Function at 0x1001c470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007177f
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x1008d200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebx + 0x38]
cmp eax, edi
je 0x1001c4c3
cmp byte [eax], 0
jne 0x1001e0e2
cmp eax, edi
jne 0x1001c4fc
push 0xe8
call fcn.1005ce85
mov esi, eax
add esp, 4
cmp esi, edi
je 0x1001c4f7
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x64], esp
cmp eax, edi
je 0x1001c4f0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.10020450
jmp 0x1001c4f9
xor eax, eax
mov dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x34]
cmp byte [ecx], 0
jne 0x1001c523
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x1001e0f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x1001e0f8
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x94], edi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x98], edi
mov eax, dword [eax + 4]
cmp eax, edi
jne 0x1001c558
push 0x80004003
call fcn.10069d90
mov ecx, dword [eax]
lea edx, [ebp - 0x70]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
cmp eax, edi
jl 0x1001e06e
mov ecx, dword [ebx + 0x38]
add ecx, 0x44
push ecx
mov ecx, dword [ebp - 0x70]
push 0x10023700
push ebx
call fcn.10021550
test al, al
je 0x1001e06e
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebp - 0x70]
add edx, 0x48
push edx
push 0x1001e120
push ebx
call fcn.10021550
test al, al
je 0x1001e06e
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebp - 0x70]
add eax, 0x4c
push eax
push 0x100238c0
push ebx
call fcn.10021550
test al, al
je 0x1001e06e
mov ecx, dword [ebx + 0x38]
add ecx, 0x50
push ecx
mov ecx, dword [ebp - 0x70]
push 0x10023a10
push ebx
call fcn.10021550
test al, al
je 0x1001e06e
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebp - 0x70]
add edx, 0x54
push edx
push 0x1001e380
push ebx
call fcn.10021550
test al, al
je 0x1001e06e
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x34]
add eax, 0xc
push eax
push edi
push edi
sub ecx, 0xffffff80
push ecx
mov ecx, dword [ebp - 0x70]
push ebx
call fcn.1001b4f0
test al, al
je 0x1001e06e
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x6c], eax
cmp eax, edi
je 0x1001c633
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x34]
add ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x70]
push 1
lea edx, [ebp - 0x6c]
push edx
add eax, 0x84
push eax
push ebx
call fcn.1001b4f0
push 0x1001a260
push 1
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c675
lea ecx, [ebp - 0x6c]
push ecx
call fcn.1005d494
jmp 0x1001e06e
lea edx, [ebp - 0x6c]
push edx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x1001c693
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001c6a8
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001c6bd
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001c6d2
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 2
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x14
push eax
push 4
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x20
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 4
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c712
lea eax, [ebp - 0x20]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x20]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x48], eax
cmp eax, edi
je 0x1001c730
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x1001c745
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x40], eax
cmp eax, edi
je 0x1001c75a
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x3c], eax
cmp eax, edi
je 0x1001c76f
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
cmp eax, edi
je 0x1001c784
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 3
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x18
push eax
push 5
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x1c
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 5
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c7c4
lea eax, [ebp - 0x48]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x48]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x1001c7e2
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x58]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001c7f7
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 4
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x1c
push eax
push 2
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x84
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c83a
lea eax, [ebp - 0x68]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x68]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001c858
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001c86d
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001c882
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 5
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x20
push eax
push 3
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x6c
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 3
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c8c2
lea eax, [ebp - 0x1c]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x1001c8e0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001c8f5
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 6
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x24
push eax
push 2
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x84
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c938
lea eax, [ebp - 0x68]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x68]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001c956
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001c96b
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001c980
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 7
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x28
push eax
push 3
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x64
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 3
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001c9c0
lea eax, [ebp - 0x1c]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x1001c9de
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001c9f3
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 8
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x2c
push eax
push 2
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x64
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001ca33
lea eax, [ebp - 0x68]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x68]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x1001ca51
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001ca66
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001ca7b
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001ca90
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 9
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x30
push eax
push 4
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x70]
add edx, 0x64
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 4
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001cad0
lea eax, [ebp - 0x20]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x20]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x1001caee
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001cb03
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x34
push eax
push 2
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x70]
sub edx, 0xffffff80
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001cb43
lea eax, [ebp - 0x68]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x68]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x1001cb61
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001cb76
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x38
push eax
push 2
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x70]
sub edx, 0xffffff80
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001cbb6
lea eax, [ebp - 0x68]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x68]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001cbd4
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001cbe9
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001cbfe
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x3c
push eax
push 3
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x70]
sub edx, 0xffffff80
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 3
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001cc3e
lea eax, [ebp - 0x1c]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001cc5c
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001cc71
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x58]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001cc86
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x34]
add eax, 0x40
push eax
push 3
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x70]
sub edx, 0xffffff80
push edx
push ebx
call fcn.1001b4f0
push 0x1001a260
push 3
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001ccc6
lea eax, [ebp - 0x1c]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1005d494
mov esi, dword [ebx + 0x38]
add esi, 0x74
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x78
call fcn.1001fb60
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x44]
cmp eax, edi
jne 0x1001ccf9
push 0x80004003
call fcn.10069d90
mov edx, dword [eax]
mov edx, dword [edx + 0xb8]
lea ecx, [ebp - 0xa4]
push ecx
push 0x28
push eax
call edx
cmp eax, edi
jl 0x1001e06e
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x88]
push eax
push 1
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0x74]
push edx
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xa8], eax
cmp eax, dword [ebp - 0x74]
jg 0x1001ce6e
mov dword [ebp - 0x60], edi
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 0xe
call fcn.1001fb80
mov edx, dword [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xa8]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
cmp eax, edi
jl 0x1001ce8d
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x80], eax
cmp eax, edi
je 0x1001cd94
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x7c], eax
cmp eax, edi
je 0x1001cda9
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x84], eax
cmp eax, edi
je 0x1001cdc5
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebx + 0x34]
push 2
lea eax, [ebp - 0x80]
sub ecx, 0xffffff80
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001cdea
mov edi, dword [ebx + 0x38]
add edi, 0x74
jmp 0x1001ce0c
mov eax, dword [ebx + 0x34]
push 1
lea edx, [ebp - 0x84]
push edx
sub eax, 0xffffff80
push eax
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001ce14
mov edi, dword [ebx + 0x38]
add edi, 0x78
lea eax, [ebp - 0x60]
call fcn.1001a230
push 0x1001a260
push 1
push 4
lea ecx, [ebp - 0x84]
push ecx
mov byte [ebp - 4], 0xf
call fcn.1005d494
push 0x1001a260
push 2
push 4
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 0xe
call fcn.1005d494
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
xor edi, edi
cmp eax, edi
je 0x1001ce58
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp eax, dword [ebp - 0x74]
jle 0x1001cd53
mov esi, dword [ebx + 0x38]
add esi, 0x58
call fcn.1001fb60
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
cmp eax, edi
jne 0x1001cea9
push 0x80004003
call fcn.10069d90
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
cmp eax, edi
je 0x1001e06e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x1001e06e
mov ecx, dword [eax]
lea edx, [ebp - 0x9c]
push edx
push 0x26
push eax
mov eax, dword [ecx + 0xc0]
call eax
cmp eax, edi
jl 0x1001e06e
mov edx, dword [ebp - 0x9c]
lea ecx, [ebp - 0x88]
push ecx
push 1
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x74]
push eax
push 1
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xac], eax
cmp eax, dword [ebp - 0x74]
jg 0x1001cff3
xor edi, edi
mov dword [ebp - 0x60], edi
lea esi, [ebp - 0x60]
call fcn.1001fb80
push eax
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0xac]
push edx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
cmp eax, edi
jl 0x1001ce8d
mov dword [ebp - 0x6c], edi
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x60]
cmp eax, edi
je 0x1001c54e
mov edi, dword [eax]
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x64], eax
call fcn.1001fb80
mov ecx, dword [ebp - 0x64]
mov edx, dword [edi + 0x48]
push eax
push ecx
call edx
test eax, eax
js 0x1001d05d
mov ecx, dword [ebx + 0x38]
mov dword [ebp - 0x84], 0
cmp dword [ecx + 0x58], 0
sete al
test al, al
je 0x1001cfb7
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x1001c54e
mov ecx, dword [ecx + 0xc]
mov edx, dword [eax]
lea esi, [ebp - 0x84]
push esi
push ecx
push eax
mov eax, dword [edx + 0x1c8]
call eax
test eax, eax
js 0x1001d05d
cmp word [ebp - 0x84], 0xffff
jne 0x1001cfb7
mov edi, dword [ebx + 0x38]
add edi, 0x58
lea eax, [ebp - 0x60]
call fcn.1001a230
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x1001cfca
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x1001cfdd
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp eax, dword [ebp - 0x74]
jle 0x1001cf03
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x4c]
xor edi, edi
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x1001d00a
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001d01f
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x13
mov eax, dword [ebx + 0x38]
lea ecx, [eax + 0x5c]
push ecx
lea edx, [ebp - 0x68]
push edx
add eax, 0x48
push 0x14
push eax
mov eax, 2
call fcn.10020e00
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001d08c
lea eax, [ebp - 0x68]
push eax
call fcn.1005d494
jmp 0x1001e06e
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x1001d070
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x1001e06e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x1001e06e
lea ecx, [ebp - 0x68]
push ecx
call fcn.1005d494
mov esi, dword [ebx + 0x38]
add esi, 0x7c
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
sub esi, 0xffffff80
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x84
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x88
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x8c
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x90
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x94
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0x98
call fcn.1001fb60
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x48]
cmp eax, edi
jne 0x1001d113
push 0x80004003
call fcn.10069d90
mov edx, dword [eax]
mov edx, dword [edx + 0xb8]
lea ecx, [ebp - 0x94]
push ecx
push 0x26
push eax
call edx
cmp eax, edi
jl 0x1001e06e
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x88]
push eax
push 1
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x74]
push edx
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x84], eax
cmp eax, dword [ebp - 0x74]
jg 0x1001d5b3
lea ecx, [ecx]
mov dword [ebp - 0x60], edi
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 0x14
call fcn.1001fb80
mov edx, dword [ebp - 0x94]
push eax
lea ecx, [ebp - 0x84]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
cmp eax, edi
jl 0x1001ce8d
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x8c], eax
cmp eax, edi
je 0x1001d1b4
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001d1cd
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001d1e2
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001d1f7
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x78], eax
cmp eax, edi
je 0x1001d210
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x17
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x1001d229
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x40], eax
cmp eax, edi
je 0x1001d23e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x3c], eax
cmp eax, edi
je 0x1001d253
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
cmp eax, edi
je 0x1001d268
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x18
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x58]
mov dword [ebp - 0x90], eax
cmp eax, edi
je 0x1001d284
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x19
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x80], eax
cmp eax, edi
je 0x1001d29d
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x7c], eax
cmp eax, edi
je 0x1001d2b2
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x1a
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x6c], eax
cmp eax, edi
je 0x1001d2cb
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x1b
mov eax, dword [ebx + 0x34]
push edi
push edi
sub eax, 0xffffff80
push eax
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d3d4
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], edi
cmp eax, edi
je 0x1001c54e
mov ecx, dword [eax]
lea edx, [ebp - 0x64]
push edx
push eax
mov eax, dword [ecx + 0x68]
call eax
cmp word [ebp - 0x64], 0xffff
jne 0x1001d3c9
push 0x1001a260
push 1
push 4
lea ecx, [ebp - 0x6c]
push ecx
mov byte [ebp - 4], 0x1a
call fcn.1005d494
push 0x1001a260
push 2
push 4
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 0x19
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 0x18
call fcn.1005d494
push 0x1001a260
push 4
push 4
lea ecx, [ebp - 0x44]
push ecx
mov byte [ebp - 4], 0x17
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea edx, [ebp - 0x78]
push edx
mov byte [ebp - 4], 0x16
call fcn.1005d494
push 0x1001a260
push 3
push 4
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x15
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea ecx, [ebp - 0x8c]
push ecx
mov byte [ebp - 4], 0x14
call fcn.1005d494
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
cmp eax, edi
je 0x1001d59d
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x1001d59d
mov edi, dword [ebx + 0x38]
add edi, 0x7c
jmp 0x1001d4e0
mov edx, dword [ebx + 0x34]
push 1
lea ecx, [ebp - 0x8c]
push ecx
add edx, 0x64
push edx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d3fb
mov edi, dword [ebx + 0x38]
sub edi, 0xffffff80
jmp 0x1001d4e0
mov ecx, dword [ebx + 0x34]
push 1
lea eax, [ebp - 0x78]
add ecx, 0x74
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d422
mov edi, dword [ebx + 0x38]
add edi, 0x88
jmp 0x1001d4e0
mov eax, dword [ebx + 0x34]
push 3
lea edx, [ebp - 0x1c]
push edx
add eax, 0x20
push eax
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d449
mov edi, dword [ebx + 0x38]
add edi, 0x84
jmp 0x1001d4e0
mov edx, dword [ebx + 0x34]
push 4
lea ecx, [ebp - 0x44]
push ecx
add edx, 0x1c
push edx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d46d
mov edi, dword [ebx + 0x38]
add edi, 0x8c
jmp 0x1001d4e0
mov ecx, dword [ebx + 0x34]
push 1
lea eax, [ebp - 0x90]
add ecx, 0x84
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d497
mov edi, dword [ebx + 0x38]
add edi, 0x90
jmp 0x1001d4e0
mov eax, dword [ebx + 0x34]
push 2
lea edx, [ebp - 0x80]
push edx
add eax, 0x6c
push eax
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d4bb
mov edi, dword [ebx + 0x38]
add edi, 0x94
jmp 0x1001d4e0
mov edx, dword [ebx + 0x34]
push 1
lea ecx, [ebp - 0x6c]
push ecx
add edx, 0x84
push edx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001d4e8
mov edi, dword [ebx + 0x38]
add edi, 0x98
lea eax, [ebp - 0x60]
call fcn.1001a230
push 0x1001a260
push 1
push 4
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 0x1a
call fcn.1005d494
push 0x1001a260
push 2
push 4
lea ecx, [ebp - 0x80]
push ecx
mov byte [ebp - 4], 0x19
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea edx, [ebp - 0x90]
push edx
mov byte [ebp - 4], 0x18
call fcn.1005d494
push 0x1001a260
push 4
push 4
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 0x17
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea ecx, [ebp - 0x78]
push ecx
mov byte [ebp - 4], 0x16
call fcn.1005d494
push 0x1001a260
push 3
push 4
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 0x15
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x14
call fcn.1005d494
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
xor edi, edi
cmp eax, edi
je 0x1001d59d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp eax, dword [ebp - 0x74]
jle 0x1001d170
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x7c], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x80], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x88], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x8c], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x84], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x90], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x94], edi
sete cl
test cl, cl
jne 0x1001d61f
cmp dword [eax + 0x98], edi
sete cl
test cl, cl
jne 0x1001d61f
xor ecx, ecx
jmp 0x1001d624
mov ecx, 1
mov byte [eax + 8], cl
mov eax, dword [ebx + 0x38]
lea ecx, [eax + 0x60]
push ecx
push edi
add eax, 0x50
push 0x34
push eax
xor eax, eax
call fcn.10020e00
test al, al
je 0x1001e06e
mov esi, dword [ebx + 0x38]
add esi, 0xa4
call fcn.1001fb60
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x50]
cmp eax, edi
jne 0x1001d666
push 0x80004003
call fcn.10069d90
mov edx, dword [eax]
mov edx, dword [edx + 0xb8]
lea ecx, [ebp - 0xa0]
push ecx
push 0x26
push eax
call edx
cmp eax, edi
jl 0x1001e06e
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x88]
push eax
push 1
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x74]
push edx
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
cmp eax, dword [ebp - 0x74]
jg 0x1001d785
mov dword [ebp - 0x6c], edi
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 0x1c
call fcn.1001fb80
mov edx, dword [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x8c]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
cmp eax, edi
jl 0x1001d7d8
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x80], eax
cmp eax, edi
je 0x1001d701
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x7c], eax
cmp eax, edi
je 0x1001d716
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebx + 0x34]
push 2
lea eax, [ebp - 0x80]
sub ecx, 0xffffff80
push eax
push ecx
lea ecx, [ebp - 0x6c]
call fcn.10024310
test al, al
je 0x1001d744
mov edi, dword [ebx + 0x38]
add edi, 0xa4
lea eax, [ebp - 0x6c]
call fcn.1001a230
push 0x1001a260
push 2
push 4
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 0x1c
call fcn.1005d494
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x6c]
xor edi, edi
cmp eax, edi
je 0x1001d76f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp eax, dword [ebp - 0x74]
jle 0x1001d6c0
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x78], eax
cmp eax, edi
je 0x1001d79a
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x1e
mov eax, dword [ebx + 0x38]
lea ecx, [eax + 0x68]
push ecx
lea edx, [ebp - 0x78]
push edx
add eax, 0x54
push 0x34
push eax
mov eax, 1
call fcn.10020e00
push 0x1001a260
push 1
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001d7e4
lea eax, [ebp - 0x78]
push eax
call fcn.1005d494
jmp 0x1001e06e
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x6c]
jmp 0x1001ce94
lea ecx, [ebp - 0x78]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x80], eax
cmp eax, edi
je 0x1001d802
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x7c], eax
cmp eax, edi
je 0x1001d817
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x1f
mov eax, dword [ebx + 0x38]
lea ecx, [eax + 0x6c]
push ecx
lea edx, [ebp - 0x80]
push edx
add eax, 0x54
push 0x34
push eax
mov eax, 2
call fcn.10020e00
push 0x1001a260
push 2
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001d855
lea eax, [ebp - 0x80]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x80]
push ecx
call fcn.1005d494
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1001d873
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001d888
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001d89d
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x20
mov eax, dword [ebx + 0x38]
lea ecx, [eax + 0x70]
push ecx
lea edx, [ebp - 0x1c]
push edx
add eax, 0x54
push 0x34
push eax
mov eax, 3
call fcn.10020e00
push 0x1001a260
push 3
mov byte [ebp - 4], 0
push 4
test al, al
jne 0x1001d8db
lea eax, [ebp - 0x1c]
push eax
call fcn.1005d494
jmp 0x1001e06e
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1005d494
mov esi, dword [ebx + 0x38]
add esi, 0xa8
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0xac
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0xb0
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0xb4
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0xb8
call fcn.1001fb60
mov esi, dword [ebx + 0x38]
add esi, 0xbc
call fcn.1001fb60
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x54]
cmp eax, edi
jne 0x1001d94c
push 0x80004003
call fcn.10069d90
mov edx, dword [eax]
mov edx, dword [edx + 0xb8]
lea ecx, [ebp - 0x98]
push ecx
push 0x26
push eax
call edx
cmp eax, edi
jl 0x1001e06e
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x88]
push eax
push 1
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x74]
push edx
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x78], eax
cmp eax, dword [ebp - 0x74]
jg 0x1001dbef
mov dword [ebp - 0x60], edi
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 0x21
call fcn.1001fb80
mov edx, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x78]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
cmp eax, edi
jl 0x1001ce8d
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x6c], eax
cmp eax, edi
je 0x1001d9e1
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x22
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x90], eax
cmp eax, edi
je 0x1001d9fd
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x23
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x64], eax
cmp eax, edi
je 0x1001da16
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x24
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x1001da2f
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x1001da44
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x25
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x80], eax
cmp eax, edi
je 0x1001da5d
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x58]
mov dword [ebp - 0x7c], eax
cmp eax, edi
je 0x1001da72
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebx + 0x34]
push edi
push edi
add eax, 0x64
push eax
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001da99
mov edi, dword [ebx + 0x38]
add edi, 0xa8
jmp 0x1001db51
mov edx, dword [ebx + 0x34]
push 1
lea ecx, [ebp - 0x6c]
push ecx
add edx, 0x64
push edx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001dac0
mov edi, dword [ebx + 0x38]
add edi, 0xac
jmp 0x1001db51
mov ecx, dword [ebx + 0x34]
push 1
lea eax, [ebp - 0x90]
sub ecx, 0xffffff80
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001dae7
mov edi, dword [ebx + 0x38]
add edi, 0xb0
jmp 0x1001db51
mov eax, dword [ebx + 0x34]
push 1
lea edx, [ebp - 0x64]
push edx
sub eax, 0xffffff80
push eax
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001db0b
mov edi, dword [ebx + 0x38]
add edi, 0xb4
jmp 0x1001db51
mov edx, dword [ebx + 0x34]
push 2
lea ecx, [ebp - 0x18]
push ecx
sub edx, 0xffffff80
push edx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001db2f
mov edi, dword [ebx + 0x38]
add edi, 0xb8
jmp 0x1001db51
mov ecx, dword [ebx + 0x34]
push 2
lea eax, [ebp - 0x80]
sub ecx, 0xffffff80
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.10024310
test al, al
je 0x1001db59
mov edi, dword [ebx + 0x38]
add edi, 0xbc
lea eax, [ebp - 0x60]
call fcn.1001a230
push 0x1001a260
push 2
push 4
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 0x25
call fcn.1005d494
push 0x1001a260
push 2
push 4
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x24
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea ecx, [ebp - 0x64]
push ecx
mov byte [ebp - 4], 0x23
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea edx, [ebp - 0x90]
push edx
mov byte [ebp - 4], 0x22
call fcn.1005d494
push 0x1001a260
push 1
push 4
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 0x21
call fcn.1005d494
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
xor edi, edi
cmp eax, edi
je 0x1001dbdf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp eax, dword [ebp - 0x74]
jle 0x1001d9a3
mov eax, dword [ebx + 0x38]
lea ecx, [eax + 0x64]
push ecx
push edi
add eax, 0x4c
push 0x34
push eax
xor eax, eax
call fcn.10020e00
test al, al
je 0x1001e06e
mov edx, dword [0x10098790]
mov edi, dword [ebx + 0x38]
mov eax, dword [edx + 0x5c]
lea esi, [edi + 0x9c]
call fcn.10028170
push eax
add edi, 0x2c
push edi
call fcn.10020f90
test al, al
je 0x1001e06e
mov eax, dword [0x10098790]
mov edi, dword [ebx + 0x38]
mov eax, dword [eax + 0x5c]
lea esi, [edi + 0xa0]
call fcn.10028170
push eax
add edi, 0x30
push edi
call fcn.10020f90
test al, al
je 0x1001e06e
mov eax, dword [ebx + 0x38]
lea ecx, [ebp - 0x64]
push ecx
lea edx, [eax + 0xb0]
push edx
add eax, 0x34
push eax
xor esi, esi
push ebx
mov dword [ebp - 0x64], esi
call fcn.100210c0
test al, al
je 0x1001e06e
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xd8], ecx
mov eax, dword [ebx + 0x38]
lea edx, [ebp - 0x64]
push edx
lea ecx, [eax + 0xb4]
push ecx
add eax, 0x38
push eax
push ebx
mov dword [ebp - 0x64], esi
call fcn.100210c0
test al, al
je 0x1001e06e
mov eax, dword [ebp - 0x64]
mov edx, dword [ebx + 0x38]
mov dword [edx + 0xdc], eax
mov eax, dword [ebx + 0x38]
lea ecx, [ebp - 0x64]
push ecx
lea edx, [eax + 0xb8]
push edx
add eax, 0x3c
push eax
push ebx
mov dword [ebp - 0x64], esi
call fcn.100210c0
test al, al
je 0x1001e06e
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xe0], ecx
mov eax, dword [ebx + 0x38]
lea edx, [ebp - 0x64]
push edx
lea ecx, [eax + 0xbc]
push ecx
add eax, 0x40
push eax
push ebx
mov dword [ebp - 0x64], esi
call fcn.100210c0
test al, al
je 0x1001e06e
mov eax, dword [ebp - 0x64]
mov edx, dword [ebx + 0x38]
mov dword [edx + 0xe4], eax
mov edx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x38]
lea ecx, [ebp - 0x64]
push ecx
add edx, 0xb4
push edx
add eax, 0x10
push eax
push ebx
mov dword [ebp - 0x64], esi
call fcn.100210c0
test al, al
je 0x1001e06e
mov ecx, dword [ebx + 0x38]
mov edx, dword [ebp - 0x64]
mov dword [ecx + 0xc0], edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x48], eax
cmp eax, esi
je 0x1001dd62
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x44], eax
cmp eax, esi
je 0x1001dd77
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x40], eax
cmp eax, esi
je 0x1001dd8c
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x3c], eax
cmp eax, esi
je 0x1001dda1
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x38], eax
cmp eax, esi
je 0x1001ddb6
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov byte [ebp - 4], 0x27
mov eax, dword [ebx + 0x38]
mov edi, 1
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x4c], 5
cmp byte [eax + 8], 0
je 0x1001de75
mov esi, dword [ebp - 0xb0]
push ebx
push 0x100253d0
push esi
add eax, 4
push eax
push ebx
call fcn.1001e770
test al, al
lea eax, [ebp - 0x48]
jne 0x1001de21
push 0x1001a260
push 5
push 4
push eax
mov byte [ebp - 4], 0
call fcn.1005d494
jmp 0x1001e06e
push 5
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x24]
push edx
push eax
push esi
push ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x14], 7
call fcn.1001f940
test al, al
jne 0x1001df2a
push 0x1001a260
push 5
push 4
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebp - 4], 0
call fcn.1005d494
jmp 0x1001e06e
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x1001de8a
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x84]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1001dea2
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x90]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x1001deba
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x94]
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x1001ded2
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x98]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x1001deea
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
push 5
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x48]
push edx
push ebx
mov byte [ebp - 4], 0x28
call fcn.1001fa70
push 0x1001a260
push 5
mov byte [ebp - 4], 0x27
push 4
test al, al
jne 0x1001df21
lea eax, [ebp - 0x24]
push eax
call fcn.1005d494
jmp 0x1001de5a
lea edx, [ebp - 0x24]
push edx
call fcn.1005d494
push 0x1001a260
push 5
push 4
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0
call fcn.1005d494
lea eax, [ebp - 0x34]
call fcn.10010d00
mov byte [ebp - 4], 0x29
call fcn.10010df0
mov esi, eax
mov dword [ebp - 0xb0], esi
push esi
mov eax, 1
mov byte [ebp - 4], 0x2a
call fcn.10014520
mov edi, dword [ebx + 0x38]
push 0x10
add edi, 0xc0
call fcn.1005ce85
add esp, 4
test eax, eax
je 0x1001df8a
mov dword [eax], 3
mov dword [eax + 8], edi
jmp 0x1001df8c
xor eax, eax
push eax
call fcn.100144b0
push esi
mov eax, 1
call fcn.10014520
push 0x10
call fcn.1005ce85
add esp, 4
test eax, eax
je 0x1001dfba
mov dword [eax], 2
mov dword [eax + 8], 0x18
jmp 0x1001dfbc
xor eax, eax
push eax
call fcn.100144b0
push 0x10
call fcn.1005ce85
add esp, 4
test eax, eax
je 0x1001dfdf
mov dword [eax], 2
mov dword [eax + 8], 0
jmp 0x1001dfe1
xor eax, eax
push eax
call fcn.100144b0
push esi
mov eax, 0x10
call fcn.10014520
mov edi, dword [ebx + 8]
push 0x10
call fcn.1005ce85
add esp, 4
test eax, eax
je 0x1001e00e
mov dword [eax], 2
mov dword [eax + 8], edi
jmp 0x1001e010
xor eax, eax
push eax
call fcn.100144b0
push esi
mov eax, 6
call fcn.10014520
push esi
mov eax, 4
call fcn.10014520
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x34]
push edx
mov edx, esi
mov dword [ebp - 0x64], 0
call fcn.10011f20
test al, al
je 0x1001e056
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebx + 0x38]
mov dword [ebx + 8], eax
test eax, eax
setne al
mov byte [ecx], al
lea eax, [ebp - 0xb0]
call fcn.100123f0
lea edx, [ebp - 0x34]
push edx
mov byte [ebp - 4], 0
call fcn.10010d90
mov eax, dword [ebp - 0x70]
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
xor edi, edi
cmp eax, edi
je 0x1001e083
push eax
call esi
mov dword [ebp - 0x70], edi
mov eax, dword [ebp - 0x9c]
cmp eax, edi
je 0x1001e096
push eax
call esi
mov dword [ebp - 0x9c], edi
mov eax, dword [ebp - 0xa4]
cmp eax, edi
je 0x1001e0a9
push eax
call esi
mov dword [ebp - 0xa4], edi
mov eax, dword [ebp - 0x94]
cmp eax, edi
je 0x1001e0bc
push eax
call esi
mov dword [ebp - 0x94], edi
mov eax, dword [ebp - 0xa0]
cmp eax, edi
je 0x1001e0cf
push eax
call esi
mov dword [ebp - 0xa0], edi
mov eax, dword [ebp - 0x98]
cmp eax, edi
je 0x1001e0e2
push eax
call esi
mov dword [ebp - 0x98], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x1001e0f8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c755
mov esp, ebp
pop ebp
ret 0xc