Function at 0x140040528
Capabilities:
Identify system language via api

Disassembly:
add al, byte [rax]
add byte [rsi - 0x75], ah
mov ah, 0x24
test byte [rdx], 0
add byte [rsi - 0x77], ah
mul dword [rsi - 0x7f]
out dx, eax
insb byte [rdi], dx
frstor dword [rsi - 0x77]
mov esp, 0x2f624
add byte [rcx + 0x38], al
ror byte [rax + 0x1a72484], cl
add byte [rax], al
mov qword [rsp + 0x198], rcx
mov dword [rsp + 0x194], r8d
mov word [rsp + 0x192], si
jne 0x140040874
jmp 0x140040690
xorps xmm0, xmm0
lea rax, [rsp + 0x284]
mov ecx, 0x1c66adaf
mov dl, byte [rsp + 0x1a7]
or dl, 0xe2
mov r8d, dword [rsp + 0x2d8]
mov byte [rsp + 0x2f5], dl
sub ecx, r8d
mov byte [rsp + 0x2f5], 0x3b
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x284], ecx
mov ecx, dword [rsp + 0x194]
or ecx, ecx
mov dword [rsp + 0x2e0], ecx
movss dword [rsp + 0x26c], xmm0
lea rax, [rsp + 0x284]
mov ecx, dword [rsp + 0x2d8]
xor ecx, 0x1c66ad0f
movss xmm0, dword [rsp + 0x26c]
mov rdx, qword [rsp + 0x198]
xor rdx, 0xffffffffffffffff
mov r8, qword [str.pA_v_]
mov r9d, dword [rsp + 0x2d8]
mov qword [rsp + 0x2e8], rdx
add r9d, 0xe3995252
cvttss2si r10d, xmm0
mov dword [rsp + 0x18c], ecx
mov ecx, r10d
mov rdx, r8
mov r8d, dword [rsp + 0x18c]
mov qword [rsp + 0x20], rax
movss dword [rsp + 0x188], xmm0
call fcn.1400410f0
mov dword [rsp + 0x184], eax
call fcn.14003b340
movss xmm0, dword [0x140042100]
add dl, dh
movups xmm1, xmmword [0x140042108]
movss xmm2, dword [rsp + 0x188]
cvtss2sd xmm3, xmm2
addsd xmm3, xmm1
cvtsd2ss xmm1, xmm3
movss dword [rsp + 0x26c], xmm1
ucomiss xmm0, xmm1
mov dword [rsp + 0x180], eax
ja 0x1400405cc
jmp 0x140040faa
mov eax, 0x6e80e2
mov ecx, eax
lea rdx, [rsp + 0x250]
mov r8, qword [rsp + 0x208]
mov qword [rsp + 0x1f8], r8
mov r9b, byte [rsp + 0x2df]
mov r10b, byte [rsp + 0x2df]
add r10b, 0x4f
add r9b, 0xc0
mov r8, qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov eax, 0x6e80e2
mov r11d, eax
lea rsi, [rsp + 0x250]
mov qword [rsp + 0x178], rcx
mov rcx, r11
mov qword [rsp + 0x170], rdx
mov rdx, rsi
mov byte [rsp + 0x16f], r10b
mov byte [rsp + 0x16e], r9b
call r8
mov edi, 0xaaa1f1
mov ecx, edi
lea rdx, [rsp + 0x298]
mov r8, qword [sym.imp.USER32.dll_ClientToScreen]
mov edi, 0xaaa1f1
mov r11d, edi
lea rsi, [rsp + 0x298]
mov qword [rsp + 0x160], rcx
mov rcx, r11
mov qword [rsp + 0x158], rdx
mov rdx, rsi
mov dword [rsp + 0x154], eax
call r8
mov edi, 0x1dc0911a
mov ecx, edi
mov r9b, byte [rsp + 0x16f]
mov byte [rsp + 0x24e], r9b
mov bx, word [rsp + 0x192]
mov word [rsp + 0x2f6], bx
mov rdx, qword [rsp + 0x2d0]
mov r9b, byte [rsp + 0x1a7]
xor r9b, 0xde
mov edi, dword [rsp + 0x2d8]
mov byte [rsp + 0x2f5], r9b
sub rcx, rdx
mov word [rsp + 0x2f6], 0x7bbf
xor edi, 0x1c66a2a0
mov r9b, byte [rsp + 0x24e]
mov dword [rsp + 0x268], edi
mov qword [rsp + 0x1d0], rcx
mov r10b, byte [rsp + 0x1a7]
and r10b, 0x42
mov byte [rsp + 0x2f5], r10b
mov r10b, byte [rsp + 0x16e]
cmp r10b, r9b
mov dword [rsp + 0x150], eax
jbe 0x140040977
jmp 0x140040849
mov eax, 0x8f297047
mov ecx, dword [rsp + 0x2d8]
mov dx, word [rsp + 0x2e6]
sub eax, ecx
add dx, 0x5ffd
mov byte [rsp + 0x2f5], 0x92
mov r8w, word [rsp + 0x2b2]
mov r9w, word [rsp + 0x192]
imul r10w, r9w, 0x766d
mov word [rsp + 0x2f6], r10w
mov dword [rsp + 0x2b4], eax
cmp r8w, dx
jb 0x140040cfd
jmp 0x140040570
mov eax, 0x1c66adaf
sub eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x2e0], 0x57ffffe6
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0x84dcb7
mov ecx, eax
lea rdx, [rsp + 0x270]
lea edx, [rsp + 0x270]
mov r8b, byte [rsp + 0x1a7]
xor r8b, 0x62
mov r9w, word [rsp + 0x2e6]
mov byte [rsp + 0x2f5], r8b
mov r8b, byte [rsp + 0x1a7]
or r8b, 0x53
add r9w, 0xcb21
mov byte [rsp + 0x2f5], r8b
mov word [rsp + 0x2b2], r9w
mov qword [rsp + 0x1a8], rdx
mov rdx, qword [sym.imp.GDI32.dll_GetClipBox]
mov eax, 0x84dcb7
mov r10d, eax
lea r11, [rsp + 0x270]
mov qword [rsp + 0x148], rcx
mov rcx, r10
mov qword [rsp + 0x140], rdx
mov rdx, r11
mov r10, qword [rsp + 0x140]
call r10
lea rcx, [rsp + 0x234]
mov esi, 0x1c66adaf
lea rdx, [rsp + 0x1e4]
mov dword [rsp + 0x2e0], 0xb874e824
mov qword [rsp + 0x2c0], rdx
mov edi, dword [rsp + 0x2d8]
mov r8b, byte [rsp + 0x1a7]
and r8b, 0x7f
mov byte [rsp + 0x2f5], r8b
sub esi, edi
mov qword [rsp + 0x288], rcx
mov dword [rsp + 0x2b4], esi
mov esi, dword [rsp + 0x194]
xor esi, 0x68a9e112
mov dword [rsp + 0x2e0], esi
mov dword [rsp + 0x13c], eax
jmp 0x140040cfd
mov eax, 0x27686
mov ecx, eax
lea rdx, [rsp + 0x268]
lea r8, [rsp + 0x1d0]
lea r9, [rsp + 0x2c8]
lea r10, [rsp + 0x210]
mov eax, dword [rsp + 0x194]
xor eax, eax
mov dword [rsp + 0x2e0], eax
mov eax, dword [rsp + 0x194]
or eax, eax
mov dword [rsp + 0x2e0], eax
mov r11, qword [rsp + 0x198]
mov qword [rsp + 0x2e8], r11
mov eax, dword [rsp + 0x2d8]
mov esi, dword [rsp + 0x194]
or esi, 0x48a6bbc9
add eax, 0xe3996160
mov dword [rsp + 0x2e0], esi
mov qword [rsp + 0x2c8], r10
mov r10, rsp
mov dword [r10 + 0x20], eax
mov r10, qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov eax, 0x27686
mov edi, eax
lea rbx, [rsp + 0x268]
lea r14, [rsp + 0x1d0]
lea r15, [rsp + 0x2c8]
mov qword [rsp + 0x130], rcx
mov rcx, rdi
mov qword [rsp + 0x128], rdx
mov rdx, rbx
mov qword [rsp + 0x120], r8
mov r8, r14
mov qword [rsp + 0x118], r9
mov r9, r15
call r10
mov esi, 0x8a2dc9
mov ecx, esi
lea rdx, [rsp + 0x2a0]
xor esi, esi
mov ebp, 0xc
mov r8d, ebp
mov r12b, byte [rsp + 0x1a7]
add r12b, 0xd8
mov byte [rsp + 0x2f5], r12b
mov r13w, word [rsp + 0x192]
and r13w, 0xe45f
mov ebp, dword [rsp + 0x2d8]
mov word [rsp + 0x2f6], r13w
mov r12b, byte [rsp + 0x1a7]
xor r12b, 0xff
add ebp, 0xe399526c
mov byte [rsp + 0x2f5], r12b
mov r9d, dword [rsp + 0x194]
imul r9d, r9d, 0x7acffb11
mov dword [rsp + 0x2e0], r9d
mov r10, qword [rsp + 0x1b8]
mov qword [rsp + 0x110], rcx
mov rcx, r10
mov qword [rsp + 0x108], rdx
mov edx, esi
mov dword [rsp + 0x104], eax
mov dword [rsp + 0x100], ebp
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
mov r8, qword [rsp + 0x108]
call sub.USER32.dll_DdeSetQualityOfService
mov r9d, 0x57081a
mov ecx, r9d
lea rdx, [rsp + 0x1b4]
lea r8, [rsp + 0x294]
mov r9d, 0x1d8ed1d4
mov r10d, r9d
mov r9d, 0x1c66b718
mov byte [rsp + 0x2f5], 0x15
mov esi, dword [rsp + 0x194]
add esi, 0x21bc7340
mov ebp, dword [rsp + 0x2d8]
add ebp, 0xe3995d75
mov dword [rsp + 0x2e0], esi
mov r11, qword [rsp + 0x2d0]
mov r12b, byte [rsp + 0x1a7]
xor r12b, 0xff
sub r9d, dword [rsp + 0x2d8]
sub r10, r11
mov byte [rsp + 0x2f5], r12b
mov esi, dword [rsp + 0x2d8]
xor esi, 0x1c66a3ed
mov r11d, dword [rsp + 0x100]
mov dword [rsp + 0x1b4], r11d
mov r11d, dword [rsp + 0x2d8]
xor r11d, 0x1c66a608
mov dword [rsp + 0x294], r9d
mov rdi, rsp
lea rbx, [rsp + 0x294]
mov qword [rdi + 0x28], rbx
lea rbx, [rsp + 0x1b4]
mov qword [rdi + 0x20], rbx
mov rdi, qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
mov r9d, 0x57081a
mov ebx, r9d
mov qword [rsp + 0xf8], rcx
mov rcx, rbx
mov qword [rsp + 0xf0], rdx
mov edx, ebp
mov qword [rsp + 0xe8], r8
mov r8d, r11d
mov r9d, esi
mov dword [rsp + 0xe4], eax
mov qword [rsp + 0xd8], r10
call rdi
mov edx, 0xe52074
mov ecx, edx
mov r10, qword [sym.imp.GDI32.dll_RemoveFontMemResourceEx]
mov edx, 0xe52074
mov edi, edx
mov qword [rsp + 0xd0], rcx
mov rcx, rdi
mov dword [rsp + 0xcc], eax
call r10
mov edx, 0x1d8ed88b
mov ecx, edx
mov r13w, 0x9b75
mov r8w, word [rsp + 0x192]
sub r8w, r8w
mov word [rsp + 0x2f6], r8w
mov r8w, word [rsp + 0x192]
sub r13w, r8w
mov word [rsp + 0x2f6], r13w
xor r8w, 0x82ef
mov word [rsp + 0x2f6], r8w
mov edx, dword [rsp + 0x194]
imul r9d, edx, 0x1209af31
mov dword [rsp + 0x2e0], r9d
mov r10, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x2d0]
mov dword [rsp + 0x2e0], edx
or edx, 0x5ceb374a
sub rcx, rdi
mov dword [rsp + 0x2e0], edx
mov rdi, qword [rsp + 0xd8]
add r10, rdi
mov qword [rsp + 0x208], r10
cmp r10, rcx
mov dword [rsp + 0xc8], eax
je 0x140040849
jmp 0x140040690
mov qword [rsp + 0x2e8], 0x179b5d81
mov eax, dword [rsp + 0x2b4]
mov rcx, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [rsp + 0xc4], eax
call rcx
mov byte [rsp + 0x2f5], 0x90
mov rcx, qword [rsp + 0x198]
add rcx, rcx
mov edx, dword [rsp + 0x2d8]
xor edx, 0x1c66a7ee
mov qword [rsp + 0x2e8], rcx
mov rcx, qword [sym.imp.USER32.dll_GetClipboardOwner]
mov word [rsp + 0xc2], ax
mov dword [rsp + 0xbc], edx
call rcx
mov edx, dword [rsp + 0x2d8]
add edx, 0xe39952be
mov rcx, qword [sym.imp.KERNEL32.dll_GetVersion]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xac], edx
call rcx
mov rcx, qword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [rsp + 0xa8], eax
call rcx
mov edx, 0x1c66b108
mov r8w, word [rsp + 0x192]
and r8w, r8w
mov word [rsp + 0x2f6], r8w
sub edx, dword [rsp + 0x2d8]
mov word [rsp + 0x2f6], 0xde8b
mov rcx, qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x9c], edx
call rcx
mov rcx, qword [sym.imp.KERNEL32.dll_GetErrorMode]
mov dword [rsp + 0x98], eax
call rcx
mov edx, 0x7d07fa
mov ecx, edx
lea r9, [rsp + 0x1e4]
mov r10, qword [rsp + 0x198]
or r10, 0x48e49314
mov qword [rsp + 0x2e8], r10
mov edx, dword [rsp + 0xbc]
mov dword [rsp + 0x1e4], edx
mov r10, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, 0x7d07fa
mov r11d, edx
lea rdx, [rsp + 0x1e4]
mov qword [rsp + 0x90], rcx
mov rcx, r11
mov dword [rsp + 0x8c], eax
mov qword [rsp + 0x80], r9
call r10
mov esi, 0xe15945
mov ecx, esi
mov bl, byte [rsp + 0x1a7]
add bl, 0x38
mov esi, dword [rsp + 0x2d8]
mov byte [rsp + 0x2f5], bl
add esi, 0xe3995252
mov rdx, qword [rsp + 0x198]
mov qword [rsp + 0x2e8], rdx
mov r9, qword [sym.imp.GDI32.dll_GetTextColor]
mov edi, 0xe15945
mov r10d, edi
mov qword [rsp + 0x78], rcx
mov rcx, r10
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], esi
call r9
mov esi, 0x9683d4
mov ecx, esi
mov esi, 0x37ef31e1
mov edx, esi
mov r9, qword [rsp + 0x198]
sub rdx, r9
mov qword [rsp + 0x2e8], rdx
mov rdx, qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov esi, 0x9683d4
mov r10d, esi
mov qword [rsp + 0x68], rcx
mov rcx, r10
mov dword [rsp + 0x64], eax
call rdx
mov esi, 0x4e9eb5
mov ecx, esi
lea rdx, [rsp + 0x234]
mov esi, dword [rsp + 0x194]
and esi, 0xf5b5f50
mov dword [rsp + 0x2e0], esi
mov r8w, word [rsp + 0x192]
and r8w, 0xb1f2
mov word [rsp + 0x2f6], r8w
mov esi, dword [rsp + 0x9c]
mov dword [rsp + 0x234], esi
mov r9, qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov esi, 0x4e9eb5
mov r10d, esi
lea r11, [rsp + 0x234]
mov qword [rsp + 0x58], rcx
mov rcx, r10
mov qword [rsp + 0x50], rdx
mov rdx, r11
mov dword [rsp + 0x4c], eax
call r9
mov word [rsp + 0x2f6], 0x24f
mov rcx, qword [rsp + 0x198]
or rcx, 0x3f449ba6
mov qword [rsp + 0x2e8], rcx
mov esi, dword [rsp + 0xc4]
mov edi, dword [rsp + 0x70]
add esi, edi
mov dword [rsp + 0x2b4], esi
mov edi, dword [rsp + 0xac]
cmp esi, edi
mov dword [rsp + 0x48], eax
je 0x1400407ef
jmp 0x140040cfd
lea rax, [rsp + 0x294]
lea rcx, [rsp + 0x1b4]
mov edx, 0x1d8ed1d3
mov r8d, edx
lea r9, [rsp + 0x2a0]
lea r10, [rsp + 0x2c8]
lea r11, [rsp + 0x210]
lea rsi, [rsp + 0x1d0]
movabs rdi, 0x157ac32d404db24a
lea rbx, [rsp + 0x268]
lea r14, [rsp + 0x298]
lea r15, [rsp + 0x250]
mov qword [rsp + 0x1c0], r15
mov edx, dword [rsp + 0x194]
xor edx, 0x50c7ab10
mov dword [rsp + 0x2e0], edx
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x2e8], rdi
mov dword [rsp + 0x2e0], 0xcc69a7b9
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x2b8], r11
mov qword [rsp + 0x1f0], r10
mov bpl, byte [rsp + 0x1a7]
mov qword [rsp + 0x40], rax
mov al, bpl
mul bpl
mov byte [rsp + 0x2f5], al
mov qword [rsp + 0x1b8], r9
mov edx, dword [rsp + 0x194]
xor edx, 0x496fbc23
mov dword [rsp + 0x2e0], edx
sub r8, qword [rsp + 0x2d0]
mov al, 0x94
mov byte [rsp + 0x3f], al
mov al, bpl
mov r12b, byte [rsp + 0x3f]
mul r12b
mov byte [rsp + 0x2f5], al
mov qword [rsp + 0x240], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x2e8], 0x1b44b301
mov qword [rsp + 0x1c8], rcx
or bpl, 0xf3
mov byte [rsp + 0x2f5], bpl
mov qword [rsp + 0x208], r8
jmp 0x140040690