Function at 0x1600cb674
Capabilities:
Check if file exists
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor edi, edi
mov r15d, r9d
mov rcx, rdx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
mov ebx, edi
mov r14, r8
mov rsi, rdx
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
je 0x1600cb895
mov r8, rsi
lea rcx, [rbp - 0x30]
mov edx, 0x104
call fcn.1600b2fdc
test eax, eax
js 0x1600cb830
lea r8, [rsp + 0x40]
mov ecx, 1
lea rdx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoSizeExW]
mov esi, eax
test eax, eax
je 0x1600cb830
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1600cb830
mov r8d, dword [rsp + 0x40]
lea rdx, [rbp - 0x30]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov ecx, 3
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoExW]
test eax, eax
je 0x1600cb830
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x48]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
mov esi, 0x3c
test eax, eax
je 0x1600cb7be
cmp dword [rsp + 0x30], edi
jbe 0x1600cb7be
mov rax, qword [rsp + 0x48]
lea r8, str.StringFileInfo_04X_04X_s
mov edx, esi
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov rax, qword [0x1601cb260]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x50]
call fcn.160059e34
test eax, eax
js 0x1600cb7be
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
jne 0x1600cb830
mov r9, qword [0x1601cb260]
lea r8, str.StringFileInfo040904E4_s
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.160059e34
test eax, eax
js 0x1600cb7f9
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
jne 0x1600cb830
mov r9, qword [0x1601cb260]
lea r8, str.StringFileInfo04090000_s
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.160059e34
test eax, eax
js 0x1600cb830
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1600cb83f
cmp di, word [rax]
jne 0x1600cb858
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveExtensionW]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
mov qword [rsp + 0x38], rax
mov rdx, r15
mov rcx, r14
mov r8, rax
test rax, rax
jne 0x1600cb86d
lea r8, [0x1601d4934]
call fcn.1600b2fdc
mov esi, eax
test rbx, rbx
je 0x1600cb88d
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
setns dil
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x320]
add rsp, 0x2f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret