Function at 0x40c179
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42f080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
test eax, eax
je 0x40c1aa
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
mov eax, 0x208
push eax
lea esi, [ebx + 0x78]
push eax
call fcn.0040812c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.0040802e
mov edi, 0x104
lea esi, [ebx + 0x84]
push edi
call fcn.0040812c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.0040802e
push str.RavDown
push esi
call fcn.00407a5c
push str.Rising.dat
push dword [esi]
lea eax, [ebx + 0x7c]
push str._s_s
call fcn.00407c2d
mov ecx, dword [esi]
add esp, 0xc
call fcn.0040ea5e
mov esi, dword [ebx + 0x68]
xor edi, edi
cmp esi, edi
je 0x40c227
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40c227
mov dword [ebx + 0x54], esi
jmp 0x40c22a
mov dword [ebx + 0x54], edi
lea esi, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.CCommandLine.0
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call fcn.0040b23e
mov eax, str._session
mov edi, esi
call fcn.0040b17e
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebx + 0x88], ecx
cmp eax, 0xffffffff
je 0x40c2bd
inc eax
cmp dword [ebp - 0x34], eax
jl 0x40c2bd
mov esi, dword [ebp - 0x30]
test eax, eax
jg 0x40c274
cmp eax, dword [ebp - 0x34]
jle 0x40c274
xor eax, eax
jmp 0x40c278
mov eax, dword [esi + eax*4 - 4]
push eax
lea eax, [ebx + 0xb8]
push eax
call fcn.00407f6c
mov eax, str._subkey
lea edi, [ebp - 0x38]
call fcn.0040b17e
cmp eax, 0xffffffff
je 0x40c30f
inc eax
cmp dword [ebp - 0x34], eax
jl 0x40c30f
test eax, eax
jg 0x40c2aa
cmp eax, dword [ebp - 0x34]
jle 0x40c2aa
xor eax, eax
jmp 0x40c2ae
mov eax, dword [esi + eax*4 - 4]
push eax
lea eax, [ebx + 0xc8]
push eax
call fcn.00407f6c
jmp 0x40c30f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
lea eax, [ebx + 0xb8]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
call fcn.00407c2d
add esp, 0x30
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], str.ProcID
call fcn.00401768
push 4
mov edi, eax
pop ecx
mov esi, 0x4283dc
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x40c355
push 0x104
lea esi, [ebx + 0x9c]
push 0x105
call fcn.0040812c
push eax
lea eax, [ebp - 0x28]
call fcn.004017fc
call fcn.0040802e
push 0x42b180
lea eax, [ebx + 0xb0]
push eax
call fcn.00407f6c
lea esi, [ebx + 0x78]
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
push 0x5c
push eax
call fcn.004136b9
pop ecx
pop ecx
test eax, eax
jne 0x40c381
or eax, 0xffffffff
jmp 0x40c383
sub eax, dword [esi]
mov ecx, edi
sub ecx, eax
lea eax, [ebp - 0x2c]
push eax
dec ecx
mov eax, esi
call fcn.0040d762
lea edi, [ebx + 0xac]
call fcn.00407a1b
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.00408191
push 0x42abba
lea edi, [ebx + 0xb4]
push edi
call fcn.00407f6c
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40c3ce
call fcn.0040ccfb
push eax
push edi
call fcn.00407f6c
mov eax, dword [esi]
and dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x3c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x40c453
push edi
call fcn.00412242
mov esi, dword [esi]
pop ecx
push eax
push edi
push dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40c44a
and dword [ebp - 0x40], 0
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x42ac40
push dword [ebp - 0x2c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40c44a
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
lea eax, [ebx + 0xa8]
call fcn.00407c2d
add esp, 0x14
push dword [ebp - 0x2c]
call fcn.00411d81
pop ecx
push ebx
call fcn.0040cd89
push 0x42b180
lea eax, [ebx + 0xa4]
push eax
call fcn.00407f6c
mov edi, ebx
call fcn.0040d440
lea ecx, [ebp - 0x38]
call fcn.0040afe4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.00411d8c
leave
ret