Function at 0x18001d910
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov r15, rdx
mov r14, rcx
xor ebx, ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov r13, qword [rdx + 0x10]
mov r12, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x18001d955
mov r12, qword [rdx]
movabs rax, 0x7fffffffffffffff
mov esi, reloc.WS2_32.dll_ntohs
cmp r13, 0x10
jae 0x18001d976
movups xmm0, xmmword [r12]
movups xmmword [rcx], xmm0
mov edi, esi
jmp 0x18001d9ea
mov rdi, r13
or rdi, rsi
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001d9bf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001df52
mov rcx, rax
call fcn.18009d1b8
mov rcx, rax
test rax, rax
je 0x18001df58
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18001d9ce
test rcx, rcx
je 0x18001d9cb
call fcn.18009d1b8
jmp 0x18001d9ce
mov rax, rbx
mov qword [r14], rax
lea r8, [r13 + 1]
mov rdx, r12
mov rcx, rax
call fcn.18009fc20
movabs rax, 0x7fffffffffffffff
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], rdi
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rsi
mov byte [rbp - 0x39], 0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rsi
mov byte [rbp - 0x19], 0
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
mov r13, qword [r15 + 0x10]
mov r12, r15
cmp qword [r15 + 0x18], 0x10
jb 0x18001da2f
mov r12, qword [r15]
cmp r13, 0x10
jae 0x18001da44
movups xmm0, xmmword [r12]
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x1f], rsi
jmp 0x18001dab4
mov rdi, r13
or rdi, 0xf
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001da8e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001df5e
mov rcx, rax
call fcn.18009d1b8
mov rcx, rax
test rax, rax
je 0x18001df64
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18001da9d
test rcx, rcx
je 0x18001da9a
call fcn.18009d1b8
jmp 0x18001da9d
mov rax, rbx
mov qword [rbp + 7], rax
lea r8, [r13 + 1]
mov rdx, r12
mov rcx, rax
call fcn.18009fc20
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x17], r13
lea rcx, [rbp - 0x39]
call fcn.180008690
nop
lea rdi, [r14 + 0x20]
mov qword [rbp + 0x6f], rdi
mov qword [rdi], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r12, qword [rbp + 0x17]
lea rax, [rbp + 7]
mov rcx, qword [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
cmovae rax, rcx
mov qword [rbp + 0x6f], rax
cmp r12, 0x10
jae 0x18001db02
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
mov r13, rsi
jmp 0x18001db81
mov r13, r12
or r13, 0xf
movabs rax, 0x7fffffffffffffff
cmp r13, rax
cmova r13, rax
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x18001db56
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001df6a
mov rcx, rax
call fcn.18009d1b8
mov rcx, rax
test rax, rax
je 0x18001df70
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18001db65
test rcx, rcx
je 0x18001db62
call fcn.18009d1b8
jmp 0x18001db65
mov rax, rbx
mov qword [rdi], rax
lea r8, [r12 + 1]
mov rdx, qword [rbp + 0x6f]
mov rcx, rax
call fcn.18009fc20
mov rdx, qword [rbp + 0x1f]
mov rcx, qword [rbp + 7]
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r13
cmp rdx, 0x10
jb 0x18001dbbc
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dbb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001df76
call fcn.18009d1f4
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rsi
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x18001dc03
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dbfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001df76
call fcn.18009d1f4
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rsi
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x18001dc4a
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dc45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001df76
call fcn.18009d1f4
mov qword [r14 + 0x40], rbx
mov qword [r14 + 0x50], rbx
mov qword [r14 + 0x58], rsi
mov byte [r14 + 0x40], 0
lea rdi, [r14 + 0x68]
mov qword [rdi], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rsi
mov byte [rdi], 0
mov qword [r14 + 0x88], rbx
mov qword [r14 + 0x98], rbx
mov qword [r14 + 0xa0], rsi
mov byte [r14 + 0x88], 0
cmp qword [r15 + 0x18], 0x10
jb 0x18001dc94
mov r15, qword [r15]
mov r13, rbx
mov qword [rbp - 0x59], rbx
xor r12b, r12b
mov byte [rbp - 0x51], r12b
lea rdx, [rbp + 0x77]
mov rcx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [rbp + 0x6f], eax
test eax, eax
je 0x18001dcf0
mov ecx, eax
call fcn.18009d8b4
mov r13, rax
mov qword [rbp - 0x59], rax
xor ecx, ecx
call fcn.18009d1f4
mov r9, r13
mov r8d, dword [rbp + 0x6f]
xor edx, edx
mov rcx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
movzx r12d, r12b
mov ecx, 1
test eax, eax
cmovne r12d, ecx
mov byte [rbp - 0x51], r12b
test r12b, r12b
je 0x18001de04
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [0x1800ea574]
mov rcx, r13
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x18001dd40
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x18001dd40
mov edx, dword [rax + 0xc]
mov ecx, dword [rax + 8]
mov eax, ecx
shr eax, 0x10
mov word [rbp + 0x6f], ax
mov word [rbp + 0x71], cx
mov eax, edx
shr eax, 0x10
mov word [rbp + 0x73], ax
mov word [rbp + 0x75], dx
jmp 0x18001dd44
mov qword [rbp + 0x6f], rbx
mov r8d, 4
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 0x6f]
call fcn.18000eb74
mov r15, rax
cmp rdi, rax
je 0x18001ddc0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18001dd99
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18001dd94
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001df7c
mov rcx, r8
call fcn.18009d1f4
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rsi
mov byte [rdi], 0
movups xmm0, xmmword [r15]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], rsi
mov byte [r15], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x18001df1f
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ddfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001df7c
call fcn.18009d1f4
jmp 0x18001df1f
mov rcx, qword [rdi + 0x18]
cmp rcx, 7
jb 0x18001de40
mov rbx, rdi
cmp rcx, 0x10
jb 0x18001de1a
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 7
mov r8d, 7
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + 7], 0
jmp 0x18001df1f
mov rdx, rcx
shr rdx, 1
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, rdx
cmp rcx, rax
jbe 0x18001de88
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.18009d1b8
test rax, rax
je 0x18001df46
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rdi + 0x18], r15
jmp 0x18001def3
lea rax, [rdx + rcx]
cmp rax, 0xf
cmova rsi, rax
lea rcx, [rsi + 1]
mov r15, rsi
cmp rcx, 0x1000
jb 0x18001deb3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001df4c
jmp 0x18001de65
test rcx, rcx
je 0x18001deef
call fcn.18009d1b8
mov rbx, rax
mov qword [rdi + 0x10], 7
mov qword [rdi + 0x18], rsi
mov ecx, dword [str.0.0.0.0]
mov dword [rax], ecx
movzx ecx, word [0x1800eae44]
mov word [rax + 4], cx
movzx ecx, byte [0x1800eae46]
mov byte [rax + 6], cl
mov byte [rax + 7], 0
jmp 0x18001df1c
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x10], 7
mov eax, dword [str.0.0.0.0]
mov dword [rbx], eax
movzx eax, word [0x1800eae44]
mov word [rbx + 4], ax
movzx eax, byte [0x1800eae46]
mov byte [rbx + 6], al
mov byte [rbx + 7], 0
mov qword [rdi], rbx
mov rcx, r13
call fcn.18009d1f4
nop
mov rax, r14
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.180001df0
nop
call fcn.180001df0
int3
call fcn.1800a45b8
nop
call fcn.180001df0
int3
call fcn.1800a45b8
nop
call fcn.180001df0
int3
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3