Function at 0x1400e6a90
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0xe8], rbx
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rbp - 0x45], r15d
lea rdx, [rbp - 0x45]
mov rcx, qword [rcx]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test eax, eax
je 0x1400e6db7
mov ecx, ebx
call fcn.140172464
mov r13, rax
test rax, rax
je 0x1400e6db7
mov r9, rax
mov r8d, ebx
mov edx, dword [rbp - 0x45]
mov rcx, qword [rdi]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400e6daf
cmp dword [reloc.WS2_32.dll_accept], r15d
je 0x1400e6b9c
mov dword [rbp - 0x41], r15d
mov dword [rbp - 0x3d], r15d
mov dword [rbp + 0x7f], r15d
mov edi, r15d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400e6b95
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e6b69
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x3d]
lea rcx, [rbp - 0x41]
call rax
movzx eax, word [rbp + 0x7f]
mov dword [rbp + 0x7f], eax
lea edi, [r15 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x1400e6b95
mov eax, dword [rbp - 0x41]
cmp eax, 6
jne 0x1400e6b86
cmp dword [rbp - 0x3d], 4
je 0x1400e6b8b
jmp 0x1400e6b95
cmp eax, 0xa
jb 0x1400e6b95
mov dword [0x1403d88e0], 1
mov dword [reloc.WS2_32.dll_accept], r15d
cmp dword [0x1403d88e0], esi
je 0x1400e6d5a
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x1400e6c81
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e6c7a
xor ecx, ecx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rcx
mov qword [rbp + 7], rcx
mov qword [rbp + 0xf], rcx
mov qword [rbp + 0x17], rcx
lea rcx, [rbp - 0x11]
call rax
mov rax, qword [rbp - 0x11]
cmp ax, 0xc
ja 0x1400e6c1a
mov ecx, 0x1240
bt ecx, eax
jae 0x1400e6c1a
mov dword [0x1403d88dc], 1
jmp 0x1400e6c7a
mov word [rbp + 0x77], r15w
mov word [rbp + 0x67], r15w
lea rcx, [0x1403026e0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400e6c71
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x67]
lea rdx, [rbp + 0x77]
call rbx
test eax, eax
je 0x1400e6c71
mov ecx, 0xaa64
mov eax, r15d
cmp word [rbp + 0x67], cx
sete al
jmp 0x1400e6c74
mov eax, r15d
mov dword [0x1403d88dc], eax
mov dword [reloc.WS2_32.dll_accept], r15d
cmp dword [0x1403d88dc], esi
jne 0x1400e6d5a
mov dword [rbp - 0x49], r15d
lea r9, [rbp - 0x49]
lea r8, [rbp - 0x19]
lea rdx, str.VarFileInfoTranslation
mov rcx, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e6d5a
mov rdi, r15
mov eax, dword [rbp - 0x49]
test rax, 0xfffffffffffffffc
jbe 0x1400e6d5a
mov r12d, 0xffffffff
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400e6f58
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rbp - 0x31], rax
mov rax, qword [rbp - 0x19]
movzx r9d, word [rax + rdi*4 + 2]
movzx r8d, word [rax + rdi*4]
lea rdx, str.StringFileInfo_04x_04xFileVersion
lea rcx, [rbp - 0x31]
call fcn.14000b080
mov qword [rbp - 0x29], r15
mov dword [rbp - 0x39], r15d
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x29]
mov rbx, qword [rbp - 0x31]
mov rdx, rbx
mov rcx, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400e6dd4
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e6d47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc rdi
mov eax, dword [rbp - 0x49]
shr rax, 2
cmp rdi, rax
jb 0x1400e6cc8
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x35], r15d
lea r9, [rbp - 0x35]
lea r8, [rbp - 0x21]
lea rdx, [0x1402fa70c]
mov rcx, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e6daf
mov rdx, qword [rbp - 0x21]
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x1402fa710]
mov rcx, r14
call fcn.14000b080
mov esi, 1
mov rcx, r13
call fcn.140171af0
mov eax, esi
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, dword [rbp - 0x39]
mov rdx, qword [rbp - 0x29]
mov rcx, r14
call fcn.140010860
xor r15b, r15b
mov rdx, qword [r14]
movsxd rdi, dword [rdx - 0x10]
xor eax, eax
test edi, edi
jle 0x1400e6e7d
lea r8d, [rax + 0x2e]
nop dword [rax]
cdqe
lea rsi, [rax + rax]
cmp word [rsi + rdx], 0x2c
jne 0x1400e6e49
test r15b, r15b
jne 0x1400e6e44
mov r15b, 1
test edi, edi
js 0x1400e6f63
mov rdx, qword [r14]
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400e6e44
mov edx, edi
mov rcx, r14
call fcn.14000bdf0
mov rdx, qword [r14]
mov r8d, 0x2e
mov word [rsi + rdx], r8w
lea rax, [rsi + 2]
sar rax, 1
cmp eax, edi
jl 0x1400e6e00
test r15b, r15b
je 0x1400e6e7d
test edi, edi
js 0x1400e6f6e
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x1400e6f6e
mov dword [rax - 0x10], edi
mov rax, qword [r14]
xor r15d, r15d
mov word [rax + rdi*2], r15w
jmp 0x1400e6e80
xor r15d, r15d
mov rax, qword [r14]
movsxd rdi, dword [rax - 0x10]
test edi, edi
js 0x1400e6f79
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400e6ead
mov edx, edi
mov rcx, r14
call fcn.14000bdf0
mov rax, qword [r14]
mov rdx, rax
lea r11, [rax + rdi*2]
cmp rax, r11
jae 0x1400e6efa
nop dword [rax]
lea r10, [rax + 2]
cmp word [rax], 0x20
je 0x1400e6ef2
lea r9, [rdx + 2]
mov r8, r15
cmp rdx, r9
je 0x1400e6ef2
cmp r8, 1
jae 0x1400e6ef2
movzx ecx, word [rax]
mov word [rdx], cx
add rax, 2
add rdx, 2
inc r8
cmp rdx, r9
jne 0x1400e6ed6
mov rax, r10
cmp r10, r11
jb 0x1400e6ec0
mov word [rdx], r15w
sub rax, rdx
sar rax, 1
sub edi, eax
js 0x1400e6f4d
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x1400e6f4d
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [r14]
mov word [rax + rcx*2], r15w
mov esi, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
sub r12d, esi
jg 0x1400e6f3b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r14]
cmp dword [rax - 0x10], 0
jne 0x1400e6daf
jmp 0x1400e6d5a
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3