Stepping into the loaded PE,Bazar loader tries to avoid targeting Russian users by checking if the Russian language is installed on the infected machine. It calls setlocale, deobfuscating the “Russia” string by adding 0xf4 to each character, and finally resolving and calling StrStrA to check if “Russia” is a substring of the current locale. If so, the loader terminates. The Bazar Backdoor repeats this step as well