Function at 0x140007f04
Capabilities:
Get common file path
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140070070]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r12, rdx
mov rbx, rcx
mov edi, 1
mov dword [rcx + 0x70], edi
lea r15, [rcx + 0x78]
mov rcx, r15
call fcn.140006208
lea rsi, [rbx + 0x80]
mov rcx, rsi
call fcn.140006208
lea rax, [rbx + 0x88]
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.140006208
lea r13, [rbx + 0x90]
mov rcx, r13
call fcn.140006208
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x44], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.14002dc80
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [r12]
cmp dword [rcx - 0x10], r14d
jl 0x140007fd3
lea rdx, [rbp - 0x50]
call fcn.14002e01c
test rax, rax
je 0x140007fd3
sub rax, qword [r12]
sar rax, 1
cmp eax, 0xffffffff
cmovne ebx, edi
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], r14d
call fcn.1400064a8
mov rcx, rax
test rax, rax
je 0x140008531
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov ecx, edi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x104
sub eax, edx
or eax, ecx
jge 0x14000801f
lea rcx, [rsp + 0x20]
call fcn.140005f18
mov rbx, qword [rsp + 0x20]
mov edx, 0x104
mov ecx, edi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140008041
lea rcx, [rsp + 0x20]
call fcn.140005f18
mov rbx, qword [rsp + 0x20]
mov edx, 0x104
mov r8d, edx
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140032164
xor ecx, ecx
test eax, eax
js 0x140008526
cmp eax, dword [rbx - 0xc]
jg 0x140008526
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], cx
lea edx, [rcx + 0x5c]
mov rcx, rbx
call fcn.14002de38
test rax, rax
jne 0x14000808c
or eax, 0xffffffff
jmp 0x140008092
sub rax, rbx
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.14000d008
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000d250
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor ebx, ebx
sub eax, 1
jg 0x1400080d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov edx, 0x5c
mov rcx, qword [rsp + 0x20]
call fcn.14002de38
test rax, rax
jne 0x1400080ed
or eax, 0xffffffff
jmp 0x1400080f5
sub rax, qword [rsp + 0x20]
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14000d008
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000d250
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008135
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140008165
mov rcx, qword [r12]
cmp dword [rcx - 0x10], ebx
jl 0x140008165
call fcn.14002e01c
test rax, rax
je 0x140008165
sub rax, qword [r12]
sar rax, 1
cmp eax, 0xffffffff
cmovne r14d, edi
mov dword [rsp + 0x40], r14d
mov rdx, r12
mov rcx, rsi
call fcn.14000d250
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000d3c8
nop
mov rbx, qword [rsp + 0x50]
mov esi, dword [rbx - 0x10]
mov edx, 0x5c
mov rcx, rbx
call fcn.14002de38
test rax, rax
jne 0x14000819d
or eax, 0xffffffff
jmp 0x1400081a3
sub rax, rbx
sar rax, 1
sub esi, eax
sub esi, edi
mov r8d, esi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14000d084
nop
mov rdx, rax
mov rcx, r15
call fcn.14000d250
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
xor esi, esi
test eax, eax
jg 0x1400081ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test eax, eax
je 0x140008474
mov ecx, ebx
call fcn.14002bbd4
mov r15, rax
mov r9, rax
mov r8d, ebx
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14000844a
mov qword [rsp + 0x38], rsi
call fcn.1400064a8
mov rcx, rax
test rax, rax
je 0x14000851b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov esi, 0x3a8
movups xmm0, xmmword [str.VarFileInfoTranslation]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [0x1400600d0]
movups xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [0x1400600e0]
movups xmmword [rbp - 0x68], xmm0
movzx eax, word [0x1400600f0]
mov word [rbp - 0x58], ax
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400082ab
mov rax, qword [rsp + 0x70]
movzx esi, word [rax]
shl esi, 0x10
movzx eax, word [rax + 2]
or esi, eax
mov r8d, esi
lea rdx, str.StringFileInfo_08xCompanyName
lea rcx, [rsp + 0x30]
call fcn.14000e420
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.VERSION.dll_VerQueryValueW]
xor ecx, ecx
test eax, eax
je 0x140008301
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x1400082eb
mov eax, ecx
jmp 0x1400082f3
mov rcx, rbx
call fcn.140032038
mov r8d, eax
mov rdx, rbx
mov rcx, r13
call fcn.1400060fc
mov r8d, esi
lea rdx, str.StringFileInfo_08xProductName
lea rcx, [rsp + 0x30]
call fcn.14000e420
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.VERSION.dll_VerQueryValueW]
xor ecx, ecx
test eax, eax
je 0x140008363
mov r14, qword [rsp + 0x38]
test r14, r14
jne 0x140008344
mov eax, ecx
jmp 0x14000834c
mov rcx, r14
call fcn.140032038
mov r8d, eax
mov rdx, r14
mov rcx, qword [rsp + 0x48]
call fcn.1400060fc
mov r14d, dword [rsp + 0x40]
xor ecx, ecx
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
cmp dword [rax - 0x10], ecx
jne 0x1400083c9
mov r8d, esi
lea rdx, str.StringFileInfo_08xFileDescription
lea rcx, [rsp + 0x30]
call fcn.14000e420
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.VERSION.dll_VerQueryValueW]
xor esi, esi
test eax, eax
je 0x1400083cb
mov rsi, qword [rsp + 0x38]
xor eax, eax
test rsi, rsi
je 0x1400083b9
mov rcx, rsi
call fcn.140032038
mov r8d, eax
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call fcn.1400060fc
xor esi, esi
cmp dword [rsp + 0x44], esi
je 0x1400083fd
mov rcx, qword [r13]
cmp dword [rcx - 0x10], esi
jl 0x1400083fd
lea rdx, str.Microsoft
call fcn.14002e01c
test rax, rax
je 0x1400083fd
sub rax, qword [r13]
sar rax, 1
mov ecx, 3
cmp eax, 0xffffffff
cmovne edi, ecx
test r14d, r14d
je 0x14000842e
mov rcx, qword [r13]
cmp dword [rcx - 0x10], esi
jl 0x14000842e
lea rdx, str.Tencent
call fcn.14002e01c
test rax, rax
je 0x14000842e
sub rax, qword [r13]
sar rax, 1
mov ecx, 2
cmp eax, 0xffffffff
cmovne edi, ecx
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008466
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140008466
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetFileVersionInfo_:_0x_x
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rcx, r15
call fcn.14002bbcc
or r15d, 0xffffffff
jmp 0x140008490
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetFileVersionInfoSize_:_0x_x
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov r9d, edi
mov r8, qword [r12]
lea rdx, str.error_module_:__s__estatus:_d
lea rcx, [0x14005f4e0]
call fcn.140025b7c
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400084cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x1400084ef
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14002b930
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140006280
nop
mov ecx, 0x80070057
call fcn.140006280
nop
mov ecx, 0x80004005
call fcn.140006280
int3