Function at 0x140023ef4
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400a12e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r15b, cl
lea rdx, [rsp + 0x40]
mov edi, 0x105
xor ecx, ecx
mov r8d, edi
xor ebx, ebx
xor esi, esi
xor ebp, ebp
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
lea r12d, [rbx + 2]
test eax, eax
je 0x140023ff4
cmp eax, edi
je 0x140023ff4
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov ecx, r12d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140023ff4
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140023ff4
mov r9d, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov ecx, r12d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
nop dword [rax + rax]
test eax, eax
je 0x140023ff4
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x38]
lea rdx, [0x14007da44]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140023ff4
cmp dword [rsp + 0x30], 0x34
jb 0x140023ff4
mov rax, qword [rsp + 0x38]
movzx esi, word [rax + 0xa]
movzx ebp, word [rax + 8]
movzx r14d, word [rax + 0xe]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
mov ecx, r12d
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rdx, rax
lea rcx, str.Microsoft__R__Message_Compiler
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fputs]
nop dword [rax + rax]
test r15b, r15b
jne 0x140024048
mov ecx, r12d
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rcx, rax
mov dword [rsp + 0x20], r14d
mov r9d, ebp
lea rdx, str.__Version__u._u._04u
mov r8d, esi
call fcn.140051858
mov ecx, r12d
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rdx, rax
lea rcx, str._nCopyright__c__Microsoft_Corporation._All_rights_reserved._n_nUsage:_n_nMC____aAbcdnouUv____m__length_____h__path_____e__extension_____r__path___n_____x__path_____w__file_____W__file_____z__basename______cp__encoding___n_____km___um___generateProjections___cs__namespace___n_____mof____p__prefix_____P__prefix___n_____filename.man_____filename.mc___n_n______________________Displays_this_message._n____a_________________Indicates_that_the_input_.mc_file_is_CP_ACP__default_._n______________________Ignored_if_the_.mc_file_has_a_UTF_8_or_UTF_16LE_BOM._n____A_________________DEPRECATED._Encode_.BIN_messages_using_CP_ACP__ANSI_._n____b_________________.BIN_filename_should_have_.mc_filename_included_for_n______________________uniqueness._n____c_________________Sets_the_Customer_bit_in_all_of_the_message_IDs._n____d_________________FACILITY_and_SEVERITY_values_should_be_printed_as_decimal_n______________________in_header_file__default_is_hexadecimal_._n____e__extension______The_extension_for_the_C_include_file__1_3_chars_._n____h__path___________The_path_for_the_C_include_file._Default_is:__.__n____m__length_________Warn_if_any_message_exceeds__length__characters._n____n_________________NUL_terminate_all_message_table_strings._n____o_________________Generate_OLE2_header_file__use_HRESULT_definition_instead_n______________________of_status_code_definition_._n____r__path___________The_directory_for_the_RC_include_file_and_the_binary_n______________________message_resource_files_it_includes._Default_is:__.__n____s__path___________Generate_a_separate_binary_resource_per_provider._n______________________Generate_summary_global_resource_MCGenResource.BIN._n____t__path___________Validate_against_baseline_resource._n____u_________________Indicates_that_the_input_.mc_file_is_UTF_16LE._This_flag_n______________________is_required_when_the_.mc_file_is_UTF_16LE_without_a_BOM._n______________________Ignored_if_the_.mc_file_has_a_UTF_8_or_UTF_16LE_BOM._n____U_________________Encode_.BIN_messages_using_UTF_16LE__default_._n____U8________________Encode_.BIN_messages_using_UTF8._Resulting_message_table_n______________________will_only_be_usable_on_Windows_20h1_or_later._n____v_________________Enables_verbose_output._n____W__file___________The_path_to_a_custom_winmeta.xml_file__rarely_needed_._n____w__file___________The_path_to_a_custom_eventman.xsd_file__rarely_needed_._n____x__path___________The_path_for_the_.dbg_C_include_file_that_maps_message_n______________________IDs_to_their_symbolic_names._This_option_can_only_be_used_n______________________with_a_message_text_file._n____z__basename_______The_base_name_of_the_generated_files._Default_is_the_base_n______________________name_of_the_input_file._n____filename.man______The_name_of_the_manifest_file_to_compile._n____filename.mc_______The_name_of_a_message_file_to_compile._n_n___Code_Generation_Options_n____________________________n____cp__encoding__________Generated_text_files_will_use_the_specified_n__________________________character_encoding._Valid_encoding_names_include_n___________________________ansi___default____utf_8___and__utf_16_._n__________________________The_UTF_encodings_will_add_a_byte_order_mark__BOM_._n____km____________________Generate_Kernel_Mode_logging_macros._n____um____________________Generate_User_Mode_logging_macros._n__________________________Note:_unless_the__mof_parameter_is_specified__the_n__________________________only_difference_between__km_and__um_is_that_the_n__________________________EventWrite_macros_generated_with__km_accept_an_n__________________________Activity_ID_parameter._n____generateProjections___Generate_logging_interfaces_projectable_to_n__________________________JavaScript._n____generateTemplateProjections_n__________________________Generate_logging_interfaces_projectable_to_n__________________________JavaScript_that_reduce_projection_cost._n____generateTemplateStubs__file__n__________________________Override_the_default_template_wrapping_stubs_file_n__________________________from_WinRTTemplateProviderStubs.js_to__file_.js._n____cs__namespace_
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fputs]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140050950
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret