Function at 0x41be70
Capabilities:
Check if file exists
Get file version info
Impersonate file version information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push edi
mov esi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41bea6
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c0]
push eax
push edi
mov byte [ebp - 0x289], 0
mov dword [ebp - 0x2c0], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x29c], eax
test eax, eax
je 0x41be94
push ebx
lea ebx, [eax + 0x400]
push ebx
call fcn.004ef56e
push ebx
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x290], eax
call fcn.00509940
mov ecx, dword [ebp - 0x290]
mov edx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x2c0]
add esp, 0x10
push ecx
push edx
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41c42c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x2d0], eax
cmp eax, ebx
je 0x41c42c
mov edi, dword [ebp - 0x290]
lea ecx, [ebp - 0x2cc]
push ecx
lea edx, [ebp - 0x2b8]
push edx
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c424
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x294], ebx
movzx ecx, word [eax]
movzx edx, word [eax + 2]
push 0x76
mov dword [ebp - 0x2b0], ecx
lea ecx, [ebp - 0x7a]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x2ac], edx
mov word [ebp - 0x7c], ax
call fcn.00509940
push 0x206
lea eax, [ebp - 0x282]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x284], dx
call fcn.00509940
add esp, 0x18
lea ecx, [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x288]
push edx
push 0x536fac
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c02c
movzx ecx, word [esi]
movzx edx, word [esi + 4]
mov eax, dword [ebp - 0x288]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 8], ecx
movzx ecx, word [esi + 8]
movzx edx, word [esi + 0xc]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 0xc], ecx
movzx ecx, word [esi]
movzx edx, word [esi + 4]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 0x10], ecx
movzx ecx, word [esi + 8]
movzx edx, word [esi + 0xc]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 0x14], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
push str._d._d._d._d
lea ecx, [ebp - 0x284]
push 0x103
push ecx
call fcn.0050690b
mov edx, dword [ebp - 0x2ac]
mov esi, dword [ebp - 0x2b0]
push edx
push esi
lea eax, [ebp - 0x7c]
push str.StringFileInfo_04x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2c
lea ecx, [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x2a4], ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c3a7
mov edi, dword [ebp - 0x288]
cmp word [edi], bx
jne 0x41c0b2
add edi, 2
mov dword [ebp - 0x288], edi
movzx eax, word [edi]
add edi, eax
mov dword [ebp - 0x288], edi
cmp word [edi], bx
jne 0x41c0cb
add edi, 2
mov dword [ebp - 0x288], edi
lea esi, [edi + 6]
mov dword [ebp - 0x2b4], edi
mov ecx, esi
mov eax, 0x53b0c8
jmp 0x41c0e0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c106
cmp dx, bx
je 0x41c102
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c106
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x41c0e0
xor eax, eax
jmp 0x41c10b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x41c149
mov ecx, esi
mov eax, 0x53b0e0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c13c
cmp dx, bx
je 0x41c138
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c13c
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x41c116
xor eax, eax
jmp 0x41c141
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41c379
mov ecx, dword [ebp - 0x2ac]
mov edx, dword [ebp - 0x2b0]
push esi
push ecx
push edx
lea eax, [ebp - 0x7c]
push str.StringFileInfo_04x_04x_s
push eax
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x294], ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x294]
push ecx
mov ecx, dword [ebp - 0x290]
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x7c]
push eax
push ecx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c373
lea eax, [ebp - 0x284]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41c1a6
sub eax, edx
sar eax, 1
lea ebx, [eax + 1]
mov edi, ebx
and edi, 0x80000001
jns 0x41c1c7
dec edi
or edi, 0xfffffffe
inc edi
mov eax, dword [ebp - 0x294]
neg edi
sbb edi, edi
neg edi
mov edx, eax
and edx, 1
mov esi, edi
sub esi, edx
sub esi, eax
add esi, ebx
cmp eax, ebx
je 0x41c33e
mov edx, dword [ebp - 0x290]
xor eax, eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
push 0x536fac
push edx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c291
mov edx, dword [ebp - 0x290]
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
push 0x53b138
push edx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c291
mov eax, dword [ebp - 0x2a0]
lea ecx, [esi + esi]
mov esi, dword [ebp - 0x290]
add word [esi], cx
add eax, 0x34
mov dword [ebp - 0x2a0], eax
cmp word [eax], 0
jne 0x41c274
add eax, 2
mov dword [ebp - 0x2a0], eax
add word [eax], cx
mov eax, dword [ebp - 0x2a8]
cmp word [eax], 0
jne 0x41c28c
add eax, 2
mov dword [ebp - 0x2a8], eax
add word [eax], cx
jmp 0x41c297
mov esi, dword [ebp - 0x290]
mov eax, dword [ebp - 0x294]
mov ecx, eax
and ecx, 1
add ecx, eax
add ecx, ecx
sub esi, ecx
sub esi, dword [ebp - 0x298]
add esi, dword [ebp - 0x29c]
push esi
call fcn.004ef56e
mov ecx, dword [ebp - 0x294]
mov edx, ecx
and edx, 1
add edx, ecx
mov ecx, dword [ebp - 0x298]
push esi
lea edx, [ecx + edx*2]
push edx
push eax
mov dword [ebp - 0x2c8], eax
call fcn.00509040
mov ecx, dword [ebp - 0x298]
push esi
mov esi, dword [ebp - 0x2c8]
lea eax, [edi + ebx]
lea edx, [ecx + eax*2]
push esi
push edx
call fcn.00509040
mov eax, dword [ebp - 0x294]
mov ecx, eax
and ecx, 1
mov edx, edi
sub edx, ecx
mov ecx, dword [ebp - 0x29c]
sub edx, eax
add edx, ebx
lea edx, [ecx + edx*2]
mov ecx, ebx
sub ecx, eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x29c], edx
add ecx, ecx
add word [eax], cx
mov edx, ebx
sub edx, dword [ebp - 0x294]
push esi
add word [eax + 2], dx
call fcn.004ad85d
add esp, 0x20
mov eax, dword [ebp - 0x298]
add edi, ebx
add edi, edi
push edi
push 0
push eax
call fcn.00509940
mov edx, dword [ebp - 0x298]
add esp, 0xc
lea ecx, [ebp - 0x284]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x41c360
xor ebx, ebx
mov edi, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2b4]
movzx eax, word [ecx]
mov edx, eax
sub edx, dword [ebp - 0x290]
add edx, ecx
mov ecx, dword [ebp - 0x29c]
dec ecx
cmp edx, ecx
jb 0x41c0b5
mov edi, dword [ebp - 0x290]
mov esi, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x2ac]
push edx
push esi
lea eax, [ebp - 0x7c]
push str.StringFileInfo_04x_04xProductVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x2cc]
push ecx
lea edx, [ebp - 0x2b8]
push edx
push str.VarFileInfoTranslation
push edi
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x2a4], ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x41c3f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x29c]
push eax
push edi
push esi
mov esi, dword [ebp - 0x2d0]
push 1
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x41c432
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
je 0x41c432
mov byte [ebp - 0x289], 1
jmp 0x41c432
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41c432
mov edi, dword [ebp - 0x290]
cmp edi, ebx
pop ebx
je 0x41c440
push edi
call fcn.00506929
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x289]
pop edi
xor ecx, ebp
pop esi
call fcn.00503edf
mov esp, ebp
pop ebp
ret