Function at 0x401000
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp + 0x18], 0xaa937b77
mov eax, 0xaa937b77
mov esi, dword [esp + 0x1c]
movzx ebp, word [esp + 6]
mov ebx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp eax, 0xa3fe075
jle 0x40108d
cmp eax, 0x3bc3b378
jle 0x4010f6
cmp eax, 0x64ee4231
jle 0x40112f
cmp eax, 0x64ee4232
je 0x40120b
cmp eax, 0x724743a3
je 0x401227
cmp eax, 0x7e43d795
jne 0x401027
mov ecx, dword [esp]
shr ecx, 0xc
imul eax, ecx, 0xdd
imul ecx, ecx
shr eax, 0xa
imul edx, ecx, 0x7b97
dec edx
mov dword [esp], eax
mov eax, 0xa076448d
cmp edx, ecx
je 0x401027
mov eax, 0x845a74
jmp 0x401027
cmp eax, 0xdd27e91a
jle 0x4010c5
cmp eax, 0xeee9bf98
jle 0x40116b
cmp eax, 0xf6c5cd5b
je 0x401260
cmp eax, 0x845a74
je 0x401161
cmp eax, 0xeee9bf99
jne 0x401027
jmp 0x4013ac
cmp eax, 0xc3501d21
jg 0x401199
cmp eax, 0xa076448d
je 0x401297
cmp eax, 0xaa937b77
je 0x401201
cmp eax, 0x895cf966
jne 0x401027
jmp 0x4013c5
cmp eax, 0x241b1474
jg 0x4011df
cmp eax, 0xa3fe076
je 0x4012c8
cmp eax, 0x13d0c0b8
jne 0x401027
mov eax, dword [esp + 8]
movzx eax, word [esp + eax*2 + 0x24]
mov word [esp + 0x12], ax
mov eax, 0xf6c5cd5b
jmp 0x401027
cmp eax, 0x3bc3b379
je 0x4012e0
cmp eax, 0x4da77fde
jne 0x401027
shr esi, 0xb
imul esi, esi, 0x1be000
add esi, 0xfff32000
shr esi, 5
call section..text
call section..text
mov eax, 0x13d0c0b8
jmp 0x401027
cmp eax, 0xdd27e91b
je 0x401387
cmp eax, 0xeb227f65
jne 0x401027
mov eax, dword [esp]
shl eax, 0x1f
add eax, 0xffffff80
shr eax, 1
mov dword [esp], eax
mov eax, 0xeee9bf99
jmp 0x401027
cmp eax, 0xc3501d22
je 0x401304
cmp eax, 0xd85c26d6
jne 0x401027
imul eax, dword [esp], 0x67
lea ecx, [eax + 0xf]
imul ecx, ecx
imul edx, ecx, 0x3ca9
dec edx
add eax, 0xe2
mov dword [esp], eax
mov eax, 0x241b1475
cmp ecx, edx
je 0x401027
mov eax, 0xa076448d
jmp 0x401027
cmp eax, 0x241b1475
je 0x401335
cmp eax, 0x3a09e3b4
jne 0x401027
imul esi, esi, 0x4600
add esi, 0x1ee00
mov eax, 0x241b1475
jmp 0x401027
imul esi, esi, 0xfeb0c000
mov eax, 0xdd27e91b
test esi, esi
je 0x40121f
mov eax, 0x241b1475
shr esi, 6
jmp 0x401027
mov dword [esp + 0x20], ebx
movsx ecx, bp
cmp ecx, 0x43e
jle 0x401351
cmp ecx, 0x818
jg 0x40136c
lea ecx, [ebp - 0x43f]
cmp cx, 4
ja 0x401387
mov edx, 0x13
jmp 0x401365
mov eax, dword [esp]
lea ecx, [eax - 0xf6]
imul ecx, ecx
imul edx, ecx, 0x8483
dec edx
add eax, 0xffffff61
mov dword [esp], eax
mov eax, 0x4da77fde
cmp edx, ecx
je 0x401289
mov eax, 0x724743a3
mov ebx, dword [esp + 8]
movzx ebp, word [esp + 0x12]
jmp 0x401027
movzx eax, word [esp + 0x10]
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [esp + 0x28], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [esp + 0x2a], ax
mov eax, 0x724743a3
xor ebx, ebx
movzx ebp, word [esp + 0xe]
jmp 0x401027
shr esi, 8
add esi, 0x1c2
call section..text
mov eax, 0xdd27e91b
jmp 0x401027
imul esi, esi, 0xef0
add esi, 0xfffff2a0
mov eax, 0x3a09e3b4
cmp esi, 0x43
jge 0x401027
mov eax, 0xa3fe076
jmp 0x401027
shr esi, 3
and esi, 0xffffffe0
add esi, 0xffffff77
call section..text
call section..text
mov eax, 0x64ee4232
cmp esi, 0xeb
jb 0x401027
mov eax, 0x3bc3b379
jmp 0x401027
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esp + 0xe], ax
call edi
mov word [esp + 0x10], ax
mov eax, 0xd85c26d6
jmp 0x401027
lea ecx, [ebp - 0x419]
cmp cx, 0x13
ja 0x401387
movzx ecx, cx
mov edx, 0xc8401
bt edx, ecx
jae 0x401387
jmp 0x4013c5
movzx ecx, bp
cmp ecx, 0x819
je 0x4013c5
cmp ecx, 0x82c
je 0x4013c5
cmp ecx, 0x843
je 0x4013c5
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov eax, 0xeb227f65
cmp ecx, 4
je 0x401027
mov eax, 0x7e43d795
jmp 0x401027
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
mov word [esp + 6], bp
mov dword [esp + 0x14], ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
mov word [esp + 6], bp
mov dword [esp + 0x14], ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]