Function at 0x407070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0xec]
push edi
mov dword [esp + 0x4c], ebx
cmp eax, 0xf3c
jge 0x476976
inc eax
mov dword [ebx + 0xec], eax
cmp eax, 1
je 0x4074f0
cmp byte [ebx + 0x100], 0
mov byte [ebx + 0x148], 0
jne 0x407367
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [ebx + 0x148], 0
mov edx, 2
jne 0x407367
cmp byte [0x4c30b7], 0
jne 0x476991
cmp byte [0x4c3660], 0
jne 0x4769a3
push 1
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
jne 0x407490
cmp byte [0x4c30c0], 1
je 0x4769cb
cmp dword [ebx + 0xfc], 1
je 0x4771f7
mov edx, 2
cmp dword [0x4c3104], 0
jne 0x4769e8
cmp byte [0x4c30c5], 1
je 0x476a75
cmp dword [ebx + 0x480], 0
je 0x4071a4
cmp byte [0x4c4180], 0
jne 0x4071a4
mov esi, dword [ebx + 0x478]
lea eax, [ebx + 0x478]
mov byte [0x4c4180], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
lea ecx, [ecx]
test esi, esi
jne 0x40738f
mov ebx, dword [esp + 0x10]
lea esp, [esp]
mov eax, dword [ebx]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4073d8
mov ebx, dword [esp + 0x4c]
mov byte [0x4c4180], al
cmp dword [esp + 0x1c], eax
jg case.default.0x476fb0
lea edx, [eax + 2]
cmp byte [0x4c3634], 0
je 0x407257
cmp byte [ebx + 0x484], 1
je 0x407257
cmp byte [0x4c3660], 1
je 0x407257
xor ecx, ecx
mov eax, 8
mul edx
seto cl
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 8
neg ecx
or ecx, eax
push ecx
call fcn.0042302a
add esp, 4
xor ecx, ecx
push 4
mov dword [esp + 0x58], eax
mov word [eax], cx
call fcn.0042302a
add esp, 4
test eax, eax
je 0x407586
mov dword [eax], 1
mov dword [esp + 0x60], eax
lea esp, [esp]
cmp dword [0x4c3654], 0
jne 0x476ab1
cmp byte [0x4c3634], 0
je 0x476c34
mov esi, dword [esp + 0x60]
dec dword [esi]
jne 0x407257
push dword [esp + 0x54]
call fcn.0042309e
add esp, 4
push esi
call fcn.0042309e
add esp, 4
mov ecx, ebx
call fcn.00407630
cmp al, 1
je case.default.0x476fb0
cmp byte [0x4c37a8], 0
jne 0x476c66
mov eax, dword [ebx + 0xfc]
cmp eax, 7
je 0x476d6b
cmp eax, 8
je 0x4770b6
cmp eax, 9
je 0x4770b6
cmp eax, 2
je 0x476f5a
cmp eax, 3
je 0x476f5a
cmp eax, 4
je 0x476f5a
cmp eax, 5
je 0x476f5a
cmp eax, 6
je 0x476f5a
mov eax, dword [ebp + 8]
mov dword [ebx + 0xf4], eax
mov esi, eax
inc eax
mov dword [ebp + 8], eax
cmp esi, dword [0x4c4110]
jg 0x476f4b
test esi, esi
jle 0x476f4b
shl esi, 4
add esi, dword [0x4c414c]
je 0x476f4b
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
mov edi, dword [eax]
mov dword [esp + 0x1c], edx
movsx eax, word [edi + 8]
test eax, eax
jne 0x4073ec
lea eax, [ebp + 8]
push eax
push esi
mov ecx, ebx
call fcn.00407660
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x407467
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
cmp ecx, 5
jge 0x476e9a
mov dword [esp + 0x2c], 1
mov dword [esp + 0x20], 0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [ebx + 0x100], 0
je 0x4070c0
mov eax, dword [ebx + 0xec]
mov byte [ebx + 0x148], 0
cmp eax, 1
je 0x4074fa
dec eax
mov dword [ebx + 0xec], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esi]
cmp byte [edi + 0x11], 0
jne 0x4073d0
mov edi, dword [edi + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
sub eax, edi
xor edx, edx
cmp edi, 0x7fffffff
ja 0x476a8f
cmp ecx, 0x7fffffff
ja 0x4073bb
cdq
mov edi, dword [esi]
test edx, edx
jl 0x4073d0
jg 0x40754c
cmp eax, dword [edi + 0x18]
jae 0x40754c
mov esi, dword [esi + 4]
jmp 0x407170
mov ecx, dword [eax]
cmp byte [ecx + 0x11], 0
jne 0x476aa0
mov eax, dword [eax + 4]
jmp 0x407182
cmp eax, 0x33
jne 0x4073fe
push esi
mov ecx, ebx
call fcn.00408600
jmp 0x407327
dec eax
cmp eax, 0x7e
ja case.0x40740f.2
movzx eax, byte [eax + 0x4075a4]
jmp dword [eax*4 + 0x407590]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0
mov ecx, ebx
call fcn.00418430
test eax, eax
js 0x407327
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
cmp word [eax + 8], 0x7f
je 0x407327
jmp 0x476e64
lea eax, [esp + 0x4b]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
push esi
push 0
mov ecx, ebx
call fcn.00405b60
jmp 0x40742a
mov eax, dword [esi + 0xc]
dec dword [eax]
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x476e80
push esi
call fcn.0042309e
add esp, 4
mov dword [esp + 0x28], 0
jmp 0x407333
cmp dword [esp + 0x54], 0x12
je 0x4769b5
lea eax, [esp + 0x50]
push eax
mov ecx, 0x4c3628
call fcn.0042194f
test eax, eax
jne 0x4074d7
lea eax, [esp + 0x50]
push eax
mov ecx, 0x4c3628
call fcn.004216da
test eax, eax
jne 0x4074d7
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
je 0x407103
jmp 0x407490
call fcn.004211b9
jmp 0x4070a6
mov ecx, ebx
call fcn.004172dc
cmp byte [ebx + 0x100], 1
je 0x407384
mov ecx, ebx
call fcn.004211e5
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [0x4c30e8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea eax, [esp + 0xe8]
push eax
call esi
test eax, eax
jle 0x407384
jmp 0x477216
inc dword [esp + 0x1c]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 0x14], eax
push dword [esi]
mov ecx, ebx
call fcn.00404687
mov ecx, dword [esi]
push 0
mov byte [ecx + 0x10], 1
mov eax, dword [eax + 0x10]
push 1
inc eax
push eax
mov ecx, ebx
call fcn.004175d4
mov eax, dword [esi]
mov byte [eax + 0x10], 0
mov esi, dword [esi + 4]
jmp 0x407170
xor eax, eax
jmp 0x407215
push 0xffffffffffffffff
push 0x9a
mov byte [0x4c30b6], 0
call fcn.0044fa8a
or eax, 0xffffffff
jmp 0x407386
cmp byte [ebx + 0x149], 0
je 0x407122
jmp 0x4070df
cmp dword [ebx + 0xfc], 0
je 0x407122
jmp 0x4070ec
mov byte [ebx + 0x100], 1
mov dword [ebx + 0xfc], 1
jmp 0x407103
mov byte [0x4c30c5], 0
mov byte [0x4c30c0], 0
mov dword [ebx + 0xfc], 1
jmp 0x407110
mov eax, dword [0x4c3108]
mov esi, dword [eax]
call fcn.0044fdd9
mov edx, dword [ebx + 0x1cc]
xor edi, edi
test edx, edx
je 0x476a1a
mov ecx, dword [ebx + 0x1c8]
mov eax, dword [ecx]
mov eax, dword [eax]
test eax, eax
je 0x476a12
cmp dword [eax], esi
je 0x476a1a
inc edi
add ecx, 4
cmp edi, edx
jb 0x476a06
cmp edi, edx
je 0x476a65
mov eax, dword [ebx + 0x1c8]
mov ecx, ebx
mov eax, dword [eax + edi*4]
mov eax, dword [eax]
add eax, 8
push eax
call fcn.00404687
mov ecx, dword [ebx + 0x1c8]
mov esi, eax
mov ecx, dword [ecx + edi*4]
mov ecx, dword [ecx]
add ecx, 0x18
push ecx
lea ecx, [ebx + 0x150]
call fcn.0040e442
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
mov ecx, ebx
call fcn.004175d4
jmp case.default.0x476fb0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edx, 2
jmp 0x40712f
cmp byte [0x4c30b7], 0
jne 0x40713c
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40735a
cmp ecx, 0x7fffffff
jbe 0x4073bb
jmp 0x4073ba
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.0044fe59
jmp 0x407180
mov eax, dword [0x4c3658]
lea ecx, [esp + 0x50]
mov esi, dword [eax]
push esi
call fcn.004698fd
mov ecx, 0x4c3654
call fcn.0046f455
test esi, esi
je 0x476ad8
push ecx
mov ecx, esi
call fcn.0044835b
cmp dword [esp + 0x58], 0
mov dword [0x4c4184], 0
je 0x407220
lea eax, [esp + 0x54]
push eax
mov ecx, ebx
call fcn.00404687
mov esi, eax
test esi, esi
je 0x407220
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
call fcn.00406a80
mov eax, dword [esp + 0x50]
push str._GUI_CTRLID
lea ecx, [esp + 0xd0]
mov dword [esp + 0x40], 1
mov dword [esp + 0x34], eax
call fcn.00405039
push 2
push 1
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.0040c664
lea ecx, [esp + 0xcc]
call fcn.0040e281
lea ecx, [esp + 0x30]
call fcn.00406a80
mov eax, dword [esp + 0x64]
push str._GUI_WINHANDLE
lea ecx, [esp + 0xc0]
mov dword [esp + 0x40], 7
mov dword [esp + 0x34], eax
call fcn.00405039
push 2
push 1
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc8]
push eax
call fcn.0040c664
lea ecx, [esp + 0xbc]
call fcn.0040e281
lea ecx, [esp + 0x30]
call fcn.00406a80
mov eax, dword [esp + 0x68]
push str._GUI_CTRLHANDLE
lea ecx, [esp + 0xa0]
mov dword [esp + 0x40], 7
mov dword [esp + 0x34], eax
call fcn.00405039
push 2
push 1
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.0040c664
lea ecx, [esp + 0x9c]
call fcn.0040e281
mov byte [ebx + 0x484], 1
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
mov ecx, ebx
call fcn.004175d4
lea ecx, [esp + 0x30]
mov byte [ebx + 0x484], 0
call fcn.00406a80
lea ecx, [esp + 0x50]
call fcn.0044f786
jmp case.default.0x476fb0
cmp dword [0x4c3794], 0
jne 0x476c59
cmp dword [0x4c4184], 0x64
jge 0x476c59
inc dword [0x4c4184]
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40723a
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40723a
cmp byte [ebx + 0x485], 1
je 0x407273
lea ecx, [esp + 0x54]
call fcn.0040e4fe
lea eax, [esp + 0x50]
push eax
mov ecx, 0x4c3708
call fcn.00448631
test al, al
je 0x476d5d
cmp dword [esp + 0x58], 0
je 0x476c7c
lea eax, [esp + 0x54]
push eax
mov ecx, ebx
call fcn.00404687
mov esi, eax
test esi, esi
je 0x476c7c
lea ecx, [esp + 0x88]
mov dword [esp + 0x88], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 1
call fcn.00406a80
mov eax, dword [esp + 0x50]
push str._TRAY_ID
lea ecx, [esp + 0xb0]
mov dword [esp + 0x98], 1
mov dword [esp + 0x8c], eax
call fcn.00405039
push 2
push 1
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.0040c664
lea ecx, [esp + 0xac]
call fcn.0040e281
mov byte [ebx + 0x485], 1
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
mov ecx, ebx
call fcn.004175d4
lea ecx, [esp + 0x88]
mov byte [ebx + 0x485], 0
call fcn.00406a80
lea ecx, [esp + 0x50]
call fcn.0044f786
jmp case.default.0x476fb0
lea ecx, [esp + 0x54]
call fcn.0040e281
jmp 0x407273
push 0xa
push dword [ebx + 0x470]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [esp + 0x74], eax
cmp eax, 0x102
je case.default.0x476fb0
lea eax, [esp + 0x74]
push eax
push dword [ebx + 0x470]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [ebx + 0x470]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], eax
jmp 0x476dc8
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x474], 0
mov dword [esp + 0x10], 0
push ecx
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0041531e
mov byte [ebx + 0x148], 1
mov dword [ebx + 0xfc], 0
jmp case.default.0x476fb0
lea ecx, [ebx + 0x16c]
call fcn.00460fb3
mov ecx, eax
call fcn.0045f514
test al, al
jne 0x476e25
movsx eax, word [edi + 0xa]
push eax
push 0xa7
mov ecx, ebx
call fcn.0044fa8a
lea ecx, [esp + 0x20]
call fcn.00418370
jmp case.default.0x476fb0
lea ecx, [ebx + 0x16c]
call fcn.00460fb3
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push esi
mov ecx, ebx
call fcn.00460817
jmp 0x40742a
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
push esi
mov ecx, ebx
call fcn.004092d0
jmp 0x40742a
movsx eax, word [eax + 0xa]
push eax
push 0x72
mov ecx, ebx
call fcn.0044fa8a
lea ecx, [esp + 0x20]
call fcn.00418370
jmp case.default.0x476fb0
push dword [esi]
call fcn.0042309e
add esp, 4
push dword [esi + 0xc]
call fcn.0042309e
add esp, 4
jmp 0x407478
add ecx, 0xfffffffb
cmp ecx, 0xa
ja case.0x476ea6.6
jmp dword [ecx*4 + 0x47724e]
test edx, edx
je case.0x476ea6.6
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x20]
call fcn.0042309e
add esp, 4
jmp case.0x476ea6.6
test edx, edx
je case.0x476ea6.6
push ecx
mov ecx, edx
call fcn.00448373
jmp case.0x476ea6.6
lea ecx, [esp + 0x20]
call fcn.004181fa
jmp case.0x476ea6.6
push dword [edx + 4]
call fcn.0042309e
add esp, 4
push dword [esp + 0x20]
call fcn.0042309e
add esp, 4
jmp case.0x476ea6.6
test edx, edx
je case.0x476ea6.6
push ecx
mov ecx, edx
call fcn.00417956
jmp case.0x476ea6.6
test edx, edx
je case.0x476ea6.6
push ecx
mov ecx, edx
call fcn.0043d328
jmp case.0x476ea6.6
test edx, edx
je case.0x476ea6.6
push ecx
mov ecx, edx
call fcn.0040ea87
jmp case.0x476ea6.6
mov dword [ebx + 0xfc], 1
jmp case.default.0x476fb0
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebx + 0x310], 0
je 0x476f9e
mov ecx, dword [ebx + 0x318]
call fcn.0041feff
test edx, edx
jl 0x476f9e
jg 0x476f84
cmp eax, dword [ebx + 0x310]
jb 0x476f9e
cmp dword [ebx + 0xfc], 2
je 0x476dda
mov dword [esp + 0x10], 0
jmp 0x476dc8
mov eax, dword [ebx + 0xfc]
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x476fb0
jmp dword [eax*4 + 0x47727a]
mov ecx, ebx
call fcn.00469825
jmp 0x476fe9
mov ecx, ebx
call fcn.00469825
jmp 0x476fd2
push 1
mov ecx, ebx
call fcn.00421f0d
mov esi, eax
test esi, esi
js 0x476fef
jg case.default.0x476fb0
jmp 0x477028
push 1
mov ecx, ebx
call fcn.00421f0d
mov esi, eax
test esi, esi
jns 0x47701e
mov eax, esi
neg eax
push 0
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.00421562
push ecx
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx]
mov dword [esp + 0x18], 0
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0041531e
test esi, esi
je case.default.0x476fb0
test esi, esi
jle 0x477095
mov eax, dword [ebx + 0xfc]
cmp eax, 5
je 0x477038
cmp eax, 3
jne 0x477095
mov eax, dword [ebx + 0x1f8]
lea ecx, [esp + 0x78]
mov esi, dword [eax]
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 1
call fcn.00406a80
push 0
lea eax, [esp + 0x7c]
push eax
mov eax, dword [ebx]
mov dword [esp + 0x8c], 7
mov ecx, dword [eax + 4]
add ecx, ebx
mov dword [esp + 0x80], esi
call fcn.0045f646
lea ecx, [esp + 0x78]
call fcn.00406a80
mov ecx, dword [ebx + 0x314]
mov byte [ebx + 0x148], 1
mov dword [ebx + 0xfc], 0
call fcn.0044b318
jmp case.default.0x476fb0
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebx + 0x468], 0
je 0x4770f3
mov ecx, dword [ebx + 0x46c]
call fcn.0041feff
test edx, edx
jl 0x4770f3
jg 0x4770e0
cmp eax, dword [ebx + 0x468]
jb 0x4770f3
mov eax, dword [ebx + 0x474]
test eax, eax
je 0x476dc0
jmp 0x476daf
mov eax, dword [ebx + 0xfc]
xor esi, esi
mov byte [esp + 0xf], 0
mov dword [esp + 0x10], esi
cmp eax, 8
jne 0x477131
mov ecx, dword [ebx + 0x458]
lea eax, [esp + 0xf]
push eax
lea edx, [esp + 0x14]
call fcn.00449ebd
add esp, 4
cmp byte [esp + 0xf], 1
jne case.default.0x476fb0
mov esi, dword [esp + 0x10]
jmp 0x47713a
cmp eax, 9
jne case.default.0x476fb0
mov ecx, dword [ebx + 0x474]
mov eax, 0xcccccccc
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x477193
lea eax, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
cmp dword [esp + 0x44], 0x103
jne 0x477179
push 0
push dword [ebx + 0x474]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne case.default.0x476fb0
push dword [ebx + 0x474]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x44]
mov dword [ebx + 0x474], 0
cmp dword [ebx + 0xfc], 8
jne 0x4771c6
mov dword [esp + 0x10], esi
fild dword [esp + 0x10]
test esi, esi
jns 0x4771ae
fadd qword [0x4b8a00]
push ecx
fstp qword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.00461ad8
jmp 0x4771d5
push 0
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.004151fd
push dword [ebx + 0x314]
mov byte [ebx + 0x148], 1
mov dword [ebx + 0xfc], 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp case.default.0x476fb0
push ecx
lea eax, [esp + 0x50]
push eax
mov eax, dword [ebx]
mov dword [esp + 0x54], 0
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0041531e
jmp 0x407367
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0xe8]
push eax
call esi
test eax, eax
jg 0x477216
jmp 0x407384