Function at 0x4051b0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x10058
call fcn.00412cf0
mov eax, dword [0x422760]
xor eax, esp
mov dword [esp + 0x10054], eax
push esi
mov esi, dword [esp + 0x10060]
push 0x7fff
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x44
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00412d20
add esp, 0xc
xor eax, eax
lea edx, [esp + 4]
push edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 0
push esi
push 0x404
push 0
push 0
push 0
lea ecx, [esp + 0x78]
push ecx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x40525a
mov edx, dword [esp]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov ecx, dword [esp + 0x10054]
xor ecx, esp
call fcn.00412cdc
add esp, 0x10058
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x57
sete cl
lea ecx, [ecx + ecx - 1]
mov eax, ecx
mov ecx, dword [esp + 0x10054]
xor ecx, esp
call fcn.00412cdc
add esp, 0x10058
ret

Function at 0x4052c0
Capabilities:
Get thread local storage value
Identify system language via api
Set thread local storage value

Disassembly:
mov eax, dword [0x4233c0]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4052fb
push 0xffff
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4052ed
mov eax, str._out_of_memory_for_error_message_
pop esi
ret
mov ecx, dword [0x4233c0]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push 0
push 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx edx, ax
push edx
push edi
push 0
push 0x1200
call ebx
test eax, eax
jne 0x40535c
push eax
push 0xffff
push esi
push eax
push edi
push eax
push 0x1200
call ebx
test eax, eax
jne 0x40535c
push edi
push str.system_error__lu
push 0xffffffffffffffff
push 0xffff
push esi
call fcn.00412731
add esp, 0x14
test eax, eax
jge 0x40535c
pop edi
pop ebx
xor eax, eax
pop esi
ret
pop edi
pop ebx
mov eax, esi
pop esi
ret

Function at 0x405370
Capabilities:
Identify system language via api

Disassembly:
push ecx
push esi
push edi
push 0
push 0xffff
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx ecx, ax
push ecx
push esi
push 0
push 0xb00
call edi
test eax, eax
jne 0x4053ee
push eax
push 0xffff
lea edx, [esp + 0x10]
push edx
push eax
push esi
push eax
push 0xb00
call edi
test eax, eax
jne 0x4053ee
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push str.system_error__lu
push 0xffffffffffffffff
push 0xffff
push eax
mov dword [esp + 0x1c], eax
call fcn.00412731
add esp, 0x14
test eax, eax
jge 0x4053ee
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret