Reading File Version from Memory

[Kurapica]

I have version 4.5.30 of Resource Hacker

I was curios to know why it sets the font style to italic in the TreeView when opening a new file

00705308                                     | 8B45 F4                   | mov eax,dword ptr ss:[ebp-C]                            |
0070530B                                     | 8B80 E0060000             | mov eax,dword ptr ds:[eax+6E0]                          |
00705311                                     | 8B16                      | mov edx,dword ptr ds:[esi]                              |
00705313                                     | E8 00DFEFFF               | call                         |
00705318                                     | 8B45 F4                   | mov eax,dword ptr ss:[ebp-C]                            |
0070531B                                     | 8B80 E0060000             | mov eax,dword ptr ds:[eax+6E0]                          |
00705321                                     | 8078 16 00                | cmp byte ptr ds:[eax+16],0                              |
00705325                                     | 74 1A                     | je resourcehacker.705341                                |
00705327                                     | 8B45 F4                   | mov eax,dword ptr ss:[ebp-C]                            |
0070532A                                     | 8B80 C8030000             | mov eax,dword ptr ds:[eax+3C8]                          |
00705330                                     | 8B40 74                   | mov eax,dword ptr ds:[eax+74]                           |
00705333                                     | 0FB615 B8557000           | movzx edx,byte ptr ds:[7055B8]                          |
0070533A                                     | E8 AD51DCFF               | call                            |
0070533F                                     | EB 18                     | jmp resourcehacker.705359                               |
00705341                                     | 8B45 F4                   | mov eax,dword ptr ss:[ebp-C]                            |

When it returns from "resourcehacker.sub_603218" , if "byte ptr ds:[eax+0x16] = 0" it won't set font style to italic.
Enter "resourcehacker.sub_603218" and you will see it checks the file for several conditions

Before entering "resourcehacker.sub_603218" you will notice this byte is set to 1
and later in that function it's set to 0

00603425 | C640 16 00 | mov byte ptr ds:[eax+16],0 |

0060329D                                     | 50                        | push eax                                                |
0060329E                                     | E8 49F8E0FF               | call                                  |
006032A3                                     | 8945 F0                   | mov dword ptr ss:[ebp-10],eax                           |
006032A6                                     | 837D F0 FF                | cmp dword ptr ss:[ebp-10],FFFFFFFF                      |
006032AA                                     | 0F84 AC000000             | je resourcehacker.60335C                                |
006032B0                                     | 33C0                      | xor eax,eax                                             |
006032B2                                     | 55                        | push ebp                                                |
006032B3                                     | 68 F3326000               | push resourcehacker.6032F3                              |
006032B8                                     | 64:FF30                   | push dword ptr fs:[eax]                                 |
006032BB                                     | 64:8920                   | mov dword ptr fs:[eax],esp                              |
006032BE                                     | 8B45 FC                   | mov eax,dword ptr ss:[ebp-4]                            |
006032C1                                     | 83C0 4C                   | add eax,4C                                              |
006032C4                                     | 50                        | push eax                                                |
006032C5                                     | 8B45 FC                   | mov eax,dword ptr ss:[ebp-4]                            |
006032C8                                     | 83C0 44                   | add eax,44                                              |
006032CB                                     | 50                        | push eax                                                |
006032CC                                     | 8B45 FC                   | mov eax,dword ptr ss:[ebp-4]                            |
006032CF                                     | 83C0 3C                   | add eax,3C                                              |
006032D2                                     | 50                        | push eax                                                |
006032D3                                     | 8B45 F0                   | mov eax,dword ptr ss:[ebp-10]                           |
006032D6                                     | 50                        | push eax                                                |
006032D7                                     | E8 28F9E0FF               | call                                  |
006032DC                                     | 33C0                      | xor eax,eax                                             |
006032DE                                     | 5A                        | pop edx                                                 |
006032DF                                     | 59                        | pop ecx                                                 |
006032E0                                     | 59                        | pop ecx                                                 |

So most probably it's a file permissions issue in your case.