Function at 0x140046510
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rsi
push r15
sub rsp, 0x150
xor r15d, r15d
mov ebx, edx
mov rsi, rcx
mov dword [rax + 0x10], r15d
mov qword [rax + 0x20], r15
mov dword [rax + 0x18], r15d
cmp edx, 2
jb 0x140046545
xor eax, eax
add rsp, 0x150
pop r15
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x1510]
cmp qword [0x140100978], rcx
jne 0x14004656b
lea rcx, [0x140100980]
mov eax, dword [rcx + rbx*4]
add rsp, 0x150
pop r15
pop rsi
pop rbx
ret
mov qword [rsp + 0x138], r12
mov qword [rsp + 0x130], r14
mov qword [0x140100978], rcx
movzx r14d, cx
mov r12d, 0x404
cmp dword [rsi + 0x1550], r15d
je 0x1400465b0
cmp cx, r12w
jne 0x1400465b0
mov qword [0x140100980], 0x7000404
mov eax, 0x7000404
jmp 0x140046839
mov eax, 0xe0080404
cmp rcx, rax
je 0x1400465e2
mov eax, 0xe0090404
cmp rcx, rax
je 0x1400465e2
mov eax, 0xe00a0404
cmp rcx, rax
je 0x1400465e2
mov eax, 0xe00b0404
cmp rcx, rax
je 0x1400465e2
mov eax, 0xe00e0804
cmp rcx, rax
jne 0x1400465f6
lea rdx, [rsp + 0x30]
mov r8d, 0xff
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
jne 0x14004660c
lea rcx, [0x140100980]
mov qword [0x140100980], r15
mov eax, dword [rcx + rbx*4]
jmp 0x140046839
mov qword [rsp + 0x148], rbp
mov qword [rsp + 0x140], rdi
cmp qword [rsi + 0x1520], r15
jne 0x140046818
or r9d, 0xffffffff
lea rax, str.TINTLGNT.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14004672a
or r9d, 0xffffffff
lea rax, str.CINTLGNT.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14004672a
or r9d, 0xffffffff
lea rax, str.MSTCIPHA.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14004672a
or r9d, 0xffffffff
lea rax, str.PINTLGNT.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14004672a
or r9d, 0xffffffff
lea rax, str.MSSCIPYA.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x140046818
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test eax, eax
je 0x140046818
mov ecx, ebp
call fcn.14003dad0
mov rdi, rax
test rax, rax
je 0x140046810
mov edx, dword [rsp + 0x178]
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x140046810
lea r9, [rsp + 0x180]
lea r8, [rsp + 0x188]
lea rdx, [0x1400d4164]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x140046810
mov rdx, qword [rsp + 0x188]
mov eax, dword [rdx + 8]
movzx ecx, al
and eax, 0xffff0000
shl ecx, 8
or ecx, eax
shl ecx, 8
cmp qword [rsi + 0x1520], r15
jne 0x140046876
cmp r14d, r12d
jne 0x140046855
cmp ecx, 0x4020000
je 0x140046876
cmp ecx, 0x4030000
je 0x140046876
cmp ecx, 0x4040000
je 0x140046876
cmp ecx, 0x5000000
je 0x140046876
cmp ecx, 0x5010000
je 0x140046876
cmp ecx, 0x5020000
je 0x140046876
cmp ecx, 0x6000000
je 0x140046876
mov rcx, rdi
call fcn.14003d430
lea rcx, [0x140100980]
mov qword [0x140100980], r15
mov eax, dword [rcx + rbx*4]
mov rdi, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x148]
mov r12, qword [rsp + 0x138]
mov r14, qword [rsp + 0x130]
add rsp, 0x150
pop r15
pop rsi
pop rbx
ret
cmp r14d, 0x804
jne 0x140046810
cmp ecx, 0x4010000
je 0x140046876
cmp ecx, 0x4020000
je 0x140046876
cmp ecx, 0x5030000
jne 0x140046810
or ecx, r14d
mov dword [0x140100980], ecx
mov eax, dword [rdx + 0xc]
mov rcx, rdi
mov dword [0x140100984], eax
call fcn.14003d430
mov eax, dword [0x140100980]
jmp 0x140046829