Function at 0x643c10e8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, str.An_attempt_to_generate_a_security_audit_failed.
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
mov eax, dword [0x643e8230]
mov esi, dword [ebp + 8]
sub eax, 0x629ba7a7
mov dword [0x643e8184], eax
mov dl, byte [ecx]
test dl, dl
je 0x643c1139
sub edx, 0x30
cmp dl, 9
jbe 0x643c1136
imul eax, eax, 0xc881a655
mov dword [0x643e8184], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, 0xc5c9e5e5
mov dword [0x643e8184], eax
jmp 0x643c1139
inc ecx
jmp 0x643c110b
mov eax, dword [0x643e8184]
xor eax, 0x27772f59
mov dword [0x643e8230], eax
call fcn.643d05d4
mov eax, dword [0x643e8230]
mov edx, str.This_stream_is_not_DAX_mappable.
mov ecx, 0x171e
and eax, 0x8cf6a9b4
mov dword [0x643e8184], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c119e
add ecx, eax
cmp ecx, 0x1e96
jbe 0x643c1166
mov dword [esp + 8], str.KnownDllPath
mov dword [esp + 4], str.CheckTokenMembership
mov dword [esp], str.Failed_to_get_the_string_from_the_database
call fcn.643d0738
or dword [0x643e8230], 0x12d813f5
and dword [0x643e8184], 0xb1ee039b
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
xor eax, 0x4ce8b37d
or eax, 0xd2d44004
mov dword [0x643e8230], eax
mov dword [esp + 8], str.CheckTokenMembership
mov dword [esp + 4], str.KnownDllPath
mov dword [esp], str.Failed_to_get_the_string_from_the_database
call fcn.643d0738
mov eax, dword [0x643e8230]
sub eax, 0x4cb9c150
mov dword [0x643e8184], eax
mov dword [esp + 4], ebx
mov dword [esp], 2
mov eax, dword [0x643d5094]
call dword [eax + 0x34]
mov ebx, eax
push edi
push edi
cmp eax, 0xffffffff
jne 0x643c12b6
mov edx, str.CheckTokenMembership
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x643c121e
inc edx
jmp 0x643c1212
xor eax, eax
cmp byte [eax + str.KnownDllPath], 0
je 0x643c1239
inc eax
cmp eax, 0x1b
jne 0x643c1220
sub dword [0x643e8184], 0xa5d8e5
mov eax, dword [0x643e8184]
add eax, 0x5753bbb6
mov dword [0x643e8230], eax
xor eax, 0x3a09861c
mov dword [0x643e8184], eax
mov dword [esp], str.An_attempt_to_generate_a_security_audit_failed.
call fcn.643d3a44
xor eax, eax
cmp byte [eax + str.KnownDllPath], 0
je 0x643c12a0
inc eax
cmp eax, 0x1cef
jne 0x643c1260
mov eax, dword [0x643e8230]
mov dword [esp + 8], str.Failed_to_get_the_string_from_the_database
mov dword [esp + 4], str.Failed_to_get_the_string_from_the_database
mov dword [esp + 0xc], eax
mov dword [esp], str.KnownDllPath
call fcn.643d0978
and dword [0x643e8230], 0xc9ec9f8b
add dword [0x643e8184], 0x3dfdb67a
call fcn.643d4480
xor esi, esi
jmp 0x643c142d
mov dword [ebp - 0x244], 0x22c
lea edi, [ebp - 0x244]
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [0x643d5094]
call dword [eax + 0x38]
push ecx
push ecx
test eax, eax
jne 0x643c1319
sub dword [0x643e8184], 0xd9d7ff2
jmp 0x643c1420
sub eax, 0x79194fcb
mov dword [0x643e8184], eax
mov dword [esp], str.An_attempt_to_generate_a_security_audit_failed.
call fcn.643d3a44
mov dword [esp + 4], edi
mov dword [esp], ebx
mov eax, dword [0x643d5094]
call dword [eax + 0x3c]
push edx
push edx
test eax, eax
je 0x643c1420
lea eax, [ebp - 0x220]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.643cd924
test eax, eax
jne 0x643c13d2
mov byte [ebp - 0x259], 0
mov eax, dword [0x643e8184]
xor edi, edi
mov esi, 0x61
mov dword [ebp - 0x250], 0x34
mov ecx, dword [0x643e8230]
mov dword [ebp - 0x24c], 0x64
mov dword [ebp - 0x248], 0xffffff08
xor edx, edx
cmp byte [edx + str.An_attempt_to_generate_a_security_audit_failed.], 0
je 0x643c1386
inc edx
cmp edx, 0x18d9
jne 0x643c136c
lea ecx, [eax + 0x740d68c4]
jmp 0x643c138e
cmp edx, 0x100b
jle 0x643c139d
imul ecx, ecx, 0x2d651e01
mov byte [ebp - 0x259], 1
jmp 0x643c13a2
or eax, 0x1235ac0f
add esi, dword [ebp + edi*4 - 0x250]
inc edi
add eax, 0x203753e8
cmp edi, 3
jne 0x643c136a
cmp byte [ebp - 0x259], 0
mov dword [0x643e8184], eax
je 0x643c13c8
mov dword [0x643e8230], ecx
mov dword [esp], ebx
call fcn.643c1065
jmp 0x643c142d
mov edx, str.An_attempt_to_generate_a_security_audit_failed.
mov al, byte [edx]
test al, al
je 0x643c13f3
sub eax, 0x30
cmp al, 9
jbe 0x643c13f0
or dword [0x643e8230], 0xdd25d12b
jmp 0x643c13f3
inc edx
jmp 0x643c13d7
mov eax, dword [0x643e8230]
mov ecx, str.An_attempt_to_generate_a_security_audit_failed.
mov dl, byte [ecx]
sub edx, 0x30
cmp dl, 9
ja 0x643c140a
inc ecx
jmp 0x643c13fd
mov ecx, str.KnownDllPath
mov dl, byte [ecx]
sub edx, 0x30
cmp dl, 9
ja 0x643c12ea
inc ecx
jmp 0x643c140f
mov dword [esp], ebx
call fcn.643c1065
jmp 0x643c12af
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret