Function at 0x10050a6
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x100bb2c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x814]
push eax
push dword [0x100b348]
mov dword [ebp - 0x818], edi
push edi
mov dword [ebp - 0x814], esi
call sub.pdh.dll_PdhPlaGetInfoW
cmp eax, esi
mov dword [ebp - 0x808], eax
jne 0x1005761
push ebx
push dword [ebp - 0x814]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x810], ebx
je 0x1005760
or dword [ebx], 0xffffffff
push ebx
lea eax, [ebp - 0x814]
push eax
push dword [0x100b348]
push edi
call sub.pdh.dll_PdhPlaGetInfoW
cmp eax, esi
mov dword [ebp - 0x808], eax
jne 0x1005751
xor eax, eax
mov ax, word [0x100c340]
push 0x1001420
push eax
call fcn.010039cc
xor eax, eax
mov ax, word [0x100c340]
push edi
push 0x264
push eax
call fcn.010039e7
mov eax, dword [ebx + 0xc]
add esp, 0x14
sub eax, esi
je 0x100519e
dec eax
je 0x100518b
dec eax
je 0x1005178
mov word [ebp - 0x804], si
jmp 0x10051b6
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x25f
jmp 0x10051af
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x25e
jmp 0x10051af
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x25d
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x804]
push eax
xor eax, eax
mov ax, word [0x100c340]
push 0x265
push eax
call fcn.010039e7
mov eax, dword [ebx + 0x80]
add esp, 0xc
sub eax, esi
push 0x400
je 0x10051fa
dec eax
lea eax, [ebp - 0x804]
push eax
je 0x10051f3
push 0x262
jmp 0x1005206
push 0x261
jmp 0x1005206
lea eax, [ebp - 0x804]
push eax
push 0x260
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x804]
push eax
xor eax, eax
mov ax, word [0x100c340]
push 0x263
push eax
call fcn.010039e7
add esp, 0xc
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x82c]
push eax
push dword [0x100b348]
push edi
call sub.pdh.dll_PdhPlaGetScheduleW
test eax, eax
jne 0x100546b
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x274
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
xor eax, eax
mov ax, word [0x100c340]
push 0x272
push eax
call fcn.010039e7
mov eax, dword [ebp - 0x82c]
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
pop ecx
pop ecx
je 0x10052ef
dec eax
dec eax
je 0x1005298
dec eax
dec eax
jne 0x1005306
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x84c]
mov ecx, eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x80c]
push eax
sar ecx, 0x1f
call edi
lea eax, [ebp - 0x828]
push eax
call fcn.01004f1d
cmp dword [ebp - 0x82c], 4
jne 0x1005306
xor eax, eax
mov ax, word [0x100c340]
push 0x276
push eax
call fcn.010039e7
jmp 0x1005304
lea eax, [ebp - 0x804]
push eax
xor eax, eax
mov ax, word [0x100c340]
push eax
call fcn.010039cc
pop ecx
pop ecx
xor eax, eax
mov ax, word [0x100c340]
push 0x1001420
push eax
call fcn.010039cc
xor eax, eax
mov ax, word [0x100c340]
push 0x273
push eax
call fcn.010039e7
mov eax, dword [ebp - 0x830]
add esp, 0x10
sub eax, esi
je 0x100543f
dec eax
dec eax
je 0x1005404
dec eax
jne 0x1005456
xor eax, eax
lea edi, [ebp - 0x828]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x80c]
push eax
add ebx, 0x50
push ebx
call sub.pdh.dll_PlaTimeInfoToMilliSeconds
push esi
push 0x3e8
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
call fcn.01009fd0
push esi
mov edi, 0xe10
push edi
push edx
push eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], edx
call fcn.01009ee0
push esi
push 0x3c
push ebx
push ecx
mov dword [ebp - 0x834], edx
mov word [ebp - 0x820], ax
call fcn.01009fd0
push esi
push 0x3c
push dword [ebp - 0x808]
mov word [ebp - 0x81e], ax
push dword [ebp - 0x80c]
call fcn.01009e20
push esi
push edi
push edx
push eax
call fcn.01009e20
mov word [ebp - 0x81c], ax
xor eax, eax
mov ax, word [0x100c340]
push 0x275
push eax
call fcn.010039e7
pop ecx
pop ecx
lea eax, [ebp - 0x828]
push eax
call fcn.01004f1d
mov ebx, dword [ebp - 0x810]
jmp 0x1005456
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x844]
mov ecx, eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x80c]
push eax
sar ecx, 0x1f
call edi
lea eax, [ebp - 0x828]
push eax
call fcn.01004f1d
jmp 0x1005456
lea eax, [ebp - 0x804]
push eax
xor eax, eax
mov ax, word [0x100c340]
push eax
call fcn.010039cc
pop ecx
pop ecx
xor eax, eax
mov ax, word [0x100c340]
push 0x1001420
push eax
call fcn.010039cc
pop ecx
pop ecx
test byte [ebx + 1], 0x10
je 0x1005593
mov eax, dword [ebx + 0x64]
cmp eax, 1
jne 0x10054ab
xor eax, eax
mov ax, word [0x100c340]
push 0x278
push eax
call fcn.010039e7
xor eax, eax
mov ax, word [0x100c340]
push 0x277
push eax
call fcn.010039e7
add esp, 0x10
jmp 0x1005593
cmp eax, 3
jne 0x1005593
xor eax, eax
lea edi, [ebp - 0x828]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x80c]
push eax
add ebx, 0x60
push ebx
call sub.pdh.dll_PlaTimeInfoToMilliSeconds
push esi
push 0x3e8
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
call fcn.01009fd0
push esi
mov edi, 0xe10
push edi
push edx
push eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], edx
call fcn.01009ee0
push esi
push 0x3c
push ebx
push ecx
mov dword [ebp - 0x834], edx
mov word [ebp - 0x820], ax
call fcn.01009fd0
push esi
push 0x3c
push dword [ebp - 0x808]
mov word [ebp - 0x81e], ax
push dword [ebp - 0x80c]
call fcn.01009e20
push esi
push edi
push edx
push eax
call fcn.01009e20
mov word [ebp - 0x81c], ax
xor eax, eax
mov ax, word [0x100c340]
push 0x278
push eax
call fcn.010039e7
xor eax, eax
mov ax, word [0x100c340]
push 0x275
push eax
call fcn.010039e7
add esp, 0x10
lea eax, [ebp - 0x828]
push eax
call fcn.01004f1d
xor eax, eax
mov ax, word [0x100c340]
push 0x1001420
push eax
call fcn.010039cc
mov ebx, dword [ebp - 0x810]
pop ecx
pop ecx
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x814]
push eax
push esi
push ebx
push dword [0x100b348]
mov edi, 0x400
push dword [ebp - 0x818]
mov dword [ebp - 0x814], edi
call sub.pdh.dll_PdhPlaGetLogFileNameW
cmp eax, esi
mov dword [ebp - 0x808], eax
je 0x10055e3
push edi
lea eax, [ebp - 0x804]
push eax
push 0x271
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp - 0x808], esi
lea eax, [ebp - 0x804]
push eax
xor eax, eax
mov ax, word [0x100c340]
push 0x266
push eax
call fcn.010039e7
mov eax, dword [ebx + 4]
add esp, 0xc
cmp eax, esi
jne 0x100560c
mov eax, 0x100123c
push eax
xor eax, eax
mov ax, word [0x100c340]
push 0x267
push eax
call fcn.010039e7
mov eax, dword [ebx + 0xc]
add esp, 0xc
sub eax, esi
je 0x10056e9
dec eax
jne 0x1005751
push dword [ebx + 0xa0]
xor eax, eax
mov ax, word [0x100c340]
push 0x26f
push eax
call fcn.010039e7
push dword [ebx + 0xb4]
xor eax, eax
mov ax, word [0x100c340]
push 0x270
push eax
call fcn.010039e7
xor eax, eax
mov ax, word [0x100c340]
push 0x27a
push eax
call fcn.010039e7
mov edi, dword [ebx + 0x94]
add esp, 0x20
cmp edi, esi
jne 0x10056e2
push 0x80
lea eax, [ebp - 0x804]
push eax
push 0x1001248
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x804]
push eax
xor eax, eax
mov ax, word [0x100c340]
push 0x279
push eax
call fcn.010039e7
add esp, 0xc
jmp 0x1005751
xor eax, eax
mov ax, word [0x100c340]
push edi
push 0x279
push eax
call fcn.010039e7
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x10056c0
jmp 0x1005751
xor eax, eax
mov ax, word [0x100c340]
push 0x26e
push eax
call fcn.010039e7
mov edi, dword [ebx + 0x94]
cmp edi, esi
pop ecx
pop ecx
je 0x1005751
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and ax, 0x3ff
cmp ax, 9
je 0x10057ac
push 0x208
push esi
mov dword [ebp - 0x818], 0x104
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
mov dword [ebp - 0x810], eax
jne 0x1005830
mov dword [ebp - 0x808], 0xc0000bbb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
xor eax, eax
mov ax, word [0x100c340]
push 0x1001420
push eax
call fcn.010039cc
mov eax, dword [ebp - 0x808]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01009ab2
leave
ret 4
xor eax, eax
mov ax, word [0x100c340]
push edi
push 0x100164c
push eax
call fcn.010039cc
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x100578a
jmp 0x1005751
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 0x810]
push edi
call sub.pdh.dll_PdhTranslateLocaleCounterW
cmp eax, 0x800007d2
mov dword [ebp - 0x808], eax
jne 0x10057fc
mov eax, dword [ebp - 0x818]
add eax, eax
push eax
push dword [ebp - 0x810]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp eax, esi
je 0x100583e
mov dword [ebp - 0x810], eax
jmp 0x1005830
cmp eax, esi
jne 0x1005808
push dword [ebp - 0x810]
jmp 0x100580f
mov dword [ebp - 0x808], esi
push edi
xor eax, eax
mov ax, word [0x100c340]
push 0x100164c
push eax
call fcn.010039cc
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x10057b3
jmp 0x1005751
cmp dword [ebp - 0x810], esi
mov dword [ebp - 0x808], 0xc0000bbb
je 0x1005751
push dword [ebp - 0x810]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1005751