Function at 0x14005ac20
Capabilities:
Get memory capacity
Identify system language via api
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rax - 0x5e8]
sub rsp, 0x6d0
mov rbx, r9
mov rdi, r8
test rdx, rdx
je 0x14005b801
test r8, r8
je 0x14005b801
cmp word [r8], 0
je 0x14005b801
test rbx, rbx
je 0x14005b801
cmp word [r9], 0
je 0x14005b801
mov r8, rdx
mov qword [rax - 0x28], r15
mov edx, 0x80
mov qword [rax + 0x18], rsi
mov r9, 0xffffffffffffffff
lea rcx, [0x140215b3a]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea rcx, [0x140215c3a]
mov r8, rdi
lea edx, [r9 + 0x29]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea rcx, [0x140215c8a]
mov r8, rbx
mov edx, 0x80
call fcn.14003c5c8
xor r15d, r15d
cmp word [0x140215d8a], r15w
mov word [0x14021adda], r15w
mov qword [0x14021b038], r15
mov word [0x14021aeda], r15w
mov word [0x14021af2a], r15w
jne 0x14005b294
cmp byte [rbp + 0x610], r15b
je 0x14005b294
lea rax, [0x1401b76b0]
mov qword [rbp - 0x18], 0xffffffffffffffff
mov r8d, 0x103
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14005b271
cmp word [rbp + 0x110], r15w
je 0x14005b271
lea r8, [0x140215d8a]
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x20]
call fcn.140091a80
test al, al
je 0x14005b271
xor r8d, r8d
lea rdx, [0x140215d8a]
call fcn.14005a0e0
xorps xmm0, xmm0
mov word [rbp - 0x10], r15w
xor eax, eax
lea rdx, str.utm_cookie
lea rcx, [0x140215d8a]
mov qword [rbp + 0x62], rax
movups xmmword [rbp - 0xe], xmm0
mov dword [rbp + 0x6a], eax
lea rbx, [rbp - 0x10]
lea edi, [rax + 0x3f]
mov word [rbp + 0x6e], ax
movups xmmword [rbp + 2], xmm0
movups xmmword [rbp + 0x12], xmm0
movups xmmword [rbp + 0x22], xmm0
movups xmmword [rbp + 0x32], xmm0
movups xmmword [rbp + 0x42], xmm0
movups xmmword [rbp + 0x52], xmm0
call fcn.140030c6c
mov rdx, rax
movabs rsi, 0x4000002400
test rax, rax
je 0x14005ae41
movzx ecx, word [rdx + 0x16]
add rdx, 0x16
test cx, cx
je 0x14005ae0f
nop word [rax + rax]
cmp cx, 0x7c
je 0x14005ae0f
cmp cx, 0x26
ja 0x14005adf5
movzx eax, cx
bt rsi, rax
jb 0x14005ae0f
cmp edi, 1
jbe 0x14005ae0f
add rdx, 2
mov word [rbx], cx
add rbx, 2
dec edi
movzx ecx, word [rdx]
test cx, cx
jne 0x14005ade0
mov word [rbx], r15w
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14005ae20
cmp rax, 8
jb 0x14005ae41
lea rcx, [rbp - 0x10]
call fcn.14003e3e8
cmp rax, 0x2710
jge 0x14005ae46
mov word [rbp - 0x10], r15w
lea rdx, str.utm_cookie_expiration
mov word [rbp + 0x110], r15w
lea rcx, [0x140215d8a]
mov edi, 0x103
lea rbx, [rbp + 0x110]
call fcn.140030c6c
mov rdx, rax
test rax, rax
je 0x14005b26c
movzx ecx, word [rdx + 0x2c]
add rdx, 0x2c
test cx, cx
je 0x14005aeb5
cmp cx, 0x7c
je 0x14005aeb5
cmp cx, 0x26
ja 0x14005ae9b
movzx eax, cx
bt rsi, rax
jb 0x14005aeb5
cmp edi, 1
jbe 0x14005aeb5
add rdx, 2
mov word [rbx], cx
add rbx, 2
dec edi
movzx ecx, word [rdx]
test cx, cx
jne 0x14005ae86
mov word [rbx], r15w
cmp word [rbp + 0x110], r15w
je 0x14005b26c
lea rcx, [rbp + 0x110]
call fcn.14003e3e8
xor ecx, ecx
mov rbx, rax
call fcn.140035e90
lea rcx, [rax - 0x1c20]
cmp rbx, rcx
jl 0x14005b26c
cmp rbx, rax
jg 0x14005b26c
cmp word [rbp - 0x10], r15w
je 0x14005b271
xorps xmm0, xmm0
mov dword [rbp + 0x5f0], 0x7e
xor eax, eax
mov qword [rbp - 0x60], r15
mov qword [rbp + 0xe4], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov dword [rbp + 0xec], eax
mov r9d, 0x20119
mov dword [rbp + 0x70], eax
xor r8d, r8d
lea rax, [rbp - 0x60]
mov dword [rbp + 0x5f8], r15d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005afd8
mov rcx, qword [rbp - 0x60]
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x5f8]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, [0x1401b7784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x60]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005afd8
lea rcx, [rbp + 0x70]
call fcn.14003e3e8
cmp rax, 0x2710
jge 0x14005b06d
xor eax, eax
mov dword [rsp + 0x50], 0x7e
mov dword [rbp + 0x70], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], r15d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b0e9
mov rcx, qword [rbp - 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, [0x1401b7784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b0e9
lea rcx, [rbp + 0x70]
call fcn.14003e3e8
cmp rax, 0x2710
jl 0x14005b0e9
cmp word [rbp + 0x70], r15w
je 0x14005b0ee
lea rdx, [0x1401b6be8]
mov word [rbp + 0x110], r15w
lea rcx, [0x140215d8a]
mov edi, 0x103
lea rbx, [rbp + 0x110]
call fcn.140030c6c
mov rdx, rax
test rax, rax
je 0x14005b271
movzx ecx, word [rdx + 0x26]
add rdx, 0x26
test cx, cx
je 0x14005b0e3
cmp cx, 0x7c
je 0x14005b0e3
cmp cx, 0x26
ja 0x14005b0c9
movzx eax, cx
bt rsi, rax
jb 0x14005b0e3
cmp edi, 1
jbe 0x14005b0e3
add rdx, 2
mov word [rbx], cx
add rbx, 2
dec edi
movzx ecx, word [rdx]
test cx, cx
jne 0x14005b0b4
mov word [rbx], r15w
jmp 0x14005b0ee
mov word [rbp + 0x70], r15w
lea rax, [rbp + 0x70]
lea r8, [rbp - 0x10]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14005b114
add rax, 2
test ecx, ecx
jne 0x14005b100
test edx, edx
je 0x14005b271
mov rcx, 0xffffffff80000002
call fcn.140003f50
test al, al
jne 0x14005b13f
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call fcn.140003ea0
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x14005b150
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x14005b1c6
lea rax, [rbp - 0x50]
mov qword [rbp - 0x50], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b1c6
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b7784]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000001
call fcn.140003f50
test al, al
jne 0x14005b1e9
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call fcn.140003ea0
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x14005b1f4
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x14005b271
lea rax, [rbp - 0x48]
mov qword [rbp - 0x48], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b271
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b7784]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005b271
mov word [rbp - 0x10], r15w
mov rcx, qword [rbp - 0x18]
lea rax, [0x1401b76b0]
mov qword [rbp - 0x20], rax
cmp rcx, 0xffffffffffffffff
je 0x14005b294
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], 0xffffffffffffffff
cmp word [0x140216d8a], r15w
jne 0x14005b7dd
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x6c8], r14
mov qword [rbp + 0x3a8], rax
lea rcx, [rbp + 0x320]
lea rax, [0x1401b7740]
mov dword [rbp + 0x3b0], r15d
mov qword [rbp + 0x3a0], rax
mov dword [rbp + 0x3b4], 0x100
mov word [rbp + 0x3b8], r15w
mov dword [rbp + 0x320], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r14, qword [rbp + 0x328]
xorps xmm0, xmm0
shr r14, 0x14
test eax, eax
mov qword [rbp + 0x100], r15
movdqu xmmword [rbp + 0xf0], xmm0
cmove r14d, r15d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov r9d, 0x20
mov dword [rbp + 0x108], eax
lea rdx, str.Arabic___Saudi_Arabia
lea rax, [0x140067510]
mov r8d, 0xb8
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
call fcn.1400410fc
test rax, rax
je 0x14005b385
mov r8, qword [rax + 8]
test r8, r8
je 0x14005b385
xor edx, edx
mov dword [rsp + 0x28], 0x1f
lea rax, [rbp + 0x360]
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x14005b3a3
mov r9, 0xffffffffffffffff
lea r8, [0x1401b6c10]
lea rcx, [rbp + 0x360]
lea edx, [r9 + 0x20]
call fcn.14003c5c8
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x360]
call fcn.14005fc10
mov rsi, qword [rbp + 0x3a8]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x40], rsi
lea ecx, [r14 + 0xff]
and ecx, 0xfffff00
lea r9, str.modeldesktopscr_res_dx_dcpu_umemory_ul_s
mov dword [rsp + 0x38], ecx
mov edx, 0x1ff
mov dword [rsp + 0x30], edi
lea rcx, [0x140216d8a]
mov dword [rsp + 0x28], ebx
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call fcn.140003dd0
xor eax, eax
mov dword [rsp + 0x60], 0x206
mov dword [rbp + 0x110], eax
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
lea rax, [rbp - 0x40]
mov qword [rbp - 0x40], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], r15d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14, qword [rsp + 0x6c8]
test eax, eax
jne 0x14005b511
mov rcx, qword [rbp - 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, str.SystemManufacturer
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b511
lea rdx, [rbp + 0x110]
call fcn.140055040
cmp rax, 3
jbe 0x14005b511
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x110]
call fcn.14005fc10
mov r9, 0xffffffffffffffff
lea r8, str.model_vendor
mov edx, 0x200
lea rcx, [0x140216d8a]
call fcn.14003e54c
mov r8, qword [rbp + 0x3a8]
lea rcx, [0x140216d8a]
mov r9, 0xffffffffffffffff
mov edx, 0x200
call fcn.14003e54c
xor eax, eax
mov dword [rsp + 0x70], 0x206
mov dword [rbp + 0x110], eax
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
lea rax, [rbp - 0x38]
mov qword [rbp - 0x38], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x78], r15d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b5fa
mov rcx, qword [rbp - 0x38]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, str.SystemProductName
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b5fa
lea rdx, [rbp + 0x110]
call fcn.140055040
cmp rax, 3
jbe 0x14005b5fa
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x110]
call fcn.14005fc10
mov r9, 0xffffffffffffffff
lea r8, str.model_device
mov edx, 0x200
lea rcx, [0x140216d8a]
call fcn.14003e54c
mov r8, qword [rbp + 0x3a8]
lea rcx, [0x140216d8a]
mov r9, 0xffffffffffffffff
mov edx, 0x200
call fcn.14003e54c
xor ecx, ecx
call fcn.140035e90
mov rdi, rax
mov dword [rbp - 0x80], 0x206
xor eax, eax
mov qword [rbp - 0x30], r15
mov dword [rbp + 0x110], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp - 0x30]
mov dword [rbp - 0x78], r15d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b6b0
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, str.Install.Time
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b6b0
cmp word [rbp + 0x110], r15w
je 0x14005b6b0
lea rcx, [rbp + 0x110]
call fcn.14003e3e8
cmp rax, rdi
cmovg rax, rdi
lea rcx, [rax + 0x128a1800]
cmp rcx, rdi
cmovl rax, rdi
mov rdi, rax
lea r9, str.fv_date_I64d
mov qword [rsp + 0x20], rdi
mov edx, 0x103
lea rcx, [rbp + 0x110]
mov r8, 0xffffffffffffffff
call fcn.140003dd0
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x110]
mov edx, 0x200
lea rcx, [0x140216d8a]
call fcn.14003e54c
xor eax, eax
mov dword [rbp - 0x70], 0x206
mov dword [rbp + 0x110], eax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAdvertisingInfo
lea rax, [rbp - 0x28]
mov qword [rbp - 0x28], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x68], r15d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b771
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x68]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, [0x1401b6d30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x28]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14005b7c1
lea rdx, [rbp + 0x110]
call fcn.140055040
cmp rax, 0x10
jbe 0x14005b7c1
mov r9, 0xffffffffffffffff
lea r8, str.advid
mov edx, 0x200
lea rcx, [0x140216d8a]
call fcn.14003e54c
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x110]
mov edx, 0x200
lea rcx, [0x140216d8a]
call fcn.14003e54c
lea rax, [0x1401b7738]
mov qword [rbp + 0x3a8], r15
mov qword [rbp + 0x3a0], rax
mov dword [rbp + 0x3b0], r15d
mov r15, qword [rsp + 0x6c0]
mov al, 1
mov rsi, qword [rsp + 0x700]
mov byte [0x140215a38], 1
add rsp, 0x6d0
pop rdi
pop rbx
pop rbp
ret
xor al, al
add rsp, 0x6d0
pop rdi
pop rbx
pop rbp
ret