Function at 0x14003259c
Capabilities:
Identify system language via api
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8f8]
sub rsp, 0x9d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x8c0], rax
xor r15d, r15d
mov r13, rcx
cmp qword [rcx + 0x28], r15
je 0x140032a11
cmp qword [0x140049498], r15
je 0x140032a11
cmp qword [0x1400494a0], r15
je 0x140032a11
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea r14, [0x14000b130]
movzx eax, ax
mov dword [rsp + 0x30], r15d
mov ebx, r15d
mov qword [rsp + 0x70], r14
mov edi, 0x800
mov dword [rsp + 0x68], eax
mov rdx, qword [r14]
lea rax, [rsp + 0x60]
mov r9d, 8
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400329fd
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400329fd
lea r8, [rbp + 0xc0]
mov r9d, edi
xor edx, edx
mov r12d, r15d
mov dword [rsp + 0x50], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1400329f2
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x54]
lea rdx, [0x140007ab4]
lea rcx, [rbp + 0xc0]
mov byte [rbp + 0x8bf], r15b
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x5c], r15d
call qword [sym.imp.msvcrt.dll_sscanf]
cmp eax, 2
jne 0x1400329c5
lea rdx, [0x14000b120]
lea rcx, [rbp + 0xc0]
mov r8d, edi
call fcn.140027ebc
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x48]
lea rdx, [rbp + 0xc0]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400329c5
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400329c5
lea r8, [rbp + 0xc0]
mov r9d, edi
xor edx, edx
mov esi, r15d
mov dword [rsp + 0x58], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1400329b5
mov r12d, dword [rsp + 0x6c]
lea rcx, [rbp + 0xc0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.msvcrt.dll_strtoul]
mov dword [rsp + 0x38], eax
lea ecx, [rax - 1]
cmp ecx, 0xfffe
ja 0x14003298b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, [rbp + 0xc0]
mov r9d, 9
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003298b
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003298b
lea rax, [rsp + 0x30]
lea rdx, [0x140002f60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
xor r8d, r8d
mov byte [rbp - 0x80], r15b
mov dword [rsp + 0x30], 0x40
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
lea r8, [rbp + 0xc0]
mov r9d, 0x800
xor edx, edx
mov byte [rbp - 0x41], r15b
mov edi, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140032976
mov r14d, dword [rsp + 0x38]
mov esi, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [rbp + 0xc0]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003294e
cmp qword [rsp + 0x38], r15
je 0x14003294e
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.msvcrt.dll__stricmp]
mov ecx, 0x2000000
lea rdx, [0x14000b0d8]
test eax, eax
mov dword [rsp + 0x30], 0x800
cmove r15d, ecx
xor eax, eax
cmp r14d, esi
mov ecx, 0x40000000
cmove eax, ecx
mov ecx, 0x80000000
or r15d, eax
xor eax, eax
cmp r14d, r12d
cmove eax, ecx
or r15d, eax
mov eax, ebx
neg eax
lea rax, [rsp + 0x30]
sbb ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
and ecx, 0xf0000000
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20000000
mov qword [rsp + 0x20], rax
or r15d, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140032940
mov rcx, qword [rsp + 0x38]
mov byte [rbp + 0x8bf], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140032916
mov byte [rbp + 0xbf], al
jmp 0x14003291a
mov byte [rbp - 0x40], 0
mov eax, dword [rsp + 0x5c]
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xc0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x54]
mov r9d, r15d
mov rcx, r13
mov dword [rsp + 0x20], eax
call fcn.140032bb0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15d, r15d
mov rcx, qword [rsp + 0x40]
inc edi
lea r8, [rbp + 0xc0]
mov edx, edi
mov r9d, 0x800
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x14003280e
mov esi, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov edi, 0x800
mov rcx, qword [rsp + 0x48]
inc esi
lea r8, [rbp + 0xc0]
mov edx, esi
mov r9d, edi
mov dword [rsp + 0x58], esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x140032745
mov r12d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r15
mov rcx, qword [rsp + 0x60]
inc r12d
lea r8, [rbp + 0xc0]
mov edx, r12d
mov r9d, edi
mov dword [rsp + 0x50], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x140032690
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r14, 8
inc ebx
mov qword [rsp + 0x70], r14
cmp ebx, 2
jb 0x140032630
mov rcx, qword [rbp + 0x8c0]
xor rcx, rsp
call fcn.14003f730
lea r11, [rsp + 0x9d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret