Function at 0x140005040
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x360
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rsp + 0x350], rax
lea rdx, str._Ben__Enter_serviceMessageFunc__
xor ecx, ecx
call fcn.1400013f0
lea rcx, str.Wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edi, edi
mov ebx, edi
test rax, rax
je 0x1400050a0
lea rdx, str.WTSSendMessageW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor ecx, ecx
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x32
lea r8, [rsp + 0x58]
mov rcx, rax
lea edx, [r9 + 0x33]
call qword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x15e
lea r8, [rsp + 0x90]
mov rcx, rax
mov edx, 0x66
call qword [sym.imp.USER32.dll_LoadStringW]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r8d, ax
lea rdx, str.__System_Language_is__d___
xor ecx, ecx
call fcn.1400013f0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebp, 0x401
lea esi, [rbp + 0xc]
cmp ax, bp
je 0x14000514f
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, si
je 0x14000514f
test rbx, rbx
je 0x1400051ac
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x48], 1
mov edx, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0x31
jmp 0x140005188
lea rdx, str.__System_Language_is_Arabic_or_Hebrew___
xor ecx, ecx
call fcn.1400013f0
test rbx, rbx
je 0x1400051ac
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x48], 1
mov edx, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0x180031
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 0x15e
mov r9d, 0x32
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
xor ecx, ecx
call rbx
cmp dword [rsp + 0x50], 1
jne 0x140005284
mov dword [rsp + 0x28], 1
lea r8, str.ms_settings:signinoptions
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x15e
lea r8, [rsp + 0x1f0]
mov rcx, rax
mov edx, 0x67
call qword [sym.imp.USER32.dll_LoadStringW]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, bp
je 0x14000523a
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, si
je 0x14000523a
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x48], 1
mov edx, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0x30
jmp 0x140005260
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x48], 1
mov edx, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0x180030
lea rax, [rsp + 0x1f0]
mov dword [rsp + 0x28], 0x15e
mov r9d, 0x32
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.140007310
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret