Function at 0x410cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
push esi
push edi
mov edi, ecx
mov dword [esp + 0x44], edi
mov eax, dword [edi + 0xec]
cmp eax, 0xed8
jge 0x44576c
inc eax
mov dword [edi + 0xec], eax
cmp eax, 1
je 0x4111bd
cmp byte [edi + 0xfc], 0
mov byte [edi + 0x144], 0
jne 0x410fe4
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [edi + 0x144], 0
mov edx, 2
jne 0x410fe4
cmp byte [0x4c8281], 0
jne 0x4457b9
cmp byte [0x4c87e8], 0
jne 0x4457cb
push 1
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call esi
test eax, eax
jne 0x411110
cmp byte [0x4c8282], 1
je 0x445840
cmp dword [edi + 0xf8], 1
je 0x4466e2
mov edx, 2
cmp dword [0x4c94b8], 0
jne 0x44585d
cmp byte [0x4c8287], 1
je 0x44591d
cmp dword [edi + 0x454], 0
je 0x410e04
cmp byte [0x4c941c], 0
jne 0x410e04
mov esi, dword [edi + 0x44c]
lea eax, [edi + 0x44c]
mov byte [0x4c941c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
nop
test esi, esi
jne 0x41100b
mov edi, dword [esp + 8]
lea esp, [esp]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x411054
mov edi, dword [esp + 0x44]
mov byte [0x4c941c], al
cmp dword [esp + 0x14], eax
jg case.default.0x44648f
lea edx, [eax + 2]
cmp byte [0x4c87bc], 0
je 0x410ecd
cmp byte [edi + 0x458], 1
je 0x410ecd
cmp byte [0x4c87e8], 1
je 0x410ecd
xor ecx, ecx
mov dword [esp + 0x9c], 0
mov eax, 8
mov dword [esp + 0xa0], 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004218c6
add esp, 4
mov dword [esp + 0x98], eax
xor ecx, ecx
mov word [eax], cx
push 4
call fcn.004218c6
add esp, 4
test eax, eax
je 0x411293
mov dword [eax], 1
mov dword [esp + 0xa4], eax
jmp 0x410e90
cmp dword [0x4c87dc], 0
jne 0x445959
cmp byte [0x4c87bc], 0
je 0x445b03
mov esi, dword [esp + 0xa4]
dec dword [esi]
jne 0x410ecd
push dword [esp + 0x98]
call fcn.0042193c
add esp, 4
push esi
call fcn.0042193c
add esp, 4
cmp dword [edi + 0x184], 0
jne 0x445b2c
cmp byte [0x4c8930], 0
jne 0x4461ab
mov eax, dword [edi + 0xf8]
cmp eax, 7
je 0x4462c8
cmp eax, 2
je 0x41117b
cmp eax, 8
je 0x4465a1
cmp eax, 9
je 0x4465a1
cmp eax, 3
je 0x41117b
cmp eax, 4
je 0x41117b
cmp eax, 5
je 0x41117b
cmp eax, 6
je 0x41117b
mov esi, dword [ebp + 8]
inc dword [ebp + 8]
mov dword [edi + 0xf4], esi
cmp esi, dword [0x4c92a0]
jg 0x446474
test esi, esi
jle 0x446474
shl esi, 4
add esi, dword [0x4c92dc]
je 0x446474
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 1
mov dword [esp + 0x50], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], ecx
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
movsx eax, word [eax + 8]
test eax, eax
jne 0x411068
lea eax, [ebp + 8]
mov ecx, edi
push eax
push esi
call fcn.0040e6a0
mov esi, dword [esp + 0x58]
test esi, esi
jne 0x4110e3
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x14], edx
cmp ecx, 5
jge 0x411280
mov dword [esp + 0x5c], 1
mov dword [esp + 0x50], 0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [edi + 0xfc], 0
je 0x410d1f
mov eax, dword [edi + 0xec]
mov byte [edi + 0x144], 0
cmp eax, 1
je 0x4111d4
dec eax
mov dword [edi + 0xec], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x11], 0
jne 0x41104c
mov edi, dword [eax + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
xor edx, edx
sub eax, edi
cmp edi, 0x7fffffff
ja 0x445937
cmp ecx, 0x7fffffff
ja 0x411037
cdq
mov edi, dword [esi]
test edx, edx
jl 0x41104c
jg 0x411245
cmp eax, dword [edi + 0x18]
jae 0x411245
mov esi, dword [esi + 4]
jmp 0x410dd0
mov ecx, dword [eax]
cmp byte [ecx + 0x11], 0
jne 0x445948
mov eax, dword [eax + 4]
jmp 0x410de2
cmp eax, 0x33
jne 0x41107a
push esi
mov ecx, edi
call fcn.0040e920
jmp 0x410fa0
dec eax
cmp eax, 0x7e
ja case.0x41108b.2
movzx eax, byte [eax + 0x4112bc]
jmp dword [eax*4 + 0x4112a8]
lea eax, [esp + 0x50]
mov ecx, edi
push eax
lea eax, [esp + 0x24]
push eax
push esi
push 0
call fcn.0040f760
test eax, eax
js 0x410fa0
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x20]
mov eax, dword [ecx + eax*4]
cmp word [eax + 8], 0x7f
je 0x410fa0
jmp 0x4463ac
lea eax, [esp + 0x6b]
mov ecx, edi
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0
call fcn.0040ffe0
jmp 0x4110a6
mov eax, dword [esi + 0xc]
dec dword [eax]
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x4463c8
push esi
call fcn.0042193c
add esp, 4
mov dword [esp + 0x58], 0
jmp 0x410fac
cmp dword [esp + 0x98], 0x12
je 0x44582a
mov ecx, dword [0x4c87d8]
cmp ecx, 0xffffffff
jne 0x4457dd
lea eax, [esp + 0x94]
mov ecx, 0x4c87b0
push eax
call fcn.0040314e
test eax, eax
jne 0x41115f
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call esi
test eax, eax
je 0x410d65
jmp 0x411110
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x2f0], 0
je 0x4111a9
mov ecx, dword [edi + 0x2f8]
call fcn.00420f74
test edx, edx
jl 0x4111a9
jg 0x411226
cmp eax, dword [edi + 0x2f0]
jae 0x411226
mov eax, dword [edi + 0xf8]
cmp eax, 3
jl case.default.0x44648f
jmp 0x446483
mov eax, dword [edi + 0x11c]
mov dword [esp + 0x40], eax
test eax, eax
je 0x410d05
jmp 0x445787
mov ecx, edi
call fcn.00411368
cmp byte [edi + 0xfc], 1
je 0x411001
mov ecx, edi
call fcn.0041138b
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [0x4c82ac]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x411001
jmp 0x446701
cmp dword [edi + 0xf8], 2
jne 0x41129a
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
jmp case.default.0x44648f
inc dword [esp + 0x14]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x44]
mov dword [edi + 0x14], eax
push dword [esi]
call fcn.00409efe
mov ecx, dword [esi]
push 0
push 1
mov byte [ecx + 0x10], 1
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x4c]
inc eax
push eax
call fcn.0040b7dc
mov eax, dword [esi]
mov byte [eax + 0x10], 0
jmp 0x41104c
add ecx, 0xfffffffb
cmp ecx, 0xa
ja case.0x41128c.6
jmp dword [ecx*4 + 0x41133c]
xor eax, eax
jmp 0x410e7e
mov dword [esp + 8], 0
jmp 0x446325
push 0xffffffffffffffff
push 0x9a
mov byte [0x4c8280], 0
call fcn.0046a390
or eax, 0xffffffff
jmp 0x411003
push dword [eax]
mov ecx, edi
call fcn.00409efe
test eax, eax
je 0x4457a2
mov eax, dword [eax + 0x10]
mov ecx, edi
push 1
inc eax
push eax
call fcn.00456f03
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x44]
call fcn.0045732e
mov eax, dword [esp + 0x40]
jmp 0x4111c7
cmp byte [edi + 0x145], 0
je 0x410d84
jmp 0x410d3e
cmp dword [edi + 0xf8], 0
je 0x410d84
jmp 0x410d4b
cmp ecx, dword [0x4c8814]
jge 0x44581b
mov eax, dword [0x4c8810]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
je 0x44581b
cmp dword [eax + 0x18], 0
je 0x44581b
lea eax, [esp + 0x94]
push eax
mov eax, dword [ecx]
push dword [eax + 0x18]
push dword [eax]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x41115f
jmp 0x41112d
mov dword [0x4c87d8], 0xffffffff
jmp 0x41112d
mov byte [edi + 0xfc], 1
mov dword [edi + 0xf8], 1
jmp 0x410d65
mov byte [0x4c8287], 0
mov byte [0x4c8282], 0
mov dword [edi + 0xf8], 1
jmp 0x410d72
mov eax, dword [0x4c94bc]
push eax
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0xc], ecx
call fcn.0042193c
dec dword [0x4c94b8]
add esp, 4
mov dword [0x4c94bc], esi
neg esi
sbb esi, esi
xor ecx, ecx
and dword [0x4c94c0], esi
mov edx, dword [edi + 0x1c8]
mov dword [esp + 0x18], ecx
test edx, edx
je 0x4458be
mov esi, dword [edi + 0x1c4]
mov edi, dword [esp + 8]
mov eax, dword [esi + ecx*4]
mov eax, dword [eax]
test eax, eax
je 0x4458b1
cmp dword [eax], edi
je 0x4458b6
inc ecx
cmp ecx, edx
jb 0x4458a4
mov edi, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
cmp ecx, edx
je 0x44590d
mov eax, dword [edi + 0x1c4]
mov eax, dword [eax + ecx*4]
mov ecx, edi
mov eax, dword [eax]
add eax, 8
push eax
call fcn.00409efe
mov ecx, dword [edi + 0x1c4]
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx + eax*4]
mov ecx, dword [ecx]
add ecx, 0x18
push ecx
lea ecx, [edi + 0x14c]
call fcn.00408007
mov eax, dword [esi + 0x10]
mov ecx, edi
push 0
push 1
inc eax
push eax
call fcn.0040b7dc
jmp case.default.0x44648f
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edx, 2
jmp 0x410d91
cmp byte [0x4c8281], 0
jne 0x410d9e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410fd7
cmp ecx, 0x7fffffff
jbe 0x411037
jmp 0x411036
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.0046a6ce
jmp 0x410de0
mov eax, dword [0x4c87e0]
lea ecx, [esp + 0x94]
mov esi, dword [eax]
push esi
call fcn.004862c6
mov ecx, 0x4c87dc
call fcn.0048be47
test esi, esi
je 0x445983
push ecx
mov ecx, esi
call fcn.00462734
cmp dword [esp + 0x9c], 0
mov dword [0x4c9420], 0
je 0x410e90
lea eax, [esp + 0x98]
mov ecx, edi
push eax
call fcn.00409efe
mov esi, eax
test esi, esi
je 0x410e90
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 1
call fcn.004098d0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x12c]
push 0x4a4ee4
mov dword [esp + 0x80], 1
mov dword [esp + 0x74], eax
call fcn.00407da1
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c9270
push eax
lea eax, [esp + 0x134]
push eax
call fcn.00408973
lea ecx, [esp + 0x12c]
call fcn.004058c4
lea ecx, [esp + 0x70]
call fcn.004098d0
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0xfc]
push str._GUI_WINHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00407da1
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c9270
push eax
lea eax, [esp + 0x104]
push eax
call fcn.00408973
lea ecx, [esp + 0xfc]
call fcn.004058c4
lea ecx, [esp + 0x70]
call fcn.004098d0
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0x11c]
push str._GUI_CTRLHANDLE
mov dword [esp + 0x80], 7
mov dword [esp + 0x74], eax
call fcn.00407da1
push 1
lea eax, [esp + 0x74]
mov ecx, 0x4c9270
push eax
lea eax, [esp + 0x124]
push eax
call fcn.00408973
lea ecx, [esp + 0x11c]
call fcn.004058c4
mov byte [edi + 0x458], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.0040b7dc
lea ecx, [esp + 0x70]
mov byte [edi + 0x458], 0
call fcn.004098d0
lea ecx, [esp + 0x98]
call fcn.004058c4
jmp case.default.0x44648f
cmp dword [0x4c891c], 0
jne 0x445b1f
cmp dword [0x4c9420], 0x64
jge 0x445b1f
inc dword [0x4c9420]
push 0
jmp 0x445b21
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410eaa
cmp byte [edi + 0x484], 1
je 0x410eda
xor eax, eax
mov byte [edi + 0x484], 1
push dword [edi + 0x188]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x68], 0
mov dword [esp + 0xbc], 0x491b84
mov dword [esp + 0x18], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
call fcn.00469f5b
lea ecx, [edi + 0x184]
call fcn.0045e012
mov esi, dword [esp + 0xf0]
lea ecx, [esp + 0x80]
mov dword [esp + 0x88], 0
push dword [esi]
call fcn.00409970
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.00409851
push dword [esi + 8]
mov ecx, edi
call fcn.00409efe
mov edx, eax
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 0x10]
push ecx
call fcn.00407028
mov dword [edi + 0xf4], ecx
mov esi, 3
cmp dword [edx + 0x14], 0
mov dword [esp + 0x3c], eax
jle 0x445d41
mov edx, dword [esp + 0xf0]
add edx, 8
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
jne 0x445c4e
mov edx, dword [esp + 0x3c]
mov edx, dword [edx + 4]
mov eax, dword [edx + esi*4 + 4]
cmp word [eax + 8], 0x33
je 0x445c2b
mov ecx, eax
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x445cc4
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x445c3e
cmp eax, 0x1e
jne 0x445cc4
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0
je 0x445c0d
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4 + 4]
inc esi
cmp word [eax + 8], 0x41
jne 0x445c7e
mov edx, dword [esp + 0x18]
inc esi
xor ecx, ecx
mov eax, dword [edx + esi*4]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x445c71
inc ecx
jmp 0x445cc1
cmp ax, 0x48
jne 0x445cb7
dec ecx
jns 0x445cc1
mov edx, dword [esp + 0x24]
push dword [edx]
lea ecx, [esp + 0xbc]
call fcn.00456ca9
mov ecx, dword [esp + 0x64]
inc esi
mov eax, dword [esp + 0x20]
inc ecx
mov edx, dword [esp + 0x24]
add edx, 4
mov dword [esp + 0x64], ecx
mov dword [esp + 0x24], edx
cmp ecx, dword [eax + 0x14]
jge 0x445d32
mov eax, dword [esp + 0x3c]
jmp 0x445bf5
cmp ax, 0x40
jne 0x445cc1
test ecx, ecx
je 0x445c7a
inc esi
jmp 0x445c61
mov eax, dword [esp + 0x3c]
mov ecx, edi
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4 + 4]
movsx eax, word [eax + 0xa]
push eax
push 0x91
call fcn.0046a390
jmp 0x445d02
mov ecx, esi
call fcn.004058c4
push esi
call fcn.0042193c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x80]
call fcn.00409ce0
lea ecx, [esp + 0xec]
call fcn.00456d38
lea ecx, [esp + 0xb8]
call fcn.00456d38
mov byte [edi + 0x484], 0
jmp 0x410eda
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
push dword [edx + 0x10]
call fcn.004083c1
mov eax, dword [esp + 0x20]
mov esi, 3
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], 1
cmp dword [eax + 0x14], 1
jl 0x445f99
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x6c], edx
mov ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], dx
jne 0x445da9
mov eax, dword [ecx + esi*4]
mov eax, dword [eax]
cmp eax, 0x24
je 0x445d96
cmp eax, 0x1e
jne 0x445d97
mov edx, 0x100
inc esi
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
je 0x445d82
mov dword [esp + 0x6c], edx
mov dword [esp + 0x4c], esi
mov edi, dword [esp + 8]
lea edx, [esi*4 + 4]
mov dword [esp + 0x24], 1
xor ecx, ecx
mov esi, dword [esp + 0x24]
mov eax, dword [edx + edi]
movzx eax, word [eax + 8]
cmp ax, 0x47
jne 0x445dd5
inc ecx
jmp 0x445ead
cmp ax, 0x48
jne 0x445e9f
dec ecx
jns 0x445ead
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x4c]
cmp dword [esp + 0x18], eax
jle 0x445f56
lea eax, [esi + 2]
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov ecx, edi
mov eax, dword [esp + 0x24]
add eax, esi
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 1
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x48]
call fcn.00409f40
test eax, eax
js 0x44603c
mov eax, dword [esp + 0x6c]
or eax, 0x200
push 1
push eax
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.00408480
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x445e7f
push ecx
call fcn.0040799d
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x445e98.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x445e98.6
jmp dword [eax*4 + 0x446738]
cmp ax, 0x40
jne 0x445ead
test ecx, ecx
je 0x445de6
inc esi
add edx, 4
jmp 0x445dc2
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x445e98.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x445f3c
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x445e98.6
lea ecx, [eax + 8]
jmp 0x445f33
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445e98.6
push ecx
call fcn.00408c94
jmp case.0x445e98.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0042193c
add esp, 4
push dword [esp + 0x28]
jmp 0x445f3c
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445e98.6
push ecx
call fcn.00457a34
jmp case.0x445e98.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x445e98.6
push ecx
call fcn.0042036f
jmp case.0x445e98.6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
test eax, eax
je case.0x445e98.6
mov ecx, eax
call fcn.004058c4
push dword [esp + 8]
call fcn.0042193c
add esp, 4
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0
jmp 0x445f73
mov eax, dword [esp + 0x14]
or edx, 0x200
push 1
push edx
push dword [eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
push dword [eax]
call fcn.00408480
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
inc eax
add dword [esp + 0x14], 4
add esi, eax
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], eax
cmp eax, dword [ecx + 0x14]
jle 0x445d68
push 0x4bba4c
lea ecx, [esp + 0x140]
call fcn.00407da1
mov esi, dword [esp + 0x80]
xor eax, eax
cmp dword [esp + 0x8c], 6
push 1
setne al
dec eax
and eax, esi
push 0
push eax
lea eax, [esp + 0x148]
push eax
call fcn.00408480
lea ecx, [esp + 0x13c]
call fcn.004058c4
mov eax, dword [esp + 0x20]
mov ecx, edi
push 0
push 0
mov eax, dword [eax + 0x10]
inc eax
push eax
call fcn.0040b7dc
mov ecx, 0x4c9280
call fcn.0040829f
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x446019
push ecx
call fcn.0040799d
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x8c]
cmp eax, 5
jl case.0x446035.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x446035.6
jmp dword [eax*4 + 0x446764]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x446052
push ecx
call fcn.0040799d
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
cmp eax, 5
jl case.0x44606b.6
add eax, 0xfffffffb
cmp eax, 0xa
ja case.0x44606b.6
jmp dword [eax*4 + 0x446790]
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x44606b.6
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x28]
jmp 0x445cea
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x44606b.6
lea ecx, [esi + 8]
jmp 0x445ce4
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x44606b.6
push ecx
call fcn.00408c94
jmp case.0x44606b.6
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call fcn.0042193c
add esp, 4
push dword [esp + 0x28]
jmp 0x445cea
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x44606b.6
push ecx
call fcn.00457a34
jmp case.0x44606b.6
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x44606b.6
push ecx
call fcn.0042036f
jmp case.0x44606b.6
mov esi, dword [esp + 0x28]
test esi, esi
je case.0x44606b.6
jmp 0x445ce2
test esi, esi
je case.0x446035.6
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x446168
test esi, esi
je case.0x446035.6
lea ecx, [esi + 8]
jmp 0x446163
test esi, esi
je case.0x446035.6
push ecx
mov ecx, esi
call fcn.00408c94
jmp case.0x446035.6
push dword [esi + 4]
call fcn.0042193c
add esp, 4
jmp 0x446168
test esi, esi
je case.0x446035.6
push ecx
mov ecx, esi
call fcn.00457a34
jmp case.0x446035.6
test esi, esi
je case.0x446035.6
push ecx
mov ecx, esi
call fcn.0042036f
jmp case.0x446035.6
test esi, esi
je case.0x446035.6
mov ecx, esi
call fcn.004058c4
push esi
call fcn.0042193c
add esp, 4
lea ecx, [esp + 0xec]
mov dword [esp + 0x8c], 1
mov dword [esp + 0x80], 0
call fcn.00456d38
lea ecx, [esp + 0xb8]
call fcn.00456d38
mov byte [edi + 0x484], 0
jmp case.default.0x44648f
cmp byte [edi + 0x459], 1
je 0x410ee7
lea ecx, [esp + 0x98]
call fcn.00407627
lea eax, [esp + 0x94]
mov ecx, 0x4c8890
push eax
call fcn.004629f8
test al, al
je 0x4462b7
cmp dword [esp + 0x9c], 0
je 0x4461c4
lea eax, [esp + 0x98]
mov ecx, edi
push eax
call fcn.00409efe
mov esi, eax
test esi, esi
je 0x4461c4
lea ecx, [esp + 0xd8]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 1
call fcn.004098d0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x10c]
push str._TRAY_ID
mov dword [esp + 0xe8], 1
mov dword [esp + 0xdc], eax
call fcn.00407da1
push 1
lea eax, [esp + 0xdc]
mov ecx, 0x4c9270
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00408973
lea ecx, [esp + 0x10c]
call fcn.004058c4
mov byte [edi + 0x459], 1
mov ecx, edi
mov eax, dword [esi + 0x10]
push 0
push 1
inc eax
push eax
call fcn.0040b7dc
lea ecx, [esp + 0xd8]
mov byte [edi + 0x459], 0
call fcn.004098d0
lea ecx, [esp + 0x98]
call fcn.004058c4
jmp case.default.0x44648f
lea ecx, [esp + 0x98]
call fcn.004058c4
jmp 0x410ee7
push 0xa
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x48], eax
cmp eax, 0x102
je case.default.0x44648f
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi + 0x444]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
jmp 0x446325
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x448], 0
mov dword [esp + 8], 0
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004207a4
jmp 0x41122f
lea ecx, [edi + 0x168]
call fcn.0047c3b0
mov ecx, eax
call fcn.00456b9c
test al, al
jne 0x446375
mov eax, dword [esp + 8]
mov ecx, edi
movsx eax, word [eax + 0xa]
push eax
push 0xa7
call fcn.0046a390
lea ecx, [esp + 0x50]
call fcn.00409ce0
jmp case.default.0x44648f
lea ecx, [edi + 0x168]
call fcn.0047c3b0
push eax
lea eax, [esp + 0x24]
mov ecx, edi
push eax
push esi
call fcn.0047b90a
jmp 0x4110a6
push 0xffffffffffffffff
lea eax, [esp + 0x54]
mov ecx, edi
push eax
lea eax, [esp + 0x28]
push eax
push esi
call fcn.00409f40
jmp 0x4110a6
movsx eax, word [eax + 0xa]
mov ecx, edi
push eax
push 0x72
call fcn.0046a390
lea ecx, [esp + 0x50]
call fcn.00409ce0
jmp case.default.0x44648f
push dword [esi]
call fcn.0042193c
add esp, 4
push dword [esi + 0xc]
call fcn.0042193c
add esp, 4
jmp 0x4110f4
test edx, edx
je case.0x41128c.6
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esp + 0x50]
jmp 0x446467
test edx, edx
je case.0x41128c.6
lea ecx, [edx + 8]
jmp 0x44645e
test edx, edx
je case.0x41128c.6
push ecx
mov ecx, edx
call fcn.00408c94
jmp case.0x41128c.6
push dword [edx + 4]
call fcn.0042193c
add esp, 4
push dword [esp + 0x50]
jmp 0x446467
test edx, edx
je case.0x41128c.6
push ecx
mov ecx, edx
call fcn.00457a34
jmp case.0x41128c.6
test edx, edx
je case.0x41128c.6
push ecx
mov ecx, edx
call fcn.0042036f
jmp case.0x41128c.6
test edx, edx
je case.0x41128c.6
mov ecx, edx
call fcn.004058c4
push dword [esp + 0x14]
call fcn.0042193c
add esp, 4
jmp case.0x41128c.6
mov dword [edi + 0xf8], 1
jmp case.default.0x44648f
sub eax, 3
cmp eax, 3
ja case.default.0x44648f
jmp dword [eax*4 + 0x4467bc]
mov ecx, edi
call fcn.004861d3
jmp 0x4464c8
mov ecx, edi
call fcn.004861d3
jmp 0x4464b1
push 1
mov ecx, edi
call fcn.0040b87d
mov esi, eax
test esi, esi
js 0x4464ce
jg case.default.0x44648f
jmp 0x446507
push 1
mov ecx, edi
call fcn.0040b87d
mov esi, eax
test esi, esi
jns 0x4464fd
mov eax, esi
neg eax
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004570e7
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004207a4
test esi, esi
je case.default.0x44648f
test esi, esi
jle 0x446580
mov eax, dword [edi + 0xf8]
cmp eax, 5
je 0x446517
cmp eax, 3
jne 0x446580
mov eax, dword [edi + 0x1f0]
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 1
mov esi, dword [eax]
call fcn.004098d0
push 0
lea eax, [esp + 0xcc]
mov dword [esp + 0xd8], 7
push eax
mov eax, dword [edi]
mov dword [esp + 0xd0], esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00457094
lea ecx, [esp + 0xc8]
call fcn.004098d0
mov ecx, dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call fcn.00465841
jmp case.default.0x44648f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x43c], 0
je 0x4465de
mov ecx, dword [edi + 0x440]
call fcn.00420f74
test edx, edx
jl 0x4465de
jg 0x4465cb
cmp eax, dword [edi + 0x43c]
jb 0x4465de
mov eax, dword [edi + 0x448]
test eax, eax
je 0x44631d
jmp 0x44630c
mov eax, dword [edi + 0xf8]
xor esi, esi
mov byte [esp + 0x1f], 0
mov dword [esp + 8], esi
cmp eax, 8
jne 0x44661c
lea eax, [esp + 0x1f]
push eax
lea ecx, [edi + 0x42c]
lea edx, [esp + 0xc]
call fcn.004641ef
add esp, 4
cmp byte [esp + 0x1f], 1
jne case.default.0x44648f
mov esi, dword [esp + 8]
jmp 0x446625
cmp eax, 9
jne case.default.0x44648f
mov ecx, dword [edi + 0x448]
mov eax, 0xcccccccc
mov dword [esp + 0x40], eax
test ecx, ecx
je 0x44667e
lea eax, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x40], 0x103
jne 0x446664
push 0
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.default.0x44648f
push dword [edi + 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
mov dword [edi + 0x448], 0
cmp dword [edi + 0xf8], 8
jne 0x4466b1
mov dword [esp + 8], esi
fild dword [esp + 8]
test esi, esi
jns 0x446699
fadd qword [0x4bdad8]
push ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi]
fstp qword [esp + 0x10]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0047cbde
jmp 0x4466c0
push 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004207f2
push dword [edi + 0x2f4]
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x44648f
push ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004207a4
jmp 0x410fe4
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x158]
push eax
call esi
test eax, eax
jg 0x446701
jmp 0x411001