Function at 0x401000
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [esp], 0xaa937b77
mov esi, dword [esp + 0x1c]
movzx edi, word [esp + 0xa]
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov eax, dword [esp]
cmp eax, 0x12caeac4
jg 0x401078
cmp eax, 0xeb227f64
jle 0x4010d3
cmp eax, 0x845a73
jle 0x401169
cmp eax, 0x845a74
je 0x4013f9
cmp eax, 0x6f0d1ed
je 0x40123f
cmp eax, 0xa3fe076
jne 0x401021
shl esi, 4
lea esi, [esi + esi*2]
and esi, 0xffffc000
call section..text
mov dword [esp], 0x6f0d1ed
jmp 0x401021
cmp eax, 0x3bc3b378
jg 0x401121
cmp eax, 0x1ceb96f0
jle 0x4011d9
cmp eax, 0x1ceb96f1
je 0x401264
cmp eax, 0x241b1475
je 0x401288
cmp eax, 0x3a09e3b4
jne 0x401021
shl esi, 0x1b
add esi, 0x36000000
mov eax, 0x241b1475
cmp esi, 0x9c
jl 0x4013a6
mov eax, 0xa3fe076
jmp 0x4013a6
cmp eax, 0xc3501d21
jg 0x4011a0
cmp eax, 0x895cf966
je 0x4012ad
cmp eax, 0xa076448d
je 0x4012ea
cmp eax, 0xaa937b77
jne 0x401021
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esp + 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esp + 0x12], ax
mov dword [esp], 0xa076448d
jmp 0x401021
cmp eax, 0x64ee4231
jle 0x401212
cmp eax, 0x64ee4232
je 0x401304
cmp eax, 0x724743a3
je 0x40131e
cmp eax, 0x7e43d795
jne 0x401021
mov ecx, dword [esp + 0xc]
mov eax, 0xeb227f65
cmp ecx, 4
je 0x4013a6
mov eax, 0xc3501d22
jmp 0x4013a6
cmp eax, 0xeee9bf99
je 0x401355
cmp eax, 0xf6c5cd5b
jne 0x40140e
imul eax, dword [esp + 4], 0x4c
add eax, 0x32
mov dword [esp + 4], eax
mov dword [esp], 0x724743a3
mov ebp, dword [esp + 0xc]
movzx edi, word [esp + 0x16]
jmp 0x401021
cmp eax, 0xc3501d22
je 0x401376
cmp eax, 0xd85c26d6
jne 0x40141b
movzx eax, word [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [esp + 0x2e], ax
mov dword [esp], 0x895cf966
jmp 0x401021
cmp eax, 0x12caeac5
je 0x401382
cmp eax, 0x13d0c0b8
jne 0x401021
mov eax, dword [esp + 4]
shr eax, 0xf
and eax, 0x3f
imul eax, eax, 0xa3
add eax, 0xffffffa7
mov dword [esp + 4], eax
mov dword [esp], 0x7e43d795
jmp 0x401021
cmp eax, 0x3bc3b379
je 0x4013ae
cmp eax, 0x4da77fde
jne 0x401021
imul esi, esi, 0x5f
add esi, 0x3e
call section..text
mov dword [esp], 0x241b1475
jmp 0x401021
imul esi, esi, 0x1b380
add esi, 0x27d4f
call section..text
call section..text
mov eax, 0x241b1475
cmp esi, 0x60
jb 0x40127e
jmp 0x4013a6
imul esi, esi, 0x4830
add esi, 0xb667
mov eax, 0x241b1475
cmp esi, 0x6d
jl 0x4013a6
mov eax, 0xaa937b77
jmp 0x4013a6
movzx eax, word [esp + 0x12]
mov word [esp + 0x2a], ax
call ebx
mov word [esp + 0x14], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], eax
mov dword [esp], 0xeee9bf99
jmp 0x401021
mov eax, dword [esp + 4]
imul ecx, eax, 0x55
imul ecx, ecx
imul edx, ecx, 0x40d5
imul eax, eax, 0x2a800
dec edx
add eax, 0x45e64
mov dword [esp + 4], eax
mov eax, 0xd85c26d6
cmp ecx, edx
je 0x4012db
mov eax, 0x724743a3
mov dword [esp], eax
xor ebp, ebp
movzx edi, word [esp + 0x10]
jmp 0x401021
mov eax, dword [esp + 4]
and eax, 0xffffff80
shl eax, 3
mov dword [esp + 4], eax
mov dword [esp], 0x241b1475
jmp 0x401021
mov eax, dword [esp + 0xc]
movzx eax, word [esp + eax*2 + 0x28]
mov word [esp + 0x16], ax
mov dword [esp], 0xf6c5cd5b
jmp 0x401021
mov dword [esp + 0x24], ebp
movsx eax, di
cmp eax, 0x43e
jle 0x4013c6
cmp eax, 0x818
jg 0x4013e1
lea eax, [edi - 0x43f]
cmp ax, 4
ja 0x4013f9
mov ecx, 0x13
jmp 0x4013da
mov eax, dword [esp + 4]
shl eax, 0xb
and eax, 0x3ff800
add eax, 0xfffffe7c
mov dword [esp + 4], eax
mov dword [esp], 0xd85c26d6
jmp 0x401021
mov dword [esp], 0x64ee4232
jmp 0x401021
shr esi, 8
and esi, 0xffffffc0
call section..text
call section..text
mov eax, 0xaa937b77
test esi, esi
je 0x4013a0
mov eax, 0x845a74
add esi, 0x84
mov dword [esp], eax
jmp 0x401021
imul esi, esi, 0x8976
add esi, 0xffe971d5
mov dword [esp], 0xaa937b77
jmp 0x401021
lea eax, [edi - 0x419]
cmp ax, 0x13
ja 0x4013f9
movzx eax, ax
mov ecx, 0xc8401
bt ecx, eax
jae 0x4013f9
jmp 0x401426
movzx eax, di
cmp eax, 0x819
je 0x401426
cmp eax, 0x82c
je 0x401426
cmp eax, 0x843
je 0x401426
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0xc], eax
mov dword [esp], 0x13d0c0b8
jmp 0x401021
cmp eax, 0xeb227f65
jne 0x401021
jmp 0x40143b
cmp eax, 0xdd27e91b
jne 0x401021
mov dword [esp + 0x1c], esi
mov word [esp + 0xa], di
mov dword [esp + 0x18], ebp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x1c], esi
mov word [esp + 0xa], di
mov dword [esp + 0x18], ebp
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret