Function at 0x14006752b
Capabilities:
Get file version info

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
xor r8d, r8d
xor r9d, r9d
mov rdi, rcx
xor ecx, ecx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x40], ecx
mov rcx, qword [rdi + 0x160]
cmp qword [0x1401eab48], rcx
mov dword [rsp + 0x44], r9d
jne 0x140067570
mov edx, edx
lea rax, [0x1401eab40]
mov eax, dword [rax + rdx*4]
jmp 0x140067803
cmp dword [rdi + 0x1a0], 0
mov qword [0x1401eab48], rcx
movzx ebp, cx
je 0x1400675a0
cmp ebp, 0x404
jne 0x1400675a0
mov qword [0x1401eab40], 0x7000404
mov eax, 0x7000404
jmp 0x140067803
mov eax, 0xe0080404
cmp rcx, rax
je 0x1400675eb
add rax, 0x10000
cmp rcx, rax
je 0x1400675eb
add rax, 0x10000
cmp rcx, rax
setne dl
add rax, 0x10000
cmp rcx, rax
setne al
test dl, al
je 0x1400675eb
mov eax, 0xe00e0804
cmp rcx, rax
je 0x1400675eb
xor eax, eax
mov qword [0x1401eab40], rax
xor eax, eax
jmp 0x140067803
lea rbx, [rsp + 0x50]
mov r8d, 0xff
mov rdx, rbx
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x1400675db
cmp qword [rdi + 0x170], 0
jne 0x1400675db
lea rax, str.TINTLGNT.IME
or r9d, 0xffffffff
mov r8, rbx
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
mov edx, 1
mov ecx, 0x409
mov rsi, qword [sym.imp.KERNEL32.dll_CompareStringA]
call rsi
cmp eax, 2
je 0x1400676fb
lea rax, str.CINTLGNT.IME
or r9d, 0xffffffff
mov r8, rbx
mov edx, 1
mov dword [rsp + 0x28], 0xffffffff
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call rsi
cmp eax, 2
je 0x1400676fb
lea rax, str.MSTCIPHA.IME
or r9d, 0xffffffff
mov r8, rbx
mov edx, 1
mov dword [rsp + 0x28], 0xffffffff
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call rsi
cmp eax, 2
je 0x1400676fb
lea rax, str.PINTLGNT.IME
or r9d, 0xffffffff
mov r8, rbx
mov edx, 1
mov dword [rsp + 0x28], 0xffffffff
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call rsi
cmp eax, 2
je 0x1400676fb
lea rax, str.MSSCIPYA.IME
or r9d, 0xffffffff
mov r8, rbx
mov edx, 1
mov dword [rsp + 0x28], 0xffffffff
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call rsi
cmp eax, 2
jne 0x1400675db
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x1400675db
mov ecx, eax
mov dword [rsp + 0x3c], eax
call fcn.1400413db
mov rsi, rax
test rax, rax
je 0x1400677f6
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov r9, rax
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1400677f6
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x48]
mov rcx, rsi
lea rdx, [0x1401a3f93]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1400677f6
mov rcx, qword [rsp + 0x48]
mov edx, dword [rcx + 8]
mov eax, edx
shl edx, 0x10
shl eax, 8
and edx, 0xff0000
and eax, 0xff000000
or eax, edx
cmp qword [rdi + 0x170], 0
jne 0x1400677d5
cmp ebp, 0x404
jne 0x1400677c0
mov edx, eax
and edx, 0xfffeffff
cmp edx, 0x4020000
je 0x1400677d5
cmp eax, 0x4040000
je 0x1400677d5
cmp edx, 0x5000000
je 0x1400677d5
cmp eax, 0x5020000
je 0x1400677d5
cmp eax, 0x6000000
jmp 0x1400677d3
lea edx, [rax - 0x4010000]
and edx, 0xfffe0000
je 0x1400677d5
cmp eax, 0x5030000
jne 0x1400677f6
or ebp, eax
mov eax, dword [rcx + 0xc]
mov rcx, rsi
mov dword [0x1401eab40], ebp
mov dword [0x1401eab44], eax
call fcn.14004149f
mov eax, dword [0x1401eab40]
jmp 0x140067803
mov rcx, rsi
call fcn.14004149f
jmp 0x1400675db
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret