Function at 0x401000
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [esp + 0x18], 0xaa937b77
mov eax, 0xaa937b77
mov ebp, dword [esp + 0x1c]
movzx ebx, word [esp + 6]
mov esi, dword [esp + 0x14]
cmp eax, 0x6f0d1ec
jg 0x401094
cmp eax, 0xdd27e91a
jle 0x4010dc
cmp eax, 0xeee9bf98
jle 0x401159
cmp eax, 0xeee9bf99
je 0x401231
cmp eax, 0xf6c5cd5b
je 0x401268
cmp eax, 0x845a74
jne 0x401021
mov dword [esp + 0x24], esi
movsx ecx, bx
cmp ecx, 0x43e
jle 0x401337
cmp ecx, 0x818
jg 0x401352
lea ecx, [ebx - 0x43f]
cmp cx, 4
ja 0x40136d
mov edx, 0x13
jmp 0x40134b
cmp eax, 0x3bc3b378
jg 0x401107
cmp eax, 0x13d0c0b7
jle 0x401183
cmp eax, 0x13d0c0b8
je 0x40136d
cmp eax, 0x241b1475
je 0x4012f9
cmp eax, 0x3a09e3b4
jne 0x401021
mov eax, dword [esp + 0x20]
movzx ebx, word [eax]
mov eax, 0x845a74
mov esi, dword [esp + 8]
jmp 0x401021
cmp eax, 0xc3501d21
jg 0x4011be
cmp eax, 0xa076448d
je 0x401284
cmp eax, 0xaa937b77
jne 0x401380
mov eax, 0x241b1475
jmp 0x401021
cmp eax, 0x64ee4231
jle 0x4011f3
cmp eax, 0x64ee4232
je 0x4012a4
cmp eax, 0x724743a3
jne 0x40138d
imul eax, dword [esp], 0xaf
lea ecx, [eax - 0x9de9]
imul ecx, ecx
add eax, 0xffff615d
imul edx, ecx, 0x374b
dec edx
shr eax, 0xb
mov dword [esp], eax
mov eax, 0xa076448d
cmp ecx, edx
je 0x401021
jmp 0x4011b4
cmp eax, 0xdd27e91b
je 0x4012bc
cmp eax, 0xeb227f65
jne 0x401021
movzx eax, word [esp + 0x12]
mov word [esp + 0x2c], ax
mov eax, 0xf6c5cd5b
jmp 0x401021
cmp eax, 0x6f0d1ed
je 0x4012d5
cmp eax, 0xa3fe076
jne 0x401021
imul eax, ebp, 0x6800
or eax, 0xa5
imul ebp, eax, 0x86
call section..text
call section..text
mov eax, 0xeb227f65
jmp 0x401021
cmp eax, 0xc3501d22
je 0x401303
cmp eax, 0xd85c26d6
jne 0x401021
movzx eax, word [esp + 0x10]
mov word [esp + 0x2a], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [esp + 0x12], ax
mov eax, 0x724743a3
jmp 0x401021
cmp eax, 0x3bc3b379
je 0x40131f
cmp eax, 0x4da77fde
jne 0x401021
mov edi, ebp
shr edi, 1
add edi, 0xd
call section..text
mov eax, 0x6f0d1ed
cmp ebp, 0x11fe6
jb 0x401227
mov eax, 0x13d0c0b8
shr edi, 0xb
mov ebp, edi
jmp 0x401021
mov ecx, dword [esp]
mov eax, 0xffffff0d
add ecx, eax
imul eax, ecx, 0xb10
imul ecx, ecx
imul edx, ecx, 0x6a33
dec edx
shr eax, 0xd
mov dword [esp], eax
mov eax, 0xa076448d
cmp ecx, edx
je 0x401021
mov eax, 0xd85c26d6
jmp 0x401021
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [esp + 0x2e], ax
mov eax, 0x845a74
xor esi, esi
movzx ebx, word [esp + 0xe]
jmp 0x401021
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esp + 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esp + 0x10], ax
mov eax, 0xeee9bf99
jmp 0x401021
mov eax, dword [esp]
shl eax, 7
and eax, 0xfff80000
mov dword [esp], eax
mov eax, 0xc3501d22
jmp 0x401021
imul eax, dword [esp], 0x806
add eax, 0xffffff5f
mov dword [esp], eax
mov eax, 0x895cf966
jmp 0x401021
imul ebp, ebp, 0x6c00
add ebp, 0xffffffd0
call section..text
call section..text
mov eax, 0xd85c26d6
cmp ebp, 0xa9
jge 0x401021
mov eax, 0xa076448d
jmp 0x401021
mov ecx, dword [esp + 8]
mov eax, 0xdd27e91b
cmp ecx, 4
je 0x401021
mov eax, 0x3bc3b379
jmp 0x401021
mov eax, dword [esp + 8]
lea eax, [esp + eax*2]
add eax, 0x28
mov dword [esp + 0x20], eax
mov eax, 0x3a09e3b4
jmp 0x401021
lea ecx, [ebx - 0x419]
cmp cx, 0x13
ja 0x40136d
movzx ecx, cx
mov edx, 0xc8401
bt edx, ecx
jae 0x40136d
jmp 0x401398
movzx ecx, bx
cmp ecx, 0x819
je 0x401398
cmp ecx, 0x843
je 0x401398
cmp ecx, 0x82c
je 0x401398
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 8], eax
mov eax, 0x64ee4232
jmp 0x401021
cmp eax, 0x895cf966
jne 0x401021
jmp 0x4013b1
cmp eax, 0x7e43d795
jne 0x401021
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
mov word [esp + 6], bx
mov dword [esp + 0x14], esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
mov word [esp + 6], bx
mov dword [esp + 0x14], esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret