Function at 0x40eb89
Capabilities:
Check mutex on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x514
push ebx
push esi
push edi
push str.LocalE3893ABF_53E0_4228_9A27_1C69FB1D67C2
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x40ebbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ebbf
xor eax, eax
jmp 0x40eeca
push str.AKLMW
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x40ebb8
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], 0x465e34
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call fcn.0041c4dd
call fcn.0041d659
mov dword [0x46e97c], eax
push 0x104
lea eax, [esp + 0x31c]
push eax
push dword [0x46dca0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [esp + 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x46e978
call fcn.0041cf47
lea eax, [esp + 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x318]
push eax
push 0x46e974
call fcn.0041cf47
cmp dword [0x46e97c], ebx
je 0x40ece6
push ebx
push 1
push 0x4661a8
lea edi, [esp + 0x84]
mov dword [esp + 0x24], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x2c], 2
mov dword [esp + 0x20], 0x46641c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.0041c0c6
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.0041beac
push ebx
lea esi, [esp + 0x18]
call fcn.0041bddc
push eax
push ebx
push ebx
push reloc.WS2_32.dll_connect
push 1
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov ecx, edi
call fcn.0041c090
mov edi, esi
call fcn.0041c1d0
mov esi, 0x46e838
call fcn.0041de8e
call fcn.004256fa
push esi
call fcn.0041e762
cmp word [0x46e908], bx
jne 0x40ed3d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and ax, 0x3ff
movzx eax, ax
movzx eax, ax
cmp eax, 7
je 0x40ed34
xor ecx, ecx
cmp eax, 0x19
sete cl
dec ecx
and ecx, 0x3f0
add ecx, 0x19
mov word [0x46e908], cx
jmp 0x40ed3d
mov word [0x46e908], 0x407
movzx eax, word [0x46e908]
push dword [0x46e8e8]
mov dword [0x46e980], eax
call fcn.0041ee43
mov eax, dword [0x46e968]
cmp dword [eax - 0xc], ebx
jne 0x40ee11
call fcn.0040eb4e
cmp al, 7
mov byte [esp + 0x13], al
jae 0x40ee11
mov edi, 0x46609c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x3c], al
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ebx, [esp + 0x18]
call fcn.00410787
xor ebx, ebx
cmp byte [esp + 0x13], bl
jne 0x40edfe
push ebx
call fcn.0041ee43
cmp dword [esp + 0x28], ebx
mov dword [esp + 0x14], edi
je 0x40edc9
push dword [esp + 0x28]
call fcn.00436f7b
cmp dword [esp + 0x50], ebx
je 0x40eddd
push dword [esp + 0x50]
call fcn.004280b8
pop ecx
mov dword [esp + 0x50], ebx
cmp dword [esp + 0x44], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
je 0x40ebb8
push dword [esp + 0x44]
call fcn.004280b8
pop ecx
jmp 0x40ebb8
cmp dword [esp + 0x28], ebx
mov dword [esp + 0x14], edi
je 0x40ee11
push dword [esp + 0x28]
call fcn.00436f7b
lea ebx, [esp + 0xd8]
call fcn.0040c53e
push ecx
mov eax, esp
xor ebx, ebx
mov dword [eax], ebx
push ecx
mov eax, esp
mov dword [eax], ebx
lea eax, [esp + 0xe0]
call fcn.0041071b
cmp eax, ebx
jne 0x40ee65
mov eax, dword [esp + 0x310]
add eax, 0xfffffff0
call fcn.0041ad22
lea edi, [esp + 0x228]
call fcn.0041c593
lea ecx, [esp + 0xd8]
call fcn.0041076d
jmp 0x40edc9
lea esi, [esp + 0x40]
call fcn.0041bd4e
mov esi, eax
call fcn.0041bc44
mov eax, dword [esp + 0x310]
add eax, 0xfffffff0
call fcn.0041ad22
lea edi, [esp + 0x228]
call fcn.0041c593
lea ecx, [esp + 0xd8]
call fcn.0041076d
cmp dword [esp + 0x50], ebx
je 0x40eeb0
push dword [esp + 0x50]
call fcn.004280b8
pop ecx
mov dword [esp + 0x50], ebx
cmp dword [esp + 0x44], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
je 0x40eec8
push dword [esp + 0x44]
call fcn.004280b8
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret