Function at 0x1003f38b
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
mov eax, 0x1007d1fb
call fcn.1007b98c
sub esp, 0x90
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
je 0x1003f57c
movdqa xmm0, xmmword [0x100082b0]
lea eax, [ebp - 0x8c]
push 3
pop edi
mov dword [ebp + 8], 0xffff
lea ecx, [ebp - 0x44]
push dword [ebp + 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x1c], ebx
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], ebx
push ebx
movdqu xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call fcn.1000c726
push 1
mov dword [ebp - 0x28], 0xe0fa
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1003f412
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003f405
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp dword [ebp + 8], ebx
jne 0x1003f425
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, 0xf5fa3187
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 8]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0xfffffff9
jne 0x1003f445
mov ecx, esi
cmp dword [ebp + 8], ebx
jne 0x1003f447
mov ecx, ebx
mov eax, dword [ebp + 8]
sub eax, ecx
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
cmp ecx, eax
mov eax, dword [ebp + 8]
setle dl
sub edx, 0x2a67f8b4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x44]
inc dword [ebp - 0x8c]
call fcn.1000c27b
mov dword [ebp + 8], 0xfffffff8
cmp dword [ebp + 8], ebx
mov byte [ebp + 0xb], bl
je 0x1003f4aa
cmp byte [ebp + 0xb], bl
je 0x1003f4c2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1003f4c2
cmp byte [ebp + 0xb], bl
je 0x1003f4c2
push ebx
push 0x260a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 0x18], 0x831713b9
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffffe
jne 0x1003f560
push 2
pop edi
mov dword [ebp - 0x14], 0xfffffff7
lea ecx, [ebp - 0x68]
push edi
call fcn.1000c1f9
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jmp 0x1003f4fd
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], esi
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1003f4f1
mov dword [ebp - 0x14], 0xffffffec
jmp 0x1003f541
push 3
lea ecx, [ebp - 0x50]
call fcn.1000c1f9
mov dword [ebp + 8], ebx
jmp 0x1003f52a
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x1003f51a
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x50]
dec dword [eax + 4]
call fcn.1000c27b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jne 0x1003f50b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.1000c27b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
je 0x1003f4d9
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
imul ecx, dword [edx], 0xa
movsx eax, byte [eax]
add eax, 0xffffffd0
add eax, ecx
mov dword [edx], eax
jmp 0x1003f822
push 2
pop edi
push edi
lea ecx, [ebp - 0x5c]
call fcn.1000c1f9
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 8], ebx
jmp 0x1003f59e
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1003f592
xor esi, esi
inc esi
mov dword [ebp + 8], esi
cmp dword [ebp + 8], ebx
jl 0x1003f5be
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x5c]
cmp dword [eax + ecx*4], ebx
jne 0x1003f5be
dec dword [ebp + 8]
jns 0x1003f5ae
lea ecx, [ebp - 0x5c]
call fcn.1000c27b
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 8], 4
or eax, 0xffffffff
mov dword [ebp + 8], eax
mov dword [ebp - 0x24], 0xddd1d8f8
mov dword [ebp + 8], 0x5165352f
mov dword [ebp + 8], 0x516a205b
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], 0x9c3d069f
mov dword [ebp + 8], eax
mov dword [ebp - 0x30], eax
mov dword [ebp + 8], 0x6c21
mov dword [ebp - 0x2c], eax
push edi
call fcn.1000c1f9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], 0x1dc6
mov dword [ebp + 8], ebx
jmp 0x1003f63a
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], esi
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1003f62e
mov dword [ebp - 0x18], 0x19
jmp 0x1003f674
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1003f662
push 0x16f8
push ebx
push ebx
push 0x1f09
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1003f671
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jl 0x1003f648
mov eax, dword [ebp - 0x20]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x14]
cmp dword [ebp + 8], eax
jne 0x1003f69c
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], eax
mov eax, esi
jne 0x1003f69e
mov eax, ebx
cmp eax, dword [ebp - 0x38]
jle 0x1003f6a6
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub eax, 0x281c3dc7
cmp eax, 0xd5eb
je 0x1003f6dc
mov dword [ebp + 8], 0xfffffff7
mov dword [ebp - 0x14], 0x15
jmp 0x1003f6d4
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
je 0x1003f6cb
jmp 0x1003f6fa
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1003f6fa
push 0x829
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x74]
call fcn.1000c27b
mov dword [ebp + 8], 0x7e2799ac
lea ecx, [ebp - 0x80]
mov dword [ebp + 8], 0xf59172dd
mov dword [ebp + 8], 0xbbb66efe
mov dword [ebp + 8], 0xe7374489
mov dword [ebp + 8], 0x11b55e97
push esi
call fcn.1000c1f9
mov dword [ebp - 0x18], 0x57cf
mov dword [ebp + 8], ebx
jmp 0x1003f74a
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0x8214d2fc
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1003f73a
mov dword [ebp + 8], 0x1a
jmp 0x1003f809
mov dword [ebp - 0x1c], 0xb5c6f8b8
xor edx, edx
mov dword [ebp - 0x20], 0xb0bb8bff
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xeab3ae5d
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
cmp eax, ecx
setg dl
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
je 0x1003f7b8
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
add eax, edi
jne 0x1003f7b4
cmp dword [ebp + 8], ebx
je 0x1003f7b8
mov ecx, esi
jmp 0x1003f7ba
mov ecx, ebx
xor eax, eax
cmp ecx, 0xffff
push 0xfffffffffffffffc
sete al
xor ecx, ecx
cmp eax, 0xb44a
mov eax, dword [ebp + 8]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 8]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xe283
setne cl
xor eax, eax
cmp ecx, 0xcf45
setge al
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x18]
dec dword [ebp + 8]
cmp dword [ebp + 8], 7
je 0x1003f75b
lea ecx, [ebp - 0x80]
call fcn.1000c27b
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret