Function at 0x413c70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b88b
mov eax, dword fs:[0]
push eax
sub esp, 0x54c
mov eax, dword [0x60c9c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
xor edi, edi
push 0xc6
mov ebx, ecx
lea edx, [ebp - 0xfe]
xor ecx, ecx
push edi
push edx
mov dword [ebp - 0x558], edi
mov dword [ebp - 0x548], edi
xor esi, esi
mov dword [ebp - 0x54c], edi
mov dword [ebp - 0x540], 1
mov dword [ebp - 0x544], edi
mov dword [ebp - 0x51c], edi
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x530], edi
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x520], eax
mov word [ebp - 0x38], ax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov dword [ebp - 0x554], edi
mov dword [ebp - 0x538], edi
mov dword [ebp - 0x550], edi
mov word [ebp - 0x100], cx
call fcn.00531fb0
push 0x206
lea ecx, [ebp - 0x506]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x508], ax
call fcn.00531fb0
push 0x1fe
lea eax, [ebp - 0x2fe]
xor edx, edx
push edi
push eax
mov word [ebp - 0x300], dx
call fcn.00531fb0
add esp, 0x24
push 0x55c8ac
lea ecx, [ebp - 0x534]
call fcn.00405b90
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x53c], edi
call fcn.004088a0
test eax, eax
je 0x413de4
mov eax, dword [ebp - 0x534]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413dda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x4140f8
lea ecx, [ebp - 0x53c]
push ecx
lea edx, [ebp - 0x534]
push edx
mov ecx, ebx
call fcn.00411c50
test eax, eax
mov eax, dword [ebp - 0x534]
je 0x413db7
cmp dword [eax - 0xc], edi
je 0x4140d7
mov edx, dword [ebx + 0x264]
mov edx, dword [edx + 0x10]
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x538]
push ecx
add ebx, 0x264
push str.TargetFileName
push str._target_file_startup_info_
mov ecx, ebx
call edx
test eax, eax
je 0x413e71
mov eax, dword [ebp - 0x538]
cmp dword [eax], edi
jle 0x413e63
mov eax, dword [eax + 0x310]
push eax
lea ecx, [ebp - 0x100]
push 0x64
push ecx
call fcn.00532f33
mov eax, dword [ebp - 0x538]
add esp, 0xc
cmp eax, edi
je 0x413e71
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x14]
mov ecx, ebx
call eax
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x538]
push ecx
push 0x55f88c
push str._target_file_startup_info_
mov ecx, ebx
call edx
test eax, eax
je 0x413ecf
mov eax, dword [ebp - 0x538]
cmp dword [eax], edi
jle 0x413ec1
mov eax, dword [eax + 0x310]
push eax
lea ecx, [ebp - 0x300]
push 0x100
push ecx
call fcn.00532f33
mov eax, dword [ebp - 0x538]
add esp, 0xc
cmp eax, edi
je 0x413ecf
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x14]
mov ecx, ebx
call eax
cmp word [ebp - 0x100], di
je 0x4140d1
cmp word [ebp - 0x300], di
je 0x4140d1
lea ecx, [ebp - 0x100]
push ecx
lea ecx, [ebp - 0x534]
call fcn.00405390
push eax
push 0x55d250
lea edx, [ebp - 0x508]
push 0x104
push edx
call fcn.00533b0b
add esp, 0x14
lea eax, [ebp - 0x54c]
push eax
lea ecx, [ebp - 0x508]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x53c], eax
cmp eax, edi
je 0x413f76
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
je 0x413f76
mov edx, dword [ebp - 0x53c]
mov eax, dword [ebp - 0x54c]
push ebx
push edx
push eax
lea ecx, [ebp - 0x508]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x413f86
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x534]
call fcn.00402e70
jmp 0x4140f6
lea edx, [ebp - 0x558]
push edx
lea eax, [ebp - 0x554]
push eax
push 0x55f888
push ebx
call sub.VERSION.dll_VerQueryValueW
push ebx
push edi
test eax, eax
je 0x413f69
mov eax, dword [ebp - 0x554]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov dword [ebp - 0x51c], ecx
movzx ecx, word [eax + 0xe]
mov dword [ebp - 0x518], edx
movzx edx, word [eax + 0xc]
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x510], edx
mov dword [ebp - 0x50c], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x413ff0
movzx eax, word [ebp + esi*2 - 0x300]
xor ecx, ecx
cmp eax, 0x2e
sete cl
xor edx, edx
cmp ax, di
sete dl
or ecx, edx
je 0x414054
mov ebx, dword [ebp - 0x548]
push esi
lea eax, [ebp + ebx*2 - 0x300]
push eax
lea ecx, [ebp - 0x38]
push 0x14
push ecx
call fcn.00533b6b
lea edx, [ebp - 0x38]
push edx
call fcn.00533b60
mov ecx, dword [ebp - 0x544]
mov dword [ebp + ecx*4 - 0x530], eax
lea eax, [ebx + esi + 1]
add esp, 0x14
xor esi, esi
inc ecx
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], ecx
jmp 0x414055
inc esi
cmp dword [ebp - 0x544], 4
jb 0x413ff0
mov dword [ebp - 0x520], edi
xor eax, eax
jmp 0x414070
mov ecx, dword [ebp + eax - 0x51c]
mov edx, dword [ebp + eax - 0x530]
cmp ecx, edx
ja 0x41409f
jb 0x4140bc
add eax, 4
cmp eax, 0x10
jl 0x414070
lea ecx, [ebp - 0x534]
call fcn.00402e70
mov eax, dword [ebp - 0x540]
jmp 0x4140f8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x540], 1
call fcn.00402e70
mov eax, dword [ebp - 0x540]
jmp 0x4140f8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x540], edi
call fcn.00402e70
mov eax, edi
jmp 0x4140f8
mov eax, dword [ebp - 0x534]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4140f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret