Function at 0x440330
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d75d6
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x50f52c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], eax
jne 0x4403a7
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x20], 8
jb 0x440398
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp + 0x20], 7
mov dword [ebp + 0x1c], eax
jmp 0x440712
cmp dword [ebp + 0x20], 8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
jae 0x4403b6
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x44]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x440678
push eax
call fcn.0048b89e
add esp, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x440617
mov edx, dword [ebp - 0x3c]
push edx
push 0
push eax
call fcn.004b32f0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp + 0x20], 8
jae 0x440401
lea eax, [ebp + 0xc]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
push ecx
push edx
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4405ea
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
push ecx
push 0x4e3448
push edx
mov dword [ebp - 0x40], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4405bd
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4405bd
movzx ecx, word [eax + 0xa]
mov dword [edi], ecx
movzx edx, word [eax + 8]
mov dword [ebx], edx
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp - 0x34]
mov dword [edx], ecx
movzx eax, word [eax + 0xc]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
push str._d._d._d._d
lea ecx, [ebp - 0x140]
call fcn.00440220
mov byte [ebp - 4], 2
push edi
push eax
call fcn.0043f780
push ebx
push eax
call fcn.0043f780
mov edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0043f780
mov ecx, dword [ebp - 0x30]
push ecx
push eax
call fcn.0043f780
push eax
lea edx, [ebp - 0x60]
push edx
call fcn.00438d90
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.00408c10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00490320
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
call fcn.0043f210
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x4404e0
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
jmp 0x4404e6
add esi, 4
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0x20], edi
jb 0x4404f3
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x30], ecx
jmp 0x4404f9
lea edx, [ebp + 0xc]
mov dword [ebp - 0x30], edx
push str._s_version:__s
lea ecx, [ebp - 0x140]
call fcn.00440220
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.0043f860
lea edx, [ebp - 0x34]
push edx
push eax
call fcn.0043f860
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00438d90
mov bl, 6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x140]
call fcn.0043f210
push str.ANTIVIRUSACTION
lea ecx, [ebp - 0x60]
call fcn.004019e0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], edi
jae 0x440557
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004019e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.00419d40
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c]
call fcn.00490320
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
call fcn.00490320
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00490320
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004b382b
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00490320
mov eax, 1
jmp 0x440718
push str.ANTIVIRUSACTION
lea ecx, [ebp - 0x2c]
call fcn.004019e0
mov bl, 9
mov byte [ebp - 4], bl
push str.VerQueryValue_error
lea ecx, [ebp - 0x60]
call fcn.004019e0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x60]
push edx
jmp 0x440642
push str.ANTIVIRUSACTION
lea ecx, [ebp - 0x2c]
call fcn.004019e0
mov bl, 0xb
mov byte [ebp - 4], bl
push str.GetFileVersionInfo_error
lea ecx, [ebp - 0x60]
call fcn.004019e0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x60]
push ecx
jmp 0x440642
push str.ANTIVIRUSACTION
lea ecx, [ebp - 0x2c]
call fcn.004019e0
mov bl, 0xd
mov byte [ebp - 4], bl
push str.Mem_alloc_error
lea ecx, [ebp - 0x60]
call fcn.004019e0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x60]
push eax
call fcn.00419d40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
call fcn.00490320
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00490320
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004b382b
add esp, 4
xor edi, edi
lea ebx, [edi + 8]
lea esi, [edi + 7]
jmp 0x4406f4
push str.ANTIVIRUSACTION
lea ecx, [ebp - 0x2c]
call fcn.004019e0
mov bl, 0xf
mov byte [ebp - 4], bl
push str.GetFileVersion_error
lea ecx, [ebp - 0x7c]
call fcn.004019e0
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x7c]
push eax
call fcn.00419d40
mov byte [ebp - 4], bl
mov ebx, 8
cmp dword [ebp - 0x64], ebx
jb 0x4406c1
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov esi, 7
xor edi, edi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x68], edi
mov word [ebp - 0x78], dx
mov byte [ebp - 4], dl
cmp dword [ebp - 0x14], ebx
jb 0x4406e8
mov eax, dword [ebp - 0x28]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], cx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x20], ebx
jb 0x44070c
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x1c], edi
xor eax, eax
mov word [ebp + 0xc], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3057
mov esp, ebp
pop ebp
ret 0x30