Function at 0x14001b2b0
Capabilities:
Identify system language via api
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r13, rcx
mov ebx, 1
mov dword [rcx + 0x2c], ebx
xor esi, esi
mov dword [rcx], esi
mov dword [rcx + 4], esi
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], esi
mov dword [rcx + 0x10], esi
mov dword [rcx + 0x14], esi
mov dword [rcx + 0x18], esi
mov dword [rcx + 0x1c], esi
mov dword [rcx + 0x20], esi
mov dword [rcx + 0x24], esi
mov dword [rcx + 0x28], esi
mov dword [rcx + 0x30], esi
mov dword [rcx + 0x34], esi
mov dword [rcx + 0x38], esi
mov dword [rcx + 0x3c], esi
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001b345
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea r12, [0x1400ee798]
mov r15, r12
or r14, 0xffffffffffffffff
shr r15, 0x10
jne 0x14001b393
movzx edi, r12w
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001b3b6
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400060c0
jmp 0x14001b3b6
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x80]
call fcn.140006310
nop
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001b3d5
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
test r15, r15
jne 0x14001b40e
movzx edi, r12w
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001b42e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400060c0
jmp 0x14001b42e
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140006310
nop
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x6c], ebx
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001b465
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
test r15, r15
jne 0x14001b4a3
movzx edi, r12w
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001b4c7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400060c0
mov rbp, qword [rsp + 0x58]
jmp 0x14001b4c7
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140006310
mov rbp, qword [rsp + 0x58]
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001b4e6
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, str.Client
test rdx, 0xffffffffffff0000
jne 0x14001b52e
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001b54f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400060c0
mov rbx, qword [rsp + 0x40]
jmp 0x14001b54f
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.140006310
mov rbx, qword [rsp + 0x40]
call fcn.14003c3f0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001b56e
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test r15, r15
jne 0x14001b5ac
movzx edi, r12w
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001b5d0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400060c0
mov rsi, qword [rsp + 0x50]
jmp 0x14001b5d0
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140006310
mov rsi, qword [rsp + 0x50]
call fcn.14003c3f0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001b5ef
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
test r15, r15
jne 0x14001b633
lea rdx, [0x1400ee798]
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001b65b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400060c0
mov r12, qword [rsp + 0x38]
jmp 0x14001b65b
xor eax, eax
mov rcx, r14
lea rdx, [0x1400ee798]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140006310
mov r12, qword [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov edi, 0x20219
mov eax, 0x20119
cmp dword [r13 + 0x2c], 0
cmovne edi, eax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rsp + 0x80]
call fcn.140006f70
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c295
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b74c
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x68]
test eax, eax
mov r15d, 1
cmove ecx, r15d
mov dword [rsp + 0x68], ecx
jmp 0x14001b752
mov r15d, 1
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001bb56
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001b82b
lea rdx, [r12 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001b8d6
cmp dword [rdx + 0x10], eax
jge 0x14001b7ed
cmp dword [r12 - 0xc], eax
jge 0x14001b7de
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [r12 - 0x10], eax
mov word [r12], ax
jmp 0x14001b8d6
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b805
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
jmp 0x14001b8d6
mov r15d, dword [r12 - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, r12
sar rdx, 1
mov qword [rsp + 0x90], rdx
mov ecx, 1
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b874
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004410
mov r12, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x90]
cmp rdx, r15
ja 0x14001b894
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [r12 + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, r12
call fcn.14009f850
jmp 0x14001b8b1
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, r12
call fcn.14009f640
test edi, edi
js 0x14001bb4b
cmp edi, dword [r12 - 0xc]
jg 0x14001bb4b
mov dword [r12 - 0x10], edi
mov word [r15 + r12], 0
mov r15d, 1
movsxd rdi, dword [r12 - 0x10]
mov ecx, r15d
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b8ff
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004410
mov r12, qword [rsp + 0x38]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, r12
call fcn.14009fd30
test edi, edi
js 0x14001bb40
cmp edi, dword [r12 - 0xc]
jg 0x14001bb40
mov dword [r12 - 0x10], edi
mov word [r12 + rdi*2], 0
cmp dword [r12 - 0x10], 0
jl 0x14001bb56
lea rdx, [0x1400ee8ac]
mov rcx, r12
call fcn.14009f5d0
test rax, rax
je 0x14001bb56
sub rax, r12
sar rax, 1
cmp eax, 0xffffffff
je 0x14001bb56
cmp dword [r12 - 0x10], 0
jge 0x14001b96c
mov eax, r14d
jmp 0x14001b98b
lea rdx, [0x1400ee8ac]
mov rcx, r12
call fcn.14009f5d0
test rax, rax
jne 0x14001b985
mov eax, r14d
jmp 0x14001b98b
sub rax, r12
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.140005f20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001ba01
cmp dword [rdi + 0x10], 0
jl 0x14001b9f2
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001b9f2
call fcn.140004470
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001b9e7
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14001ba01
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140006310
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001ba25
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400a2890
mov dword [rsp + 0x74], eax
mov esi, dword [r12 - 0x10]
test esi, esi
jns 0x14001ba52
mov eax, r14d
jmp 0x14001ba76
lea rdx, [0x1400ee8ac]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.14009f5d0
test rax, rax
jne 0x14001ba70
mov eax, r14d
jmp 0x14001ba76
sub rax, rdi
sar rax, 1
sub esi, eax
lea r8d, [rsi - 1]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call fcn.140005d90
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14001baea
cmp dword [rbx + 0x10], 0
jl 0x14001badb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001badb
call fcn.140004470
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001bad0
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14001baea
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140006310
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001bb0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.1400a2890
mov dword [rsp + 0x70], eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x14001bb56
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001bd3f
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001bc29
lea rdx, [rbp - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001bcc8
cmp dword [rdx + 0x10], eax
jge 0x14001bbeb
cmp dword [rbp - 0xc], eax
jge 0x14001bbdf
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rbp - 0x10], eax
mov word [rbp], ax
jmp 0x14001bcc8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001bc03
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x14001bcc8
mov r15d, dword [rbp - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, rbp
sar rdx, 1
mov qword [rsp + 0x98], rdx
mov ecx, 1
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001bc6d
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004410
mov rbp, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x98]
cmp rdx, r15
ja 0x14001bc8e
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [rbp + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, rbp
call fcn.14009f850
jmp 0x14001bcab
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rbp
call fcn.14009f640
test edi, edi
js 0x14001bd34
cmp edi, dword [rbp - 0xc]
jg 0x14001bd34
mov dword [rbp - 0x10], edi
mov word [r15 + rbp], 0
mov r15d, 1
movsxd rdi, dword [rbp - 0x10]
mov ecx, r15d
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001bcec
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004410
mov rbp, qword [rsp + 0x58]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbp
call fcn.14009fd30
test edi, edi
js 0x14001bd29
cmp edi, dword [rbp - 0xc]
jg 0x14001bd29
mov dword [rbp - 0x10], edi
mov word [rbp + rdi*2], 0
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, rbp
call fcn.1400a2890
mov dword [r13 + 8], eax
jmp 0x14001bd3f
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CSDVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001bff6
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001be0c
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001be9c
cmp dword [rdx + 0x10], eax
jge 0x14001bdd3
cmp dword [rsi - 0xc], eax
jge 0x14001bdc8
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x14001be9c
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001bdeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x14001be9c
mov ebp, dword [rsi - 0x10]
lea r15, [rsp + 0xc0]
sub r15, rsi
sar r15, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001be3f
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004410
mov rsi, qword [rsp + 0x50]
cmp r15, rbp
ja 0x14001be5f
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r15*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14009f850
jmp 0x14001be7c
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0xc0]
mov rdx, rbp
mov rcx, rsi
call fcn.14009f640
test edi, edi
js 0x14001bfeb
cmp edi, dword [rsi - 0xc]
jg 0x14001bfeb
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
mov r15d, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, r15d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001bec0
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004410
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.14009fd30
test edi, edi
js 0x14001bfe0
cmp edi, dword [rsi - 0xc]
jg 0x14001bfe0
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
cmp dword [rsi - 0x10], 0
jl 0x14001bff6
lea rdx, str.SERVICE_PACK
mov rcx, rsi
call fcn.14009f5d0
test rax, rax
je 0x14001bff6
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
je 0x14001bff6
mov r8d, dword [rsi - 0x10]
add r8d, 0xfffffff3
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140005d90
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001bf94
cmp dword [rdi + 0x10], 0
jl 0x14001bf85
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001bf85
call fcn.140004470
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001bf7a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14001bf94
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140006310
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001bfb8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.1400a2890
mov dword [r13 + 0x38], eax
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x14001bff6
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.InstallationType
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c1cb
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001c0be
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001c146
cmp dword [rdx + 0x10], eax
jge 0x14001c08a
cmp dword [rbx - 0xc], eax
jge 0x14001c07f
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x14001c146
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c0a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r12, qword [rsp + 0x38]
jmp 0x14001c146
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xc0]
sub rbp, rbx
sar rbp, 1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001c0ef
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rbx, qword [rsp + 0x40]
cmp rbp, rsi
ja 0x14001c10f
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009f850
jmp 0x14001c12c
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.14009f640
test edi, edi
js 0x14001c1c0
cmp edi, dword [rbx - 0xc]
jg 0x14001c1c0
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
movsxd rdi, dword [rbx - 0x10]
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001c16a
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14009fd30
test edi, edi
js 0x14001c1b5
cmp edi, dword [rbx - 0xc]
jg 0x14001c1b5
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
cmp dword [rbx - 0x10], 0
jl 0x14001c1cb
lea rdx, str.SERVER
mov rcx, rbx
call fcn.14009f5d0
test rax, rax
je 0x14001c1cb
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14001c1cb
mov dword [r13 + 0x30], r15d
jmp 0x14001c1cb
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, dword [r13 + 8]
test ecx, ecx
je 0x14001c288
cmp dword [rsp + 0x68], 0
je 0x14001c1f0
mov eax, dword [rsp + 0x78]
mov dword [r13], eax
mov eax, dword [rsp + 0x6c]
mov dword [r13 + 4], eax
jmp 0x14001c200
mov eax, dword [rsp + 0x74]
mov dword [r13], eax
mov eax, dword [rsp + 0x70]
mov dword [r13 + 4], eax
mov eax, dword [r13]
cmp eax, 0xa
jae 0x14001c284
cmp ecx, 0x2800
jae 0x14001c284
cmp eax, 5
jne 0x14001c23a
mov eax, dword [r13 + 4]
test eax, eax
jne 0x14001c224
mov dword [r13 + 0xc], r15d
jmp 0x14001c288
cmp eax, 1
jne 0x14001c22f
mov dword [r13 + 0x10], r15d
jmp 0x14001c288
cmp eax, 2
jne 0x14001c288
mov dword [r13 + 0x14], r15d
jmp 0x14001c288
cmp eax, 6
jne 0x14001c279
mov eax, dword [r13 + 4]
test eax, eax
jne 0x14001c24d
mov dword [r13 + 0x18], r15d
jmp 0x14001c288
cmp eax, 1
jne 0x14001c258
mov dword [r13 + 0x1c], r15d
jmp 0x14001c288
cmp eax, 2
jne 0x14001c263
mov dword [r13 + 0x20], r15d
jmp 0x14001c288
cmp eax, 3
jne 0x14001c26e
mov dword [r13 + 0x24], r15d
jmp 0x14001c288
cmp eax, 4
jbe 0x14001c288
mov dword [r13 + 0x28], r15d
jmp 0x14001c288
cmp eax, 7
jb 0x14001c288
mov dword [r13 + 0x28], r15d
jmp 0x14001c288
mov dword [r13 + 0x28], r15d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c29b
mov r15d, 1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [r13 + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [r13 + 0x40], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [r13 + 0x42], ax
lea rdx, [r12 - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c2de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c300
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c322
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c344
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c366
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14001c38a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400a1970
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret