Function at 0x4581d4
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
call fcn.00457cd4
call fcn.00457804
call fcn.00457ae8
call fcn.004032f8
call fcn.00459474
movzx eax, byte [0x7de53c]
test eax, eax
jle 0x45821e
cmp eax, 0x14
jge 0x45821e
push 0x7e894c
push 0x7e8364
call fcn.0040ced4
mov eax, 0xffffffff
add esp, 0x48
pop ebx
pop esi
pop edi
ret
call fcn.004592e4
movsx eax, al
test eax, eax
je 0x458236
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
push 0x7e898c
push dword [0x7de54c]
call fcn.0045ed90
add esp, 8
test eax, eax
jne 0x458329
mov eax, dword [0x56f660]
mov dword [esp + 8], eax
mov edx, dword [0x56f668]
mov dword [esp + 0x10], edx
mov ecx, dword [0x56f66c]
mov dword [esp + 0x14], ecx
mov ebx, dword [0x56f670]
mov dword [esp + 0x18], ebx
mov esi, dword [0x56f674]
mov dword [esp + 0x1c], esi
mov edi, dword [0x56f678]
mov dword [esp + 0x20], edi
mov eax, dword [0x56f67c]
mov dword [esp + 0x24], eax
mov eax, dword [0x56f680]
mov dword [esp + 0x28], eax
mov eax, dword [0x56f684]
mov dword [esp + 0x2c], eax
mov eax, dword [0x56f688]
mov dword [esp + 0x30], eax
mov eax, dword [0x56f68c]
mov dword [esp + 0x34], eax
mov eax, dword [0x56f690]
mov dword [esp + 0x38], eax
mov eax, dword [0x56f694]
mov dword [esp + 0x3c], eax
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov eax, dword [0x7de8a0]
test eax, eax
je 0x4582f2
mov eax, dword [eax + 0x2a4]
test eax, eax
je 0x4582f2
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 1
mov dword [esp + 8], 0x40
mov dword [esp + 0x14], 0x7e8978
mov dword [esp + 0x18], 0x7e898c
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
push 0x7e8994
push dword [0x7de54c]
call fcn.0045ed90
add esp, 8
test eax, eax
je 0x458791
call fcn.0045564c
test eax, eax
je 0x458359
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
movsx eax, byte [0x7de4d8]
test eax, eax
jne 0x458778
call fcn.00456b9c
test eax, eax
je 0x45837d
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.004587e0
call fcn.004566b8
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0045928c
movsx eax, al
test eax, eax
je 0x4583a5
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.00455164
test eax, eax
je 0x4583ba
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov edi, dword [0x7de8a0]
mov ebx, dword [edi + 0xc]
mov dword [0x7de5f4], ebx
mov ecx, dword [edi + 0x10]
mov dword [0x7de5f8], ecx
mov esi, ecx
movsx eax, byte [0x7de498]
test eax, eax
je 0x45840a
mov edx, dword [0x7de5dc]
mov dword [edi + 0xc], edx
mov ecx, dword [0x7de8a0]
mov eax, dword [0x7de5e0]
mov dword [ecx + 0x10], eax
mov ebx, dword [ecx + 0xc]
mov dword [0x7de5fc], ebx
mov dword [0x7de600], eax
mov esi, eax
mov ecx, eax
jmp 0x458421
mov dword [0x7de600], ecx
mov dword [0x7de5fc], ebx
mov edx, dword [0x7de5dc]
mov eax, dword [0x7de5e0]
cmp ebx, edx
jg 0x458429
cmp esi, eax
jle 0x45844d
mov ebx, edx
shr ebx, 0x1f
add edx, ebx
mov ebx, edx
sar ebx, 1
mov dword [0x7de604], ebx
mov edx, eax
shr edx, 0x1f
add eax, edx
mov esi, eax
sar esi, 1
mov dword [0x7de608], esi
jmp 0x458459
mov dword [0x7de608], ecx
mov dword [0x7de604], ebx
mov ecx, dword [0x7de404]
lea edx, [ebx + ebx]
add edx, edx
cmp ebx, 0x2000
jg 0x458751
test ecx, ecx
je 0x45873a
mov eax, edx
imul eax, esi
lea edx, [edx + eax + 4]
push edx
push ecx
call fcn.0045ef98
add esp, 8
mov edi, eax
test edi, edi
je 0x458711
mov dword [0x7de404], edi
push 0x65d420
mov ecx, dword [0x7de8a0]
call fcn.00457fc4
mov dword [0x7de644], 1
push 0x65d420
push 0x65d660
push dword [0x7de4cc]
push dword [0x7de4c8]
mov ecx, dword [0x7de8a0]
call fcn.0044fdf8
test eax, eax
jne 0x4584f5
push 0x7e899c
push 0x7e8364
call fcn.0040ced4
mov eax, 0xffffffff
add esp, 0x48
pop ebx
pop esi
pop edi
ret
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
movsx eax, byte [0x7de498]
test eax, eax
je 0x458522
mov eax, dword [0x7de8a0]
push 0
push dword [eax + 0x2a4]
call sub.IMM32.dll_ImmAssociateContext
call fcn.0045c37c
movsx eax, byte [0x7de498]
test eax, eax
je 0x458539
mov byte [0x7de4e4], 0
push 0
call fcn.0045b5f0
pop ecx
test eax, eax
jge 0x45854c
mov byte [0x7de4e4], 0
movsx eax, byte [0x7de4e4]
test eax, eax
jne 0x458561
mov eax, dword [0x7de5e4]
mov dword [0x7de5d4], eax
movsx eax, byte [0x7de4e8]
test eax, eax
jne 0x458705
call fcn.004580e4
call fcn.00458aa4
movsx eax, byte [0x7de4ec]
test eax, eax
jne 0x4586e3
push dword [0x7de4c8]
call fcn.0045c3b4
pop ecx
movsx eax, al
test eax, eax
je 0x4585a5
mov byte [0x7de4f8], 1
jmp 0x4585ac
mov byte [0x7de4f8], 0
mov dword [0x7de738], 0
push 0x7de5a4
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movsx eax, byte [0x7de360]
test eax, eax
je 0x4585dd
call fcn.004571bc
call fcn.0045bf68
movsx eax, al
test eax, eax
je 0x4585fa
call fcn.00412ea4
mov eax, 1
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.0045ad08
call fcn.0045bc78
test eax, eax
je 0x458614
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.0045adbc
movsx eax, byte [0x7de500]
call fcn.00450635
cmp eax, 1
je 0x4586a1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x7de5b4], eax
mov dword [0x7de5b8], eax
mov dword [0x7de5bc], eax
mov dword [0x7de5c0], eax
movsx eax, byte [0x7de360]
test eax, eax
je 0x458662
call fcn.00408a60
cmp eax, 1
je 0x45866b
cmp eax, 0xffffffff
je 0x4587b3
xor eax, eax
add esp, 0x40
pop ebx
pop esi
pop edi
ret
xor eax, eax
mov byte [0x7de394], al
mov byte [0x594730], 1
mov byte [0x7de360], al
push 0x7e81e4
push 0x7e48a0
call fcn.0043a4a0
push 0x7e81e4
push 0x7e48a0
call fcn.0040ced4
add esp, 0x10
jmp 0x458662
mov eax, dword [0x7de8a0]
push 5
push dword [eax + 0x2a4]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, eax
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, ebx
cmp eax, 0x5dc
jae 0x45862a
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, ebx
cmp eax, 0x5dc
jb 0x4586cf
jmp 0x45862a
call fcn.0045b6c8
cmp eax, 1
je 0x4586f9
mov byte [0x7de4ec], 0
jmp 0x458589
mov byte [0x7de4ec], 1
jmp 0x458589
mov byte [0x7de5f0], 0
jmp 0x458570
push esi
push ebx
push 0
push 0x7e8a78
push 0x7e48a0
call fcn.0043a4a0
push 0
push 1
push 0x1965e
call fcn.0045c618
add esp, 0x20
jmp 0x458495
mov eax, edx
imul eax, esi
lea edx, [edx + eax + 4]
push edx
call fcn.0045ec4c
pop ecx
mov edi, eax
jmp 0x45848d
push esi
push ebx
push 0x7e8a50
push 0x7e48a0
call fcn.0040ced4
push 1
push 0x186aa
call fcn.0045c674
add esp, 0x18
xor edi, edi
jmp 0x458495
mov esi, 0x65d8a0
mov edi, 0x65d780
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x458782
jmp 0x45837d
mov dword [0x594740], 0x7e517c
push 1
push 0x186a0
call fcn.0045c674
mov eax, 0xffffffff
add esp, 0x48
pop ebx
pop esi
pop edi
ret
xor edx, edx
mov byte [0x7de394], dl
mov ecx, 1
mov byte [0x594730], cl
mov byte [0x7de360], dl
mov byte [0x7de79c], cl
mov eax, 0xffffffff
add esp, 0x40
pop ebx
pop esi
pop edi
ret