Function at 0x140060720
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
lea rbp, [rsp - 0x2d8]
sub rsp, 0x3d8
mov rdi, r8
test r8, r8
jne 0x140060754
xor al, al
add rsp, 0x3d8
pop rdi
pop rbp
ret
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x3d0], rsi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
lea r9, str.utm_codepage_u
mov edx, 0xff
mov dword [rsp + 0x20], eax
mov r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400053b0
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0xfc
call fcn.14014d290
xor eax, eax
mov dword [rbp + 0x308], 0xfe
mov dword [rsp + 0x40], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x2f0]
xor esi, esi
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x2f0], rsi
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x2f8], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140060847
mov rcx, qword [rbp + 0x2f0]
lea rax, [rbp + 0x308]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x2f8]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1401b6784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x2f0]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140060847
lea rcx, [rsp + 0x40]
call fcn.14003e038
cmp rax, 0x2710
jge 0x1400608f2
xor eax, eax
mov dword [rbp + 0x308], 0xfe
mov dword [rsp + 0x40], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x2f0], rsi
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x2f8], esi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140060965
mov rcx, qword [rbp + 0x2f0]
lea rax, [rbp + 0x308]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x2f8]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1401b6784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x2f0]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140060965
lea rcx, [rsp + 0x40]
call fcn.14003e038
cmp rax, 0x2710
jl 0x140060965
cmp word [rsp + 0x40], si
je 0x14006096a
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], 0x7f
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14006096a
mov r9, 0xffffffffffffffff
lea r8, str.utm_uniq
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x40]
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
jmp 0x14006096a
mov word [rsp + 0x40], si
cmp byte [0x14021abd4], sil
je 0x1400609a9
mov r9, 0xffffffffffffffff
lea r8, str.utm_link
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov r9, 0xffffffffffffffff
lea r8, [0x14021abd4]
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov r9d, 0xff
lea r8, [rbp + 0xc0]
lea rdx, str.https:__www.mql5.com
call fcn.1400605b0
test al, al
je 0x140060bba
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x14021ac70], esi
je 0x140060bad
mov rsi, qword [0x14021ac68]
mov rbx, rsi
test rsi, rsi
je 0x140060bad
mov qword [rsp + 0x3c8], r14
mov qword [rsp + 0x3c0], r15
nop word [rax + rax]
lea r8, [rbp + 0xc0]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140060a34
add rax, 2
test ecx, ecx
jne 0x140060a20
test edx, edx
je 0x140060ab5
cmp word [rbx], 0x2e
jne 0x140060b6c
lea rax, [rbx + 2]
lea r8, [rbp + 0xc0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140060a64
add rax, 2
test ecx, ecx
jne 0x140060a50
test edx, edx
je 0x140060ab5
lea rdx, [0x1401b98f4]
lea rcx, [rbp + 0xc0]
call fcn.1400308bc
test rax, rax
je 0x140060b65
mov rcx, rbx
sub rax, rbx
nop word [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x140060aa5
add rcx, 2
test edx, edx
jne 0x140060a90
test r8d, r8d
jne 0x140060b65
mov rsi, qword [0x14021ac68]
lea rdx, str.utm_campaign
lea rcx, [rbx + 0x80]
call fcn.14014c9d0
test eax, eax
je 0x140060ae7
lea rdx, str.utm_source
lea rcx, [rbx + 0x80]
call fcn.14014c9d0
test eax, eax
jne 0x140060b71
cmp byte [rbx + 0xc0], 0
je 0x140060b6c
mov r9, 0xffffffffffffffff
lea r8, [0x1401b68c0]
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov r9, 0xffffffffffffffff
lea r8, [rbx + 0x80]
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov r9, 0xffffffffffffffff
lea r8, [0x1401b68c4]
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov r9, 0xffffffffffffffff
lea r8, [rbx + 0xc0]
mov edx, 0xff
mov rcx, rdi
call fcn.140040c64
mov rsi, qword [0x14021ac68]
jmp 0x140060b71
mov rsi, qword [0x14021ac68]
test rbx, rbx
je 0x140060b9d
test rsi, rsi
je 0x140060b9d
cmp rbx, rsi
jb 0x140060b9d
mov eax, dword [0x14021ac70]
mov edx, dword [0x14021ac78]
dec eax
imul eax, edx
add rax, rsi
cmp rbx, rax
jae 0x140060b9d
add rbx, rdx
jne 0x140060a10
mov r14, qword [rsp + 0x3c8]
mov r15, qword [rsp + 0x3c0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [rdi]
mov rsi, qword [rsp + 0x3d0]
mov rbx, qword [rsp + 0x400]
test al, al
je 0x140060bea
cmp al, 0x20
jne 0x140060bda
mov byte [rdi], 0x2b
jmp 0x140060bdf
jge 0x140060bdf
mov byte [rdi], 0x5f
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x140060bd1
mov al, 1
add rsp, 0x3d8
pop rdi
pop rbp
ret