Function at 0x407710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x378
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push esi
mov dword [ebp - 0x50], ebx
call fcn.0042e320
cmp dword [0x515898], 0
jne 0x4086be
push 0xa6
push esi
mov ecx, ebx
mov dword [0x515898], 1
call fcn.0042dce0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xc
push 1
push esi
call edi
push eax
mov ecx, ebx
call fcn.0042dce0
push 0x506
push 0x504
push esi
call edi
push eax
mov ecx, ebx
call fcn.0042dce0
push 0x518
push 0x519
push esi
call edi
push eax
mov ecx, ebx
call fcn.0042dce0
push dword [0x517214]
mov ecx, ebx
push 0
push 0x80
push esi
call fcn.0042e5e0
push dword [0x517214]
mov ecx, ebx
push 1
push 0x80
push esi
call fcn.0042e5e0
cmp dword [ebx + 0x28b8], 0
je 0x4086ac
lea ecx, [ebp - 0x100]
call fcn.004917a0
push 0
push 0
push 0
push str.SoftwareSynapticsSynTPEnh
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0
call fcn.004948e0
test eax, eax
je 0x40782b
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x77
push eax
lea eax, [ebp - 0x10]
push eax
push str.PatentsID
lea ecx, [ebp - 0xfc]
call fcn.004a1050
push 0x500
push esi
call edi
mov ecx, dword [ebx + 0x28b8]
push eax
mov dword [ebx + 0x28b4], eax
call fcn.0049ab20
push dword [0x516880]
lea ecx, [ebp - 0x17c]
call fcn.0048bb70
push dword [ebp - 0x118]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00406c50
push 2
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00408900
push 0x4dc588
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
call fcn.00406af0
push 0x4dc58c
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 4
call fcn.00406af0
push 0x4dc590
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 5
call fcn.00406af0
push 0x4dc594
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 6
call fcn.00406af0
push 0x4dc598
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 7
call fcn.00406af0
push 0x4dc59c
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 8
call fcn.00406af0
push 0x4dc5a0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 9
call fcn.00406af0
push 0x4dc5a4
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0xa
call fcn.00406af0
push 0x4dc5a8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xb
call fcn.00406af0
push 0x4dc5ac
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xc
call fcn.00406af0
push 0x4dc5b0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0xd
call fcn.00406af0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x9c]
push 0x4dc5b4
call fcn.00406af0
push str.01234
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
call fcn.00406af0
mov byte [ebp - 4], 0x10
call fcn.00402fa0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40799b
push 0x80004005
call fcn.00402d70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0x11
xor ebx, ebx
mov edi, edi
push 5
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x28]
call fcn.00408900
push 3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.004087c0
mov edi, eax
mov eax, dword [edi]
mov byte [ebp - 4], 0x13
mov esi, dword [eax - 0xc]
test esi, esi
js 0x4086d3
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x4079fb
push esi
mov ecx, edi
call fcn.00406130
lea eax, [esi + 1]
push eax
push dword [edi]
call fcn.004a684b
mov eax, dword [edi]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x4086d3
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [edi]
push edi
mov word [eax + esi*2], cx
lea ecx, [ebp - 0x34]
call fcn.00406fe0
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407a4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x11
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407a6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp + ebx*4 - 0xc8]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x407991
mov eax, dword [ebp - 0x34]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407aaa
test dx, dx
je 0x407aa6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407aaa
add eax, 4
add ecx, 4
test dx, dx
jne 0x407a84
xor eax, eax
jmp 0x407aaf
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x407ac4
inc ebx
cmp ebx, 0xc
jl 0x4079b0
jmp 0x407af5
cmp ebx, 3
jge 0x407ad0
push 0x4dc5bc
jmp 0x407aed
cmp ebx, 6
jge 0x407adc
push 0x4dc5c0
jmp 0x407aed
cmp ebx, 9
jge 0x407ae8
push 0x4dc5c4
jmp 0x407aed
push 0x4dc5c8
lea ecx, [ebp - 0x24]
call fcn.00407050
call fcn.00402fa0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x407b11
push 0x80004005
call fcn.00402d70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x14
push 0x51b
push eax
call fcn.0047f650
push dword [ebp - 0x24]
mov byte [ebp - 4], 0x15
push dword [ebp - 0x2c]
push dword [eax]
lea eax, [ebp - 0x30]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x24
add edx, 0xfffffff0
mov byte [ebp - 4], 0x14
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407b6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402fa0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x407b8a
push 0x80004005
call fcn.00402d70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x16
push 0x51a
push eax
call fcn.0047f650
mov esi, eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x17
push 0x50b
push eax
call fcn.0047f650
push dword [ebp - 0x30]
mov byte [ebp - 4], 0x18
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x38
add edx, 0xfffffff0
mov byte [ebp - 4], 0x17
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407c00
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x16
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407c20
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402fa0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x407c3c
push 0x80004005
call fcn.00402d70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x19
call fcn.00402fa0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x407c69
push 0x80004005
call fcn.00402d70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0
push 3
mov ecx, 0x5172d8
mov byte [ebp - 4], 0x1a
call fcn.00415e40
mov esi, eax
test esi, esi
jne 0x407ca6
push 1
push 3
mov ecx, 0x5172d8
call fcn.00415e40
mov esi, eax
test esi, esi
je 0x407e3e
mov ecx, dword [esi + 0x34]
xor eax, eax
mov dword [ebp - 0x20], eax
test ecx, ecx
je 0x407cc4
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
push 0x10000d5
push ecx
call dword [eax + 0xc]
mov eax, dword [ebp - 0x20]
test al, 8
je 0x407de1
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x407de1
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x10000102
push ecx
call dword [eax + 0xc]
cmp dword [ebp - 0x10], 2
jne 0x407de1
mov ecx, dword [esi + 0x34]
xor eax, eax
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x407d15
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x10000d5
push ecx
call dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
test eax, 0x800
je 0x407d94
mov ecx, esi
call fcn.00408770
push 0
push 0
push 0
test eax, eax
lea eax, [ebp - 0x10]
push 0x50c
push eax
je 0x407d84
call fcn.0047f650
mov byte [ebp - 4], 0x1b
push 0x4dc5cc
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
add esp, 0x20
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407d72
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x4dc5d4
lea ecx, [ebp - 0x14]
call fcn.004071d0
jmp 0x407e5c
call fcn.0047f650
mov byte [ebp - 4], 0x1c
push 0x4dc5e0
jmp 0x407d44
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x50d
push eax
call fcn.0047f650
mov byte [ebp - 4], 0x1d
push 0x4dc554
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x20
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407e4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407e4d
mov ecx, dword [esi + 0x34]
xor eax, eax
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x407dff
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x10000d5
push ecx
call dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
push 0
push 0
test eax, 0x800
lea eax, [ebp - 0x10]
push 0
je 0x407e25
push 0x50e
push eax
call fcn.0047f650
mov byte [ebp - 4], 0x1e
push 0x4dc5cc
jmp 0x407db1
push 0x50f
push eax
call fcn.0047f650
mov byte [ebp - 4], 0x1f
push 0x4dc5e8
jmp 0x407db1
push 0x17
push str.Unknown_Pointing_Device
lea ecx, [ebp - 0x14]
call fcn.00408980
push 5
push 0x4dc5d4
lea ecx, [ebp - 0x14]
call fcn.00407250
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push dword [eax - 0xc]
push eax
call fcn.00407250
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x510
push eax
call fcn.0047f650
push dword [ebp - 0x28]
mov byte [ebp - 4], 0x20
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x20
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407eb4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 5
push 0x4dc5d4
lea ecx, [ebp - 0x14]
call fcn.00407250
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push dword [eax - 0xc]
push eax
call fcn.00407250
test esi, esi
je 0x407f86
mov ecx, dword [esi + 0x34]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test ecx, ecx
je 0x407ef8
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x10000104
push ecx
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x10]
mov ecx, dword [esi + 0x34]
xor eax, eax
mov dword [ebp - 0x20], eax
test ecx, ecx
je 0x407f16
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
push 0x10000104
push ecx
call dword [eax + 0xc]
mov eax, dword [ebp - 0x20]
sar ebx, 0x10
and ebx, 0xff
sar eax, 0x18
push ebx
push eax
push 0x4dc620
lea eax, [ebp - 0xe8]
push 0x10
push eax
call fcn.004a6937
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x511
push eax
call fcn.0047f650
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x21
push ecx
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x34
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407fa4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407fa4
push 7
push 0x4dc62c
lea ecx, [ebp - 0x14]
call fcn.00408980
push 5
push 0x4dc5d4
lea ecx, [ebp - 0x14]
call fcn.00407250
push 5
push 0x4dc5d4
lea ecx, [ebp - 0x14]
call fcn.00407250
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push dword [eax - 0xc]
push eax
call fcn.00407250
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x384]
push 0x104
push eax
push str.ProgramFiles
call ebx
xor eax, eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
cmp word [ebp - 0x384], ax
jne 0x407ffc
xor ecx, ecx
jmp 0x408014
lea ecx, [ebp - 0x384]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408005
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebp - 0x68]
call fcn.00405410
sub esp, 0x18
mov byte [ebp - 4], 0x22
mov eax, esp
lea ecx, [ebp - 0x68]
push 0x4dc508
push ecx
push eax
call fcn.004069f0
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
call fcn.00493000
add esp, 0x1c
cmp dword [ebp - 0x54], 8
mov byte [ebp - 4], 0x24
jb 0x408060
push dword [ebp - 0x68]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
cmp dword [ebp - 0x3c], eax
jne 0x4081fb
call fcn.0049f6b0
test eax, eax
je 0x408190
push 0x104
lea eax, [ebp - 0x384]
push eax
push str.ProgramFiles_x86_
call ebx
xor eax, eax
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x70], 0
mov word [ebp - 0x80], ax
cmp word [ebp - 0x384], ax
jne 0x4080be
xor ecx, ecx
jmp 0x4080d6
lea ecx, [ebp - 0x384]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4080c7
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebp - 0x80]
call fcn.00405410
sub esp, 0x18
mov byte [ebp - 4], 0x25
mov eax, esp
lea ecx, [ebp - 0x80]
push 0x4dc508
push ecx
push eax
call fcn.004069f0
add esp, 0xc
lea eax, [ebp - 0xe0]
push eax
call fcn.00493000
mov ebx, eax
add esp, 0x1c
lea eax, [ebp - 0x4c]
cmp eax, ebx
je 0x408147
cmp dword [ebp - 0x38], 8
jb 0x40812a
push dword [ebp - 0x4c]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
push ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
call fcn.00408b90
cmp dword [ebp - 0xcc], 8
jb 0x40815e
push dword [ebp - 0xe0]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0xcc], 7
cmp dword [ebp - 0x6c], 8
mov dword [ebp - 0xd0], 0
mov word [ebp - 0xe0], ax
mov byte [ebp - 4], 0x24
jb 0x408190
push dword [ebp - 0x80]
call fcn.004a46e7
add esp, 4
cmp dword [ebp - 0x3c], 0
jne 0x4081fb
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x517
push eax
call fcn.0047f650
add esp, 0x14
mov edx, dword [eax]
mov byte [ebp - 4], 0x26
cmp word [edx], 0
jne 0x4081bd
xor ecx, ecx
jmp 0x4081d1
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4081c2
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4c]
call fcn.00405410
mov edx, dword [ebp - 0x10]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4081fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x512
push eax
call fcn.0047f650
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x27
cmovae ecx, dword [ebp - 0x4c]
push ecx
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x20
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40824d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 5
push 0x4dc5d4
lea ecx, [ebp - 0x14]
call fcn.00407250
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push dword [eax - 0xc]
push eax
call fcn.00407250
test esi, esi
je 0x40833e
mov ecx, dword [esi + 0x34]
xor eax, eax
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x408291
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x10000cd
push ecx
call dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
test eax, 0x80000
je 0x40829f
mov eax, 0x80000
jmp 0x4082ba
test eax, 0x100000
je 0x4082ad
mov eax, 0x100000
jmp 0x4082ba
test eax, 0x200000
mov ecx, 0x200000
cmovne eax, ecx
cmp eax, 0x80000
ja 0x408318
je 0x40830f
cmp eax, 0x20004
ja 0x4082f9
cmp eax, 0x20000
jae 0x4082ea
add eax, 0xfffeffff
cmp eax, 3
ja 0x40833e
push 0x4dc55c
lea ecx, [ebp - 0x1c]
call fcn.004070e0
jmp 0x40834d
push str.PS_2
lea ecx, [ebp - 0x1c]
call fcn.004070e0
jmp 0x40834d
cmp eax, 0x40000
jne 0x40833e
push 0x4dc574
lea ecx, [ebp - 0x1c]
call fcn.004070e0
jmp 0x40834d
push 3
push 0x4dc564
jmp 0x408345
cmp eax, 0x100000
je 0x408335
cmp eax, 0x200000
jne 0x40833e
push 0x4dc688
lea ecx, [ebp - 0x1c]
call fcn.004070e0
jmp 0x40834d
push 3
push 0x4dc56c
jmp 0x408345
push 7
push 0x4dc62c
lea ecx, [ebp - 0x1c]
call fcn.00408980
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x513
push eax
call fcn.0047f650
mov ebx, dword [ebp - 0x1c]
push ebx
push dword [eax]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x28
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x20
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408397
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4083aa
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x4083b6
call fcn.00402fa0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
push 0x4dc690
lea ecx, [ebp - 0x10]
call fcn.00406ba0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x29
push dword [eax - 0xc]
push eax
call fcn.00407250
mov edx, dword [ebp - 0x10]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4083f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push dword [eax - 0xc]
push eax
call fcn.00407250
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push 0x514
push eax
call fcn.0047f650
mov esi, dword [eax]
push 0
mov byte [ebp - 4], 0x2a
call fcn.0049e2e0
push eax
call fcn.00494840
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00405ad0
mov edx, dword [ebp - 0x10]
add esp, 0x28
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40845b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40846e
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40847a
call fcn.00402fa0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
push str.par_
lea ecx, [ebp - 0x10]
call fcn.00406ba0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2b
push dword [eax - 0xc]
push eax
call fcn.00407250
mov edx, dword [ebp - 0x10]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4084bb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push dword [edi - 0xc]
push edi
call fcn.00407250
mov ecx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 0x28b8]
mov dword [eax + 0x28], 1
cmp dword [esi - 4], 1
jle 0x4084f1
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00405a50
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x98]
push esi
push eax
call fcn.00408a40
add esp, 8
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x2c
push eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0x28b8]
call fcn.0049a7b0
cmp dword [ebp - 0x84], 0x10
jb 0x408531
push dword [ebp - 0x98]
call fcn.004a46e7
add esp, 4
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x84], 0xf
mov dword [ebp - 0x88], 0
mov byte [ebp - 0x98], 0
jb 0x40855d
push dword [ebp - 0x4c]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
lea edx, [ebx - 0x10]
mov word [ebp - 0x4c], ax
or ebx, 0xffffffff
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 0x19
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408591
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x16
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4085ae
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x14
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4085cb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x30]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0x11
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4085eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0x10
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40860b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0xf
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40862b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push fcn.004036b0
push 0xc
push 4
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 3
push eax
call fcn.004a60ef
mov edx, dword [ebp - 0x2c]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408664
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x408682
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0
call fcn.0048bbb0
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00491a30
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
push esi
call edi
push eax
push esi
call fcn.0049de70
add esp, 8
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.00402d70
int3