Function at 0x41e2a0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7bcd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x130], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
jne 0x41e42a
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push str.en_US
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.004082b0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov eax, ecx
and eax, 0x3ff
dec eax
cmp eax, 0x29
ja case.0x41e32b.2
movzx eax, byte [eax + 0x41e488]
jmp dword [eax*4 + 0x41e45c]
mov eax, 0x804
cmp cx, ax
je 0x41e350
mov eax, 0x1004
cmp cx, ax
je 0x41e350
mov edx, str.zh_TW
cmp ecx, 4
jne 0x41e355
mov edx, str.zh_CN
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x2c], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e360
sub ecx, dword [ebp - 0x2c]
sar ecx, 1
push ecx
push edx
jmp 0x41e3c3
push 5
push str.ko_KR
jmp 0x41e3c3
push 5
push str.en_US
jmp 0x41e3c3
push 5
push str.vi_VN
jmp 0x41e3c3
push 5
push str.th_TH
jmp 0x41e3c3
push 5
push str.ja_JP
jmp 0x41e3c3
push 5
push str.ru_RU
jmp 0x41e3c3
push 5
push str.pt_PT
jmp 0x41e3c3
push 5
push str.es_ES
jmp 0x41e3c3
push 5
push str.ar_IL
lea ecx, [ebp - 0x28]
call fcn.004083f0
add esi, 0x120
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x41e3eb
cmp dword [ebp - 0x14], 7
mov ecx, esi
push dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
push eax
call fcn.004083f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x41e430
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e41e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e457
push ecx
push edx
call fcn.004804a9
add esp, 8
jmp 0x41e430
add esi, 0x120
push esi
mov ecx, edi
call fcn.00408b10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret 4
call fcn.00485a5d
mov esp, 0x320041e3
jecxz 4318372
add byte [ebp - 0x1d], bh
inc ecx
add byte [ebx - 0x67ffbe1d], dh
jecxz 0x41e4b0
add byte [ebx + 0x41], dh
add byte [edx - 0x5effbe1d], ch
jecxz 0x41e4bc
add byte [edi - 0x79ffbe1d], cl
jecxz 0x41e4c4
add bl, cl
jecxz 0x41e4c8
add byte [eax], al
or cl, byte [edx]
add dword [edx], ecx
or cl, byte [edx]
or al, byte [edx]
add ecx, dword [edx]
or cl, byte [edx]
or cl, byte [edx]
or al, byte [eax + 101321226]
or cl, byte [edx]
pop es
or cl, byte [edx]
or cl, byte [edx]
or byte [edx], cl
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or esp, ecx
int3
or cl, byte [eax]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [ecx]
int3
int3
jmp [eax + 0x47]
dec edx
add byte [ecx], ah
add byte [eax], al
add byte [eax - 0x7f], dl
in al, dx
insb byte es:[edi], dx
or byte [eax], al
add byte [ecx + 0x4d1480], ah
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00482730
mov ecx, dword [esi + 0x58]
add esi, 0x48
mov eax, SysReAllocString
add esp, 0xc
sub eax, ecx
cmp eax, 0xc
jb 0x41e9bc
cmp dword [esi + 0x14], 7
jbe 0x41e522
mov esi, dword [esi]
push 0xc
push str.ldremote.exe
push ecx
push esi
push ecx
push dword [ebp - 0x848]
lea ecx, [ebp - 0x840]
call fcn.0040e310
mov dword [ebp - 4], 0
lea eax, [ebp - 0x840]
cmp dword [ebp - 0x82c], 7
cmova eax, dword [ebp - 0x840]
push eax
push str.register_firewall_start__s
push 0x61f
push str.LDRemoteModel::registerWindowDefinder
call fcn.00426450
add esp, 0x10
mov dword [ebp - 0x818], 0
xorps xmm0, xmm0
mov dword [ebp - 0x814], 0
lea ecx, [ebp - 0x828]
movups xmmword [ebp - 0x828], xmm0
push 6
push str.OSLink
call fcn.004082b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x840]
cmp dword [ebp - 0x82c], 7
lea eax, [ebp - 0x828]
cmova ecx, dword [ebp - 0x840]
cmp dword [ebp - 0x814], 7
push ecx
cmova eax, dword [ebp - 0x828]
push eax
lea eax, [ebp - 0x810]
push str.New_NetFirewallRule__DisplayName___s___Direction_Inbound__Program__s__RemoteAddress_Any__Action_Allow
push eax
call fcn.00422a00
xorps xmm0, xmm0
mov dword [ebp - 0x868], 0
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x864], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x878], xmm0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e610
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x878]
call fcn.004082b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x860]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x850], 0
push str.powershell.exe
movups xmmword [ebp - 0x860], xmm0
mov dword [ebp - 0x84c], 0
call fcn.004082b0
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 3
push eax
sub esp, 8
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x860]
call fcn.00426c00
mov byte [ebp - 4], 2
add esp, 0xc
mov ecx, dword [ebp - 0x84c]
mov byte [ebp - 0x841], al
cmp ecx, 7
jbe 0x41e6d2
mov edx, dword [ebp - 0x860]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e6c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e9c1
push ecx
push edx
call fcn.004804a9
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x864]
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
cmp ecx, 7
jbe 0x41e733
mov edx, dword [ebp - 0x878]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e729
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e9c1
push ecx
push edx
call fcn.004804a9
add esp, 8
movzx eax, byte [ebp - 0x841]
push eax
push str.register_firewall_end__d
push 0x625
push str.LDRemoteModel::registerWindowDefinder
call fcn.00426450
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00482730
cmp dword [ebp - 0x82c], 7
lea ecx, [ebp - 0x840]
lea eax, [ebp - 0x828]
cmova ecx, dword [ebp - 0x840]
cmp dword [ebp - 0x814], 7
push ecx
cmova eax, dword [ebp - 0x828]
push eax
lea eax, [ebp - 0x810]
push str.New_NetFirewallRule__DisplayName___s___Direction_Outbound__Program__s__RemoteAddress_Any__Action_Allow
push eax
call fcn.00422a00
xorps xmm0, xmm0
mov dword [ebp - 0x868], 0
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x864], 0
add esp, 0x2c
lea edx, [ecx + 2]
movups xmmword [ebp - 0x878], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e7c7
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x878]
call fcn.004082b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x860]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x850], 0
push str.powershell.exe
movups xmmword [ebp - 0x860], xmm0
mov dword [ebp - 0x84c], 0
call fcn.004082b0
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 5
push eax
sub esp, 8
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x860]
call fcn.00426c00
mov byte [ebp - 4], 4
add esp, 0xc
mov ecx, dword [ebp - 0x84c]
mov byte [ebp - 0x841], al
cmp ecx, 7
jbe 0x41e889
mov edx, dword [ebp - 0x860]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e87f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e9c6
push ecx
push edx
call fcn.004804a9
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x864]
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 7
mov word [ebp - 0x860], ax
cmp ecx, 7
jbe 0x41e8ea
mov edx, dword [ebp - 0x878]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e8e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e9c6
push ecx
push edx
call fcn.004804a9
add esp, 8
movzx eax, byte [ebp - 0x841]
push eax
push str.register_firewall_outbound__d
push 0x62b
push str.LDRemoteModel::registerWindowDefinder
call fcn.00426450
mov ecx, dword [ebp - 0x814]
add esp, 0x10
cmp ecx, 7
jbe 0x41e949
mov edx, dword [ebp - 0x828]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e93f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e9cb
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp - 0x82c]
xor eax, eax
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
cmp ecx, 7
jbe 0x41e9a2
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e998
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e9cb
push ecx
push edx
call fcn.004804a9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret
call fcn.00408bc0
call fcn.00485a5d
call fcn.00485a5d
call fcn.00485a5d
int3