Function at 0x40bc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x180
push esi
push edi
mov edi, ecx
mov dword [esp + 0x3c], edi
mov eax, dword [edi + 0xec]
cmp eax, 0xed8
jge 0x44359f
inc eax
mov dword [edi + 0xec], eax
cmp eax, 1
je 0x40c256
cmp byte [edi + 0xfc], 0
mov byte [edi + 0x144], 0
jne 0x40bf25
mov esi, 2
mov edi, edi
cmp byte [edi + 0x144], 0
jne 0x40bf25
mov ecx, edi
call fcn.004052b0
cmp eax, 1
je 0x4444ea
cmp dword [0x4c84a8], 0
jne 0x4435ec
cmp byte [0x4c7287], 1
je 0x4436a6
cmp dword [edi + 0x454], 0
je 0x40bd58
cmp byte [0x4c841c], 0
jne 0x40bd58
mov esi, dword [edi + 0x44c]
lea eax, [edi + 0x44c]
mov byte [0x4c841c], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
test esi, esi
jne 0x40bf4c
mov edi, dword [esp + 8]
mov eax, dword [edi]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40bf95
mov edi, dword [esp + 0x3c]
mov byte [0x4c841c], al
cmp dword [esp + 0x1c], eax
jg case.default.0x444297
lea esi, [eax + 2]
cmp byte [0x4c77bc], 0
je 0x40be1d
cmp byte [edi + 0x458], 1
je 0x40be1d
cmp byte [0x4c77e8], 1
je 0x40be1d
xor ecx, ecx
mov dword [esp + 0xbc], 0
mov eax, 8
mov dword [esp + 0xc0], 8
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420fe6
add esp, 4
mov dword [esp + 0xb8], eax
xor ecx, ecx
mov word [eax], cx
push 4
call fcn.00420fe6
add esp, 4
test eax, eax
je 0x40c372
mov dword [eax], 1
mov dword [esp + 0xc4], eax
lea esp, [esp]
cmp dword [0x4c77dc], 0
jne 0x4436e2
cmp byte [0x4c77bc], 0
je 0x44388c
mov esi, dword [esp + 0xc4]
dec dword [esi]
jne 0x40be1d
push dword [esp + 0xb8]
call fcn.0042105c
add esp, 4
push esi
call fcn.0042105c
add esp, 4
cmp dword [edi + 0x184], 0
jne 0x4438b5
cmp byte [0x4c7930], 0
jne 0x443f40
mov eax, dword [edi + 0xf8]
cmp eax, 7
je 0x44405d
cmp eax, 2
je 0x40c210
cmp eax, 8
je 0x4443a9
cmp eax, 9
je 0x4443a9
cmp eax, 3
je 0x40c210
cmp eax, 4
je 0x40c210
cmp eax, 5
je 0x40c210
cmp eax, 6
je 0x40c210
mov ecx, dword [ebp + 8]
mov dword [edi + 0xf4], ecx
push ecx
inc ecx
mov dword [ebp + 8], ecx
call fcn.00412fa0
mov esi, eax
mov dword [esp + 0x44], esi
test esi, esi
je 0x4440da
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 1
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
movsx eax, word [eax + 8]
test eax, eax
jne 0x40bfa9
lea eax, [ebp + 8]
mov ecx, edi
push eax
push esi
call fcn.00409a00
mov esi, dword [esp + 0x50]
test esi, esi
jne 0x40c1e9
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], edx
cmp ecx, 5
jge 0x40c35f
mov dword [esp + 0x54], 1
mov dword [esp + 0x48], 0
mov esi, 2
cmp byte [edi + 0xfc], 0
je 0x40bcc0
mov eax, dword [edi + 0xec]
mov byte [edi + 0x144], 0
cmp eax, 1
je 0x40c2af
dec eax
mov dword [edi + 0xec], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x11], 0
jne 0x40bf8d
mov edi, dword [eax + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
xor edx, edx
sub eax, edi
cmp edi, 0x7fffffff
ja 0x4436c0
cmp ecx, 0x7fffffff
ja 0x40bf78
cdq
mov edi, dword [esi]
test edx, edx
jl 0x40bf8d
jg 0x40c324
cmp eax, dword [edi + 0x18]
jae 0x40c324
mov esi, dword [esi + 4]
jmp 0x40bd28
mov ecx, dword [eax]
cmp byte [ecx + 0x11], 0
jne 0x4436d1
mov eax, dword [eax + 4]
jmp 0x40bd36
cmp eax, 0x33
jne 0x40bfbb
push esi
mov ecx, edi
call fcn.00409c80
jmp 0x40bee2
dec eax
cmp eax, 0x7e
ja case.0x40bfcc.2
movzx eax, byte [eax + 0x40c3b4]
jmp dword [eax*4 + 0x40c3a0]
mov eax, dword [esp + 8]
mov dword [esp + 0x60], 0x49098c
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], edx
mov ecx, dword [eax]
movsx eax, word [eax + 0xa]
mov dword [esp + 8], eax
mov eax, dword [0x4c8464]
mov dword [esp + 0x14], ecx
test al, 1
je 0x40c26d
cmp ecx, dword [0x4c8468]
je 0x4440e9
push ecx
lea ecx, [edi + 0x470]
call fcn.00416060
mov ecx, edi
mov al, byte [eax + 0x20]
mov byte [esp + 0x58], al
lea eax, [esp + 0x9c]
push dword [esp + 0x58]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x70]
push eax
push 0
call fcn.0040a820
test eax, eax
js 0x444111
mov esi, dword [esp + 0x14]
lea ecx, [edi + 0x470]
push esi
call fcn.00416060
mov ecx, dword [esp + 0x9c]
cmp ecx, dword [eax + 0x18]
jl 0x444138
push esi
lea ecx, [edi + 0x470]
call fcn.00416060
mov ecx, dword [esp + 0x9c]
cmp ecx, dword [eax + 0x1c]
jg 0x444138
lea ecx, [esp + 0x48]
call fcn.00404dc0
mov eax, dword [edi]
mov dword [esp + 0x54], 1
mov dword [esp + 0x48], 1
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
cmp byte [ecx + 0xd], 0
jne 0x40c379
mov dword [eax + 0x14], 0
cmp byte [ecx + 0xd], 0
mov eax, dword [ecx + 8]
jne 0x40c381
mov byte [eax + 0x18], 0
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, edi
mov dword [esp + 8], eax
cmp byte [eax + 0xd], 0
jne 0x44411f
mov esi, dword [eax + 8]
lea ecx, [esi + 0x20]
call fcn.00404dc0
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], 1
mov dword [esi + 0x20], 0
cmp byte [eax + 0xd], 0
mov eax, dword [eax + 8]
jne 0x40c389
push dword [esp + 0x14]
lea ecx, [edi + 0x470]
mov byte [eax + 0x30], 0
call fcn.00416060
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x64]
push eax
mov eax, dword [edi]
mov ecx, dword [ecx + eax]
add ecx, edx
add ecx, edi
call esi
test eax, eax
js 0x44412a
xor esi, esi
mov dword [esp + 0x60], 0x49098c
cmp dword [esp + 0x68], esi
jbe 0x40c192
jmp 0x40c160
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + esi*4]
mov dword [esp + 8], ecx
test ecx, ecx
je 0x40c184
call fcn.00405190
push dword [esp + 8]
call fcn.0042105c
mov eax, dword [esp + 0x68]
add esp, 4
mov dword [eax + esi*4], 0
inc esi
cmp esi, dword [esp + 0x68]
jb 0x40c160
push dword [esp + 0x64]
mov dword [esp + 0x6c], 0
call fcn.0042105c
mov esi, dword [esp + 0x48]
add esp, 4
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x18]
mov eax, dword [ecx + eax*4]
cmp word [eax + 8], 0x7f
je 0x40bee2
jmp 0x4441c3
lea eax, [esp + 0x83]
mov ecx, edi
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0
call fcn.0040b020
test eax, eax
jns 0x40c1aa
jmp 0x40bee2
mov eax, dword [esi + 0xc]
dec dword [eax]
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x4441df
push esi
call fcn.0042105c
add esp, 4
mov dword [esp + 0x50], 0
jmp 0x40beee
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x2f0], 0
je 0x40c242
mov ecx, dword [edi + 0x2f8]
call fcn.0042083e
test edx, edx
jl 0x40c242
jg 0x40c301
cmp eax, dword [edi + 0x2f0]
jae 0x40c301
mov eax, dword [edi + 0xf8]
cmp eax, 3
jl case.default.0x444297
jmp 0x44428b
mov eax, dword [edi + 0x11c]
mov dword [esp + 0x38], eax
test eax, eax
je 0x40bca5
jmp 0x4435ba
or eax, 1
lea ecx, [esp + 0x178]
push 0x492d0c
mov dword [0x4c8464], eax
call fcn.00411a36
mov ecx, dword [0x4c8294]
push dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x178]
mov dword [0x4c8468], eax
call fcn.00411cb6
mov ecx, dword [esp + 0x14]
jmp 0x40c006
mov ecx, edi
call fcn.0040c460
cmp byte [edi + 0xfc], 1
je 0x40bf42
mov ecx, edi
call fcn.0040c483
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [0x4c72ac]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x15c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x40bf42
jmp 0x444509
cmp dword [edi + 0xf8], 2
jne 0x40c391
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
jmp case.default.0x444297
inc dword [esp + 0x1c]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x3c]
mov dword [edi + 0x14], eax
push dword [esi]
call fcn.00405376
mov ecx, dword [esi]
push 0
push 1
mov byte [ecx + 0x10], 1
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x44]
inc eax
push eax
call fcn.00406cd8
mov eax, dword [esi]
mov byte [eax + 0x10], 0
jmp 0x40bf8d
add ecx, 0xfffffffb
cmp ecx, 0xa
ja case.0x40c36b.6
jmp dword [ecx*4 + 0x40c434]
xor eax, eax
jmp 0x40bdd2
mov eax, dword [eax + 0x38]
jmp 0x40c0b7
mov eax, dword [eax + 0x38]
jmp 0x40c0cb
mov eax, dword [eax + 0x38]
jmp 0x40c10e
mov dword [esp + 8], 0
jmp 0x4440c3
push 0xffffffffffffffff
push 0x9a
mov byte [0x4c7280], 0
call fcn.0046a48d
or eax, 0xffffffff
jmp 0x40bf44
push dword [eax]
mov ecx, edi
call fcn.00405376
test eax, eax
je 0x4435d5
mov eax, dword [eax + 0x10]
mov ecx, edi
push 1
inc eax
push eax
call fcn.0045700c
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x3c]
call fcn.00457392
mov eax, dword [esp + 0x38]
jmp 0x40c260
mov eax, dword [0x4c84ac]
push eax
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0xc], ecx
call fcn.0042105c
dec dword [0x4c84a8]
add esp, 4
mov dword [0x4c84ac], esi
neg esi
sbb esi, esi
xor ecx, ecx
and dword [0x4c84b0], esi
mov edx, dword [edi + 0x1c8]
mov dword [esp + 0x14], ecx
test edx, edx
je 0x44364d
mov esi, dword [edi + 0x1c4]
mov edi, dword [esp + 8]
mov eax, dword [esi + ecx*4]
mov eax, dword [eax]
test eax, eax
je 0x443640
cmp dword [eax], edi
je 0x443645
inc ecx
cmp ecx, edx
jb 0x443633
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x14], ecx
cmp ecx, edx
je 0x44369c
mov eax, dword [edi + 0x1c4]
mov eax, dword [eax + ecx*4]
mov ecx, edi
mov eax, dword [eax]
add eax, 8
push eax
call fcn.00405376
mov ecx, dword [edi + 0x1c4]
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx + eax*4]
mov ecx, dword [ecx]
add ecx, 0x18
push ecx
lea ecx, [edi + 0x14c]
call fcn.00411c9c
mov eax, dword [esi + 0x10]
mov ecx, edi
push 0
push 1
inc eax
push eax
call fcn.00406cd8
jmp case.default.0x444297
mov esi, 2
jmp 0x40bcea
cmp byte [0x4c7281], 0
jne 0x40bcf7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bf18
cmp ecx, 0x7fffffff
jbe 0x40bf78
jmp 0x40bf77
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0046a7cb
jmp 0x40bd34
mov eax, dword [0x4c77e0]
lea ecx, [esp + 0xb4]
mov esi, dword [eax]
push esi
call fcn.00486655
mov ecx, 0x4c77dc
call fcn.00415c75
test esi, esi
je 0x44370c
push ecx
mov ecx, esi
call fcn.00415c5d
cmp dword [esp + 0xbc], 0
mov dword [0x4c8420], 0
je 0x40bde0
lea eax, [esp + 0xb8]
mov ecx, edi
push eax
call fcn.00405376
mov esi, eax
test esi, esi
je 0x40bde0
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 1
call fcn.00404dc0
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x14c]
push 0x4a3eac
mov dword [esp + 0x80], 1
mov dword [esp + 0x74], eax
call fcn.00411a36
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c8270
push eax
lea eax, [esp + 0x154]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x14c]
call fcn.00411cb6
lea ecx, [esp + 0x70]
call fcn.00404dc0
mov eax, dword [esp + 0xc8]
lea ecx, [esp + 0x11c]
push str._GUI_WINHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00411a36
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c8270
push eax
lea eax, [esp + 0x124]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x11c]
call fcn.00411cb6
lea ecx, [esp + 0x70]
call fcn.00404dc0
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0x12c]
push str._GUI_CTRLHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00411a36
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c8270
push eax
lea eax, [esp + 0x134]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x12c]
call fcn.00411cb6
mov byte [edi + 0x458], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.00406cd8
lea ecx, [esp + 0x70]
mov byte [edi + 0x458], 0
call fcn.00404dc0
lea ecx, [esp + 0xb8]
call fcn.00411cb6
jmp case.default.0x444297
cmp dword [0x4c791c], 0
jne 0x4438a8
cmp dword [0x4c8420], 0x64
jge 0x4438a8
inc dword [0x4c8420]
push 0
jmp 0x4438aa
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bdfa
cmp byte [edi + 0x484], 1
je 0x40be2a
xor eax, eax
mov byte [edi + 0x484], 1
push dword [edi + 0x188]
lea ecx, [esp + 0x100]
mov dword [esp + 0x88], 0
mov dword [esp + 0xa8], 0x49098c
mov dword [esp + 0x20], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
call fcn.0046a058
lea ecx, [edi + 0x184]
call fcn.0045e0aa
mov esi, dword [esp + 0x100]
lea ecx, [esp + 0x88]
mov dword [esp + 0x90], 0
push dword [esi]
call fcn.00404e60
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.00404d37
push dword [esi + 8]
mov ecx, edi
call fcn.00405376
mov edx, eax
mov dword [esp + 0x40], edx
mov ecx, dword [edx + 0x10]
push ecx
call fcn.00412fa0
mov dword [edi + 0xf4], ecx
mov esi, 3
cmp dword [edx + 0x14], 0
mov dword [esp + 0x18], eax
jle 0x443ad3
mov edx, dword [esp + 0x100]
add edx, 8
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
jne 0x4439da
mov edx, dword [esp + 0x18]
mov edx, dword [edx + 4]
mov eax, dword [edx + esi*4 + 4]
cmp word [eax + 8], 0x33
je 0x4439b7
mov ecx, eax
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x443a56
mov ecx, dword [esp + 0x14]
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x4439ca
cmp eax, 0x1e
jne 0x443a56
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0
je 0x443999
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0x41
jne 0x443a0a
mov edx, dword [esp + 0x14]
inc esi
xor ecx, ecx
mov eax, dword [edx + esi*4]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x4439fd
inc ecx
jmp 0x443a53
cmp ax, 0x48
jne 0x443a49
dec ecx
jns 0x443a53
mov edx, dword [esp + 0x24]
push dword [edx]
lea ecx, [esp + 0xa8]
call fcn.00456c62
mov ecx, dword [esp + 0x84]
inc esi
mov eax, dword [esp + 0x40]
inc ecx
mov edx, dword [esp + 0x24]
add edx, 4
mov dword [esp + 0x84], ecx
mov dword [esp + 0x24], edx
cmp ecx, dword [eax + 0x14]
jge 0x443ac4
mov eax, dword [esp + 0x18]
jmp 0x443981
cmp ax, 0x40
jne 0x443a53
test ecx, ecx
je 0x443a06
inc esi
jmp 0x4439ed
mov eax, dword [esp + 0x18]
mov ecx, edi
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4 + 4]
movsx eax, word [eax + 0xa]
push eax
push 0x91
call fcn.0046a48d
jmp 0x443a94
mov ecx, esi
call fcn.00411cb6
push esi
call fcn.0042105c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x88]
call fcn.00405190
lea ecx, [esp + 0xfc]
call fcn.00456cf1
lea ecx, [esp + 0xa4]
call fcn.00456cf1
mov byte [edi + 0x484], 0
jmp 0x40be2a
mov eax, dword [esp + 0xa8]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
push dword [edx + 0x10]
call fcn.004038ff
mov eax, dword [esp + 0x40]
mov esi, 3
mov dword [esp + 0x5c], esi
mov dword [esp + 0x14], 1
cmp dword [eax + 0x14], 1
jl 0x443d2e
mov eax, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x44], edx
mov ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], dx
jne 0x443b3b
mov eax, dword [ecx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x443b28
cmp eax, 0x1e
jne 0x443b29
mov edx, 0x100
inc esi
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
je 0x443b14
mov dword [esp + 0x44], edx
mov dword [esp + 0x5c], esi
mov edi, dword [esp + 8]
lea edx, [esi*4 + 4]
mov dword [esp + 0x24], 1
xor ecx, ecx
mov esi, dword [esp + 0x24]
mov eax, dword [edx + edi]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x443b67
inc ecx
jmp 0x443c42
cmp ax, 0x48
jne 0x443c34
dec ecx
jns 0x443c42
mov eax, dword [esp + 0x84]
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x5c]
cmp dword [esp + 0x14], eax
jle 0x443ceb
lea eax, [esi + 2]
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov ecx, edi
mov eax, dword [esp + 0x24]
add eax, esi
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 1
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
call fcn.004053b0
test eax, eax
js 0x443dd1
mov eax, dword [esp + 0x44]
or eax, 0x200
push 1
push eax
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.004039be
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x443c14
push ecx
call fcn.004115f4
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x443c2d.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x443c2d.6
jmp dword [eax*4 + 0x44453f]
cmp ax, 0x40
jne 0x443c42
test ecx, ecx
je 0x443b78
inc esi
add edx, 4
jmp 0x443b54
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x443c2d.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x443cd1
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x443c2d.6
lea ecx, [eax + 8]
jmp 0x443cc8
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443c2d.6
push ecx
call fcn.004041c4
jmp case.0x443c2d.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0042105c
add esp, 4
push dword [esp + 0x28]
jmp 0x443cd1
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443c2d.6
push ecx
call fcn.00457a98
jmp case.0x443c2d.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443c2d.6
push ecx
call fcn.00457aad
jmp case.0x443c2d.6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x443c2d.6
mov ecx, eax
call fcn.00411cb6
push dword [esp + 8]
call fcn.0042105c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
jmp 0x443d08
mov eax, dword [esp + 0x1c]
or edx, 0x200
push 1
push edx
push dword [eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.004039be
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x40]
inc eax
add dword [esp + 0x1c], 4
add esi, eax
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0x14]
jle 0x443afa
push 0x4baa2c
lea ecx, [esp + 0x140]
call fcn.00411a36
mov esi, dword [esp + 0x88]
xor eax, eax
cmp dword [esp + 0x94], 6
push 1
setne al
dec eax
and eax, esi
push 0
push eax
lea eax, [esp + 0x148]
push eax
call fcn.004039be
lea ecx, [esp + 0x13c]
call fcn.00411cb6
mov eax, dword [esp + 0x40]
mov ecx, edi
push 0
push 0
mov eax, dword [eax + 0x10]
inc eax
push eax
call fcn.00406cd8
mov ecx, 0x4c8280
call fcn.00403a40
mov ecx, dword [esp + 0x90]
test ecx, ecx
je 0x443dae
push ecx
call fcn.004115f4
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x94]
cmp eax, 5
jl case.0x443dca.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x443dca.6
jmp dword [eax*4 + 0x44456b]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x443de7
push ecx
call fcn.004115f4
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x443e00.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x443e00.6
jmp dword [eax*4 + 0x444597]
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x443e00.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x443a7c
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x443e00.6
lea ecx, [esi + 8]
jmp 0x443a76
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443e00.6
push ecx
call fcn.004041c4
jmp case.0x443e00.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0042105c
add esp, 4
push dword [esp + 0x28]
jmp 0x443a7c
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443e00.6
push ecx
call fcn.00457a98
jmp case.0x443e00.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443e00.6
push ecx
call fcn.00457aad
jmp case.0x443e00.6
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x443e00.6
jmp 0x443a74
test esi, esi
je case.0x443dca.6
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x443efd
test esi, esi
je case.0x443dca.6
lea ecx, [esi + 8]
jmp 0x443ef8
test esi, esi
je case.0x443dca.6
push ecx
mov ecx, esi
call fcn.004041c4
jmp case.0x443dca.6
push dword [esi + 4]
call fcn.0042105c
add esp, 4
jmp 0x443efd
test esi, esi
je case.0x443dca.6
push ecx
mov ecx, esi
call fcn.00457a98
jmp case.0x443dca.6
test esi, esi
je case.0x443dca.6
push ecx
mov ecx, esi
call fcn.00457aad
jmp case.0x443dca.6
test esi, esi
je case.0x443dca.6
mov ecx, esi
call fcn.00411cb6
push esi
call fcn.0042105c
add esp, 4
lea ecx, [esp + 0xfc]
mov dword [esp + 0x94], 1
mov dword [esp + 0x88], 0
call fcn.00456cf1
lea ecx, [esp + 0xa4]
call fcn.00456cf1
mov byte [edi + 0x484], 0
jmp case.default.0x444297
cmp byte [edi + 0x459], 1
je 0x40be37
lea ecx, [esp + 0xb8]
call fcn.00411207
lea eax, [esp + 0xb4]
mov ecx, 0x4c7890
push eax
call fcn.00462baf
test al, al
je 0x44404c
cmp dword [esp + 0xbc], 0
je 0x443f59
lea eax, [esp + 0xb8]
mov ecx, edi
push eax
call fcn.00405376
mov esi, eax
test esi, esi
je 0x443f59
lea ecx, [esp + 0xe8]
mov dword [esp + 0xe8], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 1
call fcn.00404dc0
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x10c]
push str._TRAY_ID
mov dword [esp + 0xf8], 1
mov dword [esp + 0xec], eax
call fcn.00411a36
push 1
lea eax, [esp + 0xec]
mov ecx, 0x4c8270
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x10c]
call fcn.00411cb6
mov byte [edi + 0x459], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.00406cd8
lea ecx, [esp + 0xe8]
mov byte [edi + 0x459], 0
call fcn.00404dc0
lea ecx, [esp + 0xb8]
call fcn.00411cb6
jmp case.default.0x444297
lea ecx, [esp + 0xb8]
call fcn.00411cb6
jmp 0x40be37
push 0xa
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0xa0], eax
cmp eax, 0x102
je case.default.0x444297
lea eax, [esp + 0xa0]
push eax
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xa0]
mov dword [esp + 8], eax
jmp 0x4440c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x448], 0
mov dword [esp + 8], 0
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fd60
jmp 0x40c30e
mov dword [edi + 0xf8], 1
jmp case.default.0x444297
lea eax, [esp + 0x48]
mov ecx, edi
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.0047c355
lea ecx, [esp + 0x60]
mov dword [esp + 8], eax
call fcn.00456cf1
mov eax, dword [esp + 8]
jmp 0x40c1e0
lea ecx, [esp + 0x60]
call fcn.00456cf1
jmp 0x40bee2
mov eax, dword [eax + 8]
mov esi, dword [eax + 0x38]
jmp 0x40c0e7
lea ecx, [esp + 0x60]
call fcn.00456cf1
jmp 0x40bee2
push dword [esp + 8]
mov ecx, edi
push 0x70
call fcn.0046a48d
lea ecx, [esp + 0x60]
call fcn.00456cf1
jmp 0x40bee2
lea ecx, [edi + 0x168]
call fcn.0047c6cc
mov ecx, eax
call fcn.00456b40
test al, al
jne 0x44418c
mov eax, dword [esp + 8]
mov ecx, edi
movsx eax, word [eax + 0xa]
push eax
push 0xa7
call fcn.0046a48d
lea ecx, [esp + 0x48]
call fcn.00405190
jmp case.default.0x444297
lea ecx, [edi + 0x168]
call fcn.0047c6cc
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push esi
call fcn.0047bc26
jmp 0x40c1e0
push 0xffffffffffffffff
lea eax, [esp + 0x4c]
mov ecx, edi
push eax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.004053b0
jmp 0x40c1e0
movsx eax, word [eax + 0xa]
mov ecx, edi
push eax
push 0x72
call fcn.0046a48d
lea ecx, [esp + 0x48]
call fcn.00405190
jmp case.default.0x444297
push dword [esi]
call fcn.0042105c
add esp, 4
push dword [esi + 0xc]
call fcn.0042105c
add esp, 4
jmp 0x40c1fa
test edx, edx
je case.0x40c36b.6
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x48]
jmp 0x44427e
test edx, edx
je case.0x40c36b.6
lea ecx, [edx + 8]
jmp 0x444275
test edx, edx
je case.0x40c36b.6
push ecx
mov ecx, edx
call fcn.004041c4
jmp case.0x40c36b.6
push dword [edx + 4]
call fcn.0042105c
add esp, 4
push dword [esp + 0x48]
jmp 0x44427e
test edx, edx
je case.0x40c36b.6
push ecx
mov ecx, edx
call fcn.00457a98
jmp case.0x40c36b.6
test edx, edx
je case.0x40c36b.6
push ecx
mov ecx, edx
call fcn.00457aad
jmp case.0x40c36b.6
test edx, edx
je case.0x40c36b.6
mov ecx, edx
call fcn.00411cb6
push dword [esp + 0x1c]
call fcn.0042105c
add esp, 4
jmp case.0x40c36b.6
sub eax, 3
cmp eax, 3
ja case.default.0x444297
jmp dword [eax*4 + 0x4445c3]
mov ecx, edi
call fcn.00486562
jmp 0x4442d0
mov ecx, edi
call fcn.00486562
jmp 0x4442b9
push 1
mov ecx, edi
call fcn.00406d79
mov esi, eax
test esi, esi
js 0x4442d6
jg case.default.0x444297
jmp 0x44430f
push 1
mov ecx, edi
call fcn.00406d79
mov esi, eax
test esi, esi
jns 0x444305
mov eax, esi
neg eax
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00457135
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fd60
test esi, esi
je case.default.0x444297
test esi, esi
jle 0x444388
mov eax, dword [edi + 0xf8]
cmp eax, 5
je 0x44431f
cmp eax, 3
jne 0x444388
mov eax, dword [edi + 0x1f0]
lea ecx, [esp + 0xd8]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 1
mov esi, dword [eax]
call fcn.00404dc0
push 0
lea eax, [esp + 0xdc]
mov dword [esp + 0xe8], 7
push eax
mov eax, dword [edi]
mov dword [esp + 0xe0], esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004570e2
lea ecx, [esp + 0xd8]
call fcn.00404dc0
mov ecx, dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call fcn.004657ff
jmp case.default.0x444297
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x43c], 0
je 0x4443e6
mov ecx, dword [edi + 0x440]
call fcn.0042083e
test edx, edx
jl 0x4443e6
jg 0x4443d3
cmp eax, dword [edi + 0x43c]
jb 0x4443e6
mov eax, dword [edi + 0x448]
test eax, eax
je 0x4440bb
jmp 0x4440aa
mov eax, dword [edi + 0xf8]
xor esi, esi
mov byte [esp + 0x23], 0
mov dword [esp + 8], esi
cmp eax, 8
jne 0x444424
lea eax, [esp + 0x23]
push eax
lea ecx, [edi + 0x42c]
lea edx, [esp + 0xc]
call fcn.00464148
add esp, 4
cmp byte [esp + 0x23], 1
jne case.default.0x444297
mov esi, dword [esp + 8]
jmp 0x44442d
cmp eax, 9
jne case.default.0x444297
mov ecx, dword [edi + 0x448]
mov eax, 0xcccccccc
mov dword [esp + 0x38], eax
test ecx, ecx
je 0x444486
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x38], 0x103
jne 0x44446c
push 0
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.default.0x444297
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
mov dword [edi + 0x448], 0
cmp dword [edi + 0xf8], 8
jne 0x4444b9
mov dword [esp + 8], esi
fild dword [esp + 8]
test esi, esi
jns 0x4444a1
fadd qword [0x4bcac8]
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
fstp qword [esp + 0x10]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0047d016
jmp 0x4444c8
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fdae
push dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x444297
push ecx
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fd60
jmp 0x40bf25
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x168]
push eax
call esi
test eax, eax
jg 0x444509
jmp 0x40bf42