Function at 0x4299f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45a1e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ecx
mov dword [0x4a1af4], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x34], 1
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x4a1e24]
mov ecx, 0x4a1e24
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x38], eax
mov eax, dword [0x4a1de4]
push 0xc2
push eax
mov byte [esp + 0x38], 2
call dword [sym.imp.USER32.dll_LoadMenuA]
push ebp
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.004285a0
mov edi, dword [eax]
mov edx, esi
imul edx, edx, 0x124
add edx, 0x49d4d4
push edx
add esi, 0xfffffff8
push esi
lea eax, [esp + 0x40]
push 0x45eda4
push eax
mov dword [esp + 0x28], edi
call fcn.00412d20
mov ebx, dword [esp + 0x48]
add esp, 0x10
push ebx
push 0x800a
push ebp
push 0x800a
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
push 2
push 0x800a
push edi
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ebp, 0x8011
mov esi, 0x49c1a8
mov dword [esp + 0x10], 5
cmp dword [esi + 0x64], 1
jne 0x429b18
mov ecx, dword [esi]
mov edx, dword [esi - 4]
mov eax, dword [esi + 0x14]
push ecx
push edx
push eax
lea ecx, [esi + 0x40]
push ecx
lea edx, [ebp - 0x8010]
push edx
lea eax, [esp + 0x4c]
push 0x45ed88
push eax
call fcn.00412d20
mov ebx, dword [esp + 0x54]
add esp, 0x1c
push ebx
push ebp
push 0
push ebp
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
jmp 0x429b22
push 1
push ebp
push edi
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [esp + 0x10]
add esi, 0x3b0
inc ebp
dec eax
mov dword [esp + 0x10], eax
jne 0x429ad8
cmp word [0x4a14f4], 1
jne 0x429bc5
mov dword [esp + 0x10], 0
mov ebp, 0x8016
mov esi, 0x49c0ac
mov ecx, dword [esp + 0x10]
cmp dword [0x4a144c], ecx
je 0x429baf
cmp dword [esi - 0x14], 1
jne 0x429ba4
mov edx, dword [esi]
mov eax, dword [esi - 4]
mov ecx, dword [esi - 8]
push edx
mov edx, dword [esi - 0xc]
push eax
push ecx
push edx
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x8015]
push ecx
lea edx, [esp + 0x50]
push 0x45ed64
push edx
call fcn.00412d20
mov ebx, dword [esp + 0x58]
add esp, 0x20
push ebx
push ebp
push 0
push ebp
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
jmp 0x429bae
push 1
push ebp
push edi
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc ebp
mov edx, dword [esp + 0x10]
inc edx
add esi, 0x34
cmp esi, 0x49c1b0
mov dword [esp + 0x10], edx
jl 0x429b54
jmp 0x429bda
push 0x45ed54
push 3
push 0x401
push 3
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push eax
push 0
push ecx
push edx
push 0x42
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
add ebx, 0xfffffff0
mov byte [esp + 0x30], 1
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429c18
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov eax, dword [esp + 0x14]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x429c2b
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4