Function at 0x10028cb0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x100a1040]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc8]
push ebp
push esi
mov dword [esp + 0x3c], eax
xor ebp, ebp
mov eax, dword [esp + 0xcc]
push edi
xor edi, edi
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x48], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x30], ebp
test ebx, ebx
jle 0x10028f54
lea eax, [esp + 0x7c]
mov dword [esp + 0x38], ebx
sub eax, edx
mov esi, ecx
mov dword [esp + 0x54], eax
sub edx, ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
sub eax, ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], eax
nop
mov edi, dword [esi]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], eax
mov ecx, dword [edi]
mov dword [esp + 0x4c], ecx
test ecx, ecx
jle 0x10028e8e
add edx, dword [esp + 0x54]
mov ecx, dword [edi + 4]
add edx, esi
mov ebp, dword [edi + 8]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x18], edx
xor esi, esi
mov dword [edx], 0
xor ecx, ecx
test ebp, ebp
jle 0x10028e5f
cmp ebp, 8
jb 0x10028e2d
mov edi, dword [edi + 0x834]
lea edx, [eax*4]
dec eax
lea ecx, [esp + 0x7c]
add eax, ebp
lea ebx, [esp + ebp*4 + 0x78]
lea eax, [edi + eax*4]
cmp ecx, eax
ja 0x10028db7
lea eax, [edi + edx]
xor ecx, ecx
cmp ebx, eax
jae 0x10028e1d
mov eax, ebp
and eax, 0x80000007
jns 0x10028dc5
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, ebp
xorps xmm2, xmm2
sub ecx, eax
xorps xmm1, xmm1
nop
movups xmm0, xmmword [edi + edx]
add esi, 8
lea edx, [edx + 0x20]
psrad xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmmword [edi + edx - 0x10]
psrad xmm0, 8
paddd xmm1, xmm0
cmp esi, ecx
jl 0x10028dd0
mov edx, dword [esp + 0x18]
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd dword [edx], xmm1
mov ecx, dword [edx]
jmp 0x10028e21
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
cmp esi, ebp
jge 0x10028e5f
mov ebx, dword [edi + 0x834]
lea edx, [esi + eax]
mov edi, ebp
shl edx, 2
sub edi, esi
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
sar eax, 8
add ecx, eax
sub edi, 1
jne 0x10028e41
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
mov dword [edx], ecx
add eax, dword [esp + 0x44]
add ebx, ecx
mov edi, dword [esp + 0x10]
add edx, 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], edx
cmp eax, dword [esp + 0x4c]
jl 0x10028d74
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x3c]
add edi, ebx
mov dword [esp + 0x3c], edi
mov eax, dword [eax]
cmp dword [eax + 0xc], 2
jne 0x10028eab
mov eax, 0x40000000
jmp 0x10028ebe
mov eax, dword [esi + edx]
add eax, 0x1dd0
push eax
push dword [esi]
call fcn.10026820
add esp, 8
mov ecx, dword [esp + 0x1c]
mov dword [ecx + esi], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x20]
shl edx, 1
mov dword [esp + 0x10], edx
add ebp, dword [esp + 0x10]
add esi, 4
sub dword [esp + 0x38], 1
mov edx, dword [esp + 0x24]
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], esi
jne 0x10028d40
cmp edi, ebp
jle 0x10028f50
bsr eax, edi
mov ecx, 0x1f
mov dword [esp + 0x1c], 0
setne dl
sub ecx, eax
test dl, dl
mov eax, 0x20
cmovne eax, ecx
lea ecx, [eax - 1]
shl ebp, cl
shl edi, cl
cmp ebp, edi
jne 0x10028f2e
mov edi, dword [esp + 0x3c]
mov esi, 0x7fffffff
jmp 0x10028f59
mov eax, ebp
cdq
mov esi, eax
mov ecx, edx
mov eax, edi
cdq
push edx
shld ecx, esi, 0x1f
push eax
shl esi, 0x1f
push ecx
push esi
call fcn.1003b710
mov edi, dword [esp + 0x3c]
mov esi, eax
jmp 0x10028f59
mov edi, dword [esp + 0x3c]
mov esi, 0x7fffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 0x20000000
mov eax, dword [esp + 0x10]
imul dword [esp + 0x20]
shl edx, 1
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], 0x60000000
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
cmp esi, eax
mov dword [esp + 0x10], 0x4aaaaa80
cmovl eax, esi
mov dword [ebx], eax
add eax, 0xe6666660
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, 0x3333334
add eax, 0x6666668
cmp eax, ecx
cmovl eax, ecx
mov ecx, 0x1fffffff
cmp eax, ecx
cmovg eax, ecx
mov ecx, dword [esp + 0x28]
shl eax, 2
mov dword [esp + 0x20], eax
mov eax, dword [ecx]
cmp dword [eax + 0xc], 2
jne 0x1002936e
cmp dword [eax], 0
mov dword [esp + 0x38], 0
jle 0x100293c4
lea eax, [esp + 0x5c]
sar edi, 3
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x5c]
xor ebp, ebp
mov dword [esp + 0x3c], edi
mov eax, 0x110
mov dword [esp + 0x4c], 0x16302f
lea esi, [esp + 0x8c]
mov dword [esp + 0x30], ebp
sub eax, ecx
mov dword [esp + 0x34], esi
mov dword [esp + 0x14], eax
nop dword [eax]
mov eax, dword [esp + 0xd4]
xor ebx, ebx
xor ecx, ecx
test eax, eax
jle 0x100290a2
cmp eax, 8
jb 0x100290a2
mov edx, eax
xorps xmm2, xmm2
and edx, 0xfffffff8
xorps xmm1, xmm1
mov eax, esi
movups xmm0, xmmword [eax - 0x10]
add ecx, 8
lea eax, [eax + 0x20]
paddd xmm2, xmm0
movups xmm0, xmmword [eax - 0x20]
paddd xmm1, xmm0
cmp ecx, edx
jl 0x10029061
mov eax, dword [esp + 0xd4]
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ebx, xmm1
xor esi, esi
xor edi, edi
cmp ecx, eax
jge 0x100290f3
sub eax, ecx
cmp eax, 2
jl 0x100290de
lea eax, [ecx + ebp]
lea edx, [esp + 0x80]
lea edx, [edx + eax*4]
mov eax, dword [esp + 0xd4]
sub eax, ecx
sub eax, 2
shr eax, 1
inc eax
lea ecx, [ecx + eax*2]
add esi, dword [edx - 4]
lea edx, [edx + 8]
add edi, dword [edx - 8]
sub eax, 1
jne 0x100290d0
cmp ecx, dword [esp + 0xd4]
jge 0x100290ee
lea eax, [ecx + ebp]
add ebx, dword [esp + eax*4 + 0x7c]
lea eax, [edi + esi]
add ebx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
add eax, dword [esp + 0x14]
mov eax, dword [eax + ecx]
mov eax, dword [eax*4 + 0x1007c8e8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x1c]
shl edx, 1
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x3c]
mov ebp, ecx
cmp dword [esp + 0x10], ecx
cmovl ebp, dword [esp + 0x10]
sar ebp, 2
test ebp, ebp
jg 0x10029141
mov ebx, 0x80000000
jmp 0x10029228
bsr eax, ebp
mov edx, 0x1e
mov dword [esp + 0x1c], 0
mov ecx, 0x1f
mov esi, 0x80000000
setne bl
sub edx, eax
test bl, bl
cmovne ecx, edx
shl ebp, cl
mov edi, ecx
sub esi, ebp
neg edi
mov dword [esp + 0x1c], esi
xor ebx, ebx
mov dword [esp + 0x24], esi
mov ecx, 0x1007cda4
nop dword [eax]
movsx eax, word [ecx]
shl eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x24]
mov dword [esp + 0x10], edx
add ebx, dword [esp + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
imul dword [esp + 0x1c]
shl edx, 1
mov dword [esp + 0x10], edx
mov esi, dword [esp + 0x10]
add ecx, 2
mov dword [esp + 0x24], esi
cmp ecx, str.333_
jl 0x10029180
mov dword [esp + 0x1c], 0x71547653
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
imul dword [esp + 0x1c]
mov dword [esp + 0x10], edx
add ebx, dword [esp + 0x10]
test edi, edi
je 0x10029214
mov eax, edi
jns 0x100291e5
not eax
bsr ecx, eax
mov dword [esp + 0x1c], 0
setne al
test al, al
lea eax, [ecx - 0x1f]
jne 0x100291ff
mov eax, 0xffffffe0
add eax, 0x21
mov ecx, 0x1f
sub ecx, eax
shl edi, cl
lea ecx, [eax - 1]
sar ebx, cl
add ebx, edi
jmp 0x10029219
mov eax, 1
lea ecx, [eax - 6]
test ecx, ecx
jle 0x10029224
shl ebx, cl
jmp 0x10029228
neg ecx
sar ebx, cl
sar ebx, 2
mov eax, ebx
sar eax, 0x19
neg eax
test ebx, ebx
lea edi, [eax + 0x1f]
cmovle edi, eax
mov eax, ebx
sar eax, 0x14
xor esi, esi
and eax, 0x1f
cmp ebx, 0xc2000000
cmovge esi, dword [eax*4 + 0x1006fbb8]
mov eax, ebx
sar eax, 0xf
and eax, 0x1f
mov eax, dword [eax*4 + 0x1006fc38]
mov dword [esp + 0x1c], eax
mov eax, ebx
sar eax, 0xa
and eax, 0x1f
mov ecx, dword [eax*4 + 0x1006fcb8]
mov eax, ebx
and eax, 0x3ff
shl eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x4c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x1c]
shl edx, 1
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x44]
shl edx, 1
mov dword [esp + 0x10], edx
cmp edi, 0x1f
mov eax, 0x1f
cmovg edi, eax
mov eax, dword [esp + 0x10]
mov ecx, edi
lea esi, [eax*8]
shr esi, cl
xor ecx, ecx
cmp ebx, 0x3e000000
setge cl
xor eax, eax
test ebx, ebx
sete al
or ecx, eax
mov eax, 0x7fffffff
cmovne esi, eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x20]
shl edx, 1
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x1c]
shl edx, 1
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
add esi, 8
shl eax, 4
add ebp, 2
mov dword [edx], eax
add edx, 4
mov eax, dword [ecx]
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x18], edx
add edi, dword [eax + 4]
mov dword [esp + 0x38], edi
cmp edi, dword [eax]
jl 0x10029040
jmp 0x100293c4
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x20]
shl edx, 1
mov dword [esp + 0x10], edx
push 0
push edi
call fcn.10029820
sar eax, 2
push eax
call fcn.100203e0
mov dword [esp + 0x20], eax
add esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
shl eax, 2
mov dword [esp + 0x5c], eax
cmp dword [esp + 0xd4], 0
jle 0x100297fa
mov edx, dword [esp + 0x48]
xor esi, esi
mov eax, dword [esp + 0x40]
sub edx, ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x48], edx
mov edi, dword [edx + ecx]
xor ebx, ebx
mov edx, dword [ecx]
mov dword [esp + 0x44], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ebx
cmp dword [edx], ebx
jle 0x100297d3
xor ebp, ebp
cmp dword [edx + 8], ebp
jle 0x100297bc
mov ecx, dword [esp + 0x58]
lea edi, [edi + ebx*4]
lea eax, [esi + ebx]
add edi, 0x1ec0
mov dword [esp + 0x2c], edi
lea esi, [ecx + eax*4]
mov dword [esp + 0x34], esi
nop word [eax + eax]
mov eax, dword [edi]
mov ecx, dword [edi + 0x3c0]
mov esi, dword [esi]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x38], eax
cmp eax, 0xbe000000
jl 0x10029798
cmp ecx, eax
jle 0x10029798
mov eax, dword [esp + 0x40]
add eax, ebp
cmp byte [eax + ebx], 2
je 0x10029798
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
cmp dword [eax + 0xc], 2
jne 0x10029623
mov ecx, dword [esp + 0x18]
mov eax, ebp
cdq
mov dword [esp + 0x10], 0x5a3d7080
idiv dword [ecx + 4]
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov ecx, dword [ecx + ebx*4 + 0x110]
mov ecx, dword [ecx*4 + 0x1007c908]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + ebx*4 + 0x5c]
lea ecx, [eax*4]
mov eax, 0x8000
sub eax, edx
cmp ecx, eax
jg 0x100294eb
mov esi, 0x80000000
jmp 0x10029603
mov eax, 0x7fffffff
sub eax, ecx
cmp edx, eax
jl 0x100294fd
xor esi, esi
jmp 0x10029603
lea esi, [edx + ecx]
test esi, esi
jg 0x1002950e
mov esi, 0x80000000
jmp 0x10029600
bsr eax, esi
mov edx, 0x1e
mov dword [esp + 0x14], 0
mov ecx, 0x1f
mov edi, 0x80000000
setne bl
sub edx, eax
test bl, bl
cmovne ecx, edx
shl esi, cl
mov ebx, ecx
sub edi, esi
neg ebx
mov dword [esp + 0x14], edi
xor esi, esi
mov dword [esp + 0x24], edi
mov ecx, 0x1007cda4
nop dword [eax]
movsx eax, word [ecx]
shl eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x24]
mov dword [esp + 0x10], edx
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x10]
add ecx, 2
mov dword [esp + 0x24], edi
cmp ecx, str.333_
jl 0x10029550
mov dword [esp + 0x14], 0x71547653
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
mov dword [esp + 0x10], edx
add esi, dword [esp + 0x10]
test ebx, ebx
je 0x100295e4
mov eax, ebx
jns 0x100295b5
not eax
bsr ecx, eax
mov dword [esp + 0x14], 0
setne al
test al, al
lea eax, [ecx - 0x1f]
jne 0x100295cf
mov eax, 0xffffffe0
add eax, 0x21
mov ecx, 0x1f
sub ecx, eax
shl ebx, cl
lea ecx, [eax - 1]
sar esi, cl
add esi, ebx
jmp 0x100295e9
mov eax, 1
lea ecx, [eax - 6]
test ecx, ecx
jle 0x100295f4
shl esi, cl
jmp 0x100295f8
neg ecx
sar esi, cl
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
shl esi, 2
mov eax, dword [esp + 0x18]
push dword [eax + ebx*4 + 0x110]
call fcn.1000df80
add esi, 0xf4000000
add esp, 4
add esi, eax
jmp 0x10029733
mov ecx, dword [esp + 0x5c]
mov eax, 0x7fffffff
sub eax, esi
cmp ecx, eax
jl 0x10029639
xor esi, esi
jmp 0x10029733
add esi, ecx
test esi, esi
jg 0x10029649
mov esi, 0x80000000
jmp 0x10029730
bsr eax, esi
mov edx, 0x1e
mov dword [esp + 0x14], 0
mov ecx, 0x1f
mov edi, 0x80000000
setne bl
sub edx, eax
test bl, bl
cmovne ecx, edx
shl esi, cl
mov ebx, ecx
sub edi, esi
neg ebx
mov dword [esp + 0x14], edi
xor esi, esi
mov dword [esp + 0x24], edi
mov ecx, 0x1007cda4
movsx eax, word [ecx]
shl eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
imul dword [esp + 0x24]
mov dword [esp + 0x10], edx
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
shl edx, 1
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x10]
add ecx, 2
mov dword [esp + 0x24], edi
cmp ecx, str.333_
jl 0x10029684
mov dword [esp + 0x14], 0x71547653
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
imul dword [esp + 0x14]
mov dword [esp + 0x10], edx
add esi, dword [esp + 0x10]
test ebx, ebx
je 0x10029718
mov eax, ebx
jns 0x100296e9
not eax
bsr ecx, eax
mov dword [esp + 0x14], 0
setne al
test al, al
lea eax, [ecx - 0x1f]
jne 0x10029703
mov eax, 0xffffffe0
add eax, 0x21
lea ecx, [eax - 1]
sar esi, cl
mov ecx, 0x1f
sub ecx, eax
shl ebx, cl
add esi, ebx
jmp 0x1002971d
mov eax, 1
lea ecx, [eax - 6]
test ecx, ecx
jle 0x10029728
shl esi, cl
jmp 0x1002972c
neg ecx
sar esi, cl
mov edi, dword [esp + 0x2c]
shl esi, 2
mov edx, dword [esp + 0x4c]
mov eax, esi
mov ecx, dword [edi + 0xf0]
sub eax, edx
mov ebx, dword [esp + 0x20]
cmp eax, ecx
jle 0x10029776
mov eax, dword [esp + 0x40]
add eax, ebp
cmp byte [eax + ebx], 0
je 0x10029776
mov esi, dword [esp + 0x38]
mov eax, 0x80000000
sub eax, edx
cmp ecx, eax
jle 0x1002976c
lea eax, [ecx + edx]
cmp eax, esi
cmovg esi, eax
mov eax, dword [esp + 0x40]
add eax, ebp
mov byte [eax + ebx], 2
mov edx, dword [esp + 0x18]
cmp esi, 0xc0000000
mov eax, 0x80000000
cmovl esi, eax
mov eax, 0xbe000000
cmp esi, 0xbe000000
cmovl esi, eax
mov dword [edi], esi
mov esi, dword [esp + 0x34]
inc ebp
add esi, 4
add edi, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], edi
cmp ebp, dword [edx + 8]
jl 0x10029430
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
add ebx, dword [edx + 4]
mov dword [esp + 0x20], ebx
cmp ebx, dword [edx]
jl 0x10029401
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x48]
add ecx, 4
add esi, 0x3c
mov dword [esp + 0x28], ecx
add eax, 0x3c
mov dword [esp + 0x30], esi
sub dword [esp + 0xd4], 1
mov dword [esp + 0x40], eax
jne 0x100293e6
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b025
add esp, 0xb0
ret