Function at 0x140002b8c
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xc70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
mov rax, qword [0x1400cabe8]
xor rax, rsp
mov qword [rsp + 0xc60], rax
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov ebx, 0x400
mov r8d, ebx
lea rdx, [r11 - 0x818]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
cmp eax, ebx
jne 0x140002bfd
mov word [rsp + 0xc5e], r14w
jmp 0x140002c05
test eax, eax
je 0x140002dd2
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x460]
xor ecx, ecx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
je 0x140002dd2
mov ecx, eax
call fcn.140023638
mov rbx, rax
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x460]
xor ecx, ecx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
nop dword [rax + rax]
test eax, eax
je 0x140002dc2
mov qword [rsp + 0x38], r14
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002d7e
movzx eax, word [rcx + 2]
movzx r9d, word [rcx]
lea rcx, [0x1400290f0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r8, str.StringFileInfo_04x_04x_s
mov edi, 0x200
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140001978
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rax, qword [rsp + 0x38]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
lea rax, [0x140029148]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04x_s
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140001978
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rax, qword [rsp + 0x38]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
lea rax, [0x140029170]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04x_s
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140001978
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140002daf
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x140002daf
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x140002daf
lea rcx, str._nMicrosoft__R___s___s__n_s_n_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.Tracefmt_formats_the_messages_in_trace_logs__.etl_files__and_creates_a_text_nfile_of_the_formatted_trace_messages._You_can_specify_a_TMF_file_with_the_nformatting_instructions_for_WPP_events__or_you_can_specify_an_image_file_and_nTracefmt_finds_the_private_PDB_file_for_that_image_and_reads_the_formatting_ninstructions_from_the_PDB_file._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.140023980
lea r11, [rsp + 0xc70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret