Function at 0x140005330
Capabilities:
Access peb ldr_data
Get geographical location

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov dword [rsp + 0x20], 0
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140011fb8], eax
jle 0x140005547
lea rcx, [0x140011fb8]
call fcn.1400080a0
cmp dword [0x140011fb8], 0xffffffff
jne 0x140005547
lea rax, str.System_DefaultAnsiCodepage
mov qword [0x140011a60], rax
mov dword [0x140011a68], 0x800
mov dword [0x140011a6c], 0x1004
lea rax, str.System_DefaultCodepage
mov qword [0x140011a70], rax
mov dword [0x140011a78], 0x800
mov dword [0x140011a7c], 0xb
lea rax, str.System_DefaultLanguage
mov qword [0x140011a80], rax
mov dword [0x140011a88], 0x800
mov dword [0x140011a8c], 9
lea rax, str.System_DefaultCountry
mov qword [0x140011a90], rax
mov dword [0x140011a98], 0x800
mov dword [0x140011a9c], 0xa
lea rax, str.System_Language
mov qword [0x140011aa0], rax
mov dword [0x140011aa8], 0x800
mov dword [0x140011aac], 1
lea rax, str.System_Country
mov qword [0x140011ab0], rax
mov dword [0x140011ab8], 0x800
mov dword [0x140011abc], 5
lea rax, str.User_DefaultAnsiCodepage
mov qword [0x140011ac0], rax
mov dword [0x140011ac8], 0x400
mov dword [0x140011acc], 0x1004
lea rax, str.User_DefaultCodepage
mov qword [0x140011ad0], rax
mov dword [0x140011ad8], 0x400
mov dword [0x140011adc], 0xb
lea rax, str.User_DefaultLanguage
mov qword [0x140011ae0], rax
mov dword [0x140011ae8], 0x400
mov dword [0x140011aec], 9
lea rax, str.User_DefaultCountry
mov qword [0x140011af0], rax
mov dword [0x140011af8], 0x400
mov dword [0x140011afc], 0xa
lea rax, str.User_Language
mov qword [0x140011b00], rax
mov dword [0x140011b08], 0x400
mov dword [0x140011b0c], 1
lea rax, str.User_Country
mov qword [0x140011b10], rax
mov dword [0x140011b18], 0x400
mov dword [0x140011b1c], 5
lea rcx, [0x140011fb8]
call fcn.140008040
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rbx, [0x140011a68]
or r15, 0xffffffffffffffff
lea r14, [0x140011b28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
mov r9d, 0xa
lea r8, [rsp + 0x48]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea eax, [rdi - 1]
cmp eax, 9
ja 0x1400055c1
lea r9, [rsp + 0x48]
mov r8, qword [rbx - 8]
lea rdx, str._os_item_name___s__value___s___
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
jmp 0x140005632
cmp ecx, 0x7a
jne 0x140005632
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rsi, eax
test eax, eax
jle 0x140005632
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call qword [sym.imp.mfc140u.dll_operator]
mov rdi, rax
test rax, rax
je 0x140005632
mov r9d, esi
mov r8, rax
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x140005629
mov r9, rdi
mov r8, qword [rbx - 8]
lea rdx, str._os_item_name___s__value___s___
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_operator_1]
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
je 0x14000564d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
add rbx, 0x10
cmp rbx, r14
jl 0x140005571
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
je 0x1400056b6
lea rdx, str._locale_attrs_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
lea rdx, str.__locale_attrs_
lea rcx, [rsp + 0x40]
call qword [0x14000a540]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400056c7
lea rdx, [0x14000bba0]
mov rcx, rbp
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, rbp
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140007ea0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret