Function at 0x1400579b4
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140148f00]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r13, r9
mov rbx, rcx
mov rax, qword [0x1401c2590]
mov qword [rbp - 0x80], rax
xor r14d, r14d
test rax, rax
je 0x140057e09
xor edx, edx
mov r8d, 0x90
lea rcx, [rbp - 0x4c]
call fcn.14010b8b4
mov dword [rbp - 0x50], __WSAFDIsSet
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea r8, [rbp - 0x78]
lea rdx, [0x14012df58]
mov edi, 2
mov ecx, edi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
xorps xmm0, xmm0
xor r8d, r8d
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r8
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.1400580b0
nop
mov r9d, dword [rbp - 0x68]
mov rax, qword [rbp - 0x70]
sub r9d, eax
mov qword [rsp + 0x20], rax
mov r8d, dword [rbp - 0x78]
lea rdx, [0x14012df58]
mov ecx, edi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
mov qword [rsp + 0x78], r14
mov dword [rbp - 0x74], r14d
lea r9, [rbp - 0x74]
lea r8, [rsp + 0x78]
lea rdx, [0x14012df74]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rax, qword [rsp + 0x78]
movzx ecx, word [rax + 0xe]
mov eax, 0x4a61
mov r15d, 0x1000
cmp cx, ax
jb 0x140057c32
lea rcx, [0x14012e058]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtQueryInformationAtom
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140057c8a
mov word [rbp + 0x50], 0xb848
mov word [rbp + 0x5a], 0xe0ff
mov rcx, qword [rbp - 0x80]
mov qword [rbp + 0x52], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea r8d, [rdi + 0x14]
lea rdx, str.NtQueryInformationAtom
lea rcx, [rsp + 0x58]
call fcn.140057e48
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea r14d, [rdi + 0xa]
mov r8d, r14d
lea rdx, [0x14012dfa8]
lea rcx, [rsp + 0x38]
call fcn.140057e48
nop
lea rcx, [rsp + 0x38]
call fcn.1400655bc
mov rdx, rax
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.140056b44
mov rdi, rax
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140057b9f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, r15
jb 0x140057b9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057b9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
movdqa xmm0, xmmword [0x140136e70]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140057bee
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x140057be9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057be9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
test rdi, rdi
je 0x140057c2d
mov r9, r14
mov r8, rdi
lea rdx, [rbp + 0x60]
mov rcx, rbx
call fcn.140056680
test al, al
je 0x140057c2d
mov r9d, r14d
lea r8, [rbp + 0x50]
mov rdx, rdi
mov rcx, rbx
call fcn.140056710
test al, al
je 0x140057c2d
mov rcx, r13
call rsi
lea r8, [rbp + 0x60]
jmp 0x140057d29
xor r14d, r14d
jmp 0x140057c8a
mov eax, 0x47ba
cmp cx, ax
jb 0x140057d44
lea rcx, str.gdi32full.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiDdDDIReclaimAllocations2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetCOPPCompatibleOPMInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r15, r15
jne 0x140057c92
test rax, rax
jne 0x140057c92
mov bl, r14b
jmp 0x140057d39
mov qword [rsp + 0x30], r14
mov qword [rbp + 0x50], 0xb848
mov dword [rbp + 0x58], 0xe0ff0000
mov qword [rbp + 0x60], r14
mov esi, 8
lea r14d, [rsi + 4]
lea rdx, [rsp + 0x30]
mov rcx, rbx
test r15, r15
je 0x140057cd6
lea r8, [rbp + 0x60]
call fcn.140056e1c
test al, al
je 0x140057d06
mov r9d, esi
lea r8, [rbp - 0x80]
jmp 0x140057cf2
lea r8, [rbp + 0x70]
call fcn.140056fd0
test al, al
je 0x140057d06
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x52], rax
mov r9d, r14d
lea r8, [rbp + 0x50]
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.140056710
test al, al
jne 0x140057d0a
xor bl, bl
jmp 0x140057d39
test r15, r15
cmovne r12, r15
mov rcx, r13
call r12
test r15, r15
je 0x140057d25
mov r9d, esi
lea r8, [rbp + 0x60]
jmp 0x140057d2c
lea r8, [rbp + 0x70]
mov r9d, r14d
mov rdx, rdi
mov rcx, rbx
call fcn.140056710
mov bl, 1
mov r15d, 0x1000
jmp 0x140057dce
mov eax, 0x42ee
cmp cx, ax
jb 0x140057dcb
lea rcx, str.gdi32full.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiDdDDIReclaimAllocations2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140057dcb
mov qword [rsp + 0x30], r14
mov qword [rbp + 0x60], r14
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140056e1c
test al, al
je 0x140057dcb
mov esi, 8
mov r9d, esi
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.140056710
test al, al
je 0x140057dcb
mov rcx, r13
call rdi
mov r9d, esi
lea r8, [rbp + 0x60]
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.140056710
mov bl, 1
jmp 0x140057dce
mov bl, r14b
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140057e07
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, r15
jb 0x140057e02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057e02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov al, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14010a620
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret