Function at 0x140016350
Capabilities:
Identify system language via api
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r13, rcx
mov ebx, 1
mov dword [rcx + 0x2c], ebx
xor esi, esi
mov dword [rcx], esi
mov dword [rcx + 4], esi
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], esi
mov dword [rcx + 0x10], esi
mov dword [rcx + 0x14], esi
mov dword [rcx + 0x18], esi
mov dword [rcx + 0x1c], esi
mov dword [rcx + 0x20], esi
mov dword [rcx + 0x24], esi
mov dword [rcx + 0x28], esi
mov dword [rcx + 0x30], esi
mov dword [rcx + 0x34], esi
mov dword [rcx + 0x38], esi
mov dword [rcx + 0x3c], esi
call fcn.14004b0d0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400163e5
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea r12, [0x1400debf8]
mov r15, r12
or r14, 0xffffffffffffffff
shr r15, 0x10
jne 0x140016433
movzx edi, r12w
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140016456
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140005b70
jmp 0x140016456
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x80]
call fcn.140005dc0
nop
call fcn.14004b0d0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140016475
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
test r15, r15
jne 0x1400164ae
movzx edi, r12w
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400164ce
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140005b70
jmp 0x1400164ce
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140005dc0
nop
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x6c], ebx
call fcn.14004b0d0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140016505
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
test r15, r15
jne 0x140016543
movzx edi, r12w
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140016567
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140005b70
mov rbp, qword [rsp + 0x58]
jmp 0x140016567
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140005dc0
mov rbp, qword [rsp + 0x58]
call fcn.14004b0d0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140016586
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, str.Client
test rdx, 0xffffffffffff0000
jne 0x1400165ce
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400165ef
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140005b70
mov rbx, qword [rsp + 0x40]
jmp 0x1400165ef
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.140005dc0
mov rbx, qword [rsp + 0x40]
call fcn.14004b0d0
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001660e
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test r15, r15
jne 0x14001664c
movzx edi, r12w
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x140016670
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140005b70
mov rsi, qword [rsp + 0x50]
jmp 0x140016670
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140005dc0
mov rsi, qword [rsp + 0x50]
call fcn.14004b0d0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001668f
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
test r15, r15
jne 0x1400166d3
lea rdx, [0x1400debf8]
movzx edi, dx
mov ecx, edi
call fcn.14004aef8
test rax, rax
je 0x1400166fb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140005b70
mov r12, qword [rsp + 0x38]
jmp 0x1400166fb
xor eax, eax
mov rcx, r14
lea rdx, [0x1400debf8]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140005dc0
mov r12, qword [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], eax
mov edi, 0x20219
mov eax, 0x20119
cmp dword [r13 + 0x2c], 0
cmovne edi, eax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rsp + 0x80]
call fcn.140006a00
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017335
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMajorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400167ec
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentMinorVersionNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x68]
test eax, eax
mov r15d, 1
cmove ecx, r15d
mov dword [rsp + 0x68], ecx
jmp 0x1400167f2
mov r15d, 1
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016bf6
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x1400168cb
lea rdx, [r12 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140016976
cmp dword [rdx + 0x10], eax
jge 0x14001688d
cmp dword [r12 - 0xc], eax
jge 0x14001687e
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [r12 - 0x10], eax
mov word [r12], ax
jmp 0x140016976
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400168a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r12, [rax + 0x18]
mov qword [rsp + 0x38], r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
jmp 0x140016976
mov r15d, dword [r12 - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, r12
sar rdx, 1
mov qword [rsp + 0x90], rdx
mov ecx, 1
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016914
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004650
mov r12, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x90]
cmp rdx, r15
ja 0x140016934
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [r12 + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, r12
call fcn.1400908b0
jmp 0x140016951
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, r12
call fcn.1400907e0
test edi, edi
js 0x140016beb
cmp edi, dword [r12 - 0xc]
jg 0x140016beb
mov dword [r12 - 0x10], edi
mov word [r15 + r12], 0
mov r15d, 1
movsxd rdi, dword [r12 - 0x10]
mov ecx, r15d
sub ecx, dword [r12 - 8]
mov eax, dword [r12 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001699f
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004650
mov r12, qword [rsp + 0x38]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, r12
call fcn.140090d90
test edi, edi
js 0x140016be0
cmp edi, dword [r12 - 0xc]
jg 0x140016be0
mov dword [r12 - 0x10], edi
mov word [r12 + rdi*2], 0
cmp dword [r12 - 0x10], 0
jl 0x140016bf6
lea rdx, [0x1400decf4]
mov rcx, r12
call fcn.140090770
test rax, rax
je 0x140016bf6
sub rax, r12
sar rax, 1
cmp eax, 0xffffffff
je 0x140016bf6
cmp dword [r12 - 0x10], 0
jge 0x140016a0c
mov eax, r14d
jmp 0x140016a2b
lea rdx, [0x1400decf4]
mov rcx, r12
call fcn.140090770
test rax, rax
jne 0x140016a25
mov eax, r14d
jmp 0x140016a2b
sub rax, r12
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.1400059d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140016aa1
cmp dword [rdi + 0x10], 0
jl 0x140016a92
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140016a92
call fcn.1400046b0
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140016a87
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140016aa1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005dc0
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016ac5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140092830
mov dword [rsp + 0x74], eax
mov esi, dword [r12 - 0x10]
test esi, esi
jns 0x140016af2
mov eax, r14d
jmp 0x140016b16
lea rdx, [0x1400decf4]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140090770
test rax, rax
jne 0x140016b10
mov eax, r14d
jmp 0x140016b16
sub rax, rdi
sar rax, 1
sub esi, eax
lea r8d, [rsi - 1]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call fcn.140005840
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140016b8a
cmp dword [rbx + 0x10], 0
jl 0x140016b7b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140016b7b
call fcn.1400046b0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140016b70
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140016b8a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005dc0
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016bae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.140092830
mov dword [rsp + 0x70], eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x140016bf6
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016ddf
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140016cc9
lea rdx, [rbp - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140016d68
cmp dword [rdx + 0x10], eax
jge 0x140016c8b
cmp dword [rbp - 0xc], eax
jge 0x140016c7f
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbp - 0x10], eax
mov word [rbp], ax
jmp 0x140016d68
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016ca3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x58], rbp
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
jmp 0x140016d68
mov r15d, dword [rbp - 0x10]
lea rdx, [rsp + 0xc0]
sub rdx, rbp
sar rdx, 1
mov qword [rsp + 0x98], rdx
mov ecx, 1
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016d0d
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004650
mov rbp, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x98]
cmp rdx, r15
ja 0x140016d2e
movsxd rax, edi
lea r15, [rax + rax]
lea r8, [rbp + rdx*2]
mov r9, r15
mov rdx, r15
mov rcx, rbp
call fcn.1400908b0
jmp 0x140016d4b
movsxd rax, edi
lea r15, [rax + rax]
mov r9, r15
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rbp
call fcn.1400907e0
test edi, edi
js 0x140016dd4
cmp edi, dword [rbp - 0xc]
jg 0x140016dd4
mov dword [rbp - 0x10], edi
mov word [r15 + rbp], 0
mov r15d, 1
movsxd rdi, dword [rbp - 0x10]
mov ecx, r15d
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016d8c
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140004650
mov rbp, qword [rsp + 0x58]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbp
call fcn.140090d90
test edi, edi
js 0x140016dc9
cmp edi, dword [rbp - 0xc]
jg 0x140016dc9
mov dword [rbp - 0x10], edi
mov word [rbp + rdi*2], 0
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, rbp
call fcn.140092830
mov dword [r13 + 8], eax
jmp 0x140016ddf
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CSDVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017096
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140016eac
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140016f3c
cmp dword [rdx + 0x10], eax
jge 0x140016e73
cmp dword [rsi - 0xc], eax
jge 0x140016e68
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsi - 0x10], eax
mov word [rsi], ax
jmp 0x140016f3c
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140016e8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x140016f3c
mov ebp, dword [rsi - 0x10]
lea r15, [rsp + 0xc0]
sub r15, rsi
sar r15, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016edf
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004650
mov rsi, qword [rsp + 0x50]
cmp r15, rbp
ja 0x140016eff
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rsi + r15*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.1400908b0
jmp 0x140016f1c
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0xc0]
mov rdx, rbp
mov rcx, rsi
call fcn.1400907e0
test edi, edi
js 0x14001708b
cmp edi, dword [rsi - 0xc]
jg 0x14001708b
mov dword [rsi - 0x10], edi
mov word [rsi + rbp], 0
mov r15d, 1
movsxd rdi, dword [rsi - 0x10]
mov ecx, r15d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140016f60
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140004650
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.140090d90
test edi, edi
js 0x140017080
cmp edi, dword [rsi - 0xc]
jg 0x140017080
mov dword [rsi - 0x10], edi
mov word [rsi + rdi*2], 0
cmp dword [rsi - 0x10], 0
jl 0x140017096
lea rdx, str.SERVICE_PACK
mov rcx, rsi
call fcn.140090770
test rax, rax
je 0x140017096
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
je 0x140017096
mov r8d, dword [rsi - 0x10]
add r8d, 0xfffffff3
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140005840
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140017034
cmp dword [rdi + 0x10], 0
jl 0x140017025
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140017025
call fcn.1400046b0
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001701a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140017034
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005dc0
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017058
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.140092830
mov dword [r13 + 0x38], eax
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x140017096
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.InstallationType
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001726b
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001715e
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400171e6
cmp dword [rdx + 0x10], eax
jge 0x14001712a
cmp dword [rbx - 0xc], eax
jge 0x14001711f
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x1400171e6
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017142
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r12, qword [rsp + 0x38]
jmp 0x1400171e6
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xc0]
sub rbp, rbx
sar rbp, 1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001718f
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004650
mov rbx, qword [rsp + 0x40]
cmp rbp, rsi
ja 0x1400171af
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.1400908b0
jmp 0x1400171cc
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.1400907e0
test edi, edi
js 0x140017260
cmp edi, dword [rbx - 0xc]
jg 0x140017260
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
movsxd rdi, dword [rbx - 0x10]
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001720a
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140004650
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140090d90
test edi, edi
js 0x140017255
cmp edi, dword [rbx - 0xc]
jg 0x140017255
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
cmp dword [rbx - 0x10], 0
jl 0x14001726b
lea rdx, str.SERVER
mov rcx, rbx
call fcn.140090770
test rax, rax
je 0x14001726b
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14001726b
mov dword [r13 + 0x30], r15d
jmp 0x14001726b
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, dword [r13 + 8]
test ecx, ecx
je 0x140017328
cmp dword [rsp + 0x68], 0
je 0x140017290
mov eax, dword [rsp + 0x78]
mov dword [r13], eax
mov eax, dword [rsp + 0x6c]
mov dword [r13 + 4], eax
jmp 0x1400172a0
mov eax, dword [rsp + 0x74]
mov dword [r13], eax
mov eax, dword [rsp + 0x70]
mov dword [r13 + 4], eax
mov eax, dword [r13]
cmp eax, 0xa
jae 0x140017324
cmp ecx, 0x2800
jae 0x140017324
cmp eax, 5
jne 0x1400172da
mov eax, dword [r13 + 4]
test eax, eax
jne 0x1400172c4
mov dword [r13 + 0xc], r15d
jmp 0x140017328
cmp eax, 1
jne 0x1400172cf
mov dword [r13 + 0x10], r15d
jmp 0x140017328
cmp eax, 2
jne 0x140017328
mov dword [r13 + 0x14], r15d
jmp 0x140017328
cmp eax, 6
jne 0x140017319
mov eax, dword [r13 + 4]
test eax, eax
jne 0x1400172ed
mov dword [r13 + 0x18], r15d
jmp 0x140017328
cmp eax, 1
jne 0x1400172f8
mov dword [r13 + 0x1c], r15d
jmp 0x140017328
cmp eax, 2
jne 0x140017303
mov dword [r13 + 0x20], r15d
jmp 0x140017328
cmp eax, 3
jne 0x14001730e
mov dword [r13 + 0x24], r15d
jmp 0x140017328
cmp eax, 4
jbe 0x140017328
mov dword [r13 + 0x28], r15d
jmp 0x140017328
cmp eax, 7
jb 0x140017328
mov dword [r13 + 0x28], r15d
jmp 0x140017328
mov dword [r13 + 0x28], r15d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001733b
mov r15d, 1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [r13 + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [r13 + 0x40], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [r13 + 0x42], ax
lea rdx, [r12 - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001737e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400173a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400173c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400173e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017406
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14001742a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140090480
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret