Function at 0x42b7d0
Capabilities:
Check if file exists
Delete service
Link many functions at runtime
Move file
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556077
mov eax, dword fs:[0]
push eax
sub esp, 0x728
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x728], ecx
xor eax, eax
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x71c], eax
call fcn.00445030
or edi, 0xffffffff
test eax, eax
je 0x42bab4
push str.HdDrv
call fcn.00429dc0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x42b845
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42b8b3
push 0x10024
push str.HdDrv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42b86a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42b8b0
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x674], 0
push eax
xorps xmm0, xmm0
push 1
push esi
movups xmmword [ebp - 0x68c], xmm0
movq qword [ebp - 0x67c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x42b8a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00513d10
lea eax, [ebp - 0x71c]
push eax
call fcn.00444eb0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0x10
push str.Utils__HdDrv.sys
push dword [eax]
lea eax, [ebp - 0x420]
push eax
call esi
mov edx, dword [ebp - 0x71c]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42b90b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x710]
call fcn.00425c10
push dword [eax]
lea ecx, [ebp - 0x62c]
mov dword [ebp - 4], 0
call fcn.0041c2a0
mov eax, dword [ebp - 0x710]
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 2
cmp eax, ecx
je 0x42b94e
push eax
call fcn.0051bf28
add esp, 4
push 4
push str..tmp
lea ecx, [ebp - 0x62c]
call fcn.00427a10
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x94]
call fcn.00425c10
push dword [ebp - 0x62c]
push dword [eax]
call fcn.00528a64
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
add esp, 8
cmp eax, ecx
je 0x42b99b
push eax
call fcn.0051bf28
add esp, 4
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00513d10
lea eax, [ebp - 0x71c]
push eax
call fcn.00444eb0
add esp, 0x10
push str.Utils__HdDrv_x64.sys
push dword [eax]
lea eax, [ebp - 0x628]
push eax
call esi
mov edx, dword [ebp - 0x71c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42b9ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x94]
call fcn.00425c10
mov edx, dword [eax]
mov byte [ebp - 4], 3
test edx, edx
jne 0x42ba0a
xor ecx, ecx
jmp 0x42ba19
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ba10
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x62c]
call fcn.0041dba0
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
cmp eax, ecx
je 0x42ba43
push eax
call fcn.0051bf28
add esp, 4
push 4
push str..tmp
lea ecx, [ebp - 0x62c]
call fcn.00427a10
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x94]
call fcn.00425c10
push dword [ebp - 0x62c]
push dword [eax]
call fcn.00528a64
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
add esp, 8
cmp eax, ecx
je 0x42ba90
push eax
call fcn.0051bf28
add esp, 4
mov edx, dword [ebp - 0x62c]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42bab4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0042a770
mov ecx, eax
call fcn.0043a910
lea eax, [ebp - 0x638]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x638], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x42c7a8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x718], eax
movzx eax, word [ebp - 0x62c]
push eax
movzx eax, word [ebp - 0x62e]
push eax
movzx eax, word [ebp - 0x630]
push eax
movzx eax, word [ebp - 0x632]
push eax
movzx eax, word [ebp - 0x636]
push eax
movzx eax, word [ebp - 0x638]
push eax
lea eax, [ebp - 0x718]
mov dword [ebp - 4], 4
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.00406440
mov esi, dword [ebp - 0x718]
add esp, 0x20
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push str.LastRunTrayDate
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42bb88
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00430000
test al, al
je 0x42bbff
push 0x30
call fcn.004d6883
add esp, 4
mov dword [ebp - 0x71c], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x42bbb5
mov ecx, eax
call fcn.0041e610
jmp 0x42bbb7
xor eax, eax
mov esi, dword [ebp - 0x728]
mov dword [ebp - 4], 0xffffffff
mov edi, dword [esi + 0x45c]
mov dword [esi + 0x45c], eax
test edi, edi
je 0x42bbe6
mov ecx, edi
call fcn.0041e750
push 0x30
push edi
call fcn.004d65a7
add esp, 8
mov ecx, dword [esi + 0x45c]
lea eax, [esi + 0x28]
mov edx, esi
neg edx
sbb edx, edx
and edx, eax
push edx
call fcn.0041f220
jmp 0x42bc05
mov esi, dword [ebp - 0x728]
push str._SPB
lea ecx, [ebp - 0x670]
call fcn.00407b80
lea eax, [ebp - 0x670]
mov dword [ebp - 4], 6
push 0
push eax
call fcn.00413030
mov ecx, eax
call fcn.004100a0
mov edx, dword [ebp - 0x65c]
test eax, eax
mov dword [ebp - 4], 0xffffffff
setne al
mov byte [ebp - 0x71d], al
cmp edx, 8
jb 0x42bc89
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42bc79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42c7b2
push edx
push ecx
call fcn.004d65a7
mov al, byte [ebp - 0x71d]
add esp, 8
test al, al
je 0x42be8b
push 0
push str.run_spb
push 1
push 0
push 0x56797c
call fcn.0040f500
mov ecx, eax
call fcn.00457650
call fcn.0044f240
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x42bd92
push 0x45
push str.d:jenkins.jenkinsworkspacehalodeskcoral_traymainwndmainwnd.cpp
lea ecx, [ebp - 0x670]
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x65c], 0xf
mov byte [ebp - 0x670], al
call fcn.0040c4b0
push 3
push 0x56431c
lea ecx, [ebp - 0x640]
mov dword [ebp - 4], 7
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0xf
mov byte [ebp - 0x640], 0
call fcn.0040c4b0
mov byte [ebp - 4], 8
call fcn.0044f240
mov edi, eax
lea ecx, [ebp - 0xa8]
push 0x105
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.00407ce0
mov esi, eax
push str.DoXBandLua
push esi
mov byte [ebp - 4], 9
call fcn.00406ec0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xa8]
call fcn.00409030
lea ecx, [ebp - 0x640]
call fcn.00408790
lea ecx, [ebp - 0x670]
mov dword [ebp - 4], 0xffffffff
call fcn.00408790
push 0x10
call fcn.004d6883
mov esi, eax
add esp, 4
test esi, esi
je 0x42bdba
mov ecx, dword [ebp - 0x728]
mov dword [esi], ecx
mov dword [esi + 8], 0x428670
mov dword [esi + 0xc], 0
jmp 0x42bdbc
xor esi, esi
mov eax, 4
mov dword [ebp - 0x71c], esi
mov dword [ebp - 0x724], eax
lea ecx, [ebp - 0x654]
mov dword [ebp - 4], 0xa
call fcn.00426360
mov dword [ebp - 0x654], 0x5693c4
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x644], esi
lea eax, [ebp - 0x630]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x654]
call fcn.00432990
mov eax, dword [ebp - 0x644]
test eax, eax
je 0x42be24
push 0x10
push eax
call fcn.004d65a7
add esp, 8
mov esi, dword [ebp - 0x64c]
mov edi, dword [ebp - 0x650]
push esi
mov byte [ebp - 4], 0xc
call fcn.00447fc1
add esp, 4
test eax, eax
je 0x42be4a
push eax
call fcn.004483dc
add esp, 4
push esi
call fcn.00447f05
push edi
call fcn.0044822c
mov esi, dword [ebp - 0x728]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x44c], 0
jne 0x42c7b7
mov eax, dword [ebp - 0x630]
mov dword [esi + 0x448], eax
mov eax, dword [ebp - 0x62c]
mov dword [esi + 0x44c], eax
call fcn.0041a8b0
mov ecx, eax
call fcn.0041a9a0
call fcn.0042a650
push 0x208
mov edi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.netul.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42bf66
cmp dword [edi], 0
jne 0x42bf66
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x42bf66
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x42bf60
call eax
mov dword [edi + 0xc], eax
mov esi, dword [ebp - 0x728]
lea eax, [ebp - 0x734]
push eax
call fcn.0040f470
mov ecx, eax
call fcn.004107a0
mov eax, dword [ebp - 0x734]
mov ecx, 0x5650dc
mov dword [ebp - 4], 0xd
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42bfb6
test dx, dx
je 0x42bfb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42bfb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x42bf90
xor eax, eax
jmp 0x42bfbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42c031
push eax
mov ecx, esi
call fcn.004281e0
call fcn.00418940
test eax, eax
jne 0x42c01a
call fcn.0040f470
mov ecx, eax
call fcn.00410b40
test eax, eax
jne 0x42bff0
call fcn.0040f470
mov ecx, eax
call fcn.004108c0
test eax, eax
je 0x42bff5
call fcn.00417b50
call fcn.0040f470
mov ecx, eax
call fcn.00410b60
test eax, eax
jne 0x42c015
call fcn.0040f470
mov ecx, eax
call fcn.004108e0
test eax, eax
je 0x42c01a
call fcn.00418100
call fcn.004188f0
test eax, eax
jne 0x42c726
call fcn.00417990
jmp 0x42c726
call fcn.0040f470
mov ecx, eax
call fcn.00410b40
test eax, eax
je 0x42c04f
push 0
call fcn.0040f470
mov ecx, eax
call fcn.00410ec0
call fcn.0040f470
mov ecx, eax
call fcn.00410b60
test eax, eax
je 0x42c06d
push 0
call fcn.0040f470
mov ecx, eax
call fcn.00410f70
xor eax, eax
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 7
mov word [ebp - 0x688], ax
push 0x564ff8
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 0xe
call fcn.00407b80
lea eax, [ebp - 0x670]
mov byte [ebp - 4], 0xf
push 0
push eax
call fcn.00413030
mov ecx, eax
call fcn.004100a0
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 0xe
mov esi, eax
call fcn.004087e0
test esi, esi
je 0x42c109
push 0x564ff8
lea ecx, [ebp - 0x670]
call fcn.00407b80
lea eax, [ebp - 0x688]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.00413030
mov ecx, eax
call fcn.00410090
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 0xe
call fcn.004087e0
lea eax, [ebp - 0x730]
push eax
call fcn.0043f0d0
add esp, 4
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
push 0x565a70
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 0x12
call fcn.00407b80
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.00413030
mov ecx, eax
call fcn.00410090
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 0x12
call fcn.004087e0
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
push str.rmenu
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
je 0x42c2a9
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
push str.rmenu_theme
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
je 0x42c2a9
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
push str.startmenu
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
je 0x42c2a9
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
push str.desktop
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
je 0x42c2a9
push str._try_now
lea ecx, [ebp - 0x670]
call fcn.00407b80
mov eax, dword [ebp - 0x724]
or eax, 1
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x71c], eax
lea eax, [ebp - 0x670]
push 0
push eax
call fcn.00413030
mov ecx, eax
call fcn.004100a0
test eax, eax
jne 0x42c2a9
cmp dword [ebp - 0x678], eax
jne 0x42c2a9
mov eax, dword [ebp - 0x730]
mov ecx, 0x567a38
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42c299
test dx, dx
je 0x42c295
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42c299
add eax, 4
add ecx, 4
test dx, dx
jne 0x42c273
xor eax, eax
jmp 0x42c29e
sbb eax, eax
or eax, 1
mov byte [ebp - 0x711], 0
test eax, eax
jne 0x42c2b0
mov byte [ebp - 0x711], 1
mov eax, dword [ebp - 0x724]
mov dword [ebp - 4], 0x12
test al, 1
je 0x42c2d5
and eax, 0xfffffffe
lea ecx, [ebp - 0x670]
mov dword [ebp - 0x724], eax
call fcn.004087e0
cmp byte [ebp - 0x711], 0
je 0x42c479
push 0x5650dc
lea ecx, [ebp - 0x718]
call fcn.0040f1f0
lea eax, [ebp - 0x718]
mov byte [ebp - 4], 0x15
push eax
call fcn.0040f470
mov ecx, eax
call fcn.00410b80
mov edx, dword [ebp - 0x718]
or edi, 0xffffffff
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c32d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00418940
test eax, eax
jne 0x42c33b
call fcn.00417b50
call fcn.004189f0
test eax, eax
jne 0x42c349
call fcn.00418100
call fcn.004188f0
test eax, eax
jne 0x42c357
call fcn.00417990
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.00418fd0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x718]
call fcn.0040f1f0
lea eax, [ebp - 0x718]
mov byte [ebp - 4], 0x16
push eax
call fcn.004178b0
mov edx, dword [ebp - 0x718]
add esp, 4
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c3d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x718]
call fcn.0040f1f0
lea eax, [ebp - 0x718]
mov byte [ebp - 4], 0x17
push eax
call fcn.004186b0
mov edx, dword [ebp - 0x718]
add esp, 4
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c41f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x718]
call fcn.0040f1f0
lea eax, [ebp - 0x718]
mov byte [ebp - 4], 0x18
push eax
call fcn.004190c0
mov edx, dword [ebp - 0x718]
add esp, 4
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c465
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x728]
mov ecx, esi
push 0
call fcn.004281e0
jmp 0x42c6eb
lea eax, [ebp - 0x72c]
push eax
call fcn.0043f0d0
add esp, 4
mov eax, dword [ebp - 0x72c]
mov byte [ebp - 4], 0x19
mov esi, dword [eax - 0xc]
test esi, esi
js 0x42c7bc
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x42c4c0
push esi
lea ecx, [ebp - 0x72c]
call fcn.00406ba0
mov eax, dword [ebp - 0x72c]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0051791b
mov eax, dword [ebp - 0x72c]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x42c7bc
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x72c]
push str.tend
mov word [eax + esi*2], cx
lea ecx, [ebp - 0x718]
call fcn.0040f1f0
mov eax, dword [ebp - 0x72c]
mov ecx, dword [ebp - 0x718]
mov byte [ebp - 4], 0x1a
mov edx, dword [eax - 0xc]
mov ecx, dword [ecx - 0xc]
cmp edx, ecx
jl 0x42c617
xor edi, edi
test ecx, ecx
cmovns edi, ecx
cmp edi, edx
jl 0x42c538
add eax, 0xfffffff0
push eax
call fcn.004129e0
add esp, 4
lea esi, [eax + 0x10]
jmp 0x42c5be
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x42c54c
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x42c55c
call fcn.00406530
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x71c], eax
test ecx, ecx
je 0x42c7c6
test eax, eax
jne 0x42c57c
test edi, edi
jne 0x42c7d0
mov eax, dword [ecx]
push 2
push edi
mov eax, dword [eax]
call eax
test eax, eax
je 0x42c7da
lea esi, [eax + 0x10]
test edi, edi
js 0x42c7bc
cmp edi, dword [esi - 8]
jg 0x42c7bc
lea eax, [edi + edi]
mov dword [esi - 0xc], edi
push eax
push dword [ebp - 0x71c]
xor ecx, ecx
push eax
push esi
mov word [eax + esi], cx
call fcn.0040dc70
add esp, 0x10
mov eax, dword [ebp - 0x724]
or eax, 0xa
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x718]
test eax, eax
je 0x42c7df
mov ecx, esi
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x42c606
test dx, dx
je 0x42c602
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x42c606
add ecx, 4
add eax, 4
test dx, dx
jne 0x42c5e0
xor eax, eax
jmp 0x42c60b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42c61d
mov byte [ebp - 0x711], al
jmp 0x42c624
mov esi, dword [ebp - 0x71c]
mov byte [ebp - 0x711], 1
mov eax, dword [ebp - 0x724]
or edi, 0xffffffff
test al, 2
je 0x42c648
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42c648
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x728]
push 0
push 0
sub esp, 0x28
cmp byte [ebp - 0x711], 0
mov eax, esp
mov dword [ebp - 0x71c], esp
mov dword [eax], vtable.._AV___Func_impl_no_alloc_V___Binder_U_Unforced_std__P8CMainWnd__AEXXZPAV3__std__XPAX_std__.0
mov dword [eax + 0xc], 0
je 0x42c686
mov dword [eax + 8], 0x42c7f0
mov dword [eax + 0x10], esi
mov dword [eax + 0x24], eax
mov byte [ebp - 4], 0x1b
jmp 0x42c697
mov dword [eax + 8], 0x42cf80
mov dword [eax + 0x10], esi
mov dword [eax + 0x24], eax
mov byte [ebp - 4], 0x1c
push 1
call fcn.0041a8b0
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.0041a590
mov edx, dword [ebp - 0x718]
mov eax, edi
mov byte [ebp - 4], 0x19
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c6ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x72c]
mov eax, edi
mov byte [ebp - 4], 0x12
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c6eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x658]
call fcn.004087e0
mov edx, dword [ebp - 0x730]
mov eax, edi
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c717
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 0xd
call fcn.004087e0
call fcn.00444fb0
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
test eax, eax
je 0x42c73e
push 0xea60
jmp 0x42c743
push 0x493e0
push 0x302
push dword [esi + 4]
call edi
cmp byte [ebp - 0x71d], 0
jne 0x42c764
push 0
push 1
push 0x304
push dword [esi + 4]
call edi
mov edx, dword [ebp - 0x734]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c789
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00406210
call fcn.005172e0
call fcn.0051c090
push 0x80070057
call fcn.00406210
push 0x80004005
call fcn.00406210
push 0x80070057
call fcn.00406210
call fcn.00406e30
push 0x80004005
call fcn.00406210
int3