Function at 0x458fc0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c754d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x250
mov eax, dword [0x502054]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x180], ecx
mov byte [ebp - 0x174], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 4], 1
sub esp, 8
lea ecx, [ebp - 0x1ac]
call fcn.0045fe20
lea ecx, [ebp - 0x15c]
push ecx
push 0x4dd30c
mov eax, dword [eax + 8]
push 1
push 0
push 0x4dd32c
call eax
test eax, eax
jns 0x459073
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x1e8]
mov eax, dword [ebp - 0x15c]
mov ecx, esp
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x4590ec
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
mov dword [ebp - 0x160], 0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x15c]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x459157
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459126
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
mov dword [ebp - 0x168], 0
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 0x160]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x4591d7
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x459192
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x4591a6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x1bc]
mov dword [ebp - 0x1bc], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x459251
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45920c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459220
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
xor esi, esi
lea ecx, [esi + 3]
cmp dword [ebp - 0x1bc], esi
jle 0x4594f6
nop dword [eax]
nop word [eax + eax]
mov word [ebp - 0x1e8], cx
lea eax, [esi + 1]
mov dword [ebp - 0x1e0], eax
lea ecx, [ebp - 0x170]
movups xmm0, xmmword [ebp - 0x1e8]
mov esi, eax
mov dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x168]
push ecx
sub esp, 0x10
mov dword [ebp - 0x19c], esi
mov ecx, esp
mov edx, dword [eax]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x20]
test eax, eax
js 0x4594e4
mov esi, dword [ebp - 0x170]
push 0xc
call fcn.004a9d6b
mov edi, eax
add esp, 4
mov dword [ebp - 0x1a0], edi
mov byte [ebp - 4], 0x11
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x12
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_ITaskFolder__.0
mov dword [edi + 4], 0x4646dd
mov dword [edi + 8], esi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1f4], edi
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x16c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x4594cb
mov esi, dword [ebp - 0x16c]
push 0xc
call fcn.004a9d6b
mov edi, eax
add esp, 4
mov dword [ebp - 0x1f8], edi
mov byte [ebp - 4], 0x14
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x15
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [edi + 4], eax
mov dword [edi + 8], esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1f0], edi
mov byte [ebp - 4], 0x16
call fcn.00456f20
mov ecx, eax
test ecx, ecx
je 0x45a4b3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x158]
mov esi, dword [ebp - 0x17c]
push esi
call fcn.00460eb0
test al, al
jne 0x4593cc
test esi, esi
jne 0x4593ab
xor ecx, ecx
jmp 0x4593bf
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4593b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x158]
call fcn.00461210
mov byte [ebp - 4], 0x18
mov ecx, 0x4ec208
mov eax, dword [ebp - 0x158]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x459406
test dx, dx
je 0x459402
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x459406
add eax, 4
add ecx, 4
test dx, dx
jne 0x4593e0
xor eax, eax
jmp 0x45940b
sbb eax, eax
or eax, 1
test eax, eax
je 0x459421
push 1
push 0x4ec208
lea ecx, [ebp - 0x158]
call fcn.00461400
mov edx, dword [ebp - 0x16c]
test edx, edx
jne 0x45942f
xor ecx, ecx
jmp 0x459443
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459434
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x158]
call fcn.00461400
mov esi, dword [ebp - 0x158]
cmp dword [esi - 4], 1
jle 0x459470
push dword [esi - 0xc]
lea ecx, [ebp - 0x158]
call fcn.00460f70
mov esi, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.00458fc0
mov ecx, dword [ebp - 0x174]
test al, al
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x174], ecx
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4594b2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov edi, dword [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov esi, dword [ebp - 0x19c]
cmp esi, dword [ebp - 0x1bc]
jge 0x4594f6
mov ecx, 3
jmp 0x459270
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x184]
push edx
mov dword [ebp - 0x184], 0
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
test eax, eax
jns 0x459572
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45952d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459541
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
mov esi, dword [ebp - 0x184]
push 0xc
call fcn.004a9d6b
mov edi, eax
add esp, 4
mov dword [ebp - 0x1f4], edi
mov byte [ebp - 4], 0x1d
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x1e
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IRegisteredTaskCollection__.0
mov dword [edi + 4], 0x4646dd
mov dword [edi + 8], esi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x238], edi
mov byte [ebp - 4], 0x1f
lea edx, [ebp - 0x1d4]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1d4], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x459643
mov byte [ebp - 4], 0xa
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4595fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459612
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a488
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a488
xor eax, eax
cmp dword [ebp - 0x1d4], eax
jle 0x45a425
inc eax
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x1e0], eax
mov ecx, 3
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x188]
mov word [ebp - 0x1e8], cx
mov ecx, dword [ebp - 0x184]
movups xmm0, xmmword [ebp - 0x1e8]
push eax
sub esp, 0x10
mov edx, dword [ecx]
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x20]
test eax, eax
js 0x45a40d
mov esi, dword [ebp - 0x188]
push 0xc
call fcn.004a9d6b
mov edi, eax
add esp, 4
mov dword [ebp - 0x1f0], edi
mov byte [ebp - 4], 0x23
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x24
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IRegisteredTask__.0
mov dword [edi + 4], 0x4646dd
mov dword [edi + 8], esi
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20c], edi
mov byte [ebp - 4], 0x25
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x194], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x45a3fa
mov esi, dword [ebp - 0x194]
push 0xc
call fcn.004a9d6b
add esp, 4
mov dword [ebp - 0x170], eax
mov byte [ebp - 4], 0x26
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x27
mov ecx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [eax], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1c0], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
test eax, eax
js 0x45a3e1
mov esi, dword [ebp - 0x1c0]
push 0xc
call fcn.004a9d6b
add esp, 4
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 4], 0x29
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x2a
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_ITaskDefinition__.0
mov dword [eax + 4], 0x4646dd
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x254], eax
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x18c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x45a3c8
mov esi, dword [ebp - 0x18c]
push 0xc
call fcn.004a9d6b
add esp, 4
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 4], 0x2c
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x2d
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IActionCollection__.0
mov dword [eax + 4], 0x4646dd
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0x2e
lea edx, [ebp - 0x1cc]
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1cc], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x45a3af
xor eax, eax
cmp dword [ebp - 0x1cc], eax
jle 0x45a3af
nop dword [eax]
lea edx, [eax + 1]
mov dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x18c]
lea esi, [ebp - 0x178]
push esi
push edx
push eax
mov ecx, dword [eax]
mov dword [ebp - 0x200], edx
call dword [ecx + 0x20]
test eax, eax
js 0x45a397
mov esi, dword [ebp - 0x178]
push 0xc
call fcn.004a9d6b
mov edi, eax
add esp, 4
mov dword [ebp - 0x24c], edi
mov byte [ebp - 4], 0x2f
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x30
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IAction__.0
mov dword [edi + 4], 0x4646dd
mov dword [edi + 8], esi
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x234], edi
mov byte [ebp - 4], 0x31
lea edx, [ebp - 0x1fc]
mov eax, dword [ebp - 0x178]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x45a384
mov eax, dword [ebp - 0x1fc]
test eax, eax
je 0x459d70
cmp eax, 5
jne 0x45a384
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x164]
push edx
mov dword [ebp - 0x164], 0
push 0x4dd31c
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x45a384
mov esi, dword [ebp - 0x164]
push 0xc
call fcn.004a9d6b
add esp, 4
mov dword [ebp - 0x208], eax
mov byte [ebp - 4], 0x4c
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x4d
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IComHandlerAction__.0
mov dword [eax + 4], 0x4646dd
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x31
mov esi, eax
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x190], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x45a371
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a371
push 0xc
call fcn.004a9d6b
add esp, 4
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 0x4f
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x50
mov ecx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x154]
mov dword [eax], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [eax + 8], ecx
mov byte [ebp - 4], 0x4e
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x22c], eax
call fcn.00456f20
mov ecx, eax
test ecx, ecx
je 0x45a4b3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x228], eax
call fcn.00456f20
mov ecx, eax
test ecx, ecx
je 0x45a4b3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1b8], 2
test eax, eax
je 0x459a63
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x459a54
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x1b4]
call fcn.00461210
mov edx, dword [ebp - 0x194]
test edx, edx
jne 0x459a83
xor ecx, ecx
jmp 0x459aa3
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459a90
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1b0]
call fcn.00461210
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
push str.InprocServer32
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x90], 0
movups xmmword [ebp - 0xa4], xmm0
call fcn.004631a0
mov byte [ebp - 4], 0x57
xorps xmm0, xmm0
mov edx, dword [ebp - 0x190]
mov ecx, edx
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459b13
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xbc]
call fcn.004631a0
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0xa4]
push eax
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x134]
call fcn.0045b600
add esp, 4
mov byte [ebp - 4], 0x59
cmp dword [eax + 0x14], 8
jb 0x459b5e
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x14c]
call fcn.00457650
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x1b8]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a540
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x14c]
call fcn.00460b90
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x134]
call fcn.00460b90
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0xbc]
call fcn.00460b90
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0xa4]
call fcn.00460b90
cmp byte [ebp - 0x14d], 0
jne 0x459cf3
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
push str.InprocServer32
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x74], xmm0
call fcn.004631a0
mov byte [ebp - 4], 0x5b
xorps xmm0, xmm0
mov edx, dword [ebp - 0x190]
mov ecx, edx
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459c26
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x8c]
call fcn.004631a0
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xec]
call fcn.0045b600
add esp, 4
mov byte [ebp - 4], 0x5d
cmp dword [eax + 0x14], 8
jb 0x459c6e
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x11c]
call fcn.00457650
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x1b8]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a540
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x11c]
call fcn.00460b90
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0xec]
call fcn.00460b90
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x8c]
call fcn.00460b90
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x74]
call fcn.00460b90
mov edx, dword [ebp - 0x174]
mov ecx, 1
cmp byte [ebp - 0x14d], 0
movzx eax, dl
cmovne eax, ecx
mov byte [ebp - 0x174], al
mov byte [ebp - 4], 0x5f
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0x5f
or eax, 0xffffffff
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x459d25
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0x51
or eax, 0xffffffff
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x459d57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x1ec]
jmp 0x45a36a
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x164]
push edx
mov dword [ebp - 0x164], 0
push str.MbLk
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x45a384
mov esi, dword [ebp - 0x164]
push 0xc
call fcn.004a9d6b
add esp, 4
mov dword [ebp - 0x204], eax
mov byte [ebp - 4], 0x32
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x33
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IExecAction__.0
mov dword [eax + 4], 0x4646dd
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x31
mov esi, eax
mov dword [ebp - 0x214], esi
mov byte [ebp - 4], 0x34
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x198], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x45a371
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a371
push 0xc
call fcn.004a9d6b
mov ecx, eax
add esp, 4
mov dword [ebp - 0x158], ecx
mov byte [ebp - 4], 0x35
mov dword [ecx], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x36
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [ecx], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [ecx + 8], eax
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 0x37
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x164]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
test eax, eax
js 0x45a356
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a356
push 0xc
call fcn.004a9d6b
mov ecx, eax
add esp, 4
mov dword [ebp - 0x16c], ecx
mov byte [ebp - 4], 0x38
mov dword [ecx], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x39
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [ecx], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [ecx + 8], eax
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x240], ecx
mov byte [ebp - 4], 0x3a
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x164]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x45a33b
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a33b
push 0xc
call fcn.004a9d6b
mov ecx, eax
add esp, 4
mov dword [ebp - 0x19c], ecx
mov byte [ebp - 4], 0x3b
mov dword [ecx], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x3c
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [ecx], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [ecx + 8], eax
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x244], ecx
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x210], eax
call fcn.00456f20
mov ecx, eax
test ecx, ecx
je 0x45a4b3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x25c], eax
call fcn.00456f20
mov ecx, eax
test ecx, ecx
je 0x45a4b3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1ac], 2
test eax, eax
jne 0x459fcd
xor ecx, ecx
jmp 0x459fe7
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459fd2
mov eax, dword [ebp - 0x17c]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00461210
mov edx, dword [ebp - 0x194]
test edx, edx
jne 0x45a002
xor ecx, ecx
jmp 0x45a023
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a010
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1a4]
call fcn.00461210
mov edx, dword [ebp - 0x1c4]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a056
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.004631a0
mov byte [ebp - 4], 0x43
cmp dword [ebp - 0x198], 0
je 0x45a143
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push 0x4ed874
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
call fcn.004631a0
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x34]
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.00460d30
mov byte [ebp - 4], 0x43
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x45a101
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45a0f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a4ae
push ecx
push edx
call fcn.004aa103
add esp, 8
mov edx, dword [ebp - 0x198]
xor eax, eax
mov ecx, edx
mov word [ebp - 0x44], ax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a126
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00460d30
mov eax, dword [ebp - 0x1c8]
mov edx, 0x4ec298
test eax, eax
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
cmovne edx, eax
mov ecx, edx
movups xmmword [ebp - 0x5c], xmm0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a173
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.004631a0
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00460d30
cmp dword [ebp - 0x48], 8
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0xd4]
cmovae edx, dword [ebp - 0x5c]
call fcn.00457650
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x1ac]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a540
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xd4]
call fcn.00460b90
cmp byte [ebp - 0x14d], 0
jne 0x45a25e
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x104]
cmovae edx, dword [ebp - 0x2c]
call fcn.00457650
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1ac]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a540
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x104]
call fcn.00460b90
mov edx, dword [ebp - 0x174]
mov eax, 1
cmp byte [ebp - 0x14d], 0
movzx ecx, dl
cmovne ecx, eax
mov byte [ebp - 0x174], cl
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x5c]
call fcn.00460b90
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x45a2a8
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45a29e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a4ae
push ecx
push edx
call fcn.004aa103
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x218], eax
mov byte [ebp - 4], 0x48
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45a2ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x3d
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45a320
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x19c]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x19c]
push 1
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x16c]
push 1
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x31
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x2e
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x1cc]
jl 0x459850
mov edi, dword [ebp - 0x1f0]
mov byte [ebp - 4], 0x2b
mov esi, dword [ebp - 0x1a0]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x28
mov esi, dword [ebp - 0x1d0]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x25
mov esi, dword [ebp - 0x170]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x1f
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x1d4]
jl 0x459651
mov edi, dword [ebp - 0x1f4]
mov byte [ebp - 4], 0xa
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45a44c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x45a460
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x15c]
test ecx, ecx
je 0x45a488
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov edx, dword [ebp - 0x174]
mov al, dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a9913
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b3474
push 0x80004005
call fcn.00456c70
int3