Function at 0x100017a00
Capabilities:
Get file version info
Identify system language via api

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r15, r9
mov r14, r8
mov r13, rdx
mov r12, rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x68], r9
and dword [rsp + 0x34], 0
and qword [rsp + 0x58], 0
and dword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
test rcx, rcx
jne 0x100017aaf
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x100017aa5
test byte [rcx + 0x1c], 1
je 0x100017aa5
lea edx, [r12 + 0x43]
lea r8, [0x100001888]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
mov eax, 0x80070057
jmp 0x100017d7f
lea rdx, [rsp + 0x34]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
mov dword [rsp + 0x38], edi
test eax, eax
jne 0x100017b14
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x100017af1
test byte [rcx + 0x1c], 1
je 0x100017af1
mov edx, 0x44
lea r8, [0x100001888]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x100017d7d
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
mov qword [rsp + 0x58], rax
jmp 0x100017b43
test rsi, rsi
jne 0x100017b7e
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x100017b74
test byte [rcx + 0x1c], 1
je 0x100017b74
lea edx, [rsi + 0x45]
lea r8, [0x100001888]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
mov edi, 0x8007000e
jmp 0x100017d7d
mov r9, rsi
mov r8d, edi
mov edx, dword [rsp + 0x34]
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x100017be5
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x100017bc2
test byte [rcx + 0x1c], 1
je 0x100017bc2
mov edx, 0x46
lea r8, [0x100001888]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x100017d75
test r13, r13
je 0x100017c79
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
lea rdx, [0x1000019ec]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100017c20
mov rcx, r13
mov rdx, qword [rsp + 0x50]
mov r8d, 0x34
call sub.msvcrt.dll_memcpy
jmp 0x100017c79
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x100017d75
test byte [rcx + 0x1c], 1
je 0x100017d75
mov edx, 0x47
lea r8, [0x100001888]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
jmp 0x100017d75
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [0x100003438]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100017cd5
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor r8d, r8d
mov edx, dword [rsp + 0x30]
shr edx, 2
test edx, edx
je 0x100017ccc
mov rcx, qword [rsp + 0x40]
mov r9, rcx
cmp ax, word [r9]
je 0x100017cc6
inc r8d
add r9, 4
cmp r8d, edx
jb 0x100017cb2
jmp 0x100017cd1
mov edx, dword [rcx + r8*4]
jmp 0x100017cde
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx]
jmp 0x100017cde
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
test r14, r14
je 0x100017d73
test r15, r15
je 0x100017d73
xor edi, edi
cmp dword [rsp + 0x200], edi
jbe 0x100017d73
mov r12d, edx
shr r12d, 0x10
movzx r13d, dx
mov rax, qword [r14]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9d, r13d
lea r8, [0x100003470]
mov edx, 0x80
lea rcx, [rsp + 0x90]
call fcn.10000b314
test eax, eax
js 0x100017d64
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100017d64
mov ecx, edi
shl rcx, 4
add rcx, r15
mov rdx, qword [rsp + 0x48]
call fcn.10001627c
inc edi
add r14, 8
cmp edi, dword [rsp + 0x200]
jb 0x100017d06
xor edi, edi
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.10001e7a0
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret