Function at 0x6dae6290
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x630
mov eax, dword [0x6daed004]
xor eax, esp
mov dword [esp + 0x62c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x63c]
lea ebx, [esp + 0x14]
mov dword [esp + 8], 0x105
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov ecx, 0x411
cmp ax, cx
jne 0x6dae62d3
mov eax, str.EUDC932
jmp 0x6dae633a
mov ecx, 0x804
cmp ax, cx
je 0x6dae6335
mov ecx, 0x1004
cmp ax, cx
je 0x6dae6335
mov ecx, 0xc04
cmp ax, cx
je 0x6dae632e
mov ecx, 0x404
cmp ax, cx
je 0x6dae632e
mov ecx, 0x1404
cmp ax, cx
je 0x6dae632e
mov ecx, 0x412
cmp ax, cx
jne 0x6dae6316
mov eax, str.EUDC949
jmp 0x6dae633a
mov ecx, 0x409
cmp ax, cx
jne 0x6dae6327
mov eax, str.EUDC1252
jmp 0x6dae633a
xor eax, eax
jmp 0x6dae6567
mov eax, str.EUDC950
jmp 0x6dae633a
mov eax, str.EUDC936
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6dae6327
push esi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.SystemDefaultEUDCFont
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
shr eax, 1
mov dword [esp + 0xc], eax
test esi, esi
jne 0x6dae6594
cmp dword [esp + 0x14], 1
jne 0x6dae6594
cmp eax, 0x104
ja 0x6dae6594
xor ecx, ecx
push edi
mov word [esp + eax*2 + 0x1c], cx
lea eax, [esp + 0x1c]
push str._SystemRoot_
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
lea ecx, [esp + 0x24]
add esp, 8
cmp eax, ecx
jne 0x6dae649c
push str.SystemRoot
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x6dae6563
mov edx, ecx
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x6dae63f0
mov eax, dword [esp + 0x10]
sub edx, esi
sar edx, 1
add eax, 0xfffffff4
add eax, edx
cmp eax, 0x104
ja 0x6dae6563
lea edx, [esp + 0x228]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x6dae6420
lea edx, [esp + 0x34]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x6dae6436
lea edi, [esp + 0x228]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x6dae6450
mov ecx, edx
lea ebx, [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6dae6476
mov eax, dword [ebp]
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x28c]
push ebp
call eax
jmp 0x6dae6565
mov ecx, str.EUDC.TTE
lea eax, [esp + 0x1c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6dae64cb
test dx, dx
je 0x6dae64c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6dae64cb
add eax, 4
add ecx, 4
test dx, dx
jne 0x6dae64a5
xor eax, eax
jmp 0x6dae64d0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x6dae6580
push 0x104
lea eax, [esp + 0x438]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x6dae6563
add eax, 0x10
cmp eax, 0x104
ja 0x6dae6563
xor ecx, ecx
nop
movzx eax, word [esp + ecx + 0x434]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1a], ax
test ax, ax
jne 0x6dae6500
lea edi, [esp + 0x1c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x6dae6520
mov ecx, 8
mov esi, str.FONTSEUDC.TTE
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6dae6540
mov eax, dword [ebp]
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x28c]
push ebp
call eax
jmp 0x6dae6565
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x634]
pop ebp
pop ebx
xor ecx, esp
call fcn.6dae709a
add esp, 0x630
ret 8
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
push ecx
push ebx
push ebp
mov eax, dword [eax + 0x28c]
call eax
jmp 0x6dae6565
xor eax, eax
jmp 0x6dae6566