Function at 0x40d270
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x40
mov eax, dword [0x42482c]
xor eax, esp
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov edx, dword [eax - 8]
lea ebx, [ebp + 0x78]
sub eax, 0x10
push esi
push edi
mov edi, dword [eax + 0xc]
mov ecx, 1
sub ecx, edi
sub edx, 0x208
or ecx, edx
jge 0x40d2b0
push 0x208
mov ecx, ebx
call fcn.00403730
mov eax, dword [ebx]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebx]
test edx, edx
jne 0x40d2ca
xor esi, esi
jmp 0x40d2dd
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d2d0
sub eax, esi
mov esi, eax
js 0x40d2e2
cmp esi, dword [edx - 8]
jle 0x40d2ec
push 0x80070057
call fcn.004033d0
mov ecx, dword [ebx]
mov dword [ecx - 0xc], esi
mov edx, dword [ebx]
mov byte [esi + edx], 0
mov eax, dword [ebp + 0x84]
mov edx, dword [eax - 4]
lea esi, [ebp + 0x84]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, 0x104
or ecx, edx
jge 0x40d329
push 0x104
mov ecx, esi
call fcn.00403730
mov eax, dword [esi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [esi]
test edx, edx
jne 0x40d341
xor edi, edi
jmp 0x40d353
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d346
sub eax, edi
mov edi, eax
js 0x40d358
cmp edi, dword [edx - 8]
jle 0x40d362
push 0x80070057
call fcn.004033d0
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
push 7
push str.RavDown
mov ecx, esi
mov byte [edi + edx], 0
call fcn.00403e90
mov eax, dword [esi]
push str.Rising.dat
push eax
lea ecx, [ebp + 0x7c]
push str._s_s
push ecx
call fcn.00404580
mov edx, dword [esi]
xor edi, edi
push edi
push edx
call fcn.0040f990
mov eax, dword [ebp + 0x68]
add esp, 0x18
push eax
lea ecx, [ebp + 4]
call fcn.00403530
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x41f8d0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.0040a8a0
push str._session
lea ecx, [esp + 0x18]
call fcn.0040a7a0
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp eax, 0xffffffff
mov dword [ebp + 0x88], ecx
je 0x40d45d
mov esi, dword [esp + 0x18]
inc eax
cmp esi, eax
jl 0x40d45d
cmp eax, edi
jg 0x40d3fb
cmp eax, esi
jle 0x40d3fb
xor eax, eax
jmp 0x40d403
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + eax*4 - 4]
push eax
lea ecx, [ebp + 0xb8]
call fcn.00404770
push str._subkey
lea ecx, [esp + 0x18]
call fcn.0040a7a0
cmp eax, 0xffffffff
je 0x40d4bd
inc eax
cmp esi, eax
jl 0x40d4bd
cmp eax, edi
jg 0x40d447
cmp eax, esi
jle 0x40d447
xor eax, eax
push eax
lea ecx, [ebp + 0xc8]
call fcn.00404770
jmp 0x40d4bd
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4 - 4]
push eax
lea ecx, [ebp + 0xc8]
call fcn.00404770
jmp 0x40d4bd
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.ole32.dll_CoCreateGuid]
movzx eax, byte [esp + 0x37]
movzx ecx, byte [esp + 0x36]
movzx edx, byte [esp + 0x35]
push eax
movzx eax, byte [esp + 0x38]
push ecx
movzx ecx, byte [esp + 0x3b]
push edx
movzx edx, byte [esp + 0x3e]
push eax
movzx eax, byte [esp + 0x41]
push ecx
movzx ecx, byte [esp + 0x44]
push edx
movzx edx, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
lea edx, [ebp + 0xb8]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push edx
call fcn.00404580
add esp, 0x34
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], str.ProcID
call int.0040b710
mov ecx, 4
mov edi, eax
mov esi, 0x420054
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40d55e
mov eax, dword [ebp + 0x9c]
mov edx, dword [eax - 4]
lea esi, [ebp + 0x9c]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, 0x105
or ecx, edx
jge 0x40d517
push 0x105
mov ecx, esi
call fcn.00403730
mov eax, dword [esi]
push 0x104
push eax
lea ecx, [esp + 0x40]
call fcn.0040ac20
mov edx, dword [esi]
test edx, edx
jne 0x40d532
xor edi, edi
jmp 0x40d544
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d537
sub eax, edi
mov edi, eax
js 0x40d549
cmp edi, dword [edx - 8]
jle 0x40d553
push 0x80070057
call fcn.004033d0
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
push 3
push 0x41fab0
lea ecx, [ebp + 0xb0]
call fcn.00403f20
mov eax, dword [ebx]
mov esi, dword [eax - 0xc]
push 0x5c
push eax
call fcn.00414e94
add esp, 8
test eax, eax
jne 0x40d589
or eax, 0xffffffff
jmp 0x40d58b
sub eax, dword [ebx]
sub esi, eax
dec esi
push esi
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.0040b9d0
push eax
lea ecx, [ebp + 0xac]
call fcn.00404470
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d5c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, ebp
call fcn.0040b380
mov esi, eax
test esi, esi
lea ecx, [ebp + 0xb4]
jne 0x40d5dc
xor edx, edx
jmp 0x40d5ea
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40d5e1
sub edx, edi
push edx
push esi
call fcn.00403f20
mov eax, dword [ebx]
lea ecx, [esp + 0x20]
push ecx
push eax
mov dword [esp + 0x28], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x40d682
push esi
call fcn.00414579
mov edx, dword [esp + 0x24]
mov ebx, dword [ebx]
add esp, 4
mov edi, eax
push edi
push esi
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40d679
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x41f424
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d679
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
lea ecx, [ebp + 0xa8]
push str._d._d._d._d
push ecx
call fcn.00404580
add esp, 0x18
push edi
call fcn.0041404d
add esp, 4
mov ecx, ebp
call fcn.0040ce30
push 3
push 0x41fab0
lea ecx, [ebp + 0xa4]
call fcn.00403f20
mov eax, dword [esp + 0x1c]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x40d6ae
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x3c]
xor ecx, esp
mov eax, 1
call fcn.004145af
add esp, 0x40
ret