Function at 0x61cc66e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov eax, dword [0x61ce0200]
test eax, eax
je 0x61cc6711
mov rsi, qword [0x61ce0208]
mov rax, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, [0x61cda850]
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61cc66f8
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rdi, rax
je 0x61cc68a6
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbp
test rax, rax
mov rbx, rax
je 0x61cc69d0
xor r8d, r8d
mov dword [rsp + 0x3c], 0
lea r9, [rsp + 0x3c]
lea rdx, [rsp + 0x38]
mov ecx, 8
call rax
test eax, eax
jne 0x61cc69d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80000005
jne 0x61cc69d0
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x61cc69d0
lea rcx, [rax + rax]
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x61cc69d0
lea r9, [rsp + 0x3c]
mov r8, rax
lea rdx, [rsp + 0x38]
mov ecx, 8
call rbx
test eax, eax
je 0x61cc69c3
mov ebx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
lea edx, [rbx + rbx*4]
lea ecx, [rax + rdx*2 + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x61cc69c3
test ebx, ebx
je 0x61cc69b8
mov rbx, r12
mov r13, rsi
xor r14d, r14d
nop dword [rax]
movzx edx, word [rbx]
test dx, dx
je 0x61cc6a29
movzx ecx, dl
cmp dx, cx
jne 0x61cc6a10
cmp dx, 0x3a
je 0x61cc6a10
mov r9, r13
jmp 0x61cc6848
movzx r10d, dl
cmp dx, r10w
jne 0x61cc6a10
cmp dx, 0x3a
je 0x61cc6a10
add rbx, 2
mov byte [r9], dl
add r9, 1
movzx edx, word [rbx]
test dx, dx
jne 0x61cc6830
cmp rax, r9
je 0x61cc6a10
mov byte [r9], 0
mov rcx, r13
add rbx, 2
call sym.libintl_8.dll__nl_locale_name_canonicalize
mov rcx, r13
add r14d, 1
call sub.msvcrt.dll_strlen
add rax, r13
cmp r14d, dword [rsp + 0x38]
jae 0x61cc6a10
test r14d, r14d
mov r13, rax
je 0x61cc6800
mov byte [rax], 0x3a
lea r13, [rax + 1]
jmp 0x61cc6800
xor ebx, ebx
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Control_PanelDesktopResourceLocaO
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x61cc6a22
lea rax, [rsp + 0x3c]
lea rsi, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x3c], 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x61cc6a22
cmp dword [rsp + 0x38], 1
jne 0x61cc6a22
mov eax, dword [rsp + 0x3c]
cmp eax, 9
ja 0x61cc6a22
jne 0x61cc6a35
cmp byte [rsp + 0x58], 0
jne 0x61cc6a22
lea rdx, [rsp + 0x48]
mov r8d, 0x10
mov rcx, rsi
call sub.msvcrt.dll_strtoul
mov rdx, qword [rsp + 0x48]
cmp rdx, rsi
jbe 0x61cc6a22
cmp byte [rdx], 0
jne 0x61cc6a22
mov ecx, eax
call sym.libintl_8.dll__nl_locale_name_from_win32_LCID
test rax, rax
mov rsi, rax
jne 0x61cc69f3
test bl, bl
je 0x61cc69f3
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
lea r9, [0x61cc66c0]
mov r8d, 1
mov edx, 0x10
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
mov rsi, qword [rsp + 0x48]
jmp 0x61cc69f3
mov byte [rax], 0
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
nop dword [rax + rax]
lea rdx, [0x61cda8ad]
mov rcx, rdi
call rbp
test rax, rax
je 0x61cc6a3f
call rax
movzx ecx, ax
call sym.libintl_8.dll__nl_locale_name_from_win32_LANGID
test rax, rax
mov rsi, rax
je 0x61cc6a3f
mov qword [0x61ce0208], rsi
mov dword [0x61ce0200], 1
jmp 0x61cc66ff
cmp rsi, rax
mov byte [rax], 0
jae 0x61cc69bb
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x61cc69f3
xor esi, esi
jmp 0x61cc697f
mov r9, r13
nop dword [rax]
jmp 0x61cc685b
mov byte [rsp + rax + 0x50], 0
jmp 0x61cc6946
mov ebx, 1
jmp 0x61cc68a8