Function at 0x140032154
Capabilities:
Identify system language via api
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x9a8]
sub rsp, reloc.MFC42.dll_AFX_EVENTSINKMAPconstCCmdTarget::eventsinkMap
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x970], rax
xor edi, edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rcx
lea rdx, [0x14000b070]
lea r9d, [rdi + 8]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140032565
cmp qword [rsp + 0x40], rdi
je 0x140032565
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov r14d, edi
movzx eax, ax
mov ebx, 0x800
xor edx, edx
mov dword [rsp + 0x58], eax
jmp 0x140032538
lea rax, [rsp + 0x60]
lea rdx, [rbp + 0x170]
mov r9d, 9
xor r8d, r8d
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140032532
cmp qword [rsp + 0x60], rdi
je 0x140032532
lea rdx, [0x14000b0a0]
lea rcx, [rbp + 0x170]
call qword [sym.imp.msvcrt.dll__stricmp]
mov r13d, edi
lea rdx, [0x14000b0b8]
test eax, eax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
sete r13b
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003229e
lea rcx, [rbp + 0x170]
xor r8d, r8d
xor edx, edx
mov byte [rbp + 0x96f], dil
call qword [sym.imp.msvcrt.dll_strtoul]
mov r12d, eax
jmp 0x1400322a1
mov r12d, edi
lea r8, [rbp + 0x170]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov esi, edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x14003252a
mov r14, qword [rsp + 0x68]
lea rcx, [rbp + 0x170]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.msvcrt.dll_strtoul]
mov r15d, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffe
ja 0x140032503
lea rax, [rsp + 0x38]
lea rdx, [rbp + 0x170]
mov r9d, 9
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140032503
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140032503
lea rax, [rsp + 0x30]
lea rdx, [0x14000b0c8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140032362
mov byte [rbp + 0x6f], dil
jmp 0x140032367
mov byte [rsp + 0x70], dil
mov rcx, qword [rsp + 0x38]
lea r8, [rbp + 0x170]
mov r9d, 0x800
xor edx, edx
mov ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1400324ee
mov esi, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
lea rdx, [rbp + 0x170]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400324c6
cmp qword [rsp + 0x48], rdi
je 0x1400324c6
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x170]
call qword [sym.imp.msvcrt.dll__stricmp]
mov ecx, 0x2000000
lea rdx, [0x14000b0d8]
test eax, eax
mov dword [rsp + 0x30], 0x800
cmove edi, ecx
xor eax, eax
cmp r15d, dword [rsp + 0x58]
mov ecx, 0x40000000
cmove eax, ecx
mov ecx, 0x4000000
or edi, eax
xor eax, eax
cmp r15d, r12d
cmove eax, ecx
mov ecx, 0x80000000
or edi, eax
xor eax, eax
cmp r15d, esi
cmove eax, ecx
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
or edi, eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
bts edi, 0x1b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400324b9
mov rcx, qword [rsp + 0x48]
mov byte [rbp + 0x96f], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x140032497
mov byte [rbp + reloc.MFC42.dll_CFtpConnection::CFtpConnection], cl
jmp 0x14003249a
mov byte [rbp + 0x70], cl
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ecx
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x170]
mov rcx, r14
mov r9d, edi
call fcn.140032bb0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov rcx, qword [rsp + 0x38]
inc ebx
lea r8, [rbp + 0x170]
mov edx, ebx
mov r9d, 0x800
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x14003238f
mov esi, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
mov ebx, 0x800
inc esi
lea r8, [rbp + 0x170]
mov r9d, ebx
mov edx, esi
xor ecx, ecx
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1400322c8
mov r14d, dword [rsp + 0x54]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
mov edx, r14d
mov rcx, qword [rsp + 0x40]
lea r8, [rbp + 0x170]
mov r9d, ebx
mov dword [rsp + 0x54], r14d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x1400321f8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.14003f730
lea r11, [rsp + reloc.MFC42.dll_AFX_EVENTSINKMAPconstCCmdTarget::eventsinkMap]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret