Function at 0x44d160
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x648cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov byte [esp + 0x16], 0
mov dword [esp + 0x18], 0xfad7
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], esi
mov word [esp + 0x38], ax
mov dword [esp + 0x6c], esi
call fcn.004492b0
test eax, eax
je 0x44d1dd
mov eax, dword [0x75dc58]
cmp eax, esi
jne 0x44d1cb
mov eax, 0x75dc5c
push esi
push eax
push str._sidmvs.dll
lea ecx, [esp + 0x40]
call fcn.004021a0
jmp 0x44d1eb
push str.idmvs.dll
lea ecx, [esp + 0x38]
call fcn.004017e0
mov eax, dword [esp + 0x34]
mov bl, 1
cmp eax, esi
jne 0x44d1f9
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44d256
lea ecx, [esp + 0x1c]
call fcn.0052fdb0
mov byte [esp + 0x6c], 1
mov eax, dword [esp + 0x34]
mov byte [esp + 0x17], 0
cmp eax, esi
jne 0x44d224
lea eax, [esp + 0x38]
lea ecx, [esp + 0x17]
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00531ab0
test al, al
je 0x44d240
cmp byte [esp + 0x17], 0
jne 0x44d240
xor bl, bl
mov byte [esp + 0x6c], 0
lea ecx, [esp + 0x1c]
call fcn.0052fdc0
test bl, bl
je 0x44d454
mov eax, dword [esp + 0x34]
cmp eax, esi
jne 0x44d262
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x44d5fe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetVBuild
push edi
call esi
push str.GetVDate
push edi
mov dword [esp + 0x30], eax
call esi
push str.GetVersion1
push edi
mov ebx, eax
call esi
push str.GetVersion2
push edi
mov ebp, eax
call esi
push str.GetFullVersion
push edi
mov dword [esp + 0x24], eax
call esi
push str.GetChrExtV
push edi
mov dword [esp + 0x38], eax
call esi
push str.GetMzCCV
push edi
mov dword [esp + 0x2c], eax
call esi
push str.GetMzCCExtV
push edi
mov dword [esp + 0x28], eax
call esi
push str.GetLKFFAV
push edi
mov dword [esp + 0x34], eax
call esi
push str.GetBaseBuild
push edi
call esi
mov esi, eax
test esi, esi
je 0x44d446
mov eax, dword [esp + 0x28]
test eax, eax
je 0x44d446
test ebx, ebx
je 0x44d446
test ebp, ebp
je 0x44d446
cmp dword [esp + 0x1c], 0
je 0x44d446
cmp dword [esp + 0x30], 0
je 0x44d446
cmp dword [esp + 0x24], 0
je 0x44d446
cmp dword [esp + 0x20], 0
je 0x44d446
cmp dword [esp + 0x2c], 0
je 0x44d446
call eax
mov dword [esp + 0x18], eax
call esi
mov ecx, 0xfad7
cmp dword [esp + 0x18], ecx
jb 0x44d442
cmp eax, ecx
jne 0x44d43c
call ebx
push eax
mov ecx, 0x75dd94
call fcn.0054f750
call ebp
push eax
mov ecx, 0x75dda0
call fcn.0054f750
call dword [esp + 0x1c]
push eax
mov ecx, 0x75dda8
call fcn.0054f750
mov ebx, dword [0x75dda8]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44d395
sub eax, edx
cmp eax, 7
ja 0x44d3f3
mov eax, ebx
xor esi, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44d3b0
sub eax, edx
je 0x44d402
jmp 0x44d3c0
push esi
mov ecx, 0x75dda8
call fcn.00404050
movzx edx, al
push edx
call fcn.00622cf5
add esp, 4
test eax, eax
je 0x44d3f3
mov eax, dword [0x75dda8]
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44d3e4
sub eax, edx
cmp esi, eax
jb 0x44d3c0
jmp 0x44d402
push str.642b15
mov ecx, 0x75dda8
call fcn.0054f750
call dword [esp + 0x30]
push eax
mov ecx, 0x75dd9c
call fcn.0054f750
call dword [esp + 0x20]
mov dword [0x75db9c], eax
call dword [esp + 0x2c]
mov dword [0x75db98], eax
call dword [esp + 0x24]
push eax
mov ecx, 0x75ddb0
call fcn.0054f750
mov byte [esp + 0x16], 1
mov ecx, 0xfad7
cmp dword [esp + 0x18], ecx
jae 0x44d446
mov dword [esp + 0x18], ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [esp + 0x16], 0
jne 0x44d4bd
push 8
push str.07_16_24
mov ecx, 0x75dd94
call fcn.00402950
push 0x1d
push str._6.42_Build_15__Jul_16_2024_
mov ecx, 0x75dd9c
call fcn.00402950
push 8
push str.v6.42b15
mov ecx, 0x75dda0
call fcn.00402950
push 6
push str.642b15
mov ecx, 0x75dda8
call fcn.00402950
push 7
push str.6.42.12
mov ecx, 0x75ddb0
mov dword [0x75db9c], 0xf43e
mov dword [0x75db98], 0x11da0
call fcn.00402950
push 0x75dda0
mov ecx, 0x75dd98
call fcn.00405900
mov eax, dword [0x75dda8]
push eax
push str.v_s
push 0x75dda4
call fcn.00402f60
mov cl, 0x7b
mov byte [esp + 0x4f], cl
mov byte [esp + 0x54], cl
mov cl, 0x6e
mov al, 0x61
mov dl, 0x60
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5e], cl
mov byte [esp + 0x60], cl
mov bl, 0x6a
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0x50], 0x21
mov byte [esp + 0x51], 0x66
mov byte [esp + 0x52], al
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], 0x7d
mov byte [esp + 0x56], al
mov byte [esp + 0x57], bl
mov byte [esp + 0x59], 0x6b
mov byte [esp + 0x5a], dl
mov byte [esp + 0x5b], 0x78
mov byte [esp + 0x5c], al
mov byte [esp + 0x5d], 0x63
mov byte [esp + 0x5e], dl
mov byte [esp + 0x60], 0x6b
mov byte [esp + 0x61], 0x62
mov byte [esp + 0x63], al
mov byte [esp + 0x65], 0x68
mov byte [esp + 0x66], bl
mov byte [esp + 0x67], 0x7d
mov byte [esp + 0x68], 0x21
mov byte [esp + 0x69], 0x6c
mov byte [esp + 0x6a], dl
mov byte [esp + 0x6b], 0x62
mov byte [esp + 0x6c], 0
call fcn.00453b70
mov edx, dword [0x75dda8]
push edx
lea eax, [esp + 0x54]
push eax
push str.https:__www_s_contact_us.html_v_s
push 0x75ddac
call fcn.00402f60
mov ecx, dword [0x75dda8]
push ecx
lea edx, [esp + 0x64]
push edx
push str.https:__secure_s_subscription.html_v_s
push 0x75ddb4
call fcn.00402f60
mov eax, dword [0x75dda8]
push eax
lea ecx, [esp + 0x74]
push ecx
push str.https:__www_s_uptateidm.cgi_v_s
push 0x75ddb8
call fcn.00402f60
add esp, 0x40
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00401210
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00620b8d
add esp, 0x5c
ret
push esi
push 0x683684
push str.IDM_cannot_find_a_file_that_is_necessary_for_browser_and_system_integration._Please_reinstall_IDM
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44d454