Function at 0x140001b0c
Capabilities:
Check if file exists
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and dword [rbp + 0x30], 0
mov r14, rdx
lea rdx, [rbp + 0x30]
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140001bdb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140001bba
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001bba
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140001bba
mov dword [rbp + 0x38], eax
lea rdx, [0x140008e66]
lea rax, [0x1400085c8]
mov dword [rbp - 0x20], 0x18
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x140001bc8
mov ebx, 0x8000ffff
jmp 0x140001dc5
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140001dc5
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140001c7e
cmp dword [section..data], 2
mov ebx, 0x8007000e
jbe 0x140001dc5
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001dc5
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140001dc5
lea rcx, [rbp + 0x38]
mov dword [rbp + 0x38], ebx
mov qword [rsp + 0x30], rcx
lea rax, [0x1400085c8]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1b
mov qword [rsp + 0x28], rcx
lea rdx, [0x140008e16]
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.140001008
jmp 0x140001dc5
mov r9, rsi
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x140001cee
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140001d89
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001d89
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140001d89
mov dword [rbp - 0x20], 0x22
lea rdx, [0x140008e66]
jmp 0x140001d5b
lea r9, [rbp - 0x1c]
mov rcx, rsi
lea r8, [rbp - 0x10]
lea rdx, [0x140008560]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140001da4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140001d89
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140001d89
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140001d89
mov dword [rbp - 0x20], 0x26
lea rdx, [0x140008e66]
lea rax, [0x1400085c8]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x38], edi
call fcn.140001008
test edi, edi
jne 0x140001d94
mov ebx, 0x8000ffff
jmp 0x140001dbd
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140001dbd
mov rcx, qword [rbp - 0x10]
xor ebx, ebx
mov eax, dword [rcx + 8]
mov dword [rbp + 0x3c], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp + 0x38], eax
mov rax, qword [rbp + 0x38]
mov qword [r14], rax
mov rcx, rsi
call fcn.140005f94
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret