Function at 0x10030bd1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10065f7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push ebx
xor ebx, ebx
mov dword [esp + 0xb4], edx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x20], 0xe13a6c9c
mov dword [esp + 0x18], 0xfffffff8
push esi
mov dword [esp + 0xc], 0xffffffff
xor esi, esi
mov dword [esp + 0x10], 0xbcb1a7a8
inc esi
mov dword [esp + 0x20], 0xc3fa
mov dword [esp + 0x18], esi
inc dword [esp + 0x6c]
push edi
mov dword [esp + 0xc0], ecx
je 0x10030c86
mov eax, dword [esp + 0x28]
cmp esi, eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x28]
jl 0x10030c61
mov eax, esi
cmp dword [esp + 0x28], ebx
jne 0x10030c63
mov eax, ebx
cmp eax, 3
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, 0x5018
setg cl
shl ecx, 3
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov edi, 0xffff
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x70]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, edi
jne 0x10030cd6
mov ecx, esi
cmp dword [esp + 0x20], ebx
jne 0x10030cd8
mov ecx, ebx
mov eax, dword [esp + 0x20]
imul eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x70]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x219f
setl al
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setg dl
cmp edx, dword [esp + 0x78]
je 0x10030d1c
mov eax, ebx
cmp dword [esp + 0x28], ebx
je 0x10030d1e
mov eax, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x36f914a1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xa964a90c
mov dword [esp + 0x10], ebx
jmp 0x10030d4c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x30], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10030d3c
mov dword [esp + 0x30], 5
jmp 0x10030e1f
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0x10], ebx
jmp 0x10030d94
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xe0], 0x364d64ea
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10030d81
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x10030db0
mov edx, esi
cmp dword [esp + 0x30], ebx
jne 0x10030db2
mov edx, ebx
mov eax, dword [esp + 0xac]
xor ecx, ecx
mov eax, dword [esp + 0x30]
add eax, 2
cmp eax, 0x7008b15e
setg cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
je 0x10030ddf
mov ecx, esi
cmp dword [esp + 0xb0], ebx
jne 0x10030de1
mov ecx, ebx
mov eax, esi
sub eax, ecx
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, dword [esp + 0xb4]
cmp edx, eax
mov eax, dword [esp + 0x30]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xac]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0xe4], ecx
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff2
push 4
pop ecx
jg 0x10030d5f
mov dword [esp + 0x14], 0x5c96dd1e
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0xa36a77d7
mov dword [esp + 0x28], 0xfffc
cmp dword [esp + 0x14], ebx
je 0x10031138
push 2
lea ecx, [esp + 0x90]
call fcn.10028987
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10030e89
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10030e76
mov dword [esp + 0x1c], 0x23e2
cmp dword [esp + 0x1c], 0xaac
jge 0x10031023
lea eax, [esp + 0xa4]
mov ecx, 0x10657790
push eax
call fcn.10027fdd
mov edi, dword [esp + 0xa4]
push edi
call fcn.10035703
test edi, edi
jle 0x10030ee1
mov eax, dword [0x113fa2d8]
mov ecx, 0x10657790
lea eax, [eax + ebx*4]
push eax
call fcn.10027fdd
inc ebx
cmp ebx, edi
jl 0x10030ec9
xorps xmm0, xmm0
mov ecx, esi
movlpd qword [0x1125a300], xmm0
cmp edi, esi
jl 0x10030f1f
mov ebx, dword [0x113fa2d8]
mov eax, dword [ebx]
lea ebx, [ebx + 4]
cdq
add eax, dword [ecx*8 + 0x1125a2f8]
mov dword [ecx*8 + 0x1125a300], eax
adc edx, dword [ecx*8 + 0x1125a2fc]
mov dword [ecx*8 + 0x1125a304], edx
inc ecx
cmp ecx, edi
jle 0x10030ef8
push dword [0x113fa2dc]
push dword [0x113fa2d8]
call fcn.1002c9f6
xorps xmm0, xmm0
movlpd qword [0x111964f0], xmm0
pop ecx
pop ecx
mov ecx, esi
cmp edi, esi
jl 0x10030f70
mov ebx, dword [0x113fa2d8]
mov eax, dword [ebx]
lea ebx, [ebx + 4]
cdq
add eax, dword [ecx*8 + 0x111964e8]
mov dword [ecx*8 + 0x111964f0], eax
adc edx, dword [ecx*8 + 0x111964ec]
mov dword [ecx*8 + 0x111964f4], edx
inc ecx
cmp ecx, edi
jle 0x10030f49
lea eax, [esp + 0x6c]
mov ebx, 0x10657790
push eax
mov ecx, ebx
call fcn.10027fdd
mov edi, dword [esp + 0x6c]
jmp 0x10031014
lea eax, [esp + 0x64]
dec edi
push eax
push ecx
lea eax, [esp + 0x70]
push eax
push ecx
lea eax, [esp + 0xd4]
mov ecx, ebx
push eax
call fcn.10027fdd
pop ecx
mov ecx, eax
call fcn.10027fdd
pop ecx
mov ecx, eax
call fcn.10027fdd
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
cmp dword [esp + 0xc4], esi
jne 0x10030fe5
mov edx, dword [eax*8 + 0x1125a300]
sub edx, dword [ecx*8 + 0x1125a2f8]
mov eax, dword [eax*8 + 0x1125a304]
sbb eax, dword [ecx*8 + 0x1125a2fc]
jmp 0x10031001
mov edx, dword [eax*8 + 0x111964f0]
sub edx, dword [ecx*8 + 0x111964e8]
mov eax, dword [eax*8 + 0x111964f4]
sbb eax, dword [ecx*8 + 0x111964ec]
push eax
push edx
mov ecx, 0x106576d8
call fcn.10028865
push eax
call fcn.1002c976
pop ecx
test edi, edi
jne 0x10030f8a
dec edi
xor ebx, ebx
mov dword [esp + 0x6c], edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10031045
push 0x188e
push 0x369
push ebx
push 0x1fce
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov dword [esp + 0x14], 0x17
cmp dword [esp + 0x14], 0x10
jge 0x100310c4
mov edi, dword [esp + 0x8c]
mov dword [esp + 0x10], 0xfffffffd
cmp dword [edi + 4], ebx
je 0x10031081
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10031089
push 0xa37
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp 0x10031089
mov dword [esp + 0x24], 0xbef7d651
mov dword [esp + 0x1c], ebx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
cmp eax, 0x4938
mov eax, dword [esp + 0x14]
setg cl
imul ecx, eax
mov dword [edi + 4], ecx
mov dword [esp + 0x1c], ecx
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jl 0x1003105b
or dword [esp + 0xfc], 0xffffffff
cmp dword [esp + 0x8c], 0
je 0x100310f8
push dword [esp + 0x8c]
call fcn.1004e319
pop ecx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov edi, 0xffff
mov dword [esp + 0x2c], 0xa684
call fcn.100309b3
mov dword [esp + 0x14], 5
mov dword [esp + 0x1c], 0x813f1a07
mov dword [esp + 0x20], 0x2a3cc92e
mov dword [esp + 0x3c], 0xfff9
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x10], ebx
jmp 0x1003115d
mov dword [esp + 0x1c], 0xe520c3d8
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
jmp 0x100310fd
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc8], 0xc017f215
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003114a
mov dword [esp + 0x14], 0xffffffed
cmp dword [esp + 0x14], 0xfffffff7
je 0x10031291
mov dword [esp + 0x10], 0x161ab6ec
mov dword [esp + 0x24], 0x91e66c61
mov dword [esp + 0x28], 0x5e2de4bf
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0xfffa
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x24]
inc eax
add eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
add eax, 2
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x2c]
cmp eax, 0x4d33
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, 0xf314
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0xd0]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xd0]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x28]
setl bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffffa
mov ecx, 0xac411777
setne al
imul eax, dword [esp + 0x20]
cmp edi, eax
sbb eax, eax
add eax, 0x2ed5bb0d
cmp ecx, eax
sbb edx, edx
neg edx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
add edx, 0x9255c21f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0xd0], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
jne 0x10031177
xor ebx, ebx
mov dword [esp + 0x14], 0xfffffffd
mov dword [esp + 0x14], ebx
jmp 0x100312b2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xd4], 0x20624039
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1003129f
mov dword [esp + 0x14], ebx
jmp 0x100312cf
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100312bf
mov dword [esp + 0x14], ebx
jmp 0x10031473
mov dword [esp + 0x20], 0x76ff55e0
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100312f8
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], ebx
jl 0x1003146f
mov dword [esp + 0x10], ebx
jmp 0x1003131c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10031310
mov dword [esp + 0x2c], 0x1ddc
cmp dword [esp + 0x2c], 0xf20
jge 0x100313ac
push 0x11195fc4
push 0x10007acc
call fcn.1004d62b
pop ecx
pop ecx
push 4
pop esi
mov ebx, esi
mov edi, esi
lea eax, [esp + 0x37]
push eax
push 0x10007fac
call fcn.1004d62b
mov al, byte [esp + 0x3f]
pop ecx
pop ecx
cmp al, 0x2e
je 0x10031370
movsx eax, al
inc dword [eax*4 + 0x1125a210]
dec edi
jne 0x1003134d
dec ebx
jne 0x1003134b
xor esi, esi
mov edi, 0x1125a2d0
inc esi
mov eax, dword [0x11195fc4]
add eax, eax
cmp eax, dword [edi]
jge 0x10031394
push 0x10007c3c
call fcn.1004e532
pop ecx
add edi, 4
cmp edi, 0x1125a2f8
jl 0x1003137e
push 0x10007c40
call fcn.1004e532
pop ecx
xor ebx, ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100313c3
push 0xb9e
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [esp + 0x54], ebx
jmp 0x1003145a
push esi
lea ecx, [esp + 0x48]
call fcn.10028987
mov dword [esp + 0x10], ebx
jmp 0x100313ef
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov dword [eax + ecx*4], 0x3aeb5900
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100313dc
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov dword [eax], 8
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
cmp dword [eax], ebx
mov eax, dword [esp + 0xdc]
setne cl
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x40]
cmp ecx, eax
mov eax, dword [esp + 0x54]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setne cl
mov dword [esp + eax*4 + 0xd4], ecx
cmp dword [esp + 0x40], ebx
push dword [esp + 0x44]
call fcn.1004e319
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
inc dword [esp + 0x58]
pop ecx
cmp dword [esp + 0x54], 2
jle 0x100313cc
dec dword [esp + 0x20]
jns 0x1003130a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x100312de
mov dword [esp + 0x14], ebx
jmp 0x100314ba
mov dword [esp + 0x10], 0x7f5aee0c
mov dword [esp + 0x10], ebx
jmp 0x100314af
cmp dword [esp + 0x40], ebx
jne 0x100314b6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100314ab
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffb
jne 0x10031492
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffef
jne 0x10031484
push 4
mov byte [esp + 0x1f], bl
lea ecx, [esp + 0x84]
pop edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], 0x256915a1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], 0x7bf5cd53
mov dword [esp + 0x14], 0xfffffff8
push 2
call fcn.10028987
push esi
lea ecx, [esp + 0x9c]
mov dword [esp + 0x100], esi
call fcn.10028987
mov byte [esp + 0xfc], 2
mov dword [esp + 0x2c], 0xde726f2c
mov dword [esp + 0x24], 0x1140ae77
mov dword [esp + 0x3c], 0x9140
mov dword [esp + 0x14], ebx
jmp 0x1003154a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0x6deec541
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10031534
mov dword [esp + 0x14], ebx
jmp 0x1003156d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xfffb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10031557
mov dword [esp + 0x2c], 0x1958
cmp dword [esp + 0x2c], 0xf8d
jge 0x1003164e
lea eax, [esp + 0x58]
mov dword [esp + 0x38], ebx
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x5c], ebx
push eax
push 0x10007b28
call fcn.1004d62b
mov eax, dword [esp + 0x44]
xor ecx, ecx
add esp, 0xc
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100473e4
mov edi, eax
mov dword [esp + 0x60], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x64], ebx
pop ecx
test eax, eax
jle 0x100315fc
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x60]
push eax
push 0x10007b28
call fcn.1004d62b
imul eax, dword [esp + 0x68], 0x14
add esp, 0xc
sub eax, dword [esp + 0x60]
mov dword [edi + ebx*4], eax
inc ebx
mov eax, dword [esp + 0x38]
cmp ebx, eax
jl 0x100315d0
lea edx, [edi + eax*4]
mov byte [esp + 0xa8], 0
push dword [esp + 0xa8]
mov eax, edx
mov ecx, edi
sub eax, edi
sar eax, 2
push eax
call fcn.1002e019
mov edx, dword [esp + 0x40]
mov eax, edx
sub eax, dword [esp + 0x60]
pop ecx
pop ecx
xor ecx, ecx
mov ebx, dword [edi + eax*4]
xor eax, eax
test edx, edx
jle 0x1003163f
cmp dword [edi + eax*4], ebx
jne 0x1003163a
inc ecx
inc eax
cmp eax, edx
jl 0x10031634
push ecx
push 0x10007b04
call fcn.1004dfbc
pop ecx
pop ecx
xor ebx, ebx
mov eax, dword [esp + 0x98]
dec dword [eax]
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
neg eax
cmp eax, 0xd4f509e1
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, 0x5fef4072
mov eax, dword [esp + 0x80]
setle cl
imul ecx, dword [eax]
test ecx, ecx
jne 0x1003168e
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x80]
mov dword [eax], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], 0xed46
cmp dword [esp + 0x20], ebx
jne 0x100316b9
mov eax, esi
cmp dword [esp + 0x10], ebx
jne 0x100316bb
mov eax, ebx
mov ecx, dword [esp + 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0xfffffff9
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1521
setle al
cmp eax, dword [esp + 0x10]
jne 0x100316e6
mov ecx, ebx
cmp dword [esp + 0x24], ebx
je 0x100316e8
mov ecx, esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
je 0x10031718
cmp dword [esp + 0x3c], ebx
jne 0x1003171a
mov esi, ebx
push dword [esp + 0x98]
mov dword [esp + 0x20], esi
call fcn.1004e319
or dword [esp + 0x100], 0xffffffff
pop ecx
push dword [esp + 0x80]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
call fcn.1004e319
cmp byte [esp + 0x1f], 0
pop ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
je 0x100317be
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], 0x12
jmp 0x100317ab
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0x3c], 5
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x1c]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 6
jne 0x1003178b
push 0x2639
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov eax, dword [esp + 0xbc]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0xc0]
mov edi, edx
mov esi, eax
call fcn.1003086f
mov ecx, dword [esp + 0xf4]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret