Function at 0x437010
Capabilities:
Get file version info
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d168b
mov eax, dword fs:[0]
push eax
sub esp, 0x1fc
mov eax, dword [0x5080f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], 2
mov byte [ebp - 0x38], al
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 3
call fcn.0040f7b0
mov ecx, dword [esi + 0x10]
mov edx, eax
cmp ecx, 4
jb 0x437218
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4370a9
mov eax, dword [esi]
push edx
add ecx, 0xfffffffc
mov edx, str..sys
push 4
push 4
push 4
lea ecx, [eax + ecx*2]
call fcn.00438e50
add esp, 0x10
test eax, eax
jne 0x437218
push ecx
call fcn.0042f060
add esp, 4
test al, al
je 0x4370eb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
test byte [eax + 3], 0x40
jne 0x43796f
mov dword [ebp - 0x1ec], 0
push 3
xor eax, eax
mov dword [ebp - 0x1dc], 0
push 0x4ebb6c
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1d8], 7
mov word [ebp - 0x1ec], ax
mov byte [ebp - 4], 3
call fcn.004123e0
mov dword [ebp - 0x1d4], 0
push 3
xor eax, eax
mov dword [ebp - 0x1c4], 0
push 0x4e9670
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x1c0], 7
mov word [ebp - 0x1d4], ax
mov byte [ebp - 4], 5
call fcn.004123e0
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 7
call fcn.004362b0
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 8
push ecx
lea ecx, [ebp - 0x1d4]
mov edx, eax
push ecx
lea ecx, [ebp - 0x208]
call fcn.004366d0
mov edi, eax
add esp, 8
lea eax, [ebp - 0x30]
cmp eax, edi
je 0x4371d0
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x20], xmm0
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
nop word [eax + eax]
lea ecx, [ebp - 0x208]
call fcn.004127e0
lea ecx, [ebp - 0x19c]
call fcn.004127e0
lea ecx, [ebp - 0x1d4]
call fcn.004127e0
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 3
call fcn.004127e0
sub esp, 8
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.00436850
add esp, 8
test al, al
je 0x437998
cmp dword [ebp - 0x20], 0
lea edi, [ebp - 0x30]
cmove edi, esi
mov dword [ebp - 0x1a4], edi
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x437232
mov eax, dword [edi]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x4379b9
push esi
mov dword [ebp - 0x18], 0
call fcn.00485139
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0xb
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x43726a
mov eax, dword [edi]
push ecx
push esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x437293
mov ecx, edi
call fcn.00412590
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.GetFileVersionInfoW__ls
jmp 0x4379ce
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x17c]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x18]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x4372ca
mov ecx, edi
call fcn.00412590
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.VerQueryValueW__ls
jmp 0x4379ce
mov ecx, dword [ebp - 0x1a0]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
shr eax, 2
mov dword [ebp - 0x14], eax
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 0x1a8], 1
test eax, eax
je 0x43731d
cmp eax, 0xcf6474
ja 0x4379eb
push eax
call fcn.004384c0
mov eax, dword [ebp - 0x14]
xor edi, edi
test eax, eax
je 0x437936
nop word [eax + eax]
lea ecx, [ebp - 0x178]
call fcn.00437b30
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x17c]
push 0x4ebd00
lea ecx, [eax + edi*4]
movzx eax, word [ecx]
mov word [ebp - 0x178], ax
movzx eax, word [ecx + 2]
mov word [ebp - 0x176], ax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x19c]
push ecx
push eax
lea ecx, [ebp - 0x184]
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x174]
cmp eax, esi
je 0x4373d0
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x164], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax + eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebd18
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x15c]
cmp eax, esi
je 0x437440
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x15c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x14c], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebd30
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x144]
cmp eax, esi
je 0x4374b0
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x144], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x134], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebd50
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x437520
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebd70
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x114]
cmp eax, esi
je 0x437590
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x114], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x104], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebd88
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0xfc]
cmp eax, esi
je 0x437600
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xfc], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xec], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebdac
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0xe4]
cmp eax, esi
je 0x437670
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xe4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xd4], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4ebdc8
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0xcc]
cmp eax, esi
je 0x4376e0
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xcc], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xbc], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push str.LegalTrademarks
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0xb4]
cmp eax, esi
je 0x437750
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xb4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xa4], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push str.Comments
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x9c]
cmp eax, esi
je 0x4377c0
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x9c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x8c], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push str.PrivateBuild
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x84]
cmp eax, esi
je 0x437830
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x84], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x74], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop word [eax + eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push str.SpecialBuild
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x6c]
cmp eax, esi
je 0x437894
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x6c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x5c], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x184]
push 0x4e9814
lea eax, [eax + edi*4]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00437a00
mov esi, eax
lea eax, [ebp - 0x54]
cmp eax, esi
je 0x437900
mov ecx, eax
call fcn.004127e0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x54], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x44], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0xc
nop dword [eax + eax]
lea ecx, [ebp - 0x19c]
call fcn.004127e0
mov ecx, dword [ebp - 0x1a0]
lea eax, [ebp - 0x178]
push eax
call fcn.004383e0
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0xb
call fcn.00437cc0
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x437330
lea ecx, [ebp - 0x18]
call fcn.0041d150
lea ecx, [ebp - 0x38]
call fcn.004383c0
lea ecx, [ebp - 0x30]
call fcn.004127e0
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484d55
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00412590
push eax
push str.Cannt_query_a_.sys_file_version_info_from_PPL_process__ls
lea ecx, [ebp - 0x1bc]
call fcn.00438690
push 0x5057bc
lea eax, [ebp - 0x1bc]
push eax
call fcn.004a0209
push str.Unable_to_make_a_.sys_copy
lea ecx, [ebp - 0x1bc]
call fcn.0043e080
push 0x5057bc
lea eax, [ebp - 0x1bc]
push eax
call fcn.004a0209
mov ecx, edi
call fcn.00412590
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.GetFileVersionInfoSizeW__ls
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0041bc90
push 0x5057bc
lea eax, [ebp - 0x1bc]
push eax
call fcn.004a0209
call fcn.0040cf60
int3