Function at 0x4c0eed
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push 0x128
mov eax, 0x5abd75
call fcn.00553bf3
mov ebx, ecx
and dword [ebp - 0x124], 0
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c17ba
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x4c17ba
push esi
call fcn.005312f2
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4c17a3
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe8], 0x36455148
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xe4], 0x76734450
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xe0], 0x7463514b
mov ecx, esp
mov dword [ebp - 0xdc], 0x4c636949
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xd8], 0x39637a4c
lea edx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 0x77524847
push ecx
push eax
push edx
mov dword [ebp - 0xd0], 0x3635475a
mov dword [ebp - 0xcc], 0x34396965
mov dword [ebp - 0xc8], 0x35777844
mov dword [ebp - 0xc4], 0x67497a4a
mov dword [ebp - 0xc0], 0x59596949
mov dword [ebp - 0xbc], 0x7941794b
mov dword [ebp - 0xb8], 0x7134794a
mov dword [ebp - 0xb4], 0x795a6e47
mov dword [ebp - 0xb0], 0x2f704262
mov dword [ebp - 0xac], 0x6734694e
mov dword [ebp - 0xa8], 0x72306759
mov dword [ebp - 0xa4], 0x64736941
mov dword [ebp - 0xa0], 0x49736a4d
mov dword [ebp - 0x9c], 0x3063694d
mov dword [ebp - 0x98], 0x42453263
mov dword [ebp - 0x94], 0x704d6846
mov dword [ebp - 0x90], 0x39425147
mov dword [ebp - 0x8c], 0x374d5343
mov dword [ebp - 0x88], 0x71495147
mov dword [ebp - 0x84], 0x6e416746
mov dword [ebp - 0x80], 0x2f383259
mov dword [ebp - 0x7c], 0x58345150
mov dword [ebp - 0x78], 0x6d316e49
mov dword [ebp - 0x74], 0x786f4249
mov dword [ebp - 0x70], 0x32704444
mov dword [ebp - 0x6c], 0x6a674149
mov dword [ebp - 0x68], 0x71775341
mov dword [ebp - 0x64], 0x30526a42
mov dword [ebp - 0x60], 0x5a45474c
mov dword [ebp - 0x5c], 0x7a70774e
mov dword [ebp - 0x58], 0x504d685a
mov dword [ebp - 0x54], 0x4f774844
mov dword [ebp - 0x50], 0x396c424f
mov dword [ebp - 0x4c], 0x696c684f
mov dword [ebp - 0x48], 0x70557846
mov dword [ebp - 0x44], 0x75517850
mov dword [ebp - 0x40], 0x316c3342
mov dword [ebp - 0x3c], 0x644d444b
mov dword [ebp - 0x38], 0x374d694a
mov dword [ebp - 0x34], 0x41777a63
mov dword [ebp - 0x30], 0x69424141
call fcn.00450208
lea ecx, [ebp - 0x134]
call fcn.004c35a2
add esp, 0xc
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov ecx, eax
call fcn.004ab6d2
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
push eax
push edi
call esi
test eax, eax
je 0x4c1146
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x4c114a
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ab565
cmp byte [ebp - 0x1d], 0
jne 0x4c131b
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc8], 0x36455148
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc4], 0x76734450
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xc0], 0x7463514b
mov ecx, esp
mov dword [ebp - 0xbc], 0x4c636949
lea eax, [ebp - 0x2d]
mov dword [ebp - 0xb8], 0x39637a4c
lea edx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 0x30524847
push ecx
push eax
push edx
mov dword [ebp - 0xb0], 0x3664475a
mov dword [ebp - 0xac], 0x71306e66
mov dword [ebp - 0xa8], 0x35777844
mov dword [ebp - 0xa4], 0x67497a4a
mov dword [ebp - 0xa0], 0x59596949
mov dword [ebp - 0x9c], 0x7941794b
mov dword [ebp - 0x98], 0x7134794a
mov dword [ebp - 0x94], 0x514d5344
mov dword [ebp - 0x90], 0x614d4742
mov dword [ebp - 0x8c], 0x62303364
mov dword [ebp - 0x88], 0x3938474a
mov dword [ebp - 0x84], 0x2f6c534a
mov dword [ebp - 0x80], 0x5455534a
mov dword [ebp - 0x7c], 0x4134684c
mov dword [ebp - 0x78], 0x304d574b
mov dword [ebp - 0x74], 0x46457866
mov dword [ebp - 0x70], 0x4e554344
mov dword [ebp - 0x6c], 0x524d4865
mov dword [ebp - 0x68], 0x65516a43
mov dword [ebp - 0x64], 0x67415442
mov dword [ebp - 0x60], 0x6c6b784a
mov dword [ebp - 0x5c], 0x51777746
mov dword [ebp - 0x58], 0x4a305441
mov dword [ebp - 0x54], 0x78774248
mov dword [ebp - 0x50], 0x38307a4a
mov dword [ebp - 0x4c], 0x47676865
mov dword [ebp - 0x48], 0x7a344366
mov dword [ebp - 0x44], 0x61455143
mov dword [ebp - 0x40], 0x56737845
mov dword [ebp - 0x3c], 0x68345444
mov dword [ebp - 0x38], 0x37455165
mov dword [ebp - 0x34], 0x4141414a
mov word [ebp - 0x30], 0x4541
mov byte [ebp - 0x2e], 0x6b
call fcn.00450208
lea ecx, [ebp - 0x134]
call fcn.004c35a2
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [ebp - 0x124], 2
call fcn.004ab6d2
push eax
push edi
call esi
test eax, eax
je 0x4c1302
cmp dword [ebp - 0x14], 0
mov byte [ebp - 0x1d], 1
jne 0x4c1306
mov byte [ebp - 0x1d], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ab565
cmp byte [ebp - 0x1d], 0
je 0x4c132d
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.004c3ad4
jmp 0x4c17a3
lea eax, [ebp - 0x14]
mov dword [ebp - 0xd0], 0x44345448
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xcc], 0x314d7847
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xc8], 0x4a774742
mov ecx, esp
mov dword [ebp - 0xc4], 0x364a424b
lea eax, [ebp - 0x29]
mov dword [ebp - 0xc0], 0x7141774e
lea edx, [ebp - 0xd0]
mov dword [ebp - 0xbc], 0x6a416e45
push ecx
push eax
push edx
mov dword [ebp - 0xb8], 0x34677745
mov dword [ebp - 0xb4], 0x6d514841
mov dword [ebp - 0xb0], 0x63516949
mov dword [ebp - 0xac], 0x6b46544a
mov dword [ebp - 0xa8], 0x47674144
mov dword [ebp - 0xa4], 0x4a636d4b
mov dword [ebp - 0xa0], 0x784e4249
mov dword [ebp - 0x9c], 0x6c41694e
mov dword [ebp - 0x98], 0x69304446
mov dword [ebp - 0x94], 0x7367414e
mov dword [ebp - 0x90], 0x7a38515a
mov dword [ebp - 0x8c], 0x38746850
mov dword [ebp - 0x88], 0x54556e45
mov dword [ebp - 0x84], 0x6e595344
mov dword [ebp - 0x80], 0x6373524a
mov dword [ebp - 0x7c], 0x674d4143
mov dword [ebp - 0x78], 0x39677a4c
mov dword [ebp - 0x74], 0x646f7a4e
mov dword [ebp - 0x70], 0x6d4e3246
mov dword [ebp - 0x6c], 0x72594149
mov dword [ebp - 0x68], 0x44457a47
mov dword [ebp - 0x64], 0x2b524448
mov dword [ebp - 0x60], 0x634d794a
mov dword [ebp - 0x5c], 0x52497947
mov dword [ebp - 0x58], 0x39357a43
mov dword [ebp - 0x54], 0x56456850
mov dword [ebp - 0x50], 0x63596a4e
mov dword [ebp - 0x4c], 0x6a634465
mov dword [ebp - 0x48], 0x77515346
mov dword [ebp - 0x44], 0x64634148
mov dword [ebp - 0x40], 0x2f394149
mov dword [ebp - 0x3c], 0x6c393341
mov dword [ebp - 0x38], 0x376f6846
mov dword [ebp - 0x34], 0x42344165
mov dword [ebp - 0x30], 0x41417743
mov word [ebp - 0x2c], 0x4841
mov byte [ebp - 0x2a], 0x67
call fcn.00450208
lea ecx, [ebp - 0x134]
call fcn.004c35a2
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [ebp - 0x124], 4
call fcn.004ab6d2
push eax
push edi
call esi
test eax, eax
je 0x4c14e3
cmp dword [ebp - 0x14], 0
jne 0x4c14ea
mov byte [ebp - 0x128], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ab565
cmp byte [ebp - 0x128], 0
je 0x4c17a3
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x4c17a3
movzx eax, word [ecx + 0xc]
lea edx, [ebp - 0x120]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x120], 0x675a445a
mov ecx, esp
mov dword [ebp - 0x11c], 0x765a7a61
lea eax, [ebp - 0x26]
mov dword [ebp - 0x118], 0x71567961
mov dword [ebp - 0x114], 0x32597961
push ecx
push eax
push edx
mov dword [ebp - 0x110], 0x56635444
mov dword [ebp - 0x10c], 0x3174784c
mov dword [ebp - 0x108], 0x2b464347
mov dword [ebp - 0x104], 0x666b5244
mov dword [ebp - 0x100], 0x43386e42
mov dword [ebp - 0xfc], 0x45414344
mov dword [ebp - 0xf8], 0x5841694b
mov dword [ebp - 0xf4], 0x59416743
mov dword [ebp - 0xf0], 0x766b5143
mov dword [ebp - 0xec], 0x50306748
mov dword [ebp - 0xe8], 0x47516944
mov dword [ebp - 0xe4], 0x49307744
mov dword [ebp - 0xe0], 0x72345462
mov dword [ebp - 0xdc], 0x43557964
mov dword [ebp - 0xd8], 0x37707846
mov dword [ebp - 0xd4], 0x6d496741
mov dword [ebp - 0xd0], 0x50554346
mov dword [ebp - 0xcc], 0x476f574a
mov dword [ebp - 0xc8], 0x78647a41
mov dword [ebp - 0xc4], 0x72414849
mov dword [ebp - 0xc0], 0x314d684a
mov dword [ebp - 0xbc], 0x55554264
mov dword [ebp - 0xb8], 0x34386a47
mov dword [ebp - 0xb4], 0x346c4144
mov dword [ebp - 0xb0], 0x4530584d
mov dword [ebp - 0xac], 0x6651694f
mov dword [ebp - 0xa8], 0x64554764
mov dword [ebp - 0xa4], 0x30416764
mov dword [ebp - 0xa0], 0x58674146
mov dword [ebp - 0x9c], 0x68676865
mov dword [ebp - 0x98], 0x3930544c
mov dword [ebp - 0x94], 0x76596e50
mov dword [ebp - 0x90], 0x69417749
mov dword [ebp - 0x8c], 0x6c42474a
mov dword [ebp - 0x88], 0x366f695a
mov dword [ebp - 0x84], 0x52384748
mov dword [ebp - 0x80], 0x59736764
mov dword [ebp - 0x7c], 0x656b6866
mov dword [ebp - 0x78], 0x44676864
mov dword [ebp - 0x74], 0x6b30674b
mov dword [ebp - 0x70], 0x65594263
mov dword [ebp - 0x6c], 0x6a493345
mov dword [ebp - 0x68], 0x7a566d48
mov dword [ebp - 0x64], 0x6e6b6a48
mov dword [ebp - 0x60], 0x674d4148
mov dword [ebp - 0x5c], 0x696c544d
mov dword [ebp - 0x58], 0x30496d48
mov dword [ebp - 0x54], 0x7a6c5466
mov dword [ebp - 0x50], 0x64347842
mov dword [ebp - 0x4c], 0x59454466
mov dword [ebp - 0x48], 0x39734249
mov dword [ebp - 0x44], 0x43345444
mov dword [ebp - 0x40], 0x5459534a
mov dword [ebp - 0x3c], 0x4d6b6a43
mov dword [ebp - 0x38], 0x526f514e
mov dword [ebp - 0x34], 0x7a676a50
mov dword [ebp - 0x30], 0x2f677864
mov dword [ebp - 0x2c], 0x41414141
mov word [ebp - 0x28], 0x4172
call fcn.00450208
lea ecx, [ebp - 0x134]
call fcn.004c35a2
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004ab6d2
push eax
push ebx
call fcn.004c323e
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ab565
cmp dword [ebp - 0x18], 0
je 0x4c17b3
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0054e4d7
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
call fcn.00553ba2
ret