Function at 0x5a7cc0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6665dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], eax
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x38]
call fcn.00506ee0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ebx, dword [ebp - 0x38]
push ebx
push edi
mov ecx, dword [eax + 0x1c]
call ecx
test eax, eax
jns 0x5a7d33
push str.pxml__get_nodeName_bstr.GetAddress___
push eax
lea ecx, [ebp - 0x120]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x120]
push edx
call fcn.0060fb01
push str.Agent
lea ecx, [ebp - 0x14]
call fcn.00404700
mov byte [ebp - 4], 2
mov ecx, dword [eax]
cmp ebx, ecx
jne 0x5a7d4e
xor eax, eax
jmp 0x5a7d9a
test ebx, ebx
jne 0x5a7d72
test ecx, ecx
je 0x5a7d69
mov eax, ecx
cmp dword [eax], ebx
je 0x5a7d69
mov eax, dword [eax]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x5a7d6d
xor eax, eax
jmp 0x5a7d9a
or eax, 0xffffffff
jmp 0x5a7d9a
test ecx, ecx
jne 0x5a7d92
cmp dword [ebx], ecx
je 0x5a7d87
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x5a7d8b
xor eax, eax
jmp 0x5a7d9a
mov eax, 1
jmp 0x5a7d9a
push ecx
mov ecx, ebx
call fcn.004ffb50
test eax, eax
setne bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00407570
test bl, bl
jne 0x5a9521
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
push ecx
push str.Name
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a9513
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov bl, 4
mov byte [ebp - 4], bl
cmp dword [eax], 0
je 0x5a7df7
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a7df9
xor eax, eax
push eax
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 8]
call fcn.004077d0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.00405700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push 0x678c90
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a7eb0
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov byte [ebp - 4], 6
cmp dword [eax], 0
je 0x5a7e5b
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a7e5d
xor eax, eax
push eax
lea ecx, [ebp - 0x30]
call fcn.0040bea0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x14]
call fcn.00407570
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x110]
call fcn.004dd0f0
mov ecx, dword [eax]
mov dword [esi + 0xe0], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0xe4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0xe8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xec], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.004014a0
lea eax, [ebp - 0x28]
push eax
push 0x67a96c
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a7f1d
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov byte [ebp - 4], 9
cmp dword [eax], 0
je 0x5a7ee1
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a7ee3
xor eax, eax
push eax
lea ecx, [ebp - 0x30]
call fcn.0040bea0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14]
call fcn.00407570
push 0x66ecc8
mov edx, dword [ebp - 0x30]
push edx
call fcn.00611e0e
add esp, 8
test eax, eax
sete al
mov byte [esi + 0x5e], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.004014a0
lea ecx, [ebp - 0x28]
push ecx
push str.TERM
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a7f8a
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov byte [ebp - 4], 0xc
cmp dword [eax], 0
je 0x5a7f4e
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a7f50
xor eax, eax
push eax
lea ecx, [ebp - 0x30]
call fcn.0040bea0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x14]
call fcn.00407570
push 0x66ecc8
mov eax, dword [ebp - 0x30]
push eax
call fcn.00611e0e
add esp, 8
test eax, eax
sete cl
mov byte [esi + 0x5d], cl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.004014a0
lea edx, [ebp - 0x28]
push edx
push str.Expanded
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a7fae
lea ecx, [ebp - 0x28]
call fcn.00501380
mov byte [esi + 0xf8], al
lea eax, [ebp - 0x28]
push eax
push str.ComputerName
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8015
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov bl, 0xf
mov byte [ebp - 4], bl
cmp dword [eax], 0
je 0x5a7fe0
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a7fe2
xor eax, eax
push eax
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 0x10
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x24]
call fcn.004077d0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.00405700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00407570
jmp 0x5a803d
lea edx, [ebp - 0x64]
push edx
mov ecx, esi
call fcn.0043b4b0
mov byte [ebp - 4], 0x11
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x24]
call fcn.004077d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call fcn.00405700
lea eax, [ebp - 0x28]
push eax
push 0x66eddc
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a80a4
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov bl, 0x12
mov byte [ebp - 4], bl
cmp dword [eax], 0
je 0x5a806f
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8071
xor eax, eax
push eax
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 0x13
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x40]
call fcn.004077d0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.00405700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00407570
jmp 0x5a80d1
push 0x66eba8
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 0x14
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x64]
push edx
lea ecx, [esi + 0x40]
call fcn.004077d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call fcn.00405700
lea eax, [ebp - 0x28]
push eax
push str.PasswdHash
push edi
call fcn.005bed70
add esp, 0xc
lea ecx, [ebp - 0x28]
push ecx
test al, al
je 0x5a81b3
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov byte [ebp - 4], 0x15
cmp dword [eax], 0
je 0x5a8106
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8108
xor eax, eax
push eax
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x14]
call fcn.00407570
push 0x66ecc4
lea edx, [ebp - 0x64]
push edx
call fcn.005a6f00
add esp, 8
test al, al
je 0x5a818b
mov eax, dword [ebp - 0x54]
mov edi, eax
push eax
call fcn.005fb5ce
add esp, 4
mov ebx, eax
xor esi, esi
mov dword [ebp - 0x100], esi
cmp esi, edi
jge 0x5a8161
push esi
lea ecx, [ebp - 0x64]
call fcn.005a6e80
mov al, byte [eax]
sub al, 0x1e
mov byte [esi + ebx], al
inc esi
jmp 0x5a8144
push edi
push ebx
mov esi, dword [ebp - 0x18]
lea eax, [esi + 0x5f]
push eax
call fcn.00610e50
mov dword [esi + 0xc4], edi
push ebx
call fcn.00611a0b
add esp, 0x10
mov byte [esi + 0x5c], 1
mov byte [esi + 0xf0c], 1
jmp 0x5a819c
mov dword [esi + 0xc4], 0
mov byte [esi + 0xf0c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call fcn.00405700
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x18]
jmp 0x5a82b3
push str.PasswdHash64
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a82a2
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov byte [ebp - 4], 0x18
cmp dword [eax], 0
je 0x5a81e4
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a81e6
xor eax, eax
push eax
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 0x19
cmp dword [eax + 0x14], 8
jb 0x5a81fb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040bdf0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x64]
call fcn.00405700
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x14]
call fcn.00407570
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x5a827f
push eax
call fcn.005fb5ce
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx - 0xc]
lea edx, [ebp - 0x40]
push edx
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404c30
push eax
call fcn.0052c430
mov ebx, dword [ebp - 0x40]
push ebx
push esi
mov eax, dword [ebp - 0x18]
add eax, 0x5f
push eax
call fcn.00610e50
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0xc4], ebx
push esi
call fcn.00611a0b
add esp, 0x20
mov edx, dword [ebp - 0x18]
mov byte [edx + 0xf0c], 1
mov esi, edx
jmp 0x5a8290
mov dword [esi + 0xc4], 0
mov byte [esi + 0xf0c], 0
mov byte [esi + 0x5c], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004014a0
jmp 0x5a82b3
mov dword [esi + 0xc4], 0
mov byte [esi + 0xf0c], 0
lea eax, [ebp - 0x28]
push eax
push str.RepTypes
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a82d3
lea ecx, [ebp - 0x28]
call fcn.00501570
jmp 0x5a82d8
call fcn.005c1460
mov dword [esi + 0xd8], eax
lea ecx, [ebp - 0x28]
push ecx
push str.ViewSysKey
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8302
lea ecx, [ebp - 0x28]
call fcn.00501380
mov byte [esi + 0xdc], al
lea edx, [ebp - 0x28]
push edx
push str.LastDownload
push edi
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8395
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.00506fa0
mov bl, 0x1d
mov byte [ebp - 4], bl
cmp dword [eax], 0
je 0x5a8334
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8336
xor eax, eax
push eax
lea ecx, [ebp - 0x64]
call fcn.0040aa60
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.004f91d0
add esp, 8
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edi, dword [ebp - 0x18]
mov dword [edi + 0xc8], ecx
mov dword [edi + 0xcc], edx
mov dword [edi + 0xd0], esi
mov dword [edi + 0xd4], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.00405700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00407570
mov edi, dword [ebp + 8]
jmp 0x5a83af
xor eax, eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0x1f
mov esi, dword [edi]
lea ecx, [ebp - 0x48]
call fcn.00501bf0
push eax
push edi
mov edx, dword [esi + 0x30]
call edx
test eax, eax
jns 0x5a83f1
push str.pxml__get_childNodes_pNodes_
push eax
lea ecx, [ebp - 0x130]
call fcn.0040de50
push 0x6ba4dc
lea eax, [ebp - 0x130]
push eax
call fcn.0060fb01
xor edi, edi
mov dword [ebp - 0x80], edi
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x5a8407
push 0x80004003
call fcn.0060f000
call fcn.004ffc50
cmp edi, eax
jge 0x5a93cd
mov dword [ebp + 8], 0
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x5a8430
push 0x80004003
call fcn.0060f000
mov ebx, eax
mov esi, dword [eax]
lea ecx, [ebp + 8]
call fcn.00501bf0
push eax
push edi
push ebx
mov ecx, dword [esi + 0x1c]
call ecx
test eax, eax
jns 0x5a846a
push str.pNodes__get_item_j__pCurrNode_
push eax
lea ecx, [ebp - 0x150]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x150]
push edx
call fcn.0060fb01
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a847b
push 0x80004003
call fcn.0060f000
push 0
lea ecx, [ebp - 0x38]
call fcn.00506ee0
mov eax, dword [esi]
mov edi, dword [ebp - 0x38]
push edi
push esi
mov ecx, dword [eax + 0x1c]
call ecx
test eax, eax
jns 0x5a84b7
push str.pCurrNode__get_nodeName_bstr.GetAddress___
push eax
lea ecx, [ebp - 0x180]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x180]
push edx
call fcn.0060fb01
push str.User
lea ecx, [ebp - 0xec]
call fcn.00404700
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
cmp edi, ecx
jne 0x5a84d5
xor eax, eax
jmp 0x5a8521
test edi, edi
jne 0x5a84f9
test ecx, ecx
je 0x5a84f0
mov eax, ecx
cmp dword [eax], edi
je 0x5a84f0
mov eax, dword [eax]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x5a84f4
xor eax, eax
jmp 0x5a8521
or eax, 0xffffffff
jmp 0x5a8521
test ecx, ecx
jne 0x5a8519
cmp dword [edi], ecx
je 0x5a850e
mov ecx, dword [edi]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x5a8512
xor eax, eax
jmp 0x5a8521
mov eax, 1
jmp 0x5a8521
push ecx
mov ecx, edi
call fcn.004ffb50
xor esi, esi
cmp eax, esi
sete bl
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xec]
call fcn.00407570
test bl, bl
je 0x5a8e3a
lea eax, [ebp - 0x28]
push eax
push 0x678c90
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a93af
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xb0]
call fcn.00506fa0
mov byte [ebp - 4], 0x22
cmp dword [eax], esi
je 0x5a8579
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a857b
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040bea0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xb0]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push 0x67f5c8
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a864e
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xb4]
call fcn.00506fa0
mov byte [ebp - 4], 0x25
cmp dword [eax], esi
je 0x5a85cd
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a85cf
xor eax, eax
push eax
lea ecx, [ebp - 0x1b8]
call fcn.0040aa60
mov byte [ebp - 4], 0x26
cmp dword [eax + 0x14], 8
jb 0x5a85e7
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bea0
mov esi, eax
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x110]
call fcn.004dd0f0
push eax
mov edi, dword [ebp - 0x18]
lea ecx, [edi + 0xef8]
call fcn.00452560
push esi
mov ecx, eax
call fcn.004078d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xe0]
call fcn.004014a0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1b8]
call fcn.00405700
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xb4]
call fcn.00407570
jmp 0x5a8651
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push ecx
push str.RepTypes
mov edx, dword [ebp + 8]
push edx
call fcn.005bed70
add esp, 0xc
lea esi, [edi + 0xef8]
test al, al
je 0x5a8686
lea ecx, [ebp - 0x28]
call fcn.00501570
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x204]
jmp 0x5a8697
call fcn.005c1460
mov edi, eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x1f4]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
mov dword [eax + 8], edi
lea edx, [ebp - 0x28]
push edx
push str.ViewSysKey
mov eax, dword [ebp + 8]
push eax
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a86e4
lea ecx, [ebp - 0x28]
call fcn.00501380
mov bl, al
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
mov byte [eax + 0xc], bl
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 0x28
mov eax, dword [ebp + 8]
test eax, eax
jne 0x5a8700
push 0x80004003
call fcn.0060f000
mov ebx, eax
mov esi, dword [eax]
lea ecx, [ebp - 0x44]
call fcn.00501bf0
push eax
push ebx
mov edx, dword [esi + 0x30]
call edx
test eax, eax
jns 0x5a8739
push str.pCurrNode__get_childNodes_pNodes__
push eax
lea ecx, [ebp - 0x160]
call fcn.0040de50
push 0x6ba4dc
lea eax, [ebp - 0x160]
push eax
call fcn.0060fb01
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x5a8752
push 0x80004003
call fcn.0060f000
call fcn.004ffc50
cmp ebx, eax
jge 0x5a8e1b
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x5a877b
push 0x80004003
call fcn.0060f000
mov edi, eax
mov esi, dword [eax]
lea ecx, [ebp - 0x34]
call fcn.00501bf0
push eax
push ebx
push edi
mov ecx, dword [esi + 0x1c]
call ecx
test eax, eax
jns 0x5a87b5
push str.pNodes___get_item_k__pCurrNode__
push eax
lea ecx, [ebp - 0x170]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x170]
push edx
call fcn.0060fb01
mov esi, dword [ebp - 0x34]
test esi, esi
jne 0x5a87c6
push 0x80004003
call fcn.0060f000
push 0
lea ecx, [ebp - 0x38]
call fcn.00506ee0
mov eax, dword [esi]
mov edi, dword [ebp - 0x38]
push edi
push esi
mov ecx, dword [eax + 0x1c]
call ecx
test eax, eax
jns 0x5a8802
push str.pCurrNode___get_nodeName_bstr.GetAddress___
push eax
lea ecx, [ebp - 0x140]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x140]
push edx
call fcn.0060fb01
push str.Contragent
lea ecx, [ebp - 0xf4]
call fcn.00404700
mov byte [ebp - 4], 0x2a
mov ecx, dword [eax]
cmp edi, ecx
jne 0x5a8820
xor eax, eax
jmp 0x5a886c
test edi, edi
jne 0x5a8844
test ecx, ecx
je 0x5a883b
mov eax, ecx
cmp dword [eax], edi
je 0x5a883b
mov eax, dword [eax]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x5a883f
xor eax, eax
jmp 0x5a886c
or eax, 0xffffffff
jmp 0x5a886c
test ecx, ecx
jne 0x5a8864
cmp dword [edi], ecx
je 0x5a8859
mov ecx, dword [edi]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x5a885d
xor eax, eax
jmp 0x5a886c
mov eax, 1
jmp 0x5a886c
push ecx
mov ecx, edi
call fcn.004ffb50
xor edi, edi
cmp eax, edi
sete bl
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xf4]
call fcn.00407570
test bl, bl
je 0x5a8df7
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2c
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x90], eax
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x2e
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x30
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x32
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 0x34
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0x35
mov byte [ebp - 4], 0x36
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x28]
push eax
push str.CName
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a89b1
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xfc]
call fcn.00506fa0
mov byte [ebp - 4], 0x39
cmp dword [eax], edi
je 0x5a8997
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8999
xor eax, eax
push eax
lea ecx, [ebp - 0x68]
call fcn.004017e0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xfc]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CEMail
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8a04
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xc0]
call fcn.00506fa0
mov byte [ebp - 4], 0x3a
cmp dword [eax], edi
je 0x5a89e7
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a89e9
xor eax, eax
push eax
lea ecx, [ebp - 0x90]
call fcn.00403420
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xc0]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CICQ
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8a57
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xac]
call fcn.00506fa0
mov byte [ebp - 4], 0x3b
cmp dword [eax], edi
je 0x5a8a3a
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8a3c
xor eax, eax
push eax
lea ecx, [ebp - 0x8c]
call fcn.00403420
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xac]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CSkype
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8aaa
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xc8]
call fcn.00506fa0
mov byte [ebp - 4], 0x3c
cmp dword [eax], edi
je 0x5a8a8d
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8a8f
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.00403420
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xc8]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.szSocNets
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8afd
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xe8]
call fcn.00506fa0
mov byte [ebp - 4], 0x3d
cmp dword [eax], edi
je 0x5a8ae0
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8ae2
xor eax, eax
push eax
lea ecx, [ebp - 0x98]
call fcn.00403420
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xe8]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CMailRu
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8b4d
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xd0]
call fcn.00506fa0
mov byte [ebp - 4], 0x3e
cmp dword [eax], edi
je 0x5a8b33
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8b35
xor eax, eax
push eax
lea ecx, [ebp - 0x78]
call fcn.00403420
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xd0]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CADUser
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8b9d
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xf8]
call fcn.00506fa0
mov byte [ebp - 4], 0x3f
cmp dword [eax], edi
je 0x5a8b83
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8b85
xor eax, eax
push eax
lea ecx, [ebp - 0x74]
call fcn.00403420
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xf8]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CAvatar
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8d0a
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xd8]
call fcn.00506fa0
mov byte [ebp - 4], 0x40
cmp dword [eax], edi
je 0x5a8bd7
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8bd9
xor eax, eax
push eax
lea ecx, [ebp - 0x1d4]
call fcn.0040aa60
mov byte [ebp - 4], 0x41
cmp dword [eax + 0x14], 8
jb 0x5a8bf1
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040bdf0
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x1d4]
call fcn.00405700
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0xd8]
call fcn.00407570
mov eax, dword [ebp - 0x40]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0xa4], eax
cmp eax, edi
jle 0x5a8cd6
push eax
call fcn.005fb5ce
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx - 0xc]
lea edx, [ebp - 0xa4]
push edx
push esi
push eax
lea ecx, [ebp - 0x40]
call fcn.00404c30
push eax
call fcn.0052c430
mov edi, dword [ebp - 0xa4]
push edi
call fcn.005fb5ce
mov ebx, eax
push edi
push esi
push edi
push ebx
call fcn.0060fbd3
push esi
call fcn.00611a0b
add esp, 0x28
mov esi, dword [ebp - 0x18]
add esi, 0xef8
push edi
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
lea ecx, [eax + 0x10]
call fcn.004396a0
push ebx
call fcn.00611a0b
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x244]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
mov dword [eax + 0x3114], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x40]
call fcn.004014a0
jmp 0x5a8d30
mov esi, dword [ebp - 0x18]
add esi, 0xef8
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x234]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
mov dword [eax + 0x3114], edi
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x40]
call fcn.004014a0
jmp 0x5a8d30
mov esi, dword [ebp - 0x18]
add esi, 0xef8
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x214]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
mov dword [eax + 0x3114], edi
lea ecx, [ebp - 0x74]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x98]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x78]
call fcn.004014f0
push eax
lea ecx, [ebp - 0xa0]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x8c]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x90]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x68]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004dd0f0
push eax
mov ecx, esi
call fcn.00452560
lea ecx, [eax + 0x10]
call fcn.00437ed0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x74]
call fcn.004014a0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x78]
call fcn.004014a0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x98]
call fcn.004014a0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xa0]
call fcn.004014a0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x8c]
call fcn.004014a0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x90]
call fcn.004014a0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x68]
call fcn.004014a0
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x5a8e0a
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
inc dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x9c]
jmp 0x5a8741
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x5a8e2e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2c]
jmp 0x5a93aa
push str.Contragent
lea ecx, [ebp - 0xf0]
call fcn.00404700
mov byte [ebp - 4], 0x45
mov ecx, dword [eax]
cmp edi, ecx
jne 0x5a8e58
xor eax, eax
jmp 0x5a8ea4
cmp edi, esi
jne 0x5a8e7c
cmp ecx, esi
je 0x5a8e73
mov eax, ecx
cmp dword [eax], esi
je 0x5a8e73
mov eax, dword [eax]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, esi
jne 0x5a8e77
xor eax, eax
jmp 0x5a8ea4
or eax, 0xffffffff
jmp 0x5a8ea4
cmp ecx, esi
jne 0x5a8e9c
cmp dword [edi], esi
je 0x5a8e91
mov ecx, dword [edi]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, esi
jne 0x5a8e95
xor eax, eax
jmp 0x5a8ea4
mov eax, 1
jmp 0x5a8ea4
push ecx
mov ecx, edi
call fcn.004ffb50
cmp eax, esi
sete bl
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xf0]
call fcn.00407570
test bl, bl
je 0x5a93af
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0x47
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 0x48
mov byte [ebp - 4], 0x49
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0x4a
mov byte [ebp - 4], 0x4b
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x4d
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x84], eax
mov byte [ebp - 4], 0x4e
mov byte [ebp - 4], 0x4f
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 0x51
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 0x52
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0x28]
push eax
push str.CName
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a8fe4
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xb8]
call fcn.00506fa0
mov byte [ebp - 4], 0x54
cmp dword [eax], esi
je 0x5a8fca
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a8fcc
xor eax, eax
push eax
lea ecx, [ebp - 0x30]
call fcn.004017e0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xb8]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CEMail
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a9034
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xbc]
call fcn.00506fa0
mov byte [ebp - 4], 0x55
cmp dword [eax], esi
je 0x5a901a
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a901c
xor eax, eax
push eax
lea ecx, [ebp - 0x70]
call fcn.00403420
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xbc]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CICQ
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a9084
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00506fa0
mov byte [ebp - 4], 0x56
cmp dword [eax], esi
je 0x5a906a
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a906c
xor eax, eax
push eax
lea ecx, [ebp - 0x6c]
call fcn.00403420
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xc4]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CSkype
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a90d7
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xcc]
call fcn.00506fa0
mov byte [ebp - 4], 0x57
cmp dword [eax], esi
je 0x5a90ba
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a90bc
xor eax, eax
push eax
lea ecx, [ebp - 0x88]
call fcn.00403420
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xcc]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.szSocNets
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a912a
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xd4]
call fcn.00506fa0
mov byte [ebp - 4], 0x58
cmp dword [eax], esi
je 0x5a910d
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a910f
xor eax, eax
push eax
lea ecx, [ebp - 0x84]
call fcn.00403420
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xd4]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CMailRu
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a917d
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xdc]
call fcn.00506fa0
mov byte [ebp - 4], 0x59
cmp dword [eax], esi
je 0x5a9160
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a9162
xor eax, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.00403420
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xdc]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CADUser
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a91cd
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xe4]
call fcn.00506fa0
mov byte [ebp - 4], 0x5a
cmp dword [eax], esi
je 0x5a91b3
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a91b5
xor eax, eax
push eax
lea ecx, [ebp - 0x7c]
call fcn.00403420
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xe4]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
push str.CAvatar
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bed70
add esp, 0xc
test al, al
je 0x5a92eb
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0xa8]
call fcn.00506fa0
mov byte [ebp - 4], 0x5b
cmp dword [eax], esi
je 0x5a9207
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x5a9209
xor eax, eax
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040aa60
mov byte [ebp - 4], 0x5c
cmp dword [eax + 0x14], 8
jb 0x5a9221
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040bdf0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x19c]
call fcn.00405700
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0xa8]
call fcn.00407570
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x14], eax
cmp eax, esi
jle 0x5a92ce
push eax
call fcn.005fb5ce
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00404c30
push eax
call fcn.0052c430
mov edi, dword [ebp - 0x14]
push edi
call fcn.005fb5ce
mov ebx, eax
push edi
push esi
push edi
push ebx
call fcn.0060fbd3
push esi
call fcn.00611a0b
add esp, 0x28
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi + 0xf10]
push edi
push ebx
call fcn.004396a0
push ebx
call fcn.00611a0b
add esp, 4
mov esi, dword [esi + 0xf10]
mov dword [esi + 0x3104], 1
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x3c]
call fcn.004014a0
jmp 0x5a92fa
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xf10]
mov dword [eax + 0x3104], esi
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x3c]
call fcn.004014a0
jmp 0x5a92fa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0xf10]
mov dword [eax + 0x3104], esi
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0xf10]
lea ecx, [ebp - 0x7c]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x84]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x94]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x88]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x6c]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x70]
call fcn.004014f0
push eax
lea ecx, [ebp - 0x30]
call fcn.004014f0
push eax
mov ecx, esi
call fcn.00437ed0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x7c]
call fcn.004014a0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x94]
call fcn.004014a0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x84]
call fcn.004014a0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x88]
call fcn.004014a0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x6c]
call fcn.004014a0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x70]
call fcn.004014a0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x30]
call fcn.004014a0
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp + 8]
test eax, eax
je 0x5a93c2
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
inc dword [ebp - 0x80]
mov edi, dword [ebp - 0x80]
jmp 0x5a83f6
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x5d], 0
je 0x5a9494
xor esi, esi
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 0x60
mov dword [ebp + 8], 0x1c4
push 0x1c4
mov ecx, dword [0x716738]
push ecx
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov ebx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x60], esi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea edx, [ebp - 0x60]
push edx
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
movzx esi, word [ebp - 0x4e]
shr esi, 3
imul esi, dword [ebp - 0x5c]
imul esi, dword [ebp - 0x58]
mov dword [ebp - 0xa8], esi
push esi
call fcn.005fb5ce
add esp, 4
mov edi, eax
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xf10]
push esi
push edi
call fcn.004396a0
push edi
call fcn.0060faf6
add esp, 4
lea ecx, [ebp - 0x3c]
call fcn.004382f0
mov ebx, dword [ebx + 0xf10]
push str.Terminal_server
push 0x7f
add ebx, 0x400
push ebx
call fcn.00611c28
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3c]
call fcn.004496b0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x5a94a7
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x5a94fe
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x5a94f7
mov eax, dword [esi]
test eax, eax
je 0x5a94de
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x5a94ee
push eax
call fcn.00611a0b
add esp, 4
push esi
call fcn.0060faf6
add esp, 4
mov dword [ebp - 0x38], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00407570
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4