Function at 0x1002e1d0
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bab38
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e50d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea edx, [esi + 0xccc]
mov ecx, dword [esi + 0x754]
mov word [esi + 8], 1
mov byte [esi + 0xc], 0
mov eax, dword [ebx + 4]
mov dword [ecx + 0x54], eax
lea ecx, [ebx + 0xccc]
mov eax, dword [ebx + 0x2c]
lea edi, [ecx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0xcb0]
mov dword [esi + 0xcb0], eax
mov eax, dword [ebx + 0xcb4]
mov dword [esi + 0xcb4], eax
mov eax, dword [ebx + 0xcb8]
mov dword [esi + 0xcb8], eax
mov eax, dword [ebx + 0xcbc]
mov dword [esi + 0xcbc], eax
mov eax, dword [ebx + 0xcc0]
mov dword [esi + 0xcc0], eax
mov eax, dword [ebx + 0xcc4]
mov dword [esi + 0xcc4], eax
movzx eax, byte [ebx + 0xcc8]
mov byte [esi + 0xcc8], al
movzx eax, byte [ebx + 0xcc9]
mov byte [esi + 0xcc9], al
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
movzx eax, byte [ecx + 0xc]
mov byte [edx + 0xc], al
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x20]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x24]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x28]
mov dword [edx + 0x28], eax
sub edx, ecx
mov eax, 2
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
lea ecx, [edx + edi]
cmp ecx, edi
je 0x1002e301
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x1002e2f2
mov eax, dword [edi]
push dword [edi + 0x10]
push eax
call fcn.1000ecc0
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x50]
add edi, 0x18
sub eax, 1
mov dword [ebp - 0x4c], eax
jne 0x1002e2e1
movzx eax, byte [ebx + 0xd28]
lea ecx, [ebp - 0x17]
mov byte [esi + 0xd28], al
mov eax, dword [ebx + 0xd2c]
mov dword [esi + 0xd2c], eax
movzx eax, byte [ebx + 0xd30]
mov byte [esi + 0xd30], al
mov eax, dword [ebx + 0xd34]
mov dword [esi + 0xd34], eax
mov eax, dword [ebx + 0xd38]
mov dword [esi + 0xd38], eax
mov eax, dword [ebx + 0xd3c]
mov dword [esi + 0xd3c], eax
movzx eax, byte [ebx + 0xd40]
mov byte [esi + 0xd40], al
mov eax, dword [ebx + 0xd44]
mov dword [esi + 0xd44], eax
mov edx, dword [esi + 0xd38]
test edx, edx
jns 0x1002e38c
neg edx
call fcn.10013540
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1002e393
call fcn.10013540
mov ecx, eax
lea eax, [ebp - 0x17]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp ecx, eax
je 0x1002e3b8
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.1000ecc0
mov dword [ebp - 4], 0
cmp byte [esi + 0xcca], 0
jne 0x1002e600
cmp byte [esi + 0x34], 0
je 0x1002e3eb
mov eax, dword [0x100f2748]
xor edx, edx
mov ecx, dword [esi + 0x70]
add eax, 0x60e090
push 0
push dword [ebx + 0xcec]
call eax
cmp byte [ebx + 0x1fc], 0
je 0x1002e405
mov eax, dword [ebx + 0x238]
mov cl, byte [eax + 0x69]
mov dl, byte [eax + 0x6a]
mov bl, byte [eax + 0x6b]
jmp 0x1002e40e
mov cl, byte [ebp - 0x45]
mov dl, byte [ebp - 0x45]
mov bl, byte [ebp - 0x45]
cmp byte [esi + 0x1fc], 0
je 0x1002e46b
mov eax, dword [esi + 0x238]
mov byte [eax + 0x6c], 0xff
mov eax, dword [esi + 0x238]
mov byte [eax + 0x6b], bl
mov eax, dword [esi + 0x238]
mov byte [eax + 0x6a], dl
mov eax, dword [esi + 0x238]
mov byte [eax + 0x69], cl
cmp dword [esi + 0x220], 9
jne 0x1002e46b
mov eax, dword [esi + 0x238]
xor edx, edx
push 0
mov dword [eax + 0xa0], 0
mov eax, dword [0x100f2748]
mov ecx, dword [esi + 0x238]
add eax, 0x605cc0
call eax
cmp byte [esi + 0x34], 0
je 0x1002e4ac
mov eax, dword [esi + 0x70]
mov byte [eax + 0x6b], 0xff
mov eax, dword [esi + 0x70]
mov byte [eax + 0x6a], 0xff
mov eax, dword [esi + 0x70]
mov byte [eax + 0x69], 0xff
cmp dword [esi + 0x58], 9
jne 0x1002e4ac
mov eax, dword [esi + 0x70]
xor edx, edx
push 0
mov dword [eax + 0xa0], 0
mov eax, dword [0x100f2748]
mov ecx, dword [esi + 0x70]
add eax, 0x605cc0
call eax
mov eax, dword [esi + 0xcb8]
cmp eax, 4
je 0x1002e4db
cmp dword [esi + 0xcbc], 5
je 0x1002e4db
cmp dword [esi + 0xcb0], 2
je 0x1002e4db
cmp dword [esi + 0xcb4], 3
je 0x1002e4db
mov byte [esi + 0xf], 0
jmp 0x1002e5cc
mov byte [esi + 0xf], 1
cmp eax, 4
je 0x1002e4ed
cmp dword [esi + 0xcbc], 5
jne 0x1002e511
cmp byte [esi + 0x3c4], 0
je 0x1002e511
mov eax, dword [0x100f2748]
xor edx, edx
mov ecx, dword [esi + 0x400]
add eax, 0x60e090
push 0
push str.IcoSideShop.tga
call eax
cmp dword [esi + 0xcb0], 2
je 0x1002e523
cmp dword [esi + 0xcb4], 3
jne 0x1002e547
cmp byte [esi + 0x3c4], 0
je 0x1002e547
mov eax, dword [0x100f2748]
xor edx, edx
mov ecx, dword [esi + 0x400]
add eax, 0x60e090
push 0
push str.IcoSecretShop.tga
call eax
cmp byte [esi + 0x3c4], 0
lea edi, [esi + 0x3c4]
je 0x1002e583
mov eax, dword [edi + 0x3c]
mov byte [eax + 0x6c], 0xff
cmp dword [edi + 0x24], 9
jne 0x1002e583
mov eax, dword [edi + 0x3c]
xor edx, edx
push 0
mov dword [eax + 0xa0], 0
mov eax, dword [0x100f2748]
mov ecx, dword [edi + 0x3c]
add eax, 0x605cc0
call eax
push 5
mov ecx, edi
call fcn.10018bc0
cmp byte [edi], 0
je 0x1002e5cc
mov eax, dword [edi + 0x3c]
mov byte [eax + 0x6b], 0xf0
mov eax, dword [edi + 0x3c]
mov byte [eax + 0x6a], 0x1e
mov eax, dword [edi + 0x3c]
mov byte [eax + 0x69], 0x1e
cmp dword [edi + 0x24], 9
jne 0x1002e5cc
mov eax, dword [edi + 0x3c]
xor edx, edx
push 0
mov dword [eax + 0xa0], 0
mov eax, dword [0x100f2748]
mov ecx, dword [edi + 0x3c]
add eax, 0x605cc0
call eax
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
cmovae eax, ecx
cmp byte [esi + 0x670], 0
je 0x1002e7c1
mov ecx, dword [esi + 0x6ac]
xor edx, edx
push eax
mov eax, dword [0x100f2748]
add eax, 0x60ca10
call eax
jmp 0x1002e7be
cmp byte [esi + 0x83c], 0
je 0x1002e636
push 1
push 0x100d6824
push 0
push 0
push dword [ebx + 0xcec]
push dword [esi + 0x844]
call dword [0x100f2740]
mov edx, dword [0x100f2748]
mov ecx, eax
lea edx, [edx + 0x6212d0]
call edx
cmp byte [ebx + 0x1fc], 0
je 0x1002e652
mov eax, dword [ebx + 0x238]
mov cl, byte [eax + 0x69]
mov bh, byte [eax + 0x6a]
mov bl, cl
mov al, byte [eax + 0x6b]
jmp 0x1002e65b
mov bl, byte [ebp - 0x45]
mov bh, byte [ebp - 0x45]
mov al, byte [ebp - 0x45]
cmp byte [esi + 0x758], 0
mov byte [ebp - 0x46], al
je 0x1002e6a3
push dword [esi + 0x760]
call dword [0x100f2740]
mov edi, eax
test edi, edi
jle 0x1002e6a3
movzx edx, byte [ebp - 0x46]
or edx, 0xffffff00
movzx ecx, bh
shl edx, 8
or edx, ecx
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [edi + 0x168], 1
mov dword [edi + 0x28c], edx
mov eax, dword [esi + 0xcb8]
cmp eax, 4
je 0x1002e6d2
cmp dword [esi + 0xcbc], 5
je 0x1002e6d2
cmp dword [esi + 0xcb0], 2
je 0x1002e6d2
cmp dword [esi + 0xcb4], 3
je 0x1002e6d2
mov byte [esi + 0xf], 0
jmp 0x1002e78d
mov byte [esi + 0xf], 1
cmp eax, 4
je 0x1002e6e4
cmp dword [esi + 0xcbc], 5
jne 0x1002e719
cmp byte [esi + 0xae8], 0
je 0x1002e719
push 1
push 0x100d6824
push 0
push 0
push str.IcoSideShop.tga
push dword [esi + 0xaf0]
call dword [0x100f2740]
mov edx, dword [0x100f2748]
mov ecx, eax
lea edx, [edx + 0x6212d0]
call edx
cmp dword [esi + 0xcb0], 2
je 0x1002e72b
cmp dword [esi + 0xcb4], 3
jne 0x1002e760
cmp byte [esi + 0xae8], 0
je 0x1002e78d
push 1
push 0x100d6824
push 0
push 0
push str.IcoSecretShop.tga
push dword [esi + 0xaf0]
call dword [0x100f2740]
mov edx, dword [0x100f2748]
mov ecx, eax
lea edx, [edx + 0x6212d0]
call edx
cmp byte [esi + 0xae8], 0
je 0x1002e78d
push dword [esi + 0xaf0]
call dword [0x100f2740]
test eax, eax
jle 0x1002e78d
mov dword [eax + 0xac], 0xff
mov dword [eax + 0x1d8], 1
cmp dword [ebp - 0x30], 0x10
lea edi, [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
cmovae edi, ecx
cmp byte [esi + 0xa04], 0
je 0x1002e7c1
push 2
push dword [esi + 0xa0c]
call dword [0x100f273c]
push edi
push dword [esi + 0xa0c]
call dword [0x100f2728]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x1002e7ee
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002e7e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002e80c
push edx
push ecx
call fcn.10097faf
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10097f9e
mov esp, ebp
pop ebp
ret 4
call fcn.1009d41c
int3