Function at 0x14005a700
Capabilities:
Get memory capacity
Identify system language via api
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rax - 0x5e8]
sub rsp, 0x6d0
mov rbx, r9
mov rdi, r8
test rdx, rdx
je 0x14005b2e1
test r8, r8
je 0x14005b2e1
cmp word [r8], 0
je 0x14005b2e1
test rbx, rbx
je 0x14005b2e1
cmp word [r9], 0
je 0x14005b2e1
mov r8, rdx
mov qword [rax - 0x28], r15
mov edx, 0x80
mov qword [rax + 0x18], rsi
mov r9, 0xffffffffffffffff
lea rcx, [0x140214b2a]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea rcx, [0x140214c2a]
mov r8, rdi
lea edx, [r9 + 0x29]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea rcx, [0x140214c7a]
mov r8, rbx
mov edx, 0x80
call fcn.14003c218
xor r15d, r15d
cmp word [0x140214d7a], r15w
mov word [0x140219d4a], r15w
mov qword [0x140219fa8], r15
mov word [0x140219e4a], r15w
mov word [0x140219e9a], r15w
jne 0x14005ad74
cmp byte [rbp + 0x610], r15b
je 0x14005ad74
lea rax, [0x1401b66b8]
mov qword [rbp - 0x18], 0xffffffffffffffff
mov r8d, 0x103
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14005ad51
cmp word [rbp + 0x110], r15w
je 0x14005ad51
lea r8, [0x140214d7a]
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x20]
call fcn.140090c10
test al, al
je 0x14005ad51
xor r8d, r8d
lea rdx, [0x140214d7a]
call fcn.140059bd0
xorps xmm0, xmm0
mov word [rbp - 0x10], r15w
xor eax, eax
lea rdx, str.utm_cookie
lea rcx, [0x140214d7a]
mov qword [rbp + 0x62], rax
movups xmmword [rbp - 0xe], xmm0
mov dword [rbp + 0x6a], eax
lea rbx, [rbp - 0x10]
lea edi, [rax + 0x3f]
mov word [rbp + 0x6e], ax
movups xmmword [rbp + 2], xmm0
movups xmmword [rbp + 0x12], xmm0
movups xmmword [rbp + 0x22], xmm0
movups xmmword [rbp + 0x32], xmm0
movups xmmword [rbp + 0x42], xmm0
movups xmmword [rbp + 0x52], xmm0
call fcn.1400308bc
mov rdx, rax
movabs rsi, 0x4000002400
test rax, rax
je 0x14005a921
movzx ecx, word [rdx + 0x16]
add rdx, 0x16
test cx, cx
je 0x14005a8ef
nop word [rax + rax]
cmp cx, 0x7c
je 0x14005a8ef
cmp cx, 0x26
ja 0x14005a8d5
movzx eax, cx
bt rsi, rax
jb 0x14005a8ef
cmp edi, 1
jbe 0x14005a8ef
add rdx, 2
mov word [rbx], cx
add rbx, 2
dec edi
movzx ecx, word [rdx]
test cx, cx
jne 0x14005a8c0
mov word [rbx], r15w
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14005a900
cmp rax, 8
jb 0x14005a921
lea rcx, [rbp - 0x10]
call fcn.14003e038
cmp rax, 0x2710
jge 0x14005a926
mov word [rbp - 0x10], r15w
lea rdx, str.utm_cookie_expiration
mov word [rbp + 0x110], r15w
lea rcx, [0x140214d7a]
mov edi, 0x103
lea rbx, [rbp + 0x110]
call fcn.1400308bc
mov rdx, rax
test rax, rax
je 0x14005ad4c
movzx ecx, word [rdx + 0x2c]
add rdx, 0x2c
test cx, cx
je 0x14005a995
cmp cx, 0x7c
je 0x14005a995
cmp cx, 0x26
ja 0x14005a97b
movzx eax, cx
bt rsi, rax
jb 0x14005a995
cmp edi, 1
jbe 0x14005a995
add rdx, 2
mov word [rbx], cx
add rbx, 2
dec edi
movzx ecx, word [rdx]
test cx, cx
jne 0x14005a966
mov word [rbx], r15w
cmp word [rbp + 0x110], r15w
je 0x14005ad4c
lea rcx, [rbp + 0x110]
call fcn.14003e038
xor ecx, ecx
mov rbx, rax
call fcn.140035ae0
lea rcx, [rax - 0x1c20]
cmp rbx, rcx
jl 0x14005ad4c
cmp rbx, rax
jg 0x14005ad4c
cmp word [rbp - 0x10], r15w
je 0x14005ad51
xorps xmm0, xmm0
mov dword [rbp + 0x5f0], 0x7e
xor eax, eax
mov qword [rbp - 0x60], r15
mov qword [rbp + 0xe4], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov dword [rbp + 0xec], eax
mov r9d, 0x20119
mov dword [rbp + 0x70], eax
xor r8d, r8d
lea rax, [rbp - 0x60]
mov dword [rbp + 0x5f8], r15d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005aab8
mov rcx, qword [rbp - 0x60]
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x5f8]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, [0x1401b6784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x60]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005aab8
lea rcx, [rbp + 0x70]
call fcn.14003e038
cmp rax, 0x2710
jge 0x14005ab4d
xor eax, eax
mov dword [rsp + 0x50], 0x7e
mov dword [rbp + 0x70], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], r15d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005abc9
mov rcx, qword [rbp - 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, [0x1401b6784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005abc9
lea rcx, [rbp + 0x70]
call fcn.14003e038
cmp rax, 0x2710
jl 0x14005abc9
cmp word [rbp + 0x70], r15w
je 0x14005abce
lea rdx, [0x1401b5be8]
mov word [rbp + 0x110], r15w
lea rcx, [0x140214d7a]
mov edi, 0x103
lea rbx, [rbp + 0x110]
call fcn.1400308bc
mov rdx, rax
test rax, rax
je 0x14005ad51
movzx ecx, word [rdx + 0x26]
add rdx, 0x26
test cx, cx
je 0x14005abc3
cmp cx, 0x7c
je 0x14005abc3
cmp cx, 0x26
ja 0x14005aba9
movzx eax, cx
bt rsi, rax
jb 0x14005abc3
cmp edi, 1
jbe 0x14005abc3
add rdx, 2
mov word [rbx], cx
add rbx, 2
dec edi
movzx ecx, word [rdx]
test cx, cx
jne 0x14005ab94
mov word [rbx], r15w
jmp 0x14005abce
mov word [rbp + 0x70], r15w
lea rax, [rbp + 0x70]
lea r8, [rbp - 0x10]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14005abf4
add rax, 2
test ecx, ecx
jne 0x14005abe0
test edx, edx
je 0x14005ad51
mov rcx, 0xffffffff80000002
call fcn.140003c10
test al, al
jne 0x14005ac1f
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call fcn.140003b60
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x14005ac30
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x14005aca6
lea rax, [rbp - 0x50]
mov qword [rbp - 0x50], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005aca6
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b6784]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000001
call fcn.140003c10
test al, al
jne 0x14005acc9
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call fcn.140003b60
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x14005acd4
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x14005ad51
lea rax, [rbp - 0x48]
mov qword [rbp - 0x48], r15
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005ad51
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b6784]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005ad51
mov word [rbp - 0x10], r15w
mov rcx, qword [rbp - 0x18]
lea rax, [0x1401b66b8]
mov qword [rbp - 0x20], rax
cmp rcx, 0xffffffffffffffff
je 0x14005ad74
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], 0xffffffffffffffff
cmp word [0x140215d7a], r15w
jne 0x14005b2bd
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x6c8], r14
mov qword [rbp + 0x3a8], rax
lea rcx, [rbp + 0x320]
lea rax, [0x1401b6740]
mov dword [rbp + 0x3b0], r15d
mov qword [rbp + 0x3a0], rax
mov dword [rbp + 0x3b4], 0x100
mov word [rbp + 0x3b8], r15w
mov dword [rbp + 0x320], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r14, qword [rbp + 0x328]
xorps xmm0, xmm0
shr r14, 0x14
test eax, eax
mov qword [rbp + 0x100], r15
movdqu xmmword [rbp + 0xf0], xmm0
cmove r14d, r15d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov r9d, 0x20
mov dword [rbp + 0x108], eax
lea rdx, str.Arabic___Saudi_Arabia
lea rax, [0x1400663d0]
mov r8d, 0xb8
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
call fcn.140040d4c
test rax, rax
je 0x14005ae65
mov r8, qword [rax + 8]
test r8, r8
je 0x14005ae65
xor edx, edx
mov dword [rsp + 0x28], 0x1f
lea rax, [rbp + 0x360]
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x14005ae83
mov r9, 0xffffffffffffffff
lea r8, [0x1401b5c10]
lea rcx, [rbp + 0x360]
lea edx, [r9 + 0x20]
call fcn.14003c218
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x360]
call fcn.14005f610
mov rsi, qword [rbp + 0x3a8]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x40], rsi
lea ecx, [r14 + 0xff]
and ecx, 0xfffff00
lea r9, str.modeldesktopscr_res_dx_dcpu_umemory_ul_s
mov dword [rsp + 0x38], ecx
mov edx, 0x1ff
mov dword [rsp + 0x30], edi
lea rcx, [0x140215d7a]
mov dword [rsp + 0x28], ebx
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call fcn.140003a90
xor eax, eax
mov dword [rsp + 0x60], 0x206
mov dword [rbp + 0x110], eax
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
lea rax, [rbp - 0x40]
mov qword [rbp - 0x40], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], r15d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14, qword [rsp + 0x6c8]
test eax, eax
jne 0x14005aff1
mov rcx, qword [rbp - 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, str.SystemManufacturer
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005aff1
lea rdx, [rbp + 0x110]
call fcn.140054c90
cmp rax, 3
jbe 0x14005aff1
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x110]
call fcn.14005f610
mov r9, 0xffffffffffffffff
lea r8, str.model_vendor
mov edx, 0x200
lea rcx, [0x140215d7a]
call fcn.14003e19c
mov r8, qword [rbp + 0x3a8]
lea rcx, [0x140215d7a]
mov r9, 0xffffffffffffffff
mov edx, 0x200
call fcn.14003e19c
xor eax, eax
mov dword [rsp + 0x70], 0x206
mov dword [rbp + 0x110], eax
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
lea rax, [rbp - 0x38]
mov qword [rbp - 0x38], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x78], r15d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b0da
mov rcx, qword [rbp - 0x38]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, str.SystemProductName
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b0da
lea rdx, [rbp + 0x110]
call fcn.140054c90
cmp rax, 3
jbe 0x14005b0da
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x110]
call fcn.14005f610
mov r9, 0xffffffffffffffff
lea r8, str.model_device
mov edx, 0x200
lea rcx, [0x140215d7a]
call fcn.14003e19c
mov r8, qword [rbp + 0x3a8]
lea rcx, [0x140215d7a]
mov r9, 0xffffffffffffffff
mov edx, 0x200
call fcn.14003e19c
xor ecx, ecx
call fcn.140035ae0
mov rdi, rax
mov dword [rbp - 0x80], 0x206
xor eax, eax
mov qword [rbp - 0x30], r15
mov dword [rbp + 0x110], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp - 0x30]
mov dword [rbp - 0x78], r15d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b190
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, str.Install.Time
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b190
cmp word [rbp + 0x110], r15w
je 0x14005b190
lea rcx, [rbp + 0x110]
call fcn.14003e038
cmp rax, rdi
cmovg rax, rdi
lea rcx, [rax + 0x128a1800]
cmp rcx, rdi
cmovl rax, rdi
mov rdi, rax
lea r9, str.fv_date_I64d
mov qword [rsp + 0x20], rdi
mov edx, 0x103
lea rcx, [rbp + 0x110]
mov r8, 0xffffffffffffffff
call fcn.140003a90
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x110]
mov edx, 0x200
lea rcx, [0x140215d7a]
call fcn.14003e19c
xor eax, eax
mov dword [rbp - 0x70], 0x206
mov dword [rbp + 0x110], eax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAdvertisingInfo
lea rax, [rbp - 0x28]
mov qword [rbp - 0x28], r15
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x68], r15d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b251
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x68]
lea rax, [rbp + 0x110]
xor r8d, r8d
lea rdx, [0x1401b5d30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x28]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14005b2a1
lea rdx, [rbp + 0x110]
call fcn.140054c90
cmp rax, 0x10
jbe 0x14005b2a1
mov r9, 0xffffffffffffffff
lea r8, str.advid
mov edx, 0x200
lea rcx, [0x140215d7a]
call fcn.14003e19c
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x110]
mov edx, 0x200
lea rcx, [0x140215d7a]
call fcn.14003e19c
lea rax, [0x1401b6738]
mov qword [rbp + 0x3a8], r15
mov qword [rbp + 0x3a0], rax
mov dword [rbp + 0x3b0], r15d
mov r15, qword [rsp + 0x6c0]
mov al, 1
mov rsi, qword [rsp + 0x700]
mov byte [0x140214a28], 1
add rsp, 0x6d0
pop rdi
pop rbx
pop rbp
ret
xor al, al
add rsp, 0x6d0
pop rdi
pop rbx
pop rbp
ret