Function at 0x140016580
Capabilities:
Identify system language via api
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r13, rcx
mov ebx, 1
mov dword [rcx + 0x2c], ebx
xor esi, esi
mov dword [rcx], esi
mov dword [rcx + 4], esi
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], esi
mov dword [rcx + 0x10], esi
mov dword [rcx + 0x14], esi
mov dword [rcx + 0x18], esi
mov dword [rcx + 0x1c], esi
mov dword [rcx + 0x20], esi
mov dword [rcx + 0x24], esi
mov dword [rcx + 0x28], esi
mov dword [rcx + 0x30], esi
mov dword [rcx + 0x34], esi
mov dword [rcx + 0x38], esi
mov dword [rcx + 0x3c], esi
call fcn.14004b378
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140016615
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea r12, [0x1400dec08]
mov r15, r12
or r14, 0xffffffffffffffff
shr r15, 0x10
jne 0x140016663
movzx edi, r12w
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x140016686
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140005c00
jmp 0x140016686
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x80]
call fcn.140005e50
nop
call fcn.14004b378
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400166a5
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
test r15, r15
jne 0x1400166de
movzx edi, r12w
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x1400166fe
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140005c00
jmp 0x1400166fe
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140005e50
nop
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x6c], ebx
call fcn.14004b378
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140016735
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
test r15, r15
jne 0x140016773
movzx edi, r12w
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x140016797
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140005c00
mov rbp, qword [rsp + 0x58]
jmp 0x140016797
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140005e50
mov rbp, qword [rsp + 0x58]
call fcn.14004b378
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400167b6
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, str.Client
test rdx, 0xffffffffffff0000
jne 0x1400167fe
movzx edi, dx
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x14001681f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140005c00
mov rbx, qword [rsp + 0x40]
jmp 0x14001681f
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.140005e50
mov rbx, qword [rsp + 0x40]
call fcn.14004b378
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001683e
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test r15, r15
jne 0x14001687c
movzx edi, r12w
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x1400168a0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140005c00
mov rsi, qword [rsp + 0x50]
jmp 0x1400168a0
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140005e50
mov rsi, qword [rsp + 0x50]
call fcn.14004b378
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400168bf
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
test r15, r15
jne 0x140016903
lea rdx, [0x1400dec08]
movzx edi, dx
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x14001692b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140005c00
mov r12, qword [rsp + 0x38]
jmp 0x14001692b
xor eax, eax
mov rcx, r14
lea rdx, [0x1400dec08]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140005e50
mov r12, qword [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov edi, 0x20219
mov eax, 0x20119
cmp dword [r13 + 0x2c], 0
cmovne edi, eax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rsp + 0x80]
call fcn.140006a90
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017565
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016a1c
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x68]
test eax, eax
mov r15d, 1
cmove ecx, r15d
mov dword [rsp + 0x68], ecx
jmp 0x140016a22
mov r15d, 1
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016e26
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140016afb
lea rdx, [r12 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140016ba6
cmp dword [rdx + 0x10], eax
jge 0x140016abd
cmp dword [r12 - 0xc], eax
jge 0x140016aae
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [r12 - 0x10], eax
mov word [r12], ax
jmp 0x140016ba6
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016ad5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
jmp 0x140016ba6
mov r15d, dword [r12 - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, r12
sar rdx, 1
mov qword [rsp + 0x90], rdx
mov ecx, 1
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016b44
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004650
mov r12, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x90]
cmp rdx, r15
ja 0x140016b64
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [r12 + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, r12
call fcn.140090b50
jmp 0x140016b81
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, r12
call fcn.140090a80
test edi, edi
js 0x140016e1b
cmp edi, dword [r12 - 0xc]
jg 0x140016e1b
mov dword [r12 - 0x10], edi
mov word [r15 + r12], 0
mov r15d, 1
movsxd rdi, dword [r12 - 0x10]
mov ecx, r15d
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016bcf
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004650
mov r12, qword [rsp + 0x38]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, r12
call fcn.140091030
test edi, edi
js 0x140016e10
cmp edi, dword [r12 - 0xc]
jg 0x140016e10
mov dword [r12 - 0x10], edi
mov word [r12 + rdi*2], 0
cmp dword [r12 - 0x10], 0
jl 0x140016e26
lea rdx, [0x1400ded04]
mov rcx, r12
call fcn.140090a10
test rax, rax
je 0x140016e26
sub rax, r12
sar rax, 1
cmp eax, 0xffffffff
je 0x140016e26
cmp dword [r12 - 0x10], 0
jge 0x140016c3c
mov eax, r14d
jmp 0x140016c5b
lea rdx, [0x1400ded04]
mov rcx, r12
call fcn.140090a10
test rax, rax
jne 0x140016c55
mov eax, r14d
jmp 0x140016c5b
sub rax, r12
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.140005a60
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140016cd1
cmp dword [rdi + 0x10], 0
jl 0x140016cc2
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140016cc2
call fcn.1400046b0
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140016cb7
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140016cd1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005e50
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016cf5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140092ad0
mov dword [rsp + 0x74], eax
mov esi, dword [r12 - 0x10]
test esi, esi
jns 0x140016d22
mov eax, r14d
jmp 0x140016d46
lea rdx, [0x1400ded04]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140090a10
test rax, rax
jne 0x140016d40
mov eax, r14d
jmp 0x140016d46
sub rax, rdi
sar rax, 1
sub esi, eax
lea r8d, [rsi - 1]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call fcn.1400058d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140016dba
cmp dword [rbx + 0x10], 0
jl 0x140016dab
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140016dab
call fcn.1400046b0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140016da0
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140016dba
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005e50
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016dde
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.140092ad0
mov dword [rsp + 0x70], eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x140016e26
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001700f
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140016ef9
lea rdx, [rbp - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140016f98
cmp dword [rdx + 0x10], eax
jge 0x140016ebb
cmp dword [rbp - 0xc], eax
jge 0x140016eaf
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbp - 0x10], eax
mov word [rbp], ax
jmp 0x140016f98
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016ed3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x140016f98
mov r15d, dword [rbp - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, rbp
sar rdx, 1
mov qword [rsp + 0x98], rdx
mov ecx, 1
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016f3d
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004650
mov rbp, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x98]
cmp rdx, r15
ja 0x140016f5e
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [rbp + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, rbp
call fcn.140090b50
jmp 0x140016f7b
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rbp
call fcn.140090a80
test edi, edi
js 0x140017004
cmp edi, dword [rbp - 0xc]
jg 0x140017004
mov dword [rbp - 0x10], edi
mov word [r15 + rbp], 0
mov r15d, 1
movsxd rdi, dword [rbp - 0x10]
mov ecx, r15d
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016fbc
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004650
mov rbp, qword [rsp + 0x58]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbp
call fcn.140091030
test edi, edi
js 0x140016ff9
cmp edi, dword [rbp - 0xc]
jg 0x140016ff9
mov dword [rbp - 0x10], edi
mov word [rbp + rdi*2], 0
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, rbp
call fcn.140092ad0
mov dword [r13 + 8], eax
jmp 0x14001700f
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CSDVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400172c6
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x1400170dc
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001716c
cmp dword [rdx + 0x10], eax
jge 0x1400170a3
cmp dword [rsi - 0xc], eax
jge 0x140017098
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x14001716c
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400170bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x14001716c
mov ebp, dword [rsi - 0x10]
lea r15, [rsp + 0xc0]
sub r15, rsi
sar r15, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001710f
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004650
mov rsi, qword [rsp + 0x50]
cmp r15, rbp
ja 0x14001712f
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r15*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.140090b50
jmp 0x14001714c
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0xc0]
mov rdx, rbp
mov rcx, rsi
call fcn.140090a80
test edi, edi
js 0x1400172bb
cmp edi, dword [rsi - 0xc]
jg 0x1400172bb
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
mov r15d, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, r15d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140017190
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004650
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.140091030
test edi, edi
js 0x1400172b0
cmp edi, dword [rsi - 0xc]
jg 0x1400172b0
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
cmp dword [rsi - 0x10], 0
jl 0x1400172c6
lea rdx, str.SERVICE_PACK
mov rcx, rsi
call fcn.140090a10
test rax, rax
je 0x1400172c6
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
je 0x1400172c6
mov r8d, dword [rsi - 0x10]
add r8d, 0xfffffff3
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.1400058d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140017264
cmp dword [rdi + 0x10], 0
jl 0x140017255
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140017255
call fcn.1400046b0
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001724a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140017264
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005e50
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017288
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.140092ad0
mov dword [r13 + 0x38], eax
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x1400172c6
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.InstallationType
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001749b
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001738e
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140017416
cmp dword [rdx + 0x10], eax
jge 0x14001735a
cmp dword [rbx - 0xc], eax
jge 0x14001734f
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140017416
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017372
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r12, qword [rsp + 0x38]
jmp 0x140017416
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xc0]
sub rbp, rbx
sar rbp, 1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400173bf
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004650
mov rbx, qword [rsp + 0x40]
cmp rbp, rsi
ja 0x1400173df
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140090b50
jmp 0x1400173fc
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.140090a80
test edi, edi
js 0x140017490
cmp edi, dword [rbx - 0xc]
jg 0x140017490
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
movsxd rdi, dword [rbx - 0x10]
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001743a
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004650
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140091030
test edi, edi
js 0x140017485
cmp edi, dword [rbx - 0xc]
jg 0x140017485
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
cmp dword [rbx - 0x10], 0
jl 0x14001749b
lea rdx, str.SERVER
mov rcx, rbx
call fcn.140090a10
test rax, rax
je 0x14001749b
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14001749b
mov dword [r13 + 0x30], r15d
jmp 0x14001749b
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, dword [r13 + 8]
test ecx, ecx
je 0x140017558
cmp dword [rsp + 0x68], 0
je 0x1400174c0
mov eax, dword [rsp + 0x78]
mov dword [r13], eax
mov eax, dword [rsp + 0x6c]
mov dword [r13 + 4], eax
jmp 0x1400174d0
mov eax, dword [rsp + 0x74]
mov dword [r13], eax
mov eax, dword [rsp + 0x70]
mov dword [r13 + 4], eax
mov eax, dword [r13]
cmp eax, 0xa
jae 0x140017554
cmp ecx, 0x2800
jae 0x140017554
cmp eax, 5
jne 0x14001750a
mov eax, dword [r13 + 4]
test eax, eax
jne 0x1400174f4
mov dword [r13 + 0xc], r15d
jmp 0x140017558
cmp eax, 1
jne 0x1400174ff
mov dword [r13 + 0x10], r15d
jmp 0x140017558
cmp eax, 2
jne 0x140017558
mov dword [r13 + 0x14], r15d
jmp 0x140017558
cmp eax, 6
jne 0x140017549
mov eax, dword [r13 + 4]
test eax, eax
jne 0x14001751d
mov dword [r13 + 0x18], r15d
jmp 0x140017558
cmp eax, 1
jne 0x140017528
mov dword [r13 + 0x1c], r15d
jmp 0x140017558
cmp eax, 2
jne 0x140017533
mov dword [r13 + 0x20], r15d
jmp 0x140017558
cmp eax, 3
jne 0x14001753e
mov dword [r13 + 0x24], r15d
jmp 0x140017558
cmp eax, 4
jbe 0x140017558
mov dword [r13 + 0x28], r15d
jmp 0x140017558
cmp eax, 7
jb 0x140017558
mov dword [r13 + 0x28], r15d
jmp 0x140017558
mov dword [r13 + 0x28], r15d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001756b
mov r15d, 1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [r13 + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [r13 + 0x40], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [r13 + 0x42], ax
lea rdx, [r12 - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400175ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400175d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400175f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017614
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017636
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14001765a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140090720
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret