Function at 0x140014860
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
mov byte [rsp + 8], cl
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsx eax, byte [0x140042b55]
mov r11b, 0xaa
mov dword [rsp + 0x88], r11d
mov ebp, 0x116
mov r13b, 0x2f
cmp eax, 0x1c3
jne 0x1400148ac
movsx eax, byte [0x140042b88]
cmp eax, 0x9d
je 0x1400148ac
movzx ecx, byte [0x140042b54]
jmp 0x1400148b5
movzx ecx, byte [0x140042b54]
inc cl
movzx eax, byte [0x140042b68]
xor ebx, ebx
add al, 0x1d
or al, 0xc3
xor byte [0x140042a63], al
mov eax, ebx
cmp byte [0x140042b81], 0xdd
lea edi, [rbx + 1]
sete al
xor eax, 0x7d
jne 0x1400148e6
cmp dword [0x140042b5c], ebx
mov eax, ebx
je 0x1400148e8
mov eax, edi
mov r8d, dword [0x140042b7c]
xor cl, al
mov edx, dword [0x140042b34]
mov r9d, 0xc6
mov byte [0x140042b54], cl
movsx ecx, byte [0x140042b67]
lea eax, [r8 - 0x60]
or dword [0x140042b6c], eax
test r8d, r8d
je 0x140014927
mov eax, 0xd2
shl eax, cl
xor eax, 0x73
mov eax, edi
jne 0x140014929
mov eax, ebx
or edx, eax
test r8d, r8d
je 0x14001493e
mov eax, 0xd2
shl eax, cl
xor eax, 0x73
mov eax, edi
jne 0x140014940
mov eax, ebx
or edx, eax
sub r9, rdi
jne 0x140014914
mov eax, ebx
mov dword [0x140042b34], edx
test edx, edx
mov byte [0x140042a86], bl
setne al
mov dword [0x140042b44], eax
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
cmp dword [0x140042b38], ebx
je 0x140014983
movzx ecx, byte [0x140042b88]
mov eax, ebx
shl eax, cl
mov dword [0x140042b4c], edi
test eax, eax
jne 0x140014989
mov dword [0x140042b4c], ebx
mov eax, dword [0x140042a88]
lea ecx, [rax*4 - 0x56]
mov eax, 0x38e38e39
mul ecx
shr edx, 1
lea eax, [rdx + rdx*8]
sub ecx, eax
je 0x1400149dd
sub ecx, edi
je 0x1400149d5
sub ecx, edi
je 0x1400149ba
cmp ecx, edi
jne 0x1400149ec
xor dword [0x140042b40], edi
jmp 0x1400149ec
mov eax, dword [0x140042b34]
add eax, 0x1af
cmp eax, 0xda
sete al
add byte [0x140042a63], al
jmp 0x1400149ec
dec dword [0x140042b60]
jmp 0x1400149ec
movzx eax, byte [0x140042b7c]
xor al, 0x55
mov byte [0x140042b81], al
mov dword [0x140042b30], ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov ecx, dword [0x140042b7c]
mov r8d, ebx
mov r15d, dword [0x140042a64]
mov r10d, 0x90
movzx eax, byte [0x140042b83]
movzx r9d, byte [0x140042b80]
xor eax, 0x7d
mov r12d, dword [0x140042b30]
and ecx, eax
movsx eax, byte [0x140042b67]
mov r14d, dword [0x140042b3c]
mov r11d, dword [0x140042b4c]
sar eax, 0xe2
mov dword [rsp + 0x20], ecx
mov dword [0x140042b7c], ecx
mov ecx, dword [0x140042b68]
and ecx, eax
movzx eax, r9b
or al, 0xd4
mov dword [rsp + 0x90], ecx
movsx eax, al
mov dword [0x140042b68], ecx
imul ecx, eax, 0xffffff8b
mov eax, ebx
add byte [0x140042b66], cl
cmp dword [0x140042b2c], 0x1a2
movsx ecx, byte [0x140042b64]
sete al
mov dword [rsp + 0x80], ecx
imul esi, dword [0x140042b58], 0x9d
sub r15d, eax
mov eax, 0xaaaaaaab
mov dword [0x140042a64], r15d
or r12d, 0x60
mul esi
shr edx, 1
lea eax, [rdx + rdx*2]
mov edx, dword [0x140042b6c]
sub esi, eax
mov eax, 0xffffffaa
shl al, cl
xor al, byte [0x140042b34]
mov dword [rsp + 0x98], eax
mov al, 0x82
movsx ecx, al
mov eax, 0x103
shl eax, cl
or eax, dword [rsp + 0x80]
and edx, eax
mov eax, ebx
cmp ecx, r14d
sete al
sub r11d, r12d
and r8d, eax
movzx eax, sil
sub r10, rdi
jne 0x140014ad1
mov r12d, dword [rsp + 0x90]
mov ecx, dword [0x140042b78]
add r12b, 3
mov r10d, dword [0x140042b58]
add ecx, 0xffffffa0
movzx esi, byte [0x140042b57]
add ecx, r10d
inc byte [0x140042b67]
add esi, 0x2c
mov byte [rsp + 0x80], al
mov dword [0x140042b78], ecx
movsx eax, r12b
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x98]
sub al, 0x4f
mov dword [0x140042b6c], edx
add byte [0x140042a86], al
mov edx, dword [rsp + 0x20]
mov eax, dword [0x140042b34]
add dl, 0x3d
or eax, 0x60
mov dword [0x140042b48], r8d
sub r14d, eax
mov byte [0x140042b64], dl
mov eax, 0x2f
mov dword [0x140042b3c], r14d
mov r14d, dword [0x140042b60]
movzx ecx, r14b
sar al, cl
movsx ecx, al
movzx eax, byte [0x140042b81]
sub eax, 0x31
mov byte [0x140042a62], bl
or ecx, eax
mov eax, dword [0x140042a8c]
add eax, ecx
movzx ecx, byte [0x140042a87]
add ecx, 2
mov dword [0x140042a8c], eax
and r9b, al
mov dword [rsp + 0x20], ecx
mov byte [0x140042b80], r9b
test r8d, r8d
jne 0x140014bdb
cmp byte [0x140042b66], bl
mov eax, ebx
jne 0x140014bdd
mov eax, edi
add byte [0x140042a87], al
mov eax, 0x60
movsx r8d, byte [rsp + 0x80]
dec byte [0x140042b54]
mov ecx, r8d
shl al, cl
xor al, byte [0x140042b44]
mov ecx, dword [rsp + 0x98]
sub cl, al
movsx edx, dl
movzx eax, byte [0x140042b82]
sub al, 0x3e
mov byte [0x140042a63], cl
mov byte [0x140042b57], al
movsx eax, cl
mov ecx, eax
mov dword [rsp + 0x24], eax
mov eax, 0xffffffaa
sar eax, cl
mov ecx, ebx
mov dword [rsp + 0x98], eax
lea eax, [r8 + 0x56]
cmp dword [rsp + 0x98], eax
mov eax, 0x103
mov dword [rsp + 0x98], edx
setne cl
imul r8d, dword [0x140042b40], 0x1a2
sub eax, edx
or dword [0x140042b30], eax
mov eax, 0xcccccccd
mul r8d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r8d, eax
mov eax, ebx
test r9b, r9b
sete al
and eax, ecx
mov ecx, esi
and r11d, eax
xor ecx, 0x6b
shl byte [0x140042b56], cl
movsx eax, byte [0x140042b55]
imul ecx, eax, 7
mov eax, 0xaaaaaaab
mov dword [0x140042b4c], r11d
add ecx, 0x1c3
mul ecx
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x140014d23
sub ecx, edi
je 0x140014d0a
sub ecx, edi
je 0x140014cfb
cmp ecx, edi
je 0x140014cd4
xor r15b, 0x73
mov byte [0x140042b56], bl
sub r9b, r15b
jmp 0x140014d3f
test bl, bl
jne 0x140014ce5
cmp dword [rsp + 0x98], 0x7a
mov r10d, ebx
je 0x140014ce8
mov r10d, edi
cmp dword [0x140042b28], ebx
mov eax, ebx
setne al
mov dword [0x140042b6c], eax
jmp 0x140014d46
imul ebp, dword [0x140042b34], 0x103
shr ebp, 2
jmp 0x140014d46
mov ecx, ebx
lea eax, [rsi + 0xe0]
cmp dword [0x140042b38], eax
sete cl
mov dword [0x140042b5c], ecx
jmp 0x140014d46
movzx eax, byte [0x140042b82]
and r8b, 0x60
add eax, 0x155
or r8b, r15b
mov dword [0x140042b28], eax
or r9b, r8b
mov byte [0x140042b80], r9b
mov r15d, 0x1a2
test dword [rsp + 0x24], ebp
jne 0x140014d62
mov ecx, r10d
mov eax, r15d
shl eax, cl
or eax, dword [rsp + 0x20]
mov eax, ebx
je 0x140014d64
mov eax, edi
or r14d, eax
mov dword [0x140042b58], edi
mov dword [0x140042b60], r14d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movsx r14d, byte [rsp + 0x80]
movzx r8d, byte [0x140042b83]
mov r10d, dword [0x140042b28]
cmp ebp, r14d
jbe 0x140014dcc
imul r9d, r10d, 0xb1
shr r9d, 2
mov dword [rsp + 0x88], r9d
test r8b, r8b
jne 0x140014db9
cmp byte [0x140042b64], bl
mov eax, ebx
je 0x140014dbb
mov eax, edi
movzx edx, byte [0x140042b65]
xor dl, al
mov byte [0x140042b65], dl
jmp 0x140014ddb
movzx edx, byte [0x140042b65]
mov r9d, dword [rsp + 0x88]
movsx eax, byte [0x140042b88]
cmp eax, 0x103
jbe 0x140014eed
movzx eax, byte [0x140042b44]
mov ecx, r14d
add al, 2
mov dword [0x140042b3c], ebx
movsx r12d, al
movsx eax, r9b
add eax, 0x73
shr eax, cl
cmp eax, dword [0x140042b84]
movsx ecx, byte [0x140042a62]
sete al
mov esi, ecx
and al, r8b
xor dl, al
mov eax, ebx
movzx r8d, dl
inc r8d
mov byte [0x140042b65], dl
cmp cl, r9b
mov edx, r12d
mov dword [rsp + 0x90], edx
sete al
imul esi, r12d
mov dword [0x140042b58], eax
and esi, 0x80000003
jge 0x140014e5b
dec esi
or esi, 0xfffffffc
inc esi
cmp dword [0x140042b6c], ebx
mov eax, ebx
mov ecx, dword [0x140042b5c]
mov ebp, dword [0x140042b4c]
sete al
and eax, dword [0x140042b30]
add ecx, eax
lea eax, [r14 + 0x9d]
xor eax, 0xb1
mov dword [0x140042b5c], ecx
cmp dword [0x140042b48], eax
sete al
and r10d, edi
or byte [0x140042b56], al
mov eax, ebx
cmp byte [0x140042b82], al
cmovne eax, r10d
mov dword [0x140042b28], eax
mov eax, dword [0x140042a8c]
inc eax
test dword [rsp + 0x20], edx
mov dword [0x140042b2c], eax
mov eax, ebx
setne al
and eax, ecx
add dword [0x140042b78], eax
test r12b, r12b
setne al
xor byte [0x140042b55], al
mov eax, 0xaaaaaaab
mul r8d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ebp, eax
add ebp, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
movsx eax, byte [0x140042a63]
mov ecx, dword [0x140042b78]
sub r15d, eax
movzx eax, byte [0x140042b81]
sub ecx, r14d
movzx edx, byte [0x140042b64]
or ecx, r15d
or ecx, 0x155
and dword [0x140042b44], ecx
mov ecx, ebx
cmp eax, esi
mov eax, 0x10e
sete cl
add dword [0x140042b40], ecx
mov ecx, dword [0x140042b34]
nop dword [rax + rax]
dec ax
test dl, dl
jne 0x140014f51
mov dword [0x140042b38], ebx
test ecx, ecx
je 0x140014f57
mov dword [0x140042b38], edi
test ax, ax
jne 0x140014f40
cmp dword [0x140042b5c], ebx
je 0x140014f74
test ebp, ebp
je 0x140014f74
lea eax, [rsi - 0x1c3]
test eax, eax
mov eax, edi
jne 0x140014f76
mov eax, ebx
imul r14d, dword [0x140042a8c], 0xb1
mov ecx, dword [0x140042b84]
xor ecx, eax
mov eax, 0xcccccccd
mov dword [0x140042b84], ecx
mul r14d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r14d, eax
cmp byte [0x140042b54], bl
je 0x140014fc4
mov edx, dword [rsp + 0x90]
mov eax, 0xda
sar edx, 0xb1
shl eax, cl
mov byte [0x140042b82], dil
test eax, edx
jne 0x140014fca
mov byte [0x140042b82], bl
mov eax, dword [0x140042b30]
movzx edx, byte [0x140042b88]
add eax, 0x18
movzx r15d, byte [rsp + 0x80]
movzx ecx, r15b
mov dword [rsp + 0x98], eax
sar dl, cl
cmp esi, 0xb1
sete al
xor dl, al
xor dl, byte [0x140042b58]
add byte [0x140042a62], dl
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
mov r11d, dword [rsp + 0x88]
mov eax, ebx
mov r8d, dword [0x140042b48]
cmp r12b, r11b
setl al
cmp eax, dword [0x140042b58]
jae 0x14001510a
movzx eax, byte [0x140042b54]
imul r10d, eax, 0x2f
mov eax, 0xcccccccd
mul r10d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r10d, eax
cmp dword [0x140042b38], ebx
jne 0x14001505c
mov eax, ebx
test r15b, 0x2f
je 0x14001505e
mov eax, edi
movzx r9d, byte [0x140042b67]
mov ecx, r10d
and r9b, al
mov edx, esi
movzx eax, byte [0x140042b57]
shr edx, cl
add eax, ebp
mov ecx, r8d
mov byte [0x140042b67], r9b
shl edx, cl
xor edx, eax
mov eax, dword [0x140042b60]
sub dword [0x140042b34], edx
xor eax, 0x2f
jne 0x14001509f
mov eax, ebx
test r14b, r14b
je 0x1400150a1
mov eax, edi
sub dword [0x140042b3c], eax
mov ecx, ebx
cmp byte [0x140042b64], r12b
mov eax, 0xaaaaaaab
mov r13d, dword [0x140042b44]
sete cl
imul r13d, dword [rsp + 0x98]
add dword [0x140042b5c], ecx
mul r13d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r13d, eax
test r8d, r8d
jne 0x1400150e5
test r10d, r10d
jne 0x1400150e5
mov edi, ebx
mov eax, dword [rsp + 0x90]
sub byte [0x140042b82], dil
add eax, 0xffffffa0
or byte [0x140042a87], 1
xor eax, esi
or eax, r8d
mov dword [0x140042a64], eax
jmp 0x140015112
movzx r9d, byte [0x140042b67]
mov ecx, ebx
movsx eax, r11b
movzx edx, r14b
cmp edx, dword [0x140042b4c]
setne cl
cmp eax, ecx
movsx eax, r9b
setg bl
cmp eax, ebx
je 0x140015137
test r11b, r11b
je 0x140015156
movsx eax, byte [0x140042a63]
movsx ecx, r13b
sub ecx, edx
add ecx, 0xda
xor ecx, eax
sub r8d, ecx
mov dword [0x140042b48], r8d
call fcn.140013ea0
movsx eax, r13b
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret