Function at 0x140047586
Capabilities:
Identify system language via api

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rax, [0x1400a3595]
mov qword [rsp + 0x38], rax
lea rax, str.amd64
lea edi, [rcx - 1]
mov esi, edx
mov qword [rsp + 0x40], rax
lea rax, [0x1400a359f]
mov qword [rsp + 0x48], rax
lea rax, str.arm64
mov qword [rsp + 0x50], rax
mov dword [0x140112eec], edx
cmp edi, 3
ja 0x1400475d8
test edx, edx
jne 0x1400475e6
lea rcx, str.Note:_No_Windows_User_Experience_options_selected
call fcn.140036717
jmp 0x1400475f9
lea rbx, [0x140113100]
mov rcx, rbx
call fcn.140047238
test eax, eax
jne 0x140047600
xor eax, eax
jmp 0x140047c47
mov rcx, rbx
lea rdx, [0x1400a35db]
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x1400475f9
lea rcx, str.Selected_Windows_User_Experience_options:
call fcn.140036717
mov rdx, rbx
lea rcx, str.__xml_version_1.0__encoding_utf_8____n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._unattend_xmlns_urn:schemas_microsoft_com:unattend___n
call sub.msvcrt.dll_fputs
test esi, 1
je 0x140047764
mov rdx, rbx
lea rcx, str.___settings_pass_windowsPE___n
mov ebp, 1
call sub.msvcrt.dll_fputs
movsxd rax, edi
lea rdx, str._____component_name_Microsoft_Windows_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
mov r8, qword [rsp + rax*8 + 0x38]
lea r14, str._________RunSynchronousCommand_wcm:action_add___n
lea r13, str.___________Order__d__Order__n
lea r12, [0x14007d318]
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str._______UserData__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._________ProductKey__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.___________Key____n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.__________ProductKey__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.________UserData__n
call sub.msvcrt.dll_fputs
lea rcx, str._Bypass_SB_TPM_RAM
call fcn.140036717
mov rdx, rbx
lea rcx, str._______RunSynchronous__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
mov rcx, r14
call sub.msvcrt.dll_fputs
mov r8d, ebp
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov r8, qword [r12 + rbp*8]
mov rcx, rbx
inc rbp
lea rdx, str.___________Path_reg_add_HKLMSYSTEMSetupLabConfig__v__s__t_REG_DWORD__d_1__f__Path__n
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str.__________RunSynchronousCommand__n
call sub.msvcrt.dll_fputs
cmp rbp, 4
jne 0x1400476f3
mov rdx, rbx
lea rcx, str.________RunSynchronous__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.______component__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.____settings__n
call sub.msvcrt.dll_fputs
test esi, 4
je 0x140047820
mov rdx, rbx
lea rcx, str.___settings_pass_specialize___n
call sub.msvcrt.dll_fputs
movsxd rax, edi
lea rdx, str._____component_name_Microsoft_Windows_Deployment__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
mov r8, qword [rsp + rax*8 + 0x38]
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str._______RunSynchronous__n
call sub.msvcrt.dll_fputs
lea rcx, str._Bypass_online_account_requirement
call fcn.140036717
mov rdx, rbx
lea rcx, str._________RunSynchronousCommand_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov r8d, 1
lea rdx, str.___________Order__d__Order__n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str.___________Path_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionOOBE__v_BypassNRO__t_REG_DWORD__d_1__f__Path__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.__________RunSynchronousCommand__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.________RunSynchronous__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.______component__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.____settings__n
call sub.msvcrt.dll_fputs
test sil, 0xe8
je 0x140047bc5
mov rdx, rbx
lea rcx, str.___settings_pass_oobeSystem___n
call sub.msvcrt.dll_fputs
test esi, 0x48
je 0x140047a3d
movsxd rax, edi
lea rdx, str._____component_name_Microsoft_Windows_Shell_Setup__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
mov r8, qword [rsp + rax*8 + 0x38]
call sub.msvcrt.dll_fprintf
test esi, 8
je 0x14004789d
lea rcx, str._Disable_data_collection
call fcn.140036717
mov rdx, rbx
lea rcx, str._______OOBE__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._________ProtectYourPC_3__ProtectYourPC__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.________OOBE__n
call sub.msvcrt.dll_fputs
test esi, 0x40
je 0x140047a2e
cmp byte [0x140112e60], 0
lea rbp, [0x140112e60]
jne 0x1400478cd
mov rdx, rbp
lea rcx, str.WARNING:__s_is_not_allowed_as_local_account_name___Option_ignored
call fcn.140036717
jmp 0x140047a2e
lea rdx, str.Administrator
mov rcx, rbp
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x1400478b9
lea rdx, str.Guest
mov rcx, rbp
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x1400478b9
mov rdx, rbp
lea rcx, str._Use__s_for_local_account_name
call fcn.140036717
mov rdx, rbx
lea rcx, str._______UserAccounts__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._________LocalAccounts__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.___________LocalAccount_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov r8, rbp
lea rdx, str._____________Name__s__Name__n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov r8, rbp
lea rdx, str._____________DisplayName__s__DisplayName__n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str._____________Group_Administrators_Power_Users__Group__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._____________Password__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._______________Value_UABhAHMAcwB3AG8AcgBkAA__Value__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._______________PlainText_false__PlainText__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.______________Password__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.____________LocalAccount__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.__________LocalAccounts__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.________UserAccounts__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._______FirstLogonCommands__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str._________SynchronousCommand_wcm:action_add___n
call sub.msvcrt.dll_fputs
mov r8d, 1
lea rdx, str.___________Order__d__Order__n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov r8, rbp
lea rdx, str.___________CommandLine_net_user_quot__squot___logonpasswordchg:yes__CommandLine__n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str.__________SynchronousCommand__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.________FirstLogonCommands__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.______component__n
call sub.msvcrt.dll_fputs
test esi, 0x20
je 0x140047b39
lea rcx, str._Use_the_same_regional_options_as_this_users
call fcn.140036717
movsxd rax, edi
lea rdx, str._____component_name_Microsoft_Windows_International_Core__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
mov r8, qword [rsp + rax*8 + 0x38]
call sub.msvcrt.dll_fprintf
lea rdx, str.Keyboard_LayoutPreload1
mov rcx, 0xffffffff80000001
mov byte [0x140112f00], 0
call fcn.14004737c
lea r8, [0x140112f00]
lea rdx, str._______InputLocale__s__InputLocale__n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
call qword [sym.imp.KERNEL32.DLL_GetSystemDefaultLCID]
mov ecx, eax
call fcn.140036294
lea rdx, str._______SystemLocale__s__SystemLocale__n
mov rcx, rbx
mov r8, rax
call sub.msvcrt.dll_fprintf
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultLCID]
mov ecx, eax
call fcn.140036294
lea rdx, str._______UserLocale__s__UserLocale__n
mov rcx, rbx
mov r8, rax
call sub.msvcrt.dll_fprintf
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx ecx, ax
call fcn.140036294
lea rdx, str._______UILanguage__s__UILanguage__n
mov rcx, rbx
mov r8, rax
call sub.msvcrt.dll_fprintf
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguageInstallLanguageFallback
mov rcx, 0xffffffff80000002
mov byte [0x140112f00], 0
call fcn.14004737c
lea rdx, str._______UILanguageFallback__s__UILanguageFallback__n
mov rcx, rbx
lea r8, [0x140112f00]
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str.______component__n
call sub.msvcrt.dll_fputs
test sil, 0x80
je 0x140047bb6
lea rcx, str._Disable_bitlocker
lea rbp, str.______component__n
call fcn.140036717
movsxd rax, edi
lea rdx, str._____component_name_Microsoft_Windows_SecureStartup_FilterDriver__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
mov r8, qword [rsp + rax*8 + 0x38]
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str._______PreventDeviceEncryption_true__PreventDeviceEncryption__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
mov rcx, rbp
call sub.msvcrt.dll_fputs
mov r8, qword [rsp + 0x28]
lea rdx, str._____component_name_Microsoft_Windows_EnhancedStorage_Adm__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str._______TCGSecurityActivationDisabled_1__TCGSecurityActivationDisabled__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
mov rcx, rbp
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.____settings__n
call sub.msvcrt.dll_fputs
and esi, 0x10
je 0x140047c29
mov rdx, rbx
lea rcx, str.___settings_pass_offlineServicing___n
movsxd rdi, edi
call sub.msvcrt.dll_fputs
lea rcx, str._Set_internal_drives_offline
call fcn.140036717
mov r8, qword [rsp + rdi*8 + 0x38]
lea rdx, str._____component_name_Microsoft_Windows_PartitionManager__processorArchitecture__s__language_neutral__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance__publicKeyToken_31bf3856ad364e35__versionScope_nonSxS___n
mov rcx, rbx
call sub.msvcrt.dll_fprintf
mov rdx, rbx
lea rcx, str._______SanPolicy_4__SanPolicy__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.______component__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.____settings__n
call sub.msvcrt.dll_fputs
mov rdx, rbx
lea rcx, str.__unattend__n
call sub.msvcrt.dll_fputs
mov rcx, rbx
call sub.msvcrt.dll_fclose
lea rax, [0x140113100]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret