Function at 0x14004049c
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [rsp + 0x2cc]
mov rcx, qword [rsp + 0x1b8]
xor rcx, 0x250661d4
mov qword [rsp + 0x308], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [rsp + 0x19c], eax
call rcx
mov dl, byte [rsp + 0x1c7]
mov byte [rsp + 0x303], dl
mov rcx, qword [sym.imp.USER32.dll_GetClipboardOwner]
mov word [rsp + 0x19a], ax
call rcx
mov rcx, qword [sym.imp.KERNEL32.dll_GetVersion]
mov qword [rsp + 0x190], rax
call rcx
mov rcx, qword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [rsp + 0x18c], eax
call rcx
mov r8d, dword [rsp + 0x2fc]
mov dl, byte [rsp + 0x1c7]
mov byte [rsp + 0x303], dl
mov r9w, word [rsp + 0x1c4]
add byte [rax], al
or r9w, 0x83ab
xor r8d, 0x58b017b4
mov word [rsp + 0x300], r9w
add byte [rbx], al
add byte [rax], al
mov rcx, qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x17c], r8d
call rcx
mov r8d, dword [rsp + 0x2fc]
mov dword [rsp + 0x304], 0xd8ca0bd7
xor r8d, 0x58b01eac
mov r9w, word [rsp + 0x1c4]
and r9w, 0xac0a
mov word [rsp + 0x300], r9w
mov rcx, qword [sym.imp.KERNEL32.dll_GetErrorMode]
mov dword [rsp + 0x178], eax
mov dword [rsp + 0x174], r8d
call rcx
mov r8d, 0x7d07fa
mov ecx, r8d
lea r10, [rsp + 0x20c]
mov r11, qword [rsp + 0x1b8]
xor r11, 0xffffffffffffffff
mov qword [rsp + 0x308], r11
mov r9w, word [rsp + 0x1c4]
imul si, r9w, 0xf64a
mov r8d, dword [rsp + 0x2fc]
add al, byte [rax]
add byte [rsi - 0x77], ah
mov ah, 0x24
add byte [rbx], al
add byte [rax], al
xor r8d, 0x58b01480
mov word [rsp + 0x300], r9w
mov edi, dword [rsp + 0x174]
mov dword [rsp + 0x20c], edi
mov edi, dword [rsp + 0x1b4]
mov dword [rsp + 0x304], edi
mov ebx, dword [rsp + 0x2fc]
add ebx, 0xa74feb14
mov dl, byte [rsp + 0x1c7]
and dl, 4
mov byte [rsp + 0x303], dl
mov r11, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebp, 0x7d07fa
mov r14d, ebp
lea rdx, [rsp + 0x20c]
or al, 2
add byte [rax], al
mov qword [rsp + 0x168], rcx
mov rcx, r14
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x160], ebx
mov qword [rsp + 0x158], r10
mov dword [rsp + 0x154], r8d
call r11
mov r8d, 0xe15945
mov ecx, r8d
mov rdx, qword [sym.imp.GDI32.dll_GetTextColor]
mov r8d, 0xe15945
mov r10d, r8d
mov qword [rsp + 0x148], rcx
mov rcx, r10
mov dword [rsp + 0x144], eax
call rdx
mov r8d, 0x9683d4
mov ecx, r8d
mov rdx, qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov r8d, 0x9683d4
mov r10d, r8d
mov qword [rsp + 0x138], rcx
mov rcx, r10
mov dword [rsp + 0x134], eax
call rdx
mov r8d, 0x4e9eb5
mov ch, 0x9e
add byte [rcx + r9*4 - 0x3f], r8b
lea rdx, [rsp + 0x244]
mov r8d, dword [rsp + 0x17c]
mov dword [rsp + 0x244], r8d
mov r10, qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov r8d, 0x4e9eb5
mov r11d, r8d
lea r14, [rsp + 0x244]
mov qword [rsp + 0x128], rcx
mov rcx, r11
mov qword [rsp + 0x120], rdx
add byte [rax], al
add byte [rax], al
mov rdx, r14
mov dword [rsp + 0x11c], eax
call r10
mov r15b, byte [rsp + 0x1c7]
mov byte [rsp + 0x303], r15b
mov qword [rsp + 0x308], 0xffffffffcf1783ae
mov r8d, dword [rsp + 0x19c]
mov edi, dword [rsp + 0x160]
add r8d, edi
mov rcx, qword [rsp + 0x1b8]
and rcx, 0x12e8fe8
mov qword [rsp + 0x308], rcx
mov r9w, word [rsp + 0x1c4]
imul si, r9w, 0x54a6
mov word [rsp + 0x300], si
mov dword [rsp + 0x2cc], r8d
mov edi, dword [rsp + 0x154]
cmp r8d, edi
mov dword [rsp + 0x118], eax
je 0x140040dd7
jmp 0x140040221
lea rax, [rsp + 0x1f4]
mov cx, 0x820c
mov edx, dword [rsp + 0x1b4]
mov dword [rsp + 0x304], edx
sub cx, word [rsp + 0x316]
mov dword [rsp + 0x304], edx
mov r8d, dword [rsp + 0x2fc]
add edx, 0x67f79abb
mov r9d, dword [rsp + 0x2fc]
add r8d, 0xa74feb14
mov dword [rsp + 0x304], edx
invalid