Function at 0x518030
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x402966
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3b4
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401f28
xor eax, eax
mov ecx, 0x21
lea edi, [ebp - 0x268]
rep stosd dword es:[edi], eax
push 8
mov ecx, 0x21
lea edi, [ebp - 0x2ec]
mov dword [ebp - 0x20], eax
mov word [ebp - 0x48], ax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1e4], eax
rep stosd dword es:[edi], eax
push 0x40fff8
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov dword [ebp - 0x58], 0xfffffffd
mov ecx, dword [ebp - 0x58]
mov eax, 0x11
cmp ecx, eax
jg 0x51d6c0
mov dword [ebp - 0x70], 0xfffffffd
mov ecx, dword [ebp - 0x70]
mov eax, 0x11
cmp ecx, eax
jg 0x51d635
mov edx, dword [0x56e1fc]
mov eax, dword [ebp - 0x58]
lea ebx, [edx + ecx]
test ebx, ebx
mov ecx, dword [0x56e200]
mov dword [ebp - 0x6c], ebx
lea esi, [ecx + eax]
jle 0x51d623
test esi, esi
jle 0x51d623
mov edx, dword [0x56e1a4]
push edx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
sub ecx, edi
add ecx, ebx
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x198]
push edx
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
call dword [sym.imp.MSVBVM60.DLL___vbaVarTstEq]
lea ecx, [ebp - 0x98]
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
test di, di
je 0x51d623
mov eax, dword [0x56e1a4]
push eax
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov ecx, dword [eax + 0x1c]
mov edx, esi
sub edx, edi
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, ecx
add edx, ebx
lea ecx, [eax + edx*4]
push 4
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcRightCharVar]
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaI2ErrVar]
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x98]
movsx eax, ax
push edx
push 2
mov dword [ebp - 0x64], eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x30]
lea eax, [ecx + eax*4 - 0x30]
add esp, 0xc
inc edx
mov dword [eax], edx
cmp dword [0x56e130], 1
jne 0x5183d2
cmp dword [ebp - 0x58], 0xffffffff
jle 0x5183d2
mov eax, dword [ebp - 0x70]
cmp eax, 0xffffffff
jle 0x5183d2
cmp eax, 0x10
jge 0x5183d2
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*4 - 0x30]
cdq
mov edi, 0xa
idiv edi
test edx, edx
jne 0x5183d2
push 1
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x180], 0x5720f4
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcRightCharVar]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
lea ecx, [ebp - 0x98]
push ecx
lea edi, [eax + edx*4 - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaI2ErrVar]
mov ecx, dword [edi]
lea edx, [eax + eax*4]
movsx eax, dx
sub ecx, eax
mov dword [edi], ecx
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x98]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x44]
lea eax, [ecx + eax*4 - 0x44]
add esp, 0xc
test edx, edx
jge 0x5183d2
mov dword [eax], 0
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*4 - 0x28]
test eax, eax
lea edx, [ecx + edx*4]
mov dword [ebp - 0x364], edx
jle 0x5187c9
mov eax, dword [edx - 0x44]
test eax, eax
jle 0x5187c9
mov edi, 0x50
mov dword [edx - 0x10], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0xc], 0xff
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 8], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x28]
lea eax, [ecx + eax*4 - 0x28]
dec edx
mov dword [eax], edx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*4 - 0x28]
cdq
mov edi, 0x3c
idiv edi
test edx, edx
jne 0x51879f
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x5184ab
mov edi, 1
jmp 0x5184ad
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x5184ee
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov edi, dword [edx + ecx*4 - 0x44]
lea eax, [edx + ecx*4 - 0x44]
dec edi
mov dword [eax], edi
push 0x40d3b4
lea eax, [ebp - 0x48]
push eax
jmp 0x518701
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
fcomp dword [0x401f20]
fnstsw ax
test ah, 1
je 0x518529
mov edi, 1
jmp 0x51852b
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x518569
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov ecx, dword [eax + edx*4 - 0x44]
lea eax, [eax + edx*4 - 0x44]
add ecx, 0xfffffffe
mov dword [eax], ecx
push 0x40d1fc
jmp 0x5186fd
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
fcomp dword [0x401f20]
fnstsw ax
test ah, 1
je 0x5185a4
mov edi, 1
jmp 0x5185a6
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x5185e9
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov edi, dword [ecx + eax*4 - 0x44]
lea eax, [ecx + eax*4 - 0x44]
add edi, 0xfffffffd
push 0x40ce80
lea edx, [ebp - 0x48]
mov dword [eax], edi
push edx
jmp 0x518701
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
fcomp dword [0x4016f8]
fnstsw ax
test ah, 1
je 0x518624
mov edi, 1
jmp 0x518626
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x518669
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov edi, dword [edx + ecx*4 - 0x44]
lea eax, [edx + ecx*4 - 0x44]
add edi, 0xfffffffc
mov dword [eax], edi
push 0x40fd4c
lea eax, [ebp - 0x48]
push eax
jmp 0x518701
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
fcomp dword [0x401f20]
fnstsw ax
test ah, 1
je 0x5186a4
mov edi, 1
jmp 0x5186a6
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov ecx, dword [ebp - 0x64]
neg edi
test di, di
lea eax, [ecx*8]
je 0x5186e1
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov ecx, dword [eax + edx*4 - 0x44]
lea eax, [eax + edx*4 - 0x44]
add ecx, 0xfffffffb
mov dword [eax], ecx
push 0x40fd54
jmp 0x5186fd
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov ecx, dword [eax + edx*4 - 0x44]
lea eax, [eax + edx*4 - 0x44]
add ecx, 0xfffffffa
mov dword [eax], ecx
push 0x40fd5c
lea ecx, [ebp - 0x48]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [0x56e0c8]
mov edx, 0x19
mov eax, 1
cmp eax, edx
jg 0x518799
lea edi, [eax*8]
sub edi, eax
shl edi, 2
cmp dword [edi + ecx + 0x18], 0
je 0x518739
mov edi, 1
add eax, edi
jmp 0x518719
lea edx, [ebp - 0x48]
push edx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
mov eax, dword [0x56e0c8]
lea ecx, [edi + eax + 0x14]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov eax, dword [0x56e0c8]
lea ecx, [ebx - 1]
mov dword [edi + eax], ecx
lea edx, [esi - 1]
mov dword [edi + eax + 4], edx
mov ecx, 0xff
mov dword [edi + eax + 8], ecx
mov dword [edi + eax + 0xc], ecx
mov dword [edi + eax + 0x10], 0
mov dword [edi + eax + 0x18], 1
mov ecx, dword [0x576040]
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x44]
test edx, edx
lea eax, [ecx + eax*4 - 0x44]
jge 0x518862
mov dword [eax], 0
jmp 0x518862
mov edx, dword [edx - 0x4c]
mov eax, dword [0x576028]
sub edx, dword [eax + 0x14]
lea edi, [edx + edx*4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, edx
mov edx, dword [eax + 0xc]
mov edx, dword [edx + edi*4 + 0x58]
mov edi, dword [ebp - 0x364]
mov dword [edi - 0x10], edx
mov edi, dword [ebp - 0x64]
lea edx, [edi*8]
sub edx, edi
mov edi, dword [eax + 0x14]
lea edx, [edx + edx*2]
lea edx, [ecx + edx*4]
mov dword [ebp - 0x364], edx
mov edx, dword [edx - 0x4c]
sub edx, edi
lea edi, [edx + edx*4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, edx
mov edx, dword [eax + 0xc]
mov edx, dword [edx + edi*4 + 0x5c]
mov edi, dword [ebp - 0x364]
mov dword [edi - 0xc], edx
mov edi, dword [ebp - 0x64]
lea edx, [edi*8]
sub edx, edi
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
lea edx, [edx + edx*2]
lea edx, [ecx + edx*4]
mov dword [ebp - 0x364], edx
mov edx, dword [edx - 0x4c]
sub edx, edi
lea edi, [edx + edx*4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, edx
mov edx, dword [eax + edi*4 + 0x60]
mov eax, dword [ebp - 0x364]
mov dword [eax - 8], edx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
lea eax, [ecx + edx*4]
mov edx, dword [eax - 0x2c]
test edx, edx
jle 0x5188db
mov edi, dword [eax - 0x44]
test edi, edi
jle 0x5188db
dec edx
mov dword [eax - 0x2c], edx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4 - 0x40]
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40fd64
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov edi, eax
neg edi
sbb edi, edi
neg edi
lea ecx, [ebp - 0x7c]
neg edi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
test di, di
jne 0x51d623
mov ecx, dword [0x576040]
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
lea eax, [ecx + edx*4 - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40fd64
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
mov edi, eax
neg edi
sbb edi, edi
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*4 - 0x40]
push eax
neg edi
push 3
neg edi
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40fd70
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x64]
neg eax
sbb eax, eax
neg eax
neg eax
and edi, eax
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [0x576040]
xor edx, edx
cmp dword [eax + ecx*4 - 0x44], edx
lea ecx, [ebp - 0x80]
sete dl
push ecx
neg edx
and edi, edx
lea edx, [ebp - 0x7c]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
test di, di
je 0x5190a6
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
push 0x40fd7c
lea edx, [ecx + eax*4 - 0x40]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov edi, 1
mov dword [edx + eax*4 - 0x30], edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [0x56e240]
mov dword [edx + ecx*4 - 0x20], edi
mov ecx, dword [ebp - 0x64]
cmp ecx, eax
jne 0x518a06
mov dword [0x56e240], 0
mov edi, dword [0x56e2b8]
cmp edi, 0x63
jge 0x518a57
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov eax, dword [edx + eax*4 - 0x4c]
mov edx, dword [0x576028]
mov edi, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, edi
lea edi, [eax + eax*4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, eax
mov eax, dword [edx + edi*4 + 0x4c]
mov edx, dword [0x56e2b4]
mov edi, dword [0x56e2b8]
add edx, eax
mov dword [0x56e2b4], edx
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0x68]
test eax, eax
jle 0x518eae
mov ecx, dword [0x576060]
mov dword [ecx + eax*4], 1
call fcn.0052a500
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
sub eax, dword [edx + 0x14]
lea edi, [eax + eax*4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, eax
mov eax, dword [edx + 0xc]
cmp dword [eax + edi*4 + 0x68], 0x1e
jne 0x518da3
mov eax, dword [0x56e010]
test eax, eax
mov dword [0x56e21c], 1
jne 0x518afe
push 0x56e010
push 0x404b04
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov eax, dword [0x56e010]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3a4]
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov edi, dword [sym.imp.MSVBVM60.DLL_rtcVarBstrFromAnsi]
mov dword [ebp - 0x1dc], eax
push 0xd
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x180], 0x40fd88
mov dword [ebp - 0x188], 8
call edi
push 0xa
lea ecx, [ebp - 0xb8]
push ecx
call edi
push 0xd
lea edx, [ebp - 0xe8]
push edx
mov dword [ebp - 0x190], 0x40fdb0
mov dword [ebp - 0x198], 8
call edi
push 0xa
lea eax, [ebp - 0x108]
push eax
call edi
push 0xd
lea ecx, [ebp - 0x138]
push ecx
mov dword [ebp - 0x1a0], 0x40fdd0
mov dword [ebp - 0x1a8], 8
call edi
push 0xa
lea edx, [ebp - 0x158]
push edx
call edi
mov eax, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x188]
push ecx
mov dword [ebp - 0x1b0], 0x40fe48
mov dword [ebp - 0x1b8], 8
mov edi, dword [eax]
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xc8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea edx, [ebp - 0xe8]
push edx
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x168]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
mov eax, edi
mov edi, dword [ebp - 0x1dc]
push edi
call dword [eax + 0x54]
fnclex
test eax, eax
jge 0x518cab
push 0x54
push 0x40c204
push edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x88]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
lea ecx, [ebp - 0x178]
push ecx
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xe8]
push ecx
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x98]
push eax
push 0xf
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov eax, dword [0x56e010]
add esp, 0x40
test eax, eax
jne 0x518d52
push 0x56e010
push 0x404b04
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov eax, dword [0x56e010]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x398]
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov edi, eax
mov eax, dword [edi]
push 0xffffffffffffffff
push edi
call dword [eax + 0x9c]
fnclex
test eax, eax
jge 0x518d8e
push 0x9c
push 0x40b680
push edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x88]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + ecx*4 - 0x4c]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
cmp dword [edx + ecx*4 + 0x68], 0x21
jne 0x518ea8
mov eax, dword [0x56e010]
test eax, eax
mov dword [0x56e21c], 1
jne 0x518dfd
push 0x56e010
push 0x404b04
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov eax, dword [0x56e010]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3a4]
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov edi, eax
mov eax, dword [edi]
push 0x40feb8
push edi
call dword [eax + 0x54]
fnclex
test eax, eax
jge 0x518e36
push 0x54
push 0x40c204
push edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x88]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov eax, dword [0x56e010]
test eax, eax
jne 0x518e60
push 0x56e010
push 0x404b04
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov eax, dword [0x56e010]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x398]
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov edi, eax
mov eax, dword [edi]
push 0xffffffffffffffff
push edi
call dword [eax + 0x9c]
fnclex
test eax, eax
jge 0x518e9c
push 0x9c
push 0x40b680
push edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x88]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov edi, dword [0x56e2b8]
cmp edi, 0x78
jge 0x519012
mov ecx, dword [0x56e2b4]
mov eax, edi
imul eax, edi
lea eax, [eax + eax*4]
shl eax, 1
cmp ecx, eax
jl 0x519012
mov ecx, dword [0x56e258]
test ecx, ecx
jle 0x519012
mov ecx, dword [0x56e2b4]
sub ecx, eax
inc edi
mov dword [0x56e2b4], ecx
mov ecx, edi
and ecx, 0x80000001
mov dword [0x56e2b8], edi
jns 0x518f01
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x518f09
inc dword [0x56e2bc]
cmp edi, 0x63
jge 0x518f14
inc dword [0x56e2c0]
mov edx, dword [0x56e2a4]
mov eax, dword [0x56e25c]
inc edx
add eax, 2
mov dword [0x56e2a4], edx
mov edx, dword [0x56e264]
mov dword [0x56e25c], eax
mov dword [0x56e258], eax
mov dword [0x56e260], edx
mov eax, edi
cdq
mov ecx, 0xf
idiv ecx
test edx, edx
jne 0x518f65
mov ecx, dword [0x56e278]
mov eax, dword [0x56e27c]
inc ecx
inc eax
mov dword [0x56e278], ecx
mov dword [0x56e27c], eax
mov eax, edi
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x518f79
inc dword [0x56e2a4]
xor eax, eax
lea edx, [ebp - 0x1d8]
push edx
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d0], eax
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x1cc]
push edx
mov dword [ebp - 0x1cc], 1
call fcn.0054e860
mov eax, 0x32
mov edx, 0x40fee0
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x1d4], 0xff
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x1cc]
push edx
lea eax, [ebp - 0x7c]
push eax
call fcn.0053b720
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
call fcn.0052a500
jmp 0x518ea8
call fcn.005278d0
mov eax, dword [0x576204]
test eax, eax
jne 0x519035
push 0x576204
push 0x403780
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov eax, dword [0x576204]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x314]
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
fild dword [0x56e2b4]
mov edi, eax
mov eax, dword [0x56e2b8]
imul eax, eax
lea edx, [eax + eax*4]
shl edx, 1
mov dword [ebp - 0x36c], edx
mov ecx, dword [edi]
push ecx
fild dword [ebp - 0x36c]
fdivp st(1)
fmul qword [0x401f18]
fstp dword [esp]
push edi
call dword [ecx + 0x84]
fnclex
test eax, eax
jge 0x51909a
push 0x84
push 0x40c204
push edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x88]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov eax, dword [0x56e2e0]
test eax, eax
jne 0x5192c5
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea ebx, [edx + eax*4]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
lea edx, [edx + ecx*4 - 0x40]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40e464
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebx - 0x30]
mov edi, eax
neg edi
sbb edi, edi
inc edi
xor eax, eax
neg edi
cmp ecx, 0x14
sete al
add ebx, 0xffffffc0
push ebx
push 3
neg eax
and edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40e464
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x64]
mov ebx, dword [0x576040]
mov edx, eax
neg edx
sbb edx, edx
lea eax, [ecx*8]
sub eax, ecx
inc edx
neg edx
lea eax, [eax + eax*2]
xor ecx, ecx
cmp dword [ebx + eax*4 - 0x30], 1
lea eax, [ebp - 0x7c]
sete cl
neg ecx
and edx, ecx
or edi, edx
lea edx, [ebp - 0x80]
push edx
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
test di, di
je 0x5192c2
mov ecx, dword [ebp - 0x64]
mov ebx, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
sub eax, dword [ebx + 0x14]
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + edx*4 + 0x50]
mov dword [ebp - 0x30c], eax
neg eax
mov edi, eax
cmp edi, dword [ebp - 0x30c]
mov dword [ebp - 0x68], edi
jg 0x5192ca
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
sub eax, dword [ebx + 0x14]
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + edx*4 + 0x50]
mov eax, edx
neg eax
mov dword [ebp - 0x370], edx
mov dword [ebp - 0x50], eax
cmp eax, edx
jg 0x519235
mov edx, dword [ebp - 0x70]
add edx, edi
cmp edx, 8
jne 0x519223
mov edx, dword [ebp - 0x58]
add edx, eax
cmp edx, 8
jne 0x519223
mov edx, dword [0x56e258]
test edx, edx
jg 0x519241
mov edx, 1
add eax, edx
mov edx, dword [ebp - 0x370]
mov dword [ebp - 0x50], eax
jmp 0x519201
mov eax, 1
add edi, eax
jmp 0x5191bc
mov edx, dword [ebx + 0x14]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx - 0x4c]
sub eax, edx
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + edx*4 + 0x3c]
test edi, edi
jne 0x51927a
push 0x40fef4
jmp 0x51927f
push 0x40ff00
add ecx, 0xffffffc0
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
call fcn.0040b6d4
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x1cc]
mov ebx, dword [ebp - 0x6c]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + ecx*4 - 0x14], edx
jmp 0x519587
mov ebx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
jmp 0x5192cd
mov ebx, dword [ebp - 0x6c]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*4 - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40e464
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x64]
mov edi, eax
neg edi
sbb edi, edi
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [0x576040]
inc edi
xor edx, edx
neg edi
cmp dword [eax + ecx*4 - 0x30], 1
lea ecx, [ebp - 0x7c]
sete dl
neg edx
and edi, edx
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
test di, di
je 0x519587
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fstp dword [ebp - 0x318]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
fld dword [ebp - 0x318]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x5193e7
lea edx, [ebp - 0x98]
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f10]
call dword [sym.imp.MSVBVM60.DLL___vbaR8IntI4]
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
mov edx, dword [0x576040]
lea ecx, [ecx + ecx*2]
mov dword [edx + ecx*4 - 0x34], eax
lea ecx, [ebp - 0x98]
call edi
jmp 0x519587
fld dword [ebp - 0x318]
fcomp dword [0x401f24]
fnstsw ax
test ah, 0x40
je 0x519417
lea eax, [ebp - 0x98]
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
push eax
jmp 0x5193af
fld dword [ebp - 0x318]
fcomp dword [0x401f0c]
fnstsw ax
test ah, 0x40
je 0x51944a
lea eax, [ebp - 0x98]
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
push eax
jmp 0x5193af
fld dword [ebp - 0x318]
fcomp dword [0x401f20]
fnstsw ax
test ah, 0x40
je 0x51947d
lea eax, [ebp - 0x98]
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
push eax
jmp 0x5193af
fld dword [ebp - 0x318]
fcomp dword [0x4016f8]
fnstsw ax
test ah, 0x40
je 0x5194d9
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
push 0x40ff0c
lea edx, [ecx + eax*4 - 0x40]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x30], 1
jmp 0x519587
fld dword [ebp - 0x318]
fcomp dword [0x401f08]
fnstsw ax
test ah, 0x40
je 0x519530
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
push 0x40ff0c
lea ecx, [eax + edx*4 - 0x40]
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x30], 1
jmp 0x519587
fld dword [ebp - 0x318]
fcomp dword [0x401f04]
fnstsw ax
test ah, 0x40
je 0x519587
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
push 0x40ff0c
lea eax, [edx + ecx*4 - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov dword [edx + ecx*4 - 0x30], 1
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 - 0x40]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x84]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40ff24
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x64]
mov edi, eax
neg edi
sbb edi, edi
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 - 0x40]
push edx
inc edi
push 3
neg edi
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40ff18
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x64]
neg eax
sbb eax, eax
inc eax
neg eax
or edi, eax
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 - 0x40]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40e464
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
neg eax
or edi, eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x7c]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov edx, dword [ebp - 0x64]
add esp, 0x10
test di, di
je 0x5196d2
mov ecx, dword [0x576040]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edi, dword [ecx + eax*4 - 0x38]
cmp edi, 1
lea eax, [ecx + eax*4 - 0x38]
jne 0x5196d8
mov dword [eax], 0
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x30], 1
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
push 0x40ff30
lea ecx, [ecx + eax*4 - 0x40]
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov edx, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
lea eax, [ecx + edx*4 - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x1e4]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov ecx, dword [ebp - 0x1e4]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
push ecx
push 0x40e464
call edi
test eax, eax
je 0x51988c
mov edx, dword [ebp - 0x1e4]
push edx
push 0x40fd64
call edi
test eax, eax
je 0x519a61
mov eax, dword [ebp - 0x1e4]
push eax
push 0x40ff24
call edi
test eax, eax
jne 0x51b8f3
call fcn.0040b6d4
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x64]
mov edi, dword [ebp - 0x1cc]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov ebx, dword [eax + edx*4 - 0x14]
lea edx, [eax + edx*4]
sub edi, ebx
cmp edi, 0x9c40
jg 0x51d647
mov edi, dword [0x56e258]
test edi, edi
je 0x51d647
mov ebx, dword [0x576028]
mov edi, dword [edx - 0x4c]
sub edi, dword [ebx + 0x14]
lea ebx, [edi + edi*4]
lea ebx, [ebx + ebx*8]
shl ebx, 1
sub ebx, edi
mov edi, dword [0x576028]
mov edi, dword [edi + 0xc]
lea edi, [edi + ebx*4]
mov ebx, dword [edi + 0x3c]
test ebx, ebx
jne 0x5197cc
mov ebx, dword [0x56e258]
test ebx, ebx
jg 0x51b513
mov edx, dword [0x56e258]
test edx, edx
jle 0x51b689
mov edx, dword [edi + 0x50]
mov dword [ebp - 0x328], edx
neg edx
mov ebx, edx
cmp ebx, dword [ebp - 0x328]
mov dword [ebp - 0x68], ebx
jg 0x51b689
mov edi, dword [0x576028]
lea edx, [ecx*8]
sub edx, ecx
lea edx, [edx + edx*2]
mov edx, dword [eax + edx*4 - 0x4c]
sub edx, dword [edi + 0x14]
lea edi, [edx + edx*4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, edx
mov edx, dword [0x576028]
mov edx, dword [edx + 0xc]
mov edi, dword [edx + edi*4 + 0x50]
mov edx, edi
neg edx
mov dword [ebp - 0x370], edi
mov dword [ebp - 0x50], edx
cmp edx, edi
jg 0x51985d
mov edi, dword [ebp - 0x70]
add edi, ebx
cmp edi, 8
jne 0x51984b
mov edi, dword [ebp - 0x58]
add edi, edx
cmp edi, 8
je 0x519866
mov edi, 1
add edx, edi
mov edi, dword [ebp - 0x370]
mov dword [ebp - 0x50], edx
jmp 0x519833
mov edx, 1
add ebx, edx
jmp 0x5197e7
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
push 0x40ff00
lea edx, [eax + ecx*4 - 0x40]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ebx, dword [ebp - 0x6c]
jmp 0x519587
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4 - 0x30]
lea eax, [esi + eax*4]
mov edx, 1
cmp edi, edx
jne 0x5198d7
mov dword [eax - 0x20], edx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov edx, dword [esi + ecx*4 - 0x34]
lea eax, [esi + ecx*4]
lea ecx, [edx*4 + 1]
mov dword [eax - 0x24], ecx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [esi + edx*4 - 0x30]
lea ebx, [esi + edx*4]
cdq
mov edi, 0xb
idiv edi
test edx, edx
jne 0x519a30
inc dword [ebx - 0x20]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov edx, dword [esi + eax*4 - 0x20]
mov ecx, dword [esi + eax*4 - 0x34]
lea eax, [esi + eax*4]
lea ecx, [edx + ecx*4]
lea edx, [ebp - 0x98]
mov dword [eax - 0x24], ecx
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51995e
mov ecx, 1
jmp 0x519960
xor ecx, ecx
mov edx, dword [ebp - 0x64]
mov esi, dword [0x576040]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4 - 0x20]
xor edx, edx
cmp edi, 2
mov edi, dword [0x56e224]
sete dl
xor eax, eax
neg edx
cmp edi, 1
sete al
neg ecx
neg eax
and edx, eax
and edx, ecx
lea ecx, [ebp - 0x98]
mov esi, edx
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
test si, si
je 0x519a27
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 - 0x4c]
mov edx, dword [0x576028]
mov ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ebx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0xc]
push 0x40ff3c
push eax
call edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x7c]
call esi
push eax
push 0x40ff50
call edi
mov edx, eax
lea ecx, [ebp - 0x80]
call esi
lea ecx, [ebp - 0x80]
push ecx
call fcn.0054e970
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x7c]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*4 - 0x30]
cmp dword [eax], 0x2a
jle 0x51d623
mov ecx, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
lea eax, [ecx + edx*4]
cmp dword [eax - 0x30], 1
jne case.default.0x519a8f
mov eax, dword [eax - 0x34]
cmp eax, 7
ja case.default.0x519a8f
jmp dword [eax*4 + 0x51d7d0]
mov eax, dword [0x56e1a4]
push eax
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [eax + 0x1c]
inc edx
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, edi
add edx, ebx
lea ecx, [eax + edx*4 - 4]
push 1
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edi, dword [eax + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [eax + 0x1c]
inc edx
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, edi
add edx, ebx
mov ecx, dword [eax + edx*4 - 4]
push ecx
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x70]
neg eax
sbb eax, eax
inc eax
neg eax
xor edx, edx
cmp ecx, 9
mov ecx, dword [ebp - 0x58]
sete dl
mov word [ebp - 0x1a0], ax
xor eax, eax
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg edx
cmp ecx, 7
sete al
lea ecx, [ebp - 0x98]
push ecx
neg eax
and edx, eax
mov word [ebp - 0x1b0], dx
lea edx, [ebp - 0x198]
push edx
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0xb8]
push edx
call edi
push eax
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea edx, [ebp - 0x1b8]
push edx
lea ecx, [ebp - 0x98]
mov edi, eax
lea eax, [ebp - 0x1a8]
push eax
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x519d29
lea edx, [ebp - 0x98]
mov ebx, 0x80020004
push edx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x519c2b
mov esi, 1
jmp 0x519c2d
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x519cc0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x519c7b
mov esi, 1
jmp 0x519c7d
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x519cab
mov edx, dword [0x576040]
sub eax, ecx
lea ecx, [eax + eax*2]
mov dword [edx + ecx*4 - 0x34], 4
jmp 0x519cfa
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 6
jmp 0x519cfa
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f10]
call dword [sym.imp.MSVBVM60.DLL___vbaR8IntI4]
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
mov edx, dword [0x576040]
lea ecx, [ecx + ecx*2]
mov dword [edx + ecx*4 - 0x34], eax
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x30], 0
mov ecx, dword [ebp - 0x70]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov ecx, dword [0x56e1a4]
mov edi, dword [ecx + 0x14]
mov edx, dword [ecx + 0x1c]
mov eax, esi
sub eax, edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x378], ecx
mov ecx, edi
imul ecx, eax
sub ecx, edx
add ecx, ebx
inc eax
imul eax, edi
mov dword [ebp - 0x374], edx
mov edi, dword [ebp - 0x374]
mov edx, ecx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + edx*4]
sub eax, edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
add eax, ebx
lea ecx, [ecx + eax*4 - 4]
call edi
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov edi, dword [ecx + edx*4 - 0x54]
lea eax, [ecx + edx*4 - 0x54]
dec edi
mov dword [eax], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov ebx, dword [ecx + eax*4 - 0x50]
lea eax, [ecx + eax*4 - 0x50]
inc ebx
mov dword [eax], ebx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x1c], 0x30
jmp 0x51b358
mov ecx, dword [0x56e1a4]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
sub ecx, edi
add ecx, ebx
lea eax, [edx + ecx*4 - 4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
sub ecx, edi
add ecx, ebx
mov eax, dword [edx + ecx*4 - 4]
push eax
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
neg eax
xor ecx, ecx
mov word [ebp - 0x1a0], ax
cmp dword [ebp - 0x70], 9
mov eax, dword [ebp - 0x58]
sete cl
xor edx, edx
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg ecx
cmp eax, 8
sete dl
lea eax, [ebp - 0x98]
push eax
neg edx
and ecx, edx
mov word [ebp - 0x1b0], cx
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call edi
push eax
lea edx, [ebp - 0x1b8]
push edx
lea eax, [ebp - 0xc8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51a09d
lea ecx, [ebp - 0x98]
mov ebx, 0x80020004
push ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x519fa1
mov esi, 1
jmp 0x519fa3
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x51a035
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x519ff1
mov esi, 1
jmp 0x519ff3
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51a021
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 5
jmp 0x51a06f
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x34], 7
jmp 0x51a06f
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f10]
call dword [sym.imp.MSVBVM60.DLL___vbaR8IntI4]
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov ecx, dword [0x576040]
mov dword [ecx + edx*4 - 0x34], eax
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebp - 0x70]
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x30], 0
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov eax, dword [0x56e1a4]
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edi
imul ecx, dword [eax + 0x18]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
sub ecx, edx
mov edx, dword [eax + 0xc]
add ecx, ebx
lea eax, [edx + ecx*4]
mov edx, dword [eax]
lea ecx, [eax - 4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x54]
lea eax, [ecx + eax*4 - 0x54]
dec edx
mov dword [eax], edx
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x1c], 0x30
jmp 0x51b36f
mov eax, dword [0x56e1a4]
push eax
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [eax + 0x1c]
dec edx
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, edi
add edx, ebx
lea ecx, [eax + edx*4 - 4]
push 1
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edi, dword [eax + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [eax + 0x1c]
dec edx
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, edi
add edx, ebx
mov ecx, dword [eax + edx*4 - 4]
push ecx
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x70]
neg eax
sbb eax, eax
inc eax
xor edx, edx
neg eax
mov edi, 9
cmp ecx, edi
sete dl
xor ecx, ecx
mov word [ebp - 0x1a0], ax
mov eax, 0xb
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x198]
neg edx
cmp dword [ebp - 0x58], edi
sete cl
neg ecx
and edx, ecx
mov word [ebp - 0x1b0], dx
lea edx, [ebp - 0x98]
push edx
push eax
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0xb8]
push eax
call edi
push eax
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0xc8]
push edx
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0x1a8]
lea edx, [ebp - 0x98]
mov edi, eax
lea eax, [ebp - 0x1b8]
push eax
push ecx
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51a371
lea eax, [ebp - 0x98]
mov ebx, 0x80020004
push eax
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51a2df
mov esi, 1
jmp 0x51a2e1
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x51a365
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51a32f
mov esi, 1
jmp 0x51a331
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51a95c
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x34], 6
jmp 0x519cfa
lea eax, [ebp - 0x98]
push eax
jmp 0x519cc7
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov ecx, dword [0x56e1a4]
mov edi, dword [ecx + 0x14]
mov edx, dword [ecx + 0x1c]
mov eax, esi
sub eax, edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x378], ecx
mov ecx, edi
imul ecx, eax
sub ecx, edx
add ecx, ebx
dec eax
imul eax, edi
mov dword [ebp - 0x374], edx
mov edi, dword [ebp - 0x374]
mov edx, ecx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + edx*4]
sub eax, edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
add eax, ebx
lea ecx, [ecx + eax*4 - 4]
call edi
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov edi, dword [ecx + edx*4 - 0x54]
lea eax, [ecx + edx*4 - 0x54]
dec edi
mov dword [eax], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov ebx, dword [ecx + eax*4 - 0x50]
lea eax, [ecx + eax*4 - 0x50]
dec ebx
mov dword [eax], ebx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x1c], 0x30
jmp 0x51aa6d
mov ecx, dword [0x56e1a4]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
mov ecx, esi
sub ecx, edi
mov edi, dword [eax + 0x1c]
dec ecx
imul ecx, dword [eax + 0x18]
sub ecx, edi
add ecx, ebx
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
mov ecx, esi
sub ecx, edi
mov edi, dword [eax + 0x1c]
dec ecx
imul ecx, dword [eax + 0x18]
sub ecx, edi
add ecx, ebx
mov eax, dword [edx + ecx*4]
push eax
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
neg eax
xor ecx, ecx
mov word [ebp - 0x1a0], ax
cmp dword [ebp - 0x70], 8
mov eax, dword [ebp - 0x58]
sete cl
xor edx, edx
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg ecx
cmp eax, 9
sete dl
lea eax, [ebp - 0x98]
push eax
neg edx
and ecx, edx
mov word [ebp - 0x1b0], cx
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call edi
push eax
lea edx, [ebp - 0x1b8]
push edx
lea eax, [ebp - 0xc8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51a687
lea ecx, [ebp - 0x98]
mov ebx, 0x80020004
push ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51a5e9
mov esi, 1
jmp 0x51a5eb
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x51a035
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51a63d
mov esi, 1
jmp 0x51a63f
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51a670
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 7
jmp 0x51a06f
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x34], 1
jmp 0x51a06f
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov ecx, dword [0x56e1a4]
mov edi, dword [ecx + 0x14]
mov edx, dword [ecx + 0x1c]
mov eax, esi
sub eax, edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x378], ecx
mov ecx, edi
imul ecx, eax
sub ecx, edx
add ecx, ebx
dec eax
imul eax, edi
mov dword [ebp - 0x374], edx
mov edi, dword [ebp - 0x374]
mov edx, ecx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + edx*4]
sub eax, edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
add eax, ebx
lea ecx, [ecx + eax*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x50]
lea eax, [ecx + eax*4 - 0x50]
dec edx
mov dword [eax], edx
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x18], 0x20
jmp 0x51b36f
mov eax, dword [0x56e1a4]
push eax
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [eax + 0x1c]
dec edx
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, edi
add edx, ebx
lea ecx, [eax + edx*4 + 4]
push 1
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edi, dword [eax + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [eax + 0x1c]
dec edx
imul edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
sub edx, edi
add edx, ebx
mov ecx, dword [eax + edx*4 + 4]
push ecx
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x70]
neg eax
sbb eax, eax
inc eax
neg eax
xor edx, edx
cmp ecx, 7
mov ecx, dword [ebp - 0x58]
sete dl
mov word [ebp - 0x1a0], ax
xor eax, eax
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg edx
cmp ecx, 9
sete al
lea ecx, [ebp - 0x98]
push ecx
neg eax
and edx, eax
mov word [ebp - 0x1b0], dx
lea edx, [ebp - 0x198]
push edx
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0xb8]
push edx
call edi
push eax
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea edx, [ebp - 0x1b8]
push edx
lea ecx, [ebp - 0x98]
mov edi, eax
lea eax, [ebp - 0x1a8]
push eax
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51a98c
lea edx, [ebp - 0x98]
mov ebx, 0x80020004
push edx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51a8ed
mov esi, 1
jmp 0x51a8ef
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x519cc0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51a941
mov esi, 1
jmp 0x51a943
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51a974
mov edx, dword [0x576040]
sub eax, ecx
lea ecx, [eax + eax*2]
mov dword [edx + ecx*4 - 0x34], 0
jmp 0x519cfa
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 2
jmp 0x519cfa
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov ecx, dword [0x56e1a4]
mov edi, dword [ecx + 0x14]
mov edx, dword [ecx + 0x1c]
mov eax, esi
sub eax, edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x378], ecx
mov ecx, edi
imul ecx, eax
sub ecx, edx
add ecx, ebx
dec eax
imul eax, edi
mov dword [ebp - 0x374], edx
mov edi, dword [ebp - 0x374]
mov edx, ecx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + edx*4]
sub eax, edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
add eax, ebx
lea ecx, [ecx + eax*4 + 4]
call edi
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov edi, dword [ecx + edx*4 - 0x54]
lea eax, [ecx + edx*4 - 0x54]
inc edi
mov dword [eax], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov ebx, dword [ecx + eax*4 - 0x50]
lea eax, [ecx + eax*4 - 0x50]
dec ebx
mov dword [eax], ebx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x1c], 0xffffffd0
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x18], 0x20
jmp 0x51b36f
mov ecx, dword [0x56e1a4]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
sub ecx, edi
add ecx, ebx
lea eax, [edx + ecx*4 + 4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
sub ecx, edi
add ecx, ebx
mov eax, dword [edx + ecx*4 + 4]
push eax
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
neg eax
xor ecx, ecx
mov word [ebp - 0x1a0], ax
cmp dword [ebp - 0x70], 7
mov eax, dword [ebp - 0x58]
sete cl
xor edx, edx
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg ecx
cmp eax, 8
sete dl
lea eax, [ebp - 0x98]
push eax
neg edx
and ecx, edx
mov word [ebp - 0x1b0], cx
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call edi
push eax
lea edx, [ebp - 0x1b8]
push edx
lea eax, [ebp - 0xc8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51acb9
lea ecx, [ebp - 0x98]
mov ebx, 0x80020004
push ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51ac1b
mov esi, 1
jmp 0x51ac1d
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x51a035
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51ac6f
mov esi, 1
jmp 0x51ac71
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51aca2
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 1
jmp 0x51a06f
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x34], 3
jmp 0x51a06f
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov eax, dword [0x56e1a4]
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0x1c]
mov ecx, esi
sub ecx, edi
imul ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
sub ecx, edx
add ecx, ebx
mov edx, dword [eax + ecx*4]
lea ecx, [eax + ecx*4 + 4]
call edi
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov edi, dword [ecx + edx*4 - 0x54]
lea eax, [ecx + edx*4 - 0x54]
inc edi
mov dword [eax], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x1c], 0xffffffd0
jmp 0x51b36f
mov ecx, dword [0x56e1a4]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
mov ecx, esi
sub ecx, edi
mov edi, dword [eax + 0x1c]
inc ecx
imul ecx, dword [eax + 0x18]
sub ecx, edi
add ecx, ebx
lea eax, [edx + ecx*4 + 4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
mov ecx, esi
sub ecx, edi
mov edi, dword [eax + 0x1c]
inc ecx
imul ecx, dword [eax + 0x18]
sub ecx, edi
add ecx, ebx
mov eax, dword [edx + ecx*4 + 4]
push eax
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov edx, dword [ebp - 0x70]
neg eax
sbb eax, eax
inc eax
neg eax
xor ecx, ecx
mov word [ebp - 0x1a0], ax
mov eax, 7
cmp edx, eax
sete cl
xor edx, edx
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg ecx
cmp dword [ebp - 0x58], eax
lea eax, [ebp - 0x98]
sete dl
push eax
neg edx
and ecx, edx
mov word [ebp - 0x1b0], cx
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call edi
push eax
lea edx, [ebp - 0x1b8]
push edx
lea eax, [ebp - 0xc8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51af93
lea ecx, [ebp - 0x98]
mov ebx, 0x80020004
push ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51aef5
mov esi, 1
jmp 0x51aef7
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x51a035
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51af49
mov esi, 1
jmp 0x51af4b
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51af7c
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 2
jmp 0x51a06f
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x34], 4
jmp 0x51a06f
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov ecx, dword [0x56e1a4]
mov edi, dword [ecx + 0x14]
mov edx, dword [ecx + 0x1c]
mov eax, esi
sub eax, edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x378], ecx
mov ecx, edi
imul ecx, eax
sub ecx, edx
add ecx, ebx
inc eax
imul eax, edi
mov dword [ebp - 0x374], edx
mov edi, dword [ebp - 0x374]
mov edx, ecx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + edx*4]
sub eax, edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
add eax, ebx
lea ecx, [ecx + eax*4 + 4]
call edi
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov edi, dword [ecx + edx*4 - 0x54]
lea eax, [ecx + edx*4 - 0x54]
inc edi
mov dword [eax], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov ebx, dword [ecx + eax*4 - 0x50]
lea eax, [ecx + eax*4 - 0x50]
inc ebx
mov dword [eax], ebx
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x1c], 0xffffffd0
jmp 0x51b358
mov ecx, dword [0x56e1a4]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
mov ecx, esi
sub ecx, edi
mov edi, dword [eax + 0x1c]
inc ecx
imul ecx, dword [eax + 0x18]
sub ecx, edi
add ecx, ebx
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x56e1a4]
mov dword [ebp - 0x190], 0x40d558
mov dword [ebp - 0x198], 0x8008
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
mov ecx, esi
sub ecx, edi
mov edi, dword [eax + 0x1c]
inc ecx
imul ecx, dword [eax + 0x18]
sub ecx, edi
add ecx, ebx
mov eax, dword [edx + ecx*4]
push eax
push 0x40d3b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
neg eax
xor ecx, ecx
mov word [ebp - 0x1a0], ax
cmp dword [ebp - 0x70], 8
mov eax, dword [ebp - 0x58]
sete cl
xor edx, edx
mov edi, 0xb
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1b8], edi
neg ecx
cmp eax, 7
sete dl
lea eax, [ebp - 0x98]
push eax
neg edx
and ecx, edx
mov word [ebp - 0x1b0], cx
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarOr]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call edi
push eax
lea edx, [ebp - 0x1b8]
push edx
lea eax, [ebp - 0xc8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51b2a9
lea ecx, [ebp - 0x98]
mov ebx, 0x80020004
push ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51b20b
mov esi, 1
jmp 0x51b20d
xor esi, esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0xa
je 0x51a035
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fadd st(0), st(0)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401f14]
fnstsw ax
test ah, 0x40
je 0x51b25f
mov esi, 1
jmp 0x51b261
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
neg esi
test si, si
lea eax, [ecx*8]
je 0x51b292
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x34], 3
jmp 0x51a06f
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x34], 5
jmp 0x51a06f
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
cmp dword [ecx + edx*4 - 0x30], 1
jne case.default.0x519a8f
mov ecx, dword [0x56e1a4]
mov edi, dword [ecx + 0x14]
mov edx, dword [ecx + 0x1c]
mov eax, esi
sub eax, edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x378], ecx
mov ecx, edi
imul ecx, eax
sub ecx, edx
add ecx, ebx
inc eax
imul eax, edi
mov dword [ebp - 0x374], edx
mov edi, dword [ebp - 0x374]
mov edx, ecx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + edx*4]
sub eax, edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
add eax, ebx
lea ecx, [ecx + eax*4]
call edi
mov eax, dword [0x56e1a4]
sub esi, dword [eax + 0x14]
imul esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub esi, ecx
add esi, ebx
mov edx, 0x40b620
lea ecx, [eax + esi*4]
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov edi, dword [ecx + edx*4 - 0x50]
lea eax, [ecx + edx*4 - 0x50]
inc edi
mov dword [eax], edi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x18], 0xffffffe0
mov edi, dword [ebp - 0x64]
mov ebx, dword [0x576028]
mov esi, dword [ebx + 0x14]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*4 - 0x4c]
sub eax, esi
lea edx, [ecx + edx*4]
lea esi, [eax + eax*4]
lea esi, [esi + esi*8]
shl esi, 1
sub esi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + esi*4 + 0x44]
cmp dword [edx - 0x30], 1
jne 0x51b3f0
lea ecx, [ebp - 0x64]
push ecx
call fcn.00522500
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea edx, [eax + eax*2]
mov dword [ecx + edx*4 - 0x20], 1
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x34]
lea eax, [ecx + eax*4]
lea edx, [edx + edx*2]
lea edx, [edx + edx + 0x21]
mov dword [eax - 0x24], edx
mov edi, dword [ebp - 0x64]
lea eax, [edi*8]
sub eax, edi
lea eax, [eax + eax*2]
lea esi, [ecx + eax*4]
mov eax, dword [esi - 0x30]
cdq
idiv ebx
test edx, edx
jne case.default.0x51b448
inc dword [esi - 0x20]
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
mov esi, dword [ecx + edx*4 - 0x20]
lea eax, [ecx + edx*4]
mov edx, dword [eax - 0x34]
lea edx, [edx + edx*2]
lea edx, [esi + edx*2 + 0x20]
mov dword [eax - 0x24], edx
mov edi, dword [ebp - 0x64]
lea eax, [edi*8]
sub eax, edi
lea eax, [eax + eax*2]
mov eax, dword [ecx + eax*4 - 0x20]
dec eax
cmp eax, 5
ja case.default.0x51b448
jmp dword [eax*4 + 0x51d7f0]
lea edx, [ebp - 0x64]
push edx
jmp 0x51b468
lea eax, [ebp - 0x64]
push eax
jmp 0x51b468
lea eax, [ebp - 0x64]
push eax
call fcn.00522500
lea ecx, [ebp - 0x64]
push ecx
call fcn.00522500
mov edi, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea eax, [edi*8]
sub eax, edi
lea edx, [eax + eax*2]
mov esi, dword [ecx + edx*4 - 0x30]
lea eax, [ecx + edx*4]
lea edx, [ebx + ebx*2]
lea edx, [edx + edx - 1]
cmp esi, edx
jl 0x51d623
xor esi, esi
mov dword [eax - 0x1c], esi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 - 0x18], esi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea edx, [eax + eax*2]
push 0x40fef4
lea eax, [ecx + edx*4 - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov dword [edx + ecx*4 - 0x30], esi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebp - 0x70]
lea eax, [eax + eax*2]
mov dword [edx + eax*4 - 0x20], 1
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov edi, dword [ebp - 0x70]
cmp edi, 9
mov esi, dword [ebp - 0x58]
jne 0x51b546
cmp esi, 7
jne 0x51b546
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 5
jmp 0x51b66b
cmp edi, 9
jne 0x51b59f
cmp esi, 8
jne 0x51b573
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 6
jmp 0x51b66b
cmp edi, 9
jne 0x51b59f
cmp esi, edi
jne 0x51b59f
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 7
jmp 0x51b66b
cmp edi, 8
jne 0x51b5c6
cmp esi, 9
jne 0x51b5c6
xor esi, esi
mov dword [edx - 0x30], esi
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], esi
jmp 0x51b66b
cmp edi, 7
jne 0x51b643
cmp esi, 9
jne 0x51b5f0
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 1
jmp 0x51b66b
cmp edi, 7
jne 0x51b643
cmp esi, 8
jne 0x51b61a
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 2
jmp 0x51b66b
cmp edi, 7
jne 0x51b643
cmp esi, edi
jne 0x51b643
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 3
jmp 0x51b66b
cmp edi, 8
jne 0x51b68f
cmp esi, 7
jne 0x51b68f
mov dword [edx - 0x30], 0
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
mov dword [eax + ecx*4 - 0x34], 4
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
push 0x40ff00
lea eax, [eax + edx*4 - 0x40]
push eax
jmp 0x51d61b
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x70]
xor ebx, ebx
cmp edi, 8
jle 0x51b73a
cmp esi, 8
jge 0x51b6cb
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 5
jmp 0x51b83e
cmp edi, 8
jle 0x51b73a
cmp esi, 8
jne 0x51b701
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 6
jmp 0x51b83e
cmp edi, 8
jle 0x51b73a
cmp esi, 8
jle 0x51b737
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 7
jmp 0x51b83e
cmp edi, 8
jne 0x51b76c
cmp esi, 8
jle 0x51b769
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], ebx
jmp 0x51b83e
cmp edi, 8
jge 0x51b80c
cmp esi, 8
jle 0x51b7a3
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 1
jmp 0x51b83e
cmp edi, 8
jge 0x51b80c
cmp esi, 8
jne 0x51b7d6
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 2
jmp 0x51b83e
cmp edi, 8
jge 0x51b80c
cmp esi, 8
jge 0x51b809
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 3
jmp 0x51b83e
cmp edi, 8
jne 0x51d623
cmp esi, 8
jge 0x51b85c
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
mov dword [eax + ecx*4 - 0x30], ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*2]
mov dword [eax + edx*4 - 0x34], 4
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*2]
push 0x40ff0c
lea edx, [eax + ecx*4 - 0x40]
push edx
jmp 0x51d61b
cmp edi, 8
jne 0x51d623
cmp esi, edi
jne 0x51d623
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx + edx*2]
lea edx, [ebp - 0x98]
mov dword [eax + ecx*4 - 0x30], ebx
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f10]
call dword [sym.imp.MSVBVM60.DLL___vbaR8IntI4]
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
mov edx, dword [0x576040]
lea ecx, [ecx + ecx*2]
mov dword [edx + ecx*4 - 0x34], eax
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
push 0x40ff0c
lea edx, [ecx + eax*4 - 0x40]
push edx
jmp 0x51d61b
mov eax, dword [ebp - 0x1e4]
push eax
push 0x40c238
call edi
test eax, eax
jne 0x51c628
mov ecx, dword [ebp - 0x64]
mov ebx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov esi, dword [ebx + edx*4 - 0x30]
lea eax, [ebx + edx*4]
mov edx, 1
cmp esi, edx
jne 0x51ba02
mov dword [eax - 0x20], edx
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov ecx, dword [ebx + eax*4 - 0x34]
lea eax, [ebx + eax*4]
lea ecx, [ecx + ecx*2]
lea edx, [ecx + ecx + 0x51]
mov dword [eax - 0x24], edx
mov ecx, dword [ebp - 0x64]
mov edx, dword [esi + 0x14]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea edi, [ebx + eax*4 - 0x4c]
mov eax, dword [edi]
sub eax, edx
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
cmp dword [eax + edx*4 + 0x3c], 0
jle 0x51ba08
mov ecx, dword [0x56e200]
mov edx, dword [0x56e1fc]
add ecx, 8
mov dword [ebp - 0x1d4], ecx
add edx, 8
mov dword [ebp - 0x1d0], edx
mov dword [ebp - 0x1d8], 0
mov eax, dword [edi]
mov edi, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
sub eax, edi
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
movsx eax, word [edx + ecx*4 + 0x3c]
lea ecx, [ebp - 0x1d8]
push ecx
lea edx, [ebp - 0x1d4]
mov dword [ebp - 0x1cc], eax
push edx
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x1cc]
push ecx
call fcn.0054e860
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576028]
mov ebx, dword [0x576040]
jmp 0x51ba08
mov esi, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [ebx + edx*4 - 0x4c]
lea edi, [ebx + edx*4]
sub eax, dword [esi + 0x14]
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
lea eax, [eax + edx*4]
mov edx, dword [eax + 0x40]
mov dword [ebp - 0x394], eax
mov eax, dword [edi - 0x30]
mov dword [ebp - 0x14], edx
cdq
idiv dword [ebp - 0x14]
test edx, edx
jne 0x51c57e
cmp dword [edi - 0x20], 2
jne 0x51bab6
cmp dword [0x56e224], 1
jne 0x51bab6
mov eax, dword [ebp - 0x394]
mov ecx, dword [eax + 0xc]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push 0x40ff3c
push ecx
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x7c]
call edi
push eax
push 0x40ff64
call esi
mov edx, eax
lea ecx, [ebp - 0x80]
call edi
lea edx, [ebp - 0x80]
push edx
call fcn.0054e970
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576028]
mov ebx, dword [0x576040]
add esp, 0xc
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
lea eax, [ebx + edx*4]
cmp dword [eax - 0x20], 3
jne 0x51c542
mov eax, dword [eax - 0x4c]
sub eax, dword [esi + 0x14]
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
mov edi, dword [eax + edx*4 + 0x3c]
test edi, edi
jne 0x51bf86
mov eax, dword [ebp - 0x70]
cmp eax, 5
jle 0x51bb0f
cmp eax, 0xb
jge 0x51bb0f
mov eax, dword [ebp - 0x58]
cmp eax, 5
jle 0x51bb0f
cmp eax, 0xb
jge 0x51bb0f
mov dword [ebp - 0x60], 1
lea ecx, [ebp - 0x98]
mov edi, 0xa
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f00]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fild dword [0x56e288]
fcompp
fnstsw ax
test ah, 0x41
je 0x51bb55
mov ebx, 1
mov esi, ebx
jmp 0x51bb5c
xor esi, esi
mov ebx, 1
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg esi
test si, si
je 0x51bb72
mov dword [ebp - 0x5c], ebx
cmp dword [ebp - 0x60], ebx
jne 0x51bc9e
cmp dword [ebp - 0x5c], ebx
jne 0x51bc9e
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [ebp - 0x90], 0x80020004
mov edi, 0xa
mov dword [ebp - 0x98], edi
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
lea eax, [ebp - 0x98]
push eax
lea esi, [edx + ecx*4]
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x14]
inc ecx
mov dword [ebp - 0x398], ecx
fild dword [ebp - 0x398]
fmulp st(1)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fiadd dword [edx + ecx*4 + 0x14]
call ebx
lea ecx, [ebp - 0x98]
mov esi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
mov ecx, dword [0x56e27c]
sub ecx, dword [0x56e278]
inc ecx
mov dword [ebp - 0x39c], ecx
fild dword [ebp - 0x39c]
fmulp st(1)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fiadd dword [0x56e278]
call ebx
lea ecx, [ebp - 0x98]
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
sub esi, edi
mov dword [ebp - 0x20], esi
mov edi, 0xa
jmp 0x51bca4
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401718]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov eax, dword [ecx + eax*4 - 0x4c]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fild dword [edx + ecx*4 + 0x38]
fcompp
fnstsw ax
test ah, 0x41
jne 0x51bd12
mov esi, 1
jmp 0x51bd14
xor esi, esi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg esi
test si, si
je 0x51bd8a
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fst dword [ebp - 0x1cc]
fmul dword [0x401efc]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fadd dword [0x401ef8]
mov eax, dword [0x56e2a0]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 1
mov dword [ebp - 0x3a0], ecx
fild dword [ebp - 0x3a0]
fsubp st(1)
call ebx
lea ecx, [ebp - 0x98]
mov dword [0x56e2dc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0x34]
test eax, eax
jle 0x51befb
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fild dword [edx + ecx*4 + 0x34]
fcompp
fnstsw ax
test ah, 0x41
jne 0x51be34
mov esi, 1
jmp 0x51be36
xor esi, esi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg esi
test si, si
je 0x51bebc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fstp dword [ebp - 0x1cc]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
fild dword [edx + ecx*4 - 0x44]
fld dword [ebp - 0x1cc]
fadd st(0), st(0)
faddp st(1)
fadd qword [0x401a80]
call ebx
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
mov edx, dword [0x576040]
lea ecx, [ecx + ecx*2]
mov dword [edx + ecx*4 - 0x44], eax
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576028]
mov edx, dword [esi + 0x14]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx - 0x4c]
sub eax, edx
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*4 + 0x10]
cmp dword [ecx - 0x44], eax
jle 0x51befb
mov dword [ecx - 0x44], eax
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], edi
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401718]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ebx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fild dword [edx + ecx*4 + 0x30]
fcompp
fnstsw ax
test ah, 0x41
jne 0x51bf68
mov esi, 1
jmp 0x51bf6a
xor esi, esi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg esi
test si, si
je 0x51c3d4
jmp 0x51c378
mov eax, 1
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
mov eax, dword [ebx + eax*4 - 0x4c]
mov ebx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
sub eax, ebx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
lea eax, [ebp - 0x98]
push eax
lea esi, [edx + ecx*4]
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x14]
inc ecx
mov dword [ebp - 0x3a4], ecx
fild dword [ebp - 0x3a4]
fmulp st(1)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ebx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fiadd dword [edx + ecx*4 + 0x14]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x20], eax
call edi
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
mov ecx, dword [0x56e284]
sub ecx, dword [0x56e280]
inc ecx
mov dword [ebp - 0x3a8], ecx
fild dword [ebp - 0x3a8]
fmulp st(1)
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fiadd dword [0x56e280]
call esi
lea ecx, [ebp - 0x98]
mov ebx, eax
call edi
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x98]
sub eax, ebx
push edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401718]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
mov eax, dword [ecx + eax*4 - 0x4c]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fild dword [edx + ecx*4 + 0x38]
fcompp
fnstsw ax
test ah, 0x41
jne 0x51c10d
mov ebx, 1
jmp 0x51c10f
xor ebx, ebx
lea ecx, [ebp - 0x98]
call edi
neg ebx
test bx, bx
je 0x51c181
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fst dword [ebp - 0x1cc]
fmul dword [0x401efc]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fadd dword [0x401ef8]
mov eax, dword [0x56e2a0]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 1
mov dword [ebp - 0x3ac], ecx
fild dword [ebp - 0x3ac]
fsubp st(1)
call esi
lea ecx, [ebp - 0x98]
mov dword [0x56e2dc], eax
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0x34]
test eax, eax
jle 0x51c2f6
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fild dword [edx + ecx*4 + 0x34]
fcompp
fnstsw ax
test ah, 0x41
jne 0x51c22f
mov ebx, 1
jmp 0x51c231
xor ebx, ebx
lea ecx, [ebp - 0x98]
call edi
neg ebx
test bx, bx
je 0x51c2b7
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fstp dword [ebp - 0x1cc]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
fild dword [edx + ecx*4 - 0x44]
fld dword [ebp - 0x1cc]
fmul dword [0x4016f8]
faddp st(1)
fadd qword [0x401a80]
call esi
mov edx, dword [ebp - 0x64]
lea ecx, [edx*8]
sub ecx, edx
mov edx, dword [0x576040]
lea ecx, [ecx + ecx*2]
mov dword [edx + ecx*4 - 0x44], eax
lea ecx, [ebp - 0x98]
call edi
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576028]
mov edx, dword [esi + 0x14]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx - 0x4c]
sub eax, edx
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*4 + 0x10]
cmp dword [ecx - 0x44], eax
jle 0x51c2f6
mov dword [ecx - 0x44], eax
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401718]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
fild dword [edx + ecx*4 + 0x30]
fcompp
fnstsw ax
test ah, 0x41
jne 0x51c367
mov esi, 1
jmp 0x51c369
xor esi, esi
lea ecx, [ebp - 0x98]
call edi
neg esi
test si, si
je 0x51c3d4
mov eax, dword [0x56e200]
mov ecx, dword [0x56e1fc]
add eax, 8
add ecx, 8
lea edx, [ebp - 0x1d8]
push edx
mov dword [ebp - 0x1d4], eax
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1d0], ecx
push eax
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x1cc]
push edx
mov dword [0x56e2d8], 0x78
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1cc], 3
call fcn.0054e860
mov ebx, dword [ebp - 0x20]
xor edi, edi
cmp ebx, edi
jg 0x51c3e5
mov ebx, 1
mov dword [ebp - 0x20], ebx
mov ecx, dword [0x56e6a0]
mov eax, 0x1b6
cmp ecx, eax
je 0x51c3fc
cmp dword [0x56e724], eax
jne 0x51c41e
mov eax, dword [0x56e260]
cmp eax, ebx
jl 0x51c413
sub eax, ebx
xor ebx, ebx
mov dword [0x56e260], eax
mov dword [ebp - 0x20], ebx
jmp 0x51c41e
sub ebx, eax
mov dword [ebp - 0x20], ebx
mov dword [0x56e260], edi
sub dword [0x56e258], ebx
jns 0x51c42c
mov dword [0x56e258], edi
push 0x56e2c4
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40e464
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov esi, eax
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0x7c]
neg esi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
cmp si, di
je 0x51c47f
push 0x40ff30
push 0x56e2c4
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov dword [0x56e2d0], edi
mov ecx, dword [ebp - 0x60]
mov eax, 1
cmp ecx, eax
jne 0x51c539
mov ecx, dword [0x56e0c8]
mov edx, 0x19
mov edi, eax
cmp eax, edx
jg 0x51c539
lea esi, [eax*8]
sub esi, eax
shl esi, 2
cmp dword [esi + ecx + 0x18], 0
je 0x51c4bb
add eax, edi
jmp 0x51c49c
cmp dword [ebp - 0x5c], 1
jne 0x51c4ef
push ebx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
mov eax, dword [0x56e0c8]
lea ecx, [esi + eax + 0x14]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
jmp 0x51c4fe
mov edx, 0x40ff78
lea ecx, [esi + ecx + 0x14]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, dword [0x56e0c8]
mov ecx, dword [0x56e1fc]
mov edx, dword [0x56e200]
add ecx, 7
mov dword [esi + eax], ecx
add edx, 7
mov dword [esi + eax + 4], edx
mov dword [esi + eax + 8], 0xff
mov ecx, 0x32
mov dword [esi + eax + 0xc], ecx
mov dword [esi + eax + 0x10], ecx
mov dword [esi + eax + 0x18], 1
mov ecx, dword [ebp - 0x64]
mov ebx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov esi, dword [ebx + eax*4 - 0x20]
lea eax, [ebx + eax*4 - 0x20]
inc esi
mov dword [eax], esi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
lea eax, [ebx + ecx*4]
mov ecx, dword [eax - 0x34]
lea edx, [ecx + ecx*2]
mov ecx, dword [eax - 0x20]
lea edx, [ecx + edx*2 + 0x50]
mov dword [eax - 0x24], edx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea ebx, [ebx + eax*4]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + eax*2]
mov eax, dword [ebx - 0x30]
lea edx, [ecx + ecx - 1]
cmp eax, edx
jl 0x51d623
push 0x40ff88
add ebx, 0xffffffc0
push ebx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov dword [edx + eax*4 - 0x30], 0
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov dword [edx + ecx*4 - 0x20], 1
call fcn.0040b6d4
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebp - 0x1cc]
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov dword [eax + edx*4 - 0x14], ecx
mov ecx, dword [ebp - 0x70]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov edx, dword [ebp - 0x1e4]
push edx
push 0x40ff30
call edi
test eax, eax
jne 0x51c803
mov eax, dword [ebp - 0x64]
lea ecx, [eax*8]
sub ecx, eax
lea edx, [ecx + ecx*2]
mov ecx, dword [0x576040]
mov edi, dword [ecx + edx*4 - 0x30]
lea edx, [ecx + edx*4]
mov esi, 1
cmp edi, esi
jne 0x51c68c
mov dword [edx - 0x20], esi
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x34]
lea eax, [ecx + eax*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx + 0x81]
mov dword [eax - 0x24], edx
mov eax, dword [ebp - 0x64]
lea edx, [eax*8]
sub edx, eax
lea edx, [edx + edx*2]
mov edi, dword [ecx + edx*4 - 0x30]
and edi, 0x80000003
lea edx, [ecx + edx*4]
jns 0x51c6ac
dec edi
or edi, 0xfffffffc
inc edi
jne 0x51c76d
inc dword [edx - 0x20]
mov edx, dword [ebp - 0x64]
lea eax, [edx*8]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 - 0x34]
mov edi, dword [ecx + eax*4 - 0x20]
lea eax, [ecx + eax*4]
lea edx, [edx + edx*4]
lea edx, [edi + edx*2 + 0x80]
mov dword [eax - 0x24], edx
mov eax, dword [ebp - 0x64]
lea edx, [eax*8]
sub edx, eax
lea edx, [edx + edx*2]
mov edi, dword [ecx + edx*4 - 0x20]
cmp edi, 2
lea edx, [ecx + edx*4]
jne 0x51c76d
cmp dword [0x56e224], esi
jne 0x51c76d
mov eax, dword [edx - 0x4c]
mov edx, dword [0x576028]
mov ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
sub eax, ebx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0xc]
push 0x40ff3c
push eax
call edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x7c]
call esi
push eax
push 0x40ff94
call edi
mov edx, eax
lea ecx, [ebp - 0x80]
call esi
lea ecx, [ebp - 0x80]
push ecx
call fcn.0054e970
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x7c]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov eax, dword [ebp - 0x64]
mov ecx, dword [0x576040]
add esp, 0xc
lea edx, [eax*8]
sub edx, eax
lea edx, [edx + edx*2]
mov esi, dword [ecx + edx*4 - 0x30]
cmp esi, 0xb
lea edx, [ecx + edx*4]
jle 0x51d623
mov esi, dword [0x56e2e0]
test esi, esi
jne 0x51c7ad
push 0x40fef4
add edx, 0xffffffc0
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov eax, dword [ebp - 0x64]
mov ecx, dword [0x576040]
lea edx, [eax*8]
sub edx, eax
lea eax, [edx + edx*2]
mov dword [ecx + eax*4 - 0x30], 0
call fcn.0040b6d4
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x1cc]
mov dword [edx + ecx*4 - 0x14], eax
mov ecx, dword [ebp - 0x70]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov ecx, dword [ebp - 0x1e4]
push ecx
push 0x40fd70
call edi
test eax, eax
jne 0x51d4ce
mov ecx, dword [ebp - 0x64]
mov edi, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov ecx, dword [edi + edx*4 - 0x30]
lea eax, [edi + edx*4]
mov edx, 1
cmp ecx, edx
jne 0x51c861
mov dword [eax - 0x20], edx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov ecx, dword [edi + eax*4 - 0x34]
lea eax, [edi + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx + 1]
mov dword [eax - 0x24], ecx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov ecx, dword [edi + eax*4 - 0x30]
and ecx, 0x80000003
lea eax, [edi + eax*4]
jns 0x51c884
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x51d45c
inc dword [eax - 0x20]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov ecx, dword [edi + eax*4 - 0x34]
lea eax, [edi + eax*4]
mov edi, dword [eax - 0x20]
lea ecx, [ecx + ecx*4]
lea ecx, [edi + ecx*2 + 0x80]
mov dword [eax - 0x24], ecx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x576040]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
cmp dword [eax - 0x20], 4
jne 0x51c940
cmp dword [0x56e224], edx
jne 0x51c940
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov eax, dword [eax - 0x4c]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0xc]
push 0x40ff3c
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x7c]
call edi
push eax
push 0x40ffa8
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x80]
call edi
lea ecx, [ebp - 0x80]
push ecx
call fcn.0054e970
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x7c]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov ecx, dword [ebp - 0x64]
mov edi, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
lea eax, [edi + edx*4]
cmp dword [eax - 0x20], 5
jne 0x51d45f
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov eax, dword [eax - 0x4c]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0x6c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaR8Str]
call dword [sym.imp.MSVBVM60.DLL___vbaR8IntI4]
mov dword [ebp - 0x340], eax
mov edi, 1
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0x64]
cmp edi, eax
lea eax, [ecx*8]
jg 0x51cafe
mov edx, dword [0x576040]
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
add ecx, edi
mov eax, dword [edx + ecx*4 + 0x6c]
push eax
push 0x40b620
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
test eax, eax
je 0x51caf2
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
mov eax, dword [edx + ecx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
add ecx, edi
mov eax, dword [edx + ecx*4 + 0xe8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaR8Str]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fstp qword [ebp - 0x3b4]
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul qword [ebp - 0x3b4]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp qword [0x401ef0]
mov dword [ebp - 0x3b8], 1
fnstsw ax
test ah, 0x40
jne 0x51ca8d
mov dword [ebp - 0x3b8], 0
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov eax, dword [ebp - 0x3b8]
neg eax
test ax, ax
je 0x51caf2
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x4c], eax
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [ebp - 0x30]
add ecx, edi
mov edx, dword [edx + ecx*4 + 0x6c]
mov ecx, dword [ebp - 0x4c]
lea ecx, [eax + ecx*4]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, 1
add edi, eax
jmp 0x51c999
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
mov eax, dword [eax + edx*4 - 0x4c]
mov edx, dword [0x576028]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub eax, ecx
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*8]
shl ecx, 1
sub ecx, eax
mov eax, dword [edx + ecx*4 + 0x10]
cmp eax, 1
jl 0x51cc15
cmp eax, 0x50
jg 0x51cc15
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401700]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401ee8]
fnstsw ax
test ah, 0x40
je 0x51cb7b
mov edi, 1
jmp 0x51cb7d
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x51cba8
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
inc eax
mov edx, 0x40ffbc
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x4c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401700]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401ee8]
fnstsw ax
test ah, 0x40
je 0x51cbe9
mov eax, 1
jmp 0x51cbeb
xor eax, eax
neg eax
lea ecx, [ebp - 0x98]
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
test di, di
je 0x51cded
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
mov edx, 0x40ffcc
jmp 0x51cde1
cmp eax, 0x51
jl 0x51cd04
cmp eax, 0x96
jg 0x51cd04
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401700]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401ee8]
fnstsw ax
test ah, 0x40
je 0x51cc6a
mov edi, 1
jmp 0x51cc6c
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x51cc97
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
inc eax
mov edx, 0x40ffdc
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x4c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401700]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401ee8]
fnstsw ax
test ah, 0x40
je 0x51ccd8
mov eax, 1
jmp 0x51ccda
xor eax, eax
neg eax
lea ecx, [ebp - 0x98]
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
test di, di
je 0x51cded
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
mov edx, 0x40fe00
jmp 0x51cde1
cmp eax, 0xc8
jle 0x51cded
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f00]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401ee8]
fnstsw ax
test ah, 0x40
je 0x51cd50
mov edi, 1
jmp 0x51cd52
xor edi, edi
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg edi
test di, di
je 0x51cd7d
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
inc eax
mov edx, 0x40fe10
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x4c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x401f00]
call dword [sym.imp.MSVBVM60.DLL___vbaFPInt]
fcomp dword [0x401ee8]
fnstsw ax
test ah, 0x40
je 0x51cdbe
mov eax, 1
jmp 0x51cdc0
xor eax, eax
neg eax
lea ecx, [ebp - 0x98]
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
test di, di
je 0x51cded
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
mov edx, 0x40fe20
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax*4]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov dword [ebp - 0x24], 0
mov eax, 1
mov ecx, 0xa
cmp eax, ecx
mov dword [ebp - 0x1c], eax
jg 0x51d456
lea edx, [ebx + eax]
mov dword [ebp - 0x354], edx
mov edx, ebx
sub edx, eax
cmp edx, dword [ebp - 0x354]
mov dword [ebp - 0x68], edx
jg 0x51d44a
mov ecx, esi
sub ecx, eax
mov dword [ebp - 0x3bc], ecx
mov dword [ebp - 0x50], ecx
lea edi, [esi + eax]
cmp ecx, edi
jg 0x51d43e
mov edi, dword [ebp - 0x4c]
cmp dword [ebp - 0x24], edi
je 0x51d6c0
cmp ecx, dword [ebp - 0x3bc]
je 0x51d14e
lea edi, [esi + eax]
cmp ecx, edi
je 0x51d14e
mov edi, ebx
sub edi, eax
cmp edx, edi
je 0x51ce72
add eax, ebx
cmp edx, eax
jne 0x51d42c
mov eax, dword [0x56e198]
mov edi, 2
sub edi, dword [eax + 0x14]
imul edi, dword [eax + 0x18]
sub edi, dword [eax + 0x1c]
add edi, ecx
imul edi, dword [eax + 0x20]
sub edi, dword [eax + 0x24]
mov ecx, dword [eax + 0x2c]
add edi, edx
imul edi, dword [eax + 0x28]
mov edx, dword [0x56e154]
sub edi, ecx
mov ecx, dword [eax + 0xc]
add edi, edx
mov edx, dword [ecx + edi*4]
push edx
push 0x40b620
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov edx, dword [ebp - 0x50]
mov ecx, eax
mov eax, dword [0x56e06c]
mov edi, dword [eax + 0x14]
neg ecx
sbb ecx, ecx
sub edx, edi
imul edx, dword [eax + 0x18]
sub edx, dword [eax + 0x1c]
mov edi, dword [ebp - 0x68]
inc ecx
add edx, edi
mov edi, dword [eax + 0xc]
xor eax, eax
neg ecx
cmp dword [edi + edx*4], eax
lea edx, [ebp - 0x74]
sete al
mov dword [ebp - 0x1a8], 0xb
neg eax
and ecx, eax
mov word [ebp - 0x1a0], cx
mov ecx, dword [0x56e198]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, 3
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [ebp - 0x50]
sub ecx, edi
mov edi, dword [eax + 0x24]
add ecx, edx
imul ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x68]
sub ecx, edi
mov edi, dword [eax + 0x2c]
add ecx, edx
imul ecx, dword [eax + 0x28]
mov edx, dword [0x56e154]
sub ecx, edi
mov edi, dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
add ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call edi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov dword [ebp - 0x190], 0x40e470
mov ecx, dword [0x56e198]
push ecx
lea edx, [ebp - 0x78]
push edx
mov dword [ebp - 0x198], 0x8008
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x78]
mov edx, dword [eax + 0x14]
mov ecx, 3
sub ecx, edx
imul ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x50]
imul ecx, dword [eax + 0x20]
sub ecx, dword [eax + 0x24]
add ecx, dword [ebp - 0x68]
imul ecx, dword [eax + 0x28]
sub ecx, dword [eax + 0x2c]
add ecx, dword [0x56e154]
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0xc8]
push edx
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b8], 0x4008
call edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0xa8]
push ecx
mov dword [ebp - 0x1c0], 0x40d3ac
mov dword [ebp - 0x1c8], 0x8008
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpNe]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarAnd]
push eax
lea edx, [ebp - 0xb8]
push edx
call edi
push eax
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0xd8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpNe]
push eax
lea eax, [ebp - 0xe8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51d426
mov ecx, dword [ebp - 0x24]
mov edi, dword [0x56e154]
mov edx, dword [ebp - 0x68]
inc ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x56e170]
cmp edx, dword [ecx + edi*4]
jge 0x51d0ce
test edx, edx
jle 0x51d0ce
mov ecx, dword [ebp - 0x50]
test ecx, ecx
jle 0x51d0d1
mov dword [ebp - 0x3c0], 0
jmp 0x51d0db
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c0], 1
mov ebx, dword [0x56e18c]
xor eax, eax
cmp ecx, dword [ebx + edi*4]
mov edi, dword [ebp - 0x3c0]
setge al
or eax, edi
jne 0x51d411
lea ecx, [ebp - 0x2ec]
push ecx
push 0x40b744
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
lea ecx, [edx + eax*4]
push ecx
lea edx, [ebp - 0x2ec]
push edx
call fcn.005352d0
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.005372f0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x6c]
mov eax, 1
add ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], ecx
jmp 0x51ce32
mov eax, dword [0x56e198]
mov edi, 2
sub edi, dword [eax + 0x14]
imul edi, dword [eax + 0x18]
sub edi, dword [eax + 0x1c]
add edi, ecx
imul edi, dword [eax + 0x20]
sub edi, dword [eax + 0x24]
mov ecx, dword [0x56e154]
add edi, edx
imul edi, dword [eax + 0x28]
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0xc]
sub edi, edx
add edi, ecx
mov ecx, dword [eax + edi*4]
push ecx
push 0x40b620
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov ecx, dword [ebp - 0x50]
mov edx, eax
mov eax, dword [0x56e06c]
mov edi, dword [eax + 0x14]
neg edx
sbb edx, edx
sub ecx, edi
imul ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x1c]
mov edi, dword [ebp - 0x68]
inc edx
add ecx, edi
mov edi, dword [eax + 0xc]
xor eax, eax
neg edx
cmp dword [edi + ecx*4], eax
mov ecx, dword [0x56e198]
sete al
push ecx
mov dword [ebp - 0x1a8], 0xb
neg eax
and edx, eax
mov word [ebp - 0x1a0], dx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax + 0x14]
mov edi, dword [eax + 0x1c]
mov ecx, 3
sub ecx, edx
imul ecx, dword [eax + 0x18]
mov edx, dword [ebp - 0x50]
sub ecx, edi
mov edi, dword [eax + 0x24]
add ecx, edx
imul ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x68]
sub ecx, edi
mov edi, dword [eax + 0x2c]
add ecx, edx
imul ecx, dword [eax + 0x28]
mov edx, dword [0x56e154]
sub ecx, edi
mov edi, dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
add ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x98]
push edx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x188], 0x4008
call edi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov dword [ebp - 0x190], 0x40e470
mov ecx, dword [0x56e198]
push ecx
lea edx, [ebp - 0x78]
push edx
mov dword [ebp - 0x198], 0x8008
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x78]
mov edx, dword [eax + 0x14]
mov ecx, 3
sub ecx, edx
imul ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x50]
imul ecx, dword [eax + 0x20]
sub ecx, dword [eax + 0x24]
add ecx, dword [ebp - 0x68]
imul ecx, dword [eax + 0x28]
sub ecx, dword [eax + 0x2c]
add ecx, dword [0x56e154]
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push 1
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0xc8]
push edx
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b8], 0x4008
call edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0xa8]
push ecx
mov dword [ebp - 0x1c0], 0x40d3ac
mov dword [ebp - 0x1c8], 0x8008
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpNe]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarAnd]
push eax
lea edx, [ebp - 0xb8]
push edx
call edi
push eax
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0xd8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCmpNe]
push eax
lea eax, [ebp - 0xe8]
push eax
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x1a8]
push edx
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
test di, di
je 0x51d426
mov ecx, dword [ebp - 0x24]
mov edi, dword [0x56e154]
mov edx, dword [ebp - 0x68]
inc ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x56e170]
cmp edx, dword [ecx + edi*4]
jge 0x51d3aa
test edx, edx
jle 0x51d3aa
mov ecx, dword [ebp - 0x50]
test ecx, ecx
jle 0x51d3ad
mov dword [ebp - 0x3c4], 0
jmp 0x51d3b7
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c4], 1
mov ebx, dword [0x56e18c]
xor eax, eax
cmp ecx, dword [ebx + edi*4]
mov edi, dword [ebp - 0x3c4]
setge al
or eax, edi
jne 0x51d411
lea ecx, [ebp - 0x268]
push ecx
push 0x40b744
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
lea ecx, [edx + eax*4]
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.005352d0
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.005372f0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x6c]
mov eax, 1
add ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], ecx
jmp 0x51ce32
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x68]
mov eax, 1
add ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], ecx
jmp 0x51ce32
mov ecx, 1
add edx, ecx
jmp 0x51ce16
mov ecx, 1
add eax, ecx
jmp 0x51cdf9
mov edi, dword [0x576040]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
cmp dword [edi + eax*4 - 0x30], 0x26
jle 0x51d623
mov eax, dword [0x56e1a4]
mov edi, dword [eax + 0x14]
mov ecx, esi
sub ecx, edi
imul ecx, dword [eax + 0x18]
mov edi, dword [eax + 0x1c]
mov eax, dword [eax + 0xc]
sub ecx, edi
add ecx, ebx
mov edx, 0x40b620
lea ecx, [eax + ecx*4]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, dword [0x57604c]
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0xc]
sub esi, edi
imul esi, dword [eax + 0x18]
sub esi, edx
mov edx, dword [ebp - 0x64]
add esi, ebx
mov dword [ecx + esi*4], edx
mov ecx, dword [ebp - 0x70]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov eax, dword [ebp - 0x1e4]
push eax
push 0x40ff18
call edi
test eax, eax
jne 0x51d623
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x576040]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov edi, dword [esi + edx*4 - 0x30]
lea eax, [esi + edx*4]
mov edx, 1
cmp edi, edx
jne 0x51d52f
mov dword [eax - 0x20], edx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
mov ecx, dword [esi + eax*4 - 0x34]
lea eax, [esi + eax*4]
lea edx, [ecx*4 + 1]
mov dword [eax - 0x24], edx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea edi, [esi + eax*4]
mov eax, dword [edi - 0x30]
cdq
mov ebx, 0xb
idiv ebx
test edx, edx
jne 0x51d572
inc dword [edi - 0x20]
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov edx, dword [esi + ecx*4 - 0x34]
lea eax, [esi + ecx*4]
mov ecx, dword [eax - 0x20]
lea edx, [ecx + edx*4]
mov dword [eax - 0x24], edx
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea ecx, [esi + eax*4]
mov esi, dword [0x576028]
mov ebx, dword [esi + 0x14]
mov eax, dword [ecx - 0x4c]
sub eax, ebx
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [ecx - 0x30]
cmp esi, dword [eax + edx*4 + 0x48]
jle 0x51d623
xor esi, esi
mov dword [ecx - 0x30], esi
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x90], 0x80020004
mov dword [ebp - 0x98], 0xa
call dword [sym.imp.MSVBVM60.DLL_rtcRandomNext]
fmul dword [0x4016fc]
fcomp dword [0x401f24]
fnstsw ax
test ah, 1
je 0x51d5e3
mov esi, 1
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
neg esi
test si, si
je 0x51d5fd
push 0x40ff0c
jmp 0x51d602
push 0x40fef4
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x576040]
lea ecx, [eax + edx*4 - 0x40]
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x70]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x51816e
mov ecx, dword [ebp - 0x58]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x58], ecx
jmp 0x518157
lea edx, [ecx*8]
sub edx, ecx
lea edx, [edx + edx*2]
push 0x40d540
lea eax, [eax + edx*4 - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov ecx, dword [ebp - 0x64]
mov edx, dword [0x576040]
mov esi, dword [0x576028]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
mov edi, dword [edx + ecx*4 - 0x44]
lea eax, [edx + ecx*4 - 0x44]
add edi, 0x64
mov dword [eax], edi
mov ecx, dword [ebp - 0x64]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea ecx, [edx + eax*4]
mov edx, dword [esi + 0x14]
mov eax, dword [ecx - 0x4c]
sub eax, edx
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*4 + 0x10]
cmp dword [ecx - 0x44], eax
jle 0x51d6c0
mov dword [ecx - 0x44], eax
wait
push 0x51d7bf
jmp 0x51d778
lea ecx, [ebp - 0x1e4]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
lea eax, [ebp - 0x268]
push eax
push 0x40b744
call esi
lea ecx, [ebp - 0x2ec]
push ecx
push 0x40b744
call esi
lea eax, [ebp - 0x1cc]
push eax
lea edx, [ebp - 0x3c]
push 0
mov dword [ebp - 0x1cc], edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret