Function at 0x411e60
Capabilities:
Identify system language via api

Disassembly:
push 0xffffffffffffffff
push 0x4a3730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x1c]
call fcn.004207f0
push eax
lea eax, [esp + 0x1c]
push str.UserName_
push eax
mov dword [esp + 0x58], 0
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 1
call fcn.00401fa0
mov byte [esp + 0x4c], 0
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x411ed4
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x1c]
push edi
call ebp
test eax, eax
jg 0x411ef4
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea edi, [esp + 0x18]
call fcn.00420870
push eax
lea ecx, [esp + 0x20]
push str.ComputerName_
mov ebx, 2
push ecx
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 3
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x1c]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x411f46
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x411f66
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea edx, [esp + 0x28]
push edx
call fcn.00414850
mov esi, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x4c], 4
call fcn.004145c0
push eax
lea eax, [esp + 0x24]
push str.OS_
push eax
mov byte [esp + 0x58], 5
call fcn.00401920
add esp, 0xc
push 0x4bef30
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x58], 6
call fcn.00406fd0
add esp, 0xc
push esi
push eax
lea edx, [esp + 0x24]
mov bl, 7
push edx
mov byte [esp + 0x58], bl
call fcn.00402410
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 8
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x1c]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x411ff5
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 6
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x412012
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 5
mov edi, dword [esp + 0x20]
push edi
call ebp
test eax, eax
jg 0x41202f
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 4
mov edi, dword [esp + 0x24]
push edi
call ebp
test eax, eax
jg 0x41204c
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x28]
push edi
call ebp
test eax, eax
jg 0x41206c
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov eax, dword [0x4d9e64]
lea esi, [esp + 0x30]
call fcn.00443e90
push eax
lea eax, [esp + 0x30]
push str.Application_directory_
push eax
mov dword [esp + 0x58], 9
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0xa
call fcn.00401fa0
mov byte [esp + 0x4c], 9
mov eax, dword [esp + 0x2c]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x4120c3
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x30]
push edi
call ebp
test eax, eax
jg 0x4120e3
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea ecx, [esp + 0x2c]
push ecx
call fcn.004272b0
add esp, 4
push eax
lea edx, [esp + 0x34]
push str.Windows_directory_
mov ebx, 0xb
push edx
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0xc
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412139
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x412159
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov eax, dword [0x4d9e64]
lea esi, [esp + 0x24]
call fcn.0041e600
push eax
lea eax, [esp + 0x2c]
push str.Temporary_directory_
mov ebx, 0xd
push eax
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0xe
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x28]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x4121b0
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x24]
push edi
call ebp
test eax, eax
jg 0x4121d0
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
push str.Installer
lea ecx, [esp + 0x1c]
push ecx
mov esi, 9
call fcn.00419c10
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x50], 0xf
call fcn.004272b0
add esp, 4
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x38]
mov bl, 0x10
push edx
mov byte [esp + 0x58], bl
call fcn.00424880
add esp, 0xc
push eax
mov byte [esp + 0x50], 0x11
call fcn.00415480
mov byte [esp + 0x13], al
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x41223f
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 0xf
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x41225c
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
or ebx, 0xffffffff
mov dword [esp + 0x4c], ebx
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x41227e
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
or ebx, 0xffffffff
cmp byte [esp + 0x13], 0
je 0x4122a8
push str.Write_right_for_Installer__Yes
lea eax, [esp + 0x1c]
push eax
mov esi, 0x1f
call fcn.00419c10
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], 0x12
push ecx
jmp 0x4122c9
push str.Write_right_for_Installer__No
lea edx, [esp + 0x1c]
push edx
mov esi, 0x1e
call fcn.00419c10
lea eax, [esp + 0x18]
mov dword [esp + 0x4c], 0x13
push eax
mov ecx, dword [esp + 0x58]
call fcn.00401fa0
mov dword [esp + 0x4c], ebx
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x4122f1
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
or ebx, 0xffffffff
mov eax, dword [0x4d9e64]
lea esi, [esp + 0x30]
call fcn.0041e600
push eax
mov dword [esp + 0x50], 0x14
call fcn.00415480
mov byte [esp + 0x13], al
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412332
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
or ebx, 0xffffffff
cmp byte [esp + 0x13], 0
je 0x41235c
push str.Write_right_for_temporary_directory__Yes
lea ecx, [esp + 0x1c]
push ecx
mov esi, 0x29
call fcn.00419c10
lea edx, [esp + 0x18]
mov dword [esp + 0x4c], 0x15
push edx
jmp 0x41237d
push str.Write_right_for_temporary_directory__No
lea eax, [esp + 0x1c]
push eax
mov esi, 0x28
call fcn.00419c10
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], 0x16
push ecx
mov ecx, dword [esp + 0x58]
call fcn.00401fa0
mov dword [esp + 0x4c], ebx
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x4123a2
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
push 0xa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edx, ax
push edx
lea eax, [esp + 0x34]
push eax
call fcn.00415840
add esp, 0xc
push eax
lea ecx, [esp + 0x34]
push str.UserDefaultLangID_
mov ebx, 0x17
push ecx
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x18
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412404
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x412424
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
push 0xa
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edx, ax
push edx
lea eax, [esp + 0x34]
push eax
call fcn.00415840
add esp, 0xc
push eax
lea ecx, [esp + 0x34]
push str.SystemDefaultLangID_
mov ebx, 0x19
push ecx
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x1a
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412486
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x4124a6
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
push 0xa
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
lea edx, [esp + 0x34]
push edx
call fcn.00415810
add esp, 0xc
push eax
lea eax, [esp + 0x34]
push str.ACP_
mov ebx, 0x1b
push eax
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x1c
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412505
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x412525
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
push 0xa
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00415810
add esp, 0xc
push eax
lea edx, [esp + 0x34]
push str.OEMCP_
mov ebx, 0x1d
push edx
mov dword [esp + 0x58], ebx
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x1e
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412584
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x4125a4
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea eax, [esp + 0x2c]
push eax
call fcn.00418710
add esp, 4
push eax
lea ecx, [esp + 0x34]
push str.MS_Word_Version_
push ecx
mov dword [esp + 0x58], 0x1f
call fcn.00401920
add esp, 0xc
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x20
call fcn.00401fa0
mov byte [esp + 0x4c], 0x1f
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x4125fa
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x41261a
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea edx, [esp + 0x14]
push edx
call fcn.00418930
add esp, 4
mov dword [esp + 0x4c], 0x21
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x4126b2
lea eax, [esp + 0x2c]
call fcn.00418d30
mov bl, 0x22
mov byte [esp + 0x4c], bl
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
add eax, 0xc
push eax
add ecx, 0xc
push ecx
lea ecx, [esp + 0x38]
push str.MS_Outlook_Version___s___s_
push ecx
call fcn.0041b640
add esp, 0x10
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x23
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x30]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412695
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 0x21
mov edi, dword [esp + 0x2c]
push edi
call ebp
test eax, eax
jg 0x4126b2
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
lea edx, [esp + 0x40]
push edx
call fcn.00427170
add esp, 4
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x54], 0x24
call fcn.00425730
push eax
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x5c], 0x25
call fcn.00418e80
push eax
lea edx, [esp + 0x48]
push str.System_hard_disk_s_n_
mov bl, 0x26
push edx
mov byte [esp + 0x68], bl
call fcn.00401920
add esp, 0x1c
mov ecx, dword [esp + 0x54]
push eax
mov byte [esp + 0x50], 0x27
call fcn.00401fa0
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x34]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x412725
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 0x25
mov edi, dword [esp + 0x38]
push edi
call ebp
test eax, eax
jg 0x412742
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 0x24
mov edi, dword [esp + 0x3c]
push edi
call ebp
test eax, eax
jg 0x41275f
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov byte [esp + 0x4c], 0x21
mov edi, dword [esp + 0x40]
push edi
call ebp
test eax, eax
jg 0x41277c
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x41279e
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret 4