Function at 0x1004193c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x89c
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0xe
mov dword [ebp - 0x878], ecx
lea edi, [ebp - 0x248]
pop ecx
push 0x208
push eax
mov dword [ebp - 0x874], eax
mov esi, 0x1000862c
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x880], eax
lea eax, [ebp - 0x210]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x894], edx
mov dword [ebp - 0x870], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x878]
add esp, 0xc
test eax, eax
je 0x100420c2
test ebx, ebx
je 0x100420c2
cmp ebx, 0xffffffff
je 0x100420c2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100419ef
push 3
pop ebx
xor esi, esi
jmp 0x100420cb
mov ebx, dword [ebp - 0x878]
xor eax, eax
mov edi, eax
mov esi, eax
cmp edi, 0x10
jae 0x10041a46
push ebx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.10015ac7
push dword [edi + 0x1000149c]
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.1001a5bc
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov esi, eax
add edi, 4
test esi, esi
je 0x100419fb
mov ebx, dword [ebp - 0x870]
test esi, esi
jne 0x10041a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100420c5
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x88c], edi
test edi, edi
jne 0x10041a80
push 0xe
jmp 0x100419e7
mov edx, 0x100058a8
mov ecx, ebx
call fcn.10040001
test eax, eax
je 0x10041a50
push edi
push esi
push dword [ebp - 0x874]
lea eax, [ebp - 0x210]
push eax
push 3
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x10041a50
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x884]
push eax
push 0x10008664
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10041a50
xor eax, eax
mov esi, 0x208
push esi
push eax
mov dword [ebp - 0x868], eax
mov byte [ebp - 0x861], al
mov dword [ebp - 0x870], eax
lea eax, [ebp - 0x450]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x860]
push esi
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x658]
push 0x208
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.1004111e
cmp eax, 0xffff
je 0x100420be
push eax
push 0x10004540
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x10008698
push ebx
call fcn.100401de
mov ecx, dword [ebp - 0x884]
push 0x100086a4
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.1001fec9
add esp, 0x18
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
cmp dword [ebp - 0x86c], esi
je 0x10041bc7
push dword [ebp - 0x86c]
push 0x100086bc
push ebx
call fcn.100401de
mov dword [ebp - 0x86c], esi
push 0x100036b4
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.1001fec9
add esp, 0xc
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x86c]
test eax, eax
je 0x10041c14
movzx esi, word [eax + 0x12]
mov dword [ebp - 0x87c], esi
xor esi, esi
jmp 0x10041c1e
mov dword [ebp - 0x87c], 6
lea eax, [ebp - 0x861]
push eax
push esi
push 1
push 0x12
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
test eax, eax
js 0x100420b9
xor eax, eax
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x894]
test eax, eax
je 0x10041c65
cmp word [eax], si
je 0x10041c65
mov edi, 0x104
lea ecx, [ebp - 0x450]
push eax
mov edx, edi
call fcn.10015ac7
jmp 0x10041c78
lea eax, [ebp - 0x450]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [ebp - 0x450], 0
je 0x10041c9a
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10041c9a
and al, 0x11
cmp al, 0x10
je 0x10041cae
lea eax, [ebp - 0x210]
mov edx, edi
push eax
lea ecx, [ebp - 0x450]
call fcn.10015ac7
push 0x100086d4
mov edx, edi
lea ecx, [ebp - 0x658]
call fcn.10015ac7
mov edi, dword [ebp - 0x878]
test eax, eax
js 0x10041d93
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x868]
push eax
push ecx
lea eax, [ebp - 0x860]
push eax
push ecx
lea eax, [ebp - 0x658]
mov ecx, edi
push eax
lea edx, [ebp - 0x450]
call fcn.1004143f
test eax, eax
je 0x10041d93
push ecx
mov ecx, dword [ebp - 0x868]
lea edx, [ebp - 0x210]
call fcn.10040f92
test eax, eax
je 0x10041d29
lea eax, [ebp - 0x210]
push eax
push 0x100086e8
push ebx
call fcn.100401de
push ecx
mov ecx, dword [ebp - 0x868]
lea edx, [ebp - 0x210]
call fcn.10041058
test eax, eax
je 0x10041d51
lea eax, [ebp - 0x210]
push eax
push 0x100086fc
push ebx
call fcn.100401de
mov ecx, dword [ebp - 0x868]
mov edx, ebx
call fcn.100402eb
mov esi, dword [ebp - 0x868]
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x870], 0
je 0x10041d93
lea eax, [ebp - 0x860]
push eax
lea edx, [ebp - 0x658]
lea ecx, [ebp - 0x450]
call fcn.10041852
push 0x10008720
mov edx, 0x104
lea ecx, [ebp - 0x658]
call fcn.10015ac7
test eax, eax
js 0x10041f10
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x868]
push eax
push ecx
lea eax, [ebp - 0x860]
push eax
push ecx
lea eax, [ebp - 0x658]
mov ecx, edi
push eax
lea edx, [ebp - 0x450]
call fcn.1004143f
test eax, eax
je 0x10041f10
push ecx
mov ecx, dword [ebp - 0x868]
lea edx, [ebp - 0x210]
call fcn.10040470
test eax, eax
je 0x10041e0b
lea eax, [ebp - 0x210]
push eax
push 0x10008730
push ebx
call fcn.100401de
push ecx
mov ecx, dword [ebp - 0x868]
lea edx, [ebp - 0x210]
call fcn.10040d32
test eax, eax
je 0x10041e33
lea eax, [ebp - 0x210]
push eax
push 0x10008738
push ebx
call fcn.100401de
push ecx
mov ecx, dword [ebp - 0x868]
lea edx, [ebp - 0x210]
call fcn.10040df8
test eax, eax
je 0x10041e5b
lea eax, [ebp - 0x210]
push eax
push 0x10008750
push ebx
call fcn.100401de
push ecx
mov ecx, dword [ebp - 0x868]
lea edx, [ebp - 0x210]
call fcn.1004061f
test eax, eax
je 0x10041eca
mov esi, 0x1000876c
mov ecx, ebx
mov edx, esi
call fcn.10040001
test eax, eax
je 0x10041eca
cmp dword [ebp - 0x87c], 6
lea eax, [ebp - 0x210]
push eax
jb 0x10041ea4
push ecx
push ecx
mov ecx, dword [ebp - 0x868]
mov edx, ebx
call fcn.10040acd
jmp 0x10041ec1
push 0x10008780
push ebx
call fcn.100401de
lea eax, [ebp - 0x210]
push eax
push 0x100083f4
push ebx
call fcn.100401de
mov edx, esi
mov ecx, ebx
call fcn.100400f0
mov ecx, dword [ebp - 0x868]
call fcn.10040ebe
mov esi, dword [ebp - 0x868]
push esi
mov dword [ebp - 0x888], eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x870], 0
je 0x10041f10
lea eax, [ebp - 0x860]
push eax
lea edx, [ebp - 0x658]
lea ecx, [ebp - 0x450]
call fcn.10041852
cmp byte [ebp - 0x861], 0
jne 0x10041f2c
lea eax, [ebp - 0x861]
push eax
xor eax, eax
push eax
push eax
push 0x12
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov esi, dword [ebp - 0x86c]
test esi, esi
je 0x10042048
mov edx, 0x10008794
mov ecx, ebx
call fcn.10040001
test eax, eax
je 0x10042048
movzx eax, word [esi + 0x12]
push eax
push 0x10004540
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x100087a4
push ebx
call fcn.100401de
movzx eax, word [esi + 0x10]
push eax
push 0x10004540
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x100087b0
push ebx
call fcn.100401de
movzx eax, word [esi + 0x16]
push eax
push 0x10004540
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x100087bc
push ebx
call fcn.100401de
movzx eax, word [esi + 0x14]
mov esi, 0x104
push eax
push 0x10004540
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x100087c8
push ebx
call fcn.100401de
push dword [ebp - 0x888]
lea eax, [ebp - 0x210]
push 0x10004540
push esi
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x100087d8
push ebx
call fcn.100401de
mov edx, 0x10008794
mov ecx, ebx
call fcn.100400f0
push 0x208
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1004209f
cmp word [ebp - 0x210], si
je 0x1004209f
cmp dword [ebp - 0x880], esi
je 0x1004209f
push dword [ebp - 0x880]
push 0x100087e8
push ebx
call fcn.100401de
mov edx, 0x100058a8
mov ecx, ebx
call fcn.100400f0
test eax, eax
jne 0x100420d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100420c7
push 5
pop ebx
jmp 0x100420cb
push 0xb
jmp 0x100420bb
push 0x57
pop ebx
xor esi, esi
test ebx, ebx
je 0x100420d6
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100420d6
mov ebx, esi
mov eax, dword [ebp - 0x88c]
test eax, eax
je 0x100420ef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 8