Function at 0x10028cc3
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007cbef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb08
push esi
push edi
mov dword [ebp - 0xa4], 0xd6c05baf
mov dword [ebp - 0xa4], 0
jmp 0x10028d06
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffe9
jl 0x10028e28
mov dword [ebp - 0x208], 0x7543
push 3
lea ecx, [ebp - 0x81c]
call fcn.1000c1f9
and dword [ebp - 4], 0
mov dword [ebp - 0x5e8], 0x946b43d2
mov dword [ebp - 0x1a0], 0
jmp 0x10028d51
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x10028d70
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x81c]
call fcn.1000c297
and dword [eax], 0
jmp 0x10028d44
cmp dword [ebp - 0x208], 0x1188
jg 0x10028d88
mov dword [ebp - 0x314], 1
jmp 0x10028d8f
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
sub eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa4]
jle 0x10028daf
mov dword [ebp - 0x55c], 1
jmp 0x10028db6
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0x7fa3
jge 0x10028dce
mov dword [ebp - 0x564], 1
jmp 0x10028dd5
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x208]
add eax, dword [ebp - 0x564]
jne 0x10028dfe
push 0
lea ecx, [ebp - 0x81c]
call fcn.1000c297
cmp dword [eax], 0
jne 0x10028dfe
and dword [ebp - 0x210], 0
jmp 0x10028e08
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x5e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.1000c27b
jmp 0x10028cf9
mov dword [ebp - 0xbc], 0xd6c05baf
push 2
lea ecx, [ebp - 0x5c0]
call fcn.1000c1f9
mov dword [ebp - 4], 1
mov dword [ebp - 0xac], 0xfffffffd
mov dword [ebp - 0x6a8], 0xbc6e5c7a
push 1
lea ecx, [ebp - 0x834]
call fcn.1000c1f9
mov byte [ebp - 4], 2
mov dword [ebp - 0x54], 0
jmp 0x10028e7b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10028e97
push dword [ebp - 0x54]
lea ecx, [ebp - 0x5c0]
call fcn.1000c297
mov dword [eax], 0x5c68ec0a
jmp 0x10028e74
mov dword [ebp - 0x54], 0
jmp 0x10028ea7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10028ec0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x834]
call fcn.1000c297
and dword [eax], 0
jmp 0x10028ea0
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000c297
mov dword [eax], 0xfffffffe
jmp 0x10028ef9
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000c297
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x56c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000c297
cmp dword [eax], 0
jl 0x10028f3d
mov dword [ebp - 0x218], 0x74aa
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x10028f2e
push 0x110
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
jmp 0x10028ed5
mov dword [ebp - 0xac], 5
jmp 0x10028f56
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 8
jg 0x10029178
mov dword [ebp - 0xec], 0xcee61780
mov dword [ebp - 0x230], 0x2628217c
mov dword [ebp - 0x240], 0xfe44fa3f
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000c297
cmp dword [eax], 0
je 0x10028fa8
mov eax, 0x3061
test eax, eax
je 0x10028fa8
mov dword [ebp - 0x570], 1
jmp 0x10028faf
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x230], 0x5922
jle 0x10028fc7
mov dword [ebp - 0x574], 1
jmp 0x10028fce
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x574]
cmp eax, 0xfffffff8
jg 0x10028feb
mov dword [ebp - 0x220], 1
jmp 0x10028ff2
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x220], eax
jne 0x1002900c
mov dword [ebp - 0x57c], 1
jmp 0x10029013
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x57c], eax
jl 0x1002902d
mov dword [ebp - 0x228], 1
jmp 0x10029034
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xfffd
jb 0x1002904c
mov dword [ebp - 0x584], 1
jmp 0x10029053
and dword [ebp - 0x584], 0
xor eax, eax
sub eax, dword [ebp - 0x584]
cmp dword [ebp - 0xec], eax
je 0x1002906f
mov dword [ebp - 0x58c], 1
jmp 0x10029076
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x58c], eax
jle 0x10029099
cmp dword [ebp - 0x6a8], 0
je 0x10029099
mov dword [ebp - 0x238], 1
jmp 0x100290a0
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x238], eax
jg 0x100290ba
mov dword [ebp - 0x594], 1
jmp 0x100290c1
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x594], eax
jge 0x100290db
mov dword [ebp - 0x59c], 1
jmp 0x100290e2
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x59c], eax
jne 0x100290fc
mov dword [ebp - 0x24c], 1
jmp 0x10029103
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x570]
imul eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0xec]
jg 0x10029124
mov dword [ebp - 0x250], 1
jmp 0x1002912b
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x250], eax
jl 0x10029157
push 0
lea ecx, [ebp - 0x834]
call fcn.1000c297
cmp dword [eax], 0
je 0x10029157
mov dword [ebp - 0x400], 1
jmp 0x1002915e
and dword [ebp - 0x400], 0
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000c297
mov ecx, dword [ebp - 0x400]
mov dword [eax], ecx
jmp 0x10028f49
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x834]
call fcn.1000c27b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c0]
call fcn.1000c27b
mov dword [ebp - 0xbc], 0
jmp 0x100291af
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe9
jl 0x100297f2
mov dword [ebp - 0x7c], 0xe83c7730
mov dword [ebp - 0x6b0], 0xa5223fa3
mov dword [ebp - 0x118], 0
jmp 0x100291e6
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x10029202
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0xa88], 0xffff
jmp 0x100291d9
mov dword [ebp - 0x7c], 2
jmp 0x10029212
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x1002931d
mov dword [ebp - 0x120], 0
push 3
lea ecx, [ebp - 0x84c]
call fcn.1000c1f9
mov dword [ebp - 4], 3
mov dword [ebp - 0x168], 0
jmp 0x10029253
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x10029275
push dword [ebp - 0x168]
lea ecx, [ebp - 0x84c]
call fcn.1000c297
mov dword [eax], 0x580d416d
jmp 0x10029246
mov dword [ebp - 0x120], 2
jmp 0x1002928e
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x10029309
mov dword [ebp - 0x190], 0
jmp 0x100292b0
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x100292cc
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0xa58], 2
jmp 0x100292a3
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0xa88]
mov dword [ebp - 0x258], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x258]
mov dword [ebp + eax - 0xa58], ecx
push 2
lea ecx, [ebp - 0x84c]
call fcn.1000c297
mov ecx, dword [ebp - 0x258]
mov dword [eax], ecx
jmp 0x10029281
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call fcn.1000c27b
jmp 0x1002920b
mov dword [ebp - 0x7c], 3
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x2a8], 0x7543
push 3
lea ecx, [ebp - 0x858]
call fcn.1000c1f9
mov dword [ebp - 4], 4
mov dword [ebp - 0x5f4], 0x946b43d2
mov dword [ebp - 0xcc], 0xcea5d6c0
mov dword [ebp - 0x6c0], 0x307d7c11
mov dword [ebp - 0xcc], 0xfffffff5
jmp 0x10029382
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe4
jg 0x100293e4
mov dword [ebp - 0x6b8], 0xc5534bf8
cmp dword [ebp - 0xcc], 0
jne 0x100293b0
cmp dword [ebp - 0x6b8], 0
jne 0x100293b0
and dword [ebp - 0x4d8], 0
jmp 0x100293ba
mov dword [ebp - 0x4d8], 1
cmp dword [ebp - 0x4d8], 0
jge 0x100293cf
mov dword [ebp - 0x260], 1
jmp 0x100293d6
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x6c0], eax
jmp 0x10029375
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x10029407
push 0x1f20
push 0
push 0x121a
push 0x17ee
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [ebp - 0x128], 0
jmp 0x10029420
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x1002943f
push dword [ebp - 0x128]
lea ecx, [ebp - 0x858]
call fcn.1000c297
and dword [eax], 0
jmp 0x10029413
mov dword [ebp - 0x84], 9
mov dword [ebp - 0x418], 0x76d9935f
mov dword [ebp - 0x170], 0
jmp 0x1002946c
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x10029488
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x290], 0xa885
jmp 0x1002945f
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x84], 0
jmp 0x100294ad
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x19
jg 0x1002973a
mov dword [ebp - 0x68], 0xdba33992
mov dword [ebp - 0x6c8], 0xfffffffd
mov dword [ebp - 0x4e8], 0xbee6daba
mov dword [ebp - 0x68], 0
jmp 0x100294e5
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xfffffffe
jl 0x10029735
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x130], 0xa4ccfd66
mov dword [ebp - 0x270], 0xffffffff
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
add eax, 0x1db
cmp eax, dword [ebp - 0x6c8]
jg 0x10029544
mov dword [ebp - 0x408], 1
jmp 0x1002954b
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 1
jl 0x10029564
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x10029564
cmp dword [ebp - 0x130], 0
je 0x10029577
push 3
pop eax
test eax, eax
je 0x10029577
mov dword [ebp - 0x268], 1
jmp 0x1002957e
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x268]
neg eax
cmp eax, dword [ebp - 0x84]
jl 0x1002959d
cmp dword [ebp - 0x68], 0
jne 0x1002959d
and dword [ebp - 0x54c], 0
jmp 0x100295a7
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
je 0x100295c8
mov dword [ebp - 0x6d0], 1
jmp 0x100295cf
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x44], 0
jle 0x100295e1
mov dword [ebp - 0x410], 1
jmp 0x100295e8
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x604491d0
jge 0x10029600
mov dword [ebp - 0x278], 1
jmp 0x10029607
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x278]
jl 0x1002961e
mov dword [ebp - 0x4e0], 1
jmp 0x10029625
and dword [ebp - 0x4e0], 0
mov eax, 0xfc4f
sub eax, dword [ebp - 0x4e0]
je 0x10029644
cmp dword [ebp - 0x44], 0
je 0x10029644
mov dword [ebp - 0x280], 1
jmp 0x1002964b
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xffffffff
jg 0x1002966c
mov dword [ebp - 0x288], 1
jmp 0x10029673
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x44], 0
jmp 0x1002968f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x10029730
mov dword [ebp - 0x688], 0x2658
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x954], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x290], 0xbdae1919
je 0x100296d7
mov dword [ebp - 0x548], 1
jmp 0x100296de
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0xfffffffd
ja 0x100296f3
mov dword [ebp - 0x420], 1
jmp 0x100296fa
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x290]
cmp eax, dword [ebp - 0x420]
jl 0x10029718
mov dword [ebp - 0x298], 1
jmp 0x1002971f
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x4e8], eax
jmp 0x10029688
jmp 0x100294de
jmp 0x100294a0
cmp dword [ebp - 0x2a8], 0x1188
jg 0x10029752
mov dword [ebp - 0x2a0], 1
jmp 0x10029759
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jle 0x10029779
mov dword [ebp - 0x428], 1
jmp 0x10029780
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0x7fa3
jge 0x10029798
mov dword [ebp - 0x588], 1
jmp 0x1002979f
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x2a8]
add eax, dword [ebp - 0x588]
jne 0x100297c8
push 0
lea ecx, [ebp - 0x858]
call fcn.1000c297
cmp dword [eax], 0
jne 0x100297c8
and dword [ebp - 0x2b0], 0
jmp 0x100297d2
mov dword [ebp - 0x2b0], 1
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x5f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x858]
call fcn.1000c27b
jmp 0x100291a2
push 2
lea ecx, [ebp - 0x5b4]
call fcn.1000c1f9
mov dword [ebp - 4], 5
mov dword [ebp - 0x5fc], 0xffffffff
mov dword [ebp - 0x6dc], 0xaae0
mov dword [ebp - 0x60], 0
jmp 0x1002982a
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10029840
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x694], 0x3a18e418
jmp 0x10029823
mov dword [ebp - 0x60], 0
jmp 0x10029850
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1002986c
push dword [ebp - 0x60]
lea ecx, [ebp - 0x5b4]
call fcn.1000c297
mov dword [eax], 0xb58e17c1
jmp 0x10029849
mov eax, 0x9beb0647
test eax, eax
je 0x100299a5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x694]
mov dword [ebp - 0x430], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x430]
mov dword [ebp + eax - 0x694], ecx
push 0
lea ecx, [ebp - 0x5b4]
call fcn.1000c297
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [eax]
jne 0x100298c2
mov dword [ebp - 0x2b8], 1
jmp 0x100298c9
and dword [ebp - 0x2b8], 0
push 0
lea ecx, [ebp - 0x5b4]
call fcn.1000c297
push 1
lea ecx, [ebp - 0x5b4]
call fcn.1000c297
imul eax, dword [eax], 0
cmp dword [ebp - 0x2b8], eax
jle 0x100298fa
mov dword [ebp - 0x4f0], 1
jmp 0x10029901
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0x94d0
jge 0x10029919
mov dword [ebp - 0x2c0], 1
jmp 0x10029920
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0x355f
jne 0x10029938
mov dword [ebp - 0x728], 1
jmp 0x1002993f
and dword [ebp - 0x728], 0
push 0
lea ecx, [ebp - 0x5b4]
call fcn.1000c297
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1002996c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x694], 0
jne 0x1002996c
and dword [ebp - 0x1cc], 0
jmp 0x10029976
mov dword [ebp - 0x1cc], 1
push 1
lea ecx, [ebp - 0x5b4]
call fcn.1000c297
mov ecx, dword [ebp - 0x1cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5fc]
add eax, dword [ebp - 0x1cc]
je 0x100299a5
mov dword [ebp - 0x438], 1
jmp 0x100299ac
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 1
jne 0x100299c1
mov dword [ebp - 0x2c8], 1
jmp 0x100299c8
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x6dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b4]
call fcn.1000c27b
push 3
lea ecx, [ebp - 0x894]
call fcn.1000c1f9
mov dword [ebp - 4], 6
mov dword [ebp - 0x7c4], 0x432a2768
mov dword [ebp - 0x7c0], 0x432a2768
mov dword [ebp - 0x7bc], 0x432a2768
mov dword [ebp - 0x7b8], 0x432a2768
lea ecx, [ebp - 0x1b5]
call fcn.1000c2a6
push eax
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0xab4]
call fcn.1000c2a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x738]
call fcn.1000c255
mov byte [ebp - 4], 7
push 2
lea ecx, [ebp - 0x990]
call fcn.1000c1f9
mov byte [ebp - 4], 8
mov dword [ebp - 0x4c], 0
jmp 0x10029a79
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10029a95
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x894]
call fcn.1000c297
mov dword [eax], 0xbb2c2135
jmp 0x10029a72
mov dword [ebp - 0x4c], 0
jmp 0x10029aa5
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10029ac1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x990]
call fcn.1000c297
mov dword [eax], 0xbdbdf7c
jmp 0x10029a9e
push 0
lea ecx, [ebp - 0x738]
call fcn.1000c297
mov dword [eax], 2
jmp 0x10029afa
push 0
lea ecx, [ebp - 0x738]
call fcn.1000c297
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x550]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x738]
call fcn.1000c297
cmp dword [eax], 0
jl 0x10029c01
push 3
lea ecx, [ebp - 0x5e4]
call fcn.1000c1f9
mov byte [ebp - 4], 9
mov dword [ebp - 0x1b0], 0
jmp 0x10029b3a
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x10029b5c
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x5e4]
call fcn.1000c297
mov dword [eax], 0x10f7a73
jmp 0x10029b2d
push 0
lea ecx, [ebp - 0x5e4]
call fcn.1000c297
and dword [eax], 0
jmp 0x10029b92
push 0
lea ecx, [ebp - 0x5e4]
call fcn.1000c297
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x5e4]
call fcn.1000c297
cmp dword [eax], 2
jg 0x10029bba
mov dword [ebp - 0x604], 0x43ac
mov dword [ebp - 0x604], 0x5021c3a2
jmp 0x10029b6e
push 0
lea ecx, [ebp - 0x738]
call fcn.1000c297
push dword [eax]
lea ecx, [ebp - 0x894]
call fcn.1000c297
cmp dword [eax], 0
je 0x10029bed
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5e4]
call fcn.1000c27b
jmp 0x10029ad6
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5e4]
call fcn.1000c27b
jmp 0x10029ad6
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x990]
call fcn.1000c27b
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x738]
call fcn.1000c27b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call fcn.1000c27b
mov dword [ebp - 0x138], 0x831713b9
mov dword [ebp - 0x138], 0
jmp 0x10029c51
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xfffffffe
jne 0x10029d75
mov dword [ebp - 0x140], 0xfffffff7
push 2
lea ecx, [ebp - 0x9a0]
call fcn.1000c1f9
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x178], 0
jmp 0x10029c95
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x10029cb7
push dword [ebp - 0x178]
lea ecx, [ebp - 0x9a0]
call fcn.1000c297
mov dword [eax], 1
jmp 0x10029c88
mov dword [ebp - 0x140], 0xffffffec
jmp 0x10029cd0
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xfffffff1
je 0x10029d61
push 3
lea ecx, [ebp - 0x8ac]
call fcn.1000c1f9
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x198], 0
jmp 0x10029d07
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x10029d29
push dword [ebp - 0x198]
lea ecx, [ebp - 0x8ac]
call fcn.1000c297
mov dword [eax], 0xfffffffd
jmp 0x10029cfa
push 1
lea ecx, [ebp - 0x8ac]
call fcn.1000c297
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x440]
mov dword [ecx], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x8ac]
call fcn.1000c27b
jmp 0x10029cc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.1000c27b
jmp 0x10029c44
mov dword [ebp - 0x8bc], 0x2d5e48d3
mov dword [ebp - 0x8b8], 0x2d5e48d3
mov dword [ebp - 0x8b4], 0x2d5e48d3
mov dword [ebp - 0x8b0], 0x2d5e48d3
mov dword [ebp - 0xb4], 0x52061f6
push 2
lea ecx, [ebp - 0x760]
call fcn.1000c1f9