Function at 0x140111930
Capabilities:
Get file version info

Disassembly:
push rbx
push r13
sub rsp, 0x58
mov r8d, dword [0x140190f84]
mov rbx, rcx
mov ecx, dword [0x140190f88]
movzx r9d, word [0x140191094]
mov edx, dword [0x140190f8c]
movdqa xmm0, xmmword [0x14016aff0]
movq rax, xmm0
movups xmmword [rbx + 0xc], xmm0
mov dword [rbx + 0x1c], eax
mov word [rbx + 0x20], ax
mov word [rbx], r8w
mov word [rbx + 2], cx
mov word [rbx + 4], r9w
mov word [rbx + 6], 0xffff
cmp r8d, 6
jne 0x140111b8d
cmp ecx, 1
jne 0x1401119c1
mov dword [rbx + 8], 0x3d
cmp r9d, ecx
ja 0x140111be3
mov ecx, 0x10
mov dword [rbx + 0xc], 0x2000014
mov word [rbx + 0x16], cx
xor eax, eax
mov dword [rbx + 0x1a], 0x280010
add rsp, 0x58
pop r13
pop rbx
ret
cmp ecx, 2
jne 0x140111a04
mov eax, 0x23f0
cmp edx, eax
jne 0x140111be3
mov word [rbx + 6], ax
xor eax, eax
mov dword [rbx + 8], 0x3e
mov dword [rbx + 0xc], 0x4080014
mov dword [rbx + 0x16], 0x300010
mov dword [rbx + 0x1e], 0x140013
mov dword [rbx + 0x1a], 0x280010
add rsp, 0x58
pop r13
pop rbx
ret
cmp ecx, 3
jne 0x140111be3
mov r13d, 0x2580
cmp edx, r13d
jne 0x140111be3
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetKernelFileName
mov rcx, rax
mov rsi, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetFileName
mov r15, rax
mov edi, 0xffffffff
test rsi, rsi
je 0x140111a6e
lea rcx, [rsi - 0x10]
mov edx, edi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140111a6e
call fcn.1400d9400
mov r12, qword [r15 + 8]
lea rdx, [rsp + 0x78]
mov rcx, r12
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r14d, eax
test eax, eax
je 0x140111ac6
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8d, r14d
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, r14d
xor edx, edx
mov r9, rax
mov rcx, r12
mov rsi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x140111ac9
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, rbp
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], edi
mov r15, qword [rsp + 0x28]
cmp edi, 1
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
jne 0x140111af0
call fcn.1400d9400
test rsi, rsi
je 0x140111b28
lea r9, [rsp + 0x70]
mov rcx, rsi
lea r8, [rsp + 0x88]
lea rdx, [0x14013eb1c]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140111b28
cmp dword [rsp + 0x70], ebp
je 0x140111b28
mov rax, qword [rsp + 0x88]
movzx ebp, word [rax + 0xc]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x48]
cmp ebp, 0x4548
mov rbp, qword [rsp + 0x50]
mov eax, 0x10
mov edx, 0x20
mov word [rbx + 6], r13w
cmovae ax, dx
mov dword [rbx + 8], 0x3f
mov word [rbx + 0x16], ax
xor eax, eax
mov dword [rbx + 0xc], 0x4080018
mov dword [rbx + 0x18], 0x100030
mov dword [rbx + 0x1c], 0x100028
mov word [rbx + 0x20], 0x11
add rsp, 0x58
pop r13
pop rbx
ret
cmp r8d, 0xa
jne 0x140111be3
test ecx, ecx
jne 0x140111be3
mov eax, 0x2800
cmp edx, eax
jne 0x140111ba9
mov dword [rbx + 8], 0x64
jmp 0x140111bb9
mov eax, 0x295a
cmp edx, eax
jne 0x140111be3
mov dword [rbx + 8], 0x65
mov word [rbx + 6], ax
xor eax, eax
mov dword [rbx + 0x1e], 0x110010
mov dword [rbx + 0x16], 0x300020
mov dword [rbx + 0xc], 0x4180018
mov dword [rbx + 0x1a], 0x280010
add rsp, 0x58
pop r13
pop rbx
ret
mov eax, 0xc00000bb
add rsp, 0x58
pop r13
pop rbx
ret