Function at 0x48fc80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov eax, dword [0x007ef978]
test eax, eax
je 0x48fcb0
mov rax, qword [0x007ef970]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, str.GETTEXT_MUI
call sub.msvcrt.dll_getenv
test rax, rax
je 0x48fc98
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test rax, rax
mov rdi, rax
je 0x48fe47
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
mov rbp, qword [sym.imp.KERNEL32.DLL_GetProcAddress]
call rbp
test rax, rax
mov rbx, rax
je 0x48ff70
lea r13, [rsp + 0x50]
lea rsi, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov ecx, 8
mov r9, r13
mov rdx, rsi
call rax
test eax, eax
jne 0x48ff70
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80000005
jne 0x48ff70
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x48ff70
lea rcx, [rax + rax]
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x48ff70
mov r9, r13
mov r8, rax
mov rdx, rsi
mov ecx, 8
call rbx
test eax, eax
je 0x48ff64
mov ebx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
lea edx, [rbx + rbx*4]
lea ecx, [rax + rdx*2 + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x48ff64
test ebx, ebx
je 0x48ff59
mov rbx, r12
mov r13, rsi
xor r14d, r14d
nop
movzx edx, word [rbx]
test dx, dx
je 0x48ffd9
movzx ecx, dl
cmp dx, cx
jne 0x48ffc0
cmp dx, 0x3a
je 0x48ffc0
mov r9, r13
jmp 0x48fde8
movzx r10d, dl
cmp dx, r10w
jne 0x48ffc0
cmp dx, 0x3a
je 0x48ffc0
add r9, 1
add rbx, 2
mov byte [r9 - 1], dl
movzx edx, word [rbx]
test dx, dx
jne 0x48fdd0
cmp rax, r9
je 0x48ffc0
mov byte [r9], 0
mov rcx, r13
add rbx, 2
call fcn.0048e170
mov rcx, r13
add r14d, 1
call sub.msvcrt.dll_strlen
add rax, r13
cmp r14d, dword [rsp + 0x48]
jae 0x48ffc0
test r14d, r14d
mov r13, rax
je 0x48fda0
lea r13, [rax + 1]
mov byte [rax], 0x3a
jmp 0x48fda0
xor ebx, ebx
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Control_PanelDesktopResourceLocale
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48ffd2
lea rax, [rsp + 0x3c]
lea rsi, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x3c], 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x48ffd2
cmp dword [rsp + 0x38], 1
jne 0x48ffd2
mov eax, dword [rsp + 0x3c]
cmp eax, 9
ja 0x48ffd2
jne 0x48ffe5
cmp byte [rsp + 0x58], 0
jne 0x48ffd2
lea rdx, [rsp + 0x48]
mov r8d, 0x10
mov rcx, rsi
call sub.msvcrt.dll_strtoul
mov rdx, qword [rsp + 0x48]
cmp rdx, rsi
jbe 0x48ffd2
cmp byte [rdx], 0
jne 0x48ffd2
mov ecx, eax
call fcn.0048f8b0
test rax, rax
mov rsi, rax
jne 0x48ff93
test bl, bl
je 0x48ff93
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea r9, [0x0048fc60]
mov r8d, 1
mov edx, 0x10
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_EnumResourceLanguagesA]
mov rsi, qword [rsp + 0x50]
jmp 0x48ff93
mov byte [rax], 0
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
nop dword [rax]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rdi
call rbp
test rax, rax
je 0x48ffef
call rax
movzx ecx, ax
call fcn.0048e1e0
test rax, rax
mov rsi, rax
je 0x48ffef
mov rax, rsi
mov qword [0x007ef970], rsi
mov dword [0x007ef978], 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp rsi, rax
mov byte [rax], 0
jae 0x48ff5c
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x48ff93
xor esi, esi
jmp 0x48ff20
mov r9, r13
nop dword [rax]
jmp 0x48fdfc
mov byte [rsp + rax + 0x50], 0
jmp 0x48fee7
mov ebx, 1
jmp 0x48fe49