Function at 0x140060e00
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
lea rbp, [rsp - 0x2d8]
sub rsp, 0x3d8
mov rdi, r8
test r8, r8
jne 0x140060e34
xor al, al
add rsp, 0x3d8
pop rdi
pop rbp
ret
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x3d0], rsi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
lea r9, str.utm_codepage_u
mov edx, 0xff
mov dword [rsp + 0x20], eax
mov r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.140005670
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0xfc
call fcn.14014e180
xor eax, eax
mov dword [rbp + 0x308], 0xfe
mov dword [rsp + 0x40], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x2f0]
xor esi, esi
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x2f0], rsi
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x2f8], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140060f27
mov rcx, qword [rbp + 0x2f0]
lea rax, [rbp + 0x308]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x2f8]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1401b7784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x2f0]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140060f27
lea rcx, [rsp + 0x40]
call fcn.14003e3e8
cmp rax, 0x2710
jge 0x140060fd2
xor eax, eax
mov dword [rbp + 0x308], 0xfe
mov dword [rsp + 0x40], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x2f0], rsi
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x2f8], esi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006104c
mov rcx, qword [rbp + 0x2f0]
lea rax, [rbp + 0x308]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x2f8]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1401b7784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x2f0]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14006104c
lea rcx, [rsp + 0x40]
call fcn.14003e3e8
cmp rax, 0x2710
jl 0x14006104c
cmp word [rsp + 0x40], si
je 0x140061051
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], 0x7f
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140061051
mov r9, 0xffffffffffffffff
mov byte [rbp + 0xbf], sil
lea r8, str.utm_uniq
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x40]
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
jmp 0x140061051
mov word [rsp + 0x40], si
cmp byte [0x14021bc64], sil
je 0x140061090
mov r9, 0xffffffffffffffff
lea r8, str.utm_link
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov r9, 0xffffffffffffffff
lea r8, [0x14021bc64]
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov r9d, 0xff
lea r8, [rbp + 0xc0]
lea rdx, str.https:__www.mql5.com
call fcn.140060c90
test al, al
je 0x14006129a
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x14021bd00], esi
je 0x14006128d
mov rsi, qword [0x14021bcf8]
mov rbx, rsi
test rsi, rsi
je 0x14006128d
mov qword [rsp + 0x3c8], r14
mov qword [rsp + 0x3c0], r15
nop dword [rax]
lea r8, [rbp + 0xc0]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140061114
add rax, 2
test ecx, ecx
jne 0x140061100
test edx, edx
je 0x140061195
cmp word [rbx], 0x2e
jne 0x14006124c
lea rax, [rbx + 2]
lea r8, [rbp + 0xc0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140061144
add rax, 2
test ecx, ecx
jne 0x140061130
test edx, edx
je 0x140061195
lea rdx, [0x1401ba828]
lea rcx, [rbp + 0xc0]
call fcn.140030c6c
test rax, rax
je 0x140061245
mov rcx, rbx
sub rax, rbx
nop word [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x140061185
add rcx, 2
test edx, edx
jne 0x140061170
test r8d, r8d
jne 0x140061245
mov rsi, qword [0x14021bcf8]
lea rdx, str.utm_campaign
lea rcx, [rbx + 0x80]
call fcn.14014d8c0
test eax, eax
je 0x1400611c7
lea rdx, str.utm_source
lea rcx, [rbx + 0x80]
call fcn.14014d8c0
test eax, eax
jne 0x140061251
cmp byte [rbx + 0xc0], 0
je 0x14006124c
mov r9, 0xffffffffffffffff
lea r8, [0x1401b78c0]
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov r9, 0xffffffffffffffff
lea r8, [rbx + 0x80]
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov r9, 0xffffffffffffffff
lea r8, [0x1401b78c4]
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov r9, 0xffffffffffffffff
lea r8, [rbx + 0xc0]
mov edx, 0xff
mov rcx, rdi
call fcn.140041014
mov rsi, qword [0x14021bcf8]
jmp 0x140061251
mov rsi, qword [0x14021bcf8]
test rbx, rbx
je 0x14006127d
test rsi, rsi
je 0x14006127d
cmp rbx, rsi
jb 0x14006127d
mov eax, dword [0x14021bd00]
mov edx, dword [0x14021bd08]
dec eax
imul eax, edx
add rax, rsi
cmp rbx, rax
jae 0x14006127d
add rbx, rdx
jne 0x1400610f0
mov r14, qword [rsp + 0x3c8]
mov r15, qword [rsp + 0x3c0]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [rdi]
mov rsi, qword [rsp + 0x3d0]
mov rbx, qword [rsp + 0x400]
test al, al
je 0x1400612ca
cmp al, 0x20
jne 0x1400612ba
mov byte [rdi], 0x2b
jmp 0x1400612bf
jge 0x1400612bf
mov byte [rdi], 0x5f
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x1400612b1
mov al, 1
add rsp, 0x3d8
pop rdi
pop rbp
ret