Function at 0x14006cc50
Capabilities:
Identify system language via api

Disassembly:
mov r11, rsp
push rsi
push r15
sub rsp, 0x68
lea rax, [0x14015e578]
movsxd r15, ecx
mov qword [r11 - 0x48], rax
mov esi, edx
lea rax, str.amd64
mov dword [0x1401a0410], edx
mov qword [r11 - 0x40], rax
lea rax, [0x14015e584]
mov qword [r11 - 0x38], rax
lea rax, str.arm64
mov qword [r11 - 0x30], rax
xor eax, eax
mov qword [r11 - 0x28], rax
lea eax, [r15 - 1]
cmp eax, 3
ja 0x14006d45e
test edx, edx
je 0x14006d45e
lea r9, [0x1401e6130]
mov qword [r11 + 8], rbx
call fcn.14006ca20
test eax, eax
je 0x14006d44c
lea rdx, [0x14014fa14]
lea rcx, [0x1401e6130]
call fcn.1400e9510
mov rbx, rax
test rax, rax
je 0x14006d44c
mov qword [rsp + 0x88], rbp
lea rcx, str.Selected_Windows_User_Experience_options:
mov qword [rsp + 0x90], rdi
call fcn.14004f910
lea rdx, str.__xml_version_1.0__encoding_utf_8____n
mov rcx, rbx
call fcn.140001060
lea rdx, str._unattend_xmlns_urn:schemas_microsoft_com:unattend___n
mov rcx, rbx
call fcn.140001060
test sil, 1
je 0x14006ceeb
mov qword [rsp + 0x98], r12
lea rdx, str.___settings_pass_windowsPE___n
mov rcx, rbx
mov qword [rsp + 0x60], r14
call fcn.140001060
mov r8, qword [rsp + r15*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
mov rbp, r15
call fcn.140001060
lea rdx, str._______UserData__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._________ProductKey__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.___________Key____n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__________ProductKey__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.________UserData__n
mov rcx, rbx
call fcn.140001060
lea rcx, str._Bypass_SB_TPM_RAM
call fcn.14004f910
lea rdx, str._______RunSynchronous__n
mov rcx, rbx
call fcn.140001060
xor r12d, r12d
lea r14, str.BypassRAMCheck
lea edi, [r12 + 3]
nop
lea rdx, str._________RunSynchronousCommand_wcm:action_add___n
mov rcx, rbx
call fcn.140001060
lea r8d, [rdi - 2]
mov rcx, rbx
lea rdx, str.___________Order__d__Order__n
call fcn.140001060
mov r8, qword [r14 - 0x10]
lea rdx, str.___________Path_reg_add_HKLMSYSTEMSetupLabConfig__v__s__t_REG_DWORD__d_1__f__Path__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__________RunSynchronousCommand__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._________RunSynchronousCommand_wcm:action_add___n
mov rcx, rbx
call fcn.140001060
lea r8d, [rdi - 1]
mov rcx, rbx
lea rdx, str.___________Order__d__Order__n
call fcn.140001060
mov r8, qword [r14 - 8]
lea rdx, str.___________Path_reg_add_HKLMSYSTEMSetupLabConfig__v__s__t_REG_DWORD__d_1__f__Path__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__________RunSynchronousCommand__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._________RunSynchronousCommand_wcm:action_add___n
mov rcx, rbx
call fcn.140001060
mov r8d, edi
lea rdx, str.___________Order__d__Order__n
mov rcx, rbx
call fcn.140001060
mov r8, qword [r14]
lea rdx, str.___________Path_reg_add_HKLMSYSTEMSetupLabConfig__v__s__t_REG_DWORD__d_1__f__Path__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__________RunSynchronousCommand__n
mov rcx, rbx
call fcn.140001060
add edi, 3
lea r14, [r14 + 0x18]
add r12d, 3
cmp r12d, 3
jb 0x14006cdd0
mov r14, qword [rsp + 0x60]
lea rdx, str.________RunSynchronous__n
mov r12, qword [rsp + 0x98]
mov rcx, rbx
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.____settings__n
mov rcx, rbx
call fcn.140001060
jmp 0x14006ceee
mov rbp, r15
test sil, 4
je 0x14006cfa5
lea rdx, str.___settings_pass_specialize___n
mov rcx, rbx
call fcn.140001060
mov r8, qword [rsp + rbp*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_Deployment__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______RunSynchronous__n
mov rcx, rbx
call fcn.140001060
lea rcx, str._Bypass_online_account_requirement
call fcn.14004f910
lea rdx, str._________RunSynchronousCommand_wcm:action_add___n
mov rcx, rbx
call fcn.140001060
mov r8d, 1
lea rdx, str.___________Order__d__Order__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.___________Path_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionOOBE__v_BypassNRO__t_REG_DWORD__d_1__f__Path__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__________RunSynchronousCommand__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.________RunSynchronous__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.____settings__n
mov rcx, rbx
call fcn.140001060
test sil, 0xe8
je 0x14006d35c
lea rdx, str.___settings_pass_oobeSystem___n
mov rcx, rbx
call fcn.140001060
test sil, 0x48
je 0x14006d1da
mov r8, qword [rsp + rbp*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_Shell_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call fcn.140001060
test sil, 8
je 0x14006d01b
lea rcx, str._Disable_data_collection
call fcn.14004f910
lea rdx, str._______OOBE__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._________ProtectYourPC_3__ProtectYourPC__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.________OOBE__n
mov rcx, rbx
call fcn.140001060
test sil, 0x40
je 0x14006d1c8
cmp byte [0x1401e66e0], 0
je 0x14006d1b5
lea rdx, str.Administrator
lea rcx, [0x1401e66e0]
call fcn.140108174
test eax, eax
je 0x14006d1b5
lea rdx, str.Guest
lea rcx, [0x1401e66e0]
call fcn.140108174
test eax, eax
je 0x14006d1b5
lea rdx, [0x1401e66e0]
lea rcx, str._Use__s_for_local_account_name
call fcn.14004f910
lea rdx, str._______UserAccounts__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._________LocalAccounts__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.___________LocalAccount_wcm:action_add___n
mov rcx, rbx
call fcn.140001060
lea r8, [0x1401e66e0]
mov rcx, rbx
lea rdx, str._____________Name__s__Name__n
call fcn.140001060
lea r8, [0x1401e66e0]
mov rcx, rbx
lea rdx, str._____________DisplayName__s__DisplayName__n
call fcn.140001060
lea rdx, str._____________Group_Administrators_Power_Users__Group__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._____________Password__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______________Value_UABhAHMAcwB3AG8AcgBkAA__Value__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______________PlainText_false__PlainText__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.______________Password__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.____________LocalAccount__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__________LocalAccounts__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.________UserAccounts__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______FirstLogonCommands__n
mov rcx, rbx
call fcn.140001060
lea rdx, str._________SynchronousCommand_wcm:action_add___n
mov rcx, rbx
call fcn.140001060
mov r8d, 1
lea rdx, str.___________Order__d__Order__n
mov rcx, rbx
call fcn.140001060
lea r8, [0x1401e66e0]
mov rcx, rbx
lea rdx, str.___________CommandLine_net_user_quot__squot___logonpasswordchg:yes__CommandLine__n
call fcn.140001060
lea rdx, str.__________SynchronousCommand__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.________FirstLogonCommands__n
mov rcx, rbx
call fcn.140001060
jmp 0x14006d1c8
lea rdx, [0x1401e66e0]
lea rcx, str.WARNING:__s_is_not_allowed_as_local_account_name___Option_ignored
call fcn.14004f910
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
mov rbp, r15
mov rdi, rbp
test sil, 0x20
je 0x14006d2d7
lea rcx, str._Use_the_same_regional_options_as_this_users
call fcn.14004f910
mov r8, qword [rsp + rbp*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_International_Core__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call fcn.140001060
lea rdx, str.Keyboard_LayoutPreload1
mov byte [0x1401e5f30], 0
mov rcx, 0xffffffff80000001
call fcn.14006c500
lea r8, [0x1401e5f30]
mov rcx, rbx
lea rdx, str._______InputLocale__s__InputLocale__n
call fcn.140001060
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov ecx, eax
call fcn.14004f060
mov r8, rax
lea rdx, str._______SystemLocale__s__SystemLocale__n
mov rcx, rbx
call fcn.140001060
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
call fcn.14004f060
mov r8, rax
lea rdx, str._______UserLocale__s__UserLocale__n
mov rcx, rbx
call fcn.140001060
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
call fcn.14004f060
mov r8, rax
lea rdx, str._______UILanguage__s__UILanguage__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguageInstallLanguageFallback
mov byte [0x1401e5f30], 0
mov rcx, 0xffffffff80000002
call fcn.14006c500
lea r8, [0x1401e5f30]
mov rcx, rbx
lea rdx, str._______UILanguageFallback__s__UILanguageFallback__n
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
mov rbp, r15
test sil, sil
jns 0x14006d34d
lea rcx, str._Disable_bitlocker
call fcn.14004f910
mov rdi, qword [rsp + rdi*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_SecureStartup_FilterDriver__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov r8, rdi
mov rcx, rbx
call fcn.140001060
lea rdx, str._______PreventDeviceEncryption_true__PreventDeviceEncryption__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
mov r8, rdi
lea rdx, str._____component_name_Microsoft_Windows_EnhancedStorage_Adm__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______TCGSecurityActivationDisabled_1__TCGSecurityActivationDisabled__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.____settings__n
mov rcx, rbx
call fcn.140001060
mov rdi, qword [rsp + 0x90]
test esi, 0x110
je 0x14006d416
lea rdx, str.___settings_pass_offlineServicing___n
mov rcx, rbx
call fcn.140001060
test sil, 0x10
je 0x14006d3c3
lea rcx, str._Set_internal_drives_offline
call fcn.14004f910
mov r8, qword [rsp + rbp*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_PartitionManager__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______SanPolicy_4__SanPolicy__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
bt esi, 8
jae 0x14006d407
lea rcx, str._Enforce_S_Mode
call fcn.14004f910
mov r8, qword [rsp + rbp*8 + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_CodeIntegrity__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call fcn.140001060
lea rdx, str._______SkuPolicyRequired_1__SkuPolicyRequired__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.______component__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.____settings__n
mov rcx, rbx
call fcn.140001060
lea rdx, str.__unattend__n
mov rcx, rbx
call fcn.140001060
mov rcx, rbx
call fcn.1400e9730
mov rbp, qword [rsp + 0x88]
lea rax, [0x1401e6130]
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
pop r15
pop rsi
ret
mov rbx, qword [rsp + 0x80]
xor eax, eax
add rsp, 0x68
pop r15
pop rsi
ret
lea rcx, str.Note:_No_Windows_User_Experience_options_selected
call fcn.14004f910
xor eax, eax
add rsp, 0x68
pop r15
pop rsi
ret