Function at 0x410320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
push esi
push edi
mov edi, ecx
mov dword [esp + 0x44], edi
mov eax, dword [edi + 0xec]
cmp eax, 0xf3c
jge 0x443f86
inc eax
mov dword [edi + 0xec], eax
cmp eax, 1
je 0x410813
cmp byte [edi + 0xfc], 0
mov byte [edi + 0x144], 0
jne 0x410634
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [edi + 0x144], 0
mov edx, 2
jne 0x410634
cmp byte [0x4c3281], 0
jne 0x443fd3
cmp byte [0x4c3808], 0
jne 0x443fe5
push 1
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call esi
test eax, eax
jne 0x410760
cmp byte [0x4c3282], 1
je 0x44405a
cmp dword [edi + 0xf8], 1
je 0x444efc
mov edx, 2
cmp dword [0x4c43b8], 0
jne 0x444077
cmp byte [0x4c3287], 1
je 0x444137
cmp dword [edi + 0x478], 0
je 0x410454
cmp byte [0x4c432c], 0
jne 0x410454
mov esi, dword [edi + 0x470]
lea eax, [edi + 0x470]
mov byte [0x4c432c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
nop
test esi, esi
jne 0x41065b
mov edi, dword [esp + 8]
lea esp, [esp]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4106a4
mov edi, dword [esp + 0x44]
mov byte [0x4c432c], al
cmp dword [esp + 0x14], eax
jg case.default.0x444ca9
lea edx, [eax + 2]
cmp byte [0x4c37dc], 0
je 0x41051d
cmp byte [edi + 0x47c], 1
je 0x41051d
cmp byte [0x4c3808], 1
je 0x41051d
xor ecx, ecx
mov dword [esp + 0x9c], 0
mov eax, 8
mov dword [esp + 0xa0], 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fd2e
add esp, 4
mov dword [esp + 0x98], eax
xor ecx, ecx
mov word [eax], cx
push 4
call fcn.0041fd2e
add esp, 4
test eax, eax
je 0x4108ec
mov dword [eax], 1
mov dword [esp + 0xa4], eax
jmp 0x4104e0
cmp dword [0x4c37fc], 0
jne 0x444173
cmp byte [0x4c37dc], 0
je 0x44431d
mov esi, dword [esp + 0xa4]
dec dword [esi]
jne 0x41051d
push dword [esp + 0x98]
call fcn.0041fda4
add esp, 4
push esi
call fcn.0041fda4
add esp, 4
cmp dword [edi + 0x184], 0
jne 0x444346
cmp byte [0x4c3950], 0
jne 0x4449c5
mov eax, dword [edi + 0xf8]
cmp eax, 7
je 0x444ae2
cmp eax, 2
je 0x4107af
cmp eax, 8
je 0x444dbb
cmp eax, 9
je 0x444dbb
cmp eax, 3
je 0x4107af
cmp eax, 4
je 0x4107af
cmp eax, 5
je 0x4107af
cmp eax, 6
je 0x4107af
mov esi, dword [ebp + 8]
inc dword [ebp + 8]
mov dword [edi + 0xf4], esi
cmp esi, dword [0x4c42c0]
jg 0x444c8e
test esi, esi
jle 0x444c8e
shl esi, 4
add esi, dword [0x4c42fc]
je 0x444c8e
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 1
mov dword [esp + 0x50], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], ecx
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
movsx eax, word [eax + 8]
test eax, eax
jne 0x4106b8
lea eax, [ebp + 8]
mov ecx, edi
push eax
push esi
call fcn.0040e000
mov esi, dword [esp + 0x58]
test esi, esi
jne 0x410733
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x14], edx
cmp ecx, 5
jge 0x4108d9
mov dword [esp + 0x5c], 1
mov dword [esp + 0x50], 0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [edi + 0xfc], 0
je 0x41036f
mov eax, dword [edi + 0xec]
mov byte [edi + 0x144], 0
cmp eax, 1
je 0x41082d
dec eax
mov dword [edi + 0xec], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x11], 0
jne 0x41069c
mov edi, dword [eax + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
xor edx, edx
sub eax, edi
cmp edi, 0x7fffffff
ja 0x444151
cmp ecx, 0x7fffffff
ja 0x410687
cdq
mov edi, dword [esi]
test edx, edx
jl 0x41069c
jg 0x41089e
cmp eax, dword [edi + 0x18]
jae 0x41089e
mov esi, dword [esi + 4]
jmp 0x410420
mov ecx, dword [eax]
cmp byte [ecx + 0x11], 0
jne 0x444162
mov eax, dword [eax + 4]
jmp 0x410432
cmp eax, 0x33
jne 0x4106ca
push esi
mov ecx, edi
call fcn.0040e270
jmp 0x4105f0
dec eax
cmp eax, 0x7e
ja case.0x4106db.2
movzx eax, byte [eax + 0x410914]
jmp dword [eax*4 + 0x410900]
lea eax, [esp + 0x50]
mov ecx, edi
push eax
lea eax, [esp + 0x24]
push eax
push esi
push 0
call fcn.0040f040
test eax, eax
js 0x4105f0
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x20]
mov eax, dword [ecx + eax*4]
cmp word [eax + 8], 0x7f
je 0x4105f0
jmp 0x444bc6
lea eax, [esp + 0x6b]
mov ecx, edi
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0
call fcn.0040f800
jmp 0x4106f6
mov eax, dword [esi + 0xc]
dec dword [eax]
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x444be2
push esi
call fcn.0041fda4
add esp, 4
mov dword [esp + 0x58], 0
jmp 0x4105fc
cmp dword [esp + 0x98], 0x12
je 0x444044
mov ecx, dword [0x4c37f8]
cmp ecx, 0xffffffff
jne 0x443ff7
lea eax, [esp + 0x94]
mov ecx, 0x4c37d0
push eax
call fcn.004031ae
test eax, eax
je 0x4107f5
push 1
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call esi
test eax, eax
je 0x4103b5
jmp 0x410760
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x308], 0
je 0x4107e1
mov ecx, dword [edi + 0x310]
call fcn.0041f39d
test edx, edx
jl 0x4107e1
jg 0x41087f
cmp eax, dword [edi + 0x308]
jae 0x41087f
mov eax, dword [edi + 0xf8]
cmp eax, 3
jl case.default.0x444ca9
jmp 0x444c9d
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x410793
mov eax, dword [edi + 0x11c]
mov dword [esp + 0x40], eax
lea ecx, [ecx]
test eax, eax
je 0x410355
jmp 0x443fa1
mov ecx, edi
call fcn.004109c0
cmp byte [edi + 0xfc], 1
je 0x410651
mov ecx, edi
call fcn.004109e3
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [0x4c32ac]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x410651
jmp 0x444f1b
cmp dword [edi + 0xf8], 2
jne 0x4108f3
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
jmp case.default.0x444ca9
inc dword [esp + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x44]
mov dword [edi + 0x14], eax
push dword [esi]
call fcn.00409953
mov ecx, dword [esi]
push 0
push 1
mov byte [ecx + 0x10], 1
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x4c]
inc eax
push eax
call fcn.0040b220
mov eax, dword [esi]
mov byte [eax + 0x10], 0
jmp 0x41069c
add ecx, 0xfffffffb
cmp ecx, 0xa
ja case.0x4108e5.6
jmp dword [ecx*4 + 0x410994]
xor eax, eax
jmp 0x4104ce
mov dword [esp + 8], 0
jmp 0x444b3f
push 0xffffffffffffffff
push 0x9a
mov byte [0x4c3280], 0
call fcn.00468bc2
or eax, 0xffffffff
jmp 0x410653
push dword [eax]
mov ecx, edi
call fcn.00409953
test eax, eax
je 0x443fbc
mov eax, dword [eax + 0x10]
mov ecx, edi
push 1
inc eax
push eax
call fcn.0045539b
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x44]
call fcn.004557c6
mov eax, dword [esp + 0x40]
jmp 0x410820
cmp byte [edi + 0x145], 0
je 0x4103d4
jmp 0x41038e
cmp dword [edi + 0xf8], 0
je 0x4103d4
jmp 0x41039b
cmp ecx, dword [0x4c3834]
jge 0x444035
mov eax, dword [0x4c3830]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
je 0x444035
cmp dword [eax + 0x18], 0
je 0x444035
lea eax, [esp + 0x94]
push eax
mov eax, dword [ecx]
push dword [eax + 0x18]
push dword [eax]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x410793
jmp 0x41077d
mov dword [0x4c37f8], 0xffffffff
jmp 0x41077d
mov byte [edi + 0xfc], 1
mov dword [edi + 0xf8], 1
jmp 0x4103b5
mov byte [0x4c3287], 0
mov byte [0x4c3282], 0
mov dword [edi + 0xf8], 1
jmp 0x4103c2
mov eax, dword [0x4c43bc]
push eax
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0xc], ecx
call fcn.0041fda4
dec dword [0x4c43b8]
add esp, 4
mov dword [0x4c43bc], esi
neg esi
sbb esi, esi
xor ecx, ecx
and dword [0x4c43c0], esi
mov edx, dword [edi + 0x1c8]
mov dword [esp + 0x18], ecx
test edx, edx
je 0x4440d8
mov esi, dword [edi + 0x1c4]
mov edi, dword [esp + 8]
mov eax, dword [esi + ecx*4]
mov eax, dword [eax]
test eax, eax
je 0x4440cb
cmp dword [eax], edi
je 0x4440d0
inc ecx
cmp ecx, edx
jb 0x4440be
mov edi, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
cmp ecx, edx
je 0x444127
mov eax, dword [edi + 0x1c4]
mov eax, dword [eax + ecx*4]
mov ecx, edi
mov eax, dword [eax]
add eax, 8
push eax
call fcn.00409953
mov ecx, dword [edi + 0x1c4]
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx + eax*4]
mov ecx, dword [ecx]
add ecx, 0x18
push ecx
lea ecx, [edi + 0x14c]
call fcn.00407d2b
mov eax, dword [esi + 0x10]
mov ecx, edi
push 0
push 1
inc eax
push eax
call fcn.0040b220
jmp case.default.0x444ca9
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edx, 2
jmp 0x4103e1
cmp byte [0x4c3281], 0
jne 0x4103ee
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410627
cmp ecx, 0x7fffffff
jbe 0x410687
jmp 0x410686
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.00468f00
jmp 0x410430
mov eax, dword [0x4c3800]
lea ecx, [esp + 0x94]
mov esi, dword [eax]
push esi
call fcn.00484f25
mov ecx, 0x4c37fc
call fcn.00404663
test esi, esi
je 0x44419d
push ecx
mov ecx, esi
call fcn.0040464b
cmp dword [esp + 0x9c], 0
mov dword [0x4c4330], 0
je 0x4104e0
lea eax, [esp + 0x98]
mov ecx, edi
push eax
call fcn.00409953
mov esi, eax
test esi, esi
je 0x4104e0
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 1
call fcn.004093c0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x12c]
push 0x4a1ecc
mov dword [esp + 0x80], 1
mov dword [esp + 0x74], eax
call fcn.00407b51
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c4290
push eax
lea eax, [esp + 0x134]
push eax
call fcn.004082ef
lea ecx, [esp + 0x12c]
call fcn.00405832
lea ecx, [esp + 0x70]
call fcn.004093c0
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0xfc]
push str._GUI_WINHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00407b51
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c4290
push eax
lea eax, [esp + 0x104]
push eax
call fcn.004082ef
lea ecx, [esp + 0xfc]
call fcn.00405832
lea ecx, [esp + 0x70]
call fcn.004093c0
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0x11c]
push str._GUI_CTRLHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00407b51
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c4290
push eax
lea eax, [esp + 0x124]
push eax
call fcn.004082ef
lea ecx, [esp + 0x11c]
call fcn.00405832
mov byte [edi + 0x47c], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.0040b220
lea ecx, [esp + 0x70]
mov byte [edi + 0x47c], 0
call fcn.004093c0
lea ecx, [esp + 0x98]
call fcn.00405832
jmp case.default.0x444ca9
cmp dword [0x4c393c], 0
jne 0x444339
cmp dword [0x4c4330], 0x64
jge 0x444339
inc dword [0x4c4330]
push 0
jmp 0x44433b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4104fa
cmp byte [edi + 0x4a4], 1
je 0x41052a
xor eax, eax
mov byte [edi + 0x4a4], 1
push dword [edi + 0x188]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x68], 0
mov dword [esp + 0xbc], 0x48eb74
mov dword [esp + 0x18], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
call fcn.0046878d
lea ecx, [edi + 0x184]
call fcn.0045c4db
mov esi, dword [esp + 0xf0]
lea ecx, [esp + 0x80]
mov dword [esp + 0x88], 0
push dword [esi]
call fcn.00409480
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.00409337
push dword [esi + 8]
mov ecx, edi
call fcn.00409953
mov edx, eax
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 0x10]
push ecx
call fcn.00406de6
mov dword [edi + 0xf4], ecx
mov esi, 3
cmp dword [edx + 0x14], 0
mov dword [esp + 0x3c], eax
jle 0x44455b
mov edx, dword [esp + 0xf0]
add edx, 8
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
jne 0x444468
mov edx, dword [esp + 0x3c]
mov edx, dword [edx + 4]
mov eax, dword [edx + esi*4 + 4]
cmp word [eax + 8], 0x33
je 0x444445
mov ecx, eax
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x4444de
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x444458
cmp eax, 0x1e
jne 0x4444de
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0
je 0x444427
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0x41
jne 0x444498
mov edx, dword [esp + 0x18]
inc esi
xor ecx, ecx
mov eax, dword [edx + esi*4]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x44448b
inc ecx
jmp 0x4444db
cmp ax, 0x48
jne 0x4444d1
dec ecx
jns 0x4444db
mov edx, dword [esp + 0x24]
push dword [edx]
lea ecx, [esp + 0xbc]
call fcn.004550e1
mov ecx, dword [esp + 0x64]
inc esi
mov eax, dword [esp + 0x20]
inc ecx
mov edx, dword [esp + 0x24]
add edx, 4
mov dword [esp + 0x64], ecx
mov dword [esp + 0x24], edx
cmp ecx, dword [eax + 0x14]
jge 0x44454c
mov eax, dword [esp + 0x3c]
jmp 0x44440f
cmp ax, 0x40
jne 0x4444db
test ecx, ecx
je 0x444494
inc esi
jmp 0x44447b
mov eax, dword [esp + 0x3c]
mov ecx, edi
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4 + 4]
movsx eax, word [eax + 0xa]
push eax
push 0x91
call fcn.00468bc2
jmp 0x44451c
mov ecx, esi
call fcn.00405832
push esi
call fcn.0041fda4
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x80]
call fcn.004096e0
lea ecx, [esp + 0xec]
call fcn.00455170
lea ecx, [esp + 0xb8]
call fcn.00455170
mov byte [edi + 0x4a4], 0
jmp 0x41052a
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
push dword [edx + 0x10]
call fcn.0040814f
mov eax, dword [esp + 0x20]
mov esi, 3
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], 1
cmp dword [eax + 0x14], 1
jl 0x4447b3
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x6c], edx
mov ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], dx
jne 0x4445c3
mov eax, dword [ecx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x4445b0
cmp eax, 0x1e
jne 0x4445b1
mov edx, 0x100
inc esi
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
je 0x44459c
mov dword [esp + 0x6c], edx
mov dword [esp + 0x4c], esi
mov edi, dword [esp + 8]
lea edx, [esi*4 + 4]
mov dword [esp + 0x24], 1
xor ecx, ecx
mov esi, dword [esp + 0x24]
mov eax, dword [edx + edi]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x4445ef
inc ecx
jmp 0x4446c7
cmp ax, 0x48
jne 0x4446b9
dec ecx
jns 0x4446c7
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x4c]
cmp dword [esp + 0x18], eax
jle 0x444770
lea eax, [esi + 2]
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov ecx, edi
mov eax, dword [esp + 0x24]
add eax, esi
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 1
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x48]
call fcn.00409990
test eax, eax
js 0x444856
mov eax, dword [esp + 0x6c]
or eax, 0x200
push 1
push eax
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.004081f9
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x444699
push ecx
call fcn.0040774d
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x4446b2.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x4446b2.6
jmp dword [eax*4 + 0x444f52]
cmp ax, 0x40
jne 0x4446c7
test ecx, ecx
je 0x444600
inc esi
add edx, 4
jmp 0x4445dc
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x4446b2.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x444756
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x4446b2.6
lea ecx, [eax + 8]
jmp 0x44474d
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x4446b2.6
push ecx
call fcn.00408908
jmp case.0x4446b2.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0041fda4
add esp, 4
push dword [esp + 0x28]
jmp 0x444756
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x4446b2.6
push ecx
call fcn.00455eca
jmp case.0x4446b2.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x4446b2.6
push ecx
call fcn.00455edf
jmp case.0x4446b2.6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x4446b2.6
mov ecx, eax
call fcn.00405832
push dword [esp + 8]
call fcn.0041fda4
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
jmp 0x44478d
mov eax, dword [esp + 0x14]
or edx, 0x200
push 1
push edx
push dword [eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.004081f9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
inc eax
add dword [esp + 0x14], 4
add esi, eax
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], eax
cmp eax, dword [ecx + 0x14]
jle 0x444582
push str._COM_EVENTOBJ
lea ecx, [esp + 0x140]
call fcn.00407b51
mov esi, dword [esp + 0x80]
xor eax, eax
cmp dword [esp + 0x8c], 6
push 1
setne al
dec eax
and eax, esi
push 0
push eax
lea eax, [esp + 0x148]
push eax
call fcn.004081f9
lea ecx, [esp + 0x13c]
call fcn.00405832
mov eax, dword [esp + 0x20]
mov ecx, edi
push 0
push 0
mov eax, dword [eax + 0x10]
inc eax
push eax
call fcn.0040b220
mov ecx, 0x4c42a0
call fcn.00407faf
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x444833
push ecx
call fcn.0040774d
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x8c]
cmp eax, 5
jl case.0x44484f.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x44484f.6
jmp dword [eax*4 + 0x444f7e]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x44486c
push ecx
call fcn.0040774d
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x444885.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x444885.6
jmp dword [eax*4 + 0x444faa]
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x444885.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x444504
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x444885.6
lea ecx, [esi + 8]
jmp 0x4444fe
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x444885.6
push ecx
call fcn.00408908
jmp case.0x444885.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0041fda4
add esp, 4
push dword [esp + 0x28]
jmp 0x444504
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x444885.6
push ecx
call fcn.00455eca
jmp case.0x444885.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x444885.6
push ecx
call fcn.00455edf
jmp case.0x444885.6
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x444885.6
jmp 0x4444fc
test esi, esi
je case.0x44484f.6
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x444982
test esi, esi
je case.0x44484f.6
lea ecx, [esi + 8]
jmp 0x44497d
test esi, esi
je case.0x44484f.6
push ecx
mov ecx, esi
call fcn.00408908
jmp case.0x44484f.6
push dword [esi + 4]
call fcn.0041fda4
add esp, 4
jmp 0x444982
test esi, esi
je case.0x44484f.6
push ecx
mov ecx, esi
call fcn.00455eca
jmp case.0x44484f.6
test esi, esi
je case.0x44484f.6
push ecx
mov ecx, esi
call fcn.00455edf
jmp case.0x44484f.6
test esi, esi
je case.0x44484f.6
mov ecx, esi
call fcn.00405832
push esi
call fcn.0041fda4
add esp, 4
lea ecx, [esp + 0xec]
mov dword [esp + 0x8c], 1
mov dword [esp + 0x80], 0
call fcn.00455170
lea ecx, [esp + 0xb8]
call fcn.00455170
mov byte [edi + 0x4a4], 0
jmp case.default.0x444ca9
cmp byte [edi + 0x47d], 1
je 0x410537
lea ecx, [esp + 0x98]
call fcn.004073d7
lea eax, [esp + 0x94]
mov ecx, 0x4c38b0
push eax
call fcn.00461273
test al, al
je 0x444ad1
cmp dword [esp + 0x9c], 0
je 0x4449de
lea eax, [esp + 0x98]
mov ecx, edi
push eax
call fcn.00409953
mov esi, eax
test esi, esi
je 0x4449de
lea ecx, [esp + 0xd8]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 1
call fcn.004093c0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x10c]
push str._TRAY_ID
mov dword [esp + 0xe8], 1
mov dword [esp + 0xdc], eax
call fcn.00407b51
push 1
lea eax, [esp + 0xdc]
mov ecx, 0x4c4290
push eax
lea eax, [esp + 0x114]
push eax
call fcn.004082ef
lea ecx, [esp + 0x10c]
call fcn.00405832
mov byte [edi + 0x47d], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.0040b220
lea ecx, [esp + 0xd8]
mov byte [edi + 0x47d], 0
call fcn.004093c0
lea ecx, [esp + 0x98]
call fcn.00405832
jmp case.default.0x444ca9
lea ecx, [esp + 0x98]
call fcn.00405832
jmp 0x410537
push 0xa
push dword [edi + 0x468]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x48], eax
cmp eax, 0x102
je case.default.0x444ca9
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x468]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi + 0x468]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
jmp 0x444b3f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x46c], 0
mov dword [esp + 8], 0
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041ecfc
jmp 0x410888
lea ecx, [edi + 0x168]
call fcn.0047b072
mov ecx, eax
call fcn.00454fda
test al, al
jne 0x444b8f
mov eax, dword [esp + 8]
mov ecx, edi
movsx eax, word [eax + 0xa]
push eax
push 0xa7
call fcn.00468bc2
lea ecx, [esp + 0x50]
call fcn.004096e0
jmp case.default.0x444ca9
lea ecx, [edi + 0x168]
call fcn.0047b072
push eax
lea eax, [esp + 0x24]
mov ecx, edi
push eax
push esi
call fcn.0047a5ce
jmp 0x4106f6
push 0xffffffffffffffff
lea eax, [esp + 0x54]
mov ecx, edi
push eax
lea eax, [esp + 0x28]
push eax
push esi
call fcn.00409990
jmp 0x4106f6
movsx eax, word [eax + 0xa]
mov ecx, edi
push eax
push 0x72
call fcn.00468bc2
lea ecx, [esp + 0x50]
call fcn.004096e0
jmp case.default.0x444ca9
push dword [esi]
call fcn.0041fda4
add esp, 4
push dword [esi + 0xc]
call fcn.0041fda4
add esp, 4
jmp 0x410744
test edx, edx
je case.0x4108e5.6
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x50]
jmp 0x444c81
test edx, edx
je case.0x4108e5.6
lea ecx, [edx + 8]
jmp 0x444c78
test edx, edx
je case.0x4108e5.6
push ecx
mov ecx, edx
call fcn.00408908
jmp case.0x4108e5.6
push dword [edx + 4]
call fcn.0041fda4
add esp, 4
push dword [esp + 0x50]
jmp 0x444c81
test edx, edx
je case.0x4108e5.6
push ecx
mov ecx, edx
call fcn.00455eca
jmp case.0x4108e5.6
test edx, edx
je case.0x4108e5.6
push ecx
mov ecx, edx
call fcn.00455edf
jmp case.0x4108e5.6
test edx, edx
je case.0x4108e5.6
mov ecx, edx
call fcn.00405832
push dword [esp + 0x14]
call fcn.0041fda4
add esp, 4
jmp case.0x4108e5.6
mov dword [edi + 0xf8], 1
jmp case.default.0x444ca9
sub eax, 3
cmp eax, 3
ja case.default.0x444ca9
jmp dword [eax*4 + 0x444fd6]
mov ecx, edi
call fcn.00484e32
jmp 0x444ce2
mov ecx, edi
call fcn.00484e32
jmp 0x444ccb
push 1
mov ecx, edi
call fcn.0040b2c1
mov esi, eax
test esi, esi
js 0x444ce8
jg case.default.0x444ca9
jmp 0x444d21
push 1
mov ecx, edi
call fcn.0040b2c1
mov esi, eax
test esi, esi
jns 0x444d17
mov eax, esi
neg eax
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0045557f
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041ecfc
test esi, esi
je case.default.0x444ca9
test esi, esi
jle 0x444d9a
mov eax, dword [edi + 0xf8]
cmp eax, 5
je 0x444d31
cmp eax, 3
jne 0x444d9a
mov eax, dword [edi + 0x1f0]
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 1
mov esi, dword [eax]
call fcn.004093c0
push 0
lea eax, [esp + 0xcc]
mov dword [esp + 0xd8], 7
push eax
mov eax, dword [edi]
mov dword [esp + 0xd0], esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0045552c
lea ecx, [esp + 0xc8]
call fcn.004093c0
mov ecx, dword [edi + 0x30c]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call fcn.00463f6e
jmp case.default.0x444ca9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x460], 0
je 0x444df8
mov ecx, dword [edi + 0x464]
call fcn.0041f39d
test edx, edx
jl 0x444df8
jg 0x444de5
cmp eax, dword [edi + 0x460]
jb 0x444df8
mov eax, dword [edi + 0x46c]
test eax, eax
je 0x444b37
jmp 0x444b26
mov eax, dword [edi + 0xf8]
xor esi, esi
mov byte [esp + 0x1f], 0
mov dword [esp + 8], esi
cmp eax, 8
jne 0x444e36
lea eax, [esp + 0x1f]
push eax
lea ecx, [edi + 0x450]
lea edx, [esp + 0xc]
call fcn.0046291c
add esp, 4
cmp byte [esp + 0x1f], 1
jne case.default.0x444ca9
mov esi, dword [esp + 8]
jmp 0x444e3f
cmp eax, 9
jne case.default.0x444ca9
mov ecx, dword [edi + 0x46c]
mov eax, 0xcccccccc
mov dword [esp + 0x40], eax
test ecx, ecx
je 0x444e98
lea eax, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x40], 0x103
jne 0x444e7e
push 0
push dword [edi + 0x46c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.default.0x444ca9
push dword [edi + 0x46c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
mov dword [edi + 0x46c], 0
cmp dword [edi + 0xf8], 8
jne 0x444ecb
mov dword [esp + 8], esi
fild dword [esp + 8]
test esi, esi
jns 0x444eb3
fadd qword [0x4b8d08]
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
fstp qword [esp + 0x10]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0047b8ce
jmp 0x444eda
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041ed4a
push dword [edi + 0x30c]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x444ca9
push ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041ecfc
jmp 0x410634
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x158]
push eax
call esi
test eax, eax
jg 0x444f1b
jmp 0x410651