Function at 0x140002480
Capabilities:
Get common file path
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x670]
sub rsp, 0x770
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x660], rax
mov r13, r8
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x68], rcx
lea rdx, [rbp + 0x240]
mov r8d, 0x105
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400028e4
lea rcx, [rbp + 0x240]
call fcn.1400182b8
mov edi, 0x104
lea rdx, [rbp + 0x450]
mov r8d, edi
mov rcx, rax
call fcn.140016f30
test eax, eax
js 0x1400028e4
cmp dword [0x140050ce0], ebx
jne 0x140002617
mov edx, edi
lea rcx, [rbp + 0x30]
mov r12d, ebx
mov esi, ebx
call fcn.140018174
test eax, eax
je 0x1400028be
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r15d, eax
test eax, eax
jne 0x1400025b7
lea rcx, [rbp + 0x30]
call fcn.140017488
test eax, eax
je 0x1400028be
mov qword [rsp + 0x30], rbx
lea edi, [rbx + 1]
mov r8d, edi
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor edx, edx
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400028be
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r14d, 0x80004005
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x140002814
lea rcx, [rsp + 0x58]
jmp 0x1400026e7
mov rcx, r15
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x1400028be
mov r9, rax
lea rcx, [rbp + 0x30]
mov r8d, r15d
xor edx, edx
mov r14d, 0x80004005
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14000287f
lea r9, [rsp + 0x54]
mov rcx, rdi
lea r8, [rsp + 0x60]
lea rdx, [0x140042140]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14000287f
mov rax, qword [rsp + 0x60]
jmp 0x140002875
mov edx, edi
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400028be
lea r8, str.wmvcore.dll
mov rdx, rdi
lea rcx, [rbp + 0x240]
call fcn.140001584
test eax, eax
js 0x1400028be
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x240]
mov esi, ebx
mov r12d, ebx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r15d, eax
test eax, eax
jne 0x14000281f
lea rcx, [rbp + 0x240]
call fcn.140017488
test eax, eax
je 0x1400028be
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x240]
xor edx, edx
mov dword [rsp + 0x20], 3
lea edi, [r9 + 1]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400028be
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r14d, 0x80004005
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x140002814
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140002814
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0xac
call sub.msvcrt.dll_memset
movzx esi, word [rsp + 0x72]
lea rcx, [rbp - 0x80]
movzx eax, word [rsp + 0x76]
mov r14d, ebx
movzx r12d, word [rsp + 0x70]
shl esi, 0x10
or esi, eax
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x140002814
mov r8d, dword [rbp - 0x80]
movzx eax, r8w
neg ax
test r8d, r8d
cmovg ax, r8w
movzx ecx, ax
mov eax, 0x88888889
mul ecx
movzx eax, word [rsp + 0x78]
movzx ecx, word [rsp + 0x76]
shr edx, 5
cmp r8d, edi
jge 0x14000276a
add ax, dx
jmp 0x140002785
cmp ax, dx
jae 0x140002782
mov r8d, 0xffff
add cx, r8w
mov word [rsp + 0x76], cx
add ax, 0x18
sub ax, dx
mov word [rsp + 0x78], ax
cmp ax, 0x17
jbe 0x1400027cd
add cx, di
mov edx, 0xffe8
add ax, dx
mov word [rsp + 0x76], cx
mov word [rsp + 0x78], ax
cmp cx, 0x20
jne 0x1400027cd
movzx eax, word [rsp + 0x72]
add ax, di
mov word [rsp + 0x76], di
mov word [rsp + 0x72], ax
cmp ax, 0xd
jne 0x1400027cd
add word [rsp + 0x70], di
mov word [rsp + 0x72], di
xorps xmm0, xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
movsd qword [rsp + 0x48], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x140002814
movsd xmm0, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140002814
movzx esi, word [rsp + 0x72]
movzx eax, word [rsp + 0x76]
movzx r12d, word [rsp + 0x70]
shl esi, 0x10
or esi, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002887
mov rcx, r15
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x1400028be
mov r9, rax
lea rcx, [rbp + 0x240]
mov r8d, r15d
xor edx, edx
mov r14d, 0x80004005
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14000287f
lea r9, [rsp + 0x54]
mov rcx, rdi
lea r8, [rsp + 0x58]
lea rdx, [0x140042140]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14000287f
mov rax, qword [rsp + 0x58]
mov r12d, dword [rax + 8]
mov r14d, ebx
mov esi, dword [rax + 0xc]
mov rcx, rdi
call fcn.14003c408
test r14d, r14d
js 0x1400028be
movzx ecx, si
lea r8, str._lu._lu._lu._lu
mov dword [rsp + 0x30], ecx
mov edx, 0x104
movzx eax, r12w
lea rcx, [rbp + 0x30]
shr esi, 0x10
shr r12d, 0x10
mov dword [rsp + 0x28], esi
mov r9d, r12d
mov dword [rsp + 0x20], eax
call fcn.140001734
mov edx, dword [rsp + 0x50]
lea rax, [rbp + 0x450]
mov rcx, qword [rsp + 0x68]
lea r9, [rbp + 0x30]
mov r8, r13
mov qword [rsp + 0x20], rax
call fcn.140001734
test eax, eax
setns bl
mov eax, ebx
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x7c0]
add rsp, 0x770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret