Function at 0x14001eb50
Capabilities:
Get common file path
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6a0
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
xor r12d, r12d
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
mov ebp, r12d
call fcn.1400c0ac0
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rdi, 0xffffffffffffffff
jne 0x14001ed08
cmp eax, 0xb7
je 0x14001ed08
cmp eax, 0x20
je 0x14001ed08
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.1400c0ac0
xor edx, edx
lea rcx, [rsp + 0x480]
mov r8d, 0x208
call fcn.1400c0ac0
lea rdx, [rsp + 0x270]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14001ec3e
mov edx, 0x104
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r9, [rsp + 0x480]
xor r8d, r8d
lea rdx, [0x140106890]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x14001ed30
mov rcx, r12
nop dword [rax]
movzx eax, word [rsp + rcx + 0x480]
mov word [rsp + rcx + 0x60], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001ec70
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, r14
mov r15b, 1
call fcn.14001de20
test eax, eax
jne 0x14001ed30
mov qword [rsp + 0x30], r12
lea r8d, [rax + 1]
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, 0xffffffffffffffff
jne 0x14001eceb
cmp eax, 0xb7
je 0x14001eceb
cmp eax, 0x20
jne 0x14001ed01
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.14001e940
xor eax, eax
jmp 0x14001ee32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14001ed20
mov dword [rsp + 0x40], r12d
test rsi, rsi
je 0x14001ed3d
mov dword [rsi], r12d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x14001edce
mov ecx, edi
call fcn.140027a58
mov rbx, rax
test rax, rax
je 0x14001edce
mov r9, rax
lea rcx, [rsp + 0x60]
mov r8d, edi
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14001edc1
lea r9, [rsp + 0x50]
mov qword [rsp + 0x48], r12
lea r8, [rsp + 0x48]
mov rcx, rbx
lea rdx, [0x1401330f4]
call sub.VERSION.dll_VerQueryValueW
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
mov ebp, ecx
mov edx, dword [rax + 0xc]
and ebp, 0xffff0000
movzx eax, cx
or ebp, eax
test rsi, rsi
je 0x14001edc1
mov ecx, edx
movzx eax, dx
and ecx, 0xffff0000
or ecx, eax
mov dword [rsi], ecx
mov edx, 1
mov rcx, rbx
call fcn.1400277b4
test r15b, r15b
je 0x14001ee30
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x60]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, 0xffffffffffffffff
jne 0x14001ee1a
cmp eax, 0xb7
je 0x14001ee1a
cmp eax, 0x20
jne 0x14001ee30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.14001e940
mov eax, ebp
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140027790
add rsp, 0x6a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret