Function at 0x1800198a0
Capabilities:
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x238]
sub rsp, 0x338
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov qword [rsp + 0x38], r9
mov r13, rdx
mov r12, rcx
mov qword [rbp + 0xc0], r8
test rdx, rdx
je 0x180019eed
test r8, r8
je 0x180019eed
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0xe4]
call fcn.180211600
mov dword [rbp + 0xe0], 0x114
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea r8, [rbp + 0xb8]
lea rdx, str.kernel32.dll
mov ecx, 2
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
xorps xmm0, xmm0
mov edi, eax
movdqu xmmword [rbp + 0xc8], xmm0
xor esi, esi
mov r14d, esi
mov qword [rbp + 0xd8], rsi
mov eax, esi
mov ebx, esi
test rdi, rdi
je 0x1800199c2
cmp rdi, 0x1000
jb 0x180019989
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x180019f18
call fcn.18007b16c
test rax, rax
je 0x180019f12
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180019994
mov rcx, rdi
call fcn.18007b16c
mov rbx, rax
mov r15, rbx
mov qword [rbp + 0xc8], rbx
lea r14, [rbx + rdi]
mov qword [rbp + 0xd8], r14
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.180211600
mov qword [rbp + 0xd0], r14
mov rax, r14
jmp 0x1800199c9
mov r15, qword [rbp + 0xc8]
sub rax, rbx
mov qword [rsp + 0x20], r15
mov r9d, eax
mov r8d, dword [rbp + 0xb8]
lea rdx, str.kernel32.dll
mov ecx, 2
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
mov qword [rbp + 0xa0], rsi
mov dword [rbp + 0xbc], esi
lea r9, [rbp + 0xbc]
lea r8, [rbp + 0xa0]
lea rdx, [0x1803124c0]
mov rcx, r15
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rbx, qword [rbp + 0xa0]
mov qword [rbp + 0xa8], rbx
movzx edx, word [rbx + 0xc]
lea rcx, [rbp + 0x80]
call fcn.180017330
mov rsi, rax
movzx edx, word [rbx + 0xe]
lea rcx, [rbp + 0x60]
call fcn.180017330
mov rdi, rax
movzx edx, word [rbx + 8]
lea rcx, [rbp + 0x40]
call fcn.180017330
mov rbx, rax
mov rax, qword [rbp + 0xa8]
movzx edx, word [rax + 0xa]
lea rcx, [rbp + 0x20]
call fcn.180017330
nop
mov r9d, 4
lea r8, [0x1803127a0]
xor edx, edx
mov rcx, rax
call fcn.18000a090
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1803121ec]
lea rcx, [rsp + 0x40]
call fcn.180005430
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rbx
lea r8, [rbp - 0x60]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp]
call fcn.180016e20
nop
mov r8d, 1
lea rdx, [0x1803121ec]
lea rcx, [rbp]
call fcn.180005430
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r9, rdi
lea r8, [rbp - 0x80]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.180016e20
nop
lea r8d, [rbx + 1]
lea rdx, [0x1803121ec]
lea rcx, [rbp - 0x20]
call fcn.180005430
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r9, rsi
lea r8, [rsp + 0x60]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.180016e20
lea rcx, [rbp - 0x40]
call fcn.180005250
nop
lea rcx, [rsp + 0x60]
call fcn.180005250
nop
lea rcx, [rbp - 0x20]
call fcn.180005250
nop
lea rcx, [rbp - 0x80]
call fcn.180005250
nop
lea rcx, [rbp]
call fcn.180005250
nop
lea rcx, [rbp - 0x60]
call fcn.180005250
nop
lea rcx, [rsp + 0x40]
call fcn.180005250
nop
lea rcx, [rbp + 0x20]
call fcn.180005250
nop
lea rcx, [rbp + 0x40]
call fcn.180005250
nop
lea rcx, [rbp + 0x60]
call fcn.180005250
nop
lea rcx, [rbp + 0x80]
call fcn.180005250
mov rsi, qword [rbp + 0xa8]
movzx eax, word [rsi + 0xe]
mov ecx, 0x47ba
cmp ax, cx
jb 0x180019e1b
lea rcx, str.gdi32full.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtGdiDdDDIReclaimAllocations2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtGdiGetCOPPCompatibleOPMInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rdi, rdi
jne 0x180019cde
test rax, rax
jne 0x180019cde
mov qword [rsp + 0x50], rdi
lea r8d, [rax + 0x6e]
lea rdx, str.____Failed_to_get_export_gdi32full.NtGdiDdDDIReclaimAllocations2___win32u.NtGdiGetCOPPCompatibleOPMInformation
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x40]
call fcn.1800052d0
lea rcx, [rsp + 0x40]
call fcn.180005250
xor bl, bl
test r15, r15
je 0x180019cd6
sub r14, r15
mov rax, r15
cmp r14, 0x1000
jb 0x180019ccb
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019f12
mov rdx, r14
mov rcx, r15
call fcn.18007b164
movzx eax, bl
jmp 0x180019eef
xor eax, eax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x200], 0xb848
mov dword [rbp + 0x208], 0xe0ff0000
mov qword [rbp + 0xb0], rax
lea rdx, [rbp + 0xa8]
mov rcx, r12
test rdi, rdi
je 0x180019d87
lea r8, [rbp + 0xb0]
call fcn.180018670
test al, al
je 0x180019c9c
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rsi, qword [rbp + 0xa8]
mov rdx, rsi
mov rcx, r12
call fcn.180017be0
test al, al
je 0x180019c9c
mov rbx, rdi
mov r8d, 0x40
mov rdx, qword [rbp + 0x2a0]
mov rcx, qword [rsp + 0x38]
call rbx
mov r9d, 8
lea r8, [rbp + 0xb0]
mov rdx, rsi
mov byte [r13], al
mov rcx, r12
call fcn.180017be0
mov bl, 1
jmp 0x180019c9e
mov eax, 0x4a61
cmp word [rsi + 0xe], ax
setae r9b
lea r8, [rbp + 0x210]
call fcn.1800187f0
test al, al
je 0x180019c9c
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x202], rax
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rbp + 0x200]
mov rsi, qword [rbp + 0xa8]
mov rdx, rsi
mov rcx, r12
call fcn.180017be0
test al, al
je 0x180019c9c
test rdi, rdi
cmovne rbx, rdi
mov r8d, 0x40
mov rdx, qword [rbp + 0x2a0]
mov rcx, qword [rsp + 0x38]
call rbx
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rbp + 0x210]
mov rdx, rsi
mov byte [r13], al
mov rcx, r12
call fcn.180017be0
mov bl, 1
jmp 0x180019c9e
mov ecx, 0x42ee
cmp ax, cx
jb 0x180019c9c
lea rcx, str.gdi32full.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtGdiDdDDIReclaimAllocations2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x180019e63
mov qword [rsp + 0x50], rbx
lea r8d, [rax + 0x40]
lea rdx, str.____Failed_to_get_export_gdi32full.NtGdiDdDDIReclaimAllocations2
jmp 0x180019c7a
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xa8], rbx
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0xb0]
mov rcx, r12
call fcn.180018670
test al, al
je 0x180019c9c
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rbx, qword [rbp + 0xb0]
mov rdx, rbx
mov rcx, r12
call fcn.180017be0
test al, al
je 0x180019c9c
mov r8d, 0x40
mov rdx, qword [rbp + 0x2a0]
mov rcx, qword [rsp + 0x38]
call rdi
mov r9d, 8
lea r8, [rbp + 0xa8]
mov rdx, rbx
mov byte [r13], al
mov rcx, r12
call fcn.180017be0
mov bl, 1
jmp 0x180019c9e
xor al, al
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x338
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18021e9c0
int3
call fcn.180002140
int3