Function at 0x408820
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fe0b
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x1286440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov edi, ecx
mov dword [ebp - 0x88], ebx
call fcn.00409c60
push 0x125d910
lea esi, [edi + 0x1094]
push 0x125d91c
push ebx
mov ecx, esi
mov dword [ebp - 0xb4], esi
call fcn.0049be9c
push 1
mov ecx, esi
call fcn.0049bf58
push 1
mov ecx, esi
call fcn.0049cc3a
push 1
push 1
mov ecx, esi
call fcn.0049cfb8
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x4088e4
push 0x125d930
lea ecx, [ebp - 0x78]
call fcn.00409f00
push 0
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 1
mov ebx, 1
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov dword [ebp - 0x84], eax
jmp 0x4088ee
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40891f
mov eax, dword [ebp - 0x78]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40891f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 3
test edi, edi
je 0x4089b5
mov ecx, 0xb
xor edx, edx
mov word [ebp - 0xa0], cx
mov word [ebp - 0x98], dx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 4
or ebx, 2
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a29f3
mov dword [ebp - 4], 5
or ebx, 4
push 0x125d96c
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125d938
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 8
mov dword [ebp - 4], 6
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
jmp 0x4089b7
xor eax, eax
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049d15e
mov dword [ebp - 4], 8
test bl, 8
je 0x4089fb
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4089fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x408a15
lea ecx, [ebp - 0xb0]
and ebx, 0xfffffffb
push ecx
mov dword [ebp - 0x74], ebx
call edi
mov dword [ebp - 4], 0xffffffff
test bl, 2
je 0x408a30
lea edx, [ebp - 0xa0]
and ebx, 0xfffffffd
push edx
mov dword [ebp - 0x74], ebx
call edi
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0xa
test edi, edi
je 0x408aad
xor eax, eax
push 0x125d9b4
lea ecx, [ebp - 0xa0]
mov word [ebp - 0xa0], ax
call fcn.004a2d7c
mov byte [ebp - 4], 0xb
or ebx, 0x10
push 0x125d9c0
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125d978
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 0x20
mov dword [ebp - 4], 0xc
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
mov edi, eax
jmp 0x408aaf
xor edi, edi
mov dword [ebp - 4], 0xd
test bl, 0x20
je 0x408ae0
mov eax, dword [ebp - 0x80]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ae0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test bl, 0x10
je 0x408aff
lea ecx, [ebp - 0xa0]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
push 0x125d9c8
mov ecx, edi
call fcn.0049a800
push 1
push 0x125d9cc
mov ecx, edi
call fcn.0049a800
push 1
push 0x125d9d0
mov ecx, edi
call fcn.0049a800
push 1
push 0x125d9b4
mov ecx, edi
call fcn.0049a800
mov ecx, dword [ebp - 0x84]
push edi
mov dword [edi + 0x64], 0
call fcn.0049d15e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0xf
test edi, edi
je 0x408c00
mov edx, 8
push 0x125d9f8
mov word [ebp - 0xa0], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x408b96
push 0x8007000e
call fcn.0055d5e0
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x10
or ebx, 0x40
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a29f3
mov dword [ebp - 4], 0x11
or ebx, 0x80
push 0x125da00
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125d9dc
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 0x100
mov dword [ebp - 4], 0x12
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
jmp 0x408c02
xor eax, eax
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049d15e
mov dword [ebp - 4], 0x14
test ebx, 0x100
je 0x408c4c
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x408c66
lea ecx, [ebp - 0xb0]
and ebx, 0xffffff7f
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x408c85
lea edx, [ebp - 0xa0]
and ebx, 0xffffffbf
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x84]
push 1
push 1
push eax
mov ecx, esi
call fcn.0049d43e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x16
test edi, edi
je 0x408ce1
push 0x125da08
lea ecx, [ebp - 0x80]
call fcn.00409f00
push 1
push 0
lea ecx, [ebp - 0x80]
or ebx, 0x200
push ecx
mov byte [ebp - 4], 0x17
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov esi, eax
jmp 0x408ce3
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200
je 0x408d1a
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffdff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408d1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x19
test edi, edi
je 0x408dc0
mov ecx, 3
mov word [ebp - 0xa0], cx
mov dword [ebp - 0x98], 0xfa
lea edx, [ebp - 0xa0]
mov byte [ebp - 4], 0x1a
or ebx, 0x400
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a29f3
mov dword [ebp - 4], 0x1b
or ebx, 0x800
push 0x125da24
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125da14
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x78]
or ebx, 0x1000
push ecx
mov dword [ebp - 4], 0x1c
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
mov edi, eax
jmp 0x408dc2
xor edi, edi
mov dword [ebp - 4], 0x1e
test ebx, 0x1000
je 0x408df9
mov eax, dword [ebp - 0x78]
and ebx, 0xffffefff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408df9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x800
je 0x408e17
lea ecx, [ebp - 0xb0]
and ebx, 0xfffff7ff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400
je 0x408e3c
lea edx, [ebp - 0xa0]
and ebx, 0xfffffbff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x12c
push 0x32
push 1
mov ecx, edi
call fcn.0049a849
push edi
mov ecx, esi
call fcn.0049d15e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x20
test edi, edi
je 0x408efa
mov eax, 3
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x98], 0x96
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x21
or ebx, 0x2000
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a29f3
mov dword [ebp - 4], 0x22
or ebx, 0x4000
push 0x125da3c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125da2c
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x8000
mov dword [ebp - 4], 0x23
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
mov edi, eax
jmp 0x408efc
xor edi, edi
mov dword [ebp - 4], 0x25
test ebx, 0x8000
je 0x408f33
mov eax, dword [ebp - 0x78]
and ebx, 0xffff7fff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408f33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x4000
je 0x408f51
lea ecx, [ebp - 0xb0]
and ebx, 0xffffbfff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000
je 0x408f76
lea edx, [ebp - 0xa0]
and ebx, 0xffffdfff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, edi
call fcn.0049a849
push edi
mov ecx, esi
call fcn.0049d15e
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049d43e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x27
test edi, edi
je 0x408fe8
push 0x125da44
lea ecx, [ebp - 0x80]
call fcn.00409f00
push 0
push 0
lea eax, [ebp - 0x80]
or ebx, 0x10000
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov esi, eax
jmp 0x408fea
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x10000
je 0x409021
mov eax, dword [ebp - 0x80]
and ebx, 0xfffeffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409021
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.00414cdb
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x70]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x125da4c
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1a4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x2a
test edi, edi
je 0x4090a4
push 0x125da44
lea ecx, [ebp - 0x78]
call fcn.00409f00
push 0xffffffffffffffff
push 0
push 0x125da60
push 0x101
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x20000
mov byte [ebp - 4], 0x2b
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2429
jmp 0x4090a6
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.0049d15e
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000
je 0x4090ec
mov eax, dword [ebp - 0x78]
and ebx, 0xfffdffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4090ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x2d
test edi, edi
je 0x409190
mov ecx, 0xb
or edx, 0xffffffff
mov word [ebp - 0xa0], cx
mov word [ebp - 0x98], dx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x2e
or ebx, 0x40000
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a29f3
mov dword [ebp - 4], 0x2f
or ebx, 0x80000
push 0x125daa4
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125da74
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x100000
mov dword [ebp - 4], 0x30
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
jmp 0x409192
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.0049d15e
mov dword [ebp - 4], 0x32
test ebx, 0x100000
je 0x4091d8
mov eax, dword [ebp - 0x78]
and ebx, 0xffefffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x80000
je 0x4091f6
lea ecx, [ebp - 0xb0]
and ebx, 0xfff7ffff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000
je 0x40921b
lea edx, [ebp - 0xa0]
and ebx, 0xfffbffff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049d43e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x34
test edi, edi
je 0x409275
push 0x125dab4
lea ecx, [ebp - 0x80]
call fcn.00409f00
push 0
push 0
lea eax, [ebp - 0x80]
or ebx, 0x200000
mov byte [ebp - 4], 0x35
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov esi, eax
jmp 0x409277
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200000
je 0x4092ae
mov eax, dword [ebp - 0x80]
and ebx, 0xffdfffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4092ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x37
test edi, edi
je 0x40932e
xor ecx, ecx
mov word [ebp - 0xa0], cx
push 0x125d8f8
lea ecx, [ebp - 0xa0]
call fcn.004a2d7c
mov byte [ebp - 4], 0x38
or ebx, 0x400000
push 0x125dabc
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x800000
mov dword [ebp - 4], 0x39
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a1cec
mov edi, eax
jmp 0x409330
xor edi, edi
mov dword [ebp - 4], 0x3a
test ebx, 0x800000
je 0x409367
mov eax, dword [ebp - 0x78]
and ebx, 0xff7fffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409367
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400000
je 0x40938c
lea ecx, [ebp - 0xa0]
and ebx, 0xffbfffff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
mov ecx, edi
call fcn.0049b172
push edi
mov ecx, esi
call fcn.0049d15e
push 0x118
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x3c
test edi, edi
je 0x4093fd
push 0x125dadc
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xb8], 0xfec0d2
call fcn.00409f00
push 0
push 0x125dac8
push 0
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x1000000
mov byte [ebp - 4], 0x3d
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2055
mov edi, eax
jmp 0x4093ff
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x1000000
je 0x409436
mov eax, dword [ebp - 0x78]
and ebx, 0xfeffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409436
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 1
push 0x125dae8
mov ecx, edi
call fcn.004a19cd
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x125daf4
mov ecx, edi
call fcn.004a199d
push edi
mov ecx, esi
call fcn.0049d15e
push pe_nt_image_headers32
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x3f
test edi, edi
je 0x4094e5
push 0x125e3b8
lea ecx, [ebp - 0x84]
call fcn.00409f00
mov byte [ebp - 4], 0x40
or ebx, 0x2000000
push 0x125db5c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0x125db44
push 0x125db00
push 0
push 0x125db54
lea ecx, [ebp - 0x84]
push ecx
push 1
lea edx, [ebp - 0x78]
or ebx, 0x4000000
mov dword [ebp - 4], 0x41
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a21cd
jmp 0x4094e7
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.0049d15e
mov dword [ebp - 4], 0x42
test ebx, 0x4000000
je 0x40952d
mov eax, dword [ebp - 0x78]
and ebx, 0xfbffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40952d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000000
je 0x409567
mov eax, dword [ebp - 0x84]
and ebx, 0xfdffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409567
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push pe_nt_image_headers32
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x44
test edi, edi
je 0x4095d6
push 0x125db64
lea ecx, [ebp - 0x84]
call fcn.00409f00
mov byte [ebp - 4], 0x45
or ebx, 0x8000000
push 0x125db6c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.00409f00
push 0
push 0
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x10000000
mov dword [ebp - 4], 0x46
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a213e
jmp 0x4095d8
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x48
call fcn.0049d15e
mov dword [ebp - 4], 0x47
test ebx, 0x10000000
je 0x40961e
mov eax, dword [ebp - 0x78]
and ebx, 0xefffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40961e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x8000000
je 0x409655
mov eax, dword [ebp - 0x84]
add eax, 0xfffffff0
and ebx, 0xf7ffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409655
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049d43e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x49
test edi, edi
je 0x4096b0
push 0x125db74
lea ecx, [ebp - 0x80]
call fcn.00409f00
push 0
push 0
lea ecx, [ebp - 0x80]
or ebx, 0x20000000
push ecx
mov byte [ebp - 4], 0x4a
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov dword [ebp - 0x78], eax
jmp 0x4096b7
mov dword [ebp - 0x78], 0
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000000
je 0x4096eb
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
and ebx, 0xdfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4096eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x4c
test edi, edi
je 0x40973b
push 0x125db80
lea ecx, [ebp - 0x8c]
call fcn.00409f00
push 0
push 0
lea ecx, [ebp - 0x8c]
or ebx, 0x40000000
push ecx
mov byte [ebp - 4], 0x4d
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov esi, eax
jmp 0x40973d
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000000
je 0x409774
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
and ebx, 0xbfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409774
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x78]
push esi
call fcn.0049d15e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x4f
test edi, edi
je 0x4097d1
push 0x125db8c
lea ecx, [ebp - 0xb8]
call fcn.00409f00
push 0
push 0
lea ecx, [ebp - 0xb8]
or ebx, 0x80000000
push ecx
mov byte [ebp - 4], 0x50
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049d654
mov dword [ebp - 0x84], eax
jmp 0x4097db
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
jns 0x409808
mov eax, dword [ebp - 0xb8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409808
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x84]
push ecx
mov ecx, esi
call fcn.0049d15e
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x52
test edi, edi
je 0x4098d9
mov edx, 8
push 0x125dba4
mov word [ebp - 0xa0], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x409862
push 0x8007000e
call fcn.0055d5e0
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], 1
call fcn.004a29f3
mov dword [ebp - 4], 0x54
push 0x125dbac
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], 3
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125db98
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x8c]
mov dword [ebp - 4], 0x55
mov ebx, 7
push edx
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.004a1cec
jmp 0x4098e1
mov ebx, dword [ebp - 0x88]
xor eax, eax
mov dword [ebp - 4], 0x58
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049d15e
mov dword [ebp - 4], 0x57
test bl, 4
je 0x40992b
mov eax, dword [ebp - 0x8c]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40992b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x409948
lea ecx, [ebp - 0xb0]
and ebx, 0xfffffffd
push ecx
mov dword [ebp - 0x88], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x409966
lea edx, [ebp - 0xa0]
and ebx, 0xfffffffe
push edx
mov dword [ebp - 0x88], ebx
call esi
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x59
test edi, edi
je 0x409a25
mov eax, 8
push 0x125dbb4
mov word [ebp - 0xa0], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x4099b2
push 0x8007000e
call fcn.0055d5e0
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x5a
or ebx, 8
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], ebx
call fcn.004a29f3
mov dword [ebp - 4], 0x5b
or ebx, 0x10
push 0x125dbbc
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125db98
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x8c]
or ebx, 0x20
mov dword [ebp - 4], 0x5c
push eax
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.004a1cec
jmp 0x409a27
xor eax, eax
mov dword [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049d15e
mov dword [ebp - 4], 0x5e
test bl, 0x20
je 0x409a71
mov eax, dword [ebp - 0x8c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409a71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 0x10
je 0x409a88
lea ecx, [ebp - 0xb0]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x88], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x409aa6
lea edx, [ebp - 0xa0]
and ebx, 0xfffffff7
push edx
mov dword [ebp - 0x88], ebx
call esi
push 0xe4
call fcn.0040a13d
mov edi, eax
add esp, 4
mov dword [ebp - 0x8c], edi
mov dword [ebp - 4], 0x60
test edi, edi
je 0x409b68
mov eax, 8
push 0x125dbc4
mov word [ebp - 0xc8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xc0], eax
test eax, eax
jne 0x409af5
push 0x8007000e
call fcn.0055d5e0
lea ecx, [ebp - 0xc8]
push ecx
mov byte [ebp - 4], 0x61
or ebx, 0x40
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x88], ebx
call fcn.004a29f3
mov dword [ebp - 4], 0x62
or ebx, 0x80
push 0x125dbcc
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x88], ebx
call fcn.00409f00
push 0
push 0
push 0
push 0
push 0x125db98
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0x7c]
or ebx, 0x100
mov dword [ebp - 4], 0x63
push eax
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.004a1cec
jmp 0x409b6a
xor eax, eax
mov dword [ebp - 4], 0x66
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049d15e
mov dword [ebp - 4], 0x65
test ebx, 0x100
je 0x409bb7
mov eax, dword [ebp - 0x7c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x409bca
lea ecx, [ebp - 0xd8]
push ecx
and ebx, 0xffffff7f
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x409bdf
lea edx, [ebp - 0xc8]
push edx
call esi
mov esi, dword [ebp - 0x78]
push 0
mov ecx, esi
call fcn.0049af98
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049d43e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00546c71
mov esp, ebp
pop ebp
ret