Function at 0x100293cd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057dd3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x288
mov eax, dword [0x10070080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
cmp byte [0x8092d8], 0
je 0x1002a094
cmp dword [eax + 8], 0
je 0x10029236
cmp byte [ebx + 8], 0
je 0x1002a094
cmp dword [0x7f94cc], 0
je 0x1002a094
cmp byte [0x798550], 0
je 0x1002a094
mov eax, dword [0x10075784]
lea ecx, [ebp - 0x38]
push 0x20
mov dword [ebp - 0x230], eax
xorps xmm0, xmm0
push str.SpellGemWnd_Book_HandleRButtonUp
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.100054b0
cmp dword [ebp - 0x24], 0xf
lea esi, [ebp - 0x38]
mov edi, dword [ebp - 0x38]
mov ecx, 0x811c9dc5
seta byte [ebp - 0x231]
cmova esi, edi
xor edx, edx
cmp dword [ebp - 0x28], edx
jbe 0x100292b7
movzx eax, byte [esi + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, dword [ebp - 0x28]
jb 0x100292a5
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.1000daf0
cmp byte [ebp - 0x231], 0
mov esi, dword [eax + 4]
je 0x10029303
mov ecx, dword [ebp - 0x24]
mov eax, edi
inc ecx
cmp ecx, 0x1000
jb 0x100292f9
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0c8
push ecx
push edi
call fcn.100300c8
add esp, 8
test esi, esi
jne 0x1002942e
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x38]
push 0x20
xorps xmm0, xmm0
push str.SpellGemWnd_Book_HandleRButtonUp
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x63d648]
mov eax, dword [eax + 0x15c]
mov edi, dword [eax]
add edi, 0x48
mov dword [ebp - 0x28], esi
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], esi
call fcn.100054b0
push 0x18
mov dword [ebp - 4], esi
call fcn.10030093
mov esi, eax
add esp, 4
mov dword [ebp - 0x238], esi
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push 1
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x10], 4
call fcn.10030093
push 4
mov edx, edi
mov ecx, eax
mov byte [eax], 4
mov dword [esi], eax
mov dword [esi + 8], edi
mov dword [esi + 4], 0x10028f80
mov dword [esi + 0x14], 3
mov dword [esi + 0xc], 0
call fcn.10019680
mov eax, dword [esi + 0x14]
add esp, 8
cmp eax, 3
ja case.default.0x100293a8
jmp dword [eax*4 + 0x1002a0d0]
push 0x10028f80
push edi
mov ecx, esi
call fcn.10017190
jmp case.default.0x100293a8
push 0x10028f80
push edi
mov ecx, esi
call fcn.10017410
jmp case.default.0x100293a8
push 0x10028f80
push edi
mov ecx, esi
call fcn.100174e0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
push eax
call fcn.1000d400
mov dword [ebp - 4], 0xffffffff
mov dword [eax], esi
mov dword [esi + 0x14], 3
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1002942e
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029424
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0b4
push ecx
push edx
call fcn.100300c8
add esp, 8
mov eax, dword [0x7f94cc]
xorps xmm0, xmm0
xor edx, edx
mov eax, dword [eax + 0x88]
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 2
mov edi, 0x7f94cc
mov esi, 0x732
nop dword [eax + eax]
mov eax, dword [edi]
mov eax, dword [eax + 0x88]
movzx ecx, word [esi + eax]
test ecx, ecx
je 0x100294bb
cmp ecx, 0xfa0
jae 0x100294bb
mov eax, dword [0x805cb0]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100294c2
cmp edx, dword [ebp - 0x3c]
je 0x100294a9
mov dword [edx], eax
mov edx, dword [ebp - 0x40]
add edx, 4
mov dword [ebp - 0x40], edx
jmp 0x100294c2
lea eax, [ebp - 0x1c]
push eax
push edx
lea ecx, [ebp - 0x44]
call fcn.1000d830
mov edx, dword [ebp - 0x40]
jmp 0x100294c2
mov dword [ebp - 0x1c], 0
add esi, 2
cmp esi, 0xb32
jl 0x10029470
mov ecx, dword [ebp - 0x44]
mov eax, edx
sub eax, ecx
sar eax, 2
push 0x10029070
push eax
call fcn.10013d50
mov esi, dword [ebp - 0x22c]
add esp, 8
lea ecx, [esi + 0x18]
call fcn.1002ae60
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x244], eax
cmp edi, eax
je 0x100297d4
nop word [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb4], 0xf
movups xmmword [ebp - 0xb0], xmm0
mov byte [ebp - 0xc8], 0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
mov byte [ebp - 4], 3
mov ecx, dword [edi]
push 0xb0
push 0
mov eax, dword [ecx]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x8c]
movzx esi, byte [eax + ecx + 0x9c]
lea eax, [ebp - 0x178]
push eax
call fcn.10031db0
add esp, 8
lea ecx, [ebp - 0x178]
call fcn.10012b50
push esi
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 4
call fcn.10002ad0
mov edx, 0x1006412c
mov ecx, eax
call fcn.10004f20
mov ecx, dword [edi]
mov edx, dword [ecx + 0xd0]
mov ecx, eax
call fcn.10004f20
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x160]
call fcn.10003e40
movups xmm0, xmmword [ebp - 0x298]
mov ecx, dword [edi]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [ebp - 0x288]
mov ecx, dword [ecx]
movq qword [ebp - 0xb8], xmm0
call fcn.100231f0
mov ecx, dword [edi]
mov esi, eax
mov ecx, dword [ecx]
call fcn.100253d0
mov edx, esi
lea ecx, [ebp - 0x38]
mov edi, eax
call fcn.100279b0
mov edx, edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.100279b0
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 6
lea ecx, [ecx + 0x18]
call fcn.1002ae40
lea ecx, [ebp - 0x68]
push ecx
mov ecx, eax
call fcn.1002abe0
mov dword [ebp - 0x230], eax
cmp dword [eax + 4], 0x30c30c3
mov ecx, dword [eax]
mov dword [ebp - 0x240], ecx
je 0x1002a0b9
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 7
push 0x54
mov dword [ebp - 0x248], 0
call fcn.10030093
mov edi, eax
add esp, 4
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x248], edi
lea esi, [edi + 8]
push eax
mov ecx, esi
mov dword [ebp - 0x238], esi
call fcn.10002f20
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 8
lea ecx, [esi + 0x18]
push eax
call fcn.10002f20
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 9
lea ecx, [esi + 0x30]
push eax
call fcn.10002f20
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x240]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x248], 0
inc dword [eax + 4]
mov eax, dword [ecx + 4]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [ecx + 4], edi
mov dword [eax], edi
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xf
jbe 0x10029743
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029739
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0b4
push ecx
push edx
call fcn.100300c8
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
cmp ecx, 0xf
jbe 0x1002978d
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029783
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0b4
push ecx
push edx
call fcn.100300c8
add esp, 8
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call fcn.10010e80
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 2
call fcn.1002a0e0
mov edi, dword [ebp - 0x1c]
add edi, 4
mov dword [ebp - 0x1c], edi
cmp edi, dword [ebp - 0x244]
jne 0x10029510
mov esi, dword [ebp - 0x22c]
mov eax, dword [esi + 8]
mov edi, 0x417785
test eax, eax
jne 0x10029893
push 0x180
call fcn.10030093
mov esi, eax
add esp, 4
mov dword [ebp - 0x230], esi
push 0x180
push 0
push esi
mov byte [ebp - 4], 0xa
call fcn.10031db0
movaps xmm0, xmmword [str.dddd]
push ecx
mov eax, esp
mov dword [esi + 0x6c], 0
push 0
push 0
mov ecx, esi
movups xmmword [eax], xmm0
call edi
push 0x120
call fcn.10030093
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push 0x120
push 0
push edi
call fcn.10031db0
mov esi, dword [esi]
lea eax, [ebp - 0x1c]
add esp, 0xc
push eax
push 0x40
push 0x120
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x1c]
mov ecx, 0x48
push eax
push dword [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
push 0x120
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x230]
mov edi, 0x417785
mov byte [ebp - 4], 2
mov dword [eax], esi
mov esi, dword [ebp - 0x22c]
mov dword [esi + 8], eax
mov byte [eax + 0x28], 1
mov edx, 0x417ed4
mov eax, dword [esi + 8]
mov byte [eax + 0x29], 1
mov eax, dword [esi + 8]
mov byte [eax + 0x15], 0
mov eax, dword [esi + 8]
mov byte [eax + 0x16], 0
mov eax, dword [esi + 8]
mov byte [eax + 0x17], 0
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [eax + 0x84], 0x10028d70
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x238], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
cmp eax, ecx
je 0x10029cec
nop dword [eax]
add eax, 8
push 0x180
mov dword [ebp - 0x230], eax
call fcn.10030093
mov esi, eax
add esp, 4
mov dword [ebp - 0x254], esi
push 0x180
push 0
push esi
mov byte [ebp - 4], 0xb
call fcn.10031db0
movaps xmm0, xmmword [str.dddd]
push ecx
mov eax, esp
mov dword [esi + 0x6c], 0
push 0
push 0
mov ecx, esi
movups xmmword [eax], xmm0
call edi
push 0x120
call fcn.10030093
add esp, 4
mov edi, eax
mov dword [ebp - 0x240], edi
push 0x120
push 0
push edi
call fcn.10031db0
mov esi, dword [esi]
lea eax, [ebp - 0x4c]
add esp, 0xc
push eax
push 0x40
push 0x120
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x4c]
mov ecx, 0x48
push eax
push dword [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x240]
push 0x120
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x254]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x230]
mov dword [eax], esi
mov ecx, dword [ecx + 0x1c]
mov dword [ebp - 0x260], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x240], eax
cmp eax, ecx
je 0x10029c04
nop
add eax, 8
push 0x180
mov dword [ebp - 0x244], eax
call fcn.10030093
mov esi, eax
add esp, 4
mov dword [ebp - 0x250], esi
push 0x180
push 0
push esi
mov byte [ebp - 4], 0xc
call fcn.10031db0
movaps xmm0, xmmword [str.dddd]
push ecx
mov eax, esp
mov dword [esi + 0x6c], 0
push 0
push 0
mov ecx, esi
movups xmmword [eax], xmm0
mov eax, 0x417785
call eax
push 0x120
call fcn.10030093
add esp, 4
mov edi, eax
mov dword [ebp - 0x258], edi
push 0x120
push 0
push edi
call fcn.10031db0
mov esi, dword [esi]
lea eax, [ebp - 0x50]
add esp, 0xc
push eax
push 0x40
push 0x120
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x50]
mov ecx, 0x48
push eax
push dword [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x258]
push 0x120
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x250]
mov byte [ebp - 4], 2
mov dword [eax], esi
mov eax, dword [ebp - 0x244]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x258], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10029b22
nop
mov edi, dword [esi + 0x50]
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x38]
add edi, 0x10000
call fcn.10002f20
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x38]
cmp dword [ebp - 0x24], 0xf
lea ecx, [ebp - 0x264]
cmova eax, dword [ebp - 0x38]
push eax
mov eax, 0x575f30
call eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
cmp edx, 0xf
jbe 0x10029aea
mov eax, dword [ebp - 0x38]
inc edx
mov ecx, eax
cmp edx, 0x1000
jb 0x10029ae0
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x1002a0b4
push edx
push eax
call fcn.100300c8
add esp, 8
mov ecx, dword [ebp - 0x250]
mov eax, 0x417910
push 0
push edi
push dword [ebp - 0x264]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call eax
mov eax, dword [esi]
mov esi, eax
cmp eax, dword [ebp - 0x258]
jne 0x10029a80
mov esi, dword [ebp - 0x250]
mov eax, 0x417ed4
mov ecx, dword [0x63d5cc]
push esi
call eax
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [edi + 0x38]
call fcn.1002ad20
push dword [ebp - 0x244]
lea ecx, [ebp - 0x38]
mov dword [eax], esi
mov esi, dword [ebp - 0x48]
or esi, 0x80000000
mov dword [ebp - 0x48], esi
call fcn.10002f20
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x38]
cmp dword [ebp - 0x24], 0xf
lea ecx, [ebp - 0x25c]
cmova eax, dword [ebp - 0x38]
push eax
mov eax, 0x575f30
call eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x10029bbc
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029bb2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0b4
push ecx
push edx
call fcn.100300c8
add esp, 8
push 0
push esi
push dword [ebp - 0x25c]
mov esi, dword [ebp - 0x254]
mov eax, 0x417910
mov ecx, esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0x240], ecx
cmp ecx, dword [ebp - 0x260]
jne 0x100299b0
jmp 0x10029c10
mov esi, dword [ebp - 0x254]
mov edi, dword [ebp - 0x22c]
mov ecx, dword [0x63d5cc]
mov eax, 0x417ed4
push esi
call eax
mov dword [ebp - 0x1c], eax
lea ecx, [edi + 0x38]
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ad20
push dword [ebp - 0x230]
lea ecx, [ebp - 0x38]
mov dword [eax], esi
mov esi, dword [ebp - 0x1c]
mov edi, dword [edi + 8]
or esi, 0x80000000
mov dword [ebp - 0x1c], esi
call fcn.10002f20
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x38]
cmp dword [ebp - 0x24], 0xf
lea ecx, [ebp - 0x248]
cmova eax, dword [ebp - 0x38]
push eax
mov eax, 0x575f30
call eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x10029ca1
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029c97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0b4
push ecx
push edx
call fcn.100300c8
add esp, 8
push 0
push esi
push dword [ebp - 0x248]
mov ecx, edi
mov dword [ebp - 0x28], 0
mov eax, 0x417910
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0x18], eax
cmp ecx, dword [ebp - 0x238]
je 0x10029ce1
mov edi, 0x417785
jmp 0x100298e0
mov esi, dword [ebp - 0x22c]
mov edx, 0x417ed4
push dword [esi + 8]
mov ecx, dword [0x63d5cc]
lea edi, [esi + 0x10]
call edx
mov ecx, dword [ebp - 0x22c]
mov esi, dword [esi + 8]
add ecx, 0x38
push edi
mov dword [edi], eax
call fcn.1002ad20
mov edi, dword [ebp - 0x22c]
mov dword [eax], esi
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x10029dd6
push 0x180
call fcn.10030093
mov esi, eax
add esp, 4
mov dword [ebp - 0x248], esi
push 0x180
push 0
push esi
mov byte [ebp - 4], 0x10
call fcn.10031db0
movaps xmm0, xmmword [str.dddd]
push ecx
mov eax, esp
mov dword [esi + 0x6c], 0
push 0
push 0
mov ecx, esi
movups xmmword [eax], xmm0
mov eax, 0x417785
call eax
push 0x120
call fcn.10030093
add esp, 4
mov edi, eax
mov dword [ebp - 0x238], edi
push 0x120
push 0
push edi
call fcn.10031db0
mov esi, dword [esi]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
push 0x40
push 0x120
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
mov ecx, 0x48
push eax
push dword [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x238]
push 0x120
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x248]
mov edi, dword [ebp - 0x22c]
mov byte [ebp - 4], 2
mov dword [eax], esi
mov dword [edi + 0xc], eax
mov byte [eax + 0x28], 1
mov eax, dword [edi + 0xc]
push 0xb0
push 0
mov eax, dword [eax]
mov dword [eax + 0x84], 0x10028d30
lea eax, [ebp - 0x228]
push eax
call fcn.10031db0
add esp, 8
lea ecx, [ebp - 0x228]
call fcn.10012b50
mov edx, 0x10063fec
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x218]
call fcn.10004f20
mov ecx, dword [0x7f94cc]
lea edx, [ecx + 1]
mov ecx, eax
call fcn.10004f20
mov edx, str._spellsets.ini
mov ecx, eax
call fcn.10004f20
mov esi, dword [edi]
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x210]
call fcn.10003e40
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 0x12
cmp esi, eax
je 0x10029e78
cmp dword [ebp - 0x26c], 0xf
mov ecx, esi
push dword [ebp - 0x270]
cmova eax, dword [ebp - 0x280]
push eax
call fcn.100040a0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x26c]
cmp ecx, 0xf
jbe 0x10029eb6
mov edx, dword [ebp - 0x280]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029eac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0c3
push ecx
push edx
call fcn.100300c8
add esp, 8
mov ecx, dword [edi]
lea eax, [ebp - 0x74]
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
push eax
movq qword [ebp - 0x74], xmm0
call fcn.10023000
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x238]
mov esi, dword [edi + 0xc]
mov eax, 0x575f30
push str.Spell_Sets
call eax
push 0
push 0x30000
push dword [ebp - 0x238]
mov ecx, esi
mov eax, 0x417910
call eax
mov ecx, dword [edi + 0xc]
push 0
push eax
mov eax, 0x579f90
call eax
mov ecx, dword [edi + 0xc]
mov eax, 0x417a41
call eax
mov eax, dword [ebp - 0x70]
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x260], eax
cmp esi, eax
je 0x1002a01f
lea eax, [edi + 0x40]
mov edi, 0x20000
mov dword [ebp - 0x25c], eax
nop dword [eax + eax]
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x238], edi
push ecx
mov ecx, eax
call fcn.1002ac00
cmp eax, esi
je 0x10029f6d
cmp dword [esi + 0x14], 0xf
mov ecx, esi
jbe 0x10029f62
mov ecx, dword [esi]
push dword [esi + 0x10]
push ecx
mov ecx, eax
call fcn.100040a0
mov eax, dword [ebp - 0x22c]
lea ecx, [ebp - 0x68]
push esi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x238], eax
call fcn.10002f20
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x54], 0xf
lea ecx, [ebp - 0x248]
cmova eax, dword [ebp - 0x68]
push eax
mov eax, 0x575f30
call eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xf
jbe 0x10029fda
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10029fd0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0b4
push ecx
push edx
call fcn.100300c8
add esp, 8
mov ecx, dword [ebp - 0x238]
mov eax, 0x417910
push 0
push edi
push dword [ebp - 0x248]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
call eax
add esi, 0x18
inc edi
cmp esi, dword [ebp - 0x260]
je 0x1002a019
mov eax, dword [ebp - 0x25c]
jmp 0x10029f40
mov edi, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
add edi, 0x14
mov ecx, dword [0x63d5cc]
push dword [eax + 0xc]
mov eax, 0x417ed4
call eax
mov dword [edi], eax
mov eax, dword [ebp - 0x22c]
push edi
mov esi, dword [eax + 0xc]
lea ecx, [eax + 0x38]
call fcn.1002ad20
lea ecx, [ebp - 0x74]
mov dword [eax], esi
call fcn.1000e6e0
lea ecx, [ebp - 0x228]
call fcn.10010e80
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x1002a094
mov ecx, dword [ebp - 0x3c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1002a08a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a0c8
push ecx
push edx
call fcn.100300c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10030080
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.10037284
push str.list_too_long
call fcn.1002ec15
call fcn.10037284
call fcn.10037284
nop dword [eax]
mov esi, 0xbe100293
xchg ebx, eax
add dl, byte [eax]
scasd eax, dword es:[edi]
xchg ebx, eax
add dl, byte [eax]
int 0x93
add dl, byte [eax]