Function at 0x44f060
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ede36
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5315d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
lea eax, [ebp - 0x218]
push 0x208
push esi
push eax
mov dword [ebp - 0x228], esi
call fcn.00471c10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], eax
mov eax, dword [0x5348b4]
test al, 1
jne 0x44f108
or eax, 1
mov dword [0x5348b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x4f2a20
mov dword [0x5348a8], 0x4f58f0
mov dword [0x5348ac], eax
mov byte [0x5348b0], 0
call fcn.004658b4
mov eax, dword [0x5348b4]
add esp, 4
test al, 2
jne 0x44f15c
or eax, 2
mov dword [0x5348b8], 0x4f5908
mov dword [0x5348b4], eax
xor eax, eax
push 0x4f2a50
mov dword [0x5348bc], 0x5348a8
mov dword [0x5348cc], 2
mov dword [0x5348c4], esi
mov dword [0x5348c8], esi
mov dword [0x5348d0], eax
mov dword [0x5348c0], 0x5348b8
call fcn.004658b4
add esp, 4
mov eax, dword [0x5348b8]
mov ecx, 0x5348b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x44f197
movzx eax, ax
push eax
call fcn.0041d980
jmp 0x44f19d
push eax
call fcn.00424a50
mov eax, dword [ebp - 0x21c]
mov edx, 1
mov dword [ebp - 4], 1
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x44f1d5
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.00405250
mov eax, dword [ebp - 0x21c]
push str._system32Shell32.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x21c]
push dword [eax - 8]
push eax
call fcn.0048e1ba
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x44f318
mov eax, dword [ebp - 0x21c]
cmp ecx, dword [eax - 8]
jg 0x44f318
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x224], edx
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x22c]
mov eax, dword [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x220], eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x44f2d5
push ebx
call fcn.0048ee73
mov edi, eax
add esp, 4
test edi, edi
je 0x44f2d5
push edi
push ebx
push 0
push dword [ebp - 0x220]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44f2a7
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x4f5b40
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44f2a7
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], 1
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x228], eax
jmp 0x44f2a9
xor ebx, ebx
push edi
call fcn.0048ee56
add esp, 4
cmp dword [ebp - 0x224], 0
je 0x44f2d5
cmp ebx, 0x60002
jb 0x44f2d5
cmp dword [ebp - 0x228], 0x295a01c8
mov eax, 1
cmovae esi, eax
mov edi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x44f2fa
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004654a8
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00404290
int3