Function at 0x140038480
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rbx, r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140038765
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea r8, vtable.ATL::CAtlStringMgr.0
cmp rax, r8
jne 0x140038770
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r15, 0xffffffffffffffff
xor r12d, r12d
test rbx, rbx
je 0x14003851c
cmp rbx, 0x10000
jae 0x14003850c
movzx edx, bx
lea rcx, [rsp + 0x20]
call fcn.140012700
jmp 0x140038530
mov rax, r15
nop
inc rax
cmp word [rbx + rax*2], r12w
jne 0x140038510
jmp 0x14003851f
mov eax, r12d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x20]
mov rsi, rbx
mov rdi, r12
mov r13d, 1
cmp word [rbx], di
je 0x1400385cc
movzx eax, word [rbx]
nop dword [rax]
mov r14, rdi
mov rbp, rdi
movzx edx, ax
lea rcx, [0x1402f3750]
call fcn.14022f308
test rax, rax
je 0x140038576
mov rdi, rsi
test rbp, rbp
cmovne rdi, rbp
jmp 0x140038579
mov rdi, r12
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x140038550
test rdi, rdi
je 0x1400385cc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x140038777
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400385b8
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140002a1c
mov rbx, qword [rsp + 0x20]
cmp edi, dword [rbx - 0xc]
jg 0x14003878d
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r12w
lea r14, [0x1402f3758]
mov rsi, r14
sub rsi, rbx
sar rsi, 1
mov r12d, dword [rbx - 0x10]
mov edx, SafeArrayGetDim
mov rcx, r14
call fcn.140234fb0
mov rbp, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140038782
lea edi, [r12 + rax]
test edi, edi
js 0x140038798
sub r13d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r13d
jge 0x14003862b
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140002a1c
mov rbx, qword [rsp + 0x20]
cmp rsi, r12
ja 0x140038634
lea r14, [rbx + rsi*2]
movsxd rdx, ebp
lea rcx, [rbx + r12*2]
mov r9d, ebp
mov r8, r14
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x14003875a
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor ebp, ebp
mov word [rbx + rax*2], bp
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
mov ecx, eax
call fcn.14008ba98
mov rsi, rax
mov r9, rax
mov r8d, edi
mov edx, dword [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rsi
test eax, eax
je 0x1400386ec
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [0x1402f4264]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400386df
cmp dword [rsp + 0x28], ebp
je 0x1400386df
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + 0x12]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], eax
movzx eax, word [rcx + 0x10]
mov rdx, qword [rsp + 0x40]
mov dword [rdx], eax
movzx eax, word [rcx + 0x16]
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rcx, rsi
call fcn.14008ba90
mov dil, 1
jmp 0x1400386f4
call fcn.14008ba90
xor dil, dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140038740
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CAtlStringMgr.0
cmp rax, r9
jne 0x140038755
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140038755
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call r8
jmp 0x140038740
mov ecx, 0x80070057
call fcn.140002d3c
nop
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x1400384dc
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3