Function at 0x10028f2d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080a46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2cc
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028f83
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
movzx eax, byte [eax]
test eax, eax
je 0x10028f7e
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
jmp 0x1002a43d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x164], 7
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x4c], 0x3b0a6d08
mov dword [ebp - 0xbc], 0xe834ab46
mov dword [ebp - 0x1d4], 5
push 4
lea ecx, [ebp - 0x1c8]
call fcn.10017ff2
and dword [ebp - 4], 0
mov dword [ebp - 0x1e4], 2
mov dword [ebp - 0x90], 0
jmp 0x10028ffe
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x10029020
push dword [ebp - 0x90]
lea ecx, [ebp - 0x1c8]
call fcn.1001807e
mov dword [eax], 0x5cbf7935
jmp 0x10028ff1
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x5846
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1002a9bd
add esp, 0x1c
mov dword [ebp - 0x4c], 3
jmp 0x1002905c
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10029223
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x24], 3
jmp 0x1002908a
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1002921e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c8]
call fcn.1001807e
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c8]
call fcn.1001807e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100290c4
mov dword [ebp - 0x190], 1
jmp 0x100290cb
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x190], eax
jge 0x100290e5
mov dword [ebp - 0x19c], 1
jmp 0x100290ec
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x19c], eax
jge 0x10029106
mov dword [ebp - 0x1dc], 1
jmp 0x1002910d
and dword [ebp - 0x1dc], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c8]
call fcn.1001807e
push 0xfffffffffffffffc
pop eax
sub eax, 0x9de360ab
je 0x100291a2
push 1
lea ecx, [ebp - 0x248]
call fcn.10017ff2
mov byte [ebp - 4], 1
push 1
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.100266bc
add esp, 0xc
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x15c]
push eax
push 0
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.1002e493
add esp, 0x28
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10018079
jmp 0x10029219
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x100291e5
push 0x5cf0
push 0x7a38
push 0x2aeb
push 0x19e2
push 0x64e5
push 0x39f6
push 0x7516
push 0
push 0xc2a
push 0x70a8
call fcn.1002888f
add esp, 0x28
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x10029219
push 0x606f
push 0xdd8
push 0x7514
push 0
push 0x7106
push 0x2727
push 0x134b
call fcn.1002abff
add esp, 0x1c
jmp 0x10029083
jmp 0x10029055
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c8]
call fcn.10018079
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x34], 0xd562b994
mov dword [ebp - 0x7c], 0xfc35327
mov dword [ebp - 0x1ec], 8
mov dword [ebp - 0xac], 0xd681
push 4
lea ecx, [ebp - 0x210]
call fcn.10017ff2
mov dword [ebp - 4], 2
mov dword [ebp - 0x14], 0
jmp 0x10029287
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002929a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0x71b18d40
jmp 0x10029280
mov dword [ebp - 0x14], 0
jmp 0x100292aa
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100292bd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xe7937d8e
jmp 0x100292a3
mov dword [ebp - 0x14], 0
jmp 0x100292cd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100292e6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x210]
call fcn.1001807e
and dword [eax], 0
jmp 0x100292c6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5c], 1
jmp 0x1002930b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5c], 0
jl 0x10029594
push 3
lea ecx, [ebp - 0x21c]
call fcn.10017ff2
mov byte [ebp - 4], 3
mov dword [ebp - 0xd4], 0x56a218f0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x3f47
lea eax, [ebp - 0x298]
push eax
call fcn.1002e02d
add esp, 0x10
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
cmp dword [ebp + eax*4 - 0x6c], 0
je 0x10029379
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
call fcn.10018079
jmp 0x10029594
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x274], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x34], eax
jge 0x100293ac
mov dword [ebp - 0xc4], 1
jmp 0x100293b3
and dword [ebp - 0xc4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c]
add eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x34]
jne 0x100293d4
mov dword [ebp - 0x94], 1
jmp 0x100293db
and dword [ebp - 0x94], 0
push 1
lea ecx, [ebp - 0x21c]
call fcn.1001807e
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x94], eax
je 0x10029412
mov dword [ebp - 0x16c], 1
jmp 0x10029419
and dword [ebp - 0x16c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
cmp dword [ebp - 0x16c], eax
jle 0x10029437
mov dword [ebp - 0xcc], 1
jmp 0x1002943e
and dword [ebp - 0xcc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
sub ecx, dword [ebp + eax - 0x5c]
jne 0x1002945f
cmp dword [ebp - 0x7c], 0
jne 0x1002945f
and dword [ebp - 0x174], 0
jmp 0x10029469
mov dword [ebp - 0x174], 1
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x27c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c], 0xfff6
ja 0x1002949d
mov dword [ebp - 0x184], 1
jmp 0x100294a4
and dword [ebp - 0x184], 0
cmp dword [ebp - 0x184], 7
jb 0x100294bf
mov eax, 0xb91
test eax, eax
jne 0x100294bf
and dword [ebp - 0x18c], 0
jmp 0x100294c9
mov dword [ebp - 0x18c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
cmp dword [ebp - 0x18c], eax
jl 0x100294e7
mov dword [ebp - 0xe0], 1
jmp 0x100294ee
and dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0xe0], eax
jne 0x10029510
mov dword [ebp - 0x148], 1
jmp 0x10029517
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
add eax, 0x7e2c101d
jne 0x10029528
cmp dword [ebp - 0x34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x5c]
sub eax, dword [ebp + ecx*4 - 0x6c]
jne 0x1002954e
mov dword [ebp - 0xe8], 1
jmp 0x10029555
and dword [ebp - 0xe8], 0
cmp dword [ebp - 0xe8], 0x3ae5685e
je 0x1002956d
mov dword [ebp - 0x17c], 1
jmp 0x10029574
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
call fcn.10018079
jmp 0x100292f6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6c], 0
je 0x100296e1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5c], 0
je 0x100295c4
cmp dword [ebp - 0x34], 0
je 0x100295c4
mov dword [ebp - 0xf0], 1
jmp 0x100295cb
and dword [ebp - 0xf0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x5c]
imul ecx, dword [ebp - 0xf0]
sub eax, ecx
mov dword [ebp - 0xac], eax
mov esi, dword [ebp - 0xac]
push 2
lea ecx, [ebp - 0x210]
call fcn.1001807e
cmp esi, dword [eax]
jl 0x10029610
mov dword [ebp - 0x150], 1
jmp 0x10029617
and dword [ebp - 0x150], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.1001807e
mov ecx, dword [ebp - 0x150]
cmp ecx, dword [eax]
jl 0x1002963a
mov dword [ebp - 0x1f4], 1
jmp 0x10029641
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2a8], eax
mov esi, dword [ebp - 0x34]
push 0
lea ecx, [ebp - 0x210]
call fcn.1001807e
cmp esi, dword [eax]
jl 0x1002966a
mov dword [ebp - 0xf8], 1
jmp 0x10029671
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xf8], eax
jne 0x1002968e
cmp dword [ebp - 0xac], 0
jne 0x1002968e
and dword [ebp - 0x180], 0
jmp 0x10029698
mov dword [ebp - 0x180], 1
mov eax, dword [ebp - 0x180]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x7c]
jne 0x100296b2
mov dword [ebp - 0x100], 1
jmp 0x100296b9
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x100]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x5c]
cmp eax, 0x9123ebaa
jb 0x100296e1
mov dword [ebp - 0x158], 1
jmp 0x100296e8
and dword [ebp - 0x158], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6c]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x158]
sub edx, dword [ebp + ecx - 0x6c]
cmp eax, edx
je 0x10029714
mov dword [ebp - 0x108], 1
jmp 0x1002971b
and dword [ebp - 0x108], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x108]
mov dword [ebp + eax - 0x5c], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x210]
call fcn.10018079
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x168], 0x919c44d4
cmp dword [ebp - 0x10], 0
je 0x10029787
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
je 0x10029787
mov dword [ebp - 0x194], 1
jmp 0x1002978e
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
sub eax, 0x39d6
mov dword [ebp - 0x70], eax
je 0x100297a4
cmp dword [ebp - 0x10], 0
jne 0x100297aa
cmp dword [ebp - 0x10], 0
je 0x100297bc
cmp dword [ebp - 0x70], 0
je 0x100297bc
mov dword [ebp - 0x110], 1
jmp 0x100297c3
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x110], eax
jne 0x100297da
mov dword [ebp - 0x1fc], 1
jmp 0x100297e1
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x70], 0
jne 0x10029808
cmp dword [ebp - 0x10], 0
jne 0x10029808
and dword [ebp - 0x160], 0
jmp 0x10029812
mov dword [ebp - 0x160], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x160], eax
je 0x10029829
mov dword [ebp - 0x118], 1
jmp 0x10029830
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x118], eax
jle 0x10029847
mov dword [ebp - 0x188], 1
jmp 0x1002984e
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x10]
jg 0x10029868
mov dword [ebp - 0x1d8], 1
jmp 0x1002986f
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002988c
mov dword [ebp - 0x120], 1
jmp 0x10029893
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x70], 0
je 0x10029938
mov dword [ebp - 0x88], 0
jmp 0x100298d3
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100298ef
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x2c4], 0xffff
jmp 0x100298c6
mov dword [ebp - 0x10], 0
jmp 0x100298ff
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10029936
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2c4], 0
je 0x10029914
jmp 0x10029936
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x10029934
push 0
push 0x338
push 0x3cb9
call fcn.1002ae15
add esp, 0xc
jmp 0x100298f8
jmp 0x10029946
push 0
push 0x2fd4
call fcn.10028ea9
pop ecx
pop ecx
and dword [ebp - 0xa8], 0
jmp 0x10029965
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x28]
add eax, 0x28
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xa8], eax
jge 0x1002a43d
mov dword [ebp - 0x1c], 0xbac64a68
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x60], 0xffffffff
push 4
lea ecx, [ebp - 0x2a4]
call fcn.10017ff2
mov dword [ebp - 4], 4
push 0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.1002e36d
add esp, 0xc
mov dword [ebp - 0x1c], 0
jmp 0x100299ce
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 5
je 0x10029a81
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], 1
lea ecx, [ebp - 0xa1]
call fcn.10008d03
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.1001808d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x294]
call fcn.10018053
mov byte [ebp - 4], 5
push 0x4212
push 0x256
push 0x5b83
push 0x5ca5
push 0
push 0x637e
lea eax, [ebp - 0x294]
push eax
push 0x361b
push 0x5fc9
call fcn.10028d91
add esp, 0x24
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x294]
call fcn.10018079
jmp 0x100299c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xd705
cmp dword [ebp - 0x1c], eax
jle 0x10029aac
mov dword [ebp - 0x128], 1
jmp 0x10029ab3
and dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0xf4a4
jle 0x10029acb
mov dword [ebp - 0xb0], 1
jmp 0x10029ad2
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0xf3f17e2f
jbe 0x10029aea
mov dword [ebp - 0x130], 1
jmp 0x10029af1
and dword [ebp - 0x130], 0
cmp dword [ebp - 0x130], 0xcfd66c4a
ja 0x10029b09
mov dword [ebp - 0x170], 1
jmp 0x10029b10
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x170], eax
jg 0x10029b27
mov dword [ebp - 0x138], 1
jmp 0x10029b2e
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x18]
jne 0x10029b48
mov dword [ebp - 0x178], 1
jmp 0x10029b4f
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x18]
je 0x10029bfa
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1e0], 0x38f7
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0
call fcn.10028624
add esp, 0x18
mov dword [ebp - 0x18], 3
jmp 0x10029ba6
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10029bf8
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x10029bd1
push 0xcbb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x10029bf6
push 0x540d
push 0x3cd6
push 0x7706
push 0
call fcn.1002a4c1
add esp, 0x10
jmp 0x10029b9f
jmp 0x10029c63
mov dword [ebp - 0x60], 2
jmp 0x10029c0a
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xfffffffd
jl 0x10029c63
mov dword [ebp - 0x18], 3
jmp 0x10029c20
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10029c61
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x10029c52
push 0x984
push 0x72
push 0x70f1
push 0x765d
push 0x629f
push 1
call fcn.10028624
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.1002a44c
pop ecx
pop ecx
jmp 0x10029c19
jmp 0x10029c03
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.10018079
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x10], 0
jne 0x1002a087
mov dword [ebp - 0x84], 0
jmp 0x10029c98
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10029cb4
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1b0], 0x99841b3c
jmp 0x10029c8b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1b0], 0x14
jmp 0x10029ce2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b0], 0xfffffff1
jne 0x10029d16
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10029d14
push 0
push 0
push 0x2fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10029cc7
push 0
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x200]
push eax
push 0x7ab8
call fcn.10030ce0
add esp, 0x18
mov dword [ebp - 0x44], 0x6e3245f1
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x20], 0x8951bb35
mov dword [ebp - 0x74], 0x7507af9c
xor eax, eax
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jle 0x10029d70
mov dword [ebp - 0x140], 1
jmp 0x10029d77
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x140]
add eax, 0x6c37fc05
cmp eax, 1
je 0x10029d93
mov dword [ebp - 0xd8], 1
jmp 0x10029d9a
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xd8], eax
je 0x10029db7
cmp dword [ebp - 0x44], 0
je 0x10029db7
mov dword [ebp - 0xdc], 1
jmp 0x10029dbe
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xdc], eax
je 0x10029dd5
mov dword [ebp - 0xe4], 1
jmp 0x10029ddc
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
sub eax, 3
cmp eax, 1
jne 0x10029df6
mov dword [ebp - 0xec], 1
jmp 0x10029dfd
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
sub eax, 0x75fe6ce0
jne 0x10029e17
xor eax, eax
jne 0x10029e17
and dword [ebp - 0xf4], 0
jmp 0x10029e21
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x44], eax
je 0x10029e50
mov dword [ebp - 0xfc], 1
jmp 0x10029e57
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xfc], eax
je 0x10029e6e
mov dword [ebp - 0x104], 1
jmp 0x10029e75
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x104]
lea eax, [eax + ecx - 0xffff]
test eax, eax
je 0x10029ea5
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x10029ea0
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1002a082
mov dword [ebp - 0x64], 0xffff
mov dword [ebp - 0x78], 0
jmp 0x10029ebc
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10029ed2
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x2b8], 0xbc8b6976
jmp 0x10029eb5
mov byte [ebp - 0x38], 0
push 0x2490
push 0x4f65
push 0x12cf
push 0
push 0x7096
lea eax, [ebp - 0x38]
push eax
push 0x5596
call fcn.1002d113
add esp, 0x1c
mov dword [ebp - 0x50], 0
jmp 0x10029f0d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x10
jg 0x1002a082
mov dword [ebp - 0xa0], 0x51404fc4
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x20], eax
jg 0x10029f35
mov dword [ebp - 0x124], 1
jmp 0x10029f3c
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x64], 0
jne 0x10029f54
mov eax, 0x7a22
test eax, eax
jne 0x10029f54
and dword [ebp - 0x10c], 0
jmp 0x10029f5e
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0xa0]
jge 0x10029f7b
mov dword [ebp - 0x114], 1
jmp 0x10029f82
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x114], eax
je 0x10029f99
mov dword [ebp - 0x11c], 1
jmp 0x10029fa0
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x11c]
add eax, 9
cmp eax, 0xfffffff6
jl 0x10029fbe
mov dword [ebp - 0x1e8], 1
jmp 0x10029fc5
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0xa0], 0x45c5
jne 0x10029fdd
mov dword [ebp - 0x12c], 1
jmp 0x10029fe4
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x12c]
jne 0x10029ffe
mov dword [ebp - 0x134], 1
jmp 0x1002a005
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x134], eax
je 0x1002a01f
mov dword [ebp - 0x13c], 1
jmp 0x1002a026
and dword [ebp - 0x13c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + eax - 0x2b8], ecx
mov dword [ebp - 0x20], 0xffffffff
jmp 0x1002a049
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b
jge 0x1002a07d
mov dword [ebp - 0x64], 0x17
jmp 0x1002a05f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x28
jne 0x1002a07b
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1002a079
push 0
call fcn.1002fe38
pop ecx
jmp 0x1002a058
jmp 0x1002a042
jmp 0x10029f06
jmp 0x1002994f
push 4
lea ecx, [ebp - 0x23c]
call fcn.10017ff2
mov dword [ebp - 4], 6
push 1
lea ecx, [ebp - 0x1bc]
call fcn.10017ff2
mov byte [ebp - 4], 7
push 0xa79
push 0
lea eax, [ebp - 0x1f8]
push eax
push 0x6534
push 0x28f9
lea eax, [ebp - 0x23c]
push eax
call fcn.10030040
add esp, 0x18
lea eax, [ebp - 0x1bc]
push eax
push 0
lea eax, [ebp - 0x1f8]
push eax
call fcn.1002e3e5
add esp, 0xc
push 0
lea ecx, [ebp - 0x1bc]
call fcn.1001807e
mov dword [eax], 3
jmp 0x1002a124
push 0
lea ecx, [ebp - 0x1bc]
call fcn.1001807e
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x144]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1bc]
call fcn.1001807e
cmp dword [eax], 0
jl 0x1002a195
mov dword [ebp - 0x80], 0x3690f1d8
mov dword [ebp - 0x80], 3
jmp 0x1002a14d
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1002a16f
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x1002a16d
push 0
push 0x498
call fcn.10030aa6
pop ecx
pop ecx
jmp 0x1002a146
push 0
lea ecx, [ebp - 0x1bc]
call fcn.1001807e
push dword [eax]
lea ecx, [ebp - 0x23c]
call fcn.1001807e
cmp dword [eax], 0
je 0x1002a190
jmp 0x1002a195
jmp 0x1002a100
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1bc]
call fcn.10018079
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.10018079
push 4
push 0x1000
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14c]
add ecx, dword [eax + 0xc]
push ecx
push 0x363d
push 0x2f05
call fcn.10025c3a
pop ecx
pop ecx
call eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1f0]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x9c]
call fcn.10025cbf
add esp, 0xc
mov dword [ebp - 0x2c], 0
jmp 0x1002a217
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002a22d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1a8], 0
jmp 0x1002a210
mov dword [ebp - 0x2c], 0
jmp 0x1002a23d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002a253
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2d0], 0xfa75c19c
jmp 0x1002a236
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a8], 0
jmp 0x1002a281
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0
jge 0x1002a414
mov dword [ebp - 0x30], 0xd3f46721
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x1002a2b0
push 0
call fcn.1002abdd
pop ecx
mov dword [ebp - 0x30], 0
jmp 0x1002a2c0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1002a40f
mov dword [ebp - 0x98], 0xfffffff9
mov dword [ebp - 0x258], 0xfffffffc
mov dword [ebp - 0x254], 0xfffffffc
mov dword [ebp - 0x250], 0xfffffffc
mov dword [ebp - 0x24c], 0xfffffffc
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x2d0], ecx
je 0x1002a32a
cmp dword [ebp - 0x30], 0
je 0x1002a32a
mov dword [ebp - 0xb8], 1
jmp 0x1002a331
and dword [ebp - 0xb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
mov dword [ebp - 0x26c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1a8], 0
jne 0x1002a365
cmp dword [ebp - 0x98], 0
jne 0x1002a365
and dword [ebp - 0x154], 0
jmp 0x1002a36f
mov dword [ebp - 0x154], 1
cmp dword [ebp - 0x154], 0xffffffff
jge 0x1002a384
mov dword [ebp - 0xb4], 1
jmp 0x1002a38b
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb8], eax
jg 0x1002a3a9
mov dword [ebp - 0xc0], 1
jmp 0x1002a3b0
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 1
jne 0x1002a3c5
mov dword [ebp - 0xc8], 1
jmp 0x1002a3cc
and dword [ebp - 0xc8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc8]
sub ecx, dword [ebp + eax - 0x1a8]
cmp ecx, 0xffffffff
je 0x1002a3f0
mov dword [ebp - 0xd0], 1
jmp 0x1002a3f7
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x258], ecx
jmp 0x1002a2b9
jmp 0x1002a266
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0x782c
push 0x4ec3
push 0x69f8
call fcn.1002ae8d
add esp, 0x18
jmp 0x1002994f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret