Function at 0x140006fb4
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x470
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov r14, r9
mov rsi, r8
mov rbx, rdx
xor r15d, r15d
test rdx, rdx
jne 0x140007006
xor eax, eax
jmp 0x140007357
test r14, r14
je 0x140006fff
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x40], r15d
mov r13d, dword [r9]
mov word [rsp + 0x50], r15w
mov dword [r9], r15d
lea r8, [rsp + 0x50]
lea rdx, [0x140047140]
mov rcx, rbx
call fcn.1400073e0
test eax, eax
je 0x14000705f
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140006ef0
mov edi, dword [rsp + 0x30]
test edi, edi
jne 0x1400070a0
lea r8, [rsp + 0x50]
lea rdx, [0x140047130]
mov rcx, rbx
call fcn.1400073e0
test eax, eax
je 0x14000725f
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140006ef0
mov edi, dword [rsp + 0x30]
test edi, edi
je 0x14000725f
mov ebx, r15d
mov r12, qword [rsp + 0x38]
test r12, r12
je 0x140007355
mov ecx, edi
call fcn.140002798
mov r15, rax
xor ecx, ecx
test rax, rax
je 0x140007355
mov ebx, dword [rsp + 0x40]
mov rax, qword [0x14007e3a8]
test rax, rax
jne 0x1400070f0
lea rcx, [0x140048b98]
call fcn.14000e1a8
mov qword [0x14007e3a8], rax
xor ecx, ecx
test rax, rax
je 0x14000711d
mov r10, qword [0x14007e358]
test r10, r10
jne 0x140007124
lea rdx, str.GetFileVersionInfoW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x14007e358], rax
xor ecx, ecx
test rax, rax
jne 0x140007124
mov ebx, ecx
jmp 0x14000721d
mov r9, r15
mov r8d, edi
mov edx, ebx
mov rcx, r12
mov rax, r10
call qword [case.0x14003f18e.0]
xor edi, edi
mov ebx, edi
test eax, eax
je 0x14000721d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r12d, ax
lea rbx, [0x140047b44]
mov eax, dword [rbx]
neg eax
sbb edx, edx
and edx, r12d
mov r8d, dword [rbx - 4]
lea rcx, [rbp + 0x160]
call fcn.140006e34
mov rax, qword [0x14007e3a8]
test rax, rax
jne 0x140007192
lea rcx, [0x140048b98]
call fcn.14000e1a8
mov qword [0x14007e3a8], rax
test rax, rax
je 0x140007207
mov r10, qword [0x14007e350]
test r10, r10
jne 0x1400071bd
lea rdx, str.VerQueryValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x14007e350], rax
test rax, rax
je 0x140007207
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x160]
mov rcx, r15
mov rax, r10
call qword [case.0x14003f18e.0]
test eax, eax
je 0x140007207
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.14000dccc
mov rdi, rax
test rax, rax
je 0x140007205
nop dword [rax]
nop word [rax + rax]
test rax, rax
jne 0x14000722a
xor edi, edi
add rbx, 8
lea rax, [0x140047b84]
cmp rbx, rax
jl 0x140007155
mov ebx, edi
mov rcx, r15
call fcn.1400027dc
jmp 0x140007355
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call fcn.14000dc08
mov rcx, rdi
xor edx, edx
mov eax, edx
lea ebx, [rdx + 1]
cmp word [rdi], dx
je 0x140007252
lea rcx, [rcx + 2]
add eax, ebx
cmp word [rcx], dx
jne 0x140007247
mov dword [r14], eax
mov rcx, rdi
call fcn.1400027dc
jmp 0x14000721d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x140007341
movzx eax, byte [rsp + 0x50]
mov ebx, 1
cmp dword [rsp + 0x44], ebx
cmove eax, r15d
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007341
lea rdx, [0x1400482f0]
lea rcx, [rsp + 0x50]
call fcn.14000dd3c
mov rdx, rax
test rax, rax
je 0x140007341
add rax, 0x14
jmp 0x1400072fc
add rax, 2
test cx, cx
je 0x140007341
movzx ecx, word [rax]
cmp cx, 0x20
jne 0x1400072f5
mov word [rax], r15w
mov r8d, r13d
mov rcx, rsi
call fcn.14000dc08
mov eax, r15d
test rsi, rsi
je 0x14000732c
jmp 0x140007326
lea rsi, [rsi + 2]
add eax, ebx
cmp word [rsi], r15w
jne 0x140007320
mov dword [r14], eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140007355
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140007355
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140007352
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov ebx, r15d
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14003ee60
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret