Function at 0x10028959
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e5b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100289b8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
movzx eax, byte [eax]
test eax, eax
je 0x100289b3
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x100297a9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0
jmp 0x100289e0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x100289f6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f0], 0x55bb
jmp 0x100289d9
mov dword [ebp - 0x1c], 0
jmp 0x10028a06
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10028a1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], 0xfe223643
jmp 0x100289ff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a4], 0
jmp 0x10028a4a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a4], 0
jg 0x10028ab5
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x180], 0xd672a835
push 0x3f2a
push 0
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x188]
push eax
push 0x2881
call fcn.10027dd7
add esp, 0x14
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x10028ab0
push 0
push 0x4b31
push 0x2874
call fcn.10027518
add esp, 0xc
jmp 0x10028a2f
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x1bc], 0xeea2a3b3
mov dword [ebp - 0x1b8], 0xeea2a3b3
mov dword [ebp - 0x1b4], 0xeea2a3b3
mov dword [ebp - 0x1b0], 0xeea2a3b3
mov dword [ebp - 0x80], 0xa7ef5d87
push 3
lea ecx, [ebp - 0x198]
call fcn.10016cb0
and dword [ebp - 4], 0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x150], 0xfeae
mov dword [ebp - 0x34], 0
jmp 0x10028b2c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10028b42
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x218], 1
jmp 0x10028b25
lea eax, [ebp - 0x198]
push eax
push 0x3dca
push 0x680e
push 0x6ea8
push 0x2c57
push 0
lea eax, [ebp - 0x34]
push eax
push 0x195d
push 0x2b6b
call fcn.100297b8
add esp, 0x24
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
je 0x10028b92
mov eax, 0xb3e713e1
test eax, eax
je 0x10028b92
mov dword [ebp - 0x98], 1
jmp 0x10028b99
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x98], eax
je 0x10028bb0
mov dword [ebp - 0x10c], 1
jmp 0x10028bb7
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0xffffffff
je 0x10028bcc
mov dword [ebp - 0x154], 1
jmp 0x10028bd3
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x120], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x120]
mov dword [ebp + eax - 0x1bc], ecx
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x120]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x218]
jg 0x10028c25
mov dword [ebp - 0x9c], 1
jmp 0x10028c2c
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x9c]
jg 0x10028c43
mov dword [ebp - 0x148], 1
jmp 0x10028c4a
and dword [ebp - 0x148], 0
push 1
lea ecx, [ebp - 0x198]
call fcn.10016d1d
push 1
lea ecx, [ebp - 0x198]
call fcn.10016d1d
cmp dword [eax], 0
je 0x10028c87
push 0
lea ecx, [ebp - 0x198]
call fcn.10016d1d
cmp dword [eax], 0
je 0x10028c87
mov dword [ebp - 0xe4], 1
jmp 0x10028c8e
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x184], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x150]
mov dword [ebp + eax - 0x1bc], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.10016d18
push 3
lea ecx, [ebp - 0x1dc]
call fcn.10016cb0
mov dword [ebp - 4], 1
mov dword [ebp - 0x3c], 0x39beb064
mov dword [ebp - 0x44], 0
jmp 0x10028ce7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10028d03
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1dc]
call fcn.10016d1d
mov dword [eax], 0xbbca6318
jmp 0x10028ce0
mov dword [ebp - 0x3c], 2
jmp 0x10028d13
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10028d5d
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 0
jmp 0x10028d30
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10028d5b
lea eax, [ebp - 0x3c]
push eax
push 0
lea eax, [ebp - 0x38]
push eax
push 0x31c9
lea eax, [ebp - 0x1dc]
push eax
push 0x40ab
call fcn.1002bf6e
add esp, 0x18
jmp 0x10028d29
jmp 0x10028d0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.10016d18
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x20], eax
and dword [ebp - 0x78], 0
jmp 0x10028d97
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x20]
add eax, 0x28
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x78], eax
jge 0x100297a9
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x40], 0xb1891f78
mov dword [ebp - 0x6c], 0x98d72a67
mov dword [ebp - 0x1d0], 0x74bf7a83
mov dword [ebp - 0x1cc], 0x74bf7a83
mov dword [ebp - 0x1c8], 0x74bf7a83
mov dword [ebp - 0x1c4], 0x74bf7a83
lea ecx, [ebp - 0x71]
call fcn.10008a83
push eax
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x220]
call fcn.10016d2c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x208]
call fcn.10016cf2
mov dword [ebp - 4], 2
mov dword [ebp - 0x60], 0
jmp 0x10028e2f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10028e42
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x50], 6
jmp 0x10028e28
mov dword [ebp - 0x64], 0xfffffff2
jmp 0x10028e52
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x1a
jne 0x100290c9
mov dword [ebp - 0x5c], 0x5739
mov dword [ebp - 0x108], 0x24b83428
mov dword [ebp - 0x40], 0x51d69f42
mov dword [ebp - 0x40], 0xffffffe7
jmp 0x10028e84
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffffa
je 0x100290c4
mov dword [ebp - 0x1e0], 0x34caa8e5
mov dword [ebp - 0x24], 0
jmp 0x10028ea8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10028ebe
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x174], 0xfe4b2830
jmp 0x10028ea1
mov dword [ebp - 0x24], 0
jmp 0x10028ece
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10028ee4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x230], 0xf9150fae
jmp 0x10028ec7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x174], 0
jmp 0x10028f12
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x174], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x174], 0x1c
je 0x100290bf
mov dword [ebp - 0xa4], 0xfffffffa
mov dword [ebp - 0x158], 0x5e3aa9c1
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
dec ecx
mov dword [ebp - 0x5c], ecx
cmp eax, 0xe56e
je 0x10028f52
cmp dword [ebp - 0xa4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x5c], 0x3cea
je 0x10028f77
mov dword [ebp - 0x17c], 1
jmp 0x10028f7e
and dword [ebp - 0x17c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
add eax, dword [ebp - 0xa4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x50]
jge 0x10028fa9
mov dword [ebp - 0x104], 1
jmp 0x10028fb0
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0
jg 0x10028fc5
mov dword [ebp - 0xac], 1
jmp 0x10028fcc
and dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 1
jbe 0x10028fe1
mov dword [ebp - 0xec], 1
jmp 0x10028fe8
and dword [ebp - 0xec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0xec], eax
jle 0x10029006
mov dword [ebp - 0xb4], 1
jmp 0x1002900d
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x323fa9df
jl 0x10029031
mov dword [ebp - 0xbc], 1
jmp 0x10029038
and dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0xcd9d7
jl 0x10029050
mov dword [ebp - 0xf4], 1
jmp 0x10029057
and dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 9
je 0x1002906c
mov dword [ebp - 0xc4], 1
jmp 0x10029073
and dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 7
jl 0x10029088
mov dword [ebp - 0x11c], 1
jmp 0x1002908f
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 0x404e
jg 0x100290a7
mov dword [ebp - 0xcc], 1
jmp 0x100290ae
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x158], eax
jmp 0x10028ef7
jmp 0x10028e7d
jmp 0x10028e4b
mov dword [ebp - 0x6c], 0xd
jmp 0x100290d9
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xa
jl 0x1002911c
mov dword [ebp - 0x18c], 0x3e5f8859
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xfc], eax
push 1
lea ecx, [ebp - 0x208]
call fcn.10016d1d
mov ecx, dword [ebp - 0xfc]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + eax - 0x50], ecx
jmp 0x100290d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x208]
call fcn.10016d18
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x10], 0
jne 0x1002935d
push 0
call fcn.1002761b
pop ecx
lea eax, [ebp - 0x84]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0x23df
push 0x4aa
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.100254a9
add esp, 0x1c
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x48], 0xf8ee
mov dword [ebp - 0x68], 0xfffffffb
mov dword [ebp - 0x58], 0
jmp 0x10029192
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100291a8
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x12c], 7
jmp 0x1002918b
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x100291c8
push 0
push 0x4af5
push 0x629a
call fcn.100299b2
add esp, 0xc
mov dword [ebp - 0x18], 2
jmp 0x100291d8
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10029358
mov dword [ebp - 0x7c], 0x86ff18ee
mov dword [ebp - 0x164], 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1f4], eax
push 4
pop eax
shl eax, 1
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x12c]
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0x68], 0xa10dd664
jbe 0x1002922d
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x12c], 0
jne 0x1002922d
and dword [ebp - 0xd4], 0
jmp 0x10029237
mov dword [ebp - 0xd4], 1
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0xd4]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x12c]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffff
jae 0x10029265
mov dword [ebp - 0x114], 1
jmp 0x1002926c
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x114], eax
jl 0x10029283
mov dword [ebp - 0xdc], 1
jmp 0x1002928a
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 0x7bf19931
jl 0x100292a2
mov dword [ebp - 0x94], 1
jmp 0x100292a9
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x12c]
cmp dword [ebp - 0x94], eax
jg 0x100292c7
mov dword [ebp - 0x90], 1
jmp 0x100292ce
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x12c]
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x90]
imul eax, ecx
sub eax, 0x63f76313
je 0x100292ef
cmp dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x12c]
cmp dword [ebp + eax*4 - 0x12c], ecx
jge 0x10029314
cmp dword [ebp - 0x68], 0
jne 0x10029314
and dword [ebp - 0xa0], 0
jmp 0x1002931e
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa0], eax
jne 0x10029335
mov dword [ebp - 0xa8], 1
jmp 0x1002933c
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x68], 0
je 0x10029353
jmp 0x100291d1
jmp 0x100291d1
jmp 0x10028d87
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x54], 0xfffffffd
push 2
lea ecx, [ebp - 0x138]
call fcn.10016cb0
mov dword [ebp - 4], 3
mov dword [ebp - 0x140], 0xfffffffd
mov dword [ebp - 0x14], 0
jmp 0x10029399
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100293af
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 1
jmp 0x10029392
push 0x8c7
push 1
push 0xb18
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40b0
push 0x520b
call fcn.100254a9
add esp, 0x1c
mov dword [ebp - 0x14], 0
jmp 0x100293e8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x100293fe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x178], 0xba16
jmp 0x100293e1
mov dword [ebp - 0x14], 0
jmp 0x1002940e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10029424
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ec], 0x461d
jmp 0x10029407
mov dword [ebp - 0x10], 1
jmp 0x10029434
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10029562
mov dword [ebp - 0x168], 8
mov byte [ebp - 0x2d], 0
push 0x474d
push 0x5dad
push 0
lea eax, [ebp - 0x2d]
push eax
call fcn.1002bb82
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x8c]
neg eax
cmp eax, 0x693009c
jle 0x10029483
mov dword [ebp - 0xc8], 1
jmp 0x1002948a
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x100294a7
mov dword [ebp - 0xb0], 1
jmp 0x100294ae
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0x7563ffaf
jl 0x100294c6
mov dword [ebp - 0xb8], 1
jmp 0x100294cd
and dword [ebp - 0xb8], 0
push 0
lea ecx, [ebp - 0x138]
call fcn.10016d1d
mov ecx, dword [ebp - 0xb8]
cmp ecx, dword [eax]
jl 0x100294f0
mov dword [ebp - 0xc0], 1
jmp 0x100294f7
and dword [ebp - 0xc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp dword [ebp - 0xc0], eax
jge 0x10029518
mov dword [ebp - 0xd0], 1
jmp 0x1002951f
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xd0]
jne 0x10029539
mov dword [ebp - 0xd8], 1
jmp 0x10029540
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd8]
sub ecx, dword [ebp + eax*4 - 0x8c]
imul eax, ecx, 0x38ab
inc eax
mov dword [ebp - 0x168], eax
jmp 0x1002942d
mov dword [ebp - 0x10], 0
jmp 0x10029572
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x10029735
mov dword [ebp - 0x144], 0xfffffffa
mov dword [ebp - 0x70], 0
jmp 0x10029596
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x100295ac
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1ac], 0x5659
jmp 0x1002958f
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x8c], 0
jne 0x100295c5
mov dword [ebp - 0xf0], 1
jmp 0x100295cc
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x8c]
cmp dword [ebp + eax*4 - 0x8c], ecx
jge 0x100295ee
mov dword [ebp - 0xe0], 1
jmp 0x100295f5
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x8c]
cmp dword [ebp - 0x54], eax
jg 0x10029619
mov dword [ebp - 0xe8], 1
jmp 0x10029620
and dword [ebp - 0xe8], 0
imul esi, dword [ebp - 0xe8], 0xe71c
push 0
lea ecx, [ebp - 0x138]
call fcn.10016d1d
add esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp esi, dword [ebp + eax - 0x1ac]
je 0x10029654
mov dword [ebp - 0xf8], 1
jmp 0x1002965b
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0xf8]
imul eax, eax, 0xa6d7
cmp eax, 2
jle 0x1002967e
mov dword [ebp - 0x100], 1
jmp 0x10029685
and dword [ebp - 0x100], 0
imul eax, dword [ebp - 0x100], 0x3e99
cmp eax, 0x5291260e
jge 0x100296a2
mov dword [ebp - 0x110], 1
jmp 0x100296a9
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x110]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x1ac]
je 0x100296dc
push 0
lea ecx, [ebp - 0x138]
call fcn.10016d1d
mov eax, dword [eax]
mov dword [ebp - 0x144], eax
jmp 0x10029715
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x10029701
push 0x1f15
push 0
push 0x49f0
push 0x1d7f
call fcn.1002d160
add esp, 0x10
push 0
lea ecx, [ebp - 0x138]
call fcn.10016d1d
cmp dword [eax], 0
je 0x10029715
jmp 0x10029735
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ec]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1ec], eax
jmp 0x1002956b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.10016d18
push 4
push 0x1000
mov eax, dword [ebp - 0x20]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x118]
add ecx, dword [eax + 0xc]
push ecx
push 0xc228
push 0xa1d0
call fcn.1002491e
pop ecx
pop ecx
call eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x20]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14c]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x84]
call fcn.10024aaa
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x84]
mov dword [eax + 8], ecx
jmp 0x10028d87
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret