Function at 0x14003f6f0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rsi
push r13
sub rsp, 0x150
xor r13d, r13d
mov ebx, edx
mov rsi, rcx
mov dword [rax + 0x10], r13d
mov qword [rax + 0x20], r13
mov dword [rax + 0x18], r13d
cmp edx, 2
jb 0x14003f725
xor eax, eax
add rsp, 0x150
pop r13
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x1510]
cmp qword [0x1400e08d8], rcx
jne 0x14003f74b
lea rcx, [0x1400e08e0]
mov eax, dword [rcx + rbx*4]
add rsp, 0x150
pop r13
pop rsi
pop rbx
ret
mov qword [rsp + 0x138], r12
mov qword [rsp + 0x130], r14
mov qword [0x1400e08d8], rcx
mov r14d, 0x404
movzx r12d, cx
cmp dword [rsi + 0x1550], r13d
je 0x14003f790
cmp cx, r14w
jne 0x14003f790
mov qword [0x1400e08e0], 0x7000404
mov eax, 0x7000404
jmp 0x14003fa19
mov eax, 0xe0080404
cmp rcx, rax
je 0x14003f7c2
mov eax, 0xe0090404
cmp rcx, rax
je 0x14003f7c2
mov eax, 0xe00a0404
cmp rcx, rax
je 0x14003f7c2
mov eax, 0xe00b0404
cmp rcx, rax
je 0x14003f7c2
mov eax, 0xe00e0804
cmp rcx, rax
jne 0x14003f7d6
lea rdx, [rsp + 0x30]
mov r8d, 0xff
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
jne 0x14003f7ec
lea rcx, [0x1400e08e0]
mov qword [0x1400e08e0], r13
mov eax, dword [rcx + rbx*4]
jmp 0x14003fa19
mov qword [rsp + 0x148], rbp
mov qword [rsp + 0x140], rdi
cmp qword [rsi + 0x1520], r13
jne 0x14003f9f8
or r9d, 0xffffffff
lea rax, str.TINTLGNT.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14003f90a
or r9d, 0xffffffff
lea rax, str.CINTLGNT.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14003f90a
or r9d, 0xffffffff
lea rax, str.MSTCIPHA.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14003f90a
or r9d, 0xffffffff
lea rax, str.PINTLGNT.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x14003f90a
or r9d, 0xffffffff
lea rax, str.MSSCIPYA.IME
lea r8, [rsp + 0x30]
lea edx, [r9 + 2]
mov ecx, 0x409
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x14003f9f8
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test eax, eax
je 0x14003f9f8
mov ecx, ebp
call fcn.14001f500
mov rdi, rax
test rax, rax
je 0x14003f9f0
mov edx, dword [rsp + 0x178]
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x14003f9f0
lea r9, [rsp + 0x180]
lea r8, [rsp + 0x188]
lea rdx, [0x1400c0078]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x14003f9f0
mov rdx, qword [rsp + 0x188]
mov eax, dword [rdx + 8]
movzx ecx, al
and eax, 0xffff0000
shl ecx, 8
or ecx, eax
shl ecx, 8
cmp qword [rsi + 0x1520], r13
jne 0x14003fa56
cmp r12d, r14d
jne 0x14003fa35
cmp ecx, 0x4020000
je 0x14003fa56
cmp ecx, 0x4030000
je 0x14003fa56
cmp ecx, 0x4040000
je 0x14003fa56
cmp ecx, 0x5000000
je 0x14003fa56
cmp ecx, 0x5010000
je 0x14003fa56
cmp ecx, 0x5020000
je 0x14003fa56
cmp ecx, 0x6000000
je 0x14003fa56
mov rcx, rdi
call fcn.14001f530
lea rcx, [0x1400e08e0]
mov qword [0x1400e08e0], r13
mov eax, dword [rcx + rbx*4]
mov rdi, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x148]
mov r12, qword [rsp + 0x138]
mov r14, qword [rsp + 0x130]
add rsp, 0x150
pop r13
pop rsi
pop rbx
ret
cmp r12d, 0x804
jne 0x14003f9f0
cmp ecx, 0x4010000
je 0x14003fa56
cmp ecx, 0x4020000
je 0x14003fa56
cmp ecx, 0x5030000
jne 0x14003f9f0
or ecx, r12d
mov dword [0x1400e08e0], ecx
mov eax, dword [rdx + 0xc]
mov rcx, rdi
mov dword [0x1400e08e4], eax
call fcn.14001f530
mov eax, dword [0x1400e08e0]
jmp 0x14003fa09