Function at 0x140176d40
Capabilities:
Check os version

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1408fa960]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x40], 0xffffffff
mov r8d, MsiDatabaseIsTablePersistentA
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140223e30
mov dword [rsp + 0x90], MsiEnableLogA
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140177047
cmp dword [rsp + 0x94], 4
jne 0x140176de3
movzx eax, byte [rsp + 0x12a]
mov byte [rsp + 0x50], al
cmp byte [rsp + 0x50], 1
je 0x140176dc4
cmp byte [rsp + 0x50], 2
je 0x140176dd6
cmp byte [rsp + 0x50], 3
je 0x140176dce
jmp 0x140176dde
mov dword [rsp + 0x40], 3
jmp 0x140176dde
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x40], 5
jmp 0x140177042
cmp dword [rsp + 0x94], 5
jne 0x140176e8c
movzx eax, byte [rsp + 0x12a]
mov byte [rsp + 0x54], al
cmp byte [rsp + 0x54], 1
je 0x140176e14
cmp byte [rsp + 0x54], 2
je 0x140176e6b
cmp byte [rsp + 0x54], 3
je 0x140176e4d
jmp 0x140176e87
cmp dword [rsp + 0x98], 0
jne 0x140176e28
mov dword [rsp + 0x40], 6
jmp 0x140176e4b
movzx eax, word [rsp + 0x128]
and eax, 0x200
test eax, eax
je 0x140176e43
mov dword [rsp + 0x40], 9
jmp 0x140176e4b
mov dword [rsp + 0x40], 0xa
jmp 0x140176e87
cmp dword [rsp + 0x98], 0
jne 0x140176e61
mov dword [rsp + 0x40], 7
jmp 0x140176e69
mov dword [rsp + 0x40], reloc.WSOCK32.dll_inet_ntoa
jmp 0x140176e87
cmp dword [rsp + 0x98], 0
jne 0x140176e7f
mov dword [rsp + 0x40], 8
jmp 0x140176e87
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x140177042
cmp dword [rsp + 0x94], 6
jne 0x140176fbd
movzx eax, byte [rsp + 0x12a]
mov byte [rsp + 0x58], al
cmp byte [rsp + 0x58], 1
je 0x140176ec4
cmp byte [rsp + 0x58], 2
je 0x140176f69
cmp byte [rsp + 0x58], 3
je 0x140176f18
jmp 0x140176fb8
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140176eed
cmp dword [rsp + 0x44], 1
je 0x140176ef7
cmp dword [rsp + 0x44], 2
je 0x140176f01
cmp dword [rsp + 0x44], 3
je 0x140176f0b
jmp 0x140176f13
mov dword [rsp + 0x40], reloc.ODBC32.dll_SQLFetch
jmp 0x140176f13
mov dword [rsp + 0x40], MsiDatabaseImportA
jmp 0x140176f13
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseGenerateTransformA
jmp 0x140176f13
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseGetPrimaryKeysW
jmp 0x140176fb8
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x140176f41
cmp dword [rsp + 0x48], 1
je 0x140176f4b
cmp dword [rsp + 0x48], 2
je 0x140176f55
cmp dword [rsp + 0x48], 3
je 0x140176f5f
jmp 0x140176f67
mov dword [rsp + 0x40], reloc.WSOCK32.dll_ntohl
jmp 0x140176f67
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseExportA
jmp 0x140176f67
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseGenerateTransformW
jmp 0x140176f67
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseImportA
jmp 0x140176fb8
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
je 0x140176f92
cmp dword [rsp + 0x4c], 1
je 0x140176f9c
cmp dword [rsp + 0x4c], 2
je 0x140176fa6
cmp dword [rsp + 0x4c], 3
je 0x140176fb0
jmp 0x140176fb8
mov dword [rsp + 0x40], MsiDatabaseExportA
jmp 0x140176fb8
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseExportW
jmp 0x140176fb8
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseGetPrimaryKeysA
jmp 0x140176fb8
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseImportW
jmp 0x140177042
cmp dword [rsp + 0x94], 0xa
jne 0x140177042
movzx eax, byte [rsp + 0x12a]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 1
je 0x140176fea
cmp byte [rsp + 0x5c], 2
je 0x140177026
cmp byte [rsp + 0x5c], 3
je 0x140177008
jmp 0x140177042
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140176ffe
jmp 0x140177006
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseMergeA
jmp 0x140177042
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x14017701c
jmp 0x140177024
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseMergeW
jmp 0x140177042
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
je 0x14017703a
jmp 0x140177042
mov dword [rsp + 0x40], reloc.msi.dll_MsiDatabaseOpenViewA
jmp 0x14017719b
mov r8d, MsiVerifyPackageW
xor edx, edx
lea rcx, [rsp + 0x130]
call fcn.140223e30
mov dword [rsp + 0x130], MsiVerifyPackageW
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14017719b
cmp dword [rsp + 0x134], 4
jne 0x14017719b
cmp dword [rsp + 0x138], 0
jne 0x14017716b
cmp dword [rsp + 0x140], 2
jne 0x140177157
lea rcx, [rsp + 0x70]
call fcn.14000a280
nop
mov dword [rsp + 0x30], 2
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
lea r8, [0x1403192c8]
lea rdx, [0x1403192e0]
mov rcx, 0xffffffff80000002
call fcn.1400f6f60
lea rdx, [0x140319340]
lea rcx, [rsp + 0x70]
call fcn.14003a7a0
movzx eax, al
test eax, eax
je 0x140177109
mov dword [rsp + 0x40], 3
jmp 0x14017714b
lea rdx, [0x140319350]
lea rcx, [rsp + 0x70]
call fcn.14003a7a0
movzx eax, al
test eax, eax
je 0x14017712b
mov dword [rsp + 0x40], 4
jmp 0x14017714b
lea rdx, [0x140319368]
lea rcx, [rsp + 0x70]
call fcn.14003a7a0
movzx eax, al
test eax, eax
je 0x14017714b
mov dword [rsp + 0x40], 5
lea rcx, [rsp + 0x70]
call fcn.14000a800
jmp 0x140177169
cmp dword [rsp + 0x140], 1
jne 0x140177169
mov dword [rsp + 0x40], 0
jmp 0x14017719b
cmp dword [rsp + 0x140], 1
jne 0x14017719b
cmp dword [rsp + 0x138], 0xa
jne 0x140177189
mov dword [rsp + 0x40], 1
jmp 0x14017719b
cmp dword [rsp + 0x138], 0x5a
jne 0x14017719b
mov dword [rsp + 0x40], 2
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140222a60
add rsp, 0x1e8
ret