Function at 0x4db5f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57753e
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
call fcn.0041f020
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__23]
call fcn.004eebf0
lea ecx, [ebp - 0x24]
test al, al
je 0x4db667
push str.Server
jmp 0x4db66c
push str.Client
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
lea eax, [ebp - 0x2c]
push eax
push str.Kernel32.dll
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4db891
inc eax
push eax
mov esi, dword [sym.imp.mfc140u.dll_operator_1]
call esi
mov ebx, eax
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x1c]
inc eax
push eax
call esi
add esp, 8
mov dword [ebp - 0x38], eax
test ebx, ebx
jne 0x4db6da
push 0x1f7
push str.c:DevjenkinsworkspaceiTools_for_IDMDeployer_V9.87_servermodbuscommandhandler.cpp
push 0x587798
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec040
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
jmp 0x4dbae0
test eax, eax
jne 0x4db70f
push ebx
call dword [sym.imp.mfc140u.dll_operator_2]
mov ebx, 0x8123
mov dword [ebp - 0x44], ebx
push 0x1fd
push str.c:DevjenkinsworkspaceiTools_for_IDMDeployer_V9.87_servermodbuscommandhandler.cpp
push 0x587798
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec040
add esp, 0x14
mov esi, dword [ebp - 0x1c]
inc esi
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push esi
push 0
push dword [ebp - 0x38]
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
push ebx
push dword [ebp - 0x1c]
push 0
push str.Kernel32.dll
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4db86c
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4db86c
lea esi, [edi + 0xdc]
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
xor ebx, ebx
mov dword [ebp - 0x54], ebx
cmp ebx, 2
jae 0x4db869
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x4db869
xor esi, esi
mov dword [ebp - 0x50], esi
cmp esi, 1
jae 0x4db85d
mov eax, dword [edi + 0xdc]
cmp dword [eax - 0xc], 0
jne 0x4db85d
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 3
mov eax, ebx
sub eax, 0
je 0x4db7db
sub eax, 1
jne 0x4db7db
mov eax, dword [ebp - 0x3c]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xProductVersion
jmp 0x4db7ef
mov eax, dword [ebp - 0x3c]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xFileVersion
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__31]
add esp, 0x10
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x44]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4db84a
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4db84a
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0xdc]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
inc esi
jmp 0x4db790
inc ebx
lea esi, [edi + 0xdc]
jmp 0x4db776
mov ebx, dword [ebp - 0x44]
push ebx
mov esi, dword [sym.imp.mfc140u.dll_operator_2]
call esi
mov eax, 0x8123
test ebx, ebx
cmovne ebx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0
push dword [ebp - 0x38]
call esi
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 0
jmp 0x4db8d9
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
push 1
lea eax, [edi + 0xb8]
push eax
lea ecx, [ebp - 0x30]
call fcn.004f6560
mov byte [ebp - 4], 6
cmp dword [edi + 0xb4], 0
je 0x4db98e
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 8
push 0x641d2c
lea ecx, [ebp - 0x38]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__30]
mov ebx, dword [ebp - 0x48]
or ebx, 1
mov dword [ebp - 0x48], ebx
push dword [ebp - 0x24]
push dword [edi + 0xdc]
push dword [ebp - 0x38]
push str.Host__s_is__s___s_
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__31]
add esp, 0x14
and ebx, 0xfffffffe
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x38]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
push dword [ebp - 0x18]
call dword [eax + 0x60]
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
push 0x5a15e0
call dword [eax + 0x60]
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 0x54]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004f6620
push 0x59fe70
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x38]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x12
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x28]
sub eax, 1
je 0x4db9f8
sub eax, 1
je 0x4db9f1
sub eax, 1
jne 0x4dba06
push str.TokenElevationTypeLimited___User_has_a_split_token__but_the_process_is_not_running_elevated.
jmp 0x4db9fd
push str.TokenElevationTypeFull___User_has_a_split_token__and_the_process_is_running_elevated.
jmp 0x4db9fd
push str.TokenElevationTypeDefault___User_is_not_using_a_split_token.
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4dba14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 9
jmp 0x4dba4f
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
push 1
lea eax, [edi + 0xb8]
push eax
lea ecx, [ebp - 0x30]
call fcn.004f6560
mov byte [ebp - 4], 0xc
cmp dword [edi + 0xb4], 0
je 0x4dbacd
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 0xd
push dword [ebp - 0x20]
push str.User_is_of_type__s
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__31]
add esp, 0xc
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
push dword [ebp - 0x18]
call dword [eax + 0x60]
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
push 0x5a15e0
call dword [eax + 0x60]
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 0x54]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x30]
call fcn.004f6620
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret