Function at 0x1002bf40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002cd60
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10038780]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x10038780]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
call fcn.1000ad5f
mov dword [esp + 0x24], eax
call fcn.1000ab8d
xor edi, edi
push edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.1000aeaf
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x1002bf9f
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x18]
call fcn.1000aed7
mov dword [esp + 0x78], edi
push 3
push 0x10034810
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], edi
mov byte [esp + 0x58], 0
call fcn.10006eb0
mov byte [esp + 0x78], 1
movzx eax, word [0x1003983c]
push eax
call fcn.100202f0
mov ecx, dword [0x10039838]
movzx eax, ax
add al, cl
mov edi, dword [esp + 0x50]
add al, 0x40
mov byte [esp + 0x17], al
mov bl, byte [esp + 0x17]
movzx dx, bl
add dx, cx
add dx, 0x40
movzx eax, dx
mov dword [esp + 0x1c], eax
sub al, cl
add bl, al
mov eax, dword [0x100399fc]
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x64]
add esi, 0x100399fc
mov ecx, edi
cmp eax, 0x10
jae 0x1002c02b
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0x60]
add ecx, edx
mov dword [esp + 0x20], ecx
je 0x1002c05b
mov edx, edi
cmp eax, 0x10
jae 0x1002c042
lea edx, [esp + 0x50]
cmp edx, ecx
ja 0x1002c05b
mov edx, edi
cmp eax, 0x10
jae 0x1002c051
lea edx, [esp + 0x50]
mov edi, dword [esp + 0x60]
add edx, edi
cmp ecx, edx
jbe 0x1002c064
call fcn.1000c0c6
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x50]
cmp eax, 0x10
jb 0x1002c1d4
mov dword [esp + 0x18], edx
test edx, edx
je 0x1002c0a1
mov ecx, edx
cmp eax, 0x10
jae 0x1002c084
lea ecx, [esp + 0x50]
cmp ecx, dword [esp + 0x18]
ja 0x1002c0a1
cmp eax, 0x10
mov eax, edx
jae 0x1002c095
lea eax, [esp + 0x50]
mov edx, dword [esp + 0x60]
add eax, edx
cmp dword [esp + 0x18], eax
jbe 0x1002c0a6
call fcn.1000c0c6
lea edi, [esp + 0x24]
call fcn.10008350
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x48]
push ecx
mov ecx, eax
call edx
movzx eax, word [esp + 0x1c]
mov edx, dword [0x1003980c]
cmp edx, eax
ja 0x1002c10d
movzx ecx, bl
mov dword [0x1003981c], ecx
imul ecx, ecx, 0x57
neg eax
sub eax, ecx
mov ecx, dword [0x100397a4]
add ecx, eax
mov bl, 0x22
mov dword [0x100397a4], ecx
sub bl, cl
cmp edx, 0x8b2
jne 0x1002c12d
mov eax, dword [0x100397a4]
sub bl, byte [0x1003982c]
lea ecx, [eax + eax - 0x560f]
mov dword [0x100397a4], ecx
movzx edx, word [0x1003983c]
push edx
call fcn.100202f0
movzx ecx, ax
mov al, byte [0x10039838]
mov dl, 0x57
imul dl
mov dword [esp + 0x1c], ecx
push 8
neg cl
push 1
sub cl, al
add byte [esp + 0x1f], cl
push str.please
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov ecx, 0xc
jmp 0x1002c170
movzx esi, bl
cmp esi, dword [0x1003980c]
je 0x1002c1a7
mov edx, dword [esp + 0x1c]
mov edi, dword [0x100397a4]
movzx eax, dx
add dword [ecx*4 + 0x100397f0], eax
add edi, edi
sub edi, esi
sub dl, bl
lea esi, [edi + eax - 0x560f]
add dl, 0x33
mov dword [0x100397a4], esi
mov bl, dl
sub ecx, 2
cmp ecx, 1
jg 0x1002c170
mov eax, dword [0x100397f8]
sub eax, 2
mov dword [0x100439b0], ecx
je 0x1002c1e1
mov al, byte [0x100397a4]
mov cl, 0x57
imul cl
mov cl, byte [esp + 0x1c]
neg cl
sub cl, al
add bl, cl
jmp 0x1002c1f3
lea ecx, [esp + 0x50]
mov dword [esp + 0x18], ecx
jmp 0x1002c079
movzx eax, word [esp + 0x1c]
movzx edx, bl
lea ecx, [edx + eax + 3]
mov dword [0x100397a4], ecx
movzx edx, word [0x1003983c]
push edx
call fcn.100201a0
movzx si, bl
movzx ecx, ax
mov eax, dword [0x10039838]
mov edi, eax
neg edi
mov edx, esi
imul edx, edx, 0x57
sub edi, edx
add ecx, edi
mov dword [esp + 0x1c], ecx
movzx ecx, bl
sub ecx, dword [0x100397a4]
lea edi, [esp + 0x24]
add eax, ecx
mov ecx, dword [0x100399fc]
mov dword [0x10039838], eax
mov eax, dword [ecx + 4]
add eax, 0x100399fc
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x10039a24]
test eax, eax
sete cl
mov byte [esp + 0x38], 1
mov dword [esp + 0x18], eax
mov byte [esp + 0x30], cl
call fcn.100084a0
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x44]
push ecx
xor ecx, ecx
push ecx
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x60]
push ecx
mov ecx, eax
call edx
mov eax, dword [0x10039838]
push eax
call fcn.100202f0
mov ecx, dword [0x10039838]
mov edx, dword [esp + 0x1c]
mov dword [0x100397a4], eax
mov eax, dword [0x100397b8]
sub esi, ecx
sub eax, 2
lea edx, [edx + esi + 0x19]
je 0x1002c2d4
movzx esi, byte [0x10039834]
mov eax, ecx
imul eax, eax, 0x57
neg esi
sub esi, eax
add dword [0x100397a4], esi
jmp 0x1002c2ea
movzx ecx, byte [0x10039834]
mov eax, dword [0x100397a4]
lea ecx, [ecx + eax + 3]
mov dword [0x10039838], ecx
movzx eax, byte [esp + 0x17]
cmp ecx, eax
jb 0x1002c30e
mov esi, dword [0x100397ec]
movzx eax, bl
imul esi, eax
add cl, bl
add cl, 0x11
mov dword [0x100397ec], esi
mov byte [esp + 0x17], cl
mov eax, dword [0x100397f8]
sub eax, 2
je 0x1002c330
mov al, byte [0x100397a4]
mov cl, 0x57
imul cl
mov cl, dl
neg cl
sub cl, al
mov eax, dword [0x100397a4]
add bl, cl
jmp 0x1002c33f
movzx ecx, dx
movzx eax, bl
lea eax, [ecx + eax + 3]
mov dword [0x100397a4], eax
movzx ecx, bl
cmp eax, ecx
jb 0x1002c35d
movzx ecx, dx
imul ecx, dword [0x1003982c]
add dl, al
add dl, 0x11
mov dword [0x1003982c], ecx
mov bl, dl
call fcn.1002b270
mov edi, 2
movzx eax, ax
mov dword [0x100439b0], edi
mov edx, dword [0x10039838]
cmp edx, dword [0x100397c4]
je 0x1002c3a9
mov cx, word [edi*4 + 0x100397b0]
movzx edx, byte [0x10039834]
imul cx, ax
movzx eax, cx
movzx esi, ax
mov ecx, esi
sub ecx, edx
add dword [0x10039838], ecx
cmp esi, dword [0x100397b0]
je 0x1002c3b1
add edi, 2
cmp edi, 0xb
jl 0x1002c370
movzx ecx, byte [esp + 0x17]
movzx edx, ax
mov eax, ecx
sub eax, edx
add eax, 9
mov dword [0x10039838], eax
mov eax, dword [0x100397b8]
sub eax, 2
mov dword [0x100439b0], edi
jne 0x1002c3e1
movzx edx, bl
lea eax, [edx + ecx + 3]
mov dword [0x10039838], eax
cmp dword [esp + 0x64], 0x10
jb 0x1002c3f5
mov ecx, dword [esp + 0x50]
push ecx
call fcn.1000c1bc
add esp, 4
mov dword [esp + 0x78], 0xffffffff
mov edi, dword [esp + 0x24]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
test edi, edi
je 0x1002c457
push 0
lea ecx, [esp + 0x24]
call fcn.1000aeaf
mov eax, dword [edi + 4]
test eax, eax
jbe 0x1002c435
cmp eax, 0xffffffff
jae 0x1002c435
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x20]
and esi, edi
call fcn.1000aed7
test esi, esi
je 0x1002c457
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1000ba96
mov esp, ebp
pop ebp
ret 0xc