Function at 0x14001a620
Capabilities:
Identify system language via api
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r13, rcx
mov ebx, 1
mov dword [rcx + 0x2c], ebx
xor esi, esi
mov dword [rcx], esi
mov dword [rcx + 4], esi
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], esi
mov dword [rcx + 0x10], esi
mov dword [rcx + 0x14], esi
mov dword [rcx + 0x18], esi
mov dword [rcx + 0x1c], esi
mov dword [rcx + 0x20], esi
mov dword [rcx + 0x24], esi
mov dword [rcx + 0x28], esi
mov dword [rcx + 0x30], esi
mov dword [rcx + 0x34], esi
mov dword [rcx + 0x38], esi
mov dword [rcx + 0x3c], esi
call fcn.140055b68
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001a6b5
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea r12, [0x1400e9c18]
mov r15, r12
or r14, 0xffffffffffffffff
shr r15, 0x10
jne 0x14001a703
movzx edi, r12w
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001a726
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140006090
jmp 0x14001a726
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x80]
call fcn.1400062e0
nop
call fcn.140055b68
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001a745
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
test r15, r15
jne 0x14001a77e
movzx edi, r12w
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001a79e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006090
jmp 0x14001a79e
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1400062e0
nop
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x6c], ebx
call fcn.140055b68
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001a7d5
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
test r15, r15
jne 0x14001a813
movzx edi, r12w
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001a837
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006090
mov rbp, qword [rsp + 0x58]
jmp 0x14001a837
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.1400062e0
mov rbp, qword [rsp + 0x58]
call fcn.140055b68
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001a856
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, str.Client
test rdx, 0xffffffffffff0000
jne 0x14001a89e
movzx edi, dx
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001a8bf
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140006090
mov rbx, qword [rsp + 0x40]
jmp 0x14001a8bf
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.1400062e0
mov rbx, qword [rsp + 0x40]
call fcn.140055b68
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001a8de
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test r15, r15
jne 0x14001a91c
movzx edi, r12w
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001a940
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006090
mov rsi, qword [rsp + 0x50]
jmp 0x14001a940
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.1400062e0
mov rsi, qword [rsp + 0x50]
call fcn.140055b68
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001a95f
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
test r15, r15
jne 0x14001a9a3
lea rdx, [0x1400e9c18]
movzx edi, dx
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001a9cb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140006090
mov r12, qword [rsp + 0x38]
jmp 0x14001a9cb
xor eax, eax
mov rcx, r14
lea rdx, [0x1400e9c18]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.1400062e0
mov r12, qword [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov edi, 0x20219
mov eax, 0x20119
cmp dword [r13 + 0x2c], 0
cmovne edi, eax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rsp + 0x80]
call fcn.140006f20
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b605
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001aabc
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x68]
test eax, eax
mov r15d, 1
cmove ecx, r15d
mov dword [rsp + 0x68], ecx
jmp 0x14001aac2
mov r15d, 1
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001aec6
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001ab9b
lea rdx, [r12 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001ac46
cmp dword [rdx + 0x10], eax
jge 0x14001ab5d
cmp dword [r12 - 0xc], eax
jge 0x14001ab4e
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [r12 - 0x10], eax
mov word [r12], ax
jmp 0x14001ac46
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001ab75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
jmp 0x14001ac46
mov r15d, dword [r12 - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, r12
sar rdx, 1
mov qword [rsp + 0x90], rdx
mov ecx, 1
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001abe4
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004670
mov r12, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x90]
cmp rdx, r15
ja 0x14001ac04
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [r12 + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, r12
call fcn.14009b340
jmp 0x14001ac21
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, r12
call fcn.14009b270
test edi, edi
js 0x14001aebb
cmp edi, dword [r12 - 0xc]
jg 0x14001aebb
mov dword [r12 - 0x10], edi
mov word [r15 + r12], 0
mov r15d, 1
movsxd rdi, dword [r12 - 0x10]
mov ecx, r15d
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001ac6f
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004670
mov r12, qword [rsp + 0x38]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, r12
call fcn.14009b820
test edi, edi
js 0x14001aeb0
cmp edi, dword [r12 - 0xc]
jg 0x14001aeb0
mov dword [r12 - 0x10], edi
mov word [r12 + rdi*2], 0
cmp dword [r12 - 0x10], 0
jl 0x14001aec6
lea rdx, [0x1400e9d14]
mov rcx, r12
call fcn.14009b200
test rax, rax
je 0x14001aec6
sub rax, r12
sar rax, 1
cmp eax, 0xffffffff
je 0x14001aec6
cmp dword [r12 - 0x10], 0
jge 0x14001acdc
mov eax, r14d
jmp 0x14001acfb
lea rdx, [0x1400e9d14]
mov rcx, r12
call fcn.14009b200
test rax, rax
jne 0x14001acf5
mov eax, r14d
jmp 0x14001acfb
sub rax, r12
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.140005ef0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001ad71
cmp dword [rdi + 0x10], 0
jl 0x14001ad62
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001ad62
call fcn.1400046d0
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001ad57
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14001ad71
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400062e0
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001ad95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.14009d2c0
mov dword [rsp + 0x74], eax
mov esi, dword [r12 - 0x10]
test esi, esi
jns 0x14001adc2
mov eax, r14d
jmp 0x14001ade6
lea rdx, [0x1400e9d14]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.14009b200
test rax, rax
jne 0x14001ade0
mov eax, r14d
jmp 0x14001ade6
sub rax, rdi
sar rax, 1
sub esi, eax
lea r8d, [rsi - 1]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call fcn.140005d60
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14001ae5a
cmp dword [rbx + 0x10], 0
jl 0x14001ae4b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001ae4b
call fcn.1400046d0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001ae40
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14001ae5a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400062e0
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001ae7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.14009d2c0
mov dword [rsp + 0x70], eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x14001aec6
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b0af
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001af99
lea rdx, [rbp - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001b038
cmp dword [rdx + 0x10], eax
jge 0x14001af5b
cmp dword [rbp - 0xc], eax
jge 0x14001af4f
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbp - 0x10], eax
mov word [rbp], ax
jmp 0x14001b038
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001af73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x14001b038
mov r15d, dword [rbp - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, rbp
sar rdx, 1
mov qword [rsp + 0x98], rdx
mov ecx, 1
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001afdd
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004670
mov rbp, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x98]
cmp rdx, r15
ja 0x14001affe
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [rbp + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, rbp
call fcn.14009b340
jmp 0x14001b01b
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rbp
call fcn.14009b270
test edi, edi
js 0x14001b0a4
cmp edi, dword [rbp - 0xc]
jg 0x14001b0a4
mov dword [rbp - 0x10], edi
mov word [r15 + rbp], 0
mov r15d, 1
movsxd rdi, dword [rbp - 0x10]
mov ecx, r15d
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b05c
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004670
mov rbp, qword [rsp + 0x58]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbp
call fcn.14009b820
test edi, edi
js 0x14001b099
cmp edi, dword [rbp - 0xc]
jg 0x14001b099
mov dword [rbp - 0x10], edi
mov word [rbp + rdi*2], 0
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, rbp
call fcn.14009d2c0
mov dword [r13 + 8], eax
jmp 0x14001b0af
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CSDVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b366
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001b17c
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001b20c
cmp dword [rdx + 0x10], eax
jge 0x14001b143
cmp dword [rsi - 0xc], eax
jge 0x14001b138
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x14001b20c
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b15b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x14001b20c
mov ebp, dword [rsi - 0x10]
lea r15, [rsp + 0xc0]
sub r15, rsi
sar r15, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b1af
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004670
mov rsi, qword [rsp + 0x50]
cmp r15, rbp
ja 0x14001b1cf
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r15*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14009b340
jmp 0x14001b1ec
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0xc0]
mov rdx, rbp
mov rcx, rsi
call fcn.14009b270
test edi, edi
js 0x14001b35b
cmp edi, dword [rsi - 0xc]
jg 0x14001b35b
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
mov r15d, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, r15d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b230
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004670
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.14009b820
test edi, edi
js 0x14001b350
cmp edi, dword [rsi - 0xc]
jg 0x14001b350
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
cmp dword [rsi - 0x10], 0
jl 0x14001b366
lea rdx, str.SERVICE_PACK
mov rcx, rsi
call fcn.14009b200
test rax, rax
je 0x14001b366
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
je 0x14001b366
mov r8d, dword [rsi - 0x10]
add r8d, 0xfffffff3
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140005d60
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001b304
cmp dword [rdi + 0x10], 0
jl 0x14001b2f5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001b2f5
call fcn.1400046d0
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001b2ea
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14001b304
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400062e0
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b328
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.14009d2c0
mov dword [r13 + 0x38], eax
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x14001b366
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.InstallationType
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b53b
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001b42e
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001b4b6
cmp dword [rdx + 0x10], eax
jge 0x14001b3fa
cmp dword [rbx - 0xc], eax
jge 0x14001b3ef
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x14001b4b6
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b412
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r12, qword [rsp + 0x38]
jmp 0x14001b4b6
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xc0]
sub rbp, rbx
sar rbp, 1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b45f
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004670
mov rbx, qword [rsp + 0x40]
cmp rbp, rsi
ja 0x14001b47f
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009b340
jmp 0x14001b49c
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.14009b270
test edi, edi
js 0x14001b530
cmp edi, dword [rbx - 0xc]
jg 0x14001b530
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
movsxd rdi, dword [rbx - 0x10]
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001b4da
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004670
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14009b820
test edi, edi
js 0x14001b525
cmp edi, dword [rbx - 0xc]
jg 0x14001b525
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
cmp dword [rbx - 0x10], 0
jl 0x14001b53b
lea rdx, str.SERVER
mov rcx, rbx
call fcn.14009b200
test rax, rax
je 0x14001b53b
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14001b53b
mov dword [r13 + 0x30], r15d
jmp 0x14001b53b
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, dword [r13 + 8]
test ecx, ecx
je 0x14001b5f8
cmp dword [rsp + 0x68], 0
je 0x14001b560
mov eax, dword [rsp + 0x78]
mov dword [r13], eax
mov eax, dword [rsp + 0x6c]
mov dword [r13 + 4], eax
jmp 0x14001b570
mov eax, dword [rsp + 0x74]
mov dword [r13], eax
mov eax, dword [rsp + 0x70]
mov dword [r13 + 4], eax
mov eax, dword [r13]
cmp eax, 0xa
jae 0x14001b5f4
cmp ecx, 0x2800
jae 0x14001b5f4
cmp eax, 5
jne 0x14001b5aa
mov eax, dword [r13 + 4]
test eax, eax
jne 0x14001b594
mov dword [r13 + 0xc], r15d
jmp 0x14001b5f8
cmp eax, 1
jne 0x14001b59f
mov dword [r13 + 0x10], r15d
jmp 0x14001b5f8
cmp eax, 2
jne 0x14001b5f8
mov dword [r13 + 0x14], r15d
jmp 0x14001b5f8
cmp eax, 6
jne 0x14001b5e9
mov eax, dword [r13 + 4]
test eax, eax
jne 0x14001b5bd
mov dword [r13 + 0x18], r15d
jmp 0x14001b5f8
cmp eax, 1
jne 0x14001b5c8
mov dword [r13 + 0x1c], r15d
jmp 0x14001b5f8
cmp eax, 2
jne 0x14001b5d3
mov dword [r13 + 0x20], r15d
jmp 0x14001b5f8
cmp eax, 3
jne 0x14001b5de
mov dword [r13 + 0x24], r15d
jmp 0x14001b5f8
cmp eax, 4
jbe 0x14001b5f8
mov dword [r13 + 0x28], r15d
jmp 0x14001b5f8
cmp eax, 7
jb 0x14001b5f8
mov dword [r13 + 0x28], r15d
jmp 0x14001b5f8
mov dword [r13 + 0x28], r15d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001b60b
mov r15d, 1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [r13 + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [r13 + 0x40], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [r13 + 0x42], ax
lea rdx, [r12 - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b64e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b670
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b692
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b6b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001b6d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14001b6fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14009af10
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret