Function at 0x1002905b
Capabilities:
Identify system language via api
Modify service

Disassembly:
mov eax, 0x1005cc2a
call fcn.1005b9d8
sub esp, 0x100
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0x14], cl
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], esi
cmp byte [ebp + 8], bl
je 0x100295d9
cmp byte [ebp + 0x1c], bl
je 0x1002922f
mov dword [ebp + 8], 0x617e
cmp dword [ebp + 8], 0x62a4
jle 0x100290ea
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x10c]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100290c0
mov eax, dword [eax]
push eax
call fcn.1004434f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x10c]
call fcn.100035c0
inc edi
cmp edi, 0xe5d
jl 0x100290a1
inc esi
cmp esi, 0x363c
jl 0x1002909f
mov esi, dword [ebp - 0x40]
cmp dword [ebp + 8], 0x5eae
jge 0x100290fe
push str.jlqvyuxru_vvory_hwn_vmg_ryqmhlb_dhxuyla_etlk_rexqnt_uyhzpbv_yzpgenuw
call fcn.1004434f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x38], ebx
call fcn.10028007
mov edx, esi
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.10028007
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x64]
sub eax, dword [ebp - 0x70]
sar ecx, 2
sar eax, 2
mov dword [ebp - 0x1c], ebx
cmp eax, ecx
jbe 0x10029175
lea eax, [ebp - 0x1c]
push eax
push ecx
push 0x7744
push 1
push ecx
lea ecx, [ebp - 0x70]
call fcn.10028d05
add esp, 0x14
lea eax, [ebp - 0x18]
push 0x43ec
push eax
push ecx
push ecx
lea eax, [ebp - 0x64]
push eax
push ecx
push 1
lea ecx, [ebp - 0x1c]
call fcn.10028d2f
add esp, 0x1c
jmp 0x100291bb
push 0x6db6
lea eax, [ebp - 0x64]
mov edx, 0x6a26
push eax
push ecx
push 1
lea eax, [ebp - 0x1c]
mov ecx, 0x2cfa
push eax
push 0xd47
call fcn.10028d76
add esp, 0x14
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x70]
push eax
push ecx
push 1
push 0x3d5d
push 0x177
lea ecx, [ebp - 0x18]
call fcn.10028ea2
add esp, 0x18
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], ebx
jle 0x10029215
test ebx, ebx
jne 0x10029215
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x583f
lea eax, [ebp - 0x18]
push eax
push 0x24dd
push ecx
lea eax, [ebp - 0x64]
mov cl, 1
push eax
call fcn.1002a63a
add esp, 0x14
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x38]
push 1
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.1002a7a9
mov eax, dword [ebp - 0x18]
add esp, 0x18
mov ebx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jl 0x100291c4
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x64]
mov dword [eax], ebx
call fcn.1002bb63
lea ecx, [ebp - 0x70]
call fcn.1002bb63
jmp 0x100296d0
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 4
cmp dword [edi + 0x10], ebx
je 0x100295bf
push 0x2e
pop eax
push 2
mov dword [ebp - 0x34], 0x7904cb00
mov ecx, ebx
mov word [ebp - 0x30], 0x2517
mov byte [ebp - 0x2e], 0xb1
mov word [ebp - 0x20], ax
pop esi
cmp esi, 2
jne 0x1002927d
push 5
pop ecx
push ecx
pop esi
jmp 0x100292a4
movzx edx, byte [ebp + esi - 0x33]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x36]
movzx eax, word [ebp + eax*2 - 0x20]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x34]
mov word [ebp + eax*2 - 0x20], cx
mov ecx, ebx
add esi, 2
cmp esi, 7
jb 0x10029271
xor eax, eax
mov dword [ebp - 0xc8], 7
mov word [ebp - 0x1e], ax
lea ecx, [ebp - 0xdc]
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xcc], ebx
call fcn.100036ac
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 5
push eax
mov edx, edi
lea ecx, [ebp - 0x58]
call fcn.1002776b
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 7
call fcn.10003acb
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x58]
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x20], ebx
test eax, eax
jne 0x10029597
mov dword [ebp + 8], 0x2355
cmp dword [ebp + 8], 0x678
jge 0x10029492
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push str._ld__ld
call fcn.100462b6
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x8c]
add esp, 0xc
inc eax
push eax
call fcn.1002b936
push 2
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2c]
pop eax
mov dword [ebp - 0x48], eax
cmp ecx, eax
jl 0x10029398
lea eax, [ebp - 0x9c]
push eax
push 0x10066f3c
call fcn.100462b6
pop ecx
pop ecx
imul ecx, dword [ebp - 0x9c], 0xc
lea eax, [ebp - 0x48]
push eax
add ecx, dword [ebp - 0x8c]
call fcn.1002b8e3
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x48], eax
cmp eax, ecx
jle 0x10029361
xor edi, edi
inc edi
cmp ecx, edi
jl 0x100293d5
push 0xc
pop esi
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 0xa8], bl
push dword [ebp - 0xa8]
mov edx, dword [esi + ecx + 4]
mov eax, edx
mov ecx, dword [esi + ecx]
sub eax, ecx
sar eax, 2
push eax
call fcn.1002c013
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
lea esi, [esi + 0xc]
inc edi
cmp edi, ecx
jle 0x100293a2
lea eax, [ecx + 1]
push eax
lea ecx, [ebp - 0xe8]
call fcn.10025322
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa0]
mov eax, dword [ebp - 0x2c]
push ecx
inc eax
mov dword [ebp - 0xa0], ebx
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
call fcn.1002bcd8
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 0xa
xor edx, edx
lea ecx, [ebp - 0x8c]
push eax
inc edx
call fcn.10028f86
pop ecx
jmp 0x10029462
dec eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0xa4]
push eax
push str._ld__ld
call fcn.100462b6
push dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x8c]
call fcn.10028ff4
push eax
push str._ld_n
call fcn.1004434f
add esp, 0x1c
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x10029424
dec eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x3c], eax
call fcn.100032b6
lea ecx, [ebp - 0xe8]
call fcn.100032b6
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
call fcn.1002bd6c
mov edi, dword [ebp + 0xc]
push 0x2d
pop eax
push 2
mov ecx, ebx
mov dword [ebp - 0x28], 0x9a03d900
mov word [ebp - 0x24], 0x9502
mov word [ebp - 0x44], ax
pop esi
mov dword [ebp - 0x4c], ecx
cmp esi, 2
jne 0x100294bd
push 4
pop ecx
push ecx
mov dword [ebp - 0x4c], ecx
pop esi
jmp 0x10029504
movzx edx, byte [ebp + esi - 0x27]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x2a]
movzx eax, word [ebp + eax*2 - 0x44]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x28]
mov word [ebp + eax*2 - 0x44], cx
lea eax, [ebp - 0x4c]
push eax
push 0x5d9e
push ecx
push ecx
push 0x1c09
push ecx
push ebx
mov ecx, 0x606f
call fcn.10028d2f
mov ecx, dword [ebp - 0x4c]
add esp, 0x1c
add esi, 2
cmp esi, 6
jb 0x100294ae
xor eax, eax
mov dword [ebp - 0xb0], 7
mov word [ebp - 0x42], ax
lea ecx, [ebp - 0xc4]
mov word [ebp - 0xc4], ax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0xb4], ebx
call fcn.100036ac
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0xb
push eax
mov edx, edi
lea ecx, [ebp - 0xf4]
call fcn.1002776b
pop ecx
mov esi, eax
lea eax, [ebp - 0x58]
cmp eax, esi
je 0x1002957a
mov ecx, eax
call fcn.1002ba8a
mov ecx, dword [esi]
mov dword [ebp - 0x58], ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x54], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x50], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [ebp - 0xf4]
call fcn.1002ba8a
push ebx
push 1
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 7
call fcn.10003acb
lea eax, [ebp - 0x98]
mov edx, 0x2b6d
push eax
sub esp, 0xc
lea ecx, [ebp - 0x58]
push 1
call fcn.10027e11
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.1002ba8a
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x98]
push eax
call fcn.1002b737
lea ecx, [ebp - 0x98]
jmp 0x10029225
mov dword [ebp - 0x40], 0x63fa
cmp dword [ebp - 0x40], 0x67aa
jle 0x1002965d
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, ebx
mov dword [ebp + 8], ebx
mov edi, ebx
mov eax, esi
mov dword [ebp - 0xac], ebx
cdq
idiv edi
mov esi, edx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10077e58
cdq
push edx
push eax
call fcn.100030bc
inc ebx
cmp ebx, 0x27a2
jl 0x10029609
mov esi, dword [ebp + 8]
inc edi
push 0
pop ebx
cmp edi, 0x1cb4
jl 0x100295fc
inc esi
mov dword [ebp + 8], esi
cmp esi, 0x875
jl 0x100295fa
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x10b
push 0x1167
push 0xbfc
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x40], 0x6318
jge 0x1002969a
mov edx, str.yjidz_gtubf_utf_wnpgpjqzq
mov ecx, 0x10077e58
call fcn.1000530a
jmp 0x1002969a
cmp byte [ebp - 0x14], 0
je 0x100296a8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x100296d0
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x100296d0
push ebx
push 0x24db
push 0xa15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret