Function at 0x140006540
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x200
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor ebx, ebx
mov rbp, r8
mov qword [rsp + 0x40], r8
mov r15, rcx
mov r12, rdx
lea r8d, [rbx + 0x7f]
lea rcx, [rsp + 0x51]
xor edx, edx
mov edi, r9d
mov esi, ebx
mov r14d, ebx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x50], bl
call fcn.140013580
lea rcx, [rsp + 0xd1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xd0], bl
call fcn.140013580
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x38], rbx
test r15, r15
je 0x140006875
test rbp, rbp
je 0x140006875
test edi, edi
je 0x140006875
mov r8, rdi
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x48], rdi
call fcn.140013580
lea rdx, [rsp + 0x24]
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test eax, eax
jne 0x140006640
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 2
jne 0x14000687a
call fcn.140003f60
lea rdx, [rsp + 0x24]
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
call fcn.1400040b0
test edi, edi
jne 0x14000663a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000687a
mov r14d, 1
mov ecx, edi
mov qword [rsp + 0x1f8], r13
mov r13d, edi
call fcn.140003f58
mov rbp, rax
test rax, rax
jne 0x140006662
lea esi, [rax + 8]
jmp 0x14000685c
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.140013580
test r14d, r14d
je 0x140006679
call fcn.140003f60
mov edx, dword [rsp + 0x24]
mov r9, rbp
mov r8d, edi
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoA
mov edi, eax
test r14d, r14d
je 0x140006697
call fcn.1400040b0
test edi, edi
jne 0x1400066a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000685c
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, rbp
mov dword [rsp + 0x50], 0x7261565c
mov dword [rsp + 0x54], 0x656c6946
mov dword [rsp + 0x58], 0x6f666e49
mov dword [rsp + 0x5c], 0x6172545c
mov dword [rsp + 0x60], 0x616c736e
mov dword [rsp + 0x64], 0x6e6f6974
mov byte [rsp + 0x68], bl
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x140006704
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000685c
mov eax, 0x5c
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov word [rsp + 0x68], ax
xor eax, eax
mov dword [rsp + 0x50], 0x7274535c
mov dword [rsp + 0x54], 0x46676e69
mov dword [rsp + 0x58], 0x49656c69
mov dword [rsp + 0x5c], 0x5c6f666e
mov dword [rsp + 0x60], 0x78343025
mov dword [rsp + 0x64], 0x78343025
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [r12 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140006750
test dword [rsp + 0x28], 0xfffffffc
jbe 0x14000685c
mov rdi, rbx
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd0]
movzx r9d, word [rdi + rax + 2]
movzx r8d, word [rdi + rax]
call fcn.140014060
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x140006839
mov rax, qword [rsp + 0x38]
cmp word [rdi + rax], 0
jne 0x1400067fd
movzx r9d, word [rdi + rax + 2]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd0]
mov r8d, 0x409
call fcn.140014060
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x140006814
mov eax, dword [rsp + 0x28]
inc ebx
add rdi, 4
shr eax, 2
cmp ebx, eax
jb 0x140006771
jmp 0x14000685c
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
dec rax
cmp rax, r8
cmovb r8, rax
call fcn.140014720
jmp 0x14000685c
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
dec rax
cmp rax, r8
cmovb r8, rax
call fcn.140014720
mov r13, qword [rsp + 0x1f8]
test rbp, rbp
je 0x140006871
mov rcx, rbp
call fcn.140013e24
mov eax, esi
jmp 0x14000687a
mov eax, 0x57
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140013680
add rsp, 0x200
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret