Function at 0x40b4c0
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x40
mov eax, dword [str._u]
xor eax, esp
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov edx, dword [eax - 8]
lea ebx, [ebp + 0x78]
sub eax, 0x10
push esi
push edi
mov edi, dword [eax + 0xc]
mov ecx, 1
sub ecx, edi
sub edx, 0x208
or ecx, edx
jge 0x40b500
push 0x208
mov ecx, ebx
call fcn.00403690
mov eax, dword [ebx]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebx]
test edx, edx
jne 0x40b51a
xor esi, esi
jmp 0x40b52d
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b520
sub eax, esi
mov esi, eax
js 0x40b532
cmp esi, dword [edx - 8]
jle 0x40b53c
push 0x80070057
call fcn.00403340
mov ecx, dword [ebx]
mov dword [ecx - 0xc], esi
mov edx, dword [ebx]
mov byte [esi + edx], 0
mov eax, dword [ebp + 0x84]
mov edx, dword [eax - 4]
lea esi, [ebp + 0x84]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, 0x104
or ecx, edx
jge 0x40b579
push 0x104
mov ecx, esi
call fcn.00403690
mov eax, dword [esi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [esi]
test edx, edx
jne 0x40b591
xor edi, edi
jmp 0x40b5a3
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b596
sub eax, edi
mov edi, eax
js 0x40b5a8
cmp edi, dword [edx - 8]
jle 0x40b5b2
push 0x80070057
call fcn.00403340
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
push 7
push str.RavDown
mov ecx, esi
mov byte [edi + edx], 0
call fcn.00403dd0
mov eax, dword [esi]
push str.Rising.dat
push eax
lea ecx, [ebp + 0x7c]
push str._s_s
push ecx
call fcn.00404490
mov edx, dword [esi]
xor edi, edi
push edi
push edx
call fcn.0040db60
mov eax, dword [ebp + 0x68]
add esp, 0x18
push eax
lea ecx, [ebp + 4]
call fcn.004034a0
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x41d7f8
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.00408d60
push str._session
lea ecx, [esp + 0x18]
call fcn.00408c60
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp eax, 0xffffffff
mov dword [ebp + 0x88], ecx
je 0x40b6ad
mov esi, dword [esp + 0x18]
inc eax
cmp esi, eax
jl 0x40b6ad
cmp eax, edi
jg 0x40b64b
cmp eax, esi
jle 0x40b64b
xor eax, eax
jmp 0x40b653
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + eax*4 - 4]
push eax
lea ecx, [ebp + 0xb8]
call fcn.00404680
push str._subkey
lea ecx, [esp + 0x18]
call fcn.00408c60
cmp eax, 0xffffffff
je 0x40b70d
inc eax
cmp esi, eax
jl 0x40b70d
cmp eax, edi
jg 0x40b697
cmp eax, esi
jle 0x40b697
xor eax, eax
push eax
lea ecx, [ebp + 0xc8]
call fcn.00404680
jmp 0x40b70d
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4 - 4]
push eax
lea ecx, [ebp + 0xc8]
call fcn.00404680
jmp 0x40b70d
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.ole32.dll_CoCreateGuid]
movzx eax, byte [esp + 0x37]
movzx ecx, byte [esp + 0x36]
movzx edx, byte [esp + 0x35]
push eax
movzx eax, byte [esp + 0x38]
push ecx
movzx ecx, byte [esp + 0x3b]
push edx
movzx edx, byte [esp + 0x3e]
push eax
movzx eax, byte [esp + 0x41]
push ecx
movzx ecx, byte [esp + 0x44]
push edx
movzx edx, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
lea edx, [ebp + 0xb8]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push edx
call fcn.00404490
add esp, 0x34
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], str.ProcID
call fcn.00409b70
mov ecx, 4
mov edi, eax
mov esi, 0x41df0c
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40b7ae
mov eax, dword [ebp + 0x9c]
mov edx, dword [eax - 4]
lea esi, [ebp + 0x9c]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, 0x105
or ecx, edx
jge 0x40b767
push 0x105
mov ecx, esi
call fcn.00403690
mov eax, dword [esi]
push 0x104
push eax
lea ecx, [esp + 0x40]
call fcn.004090e0
mov edx, dword [esi]
test edx, edx
jne 0x40b782
xor edi, edi
jmp 0x40b794
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b787
sub eax, edi
mov edi, eax
js 0x40b799
cmp edi, dword [edx - 8]
jle 0x40b7a3
push 0x80070057
call fcn.00403340
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
push 3
push 0x41d960
lea ecx, [ebp + 0xb0]
call fcn.00403e60
mov eax, dword [ebx]
mov esi, dword [eax - 0xc]
push 0x5c
push eax
call fcn.00413064
add esp, 8
test eax, eax
jne 0x40b7d9
or eax, 0xffffffff
jmp 0x40b7db
sub eax, dword [ebx]
sub esi, eax
dec esi
push esi
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00409d80
push eax
lea ecx, [ebp + 0xac]
call fcn.004043b0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b815
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, ebp
call fcn.004097e0
mov esi, eax
test esi, esi
lea ecx, [ebp + 0xb4]
jne 0x40b82c
xor edx, edx
jmp 0x40b83a
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40b831
sub edx, edi
push edx
push esi
call fcn.00403e60
mov eax, dword [ebx]
lea ecx, [esp + 0x20]
push ecx
push eax
mov dword [esp + 0x28], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x40b8d2
push esi
call fcn.00412749
mov edx, dword [esp + 0x24]
mov ebx, dword [ebx]
add esp, 4
mov edi, eax
push edi
push esi
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b8c9
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x41d38c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b8c9
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
lea ecx, [ebp + 0xa8]
push str._d._d._d._d
push ecx
call fcn.00404490
add esp, 0x18
push edi
call fcn.0041221d
add esp, 4
mov ecx, ebp
call fcn.0040b080
push 3
push 0x41d960
lea ecx, [ebp + 0xa4]
call fcn.00403e60
mov eax, dword [esp + 0x1c]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x40b8fe
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x3c]
xor ecx, esp
mov eax, 1
call fcn.0041277f
add esp, 0x40
ret