Function at 0x410cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
push esi
push edi
mov edi, ecx
mov dword [esp + 0x44], edi
mov eax, dword [edi + 0xec]
cmp eax, 0xed8
jge 0x4455ea
inc eax
mov dword [edi + 0xec], eax
cmp eax, 1
je 0x4111bd
cmp byte [edi + 0xfc], 0
mov byte [edi + 0x144], 0
jne 0x410fe4
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [edi + 0x144], 0
mov edx, 2
jne 0x410fe4
cmp byte [0x4c5281], 0
jne 0x445637
cmp byte [0x4c57e8], 0
jne 0x445649
push 1
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call esi
test eax, eax
jne 0x411110
cmp byte [0x4c5282], 1
je 0x4456be
cmp dword [edi + 0xf8], 1
je 0x446560
mov edx, 2
cmp dword [0x4c64b8], 0
jne 0x4456db
cmp byte [0x4c5287], 1
je 0x44579b
cmp dword [edi + 0x454], 0
je 0x410e04
cmp byte [0x4c641c], 0
jne 0x410e04
mov esi, dword [edi + 0x44c]
lea eax, [edi + 0x44c]
mov byte [0x4c641c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
nop
test esi, esi
jne 0x41100b
mov edi, dword [esp + 8]
lea esp, [esp]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x411054
mov edi, dword [esp + 0x44]
mov byte [0x4c641c], al
cmp dword [esp + 0x14], eax
jg case.default.0x44630d
lea edx, [eax + 2]
cmp byte [0x4c57bc], 0
je 0x410ecd
cmp byte [edi + 0x458], 1
je 0x410ecd
cmp byte [0x4c57e8], 1
je 0x410ecd
xor ecx, ecx
mov dword [esp + 0x9c], 0
mov eax, 8
mov dword [esp + 0xa0], 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004217e6
add esp, 4
mov dword [esp + 0x98], eax
xor ecx, ecx
mov word [eax], cx
push 4
call fcn.004217e6
add esp, 4
test eax, eax
je 0x411293
mov dword [eax], 1
mov dword [esp + 0xa4], eax
jmp 0x410e90
cmp dword [0x4c57dc], 0
jne 0x4457d7
cmp byte [0x4c57bc], 0
je 0x445981
mov esi, dword [esp + 0xa4]
dec dword [esi]
jne 0x410ecd
push dword [esp + 0x98]
call fcn.0042185c
add esp, 4
push esi
call fcn.0042185c
add esp, 4
cmp dword [edi + 0x184], 0
jne 0x4459aa
cmp byte [0x4c5930], 0
jne 0x446029
mov eax, dword [edi + 0xf8]
cmp eax, 7
je 0x446146
cmp eax, 2
je 0x41117b
cmp eax, 8
je 0x44641f
cmp eax, 9
je 0x44641f
cmp eax, 3
je 0x41117b
cmp eax, 4
je 0x41117b
cmp eax, 5
je 0x41117b
cmp eax, 6
je 0x41117b
mov esi, dword [ebp + 8]
inc dword [ebp + 8]
mov dword [edi + 0xf4], esi
cmp esi, dword [0x4c62a0]
jg 0x4462f2
test esi, esi
jle 0x4462f2
shl esi, 4
add esi, dword [0x4c62dc]
je 0x4462f2
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 1
mov dword [esp + 0x50], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], ecx
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
movsx eax, word [eax + 8]
test eax, eax
jne 0x411068
lea eax, [ebp + 8]
mov ecx, edi
push eax
push esi
call fcn.0040e6a0
mov esi, dword [esp + 0x58]
test esi, esi
jne 0x4110e3
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x14], edx
cmp ecx, 5
jge 0x411280
mov dword [esp + 0x5c], 1
mov dword [esp + 0x50], 0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [edi + 0xfc], 0
je 0x410d1f
mov eax, dword [edi + 0xec]
mov byte [edi + 0x144], 0
cmp eax, 1
je 0x4111d4
dec eax
mov dword [edi + 0xec], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x11], 0
jne 0x41104c
mov edi, dword [eax + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
xor edx, edx
sub eax, edi
cmp edi, 0x7fffffff
ja 0x4457b5
cmp ecx, 0x7fffffff
ja 0x411037
cdq
mov edi, dword [esi]
test edx, edx
jl 0x41104c
jg 0x411245
cmp eax, dword [edi + 0x18]
jae 0x411245
mov esi, dword [esi + 4]
jmp 0x410dd0
mov ecx, dword [eax]
cmp byte [ecx + 0x11], 0
jne 0x4457c6
mov eax, dword [eax + 4]
jmp 0x410de2
cmp eax, 0x33
jne 0x41107a
push esi
mov ecx, edi
call fcn.0040e920
jmp 0x410fa0
dec eax
cmp eax, 0x7e
ja case.0x41108b.2
movzx eax, byte [eax + 0x4112bc]
jmp dword [eax*4 + 0x4112a8]
lea eax, [esp + 0x50]
mov ecx, edi
push eax
lea eax, [esp + 0x24]
push eax
push esi
push 0
call fcn.0040f760
test eax, eax
js 0x410fa0
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x20]
mov eax, dword [ecx + eax*4]
cmp word [eax + 8], 0x7f
je 0x410fa0
jmp 0x44622a
lea eax, [esp + 0x6b]
mov ecx, edi
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0
call fcn.0040ffe0
jmp 0x4110a6
mov eax, dword [esi + 0xc]
dec dword [eax]
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x446246
push esi
call fcn.0042185c
add esp, 4
mov dword [esp + 0x58], 0
jmp 0x410fac
cmp dword [esp + 0x98], 0x12
je 0x4456a8
mov ecx, dword [0x4c57d8]
cmp ecx, 0xffffffff
jne 0x44565b
lea eax, [esp + 0x94]
mov ecx, 0x4c57b0
push eax
call fcn.0040314e
test eax, eax
jne 0x41115f
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call esi
test eax, eax
je 0x410d65
jmp 0x411110
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x2f0], 0
je 0x4111a9
mov ecx, dword [edi + 0x2f8]
call fcn.00420e91
test edx, edx
jl 0x4111a9
jg 0x411226
cmp eax, dword [edi + 0x2f0]
jae 0x411226
mov eax, dword [edi + 0xf8]
cmp eax, 3
jl case.default.0x44630d
jmp 0x446301
mov eax, dword [edi + 0x11c]
mov dword [esp + 0x40], eax
test eax, eax
je 0x410d05
jmp 0x445605
mov ecx, edi
call fcn.00411368
cmp byte [edi + 0xfc], 1
je 0x411001
mov ecx, edi
call fcn.0041138b
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [0x4c52ac]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x411001
jmp 0x44657f
cmp dword [edi + 0xf8], 2
jne 0x41129a
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
jmp case.default.0x44630d
inc dword [esp + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x44]
mov dword [edi + 0x14], eax
push dword [esi]
call fcn.00409efe
mov ecx, dword [esi]
push 0
push 1
mov byte [ecx + 0x10], 1
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x4c]
inc eax
push eax
call fcn.0040b7dc
mov eax, dword [esi]
mov byte [eax + 0x10], 0
jmp 0x41104c
add ecx, 0xfffffffb
cmp ecx, 0xa
ja case.0x41128c.6
jmp dword [ecx*4 + 0x41133c]
xor eax, eax
jmp 0x410e7e
mov dword [esp + 8], 0
jmp 0x4461a3
push 0xffffffffffffffff
push 0x9a
mov byte [0x4c5280], 0
call fcn.0046a08f
or eax, 0xffffffff
jmp 0x411003
push dword [eax]
mov ecx, edi
call fcn.00409efe
test eax, eax
je 0x445620
mov eax, dword [eax + 0x10]
mov ecx, edi
push 1
inc eax
push eax
call fcn.00456c34
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x44]
call fcn.0045705f
mov eax, dword [esp + 0x40]
jmp 0x4111c7
cmp byte [edi + 0x145], 0
je 0x410d84
jmp 0x410d3e
cmp dword [edi + 0xf8], 0
je 0x410d84
jmp 0x410d4b
cmp ecx, dword [0x4c5814]
jge 0x445699
mov eax, dword [0x4c5810]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
je 0x445699
cmp dword [eax + 0x18], 0
je 0x445699
lea eax, [esp + 0x94]
push eax
mov eax, dword [ecx]
push dword [eax + 0x18]
push dword [eax]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x41115f
jmp 0x41112d
mov dword [0x4c57d8], 0xffffffff
jmp 0x41112d
mov byte [edi + 0xfc], 1
mov dword [edi + 0xf8], 1
jmp 0x410d65
mov byte [0x4c5287], 0
mov byte [0x4c5282], 0
mov dword [edi + 0xf8], 1
jmp 0x410d72
mov eax, dword [0x4c64bc]
push eax
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0xc], ecx
call fcn.0042185c
dec dword [0x4c64b8]
add esp, 4
mov dword [0x4c64bc], esi
neg esi
sbb esi, esi
xor ecx, ecx
and dword [0x4c64c0], esi
mov edx, dword [edi + 0x1c8]
mov dword [esp + 0x18], ecx
test edx, edx
je 0x44573c
mov esi, dword [edi + 0x1c4]
mov edi, dword [esp + 8]
mov eax, dword [esi + ecx*4]
mov eax, dword [eax]
test eax, eax
je 0x44572f
cmp dword [eax], edi
je 0x445734
inc ecx
cmp ecx, edx
jb 0x445722
mov edi, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
cmp ecx, edx
je 0x44578b
mov eax, dword [edi + 0x1c4]
mov eax, dword [eax + ecx*4]
mov ecx, edi
mov eax, dword [eax]
add eax, 8
push eax
call fcn.00409efe
mov ecx, dword [edi + 0x1c4]
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx + eax*4]
mov ecx, dword [ecx]
add ecx, 0x18
push ecx
lea ecx, [edi + 0x14c]
call fcn.00408007
mov eax, dword [esi + 0x10]
mov ecx, edi
push 0
push 1
inc eax
push eax
call fcn.0040b7dc
jmp case.default.0x44630d
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edx, 2
jmp 0x410d91
cmp byte [0x4c5281], 0
jne 0x410d9e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410fd7
cmp ecx, 0x7fffffff
jbe 0x411037
jmp 0x411036
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.0046a3cd
jmp 0x410de0
mov eax, dword [0x4c57e0]
lea ecx, [esp + 0x94]
mov esi, dword [eax]
push esi
call fcn.00485f9a
mov ecx, 0x4c57dc
call fcn.0048bb0a
test esi, esi
je 0x445801
push ecx
mov ecx, esi
call fcn.0048601a
cmp dword [esp + 0x9c], 0
mov dword [0x4c6420], 0
je 0x410e90
lea eax, [esp + 0x98]
mov ecx, edi
push eax
call fcn.00409efe
mov esi, eax
test esi, esi
je 0x410e90
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 1
call fcn.004098d0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x12c]
push 0x4a2ee4
mov dword [esp + 0x80], 1
mov dword [esp + 0x74], eax
call fcn.00407da1
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c6270
push eax
lea eax, [esp + 0x134]
push eax
call fcn.00408973
lea ecx, [esp + 0x12c]
call fcn.004058c3
lea ecx, [esp + 0x70]
call fcn.004098d0
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0xfc]
push str._GUI_WINHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00407da1
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c6270
push eax
lea eax, [esp + 0x104]
push eax
call fcn.00408973
lea ecx, [esp + 0xfc]
call fcn.004058c3
lea ecx, [esp + 0x70]
call fcn.004098d0
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0x11c]
push str._GUI_CTRLHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00407da1
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c6270
push eax
lea eax, [esp + 0x124]
push eax
call fcn.00408973
lea ecx, [esp + 0x11c]
call fcn.004058c3
mov byte [edi + 0x458], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.0040b7dc
lea ecx, [esp + 0x70]
mov byte [edi + 0x458], 0
call fcn.004098d0
lea ecx, [esp + 0x98]
call fcn.004058c3
jmp case.default.0x44630d
cmp dword [0x4c591c], 0
jne 0x44599d
cmp dword [0x4c6420], 0x64
jge 0x44599d
inc dword [0x4c6420]
push 0
jmp 0x44599f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410eaa
cmp byte [edi + 0x484], 1
je 0x410eda
xor eax, eax
mov byte [edi + 0x484], 1
push dword [edi + 0x188]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x68], 0
mov dword [esp + 0xbc], 0x48fb84
mov dword [esp + 0x18], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
call fcn.00469c79
lea ecx, [edi + 0x184]
call fcn.0045ddc8
mov esi, dword [esp + 0xf0]
lea ecx, [esp + 0x80]
mov dword [esp + 0x88], 0
push dword [esi]
call fcn.00409970
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.00409851
push dword [esi + 8]
mov ecx, edi
call fcn.00409efe
mov edx, eax
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 0x10]
push ecx
call fcn.00407028
mov dword [edi + 0xf4], ecx
mov esi, 3
cmp dword [edx + 0x14], 0
mov dword [esp + 0x3c], eax
jle 0x445bbf
mov edx, dword [esp + 0xf0]
add edx, 8
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
jne 0x445acc
mov edx, dword [esp + 0x3c]
mov edx, dword [edx + 4]
mov eax, dword [edx + esi*4 + 4]
cmp word [eax + 8], 0x33
je 0x445aa9
mov ecx, eax
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x445b42
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x445abc
cmp eax, 0x1e
jne 0x445b42
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0
je 0x445a8b
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0x41
jne 0x445afc
mov edx, dword [esp + 0x18]
inc esi
xor ecx, ecx
mov eax, dword [edx + esi*4]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x445aef
inc ecx
jmp 0x445b3f
cmp ax, 0x48
jne 0x445b35
dec ecx
jns 0x445b3f
mov edx, dword [esp + 0x24]
push dword [edx]
lea ecx, [esp + 0xbc]
call fcn.004569da
mov ecx, dword [esp + 0x64]
inc esi
mov eax, dword [esp + 0x20]
inc ecx
mov edx, dword [esp + 0x24]
add edx, 4
mov dword [esp + 0x64], ecx
mov dword [esp + 0x24], edx
cmp ecx, dword [eax + 0x14]
jge 0x445bb0
mov eax, dword [esp + 0x3c]
jmp 0x445a73
cmp ax, 0x40
jne 0x445b3f
test ecx, ecx
je 0x445af8
inc esi
jmp 0x445adf
mov eax, dword [esp + 0x3c]
mov ecx, edi
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4 + 4]
movsx eax, word [eax + 0xa]
push eax
push 0x91
call fcn.0046a08f
jmp 0x445b80
mov ecx, esi
call fcn.004058c3
push esi
call fcn.0042185c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x80]
call fcn.00409ce0
lea ecx, [esp + 0xec]
call fcn.00456a69
lea ecx, [esp + 0xb8]
call fcn.00456a69
mov byte [edi + 0x484], 0
jmp 0x410eda
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
push dword [edx + 0x10]
call fcn.004083c1
mov eax, dword [esp + 0x20]
mov esi, 3
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], 1
cmp dword [eax + 0x14], 1
jl 0x445e17
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x6c], edx
mov ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], dx
jne 0x445c27
mov eax, dword [ecx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x445c14
cmp eax, 0x1e
jne 0x445c15
mov edx, 0x100
inc esi
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
je 0x445c00
mov dword [esp + 0x6c], edx
mov dword [esp + 0x4c], esi
mov edi, dword [esp + 8]
lea edx, [esi*4 + 4]
mov dword [esp + 0x24], 1
xor ecx, ecx
mov esi, dword [esp + 0x24]
mov eax, dword [edx + edi]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x445c53
inc ecx
jmp 0x445d2b
cmp ax, 0x48
jne 0x445d1d
dec ecx
jns 0x445d2b
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x4c]
cmp dword [esp + 0x18], eax
jle 0x445dd4
lea eax, [esi + 2]
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov ecx, edi
mov eax, dword [esp + 0x24]
add eax, esi
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 1
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x48]
call fcn.00409f40
test eax, eax
js 0x445eba
mov eax, dword [esp + 0x6c]
or eax, 0x200
push 1
push eax
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.00408480
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x445cfd
push ecx
call fcn.0040799d
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x445d16.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x445d16.6
jmp dword [eax*4 + 0x4465b6]
cmp ax, 0x40
jne 0x445d2b
test ecx, ecx
je 0x445c64
inc esi
add edx, 4
jmp 0x445c40
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x445d16.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x445dba
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x445d16.6
lea ecx, [eax + 8]
jmp 0x445db1
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445d16.6
push ecx
call fcn.00408c94
jmp case.0x445d16.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0042185c
add esp, 4
push dword [esp + 0x28]
jmp 0x445dba
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445d16.6
push ecx
call fcn.00457765
jmp case.0x445d16.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445d16.6
push ecx
call fcn.00420290
jmp case.0x445d16.6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x445d16.6
mov ecx, eax
call fcn.004058c3
push dword [esp + 8]
call fcn.0042185c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
jmp 0x445df1
mov eax, dword [esp + 0x14]
or edx, 0x200
push 1
push edx
push dword [eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.00408480
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
inc eax
add dword [esp + 0x14], 4
add esi, eax
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], eax
cmp eax, dword [ecx + 0x14]
jle 0x445be6
push 0x4b7dcc
lea ecx, [esp + 0x140]
call fcn.00407da1
mov esi, dword [esp + 0x80]
xor eax, eax
cmp dword [esp + 0x8c], 6
push 1
setne al
dec eax
and eax, esi
push 0
push eax
lea eax, [esp + 0x148]
push eax
call fcn.00408480
lea ecx, [esp + 0x13c]
call fcn.004058c3
mov eax, dword [esp + 0x20]
mov ecx, edi
push 0
push 0
mov eax, dword [eax + 0x10]
inc eax
push eax
call fcn.0040b7dc
mov ecx, 0x4c6280
call fcn.0040829f
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x445e97
push ecx
call fcn.0040799d
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x8c]
cmp eax, 5
jl case.0x445eb3.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x445eb3.6
jmp dword [eax*4 + 0x4465e2]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x445ed0
push ecx
call fcn.0040799d
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x445ee9.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x445ee9.6
jmp dword [eax*4 + 0x44660e]
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x445ee9.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x445b68
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x445ee9.6
lea ecx, [esi + 8]
jmp 0x445b62
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445ee9.6
push ecx
call fcn.00408c94
jmp case.0x445ee9.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0042185c
add esp, 4
push dword [esp + 0x28]
jmp 0x445b68
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445ee9.6
push ecx
call fcn.00457765
jmp case.0x445ee9.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445ee9.6
push ecx
call fcn.00420290
jmp case.0x445ee9.6
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x445ee9.6
jmp 0x445b60
test esi, esi
je case.0x445eb3.6
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x445fe6
test esi, esi
je case.0x445eb3.6
lea ecx, [esi + 8]
jmp 0x445fe1
test esi, esi
je case.0x445eb3.6
push ecx
mov ecx, esi
call fcn.00408c94
jmp case.0x445eb3.6
push dword [esi + 4]
call fcn.0042185c
add esp, 4
jmp 0x445fe6
test esi, esi
je case.0x445eb3.6
push ecx
mov ecx, esi
call fcn.00457765
jmp case.0x445eb3.6
test esi, esi
je case.0x445eb3.6
push ecx
mov ecx, esi
call fcn.00420290
jmp case.0x445eb3.6
test esi, esi
je case.0x445eb3.6
mov ecx, esi
call fcn.004058c3
push esi
call fcn.0042185c
add esp, 4
lea ecx, [esp + 0xec]
mov dword [esp + 0x8c], 1
mov dword [esp + 0x80], 0
call fcn.00456a69
lea ecx, [esp + 0xb8]
call fcn.00456a69
mov byte [edi + 0x484], 0
jmp case.default.0x44630d
cmp byte [edi + 0x459], 1
je 0x410ee7
lea ecx, [esp + 0x98]
call fcn.00407627
lea eax, [esp + 0x94]
mov ecx, 0x4c5890
push eax
call fcn.0046274a
test al, al
je 0x446135
cmp dword [esp + 0x9c], 0
je 0x446042
lea eax, [esp + 0x98]
mov ecx, edi
push eax
call fcn.00409efe
mov esi, eax
test esi, esi
je 0x446042
lea ecx, [esp + 0xd8]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 1
call fcn.004098d0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x10c]
push str._TRAY_ID
mov dword [esp + 0xe8], 1
mov dword [esp + 0xdc], eax
call fcn.00407da1
push 1
lea eax, [esp + 0xdc]
mov ecx, 0x4c6270
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00408973
lea ecx, [esp + 0x10c]
call fcn.004058c3
mov byte [edi + 0x459], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.0040b7dc
lea ecx, [esp + 0xd8]
mov byte [edi + 0x459], 0
call fcn.004098d0
lea ecx, [esp + 0x98]
call fcn.004058c3
jmp case.default.0x44630d
lea ecx, [esp + 0x98]
call fcn.004058c3
jmp 0x410ee7
push 0xa
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x48], eax
cmp eax, 0x102
je case.default.0x44630d
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
jmp 0x4461a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x448], 0
mov dword [esp + 8], 0
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004206c5
jmp 0x41122f
lea ecx, [edi + 0x168]
call fcn.0047c085
mov ecx, eax
call fcn.004568cd
test al, al
jne 0x4461f3
mov eax, dword [esp + 8]
mov ecx, edi
movsx eax, word [eax + 0xa]
push eax
push 0xa7
call fcn.0046a08f
lea ecx, [esp + 0x50]
call fcn.00409ce0
jmp case.default.0x44630d
lea ecx, [edi + 0x168]
call fcn.0047c085
push eax
lea eax, [esp + 0x24]
mov ecx, edi
push eax
push esi
call fcn.0047b5df
jmp 0x4110a6
push 0xffffffffffffffff
lea eax, [esp + 0x54]
mov ecx, edi
push eax
lea eax, [esp + 0x28]
push eax
push esi
call fcn.00409f40
jmp 0x4110a6
movsx eax, word [eax + 0xa]
mov ecx, edi
push eax
push 0x72
call fcn.0046a08f
lea ecx, [esp + 0x50]
call fcn.00409ce0
jmp case.default.0x44630d
push dword [esi]
call fcn.0042185c
add esp, 4
push dword [esi + 0xc]
call fcn.0042185c
add esp, 4
jmp 0x4110f4
test edx, edx
je case.0x41128c.6
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x50]
jmp 0x4462e5
test edx, edx
je case.0x41128c.6
lea ecx, [edx + 8]
jmp 0x4462dc
test edx, edx
je case.0x41128c.6
push ecx
mov ecx, edx
call fcn.00408c94
jmp case.0x41128c.6
push dword [edx + 4]
call fcn.0042185c
add esp, 4
push dword [esp + 0x50]
jmp 0x4462e5
test edx, edx
je case.0x41128c.6
push ecx
mov ecx, edx
call fcn.00457765
jmp case.0x41128c.6
test edx, edx
je case.0x41128c.6
push ecx
mov ecx, edx
call fcn.00420290
jmp case.0x41128c.6
test edx, edx
je case.0x41128c.6
mov ecx, edx
call fcn.004058c3
push dword [esp + 0x14]
call fcn.0042185c
add esp, 4
jmp case.0x41128c.6
mov dword [edi + 0xf8], 1
jmp case.default.0x44630d
sub eax, 3
cmp eax, 3
ja case.default.0x44630d
jmp dword [eax*4 + 0x44663a]
mov ecx, edi
call fcn.00485ea7
jmp 0x446346
mov ecx, edi
call fcn.00485ea7
jmp 0x44632f
push 1
mov ecx, edi
call fcn.0040b87d
mov esi, eax
test esi, esi
js 0x44634c
jg case.default.0x44630d
jmp 0x446385
push 1
mov ecx, edi
call fcn.0040b87d
mov esi, eax
test esi, esi
jns 0x44637b
mov eax, esi
neg eax
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00456e18
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004206c5
test esi, esi
je case.default.0x44630d
test esi, esi
jle 0x4463fe
mov eax, dword [edi + 0xf8]
cmp eax, 5
je 0x446395
cmp eax, 3
jne 0x4463fe
mov eax, dword [edi + 0x1f0]
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 1
mov esi, dword [eax]
call fcn.004098d0
push 0
lea eax, [esp + 0xcc]
mov dword [esp + 0xd8], 7
push eax
mov eax, dword [edi]
mov dword [esp + 0xd0], esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00456dc5
lea ecx, [esp + 0xc8]
call fcn.004098d0
mov ecx, dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call fcn.00465563
jmp case.default.0x44630d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x43c], 0
je 0x44645c
mov ecx, dword [edi + 0x440]
call fcn.00420e91
test edx, edx
jl 0x44645c
jg 0x446449
cmp eax, dword [edi + 0x43c]
jb 0x44645c
mov eax, dword [edi + 0x448]
test eax, eax
je 0x44619b
jmp 0x44618a
mov eax, dword [edi + 0xf8]
xor esi, esi
mov byte [esp + 0x1f], 0
mov dword [esp + 8], esi
cmp eax, 8
jne 0x44649a
lea eax, [esp + 0x1f]
push eax
lea ecx, [edi + 0x42c]
lea edx, [esp + 0xc]
call fcn.00463f77
add esp, 4
cmp byte [esp + 0x1f], 1
jne case.default.0x44630d
mov esi, dword [esp + 8]
jmp 0x4464a3
cmp eax, 9
jne case.default.0x44630d
mov ecx, dword [edi + 0x448]
mov eax, 0xcccccccc
mov dword [esp + 0x40], eax
test ecx, ecx
je 0x4464fc
lea eax, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x40], 0x103
jne 0x4464e2
push 0
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.default.0x44630d
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
mov dword [edi + 0x448], 0
cmp dword [edi + 0xf8], 8
jne 0x44652f
mov dword [esp + 8], esi
fild dword [esp + 8]
test esi, esi
jns 0x446517
fadd qword [0x4b9e28]
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
fstp qword [esp + 0x10]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0047c8b3
jmp 0x44653e
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00420713
push dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x44630d
push ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004206c5
jmp 0x410fe4
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x158]
push eax
call esi
test eax, eax
jg 0x44657f
jmp 0x411001