Function at 0x1002c54c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
dec eax
mov dword [ebp - 8], ebx
cmp eax, 0xb
ja case.default.0x1002c56c
push edi
jmp dword [eax*4 + 0x1002c8b0]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, eax
cmp edi, ebx
je case.0x1002c56c.5
or dword [ebp - 0xc], 0xffffffff
push edi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 4], eax
mov esi, 0x400
cmp eax, ebx
jle 0x1002c5bf
push esi
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMenuState]
test al, al
jns 0x1002c5b9
push esi
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_HiliteMenuItem]
mov dword [ebp - 0xc], ebx
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x1002c59d
mov eax, dword [0x10054598]
mov eax, dword [eax + 0x1c]
push dword [eax + 4]
push dword [eax]
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
mov ebx, eax
cmp ebx, 0xffffffff
je case.0x1002c56c.5
push esi
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMenuState]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], ebx
je 0x1002c5f8
call dword [sym.imp.USER32.dll_EndMenu]
push 0x480
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_HiliteMenuItem]
cmp dword [ebp + 0xc], 2
je case.0x1002c56c.5
test byte [ebp - 4], 3
jne case.0x1002c56c.5
test byte [ebp - 4], 0x10
je 0x1002c667
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, eax
test esi, esi
je case.0x1002c56c.5
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetMenuItemRect]
test eax, eax
je case.0x1002c56c.5
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0x4000
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp case.0x1002c56c.5
test dword [ebp - 4], 0x800
je 0x1002c674
xor eax, eax
jmp 0x1002c685
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp eax, 0xffffffff
je case.0x1002c56c.5
movzx eax, ax
push 0
push eax
push 0x111
jmp 0x1002c89d
mov eax, dword [0x10054598]
push 0xffffffffffffffff
push dword [eax + 0x7b8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10054598]
mov eax, dword [eax + 0x1c]
add eax, 8
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov esi, dword [0x10054598]
mov eax, dword [esi + 0x1c]
mov cl, byte [eax + 0x1a]
mov dl, byte [eax + 0x19]
shr cl, 7
shr dl, 7
test cl, cl
je 0x1002c70b
test dl, dl
jne 0x1002c6ee
test byte [eax + 0x7b], 0x80
je 0x1002c731
push ebx
push ebx
push 0x10
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetAncestor]
jmp 0x1002c72a
test byte [eax + 0x36], 0x80
je 0x1002c731
push 1
push ebx
push ebx
push str.taskmgr
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1002c731
test dl, dl
je 0x1002c731
test byte [eax + 0x23], 0x80
je 0x1002c731
push 5
push dword [esi + 0x828]
call dword [sym.imp.USER32.dll_GetWindow]
push ebx
push ebx
push 0x201
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x10054598]
push dword [eax + 0x7b8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp case.0x1002c56c.5
mov eax, dword [0x10054598]
cmp dword [eax + 0x7a0], ebx
je case.0x1002c56c.5
mov eax, dword [ebp + 8]
call fcn.1002cc8a
mov dword [ebp - 8], 0xdead
jmp case.0x1002c56c.5
push ebx
push esi
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
jmp case.0x1002c56c.5
mov dword [ebp - 8], 0xdeadc0de
jmp case.0x1002c56c.5
mov eax, dword [0x10054598]
push 5
push ebx
push ebx
push dword [eax + 0x83c]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp case.0x1002c56c.5
movsx eax, si
mov dword [ebp - 0x10], eax
shr esi, 0x10
movsx eax, si
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x445
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
jmp case.0x1002c56c.5
mov edi, dword [ebp + 8]
movsx eax, si
mov dword [ebp - 0x10], eax
shr esi, 0x10
movsx eax, si
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x445
push edi
call esi
cmp eax, ebx
je case.0x1002c56c.5
lea ecx, [ebp - 0x2c]
push ecx
push eax
push 0x417
push edi
call esi
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x28]
push 0x44b
push edi
call esi
lea eax, [ebp - 0x42c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
test byte [ebp - 0x24], 1
mov esi, eax
jne 0x1002c836
mov ecx, dword [0x10054598]
call fcn.1002807d
cmp dword [ebp + 0xc], 0xb
jne case.0x1002c56c.5
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_ClientToScreen]
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp - 0x10]
shl eax, 0x10
or eax, ecx
push eax
mov eax, dword [0x10054598]
mov eax, dword [eax + 0x1c]
push 0xc
push dword [eax + 0x193]
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x1002c56c.5
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push ebx
push ebx
push dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
push ebx
movsx ecx, cx
push ecx
movsx ecx, si
push ecx
push 0x100
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push eax
push 0x112
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret