Function at 0x1002b460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x100b7040]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
mov esi, ecx
mov dword [esp + 0x24], 0x706d581f
push edi
mov dword [esp + 0x18], esi
mov dl, 0x1f
mov dword [esp + 0x2c], 0x53406f6a
xor ecx, ecx
mov dword [esp + 0x30], 0x71567870
mov byte [esp + 0x34], 0
nop dword [eax]
lea eax, [esp + 0x29]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x1002b4b3
mov dl, byte [esp + 0x28]
jmp 0x1002b4a0
xorps xmm0, xmm0
mov byte [esp + 0x34], 0
lea ecx, [esp + 0x29]
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
lea edx, [ecx + 1]
mov dword [esp + 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002b4d7
sub ecx, edx
lea eax, [esp + 0x29]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi]
mov dword [esp + 0x20], edi
je 0x1002b576
test edi, edi
je 0x1002b576
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002b576
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002b572
nop dword [eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002b52d
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002b559
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002b53f
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002b5a9
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002b56a
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002b520
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x58], edi
cmp ecx, 0xf
jbe 0x1002b5b9
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002b5af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c129
jmp 0x1002b5af
mov esi, dword [esp + 0x18]
jmp 0x1002b578
push ecx
push edx
call fcn.100810d6
add esp, 8
mov byte [esp + 0x70], 0x12
mov al, 0x57
xor al, byte [esp + 0x70]
mov cl, 0x76
mov byte [esp + 0x71], al
mov dl, 0x7b
mov al, byte [esp + 0x70]
mov ch, 0x4d
mov dh, 0x5b
mov byte [esp + 0x17], 0x56
xor cl, al
mov byte [esp + 0x78], 0
xor dl, al
mov byte [esp + 0x72], cl
xor ch, al
mov byte [esp + 0x73], dl
xor dh, al
mov byte [esp + 0x75], ch
mov ah, 0x66
mov byte [esp + 0x76], dh
xor ah, al
mov byte [esp + 0x78], 0
mov al, byte [esp + 0x17]
lea ecx, [esp + 0x71]
xor al, byte [esp + 0x70]
lea edx, [ecx + 1]
xorps xmm0, xmm0
mov byte [esp + 0x74], ah
mov byte [esp + 0x77], al
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002b630
sub ecx, edx
lea eax, [esp + 0x71]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi + 0x58]
mov dword [esp + 0x20], edi
je 0x1002b6cd
test edi, edi
je 0x1002b6cd
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002b6cd
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002b6c9
cmp esi, dword [edi + 0xc4]
jne 0x1002b684
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002b6b0
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002b696
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002b700
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002b6c1
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002b677
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x5c], edi
cmp ecx, 0xf
jbe 0x1002b710
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002b706
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c12e
jmp 0x1002b706
mov esi, dword [esp + 0x18]
jmp 0x1002b6cf
push ecx
push edx
call fcn.100810d6
add esp, 8
mov byte [esp + 0x70], 0x3d
mov al, 0x78
xor al, byte [esp + 0x70]
mov cl, 0x59
mov byte [esp + 0x71], al
mov dl, 0x54
mov al, byte [esp + 0x70]
mov ch, 0x62
mov dh, 0x6d
mov byte [esp + 0x17], 0x6a
xor cl, al
mov byte [esp + 0x78], 0
xor dl, al
mov byte [esp + 0x72], cl
xor ch, al
mov byte [esp + 0x73], dl
xor dh, al
mov byte [esp + 0x75], ch
mov ah, 0x49
mov byte [esp + 0x76], dh
xor ah, al
mov byte [esp + 0x78], 0
mov al, byte [esp + 0x17]
lea ecx, [esp + 0x71]
xor al, byte [esp + 0x70]
lea edx, [ecx + 1]
xorps xmm0, xmm0
mov byte [esp + 0x74], ah
mov byte [esp + 0x77], al
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002b785
sub ecx, edx
lea eax, [esp + 0x71]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi + 0x58]
mov dword [esp + 0x20], edi
je 0x1002b826
test edi, edi
je 0x1002b826
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002b826
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002b822
nop dword [eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002b7dd
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002b809
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002b7ef
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002b859
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002b81a
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002b7d0
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x60], edi
cmp ecx, 0xf
jbe 0x1002b869
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002b85f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c133
jmp 0x1002b85f
mov esi, dword [esp + 0x18]
jmp 0x1002b828
push ecx
push edx
call fcn.100810d6
add esp, 8
mov byte [esp + 0x70], 0x73
mov al, 0x11
xor al, byte [esp + 0x70]
mov cl, 7
mov ch, 0x1c
mov byte [esp + 0x71], al
mov al, byte [esp + 0x70]
mov dl, 0x1d
xor cl, al
mov byte [esp + 0x77], 0
xor ch, al
mov byte [esp + 0x72], cl
mov ah, 0x2c
mov byte [esp + 0x75], ch
mov dh, 0x18
mov byte [esp + 0x77], 0
xor dl, al
mov dword [esp + 0x50], 0
xor ah, al
mov byte [esp + 0x73], dl
xor dh, al
mov byte [esp + 0x74], ah
xorps xmm0, xmm0
mov byte [esp + 0x76], dh
lea ecx, [esp + 0x71]
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x54], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002b8d0
sub ecx, edx
lea eax, [esp + 0x71]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
mov ecx, dword [esi + 0x58]
lea edx, [esp + 0x40]
call fcn.10017ca0
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x64], eax
cmp ecx, 0xf
jbe 0x1002b92d
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002b923
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c138
push ecx
push edx
call fcn.100810d6
add esp, 8
mov dl, 0x11
mov dword [esp + 0x28], 0x7f657311
mov dword [esp + 0x2c], 0x7c74634e
xor ecx, ecx
mov dword [esp + 0x30], 0x74737c74
mov word [esp + 0x34], 0x63
lea eax, [esp + 0x29]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x1002b963
mov dl, byte [esp + 0x28]
jmp 0x1002b950
xorps xmm0, xmm0
mov byte [esp + 0x35], 0
lea ecx, [esp + 0x29]
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
lea edx, [ecx + 1]
mov dword [esp + 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002b987
sub ecx, edx
lea eax, [esp + 0x29]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi + 0x58]
mov dword [esp + 0x20], edi
je 0x1002ba26
test edi, edi
je 0x1002ba26
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002ba26
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002ba22
nop
cmp esi, dword [edi + 0xc4]
jne 0x1002b9dd
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002ba09
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002b9ef
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002ba59
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002ba1a
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002b9d0
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x68], edi
cmp ecx, 0xf
jbe 0x1002ba69
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ba5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c13d
jmp 0x1002ba5f
mov esi, dword [esp + 0x18]
jmp 0x1002ba28
push ecx
push edx
call fcn.100810d6
add esp, 8
cmp dword [0x100b8fbc], 0
je 0x1002bad5
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002ba93
mov eax, dword [0x100b8f78]
dec eax
cmp eax, 0x14
ja 0x1002ba93
push 1
mov edx, 0x100b8f68
call fcn.10017da0
add esp, 4
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x1002bab4
mov eax, dword [0x100b8f90]
dec eax
cmp eax, 0x2f
ja 0x1002bab4
push 0
mov edx, 0x100b8f80
call fcn.10017da0
add esp, 4
mov edi, dword [esi + 0x68]
test edi, edi
je 0x1002bad5
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bad5
lea ecx, [edi + 0xd0]
mov dl, 3
call fcn.10018350
movaps xmm0, xmmword [0x100af0b0]
xor ecx, ecx
movups xmmword [esp + 0x28], xmm0
mov dword [esp + 0x38], 0x6a6b042f
mov byte [esp + 0x3c], 0
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0x13
jb 0x1002baf0
xorps xmm0, xmm0
mov byte [esp + 0x3c], 0
lea ecx, [esp + 0x29]
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
lea edx, [ecx + 1]
mov dword [esp + 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bb22
sub ecx, edx
lea eax, [esp + 0x29]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi]
mov dword [esp + 0x20], edi
je 0x1002bbbe
test edi, edi
je 0x1002bbbe
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bbbe
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002bbba
cmp esi, dword [edi + 0xc4]
jne 0x1002bb75
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002bba1
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bb87
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002bbf1
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002bbb2
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002bb68
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x6c], edi
cmp ecx, 0xf
jbe 0x1002bc01
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002bbf7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c142
jmp 0x1002bbf7
mov esi, dword [esp + 0x18]
jmp 0x1002bbc0
push ecx
push edx
call fcn.100810d6
add esp, 8
mov al, 1
mov byte [esp + 0x17], al
movzx edi, al
mov cl, 0x1f
mov ch, cl
mov byte [esp + 0x28], 0x7a
xor cl, byte [esp + 0x28]
mov al, 9
xor al, byte [esp + 0x28]
mov dl, 8
mov byte [esp + 0x29], al
mov dh, dl
mov byte [esp + 0x2a], cl
mov ah, 0xc
mov cl, byte [esp + 0x28]
xorps xmm0, xmm0
mov byte [esp + 0x6e], 0x25
xor dl, cl
mov al, byte [esp + 0x6e]
xor ah, cl
xor al, cl
mov byte [esp + 0x6f], 0x5f
mov byte [esp + 0x2f], al
xor dh, cl
mov al, byte [esp + 0x6f]
xor ch, cl
xor al, cl
mov byte [esp + 0x27], 0x1e
mov byte [esp + 0x30], al
mov al, byte [esp + 0x27]
xor al, cl
mov byte [esp + 0x2b], dl
push edi
sub esp, 0x18
mov byte [esp + 0x4a], dh
mov edx, esp
mov byte [esp + 0x49], ch
lea ecx, [esp + 0x45]
mov byte [esp + 0x48], ah
mov byte [esp + 0x4d], al
lea eax, [ecx + 1]
mov byte [esp + 0x4e], 0
movups xmmword [edx], xmm0
mov byte [esp + 0x4e], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [esp + 0x3c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bca3
sub ecx, dword [esp + 0x3c]
lea eax, [esp + 0x45]
push ecx
push eax
mov ecx, edx
call fcn.10002580
lea eax, [esp + 0x5c]
push eax
call fcn.1000a310
mov ecx, dword [esi + 0x6c]
add esp, 0x20
mov edx, eax
call fcn.10017ca0
mov ecx, dword [esp + 0x54]
mov dword [esi + edi*4 + 4], eax
cmp ecx, 0xf
jbe 0x1002bd0c
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002bd02
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c129
push ecx
push edx
call fcn.100810d6
add esp, 8
mov al, byte [esp + 0x17]
inc al
mov byte [esp + 0x17], al
cmp al, 0x14
jbe 0x1002bc07
mov byte [esp + 0x70], 0x2d
mov al, 0x7d
xor al, byte [esp + 0x70]
mov ah, 0x40
mov byte [esp + 0x71], al
mov cl, 0x5f
mov al, byte [esp + 0x70]
mov dl, 0x48
mov ch, 0x44
mov byte [esp + 0x27], ah
mov dh, 0x58
mov byte [esp + 0x78], 0
xor cl, al
mov byte [esp + 0x78], 0
xor dl, al
mov byte [esp + 0x72], cl
xor ch, al
mov byte [esp + 0x73], dl
xor dh, al
mov byte [esp + 0x75], ch
xor ah, al
mov byte [esp + 0x76], dh
mov al, byte [esp + 0x27]
lea ecx, [esp + 0x71]
xor al, byte [esp + 0x70]
lea edx, [ecx + 1]
xorps xmm0, xmm0
mov byte [esp + 0x74], ah
mov byte [esp + 0x77], al
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bd92
sub ecx, edx
lea eax, [esp + 0x71]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi]
mov dword [esp + 0x20], edi
je 0x1002be2e
test edi, edi
je 0x1002be2e
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002be2e
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002be2a
cmp esi, dword [edi + 0xc4]
jne 0x1002bde5
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002be11
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bdf7
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002be61
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002be22
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002bdd8
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x70], edi
cmp ecx, 0xf
jbe 0x1002be71
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002be67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c147
jmp 0x1002be67
mov esi, dword [esp + 0x18]
jmp 0x1002be30
push ecx
push edx
call fcn.100810d6
add esp, 8
movaps xmm0, xmmword [str._vLydTbe]
xor ecx, ecx
movups xmmword [esp + 0x28], xmm0
mov dword [esp + 0x38], 0x656462
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0x12
jb 0x1002be87
xorps xmm0, xmm0
mov byte [esp + 0x3b], 0
lea ecx, [esp + 0x29]
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0
lea edx, [ecx + 1]
mov dword [esp + 0x54], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bec0
sub ecx, edx
lea eax, [esp + 0x29]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10002580
cmp dword [esp + 0x50], 0
mov edi, dword [esi]
mov dword [esp + 0x20], edi
je 0x1002bf5c
test edi, edi
je 0x1002bf5c
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bf5c
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002bf58
cmp esi, dword [edi + 0xc4]
jne 0x1002bf13
call fcn.1008625f
mov edi, dword [esi + 8]
test edi, edi
je 0x1002bf3f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bf25
mov ecx, dword [ecx]
cmp dword [esp + 0x54], 0xf
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002bf8f
mov edi, dword [esp + 0x20]
cmp esi, dword [edi + 0xc4]
jne 0x1002bf50
call fcn.1008625f
mov esi, dword [esi]
cmp esi, dword [esp + 0x1c]
jne 0x1002bf06
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x54], edi
cmp ecx, 0xf
jbe 0x1002bf9f
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002bf95
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c14c
jmp 0x1002bf95
mov esi, dword [esp + 0x18]
jmp 0x1002bf5e
push ecx
push edx
call fcn.100810d6
add esp, 8
mov eax, dword [0xc20bb0]
mov ecx, dword [0xc20bac]
mov edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x54]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1002bfe2
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bfe2
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xe4]
sub eax, dword [ecx + 0xdc]
mov dword [esp + 0x1c], eax
jmp 0x1002bfea
mov dword [esp + 0x1c], 0
mov eax, dword [esi + 0x54]
mov dword [esp + 0x70], eax
test eax, eax
je 0x1002c012
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c012
sub edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x70]
push eax
push edi
call dword [0x100ae50c]
mov edi, dword [esi + 0x58]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
test edi, edi
je 0x1002c043
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c043
lea eax, [esp + 0x70]
mov ecx, edi
push eax
call dword [0x100ae508]
mov edi, dword [esi + 0x58]
test edi, edi
je 0x1002c065
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c065
mov eax, dword [edi + 0xe8]
sub eax, dword [edi + 0xe0]
jmp 0x1002c067
xor eax, eax
sub dword [esp + 0x18], eax
mov edi, dword [esi + 0x58]
test edi, edi
je 0x1002c08f
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c08f
push dword [esp + 0x18]
mov ecx, edi
push dword [esp + 0x74]
call dword [0x100ae50c]
mov edi, dword [esi + 0x6c]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
test edi, edi
je 0x1002c0c0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c0c0
lea eax, [esp + 0x70]
mov ecx, edi
push eax
call dword [0x100ae508]
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x1002c0de
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c0de
push eax
push eax
mov ecx, edi
call dword [0x100ae50c]
mov eax, dword [esi + 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1002c0f0
push 4
push eax
call edi
mov esi, dword [esi + 0x70]
test esi, esi
je 0x1002c118
push 4
push esi
call edi
test eax, eax
jne 0x1002c118
push eax
mov eax, dword [esp + 0x24]
mov ecx, esi
cdq
sub eax, edx
sar eax, 1
sub eax, 0x201
push eax
call dword [0x100ae50c]
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor ecx, esp
call fcn.10081075
mov esp, ebp
pop ebp
ret
call fcn.1008626f
call fcn.1008626f
call fcn.1008626f
call fcn.1008626f
call fcn.1008626f
call fcn.1008626f
call fcn.1008626f
call fcn.1008626f
int3