Function at 0x105da23
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10619c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ebx
cmp esi, ebx
jne 0x105da56
xor eax, eax
jmp 0x105e1af
test dword [ebp + 0xc], reloc.Secur32.dll_LsaDeregisterLogonProcess
jne 0x105da4f
push edi
mov edi, dword [ebp + 0x10]
cmp di, bx
jne 0x105da72
test byte [ebp + 0xc], 0x10
jne 0x105e0dc
call fcn.0105d55d
mov dword [0x10630b8], eax
movzx eax, al
and eax, 0x20
or eax, 2
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
test eax, eax
je 0x105e0dc
test byte [0x10630b8], 0x20
jne 0x105e1ae
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push 0x104
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x105e0d0
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
test eax, eax
jne 0x105daee
and dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ebx
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
jmp 0x105db00
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ecx
xor ecx, ecx
mov word [eax - 2], cx
push 0
push dword [ebp - 0x414]
call fcn.0105d428
test eax, eax
je 0x105e0b8
test di, di
jne 0x105e090
mov al, byte [0x10630b8]
test al, 4
je 0x105de9f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, 0x404
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
cmp ax, cx
jne 0x105db52
call fcn.0105d69c
movzx eax, ax
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
mov eax, dword [ebp + 0xc]
and eax, 8
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
je 0x105dc28
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x420]
lea edi, reloc.Secur32.dll_LsaDeregisterLogonProcess
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
je 0x105e11c
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov edx, esi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
lea edx, reloc.Secur32.dll_LsaDeregisterLogonProcess
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
cmp word [ebp - 0x208], ax
je 0x105dc07
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov edx, edi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
mov eax, 0xc04
cmp word [ebp - 0x420], ax
jne 0x105ddd3
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0x404
jmp 0x105db5e
movzx eax, word [ebp - 0x420]
push eax
push 0x1014388
lea eax, [ebp - 0xb0]
push 0x55
push eax
call fcn.0101b185
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
add esp, 0x10
push dword [ebp - 0x41c]
lea edx, [ebp - 0xb0]
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x420]
xor edi, edi
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
je 0x105dcda
push 2
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call fcn.0105e22a
movzx eax, ax
test ax, ax
je 0x105dcda
movzx eax, ax
push eax
push 0x1014388
mov eax, esi
push 0x55
push eax
call fcn.0101b185
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
add esp, 0x10
push dword [ebp - 0x41c]
mov edx, esi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
mov eax, 0xc04
cmp word [ebp - 0x420], ax
je 0x105dc19
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
cmp si, word [ebp - 0x420]
je 0x105ddb7
movzx eax, si
push eax
push 0x1014388
lea eax, [ebp - 0xb0]
push 0x55
push eax
call fcn.0101b185
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
add esp, 0x10
push dword [ebp - 0x41c]
lea edx, [ebp - 0xb0]
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push esi
xor edi, edi
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
je 0x105ddb1
push 2
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call fcn.0105e22a
movzx eax, ax
test ax, ax
je 0x105ddb1
movzx eax, ax
push eax
push 0x1014388
mov eax, esi
push 0x55
push eax
call fcn.0101b185
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
add esp, 0x10
push dword [ebp - 0x41c]
mov edx, esi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
mov esi, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov eax, 0x409
mov ecx, eax
cmp cx, word [ebp - 0x420]
je 0x105e068
cmp ax, si
jmp 0x105e040
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
cmp ax, word [ebp - 0x420]
je 0x105de86
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push eax
lea edi, reloc.Secur32.dll_LsaDeregisterLogonProcess
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
je 0x105e0b8
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov edx, esi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
lea edx, reloc.Secur32.dll_LsaDeregisterLogonProcess
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
cmp word [ebp - 0x208], ax
je 0x105de86
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov edx, edi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
mov eax, 0x409
mov ecx, eax
cmp cx, word [ebp - 0x420]
je 0x105e068
jmp 0x105df5d
test al, 3
je 0x105e0b8
call fcn.0105d705
test byte [ebp + 0xc], 8
movzx eax, ax
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
je 0x105df86
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push eax
lea edi, reloc.Secur32.dll_LsaDeregisterLogonProcess
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
je 0x105e0b8
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov edx, esi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
lea edx, reloc.Secur32.dll_LsaDeregisterLogonProcess
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
cmp word [ebp - 0x208], ax
je 0x105df56
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov edx, edi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
mov eax, 0x409
mov ecx, eax
cmp cx, word [ebp - 0x424]
je 0x105e068
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push eax
xor edi, edi
lea esi, [ebp - 0xb0]
call fcn.0105d880
mov edx, esi
jmp 0x105e047
movzx eax, ax
push eax
push 0x1014388
lea eax, [ebp - 0xb0]
push 0x55
push eax
call fcn.0101b185
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
add esp, 0x10
push dword [ebp - 0x41c]
lea edx, [ebp - 0xb0]
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x424]
xor edi, edi
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
je 0x105e034
push 2
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call fcn.0105e22a
movzx eax, ax
test ax, ax
je 0x105e034
movzx eax, ax
push eax
push 0x1014388
mov eax, esi
push 0x55
push eax
call fcn.0101b185
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
add esp, 0x10
push dword [ebp - 0x41c]
mov edx, esi
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
mov eax, 0x409
cmp ax, word [ebp - 0x424]
je 0x105e068
mov edx, 0x1014374
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
xor edx, edx
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
jne 0x105e120
jmp 0x105e11c
test byte [0x10630b8], 7
je 0x105e0b8
test byte [ebp + 0xc], 8
je 0x105e0e3
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push edi
xor edi, edi
lea esi, [ebp - 0xb0]
call fcn.0105d880
test eax, eax
jne 0x105e0fd
test byte [ebp + 0xc], 0x10
je 0x105e130
push dword [ebp + 0x10]
push dword [ebp - 0x414]
call fcn.0105d428
test eax, eax
jne 0x105e130
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x105e1ae
movzx eax, di
push eax
push 0x1014388
lea eax, [ebp - 0xb0]
push 0x55
push eax
call fcn.0101b185
add esp, 0x10
push dword [ebp - 0x41c]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
lea edx, [ebp - 0xb0]
call fcn.0105d9bc
mov ebx, eax
test ebx, ebx
je 0x105e0b8
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
jmp 0x105e1ae
test byte [ebp - 0x414], 1
je 0x105e1a8
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.0105d55d
test al, 0x38
je 0x105e185
push dword [ebp - 0x418]
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push dword [ebp - 0x41c]
push 0x1003de4
push 0x104
push eax
call fcn.0101b185
add esp, 0x14
push 0
push 1
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call fcn.0105d4d0
jmp 0x105e1a2
call fcn.0105d55d
push 0
and eax, 0x26
pop eax
setne al
push eax
push 0
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01041ea8
leave
ret 0xc