Function at 0x44f64c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], 0x4b1f91
mov dword [ebp - 0x28], str.amd64
lea edi, [eax - 1]
mov dword [ebp - 0x24], 0x4b1f9b
mov dword [ebp - 0x20], str.arm64
mov dword [0x528588], esi
cmp edi, 3
ja 0x44f689
test esi, esi
jne 0x44f697
mov dword [esp], str.Note:_No_Windows_User_Experience_options_selected
call fcn.0043d9e0
jmp 0x44f6a5
mov eax, 0x5287a0
call fcn.0044f2a3
test eax, eax
jne 0x44f6ac
xor eax, eax
jmp 0x44fdba
mov dword [esp + 4], 0x4b1fd7
mov dword [esp], 0x5287a0
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x44f6a5
mov dword [esp], str.Selected_Windows_User_Experience_options:
call fcn.0043d9e0
mov dword [esp + 4], ebx
mov dword [esp], str.__xml_version_1.0__encoding_utf_8____n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._unattend_xmlns_urn:schemas_microsoft_com:unattend___n
call sub.msvcrt.dll_fputs
mov eax, esi
and eax, 1
mov dword [ebp - 0x3c], eax
je 0x44f822
mov dword [esp + 4], ebx
mov dword [esp], str.___settings_pass_windowsPE___n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._______UserData__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._________ProductKey__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.___________Key____n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.__________ProductKey__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.________UserData__n
call sub.msvcrt.dll_fputs
mov dword [esp], str._Bypass_SB_TPM_RAM
call fcn.0043d9e0
mov dword [esp + 4], ebx
mov dword [esp], str._______RunSynchronous__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._________RunSynchronousCommand_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], str.___________Order__d__Order__n
mov dword [esp], ebx
mov dword [esp + 8], eax
inc dword [ebp - 0x3c]
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], str.___________Path_reg_add_HKLMSYSTEMSetupLabConfig__v__s__t_REG_DWORD__d_1__f__Path__n
mov dword [esp], ebx
mov eax, dword [eax*4 + 0x48fcc0]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str.__________RunSynchronousCommand__n
call sub.msvcrt.dll_fputs
cmp dword [ebp - 0x3c], 4
jne 0x44f794
mov dword [esp + 4], ebx
mov dword [esp], str.________RunSynchronous__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.____settings__n
call sub.msvcrt.dll_fputs
test esi, 4
je 0x44f8ea
mov dword [esp + 4], ebx
mov dword [esp], str.___settings_pass_specialize___n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_Deployment__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._______RunSynchronous__n
call sub.msvcrt.dll_fputs
mov dword [esp], str._Bypass_online_account_requirement
call fcn.0043d9e0
mov dword [esp + 4], ebx
mov dword [esp], str._________RunSynchronousCommand_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov dword [esp + 8], 1
mov dword [esp + 4], str.___________Order__d__Order__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str.___________Path_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionOOBE__v_BypassNRO__t_REG_DWORD__d_1__f__Path__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.__________RunSynchronousCommand__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.________RunSynchronous__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.____settings__n
call sub.msvcrt.dll_fputs
test esi, 0xe8
je 0x44fcdb
mov dword [esp + 4], ebx
mov dword [esp], str.___settings_pass_oobeSystem___n
call sub.msvcrt.dll_fputs
test esi, 0x48
je 0x44fb40
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_Shell_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
test esi, 8
je 0x44f96e
mov dword [esp], str._Disable_data_collection
call fcn.0043d9e0
mov dword [esp + 4], ebx
mov dword [esp], str._______OOBE__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._________ProtectYourPC_3__ProtectYourPC__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.________OOBE__n
call sub.msvcrt.dll_fputs
test esi, 0x40
je 0x44fb30
cmp byte [0x528500], 0
jne 0x44f99c
mov dword [esp + 4], 0x528500
mov dword [esp], str.WARNING:__s_is_not_allowed_as_local_account_name___Option_ignored
call fcn.0043d9e0
jmp 0x44fb30
mov dword [esp + 4], str.Administrator
mov dword [esp], 0x528500
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x44f983
mov dword [esp + 4], str.Guest
mov dword [esp], 0x528500
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x44f983
mov dword [esp + 4], 0x528500
mov dword [esp], str._Use__s_for_local_account_name
call fcn.0043d9e0
mov dword [esp + 4], ebx
mov dword [esp], str._______UserAccounts__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._________LocalAccounts__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.___________LocalAccount_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov dword [esp + 8], 0x528500
mov dword [esp + 4], str._____________Name__s__Name__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 8], 0x528500
mov dword [esp + 4], str._____________DisplayName__s__DisplayName__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._____________Group_Administrators_Power_Users__Group__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._____________Password__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._______________Value_UABhAHMAcwB3AG8AcgBkAA__Value__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._______________PlainText_false__PlainText__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______________Password__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.____________LocalAccount__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.__________LocalAccounts__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.________UserAccounts__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._______FirstLogonCommands__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str._________SynchronousCommand_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov dword [esp + 8], 1
mov dword [esp + 4], str.___________Order__d__Order__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 8], 0x528500
mov dword [esp + 4], str.___________CommandLine_net_user_quot__squot___logonpasswordchg:yes__CommandLine__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str.__________SynchronousCommand__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.________FirstLogonCommands__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
test esi, 0x20
je 0x44fc45
mov dword [esp], str._Use_the_same_regional_options_as_this_users
call fcn.0043d9e0
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_International_Core__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov edx, str.Keyboard_LayoutPreload1
mov eax, 0x80000001
mov byte [0x5285a0], 0
call fcn.0044f440
mov dword [esp + 8], 0x5285a0
mov dword [esp + 4], str._______InputLocale__s__InputLocale__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLCID]
mov dword [esp], eax
call fcn.0043d402
mov dword [esp + 4], str._______SystemLocale__s__SystemLocale__n
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLCID]
mov dword [esp], eax
call fcn.0043d402
mov dword [esp + 4], str._______UserLocale__s__UserLocale__n
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esp], eax
call fcn.0043d402
mov dword [esp + 4], str._______UILanguage__s__UILanguage__n
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov edx, str.SYSTEMCurrentControlSetControlNlsLanguageInstallLanguageFallback
mov eax, 0x80000002
mov byte [0x5285a0], 0
call fcn.0044f440
mov dword [esp + 8], 0x5285a0
mov dword [esp + 4], str._______UILanguageFallback__s__UILanguageFallback__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
test esi, 0x80
je 0x44fccb
mov dword [esp], str._Disable_bitlocker
call fcn.0043d9e0
mov edx, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_SecureStartup_FilterDriver__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], edx
mov dword [ebp - 0x3c], edx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._______PreventDeviceEncryption_true__PreventDeviceEncryption__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_EnhancedStorage_Adm__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._______TCGSecurityActivationDisabled_1__TCGSecurityActivationDisabled__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.____settings__n
call sub.msvcrt.dll_fputs
test esi, 0x110
je 0x44fd9d
mov dword [esp + 4], ebx
mov dword [esp], str.___settings_pass_offlineServicing___n
call sub.msvcrt.dll_fputs
test esi, 0x10
je 0x44fd43
mov dword [esp], str._Set_internal_drives_offline
call fcn.0043d9e0
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_PartitionManager__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._______SanPolicy_4__SanPolicy__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
bt esi, 8
jae 0x44fd8d
mov dword [esp], str._Enforce_S_Mode
call fcn.0043d9e0
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [esp + 4], str._____component_name_Microsoft_Windows_CodeIntegrity__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], str._______SkuPolicyRequired_1__SkuPolicyRequired__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.______component__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.____settings__n
call sub.msvcrt.dll_fputs
mov dword [esp + 4], ebx
mov dword [esp], str.__unattend__n
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, 0x5287a0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret