Function at 0x180027920
Capabilities:
Identify system language via api

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x78], rdx
mov r13, rcx
or rax, 0xffffffffffffffff
movzx r14d, ax
movzx edi, ax
mov word [rsp + 0x54], ax
xor esi, esi
mov qword [rsp + 0x68], rsi
lea r15, [rsp + 0x90]
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x5c], esi
mov dword [rsp + 0x58], 0x64
mov r12b, sil
mov byte [rsp + 0x50], sil
test rcx, rcx
jne 0x1800279a4
mov eax, 0xc0000008
jmp 0x180027b8e
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x5c]
mov ecx, 4
call qword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov ebx, eax
test eax, eax
je 0x1800279d2
cmp eax, 0xc0000023
jne 0x180027b7e
cmp dword [rsp + 0x58], 0x64
jbe 0x180027a2c
mov edx, dword [rsp + 0x58]
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNELBASE.dll_LocalAlloc]
mov r15, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x180027a02
mov ebx, 0xc0000017
jmp 0x180027b7e
mov r12b, 1
mov byte [rsp + 0x50], r12b
lea r9, [rsp + 0x58]
mov r8, rax
lea rdx, [rsp + 0x5c]
mov ecx, 4
call qword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov ebx, eax
test eax, eax
jne 0x180027b7e
cmp dword [rsp + 0x5c], esi
je 0x180027a96
mov rbx, r15
cmp dword [rsp + 0x58], esi
jbe 0x180027a96
cmp word [rbx], si
je 0x180027a96
lea r8, [rsp + 0x54]
lea rdx, [0x18007b9f8]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_swscanf_s]
or rcx, 0xffffffffffffffff
cmp eax, ecx
je 0x180027ab3
cmp r14w, cx
jne 0x180027a6b
movzx r14d, word [rsp + 0x54]
jmp 0x180027a73
cmp r14w, word [rsp + 0x54]
jne 0x180027aac
mov rax, rcx
inc rax
cmp word [rbx + rax*2], si
jne 0x180027a76
lea rbx, [rbx + rax*2]
add rbx, 2
mov rax, rbx
sub rax, r15
sar rax, 1
cmp eax, dword [rsp + 0x58]
jb 0x180027a3b
or rax, 0xffffffffffffffff
cmp r14w, ax
jne 0x180027abd
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
movzx r14d, ax
jmp 0x180027ad1
movzx edi, word [rsp + 0x54]
jmp 0x180027a96
mov ebx, 0xc000000d
jmp 0x180027b7e
cmp di, ax
jne 0x180027ada
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
movzx edi, ax
cmp r14w, ax
jne 0x180027ada
call qword [sym.imp.KERNELBASE.dll_GetUserDefaultUILanguage]
movzx edi, ax
cmp r14w, di
jne 0x180027ae9
call qword [sym.imp.KERNELBASE.dll_GetSystemDefaultUILanguage]
movzx edi, ax
movsx eax, di
movsx ecx, r14w
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [r13 + 8]
xor r8d, r8d
lea edx, [r8 + 0x21]
lea rcx, [0x18005e080]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rbx, rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
jmp 0x180027b7e
test r12b, r12b
je 0x180027b8c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180017170
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret