Function at 0x14001a1cc
Capabilities:
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r12, r8
mov r15, rdx
mov rdi, rcx
test rcx, rcx
je 0x14001a491
test rdx, rdx
je 0x14001a491
test r8, r8
je 0x14001a491
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x14001a418
mov rcx, rdi
call fcn.140019eb0
test eax, eax
jne 0x14001a24c
mov eax, 0x80070002
jmp 0x14001a496
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea esi, [r9 + 1]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001a491
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov ebx, 0x80004005
call qword [sym.imp.KERNEL32.dll_GetFileTime]
nop dword [rax + rax]
test eax, eax
je 0x14001a405
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
nop dword [rax + rax]
test eax, eax
je 0x14001a405
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0xac
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movzx eax, word [rsp + 0x58]
xor ebx, ebx
movzx ecx, word [rsp + 0x5a]
mov dword [r15], eax
movzx eax, word [rsp + 0x5e]
shl ecx, 0x10
or ecx, eax
mov dword [r12], ecx
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001a405
mov r8d, dword [rsp + 0x70]
movzx eax, r8w
test r8d, r8d
jg 0x14001a328
neg ax
movzx ecx, ax
mov eax, 0x88888889
mul ecx
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0x5e]
shr edx, 5
cmp r8d, esi
jge 0x14001a349
add ax, dx
jmp 0x14001a364
cmp ax, dx
jae 0x14001a361
mov r8d, 0xffff
add cx, r8w
mov word [rsp + 0x5e], cx
add ax, 0x18
sub ax, dx
mov word [rsp + 0x60], ax
cmp ax, 0x17
jbe 0x14001a3ac
add cx, si
mov edx, 0xffe8
add ax, dx
mov word [rsp + 0x5e], cx
mov word [rsp + 0x60], ax
cmp cx, 0x20
jne 0x14001a3ac
movzx eax, word [rsp + 0x5a]
add ax, si
mov word [rsp + 0x5e], si
mov word [rsp + 0x5a], ax
cmp ax, 0xd
jne 0x14001a3ac
add word [rsp + 0x58], si
mov word [rsp + 0x5a], si
xorps xmm0, xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
movsd qword [rsp + 0x48], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
nop dword [rax + rax]
test eax, eax
je 0x14001a405
movsd xmm0, qword [rsp + 0x48]
lea rdx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
nop dword [rax + rax]
test eax, eax
je 0x14001a405
movzx eax, word [rsp + 0x58]
movzx ecx, word [rsp + 0x5a]
mov dword [r15], eax
movzx eax, word [rsp + 0x5e]
shl ecx, 0x10
or ecx, eax
mov dword [r12], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14001a496
mov rcx, r14
call fcn.14000130c
mov rsi, rax
test rax, rax
jne 0x14001a42f
mov eax, 0x8007000e
jmp 0x14001a496
mov r9, rsi
mov r8d, r14d
xor edx, edx
mov rcx, rdi
mov ebx, 0x80004005
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14001a487
lea r9, [rsp + 0x48]
mov rcx, rsi
lea r8, [rsp + 0x50]
lea rdx, [0x140043760]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001a487
mov rcx, qword [rsp + 0x50]
xor ebx, ebx
mov eax, dword [rcx + 8]
mov dword [r15], eax
mov eax, dword [rcx + 0xc]
mov dword [r12], eax
mov rcx, rsi
call fcn.1400012c0
jmp 0x14001a414
mov eax, 0x80004005
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140001660
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret