Function at 0x1400704a0
Capabilities:
Get file version info
Identify system language via api

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x328], rbx
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r13, r8
mov r12, rdx
mov qword [rbp - 0x68], rdx
mov r14, rcx
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x58], r8
xor esi, esi
mov dword [rsp + 0x58], esi
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140070c23
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.VarFileInfoTranslation
lea rdi, [rsi - 1]
cmp rdx, 0x10000
jae 0x14007053b
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.14000d4c0
jmp 0x140070558
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140070540
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.14000fd40
nop
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140070c2e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.StringFileInfo040904e4_
cmp rdx, 0x10000
jae 0x140070597
movzx edx, dx
lea rcx, [rsp + 0x48]
call fcn.14000d4c0
jmp 0x1400705b8
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400705a0
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000fd40
nop
mov rax, qword [r13]
cmp dword [rax - 0x10], 0
jne 0x1400705f5
lea rcx, [rbp - 0x70]
call fcn.14001b6b0
nop
mov rdx, rax
mov rcx, r13
call fcn.140044be0
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400705f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov rcx, qword [r13]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test eax, eax
jne 0x1400706ed
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140070c39
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rdx, [0x1400f4784]
cmp rdx, 0x10000
jae 0x140070645
movzx edx, dx
mov rcx, r14
call fcn.14000d4c0
jmp 0x140070666
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140070650
mov r8d, eax
mov rcx, r14
call fcn.14000fd40
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070685
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400706a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400706c0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, r14
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400a79f0
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbx
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x78]
call fcn.14006d920
nop
mov r15, qword [rsp + 0x78]
mov r9, r15
mov r8d, ebx
xor edx, edx
mov rcx, qword [r13]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140070812
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140070c44
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rdx, [0x1400f4784]
cmp rdx, 0x10000
jae 0x140070759
movzx edx, dx
mov rcx, r14
call fcn.14000d4c0
jmp 0x140070776
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140070760
mov r8d, eax
mov rcx, r14
call fcn.14000fd40
nop
test r15, r15
je 0x1400707b0
mov rdx, qword [rbp - 0x78]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x1400707a7
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070c4f
mov rcx, r15
call fcn.1400a7308
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400707cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400707ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400706c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400706c0
mov qword [rsp + 0x50], rsi
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140070864
cmp dword [rsp + 0x3c], 4
jne 0x140070864
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax]
mov eax, ecx
shr eax, 0x10
movzx r9d, cx
mov dword [rsp + 0x20], eax
lea r8, str.StringFileInfo_04X_04X_
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.14004f400
jmp 0x140070883
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r9d, ax
lea r8, str.StringFileInfo_04X04B0_
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.14004f400
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140070c55
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rax, [rbp - 0x50]
cmp rax, 0x10000
lea rax, [rbp - 0x50]
jae 0x1400708c5
movzx edx, ax
lea rcx, [rsp + 0x30]
call fcn.14000d4c0
jmp 0x140070a04
mov rsi, rdi
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400708d0
test esi, esi
jne 0x14007093d
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140070a04
cmp dword [rdx + 0x10], 0
jge 0x14007090c
cmp dword [rbx - 0xc], 0
jl 0x140070c60
xor eax, eax
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140070a04
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070921
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x78]
jmp 0x140070a04
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x60], eax
lea r12, [rbp - 0x50]
sub r12, rbx
sar r12, 1
test esi, esi
js 0x140070c6b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140070978
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.14000e630
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x60]
cmp r12, rax
movsxd rax, esi
ja 0x1400709d3
lea rdx, [rbx + r12*2]
lea r12, [rax + rax]
test r12, r12
je 0x1400709ed
test rdx, rdx
jne 0x1400709a8
call fcn.1400b7a94
mov dword [rax], 0x16
call fcn.1400b7944
jmp 0x1400709ed
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r12
jae 0x1400709c6
call fcn.1400b7a94
mov dword [rax], 0x22
call fcn.1400b7944
jmp 0x1400709ed
mov r8, r12
mov rcx, rbx
call fcn.1400aea90
jmp 0x1400709ed
lea r12, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
lea r8, [rbp - 0x50]
mov rcx, rbx
call fcn.140018b60
cmp esi, dword [rbx - 0xc]
jg 0x140070c18
mov dword [rbx - 0x10], esi
xor eax, eax
mov word [r12 + rbx], ax
mov r12, qword [rbp - 0x68]
mov rdx, qword [r12]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14004eeb0
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x140070b6a
mov rbx, qword [rsp + 0x48]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x140070a54
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140070a65
call fcn.14000ce10
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140070c76
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], 2
mov r9, qword [r12]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140022180
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
sete r15b
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070adb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15b, r15b
je 0x140070b6a
lea rdx, [0x1400f4784]
mov rcx, r14
call fcn.14001c2a0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070b13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140070b4f
mov rdx, qword [rbp - 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070c0c
call fcn.1400a7308
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1400707cf
mov rcx, qword [rsi]
mov rdx, rsi
jmp 0x1400707c8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14001c2a0
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
call fcn.14000c440
add rax, 0x18
mov qword [r14], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070bae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070bcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400707b0
mov rdx, qword [rbp - 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400707aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070c12
jmp 0x1400707aa
call fcn.1400b7964
int3
call fcn.1400b7964
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
call fcn.1400b7964
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
int3