Function at 0x412b30
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4689b9
mov eax, dword fs:[0]
push eax
sub esp, 0x7ec
mov eax, dword [0x48a034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [ebp - 0x34], edi
push eax
push 0x47bd54
mov dword [ebp - 0x14], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
call fcn.0040a1e0
xor eax, eax
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [ecx + 0x10], 0
push eax
push 0x47bd54
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0040a1e0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
push 5
xor eax, eax
mov dword [ecx + 0x10], 0
push str.en_US
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0040a1e0
mov dword [edi + 0x48], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x7f8]
push 5
xor eax, eax
mov dword [ebp - 0x7e8], 0
push str.ar_AE
mov dword [ebp - 0x7e4], 7
mov word [ebp - 0x7f8], ax
call fcn.0040a1e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7e0]
push 0xc
xor eax, eax
mov dword [ebp - 0x7d0], 0
push 0x47c98c
mov dword [ebp - 0x7cc], 7
mov word [ebp - 0x7e0], ax
call fcn.0040a1e0
push str.Arabic__Bahrain_
push str.ar_BH
lea ecx, [ebp - 0x7c8]
mov byte [ebp - 4], 4
call fcn.00415130
push str.Arabic__Egypt_
push str.ar_EG
lea ecx, [ebp - 0x798]
mov byte [ebp - 4], 5
call fcn.00415130
push str.Arabic__Kuwait_
push str.ar_KW
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 6
call fcn.00415130
push str.Arabic__Qatar_
push str.ar_QA
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 7
call fcn.00415130
push str.Arabic__Saudi_Arabia_
push str.ar_SA
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 8
call fcn.00415130
push str.Arabic__Syria_
push str.ar_SY
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 9
call fcn.00415130
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6a8]
push 5
xor eax, eax
mov dword [ebp - 0x698], 0
push str.ca_ES
mov dword [ebp - 0x694], 7
mov word [ebp - 0x6a8], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x690]
push 7
xor eax, eax
mov dword [ebp - 0x680], 0
push str.Catalan
mov dword [ebp - 0x67c], 7
mov word [ebp - 0x690], ax
call fcn.0040a1e0
push str.Danish__Denmark_
push str.da_DK
lea ecx, [ebp - 0x678]
mov byte [ebp - 4], 0xc
call fcn.00415130
push str.German__Germany_
push str.de_DE
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 0xd
call fcn.00415130
push str.English__Australia_
push str.en_AU
lea ecx, [ebp - 0x618]
mov byte [ebp - 4], 0xe
call fcn.00415130
push str.English__Canada_
push str.en_CA
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0xf
call fcn.00415130
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x5b8]
push 5
xor eax, eax
mov dword [ebp - 0x5a8], 0
push str.en_GB
mov dword [ebp - 0x5a4], 7
mov word [ebp - 0x5b8], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x5a0]
push 0x18
xor eax, eax
mov dword [ebp - 0x590], 0
push str.English__United_Kingdom_
mov dword [ebp - 0x58c], 7
mov word [ebp - 0x5a0], ax
call fcn.0040a1e0
push str.English__India_
push str.en_IN
lea ecx, [ebp - 0x588]
mov byte [ebp - 4], 0x12
call fcn.00415130
push str.English__New_Zealand_
push str.en_NZ
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 0x13
call fcn.00415130
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x528]
push 5
xor eax, eax
mov dword [ebp - 0x518], 0
push str.en_US
mov dword [ebp - 0x514], 7
mov word [ebp - 0x528], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x510]
push 0x17
xor eax, eax
mov dword [ebp - 0x500], 0
push str.English__United_States_
mov dword [ebp - 0x4fc], 7
mov word [ebp - 0x510], ax
call fcn.0040a1e0
push str.Spanish__Spain_
push str.es_ES
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x16
call fcn.00415130
push str.Spanish__Mexico_
push str.es_MX
lea ecx, [ebp - 0x4c8]
mov byte [ebp - 4], 0x17
call fcn.00415130
push str.Finnish__Finland_
push str.fi_FI
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 0x18
call fcn.00415130
push str.French__Canada_
push str.fr_CA
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x19
call fcn.00415130
push str.French__France_
push str.fr_FR
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x1a
call fcn.00415130
push str.Gujarati__Indian_
push str.gu_IN
lea ecx, [ebp - 0x408]
mov byte [ebp - 4], 0x1b
call fcn.00415130
push str.Hindi__India_
push str.hi_IN
lea ecx, [ebp - 0x3d8]
mov byte [ebp - 4], 0x1c
call fcn.00415130
push str.Italian__Italy_
push str.it_IT
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x1d
call fcn.00415130
push str.Japanese__Japan_
push str.ja_JP
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x1e
call fcn.00415130
push str.Korean__Korea_
push str.ko_KR
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 0x1f
call fcn.00415130
push str.Marathi__India_
push str.mr_IN
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x20
call fcn.00415130
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x2e8]
push 5
xor eax, eax
mov dword [ebp - 0x2d8], 0
push str.nb_NO
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x2d0]
push 0x12
xor eax, eax
mov dword [ebp - 0x2c0], 0
push str.Norwegian__Bokm
mov dword [ebp - 0x2bc], 7
mov word [ebp - 0x2d0], ax
call fcn.0040a1e0
push str.Dutch__Netherlands_
push str.nl_NL
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x23
call fcn.00415130
push str.Polish__Poland_
push str.pl_PL
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x24
call fcn.00415130
push str.Portuguese__Brazil_
push str.pt_BR
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x25
call fcn.00415130
push str.Portuguese__Portugal_
push str.pt_PT
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x26
call fcn.00415130
push str.Russian__Russia_
push str.ru_RU
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x27
call fcn.00415130
push str.Swedish__Sweden_
push str.sv_SE
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x28
call fcn.00415130
push str.Tamil__India_
push str.ta_IN
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x29
call fcn.00415130
push str.Telugu__India_
push str.te_IN
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x2a
call fcn.00415130
push str.Thai__Thailand_
push str.th_TH
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x2b
call fcn.00415130
mov byte [ebp - 4], 0x2c
push str.Turkish__Turkey_
push str.tr_TR
lea ecx, [ebp - 0x108]
call fcn.00415130
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xd8]
push 5
xor eax, eax
mov dword [ebp - 0xc8], 0
push str.zh_CN
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xc0]
push 0x1e
xor eax, eax
mov dword [ebp - 0xb0], 0
push str.Chinese__Mandarin__simplified_
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xa8]
push 5
xor eax, eax
mov dword [ebp - 0x98], 0
push str.zh_HK
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x90]
push 0x20
xor eax, eax
mov dword [ebp - 0x80], 0
push str.Chinese__Cantonese__Traditional_
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x78]
push 5
xor eax, eax
mov dword [ebp - 0x68], 0
push str.zh_TW
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x60]
push 0x1c
xor eax, eax
mov dword [ebp - 0x50], 0
push str.Chinese__Taiwanese_Mandarin_
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
call fcn.0040a1e0
mov byte [ebp - 4], 0x33
lea ebx, [edi + 0x4c]
mov dword [ebp - 0x38], ebx
lea esi, [ebp - 0x7f8]
push 0x40
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.0042eee1
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebx], eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x34
cmp esi, ecx
je 0x41332d
push esi
push eax
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
call fcn.00415470
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], eax
test al, al
jne 0x41331b
cmp dword [ebx + 4], 0x3ffffff
je 0x41336b
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 0x35
push 0x40
mov dword [ebp - 0x20], 0
call fcn.0042eee1
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
lea edi, [ebx + 0x10]
mov byte [ebp - 4], 0x36
push esi
mov ecx, edi
mov dword [ebp - 0x3c], edi
call fcn.00412150
lea eax, [esi + 0x18]
mov byte [ebp - 4], 0x37
push eax
lea ecx, [edi + 0x18]
call fcn.00412150
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0x34
mov edi, dword [ebp - 0x1c]
mov dword [ebx], eax
push ebx
push dword [ebp - 0x2c]
mov dword [ebx + 4], eax
push dword [ebp - 0x30]
mov dword [ebx + 8], eax
mov word [ebx + 0xc], 0
lea ebx, [edi + 0x4c]
mov ecx, ebx
mov dword [ebp - 0x20], 0
call fcn.004105d0
add esi, 0x30
lea eax, [ebp - 0x48]
cmp esi, eax
je 0x41332d
mov eax, dword [ebp - 0x14]
jmp 0x413276
push fcn.00413470
push 0x29
push 0x30
lea eax, [ebp - 0x7f8]
mov byte [ebp - 4], 0x39
push eax
call fcn.0042ef42
mov dword [edi + 0x54], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042eecb
mov esp, ebp
pop ebp
ret
call fcn.00404e80
int3