Function at 0x409890
Capabilities:
Get file size
Get file version info
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c9c3
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x46d45c]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x154]
push ecx
mov ecx, 0x46f874
call fcn.004173f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.00416b30
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x10]
call fcn.00402160
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4099f6
mov edx, dword [ebp - 0x20]
push edx
call fcn.00437999
add esp, 4
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4099e7
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
je 0x409966
mov edx, dword [ebp - 0x1c]
add edx, 2
mov dword [ebp - 0x1c], edx
jmp 0x409950
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00409010
add esp, 8
push 0x454bf4
mov edx, dword [ebp - 0xcc]
push edx
lea eax, [ebp - 0x198]
push eax
call fcn.00409170
add esp, 0xc
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1a0]
push edx
lea ecx, [ebp - 0x10]
call fcn.00402240
mov ecx, eax
call fcn.00402270
mov dword [ebp - 0x194], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call fcn.004021c0
cmp dword [ebp - 0x194], 0
je 0x4099e7
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00402240
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.00437abb
add esp, 4
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call fcn.00404890
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffff
je 0x409d57
push 0
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00409550
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x409a6b
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x40
lea ecx, [ebp - 0x14c]
push ecx
push 0
lea edx, [ebp - 0x30]
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x40
lea eax, [ebp - 0xbc]
push eax
push 0
lea ecx, [ebp - 0x30]
push ecx
push 2
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
lea edx, [ebp - 0xbc]
push edx
lea eax, [ebp - 0x14c]
push eax
push str._s__s
push 1
push 0x64
mov ecx, dword [ebp + 0x18]
call fcn.004023f0
push eax
call fcn.00438ac1
add esp, 0x10
cmp dword [ebp + 0x20], 0
je 0x409d4a
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
je 0x409d4a
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x160]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
je 0x409d3d
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x164]
push eax
push 0x8003
call fcn.004209f0
add esp, 0x10
mov ecx, dword [ebp + 0x20]
add ecx, 4
push ecx
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
push 0x8004
call fcn.004209f0
add esp, 0x10
mov edx, dword [ebp + 0x20]
add edx, 8
push edx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x164]
push edx
push 0x800c
call fcn.004209f0
add esp, 0x10
mov byte [ebp - 0x188], 0
xor eax, eax
mov dword [ebp - 0x187], eax
mov dword [ebp - 0x183], eax
mov dword [ebp - 0x17f], eax
mov dword [ebp - 0x17b], eax
mov dword [ebp - 0x177], eax
mov dword [ebp - 0x173], eax
mov dword [ebp - 0x16f], eax
mov word [ebp - 0x16b], ax
mov byte [ebp - 0x169], al
mov dword [ebp - 0x168], 0x20
push 1
mov ecx, dword [ebp - 0x168]
lea edx, [ecx + ecx + 1]
push edx
mov ecx, dword [ebp + 0x20]
add ecx, 0xc
call fcn.004023f0
push 0
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x168]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
call dword [0x46f6cc]
test eax, eax
je 0x409c8a
mov dword [ebp - 0x18c], 0
jmp 0x409c47
mov eax, dword [ebp - 0x18c]
add eax, 1
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x18c]
cmp ecx, dword [ebp - 0x168]
jae 0x409c8a
mov edx, dword [ebp - 0x18c]
movzx eax, byte [ebp + edx - 0x188]
push eax
push 0x454c1c
mov ecx, dword [ebp + 0x20]
add ecx, 0xc
call fcn.00402270
mov ecx, dword [ebp - 0x18c]
shl ecx, 1
lea edx, [eax + ecx*2]
push edx
call fcn.00438ac1
add esp, 0xc
jmp 0x409c38
mov dword [ebp - 0x168], 0x20
push 1
mov eax, dword [ebp - 0x168]
lea ecx, [eax + eax + 1]
push ecx
mov ecx, dword [ebp + 0x20]
add ecx, 0x10
call fcn.004023f0
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x188]
push eax
push str.2.16.840.1.101.3.4.2.1
mov ecx, dword [ebp - 0xc0]
push ecx
call fcn.004096c0
add esp, 0x10
test eax, eax
jne 0x409d30
mov dword [ebp - 0x190], 0
jmp 0x409ced
mov edx, dword [ebp - 0x190]
add edx, 1
mov dword [ebp - 0x190], edx
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x168]
jae 0x409d30
mov ecx, dword [ebp - 0x190]
movzx edx, byte [ebp + ecx - 0x188]
push edx
push 0x454c40
mov ecx, dword [ebp + 0x20]
add ecx, 0x10
call fcn.00402270
mov ecx, dword [ebp - 0x190]
shl ecx, 1
lea edx, [eax + ecx*2]
push edx
call fcn.00438ac1
add esp, 0xc
jmp 0x409cde
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004021c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.004168d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.004376f1
mov esp, ebp
pop ebp
ret