Function at 0x140001bd4
Capabilities:
Check if file exists
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
and dword [rbp + 0x77], 0
mov rsi, rdx
lea rdx, [rbp + 0x77]
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140001ca2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140001c81
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001c81
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140001c81
mov dword [rbp + 0x7f], eax
lea rdx, [0x140008cbe]
lea rax, [0x140008568]
mov dword [rbp - 0x19], 0x18
mov qword [rbp + 0x17], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x140001c8f
mov ebx, 0x8000ffff
jmp 0x140001eb9
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140001eb9
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp + 7], rax
test rax, rax
jne 0x140001d46
cmp dword [section..data], 2
mov ebx, 0x8007000e
jbe 0x140001eb9
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001eb9
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140001eb9
lea rcx, [rbp - 0x15]
mov dword [rbp - 0x15], ebx
mov qword [rsp + 0x30], rcx
lea rax, [0x140008568]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x1b
mov qword [rsp + 0x28], rcx
lea rdx, [0x140008c6e]
lea rcx, [rbp + 0x1f]
mov qword [rbp + 0x1f], rax
mov qword [rsp + 0x20], rcx
call fcn.140001008
jmp 0x140001eb9
mov r9, rax
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x140001ddd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140001e79
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001e79
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140001e79
mov dword [rbp - 0xd], eax
lea rdx, [0x140008cbe]
lea rax, [0x140008568]
mov dword [rbp - 9], 0x22
mov qword [rbp + 0x27], rax
lea rax, [rbp - 0xd]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x27]
jmp 0x140001e6f
mov rcx, qword [rbp + 7]
lea r9, [rbp + 0xf]
lea r8, [rbp + 0x37]
lea rdx, [0x140008500]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140001e94
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140001e79
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001e79
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140001e79
mov dword [rbp - 5], eax
lea rdx, [0x140008cbe]
lea rax, [0x140008568]
mov dword [rbp - 1], 0x26
mov qword [rbp + 0x2f], rax
lea rax, [rbp - 5]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x140001e84
mov ebx, 0x8000ffff
jmp 0x140001eb0
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140001eb0
mov rcx, qword [rbp + 0x37]
xor ebx, ebx
mov eax, dword [rcx + 8]
mov dword [rbp + 0x83], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp + 0x7f], eax
mov rax, qword [rbp + 0x7f]
mov qword [rsi], rax
mov rcx, qword [rbp + 7]
call fcn.1400062b4
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret