Function at 0x4143e9
Capabilities:
Get file version info
Read file on windows

Disassembly:
push 0x3b8
mov eax, 0x425299
call fcn.004231c0
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x384], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x374], eax
test esi, esi
je 0x414450
xor eax, eax
cmp ax, word [esi]
je 0x414450
push eax
push eax
push 3
push eax
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x384], edi
cmp edi, 0xffffffff
jne 0x414462
mov ecx, ebx
push 0x42b7cc
call fcn.0040655d
mov eax, ebx
call fcn.0042316a
ret
mov eax, dword [ebp - 0x374]
and dword [ebp - 0x398], 0
mov dword [eax], 1
and dword [ebp - 4], 0
call fcn.00401b0a
push eax
lea ecx, [ebp - 0x37c]
call fcn.00401564
mov dword [ebp - 4], 2
call fcn.00401b0a
push eax
lea ecx, [ebp - 0x368]
call fcn.00401564
push 0
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x36c], eax
test eax, eax
je 0x4146c1
push eax
call fcn.0042246a
pop ecx
push eax
push dword [ebp - 0x36c]
mov dword [ebp - 0x364], eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4146a1
and dword [ebp - 0x388], 0
lea eax, [ebp - 0x39c]
and dword [ebp - 0x39c], 0
push eax
lea eax, [ebp - 0x388]
push eax
push 0x42b7b4
push dword [ebp - 0x364]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x414541
mov ecx, dword [ebp - 0x388]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x37c]
push str._d._d._d._d
push eax
call fcn.0040731f
add esp, 0x18
and dword [ebp - 0x38c], 0
lea eax, [ebp - 0x370]
and dword [ebp - 0x370], 0
push eax
lea eax, [ebp - 0x38c]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x364]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
xor edx, edx
test dword [ebp - 0x370], 0xfffffffc
mov dword [ebp - 0x36c], edx
jbe 0x4146a1
mov ecx, dword [ebp - 0x38c]
xor eax, eax
mov word [ebp - 0x224], ax
movzx eax, word [ecx + edx*4 + 2]
push eax
movzx eax, word [ecx + edx*4]
push eax
push str.StringFileInfo_04x_04xLegalCopyright
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.00416dcf
and dword [ebp - 0x390], 0
lea eax, [ebp - 0x3a0]
and dword [ebp - 0x3a0], 0
add esp, 0x14
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x364]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x414665
push dword [ebp - 0x390]
mov ecx, dword [ebp - 0x394]
call fcn.004014c7
mov eax, dword [ebp - 0x394]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00406d2d
add eax, 0x10
mov dword [ebp - 0x360], eax
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 4
call fcn.004062ea
push 0
push str.microsoft
lea ecx, [ebp - 0x360]
call fcn.00406313
cmp eax, 0xffffffff
jne 0x414685
push 0
push str.tencent
lea ecx, [ebp - 0x360]
call fcn.00406313
cmp eax, 0xffffffff
jne 0x414685
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x360]
lea ecx, [ecx - 0x10]
call fcn.0040188c
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x370]
inc edx
shr eax, 2
mov dword [ebp - 0x36c], edx
cmp edx, eax
jb 0x414586
jmp 0x4146a1
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x360]
mov dword [ebp - 0x398], 1
lea ecx, [ecx - 0x10]
call fcn.0040188c
push dword [ebp - 0x364]
call fcn.004224a3
cmp dword [ebp - 0x398], 0
pop ecx
je 0x4146c1
mov eax, dword [ebp - 0x374]
and dword [eax], 0
jmp 0x4146db
mov edx, dword [ebp - 0x380]
mov ecx, esi
call fcn.00419a6a
mov ecx, dword [ebp - 0x374]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x378]
push 0
push eax
push 0x40
lea eax, [ebp - 0x264]
push eax
push edi
call esi
test eax, eax
je 0x4147d8
cmp dword [ebp - 0x378], 0x40
jne 0x4147d8
push 0
push 0
push dword [ebp - 0x228]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x378]
push eax
push 0xf8
lea eax, [ebp - 0x35c]
push eax
push edi
call esi
test eax, eax
je 0x4147d8
cmp dword [ebp - 0x378], 0xf8
jne 0x4147d8
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime32]
pop ecx
test eax, eax
je 0x4147bc
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x3b4]
push dword [ebp - 0x3c0]
inc eax
push dword [ebp - 0x3bc]
push dword [ebp - 0x3b8]
push eax
mov eax, dword [ebp - 0x3b0]
add eax, 0x76c
push eax
lea eax, [ebp - 0x368]
push str.__04d__02d__02d__02d:_02d:_02d_GMT
push eax
call fcn.0040731f
mov edi, dword [ebp - 0x384]
jmp 0x4147d5
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x368]
push str.__04d__02d__02d__02d:_02d:_02d_GMT
push eax
call fcn.0040731f
add esp, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x368]
mov ecx, ebx
push eax
lea edx, [ebp - 0x37c]
call fcn.004061a4
pop ecx
mov ecx, dword [ebp - 0x368]
lea ecx, [ecx - 0x10]
call fcn.0040188c
mov ecx, dword [ebp - 0x37c]
lea ecx, [ecx - 0x10]
call fcn.0040188c
jmp 0x41445a