Function at 0x41b70b
Capabilities:
Identify system language via api
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435590
push 0x42f730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
movsx eax, byte [0x43bbd1]
push eax
push 0xaa23ffff
call fcn.004118a0
pop ecx
pop ecx
add word [0x43bbe0], ax
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41b92d
inc word [0x43bbe2]
mov dword [0x43bbf4], 0xd6460001
and dword [ebp - 0x20], 0
movsx ax, byte [0x43bbce]
sub ax, word [0x43bbe0]
mov word [0x43bbde], ax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x41b92d
push 0x47ebffff
push 0x2c8dffff
call fcn.004116de
pop ecx
pop ecx
add word [0x43bbe0], ax
dec byte [0x43bbcd]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x41b92d
movsx eax, word [0x43bbe2]
push eax
push 0x3c75ffff
call fcn.0041172e
add word [0x43bbda], ax
push 0x4e
call fcn.00415e0d
add esp, 0xc
call eax
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x41b808
push ebx
call fcn.0041ca4c
pop ecx
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push 0xb46dffff
call dword [sym.imp.USER32.dll_IsWindow]
add dword [0x43bbe8], eax
push 0x40
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x41b92d
push 0xeb97ffff
movsx eax, byte [0x43bbd1]
push eax
call fcn.00411820
pop ecx
pop ecx
add byte [0x43bbcb], al
push 1
pop esi
mov dword [0x43bbfc], esi
mov ax, word [0x43bbda]
inc ax
add word [0x43bbe0], ax
cmp word [ebx], 0x5a4d
jne 0x41b92d
push 0xfdedffff
push 0x10f9ffff
call fcn.00411762
add byte [0x43bbd1], al
mov word [0x43bbdc], si
push dword [ebx + 0x3c]
push ebx
call fcn.0041b6bf
mov edi, eax
mov dword [ebp - 0x24], edi
push 0x4fc1ffff
movsx eax, byte [0x43bbc9]
push eax
call fcn.00411820
add esp, 0x18
mov byte [0x43bbca], al
cmp word [0x43bbdc], 0
jne 0x41b8c3
cmp byte [0x43bbcf], 0
jne 0x41b8c3
xor esi, esi
add word [0x43bbd2], si
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x41b92d
push dword [0x43bbf4]
push 0xea21ffff
call fcn.00411762
mov byte [0x43bbcd], al
movsx eax, byte [0x43bbce]
push eax
movsx eax, word [0x43bbdc]
push eax
call fcn.004118a0
add word [0x43bbdc], ax
movsx eax, word [0x43bbe2]
push eax
push 0x905ffff
call fcn.004117aa
add esp, 0x18
mov dword [0x43bbf8], eax
cmp dword [edi], 0x4550
je 0x41b934
xor eax, eax
jmp 0x41c375
inc dword [0x43bc08]
push dword [edi + 0x80]
push ebx
call fcn.0041b6bf
mov esi, eax
mov dword [ebp - 0x2c], esi
movsx eax, word [0x43bbdc]
push eax
push dword [0x43bc00]
call fcn.00411820
add esp, 0x10
mov dword [0x43bbf0], eax
mov eax, dword [0x43bbf4]
sub eax, dword [0x43bc00]
mov dword [0x43bc04], eax
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
add word [0x43bbd8], ax
cmp esi, ebx
je 0x41bd98
inc byte [0x43bbd1]
cmp esi, edi
je 0x41bd98
push dword [0x43bc08]
movsx eax, byte [0x43bbce]
push eax
call fcn.0041172e
add dword [0x43bc00], eax
movsx eax, byte [0x43bbce]
push eax
push 0x6ba9ffff
call fcn.004116de
add esp, 0x10
add word [0x43bbd8], ax
xor edi, edi
mov dword [ebp - 4], edi
push 0xa5c5ffff
movsx eax, byte [0x43bbca]
push eax
call fcn.004117aa
pop ecx
pop ecx
add dword [0x43bbec], eax
cmp dword [esi + 0xc], edi
je 0x41baff
mov dword [ebp - 4], 1
inc byte [0x43bbcc]
push dword [esi + 0xc]
push ebx
call fcn.0041b6bf
mov dword [ebp - 0x38], eax
movsx eax, byte [0x43bbc8]
push eax
push dword [0x43bbec]
call fcn.0041172e
add esp, 0x10
mov byte [0x43bbd0], al
push 0xf29dffff
call dword [sym.imp.USER32.dll_IsMenu]
mov byte [0x43bbca], al
lea eax, [ebp - 0x34]
push eax
push 4
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov dword [ebp - 0x3c], eax
cmp byte [0x43bbcc], 0
jne 0x41ba6a
cmp dword [0x43bc00], edi
jne 0x41ba6a
xor eax, eax
jmp 0x41ba6d
push 1
pop eax
add byte [0x43bbd0], al
movsx eax, byte [0x43bbcf]
movsx ecx, word [0x43bbe2]
and eax, ecx
add dword [0x43bc0c], eax
movsx eax, byte [0x43bbce]
push eax
movsx eax, word [0x43bbe0]
push eax
call fcn.00411762
mov byte [0x43bbce], al
push dword [ebp + 0xc]
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x10
test eax, eax
jne 0x41bbf4
movsx eax, byte [0x43bbc9]
push eax
push 0xff4bffff
call fcn.00411856
pop ecx
pop ecx
mov word [0x43bbd8], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov byte [0x43bbcc], 1
mov dword [0x43bbfc], 0x61920000
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xc], edi
je 0x41bd98
push dword [esi + 0x10]
push ebx
call fcn.0041b6bf
mov esi, eax
push 0x4f4bffff
movsx eax, byte [0x43bbcb]
push eax
call fcn.0041172e
add dword [0x43bbec], eax
push 0x39ffffff
push 0x8391ffff
call fcn.0041172e
add dword [0x43bbfc], eax
push 0xab07ffff
push 0xf0edffff
call fcn.004117d2
add esp, 0x20
mov byte [0x43bbcc], al
cmp dword [esi], edi
je 0x41bd98
movsx ax, byte [0x43bbc8]
imul eax, dword [0x43bc00]
mov word [0x43bbd2], ax
push 0x6d8fffff
push 0x759bffff
call fcn.004118a0
add byte [0x43bbce], al
push 0x916dffff
movsx eax, word [0x43bbd2]
push eax
call fcn.004118a0
add esp, 0x10
mov word [0x43bbe2], ax
mov eax, dword [esi]
cmp eax, dword [ebp - 0x28]
je 0x41bc4b
add esi, 4
mov eax, dword [0x43bc0c]
or eax, dword [0x43bbfc]
add dword [0x43bc0c], eax
push 0x82d9ffff
movsx eax, byte [0x43bbcb]
push eax
call fcn.0041172e
pop ecx
pop ecx
mov word [0x43bbe2], ax
push eax
call dword [sym.imp.USER32.dll_IsCharUpperA]
add word [0x43bbda], ax
jmp 0x41bb5b
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov dword [ebp - 4], edi
jmp 0x41bc2b
mov ax, word [0x43bbd8]
movsx ecx, byte [0x43bbcb]
sub eax, ecx
mov word [0x43bbe4], ax
add esi, 0x14
mov dword [ebp - 0x2c], esi
jmp 0x41b9ef
push 0x867fffff
push 0xa68dffff
call fcn.004116de
add word [0x43bbd8], ax
dec byte [0x43bbc8]
push 0x531fffff
push dword [0x43bbf8]
call fcn.0041172e
add esp, 0x10
add word [0x43bbde], ax
lea eax, [ebp - 0x40]
push eax
push 4
push 4
push esi
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov edi, eax
mov al, byte [0x43bbd4]
add al, byte [0x43bbda]
add byte [0x43bbca], al
inc word [0x43bbe4]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov dword [0x43bc04], eax
test edi, edi
je 0x41bd0b
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov al, byte [0x43bbda]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
mov word [0x43bbda], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call edi
movzx eax, ax
add dword [0x43bc00], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 4
push esi
push 0x5f
call fcn.00415e0d
pop ecx
call eax
call edi
movzx eax, ax
mov dword [0x43bc00], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
movsx eax, byte [0x43bbc9]
movsx ecx, word [0x43bbde]
or eax, ecx
add dword [0x43bbf8], eax
push 0x470fffff
push 0x47d5ffff
call fcn.004116ab
add word [0x43bbd8], ax
push 0x6bfdffff
push 0xa3afffff
call fcn.004117d2
add esp, 0x10
add byte [0x43bbcb], al
jmp 0x41bd98
movsx eax, byte [0x43bbc9]
and eax, 0xeb63ffff
mov dword [0x43bbec], eax
or word [0x43bbd6], 0xffff
push 0x28b7ffff
movsx eax, word [0x43bbd8]
push eax
call fcn.00411820
mov dword [0x43bc04], eax
inc word [0x43bbd8]
mov eax, dword [ebp - 0x24]
push dword [eax + 0xe0]
push dword [ebp - 0x1c]
call fcn.0041b6bf
mov ebx, eax
mov dword [ebp - 0x48], ebx
push 0xf649ffff
push 0xfe85ffff
call fcn.004118a0
mov word [0x43bbe2], ax
movsx eax, byte [0x43bbcb]
push eax
movsx eax, word [0x43bbd2]
push eax
call fcn.004118e8
add esp, 0x20
mov word [0x43bbe4], ax
cmp ebx, dword [ebp - 0x1c]
je 0x41c35a
push 0x10d3ffff
movsx eax, word [0x43bbdc]
push eax
call fcn.004118a0
pop ecx
pop ecx
mov byte [0x43bbca], al
cmp ebx, dword [ebp - 0x24]
je 0x41c35a
mov eax, dword [0x43bbf4]
and ax, word [0x43bbe0]
add word [0x43bbe4], ax
mov dword [0x43bc04], 0x4031ffff
xor eax, eax
cmp dword [0x43bc08], eax
setne al
add word [0x43bbe4], ax
push 2
pop esi
mov dword [ebp - 4], esi
cmp dword [ebx + 4], 0
je 0x41bf62
call dword [sym.imp.KERNEL32.dll_GetVersion]
add byte [0x43bbca], al
movsx eax, byte [0x43bbcc]
imul eax, eax, 0x347bffff
mov word [0x43bbd8], ax
mov dword [ebp - 4], 3
push dword [ebx + 4]
push dword [ebp - 0x1c]
call fcn.0041b6bf
mov dword [ebp - 0x58], eax
push dword [0x43bc00]
movsx eax, word [0x43bbd4]
push eax
call fcn.00411856
add esp, 0x10
mov word [0x43bbd8], ax
movsx ax, byte [0x43bbc8]
add word [0x43bbe0], ax
mov al, byte [0x43bbf4]
dec al
add byte [0x43bbd1], al
lea eax, [ebp - 0x54]
push eax
push 4
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov dword [ebp - 0x5c], eax
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41c007
movsx eax, word [0x43bbda]
push eax
push 0x844bffff
call fcn.00411762
pop ecx
pop ecx
add word [0x43bbd4], ax
mov dword [0x43bc04], 0x7f6fffff
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.00415e0d
pop ecx
call eax
inc dword [0x43bbf0]
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
push dword [0x43bbfc]
push 0xe249ffff
call fcn.00411762
pop ecx
pop ecx
mov byte [0x43bbca], al
cmp dword [ebx + 4], 0
je 0x41c35a
add al, byte [0x43bbd1]
add byte [0x43bbc9], al
mov al, byte [0x43bbde]
mov byte [0x43bbcb], al
push dword [ebx + 0x10]
push dword [ebp - 0x1c]
call fcn.0041b6bf
pop ecx
pop ecx
mov esi, eax
and dword [ebp - 0x4c], 0
cmp dword [esi], 0
je 0x41c2c6
sub dword [0x43bbec], 0x4f600002
or al, 0xff
sub al, byte [0x43bbd4]
mov byte [0x43bbcb], al
test byte [esi + 3], 0x80
je 0x41c0aa
mov eax, dword [0x43bc08]
imul eax, dword [0x43bc00]
add word [0x43bbe0], ax
mov al, byte [0x43bbc8]
or al, byte [0x43bbcf]
movsx ax, al
mov word [0x43bbdc], ax
jmp 0x41c12a
xor eax, eax
cmp dword [0x43bbfc], eax
setne al
mov word [0x43bbe0], ax
mov eax, dword [0x43bbf0]
imul eax, eax, 0x1891ffff
mov word [0x43bbd4], ax
push dword [0x43bbe8]
push dword [0x43bc0c]
call fcn.004118a0
pop ecx
pop ecx
add word [0x43bbe2], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov dword [ebp - 4], esi
jmp 0x41c09f
add ebx, 0x20
mov dword [ebp - 0x48], ebx
jmp 0x41be78
movsx ecx, word [0x43bbe2]
push ecx
movsx eax, al
push eax
call fcn.004118e8
add byte [0x43bbca], al
mov edi, dword [esi]
movsx eax, word [0x43bbd2]
push eax
movsx eax, byte [0x43bbcd]
push eax
call fcn.004118e8
mov dword [0x43bbf4], eax
push 0x7845ffff
push dword [0x43bbfc]
call fcn.00411762
mov word [0x43bbd2], ax
add edi, 2
push edi
push dword [ebp - 0x1c]
call fcn.0041b6bf
mov edi, eax
push 0xc637ffff
movsx eax, word [0x43bbd8]
push eax
call fcn.0041172e
mov word [0x43bbe0], ax
push dword [ebp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x30
test eax, eax
je 0x41c155
cmp word [0x43bbe2], 0
jne 0x41c141
cmp byte [0x43bbca], 0
jne 0x41c141
xor eax, eax
jmp 0x41c144
push 1
pop eax
add dword [0x43bbf4], eax
add esi, 4
inc dword [ebp - 0x4c]
jmp 0x41bfb0
cmp byte [0x43bbc8], 0
je 0x41c16c
cmp dword [0x43bbf8], 0
je 0x41c16c
push 1
pop eax
jmp 0x41c16e
xor eax, eax
add dword [0x43bbec], eax
cmp byte [0x43bbd0], 0
je 0x41c18b
cmp dword [0x43bc00], 0
je 0x41c18b
push 1
pop eax
jmp 0x41c18d
xor eax, eax
add word [0x43bbd2], ax
push dword [ebx + 0xc]
push dword [ebp - 0x1c]
call fcn.0041b6bf
pop ecx
pop ecx
mov esi, eax
cmp byte [0x43bbc8], 0
setne al
mov byte [0x43bbca], al
push 0x2d3bffff
call dword [sym.imp.USER32.dll_IsWindow]
add dword [0x43bbf4], eax
push 0x7091ffff
movsx eax, byte [0x43bbc8]
push eax
call fcn.004118a0
pop ecx
pop ecx
mov word [0x43bbe4], ax
mov eax, dword [ebp - 0x4c]
lea esi, [esi + eax*4]
lea eax, [ebp - 0x68]
push eax
push 4
push 4
push esi
push 0x5f
call fcn.00415e0d
pop ecx
call eax
mov edi, eax
push 0x6c61ffff
movsx eax, word [0x43bbe2]
push eax
call fcn.00411820
mov word [0x43bbe0], ax
push dword [0x43bbf4]
movsx eax, byte [0x43bbcd]
push eax
call fcn.004117d2
mov word [0x43bbd8], ax
movsx eax, byte [0x43bbc8]
push eax
push 0x4e4fffff
call fcn.00411820
add esp, 0x18
mov word [0x43bbde], ax
test edi, edi
je 0x41c2c6
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
push 0x37bfffff
push 0x7f15ffff
call fcn.00411820
pop ecx
pop ecx
add word [0x43bbda], ax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x68]
push 4
push esi
push 0x5f
call fcn.00415e0d
pop ecx
call eax
movsx eax, word [0x43bbd4]
push eax
movsx eax, byte [0x43bbcd]
push eax
call fcn.004117d2
mov byte [0x43bbd0], al
push 0x58f3ffff
push dword [0x43bc08]
call fcn.004116de
add esp, 0x10
add word [0x43bbdc], ax
cmp dword [ebp - 0x20], 0
jne 0x41c2b9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov al, byte [0x43bbcb]
inc al
add byte [0x43bbca], al
push 0x5ac3ffff
push 0xdfcfffff
call fcn.00411856
pop ecx
pop ecx
add word [0x43bbe4], ax
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
add byte [0x43bbd1], al
push 0x29f7ffff
push 0xe979ffff
call fcn.004118e8
pop ecx
pop ecx
add dword [0x43bbf8], eax
jmp 0x41c35a
push 0x3b11ffff
push dword [0x43bc0c]
call fcn.004116de
pop ecx
pop ecx
add dword [0x43bc0c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10