Function at 0x464150
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xcc], 0x532390
mov ebx, edx
mov dword [ebp - 0xc8], str.amd64
push edi
mov dword [ebp - 0xd0], ebx
lea eax, [esi - 1]
mov dword [ebp - 0xc4], 0x53239c
mov dword [ebp - 0xc0], str.arm64
mov dword [ebp - 0xbc], 0
mov dword [0x55b230], ebx
cmp eax, 3
ja 0x4648b0
test ebx, ebx
je 0x4648b0
push 0x5a02c8
push ecx
call fcn.00463d80
add esp, 8
test eax, eax
je 0x4648bd
push 0x525f6c
push 0x5a02c8
call fcn.004d14af
mov edi, eax
add esp, 8
test edi, edi
je 0x4648bd
push str.Selected_Windows_User_Experience_options:
call fcn.0044b0b0
add esp, 4
push str.__xml_version_1.0__encoding_utf_8____n
push edi
call fcn.00401040
push str._unattend_xmlns_urn:schemas_microsoft_com:unattend___n
push edi
call fcn.00401040
add esp, 0x10
test bl, 1
je 0x464319
push str.___settings_pass_windowsPE___n
push edi
call fcn.00401040
lea eax, [esi*4 - 4]
push dword [ebp + eax - 0xcc]
mov dword [ebp - 0xd4], eax
push str._____component_name_Microsoft_Windows_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0x14
push str._______UserData__n
push edi
call fcn.00401040
push str._________ProductKey__n
push edi
call fcn.00401040
push str.___________Key____n
push edi
call fcn.00401040
push str.__________ProductKey__n
push edi
call fcn.00401040
push str.________UserData__n
push edi
call fcn.00401040
push str._Bypass_SB_TPM_RAM
call fcn.0044b0b0
add esp, 0x2c
push str._______RunSynchronous__n
push edi
call fcn.00401040
add esp, 8
xor ebx, ebx
nop
push str._________RunSynchronousCommand_wcm:action_add___n
push edi
call fcn.00401040
lea esi, [ebx + 1]
push esi
push str.___________Order__d__Order__n
push edi
call fcn.00401040
add esp, 0x14
push dword [ebx*4 + 0x528118]
push str.___________Path_reg_add_HKLMSYSTEMSetupLabConfig__v__s__t_REG_DWORD__d_1__f__Path__n
push edi
call fcn.00401040
add esp, 0xc
push str.__________RunSynchronousCommand__n
push edi
call fcn.00401040
mov ebx, esi
add esp, 8
cmp ebx, 3
jb 0x4642a0
push str.________RunSynchronous__n
push edi
call fcn.00401040
push str.______component__n
push edi
call fcn.00401040
push str.____settings__n
push edi
call fcn.00401040
mov ebx, dword [ebp - 0xd0]
add esp, 0x18
mov esi, dword [ebp - 0xd4]
jmp 0x464320
lea esi, [esi*4 - 4]
lea esi, [ebp + esi - 0xcc]
mov dword [ebp - 0xd0], esi
test bl, 4
je 0x4643c0
push str.___settings_pass_specialize___n
push edi
call fcn.00401040
push dword [esi]
push str._____component_name_Microsoft_Windows_Deployment__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0x14
push str._______RunSynchronous__n
push edi
call fcn.00401040
push str._Bypass_online_account_requirement
call fcn.0044b0b0
add esp, 0xc
push str._________RunSynchronousCommand_wcm:action_add___n
push edi
call fcn.00401040
push 1
push str.___________Order__d__Order__n
push edi
call fcn.00401040
add esp, 0x14
push str.___________Path_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionOOBE__v_BypassNRO__t_REG_DWORD__d_1__f__Path__n
push edi
call fcn.00401040
push str.__________RunSynchronousCommand__n
push edi
call fcn.00401040
push str.________RunSynchronous__n
push edi
call fcn.00401040
push str.______component__n
push edi
call fcn.00401040
push str.____settings__n
push edi
call fcn.00401040
add esp, 0x28
jmp 0x4643c6
mov dword [ebp - 0xd0], esi
test bl, 0xe8
je 0x4647e5
push str.___settings_pass_oobeSystem___n
push edi
call fcn.00401040
add esp, 8
test bl, 0x48
je 0x46459b
push dword [esi]
push str._____component_name_Microsoft_Windows_Shell_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0xc
test bl, 8
je 0x46442c
push str._Disable_data_collection
call fcn.0044b0b0
add esp, 4
push str._______OOBE__n
push edi
call fcn.00401040
push str._________ProtectYourPC_3__ProtectYourPC__n
push edi
call fcn.00401040
push str.________OOBE__n
push edi
call fcn.00401040
add esp, 0x18
test bl, 0x40
je 0x46458d
cmp byte [0x5a08c0], 0
je 0x46457b
push str.Administrator
push 0x5a08c0
call fcn.004e7afe
add esp, 8
test eax, eax
je 0x46457b
push str.Guest
push 0x5a08c0
call fcn.004e7afe
add esp, 8
test eax, eax
je 0x46457b
push 0x5a08c0
push str._Use__s_for_local_account_name
call fcn.0044b0b0
push str._______UserAccounts__n
push edi
call fcn.00401040
push str._________LocalAccounts__n
push edi
call fcn.00401040
push str.___________LocalAccount_wcm:action_add___n
push edi
call fcn.00401040
push 0x5a08c0
push str._____________Name__s__Name__n
push edi
call fcn.00401040
add esp, 0x2c
push 0x5a08c0
push str._____________DisplayName__s__DisplayName__n
push edi
call fcn.00401040
add esp, 0xc
push str._____________Group_Administrators_Power_Users__Group__n
push edi
call fcn.00401040
push str._____________Password__n
push edi
call fcn.00401040
push str._______________Value_UABhAHMAcwB3AG8AcgBkAA__Value__n
push edi
call fcn.00401040
push str._______________PlainText_false__PlainText__n
push edi
call fcn.00401040
push str.______________Password__n
push edi
call fcn.00401040
push str.____________LocalAccount__n
push edi
call fcn.00401040
push str.__________LocalAccounts__n
push edi
call fcn.00401040
push str.________UserAccounts__n
push edi
call fcn.00401040
add esp, 0x40
push str._______FirstLogonCommands__n
push edi
call fcn.00401040
push str._________SynchronousCommand_wcm:action_add___n
push edi
call fcn.00401040
push 1
push str.___________Order__d__Order__n
push edi
call fcn.00401040
add esp, 0x1c
push 0x5a08c0
push str.___________CommandLine_net_user_quot__squot___logonpasswordchg:yes__CommandLine__n
push edi
call fcn.00401040
add esp, 0xc
push str.__________SynchronousCommand__n
push edi
call fcn.00401040
push str.________FirstLogonCommands__n
push edi
call fcn.00401040
add esp, 0x10
jmp 0x46458d
push 0x5a08c0
push str.WARNING:__s_is_not_allowed_as_local_account_name___Option_ignored
call fcn.0044b0b0
add esp, 8
push str.______component__n
push edi
call fcn.00401040
add esp, 8
test bl, 0x20
je 0x464771
push str._Use_the_same_regional_options_as_this_users
call fcn.0044b0b0
add esp, 4
push dword [esi]
push str._____component_name_Microsoft_Windows_International_Core__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
mov edx, str.Keyboard_LayoutPreload1
mov byte [0x5a00c8], 0
mov ecx, 0x80000001
call fcn.00463660
add esp, 0xc
push 0x5a00c8
push str._______InputLocale__s__InputLocale__n
push edi
call fcn.00401040
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
push 0x55
lea ecx, [ebp - 0xb8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
test eax, eax
jle 0x464629
push 0
push 0
push 0x55
push 0x59d790
push 0xffffffffffffffff
lea eax, [ebp - 0xb8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x464646
mov eax, dword [str.en_US]
mov dword [0x59d790], eax
mov ax, word [0x539018]
mov word [0x59d794], ax
mov byte [0x59d795], 0
push 0x59d790
push str._______SystemLocale__s__SystemLocale__n
push edi
call fcn.00401040
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0x55
lea ecx, [ebp - 0xb8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
test eax, eax
jle 0x464698
push 0
push 0
push 0x55
push 0x59d790
push 0xffffffffffffffff
lea eax, [ebp - 0xb8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x4646b5
mov eax, dword [str.en_US]
mov dword [0x59d790], eax
mov ax, word [0x539018]
mov word [0x59d794], ax
mov byte [0x59d795], 0
push 0x59d790
push str._______UserLocale__s__UserLocale__n
push edi
call fcn.00401040
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0x55
lea ecx, [ebp - 0xb8]
movzx eax, ax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
test eax, eax
jle 0x46470a
push 0
push 0
push 0x55
push 0x59d790
push 0xffffffffffffffff
lea eax, [ebp - 0xb8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x464727
mov eax, dword [str.en_US]
mov dword [0x59d790], eax
mov ax, word [0x539018]
mov word [0x59d794], ax
mov byte [0x59d795], 0
push 0x59d790
push str._______UILanguage__s__UILanguage__n
push edi
call fcn.00401040
mov edx, str.SYSTEMCurrentControlSetControlNlsLanguageInstallLanguageFallback
mov byte [0x5a00c8], 0
mov ecx, 0x80000002
call fcn.00463660
add esp, 0xc
push 0x5a00c8
push str._______UILanguageFallback__s__UILanguageFallback__n
push edi
call fcn.00401040
add esp, 0xc
push str.______component__n
push edi
call fcn.00401040
add esp, 8
test bl, bl
jns 0x4647d7
push str._Disable_bitlocker
call fcn.0044b0b0
mov esi, dword [esi]
add esp, 4
push esi
push str._____component_name_Microsoft_Windows_SecureStartup_FilterDriver__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0xc
push str._______PreventDeviceEncryption_true__PreventDeviceEncryption__n
push edi
call fcn.00401040
push str.______component__n
push edi
call fcn.00401040
push esi
push str._____component_name_Microsoft_Windows_EnhancedStorage_Adm__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0x1c
push str._______TCGSecurityActivationDisabled_1__TCGSecurityActivationDisabled__n
push edi
call fcn.00401040
push str.______component__n
push edi
call fcn.00401040
mov esi, dword [ebp - 0xd0]
add esp, 0x10
push str.____settings__n
push edi
call fcn.00401040
add esp, 8
test ebx, 0x110
je 0x464886
push str.___settings_pass_offlineServicing___n
push edi
call fcn.00401040
add esp, 8
test bl, 0x10
je 0x46483a
push str._Set_internal_drives_offline
call fcn.0044b0b0
add esp, 4
push dword [esi]
push str._____component_name_Microsoft_Windows_PartitionManager__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0xc
push str._______SanPolicy_4__SanPolicy__n
push edi
call fcn.00401040
push str.______component__n
push edi
call fcn.00401040
add esp, 0x10
test ebx, 0x100
je 0x464878
push str._Enforce_S_Mode
call fcn.0044b0b0
add esp, 4
push dword [esi]
push str._____component_name_Microsoft_Windows_CodeIntegrity__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
push edi
call fcn.00401040
add esp, 0xc
push str._______SkuPolicyRequired_1__SkuPolicyRequired__n
push edi
call fcn.00401040
push str.______component__n
push edi
call fcn.00401040
add esp, 0x10
push str.____settings__n
push edi
call fcn.00401040
add esp, 8
push str.__unattend__n
push edi
call fcn.00401040
push edi
call fcn.004d1662
add esp, 0xc
mov eax, 0x5a02c8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
push str.Note:_No_Windows_User_Experience_options_selected
call fcn.0044b0b0
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret