Function at 0x1400c8eb0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov eax, dword [0x1402a2978]
test eax, eax
je 0x1400c8ee0
mov rax, qword [0x1402a2970]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, [0x14019fed0]
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400c8ec8
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rdi, rax
je 0x1400c906c
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbp
test rax, rax
mov rbx, rax
je 0x1400c91a4
lea rsi, [rsp + 0x50]
lea r13, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov ecx, 8
mov r9, rsi
mov rdx, r13
call rax
test eax, eax
jne 0x1400c91a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80000005
jne 0x1400c91a4
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1400c91a4
lea rcx, [rax + rax]
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x1400c91a4
mov r9, rsi
mov r8, rax
mov rdx, r13
mov ecx, 8
call rbx
test eax, eax
je 0x1400c919c
mov ebx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
lea edx, [rbx + rbx*4]
lea ecx, [rax + rdx*2 + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x1400c919c
test ebx, ebx
je 0x1400c9194
mov rbx, r12
xor r14d, r14d
nop dword [rax + rax]
test r14d, r14d
je 0x1400c9180
movzx edx, word [rbx]
lea r13, [rax + 1]
mov byte [rax], 0x3a
test dx, dx
je 0x1400c91eb
test dx, 0xff00
jne 0x1400c9050
cmp dx, 0x3a
je 0x1400c9050
mov rcx, r13
jmp 0x1400c900d
test dx, 0xff00
jne 0x1400c9050
cmp dx, 0x3a
je 0x1400c9050
add rcx, 1
add rbx, 2
mov byte [rcx - 1], dl
movzx edx, word [rbx]
test dx, dx
jne 0x1400c9000
cmp rcx, rax
je 0x1400c9050
mov byte [rcx], 0
mov rcx, r13
add rbx, 2
call fcn.1400c9370
mov rcx, r13
add r14d, 1
call sub.msvcrt.dll_strlen
add rax, r13
cmp r14d, dword [rsp + 0x48]
jb 0x1400c8fd0
nop word [rax + rax]
cmp rsi, rax
mov byte [rax], 0
jae 0x1400c9194
mov rcx, r12
call fcn.14016b5d8
mov rax, rsi
jmp 0x1400c91c4
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Control_PanelDesktopResourceLocale
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400c923b
xor ebx, ebx
lea rax, [rsp + 0x3c]
lea rsi, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x3c], 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x1400c91e4
cmp dword [rsp + 0x38], 1
jne 0x1400c91e4
mov eax, dword [rsp + 0x3c]
cmp eax, 9
ja 0x1400c91e4
jne 0x1400c9231
cmp byte [rsp + 0x58], 0
jne 0x1400c91e4
lea rdx, [rsp + 0x48]
mov r8d, 0x10
mov rcx, rsi
call sub.msvcrt.dll_strtoul
mov rdx, qword [rsp + 0x48]
cmp rdx, rsi
jbe 0x1400c91e4
cmp byte [rdx], 0
jne 0x1400c91e4
mov ecx, eax
call fcn.1400caab0
test rax, rax
jne 0x1400c91c4
test bl, bl
je 0x1400c91c4
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rsi
lea r9, [0x1400c8e90]
mov r8d, 1
mov edx, 0x10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
mov rax, qword [rsp + 0x50]
jmp 0x1400c91c4
movzx edx, word [rbx]
test dx, dx
je 0x1400c9050
mov r13, rax
jmp 0x1400c8fec
mov rcx, rsi
call fcn.14016b5d8
mov rcx, r12
call fcn.14016b5d8
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rdi
call rbp
test rax, rax
je 0x1400c91f3
call rax
movzx ecx, ax
call fcn.1400c93e0
test rax, rax
je 0x1400c91f3
mov qword [0x1402a2970], rax
mov dword [0x1402a2978], 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
jmp 0x1400c9146
mov rcx, r13
jmp 0x1400c9020
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Control_PanelDesktopResourceLocale
mov rcx, 0xffffffff80000001
mov ebx, 1
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400c909d
jmp 0x1400c914a
mov byte [rsp + rax + 0x50], 0
jmp 0x1400c910c
xor eax, eax
jmp 0x1400c91c4