Function at 0x40bc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x180
push esi
push edi
mov edi, ecx
mov dword [esp + 0x3c], edi
mov eax, dword [edi + 0xec]
cmp eax, 0xed8
jge 0x4434cf
inc eax
mov dword [edi + 0xec], eax
cmp eax, 1
je 0x40c256
cmp byte [edi + 0xfc], 0
mov byte [edi + 0x144], 0
jne 0x40bf25
mov esi, 2
mov edi, edi
cmp byte [edi + 0x144], 0
jne 0x40bf25
mov ecx, edi
call fcn.004052b0
cmp eax, 1
je 0x44441a
cmp dword [0x4c74a8], 0
jne 0x44351c
cmp byte [0x4c6287], 1
je 0x4435d6
cmp dword [edi + 0x454], 0
je 0x40bd58
cmp byte [0x4c741c], 0
jne 0x40bd58
mov esi, dword [edi + 0x44c]
lea eax, [edi + 0x44c]
mov byte [0x4c741c], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
test esi, esi
jne 0x40bf4c
mov edi, dword [esp + 8]
mov eax, dword [edi]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40bf95
mov edi, dword [esp + 0x3c]
mov byte [0x4c741c], al
cmp dword [esp + 0x1c], eax
jg case.default.0x4441c7
lea esi, [eax + 2]
cmp byte [0x4c67bc], 0
je 0x40be1d
cmp byte [edi + 0x458], 1
je 0x40be1d
cmp byte [0x4c67e8], 1
je 0x40be1d
xor ecx, ecx
mov dword [esp + 0xbc], 0
mov eax, 8
mov dword [esp + 0xc0], 8
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420f16
add esp, 4
mov dword [esp + 0xb8], eax
xor ecx, ecx
mov word [eax], cx
push 4
call fcn.00420f16
add esp, 4
test eax, eax
je 0x40c372
mov dword [eax], 1
mov dword [esp + 0xc4], eax
lea esp, [esp]
cmp dword [0x4c67dc], 0
jne 0x443612
cmp byte [0x4c67bc], 0
je 0x4437bc
mov esi, dword [esp + 0xc4]
dec dword [esi]
jne 0x40be1d
push dword [esp + 0xb8]
call fcn.00420f8c
add esp, 4
push esi
call fcn.00420f8c
add esp, 4
cmp dword [edi + 0x184], 0
jne 0x4437e5
cmp byte [0x4c6930], 0
jne 0x443e70
mov eax, dword [edi + 0xf8]
cmp eax, 7
je 0x443f8d
cmp eax, 2
je 0x40c210
cmp eax, 8
je 0x4442d9
cmp eax, 9
je 0x4442d9
cmp eax, 3
je 0x40c210
cmp eax, 4
je 0x40c210
cmp eax, 5
je 0x40c210
cmp eax, 6
je 0x40c210
mov ecx, dword [ebp + 8]
mov dword [edi + 0xf4], ecx
push ecx
inc ecx
mov dword [ebp + 8], ecx
call fcn.00412fa0
mov esi, eax
mov dword [esp + 0x44], esi
test esi, esi
je 0x44400a
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 1
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
movsx eax, word [eax + 8]
test eax, eax
jne 0x40bfa9
lea eax, [ebp + 8]
mov ecx, edi
push eax
push esi
call fcn.00409a00
mov esi, dword [esp + 0x50]
test esi, esi
jne 0x40c1e9
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], edx
cmp ecx, 5
jge 0x40c35f
mov dword [esp + 0x54], 1
mov dword [esp + 0x48], 0
mov esi, 2
cmp byte [edi + 0xfc], 0
je 0x40bcc0
mov eax, dword [edi + 0xec]
mov byte [edi + 0x144], 0
cmp eax, 1
je 0x40c2af
dec eax
mov dword [edi + 0xec], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x11], 0
jne 0x40bf8d
mov edi, dword [eax + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
xor edx, edx
sub eax, edi
cmp edi, 0x7fffffff
ja 0x4435f0
cmp ecx, 0x7fffffff
ja 0x40bf78
cdq
mov edi, dword [esi]
test edx, edx
jl 0x40bf8d
jg 0x40c324
cmp eax, dword [edi + 0x18]
jae 0x40c324
mov esi, dword [esi + 4]
jmp 0x40bd28
mov ecx, dword [eax]
cmp byte [ecx + 0x11], 0
jne 0x443601
mov eax, dword [eax + 4]
jmp 0x40bd36
cmp eax, 0x33
jne 0x40bfbb
push esi
mov ecx, edi
call fcn.00409c80
jmp 0x40bee2
dec eax
cmp eax, 0x7e
ja case.0x40bfcc.2
movzx eax, byte [eax + 0x40c3b4]
jmp dword [eax*4 + 0x40c3a0]
mov eax, dword [esp + 8]
mov dword [esp + 0x60], 0x49098c
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], edx
mov ecx, dword [eax]
movsx eax, word [eax + 0xa]
mov dword [esp + 8], eax
mov eax, dword [0x4c7464]
mov dword [esp + 0x14], ecx
test al, 1
je 0x40c26d
cmp ecx, dword [0x4c7468]
je 0x444019
push ecx
lea ecx, [edi + 0x470]
call fcn.00416060
mov ecx, edi
mov al, byte [eax + 0x20]
mov byte [esp + 0x58], al
lea eax, [esp + 0x9c]
push dword [esp + 0x58]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x70]
push eax
push 0
call fcn.0040a820
test eax, eax
js 0x444041
mov esi, dword [esp + 0x14]
lea ecx, [edi + 0x470]
push esi
call fcn.00416060
mov ecx, dword [esp + 0x9c]
cmp ecx, dword [eax + 0x18]
jl 0x444068
push esi
lea ecx, [edi + 0x470]
call fcn.00416060
mov ecx, dword [esp + 0x9c]
cmp ecx, dword [eax + 0x1c]
jg 0x444068
lea ecx, [esp + 0x48]
call fcn.00404dc0
mov eax, dword [edi]
mov dword [esp + 0x54], 1
mov dword [esp + 0x48], 1
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
cmp byte [ecx + 0xd], 0
jne 0x40c379
mov dword [eax + 0x14], 0
cmp byte [ecx + 0xd], 0
mov eax, dword [ecx + 8]
jne 0x40c381
mov byte [eax + 0x18], 0
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, edi
mov dword [esp + 8], eax
cmp byte [eax + 0xd], 0
jne 0x44404f
mov esi, dword [eax + 8]
lea ecx, [esi + 0x20]
call fcn.00404dc0
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], 1
mov dword [esi + 0x20], 0
cmp byte [eax + 0xd], 0
mov eax, dword [eax + 8]
jne 0x40c389
push dword [esp + 0x14]
lea ecx, [edi + 0x470]
mov byte [eax + 0x30], 0
call fcn.00416060
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x64]
push eax
mov eax, dword [edi]
mov ecx, dword [ecx + eax]
add ecx, edx
add ecx, edi
call esi
test eax, eax
js 0x44405a
xor esi, esi
mov dword [esp + 0x60], 0x49098c
cmp dword [esp + 0x68], esi
jbe 0x40c192
jmp 0x40c160
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + esi*4]
mov dword [esp + 8], ecx
test ecx, ecx
je 0x40c184
call fcn.00405190
push dword [esp + 8]
call fcn.00420f8c
mov eax, dword [esp + 0x68]
add esp, 4
mov dword [eax + esi*4], 0
inc esi
cmp esi, dword [esp + 0x68]
jb 0x40c160
push dword [esp + 0x64]
mov dword [esp + 0x6c], 0
call fcn.00420f8c
mov esi, dword [esp + 0x48]
add esp, 4
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x18]
mov eax, dword [ecx + eax*4]
cmp word [eax + 8], 0x7f
je 0x40bee2
jmp 0x4440f3
lea eax, [esp + 0x83]
mov ecx, edi
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0
call fcn.0040b020
test eax, eax
jns 0x40c1aa
jmp 0x40bee2
mov eax, dword [esi + 0xc]
dec dword [eax]
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x44410f
push esi
call fcn.00420f8c
add esp, 4
mov dword [esp + 0x50], 0
jmp 0x40beee
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x2f0], 0
je 0x40c242
mov ecx, dword [edi + 0x2f8]
call fcn.0042074e
test edx, edx
jl 0x40c242
jg 0x40c301
cmp eax, dword [edi + 0x2f0]
jae 0x40c301
mov eax, dword [edi + 0xf8]
cmp eax, 3
jl case.default.0x4441c7
jmp 0x4441bb
mov eax, dword [edi + 0x11c]
mov dword [esp + 0x38], eax
test eax, eax
je 0x40bca5
jmp 0x4434ea
or eax, 1
lea ecx, [esp + 0x178]
push 0x492d0c
mov dword [0x4c7464], eax
call fcn.00411a36
mov ecx, dword [0x4c7294]
push dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x178]
mov dword [0x4c7468], eax
call fcn.00411cb6
mov ecx, dword [esp + 0x14]
jmp 0x40c006
mov ecx, edi
call fcn.0040c460
cmp byte [edi + 0xfc], 1
je 0x40bf42
mov ecx, edi
call fcn.0040c483
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [0x4c62ac]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x15c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x40bf42
jmp 0x444439
cmp dword [edi + 0xf8], 2
jne 0x40c391
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
jmp case.default.0x4441c7
inc dword [esp + 0x1c]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x3c]
mov dword [edi + 0x14], eax
push dword [esi]
call fcn.00405376
mov ecx, dword [esi]
push 0
push 1
mov byte [ecx + 0x10], 1
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x44]
inc eax
push eax
call fcn.00406cd8
mov eax, dword [esi]
mov byte [eax + 0x10], 0
jmp 0x40bf8d
add ecx, 0xfffffffb
cmp ecx, 0xa
ja case.0x40c36b.6
jmp dword [ecx*4 + 0x40c434]
xor eax, eax
jmp 0x40bdd2
mov eax, dword [eax + 0x38]
jmp 0x40c0b7
mov eax, dword [eax + 0x38]
jmp 0x40c0cb
mov eax, dword [eax + 0x38]
jmp 0x40c10e
mov dword [esp + 8], 0
jmp 0x443ff3
push 0xffffffffffffffff
push 0x9a
mov byte [0x4c6280], 0
call fcn.0046a2fa
or eax, 0xffffffff
jmp 0x40bf44
push dword [eax]
mov ecx, edi
call fcn.00405376
test eax, eax
je 0x443505
mov eax, dword [eax + 0x10]
mov ecx, edi
push 1
inc eax
push eax
call fcn.00456def
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x3c]
call fcn.00457175
mov eax, dword [esp + 0x38]
jmp 0x40c260
mov eax, dword [0x4c74ac]
push eax
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0xc], ecx
call fcn.00420f8c
dec dword [0x4c74a8]
add esp, 4
mov dword [0x4c74ac], esi
neg esi
sbb esi, esi
xor ecx, ecx
and dword [0x4c74b0], esi
mov edx, dword [edi + 0x1c8]
mov dword [esp + 0x14], ecx
test edx, edx
je 0x44357d
mov esi, dword [edi + 0x1c4]
mov edi, dword [esp + 8]
mov eax, dword [esi + ecx*4]
mov eax, dword [eax]
test eax, eax
je 0x443570
cmp dword [eax], edi
je 0x443575
inc ecx
cmp ecx, edx
jb 0x443563
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x14], ecx
cmp ecx, edx
je 0x4435cc
mov eax, dword [edi + 0x1c4]
mov eax, dword [eax + ecx*4]
mov ecx, edi
mov eax, dword [eax]
add eax, 8
push eax
call fcn.00405376
mov ecx, dword [edi + 0x1c4]
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx + eax*4]
mov ecx, dword [ecx]
add ecx, 0x18
push ecx
lea ecx, [edi + 0x14c]
call fcn.00411c9c
mov eax, dword [esi + 0x10]
mov ecx, edi
push 0
push 1
inc eax
push eax
call fcn.00406cd8
jmp case.default.0x4441c7
mov esi, 2
jmp 0x40bcea
cmp byte [0x4c6281], 0
jne 0x40bcf7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bf18
cmp ecx, 0x7fffffff
jbe 0x40bf78
jmp 0x40bf77
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0046a638
jmp 0x40bd34
mov eax, dword [0x4c67e0]
lea ecx, [esp + 0xb4]
mov esi, dword [eax]
push esi
call fcn.0048641d
mov ecx, 0x4c67dc
call fcn.00415c75
test esi, esi
je 0x44363c
push ecx
mov ecx, esi
call fcn.00415c5d
cmp dword [esp + 0xbc], 0
mov dword [0x4c7420], 0
je 0x40bde0
lea eax, [esp + 0xb8]
mov ecx, edi
push eax
call fcn.00405376
mov esi, eax
test esi, esi
je 0x40bde0
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 1
call fcn.00404dc0
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x14c]
push 0x4a3eac
mov dword [esp + 0x80], 1
mov dword [esp + 0x74], eax
call fcn.00411a36
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c7270
push eax
lea eax, [esp + 0x154]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x14c]
call fcn.00411cb6
lea ecx, [esp + 0x70]
call fcn.00404dc0
mov eax, dword [esp + 0xc8]
lea ecx, [esp + 0x11c]
push str._GUI_WINHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00411a36
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c7270
push eax
lea eax, [esp + 0x124]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x11c]
call fcn.00411cb6
lea ecx, [esp + 0x70]
call fcn.00404dc0
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0x12c]
push str._GUI_CTRLHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00411a36
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c7270
push eax
lea eax, [esp + 0x134]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x12c]
call fcn.00411cb6
mov byte [edi + 0x458], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.00406cd8
lea ecx, [esp + 0x70]
mov byte [edi + 0x458], 0
call fcn.00404dc0
lea ecx, [esp + 0xb8]
call fcn.00411cb6
jmp case.default.0x4441c7
cmp dword [0x4c691c], 0
jne 0x4437d8
cmp dword [0x4c7420], 0x64
jge 0x4437d8
inc dword [0x4c7420]
push 0
jmp 0x4437da
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bdfa
cmp byte [edi + 0x484], 1
je 0x40be2a
xor eax, eax
mov byte [edi + 0x484], 1
push dword [edi + 0x188]
lea ecx, [esp + 0x100]
mov dword [esp + 0x88], 0
mov dword [esp + 0xa8], 0x49098c
mov dword [esp + 0x20], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
call fcn.00469ec5
lea ecx, [edi + 0x184]
call fcn.0045de8d
mov esi, dword [esp + 0x100]
lea ecx, [esp + 0x88]
mov dword [esp + 0x90], 0
push dword [esi]
call fcn.00404e60
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.00404d37
push dword [esi + 8]
mov ecx, edi
call fcn.00405376
mov edx, eax
mov dword [esp + 0x40], edx
mov ecx, dword [edx + 0x10]
push ecx
call fcn.00412fa0
mov dword [edi + 0xf4], ecx
mov esi, 3
cmp dword [edx + 0x14], 0
mov dword [esp + 0x18], eax
jle 0x443a03
mov edx, dword [esp + 0x100]
add edx, 8
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
jne 0x44390a
mov edx, dword [esp + 0x18]
mov edx, dword [edx + 4]
mov eax, dword [edx + esi*4 + 4]
cmp word [eax + 8], 0x33
je 0x4438e7
mov ecx, eax
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x443986
mov ecx, dword [esp + 0x14]
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x4438fa
cmp eax, 0x1e
jne 0x443986
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0
je 0x4438c9
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0x41
jne 0x44393a
mov edx, dword [esp + 0x14]
inc esi
xor ecx, ecx
mov eax, dword [edx + esi*4]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x44392d
inc ecx
jmp 0x443983
cmp ax, 0x48
jne 0x443979
dec ecx
jns 0x443983
mov edx, dword [esp + 0x24]
push dword [edx]
lea ecx, [esp + 0xa8]
call fcn.00456a45
mov ecx, dword [esp + 0x84]
inc esi
mov eax, dword [esp + 0x40]
inc ecx
mov edx, dword [esp + 0x24]
add edx, 4
mov dword [esp + 0x84], ecx
mov dword [esp + 0x24], edx
cmp ecx, dword [eax + 0x14]
jge 0x4439f4
mov eax, dword [esp + 0x18]
jmp 0x4438b1
cmp ax, 0x40
jne 0x443983
test ecx, ecx
je 0x443936
inc esi
jmp 0x44391d
mov eax, dword [esp + 0x18]
mov ecx, edi
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4 + 4]
movsx eax, word [eax + 0xa]
push eax
push 0x91
call fcn.0046a2fa
jmp 0x4439c4
mov ecx, esi
call fcn.00411cb6
push esi
call fcn.00420f8c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x88]
call fcn.00405190
lea ecx, [esp + 0xfc]
call fcn.00456ad4
lea ecx, [esp + 0xa4]
call fcn.00456ad4
mov byte [edi + 0x484], 0
jmp 0x40be2a
mov eax, dword [esp + 0xa8]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
push dword [edx + 0x10]
call fcn.004038ff
mov eax, dword [esp + 0x40]
mov esi, 3
mov dword [esp + 0x5c], esi
mov dword [esp + 0x14], 1
cmp dword [eax + 0x14], 1
jl 0x443c5e
mov eax, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x44], edx
mov ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], dx
jne 0x443a6b
mov eax, dword [ecx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x443a58
cmp eax, 0x1e
jne 0x443a59
mov edx, 0x100
inc esi
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
je 0x443a44
mov dword [esp + 0x44], edx
mov dword [esp + 0x5c], esi
mov edi, dword [esp + 8]
lea edx, [esi*4 + 4]
mov dword [esp + 0x24], 1
xor ecx, ecx
mov esi, dword [esp + 0x24]
mov eax, dword [edx + edi]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x443a97
inc ecx
jmp 0x443b72
cmp ax, 0x48
jne 0x443b64
dec ecx
jns 0x443b72
mov eax, dword [esp + 0x84]
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x5c]
cmp dword [esp + 0x14], eax
jle 0x443c1b
lea eax, [esi + 2]
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov ecx, edi
mov eax, dword [esp + 0x24]
add eax, esi
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 1
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
call fcn.004053b0
test eax, eax
js 0x443d01
mov eax, dword [esp + 0x44]
or eax, 0x200
push 1
push eax
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.004039be
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x443b44
push ecx
call fcn.004115f4
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x443b5d.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x443b5d.6
jmp dword [eax*4 + 0x44446f]
cmp ax, 0x40
jne 0x443b72
test ecx, ecx
je 0x443aa8
inc esi
add edx, 4
jmp 0x443a84
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x443b5d.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x443c01
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x443b5d.6
lea ecx, [eax + 8]
jmp 0x443bf8
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443b5d.6
push ecx
call fcn.004041c4
jmp case.0x443b5d.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.00420f8c
add esp, 4
push dword [esp + 0x28]
jmp 0x443c01
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443b5d.6
push ecx
call fcn.0045787b
jmp case.0x443b5d.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443b5d.6
push ecx
call fcn.00457890
jmp case.0x443b5d.6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x443b5d.6
mov ecx, eax
call fcn.00411cb6
push dword [esp + 8]
call fcn.00420f8c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
jmp 0x443c38
mov eax, dword [esp + 0x1c]
or edx, 0x200
push 1
push edx
push dword [eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.004039be
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x40]
inc eax
add dword [esp + 0x1c], 4
add esi, eax
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0x14]
jle 0x443a2a
push 0x4b8dac
lea ecx, [esp + 0x140]
call fcn.00411a36
mov esi, dword [esp + 0x88]
xor eax, eax
cmp dword [esp + 0x94], 6
push 1
setne al
dec eax
and eax, esi
push 0
push eax
lea eax, [esp + 0x148]
push eax
call fcn.004039be
lea ecx, [esp + 0x13c]
call fcn.00411cb6
mov eax, dword [esp + 0x40]
mov ecx, edi
push 0
push 0
mov eax, dword [eax + 0x10]
inc eax
push eax
call fcn.00406cd8
mov ecx, 0x4c7280
call fcn.00403a40
mov ecx, dword [esp + 0x90]
test ecx, ecx
je 0x443cde
push ecx
call fcn.004115f4
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x94]
cmp eax, 5
jl case.0x443cfa.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x443cfa.6
jmp dword [eax*4 + 0x44449b]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x443d17
push ecx
call fcn.004115f4
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x443d30.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x443d30.6
jmp dword [eax*4 + 0x4444c7]
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x443d30.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x4439ac
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x443d30.6
lea ecx, [esi + 8]
jmp 0x4439a6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443d30.6
push ecx
call fcn.004041c4
jmp case.0x443d30.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.00420f8c
add esp, 4
push dword [esp + 0x28]
jmp 0x4439ac
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443d30.6
push ecx
call fcn.0045787b
jmp case.0x443d30.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x443d30.6
push ecx
call fcn.00457890
jmp case.0x443d30.6
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x443d30.6
jmp 0x4439a4
test esi, esi
je case.0x443cfa.6
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x443e2d
test esi, esi
je case.0x443cfa.6
lea ecx, [esi + 8]
jmp 0x443e28
test esi, esi
je case.0x443cfa.6
push ecx
mov ecx, esi
call fcn.004041c4
jmp case.0x443cfa.6
push dword [esi + 4]
call fcn.00420f8c
add esp, 4
jmp 0x443e2d
test esi, esi
je case.0x443cfa.6
push ecx
mov ecx, esi
call fcn.0045787b
jmp case.0x443cfa.6
test esi, esi
je case.0x443cfa.6
push ecx
mov ecx, esi
call fcn.00457890
jmp case.0x443cfa.6
test esi, esi
je case.0x443cfa.6
mov ecx, esi
call fcn.00411cb6
push esi
call fcn.00420f8c
add esp, 4
lea ecx, [esp + 0xfc]
mov dword [esp + 0x94], 1
mov dword [esp + 0x88], 0
call fcn.00456ad4
lea ecx, [esp + 0xa4]
call fcn.00456ad4
mov byte [edi + 0x484], 0
jmp case.default.0x4441c7
cmp byte [edi + 0x459], 1
je 0x40be37
lea ecx, [esp + 0xb8]
call fcn.00411207
lea eax, [esp + 0xb4]
mov ecx, 0x4c6890
push eax
call fcn.00462a1b
test al, al
je 0x443f7c
cmp dword [esp + 0xbc], 0
je 0x443e89
lea eax, [esp + 0xb8]
mov ecx, edi
push eax
call fcn.00405376
mov esi, eax
test esi, esi
je 0x443e89
lea ecx, [esp + 0xe8]
mov dword [esp + 0xe8], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 1
call fcn.00404dc0
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x10c]
push str._TRAY_ID
mov dword [esp + 0xf8], 1
mov dword [esp + 0xec], eax
call fcn.00411a36
push 1
lea eax, [esp + 0xec]
mov ecx, 0x4c7270
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00403ea3
lea ecx, [esp + 0x10c]
call fcn.00411cb6
mov byte [edi + 0x459], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.00406cd8
lea ecx, [esp + 0xe8]
mov byte [edi + 0x459], 0
call fcn.00404dc0
lea ecx, [esp + 0xb8]
call fcn.00411cb6
jmp case.default.0x4441c7
lea ecx, [esp + 0xb8]
call fcn.00411cb6
jmp 0x40be37
push 0xa
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0xa0], eax
cmp eax, 0x102
je case.default.0x4441c7
lea eax, [esp + 0xa0]
push eax
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xa0]
mov dword [esp + 8], eax
jmp 0x443ff3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x448], 0
mov dword [esp + 8], 0
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fc8b
jmp 0x40c30e
mov dword [edi + 0xf8], 1
jmp case.default.0x4441c7
lea eax, [esp + 0x48]
mov ecx, edi
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.0047c11d
lea ecx, [esp + 0x60]
mov dword [esp + 8], eax
call fcn.00456ad4
mov eax, dword [esp + 8]
jmp 0x40c1e0
lea ecx, [esp + 0x60]
call fcn.00456ad4
jmp 0x40bee2
mov eax, dword [eax + 8]
mov esi, dword [eax + 0x38]
jmp 0x40c0e7
lea ecx, [esp + 0x60]
call fcn.00456ad4
jmp 0x40bee2
push dword [esp + 8]
mov ecx, edi
push 0x70
call fcn.0046a2fa
lea ecx, [esp + 0x60]
call fcn.00456ad4
jmp 0x40bee2
lea ecx, [edi + 0x168]
call fcn.0047c494
mov ecx, eax
call fcn.00456923
test al, al
jne 0x4440bc
mov eax, dword [esp + 8]
mov ecx, edi
movsx eax, word [eax + 0xa]
push eax
push 0xa7
call fcn.0046a2fa
lea ecx, [esp + 0x48]
call fcn.00405190
jmp case.default.0x4441c7
lea ecx, [edi + 0x168]
call fcn.0047c494
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push esi
call fcn.0047b9ee
jmp 0x40c1e0
push 0xffffffffffffffff
lea eax, [esp + 0x4c]
mov ecx, edi
push eax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.004053b0
jmp 0x40c1e0
movsx eax, word [eax + 0xa]
mov ecx, edi
push eax
push 0x72
call fcn.0046a2fa
lea ecx, [esp + 0x48]
call fcn.00405190
jmp case.default.0x4441c7
push dword [esi]
call fcn.00420f8c
add esp, 4
push dword [esi + 0xc]
call fcn.00420f8c
add esp, 4
jmp 0x40c1fa
test edx, edx
je case.0x40c36b.6
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x48]
jmp 0x4441ae
test edx, edx
je case.0x40c36b.6
lea ecx, [edx + 8]
jmp 0x4441a5
test edx, edx
je case.0x40c36b.6
push ecx
mov ecx, edx
call fcn.004041c4
jmp case.0x40c36b.6
push dword [edx + 4]
call fcn.00420f8c
add esp, 4
push dword [esp + 0x48]
jmp 0x4441ae
test edx, edx
je case.0x40c36b.6
push ecx
mov ecx, edx
call fcn.0045787b
jmp case.0x40c36b.6
test edx, edx
je case.0x40c36b.6
push ecx
mov ecx, edx
call fcn.00457890
jmp case.0x40c36b.6
test edx, edx
je case.0x40c36b.6
mov ecx, edx
call fcn.00411cb6
push dword [esp + 0x1c]
call fcn.00420f8c
add esp, 4
jmp case.0x40c36b.6
sub eax, 3
cmp eax, 3
ja case.default.0x4441c7
jmp dword [eax*4 + 0x4444f3]
mov ecx, edi
call fcn.0048632a
jmp 0x444200
mov ecx, edi
call fcn.0048632a
jmp 0x4441e9
push 1
mov ecx, edi
call fcn.00406d79
mov esi, eax
test esi, esi
js 0x444206
jg case.default.0x4441c7
jmp 0x44423f
push 1
mov ecx, edi
call fcn.00406d79
mov esi, eax
test esi, esi
jns 0x444235
mov eax, esi
neg eax
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00456f18
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fc8b
test esi, esi
je case.default.0x4441c7
test esi, esi
jle 0x4442b8
mov eax, dword [edi + 0xf8]
cmp eax, 5
je 0x44424f
cmp eax, 3
jne 0x4442b8
mov eax, dword [edi + 0x1f0]
lea ecx, [esp + 0xd8]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 1
mov esi, dword [eax]
call fcn.00404dc0
push 0
lea eax, [esp + 0xdc]
mov dword [esp + 0xe8], 7
push eax
mov eax, dword [edi]
mov dword [esp + 0xe0], esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00456ec5
lea ecx, [esp + 0xd8]
call fcn.00404dc0
mov ecx, dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call fcn.0046566c
jmp case.default.0x4441c7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x43c], 0
je 0x444316
mov ecx, dword [edi + 0x440]
call fcn.0042074e
test edx, edx
jl 0x444316
jg 0x444303
cmp eax, dword [edi + 0x43c]
jb 0x444316
mov eax, dword [edi + 0x448]
test eax, eax
je 0x443feb
jmp 0x443fda
mov eax, dword [edi + 0xf8]
xor esi, esi
mov byte [esp + 0x23], 0
mov dword [esp + 8], esi
cmp eax, 8
jne 0x444354
lea eax, [esp + 0x23]
push eax
lea ecx, [edi + 0x42c]
lea edx, [esp + 0xc]
call fcn.00463fb5
add esp, 4
cmp byte [esp + 0x23], 1
jne case.default.0x4441c7
mov esi, dword [esp + 8]
jmp 0x44435d
cmp eax, 9
jne case.default.0x4441c7
mov ecx, dword [edi + 0x448]
mov eax, 0xcccccccc
mov dword [esp + 0x38], eax
test ecx, ecx
je 0x4443b6
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x38], 0x103
jne 0x44439c
push 0
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.default.0x4441c7
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
mov dword [edi + 0x448], 0
cmp dword [edi + 0xf8], 8
jne 0x4443e9
mov dword [esp + 8], esi
fild dword [esp + 8]
test esi, esi
jns 0x4443d1
fadd qword [0x4bae48]
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
fstp qword [esp + 0x10]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0047cdde
jmp 0x4443f8
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fcd9
push dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x4441c7
push ecx
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0041fc8b
jmp 0x40bf25
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x168]
push eax
call esi
test eax, eax
jg 0x444439
jmp 0x40bf42