Function at 0x140009a8c
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400150f8]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12, qword [rbp + 0x1f0]
lea rcx, [0x1400158c0]
mov rdi, qword [rbp + 0x1f8]
mov r14, rdx
lea rdx, [rsp + 0x44]
mov r13, r9
mov r15, r8
call qword [sym.imp.api_ms_win_core_versionansi_l1_1_1.dll_GetFileVersionInfoSizeA]
nop dword [rax + rax]
xor ebx, ebx
mov esi, eax
test eax, eax
jne 0x140009b14
lea rdx, [rsp + 0x40]
call fcn.14000d78c
test eax, eax
je 0x140009d87
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov dword [r15], ebx
jmp 0x140009d87
mov qword [r13], rbx
mov rcx, rsi
mov qword [r12], rbx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140009b55
lea r9, [0x1400158c0]
mov rcx, rdi
lea r8, [0x140010c00]
lea rdx, str.Out_of_memory_allocating_version_buffer_for_file__1
call fcn.1400081b0
jmp 0x140009d74
mov edx, dword [rsp + 0x44]
mov r8d, esi
lea rsi, [0x1400158c0]
mov r9, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_versionansi_l1_1_1.dll_GetFileVersionInfoA]
nop dword [rax + rax]
test eax, eax
jne 0x140009ba8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str._d_s
mov qword [rsp + 0x20], rsi
mov r9d, eax
lea rdx, str.GetFileVersionInfo_returned__1_on_file__2
mov rcx, rdi
call fcn.1400081b0
jmp 0x140009d65
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [0x140012944]
call fcn.140009dc0
test eax, eax
je 0x140009bdb
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + 8]
mov dword [r14], eax
mov eax, dword [rcx + 0xc]
mov dword [r15], eax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x38]
mov rcx, rbx
lea rdx, str.VarFileInfoTranslation
call fcn.140009dc0
test eax, eax
je 0x140009d78
mov rax, qword [rsp + 0x38]
lea r8, [0x140011624]
mov r15d, 0x100
lea rcx, [rbp + 0x80]
mov edx, r15d
mov esi, dword [rax]
movzx r14d, si
mov r9d, r14d
call fcn.1400082e4
mov rcx, qword [rsp + 0x38]
add rcx, 4
cmp dword [rsp + 0x30], 4
jmp 0x140009c88
movzx r9d, word [rcx]
lea r8, [0x140012964]
lea rcx, [rsp + 0x68]
mov edx, 0x10
call fcn.1400082e4
test eax, eax
js 0x140009c8f
lea r8, [rsp + 0x68]
mov rdx, r15
lea rcx, [rbp + 0x80]
call fcn.140001134
test eax, eax
js 0x140009c8f
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add eax, 0xfffffffc
add rcx, 4
mov dword [rsp + 0x30], eax
cmp eax, 4
mov qword [rsp + 0x38], rcx
ja 0x140009c3b
lea rcx, [rbp + 0x80]
call qword [sym.imp.msvcrt.dll__strdup]
nop dword [rax + rax]
mov qword [r12], rax
test rax, rax
jne 0x140009cb7
lea rdx, str.Out_of_memory_duplicating_language_string_for_file__1
jmp 0x140009d4f
shr esi, 0x10
lea r8, str.StringFileInfo_04x_04xFileVersion
mov r9d, esi
mov dword [rsp + 0x20], r14d
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1400082e4
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rbp - 0x80]
call fcn.140009dc0
test eax, eax
jne 0x140009d29
mov r9d, r14d
mov dword [rsp + 0x20], esi
lea r8, str.StringFileInfo_04x_04xFileVersion
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1400082e4
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rbp - 0x80]
call fcn.140009dc0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140009d78
call qword [sym.imp.msvcrt.dll__strdup]
nop dword [rax + rax]
mov qword [r13], rax
test rax, rax
jne 0x140009d78
lea rdx, str.Out_of_memory_duplicating_version_string_for_file__1
lea r9, [0x1400158c0]
mov rcx, rdi
lea r8, [0x140010c00]
call fcn.1400081b0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
xor eax, eax
jmp 0x140009d8c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14000e520
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret