Function at 0x14001d394
Capabilities:
Get system information on windows
Identify system language via api

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
and qword [rdx], 0
xor ebx, ebx
and qword [rbp - 0x38], rbx
mov sil, r8b
and dword [rbp + 0x30], ebx
mov r14, rdx
mov qword [rbp - 0x50], rbx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rcx, [rbp + 0x30]
mov rax, qword [rax + 0x98]
call qword [0x14003b4b0]
test eax, eax
js 0x14001d55a
cmp dword [rbp + 0x30], ebx
je 0x14001d55a
and qword [rbp - 0x48], rbx
lea rdx, [rbp - 0x48]
lea rcx, str.Miscellaneous_Configuration
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov rcx, qword [rbp - 0x48]
mov edi, eax
test eax, eax
jns 0x14001d41b
test rcx, rcx
je 0x14001d55c
call qword [sym.imp.mpclient.dll_MpConfigClose]
jmp 0x14001d55c
and qword [rbp - 0x40], rbx
and dword [rbp + 0x38], ebx
mov dword [rbp + 0x48], 2
and qword [rsp + 0x28], rbx
lea rax, [rbp - 0x40]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x48]
lea rdx, str.OfflineScanner_Url
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov edi, eax
cmp eax, 0x80070002
jne 0x14001d4ab
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14001d464
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14001d473
call qword [sym.imp.mpclient.dll_MpConfigClose]
xorps xmm0, xmm0
lea rcx, [rbp - 0x30]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rbp - 0x30]
test eax, eax
je 0x14001d59f
cmp eax, 9
je 0x14001d58f
mov edi, 0x80070032
jmp 0x14001d679
test eax, eax
jns 0x14001d4c7
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14001d4be
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp - 0x48]
jmp 0x14001d407
mov rdi, qword [rbp - 0x40]
and qword [rbp - 0x40], rbx
mov rcx, qword [rbp - 0x48]
mov qword [rbp - 0x38], rdi
test rcx, rcx
je 0x14001d4e2
call qword [sym.imp.mpclient.dll_MpConfigClose]
test rdi, rdi
je 0x14001d473
mov rcx, qword [0x140060048]
lea rsi, [0x140060048]
cmp rcx, rsi
je 0x14001d518
test byte [rcx + 0x1c], 4
je 0x14001d518
mov rcx, qword [rcx + 0x10]
lea r8, [0x140050bb0]
mov edx, 0xe
mov r9, rdi
call fcn.140008ba4
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.1400301e4
mov edi, eax
test eax, eax
jns 0x14001d54e
mov rax, qword [0x140060048]
cmp rax, rsi
je 0x14001d63e
test byte [rax + 0x1c], 1
je 0x14001d63e
mov edx, 0xf
jmp 0x14001d621
mov rax, qword [rbp - 0x50]
mov qword [r14], rax
jmp 0x14001d677
xor edi, edi
test edi, edi
jns 0x14001d473
mov rax, qword [0x140060048]
lea rsi, [0x140060048]
cmp rax, rsi
je 0x14001d679
test byte [rax + 0x1c], 1
je 0x14001d679
mov edx, 0xd
jmp 0x14001d621
lea rax, str.https:__go.microsoft.com_fwlink__LinkID518968
lea rbx, str.https:__go.microsoft.com_fwlink__LinkId246445
jmp 0x14001d5ad
lea rax, str.https:__go.microsoft.com_fwlink__LinkID518969
lea rbx, str.https:__go.microsoft.com_fwlink__LinkId246444
test sil, sil
cmovne rbx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
mov rcx, qword [0x140060048]
lea rsi, [0x140060048]
cmp rcx, rsi
je 0x14001d5ee
test byte [rcx + 0x1c], 4
je 0x14001d5ee
mov rcx, qword [rcx + 0x10]
lea r8, [0x140050bb0]
mov r9d, edi
mov edx, 0x11
call fcn.1400012f0
mov r9d, edi
lea rdx, str._lsclcid_04X
mov r8, rbx
lea rcx, [rbp - 0x50]
call fcn.14002e7c4
mov edi, eax
test eax, eax
jns 0x14001d644
mov rax, qword [0x140060048]
cmp rax, rsi
je 0x14001d63e
test byte [rax + 0x1c], 1
je 0x14001d63e
mov edx, 0x12
lfence
mov rcx, qword [0x140060048]
lea r8, [0x140050bb0]
mov r9d, edi
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
mov rbx, qword [rbp - 0x50]
jmp 0x14001d679
mov rcx, qword [0x140060048]
mov rdi, qword [rbp - 0x50]
cmp rcx, rsi
je 0x14001d672
test byte [rcx + 0x1c], 4
je 0x14001d672
mov rcx, qword [rcx + 0x10]
lea r8, [0x140050bb0]
mov edx, 0x13
mov r9, rdi
call fcn.140008ba4
xor ebx, ebx
mov qword [r14], rdi
xor edi, edi
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14001d688
call qword [sym.imp.mpclient.dll_MpFreeMemory]
test rbx, rbx
je 0x14001d695
mov rcx, rbx
call fcn.140034674
mov eax, edi
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret