Function at 0x460ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5faeff
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x6f1550]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xbc]
mov eax, dword [ebx + 4]
mov edi, ecx
push eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
jne 0x460f5a
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
mov ecx, ebx
call fcn.005aad23
jmp 0x460f71
mov esi, dword [sym.imp.USER32.dll_RemoveMenu]
mov ecx, dword [ebx + 4]
push 0x400
push 0
push ecx
call esi
test eax, eax
jne 0x460f60
mov eax, dword [edi + 0x26c]
xor esi, esi
test eax, eax
jle 0x460fb2
lea ecx, [ecx]
test esi, esi
jl 0x461175
cmp esi, dword [edi + 0x26c]
jge 0x461175
mov edx, dword [edi + 0x268]
lea eax, [edx + esi*4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
add esi, 1
cmp esi, dword [edi + 0x26c]
jl 0x460f80
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x264]
call fcn.00434160
push 0xffffffffffffffff
lea ecx, [edi + 0x278]
push 0
mov dword [esp + 0x68], ecx
call fcn.0045aae0
cmp dword [edi + 0x234], 2
mov eax, dword [edi + 0x168]
mov dword [esp + 0x54], 0
mov dword [esp + 0x30], eax
jne 0x461981
xor ebp, ebp
mov dword [esp + 0x44], 0x814c
mov dword [esp + 0x1c], ebp
mov dword [esp + 0xb4], 1
mov esi, dword [esp + 0x48]
mov eax, dword [esi + 0xec]
cmp eax, ebp
je 0x4616c4
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x4616c4
mov dword [esp + 0x14], ebp
mov byte [esp + 0xb4], 3
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push ebp
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4616ac
jmp 0x461060
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.00486640
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x90], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x94], edx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x90]
push 0x615cd0
push eax
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa4], edx
call fcn.00401260
add esp, 0x10
test eax, eax
jne 0x46129b
lea ecx, [esp + 0x88]
push 0x616efc
push ecx
call fcn.00401260
add esp, 8
test eax, eax
jne 0x46129b
lea edx, [esp + 0x88]
push 0x61dc30
push edx
call fcn.00401260
add esp, 8
test eax, eax
je 0x461678
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x50]
call fcn.00457590
mov byte [esp + 0xb4], 0x18
mov eax, dword [esp + 0x4c]
cmp eax, ebp
je 0x461285
mov ecx, dword [eax]
lea edx, [esp + 0x74]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
cmp dword [esp + 0x74], ebp
jle 0x461285
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x23]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
push 0x20
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x70], eax
mov byte [esp + 0xb4], 0x19
cmp eax, ebp
je 0x46117a
cmp byte [esp + 0x23], 0
mov ecx, 0x61dc24
jne 0x461165
mov ecx, 0x61dc18
push ebp
push ecx
push 0x8214
mov ecx, eax
call fcn.0045da30
jmp 0x46117c
call fcn.005a2358
xor eax, eax
mov byte [esp + 0xb4], 0x18
mov cl, byte [esp + 0x23]
mov edi, dword [esp + 0x18]
neg cl
push ebp
push eax
sbb ecx, ecx
and ecx, 0xfffffff8
add ecx, 8
push ecx
mov ecx, edi
call fcn.00430020
mov ecx, edi
call fcn.0042e530
mov eax, dword [esp + 0x4c]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
lea ecx, [esp + 0x84]
push ecx
push eax
call edx
xor esi, esi
cmp dword [esp + 0x74], ebp
jle 0x461285
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esp + 0x54], 1
lea ecx, [esp + 0x6c]
call fcn.00401a30
mov byte [esp + 0xb4], 0x1a
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x68]
push edx
mov dword [esp + 0x6c], ebp
mov ecx, dword [eax]
push esi
push eax
mov eax, dword [ecx + 0x18]
call eax
mov ecx, dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x70]
call fcn.00405fe0
mov edx, dword [esp + 0x68]
push edx
call ebx
push 0x20
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x70], eax
mov byte [esp + 0xb4], 0x1b
cmp eax, ebp
je 0x461241
mov ecx, dword [esp + 0x6c]
push ebp
push ecx
lea edx, [esi + 0x8215]
push edx
mov ecx, eax
call fcn.0045da30
jmp 0x461243
xor eax, eax
mov byte [esp + 0xb4], 0x1a
push ebp
push eax
xor eax, eax
cmp dword [esp + 0x8c], esi
mov ecx, edi
setne al
sub eax, 1
and eax, 8
push eax
call fcn.00430020
mov byte [esp + 0xb4], 0x18
lea ecx, [esp + 0x6c]
call fcn.00401aa0
add esi, 1
cmp esi, dword [esp + 0x74]
jl 0x4611d5
mov byte [esp + 0xb4], 3
lea ecx, [esp + 0x4c]
call fcn.00456d10
jmp 0x461678
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x40]
call fcn.00457440
mov byte [esp + 0xb4], 4
cmp dword [esp + 0x3c], ebp
je 0x461651
mov dword [esp + 0x24], ebp
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x40], ebp
mov dword [esp + 0x64], ebp
mov byte [esp + 0xb4], 6
mov dword [esp + 0x58], ebp
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x24]
push ecx
push eax
call edx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x24]
xor ebx, ebx
cmp eax, ebp
jbe 0x46160b
lea ecx, [ecx]
mov eax, dword [esp + 0x60]
mov esi, dword [eax + 4]
cmp esi, dword [eax + 8]
mov edi, dword [esp + 0x3c]
jb 0x461333
lea ecx, [esi + 1]
push ecx
mov ecx, eax
call fcn.0040c6d0
test al, al
je 0x461831
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
lea eax, [eax + esi*4]
cmp eax, ebp
mov dword [esp + 0x34], eax
je 0x46135a
cmp edi, ebp
mov dword [eax], edi
je 0x461352
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
push edi
call edx
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x60]
add dword [eax + 4], 1
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x58]
push edx
lea edx, [esp + 0x68]
push edx
lea edx, [esp + 0x48]
push edx
lea edx, [esp + 0x84]
push edx
lea edx, [esp + 0x6c]
push edx
lea edx, [esp + 0x90]
push edx
push ebp
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebp
mov dword [esp + 0x5c], ebp
mov ecx, dword [eax]
push ebx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ecx, dword [esp + 0x78]
cmp ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x44]
je 0x4613c6
cmp edi, dword [esp + 0x70]
jbe 0x4613c6
mov ecx, dword [esp + 0x18]
call fcn.0042e530
cmp dword [esp + 0x40], ebp
mov edx, dword [esp + 0x78]
mov dword [esp + 0x80], edx
jne 0x46144f
push str.Unknown_Stream
lea ecx, [esp + 0x3c]
call fcn.00412bf0
mov byte [esp + 0xb4], 0xb
mov eax, dword [esp + 0x38]
mov eax, dword [eax - 0xc]
lea ecx, [eax + eax + 8]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
lea ecx, [ebx + 1]
cmp ecx, 0x3e7
mov dword [esp + 0x40], eax
jb 0x461413
mov ecx, 0x3e7
mov edx, dword [esp + 0x38]
push ecx
push edx
push 0x61dbec
push eax
call fcn.00453590
add esp, 0x10
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46144f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x30]
call fcn.00418ef0
mov byte [esp + 0xb4], 0xd
mov eax, dword [esp + 0x2c]
mov esi, dword [eax - 0xc]
push 0x2f
push eax
call fcn.005c282c
add esp, 8
cmp eax, ebp
jne 0x461480
or eax, 0xffffffff
jmp 0x461484
sub eax, dword [esp + 0x2c]
sub esi, eax
sub esi, 1
push esi
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x34]
call fcn.0042eb10
mov byte [esp + 0xb4], 0xe
push eax
lea ecx, [esp + 0x30]
call fcn.004044c0
mov byte [esp + 0xb4], 0xd
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4614d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [esp + 0x7c]
test al, 2
push 0x20
je 0x461527
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x10
cmp eax, ebp
je 0x461517
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
push edi
mov ecx, eax
call fcn.0045da30
add edi, 1
mov dword [esp + 0x44], edi
mov byte [esp + 0xb4], 0xd
push ebp
push eax
push 8
jmp 0x461596
xor eax, eax
mov byte [esp + 0xb4], 0xd
push ebp
push eax
push 8
jmp 0x461596
test al, 1
je 0x46155a
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x11
cmp eax, ebp
je 0x461589
mov edx, dword [esp + 0x2c]
push ebp
push edx
push edi
mov ecx, eax
call fcn.0045da30
add edi, 1
mov dword [esp + 0x44], edi
jmp 0x46158b
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x12
cmp eax, ebp
je 0x461589
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
push edi
mov ecx, eax
call fcn.0045da30
add edi, 1
mov dword [esp + 0x44], edi
jmp 0x46158b
xor eax, eax
mov byte [esp + 0xb4], 0xd
push ebp
push eax
push ebp
mov ecx, dword [esp + 0x24]
call fcn.00430020
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4615d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x64]
add ebx, 1
cmp eax, ebp
je 0x4615e9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x64], ebp
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x4615fd
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x58], ebp
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x461310
cmp eax, ebp
jne 0x461621
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x461621
mov dword [esp + 0x3c], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xb4], 6
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x461639
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xb4], 4
mov eax, dword [esp + 0x64]
cmp eax, ebp
je 0x461651
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esp + 0x30], ebp
je 0x461660
mov ecx, dword [esp + 0x18]
call fcn.0042e530
mov byte [esp + 0xb4], 3
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x461678
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x46168c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push ebp
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x461060
mov esi, dword [esp + 0x48]
mov byte [esp + 0xb4], 1
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4616c4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x4616df
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0xec]
push eax
push 0x615d80
call fcn.00487b80
add esp, 8
mov dword [esp + 0x28], ebp
mov dword [esp + 0xb4], 0x1f
cmp eax, ebp
je 0x461717
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x61d498
push eax
mov eax, dword [ecx]
call eax
mov dword [esp + 0xb4], 0x20
mov ecx, dword [esp + 0x28]
cmp ecx, ebp
jne 0x461781
mov eax, dword [esi + 0xec]
push eax
push str.D3CD7858_971A_4838_ACEC_40CA5D529DC8
call fcn.00487e70
mov ecx, dword [esp + 0x30]
add esp, 8
cmp ecx, eax
je 0x461777
mov esi, ecx
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x28], ecx
je 0x461767
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x61d498
push eax
mov eax, dword [ecx]
call eax
mov ecx, dword [esp + 0x28]
cmp esi, ebp
je 0x461777
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov ecx, dword [esp + 0x28]
cmp ecx, ebp
je 0x461966
xor ebp, ebp
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
push ecx
call eax
test eax, eax
jl 0x461966
cmp dword [esp + 0x1c], 1
jbe 0x461966
cmp dword [esp + 0x54], 0
je 0x4617b5
mov ecx, dword [esp + 0x18]
call fcn.0042e530
xor ebp, ebp
cmp dword [esp + 0x1c], ebp
mov edi, 0x68
jle 0x461966
mov bl, 0x21
mov eax, dword [esp + 0x28]
xor ecx, ecx
push ecx
push ecx
lea esi, [esp + 0x2c]
push esi
push ecx
push ecx
lea esi, [esp + 0x68]
push esi
push ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x70], ecx
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
jl 0x461966
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00418ef0
mov byte [esp + 0xb4], bl
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
mov esi, dword [eax - 0xc]
push 0x2f
push eax
call fcn.005c282c
add esp, 8
test eax, eax
jne 0x46183b
or eax, 0xffffffff
jmp 0x46183f
push 0x8007000e
call fcn.00401480
sub eax, dword [esp + 0x14]
sub esi, eax
sub esi, 1
push esi
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042eb10
mov byte [esp + 0xb4], 0x22
push eax
lea ecx, [esp + 0x18]
call fcn.004044c0
mov byte [esp + 0xb4], bl
lea ecx, [esp + 0x50]
call fcn.00401aa0
mov al, byte [esp + 0x54]
test al, 2
push 0x20
je 0x4618c9
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x5c], eax
mov byte [esp + 0xb4], 0x23
test eax, eax
je 0x4618ba
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edi
mov ecx, eax
call fcn.0045da30
add edi, 1
mov byte [esp + 0xb4], bl
push 0
push eax
push 8
jmp 0x46193f
xor eax, eax
mov byte [esp + 0xb4], bl
push eax
push eax
push 8
jmp 0x46193f
test al, 1
je 0x461905
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x5c], eax
mov byte [esp + 0xb4], 0x24
test eax, eax
je 0x4618ba
mov edx, dword [esp + 0x14]
push 0
push edx
push edi
mov ecx, eax
call fcn.0045da30
add edi, 1
mov byte [esp + 0xb4], bl
push 0
push eax
push 8
jmp 0x46193f
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x5c], eax
mov byte [esp + 0xb4], 0x25
test eax, eax
je 0x461931
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edi
mov ecx, eax
call fcn.0045da30
add edi, 1
jmp 0x461933
xor eax, eax
mov byte [esp + 0xb4], bl
push 0
push eax
push 0
mov ecx, dword [esp + 0x24]
call fcn.00430020
mov byte [esp + 0xb4], 0x20
lea ecx, [esp + 0x14]
call fcn.00401aa0
add ebp, 1
cmp ebp, dword [esp + 0x1c]
jl 0x4617c8
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x461981
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x48]
cmp dword [eax + 0x234], 2
jne 0x461c80
cmp byte [eax + 0x249], 0
jne 0x461c80
cmp dword [eax + 0x188], 0
je 0x461c80
mov edi, dword [esp + 0x30]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x8214
je 0x461c80
nop
xor eax, eax
cmp edi, ebp
setne al
cmp eax, ebp
je 0x461caa
mov eax, edi
mov ebx, dword [eax + 8]
cmp ebx, ebp
mov edi, dword [edi]
mov dword [esp + 0x30], edi
mov dword [esp + 0x5c], ebx
je 0x4619ea
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
push ebx
call edx
mov dword [esp + 0xb4], 0x29
cmp ebx, ebp
jne 0x461a09
mov dword [esp + 0xb4], 0xffffffff
jmp 0x461c78
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
push ebx
mov dword [esp + 0x3c], ebp
call ecx
cmp eax, ebp
mov dword [esp + 0x50], eax
jle 0x461c06
lea edi, [esi - 0x8214]
mov ecx, dword [esp + 0x38]
push ebp
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], ebp
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
push ecx
push ebx
call edx
test eax, eax
jl 0x461b4e
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.00418ef0
mov byte [esp + 0xb4], 0x2b
push 0x61dbe8
push 0x61976c
lea ecx, [esp + 0x24]
call fcn.0040f2e0
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + 0x180]
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
push 0x20
jne 0x461ace
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x2c
cmp eax, ebp
je 0x461abe
mov edx, dword [esp + 0x1c]
push ebp
push edx
push esi
mov ecx, eax
call fcn.0045da30
add esi, 1
add edi, 1
mov byte [esp + 0xb4], 0x2b
push ebp
push eax
push 8
jmp 0x461b09
xor eax, eax
mov byte [esp + 0xb4], 0x2b
push ebp
push eax
push 8
jmp 0x461b09
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x2d
cmp eax, ebp
je 0x461afc
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
push esi
mov ecx, eax
call fcn.0045da30
add esi, 1
add edi, 1
jmp 0x461afe
xor eax, eax
mov byte [esp + 0xb4], 0x2b
push ebp
push eax
push ebp
mov ecx, dword [esp + 0x24]
call fcn.00430020
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esp + 0xb4], 0x29
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x461bf1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x461bf1
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + 0x180]
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
push 0x20
jne 0x461bad
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x2f
cmp eax, ebp
je 0x461b9d
push ebp
push 0x61dbe0
push esi
mov ecx, eax
call fcn.0045da30
add esi, 1
add edi, 1
mov byte [esp + 0xb4], 0x29
push ebp
push eax
push 8
jmp 0x461be8
xor eax, eax
mov byte [esp + 0xb4], 0x29
push ebp
push eax
push 8
jmp 0x461be8
call fcn.0059b02f
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x30
cmp eax, ebp
je 0x461bdb
push ebp
push 0x61dbe0
push esi
mov ecx, eax
call fcn.0045da30
add esi, 1
add edi, 1
jmp 0x461bdd
xor eax, eax
mov byte [esp + 0xb4], 0x29
push ebp
push eax
push ebp
mov ecx, dword [esp + 0x24]
call fcn.00430020
mov eax, dword [esp + 0x38]
add eax, 1
cmp eax, dword [esp + 0x50]
mov dword [esp + 0x38], eax
jl 0x461a27
cmp dword [esp + 0x30], ebp
je 0x461c61
mov edx, dword [esp + 0x30]
cmp dword [edx + 8], ebp
je 0x461c61
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x98]
push ecx
push ebx
call edx
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x88]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.00401260
add esp, 8
test eax, eax
jne 0x461c61
mov ecx, dword [esp + 0x18]
call fcn.0042e530
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
push ebx
call ecx
mov edi, dword [esp + 0x30]
cmp edi, ebp
jne 0x4619c0
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005bf6a4
add esp, 0xa4
ret 4
push 0x80004005
call fcn.00401480
int3