Function at 0x140028bf0
Capabilities:
Get file version info
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x200
xor r14b, r14b
call fcn.14003aa80
lea rcx, [rbp + 0x150]
sub rcx, rbx
nop dword [rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140028c30
lea rdx, str..inf
lea rcx, [rbp + 0x150]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x140028c61
mov word [rax + 1], 0x7973
mov byte [rax + 3], 0x73
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.14003aa80
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str._SYSTEMROOT_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [rsp + 0x50]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140028c93
movzx eax, word [0x140095490]
movups xmm0, xmmword [str.System32drivers_]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
movzx eax, byte [0x140095492]
mov byte [rcx + 0x12], al
lea rcx, [rsp + 0x50]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140028cc4
xor edx, edx
movzx eax, byte [rdi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140028cd0
lea rcx, [rsp + 0x50]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140028cf0
mov eax, dword [str..sys]
xor esi, esi
mov dword [rcx], eax
xor edx, edx
movzx eax, byte [0x140095498]
mov byte [rcx + 4], al
lea rcx, [rbp + 0x150]
mov qword [rbp + 0x3a8], rsi
mov qword [rsp + 0x48], rsi
mov dword [rbp + 0x390], esi
mov dword [rbp + 0x3a0], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
xor edx, edx
mov edi, eax
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test edi, edi
je 0x140028f65
test eax, eax
je 0x140028f65
mov qword [rsp + 0x498], r12
mov ecx, edi
mov qword [rsp + 0x450], r15
call fcn.1400394b4
mov ecx, ebx
mov r12, rax
call fcn.1400394b4
mov r15, rax
test r12, r12
je 0x140028f36
test rax, rax
je 0x140028f2e
mov r9, r12
lea rcx, [rbp + 0x150]
mov r8d, edi
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x140028f2e
mov r9, r15
lea rcx, [rsp + 0x50]
mov r8d, ebx
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x140028f2e
lea r9, [rbp + 0x390]
mov rcx, r12
lea r8, [rbp + 0x3a8]
lea rdx, [0x14008daac]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x140028f2e
lea r9, [rbp + 0x3a0]
mov rcx, r15
lea r8, [rsp + 0x48]
lea rdx, [0x14008daac]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x140028f2e
mov rcx, qword [rbp + 0x3a8]
test rcx, rcx
je 0x140028f2e
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140028f2e
mov eax, dword [rdx + 0x10]
cmp dword [rcx + 0x10], eax
jne 0x140028f2e
mov eax, dword [rdx + 0x14]
cmp dword [rcx + 0x14], eax
jne 0x140028f2e
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], esi
lea rcx, [rbp + 0x150]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov qword [rsp + 0x458], r13
xor ebx, ebx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140028f26
xor eax, eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
mov rcx, r13
mov esi, eax
cmovne rbx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140028f26
xor eax, eax
lea r8d, [rdi + 1]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140028f26
xor eax, eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
mov rcx, r13
mov esi, eax
cmovne rdi, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140028f26
cmp rbx, rdi
movzx r14d, r14b
mov eax, 1
cmove r14d, eax
mov r13, qword [rsp + 0x458]
mov rcx, r12
call fcn.1400394bc
mov r12, qword [rsp + 0x498]
test r15, r15
je 0x140028f4b
mov rcx, r15
call fcn.1400394bc
mov r15, qword [rsp + 0x450]
movzx eax, r14b
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, r14b
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret