Function at 0x41b8aa
Capabilities:
Identify system language via api
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434590
push 0x42f320
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push dword [0x43abf4]
push dword [0x43abf0]
call fcn.00411706
pop ecx
pop ecx
mov byte [0x43abc8], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [0x43abda], ax
push 0xe991ffff
movsx eax, word [0x43abe2]
push eax
call fcn.00411864
pop ecx
pop ecx
add word [0x43abd6], ax
mov edi, dword [ebp + 8]
test edi, edi
je 0x41baee
add dword [0x43ac0c], 0x3ffff
push 0xbe17ffff
push 0x505ffff
call fcn.004117b3
mov word [0x43abd2], ax
and dword [ebp - 0x20], 0
inc byte [0x43abcb]
push 0x2183ffff
push 0xaf21ffff
call fcn.004118af
add esp, 0x10
mov byte [0x43abcd], al
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x41baee
movsx eax, word [0x43abde]
movsx ecx, byte [0x43abc9]
or eax, ecx
add dword [0x43abf0], eax
movsx eax, byte [0x43abcb]
push eax
movsx eax, word [0x43abe0]
push eax
call fcn.00411906
pop ecx
pop ecx
add byte [0x43abd0], al
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x41baee
add dword [0x43abfc], 0x72f40001
mov word [0x43abd8], 1
push 0x4e
call fcn.00415e1f
pop ecx
call eax
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x41b9ee
push edi
call fcn.0041cc28
pop ecx
mov edi, eax
mov dword [ebp - 0x1c], edi
mov eax, dword [0x43ac00]
add byte [0x43abc8], al
push eax
push 0xb9a3ffff
call fcn.00411775
pop ecx
pop ecx
add dword [0x43ac0c], eax
push 0x40
push edi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
call esi
test eax, eax
jne 0x41baee
movsx eax, word [0x43abd2]
push eax
push 0xfb8fffff
call fcn.004116b5
add dword [0x43ac00], eax
push 0x27fdffff
push dword [0x43ac04]
call fcn.004117ef
add byte [0x43abd0], al
push 0x9aadffff
movsx eax, word [0x43abd4]
push eax
call fcn.00411864
add esp, 0x18
add byte [0x43abcf], al
cmp word [edi], 0x5a4d
jne 0x41baee
push dword [0x43ac08]
push dword [0x43abec]
call fcn.00411775
mov eax, dword [0x43abe8]
and eax, dword [0x43ac08]
mov dword [0x43abec], eax
mov word [0x43abde], 1
push dword [edi + 0x3c]
push edi
call fcn.0041b85e
add esp, 0x10
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov eax, dword [0x43abe8]
imul eax, eax, 0xc9d9ffff
add dword [0x43abfc], eax
push 0xf8
push ebx
call esi
test eax, eax
jne 0x41baee
movsx eax, word [0x43abe0]
push eax
movsx eax, byte [0x43abd1]
push eax
call fcn.004117b3
pop ecx
pop ecx
mov byte [0x43abcc], al
cmp dword [ebx], 0x4550
je 0x41baf5
xor eax, eax
jmp 0x41c4f7
movsx eax, word [0x43abe0]
push eax
movsx eax, word [0x43abdc]
push eax
call fcn.0041181a
mov dword [0x43ac08], eax
and eax, 0xf395ffff
add dword [0x43abec], eax
push dword [ebx + 0x80]
push edi
call fcn.0041b85e
mov esi, eax
mov dword [ebp - 0x2c], esi
push dword [0x43abe8]
push dword [0x43abf8]
call fcn.004117ef
add esp, 0x18
mov byte [0x43abcd], al
cmp esi, edi
je 0x41bf33
mov byte [0x43abcb], 1
sub dword [0x43abf8], 0x18c00001
cmp esi, ebx
je 0x41bf33
push 0x6177ffff
movsx eax, word [0x43abde]
push eax
call fcn.00411738
pop ecx
pop ecx
mov byte [0x43abcf], al
xor ebx, ebx
mov dword [ebp - 4], ebx
movsx eax, byte [0x43abca]
or eax, 0x8f17ffff
mov word [0x43abd2], ax
push 0x5117ffff
movsx eax, word [0x43abe0]
push eax
call fcn.004118af
pop ecx
pop ecx
mov word [0x43abe2], ax
cmp dword [esi + 0xc], ebx
je 0x41bcc2
mov dword [ebp - 4], 1
push dword [0x43ac0c]
push 0x26f7ffff
call fcn.00411864
mov dword [0x43abfc], eax
movsx eax, word [0x43abd2]
push eax
push 0xd6dfffff
call fcn.004116b5
add word [0x43abe0], ax
mov dword [0x43abe8], 0x9c420000
push dword [esi + 0xc]
push edi
call fcn.0041b85e
add esp, 0x18
mov dword [ebp - 0x38], eax
movsx ax, byte [0x43abca]
add word [0x43abe0], ax
lea eax, [ebp - 0x34]
push eax
push 4
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov dword [ebp - 0x3c], eax
push 0xdb2bffff
movsx eax, byte [0x43abcb]
push eax
call fcn.0041181a
add word [0x43abda], ax
push dword [ebp + 0xc]
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x10
test eax, eax
jne 0x41bd78
mov ax, word [0x43abe2]
inc ax
add word [0x43abd8], ax
push 0xc179ffff
movsx eax, word [0x43abd2]
push eax
call fcn.004118af
pop ecx
pop ecx
add byte [0x43abcd], al
movsx eax, byte [0x43abc8]
add eax, 0x20200001
mov dword [0x43ac04], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov eax, dword [0x43abf0]
sub eax, dword [0x43abec]
mov byte [0x43abcc], al
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xc], ebx
je 0x41bf33
push dword [esi + 0x10]
push edi
call fcn.0041b85e
mov esi, eax
push 0x770fffff
push 0x5137ffff
call fcn.004117ef
add esp, 0x10
add word [0x43abe2], ax
mov al, byte [0x43abe0]
neg al
mov byte [0x43abcb], al
mov ax, word [0x43abe4]
dec ax
add word [0x43abd8], ax
cmp dword [esi], ebx
je 0x41bf33
movsx ax, byte [0x43abca]
mov cx, word [0x43abdc]
sub cx, ax
mov word [0x43abd4], cx
mov eax, dword [esi]
cmp eax, dword [ebp - 0x28]
je 0x41bdec
add esi, 4
movsx eax, word [0x43abe4]
push eax
push dword [0x43abf0]
call fcn.004117b3
mov word [0x43abdc], ax
push 0xd261ffff
push 0xdf8bffff
call fcn.00411864
add esp, 0x10
add byte [0x43abcc], al
cmp dword [esi], 0
jne 0x41bd16
jmp 0x41bf33
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov dword [ebp - 4], ebx
jmp 0x41bdb3
mov al, byte [0x43abca]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov word [0x43abdc], ax
movsx eax, byte [0x43abcf]
push eax
push 0x25c7ffff
call fcn.004116b5
pop ecx
pop ecx
mov byte [0x43abd1], al
add esi, 0x14
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp - 0x1c]
jmp 0x41bbaf
inc byte [0x43abd1]
lea eax, [ebp - 0x40]
push eax
push 4
push 4
push esi
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov edi, eax
push 0xe3e3ffff
movsx eax, byte [0x43abd0]
push eax
call fcn.004116b5
pop ecx
pop ecx
mov byte [0x43abd1], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add word [0x43abdc], ax
xor ebx, ebx
cmp word [0x43abe0], bx
je 0x41be45
cmp byte [0x43abcc], bl
je 0x41be45
push 1
pop eax
jmp 0x41be47
xor eax, eax
add byte [0x43abcd], al
cmp edi, ebx
je 0x41bea4
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [0x43ac04]
mov ecx, dword [0x43abf0]
lea eax, [ecx + eax - 0x1dd80001]
mov dword [0x43abf0], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 4
push esi
push 0x5f
call fcn.00415e1f
pop ecx
call eax
movsx eax, byte [0x43abcb]
push eax
movsx eax, word [0x43abd8]
push eax
call fcn.00411775
pop ecx
pop ecx
add dword [0x43abf8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push 0x8c15ffff
movsx eax, word [0x43abda]
push eax
call fcn.00411906
pop ecx
pop ecx
mov dword [0x43abec], eax
cmp word [0x43abd6], bx
jne 0x41bed2
cmp dword [0x43ac0c], ebx
jne 0x41bed2
xor eax, eax
jmp 0x41bed5
push 1
pop eax
add word [0x43abe2], ax
mov ax, word [0x43abe0]
inc ax
mov word [0x43abde], ax
jmp 0x41bf33
mov al, byte [0x43abe8]
inc al
add byte [0x43abd1], al
push 0x86abffff
movsx eax, word [0x43abda]
push eax
call fcn.00411706
add word [0x43abe4], ax
movsx eax, byte [0x43abce]
push eax
movsx eax, word [0x43abe4]
push eax
call fcn.004118af
mov dword [0x43ac00], eax
movsx ax, byte [0x43abcc]
imul ax, word [0x43abd8]
mov word [0x43abde], ax
movsx eax, word [0x43abe2]
push eax
movsx eax, byte [0x43abc8]
push eax
call fcn.00411864
mov word [0x43abda], ax
mov esi, dword [ebp - 0x24]
push dword [esi + 0xe0]
push dword [ebp - 0x1c]
call fcn.0041b85e
mov edi, eax
mov dword [ebp - 0x48], edi
push 0x73d9ffff
push 0xa9a5ffff
call fcn.004117ef
add byte [0x43abcf], al
push 0xde8fffff
push 0x7ea7ffff
call fcn.00411906
add word [0x43abdc], ax
movsx eax, byte [0x43abcc]
push eax
push 0xd73fffff
call fcn.00411738
add esp, 0x38
add dword [0x43ac00], eax
cmp edi, dword [ebp - 0x1c]
je 0x41c4da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [0x43abcb], al
inc byte [0x43abcc]
push 0x1393ffff
movsx eax, byte [0x43abd1]
push eax
call fcn.00411738
pop ecx
pop ecx
add dword [0x43ac08], eax
cmp edi, esi
je 0x41c4da
movsx eax, byte [0x43abcf]
imul eax, eax, 0xa7b7ffff
mov dword [0x43abfc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add byte [0x43abce], al
push 2
pop esi
mov dword [ebp - 4], esi
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x41c178
push dword [0x43abf4]
push 0x1c03ffff
call fcn.00411738
add dword [0x43abec], eax
push 0x6c2fffff
movsx eax, byte [0x43abcf]
push eax
call fcn.004117b3
add esp, 0x10
add word [0x43abe0], ax
mov dword [ebp - 4], 3
push dword [edi + 4]
push dword [ebp - 0x1c]
call fcn.0041b85e
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
inc byte [0x43abcf]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x43abcb], al
movsx eax, word [0x43abd8]
push eax
push 0x8b0bffff
call fcn.00411738
pop ecx
pop ecx
add dword [0x43abf0], eax
lea eax, [ebp - 0x54]
push eax
push 4
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov dword [ebp - 0x5c], eax
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41c221
push 0x34c1ffff
movsx eax, word [0x43abd8]
push eax
call fcn.004117ef
pop ecx
pop ecx
add byte [0x43abd1], al
cmp byte [0x43abc8], bl
je 0x41c13e
cmp word [0x43abd2], bx
je 0x41c13e
push 1
pop eax
jmp 0x41c140
xor eax, eax
add word [0x43abe4], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.00415e1f
pop ecx
call eax
movsx ax, byte [0x43abca]
inc eax
add word [0x43abe0], ax
mov byte [0x43abd0], 1
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
movsx eax, byte [0x43abd1]
push eax
movsx eax, byte [0x43abcc]
push eax
call fcn.00411706
pop ecx
pop ecx
add byte [0x43abcf], al
cmp dword [edi + 4], ebx
je 0x41c4da
push dword [0x43abe8]
push 0x591fffff
call fcn.00411775
add dword [0x43ac04], eax
push dword [edi + 0x10]
push dword [ebp - 0x1c]
call fcn.0041b85e
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x4c], ebx
cmp dword [esi], ebx
je 0x41c488
push 0x30ebffff
push dword [0x43ac08]
call fcn.00411864
pop ecx
pop ecx
add byte [0x43abce], al
add dword [0x43abf0], 0x708e0000
test byte [esi + 3], 0x80
je 0x41c29e
push 0xe831ffff
push 0x1441ffff
call fcn.004118af
pop ecx
pop ecx
mov byte [0x43abcb], al
and byte [0x43abca], 0
jmp 0x41c32a
inc byte [0x43abc8]
movsx eax, byte [0x43abcf]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
add byte [0x43abcc], al
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov dword [ebp - 4], esi
jmp 0x41c293
add edi, 0x20
mov dword [ebp - 0x48], edi
jmp 0x41c060
push 0x1d6dffff
movsx eax, word [0x43abda]
push eax
call fcn.00411706
mov dword [0x43abec], eax
inc word [0x43abe4]
mov ebx, dword [esi]
movsx eax, byte [0x43abcf]
push eax
push 0x90bfffff
call fcn.00411738
add dword [0x43ac08], eax
movsx eax, byte [0x43abd0]
push eax
push 0xa5d7ffff
call fcn.0041181a
add byte [0x43abce], al
add ebx, 2
push ebx
push dword [ebp - 0x1c]
call fcn.0041b85e
mov ecx, dword [0x43abf8]
dec ecx
add word [0x43abe4], cx
xor ecx, ecx
cmp dword [0x43abf0], ecx
setne cl
mov dword [0x43abfc], ecx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x28
test eax, eax
je 0x41c357
movsx eax, word [0x43abe2]
mov ecx, dword [0x43abec]
lea eax, [ecx + eax - 0x799e0001]
mov dword [0x43abec], eax
add esi, 4
inc dword [ebp - 0x4c]
cmp dword [esi], 0
jne 0x41c1d3
jmp 0x41c488
mov eax, dword [0x43abf0]
dec eax
add word [0x43abe4], ax
movsx eax, word [0x43abe2]
movsx ecx, word [0x43abd6]
sub ecx, eax
add dword [0x43abf8], ecx
push dword [edi + 0xc]
push dword [ebp - 0x1c]
call fcn.0041b85e
mov esi, eax
push dword [0x43abf4]
push 0x2a87ffff
call fcn.004116b5
add esp, 0x10
mov word [0x43abd4], ax
mov eax, dword [ebp - 0x4c]
lea esi, [esi + eax*4]
lea eax, [ebp - 0x68]
push eax
push 4
push 4
push esi
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov cx, word [0x43abd6]
add word [0x43abd8], cx
mov byte [0x43abcb], 1
test eax, eax
je 0x41c488
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov byte [0x43abcc], 0xfe
push 1
pop edi
mov dword [0x43ac0c], edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x68]
push 4
push esi
push 0x5f
call fcn.00415e1f
pop ecx
call eax
mov al, byte [0x43abf8]
add al, byte [0x43ac00]
mov byte [0x43abcc], al
movsx eax, byte [0x43abd0]
push eax
movsx eax, word [0x43abd4]
push eax
call fcn.004118af
pop ecx
pop ecx
add word [0x43abd8], ax
cmp dword [ebp - 0x20], 0
jne 0x41c439
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [0x43ac04], 0
je 0x41c44f
cmp byte [0x43abcc], 0
je 0x41c44f
mov eax, edi
jmp 0x41c451
xor eax, eax
add byte [0x43abca], al
push 0xff29ffff
push 0x8833ffff
call fcn.0041181a
add dword [0x43abec], eax
movsx eax, word [0x43abe2]
push eax
push 0x335dffff
call fcn.004116b5
add esp, 0x10
add word [0x43abe2], ax
mov dword [0x43ac08], 0x43f3fffe
movsx eax, byte [0x43abcf]
push eax
push 0x1ffdffff
call fcn.0041181a
pop ecx
pop ecx
mov dword [0x43ac00], eax
jmp 0x41c4da
movsx eax, byte [0x43abcf]
push eax
push 0x48f5ffff
call fcn.00411864
pop ecx
pop ecx
add byte [0x43abcf], al
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10