Function at 0x432950
Capabilities:
Check for time delay via gettickcount
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x511b7e
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x28]
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [eax]
mov word [esp + 0x90], cx
mov ecx, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0xa4], 7
mov dword [esp + 0xa0], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4329c2
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x90]
call fcn.004133e0
mov dword [esp + 0x320], ebx
push 6
push ebx
mov dword [esp + 0x50], vtable.CInstallShortCut.0
mov dword [esp + 0x54], vtable.CQMTInitializeCOMThread.0
mov dword [esp + 0x58], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
jne 0x432a0e
mov dword [esp + 0x50], 1
lea eax, [edi + 0x34]
mov byte [esp + 0x320], 1
mov dword [esp + 0x40], eax
mov eax, dword [eax + 0x24]
cmp eax, ebx
je 0x432a2d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00415640
mov eax, dword [0x546880]
cmp eax, ebx
je 0x432a6e
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x4a
lea edx, [esp + 0x44]
push eax
mov dword [esp + 0x48], 5
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], 0x2711
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 8
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xa8]
cmp eax, ebx
je 0x432a89
mov edx, dword [edi + 0x30]
push edx
push 0x51d178
push ebx
push 5
call eax
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x38], eax
mov eax, dword [esi]
push eax
push 0x51d184
mov ecx, 0x546980
call fcn.004df340
mov eax, dword [esi]
push eax
call fcn.00415370
add esp, 0xc
cmp eax, ebx
jne 0x432afc
mov dword [0x542984], 0x3f4
mov ecx, dword [esi]
push ecx
push str.CreateDeepDirectory__ws_
mov ecx, 0x546980
call fcn.004df340
mov eax, dword [edi + 0xa8]
add esp, 8
cmp eax, ebx
je 0x43359e
mov edx, dword [edi + 0x30]
push edx
push 0x51d1b4
push 1
push 0xa
call eax
add esp, 0x10
jmp 0x43359e
push edi
call fcn.00431a90
mov eax, dword [0x546880]
cmp eax, ebx
je 0x432b3e
lea edx, [esp + 0x2c]
push edx
push ebx
push 0x4a
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x2d
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], 0x2711
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], 8
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xa8]
cmp eax, ebx
je 0x432b59
mov ecx, dword [edi + 0x30]
push ecx
push str.ck_W_e
push ebx
push 0x2d
call eax
add esp, 0x10
push str.ExtractProductFiles_begin...
mov ecx, 0x546980
call fcn.004df340
mov eax, dword [0x546a38]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 4
cmp eax, ebx
jne 0x432ba1
push str.Kernel32.dll
call esi
cmp eax, ebx
je 0x432b98
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x546a38], eax
jmp 0x432b9d
mov eax, dword [0x546a38]
cmp eax, ebx
je 0x432ba4
push ebx
call eax
mov ecx, edi
call fcn.0042f580
mov dword [esp + 0x14], eax
mov eax, dword [0x546a38]
cmp eax, ebx
jne 0x432bdf
push str.Kernel32.dll
call esi
cmp eax, ebx
je 0x432bd6
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x546a38], eax
jmp 0x432bdb
mov eax, dword [0x546a38]
cmp eax, ebx
je 0x432be3
push 1
call eax
push str.ExtractProductFiles_end...
mov ecx, 0x546980
call fcn.004df340
add esp, 4
cmp dword [esp + 0x14], ebx
jne 0x432c3b
push 0x51d218
mov ecx, 0x546980
call fcn.004df340
mov ecx, dword [edi + 0xa8]
add esp, 4
cmp ecx, ebx
je 0x43359e
mov eax, dword [edi + 0x64]
mov edx, dword [edi + 0x30]
neg eax
push edx
sbb eax, eax
add eax, 3
push 0x51d22c
push eax
push 0x46
call ecx
add esp, 0x10
jmp 0x43359e
xor edx, edx
lea ecx, [edx + 0x46]
call fcn.00421510
mov eax, dword [edi + 0xa8]
cmp eax, ebx
je 0x432c60
mov ecx, dword [edi + 0x30]
push ecx
push str.ck_W
push ebx
push 0x46
call eax
add esp, 0x10
lea ecx, [esp + 0xa8]
call fcn.004e2e40
mov esi, eax
push 0x51d250
mov ebx, esi
mov byte [esp + 0x324], 2
call fcn.004e3310
cmp dword [esi + 0x18], 8
jb 0x432c8d
mov esi, dword [esi + 4]
jmp 0x432c90
add esi, 4
push 0
push esi
call fcn.004ef642
xor edx, edx
add esp, 8
cmp eax, 0xffffffff
setne dl
mov byte [esp + 0x320], 1
mov eax, edx
test eax, eax
sete bl
cmp dword [esp + 0xc0], 8
jb 0x432ccc
mov eax, dword [esp + 0xac]
push eax
call fcn.004ea0ff
add esp, 4
test bl, bl
jne 0x432d90
lea ecx, [esp + 0x70]
call fcn.004e2e40
mov esi, eax
push 0x51d264
mov ebx, esi
mov byte [esp + 0x324], 3
call fcn.004e3310
xor ecx, ecx
xor ebx, ebx
push 0xffffffffffffffff
mov word [esp + 0xcc], cx
mov edi, 7
push ebx
mov eax, esi
lea ecx, [esp + 0xcc]
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe0], ebx
call fcn.0040e810
mov esi, 8
mov byte [esp + 0x320], 5
cmp dword [esp + 0x88], esi
jb 0x432d46
mov edx, dword [esp + 0x74]
push edx
call fcn.004ea0ff
add esp, 4
lea ecx, [esp + 0xc4]
xor eax, eax
push ecx
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], ax
call fcn.004de3f0
add esp, 4
mov byte [esp + 0x320], 1
cmp dword [esp + 0xdc], esi
jb 0x432d8c
mov edx, dword [esp + 0xc8]
push edx
call fcn.004ea0ff
add esp, 4
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x10], 0
je 0x432da9
cmp dword [edi + 0xc], 0
je 0x432da9
cmp dword [0x5463d4], 2
je 0x433195
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x106]
push ecx
mov word [esp + 0x108], ax
call fcn.004f0190
add esp, 0xc
lea esi, [esp + 0xfc]
call fcn.004ded10
test eax, eax
je 0x432fb7
lea ecx, [esp + 0xa8]
call fcn.004e2e40
lea ecx, [esp + 0x54]
mov byte [esp + 0x320], 6
call fcn.004e2d60
lea ecx, [esp + 0x70]
mov byte [esp + 0x320], 7
call fcn.004e3000
lea ecx, [esp + 0xc4]
mov byte [esp + 0x320], 8
call fcn.004e2f20
mov byte [esp + 0x320], 9
mov ecx, dword [esp + 0xac]
mov esi, 8
cmp dword [esp + 0xc0], esi
jae 0x432e43
lea ecx, [esp + 0xac]
lea edx, [esp + 0xfc]
push edx
call fcn.00426430
mov ecx, dword [esp + 0x5c]
add esp, 4
cmp dword [esp + 0x6c], esi
jae 0x432e61
lea ecx, [esp + 0x58]
lea eax, [esp + 0xfc]
push eax
call fcn.00426430
add esp, 4
lea edi, [esp + 0x70]
call fcn.004e3210
push 0x51d278
mov ebx, edi
call fcn.004e3310
mov ecx, dword [esp + 0x74]
cmp dword [esp + 0x88], esi
jae 0x432e97
lea ecx, [esp + 0x74]
lea edx, [esp + 0xfc]
push edx
call fcn.00426430
add esp, 4
lea edi, [esp + 0xc4]
call fcn.004e3210
push 0x51d284
mov ebx, edi
call fcn.004e3310
mov ecx, dword [esp + 0xc8]
cmp dword [esp + 0xdc], esi
jae 0x432ed6
lea ecx, [esp + 0xc8]
lea eax, [esp + 0xfc]
push eax
call fcn.00426430
add esp, 4
lea ecx, [esp + 0x54]
push ecx
lea esi, [esp + 0xe4]
call fcn.0040e3e0
push 0x51d290
mov ebx, esi
mov byte [esp + 0x324], 0xa
call fcn.004e3310
cmp dword [esp + 0xf8], 8
mov eax, dword [esp + 0xe4]
jae 0x432f23
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.004de650
add esp, 8
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xcc]
lea ecx, [esp + 0xe8]
call fcn.0040e810
push 0x51d2a4
lea ebx, [esp + 0xe4]
call fcn.004e3310
cmp dword [esp + 0xf8], 8
mov eax, dword [esp + 0xe4]
jae 0x432f6e
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.004de650
add esp, 8
lea esi, [esp + 0xe0]
call fcn.00426800
lea esi, [esp + 0xc4]
call fcn.00426800
lea esi, [esp + 0x70]
call fcn.00426800
lea esi, [esp + 0x54]
call fcn.00426800
lea esi, [esp + 0xa8]
mov byte [esp + 0x320], 1
call fcn.00426800
mov edi, dword [esp + 0x28]
lea edx, [esp + 0x14]
push edi
push edx
mov ebx, 0x51d2b8
call fcn.00417ae0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432ff9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4330a8
lea ecx, [esp + 0x18]
push edi
push ecx
mov ebx, 0x51d2ec
call fcn.00417ae0
add esp, 8
mov esi, eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x320], 0xb
call fcn.004e2e40
mov ebx, eax
mov byte [esp + 0x320], 0xc
cmp dword [esp + 0xa4], 8
jb 0x43304b
mov edx, dword [esp + 0x90]
mov dword [esp + 0x14], edx
jmp 0x433056
lea eax, [esp + 0x90]
mov dword [esp + 0x14], eax
mov esi, dword [esi]
push 0x51d304
call fcn.004e3310
cmp dword [ebx + 0x18], 8
jb 0x43306d
mov edx, dword [ebx + 4]
jmp 0x433070
lea edx, [ebx + 4]
mov ecx, dword [esp + 0x14]
push 0x51d2e4
push 0x51d2e8
push ecx
mov ecx, 0x51d2d0
mov ebx, esi
call fcn.004141b0
lea esi, [esp + 0xa8]
call fcn.00426800
lea ecx, [esp + 0x18]
mov byte [esp + 0x320], 1
call fcn.00406cf0
lea edx, [esp + 0x14]
push edx
mov ecx, 0x51d318
call fcn.00406c40
lea eax, [esp + 0x14]
mov byte [esp + 0x320], 0xd
call fcn.004352e0
test eax, eax
mov byte [esp + 0x320], 1
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4330f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x433195
lea ecx, [esp + 0x14]
push 0x546884
push ecx
mov ebx, edi
call fcn.00435480
push eax
lea edx, [esp + 0x24]
push edx
mov ebx, 0x51d32c
mov byte [esp + 0x330], 0xe
call fcn.00417ae0
add esp, 0x10
mov esi, eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x320], 0xf
call fcn.004e2d60
mov ebx, eax
mov byte [esp + 0x320], 0x10
mov esi, dword [esi]
push 0x51d34c
call fcn.004e3310
cmp dword [ebx + 0x18], 8
jb 0x433160
mov ebx, dword [ebx + 4]
jmp 0x433163
add ebx, 4
push esi
push ebx
push str.http:__www.romzj.com__refdesktop
call fcn.00432880
lea esi, [esp + 0xa8]
call fcn.00426800
lea ecx, [esp + 0x18]
call fcn.00406cf0
lea ecx, [esp + 0x14]
mov byte [esp + 0x320], 1
call fcn.00406cf0
lea ecx, [esp + 0xa8]
call fcn.004e2f20
mov ebx, eax
push 0x51d3a4
mov byte [esp + 0x324], 0x11
call fcn.004e3310
mov esi, 8
cmp dword [ebx + 0x18], esi
jb 0x4331c4
mov ebx, dword [ebx + 4]
jmp 0x4331c7
add ebx, 4
push ebx
call fcn.004de510
add esp, 4
mov byte [esp + 0x320], 1
cmp dword [esp + 0xc0], esi
jb 0x4331f1
mov eax, dword [esp + 0xac]
push eax
call fcn.004ea0ff
add esp, 4
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x18]
push edi
push ecx
mov ebx, 0x51d3b0
call fcn.00417ae0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x433233
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x43331f
lea ecx, [esp + 0x18]
push edi
push ecx
mov ebx, str.Shuame.exe
call fcn.00417ae0
add esp, 8
mov esi, eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x320], 0x12
call fcn.004e2f20
mov ebx, eax
mov byte [esp + 0x320], 0x13
cmp dword [esp + 0xa4], 8
jb 0x433282
mov edx, dword [esp + 0x90]
mov dword [esp + 0x14], edx
jmp 0x43328d
lea eax, [esp + 0x90]
mov dword [esp + 0x14], eax
mov esi, dword [esi]
push 0x51d3fc
call fcn.004e3310
push 0x51d408
call fcn.004e3310
cmp dword [ebx + 0x18], 8
jb 0x4332ae
mov edx, dword [ebx + 4]
jmp 0x4332b1
lea edx, [ebx + 4]
mov ecx, dword [esp + 0x14]
push 0x51d3dc
push 0x51d3e0
push ecx
mov ecx, 0x51d3c8
mov ebx, esi
call fcn.004141b0
cmp dword [esp + 0x6c], 8
jb 0x4332e0
mov edx, dword [esp + 0x58]
push edx
call fcn.004ea0ff
add esp, 4
xor eax, eax
mov word [esp + 0x58], ax
mov byte [esp + 0x320], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43331f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push edi
push ecx
mov ebx, 0x51d41c
call fcn.00417ae0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43335d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x43343b
lea ecx, [esp + 0x18]
push edi
push ecx
mov ebx, str.Uninst.exe
call fcn.00417ae0
add esp, 8
mov esi, eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x320], 0x14
call fcn.004e2f20
mov ebx, eax
mov byte [esp + 0x320], 0x15
cmp dword [esp + 0xa4], 8
mov edi, dword [esp + 0x90]
jae 0x4333ad
lea edi, [esp + 0x90]
mov esi, dword [esi]
push 0x51d468
call fcn.004e3310
push 0x51d474
call fcn.004e3310
cmp dword [ebx + 0x18], 8
jb 0x4333ce
mov edx, dword [ebx + 4]
jmp 0x4333d1
lea edx, [ebx + 4]
push 0x51d448
push 0x51d44c
push edi
mov ecx, 0x51d434
mov ebx, esi
call fcn.004141b0
cmp dword [esp + 0x6c], 8
jb 0x4333fc
mov edx, dword [esp + 0x58]
push edx
call fcn.004ea0ff
add esp, 4
xor eax, eax
mov word [esp + 0x58], ax
mov byte [esp + 0x320], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43343b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.lianwifi2
call fcn.00406c40
lea eax, [esp + 0x14]
mov byte [esp + 0x320], 0x16
call fcn.004352e0
test eax, eax
mov byte [esp + 0x320], 1
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x433488
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x433589
mov ebx, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push 0x546884
push ecx
call fcn.00435480
push eax
lea edx, [esp + 0x24]
push edx
mov ebx, str.data_romzj.ico
mov byte [esp + 0x330], 0x17
call fcn.00417ae0
add esp, 0x10
mov esi, eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x320], 0x18
call fcn.004e2f20
mov ebx, eax
mov byte [esp + 0x320], 0x19
mov esi, dword [esi]
push 0x51d4c0
call fcn.004e3310
push 0x51d4cc
call fcn.004e3310
mov edi, 8
cmp dword [ebx + 0x18], edi
jb 0x433500
mov ebx, dword [ebx + 4]
jmp 0x433503
add ebx, 4
push esi
push ebx
push str.http:__www.romzj.com__refstartmenu
call fcn.00432880
cmp dword [esp + 0x6c], edi
jb 0x433522
mov eax, dword [esp + 0x58]
push eax
call fcn.004ea0ff
add esp, 4
mov byte [esp + 0x320], 0x17
mov eax, dword [esp + 0x18]
xor ecx, ecx
add eax, 0xfffffff0
mov word [esp + 0x58], cx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x433561
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x320], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433589
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x24]
push esi
call fcn.00431c40
mov dword [esi + 0x14], 1
xor ebx, ebx
mov edi, esi
mov esi, dword [esp + 0x40]
call fcn.00418e40
cmp dword [edi + 0x14], ebx
je 0x433649
mov eax, dword [0x546880]
cmp eax, ebx
je 0x4335f1
lea edx, [esp + 0x2c]
push edx
push ebx
push 0x4a
lea ecx, [esp + 0x4c]
push eax
mov dword [esp + 0x50], 0x64
mov dword [esp + 0x54], ebx
mov dword [esp + 0x3c], 0x2711
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], 8
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x546880]
mov ecx, dword [edi + 0xa8]
cmp ecx, ebx
je 0x433611
mov eax, dword [edi + 0x30]
push eax
push 0x51d528
push ebx
push 0x64
call ecx
mov eax, dword [0x546880]
add esp, 0x10
cmp eax, ebx
je 0x433623
push ebx
push ebx
push 0x535
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x38]
mov ecx, dword [edi + 0x14]
push eax
push ecx
push str.install_end__return:_d__install_cost_time:_dms
mov ecx, 0x546980
call fcn.004df340
add esp, 0xc
jmp 0x4336f0
push 0x51d564
mov ecx, 0x546980
call fcn.004df340
add esp, 4
push ebx
push 0x516217
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00401800
push ebx
push ebx
push 9
push edi
lea ecx, [esp + 0x80]
mov byte [esp + 0x330], 0x1a
call fcn.00430ad0
cmp dword [esp + 0x88], 0x10
jb 0x4336b0
mov edx, dword [esp + 0x74]
push edx
call fcn.004ea0ff
add esp, 4
mov eax, dword [0x546880]
cmp eax, ebx
je 0x4336f0
lea edx, [esp + 0x2c]
push edx
push ebx
push 0x4a
lea ecx, [esp + 0x44]
push eax
mov dword [esp + 0x48], 0x64
mov dword [esp + 0x4c], 9
mov dword [esp + 0x3c], 0x2711
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], 8
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x50], ebx
je 0x4336fc
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0xa4], 8
jb 0x433716
mov eax, dword [esp + 0x90]
push eax
call fcn.004ea0ff
add esp, 4
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.004ea10a
mov esp, ebp
pop ebp
ret