Function at 0x140002e60
Capabilities:
Access pe header
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x580], rax
movzx edx, word [0x14000d980]
lea rax, [rsp + 0x60]
xor ebx, ebx
mov byte [rsp + 0x40], cl
xor r12b, r12b
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x48], rbx
mov r13d, ebx
mov esi, ebx
test dx, dx
je 0x140002ee0
lea rcx, [0x14000d980]
lea rdi, [rsp + 0x60]
sub rcx, rdi
nop
mov word [rax], dx
add rax, 2
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140002ed0
mov word [rax], bx
lea rax, [rsp + 0x60]
cmp word [rsp + 0x60], bx
je 0x140002ef9
nop
add rax, 2
cmp word [rax], bx
jne 0x140002ef0
lea rdx, str.ntkrnlmp.exe
mov ecx, 0x6e
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002f10
lea rdx, [rsp + 0x58]
mov word [rax], bx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], ebx
mov r14d, ebx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r15d, eax
test eax, eax
je 0x140003374
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r15d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003374
mov r9, rax
lea rcx, [rsp + 0x60]
mov r8d, r15d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140002fbf
lea r9, [rsp + 0x5c]
mov rcx, rdi
lea r8, [rsp + 0x50]
lea rdx, [0x14000a138]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov r14d, eax
test eax, eax
je 0x140002fbf
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + 8]
mov ebx, ecx
mov eax, dword [rdx + 0xc]
mov esi, eax
shr ebx, 0x10
shr esi, 0x10
movzx r13d, cx
movzx r15d, ax
jmp 0x140002fc4
mov r15d, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
je 0x140003374
xor eax, eax
lea rdi, [rbp + 0x370]
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov dword [rsp + 0x38], r15d
lea r9, str.Patch:_Ntoskrnl_version:__lu._lu._lu._lu_n
mov edx, 0x104
mov dword [rsp + 0x30], esi
mov r8d, edx
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x370]
mov dword [rsp + 0x20], ebx
call rdi
lea rdx, [rbp + 0x370]
call fcn.140002d10
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140007480
mov rbx, rax
test rax, rax
je 0x140003363
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r14, rax
call fcn.140005da0
mov r15d, eax
cmp al, 1
je 0x140003086
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.Cannot_load_symbols_for_the_ntoskrnl__signatures_now_used
call fcn.140007010
mov r9, qword [rsp + 0x48]
lea rax, [0x14000dc40]
mov qword [rsp + 0x28], rax
mov r8, rbx
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.1400069a0
test al, al
je 0x140003306
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000dc40]
lea r9, str.___SeValidateImageData_t_t_08llX
mov edx, 0x208
mov qword [rsp + 0x20], rax
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
lea rax, [0x14000dc20]
mov r8, rbx
mov qword [rsp + 0x28], rax
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.1400066e0
test al, al
je 0x1400032fd
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000dc20]
lea r9, str.___CcInitializeBcbProfiler_t_08llX
mov edx, 0x208
mov qword [rsp + 0x20], rax
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
cmp byte [rsp + 0x40], 0
mov r8, rbx
mov ecx, esi
je 0x140003232
lea rax, [0x14000dc00]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.1400064b0
test al, al
je 0x140003226
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000dc00]
lea r9, str.___KiFilterFiberContext_t_t_08llX
mov qword [rsp + 0x20], rax
mov edx, 0x208
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
lea rax, [0x14000dbe0]
mov r8, rbx
mov qword [rsp + 0x28], rax
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.140006d10
test al, al
je 0x1400032eb
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000dbe0]
lea r9, str.___SepInitializeCodeIntegrity_t_08llX
mov edx, 0x208
mov qword [rsp + 0x20], rax
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
mov r12b, 1
jmp 0x140003317
lea rdx, str.Cannot_query_KiFilterFiberContext_offset
jmp 0x14000330d
lea rax, [0x14000dba0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.1400060c0
test al, al
je 0x1400032f4
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000dba0]
lea r9, str.___KeInitAmd64SpecificState_t_08llX
mov edx, 0x208
mov qword [rsp + 0x20], rax
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
cmp esi, 0x1db1
jbe 0x1400031bc
lea rax, [0x14000dbc0]
mov r8, rbx
mov qword [rsp + 0x28], rax
mov ecx, esi
mov qword [rsp + 0x20], r14
call fcn.1400062a0
test al, al
je 0x1400032e2
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000dbc0]
lea r9, str.___ExpLicenseWatchInitWorker_t_08llX
mov qword [rsp + 0x20], rax
jmp 0x1400031a0
lea rdx, str.Cannot_query_ExpLicenseWatchInitWorker_offset
jmp 0x14000330d
lea rdx, str.Cannot_query_SepInitializeCodeIntegrity_offset
jmp 0x14000330d
lea rdx, str.Cannot_query_KeInitAmd64SpecificState_offset
jmp 0x14000330d
lea rdx, str.Cannot_query_CcInitializeBcbProfiler_offset
jmp 0x14000330d
lea rdx, str.Cannot_query_SeValidateImageData_offset
mov ecx, 0x3eb
call fcn.140007010
test r15b, r15b
je 0x140003351
mov rdi, qword [0x14000d918]
mov rcx, rdi
call qword [0x1400092d8]
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call rdi
mov rdi, qword [0x14000d8f8]
mov rcx, rdi
call qword [0x1400092d8]
mov rcx, 0xffffffffffffffff
call rdi
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x140003385
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.Cannot_map_ntos_file
jmp 0x140003380
lea rdx, str.Cannot_query_ntoskrnl_version_information
mov ecx, 0x309
call fcn.140007010
movzx eax, r12b
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1400081d0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret