Function at 0x14001b7a0
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
push rbp
push r15
sub rsp, 0x318
mov rax, qword [0x1402ad7a8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov qword [r11 - 0x18], rbx
mov rbx, r9
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r12
mov r12, rcx
mov qword [r11 - 0x38], r13
mov rcx, r8
mov qword [rsp + 0x68], rbx
mov r13, rdx
mov qword [rsp + 0x70], r8
call fcn.1401ca740
mov rcx, rbx
mov rsi, rax
call fcn.1401ca740
xor edi, edi
mov r15, rax
mov ebp, edi
test rsi, rsi
je 0x14001b841
test rax, rax
je 0x14001b841
mov eax, dword [rsp + 0x358]
mov r9, r15
mov dword [rsp + 0x28], eax
mov r8, rsi
mov rax, qword [rsp + 0x350]
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [r12 + 0x60]
test rax, rax
jne 0x14001b846
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14001b846
mov ebp, 8
mov rax, qword [r12]
test rax, rax
je 0x14001b9d7
test rsi, rsi
je 0x14001b9e4
test byte [rax + 0x28], 8
mov qword [rsp + 0x2e8], r14
je 0x14001b8f8
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rdi
mov rcx, rsi
mov dword [rsp + 0x50], edi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov r14d, eax
test eax, eax
je 0x14001b8f8
mov ecx, r14d
call fcn.1401c9ccc
mov rbx, rax
test rax, rax
je 0x14001b8f8
mov edx, dword [rsp + 0x50]
mov r9, rax
mov r8d, r14d
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x14001b8f0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x54], 0x5c
lea r8, [rsp + 0x58]
mov rcx, rbx
lea rdx, [rsp + 0x54]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x14001b8de
mov qword [rsp + 0x58], rdi
jmp 0x14001b8f0
mov rax, qword [rsp + 0x58]
mov edi, dword [rax + 8]
mov eax, dword [rax + 0xc]
shl rdi, 0x20
add rdi, rax
mov rcx, rbx
call fcn.1401bf408
mov r14, qword [rsp + 0x350]
lea r9, [rsp + 0x80]
mov r8, r14
lea rbx, str._unknown_
mov rdx, r13
mov rcx, r12
call fcn.14001ba60
test eax, eax
je case.0x14001b93f.7
movsxd rax, dword [rsp + 0xa0]
cmp eax, 9
ja case.0x14001b93f.7
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1ba38]
add rcx, rdx
jmp rcx
lea rbx, str._nosymbols_
jmp case.0x14001b93f.7
lea rbx, str.COFF
jmp case.0x14001b93f.7
lea rbx, [0x14026ad6c]
jmp case.0x14001b93f.7
lea rbx, [0x14026ad70]
jmp case.0x14001b93f.7
lea rbx, str._exported_
jmp case.0x14001b93f.7
lea rbx, str._deferred_
jmp case.0x14001b93f.7
lea rbx, [0x14026ad94]
jmp case.0x14001b93f.7
lea rbx, str.Virtual
jmp case.0x14001b93f.7
lea rbx, [0x14026ada0]
mov rcx, qword [r12]
lea rdx, [rsp + 0x1c4]
mov r9d, dword [rsp + 0x358]
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x40], rdi
mov rax, qword [rcx]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r9d
mov r9, r14
call qword [rax + 0x10]
mov r14, qword [rsp + 0x2e8]
test rsi, rsi
je 0x14001b9e4
mov rcx, rsi
call fcn.1401bf408
mov r13, qword [rsp + 0x2f0]
mov r12, qword [rsp + 0x2f8]
mov rdi, qword [rsp + 0x300]
mov rsi, qword [rsp + 0x308]
mov rbx, qword [rsp + 0x310]
test r15, r15
je 0x14001ba19
mov rcx, r15
call fcn.1401bf408
mov eax, ebp
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1401b72a0
add rsp, 0x318
pop r15
pop rbp
ret