Function at 0x404e10
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6dc
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 0x28]
mov eax, dword [eax + 0x14]
mov dword [esi], 1
mov dword [esi + 0xc], 0x8000
mov dword [ebp - 0x66c], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x65c], edi
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x680], eax
call eax
mov dword [esi + 0x10], 0
mov dword [esi + 8], eax
sub esp, 0xc
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
movzx edx, word [edi + 0x50]
cmp dx, 0xee
ja case.0x404ece.3
cmp dx, 0x7f
jbe 0x4051a0
lea eax, [edx - 0x80]
cmp ax, 0x6e
ja case.0x404ece.3
movzx eax, ax
jmp dword [eax*4 + 0x417bb0]
mov ebx, 0x36a
mov dword [esp + 8], ebx
mov dword [esp + 4], str._rtf1_ansi_ansicpg_ddeff0
lea eax, [ebp - 0x418]
mov dword [esp], eax
mov edi, eax
mov dword [ebp - 0x664], eax
call sym._sprintf
mov edx, edi
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405190
mov edx, str._fonttbl
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405190
mov eax, dword [ebp - 0x65c]
xor ebx, ebx
mov dword [ebp - 0x660], 0
mov eax, dword [eax + 0x84]
test eax, eax
je 0x4051e3
mov dword [ebp + 0xc], esi
mov esi, dword [ebp - 0x664]
jmp 0x404fc6
mov eax, str.roman
cmp dl, 0x10
je 0x404f6a
cmp dl, 0x20
mov eax, 0x4176ea
mov edx, str.swiss
cmove eax, edx
lea edx, [edi + 0x1c]
and ecx, 0xf
mov dword [esp + 0x18], edx
movzx edx, byte [edi + 0x17]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str._f_d_f_s_fprq_d_fcharset_d__s_
mov dword [esp], esi
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405190
mov eax, dword [ebp - 0x65c]
add dword [ebp - 0x660], 0x44
add ebx, 1
cmp dword [eax + 0x84], ebx
jbe 0x4051e0
mov eax, dword [ebp - 0x65c]
mov edi, dword [ebp - 0x660]
add edi, dword [eax + 0x88]
movzx ecx, byte [edi + 0x1b]
mov edx, ecx
and edx, 0xfffffff0
cmp dl, 0x30
je 0x4051d0
jbe 0x404f50
mov eax, str.script
cmp dl, 0x40
je 0x404f6a
cmp dl, 0x50
mov eax, 0x4176ea
mov edx, str.decor
cmove eax, edx
jmp 0x404f6a
mov ebx, 0x551
jmp 0x404eda
mov esi, dword [ebp + 0xc]
mov edx, 0x417587
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405190
mov eax, dword [ebp - 0x65c]
mov ecx, 0xffffffff
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x69c], 0
movzx edi, word [eax + 0x4c]
mov word [ebp - 0x660], di
mov edi, esi
mov eax, dword [ebp - 0x66c]
cmp word [ebp - 0x660], 0x10
lea ebx, [eax - 0xc]
ja 0x4053c8
mov eax, dword [ebp - 0x65c]
xor edx, edx
movzx esi, word [eax + 0x54]
mov eax, ebx
div esi
mov dword [ebp - 0x674], eax
cmp ecx, eax
je 0x40509f
cmp ecx, 0xffffffff
je 0x40509f
mov dword [ebp - 0x66c], ebx
sub edx, 0xc
mov eax, dword [ebp - 0x65c]
mov esi, dword [ebp - 0x674]
cmp dword [eax + 0x78], esi
jbe 0x4072a4
mov esi, dword [ebp - 0x65c]
mov ebx, dword [ebp - 0x674]
mov eax, dword [esi + 0x70]
mov esi, dword [esi + 0x74]
add edx, dword [eax + ebx*4]
lea eax, [edx + 0x15]
mov dword [ebp - 0x678], edx
mov dword [ebp - 0x694], eax
cmp eax, esi
jae 0x4072dc
cmp ecx, dword [ebp - 0x674]
mov eax, 0
cmove eax, dword [ebp - 0x68c]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x678]
movzx eax, byte [eax + 0x14]
cmp al, 2
je 0x4053e0
jbe 0x405350
cmp al, 0x20
je 0x40511c
cmp al, 0x23
jne 0x405358
mov ecx, dword [ebp - 0x678]
movzx ebx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
movzx edx, byte [ecx]
shl ebx, 8
add ebx, eax
movzx eax, byte [ecx + 1]
shl ebx, 0x10
shl eax, 8
add eax, edx
movzx eax, ax
add ebx, eax
lea eax, [ecx + ebx]
cmp esi, eax
cmovae esi, eax
lea eax, [ecx + 0x19]
mov dword [ebp - 0x668], eax
cmp esi, eax
jae 0x405400
test byte [0x416010], 4
je 0x405190
mov dword [esp + 0xc], str.header_too_small_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x4e4
cmp dx, 1
jbe 0x404eda
cmp dx, 0x4d
jne case.0x404ece.3
mov dword [esp + 8], 0x41773e
mov dword [esp + 4], str._rtf1_sdeff0
jmp 0x404ee6
mov eax, str.modern
jmp 0x404f6a
mov esi, dword [ebp + 0xc]
mov edx, 0x417587
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405190
mov edx, str.colortbl___red0green128_blue0_
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405190
mov eax, dword [ebp - 0x65c]
xor ebx, ebx
xor edi, edi
mov eax, dword [eax + 0x84]
test eax, eax
je 0x405020
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp - 0x65c]
mov esi, dword [ebp - 0x664]
jmp 0x405248
mov ecx, dword [ebp - 0x660]
add edi, 1
add ebx, 0x44
cmp dword [ecx + 0x84], edi
jbe 0x40501d
mov eax, dword [ecx + 0x88]
mov dword [ebp - 0x660], ecx
mov eax, dword [eax + ebx + 0x40]
mov dword [esp + 4], str._red_dgreen_d_blue_d_
mov dword [esp], esi
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov dword [esp + 0x10], edx
movzx edx, ah
movzx eax, al
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405230
jmp 0x405190
mov ebx, 0x4e2
jmp 0x404eda
mov ebx, 0x4e4
test byte [0x416010], 1
je 0x404eda
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unsupported_charset__u_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x404eda
mov ebx, 0x3a4
jmp 0x404eda
mov ebx, 0x3b5
jmp 0x404eda
mov ebx, 0x3a8
jmp 0x404eda
mov ebx, 0x3b6
jmp 0x404eda
mov ebx, 0x4e5
jmp 0x404eda
mov ebx, 0x4e6
jmp 0x404eda
mov ebx, 0x4ea
jmp 0x404eda
mov ebx, 0x4e7
jmp 0x404eda
mov ebx, 0x4e8
jmp 0x404eda
mov ebx, 0x4e9
jmp 0x404eda
mov ebx, 0x4e3
jmp 0x404eda
cmp al, 1
je 0x40511c
test byte [0x416010], 2
jne 0x406514
mov esi, dword [ebp - 0x678]
movzx eax, byte [esi + 0xf]
movzx edx, byte [esi + 0xe]
movzx ecx, byte [esi + 0xc]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0xd]
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add edx, eax
cmp word [ebp - 0x660], 0x10
mov ebx, edx
ja 0x4053b0
add ebx, dword [ebp - 0x66c]
cmp ebx, 0xffffffff
je 0x40705c
test edx, edx
je 0x40705c
mov dword [ebp - 0x66c], ebx
mov ecx, dword [ebp - 0x674]
jmp 0x405060
mov eax, ebx
and ebx, 0x3fff
shr eax, 0xe
mov edx, ebx
mov dword [ebp - 0x674], eax
jmp 0x40509f
mov ecx, dword [ebp - 0x69c]
test ecx, ecx
jne 0x40705c
mov dword [ebp - 0x69c], 1
jmp 0x405365
mov edx, dword [ebp - 0x678]
movzx eax, byte [edx + 7]
movzx edx, byte [edx + 6]
shl eax, 8
add eax, edx
mov edx, dword [ebp - 0x678]
mov ecx, eax
movzx eax, byte [edx + 5]
movzx edx, byte [edx + 4]
shl ecx, 0x10
shl eax, 8
add eax, edx
movzx eax, ax
add eax, ecx
mov ecx, dword [ebp - 0x678]
mov dword [ebp - 0x660], eax
movzx eax, byte [ecx + 0x13]
movzx edx, byte [ecx + 0x12]
shl eax, 8
add edx, eax
movzx eax, byte [ecx + 0x11]
movzx ecx, byte [ecx + 0x10]
mov dword [esp + 4], 0
shl edx, 0x10
shl eax, 8
add eax, ecx
movzx eax, ax
add edx, eax
mov dword [ebp - 0x664], edx
mov edx, dword [ebp - 0x660]
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x680]
call eax
mov dword [ebp - 0x690], eax
sub esp, 0xc
test eax, eax
je 0x405190
mov edx, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x678]
sub ebx, edx
add ecx, edx
cmp dword [ebp - 0x660], ebx
jle 0x406b00
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov edx, dword [eax + 0x5c]
test edx, edx
jne 0x407078
mov edx, dword [eax + 0x60]
test edx, edx
jne 0x407207
movzx esi, byte [0x416010]
test esi, 1
jne 0x40733d
mov eax, dword [ebp - 0x690]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._memcpy
add ebx, dword [ebp - 0x690]
mov dword [ebp - 0x688], ebx
mov ebx, dword [ebp - 0x678]
movzx eax, byte [ebx + 0x13]
movzx edx, byte [ebx + 0x12]
movzx ecx, byte [ebx + 0x10]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0x11]
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add eax, edx
add eax, ebx
and esi, 8
mov dword [ebp - 0x684], eax
movzx eax, byte [ebx + 0x14]
jne 0x406a88
cmp al, 0x20
je 0x4065f2
mov dword [ebp - 0x6a0], 0
mov ebx, dword [ebp - 0x694]
mov dword [ebp - 0x664], ebx
cmp al, 0x23
je 0x4065f2
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x690]
mov ecx, 0xffffffff
xor ebx, ebx
mov word [ebp - 0x6a8], cx
mov dword [ebp - 0x668], eax
mov word [ebp - 0x698], bx
test byte [0x416010], 8
jne 0x4065ae
mov edx, str.pard
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
mov eax, dword [ebp - 0x678]
add word [ebp - 0x698], 1
movzx eax, byte [eax + 0x14]
cmp al, 0x23
je 0x406552
mov esi, dword [ebp - 0x664]
cmp al, 1
lea edx, [esi + 6]
lea ebx, [esi + 4]
cmove ebx, edx
movzx eax, byte [ebx + 1]
movzx edx, byte [ebx]
shl eax, 8
add eax, edx
and edx, 1
mov word [ebp - 0x660], ax
jne 0x4064e2
lea eax, [ebx + 2]
mov dword [ebp - 0x664], eax
test byte [ebp - 0x660], 2
je 0x40567e
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi]
test al, 1
je 0x406850
movzx eax, word [esi]
add esi, 2
mov dword [ebp - 0x664], esi
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov esi, dword [ebp + 8]
cwde
mov edx, dword [esi + 0x28]
lea esi, [ebp - 0x644]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._sb_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
test byte [ebp - 0x660], 4
je 0x4056f2
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi]
test al, 1
je 0x4069da
movzx eax, word [esi]
add esi, 2
mov dword [ebp - 0x664], esi
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov esi, dword [ebp + 8]
cwde
mov edx, dword [esi + 0x28]
lea esi, [ebp - 0x644]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._sa_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
test byte [ebp - 0x660], 8
je 0x405766
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi]
test al, 1
je 0x4069f2
movzx eax, word [esi]
add esi, 2
mov dword [ebp - 0x664], esi
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x644]
cwde
mov edx, dword [ebx + 0x28]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._sl_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
test byte [ebp - 0x660], 0x10
je 0x4057da
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi]
test al, 1
je 0x406a0a
movzx eax, word [esi]
add esi, 2
mov dword [ebp - 0x664], esi
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov esi, dword [ebp + 8]
cwde
mov edx, dword [esi + 0x28]
lea esi, [ebp - 0x644]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.li_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
test byte [ebp - 0x660], 0x20
je 0x40584e
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi]
test al, 1
je 0x406a22
movzx eax, word [esi]
add esi, 2
mov dword [ebp - 0x664], esi
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x644]
cwde
mov edx, dword [ebx + 0x28]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._ri_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
test byte [ebp - 0x660], 0x40
je 0x4058c2
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi]
test al, 1
je 0x406a3a
movzx eax, word [esi]
add esi, 2
mov dword [ebp - 0x664], esi
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov esi, dword [ebp + 8]
cwde
mov edx, dword [esi + 0x28]
lea esi, [ebp - 0x644]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._fi_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
test word [ebp - 0x660], 0x100
je 0x405951
mov eax, dword [ebp - 0x664]
movzx ebx, byte [eax]
test bl, 1
jne 0x406df8
test bl, 2
jne 0x406dd8
test bl, 4
jne 0x406e60
test bl, 8
jne 0x406e3d
test bl, 0x10
jne 0x406ea0
test bl, 0x20
jne 0x406e80
mov edx, str._brdrs
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
and ebx, 0x40
jne 0x406f08
mov esi, dword [ebp - 0x664]
movsx ax, byte [esi + 2]
movzx edx, byte [esi + 1]
add esi, 3
mov dword [ebp - 0x664], esi
shl eax, 8
add ax, dx
jne 0x406ec0
test word [ebp - 0x660], 0x200
jne 0x406868
movzx eax, word [ebp - 0x660]
and ax, 0xc00
cmp ax, 0x400
je 0x406a68
cmp ax, 0x800
je 0x406ae0
test ax, ax
je 0x406abf
test byte [0x416010], 1
jne 0x407314
lea esi, [esi]
test word [ebp - 0x660], 0x1000
jne 0x406830
test word [ebp - 0x660], 0xe080
je 0x4059bf
test byte [0x416010], 1
jne 0x4070b2
mov esi, dword [ebp - 0x664]
cmp dword [ebp - 0x684], esi
jbe 0x405b32
lea esi, [esi]
mov esi, dword [ebp - 0x688]
cmp dword [ebp - 0x668], esi
jae 0x405b32
mov eax, dword [ebp - 0x668]
test byte [0x416010], 8
jne 0x406110
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0x67c], eax
test eax, eax
jne 0x405fb0
mov eax, dword [ebp - 0x664]
add dword [ebp - 0x668], 1
movzx ebx, byte [eax]
cmp bl, 0xff
je 0x406dcc
cmp bl, 0xef
ja case.0x405a4c.4
test bl, bl
jns 0x405f80
lea eax, [ebx - 0x80]
cmp al, 0x6f
ja case.0x405a4c.4
movzx eax, al
jmp dword [eax*4 + 0x417d6c]
mov eax, dword [ebp - 0x664]
lea esi, [eax + 8]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x660], esi
cmp al, 4
je 0x407152
ja 0x406436
test al, al
je 0x406a52
cmp al, 1
jne 0x4070fe
mov eax, dword [ebp - 0x664]
movsx ecx, byte [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 8]
mov dword [ebp - 0x660], eax
mov edx, ebx
shr bl, 2
mov esi, dword [ebp - 0x664]
mov dword [esp + 0x10], ecx
xor ebx, 1
mov dword [esp + 0xc], 0
not edx
and ebx, 1
and edx, 1
mov dword [esp + 8], ebx
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx ebx, byte [esi + 4]
shl eax, 8
add eax, ecx
movzx ecx, byte [esi + 5]
mov dword [esp], 0xffffffff
shl eax, 0x10
shl ecx, 8
add ecx, ebx
movzx ecx, cx
add eax, ecx
mov ecx, dword [ebp - 0x660]
mov dword [esp + 4], eax
mov eax, edi
call dbg.HLPFILE_AllocLink
movzx eax, byte [esi + 2]
movzx edx, byte [esi + 1]
shl eax, 8
add eax, edx
movzx eax, ax
lea eax, [esi + eax + 3]
mov dword [ebp - 0x664], eax
lea esi, [esi]
nop
mov esi, dword [ebp - 0x684]
cmp dword [ebp - 0x664], esi
jb 0x4059d8
movsx eax, word [ebp - 0x698]
cmp eax, dword [ebp - 0x6a4]
jb 0x405599
mov esi, dword [ebp - 0x690]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x674]
sub esp, 0xc
shl eax, 0xf
add eax, dword [ebp - 0x68c]
cmp eax, dword [ebp + 0x14]
jae 0x405b89
mov eax, dword [edi + 0x10]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x65c]
mov esi, dword [ebp - 0x6a0]
add dword [ebp - 0x68c], esi
movzx eax, word [eax + 0x4c]
mov word [ebp - 0x660], ax
jmp 0x405365
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi + 4]
movzx edx, byte [esi + 3]
movzx ecx, byte [esi + 1]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 2]
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add eax, edx
test byte [0x416010], 4
jne 0x406b5b
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x28]
mov ecx, dword [edx + 8]
mov edx, ebx
shr bl, 2
mov dword [esp + 0x10], 0xffffffff
xor ebx, 1
mov dword [esp + 0xc], 0
not edx
and ebx, 1
and edx, 1
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, edi
mov dword [esp], 0xffffffff
call dbg.HLPFILE_AllocLink
add dword [ebp - 0x664], 5
jmp 0x405b20
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi + 4]
movzx edx, byte [esi + 3]
movzx ecx, byte [esi + 1]
shl eax, 8
add eax, edx
mov edx, eax
movzx eax, byte [esi + 2]
shl edx, 0x10
shl eax, 8
add eax, ecx
movzx eax, ax
add eax, edx
test byte [0x416010], 4
jne 0x406bb5
mov esi, dword [ebp + 8]
not ebx
mov edx, dword [esi + 0x28]
mov ecx, dword [edx + 8]
mov edx, ebx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 0
and edx, 1
mov dword [esp + 8], 1
jmp 0x405c0d
mov edx, 0x417b50
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
add dword [ebp - 0x664], 1
add dword [edi + 0x10], 1
jmp 0x405b20
mov eax, dword [ebp - 0x664]
lea esi, [eax + 3]
test byte [0x416010], 8
jne 0x406c0f
shr bl, 2
mov dword [esp + 0x10], 0xffffffff
mov ecx, esi
xor ebx, 1
mov dword [esp + 0xc], 0
and ebx, 1
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x664]
movzx eax, byte [ebx + 2]
movzx edx, byte [ebx + 1]
mov esi, ebx
shl eax, 8
add eax, edx
mov edx, 2
movzx eax, ax
mov dword [esp], eax
mov eax, edi
call dbg.HLPFILE_AllocLink
jmp 0x405afd
mov edx, 0x417b4d
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405ca0
mov edi, dword [ebp - 0x690]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x20]
add dword [ebp - 0x664], 1
test eax, eax
je 0x406d93
mov edx, dword [edi + 0x10]
mov dword [eax + 0x18], edx
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
jmp 0x405b20
mov esi, dword [ebp - 0x664]
movzx edx, byte [esi + 1]
test byte [esi + 2], 1
je 0x4067eb
mov eax, dword [esi + 2]
add esi, 6
add eax, 0x80000000
shr eax, 1
mov dword [ebp - 0x660], eax
movzx ecx, byte [0x416010]
cmp dl, 5
je 0x406f70
cmp dl, 0x22
je 0x406780
cmp dl, 3
je 0x406790
and ecx, 1
jne 0x40749d
nop
add esi, dword [ebp - 0x660]
mov dword [ebp - 0x664], esi
jmp 0x405b20
mov edx, str._tab
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405ca0
jmp 0x405d2d
mov edx, str.line
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405ca0
jmp 0x405d2d
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi + 2]
movzx edx, byte [esi + 1]
shl eax, 8
add eax, edx
movzx esi, ax
test byte [0x416010], 8
jne 0x406d66
mov eax, dword [ebp + 8]
mov ebx, dword [edi + 0x18]
add dword [ebp - 0x664], 3
mov edx, dword [eax + 0x28]
imul eax, esi, 0x44
add eax, dword [edx + 0x88]
mov ecx, dword [eax]
lea edx, [ecx - 4]
test ebx, ebx
je 0x405e71
lea edx, [ecx + 4]
cmp ebx, 2
cmovne edx, ecx
cmp byte [eax + 0x16], 0
mov ecx, str._strike
mov ebx, str._strike0
cmovne ebx, ecx
cmp byte [eax + 0x15], 0
mov ecx, str.ul0
mov dword [ebp - 0x670], ebx
mov ebx, 0x41770f
cmovne ecx, ebx
cmp byte [eax + 0x14], 0
mov ebx, 0x417718
mov dword [ebp - 0x660], ecx
mov ecx, 0x41771b
cmovne ecx, ebx
cmp dword [eax + 0x10], 0x190
mov ebx, 0x417722
mov eax, 0x41771f
cmovle eax, ebx
mov ebx, dword [ebp - 0x670]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ebx
mov ebx, dword [ebp - 0x660]
mov dword [esp + 0x14], eax
lea eax, [esi + 2]
mov dword [esp + 0x1c], ebx
lea ebx, [ebp - 0x644]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str._f_dcf_d_fs_d_s_s_s_s
mov dword [esp], ebx
call sym._sprintf
mov edx, ebx
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405b20
jmp 0x405d2d
test byte [0x416010], 4
jne 0x406d39
add dword [ebp - 0x664], 1
jmp 0x405b20
mov eax, dword [ebp - 0x678]
cmp byte [eax + 0x14], 0x23
jne 0x406811
mov eax, dword [ebp - 0x664]
cmp byte [eax + 1], 0xff
je 0x406f28
mov edx, str.parintbl
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
mov eax, dword [edi + 0x10]
add eax, 1
add dword [ebp - 0x664], 1
mov dword [edi + 0x10], eax
jmp 0x405b20
cmp bl, 0x20
je 0x406400
cmp bl, 0x21
jne case.0x405a4c.4
test byte [0x416010], 1
jne 0x406b32
add dword [ebp - 0x664], 3
jmp 0x405b20
mov esi, dword [edi + 0x24]
test esi, esi
je 0x405fdc
mov eax, dword [edi + 0x20]
cmp dword [eax], 1
je 0x4063b0
mov edx, str.ulcf1
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
sete al
test al, al
jne 0x405d2d
mov ebx, dword [edi]
test ebx, ebx
je 0x406368
mov esi, dword [ebp - 0x668]
movzx eax, byte [esi]
test al, al
je 0x40704f
mov ebx, esi
mov edx, esi
mov esi, edi
jmp 0x406028
cmp al, 0x7b
je 0x4060f8
cmp al, 0x7d
je 0x4060e0
lea ecx, [ebx + 1]
cmp al, 0x5c
je 0x4060c8
movzx eax, byte [ecx]
mov ebx, ecx
test al, al
je 0x406098
lea esi, [esi]
test al, al
jns 0x406000
mov dword [esp + 8], eax
mov edi, section..bss
mov dword [esp + 4], str._x
mov dword [esp], section..bss
mov dword [ebp - 0x670], edx
call sym._sprintf
mov edx, dword [ebp - 0x670]
mov dword [ebp - 0x660], eax
cmp ebx, edx
je 0x406072
mov ecx, ebx
mov eax, esi
sub ecx, edx
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405d2d
mov ecx, dword [ebp - 0x660]
mov edx, edi
mov eax, esi
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405d2d
movzx eax, byte [ebx + 1]
lea ecx, [ebx + 1]
mov edx, ecx
mov ebx, ecx
test al, al
jne 0x406028
mov edi, esi
sub ecx, edx
mov eax, edi
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405d2d
mov ecx, dword [edi + 0x24]
test ecx, ecx
jne 0x406390
mov eax, dword [ebp - 0x67c]
add dword [edi + 0x10], eax
jmp 0x406285
mov dword [ebp - 0x660], 2
mov edi, 0x4176fb
jmp 0x40605b
mov dword [ebp - 0x660], 2
mov edi, 0x4176f5
jmp 0x40605b
mov dword [ebp - 0x660], 2
mov edi, 0x4176f8
jmp 0x40605b
test eax, eax
je 0x4064d8
shr eax, 0x10
je 0x4063d0
mov esi, dword [ebp - 0x668]
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, 0x417389
sub esp, 8
test eax, eax
jne 0x40621e
movzx edx, byte [esi]
test dl, dl
je 0x4064fa
mov ebx, esi
lea esi, [esi]
mov ecx, eax
lea eax, [eax + 1]
cmp byte [ebx + ecx + 1], 0
jne 0x406158
mov ebx, dword [ebp - 0x668]
mov byte [ebp - 0x544], 0x22
lea eax, [ebp - 0x543]
mov dword [ebp - 0x660], ebx
jmp 0x4061bc
cmp dl, 9
je 0x406300
cmp dl, 0xa
jne 0x40631f
mov edx, 0x6e5c
add eax, 2
mov word [eax - 2], dx
nop
lea ebx, [ebp - 0x421]
lea esi, [ecx - 1]
cmp eax, ebx
ja 0x4061f0
test ecx, ecx
jle 0x4061f0
mov ebx, dword [ebp - 0x660]
mov ecx, esi
movzx edx, byte [ebx]
add dword [ebp - 0x660], 1
cmp dl, 0xd
je 0x4062e8
jle 0x406180
cmp dl, 0x22
je 0x406350
cmp dl, 0x5c
jne 0x406311
mov esi, 0x5c5c
add eax, 2
mov word [eax - 2], si
jmp 0x4061a0
mov byte [eax], 0x22
test esi, esi
jle 0x40650c
mov ecx, 0x2e2e
mov byte [eax + 3], 0x2e
lea edx, [eax + 4]
mov word [eax + 1], cx
lea eax, [ebp - 0x544]
mov byte [edx], 0
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov edx, eax
mov eax, dword [ebp - 0x684]
mov esi, dword [ebp - 0x668]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Got_text:__s___p__p____p__p__n
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x664]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x688]
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x18], eax
mov dword [esp + 4], 0x416010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0x67c], eax
test eax, eax
jne 0x405fb0
mov eax, dword [ebp - 0x668]
mov esi, dword [ebp - 0x67c]
lea eax, [eax + esi + 1]
mov esi, dword [ebp - 0x664]
mov dword [ebp - 0x668], eax
movzx ebx, byte [esi]
test byte [0x416010], 8
je 0x405a24
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.format0x_02x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
movzx ebx, byte [esi]
jmp 0x405a24
mov esi, 0x725c
add eax, 2
mov word [eax - 2], si
jmp 0x4061a0
mov ebx, 0x745c
add eax, 2
mov word [eax - 2], bx
jmp 0x4061a0
lea esi, [edx - 0x20]
mov ebx, esi
cmp bl, 0x5e
jbe 0x4063f0
mov ebx, 0x785c
add eax, 4
mov word [eax - 4], bx
mov ebx, edx
and edx, 0xf
shr bl, 4
movzx edx, byte [edx + str.0123456789abcdefHLPFILE_PageByOffset]
movzx esi, bl
movzx ebx, byte [esi + str.0123456789abcdefHLPFILE_PageByOffset]
mov byte [eax - 1], dl
mov byte [eax - 2], bl
jmp 0x4061a0
mov edx, 0x225c
add eax, 2
mov word [eax - 2], dx
jmp 0x4061a0
mov ecx, 1
mov edx, 0x417200
mov eax, edi
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405d2d
mov dword [edi], 1
jmp 0x405fe6
mov edx, 0x417587
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4060b6
jmp 0x405d2d
mov edx, str.uldcf1
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
sete al
jmp 0x405fd4
movzx eax, word [ebp - 0x668]
mov dword [esp], 0x41737c
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov edx, eax
jmp 0x40621e
mov byte [eax], dl
add eax, 1
jmp 0x4061a0
test byte [0x416010], 1
je 0x405c1f
mov dword [esp + 0xc], str.NIY20_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405c1f
cmp al, 6
jne 0x4070fe
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x28]
mov eax, dword [edx + 0x8c]
lea ecx, [eax - 1]
test ecx, ecx
js 0x40795c
imul eax, eax, 0x68
mov edx, dword [edx + 0x90]
mov byte [ebp - 0x670], bl
mov ebx, ecx
mov dword [ebp + 0xc], edi
lea edx, [edx + eax - 0x5e]
mov edi, edx
jmp 0x406487
sub ebx, 1
sub edi, 0x68
cmp ebx, 0xffffffff
je 0x407391
mov eax, dword [ebp - 0x660]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
jne 0x406478
mov ecx, ebx
mov edi, dword [ebp + 0xc]
movzx ebx, byte [ebp - 0x670]
mov esi, dword [ebp - 0x660]
mov dword [ebp - 0x670], ecx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ecx, dword [ebp - 0x670]
lea eax, [esi + eax + 1]
mov dword [ebp - 0x660], eax
jmp 0x405a9d
mov edx, 0x417382
jmp 0x40621e
lea eax, [ebx + 6]
lea edx, [ebx + 4]
test byte [ebx + 2], 1
cmove eax, edx
mov dword [ebp - 0x664], eax
jmp 0x40560a
mov eax, 0x2222
mov word [ebp - 0x544], ax
lea eax, [ebp - 0x543]
lea edx, [eax + 1]
jmp 0x40620b
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.buf_0x14____x_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x416010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x65c]
movzx eax, word [eax + 0x4c]
mov word [ebp - 0x660], ax
jmp 0x405365
mov esi, dword [ebp - 0x664]
movsx ax, byte [esi + 1]
movzx edx, byte [esi]
shl eax, 8
add eax, edx
mov word [ebp - 0x698], ax
cmp ax, 0xffff
je 0x407b07
mov edx, str.intbl
mov eax, edi
add dword [ebp - 0x664], 5
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
mov eax, dword [ebp - 0x678]
movzx ebx, word [ebp - 0x698]
movzx eax, byte [eax + 0x14]
mov word [ebp - 0x6a8], bx
jmp 0x4055d4
movsx eax, word [ebp - 0x698]
mov dword [esp + 0xc], str.looking_for_format_at_offset__Iu_in_column__d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x664]
sub eax, dword [ebp - 0x694]
mov dword [esp + 4], 0x416010
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x4055a6
mov esi, dword [ebp - 0x678]
test byte [esi + 0x15], 1
je 0x406e2b
mov ebx, dword [ebp - 0x668]
movzx edx, byte [esi + 0x19]
test dl, 1
je 0x406e18
movzx edx, word [ebx]
add ebx, 2
mov dword [ebp - 0x664], ebx
shr dx, 1
movzx esi, dx
mov dword [ebp - 0x6a0], esi
cmp al, 0x23
jne 0x40556e
mov esi, dword [ebp - 0x664]
mov edx, str._trowd
mov eax, edi
movzx ebx, byte [esi]
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
movzx ecx, byte [esi + 1]
mov eax, esi
test cl, 0xfd
je 0x4078ff
mov dword [ebp - 0x668], 0x7fff
add eax, 2
mov esi, eax
movzx eax, bl
mov dword [ebp - 0x6a4], eax
test byte [0x416010], 8
jne 0x4078bb
cmp dword [ebp - 0x6a4], 1
ja 0x407581
movsx cx, byte [esi + 1]
movzx eax, byte [esi]
shl ecx, 8
add ecx, eax
test byte [0x416010], 8
jne 0x407970
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.kernel32.dll_MulDiv]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x668]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], eax
movsx eax, cx
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x668]
sub esp, 0xc
mov ecx, dword [ecx + 0x28]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], eax
movsx ax, byte [esi + 3]
movzx edx, byte [esi + 2]
shl eax, 8
add eax, edx
cwde
imul eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0xa8]
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 0x660]
sub esp, 0xc
sub eax, 1
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x644]
mov dword [esp + 8], eax
mov dword [esp + 4], str._trleft_dcellx_d
mov dword [esp], ebx
call sym._sprintf
mov edx, ebx
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
mov eax, dword [ebp - 0x6a4]
lea esi, [esi + eax*4]
mov dword [ebp - 0x664], esi
test eax, eax
jne 0x40556e
jmp 0x405b45
xor ebx, ebx
test byte [esi], 1
mov edx, esi
setne bl
mov esi, ebx
lea esi, [esi + edx + 1]
movsx dx, byte [esi + 1]
mov ebx, edx
movzx edx, byte [esi]
shl ebx, 8
add edx, ebx
movsx ebx, dx
test dx, dx
je 0x40718c
cmp dx, 1
je 0x40716a
and ecx, 1
je 0x405de0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._____u_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405de0
mov ebx, dword [ebp - 0x664]
movzx eax, word [ebx + 2]
lea esi, [ebx + 4]
sub eax, 0x8000
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
mov dword [ebp - 0x660], eax
jmp 0x405db3
mov edx, str.par
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405f68
jmp 0x405d2d
mov edx, str.keep
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4059a7
jmp 0x405d2d
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x40563f
mov ebx, dword [ebp - 0x664]
movzx eax, byte [ebx]
test al, 1
je 0x4070e6
movzx eax, word [ebx]
add ebx, 2
mov dword [ebp - 0x664], ebx
lea edx, [eax - 0x8000]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movsx ebx, ax
mov dword [ebp - 0x670], ebx
test ax, ax
jle 0x405960
mov dword [ebp + 0xc], edi
xor ecx, ecx
mov edi, dword [ebp - 0x664]
lea esi, [ebp - 0x644]
jmp 0x406967
movzx eax, word [edi]
shr ax, 1
mov ebx, eax
and bx, 0x3fff
test ah, 0x40
je 0x407b48
movzx edx, byte [edi + 2]
test dl, 1
je 0x406988
movzx edx, word [edi + 2]
add edi, 4
shr dx, 1
movzx eax, dx
cmp dx, 2
jbe 0x406a5c
mov edx, 0x4176f4
test byte [0x416010], 1
jne 0x406995
mov eax, dword [ebp + 8]
movzx ebx, bx
mov dword [ebp - 0x664], ecx
mov eax, dword [eax + 0x28]
imul ebx, dword [eax + 0xa4]
sub ebx, dword [eax + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str._s_tx_d
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
mov ecx, dword [ebp - 0x664]
add ecx, 1
cmp dword [ebp - 0x670], ecx
je 0x40715c
movzx ebx, byte [edi]
test bl, 1
jne 0x4068c0
shr bl, 1
add edi, 1
mov edx, 0x4176f4
movzx ebx, bl
jmp 0x40690c
shr dl, 1
add edi, 3
movzx edx, dl
jmp 0x4068ed
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unknown_tab_style__x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
mov dword [ebp - 0x67c], ecx
mov dword [ebp - 0x664], edx
call sym._wine_dbg_log.constprop.0_1
mov ecx, dword [ebp - 0x67c]
mov edx, dword [ebp - 0x664]
jmp 0x40690c
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x4056b3
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x405727
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x40579b
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x40580f
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x405883
mov ecx, 0xffffffff
jmp 0x405a8e
mov edx, dword [eax*4 + 0x4183e8]
jmp 0x40690c
mov edx, 0x4179be
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405998
jmp 0x405d2d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Record_type__buf_0x14____0x_x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x678]
movzx eax, byte [eax + 0x14]
jmp 0x405548
mov edx, 0x4179ba
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405998
jmp 0x405d2d
mov edx, 0x4179c2
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405998
jmp 0x405d2d
mov esi, dword [ebp - 0x690]
mov ebx, dword [ebp - 0x660]
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], ebx
call sym._memcpy
mov eax, ebx
add eax, esi
movzx esi, byte [0x416010]
mov dword [ebp - 0x688], eax
jmp 0x40550b
mov dword [esp + 0xc], str.NIY21_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405f9b
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.jump_topic_1____u_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi + 4]
movzx ecx, byte [esi + 3]
movzx edx, byte [esi + 1]
movzx ebx, byte [esi]
shl eax, 8
add eax, ecx
mov ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 0x10
shl eax, 8
add eax, edx
movzx eax, ax
add eax, ecx
jmp 0x405be0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.jump_topic_1____u_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov esi, dword [ebp - 0x664]
movzx eax, byte [esi + 4]
movzx ecx, byte [esi + 3]
movzx edx, byte [esi + 1]
movzx ebx, byte [esi]
shl eax, 8
add eax, ecx
mov ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 0x10
shl eax, 8
add eax, edx
movzx eax, ax
add eax, ecx
jmp 0x405c62
mov eax, esi
shr eax, 0x10
je 0x407379
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov ecx, eax
sub esp, 8
mov eax, 0x417389
test ecx, ecx
jne 0x406d03
mov ebx, dword [ebp - 0x664]
movzx eax, byte [ebx + 3]
test al, al
je 0x407839
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp byte [ebx + edx + 4], 0
jne 0x406c50
mov byte [ebp - 0x544], 0x22
lea ebx, [ebp - 0x543]
mov dword [ebp - 0x660], esi
jmp 0x406ca6
cmp al, 9
je 0x407293
cmp al, 0xa
jne 0x407252
mov eax, 0x6e5c
add ebx, 2
mov word [ebx - 2], ax
lea esi, [esi]
lea ecx, [edx - 1]
test edx, edx
jle 0x406cd1
lea eax, [ebp - 0x421]
cmp ebx, eax
ja 0x406cd1
movzx eax, byte [esi]
mov edx, ecx
add esi, 1
cmp al, 0xd
je 0x407235
jle 0x406c71
cmp al, 0x22
je 0x407282
cmp al, 0x5c
jne 0x407246
mov eax, 0x5c5c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x406c90
mov byte [ebx], 0x22
mov esi, dword [ebp - 0x660]
test ecx, ecx
jle 0x407848
mov ecx, 0x2e2e
mov byte [ebx + 3], 0x2e
lea eax, [ebx + 4]
mov word [ebx + 1], cx
mov byte [eax], 0
lea eax, [ebp - 0x544]
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.macro____s_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x664]
movzx ebx, byte [eax]
jmp 0x405cc6
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.format__02x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x405f28
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Changing_font_to__d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x405e46
test byte [0x416010], 1
je 0x405d73
mov dword [esp + 0xc], str.No_existing_link_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [edi + 0x20]
jmp 0x405d73
add dword [ebp - 0x664], 1
jmp 0x405b32
mov edx, str._brdrt
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4058ec
jmp 0x405d2d
mov edx, str._box
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4058e3
jmp 0x405d2d
shr dl, 1
add ebx, 1
mov dword [ebp - 0x664], ebx
movzx edx, dl
jmp 0x406624
mov esi, dword [ebp - 0x678]
movzx edx, byte [esi + 0x17]
lea ebx, [esi + 0x17]
jmp 0x40660c
mov edx, str._brdrb
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4058fe
jmp 0x405d2d
mov edx, str._brdrl
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4058f5
jmp 0x405d2d
mov edx, str._brdrth
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405924
jmp 0x405d2d
mov edx, str._brdrr
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405907
jmp 0x405d2d
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x644]
cwde
mov edx, dword [ebx + 0x28]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._brdrw_d
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405951
jmp 0x405d2d
mov edx, str._brdrdb
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x40592d
jmp 0x405d2d
mov ebx, dword [ebp - 0x664]
movsx ax, byte [ebx + 3]
movzx edx, byte [ebx + 2]
shl eax, 8
add eax, edx
cmp ax, 0xffff
je 0x4077d4
cmp ax, word [ebp - 0x6a8]
je 0x407528
mov edx, str.cellpard
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405f68
jmp 0x405d2d
and ecx, 1
je 0x405de0
lea eax, [esi + 6]
mov dword [ebp - 0x664], eax
shr eax, 0x10
je 0x4079f3
mov eax, dword [ebp - 0x664]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, 0x417389
sub esp, 8
test eax, eax
jne 0x4074fb
movzx edx, byte [esi + 6]
test dl, dl
je 0x407b31
mov ebx, eax
lea eax, [eax + 1]
cmp byte [esi + ebx + 7], 0
jne 0x406fbe
mov dword [ebp - 0x670], esi
lea eax, [ebp - 0x543]
mov esi, dword [ebp - 0x664]
mov byte [ebp - 0x544], 0x22
jmp 0x407021
cmp dl, 9
je 0x407861
cmp dl, 0xa
jne 0x40787e
mov edx, 0x6e5c
add eax, 2
mov word [eax - 2], dx
lea ecx, [ebx - 1]
test ebx, ebx
jle 0x4074ca
lea ebx, [ebp - 0x421]
cmp eax, ebx
ja 0x4074ca
movzx edx, byte [esi]
mov ebx, ecx
add esi, 1
cmp dl, 0xd
je 0x407850
jle 0x406fe5
cmp dl, 0x22
je 0x4078aa
cmp dl, 0x5c
jne 0x407872
mov edx, 0x5c5c
add eax, 2
mov word [eax - 2], dx
jmp 0x407003
mov edx, dword [ebp - 0x668]
xor ecx, ecx
jmp 0x40609c
mov esi, edi
mov eax, dword [esi + 0x1c]
mov edi, dword [ebp + 8]
mov edx, 0x417587
mov dword [edi + 8], eax
mov eax, esi
call dbg.HLPFILE_RtfAddControl
jmp 0x405192
mov ebx, dword [ebp - 0x660]
add ebx, dword [ebp - 0x690]
mov dword [esp], esi
lea edx, [eax + 0x6c]
mov dword [ebp - 0x688], ebx
add eax, 0x68
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x690]
mov dword [esp + 4], ebx
call sym._HLPFILE_Uncompress2.isra.0
movzx esi, byte [0x416010]
jmp 0x40550b
movzx eax, word [ebp - 0x660]
mov dword [esp + 0xc], str.Unsupported_bits__04x__potential_trouble_ahead_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x4059bf
lea edx, [eax - 0x80]
add dword [ebp - 0x664], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x406894
mov ecx, 0xffffffff
test byte [0x416010], 4
je 0x405a9d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unknown_link_type__d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 2
mov dword [ebp - 0x670], ecx
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x670]
movzx ebx, byte [eax]
jmp 0x405a9d
mov ecx, 0xffffffff
jmp 0x405a9d
mov dword [ebp - 0x664], edi
mov edi, dword [ebp + 0xc]
jmp 0x405960
and ecx, 1
jne 0x4077f3
mov eax, dword [ebp + 8]
lea ecx, [esi + 2]
mov edx, dword [eax + 0x28]
mov eax, edi
call sym._HLPFILE_RtfAddGfxByAddr.isra.0
add dword [edi + 0x10], 1
jmp 0x405de0
movsx dx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
add edx, eax
mov eax, dword [ebp + 8]
and ecx, 8
movsx edx, dx
mov ebx, dword [eax + 0x28]
jne 0x407548
lea ecx, [ebp - 0x544]
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 4], str.bm_u
call sym._sprintf
lea eax, [ebp - 0x648]
lea edx, [ebx + 4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x64c]
lea ecx, [ebp - 0x544]
mov dword [esp], eax
mov eax, ebx
call sym._HLPFILE_FindSubFile.isra.0
test eax, eax
jne 0x407480
test byte [0x416010], 4
jne 0x4079ca
add dword [edi + 0x10], 1
jmp 0x405de0
mov ebx, dword [ebp - 0x660]
mov edx, dword [ebp - 0x690]
mov dword [esp + 4], esi
mov dword [esp], ecx
add ebx, edx
mov ecx, ebx
mov dword [ebp - 0x688], ebx
call dbg.HLPFILE_Uncompress3
movzx esi, byte [0x416010]
jmp 0x40550b
mov eax, 0x725c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x406c90
lea ecx, [eax - 0x20]
cmp cl, 0x5e
jbe 0x407476
mov ecx, 0x785c
add ebx, 4
mov word [ebx - 4], cx
mov ecx, eax
and eax, 0xf
shr cl, 4
movzx eax, byte [eax + str.0123456789abcdefHLPFILE_PageByOffset]
movzx ecx, cl
movzx ecx, byte [ecx + str.0123456789abcdefHLPFILE_PageByOffset]
mov byte [ebx - 1], al
mov byte [ebx - 2], cl
jmp 0x406c90
mov eax, 0x225c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x406c90
mov eax, 0x745c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x406c90
mov esi, edi
test byte [0x416010], 4
je 0x40705e
mov dword [esp + 0xc], str.maplen_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x40705e
mov esi, edi
test byte [0x416010], 4
je 0x40705e
mov dword [esp + 0xc], str.extra_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x40705e
mov dword [esp + 0xc], str.Unsupported_alignment_0xC00_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405998
mov dword [esp + 0xc], str.Text_size_is_too_long__splitting_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
mov dword [ebp - 0x660], ecx
call sym._wine_dbg_log.constprop.0_1
movzx esi, byte [0x416010]
mov ecx, dword [ebp - 0x660]
jmp 0x4054e9
movzx eax, si
mov dword [esp], 0x41737c
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x406d03
movzx ebx, byte [ebp - 0x670]
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
test byte [0x416010], 4
je 0x4064aa
mov eax, dword [ebp - 0x660]
shr eax, 0x10
je 0x407a32
mov eax, dword [ebp - 0x660]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
push edx
push edx
test eax, eax
jne 0x407b55
mov esi, dword [ebp - 0x664]
cmp byte [esi + 8], 0
je 0x407b5f
mov esi, dword [ebp - 0x664]
mov ebx, eax
lea eax, [eax + 1]
cmp byte [esi + ebx + 9], 0
jne 0x4073ed
mov byte [ebp - 0x544], 0x22
mov esi, dword [ebp - 0x660]
lea eax, [ebp - 0x543]
jmp 0x407449
cmp cl, 9
je 0x407adb
cmp cl, 0xa
jne 0x407aaf
mov word [eax], 0x6e5c
add eax, 2
lea edx, [ebx - 1]
test ebx, ebx
jle 0x407a84
lea ebx, [ebp - 0x421]
cmp eax, ebx
ja 0x407a84
mov ebx, edx
movzx ecx, byte [esi]
add esi, 1
cmp cl, 0xd
je 0x407b24
jle 0x407414
cmp cl, 0x22
je 0x407afa
cmp cl, 0x5c
jne 0x407ae8
mov word [eax], 0x5c5c
add eax, 2
jmp 0x40742e
mov byte [ebx], al
add ebx, 1
jmp 0x406c90
mov eax, dword [ebp - 0x64c]
mov edx, ebx
lea ecx, [eax + 9]
mov eax, edi
mov dword [ebp - 0x64c], ecx
call sym._HLPFILE_RtfAddGfxByAddr.isra.0
jmp 0x4071fe
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Got_a_type__d_picture_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405de0
mov byte [eax], 0x22
mov esi, dword [ebp - 0x670]
test ecx, ecx
jle 0x407b40
mov word [eax + 1], 0x2e2e
lea edx, [eax + 4]
mov byte [eax + 3], 0x2e
lea eax, [ebp - 0x544]
mov byte [edx], 0
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Got_an_embedded_element__s_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405de0
mov edx, str.parpard
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405f68
jmp 0x405d2d
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Loading_picture__d_n
mov dword [esp + 8], str.HLPFILE_RtfAddGfxByIndex
mov dword [esp + 4], 0x416010
mov dword [esp], 3
mov dword [ebp - 0x664], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x664]
jmp 0x4071ac
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x28]
mov eax, dword [ebp - 0x668]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], eax
movsx ax, byte [esi + 3]
movzx edx, byte [esi + 2]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 6]
movsx ecx, ax
movsx ax, byte [esi + 7]
shl eax, 8
add eax, edx
cwde
sub ecx, eax
mov eax, dword [ebx + 0xa4]
imul eax, ecx
sub eax, dword [ebx + 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_MulDiv]
mov dword [ebp - 0x670], eax
call eax
mov edx, dword [ebp - 0x668]
mov ecx, dword [ebp + 8]
sub esp, 0xc
mov ebx, eax
mov ecx, dword [ecx + 0x28]
mov dword [esp + 8], 0x7fff
sub ebx, 1
mov dword [esp + 4], edx
movsx ax, byte [esi + 7]
movzx edx, byte [esi + 6]
shl eax, 8
add eax, edx
cwde
imul eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0x670]
call eax
sub esp, 0xc
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x644]
mov dword [esp + 8], eax
mov dword [esp + 4], str._trgaph_d_trleft_d
mov dword [esp], ebx
call sym._sprintf
mov edx, ebx
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
movsx ax, byte [esi + 7]
movzx edx, byte [esi + 6]
mov dword [ebp + 0xc], edi
mov edi, ebx
shl eax, 8
add edx, eax
shr ax, 0xf
add eax, edx
sar ax, 1
cwde
mov dword [ebp - 0x660], eax
xor eax, eax
mov word [ebp - 0x664], ax
xor eax, eax
mov ebx, eax
jmp 0x40770a
mov ebx, dword [ebp + 8]
add eax, edx
add dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov edx, dword [ebx + 0x28]
mov ebx, dword [ebp - 0x668]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0x670]
call eax
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], str.cellx_d
mov dword [esp], edi
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
add word [ebp - 0x664], 1
movsx ebx, word [ebp - 0x664]
cmp dword [ebp - 0x6a4], ebx
jbe 0x407a1b
lea eax, [ebx*4]
lea edx, [esi + eax + 3]
lea ecx, [esi + eax + 2]
mov dword [ebp - 0x698], edx
movsx dx, byte [edx]
mov dword [ebp - 0x67c], ecx
movzx ecx, byte [ecx]
shl edx, 8
add edx, ecx
lea ecx, [esi + eax]
lea eax, [esi + eax + 1]
mov dword [ebp - 0x6ac], eax
movsx ax, byte [eax]
movsx edx, dx
mov dword [ebp - 0x6a8], ecx
movzx ecx, byte [ecx]
shl eax, 8
add eax, ecx
cwde
test byte [0x416010], 8
je 0x407688
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x6a4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.column__d__d__gap_d_width_d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x6ac]
mov ebx, dword [ebp - 0x6a8]
movsx ax, byte [eax]
movzx edx, byte [ebx]
mov ebx, dword [ebp - 0x698]
shl eax, 8
add eax, edx
movsx dx, byte [ebx]
mov ebx, dword [ebp - 0x67c]
cwde
movzx ecx, byte [ebx]
shl edx, 8
add edx, ecx
movsx edx, dx
jmp 0x407688
mov edx, str.cellintbl_row
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
mov eax, dword [edi + 0x10]
add eax, 2
jmp 0x405f6b
movsx dx, byte [esi + 3]
movzx ecx, byte [esi + 2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
shl edx, 8
mov dword [esp + 0xc], str.does_it_work______x__lu__u_n
add edx, ecx
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
movsx edx, dx
mov dword [esp + 4], 0x416010
mov dword [esp + 0x18], edx
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x407173
mov word [ebp - 0x544], 0x2222
lea ebx, [ebp - 0x543]
lea eax, [ebx + 1]
jmp 0x406cf2
mov ecx, 0x725c
add eax, 2
mov word [eax - 2], cx
jmp 0x407003
mov edx, 0x745c
add eax, 2
mov word [eax - 2], dx
jmp 0x407003
lea ecx, [edx - 0x20]
cmp cl, 0x5e
jbe 0x407a11
mov ecx, edx
and edx, 0xf
mov word [eax], 0x785c
add eax, 4
shr cl, 4
movzx edx, byte [edx + str.0123456789abcdefHLPFILE_PageByOffset]
movzx ecx, cl
movzx ecx, byte [ecx + str.0123456789abcdefHLPFILE_PageByOffset]
mov byte [eax - 1], dl
mov byte [eax - 2], cl
jmp 0x407003
mov ecx, 0x225c
add eax, 2
mov word [eax - 2], cx
jmp 0x407003
mov eax, dword [ebp - 0x668]
mov dword [esp + 0xc], str.New_table:_cols_d_type_x_width_d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x18], eax
movzx eax, cl
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x6a4]
mov dword [esp + 4], 0x416010
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x406686
mov esi, dword [ebp - 0x664]
mov byte [ebp - 0x670], cl
movzx eax, byte [esi + 2]
movzx edx, byte [esi + 3]
mov byte [ebp - 0x660], al
mov eax, edi
mov byte [ebp - 0x664], dl
mov edx, str._trqc
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
movzx eax, word [ebp - 0x664]
movzx edx, byte [ebp - 0x660]
add esi, 4
movzx ecx, byte [ebp - 0x670]
shl eax, 8
add eax, edx
cwde
mov dword [ebp - 0x668], eax
jmp 0x406670
cmp ecx, 0xffffffff
jne 0x4064aa
jmp 0x40739b
movsx ax, byte [esi + 3]
movzx edx, byte [esi + 2]
movsx ecx, cx
mov dword [esp + 0xc], str.column_0__d__gap_d_width_d_n
mov dword [esp + 0x14], ecx
shl eax, 8
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
add eax, edx
mov dword [esp + 4], 0x416010
cwde
mov dword [esp], 3
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x6a4]
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0_1
movsx cx, byte [esi + 1]
movzx eax, byte [esi]
shl ecx, 8
add ecx, eax
jmp 0x4066ad
mov dword [esp + 0xc], str.no_sub_file_n
mov dword [esp + 8], str.HLPFILE_RtfAddGfxByIndex
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x4071fe
movzx eax, word [ebp - 0x664]
mov dword [esp], 0x41737c
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov edx, eax
jmp 0x4074fb
mov byte [eax], dl
add eax, 1
jmp 0x407003
mov eax, dword [ebp - 0x6a4]
mov edi, dword [ebp + 0xc]
lea eax, [esi + eax*4]
mov dword [ebp - 0x664], eax
jmp 0x405578
movzx eax, word [ebp - 0x660]
mov dword [esp], 0x41737c
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4174e8
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x416010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x664]
mov ecx, 0xffffffff
movzx ebx, byte [eax]
jmp 0x4064aa
mov byte [eax], 0x22
test edx, edx
jle 0x407b6e
mov word [eax + 1], 0x2e2e
lea edx, [eax + 4]
mov byte [eax + 3], 0x2e
lea eax, [ebp - 0x544]
mov byte [edx], 0
mov dword [esp], eax
call dbg.__wine_dbg_strdup
jmp 0x407a49
mov edx, ecx
and ecx, 0xf
mov word [eax], 0x785c
add eax, 4
shr dl, 4
movzx edx, dl
movzx edx, byte [edx + str.0123456789abcdefHLPFILE_PageByOffset]
mov byte [eax - 2], dl
movzx edx, byte [ecx + str.0123456789abcdefHLPFILE_PageByOffset]
mov byte [eax - 1], dl
jmp 0x40742e
mov word [eax], 0x745c
add eax, 2
jmp 0x40742e
lea edx, [ecx - 0x20]
cmp dl, 0x5e
ja 0x407aaf
mov byte [eax], cl
add eax, 1
jmp 0x40742e
mov word [eax], 0x225c
add eax, 2
jmp 0x40742e
mov edx, str._row
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405d2d
add dword [edi + 0x10], 2
jmp 0x405b45
mov word [eax], 0x725c
add eax, 2
jmp 0x40742e
mov word [ebp - 0x544], 0x2222
lea eax, [ebp - 0x543]
lea edx, [eax + 1]
jmp 0x4074e8
add edi, 2
mov edx, 0x4176f4
jmp 0x40690c
mov eax, 0x417389
jmp 0x407a49
mov word [ebp - 0x544], 0x2222
lea eax, [ebp - 0x543]
lea edx, [eax + 1]
jmp 0x407a9c