Function at 0x18026a2e0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rsi
push r14
sub rsp, 0x148
xor r14d, r14d
mov rsi, rcx
mov rcx, qword [rcx + 0x160]
cmp qword [0x180a54ee8], rcx
mov dword [rax + 8], r14d
mov qword [rax + 0x20], r14
mov dword [rax + 0x18], r14d
jne 0x18026a326
mov eax, edx
lea rcx, [0x180a54ef0]
mov eax, dword [rcx + rax*4]
add rsp, 0x148
pop r14
pop rsi
ret
mov qword [rsp + 0x138], rbp
movzx ebp, cx
mov qword [0x180a54ee8], rcx
cmp dword [rsi + 0x1a0], r14d
je 0x18026a36c
cmp ebp, 0x404
jne 0x18026a36c
mov rbp, qword [rsp + 0x138]
mov eax, 0x7000404
mov qword [0x180a54ef0], 0x7000404
add rsp, 0x148
pop r14
pop rsi
ret
mov eax, 0xe0080404
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x130], rdi
cmp rcx, rax
je 0x18026a3b2
mov eax, 0xe0090404
cmp rcx, rax
je 0x18026a3b2
mov eax, 0xe00a0404
cmp rcx, rax
je 0x18026a3b2
mov eax, 0xe00b0404
cmp rcx, rax
je 0x18026a3b2
mov eax, 0xe00e0804
cmp rcx, rax
jne 0x18026a5cc
mov r8d, 0xff
lea rdx, [rsp + 0x30]
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x18026a5cc
cmp qword [rsi + 0x170], r14
jne 0x18026a5cc
lea rax, str.TINTLGNT.IME
mov dword [rsp + 0x28], 0xffffffff
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x18026a4e7
lea rax, str.CINTLGNT.IME
mov dword [rsp + 0x28], 0xffffffff
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x18026a4e7
lea rax, str.MSTCIPHA.IME
mov dword [rsp + 0x28], 0xffffffff
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x18026a4e7
lea rax, str.PINTLGNT.IME
mov dword [rsp + 0x28], 0xffffffff
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x18026a4e7
lea rax, str.MSSCIPYA.IME
mov dword [rsp + 0x28], 0xffffffff
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x18026a5cc
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test eax, eax
je 0x18026a5cc
mov ecx, edi
call fcn.18024aee0
mov rbx, rax
test rax, rax
je 0x18026a5c4
mov edx, dword [rsp + 0x160]
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x18026a5c4
lea r9, [rsp + 0x170]
mov rcx, rbx
lea r8, [rsp + 0x178]
lea rdx, [0x18040c728]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x18026a5c4
mov rdx, qword [rsp + 0x178]
mov eax, dword [rdx + 8]
movzx ecx, al
and eax, 0xffff0000
shl ecx, 8
or ecx, eax
shl ecx, 8
cmp qword [rsi + 0x170], r14
jne 0x18026a618
cmp ebp, 0x404
jne 0x18026a5f8
cmp ecx, 0x4020000
je 0x18026a618
cmp ecx, 0x4030000
je 0x18026a618
cmp ecx, 0x4040000
je 0x18026a618
cmp ecx, 0x5000000
je 0x18026a618
cmp ecx, 0x5010000
je 0x18026a618
cmp ecx, 0x5020000
je 0x18026a618
cmp ecx, 0x6000000
je 0x18026a618
mov rcx, rbx
call fcn.18024aeb0
mov qword [0x180a54ef0], r14
xor eax, eax
mov rbx, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x138]
add rsp, 0x148
pop r14
pop rsi
ret
cmp ebp, 0x804
jne 0x18026a5c4
cmp ecx, 0x4010000
je 0x18026a618
cmp ecx, 0x4020000
je 0x18026a618
cmp ecx, 0x5030000
jne 0x18026a5c4
mov eax, dword [rdx + 0xc]
or ecx, ebp
mov dword [0x180a54ef0], ecx
mov rcx, rbx
mov dword [0x180a54ef4], eax
call fcn.18024aeb0
mov eax, dword [0x180a54ef0]
jmp 0x18026a5d5