Function at 0x14010ef60
Capabilities:
Get file version info
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r13, r8
mov r14, rdx
mov qword [rbp - 0x30], rcx
mov qword [rsp + 0x78], rdx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rdx], rbx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], 7
mov word [rdx], bx
xor r8d, r8d
lea rdx, [0x1401c16d8]
mov rcx, r14
call fcn.140005060
mov dword [rsp + 0x30], 1
mov rcx, r13
call fcn.14010f5e0
mov r12d, eax
mov edx, eax
lea rcx, [rbp]
call fcn.14010ed30
nop
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov rdi, qword [rbp + 0x10]
lea rsi, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rsi, qword [rbp]
movabs rax, 0x7ffffffffffffffe
cmp rdi, 8
jae 0x14010f02c
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], 7
jmp 0x14010f067
mov rbx, rdi
or rbx, 7
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x38]
call fcn.140005370
mov qword [rsp + 0x38], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140151a90
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x38]
mov qword [rbp - 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x28]
call fcn.140006b00
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140104fc0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.WWAHost.exe
call fcn.14016d6c4
mov rdi, 0xffffffffffffffff
test eax, eax
je 0x14010f173
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.clr.exe
call fcn.14016d6c4
test eax, eax
je 0x14010f173
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.ApplicationFrameHost.exe
call fcn.14016d6c4
test eax, eax
je 0x14010f173
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x50]
call fcn.140152140
mov byte [rsp + 0x20], 0
mov r9d, 0x208
lea r8, [rbp + 0x50]
lea rdx, str.PackageRoot
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAppx
call fcn.140006ff0
test al, al
je 0x14010f16e
lea rax, [rbp + 0x50]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14010f140
test r8, r8
je 0x14010f16e
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
lea rdx, [rbp + 0x50]
call fcn.140173aa0
test eax, eax
je 0x14010f173
xor r15b, r15b
jmp 0x14010f176
mov r15b, 1
lea rcx, [rbp - 0x20]
call fcn.140004ff0
nop
lea rcx, [rsp + 0x38]
call fcn.140004ff0
test r15b, r15b
je 0x14010f1a6
mov edx, r12d
lea rcx, [rbp - 0x58]
call fcn.14010fdc0
nop
mov esi, 3
jmp 0x14010f235
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
mov rsi, qword [rbp + 0x10]
lea r12, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r12, qword [rbp]
cmp rsi, 8
jae 0x14010f1dd
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], 7
jmp 0x14010f21f
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x20]
call fcn.140005370
mov qword [rbp - 0x20], rax
lea r8, [rsi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.140151a90
mov qword [rbp - 8], rbx
xor ebx, ebx
mov qword [rbp - 0x10], rsi
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x78]
call fcn.140104fc0
mov esi, 5
mov dword [rsp + 0x30], esi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
test sil, 4
je 0x14010f26e
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x78]
call fcn.140004ff0
nop
test sil, 2
je 0x14010f284
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x58]
call fcn.140004ff0
mov rax, qword [r14 + 0x10]
test rax, rax
jne 0x14010f574
lea r8, [rbp + 0x28]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp - 0x30]
call fcn.14010ec10
mov rbx, rax
cmp r14, rax
je 0x14010f2d4
mov rcx, r14
call fcn.140004ff0
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea rcx, [rsp + 0x58]
call fcn.140004ff0
mov rax, qword [r14 + 0x10]
xor ebx, ebx
test rax, rax
jne 0x14010f574
test r15b, r15b
je 0x14010f32e
mov r8d, 0x104
lea rdx, [rbp + 0x50]
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rbp + 0x50]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14010f310
mov r8, rdi
lea rdx, [rbp + 0x50]
mov rcx, r14
call fcn.140005060
jmp 0x14010f574
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r15, qword [rbp + 0x10]
lea r12, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r12, qword [rbp]
cmp r15, 8
jae 0x14010f36a
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], 7
jmp 0x14010f3af
mov rbx, r15
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x38]
call fcn.140005370
mov qword [rsp + 0x38], rax
lea r8, [r15*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.140151a90
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x38]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bx
xor r8d, r8d
lea rdx, [0x1401c16d8]
lea rcx, [rsp + 0x58]
call fcn.140005060
or esi, 8
mov dword [rsp + 0x30], esi
lea r15, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r15, qword [rsp + 0x38]
mov dword [rbp - 0x28], ebx
lea rdx, [rbp - 0x28]
mov rcx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
test eax, eax
je 0x14010f521
mov ecx, r12d
call fcn.14014f93c
mov rbx, rax
mov r9, rax
mov r8d, r12d
mov edx, dword [rbp - 0x28]
mov rcx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14010f51f
xor eax, eax
mov dword [rbp + 0x20], eax
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x24], eax
lea r9, [rbp + 0x20]
lea r8, [rbp - 0x30]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rax, qword [rbp - 0x30]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04xProductName
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.140104f00
lea r9, [rbp - 0x24]
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14010f4bc
mov rdx, qword [rbp - 0x38]
nop word [rax + rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x14010f4b0
jmp 0x14010f50a
mov rax, qword [rbp - 0x30]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04xFileDescription
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.140104f00
lea r9, [rbp - 0x24]
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14010f517
mov rdx, qword [rbp - 0x38]
nop
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x14010f500
mov r8, rdi
lea rcx, [rsp + 0x58]
call fcn.140005060
mov rcx, rbx
call fcn.14014f59c
xor ebx, ebx
lea rcx, [rsp + 0x38]
call fcn.140004ff0
lea rax, [rsp + 0x58]
cmp r14, rax
je 0x14010f563
mov rcx, r14
call fcn.140004ff0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [r14 + 0x10], xmm1
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bx
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x58]
call fcn.140004ff0
cmp qword [r14 + 0x10], 0
jne 0x14010f59f
lea rax, [rbp + 0x28]
cmp r14, rax
je 0x14010f59f
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x38]
mov rcx, r14
call fcn.140005060
nop
lea rcx, [rbp + 0x28]
call fcn.140004ff0
nop
lea rcx, [rbp]
call fcn.140004ff0
mov rax, r14
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14014f2f0
mov rbx, qword [rsp + 0x3c8]
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret