Function at 0x140038670
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rbx, r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140038955
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea r8, vtable.ATL::CAtlStringMgr.0
cmp rax, r8
jne 0x140038960
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r15, 0xffffffffffffffff
xor r12d, r12d
test rbx, rbx
je 0x14003870c
cmp rbx, 0x10000
jae 0x1400386fc
movzx edx, bx
lea rcx, [rsp + 0x20]
call fcn.140012700
jmp 0x140038720
mov rax, r15
nop
inc rax
cmp word [rbx + rax*2], r12w
jne 0x140038700
jmp 0x14003870f
mov eax, r12d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x20]
mov rsi, rbx
mov rdi, r12
mov r13d, 1
cmp word [rbx], di
je 0x1400387bc
movzx eax, word [rbx]
nop dword [rax]
mov r14, rdi
mov rbp, rdi
movzx edx, ax
lea rcx, [0x1402f3720]
call fcn.14022fa08
test rax, rax
je 0x140038766
mov rdi, rsi
test rbp, rbp
cmovne rdi, rbp
jmp 0x140038769
mov rdi, r12
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x140038740
test rdi, rdi
je 0x1400387bc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x140038967
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400387a8
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140002a1c
mov rbx, qword [rsp + 0x20]
cmp edi, dword [rbx - 0xc]
jg 0x14003897d
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r12w
lea r14, [0x1402f3728]
mov rsi, r14
sub rsi, rbx
sar rsi, 1
mov r12d, dword [rbx - 0x10]
mov edx, SafeArrayGetDim
mov rcx, r14
call fcn.1402356b0
mov rbp, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140038972
lea edi, [r12 + rax]
test edi, edi
js 0x140038988
sub r13d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r13d
jge 0x14003881b
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140002a1c
mov rbx, qword [rsp + 0x20]
cmp rsi, r12
ja 0x140038824
lea r14, [rbx + rsi*2]
movsxd rdx, ebp
lea rcx, [rbx + r12*2]
mov r9d, ebp
mov r8, r14
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x14003894a
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor ebp, ebp
mov word [rbx + rax*2], bp
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
mov ecx, eax
call fcn.14008c198
mov rsi, rax
mov r9, rax
mov r8d, edi
mov edx, dword [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rsi
test eax, eax
je 0x1400388dc
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [0x1402f4204]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400388cf
cmp dword [rsp + 0x28], ebp
je 0x1400388cf
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + 0x12]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], eax
movzx eax, word [rcx + 0x10]
mov rdx, qword [rsp + 0x40]
mov dword [rdx], eax
movzx eax, word [rcx + 0x16]
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rcx, rsi
call fcn.14008c190
mov dil, 1
jmp 0x1400388e4
call fcn.14008c190
xor dil, dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140038930
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CAtlStringMgr.0
cmp rax, r9
jne 0x140038945
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140038945
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call r8
jmp 0x140038930
mov ecx, 0x80070057
call fcn.140002d3c
nop
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x1400386cc
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3