov dword [ebp - 0x58], 0x2f55424f
mov dword [ebp - 0x54], 0x766f6a47
mov dword [ebp - 0x50], 0x6f786846
mov dword [ebp - 0x4c], 0x51557941
mov dword [ebp - 0x48], 0x3634514a
mov dword [ebp - 0x44], 0x6770574d
mov dword [ebp - 0x40], 0x2f346944
mov dword [ebp - 0x3c], 0x6a464447
mov dword [ebp - 0x38], 0x3967794f
mov dword [ebp - 0x34], 0x49456e41
mov dword [ebp - 0x30], 0x6b683247
mov dword [ebp - 0x2c], 0x7449524c
mov dword [ebp - 0x28], 0x41414141
mov word [ebp - 0x24], 0x774e
call fcn.1001986e
lea ecx, [ebp - 0x134]
call fcn.10011111
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.100199e0
push eax
push ebx
call fcn.1001b582
add esp, 0x18
lea ecx, [ebp - 0x134]
call fcn.1001994c
cmp dword [ebp - 0x18], 0
je 0x10012046
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001eb5b
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1000ff12
call fcn.1002e595
ret