Function at 0x1002b27a
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002b9f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x1002b2b8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002b2ce
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x158], 0xffffffff
jmp 0x1002b2b1
push 0x3548
push 0
lea eax, [ebp - 0xd4]
push eax
call fcn.10030c4b
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0xfe30
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x14], 0xd1cb6a7f
mov dword [ebp - 0x118], 0xfffffffd
mov dword [ebp - 0x24], 1
mov dword [ebp - 0xf0], 3
mov dword [ebp - 0x1c], 0
jmp 0x1002b345
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002b35b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0], 1
jmp 0x1002b33e
cmp dword [ebp - 4], 0
je 0x1002b3c0
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jg 0x1002b372
mov dword [ebp - 0x54], 1
jmp 0x1002b376
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x54], eax
jg 0x1002b38a
mov dword [ebp - 0xf4], 1
jmp 0x1002b391
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 4]
test eax, eax
je 0x1002b3c0
mov dword [ebp - 0xc0], 1
jmp 0x1002b3c7
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0x4709
je 0x1002b3dc
mov dword [ebp - 0x50], 1
jmp 0x1002b3e0
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x50], eax
je 0x1002b3f4
mov dword [ebp - 0x8c], 1
jmp 0x1002b3fb
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x108], eax
mov eax, 0xe13f
cmp eax, 0xd1aa
jge 0x1002b441
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1002b441
and dword [ebp - 0x30], 0
jmp 0x1002b448
mov dword [ebp - 0x30], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp + eax - 0xd0], ecx
imul eax, dword [ebp - 0x30], 0
test eax, eax
je 0x1002b479
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0], 0
je 0x1002b479
mov dword [ebp - 0x5c], 1
jmp 0x1002b47d
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x5c], eax
je 0x1002b5b6
mov dword [ebp - 0x34], 0x122d800f
mov dword [ebp - 0xf8], 0x43c7d757
mov dword [ebp - 0x20], 0
jmp 0x1002b4aa
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002b4c0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x150], 0xfffffffc
jmp 0x1002b4a3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x14], 0x5015
jl 0x1002b4de
mov dword [ebp - 0xb4], 1
jmp 0x1002b4e5
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 4]
add eax, 0x1a3827ea
cmp dword [ebp - 0xb4], eax
jg 0x1002b4fe
mov dword [ebp - 0x64], 1
jmp 0x1002b502
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x94], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x94]
mov dword [ebp + eax - 0x150], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x94], eax
jge 0x1002b53f
mov dword [ebp - 0x6c], 1
jmp 0x1002b543
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x6c]
cmp eax, 8
jae 0x1002b56a
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x150], 0
je 0x1002b56a
mov dword [ebp - 0xac], 1
jmp 0x1002b571
and dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 0xf21ddbc7
jne 0x1002b586
mov dword [ebp - 0x74], 1
jmp 0x1002b58a
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x74], eax
jle 0x1002b59e
mov dword [ebp - 0x9c], 1
jmp 0x1002b5a5
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xf8], eax
jmp 0x1002b72a
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0xc], 0
jmp 0x1002b5d0
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x1002b5e3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x44], 0xbde8aff
jmp 0x1002b5c9
mov dword [ebp - 0xc], 0
jmp 0x1002b5f3
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x1002b609
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x160], 0xfffffffc
jmp 0x1002b5ec
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x44], 0
jne 0x1002b61f
mov dword [ebp - 0x7c], 1
jmp 0x1002b623
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x14], eax
jg 0x1002b647
mov dword [ebp - 0xbc], 1
jmp 0x1002b64e
and dword [ebp - 0xbc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0xbc], eax
jl 0x1002b66c
mov dword [ebp - 0x84], 1
jmp 0x1002b673
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x84], eax
jge 0x1002b68a
mov dword [ebp - 0xa4], 1
jmp 0x1002b691
and dword [ebp - 0xa4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa4]
sub ecx, dword [ebp + eax - 0x44]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x44]
jge 0x1002b6b6
mov dword [ebp - 0x4c], 1
jmp 0x1002b6ba
and dword [ebp - 0x4c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 0x4c]
cmp dword [ebp + eax - 0xd0], ecx
je 0x1002b6dc
mov dword [ebp - 0xec], 1
jmp 0x1002b6e3
and dword [ebp - 0xec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x120], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x13c], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xd0], 0x37ece519
push 0x6ec
lea eax, [ebp - 0xe0]
push eax
push 0
call fcn.1002c1c9
add esp, 0xc
mov dword [ebp - 0x24], 0
jmp 0x1002b73a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 9
jne 0x1002b802
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x78], 9
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd0]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
je 0x1002b778
mov dword [ebp - 0x58], 1
jmp 0x1002b77c
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x58], eax
jge 0x1002b790
mov dword [ebp - 0x60], 1
jmp 0x1002b794
and dword [ebp - 0x60], 0
mov eax, 0xc4a2
sub eax, dword [ebp - 0x60]
cmp eax, 0x3c5b
jne 0x1002b7ac
mov dword [ebp - 0x68], 1
jmp 0x1002b7b0
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x68], eax
je 0x1002b7c4
mov dword [ebp - 0xe8], 1
jmp 0x1002b7cb
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x38], 0xffffffff
jge 0x1002b7e3
mov dword [ebp - 0x70], 1
jmp 0x1002b7e7
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0x78], eax
jmp 0x1002b733
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 4], 0
jbe 0x1002b9f3
mov dword [ebp - 8], 0x184c506d
mov dword [ebp - 0x2c], 0
jmp 0x1002b829
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002b83f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x104], 0xffffffff
jmp 0x1002b822
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002b868
push 0
push 0
push 0
push 0
push 0xd33
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 8], 2
jmp 0x1002b878
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x1002b9b4
mov dword [ebp - 0x18], 0xfffb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x104], 0
ja 0x1002b8a2
mov dword [ebp - 0x48], 1
jmp 0x1002b8a6
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 8], 0x81f3
jne 0x1002b8c4
mov dword [ebp - 0x88], 1
jmp 0x1002b8cb
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x88]
jl 0x1002b8e5
cmp dword [ebp - 8], 0
jne 0x1002b8e5
and dword [ebp - 0x90], 0
jmp 0x1002b8ef
mov dword [ebp - 0x90], 1
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x90]
test eax, eax
je 0x1002b91e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x104], 0
je 0x1002b91e
cmp dword [ebp - 0x18], 0
je 0x1002b91e
mov dword [ebp - 0x98], 1
jmp 0x1002b925
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0xfffffffa
jbe 0x1002b93a
mov dword [ebp - 0xa0], 1
jmp 0x1002b941
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x18]
jg 0x1002b95b
mov dword [ebp - 0xd8], 1
jmp 0x1002b962
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 8], 0x660
jle 0x1002b989
mov dword [ebp - 0xdc], 1
jmp 0x1002b990
and dword [ebp - 0xdc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x104]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x104], ecx
jmp 0x1002b871
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xb0]
add ecx, dword [eax]
mov dword [ebp - 0xb8], ecx
mov eax, dword [ebp - 0xb8]
cmp dword [eax], 0
jbe 0x1002b9f3
push 1
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xe4]
call fcn.1002b211
add esp, 0x10
jmp 0x1002b9c8
jmp 0x1002b9fb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esp, ebp
pop ebp
ret