Function at 0x458ba0
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
call fcn.00457f08
call fcn.00457ab8
call fcn.00457d9c
call fcn.004032f8
call fcn.00459d9c
movzx eax, byte [0x7df52c]
test eax, eax
jle 0x458bea
cmp eax, 0x14
jge 0x458bea
push 0x7e9968
push 0x7e9364
call fcn.0040ced4
mov eax, 0xffffffff
add esp, 0x48
pop ebx
pop esi
pop edi
ret
call fcn.00459c0c
movsx eax, al
test eax, eax
je 0x458c02
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
push 0x7e99a8
push dword [0x7df53c]
call fcn.0045f7f0
add esp, 8
test eax, eax
jne 0x458cf5
mov eax, dword [0x570660]
mov dword [esp + 8], eax
mov edx, dword [0x570668]
mov dword [esp + 0x10], edx
mov ecx, dword [0x57066c]
mov dword [esp + 0x14], ecx
mov ebx, dword [0x570670]
mov dword [esp + 0x18], ebx
mov esi, dword [0x570674]
mov dword [esp + 0x1c], esi
mov edi, dword [0x570678]
mov dword [esp + 0x20], edi
mov eax, dword [0x57067c]
mov dword [esp + 0x24], eax
mov eax, dword [0x570680]
mov dword [esp + 0x28], eax
mov eax, dword [0x570684]
mov dword [esp + 0x2c], eax
mov eax, dword [0x570688]
mov dword [esp + 0x30], eax
mov eax, dword [0x57068c]
mov dword [esp + 0x34], eax
mov eax, dword [0x570690]
mov dword [esp + 0x38], eax
mov eax, dword [0x570694]
mov dword [esp + 0x3c], eax
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov eax, dword [0x7df88c]
test eax, eax
je 0x458cbe
mov eax, dword [eax + 0x2a4]
test eax, eax
je 0x458cbe
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 1
mov dword [esp + 8], 0x40
mov dword [esp + 0x14], 0x7e9994
mov dword [esp + 0x18], 0x7e99a8
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
push 0x7e99b0
push dword [0x7df53c]
call fcn.0045f7f0
add esp, 8
test eax, eax
je 0x45915d
call fcn.00455934
test eax, eax
je 0x458d25
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
movsx eax, byte [0x7df4d8]
test eax, eax
jne 0x459144
call fcn.00456e50
test eax, eax
je 0x458d49
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.004591ac
call fcn.004569d8
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.00459bb4
movsx eax, al
test eax, eax
je 0x458d71
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.0045548c
test eax, eax
je 0x458d86
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov edi, dword [0x7df88c]
mov ebx, dword [edi + 0xc]
mov dword [0x7df5e4], ebx
mov ecx, dword [edi + 0x10]
mov dword [0x7df5e8], ecx
mov esi, ecx
movsx eax, byte [0x7df498]
test eax, eax
je 0x458dd6
mov edx, dword [0x7df5cc]
mov dword [edi + 0xc], edx
mov ecx, dword [0x7df88c]
mov eax, dword [0x7df5d0]
mov dword [ecx + 0x10], eax
mov ebx, dword [ecx + 0xc]
mov dword [0x7df5ec], ebx
mov dword [0x7df5f0], eax
mov esi, eax
mov ecx, eax
jmp 0x458ded
mov dword [0x7df5f0], ecx
mov dword [0x7df5ec], ebx
mov edx, dword [0x7df5cc]
mov eax, dword [0x7df5d0]
cmp ebx, edx
jg 0x458df5
cmp esi, eax
jle 0x458e19
mov ebx, edx
shr ebx, 0x1f
add edx, ebx
mov ebx, edx
sar ebx, 1
mov dword [0x7df5f4], ebx
mov edx, eax
shr edx, 0x1f
add eax, edx
mov esi, eax
sar esi, 1
mov dword [0x7df5f8], esi
jmp 0x458e25
mov dword [0x7df5f8], ecx
mov dword [0x7df5f4], ebx
mov ecx, dword [0x7df404]
lea edx, [ebx + ebx]
add edx, edx
cmp ebx, 0x2000
jg 0x45911d
test ecx, ecx
je 0x459106
mov eax, edx
imul eax, esi
lea edx, [edx + eax + 4]
push edx
push ecx
call fcn.0045f9f8
add esp, 8
mov edi, eax
test edi, edi
je 0x4590dd
mov dword [0x7df404], edi
push 0x65e420
mov ecx, dword [0x7df88c]
call fcn.00458990
mov dword [0x7df634], 1
push 0x65e420
push 0x65e660
push dword [0x7df4cc]
push dword [0x7df4c8]
mov ecx, dword [0x7df88c]
call fcn.0044fc80
test eax, eax
jne 0x458ec1
push 0x7e99b8
push 0x7e9364
call fcn.0040ced4
mov eax, 0xffffffff
add esp, 0x48
pop ebx
pop esi
pop edi
ret
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
movsx eax, byte [0x7df498]
test eax, eax
je 0x458eee
mov eax, dword [0x7df88c]
push 0
push dword [eax + 0x2a4]
call sub.IMM32.dll_ImmAssociateContext
call fcn.0045cddc
movsx eax, byte [0x7df498]
test eax, eax
je 0x458f05
mov byte [0x7df4e4], 0
push 0
call fcn.0045bf14
pop ecx
test eax, eax
jge 0x458f18
mov byte [0x7df4e4], 0
movsx eax, byte [0x7df4e4]
test eax, eax
jne 0x458f2d
mov eax, dword [0x7df5d4]
mov dword [0x7df5c4], eax
movsx eax, byte [0x7df4e8]
test eax, eax
jne 0x4590d1
call fcn.00458ab0
call fcn.00459470
movsx eax, byte [0x7df4ec]
test eax, eax
jne 0x4590af
push dword [0x7df4c8]
call fcn.0045ce14
pop ecx
movsx eax, al
test eax, eax
je 0x458f71
mov byte [0x7df4f4], 1
jmp 0x458f78
mov byte [0x7df4f4], 0
mov dword [0x7df728], 0
push 0x7df594
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movsx eax, byte [0x7df360]
test eax, eax
je 0x458fa9
call fcn.00457470
call fcn.0045c88c
movsx eax, al
test eax, eax
je 0x458fc6
call fcn.00412bf4
mov eax, 1
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.0045b62c
call fcn.0045c59c
test eax, eax
je 0x458fe0
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.0045b6e0
movsx eax, byte [0x7df4fc]
call fcn.004504bd
cmp eax, 1
je 0x45906d
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x7df5a4], eax
mov dword [0x7df5a8], eax
mov dword [0x7df5ac], eax
mov dword [0x7df5b0], eax
movsx eax, byte [0x7df360]
test eax, eax
je 0x45902e
call fcn.00408a60
cmp eax, 1
je 0x459037
cmp eax, 0xffffffff
je 0x45917f
xor eax, eax
add esp, 0x40
pop ebx
pop esi
pop edi
ret
xor eax, eax
mov byte [0x7df394], al
mov byte [0x595730], 1
mov byte [0x7df360], al
push 0x7e91e4
push 0x7e58a0
call fcn.0045d62c
push 0x7e91e4
push 0x7e58a0
call fcn.0040ced4
add esp, 0x10
jmp 0x45902e
mov eax, dword [0x7df88c]
push 5
push dword [eax + 0x2a4]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, eax
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, ebx
cmp eax, 0x5dc
jae 0x458ff6
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, ebx
cmp eax, 0x5dc
jb 0x45909b
jmp 0x458ff6
call fcn.0045bfec
cmp eax, 1
je 0x4590c5
mov byte [0x7df4ec], 0
jmp 0x458f55
mov byte [0x7df4ec], 1
jmp 0x458f55
mov byte [0x7df5e0], 0
jmp 0x458f3c
push esi
push ebx
push 0
push 0x7e9a98
push 0x7e58a0
call fcn.0045d62c
push 0
push 1
push 0x1965e
call fcn.0045d078
add esp, 0x20
jmp 0x458e61
mov eax, edx
imul eax, esi
lea edx, [edx + eax + 4]
push edx
call fcn.0045f6ac
pop ecx
mov edi, eax
jmp 0x458e59
push esi
push ebx
push 0x7e9a70
push 0x7e58a0
call fcn.0040ced4
push 1
push 0x186aa
call fcn.0045d0d4
add esp, 0x18
xor edi, edi
jmp 0x458e61
mov esi, 0x65e8a0
mov edi, 0x65e780
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x45914e
jmp 0x458d49
mov dword [0x595740], 0x7e617c
push 1
push 0x186a0
call fcn.0045d0d4
mov eax, 0xffffffff
add esp, 0x48
pop ebx
pop esi
pop edi
ret
xor edx, edx
mov byte [0x7df394], dl
mov ecx, 1
mov byte [0x595730], cl
mov byte [0x7df360], dl
mov byte [0x7df788], cl
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret