Function at 0x1400c8fc0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov eax, dword [0x1402a3978]
test eax, eax
je 0x1400c8ff0
mov rax, qword [0x1402a3970]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, [0x1401a0f30]
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400c8fd8
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rdi, rax
je 0x1400c917c
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbp
test rax, rax
mov rbx, rax
je 0x1400c92b4
lea rsi, [rsp + 0x50]
lea r13, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov ecx, 8
mov r9, rsi
mov rdx, r13
call rax
test eax, eax
jne 0x1400c92b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80000005
jne 0x1400c92b4
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1400c92b4
lea rcx, [rax + rax]
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x1400c92b4
mov r9, rsi
mov r8, rax
mov rdx, r13
mov ecx, 8
call rbx
test eax, eax
je 0x1400c92ac
mov ebx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
lea edx, [rbx + rbx*4]
lea ecx, [rax + rdx*2 + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x1400c92ac
test ebx, ebx
je 0x1400c92a4
mov rbx, r12
xor r14d, r14d
nop dword [rax + rax]
test r14d, r14d
je 0x1400c9290
movzx edx, word [rbx]
lea r13, [rax + 1]
mov byte [rax], 0x3a
test dx, dx
je 0x1400c92fb
test dx, 0xff00
jne 0x1400c9160
cmp dx, 0x3a
je 0x1400c9160
mov rcx, r13
jmp 0x1400c911d
test dx, 0xff00
jne 0x1400c9160
cmp dx, 0x3a
je 0x1400c9160
add rcx, 1
add rbx, 2
mov byte [rcx - 1], dl
movzx edx, word [rbx]
test dx, dx
jne 0x1400c9110
cmp rcx, rax
je 0x1400c9160
mov byte [rcx], 0
mov rcx, r13
add rbx, 2
call fcn.1400c9480
mov rcx, r13
add r14d, 1
call sub.msvcrt.dll_strlen
add rax, r13
cmp r14d, dword [rsp + 0x48]
jb 0x1400c90e0
nop word [rax + rax]
cmp rsi, rax
mov byte [rax], 0
jae 0x1400c92a4
mov rcx, r12
call fcn.14016b6d8
mov rax, rsi
jmp 0x1400c92d4
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Control_PanelDesktopResourceLocale
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400c934b
xor ebx, ebx
lea rax, [rsp + 0x3c]
lea rsi, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x3c], 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x1400c92f4
cmp dword [rsp + 0x38], 1
jne 0x1400c92f4
mov eax, dword [rsp + 0x3c]
cmp eax, 9
ja 0x1400c92f4
jne 0x1400c9341
cmp byte [rsp + 0x58], 0
jne 0x1400c92f4
lea rdx, [rsp + 0x48]
mov r8d, 0x10
mov rcx, rsi
call sub.msvcrt.dll_strtoul
mov rdx, qword [rsp + 0x48]
cmp rdx, rsi
jbe 0x1400c92f4
cmp byte [rdx], 0
jne 0x1400c92f4
mov ecx, eax
call fcn.1400cabc0
test rax, rax
jne 0x1400c92d4
test bl, bl
je 0x1400c92d4
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rsi
lea r9, [0x1400c8fa0]
mov r8d, 1
mov edx, 0x10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
mov rax, qword [rsp + 0x50]
jmp 0x1400c92d4
movzx edx, word [rbx]
test dx, dx
je 0x1400c9160
mov r13, rax
jmp 0x1400c90fc
mov rcx, rsi
call fcn.14016b6d8
mov rcx, r12
call fcn.14016b6d8
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rdi
call rbp
test rax, rax
je 0x1400c9303
call rax
movzx ecx, ax
call fcn.1400c94f0
test rax, rax
je 0x1400c9303
mov qword [0x1402a3970], rax
mov dword [0x1402a3978], 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
jmp 0x1400c9256
mov rcx, r13
jmp 0x1400c9130
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Control_PanelDesktopResourceLocale
mov rcx, 0xffffffff80000001
mov ebx, 1
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400c91ad
jmp 0x1400c925a
mov byte [rsp + rax + 0x50], 0
jmp 0x1400c921c
xor eax, eax
jmp 0x1400c92d4