Function at 0x100b663
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4cc
mov eax, dword [0x10110ec]
and word [ebp - 0x30], 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp + 0x14]
push 7
pop ecx
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c4], eax
xor eax, eax
lea edi, [ebp - 0x2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x1002048
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 6
pop ecx
push 0xa
mov esi, 0x1002030
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 5
mov esi, 0x1002008
lea edi, [ebp - 0xac]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x1001ff0
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x1001fe4
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x4c0], 0
movsw word es:[edi], word [esi]
mov esi, 0x1001fd4
lea edi, [ebp - 0x6c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x104
push esi
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor edi, edi
cmp eax, edi
je 0x100b8d2
cmp eax, esi
ja 0x100b8d2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp dword [ebp + 8], edi
movzx esi, ax
je 0x100b7a8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2b4]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x14
test eax, eax
jge 0x100b777
cmp dword [0x1011724], edi
je 0x100b8f5
push 0x1001fa4
jmp 0x100b834
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x30]
push 0xf
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x10
test eax, eax
jge 0x100b848
cmp dword [0x1011724], edi
je 0x100b8f5
push 0x1001f80
jmp 0x100b834
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.01009386
cmp esi, 0x409
pop ecx
pop ecx
mov edi, 0x103
je 0x100b7ff
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x2b4]
push edi
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
test eax, eax
jle 0x100b7ff
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
movzx eax, al
test eax, eax
jne 0x100b848
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2b4]
push edi
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x14
test eax, eax
jge 0x100b848
cmp dword [0x1011724], 0
je 0x100b8f5
push 0x1001f50
push 0x1001f3c
push 1
call fcn.0100d7ab
add esp, 0xc
jmp 0x100b8f5
lea eax, [ebp - 0x2b4]
push eax
call fcn.010093aa
mov edi, dword [ebp - 0x4c8]
mov esi, eax
inc esi
test ebx, ebx
pop ecx
je 0x100b881
test edi, edi
je 0x100b887
cmp dword [edi], esi
jb 0x100b881
push esi
lea eax, [ebp - 0x2b4]
push eax
push ebx
call sub.ntdll.dll_wcsncpy
add esp, 0xc
and word [ebx + esi*2 - 2], 0
test edi, edi
je 0x100b887
mov dword [edi], esi
lea eax, [ebp - 0x30]
push eax
call fcn.010093aa
mov ebx, dword [ebp - 0x4cc]
mov edi, dword [ebp - 0x4c4]
mov esi, eax
inc esi
test ebx, ebx
pop ecx
je 0x100b8c0
test edi, edi
je 0x100b8c6
cmp dword [edi], esi
jb 0x100b8c0
push esi
lea eax, [ebp - 0x30]
push eax
push ebx
call sub.ntdll.dll_wcsncpy
add esp, 0xc
and word [ebx + esi*2 - 2], 0
test edi, edi
je 0x100b8c6
mov dword [edi], esi
mov dword [ebp - 0x4c0], 1
jmp 0x100b8f5
cmp dword [0x1011724], edi
je 0x100b8f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f0c
push 0x1001f3c
push 1
call fcn.0100d7ab
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c0]
pop edi
pop esi
pop ebx
call fcn.010060f9
leave
ret 0x14