Function at 0x401110
Capabilities:
Check os version
Delete file
Get common file path
Get file version info
Move file
Persist via run registry key

Disassembly:
sub esp, 0xa50
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
mov edi, 0x4110b0
push 0x104
xor ebx, ebx
push 0x4110b0
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dl, byte [eax + 0x4110b0]
lea ecx, [eax + 0x4110b0]
cmp dl, 0x5c
je 0x40115d
mov edx, eax
dec eax
test edx, edx
jle 0x40115d
mov byte [ecx], bl
mov dl, byte [ecx - 1]
dec ecx
cmp dl, 0x5c
jne 0x40114b
mov edi, dword [esp + 0xa68]
mov esi, str.setup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40118f
cmp cl, bl
je 0x40118b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40118f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40116b
xor eax, eax
jmp 0x401194
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4011d5
call fcn.00402160
call fcn.00401f10
call fcn.004028c0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4110b0
call fcn.00402910
add esp, 4
call fcn.00403c60
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xa50
ret 0x10
mov esi, 0x40e504
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401200
cmp cl, bl
je 0x4011fc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401200
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4011dc
xor eax, eax
jmp 0x401205
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40124e
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push 0x4110b0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push str._sQvodPlayer.exe
push eax
call fcn.00404394
lea ecx, [esp + 0x138]
push ecx
call fcn.00401f40
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.maxthon
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401279
cmp cl, bl
je 0x401275
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401279
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401255
xor eax, eax
jmp 0x40127e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40140e
push str.SoftwareMaxthon2_
push 0x80000001
lea ecx, [esp + 0x64c]
call fcn.00403dc0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x438]
push 0x103
rep stosd dword es:[edi], eax
lea eax, [esp + 0x43c]
lea ecx, [esp + 0x648]
push eax
push str.Folder
push 0x4110ac
call fcn.00403e00
test eax, eax
je 0x4013f4
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x438]
push ecx
push str._sSharedAccountConfigMxSpeedDialSpeedDial.ini
push edx
call fcn.00404394
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
call fcn.00401000
push str.http:__caipiao.qvod.com
push 0x40e47c
push 0x40e478
lea ecx, [esp + 0x18]
call fcn.004010e0
push 0x40e460
push str.title
push 0x40e478
lea ecx, [esp + 0x18]
call fcn.004010e0
push 0x40e478
push str.picture_name
push 0x40e478
lea ecx, [esp + 0x18]
call fcn.004010e0
push str.http:__caipiao.qvod.com
push str.UrlUserInput
push 0x40e478
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x438]
push ecx
push str._sSharedAccountConfigMxSpeedDialThumbnailPic6.bmp
push edx
call fcn.00404394
add esp, 0xc
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
rep stosd dword es:[edi], eax
push 0x4110b0
lea eax, [esp + 0x338]
push str._sPic6.bmp
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x28]
lea eax, [esp + 0x334]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0xc], 0x40b188
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4013f4
push eax
call fcn.004042b4
add esp, 4
lea ecx, [esp + 0x644]
call fcn.00403df0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xa50
ret 0x10
mov esi, 0x40e3f0
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401439
cmp cl, bl
je 0x401435
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401439
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401415
xor eax, eax
jmp 0x40143e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401479
call fcn.00402160
push 1
call fcn.00402430
add esp, 4
call fcn.00402620
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004028c0
call fcn.00402ca0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.resetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4014a4
cmp cl, bl
je 0x4014a0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4014a4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401480
xor eax, eax
jmp 0x4014a9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4014f1
call fcn.00402160
push 1
call fcn.00402430
add esp, 4
call fcn.00402620
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004028c0
push 0x4110b0
call fcn.00402910
add esp, 4
call fcn.00402ca0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.nbsetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40151c
cmp cl, bl
je 0x401518
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40151c
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4014f8
xor eax, eax
jmp 0x401521
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40156b
call fcn.00402620
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 1
call fcn.00402430
add esp, 4
call fcn.004028c0
push 0x3e8
call esi
push 0x4110b0
call fcn.00402910
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.nbrun
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401596
cmp cl, bl
je 0x401592
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401596
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401572
xor eax, eax
jmp 0x40159b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4015b8
push ebx
push 1
call fcn.00402670
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.setupdate
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4015e3
cmp cl, bl
je 0x4015df
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4015e3
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4015bf
xor eax, eax
jmp 0x4015e8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4015ff
call fcn.004021d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.Google
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40162a
cmp cl, bl
je 0x401626
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40162a
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401606
xor eax, eax
jmp 0x40162f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401762
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
push 0x4110b0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sgtapi_signed.dll
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov esi, 1
cmp edi, ebx
mov dword [esp + 0x14], ebx
je 0x40169a
push str.ToolbarCompatibilityCheck
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x401693
lea edx, [esp + 0x14]
push edx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push 0x40e390
push eax
call fcn.00404394
mov edi, str.google.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4110b0
mov esi, edi
mov edx, ecx
mov edi, 0x4110b0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00401000
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push str.check
push str.GOOGLE
call fcn.004010e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x40e390
push edx
call fcn.00404394
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push str.checkerr
push str.GOOGLE
call fcn.004010e0
mov dword [esp + 0xc], 0x40b188
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x401efa
jmp 0x401ef1
mov esi, str.WriteIni
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40178d
cmp cl, bl
je 0x401789
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40178d
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401769
xor eax, eax
jmp 0x401792
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401a68
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push 0x4110b0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push str._sqvod1.ini
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
lea ecx, [esp + 0x644]
call fcn.00403d80
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
lea edx, [esp + 0x12c]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.Insertpath
push str.Insert
lea ecx, [esp + 0x654]
call fcn.00403e00
test eax, eax
je 0x40182e
cmp byte [esp + 0x12c], bl
je 0x40182e
lea eax, [esp + 0x12c]
push eax
jmp 0x4018b9
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x94
push ecx
mov esi, 5
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40184e
mov esi, dword [esp + 0x2c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x12c]
lea edx, [esp + 0x438]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, 6
mov byte [esp + 0x43b], bl
jl 0x401894
lea eax, [esp + 0x438]
lea ecx, [esp + 0x12c]
push eax
push str._sQvodPlayer
push ecx
jmp 0x4018a9
lea edx, [esp + 0x438]
lea eax, [esp + 0x12c]
push edx
push str._sProgram_FilesQvodPlayer
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x12c]
push ecx
push str.State
push str.Field_3
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
lea edx, [esp + 0x12c]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x654]
call fcn.00403e00
cmp eax, ebx
jne 0x40194e
push str.SoftwareQvodPlayer_
push 0x80000002
lea ecx, [esp + 0x440]
call fcn.00403dc0
lea eax, [esp + 0x12c]
push 0x208
push eax
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x448]
call fcn.00403e00
lea ecx, [esp + 0x438]
mov esi, eax
call fcn.00403df0
cmp esi, ebx
je 0x401961
cmp byte [esp + 0x12c], bl
je 0x401961
lea ecx, [esp + 0x12c]
push ecx
jmp 0x4019c1
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
lea edx, [esp + 0x334]
rep stosd dword es:[edi], eax
push edx
call fcn.00403b20
add esp, 4
test eax, eax
je 0x4019bc
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x438]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x334]
lea ecx, [esp + 0x438]
push eax
push str._sMedia_
push ecx
call fcn.00404394
add esp, 0xc
lea edx, [esp + 0x438]
push edx
jmp 0x4019c1
push str.C:Media_
push str.State
push str.Field_4
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push 0x4110ac
rep stosd dword es:[edi], eax
push 0x80000001
lea ecx, [esp + 0x858]
call fcn.00403dc0
lea eax, [esp + 0x12c]
push 0x208
push eax
push str.QvodPlayer
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x860]
call fcn.00403e00
push 0x40e270
push str.State
push str.Field_8
lea ecx, [esp + 0x18]
test eax, eax
call fcn.004010e0
lea ecx, [esp + 0x850]
call fcn.00403df0
lea ecx, [esp + 0x644]
call fcn.00403df0
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40b188
cmp eax, ebx
je 0x401efa
jmp 0x401ef1
mov esi, str.Updateini
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401a93
cmp cl, bl
je 0x401a8f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401a93
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401a6f
xor eax, eax
jmp 0x401a98
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401b94
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push 0x4110b0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push str._sQvodCfg.ini
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
lea ecx, [esp + 0x644]
call fcn.00403d80
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push ebx
rep stosd dword es:[edi], eax
push str.Update
push str.Option
lea ecx, [esp + 0x650]
call fcn.00403f00
mov esi, eax
cmp esi, 2
jle 0x401b2e
push ebx
push str.Update
push str.Option
lea ecx, [esp + 0x650]
xor esi, esi
call fcn.00403fc0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push esi
lea edx, [esp + 0x130]
push 0x40e390
rep stosd dword es:[edi], eax
push edx
call fcn.00404394
add esp, 0xc
lea eax, [esp + 0x12c]
lea ecx, [esp + 0xc]
push eax
push str.update
push str.QVODTERMINAL
call fcn.004010e0
lea ecx, [esp + 0x644]
call fcn.00403df0
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40b188
cmp eax, ebx
je 0x401efa
jmp 0x401ef1
mov esi, str.space
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401bbf
cmp cl, bl
je 0x401bbb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401bbf
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401b9b
xor eax, eax
jmp 0x401bc4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401bf6
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x334]
push eax
call fcn.00403b20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xa50
ret 0x10
mov esi, str.writett
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401c21
cmp cl, bl
je 0x401c1d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401c21
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401bfd
xor eax, eax
jmp 0x401c26
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401d40
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push 0x4110b0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push str._stt.ini
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
push str.SoftwareTENCENTTTraveler
push 0x80000001
lea ecx, [esp + 0x858]
call fcn.00403dc0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
push 0x104
push edx
rep stosd dword es:[edi], eax
push 0x40e1f0
push 0x4110ac
lea ecx, [esp + 0x860]
call fcn.00403e00
test eax, eax
je 0x401d1b
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x28]
lea edx, [esp + ecx + 0x28]
cmp al, 0x5c
je 0x401cdb
mov eax, ecx
dec ecx
test eax, eax
jle 0x401cdb
mov byte [edx], bl
mov al, byte [edx - 1]
dec edx
cmp al, 0x5c
jne 0x401cca
mov byte [edx], bl
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
dec edx
repne scasb al, byte es:[edi]
mov al, byte [edx]
not ecx
dec ecx
cmp al, 0x5c
je 0x401d03
mov eax, ecx
dec ecx
test eax, eax
jle 0x401d03
mov byte [edx], bl
mov al, byte [edx - 1]
dec edx
cmp al, 0x5c
jne 0x401cf2
lea ecx, [esp + 0x28]
push ecx
push str.path
push 0x40e1e4
lea ecx, [esp + 0x18]
call fcn.004010e0
lea ecx, [esp + 0x850]
call fcn.00403df0
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40b188
cmp eax, ebx
je 0x401efa
jmp 0x401ef1
mov esi, str.qvodv
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401d6b
cmp cl, bl
je 0x401d67
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401d6b
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401d47
xor eax, eax
jmp 0x401d70
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401efa
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x438]
push 0x4110b0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x43c]
push str._sqvod3_u.ini
push eax
call fcn.00404394
add esp, 0xc
lea ecx, [esp + 0x438]
push ecx
lea ecx, [esp + 0x24]
call fcn.00401000
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x12c]
push 0x4110b0
lea edx, [esp + 0x130]
push str._sQvodTerminal.exe
rep stosd dword es:[edi], eax
push edx
call fcn.00404394
lea eax, [esp + 0x138]
push ebx
push eax
call fcn.00404350
add esp, 0x14
cmp eax, 0xffffffff
je 0x401ee1
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x12c]
push ecx
push edx
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.004042bf
add esp, 4
mov esi, eax
lea eax, [esp + 0x12c]
push esi
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401ee1
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
xor edx, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x33c]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.00404394
add esp, 0x10
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
lea eax, [esp + 0x334]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401ee1
mov ecx, dword [esp + 0x14]
push 0x40e170
push ecx
call fcn.004042d0
mov edx, dword [esp + 0x1c]
push 0x40e16c
push edx
mov esi, eax
call fcn.004042d0
add esp, 0x10
cmp esi, ebx
jne 0x401ec9
cmp eax, ebx
je 0x401ee1
push 0x40e270
push str.State
push str.Field_1
lea ecx, [esp + 0x2c]
call fcn.004010e0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], 0x40b188
cmp eax, ebx
je 0x401efa
push eax
call fcn.004042b4
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xa50
ret 0x10