Function at 0x61ec68b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x61ede1a4]
test eax, eax
je 0x61ec68c0
mov eax, dword [0x61ede1a0]
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp], 0x61ed9834
call sub.msvcrt.dll_getenv
test eax, eax
je 0x61ec6c20
mov dword [esp], str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
mov dword [esp + 0x24], eax
je 0x61ec6a5f
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.GetUserPreferredUILanguages
mov dword [esp + 0x28], eax
call eax
sub esp, 8
test eax, eax
mov ebx, eax
je 0x61ec6bd0
lea edi, [esp + 0x44]
lea esi, [esp + 0x40]
mov dword [esp + 0x44], 0
mov dword [esp + 8], 0
mov dword [esp], 8
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
call eax
sub esp, 0x10
test eax, eax
jne 0x61ec6bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80000005
jne 0x61ec6bd0
mov eax, dword [esp + 0x44]
test eax, eax
je 0x61ec6bd0
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x2c], eax
je 0x61ec6bd0
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
je 0x61ec6bbb
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
lea edx, [ebx + ebx*4]
lea eax, [eax + edx*2 + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x61ec6bbb
test ebx, ebx
je 0x61ec6bb3
mov ebx, edi
xor ebp, ebp
test ebp, ebp
je 0x61ec6ba0
movzx edx, word [ebx]
lea edi, [eax + 1]
mov byte [eax], 0x3a
test dx, dx
je 0x61ec6c2e
test dx, 0xff00
jne 0x61ec6a43
cmp dx, 0x3a
je 0x61ec6a43
mov ecx, edi
jmp 0x61ec6a0d
test dx, 0xff00
jne 0x61ec6a43
cmp dx, 0x3a
je 0x61ec6a43
add ecx, 1
add ebx, 2
mov byte [ecx - 1], dl
movzx edx, word [ebx]
test dx, dx
jne 0x61ec6a00
cmp eax, ecx
je 0x61ec6a43
mov byte [ecx], 0
mov dword [esp], edi
add ebx, 2
call sym.libintl_8.dll__nl_locale_name_canonicalize
mov dword [esp], edi
add ebp, 1
call sub.msvcrt.dll_strlen
add eax, edi
cmp ebp, dword [esp + 0x40]
jb 0x61ec69d0
cmp esi, eax
mov byte [eax], 0
jae 0x61ec6bb3
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x61ec6bfd
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x61ec6c85
xor ebx, ebx
lea eax, [esp + 0x3c]
lea edi, [esp + 0x44]
mov dword [esp + 0x3c], 9
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov esi, eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
test esi, esi
jne 0x61ec6c27
cmp dword [esp + 0x38], 1
jne 0x61ec6c27
mov eax, dword [esp + 0x3c]
cmp eax, 9
ja 0x61ec6c27
jne 0x61ec6c7b
cmp byte [esp + 0x4c], 0
jne 0x61ec6c27
lea eax, [esp + 0x40]
mov dword [esp + 8], 0x10
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strtoul
mov edx, dword [esp + 0x40]
cmp edx, edi
jbe 0x61ec6c27
cmp byte [edx], 0
jne 0x61ec6c27
mov dword [esp], eax
call sym.libintl_8.dll__nl_locale_name_from_win32_LCID
test eax, eax
mov esi, eax
jne 0x61ec6bfd
test bl, bl
je 0x61ec6bfd
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x61ec6890
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
sub esp, 0x14
mov esi, dword [esp + 0x44]
jmp 0x61ec6bfd
movzx edx, word [ebx]
test dx, dx
je 0x61ec6a43
mov edi, eax
jmp 0x61ec69ea
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov esi, esi
lea edi, [edi]
mov eax, dword [esp + 0x24]
mov dword [esp + 4], str.GetUserDefaultUILanguage
mov dword [esp], eax
call dword [esp + 0x28]
sub esp, 8
test eax, eax
je 0x61ec6c35
call eax
movzx eax, ax
mov dword [esp], eax
call sym.libintl_8.dll__nl_locale_name_from_win32_LANGID
test eax, eax
mov esi, eax
je 0x61ec6c35
mov dword [0x61ede1a0], esi
mov dword [0x61ede1a4], 1
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x61ede1a0]
jmp 0x61ec6c0f
xor esi, esi
jmp 0x61ec6b5b
mov ecx, edi
jmp 0x61ec6a1e
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
mov ebx, 1
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
lea edi, [esp + 0x44]
je 0x61ec6a99
jmp 0x61ec6b63
mov byte [esp + eax + 0x44], 0
jmp 0x61ec6b1c
xor esi, esi
jmp 0x61ec6bfd