Function at 0x406220
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d118
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x5c7100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov edi, ecx
mov dword [ebp - 0x64], ebx
call fcn.00407510
push str.Value
lea esi, [edi + 0x1094]
push str.Property
push ebx
mov ecx, esi
mov dword [ebp - 0x8c], esi
call fcn.00487fec
push 1
mov ecx, esi
call fcn.004880a8
push 1
mov ecx, esi
call fcn.00488d8a
push 1
push 1
mov ecx, esi
call fcn.004890e8
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x4062de
push 0x59f594
lea ecx, [ebp - 0x54]
call fcn.00407780
push 0
push 0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
mov ebx, 1
push eax
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov dword [ebp - 0x60], eax
jmp 0x4062e5
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x406316
mov eax, dword [ebp - 0x54]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406316
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 3
test edi, edi
je 0x4063a3
mov ecx, 0xb
xor edx, edx
mov word [ebp - 0x78], cx
mov word [ebp - 0x70], dx
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 4
or ebx, 2
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x50], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 5
or ebx, 4
push 0x59f5d0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f59c
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x5c]
or ebx, 8
mov dword [ebp - 4], 6
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
jmp 0x4063a5
xor eax, eax
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x60]
push eax
call fcn.004892eb
mov dword [ebp - 4], 8
test bl, 8
je 0x4063e6
mov eax, dword [ebp - 0x5c]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4063e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x406400
lea ecx, [ebp - 0x88]
and ebx, 0xfffffffb
push ecx
mov dword [ebp - 0x50], ebx
call edi
mov dword [ebp - 4], 0xffffffff
test bl, 2
je 0x406418
lea edx, [ebp - 0x78]
and ebx, 0xfffffffd
push edx
mov dword [ebp - 0x50], ebx
call edi
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0xa
test edi, edi
je 0x40648c
xor eax, eax
push 0x59f614
lea ecx, [ebp - 0x78]
mov word [ebp - 0x78], ax
call fcn.0048eeae
mov byte [ebp - 4], 0xb
or ebx, 0x10
push 0x59f620
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f5dc
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x5c]
or ebx, 0x20
mov dword [ebp - 4], 0xc
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
mov edi, eax
jmp 0x40648e
xor edi, edi
mov dword [ebp - 4], 0xd
test bl, 0x20
je 0x4064bf
mov eax, dword [ebp - 0x5c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test bl, 0x10
je 0x4064db
lea ecx, [ebp - 0x78]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
push 0x59f628
mov ecx, edi
call fcn.00486903
push 1
push 0x59f62c
mov ecx, edi
call fcn.00486903
push 1
push 0x59f630
mov ecx, edi
call fcn.00486903
push 1
push 0x59f614
mov ecx, edi
call fcn.00486903
mov ecx, dword [ebp - 0x60]
push edi
mov dword [edi + 0x64], 0
call fcn.004892eb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0xf
test edi, edi
je 0x4065bd
mov edx, 8
push 0x59f658
mov word [ebp - 0x78], dx
call fcn.0055ab00
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x10
or ebx, 0x40
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x50], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 0x11
or ebx, 0x80
push 0x59f660
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f63c
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x5c]
or ebx, 0x100
mov dword [ebp - 4], 0x12
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
jmp 0x4065bf
xor eax, eax
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x60]
push eax
call fcn.004892eb
mov dword [ebp - 4], 0x14
test ebx, 0x100
je 0x406606
mov eax, dword [ebp - 0x5c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406606
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x406620
lea ecx, [ebp - 0x88]
and ebx, 0xffffff7f
push ecx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x40663c
lea edx, [ebp - 0x78]
and ebx, 0xffffffbf
push edx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x60]
push 1
push 1
push eax
mov ecx, esi
call fcn.004895cb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x16
test edi, edi
je 0x406695
push 0x59f668
lea ecx, [ebp - 0x5c]
call fcn.00407780
push 1
push 0
lea ecx, [ebp - 0x5c]
or ebx, 0x200
push ecx
mov byte [ebp - 4], 0x17
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov esi, eax
jmp 0x406697
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200
je 0x4066ce
mov eax, dword [ebp - 0x5c]
and ebx, 0xfffffdff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4066ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x19
test edi, edi
je 0x406767
mov ecx, 3
mov word [ebp - 0x78], cx
mov dword [ebp - 0x70], 0xfa
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 0x1a
or ebx, 0x400
push edx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x50], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 0x1b
or ebx, 0x800
push 0x59f684
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f674
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x54]
or ebx, 0x1000
push ecx
mov dword [ebp - 4], 0x1c
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
mov edi, eax
jmp 0x406769
xor edi, edi
mov dword [ebp - 4], 0x1e
test ebx, 0x1000
je 0x4067a0
mov eax, dword [ebp - 0x54]
and ebx, 0xffffefff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4067a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x800
je 0x4067be
lea ecx, [ebp - 0x88]
and ebx, 0xfffff7ff
push ecx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400
je 0x4067e0
lea edx, [ebp - 0x78]
and ebx, 0xfffffbff
push edx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x12c
push 0x32
push 1
mov ecx, edi
call fcn.0048694c
push edi
mov ecx, esi
call fcn.004892eb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x20
test edi, edi
je 0x406891
mov eax, 3
mov word [ebp - 0x78], ax
mov dword [ebp - 0x70], 0x96
lea ecx, [ebp - 0x78]
push ecx
mov byte [ebp - 4], 0x21
or ebx, 0x2000
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x50], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 0x22
or ebx, 0x4000
push 0x59f69c
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f68c
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x54]
or ebx, 0x8000
mov dword [ebp - 4], 0x23
push eax
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
mov edi, eax
jmp 0x406893
xor edi, edi
mov dword [ebp - 4], 0x25
test ebx, 0x8000
je 0x4068ca
mov eax, dword [ebp - 0x54]
and ebx, 0xffff7fff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4068ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x4000
je 0x4068e8
lea ecx, [ebp - 0x88]
and ebx, 0xffffbfff
push ecx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000
je 0x40690a
lea edx, [ebp - 0x78]
and ebx, 0xffffdfff
push edx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, edi
call fcn.0048694c
push edi
mov ecx, esi
call fcn.004892eb
mov ecx, dword [ebp - 0x8c]
push 1
push 1
push esi
call fcn.004895cb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x27
test edi, edi
je 0x40697c
push 0x59f6a4
lea ecx, [ebp - 0x5c]
call fcn.00407780
push 0
push 0
lea eax, [ebp - 0x5c]
or ebx, 0x10000
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov esi, eax
jmp 0x40697e
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x10000
je 0x4069b5
mov eax, dword [ebp - 0x5c]
and ebx, 0xfffeffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.0043800d
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x4c]
push ecx
push 0x3c
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
push 0x59f6ac
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x164
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x2a
test edi, edi
je 0x406a38
push 0x59f6a4
lea ecx, [ebp - 0x54]
call fcn.00407780
push 0xffffffffffffffff
push 0
push 0x59f6b8
push 0x101
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x54]
or ebx, 0x20000
mov byte [ebp - 4], 0x2b
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e504
jmp 0x406a3a
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.004892eb
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000
je 0x406a80
mov eax, dword [ebp - 0x54]
and ebx, 0xfffdffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406a80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x2d
test edi, edi
je 0x406b17
mov ecx, 0xb
or edx, 0xffffffff
mov word [ebp - 0x78], cx
mov word [ebp - 0x70], dx
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2e
or ebx, 0x40000
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x50], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 0x2f
or ebx, 0x80000
push 0x59f6f0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f6cc
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x54]
or ebx, 0x100000
mov dword [ebp - 4], 0x30
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
jmp 0x406b19
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.004892eb
mov dword [ebp - 4], 0x32
test ebx, 0x100000
je 0x406b5f
mov eax, dword [ebp - 0x54]
and ebx, 0xffefffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x80000
je 0x406b7d
lea ecx, [ebp - 0x88]
and ebx, 0xfff7ffff
push ecx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000
je 0x406b9f
lea edx, [ebp - 0x78]
and ebx, 0xfffbffff
push edx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x8c]
push 1
push 1
push esi
call fcn.004895cb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x34
test edi, edi
je 0x406bf9
push 0x59f700
lea ecx, [ebp - 0x5c]
call fcn.00407780
push 0
push 0
lea eax, [ebp - 0x5c]
or ebx, 0x200000
mov byte [ebp - 4], 0x35
push eax
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov esi, eax
jmp 0x406bfb
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200000
je 0x406c32
mov eax, dword [ebp - 0x5c]
and ebx, 0xffdfffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x37
test edi, edi
je 0x406ca9
xor ecx, ecx
mov word [ebp - 0x78], cx
push 0x59f568
lea ecx, [ebp - 0x78]
call fcn.0048eeae
mov byte [ebp - 4], 0x38
or ebx, 0x400000
push 0x59f708
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x54]
or ebx, 0x800000
mov dword [ebp - 4], 0x39
push eax
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e030
mov edi, eax
jmp 0x406cab
xor edi, edi
mov dword [ebp - 4], 0x3a
test ebx, 0x800000
je 0x406ce2
mov eax, dword [ebp - 0x54]
and ebx, 0xff7fffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406ce2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400000
je 0x406d04
lea ecx, [ebp - 0x78]
and ebx, 0xffbfffff
push ecx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
mov ecx, edi
call fcn.004872c2
push edi
mov ecx, esi
call fcn.004892eb
push 0x118
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x3c
test edi, edi
je 0x406d75
push 0x59f724
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x90], 0xfec0d2
call fcn.00407780
push 0
push 0x59f710
push 0
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x54]
or ebx, 0x1000000
mov byte [ebp - 4], 0x3d
push eax
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e2b4
mov edi, eax
jmp 0x406d77
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x1000000
je 0x406dae
mov eax, dword [ebp - 0x54]
and ebx, 0xfeffffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406dae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 1
push 0x59f730
mov ecx, edi
call fcn.0048dd14
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x59f738
mov ecx, edi
call fcn.0048dce4
push edi
mov ecx, esi
call fcn.004892eb
push pe_nt_image_headers32
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x3f
test edi, edi
je 0x406e57
push 0x59ffd8
lea ecx, [ebp - 0x60]
call fcn.00407780
mov byte [ebp - 4], 0x40
or ebx, 0x2000000
push 0x59f780
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0x59f76c
push 0x59f740
push 0
push 0x59f77c
lea ecx, [ebp - 0x60]
push ecx
push 1
lea edx, [ebp - 0x54]
or ebx, 0x4000000
mov dword [ebp - 4], 0x41
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e42c
jmp 0x406e59
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.004892eb
mov dword [ebp - 4], 0x42
test ebx, 0x4000000
je 0x406e9f
mov eax, dword [ebp - 0x54]
and ebx, 0xfbffffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406e9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000000
je 0x406ed6
mov eax, dword [ebp - 0x60]
and ebx, 0xfdffffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406ed6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push pe_nt_image_headers32
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x44
test edi, edi
je 0x406f3f
push 0x59f788
lea ecx, [ebp - 0x60]
call fcn.00407780
mov byte [ebp - 4], 0x45
or ebx, 0x8000000
push 0x59f78c
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
call fcn.00407780
push 0
push 0
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x54]
or ebx, 0x10000000
mov dword [ebp - 4], 0x46
push edx
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.0048e39d
jmp 0x406f41
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x48
call fcn.004892eb
mov dword [ebp - 4], 0x47
test ebx, 0x10000000
je 0x406f87
mov eax, dword [ebp - 0x54]
and ebx, 0xefffffff
add eax, 0xfffffff0
mov dword [ebp - 0x50], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x8000000
je 0x406fbb
mov eax, dword [ebp - 0x60]
add eax, 0xfffffff0
and ebx, 0xf7ffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406fbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x8c]
push 1
push 1
push esi
call fcn.004895cb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x49
test edi, edi
je 0x407016
push 0x59f794
lea ecx, [ebp - 0x5c]
call fcn.00407780
push 0
push 0
lea ecx, [ebp - 0x5c]
or ebx, 0x20000000
push ecx
mov byte [ebp - 4], 0x4a
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov dword [ebp - 0x54], eax
jmp 0x40701d
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000000
je 0x407051
mov eax, dword [ebp - 0x5c]
add eax, 0xfffffff0
and ebx, 0xdfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407051
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x4c
test edi, edi
je 0x40709b
push 0x59f7a0
lea ecx, [ebp - 0x68]
call fcn.00407780
push 0
push 0
lea ecx, [ebp - 0x68]
or ebx, 0x40000000
push ecx
mov byte [ebp - 4], 0x4d
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov esi, eax
jmp 0x40709d
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000000
je 0x4070d1
mov eax, dword [ebp - 0x68]
add eax, 0xfffffff0
and ebx, 0xbfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4070d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x54]
push esi
call fcn.004892eb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x4f
test edi, edi
je 0x40712b
push 0x59f7ac
lea ecx, [ebp - 0x90]
call fcn.00407780
push 0
push 0
lea ecx, [ebp - 0x90]
or ebx, 0x80000000
push ecx
mov byte [ebp - 4], 0x50
mov ecx, edi
mov dword [ebp - 0x50], ebx
call fcn.004897d2
mov dword [ebp - 0x60], eax
jmp 0x407132
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
jns 0x40715f
mov eax, dword [ebp - 0x90]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40715f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, esi
call fcn.004892eb
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x52
test edi, edi
je 0x407202
mov edx, 8
push 0x59f7c4
mov word [ebp - 0x78], dx
call fcn.0055ab00
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x64], 1
call fcn.0048eaaf
mov dword [ebp - 4], 0x54
push 0x59f7cc
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], 3
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f7b8
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x68]
mov dword [ebp - 4], 0x55
mov ebx, 7
push edx
mov ecx, edi
mov dword [ebp - 0x64], ebx
call fcn.0048e030
jmp 0x407207
mov ebx, dword [ebp - 0x64]
xor eax, eax
mov dword [ebp - 4], 0x58
mov ecx, dword [ebp - 0x60]
push eax
call fcn.004892eb
mov dword [ebp - 4], 0x57
test bl, 4
je 0x407248
mov eax, dword [ebp - 0x68]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [ebp - 0x64], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407248
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x407262
lea ecx, [ebp - 0x88]
and ebx, 0xfffffffd
push ecx
mov dword [ebp - 0x64], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40727a
lea edx, [ebp - 0x78]
and ebx, 0xfffffffe
push edx
mov dword [ebp - 0x64], ebx
call esi
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0x59
test edi, edi
je 0x40730e
mov eax, 8
push 0x59f7d4
mov word [ebp - 0x78], ax
call fcn.0055ab00
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x78]
push ecx
mov byte [ebp - 4], 0x5a
or ebx, 8
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x64], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 0x5b
or ebx, 0x10
push 0x59f7dc
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f7b8
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x68]
or ebx, 0x20
mov dword [ebp - 4], 0x5c
push eax
mov ecx, edi
mov dword [ebp - 0x64], ebx
call fcn.0048e030
jmp 0x407310
xor eax, eax
mov dword [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x60]
push eax
call fcn.004892eb
mov dword [ebp - 4], 0x5e
test bl, 0x20
je 0x407351
mov eax, dword [ebp - 0x68]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x64], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407351
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 0x10
je 0x407365
lea ecx, [ebp - 0x88]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x64], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x40737d
lea edx, [ebp - 0x78]
and ebx, 0xfffffff7
push edx
mov dword [ebp - 0x64], ebx
call esi
push 0xe4
call fcn.004085fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x68], edi
mov dword [ebp - 4], 0x60
test edi, edi
je 0x407424
mov eax, 8
push 0x59f7e4
mov word [ebp - 0xa0], ax
call fcn.0055ab00
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x61
or ebx, 0x40
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x64], ebx
call fcn.0048eaaf
mov dword [ebp - 4], 0x62
or ebx, 0x80
push 0x59f7ec
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x64], ebx
call fcn.00407780
push 0
push 0
push 0
push 0
push 0x59f7b8
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x58]
or ebx, 0x100
mov dword [ebp - 4], 0x63
push eax
mov ecx, edi
mov dword [ebp - 0x64], ebx
call fcn.0048e030
jmp 0x407426
xor eax, eax
mov dword [ebp - 4], 0x66
mov ecx, dword [ebp - 0x60]
push eax
call fcn.004892eb
mov dword [ebp - 4], 0x65
test ebx, 0x100
je 0x40746d
mov eax, dword [ebp - 0x58]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x64], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40746d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x407480
lea ecx, [ebp - 0xb0]
push ecx
and ebx, 0xffffff7f
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x407495
lea edx, [ebp - 0xa0]
push edx
call esi
mov esi, dword [ebp - 0x54]
push 0
mov ecx, esi
call fcn.004870e8
mov ecx, dword [ebp - 0x8c]
push 1
push 1
push esi
call fcn.004895cb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00543b64
mov esp, ebp
pop ebp
ret