Function at 0x140001000
Capabilities:
Get file version info
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor esi, esi
mov rbx, rcx
cmp word [rcx], 0x25
jne 0x140001047
mov r8d, 0x104
lea rdx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14000117d
mov r8, rbx
lea rcx, [rbp - 0x30]
mov edx, 0x104
call fcn.1400093f0
mov r8d, 9
lea rdx, str.system32_
mov rcx, rbx
call fcn.14000bc8c
test eax, eax
jne 0x140001097
lea r8, str.SystemRoot_
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.1400093f0
mov r8, rbx
lea rcx, [rbp - 0x30]
mov edx, 0x104
call fcn.14000ccf4
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], esi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rsi
lea r9, [rsp + 0x78]
mov dword [rsp + 0x40], 0x120
lea r8, [rbp - 0x68]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80100000
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x68], 0x30
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x58], rax
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x140001384
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x30]
xor r9d, r9d
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x140001142
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001384
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 4
lea rdx, [0x1400238a8]
lea rcx, [rbp - 0x30]
call fcn.14000bc8c
test eax, eax
lea rcx, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov edx, 0x104
cmovne r8, rcx
lea rcx, [rbp + 0x1e0]
call fcn.1400093f0
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x528], rdi
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
jne 0x1400011b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_getting_version_info_size:__lu_n
call fcn.140005730
jmp 0x14000137c
mov rcx, rdi
call fcn.14000bc70
mov rbx, rax
test rax, rax
jne 0x1400011d7
lea rcx, str.Memory_allocation_error_n
call fcn.140005730
jmp 0x14000137c
mov edx, dword [rsp + 0x70]
lea rcx, [rbp + 0x1e0]
mov r9, rbx
mov r8d, edi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x140001213
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_getting_version_info:__lu_n
call fcn.140005730
mov rcx, rbx
call fcn.14000bc78
jmp 0x14000137c
lea r9, [rsp + 0x74]
mov rcx, rbx
lea r8, [rbp - 0x78]
lea rdx, [0x140023924]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x140001251
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_querying_version_value:__lu_n
call fcn.140005730
mov rcx, rbx
call fcn.14000bc78
jmp 0x14000137c
lea r9, [rsp + 0x60]
mov rcx, rbx
lea r8, [rsp + 0x68]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x140001290
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_querying_translation_info:__lu_n
call fcn.140005730
mov rcx, rbx
call fcn.14000bc78
jmp 0x14000137c
mov rax, qword [rsp + 0x68]
lea r8, str.StringFileInfo_04x_04xCompanyName
mov edx, 0x32
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rbp - 0x68]
call fcn.1400056d0
lea r9, [rsp + 0x74]
mov rcx, rbx
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x1400012f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_querying_company_name:__lu_n
call fcn.140005730
mov rcx, rbx
call fcn.14000bc78
jmp 0x14000137c
mov rcx, rbx
call fcn.14000bc78
mov rcx, qword [rsp + 0x78]
call fcn.14000be60
mov rdi, rax
test rax, rax
je 0x14000137c
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], sil
jne 0x140001313
test rcx, rcx
je 0x14000137c
mov rcx, rdi
call fcn.14000c0dc
mov rax, qword [str.gen_digital]
test rax, rax
je 0x14000137c
mov qword [rsp + 0x530], r14
mov rbx, rsi
lea r14, str.gen_digital
nop word [rax + rax]
mov rdx, rax
mov rcx, rdi
call fcn.1400064e0
test rax, rax
jne 0x14000136f
mov rax, qword [r14 + rbx*8 + 8]
inc rbx
test rax, rax
jne 0x140001350
jmp 0x140001374
mov esi, 1
mov r14, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x528]
mov eax, esi
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400057b0
add rsp, 0x500
pop rsi
pop rbx
pop rbp
ret