Function at 0x42fbe0
Capabilities:
Contain obfuscated stackstrings
Get file version info

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x16c
mov edi, dword [ebp + 8]
mov dword [esp + 4], 0
mov eax, dword [edi]
mov dword [esp], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
sub esp, 8
test eax, eax
jne 0x42fcb0
call fcn.0042c430
mov esi, eax
lea ebx, [ebp - 0x114]
mov edi, 0x6e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x11c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Get_file_version_info_size_failed__error_id_is__lu
mov dword [esp + 0xc], 0x1a0
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x114], 0x46746547
mov dword [ebp - 0x110], 0x56656c69
mov dword [ebp - 0x10c], 0x69737265
mov word [ebp - 0x108], di
mov dword [ebp - 0x118], 0xe
mov byte [ebp - 0x106], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x42fca0
mov dword [esp], eax
call fcn.004ed8c0
lea esp, [ebp - 0xc]
xor edi, edi
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov dword [esp], eax
call fcn.004ed8e0
mov esi, eax
mov eax, ebx
sub eax, 1
js 0x42fce5
lea eax, [ebx - 2]
mov dword [esp + 4], 0
mov dword [esp], esi
cmp eax, 0xffffffff
mov eax, 1
cmovge eax, ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004327e0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi]
mov dword [esp], eax
call sub.VERSION.dll_GetFileVersionInfoA
sub esp, 0x10
test eax, eax
mov edi, eax
jne 0x42fdd4
call fcn.0042c430
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x11c]
lea ebx, [ebp - 0x114]
mov ecx, 0x6e6f
mov dword [esp + 0x10], str.Get_file_version_info_failed__error_id_is__lu
mov dword [esp + 0xc], 0x1ac
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x114], 0x46746547
mov dword [ebp - 0x110], 0x56656c69
mov dword [ebp - 0x10c], 0x69737265
mov word [ebp - 0x108], cx
mov dword [ebp - 0x118], 0xe
mov byte [ebp - 0x106], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x42fdc2
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], esi
call fcn.004ed8b0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x144]
mov dword [esp + 4], str.VarFileInfoTranslation
mov dword [esp], esi
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x140]
mov dword [esp + 8], eax
call sub.VERSION.dll_VerQueryValueA
sub esp, 0x10
test eax, eax
mov edi, eax
je 0x430010
lea edi, [ebp - 0x11c]
xor eax, eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x144]
shr eax, 2
test eax, eax
je 0x42ff70
shl eax, 2
xor ebx, ebx
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x140]
add eax, ebx
movzx edx, word [eax + 2]
mov dword [esp + 0x10], edx
movzx eax, word [eax]
mov dword [esp + 8], str.StringFileInfo_04x_04xFILEVERSION
mov dword [esp + 4], 0x103
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call fcn.0044c2c0
test eax, eax
js 0x4300b5
lea eax, [ebp - 0x13c]
mov dword [esp], esi
mov dword [ebp - 0x138], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x138]
mov dword [esp + 8], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
call sub.VERSION.dll_VerQueryValueA
sub esp, 0x10
cmp eax, 1
mov edi, eax
je 0x430140
call fcn.0042c430
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x134]
lea edi, [ebp - 0x12c]
mov ecx, 0x6e6f
mov dword [esp + 0x10], str.Query_version_value_failed__error_id_is__lu
mov dword [esp + 0xc], 0x1c9
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x12c], 0x46746547
mov dword [ebp - 0x128], 0x56656c69
mov dword [ebp - 0x124], 0x69737265
mov word [ebp - 0x120], cx
mov dword [ebp - 0x130], 0xe
mov byte [ebp - 0x11e], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x134]
cmp eax, edi
je 0x4300a1
mov dword [esp], eax
add ebx, 4
call fcn.004ed8c0
cmp ebx, dword [ebp - 0x150]
jne 0x42fe44
call fcn.0042c430
lea edx, [ebp - 0x134]
lea edi, [ebp - 0x12c]
mov ecx, 0x6e6f
mov dword [esp + 0x10], str.Failed
mov dword [esp + 0xc], 0x1cd
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x12c], 0x46746547
mov dword [ebp - 0x128], 0x56656c69
mov dword [ebp - 0x124], 0x69737265
mov word [ebp - 0x120], cx
mov dword [ebp - 0x130], 0xe
mov byte [ebp - 0x11e], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x134]
cmp eax, edi
je 0x42fff8
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], esi
xor edi, edi
call fcn.004ed8b0
jmp 0x42fdca
call fcn.0042c430
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x11c]
lea ebx, [ebp - 0x114]
mov ecx, 0x6e6f
mov dword [esp + 0x10], str.Query_version_value_failed__error_id_is__lu
mov dword [esp + 0xc], 0x1b5
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x114], 0x46746547
mov dword [ebp - 0x110], 0x56656c69
mov dword [ebp - 0x10c], 0x69737265
mov word [ebp - 0x108], cx
mov dword [ebp - 0x118], 0xe
mov byte [ebp - 0x106], 0
call fcn.0042ce70
jmp 0x42fdb0
add ebx, 4
cmp ebx, dword [ebp - 0x150]
jne 0x42fe44
jmp 0x42ff70
call fcn.0042c430
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x134]
lea edi, [ebp - 0x12c]
mov ecx, 0x6e6f
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.String_cchprintf_failed__error_id_is__lu
mov dword [esp + 0xc], 0x1bf
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], ebx
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x12c], 0x46746547
mov dword [ebp - 0x128], 0x56656c69
mov dword [ebp - 0x124], 0x69737265
mov word [ebp - 0x120], cx
mov dword [ebp - 0x130], 0xe
mov byte [ebp - 0x11e], 0
call fcn.0042ce70
jmp 0x42ffe6
mov ebx, dword [ebp + 0xc]
mov eax, 0x7fffffff
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
sub eax, dword [ebx + 4]
cmp edx, eax
ja 0x4301ce
mov dword [esp], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], edx
call fcn.004cde40
sub esp, 8
jmp 0x42fdc2
mov ebx, eax
mov eax, dword [ebp - 0x134]
cmp eax, edi
je 0x430186
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], esi
call fcn.004ed8b0
mov dword [esp], ebx
call fcn.0043f8d0
mov edx, dword [ebp - 0x11c]
mov esi, eax
cmp edx, ebx
je 0x4301aa
mov dword [esp], edx
call fcn.004ed8c0
mov dword [esp], esi
call fcn.0043f8d0
mov ebx, eax
jmp 0x430186
mov dword [esp], 0x4fe011
call fcn.004e7d10
jmp 0x430172