Function at 0x404e90
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x10058
call fcn.00412710
mov eax, dword [0x422760]
xor eax, esp
mov dword [esp + 0x10054], eax
push esi
mov esi, dword [esp + 0x10060]
push 0x7fff
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x44
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00412740
add esp, 0xc
xor eax, eax
lea edx, [esp + 4]
push edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 0
push esi
push 0x404
push 0
push 0
push 0
lea ecx, [esp + 0x78]
push ecx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x404f3a
mov edx, dword [esp]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov ecx, dword [esp + 0x10054]
xor ecx, esp
call fcn.004126f3
add esp, 0x10058
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x57
sete cl
lea ecx, [ecx + ecx - 1]
mov eax, ecx
mov ecx, dword [esp + 0x10054]
xor ecx, esp
call fcn.004126f3
add esp, 0x10058
ret

Function at 0x404fa0
Capabilities:
Get thread local storage value
Identify system language via api
Set thread local storage value

Disassembly:
mov eax, dword [0x4233c0]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x404fdb
push 0xffff
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x404fcd
mov eax, str._out_of_memory_for_error_message_
pop esi
ret
mov ecx, dword [0x4233c0]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push 0
push 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx edx, ax
push edx
push edi
push 0
push 0x1200
call ebx
test eax, eax
jne 0x40503c
push eax
push 0xffff
push esi
push eax
push edi
push eax
push 0x1200
call ebx
test eax, eax
jne 0x40503c
push edi
push str.system_error__lu
push 0xffffffffffffffff
push 0xffff
push esi
call fcn.004126d2
add esp, 0x14
test eax, eax
jge 0x40503c
pop edi
pop ebx
xor eax, eax
pop esi
ret
pop edi
pop ebx
mov eax, esi
pop esi
ret

Function at 0x405050
Capabilities:
Identify system language via api

Disassembly:
push ecx
push esi
push edi
push 0
push 0xffff
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx ecx, ax
push ecx
push esi
push 0
push 0xb00
call edi
test eax, eax
jne 0x4050ce
push eax
push 0xffff
lea edx, [esp + 0x10]
push edx
push eax
push esi
push eax
push 0xb00
call edi
test eax, eax
jne 0x4050ce
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push str.system_error__lu
push 0xffffffffffffffff
push 0xffff
push eax
mov dword [esp + 0x1c], eax
call fcn.004126d2
add esp, 0x14
test eax, eax
jge 0x4050ce
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret