Function at 0x40bc60
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58e932
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
push esi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
push edi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
call fcn.0040d4f0
push str.Value
add esi, 0x1130
push str.Property
push ebx
mov ecx, esi
mov dword [ebp - 0x3c], esi
call fcn.004a7a16
push 1
mov ecx, esi
call fcn.004a79d4
push 1
mov ecx, esi
call fcn.004ae0bb
push 1
push 1
mov ecx, esi
call fcn.004a897f
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x40bd47
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d39c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6cf0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40bd1e
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40bd28
push 0x5d6cf0
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
mov ebx, 1
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov edi, eax
jmp 0x40bd49
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40bd76
mov edx, dword [ebp - 0x14]
and ebx, 0xfffffffe
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40bd76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 4
mov eax, 0xb
test esi, esi
je 0x40be3f
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 5
or ebx, 2
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
call fcn.004aee58
mov dword [ebp - 4], 6
or ebx, 4
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3a6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6d2c
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40be07
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40be11
push 0x5d6d2c
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6cf8
mov dword [ebp - 4], 8
lea eax, [ebp - 0x50]
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
or ebx, 0xc
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6725
jmp 0x40be41
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0xb
call fcn.004a6f07
mov dword [ebp - 4], 0xa
test bl, 8
je 0x40be7d
mov edx, dword [ebp - 0x18]
and ebx, 0xfffffff7
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40be7d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x40be98
lea ecx, [ebp - 0x50]
and ebx, 0xfffffffb
push ecx
mov dword [ebp - 0x10], ebx
call eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test bl, 2
je 0x40beb0
lea ecx, [ebp - 0x38]
and ebx, 0xfffffffd
push ecx
mov dword [ebp - 0x10], ebx
call eax
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xc
test esi, esi
je 0x40bf60
xor eax, eax
lea ecx, [ebp - 0x38]
push 0x5d6d74
mov word [ebp - 0x38], ax
call fcn.004af0af
mov byte [ebp - 4], 0xd
or ebx, 0x10
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6d80
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40bf29
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40bf33
push 0x5d6d80
call fcn.0040b530
push 0
push 0
push 0
push 0
push str.vQ_NKN
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x18]
or ebx, 0x20
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.004a6725
mov esi, eax
jmp 0x40bf62
xor esi, esi
mov dword [ebp - 4], 0x10
test bl, 0x20
je 0x40bf8f
mov edx, dword [ebp - 0x18]
and ebx, 0xffffffdf
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40bf8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test bl, 0x10
je 0x40bfac
lea eax, [ebp - 0x38]
and ebx, 0xffffffef
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x10], ebx
call eax
push 1
push 0x5d6d88
mov ecx, esi
call fcn.004a6e3a
push 1
push 0x5d6d8c
mov ecx, esi
call fcn.004a6e3a
push 1
push 0x5d6d90
mov ecx, esi
call fcn.004a6e3a
push 1
push 0x5d6d9c
mov ecx, esi
call fcn.004a6e3a
push esi
mov ecx, edi
mov dword [esi + 0x68], 0
call fcn.004a6f07
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0x12
mov eax, 8
test esi, esi
je 0x40c0d2
push 0x5d6dc4
mov word [ebp - 0x38], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40d3ba
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x13
or ebx, 0x40
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
call fcn.004aee58
mov dword [ebp - 4], 0x14
or ebx, 0x80
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3c4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6dcc
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40c097
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c0a1
push 0x5d6dcc
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6da8
mov dword [ebp - 4], 0x16
lea eax, [ebp - 0x50]
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
or ebx, 0x180
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6725
jmp 0x40c0d4
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x19
call fcn.004a6f07
mov dword [ebp - 4], 0x18
test ebx, 0x100
je 0x40c116
mov edx, dword [ebp - 0x18]
and ebx, 0xfffffeff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c116
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, bl
jns 0x40c12f
lea eax, [ebp - 0x50]
and ebx, 0xffffff7f
push eax
mov dword [ebp - 0x10], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x40c147
lea eax, [ebp - 0x38]
and ebx, 0xffffffbf
push eax
mov dword [ebp - 0x10], ebx
call esi
mov ecx, dword [ebp - 0x3c]
push 1
push 1
push edi
call fcn.004a6e83
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x1a
test esi, esi
je 0x40c1d4
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6dd4
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40c1a9
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c1b3
push 0x5d6dd4
call fcn.0040b530
push 1
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
or ebx, 0x200
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov dword [ebp - 0x20], eax
jmp 0x40c1db
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200
je 0x40c20e
mov edx, dword [ebp - 0x18]
and ebx, 0xfffffdff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c20e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x1e
mov eax, 3
test esi, esi
je 0x40c2e1
mov word [ebp - 0x38], ax
mov dword [ebp - 0x30], 0xfa
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x1f
or ebx, 0x400
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], ebx
mov edi, ebx
call fcn.004aee58
mov dword [ebp - 4], 0x20
or ebx, 0x800
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3d8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6df0
mov dword [ebp - 4], 0x21
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40c2a5
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c2af
push 0x5d6df0
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6de0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0x22
push eax
mov ebx, edi
lea eax, [ebp - 0x14]
or ebx, 0x1800
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6725
mov esi, eax
jmp 0x40c2e3
xor esi, esi
mov dword [ebp - 4], 0x24
test ebx, 0x1000
je 0x40c316
mov edx, dword [ebp - 0x14]
and ebx, 0xffffefff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c316
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, 0x800
je 0x40c333
lea eax, [ebp - 0x50]
and ebx, 0xfffff7ff
push eax
mov dword [ebp - 0x10], ebx
call edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400
je 0x40c351
lea eax, [ebp - 0x38]
and ebx, 0xfffffbff
push eax
mov dword [ebp - 0x10], ebx
call edi
push 0x12c
push 0x32
push 1
mov ecx, esi
call fcn.004a7b3a
mov edi, dword [ebp - 0x20]
mov ecx, edi
push esi
call fcn.004a6f07
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x26
test esi, esi
je 0x40c442
mov eax, 3
mov dword [ebp - 0x30], 0x96
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x27
or ebx, 0x2000
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], ebx
mov edi, ebx
call fcn.004aee58
mov dword [ebp - 4], 0x28
or ebx, 0x4000
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3e2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6e08
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40c403
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c40d
push 0x5d6e08
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6df8
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0x2a
push eax
mov ebx, edi
lea eax, [ebp - 0x14]
or ebx, 0xc000
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6725
mov edi, dword [ebp - 0x20]
mov esi, eax
jmp 0x40c444
xor esi, esi
mov dword [ebp - 4], 0x2c
test ebx, 0x8000
je 0x40c477
mov edx, dword [ebp - 0x14]
and ebx, 0xffff7fff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c477
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, 0x4000
je 0x40c493
lea eax, [ebp - 0x50]
and ebx, 0xffffbfff
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x10], ebx
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000
je 0x40c4b5
lea eax, [ebp - 0x38]
and ebx, 0xffffdfff
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, esi
call fcn.004a7b3a
push esi
mov ecx, edi
call fcn.004a6f07
mov ecx, dword [ebp - 0x3c]
push 1
push 1
push edi
call fcn.004a6e83
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x2e
test esi, esi
je 0x40c559
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3ec
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6e10
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40c52f
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c539
push 0x5d6e10
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x30
or ebx, 0x10000
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov edi, eax
jmp 0x40c55b
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x10000
je 0x40c58e
mov edx, dword [ebp - 0x18]
and ebx, 0xfffeffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c58e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.0044303a
lea ecx, [ebp - 0xd0]
push ecx
push 0x5c
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x5d6e18
lea eax, [ebp - 0xb4]
push 0x20
push eax
call fcn.005779c0
push 0x1a8
call fcn.0040e780
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x32
test esi, esi
je 0x40c64f
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d3f6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6e40
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40c616
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c620
push 0x5d6e40
call fcn.0040b530
push 0xffffffffffffffff
push 0
push 0x5d6e2c
push 0x101
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x34
push eax
lea eax, [ebp - 0x14]
or ebx, 0x20000
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.004a6690
jmp 0x40c651
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x35
call fcn.004a6f07
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000
je 0x40c693
mov edx, dword [ebp - 0x14]
and ebx, 0xfffdffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c693
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0x36
test esi, esi
je 0x40c766
mov eax, 0xb
mov word [ebp - 0x38], ax
or eax, 0xffffffff
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x37
or ebx, 0x40000
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
call fcn.004aee58
mov dword [ebp - 4], 0x38
or ebx, 0x80000
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d400
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6e78
mov dword [ebp - 4], 0x39
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40c72b
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c735
push 0x5d6e78
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6e48
mov dword [ebp - 4], 0x3a
lea eax, [ebp - 0x50]
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
or ebx, 0x180000
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6725
jmp 0x40c768
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x3d
call fcn.004a6f07
mov dword [ebp - 4], 0x3c
test ebx, 0x100000
je 0x40c7aa
mov edx, dword [ebp - 0x14]
and ebx, 0xffefffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c7aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, 0x80000
je 0x40c7c7
lea eax, [ebp - 0x50]
and ebx, 0xfff7ffff
push eax
mov dword [ebp - 0x10], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000
je 0x40c7e5
lea eax, [ebp - 0x38]
and ebx, 0xfffbffff
push eax
mov dword [ebp - 0x10], ebx
call esi
mov ecx, dword [ebp - 0x3c]
push 1
push 1
push edi
call fcn.004a6e83
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x3e
test esi, esi
je 0x40c871
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d40a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6e88
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40c847
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c851
push 0x5d6e88
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x40
or ebx, 0x200000
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov edi, eax
jmp 0x40c873
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200000
je 0x40c8a6
mov edx, dword [ebp - 0x18]
and ebx, 0xffdfffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c8a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x42
test esi, esi
je 0x40c959
xor eax, eax
lea ecx, [ebp - 0x38]
push 0x5d6e90
mov word [ebp - 0x38], ax
call fcn.004af0af
mov byte [ebp - 4], 0x43
or ebx, 0x400000
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d414
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6e9c
mov dword [ebp - 4], 0x44
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40c922
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40c92c
push 0x5d6e9c
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x45
push eax
lea eax, [ebp - 0x14]
or ebx, 0x800000
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.004a6725
mov esi, eax
jmp 0x40c95b
xor esi, esi
mov dword [ebp - 4], 0x46
test ebx, 0x800000
je 0x40c98e
mov edx, dword [ebp - 0x14]
and ebx, 0xff7fffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c98e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400000
je 0x40c9b0
lea eax, [ebp - 0x38]
and ebx, 0xffbfffff
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
mov ecx, esi
call fcn.004a7976
push esi
mov ecx, edi
call fcn.004a6f07
push pe_nt_image_headers32
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0x48
test esi, esi
je 0x40ca50
mov dword [ebp - 0x1c], 0xfec0d2
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d41e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6ebc
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40ca1d
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40ca27
push 0x5d6ebc
call fcn.0040b530
push 0
push 0x5d6ea8
push 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0x14]
or ebx, 0x1000000
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.004a6204
mov esi, eax
jmp 0x40ca52
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x1000000
je 0x40ca85
mov edx, dword [ebp - 0x14]
and ebx, 0xfeffffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ca85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 1
push 0x5d6ec8
mov ecx, esi
call fcn.004a7b07
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x5d6ed4
mov ecx, esi
call fcn.004a79a6
push esi
mov ecx, edi
call fcn.004a6f07
push 0x100
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x4c
test esi, esi
je 0x40cb9f
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d428
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov eax, 0x5d6ef4
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x28]
test eax, 0xffff0000
jne 0x40cb0d
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40cb17
push 0x5d6ef4
call fcn.0040b530
mov byte [ebp - 4], 0x4e
or ebx, 0x2000000
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d432
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6ef8
mov dword [ebp - 4], 0x4f
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40cb5f
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40cb69
push 0x5d6ef8
call fcn.0040b530
push 0
push 0x5d6edc
push 0x5db188
push 0
push 0x5d6eec
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0x50
push eax
push 1
lea eax, [ebp - 0x14]
or ebx, 0x4000000
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.004a65bb
jmp 0x40cba1
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x52
call fcn.004a6f07
mov dword [ebp - 4], 0x51
test ebx, 0x4000000
je 0x40cbe3
mov edx, dword [ebp - 0x14]
and ebx, 0xfbffffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cbe3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000000
je 0x40cc16
mov edx, dword [ebp - 0x28]
and ebx, 0xfdffffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cc16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x100
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x53
test esi, esi
je 0x40ccf0
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d43c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6f00
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40cc6f
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40cc79
push 0x5d6f00
call fcn.0040b530
mov byte [ebp - 4], 0x55
or ebx, 0x8000000
mov dword [ebp - 0x10], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d446
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov eax, 0x5d6f08
mov dword [ebp - 4], 0x56
lea ecx, [ebp - 0x28]
test eax, 0xffff0000
jne 0x40ccc1
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40cccb
push 0x5d6f08
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0x57
push eax
lea eax, [ebp - 0x28]
or ebx, 0x10000000
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.004a652a
jmp 0x40ccf2
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x59
call fcn.004a6f07
mov dword [ebp - 4], 0x58
test ebx, 0x10000000
je 0x40cd34
mov edx, dword [ebp - 0x28]
and ebx, 0xefffffff
mov dword [ebp - 0x10], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x8000000
je 0x40cd64
mov edx, dword [ebp - 0x14]
and ebx, 0xf7ffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
push 1
push 1
push edi
call fcn.004a6e83
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0x5a
test esi, esi
je 0x40cdf1
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d450
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov eax, str.B_k
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x28]
test eax, 0xffff0000
jne 0x40cdc6
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40cdd0
push str.B_k
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x5c
or ebx, 0x20000000
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov dword [ebp - 0x1c], eax
jmp 0x40cdf8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000000
je 0x40ce28
mov edx, dword [ebp - 0x28]
and ebx, 0xdfffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ce28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0x5e
test esi, esi
je 0x40cea7
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d45a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6f1c
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40ce7d
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40ce87
push 0x5d6f1c
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x60
or ebx, 0x40000000
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov edi, eax
jmp 0x40cea9
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000000
je 0x40ced9
mov edx, dword [ebp - 0x18]
and ebx, 0xbfffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ced9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
push edi
call fcn.004a6f07
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0x62
test esi, esi
je 0x40cf64
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d464
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, 0x5d6f28
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x40cf37
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40cf41
push 0x5d6f28
call fcn.0040b530
push 0
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x64
or ebx, 0x80000000
mov ecx, esi
push eax
mov dword [ebp - 0x10], ebx
call fcn.004a6847
mov esi, eax
mov dword [ebp - 0x20], eax
jmp 0x40cf69
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
jns 0x40cf8f
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cf8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
mov ecx, edi
call fcn.004a6f07
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x66
test esi, esi
je 0x40d06e
mov eax, 8
push 0x5d6f40
mov word [ebp - 0x38], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40d46e
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x67
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x24], 1
call fcn.004aee58
mov dword [ebp - 4], 0x68
mov dword [ebp - 0x24], 3
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d478
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6f48
mov dword [ebp - 4], 0x69
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40d037
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40d041
push 0x5d6f48
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6f34
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0x18]
mov ebx, 7
push eax
mov ecx, esi
mov dword [ebp - 0x24], ebx
call fcn.004a6725
jmp 0x40d073
mov ebx, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 4], 0x6d
mov edi, dword [ebp - 0x20]
mov ecx, edi
push eax
call fcn.004a6f07
mov dword [ebp - 4], 0x6c
test bl, 4
je 0x40d0b2
mov edx, dword [ebp - 0x18]
and ebx, 0xfffffffb
mov dword [ebp - 0x24], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d0b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x40d0c9
lea eax, [ebp - 0x50]
and ebx, 0xfffffffd
push eax
mov dword [ebp - 0x24], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40d0e1
lea eax, [ebp - 0x38]
and ebx, 0xfffffffe
push eax
mov dword [ebp - 0x24], ebx
call esi
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0x6e
test esi, esi
je 0x40d1ba
mov eax, 8
push 0x5d6f5c
mov word [ebp - 0x38], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40d482
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x6f
or ebx, 8
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], ebx
call fcn.004aee58
mov dword [ebp - 4], 0x70
or ebx, 0x10
mov dword [ebp - 0x24], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d48c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5d6f64
mov dword [ebp - 4], 0x71
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x40d182
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40d18c
push 0x5d6f64
call fcn.0040b530
push 0
push 0
push 0
push 0
push 0x5d6f50
mov dword [ebp - 4], 0x72
lea eax, [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
or ebx, 0x30
push eax
mov dword [ebp - 0x24], ebx
call fcn.004a6725
jmp 0x40d1bc
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x75
call fcn.004a6f07
mov dword [ebp - 4], 0x74
test bl, 0x20
je 0x40d1f8
mov edx, dword [ebp - 0x18]
and ebx, 0xffffffdf
mov dword [ebp - 0x24], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d1f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 0x10
je 0x40d20f
lea eax, [ebp - 0x50]
and ebx, 0xffffffef
push eax
mov dword [ebp - 0x24], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x40d227
lea eax, [ebp - 0x38]
and ebx, 0xfffffff7
push eax
mov dword [ebp - 0x24], ebx
call esi
push 0xe8
call fcn.0040e780
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0x76
test esi, esi
je 0x40d306
mov eax, 8
push 0x5d6f78
mov word [ebp - 0x60], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x40d496
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x77
or ebx, 0x40
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], ebx
call fcn.004aee58
mov dword [ebp - 4], 0x78
or ebx, 0x80
mov dword [ebp - 0x24], ebx
call fcn.00444bde
mov ecx, eax
test ecx, ecx
je 0x40d4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, 0x5d6f80
mov dword [ebp - 4], 0x79
lea ecx, [ebp - 0x20]
test eax, 0xffff0000
jne 0x40d2cb
movzx eax, ax
push eax
call fcn.00405ed0
jmp 0x40d2d5
push 0x5d6f80
call fcn.0040b530
push 0
push 0
push 0
push 0
push str.dk:N
mov dword [ebp - 4], 0x7a
lea eax, [ebp - 0x70]
mov ebx, dword [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x20]
or ebx, 0x180
push eax
mov dword [ebp - 0x24], ebx
call fcn.004a6725
jmp 0x40d308
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], 0x7d
call fcn.004a6f07
mov dword [ebp - 4], 0x7c
test ebx, 0x100
je 0x40d34a
mov edx, dword [ebp - 0x20]
and ebx, 0xfffffeff
mov dword [ebp - 0x24], ebx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d34a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, bl
jns 0x40d360
lea eax, [ebp - 0x70]
and ebx, 0xffffff7f
push eax
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x40d372
lea eax, [ebp - 0x60]
push eax
call esi
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push 0
call fcn.004a7d67
mov ecx, dword [ebp - 0x3c]
push 1
push 1
push ebx
call fcn.004a6e83
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x8007000e
call fcn.00571c30
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x80004005
call fcn.00404250
push 0x8007000e
call fcn.00571c30
push 0x80004005
call fcn.00404250
push 0x8007000e
call fcn.00571c30
push 0x80004005
call fcn.00404250
push 0x8007000e
call fcn.00571c30
push 0x80004005
call fcn.00404250
int3