Function at 0x494920
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [esi], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [edi], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x4949a9
push eax
call fcn.00498b00
pop ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 4], eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49499b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5e4df4
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49499b
cmp dword [ebp - 0xc], ebx
je 0x49499b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], ebx
je 0x4949a9
push dword [ebp - 4]

Function at 0x4949e5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x5948dd
call fcn.00593620
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x619864
mov dword [ebp - 0x10], edi
call fcn.0042fe84
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.0049a380
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00432279
push esi
call fcn.0047fba0
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x494b40
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.0049a380
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x494b99
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x494c4f
mov eax, dword [ebp - 0x94]
dec eax
je 0x494c3b
dec eax
jne 0x494c4f
mov eax, dword [ebp - 0xa0]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x494be8
cmp dword [ebp - 0x9c], edx
jne 0x494bd2
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x494c37
cmp dword [ebp - 0x9c], edi
jne 0x494c20
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x494c37
cmp eax, 5
jne 0x494c12
cmp dword [ebp - 0x9c], 2
jne 0x494bf9
push eax
jmp 0x494c19
cmp dword [ebp - 0x9c], 1
jne 0x494c06
mov edi, ecx
jmp 0x494c4f
cmp dword [ebp - 0x9c], edi
jne 0x494c4f
push 3
jmp 0x494c19
cmp eax, 4
ja 0x494c1c
push 4
pop edi
jmp 0x494c4f
cmp eax, ecx
jb 0x494c4f
cmp dword [ebp - 0x9c], 2
jae 0x494c2d
cmp eax, ecx
jbe 0x494c4f
cmp byte [ebp + 0x76], dl
jne 0x494c4f
call fcn.00494a68
mov edi, eax
jmp 0x494c4f
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret