Function at 0x140061880
Capabilities:
Identify system language via api
Parse pe header

Disassembly:
movzx edx, cx
mov ecx, edx
and ecx, 0x3ff
cmp ecx, 0x781a
jg 0x140060f8f
je 0x140060d6d
dec ecx
cmp ecx, 0x90
ja case.0x140060ca0.5
lea r8, [0x140000000]
movsxd rax, ecx
mov ecx, dword [r8 + rax*4 + 0x60fac]
add rcx, r8
jmp rcx
mov eax, SafeArrayDestroy
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayDestroy
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
ret
mov eax, reloc.msi.dll_MsiDatabaseExportA
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayGetUBound
ret
mov eax, reloc.msi.dll_MsiDatabaseGenerateTransformA
ret
mov eax, SafeArrayGetElement
ret
mov eax, SafeArrayGetElement
ret
mov eax, SafeArrayGetElement
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayUnaccessData
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayGetElement
ret
mov eax, 0x141a
cmp dx, ax
je 0x140060d6d
mov eax, 0x201a
cmp dx, ax
je 0x140060d6d
mov eax, 0x181a
cmp dx, ax
je 0x140060d67
mov eax, 0x1c1a
cmp dx, ax
je 0x140060d67
mov eax, 0x2c1a
cmp dx, ax
je 0x140060d67
mov eax, 0x301a
cmp dx, ax
je 0x140060d67
mov eax, 0x241a
cmp dx, ax
je 0x140060d67
mov eax, 0x281a
cmp dx, ax
je 0x140060d67
mov eax, 0x41a
cmp dx, ax
je 0x140060d67
mov eax, 0x81a
cmp dx, ax
je 0x140060d67
mov eax, 0xc1a
cmp dx, ax
je 0x140060d67
xor r8d, r8d
mov ecx, 0x101a
mov eax, MsiEnumClientsA
cmp dx, cx
cmovne eax, r8d
ret
mov eax, 0x50
ret
mov eax, 0x19
ret
mov eax, 0x1a
ret
mov eax, 0x1b
ret
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
ret
mov eax, MsiEnumClientsA
ret
mov eax, MsiEnumComponentQualifiersA
ret
mov eax, MsiEnumComponentQualifiersA
ret
mov eax, 8
ret
mov eax, 1
ret
mov eax, reloc.msi.dll_MsiEnumClientsA
ret
mov eax, MsiEnumComponentQualifiersA
ret
mov eax, 2
ret
mov eax, reloc.msi.dll_MsiEnumComponentQualifiersA
ret
mov eax, 0x23
ret
mov eax, 0x24
ret
mov eax, 3
ret
mov eax, 0x25
ret
mov eax, 0x26
ret
mov eax, MsiEvaluateConditionW
ret
mov eax, MsiEvaluateConditionW
ret
mov eax, MsiEvaluateConditionW
ret
mov eax, MsiEvaluateConditionW
ret
mov eax, reloc.msi.dll_MsiEvaluateConditionW
ret
mov eax, MsiGetActiveDatabase
ret
mov eax, reloc.msi.dll_MsiGetActiveDatabase
ret
mov eax, MsiGetFeatureCostA
ret
mov eax, MsiGetFeatureCostA
ret
mov eax, MsiGetFeatureCostA
ret
mov eax, 4
ret
mov eax, 5
ret
mov eax, reloc.msi.dll_MsiGetFeatureCostA
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x3d
ret
mov eax, 0x3e
ret
mov eax, 0x3f
ret
mov eax, 0x40
ret
mov eax, 0x41
ret
mov eax, MsiGetPropertyW
ret
mov eax, MsiGetPropertyW
ret
mov eax, MsiGetPropertyW
ret
mov eax, MsiGetPropertyW
ret
mov eax, reloc.msi.dll_MsiGetPropertyW
ret
mov eax, MsiGetSummaryInformationW
ret
mov eax, MsiGetSummaryInformationW
ret
mov eax, 7
ret
mov eax, MsiGetSummaryInformationW
ret
mov eax, reloc.msi.dll_MsiGetSummaryInformationW
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0xa
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, MsiOpenDatabaseW
ret
mov eax, MsiOpenDatabaseW
ret
mov eax, 6
ret
mov eax, MsiOpenDatabaseW
ret
mov eax, MsiOpenDatabaseW
ret
mov eax, reloc.msi.dll_MsiOpenDatabaseW
ret
mov eax, 0x59
ret
mov eax, MsiPreviewBillboardW
ret
mov eax, MsiPreviewBillboardW
ret
mov eax, MsiPreviewDialogW
ret
mov eax, MsiPreviewDialogW
ret
mov eax, reloc.msi.dll_MsiPreviewBillboardW
ret
mov eax, MsiPreviewDialogW
ret
mov eax, reloc.msi.dll_MsiPreviewDialogW
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0x65
ret
mov eax, 0x66
ret
mov eax, 0x67
ret
mov eax, 0x68
ret
mov eax, 0x69
ret
mov eax, 0x6a
ret
mov eax, MsiRecordGetFieldCount
ret
sub ecx, 0x7c04
je 0x140060fa3
cmp ecx, 0x16
je 0x140060d67
xor eax, eax
ret
mov eax, SafeArrayDestroy
ret
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
mov ecx, edx
cmp edx, 0x804
jg 0x140061927
cmp edx, 0x804
je 0x140061980
sub ecx, 0x404
cmp ecx, 0x15
ja case.0x1400618cb.1030
lea r8, [0x140000000]
movsxd rcx, ecx
mov eax, dword [r8 + rcx*4 + 0x6198c]
add rax, r8
jmp rax
mov eax, 1
add rsp, 0x28
ret
mov eax, 2
add rsp, 0x28
ret
mov eax, 3
add rsp, 0x28
ret
mov eax, 4
add rsp, 0x28
ret
mov eax, 5
add rsp, 0x28
ret
mov eax, 8
add rsp, 0x28
ret
mov eax, 9
add rsp, 0x28
ret
mov eax, 0xa
add rsp, 0x28
ret
mov eax, SafeArrayDestroy
add rsp, 0x28
ret
cmp ecx, 0xc0a
jg 0x14006195a
je 0x140061950
sub ecx, 0x80a
je 0x140061950
sub ecx, 0xc
je case.0x1400618cb.1046
cmp ecx, 0x3ee
jmp 0x140061968
mov eax, 7
add rsp, 0x28
ret
mov eax, 6
add rsp, 0x28
ret
cmp ecx, 0x1004
je 0x140061980
cmp ecx, 0x1404
je case.0x1400618cb.1028
movzx ecx, dx
add rsp, 0x28
jmp 0x140060c60
mov eax, SafeArrayDestroy
add rsp, 0x28
ret
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
add rsp, 0x28
ret