Function at 0x101281a0
Capabilities:
Check if file exists
Get common file path
Get file version info
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10196400
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2f0], edi
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], 7
mov word [ebp - 0x2c8], ax
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 4
call fcn.1012c3e0
lea ecx, [ebp - 0x2dc]
call fcn.101083b0
push 7
push str.UNKNOWN
lea ecx, [ebp - 0x234]
call fcn.10001d60
mov eax, dword [ebp - 0x2dc]
add eax, 0xfffffffc
cmp eax, 6
ja case.0x10128290.7
jmp dword [eax*4 + 0x10128e10]
push 0xa
push str.Windows_10
jmp 0x10128382
mov eax, dword [ebp - 0x2d8]
cmp eax, 3
jne 0x101282ba
push 0xb
push str.Windows_8.1
jmp 0x10128382
cmp eax, 2
jne 0x101282d4
push str.Windows_8
lea ecx, [ebp - 0x234]
call fcn.10001c70
jmp 0x1012838d
cmp eax, 1
jne 0x101282ee
push str.Windows_7
lea ecx, [ebp - 0x234]
call fcn.10001c70
jmp 0x1012838d
test eax, eax
jne 0x1012838d
push str.Windows_Vista
lea ecx, [ebp - 0x234]
call fcn.10001c70
jmp 0x1012838d
mov eax, dword [ebp - 0x2d8]
cmp eax, 2
je 0x10128331
cmp eax, 1
je 0x10128331
test eax, eax
jne 0x1012838d
push str.Windows_2000
lea ecx, [ebp - 0x234]
call fcn.10001c70
jmp 0x1012838d
push 0xa
push str.Windows_XP
jmp 0x10128382
mov eax, dword [ebp - 0x2d8]
cmp eax, 0x5a
jne 0x1012834e
push 0xa
push str.Windows_ME
jmp 0x10128382
cmp eax, 0xa
jne 0x10128365
push str.Windows_98
lea ecx, [ebp - 0x234]
call fcn.10001c70
jmp 0x1012838d
test eax, eax
jne 0x1012838d
push str.Windows_95
lea ecx, [ebp - 0x234]
call fcn.10001c70
jmp 0x1012838d
push 7
push str.UNKNOWN
lea ecx, [ebp - 0x234]
call fcn.10001d60
lea edx, [ebp - 0x2b0]
lea ecx, [ebp - 0x2dc]
call fcn.10117a00
lea edx, [ebp - 0x2cc]
lea ecx, [ebp - 0x2ec]
call fcn.101081c0
mov edx, dword [ebp - 0x2ec]
lea ecx, [ebp - 0x308]
call fcn.1010f830
mov edx, dword [ebp - 0x2f4]
cmp edx, 8
jb 0x10128400
mov ecx, dword [ebp - 0x308]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x101283f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
xor eax, eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
lea edx, [ebp - 0x2cc]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x21c]
call fcn.101081c0
cmp dword [ebp - 0x2cc], 2
jne 0x1012845f
lea ecx, [ebp - 0x250]
call fcn.100fcd00
jmp 0x101284b4
push 0
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x101284b4
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10128480
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.10001d60
push 0x1b
push str.AdobeAdobe_Creative_Cloud
lea ecx, [ebp - 0x250]
call fcn.10001e70
push 0x16
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.ACCCreative_Cloud.exe
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
push 0
lea eax, [ebp - 0x2e8]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.100fd940
mov byte [ebp - 4], 6
add esp, 0xc
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x10128543
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128539
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128de0
push edx
push ecx
call fcn.1015cbd5
add esp, 8
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10128790
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.10002700
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x238]
xor bl, bl
mov dword [ebp - 0x238], 0
cmp dword [ebp - 0x2d4], 8
lea eax, [ebp - 0x2e8]
push ecx
cmovae eax, dword [ebp - 0x2e8]
push eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x2cc], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push 0x208
mov esi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10160450
add esp, 0xc
test esi, esi
je 0x10128695
push esi
call fcn.1015cbe3
add esp, 4
lea ecx, [ebp - 0x2e8]
cmp dword [ebp - 0x2d4], 8
mov edi, eax
cmovae ecx, dword [ebp - 0x2e8]
push edi
push esi
push dword [ebp - 0x238]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10128686
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0x101ace08
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10128686
cmp dword [ebp - 0x21c], 0
je 0x10128686
mov eax, dword [ebp - 0x2cc]
cmp dword [eax], 0xfeef04bd
jne 0x10128686
movzx esi, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
push ecx
push edx
push esi
push str._d._d._d._d
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100fc110
add esp, 0x1c
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x268]
push eax
call fcn.10001c70
mov bl, 1
push edi
call fcn.1015c886
mov edi, dword [ebp - 0x2f0]
add esp, 4
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x101286d9
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x101286cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128de5
push edx
push ecx
call fcn.1015cbd5
add esp, 8
test bl, bl
je 0x10128790
push 0xd
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.ACC_Version:
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
lea eax, [ebp - 0x2e8]
mov byte [ebp - 4], 9
push eax
lea ecx, [edi + 0xac]
call fcn.1001e770
lea ecx, [ebp - 0x268]
cmp eax, ecx
je 0x1012874c
cmp dword [ebp - 0x254], 8
push dword [ebp - 0x258]
cmovae ecx, dword [ebp - 0x268]
push ecx
mov ecx, eax
call fcn.10001d60
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x10128790
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128786
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128dea
push edx
push ecx
call fcn.1015cbd5
add esp, 8
push 0x4e
push 0x101dddb8
lea ecx, [edi + 0x94]
call fcn.10001d60
push 9
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.OS_Name:
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x2e8]
cmp dword [ebp - 0x220], 8
lea ebx, [edi + 0xac]
lea esi, [ebp - 0x234]
mov ecx, ebx
cmovae esi, dword [ebp - 0x234]
push eax
call fcn.1001e770
mov edx, esi
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10128802
sub edx, edi
mov ecx, eax
sar edx, 1
push edx
push esi
call fcn.10001d60
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x1012885e
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128854
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128def
push edx
push ecx
call fcn.1015cbd5
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.OS_Version:
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x2e8]
cmp dword [ebp - 0x29c], 8
lea esi, [ebp - 0x2b0]
push eax
cmovae esi, dword [ebp - 0x2b0]
mov ecx, ebx
call fcn.1001e770
mov edx, esi
lea edi, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x101288c0
sub edx, edi
mov ecx, eax
sar edx, 1
push edx
push esi
call fcn.10001d60
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x1012891c
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128912
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128df4
push edx
push ecx
call fcn.1015cbd5
add esp, 8
push 0xb
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.OS_Locale:
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x2e8]
cmp dword [ebp - 0x26c], 8
lea esi, [ebp - 0x280]
push eax
cmovae esi, dword [ebp - 0x280]
mov ecx, ebx
call fcn.1001e770
mov edx, esi
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10128976
sub edx, edi
mov ecx, eax
sar edx, 1
push edx
push esi
call fcn.10001d60
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x101289d2
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x101289c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128df9
push edx
push ecx
call fcn.1015cbd5
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.Bit:
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x308]
mov edx, dword [ebp - 0x2ec]
call fcn.1010f830
mov esi, eax
mov byte [ebp - 4], 0xe
cmp dword [esi + 0x14], 8
jb 0x10128a24
mov esi, dword [esi]
lea eax, [ebp - 0x2e8]
mov ecx, ebx
push eax
call fcn.1001e770
mov edx, esi
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10128a37
sub edx, edi
mov ecx, eax
sar edx, 1
push edx
push esi
call fcn.10001d60
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2f4]
cmp edx, 8
jb 0x10128a93
mov ecx, dword [ebp - 0x308]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128a89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128dfe
push edx
push ecx
call fcn.1015cbd5
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 7
mov word [ebp - 0x308], ax
cmp edx, 8
jb 0x10128af4
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128aea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128dfe
push edx
push ecx
call fcn.1015cbd5
add esp, 8
lea ecx, [ebp - 0x298]
call fcn.101085f0
push 0x12
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.OS_Build_Version:
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.10001d60
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x2e8]
cmp dword [ebp - 0x284], 8
lea esi, [ebp - 0x298]
push eax
cmovae esi, dword [ebp - 0x298]
mov ecx, ebx
call fcn.1001e770
mov edx, esi
lea edi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10128b60
sub edx, edi
mov ecx, eax
sar edx, 1
push edx
push esi
call fcn.10001d60
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2d4]
cmp edx, 8
jb 0x10128bbc
mov ecx, dword [ebp - 0x2e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128bb2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e03
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov ecx, dword [ebp - 0x2f0]
push 0x4e
push 0x101dddb8
add ecx, 0xb4
call fcn.10001d60
mov edx, dword [ebp - 0x254]
cmp edx, 8
jb 0x10128c14
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128c0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov edx, dword [ebp - 0x23c]
xor eax, eax
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
cmp edx, 8
jb 0x10128c71
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128c67
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov edx, dword [ebp - 0x284]
xor eax, eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
cmp edx, 8
jb 0x10128cce
mov ecx, dword [ebp - 0x298]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128cc4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov edx, dword [ebp - 0x26c]
cmp edx, 8
jb 0x10128d0e
mov ecx, dword [ebp - 0x280]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128d04
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov edx, dword [ebp - 0x220]
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
cmp edx, 8
jb 0x10128d6b
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128d61
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov edx, dword [ebp - 0x29c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
cmp edx, 8
jb 0x10128dc4
mov ecx, dword [ebp - 0x2b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10128dba
adc byte [eax], al
add byte [edx + 0x10], dh
adc byte [ebx - 0x3d7c03b7], cl
and ebp, dword [ebx]
rol dword [ebx - 0x77c0340], 0x1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10128e08
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
call fcn.101686f5
nop dword [eax]
cmp al, byte [ebx - 0x7cf4efee]
adc dl, byte [eax]
mov dword [0x7b101282], eax
adc dword [edx], 16
jnp 0x10128da5
adc dl, byte [eax]
jnp 0x10128da9
adc dl, byte [eax]
xchg edi, eax
adc byte [edx], 16
int3