Function at 0x14000df50
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r9
mov r13, r8
mov r12, rdx
mov r14, rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x38], rax
lea rdx, str.Version.dll
lea rcx, [rsp + 0x40]
call fcn.140001ed4
nop
call fcn.140014280
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.140014350
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140001dd0
test rbx, rbx
je 0x14000e1bf
lea rdx, str.VerQueryValueW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
je 0x14000e1bf
xor sil, sil
lea rdx, str.Version.dll
lea rcx, [rsp + 0x40]
call fcn.140001ed4
nop
call fcn.140014280
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.140014350
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140001dd0
test rbx, rbx
je 0x14000e1b9
lea rdx, str.GetFileVersionInfoExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.GetFileVersionInfoSizeExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test r15, r15
je 0x14000e0c8
test rax, rax
je 0x14000e0c8
mov dword [rsp + 0x70], 0
mov rcx, r14
call fcn.140001ccc
mov rdx, rax
lea r8, [rsp + 0x70]
xor ecx, ecx
call r9
mov edi, eax
test eax, eax
je 0x14000e1b9
mov edx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
mov rcx, r14
call fcn.140001ccc
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8d, dword [rsp + 0x70]
xor ecx, ecx
call r15
test eax, eax
jne 0x14000e144
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, sil
jmp 0x14000e1c1
lea rdx, str.GetFileVersionInfoW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.GetFileVersionInfoSizeW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test r15, r15
je 0x14000e1b9
test rax, rax
je 0x14000e1b9
mov rcx, r14
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call r8
mov edi, eax
test eax, eax
je 0x14000e1b9
mov edx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
mov rcx, r14
call fcn.140001ccc
mov rcx, rax
mov r9, rbx
mov r8d, edi
xor edx, edx
call r15
test eax, eax
je 0x14000e1b0
test rbx, rbx
je 0x14000e1b9
xor eax, eax
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x68]
lea rdx, [0x140032e48]
mov rcx, rbx
call rbp
test eax, eax
je 0x14000e1b0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000e1b0
cmp dword [rsp + 0x74], 0
jbe 0x14000e1b0
cmp dword [rcx], 0xfeef04bd
jne 0x14000e1b0
movzx eax, word [rcx + 0xa]
mov dword [r12], eax
movzx eax, word [rcx + 8]
mov dword [r13], eax
movzx eax, word [rcx + 0xe]
mov rdx, qword [rsp + 0x30]
mov dword [rdx], eax
movzx eax, word [rcx + 0xc]
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov sil, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, sil
jmp 0x14000e1c1
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret