Function at 0x401950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x12f0
call fcn.004ac150
push ebx
push ebp
push esi
push edi
mov esi, edx
mov dword [esp + 0xac], esi
mov ebp, ecx
mov dword [esp + 0x20], ebp
mov byte [esp + 0x32], 0
cmp esi, 2
jne 0x40199e
cmp byte [0x4dbc43], 0
mov esi, 1
mov dword [esp + 0xac], esi
jne 0x40199e
mov byte [0x4dbc43], 1
mov byte [esp + 0x32], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], ebx
cmp ebp, 0x8000012f
jne 0x4019cb
mov ebp, 0xa
mov byte [esp + 0x29], 1
mov dword [esp + 0x20], ebp
mov dword [esp + 0xa0], 0
jmp 0x4019eb
cmp ebp, 5
setle byte [esp + 0x29]
jg 0x4019e2
mov dword [esp + 0xa0], 0
jmp 0x4019eb
call ebx
mov dword [esp + 0xa0], eax
cmp dword [0x4dbfe8], 0
je 0x4019f9
call fcn.00403f60
cmp dword [0x4dd3fc], 0
mov edi, 1
mov byte [esp + 0x7c], 0
je 0x401a21
call fcn.00403d00
mov ecx, dword [esp + 0x7c]
test al, al
movzx ecx, cl
cmovne ecx, edi
mov dword [esp + 0x7c], ecx
test ebp, ebp
jle 0x401a5b
cmp esi, 1
jne 0x401a5b
inc dword [0x4dbc74]
cmp byte [0x4dbc42], 0
mov byte [esp + 0x33], 1
jne 0x401a60
push 0
push 0xa
push 9
push dword [0x4dbc70]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne byte [0x4dbc42]
jmp 0x401a60
mov byte [esp + 0x33], 0
mov eax, dword [sym.imp.USER32.dll_GetMessageW]
xor esi, esi
mov dword [esp + 0xf8], eax
mov eax, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0xd4], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0xd8], eax
mov eax, dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [esp + 0xb0], eax
mov eax, dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0xfc], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0xb4], eax
mov eax, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov dword [esp + 0xe0], eax
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp + 0xb8], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esp + 0x90], eax
mov eax, dword [sym.imp.USER32.dll_IsWindowEnabled]
mov dword [esp + 0x100], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x34], eax
mov eax, dword [sym.imp.USER32.dll_IsDialogMessageW]
mov dword [esp + 0xdc], eax
mov eax, dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov dword [esp + 0x108], eax
mov eax, dword [sym.imp.SHELL32.dll_DragFinish]
mov dword [esp + 0x88], eax
mov eax, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [esp + 0x80], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [esp + 0xd0], eax
mov eax, dword [sym.imp.USER32.dll_CountClipboardFormats]
mov dword [esp + 0x118], eax
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [esp + 0x11c], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0xec], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
mov dword [esp + 0x120], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [esp + 0x40], eax
mov eax, dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edx, dword [esp + 0x40]
mov dword [esp + 0xbc], eax
mov eax, dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xe4], eax
mov eax, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esp + 0x104], eax
mov eax, dword [sym.imp.USER32.dll_GetClassLongW]
mov dword [esp + 0xe8], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [esp + 0x10c], eax
mov eax, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [esp + 0x110], eax
mov eax, dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [esp + 0x98], eax
mov eax, dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
mov byte [esp + 0x2b], 0
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x84], eax
mov al, byte [esp + 0x2b]
mov dword [esp + 0x8c], edx
mov dl, byte [esp + 0x2b]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x40]
mov byte [esp + 0x13], 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2a], dl
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x9c], eax
mov al, byte [esp + 0x13]
mov dword [esp + 0x44], ecx
jmp 0x401c6b
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x401c67
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test ebp, ebp
jle 0x401d0b
test al, al
jne 0x401d0b
cmp byte [0x4dbc43], al
jne 0x401d18
cmp dword [0x4d78c0], 0
je 0x401ce0
cmp dword [0x4dbc4c], 0
jne 0x401ce0
cmp dword [0x4dbc60], 0
jne 0x401ca9
mov ecx, 1
jmp 0x401ce2
mov ecx, dword [0x4d78c8]
cmp byte [ecx + 0x53], 0
jne 0x401cd5
cmp dword [ecx + 0x44], 0xffffffff
jle 0x401cd5
call ebx
mov ecx, dword [0x4d78c8]
sub eax, dword [ecx + 0x48]
cmp eax, dword [ecx + 0x44]
jb 0x401cd5
cmp dword [ecx + 0x40], 0
je 0x401cd5
mov byte [ecx + 0x53], 1
mov eax, dword [0x4d78c8]
movzx ecx, byte [eax + 0x53]
jmp 0x401ce2
xor ecx, ecx
xor edx, edx
mov eax, 0x311
test ecx, ecx
cmovne eax, edx
push eax
push edx
push edx
lea eax, [esp + 0x54]
push eax
call dword [esp + 0x108]
cmp eax, 0xffffffff
je 0x402060
jmp 0x401fc4
cmp byte [0x4dbc43], 0
je 0x401ebe
call dword [esp + 0xd4]
mov esi, eax
test esi, esi
je 0x401ebe
push 0
push esi
call dword [esp + 0xe0]
cmp eax, dword [0x4dcd34]
jne 0x401ebe
cmp dword [0x4dbc6c], 0
je 0x401d99
push 0x20
lea eax, [esp + 0x20c]
push eax
push esi
mov esi, dword [esp + 0xbc]
call esi
mov ecx, str.32770
lea eax, [esp + 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401d8e
test dx, dx
je 0x401d8a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401d8e
add eax, 4
add ecx, 4
test dx, dx
jne 0x401d68
xor eax, eax
jmp 0x401d93
sbb eax, eax
or eax, 1
test eax, eax
je 0x401df2
jmp 0x401da0
mov esi, dword [esp + 0xb0]
call dword [esp + 0xfc]
test eax, eax
je 0x401ebe
push 0x20
lea ecx, [esp + 0x20c]
push ecx
push eax
call esi
lea eax, [esp + 0x208]
push str.SysTreeView32
push eax
call fcn.004979b3
add esp, 8
test eax, eax
je 0x401df2
lea eax, [esp + 0x208]
push str.SysListView32
push eax
call fcn.004979b3
add esp, 8
test eax, eax
jne 0x401ebe
cmp dword [0x4d78c0], 0
je 0x401e46
cmp dword [0x4dbc4c], 0
jne 0x401e46
cmp dword [0x4dbc60], 0
jne 0x401e14
mov eax, 1
jmp 0x401e48
mov ecx, dword [0x4d78c8]
cmp byte [ecx + 0x53], 0
jne 0x401e40
cmp dword [ecx + 0x44], 0xffffffff
jle 0x401e40
call ebx
mov ecx, dword [0x4d78c8]
sub eax, dword [ecx + 0x48]
cmp eax, dword [ecx + 0x44]
jb 0x401e40
cmp dword [ecx + 0x40], 0
je 0x401e40
mov byte [ecx + 0x53], 1
movzx eax, byte [ecx + 0x53]
jmp 0x401e48
xor eax, eax
push 0
test eax, eax
mov esi, 0x311
push 0x1ff
mov eax, 0xffffffff
push 0
cmovne esi, eax
lea eax, [esp + 0x54]
push 0
push eax
call edi
test eax, eax
lea eax, [esp + 0x48]
jne 0x401e7e
push 1
push esi
push 0x20f
jmp 0x401f2e
mov edi, dword [esp + 0x58]
push 0
push esi
push 0x20f
push 0
push eax
call dword [esp + 0x30]
push 1
test eax, eax
jne 0x401ea5
mov edi, dword [esp + 0x20]
push 0x1ff
jmp 0x401f28
mov eax, dword [esp + 0x5c]
sub eax, edi
mov edi, dword [esp + 0x20]
test eax, eax
lea eax, [esp + 0x4c]
jle 0x401e73
push 0x1ff
jmp 0x401f2c
cmp dword [0x4d78c0], 0
je 0x401f17
cmp dword [0x4dbc4c], 0
jne 0x401f17
cmp dword [0x4dbc60], 0
jne 0x401ee0
mov ecx, 1
jmp 0x401f19
mov ecx, dword [0x4d78c8]
cmp byte [ecx + 0x53], 0
jne 0x401f0c
cmp dword [ecx + 0x44], 0xffffffff
jle 0x401f0c
call ebx
mov ecx, dword [0x4d78c8]
sub eax, dword [ecx + 0x48]
cmp eax, dword [ecx + 0x44]
jb 0x401f0c
cmp dword [ecx + 0x40], 0
je 0x401f0c
mov byte [ecx + 0x53], 1
mov eax, dword [0x4d78c8]
movzx ecx, byte [eax + 0x53]
jmp 0x401f19
xor ecx, ecx
xor edx, edx
mov eax, 0x311
test ecx, ecx
push 1
cmovne eax, edx
push eax
lea eax, [esp + 0x50]
push 0
push 0
push eax
call edi
test eax, eax
jne 0x401fc0
test ebp, ebp
jne 0x401f5f
cmp byte [esp + 0x2b], al
jne 0x401f5f
push ebp
call dword [esp + 0xb8]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
mov byte [esp + 0x2b], 1
jmp 0x401c6b
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x401f8d
cmp byte [esp + 0x29], 0
je 0x401f8d
test ebp, ebp
jle 0x401f7b
push 5
call dword [esp + 0xb8]
mov al, byte [esp + 0x13]
mov esi, 1
mov dword [esp + 0x18], esi
jmp 0x401c6b
call ebx
cmp byte [esp + 0x29], 0
jne 0x403b70
mov ecx, dword [esp + 0xa0]
sub ecx, eax
add ecx, ebp
cmp ecx, 5
jle 0x403b70
push 5
call dword [esp + 0xb8]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov esi, dword [esp + 0x18]
inc esi
cmp dword [0x4dcd44], 0
mov dword [esp + 0x18], esi
je 0x401ffb
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x1c4]
mov ecx, dword [esp + 0x48]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x5c]
push dword [esp + 0x5c]
call fcn.00404030
add esp, 0x10
test al, al
jne 0x402060
cmp dword [0x4dbc78], 0
mov edx, dword [esp + 0x4c]
je 0x402545
lea eax, [edx - 0x100]
cmp eax, 9
ja 0x402545
mov ecx, dword [esp + 0x48]
call fcn.0045e470
mov ebx, eax
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x40253b
mov ecx, dword [ebx + 0x40]
mov ebp, dword [esp + 0x48]
test ecx, ecx
je 0x40206d
lea eax, [esp + 0x48]
push eax
push ecx
push dword [ebx + 0x1c]
call dword [esp + 0xec]
test eax, eax
je 0x40206d
mov ebp, dword [esp + 0x20]
nop word [eax + eax]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov edx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
cmp edx, 0x100
jne 0x402435
cmp byte [ebx + 0xbc], 0
je 0x40229b
cmp esi, 0x22
je 0x4020ab
cmp esi, 0x21
je 0x4020ab
cmp esi, 9
je 0x4020ab
cmp esi, 0x25
je 0x4020ab
cmp esi, 0x27
jne 0x40229b
push ebp
mov edi, ebp
call dword [esp + 0xc0]
lea esi, [eax - 3]
cmp esi, dword [ebx + 0x5c]
jb 0x4020df
push ebp
call dword [esp + 0xe8]
mov edi, eax
test edi, edi
je 0x4020d6
push edi
call dword [esp + 0xc0]
lea esi, [eax - 3]
cmp esi, dword [ebx + 0x5c]
jae 0x40227d
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + esi*4]
mov dword [esp + 0x3c], ecx
cmp dword [ecx + 0x18], edi
jne 0x40227d
cmp esi, 0x2af8
je 0x40227d
test ecx, ecx
je 0x402283
mov al, byte [ecx + 0x30]
cmp al, 0xf
je 0x402283
mov esi, dword [esp + 0x50]
xor edi, edi
cmp al, 0x13
jne 0x402156
mov edi, ecx
cmp esi, 0x25
je 0x402127
cmp esi, 0x27
jne 0x402156
cmp esi, 0x27
push 0
sete al
push 0
movzx eax, al
push eax
push ecx
mov ecx, ebx
call fcn.0046bbb0
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
cmp esi, 0x25
je 0x402287
cmp esi, 0x27
je 0x402287
push 0x11
call dword [esp + 0xbc]
mov ecx, 0x8000
test cx, ax
je 0x402283
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
cmp esi, 9
jne 0x4021ae
cmp byte [eax + 0x30], 0xc
jne 0x4021ae
push 0xfffffffffffffff0
push dword [eax + 0x18]
call dword [esp + 0x98]
test al, 4
jne 0x402283
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
test edi, edi
jne 0x402237
mov ch, byte [eax + 0x32]
cmp ch, 0xff
je 0x402201
mov ebx, dword [ebx + 0x5c]
xor cl, cl
xor edx, edx
test ebx, ebx
je 0x4021fd
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x2c]
mov edi, dword [eax]
cmp byte [edi + 0x30], 0x13
jne 0x4021de
cmp cl, ch
je 0x4021f3
inc cl
inc edx
add eax, 4
cmp edx, ebx
jb 0x4021d0
mov ecx, dword [esp + 0x24]
xor al, al
xor edx, edx
mov ebx, dword [ecx + 0x5c]
jmp 0x402214
mov ebx, dword [esp + 0x24]
test edi, edi
jne 0x402237
jmp 0x402201
mov ebx, dword [esp + 0x24]
mov ebx, dword [ebx + 0x5c]
xor al, al
xor edx, edx
test ebx, ebx
je 0x402287
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 0x2c]
mov edi, dword [ecx]
cmp byte [edi + 0x30], 0x13
jne 0x402225
test al, al
je 0x40222f
inc al
inc edx
add ecx, 4
cmp edx, ebx
jb 0x402217
jmp 0x402287
test edi, edi
je 0x402287
mov ebx, dword [esp + 0x24]
push dword [edi + 0x18]
call dword [esp + 0x104]
test eax, eax
je 0x402283
mov eax, dword [esp + 0x50]
cmp eax, 0x22
je 0x402270
cmp eax, 9
jne 0x402263
push 0x10
call dword [esp + 0xbc]
bt ax, 0xf
jae 0x402270
push 1
push 1
xor al, al
push eax
push edi
jmp 0x402136
push 1
push 1
mov al, 1
push eax
push edi
jmp 0x402136
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
cmp edx, 0x100
jne 0x402435
mov ebx, dword [esp + 0x24]
cmp esi, 0x1b
je 0x4022d6
cmp esi, 9
je 0x4022d6
cmp esi, 0x41
jne 0x402435
mov esi, dword [esp + 0xb8]
push 0x11
call esi
bt ax, 0xf
jae 0x40242d
push 0xa5
call esi
bt ax, 0xf
jb 0x40242d
mov edi, dword [esp + 0xbc]
push ebp
call edi
lea esi, [eax - 3]
cmp esi, dword [ebx + 0x5c]
jb 0x402305
push ebp
call dword [esp + 0xe8]
mov ebp, eax
test ebp, ebp
je 0x4022fc
push ebp
call edi
lea esi, [eax - 3]
cmp esi, dword [ebx + 0x5c]
jae 0x402427
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + esi*4]
mov dword [esp + 0x3c], edi
mov ecx, dword [edi + 0x18]
cmp ecx, ebp
jne 0x402427
cmp esi, 0x2af8
je 0x402427
test edi, edi
je 0x40242d
cmp byte [edi + 0x30], 0xc
jne 0x40242d
mov esi, dword [esp + 0x50]
cmp esi, 0x1b
je 0x4023aa
mov al, byte [edi + 0x31]
cmp esi, 0x41
je 0x40237b
test al, al
jns 0x402431
push 0x4b4374
push 1
push 0xc2
push ecx
call dword [esp + 0x44]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
test al, 2
jne 0x402431
push 0xffffffffffffffff
push 0
push 0xb1
push ecx
call dword [esp + 0x44]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov edx, dword [ebx + 0x54]
xor ecx, ecx
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
test edx, edx
jle 0x401c67
mov eax, dword [ebx + 0x4c]
add eax, 0xa
nop dword [eax]
cmp dword [eax - 6], 3
jne 0x4023db
cmp byte [eax], 0
je 0x4023fc
inc ecx
add eax, 0xc
cmp ecx, edx
jl 0x4023d0
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
push 0
push 0x2af80003
push 0x414
push dword [ebx + 0x1c]
call dword [esp + 0x114]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov eax, dword [0x4dccfc]
test eax, eax
je 0x40249e
cmp edx, 0x100
jne 0x40249e
cmp esi, 0xd
jne 0x402472
push 0
push 0
push 0x1116
push eax
call dword [esp + 0x44]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
cmp esi, 0x1b
jne 0x40249e
push 0
push 1
push 0x1116
push eax
call dword [esp + 0x44]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov ebx, dword [esp + 0x24]
cmp dword [ebx + 0x5c], 0
jne 0x4024b0
cmp edx, 0x106
je 0x4024ea
mov ecx, dword [0x4d78c8]
mov byte [ecx + 0x52], 1
mov eax, dword [esp + 0x4c]
mov dword [ecx + 0x4c], eax
lea eax, [esp + 0x48]
push eax
push dword [ebx + 0x1c]
call dword [esp + 0xe4]
mov ecx, dword [0x4d78c8]
mov byte [ecx + 0x52], 0
test eax, eax
jne 0x40213d
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x20]
cmp edx, 0x401
ja 0x402726
cmp edx, 0x400
jae case.0x40273c.1045
cmp edx, 0x100
ja 0x4025a3
je 0x40256e
cmp edx, 0x12
je 0x40254b
cmp edx, 0x4b
jne case.0x40273c.1027
mov edi, dword [esp + 0x1c]
mov al, 1
mov dword [0x4dbc5c], 0
mov byte [esp + 0x13], al
jmp 0x401c63
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
jmp 0x4024ee
mov esi, dword [esp + 0x50]
jmp 0x4024ee
push 0
push 5
mov ecx, 0x4dcd68
call fcn.00415de0
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov eax, dword [esp + 0x48]
cmp eax, dword [0x4dbc58]
jne case.0x40273c.1027
cmp esi, 0x1b
jne case.0x40273c.1027
push 0
push dword [0x4dbc70]
call dword [esp + 0xf4]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
cmp edx, 0x113
je 0x402631
cmp edx, 0x312
je case.0x40273c.1026
call dword [esp + 0xd4]
mov esi, eax
test esi, esi
je 0x403afe
push 0
push esi
call dword [esp + 0xe0]
cmp eax, dword [0x4dcd34]
jne 0x403afe
push 0x20
lea eax, [esp + 0x20c]
push eax
push esi
call dword [esp + 0xbc]
mov ecx, str.32770
lea eax, [esp + 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403aa5
test dx, dx
je 0x40262a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403aa5
add eax, 4
add ecx, 4
test dx, dx
jne 0x402600
xor eax, eax
jmp 0x403aaa
cmp dword [esp + 0x54], 0
jne case.0x40273c.1027
mov eax, dword [esp + 0x48]
cmp eax, dword [0x4dbc70]
jne case.0x40273c.1027
cmp dword [0x4dbfe8], 0
je 0x40265a
call fcn.00403f60
cmp dword [0x4dd3fc], 0
je 0x40267d
call fcn.00403d00
mov edx, dword [esp + 0x7c]
test al, al
movzx ecx, dl
mov eax, 1
cmovne ecx, eax
mov byte [esp + 0x7c], cl
cmp dword [esp + 0xac], 0
je 0x40213d
cmp ebp, 1
jl 0x40213d
mov ebx, dword [esp + 0x14]
call ebx
cmp byte [esp + 0x29], 0
jne 0x4026b5
mov ecx, dword [esp + 0xa0]
sub ecx, eax
add ecx, ebp
cmp ecx, 5
jg 0x402145
xor ecx, ecx
mov dword [0x4dd444], eax
cmp byte [esp + 0x32], cl
movzx eax, byte [0x4dbc43]
cmovne eax, ecx
mov byte [0x4dbc43], al
cmp byte [esp + 0x33], cl
je 0x402718
sub dword [0x4dbc74], 1
jne 0x402718
cmp dword [0x4dd3fc], ecx
jne 0x402718
cmp dword [0x4dbfe8], ecx
jne 0x402718
cmp byte [0x4dbc42], cl
je 0x402718
push 9
push dword [0x4dbc70]
call dword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x4dbc42]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov byte [0x4dbc42], cl
mov edx, dword [esp + 0x7c]
mov al, dl
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edx - 0x402]
cmp eax, 0x1c
ja case.0x40273c.1027
movzx eax, byte [eax + 0x403bbc]
jmp dword [eax*4 + 0x403bb0]
mov edi, dword [esp + 0x48]
test edi, edi
je case.0x40273c.1026
cmp edi, dword [0x4dbc70]
jne case.0x40273c.1027
lea eax, [edx - 0x401]
xor ebp, ebp
cmp eax, 0x1d
ja case.0x40276f.1027
movzx eax, byte [eax + 0x403bf8]
jmp dword [eax*4 + 0x403bdc]
mov edi, dword [esp + 0x48]
push 0xffffffffffffffe0
push edi
call dword [esp + 0xf0]
movzx eax, ax
cmp ax, word [0x4de0d0]
je 0x402799
mov dword [esp + 0x24], ebp
jmp case.0x40273c.1027
push 0xffffffffffffffeb
push edi
call dword [esp + 0x98]
mov ebx, eax
mov dword [esp + 0x24], ebx
test ebx, ebx
je case.0x40273c.1027
mov ecx, dword [esp + 0x50]
mov edx, ecx
mov eax, dword [esp + 0x54]
shr edx, 8
mov dword [esp + 0x38], eax
movzx eax, cl
mov dword [esp + 0x78], edx
xor edx, edx
shr ecx, 0x10
mov dword [esp + 0x84], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x8c], eax
cmp ecx, dword [ebx + 0x5c]
jae 0x4027f4
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + ecx*4]
mov eax, dword [esp + 0x84]
jmp 0x4027f6
xor edi, edi
lea esi, [ebx + 0x4c]
mov dword [esp + 0x3c], edi
xor bl, bl
mov byte [esp + 0x2a], dl
dec eax
mov byte [esp + 0xa4], bl
cmp eax, 0x10
ja case.0x402817.6
movzx eax, byte [eax + 0x403c2c]
jmp dword [eax*4 + 0x403c18]
mov edi, dword [esp + 0x24]
mov ebp, dword [edi + 0x34]
test ebp, ebp
je 0x40213d
push 0
push 0
push 0xffffffffffffffff
push ebp
call dword [esp + pe_nt_image_headers32]
mov dword [esp + 0x38], eax
test eax, eax
jne case.0x402817.2
push ebp
call dword [esp + 0x8c]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
mov dword [edi + 0x34], 0
mov edi, dword [esp + 0x1c]
jmp 0x401c6b
mov eax, dword [esp + 0x38]
mov bl, 2
mov byte [esp + 0xa4], bl
mov dword [esp + 0x8c], eax
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
test edi, edi
je 0x401c55
lea esi, [edi + 0x20]
mov byte [esp + 0x2a], 1
test esi, esi
je case.0x402817.5
mov edx, dword [esi + 4]
test edx, edx
je case.0x402817.5
nop word [eax + eax]
cmp byte [edx + 0x10], 0
jne 0x4028d5
mov eax, dword [edx + 8]
mov edi, dword [esp + 0x8c]
lea ecx, [eax + eax*2]
mov eax, dword [esi]
cmp dword [eax + ecx*4 + 4], edi
mov edi, dword [esp + 0x24]
jne 0x4028d5
cmp byte [eax + ecx*4 + 0xa], bl
je 0x4028e7
mov edx, dword [edx + 4]
test edx, edx
jne 0x4028b0
mov edx, dword [esp + 0x4c]
xor edi, edi
jmp 0x402ccd
test ebp, ebp
jne 0x402843
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
test esi, esi
je 0x402958
push 0xffffffffffffffe0
push esi
call dword [esp + 0xf0]
movzx eax, ax
cmp ax, word [0x4de0d0]
je 0x40292a
xor esi, esi
mov dword [esp + 0x24], esi
jmp 0x40293e
push 0xffffffffffffffeb
push esi
call dword [esp + 0x98]
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
jne 0x402952
mov eax, dword [esp + 0x48]
test eax, eax
je 0x402952
cmp eax, dword [0x4dbc70]
jne case.0x40273c.1027
mov edx, dword [esp + 0x4c]
jmp 0x40295e
xor esi, esi
mov dword [esp + 0x24], esi
mov ecx, dword [0x4dd400]
test ecx, ecx
je 0x402997
mov eax, dword [esp + 0x54]
nop dword [eax]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x68], ebx
test ebx, ebx
je 0x402990
nop dword [eax + eax]
cmp dword [ebx + 0x14], eax
je 0x4029b6
mov ebx, dword [ebx + 0x20]
mov dword [esp + 0x68], ebx
test ebx, ebx
jne 0x402980
mov ecx, dword [ecx + 0x20]
test ecx, ecx
jne 0x402970
mov ebp, dword [esp + 0x20]
xor eax, eax
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x68], eax
mov al, byte [esp + 0x13]
jmp 0x401c6b
cmp dword [ebx + 8], ebp
je 0x40213d
mov edi, dword [ebx + 0x18]
jmp 0x402cd5
cmp esi, dword [0x4dbfe4]
jae 0x40213d
mov eax, dword [0x4dbfe0]
mov esi, dword [eax + esi*4]
mov dword [esp + 0x94], esi
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x402a25
mov edx, dword [esi + 4]
call fcn.00409e70
mov esi, eax
mov dword [esp + 0x64], esi
mov dword [esp + 0x6c], esi
test esi, esi
je 0x40213d
mov esi, dword [esp + 0x94]
mov ecx, dword [esi + 0x10]
mov cl, byte [ecx]
cmp cl, 1
je 0x402a2f
cmp cl, 3
je 0x402a2f
xor ebx, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
jmp 0x402a2f
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
push dword [esp + 0x54]
mov ecx, esi
call fcn.0040c300
cmp dword [esi + 0xc], ebp
jne 0x40213d
cmp byte [esi + 0x2a], 0
je 0x402a60
mov ax, word [esp + 0x54]
mov edx, dword [esp + 0x4c]
mov word [0x4dd414], ax
mov edi, dword [esi + 0x14]
jmp 0x402ccd
mov edx, dword [esp + 0x4c]
xor eax, eax
mov word [0x4dd414], ax
mov edi, dword [esi + 0x14]
jmp 0x402ccd
cmp byte [0x4dd3e8], 0
jne 0x40213d
xor edi, edi
jmp 0x402ccd
mov ebx, esi
mov dword [esp + 0x44], ebx
test ebx, ebx
jne 0x402aaf
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
mov dword [esp + 0x44], ebp
mov ebp, dword [esp + 0x20]
jmp 0x401c6b
mov eax, dword [0x4dbc68]
cmp eax, ebx
jne 0x402ac2
mov eax, dword [esi + 4]
mov dword [0x4dbc68], eax
jmp 0x402ada
test eax, eax
je 0x402a92
lea ecx, [eax + 4]
mov eax, dword [ecx]
cmp eax, esi
je 0x402ad5
test eax, eax
jne 0x402ac6
jmp 0x402a92
mov eax, dword [esi + 4]
mov dword [ecx], eax
call fcn.00409c10
mov eax, dword [ebx + 8]
mov dword [esi + 4], ebp
test eax, eax
je 0x402a92
mov ecx, eax
cmp dword [0x4dbc68], ebp
jne 0x402b0c
cmp dword [0x4dbff4], ebp
jne 0x402b0c
test byte [0x4dbffe], 1
jne 0x402b0c
call fcn.0040a1b0
mov ecx, dword [ebx + 8]
cmp dword [ecx + 0x368], ebp
je 0x402b1f
mov edx, dword [esp + 0x4c]
xor edi, edi
jmp 0x402ccd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebx + 8], ebp
cmp dword [0x4dbc60], ebp
jne 0x402a92
mov ecx, 0x4dcd68
call fcn.00415d40
test al, al
jne 0x402a92
push 0
push 7
mov ecx, 0x4dcd68
call fcn.00415de0
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
mov dword [esp + 0x44], ebp
mov ebp, dword [esp + 0x20]
jmp 0x401c6b
mov ebx, dword [0x4dbc68]
mov edi, dword [esp + 0x1c]
mov al, byte [esp + 0x13]
mov dword [esp + 0x44], ebx
test ebx, ebx
je 0x401c5f
nop dword [eax + eax]
cmp ebx, esi
je 0x402bb4
mov ebx, dword [ebx + 4]
mov dword [esp + 0x44], ebx
test ebx, ebx
jne 0x402b90
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov eax, dword [ebx + 8]
cmp edx, 0x41c
jne 0x402bc7
mov eax, dword [eax + 0x36c]
jmp 0x402bdd
cmp edx, 0x41e
jne 0x402bd7
mov eax, dword [eax + 0x374]
jmp 0x402bdd
mov eax, dword [eax + 0x370]
test eax, eax
je 0x40213d
xor edi, edi
jmp 0x402ccd
mov eax, esi
and eax, 0x7fff
cmp ax, word [0x4dbffc]
jae 0x40213d
mov ecx, eax
shr esi, 0x10
mov eax, dword [0x4dbfec]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0xa8], eax
test si, si
je 0x402c49
mov ebx, dword [eax + 0x20]
add esi, 0xffff
mov dword [esp + 0x9c], ebx
test si, si
je 0x402c45
nop
mov ebx, dword [ebx + 0xc]
add esi, 0xffff
test si, si
jne 0x402c30
mov dword [esp + 0x9c], ebx
test ebx, ebx
jne 0x402c72
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
call fcn.0040a750
mov esi, dword [esp + 0x6c]
mov ebx, eax
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x64], esi
test ebx, ebx
je 0x40213d
mov edx, dword [esp + 0x4c]
mov al, byte [ebx + 0x1a]
cmp al, byte [ebx + 0x1b]
jb 0x402ca4
cmp byte [ebx + 0x1e], 0
je 0x402c84
mov byte [ebx + 0x1f], 1
call dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [ebx + 0x10], eax
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov eax, dword [ebx + 8]
test eax, eax
je 0x402cc0
mov al, byte [eax]
cmp al, 2
je 0x402cc0
cmp al, 4
je 0x402cc0
cmp al, 5
jne 0x402cca
mov eax, dword [0x4dbc64]
jmp 0x402cc2
xor eax, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x64], eax
mov edi, dword [ebx + 0x14]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x68]
mov eax, dword [0x4dbc60]
cmp eax, dword [0x4d78c4]
jl 0x402d2b
test ebp, ebp
je 0x402cf9
push ebp
call dword [esp + 0x8c]
mov dword [esi + 0x34], 0
mov edx, dword [esp + 0x4c]
cmp edx, 0x41b
jne 0x40213d
mov ebx, dword [esp + 0x44]
mov eax, dword [ebx + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov eax, dword [0x4d78c8]
cmp edi, dword [eax + 0x3c]
jge 0x402d6d
test ebp, ebp
je 0x402d4c
push ebp
call dword [esp + 0x8c]
mov dword [esi + 0x34], 0
mov edx, dword [esp + 0x4c]
cmp edx, 0x41b
je 0x402d05
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
jmp 0x401c6b
lea eax, [edx - 0x402]
mov byte [esp + 0x7c], 1
cmp eax, 0x1c
ja case.0x402d84.1027
movzx eax, byte [eax + 0x403c48]
jmp dword [eax*4 + 0x403c40]
mov eax, dword [0x4dd3b0]
mov dword [0x4dd3b4], eax
mov eax, dword [0x4dd40c]
mov dword [0x4dd410], eax
cmp edx, 0x401
jne 0x402db3
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 4]
jmp 0x402dbd
mov eax, dword [esp + 0xa8]
mov eax, dword [eax + 0x1c]
mov dword [0x4dd3b0], eax
call dword [esp + 0x14]
mov dword [0x4dd40c], eax
mov esi, dword [0x4d78c8]
inc dword [0x4dbc60]
add esi, 0xa0
mov eax, dword [0x4dbc48]
mov dword [0x4d78c8], esi
test eax, eax
je 0x402df1
add eax, 0x58
jmp 0x402df3
xor eax, eax
test esi, esi
je 0x402dfc
lea ecx, [esi + 0x58]
jmp 0x402dfe
xor ecx, ecx
movups xmm0, xmmword [eax]
push 0x58
push 0
movups xmmword [ecx], xmm0
push esi
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [ecx + 0x30], xmm0
mov eax, dword [eax + 0x40]
mov dword [ecx + 0x40], eax
call fcn.004956d0
add esp, 0xc
mov byte [esi + 0x53], 1
mov ecx, 0x4dcd68
mov dword [esi + 0x3c], edi
push 0
call fcn.00415750
mov al, byte [esi + 0x96]
test al, al
jne 0x402e52
mov byte [esi + 0x96], al
cmp dword [0x4dd440], 0
je 0x402e64
cmp dword [0x4dd43c], 0
jne 0x402e68
test al, al
je 0x402e91
mov byte [esi + 0x53], 0
test al, al
jne 0x402e91
cmp dword [0x4dd440], 0
jge 0x402e82
mov dword [esi + 0x44], 0xffffffff
jmp 0x402e91
call dword [esp + 0x14]
mov dword [esi + 0x48], eax
mov eax, dword [0x4dd440]
mov dword [esi + 0x44], eax
mov esi, dword [0x4d78c8]
call dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
mov dword [0x4dd444], eax
lea eax, [edi - 0x401]
cmp eax, 0x1d
ja case.0x402eba.1027
movzx eax, byte [eax + 0x403c88]
jmp dword [eax*4 + 0x403c68]
mov dl, byte [esp + 0x2a]
mov ebx, dword [esp + 0x24]
test dl, dl
jne 0x402ed2
cmp dword [ebx + 0x48], ebx
je 0x402eff
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x158]
mov edi, dword [esp + 0x3c]
mov eax, esi
shl eax, 4
inc esi
add ecx, eax
mov dword [esp + 0x2c], esi
test dl, dl
mov eax, ebx
cmovne eax, edi
mov dword [ecx + 8], 5
mov dword [ecx], eax
jmp 0x402f07
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x84]
lea eax, [edx - 1]
cmp eax, 0x10
ja case.0x402f21.6
movzx eax, byte [eax + 0x403cbc]
jmp dword [eax*4 + 0x403ca8]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edx
test edi, edi
je 0x403162
cmp byte [esp + 0x78], 0
je 0x403086
movzx eax, byte [edi + 0x30]
add eax, 0xfffffff7
mov dword [esp + 0xc0], VariantCopy
cmp eax, 8
ja case.0x402f66.12
jmp dword [eax*4 + 0x403cd0]
mov ebp, dword [esp + 0x34]
push 0
push 0
push 0x19f
push dword [edi + 0x18]
call ebp
cmp eax, 0xffffffff
je case.0x402f66.12
lea ecx, [esp + 0xc0]
push ecx
push eax
push 0x198
push dword [edi + 0x18]
call ebp
jmp case.0x402f66.12
mov ebp, dword [esp + 0x34]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x18]
call ebp
cmp eax, 0xffffffff
je case.0x402f66.12
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc0], 2
push ecx
push eax
push 0x100e
push dword [edi + 0x18]
call ebp
jmp case.0x402f66.12
mov ebp, dword [esp + 0x34]
push 0
push 9
push 0x110a
push dword [edi + 0x18]
call ebp
test eax, eax
je case.0x402f66.12
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xc0]
push eax
push 1
push 0x1104
push dword [edi + 0x18]
call ebp
jmp case.0x402f66.12
lea eax, [esp + 0xc0]
push eax
push 0
push 0x419
push dword [edi + 0x18]
call dword [esp + 0x44]
cmp dword [esp + 0xc0], 0x80000000
lea ecx, [esp + 0xc0]
mov eax, dword [edi + 0x18]
jne 0x403042
push ecx
push eax
call dword [esp + 0x114]
jmp 0x40304f
push 2
push ecx
push 0
push eax
call dword [esp + 0x120]
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0xcc]
sub eax, ecx
mov eax, eax
test eax, eax
jns 0x403073
add eax, 1
sar eax, 1
mov edx, dword [esp + 0x60]
add ecx, 2
add eax, ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x74], eax
movzx eax, byte [edi + 0x30]
sub eax, 9
je 0x40314c
sub eax, 1
je 0x40312f
sub eax, 1
jne 0x403162
cmp byte [esp + 0x78], al
je 0x4030e7
push eax
push 9
push 0x110a
push dword [edi + 0x18]
call dword [esp + 0x44]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x70]
push eax
push dword [ebx + 0x1c]
call dword [esp + 0x88]
mov eax, esi
lea ecx, [esp + 0x158]
shl eax, 4
mov edx, edi
add ecx, eax
mov esi, 5
jmp 0x40319a
mov ebp, dword [esp + 0x80]
lea eax, [esp + 0x1c8]
push eax
push dword [edi + 0x18]
mov dword [esp + 0x1d0], ecx
mov dword [esp + 0x1d4], edx
call ebp
lea eax, [esp + 0x1c8]
push eax
push 0
push 0x1111
push dword [edi + 0x18]
call dword [esp + 0x44]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x70]
push eax
push dword [ebx + 0x1c]
call ebp
jmp 0x4030cd
cmp byte [esp + 0x78], 0
je 0x4030be
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x18]
call dword [esp + 0x44]
inc eax
jmp 0x4030ba
push 0
push 0
push 0x19f
push dword [edi + 0x18]
call dword [esp + 0x44]
inc eax
jmp 0x4030ba
lea eax, [esp + 0x70]
push eax
push dword [ebx + 0x1c]
call dword [esp + 0x88]
mov eax, esi
lea ecx, [esp + 0x158]
shl eax, 4
add ecx, eax
test edi, edi
je 0x40318c
mov edx, edi
mov esi, 5
jmp 0x40319a
mov dword [ecx + 4], 0xffffffff
mov edx, 0x4b431c
xor esi, esi
mov dword [ecx + 8], esi
mov dword [ecx], edx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov dword [esp + eax + 0x168], ecx
mov dword [esp + eax + 0x170], 1
mov dword [esp + eax + 0x16c], 0
lea ecx, [edx + 2]
xor eax, eax
lea esi, [edx + 4]
add ecx, ecx
lea ebp, [esi + 1]
cmp byte [esp + 0x78], al
push ebx
sete al
mov dword [esp + 0x30], ebp
mov dword [esp + ecx*8 + 0x15c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + ecx*8 + 0x164], 1
mov dword [esp + ecx*8 + 0x160], 0
cdq
mov dword [esp + ecx*8 + 0x16c], eax
mov eax, esi
mov dword [esp + ecx*8 + 0x170], edx
mov dword [esp + ecx*8 + 0x174], 1
lea ecx, [esp + 0x15c]
shl eax, 4
add ecx, eax
mov eax, dword [esp + 0x78]
cdq
mov dword [ecx + 8], 1
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebx]
call dword [eax + 4]
jmp 0x403606
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x78], ecx
push dword [ebx + 0x1c]
call dword [esp + 0x88]
push 0xffffffffffffffec
push dword [ebx + 0x1c]
call dword [esp + 0x98]
and eax, 0xffffffef
push eax
push 0xffffffffffffffec
push dword [ebx + 0x1c]
call dword [esp + 0xdc]
shl esi, 4
mov eax, esi
test edi, edi
je 0x40328e
mov ecx, edi
mov edx, 5
jmp 0x4032a0
mov dword [esp + eax + 0x15c], 0xffffffff
mov ecx, 0x4b431c
xor edx, edx
mov edi, dword [esp + 0x2c]
mov dword [esp + eax + 0x160], edx
mov dword [esp + eax + 0x158], ecx
mov ecx, ebp
call fcn.00460710
mov dword [esp + esi + 0x170], 5
mov dword [esp + esi + 0x168], eax
lea esi, [edi + 2]
add esi, esi
cmp byte [ebx + 0xc6], 0
je 0x4032ee
push dword [0x4dcd38]
push 0x60
push dword [esp + 0x78]
call dword [esp + 0xa4]
jmp 0x4032f2
mov eax, dword [esp + 0x70]
cdq
mov dword [esp + esi*8 + 0x158], eax
lea eax, [edi + 4]
mov dword [esp + esi*8 + 0x160], 1
mov dword [esp + esi*8 + 0x15c], edx
cmp byte [ebx + 0xc6], 0
mov dword [esp + 0x2c], eax
je 0x403331
push dword [0x4dcd38]
push 0x60
push dword [esp + 0x7c]
call dword [esp + 0xa4]
jmp 0x403335
mov eax, dword [esp + 0x74]
cdq
push ebp
mov dword [esp + esi*8 + 0x174], 1
mov dword [esp + esi*8 + 0x16c], eax
mov dword [esp + esi*8 + 0x170], edx
call dword [esp + 0x8c]
mov dword [ebx + 0x34], 0
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x114]
mov edx, dword [esp + 0x2c]
lea esi, [ebx + 0x4c]
push eax
push ebx
push dword [esp + 0xac]
add ecx, 0x20
lea eax, [esp + 0x164]
push dword [esp + 0x98]
cmp byte [esp + 0x3a], 0
push edx
push eax
cmove ecx, esi
call fcn.00474ce0
mov edi, dword [ebx + 0x1c]
test edi, edi
je 0x4036c3
mov eax, dword [esp + 0x84]
sub eax, 1
je 0x403684
sub eax, 1
jne 0x4036c3
cmp dword [esp + 0x114], eax
jne 0x4036da
push eax
push edi
call dword [esp + 0xf4]
push dword [ebx + 0x1c]
call dword [esp + 0x128]
test eax, eax
setne al
cmp al, byte [ebx + 0xc8]
je 0x403650
mov ecx, dword [ebx]
mov byte [ebx + 0xc8], al
push ebx
test al, al
je 0x40364d
call dword [ecx + 4]
jmp 0x403650
cmp edx, 4
jne 0x4035ee
mov eax, dword [esp + 0x78]
mov ecx, esi
shl ecx, 4
lea esi, [esp + 0x168]
movsx eax, al
add esi, ecx
cdq
mov dword [esp + ecx + 0x158], eax
mov eax, dword [esp + 0x38]
mov dword [esp + ecx + 0x160], 1
mov dword [esp + ecx + 0x15c], edx
cmp byte [ebx + 0xc6], 0
movzx eax, ax
je 0x403465
push dword [0x4dcd38]
push 0x60
push eax
call dword [esp + 0xa4]
mov ebp, dword [esp + 0x2c]
cdq
mov dword [esi], eax
mov eax, ebp
mov dword [esi + 8], 1
add ebp, 3
mov dword [esi + 4], edx
lea esi, [esp + 0x178]
shl eax, 4
add esi, eax
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x38]
shr eax, 0x10
cmp byte [ebx + 0xc6], 0
je 0x4034ab
push dword [0x4dcd38]
push 0x60
push eax
call dword [esp + 0xa4]
cdq
mov dword [esi + 8], 1
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x4035f2
cmp byte [edi + 0x30], 0x17
jne 0x40357e
cmp edx, 7
jne 0x40357e
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x248], 0xd
lea eax, [ebp - 1]
mov dword [esp + 0x24c], eax
lea eax, [esp + 0x248]
push eax
push 0
push 0x703
push dword [edi + 0x18]
call dword [esp + 0x44]
test eax, eax
je 0x40350b
mov ax, word [esp + 0x258]
mov ecx, esi
add ecx, ecx
test ax, ax
je 0x403531
lea eax, [esp + 0x258]
mov dword [esp + ecx*8 + 0x15c], 0xffffffff
mov dword [esp + ecx*8 + 0x158], eax
xor eax, eax
jmp 0x403547
mov eax, ebp
cdq
mov dword [esp + ecx*8 + 0x158], eax
mov eax, 1
mov dword [esp + ecx*8 + 0x15c], edx
mov dword [esp + ecx*8 + 0x160], eax
add esi, 2
lea eax, [esp + 0x2b8]
mov dword [esp + ecx*8 + 0x170], 0
mov dword [esp + ecx*8 + 0x168], eax
mov dword [esp + ecx*8 + 0x16c], 0xffffffff
mov dword [esp + 0x2c], esi
jmp case.0x402f21.17
mov ecx, dword [esp + 0x38]
mov eax, esi
add eax, eax
inc esi
mov dword [esp + 0x2c], esi
mov dword [esp + eax*8 + 0x160], 1
mov dword [esp + eax*8 + 0x158], ecx
mov dword [esp + eax*8 + 0x15c], 0
mov eax, edx
sub eax, 0xa
je 0x4035c1
sub eax, 1
je 0x4035bb
sub eax, 2
je 0x4035c1
jmp 0x4035ee
cmp byte [edi + 0x30], 0xa
jne 0x4035ee
mov eax, esi
lea ecx, [esp + 0x158]
shl eax, 4
inc esi
add ecx, eax
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x78]
movzx eax, al
cdq
sub eax, 1
mov dword [ecx + 8], 1
mov dword [ecx], eax
sbb edx, 0
mov dword [ecx + 4], edx
mov ebp, dword [esp + 0x2c]
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
cmp dword [esp + 0x84], 5
jne 0x403364
test edi, edi
je 0x403364
push 0
push ebx
push dword [esp + 0xac]
lea eax, [ebp - 1]
push dword [esp + 0x98]
lea ecx, [edi + 0x20]
push eax
lea eax, [esp + 0x17c]
push eax
call fcn.00474ce0
cmp eax, 7
je 0x403642
cmp dword [ebx + 0x1c], 0
jne 0x403364
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
jmp 0x403a49
call dword [ecx + 8]
cmp dword [0x4dbc60], 0
jne 0x4036da
mov ecx, 0x4dcd68
call fcn.00415d40
test al, al
jne 0x4036da
push 0
push 5
mov ecx, 0x4dcd68
call fcn.00415de0
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
jmp 0x403a49
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4036cd
mov eax, dword [esi]
add eax, 0xa
cmp dword [eax - 6], 1
jne 0x40369d
cmp byte [eax], 0
je 0x4036a7
inc ecx
add eax, 0xc
cmp ecx, edx
jl 0x403692
jmp 0x4036cd
push 0xffffffffffffffec
push edi
call dword [esp + 0x98]
or eax, 0x10
push eax
push 0xffffffffffffffec
push dword [ebx + 0x1c]
call dword [esp + 0xdc]
jmp 0x4036cd
cmp dword [esp + 0x84], 1
jne 0x4036da
mov eax, dword [esp + 0x178]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
jmp 0x403a49
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4036ff
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x20], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x24], eax
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov esi, dword [ebx + 0x10]
push esi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [ebx]
xor ecx, ecx
mov dword [esp + 0x128], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x130], 0
mov dword [esp + 0x12c], 0xffffffff
mov eax, dword [eax + 0x14]
test eax, eax
je 0x40373f
cmp eax, ebx
je 0x403742
mov eax, dword [eax + 0x20]
inc ecx
test eax, eax
jne 0x403733
or ecx, 0xffffffff
push 0
lea eax, [ecx + 1]
mov dword [esp + 0x144], 1
mov ecx, dword [ebx + 8]
mov edx, ecx
push 0
mov dword [esp + 0x140], eax
lea eax, [esp + 0x130]
push 3
push eax
push 0
mov dword [esp + 0x150], 0
mov dword [esp + 0x164], 5
mov dword [esp + 0x15c], esi
call fcn.0046f110
mov eax, dword [esi]
add esp, 0x14
push esi
call dword [eax + 8]
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x403a49
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
jmp 0x403a49
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x64]
mov dword [esi + 0x20], eax
mov al, byte [ecx + 0x21]
mov byte [esi + 0x99], al
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x58], eax
mov esi, ecx
mov al, byte [esi + 0x24]
cmp al, byte [esi + 0x25]
jae 0x403a49
push 0
mov byte [0x4dd416], 0
mov eax, dword [esi + 4]
inc byte [esi + 0x24]
mov ecx, dword [esi]
mov edx, ecx
push 0
mov dword [esp + 0x1e0], eax
lea eax, [esp + 0x1e0]
push 1
push eax
push 0
mov dword [esp + 0x1f4], 0
mov dword [esp + 0x1f0], 0xffffffff
call fcn.0046f110
add esp, 0x14
dec byte [esi + 0x24]
jmp 0x403a49
call dword [esp + pe_nt_image_headers32]
test eax, eax
je 0x40385b
mov ebx, dword [esp + 0x11c]
push 0xd
call ebx
test eax, eax
jne 0x403852
push 0xf
call ebx
test eax, eax
jne 0x403852
mov eax, 2
xor ecx, ecx
jmp 0x403875
mov eax, 1
xor ecx, ecx
jmp 0x403875
xorps xmm0, xmm0
movlpd qword [esp + 0x1b8], xmm0
mov ecx, dword [esp + 0x1bc]
mov eax, dword [esp + 0x1b8]
push 0
push 1
mov dword [esp + 0x1f0], eax
lea eax, [esp + 0x1f0]
push 1
mov dword [esp + 0x1f8], ecx
mov ecx, 0x4dd3c8
push eax
mov dword [esp + 0x200], 1
mov byte [0x4dd3e8], 1
call fcn.00474bb0
mov byte [0x4dd3e8], 0
jmp 0x403a49
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x1f8]
push 0
push 0
push 1
mov ecx, dword [ebx + 8]
mov dword [esp + 0x20c], 5
mov dword [esp + 0x204], ecx
push eax
mov ecx, dword [ecx + 0x368]
mov edx, ecx
push 0
call fcn.0046f110
mov eax, dword [ebx + 8]
add esp, 0x14
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x403a49
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x130], 5
mov dword [esp + 0x140], 1
mov esi, dword [eax + 8]
movzx eax, cl
cdq
sar ecx, 0x10
mov dword [esp + 0x138], eax
movzx eax, cx
mov dword [esp + 0x13c], edx
cdq
mov dword [esp + 0x128], esi
mov dword [esp + 0x150], 1
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], edx
cmp edi, 0x41c
jne 0x40396a
mov ecx, dword [esi + 0x36c]
jmp 0x403970
mov ecx, dword [esi + 0x374]
push 0
push 0
push 3
lea eax, [esp + 0x134]
mov edx, ecx
push eax
push 0
call fcn.0046f110
add esp, 0x14
jmp 0x403a49
mov eax, dword [esp + 0x54]
mov word [esp + 0xf0], ax
sar eax, 0x10
mov word [esp + 0xf2], ax
xor eax, eax
mov word [esp + 0xf4], ax
mov eax, dword [esp + 0x44]
push 0
push 0
push 2
mov ecx, dword [eax + 8]
lea eax, [esp + 0xfc]
mov dword [esp + 0x144], eax
lea eax, [esp + 0x134]
mov dword [esp + 0x13c], 5
mov dword [esp + 0x134], ecx
mov dword [esp + 0x14c], 0
mov dword [esp + 0x148], 0xffffffff
mov ecx, dword [ecx + 0x370]
mov edx, ecx
push eax
push 0
call fcn.0046f110
add esp, 0x14
jmp 0x403a49
mov ecx, dword [esp + 0xa8]
mov al, byte [ecx + 0x10]
add al, 0x64
cmp al, 3
ja 0x403a26
mov eax, dword [esp + 0x54]
mov dword [esi + 0x24], eax
mov ebx, dword [esp + 0x9c]
mov eax, dword [esp + 0x64]
mov dword [esi + 0x20], eax
push ebx
mov al, byte [ebx + 0x1c]
mov byte [esi + 0x99], al
mov eax, dword [ebx + 8]
mov dword [esi + 0x58], eax
call fcn.0040a9d0
call fcn.00404340
cmp dword [esp + 0xac], 0
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x13]
je 0x401c6b
call ebx
cmp byte [esp + 0x29], 0
jne 0x403a8d
mov ecx, dword [esp + 0xa0]
sub ecx, eax
add ecx, ebp
cmp ecx, 5
jg 0x402145
mov esi, dword [esp + 0x18]
mov dword [0x4dd444], eax
mov al, 1
mov byte [esp + 0x13], al
mov byte [esp + 0x29], al
jmp 0x401c6b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403afe
mov ecx, dword [0x4d78c8]
mov byte [ecx + 0x52], 1
mov eax, dword [esp + 0x4c]
mov dword [ecx + 0x4c], eax
lea eax, [esp + 0x48]
push eax
push esi
call dword [esp + 0xe4]
test eax, eax
je 0x403af2
mov eax, dword [0x4d78c8]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov byte [eax + 0x52], 0
mov al, byte [esp + 0x13]
jmp 0x401c6b
mov ecx, dword [0x4d78c8]
mov byte [ecx + 0x52], 0
jmp 0x403b04
mov ecx, dword [0x4d78c8]
mov eax, dword [0x4dbc54]
test eax, eax
je 0x403b2e
lea ecx, [esp + 0x48]
push ecx
push eax
push dword [0x4dbc70]
call dword [esp + 0xec]
test eax, eax
jne 0x40213d
mov ecx, dword [0x4d78c8]
mov byte [ecx + 0x52], 1
mov eax, dword [esp + 0x4c]
mov dword [ecx + 0x4c], eax
lea eax, [esp + 0x48]
push eax
call dword [esp + 0x124]
lea eax, [esp + 0x48]
push eax
call dword [esp + 0x44]
mov eax, dword [0x4d78c8]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov byte [eax + 0x52], 0
mov al, byte [esp + 0x13]
jmp 0x401c6b
xor ecx, ecx
mov dword [0x4dd444], eax
cmp byte [esp + 0x32], cl
movzx eax, byte [0x4dbc43]
cmovne eax, ecx
mov byte [0x4dbc43], al
cmp byte [esp + 0x33], cl
je 0x402718
mov eax, dword [0x4dbc74]
dec eax
mov dword [0x4dbc74], eax
test ebp, ebp
jle 0x402718
test eax, eax
jmp 0x4026dc