Function at 0x496170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405216
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x402f18
mov eax, dword [0x538c1c]
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x68], 0
mov byte [ebp - 0x6c], 0
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], esi
mov ecx, dword [eax]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], esi
mov word [0x53a220], 0xffff
mov dword [0x538c4c], esi
call dword [ecx + 0x50]
cmp eax, esi
fnclex
jge 0x496213
mov edx, dword [0x538c1c]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
push 0x50
push 0x420690
push edx
push eax
call edi
jmp 0x496219
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0x1f9
push 0x294
push esi
push esi
push 0x2f
push 0x46
push 7
push eax
call dword [ecx + 0x78]
cmp eax, esi
fnclex
jge 0x496256
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x4276cc
lea ecx, [ebp - 0x40]
call esi
push 0x37
lea edx, [ebp - 0x40]
push 0x15b
push edx
push 0x11
call fcn.00439580
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x40]
call ebx
cmp byte [0x53a218], 5
jae 0x496291
call fcn.004939e0
call fcn.00495e20
test ax, ax
jne 0x4991ae
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
mov ecx, dword [0x5390b8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x80], edx
xor edx, edx
cmp word [0x538dd0], dx
je 0x496846
mov al, byte [0x538df4]
mov dword [ebp - 0x1c], 0xffffffff
cmp al, 0x14
mov dword [0x538ab8], 3
jne 0x4966ad
mov cx, word [0x538c14]
cmp cx, dx
jne 0x496356
cmp dword [0x53a44c], 4
jne 0x496356
mov ax, word [0x53a450]
cmp ax, dx
jne 0x496350
mov eax, dword [0x538ae4]
cmp eax, 0x17b
jle 0x496356
cmp eax, 0x1a4
jge 0x496356
mov eax, dword [0x538ae8]
cmp eax, 0xb1
jle 0x496356
cmp eax, 0xdb
jge 0x496356
mov al, byte [0x538df6]
cmp al, 0x17
jne 0x496343
mov dword [ebp - 0x18], 0x2f
jmp 0x496356
sub al, 0x18
neg al
sbb eax, eax
and al, 0xf9
add eax, 0x30
jmp 0x496353
movsx eax, ax
mov dword [ebp - 0x18], eax
cmp cx, 1
jne 0x496846
fld dword [0x538b7c]
fadd dword [0x53a428]
fst dword [0x53a428]
fcomp dword [0x401514]
fnstsw ax
test cl, ah
jne 0x496388
mov dword [0x53a428], 0
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0x28
push 0xa6
push 0x730
push 0x1ee
push 0x5a
push 0x13d
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x4963cd
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov al, byte [0x538df6]
cmp al, 2
jne 0x496472
mov edx, dword [0x538c1c]
lea eax, [ebp - 0x64]
fld dword [0x53a428]
mov ebx, dword [edx]
push eax
push 0x3f800000
push 0x56
push 0xa4
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fmul dword [0x402f14]
fadd dword [0x402f10]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [0x538c1c]
push eax
push 0x498
push 0x99
push 0x13e
push 1
push ecx
call dword [ebx + 0x78]
test eax, eax
fnclex
jge 0x496443
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov edx, 0x42779c
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x70], 0x3f800000
call esi
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x40]
push eax
push 0x1dc
push 0x113
push 0x67
push 0x191
push ecx
jmp 0x49664e
cmp al, 0x17
jne 0x49650f
mov edx, dword [0x538c1c]
lea eax, [ebp - 0x64]
fld dword [0x53a428]
mov ebx, dword [edx]
push eax
push 0x3f800000
push 0x56
push 0xa4
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fmul dword [0x402f14]
fadd dword [0x402f0c]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [0x538c1c]
push eax
push 0x6d
push 0x99
push 0x13e
push 1
push ecx
call dword [ebx + 0x78]
test eax, eax
fnclex
jge 0x4964e0
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov edx, 0x4277b4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x70], 0x3f800000
call esi
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x40]
push eax
push 0x1dc
push 0x113
push 0x67
push 0x174
push ecx
jmp 0x49664e
mov edx, dword [0x538c1c]
cmp al, 0x18
fld dword [0x53a428]
mov ebx, dword [edx]
lea eax, [ebp - 0x64]
push eax
push 0x3f800000
push 0x56
push 0xa4
jne 0x4965ab
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fmul dword [0x402f14]
fadd dword [0x402f08]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [0x538c1c]
push eax
push 0x14c
push 0x99
push 0x13e
push 1
push ecx
call dword [ebx + 0x78]
test eax, eax
fnclex
jge 0x49657c
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov edx, 0x4277d4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x70], 0x3f800000
call esi
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x40]
push eax
push 0x1dc
push 0x113
push 0x67
push 0x181
push ecx
jmp 0x49664e
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fmul dword [0x402f14]
fadd dword [0x402f10]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [0x538c1c]
push eax
push 0x498
push 0x99
push 0x13e
push 1
push ecx
call dword [ebx + 0x78]
test eax, eax
fnclex
jge 0x4965f6
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov al, byte [0x538df5]
mov dword [ebp - 0x70], 0x3f800000
test al, al
jne 0x49662b
mov edx, 0x4277f0
lea ecx, [ebp - 0x40]
call esi
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x40]
push eax
push 0x1dc
push 0x113
push 0x67
push 0x185
push ecx
jmp 0x49664e
mov edx, 0x42780c
lea ecx, [ebp - 0x40]
call esi
lea edx, [ebp - 0x70]
lea eax, [ebp - 0x40]
push edx
push 0x1dc
push 0x113
push 0x67
push 0x190
push eax
call fcn.004398b0
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0x30
push 0x30
push 0x67
push 0x198
push 0xae
push 0x178
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x49669e
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov dword [0x53a44c], 4
jmp 0x49684c
cmp al, 0x15
jne 0x496821
cmp byte [0x538df6], 1
jne 0x49684c
mov eax, dword [0x538ae8]
cmp eax, 0xbb
jle 0x496701
cmp eax, 0xe5
jge 0x496701
mov eax, dword [0x538ae4]
cmp eax, 0x17b
jle 0x496701
cmp eax, 0x1a4
jge 0x496701
cmp word [0x538c14], dx
jne 0x496701
cmp dword [0x53a44c], 2
jne 0x496701
mov dword [ebp - 0x18], 0x31
cmp word [0x538c14], 1
jne 0x49684c
mov eax, dword [0x538c1c]
lea ecx, [ebp - 0x64]
push ecx
push 0x3f800000
mov edx, dword [eax]
push 0xb9
push 0xb4
push 0x1c4
push 0x2be
push 0x98
push 0x144
push 2
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x49675a
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0x30
push 0x30
push 0x67
push 0x198
push pe_nt_image_headers32
push 0x178
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x49679c
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov eax, dword [0x538c1c]
lea ecx, [ebp - 0x64]
push ecx
push 0x3f800000
mov edx, dword [eax]
push 0x28
push 0xa6
push 0x730
push 0x1ee
push 0x5a
push 0x13d
push 7
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4967e1
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov edx, 0x427824
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x70], 0x3f800000
call esi
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x40]
push eax
push 0x1dc
push 0x113
push 0x67
push 0x17a
push ecx
call fcn.004398b0
lea ecx, [ebp - 0x40]
call ebx
mov dword [0x53a44c], 2
jmp 0x49684c
cmp al, 0x16
jne 0x496838
cmp word [0x538dd4], dx
jne 0x49683c
call fcn.00495850
mov dword [ebp - 0x18], eax
jmp 0x49684c
cmp al, 0x1a
jne 0x496846
call fcn.00495ad0
mov dword [ebp - 0x18], eax
jmp 0x49684c
mov dword [0x53a44c], edx
xor ecx, ecx
cmp word [ebp - 0x1c], cx
jne 0x496881
mov eax, dword [ebp - 0x80]
xor edx, edx
mov bl, byte [eax + 0x874]
cmp bl, 7
mov bl, byte [eax + 0x9a0]
setne dl
dec edx
mov word [0x53a27e], dx
mov dl, 4
cmp dl, bl
sbb eax, eax
mov word [0x53a27c], ax
jmp 0x49688f
mov word [0x53a27e], cx
mov word [0x53a27c], cx
mov al, byte [0x53a218]
test al, al
je 0x49817e
cmp al, 1
je 0x49817e
cmp al, 2
je 0x49817e
cmp al, 3
jne 0x497253
mov ecx, dword [0x538f3c]
mov esi, 1
mov eax, 0x1f
cmp esi, eax
jg 0x4969fd
cmp word [ebp - 0x1c], 0
lea ebx, [ecx + 0x14]
lea edi, [ecx + 0xc]
je 0x49690b
mov eax, dword [ecx + 0x14]
mov edx, esi
sub edx, eax
mov eax, dword [ecx + 0xc]
shl edx, 4
xor ecx, ecx
push esi
mov cl, byte [edx + eax + 0xc]
push ecx
call fcn.0048fa50
mov ecx, dword [ebx]
mov edx, esi
sub edx, ecx
mov ecx, dword [edi]
shl edx, 4
mov word [edx + ecx + 0xe], ax
mov ecx, dword [0x538f3c]
jmp 0x49691d
mov eax, dword [ebx]
mov edx, esi
sub edx, eax
mov eax, dword [edi]
shl edx, 4
mov word [edx + eax + 0xe], 0xffff
mov eax, dword [ebx]
mov edx, esi
sub edx, eax
mov eax, dword [edi]
shl edx, 4
cmp word [edx + eax + 0xe], 0
je 0x4969eb
push esi
call fcn.00492050
test ax, ax
je 0x496988
mov eax, dword [0x538f3c]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, edi
lea edi, [ebp - 0x64]
shl ecx, 4
push edi
push 0x3f800000
movsx edi, word [ecx + edx + 4]
lea eax, [ecx + edx]
mov ecx, dword [0x538c1c]
push 0x28
push 0x28
mov edx, dword [ecx]
push 0
push edi
movsx edi, word [eax + 2]
movsx eax, word [eax]
push edi
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4969e5
jmp 0x4969d0
mov eax, dword [0x538f3c]
mov edx, esi
mov ecx, dword [0x538c1c]
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, edi
lea edi, [ebp - 0x64]
shl edx, 4
add eax, edx
mov edx, dword [ecx]
push edi
push 0x3f800000
movsx edi, word [eax + 2]
movsx eax, word [eax]
push 0x28
push 0x28
push 0x347
push 0x320
push edi
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4969e5
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [0x538f3c]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, 1
add esi, eax
jmp 0x4968bf
mov edx, dword [ebp - 0x80]
mov al, byte [edx + 0x234]
cmp al, 1
mov eax, dword [0x538c1c]
jne 0x496a4e
lea edx, [ebp - 0x64]
mov ecx, dword [eax]
push edx
push 0x3f800000
push 0xd1
push 0xa0
push 0xec
push 0
push 0x5a
push 0x14a
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x496a91
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
jmp 0x496a8e
lea ecx, [ebp - 0x64]
mov edx, dword [eax]
push ecx
push 0x3f800000
push 0xd1
push 0xa0
push 0xec
push 0xa0
push 0x56
push 0x14d
push 2
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x496a91
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov esi, 1
mov eax, 0x1f
cmp esi, eax
jg 0x496ccf
mov eax, dword [0x538f3c]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, edi
shl ecx, 4
add ecx, edx
cmp word [ecx + 0xe], 0
je 0x496cbd
mov dx, word [ecx]
mov eax, dword [0x538ae4]
movsx edi, dx
cmp eax, edi
jle 0x496afb
lea edi, [edx + 0x28]
movsx edi, di
cmp eax, edi
jge 0x496afb
mov ax, word [ecx + 2]
mov ebx, dword [0x538ae8]
movsx edi, ax
cmp ebx, edi
jle 0x496afb
add eax, 0x28
mov edi, ebx
movsx eax, ax
cmp edi, eax
jge 0x496afb
mov dword [ebp - 0x18], esi
mov edi, dword [ebp - 0x80]
lea eax, [esi + esi*8]
lea eax, [esi + eax*4]
cmp word [edi + eax*4 + 0x1f4], 0
lea edi, [edi + eax*4]
je 0x496b19
cmp word [ebp - 0x1c], 0
je 0x496b31
cmp byte [0x538df4], 0x17
jne 0x496bc7
cmp word [ebp - 0x1c], 0xffff
jne 0x496bc7
mov cx, word [ecx + 2]
mov eax, dword [0x538c1c]
sub cx, 3
push 0x2e
movsx ecx, cx
mov ebx, dword [eax]
add edx, 0xfffffffd
push 0x3f800000
push ecx
movsx ecx, word [edi + 0x1f6]
movsx edx, dx
push edx
push ecx
push eax
call dword [ebx + 0x9c]
test eax, eax
fnclex
jge 0x496b7f
mov edx, dword [0x538c1c]
push 0x9c
push 0x420690
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
cmp dword [ebp - 0x18], esi
jne 0x496cbd
cmp word [0x538dd0], 0
jne 0x496cbd
mov edx, dword [ebp - 0x80]
lea eax, [esi + esi*8 + 0x1b]
lea ecx, [esi + eax*4 + 3]
lea eax, [edx + ecx*4]
push eax
push 0x538d98
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, 1
add esi, eax
jmp 0x496a96
cmp esi, 0xe
jne 0x496bd6
cmp word [0x53a27c], 0
jne 0x496bf4
cmp esi, 0x10
jne 0x496be5
cmp word [0x53a27e], 0
jne 0x496bf4
cmp esi, 0x1e
jne 0x496c59
cmp word [0x538cb8], 0
jne 0x496c59
mov cx, word [ecx + 2]
mov eax, dword [0x538c1c]
lea ebx, [ebp - 0x64]
add cx, 0xd
mov edi, dword [eax]
push ebx
push 0x3f800000
add edx, 0xe
push 0x10
push 0xc
movsx ecx, cx
movsx edx, dx
push 0x13
push 0x190
push ecx
push edx
push 2
push eax
call dword [edi + 0x78]
test eax, eax
fnclex
jge 0x496cbd
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, 1
add esi, eax
jmp 0x496a96
mov edx, dword [0x538f3c]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [0x538f3c]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, edi
shl ecx, 4
lea eax, [ecx + edx]
mov cx, word [ecx + edx + 2]
mov ax, word [eax]
add cx, 4
add ax, 4
movsx edx, cx
movsx ecx, ax
mov eax, dword [ebp - 0x3c]
push edx
mov edx, esi
push ecx
mov ebx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ebx
shl edx, 4
lea ecx, [edx + eax + 8]
push ecx
push 9
call fcn.00439580
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, 1
add esi, eax
jmp 0x496a96
fld dword [0x53a42c]
fadd dword [0x538b7c]
fst dword [0x53a42c]
fcomp dword [0x401518]
fnstsw ax
test ah, 1
jne 0x496cf8
mov dword [0x53a42c], 0
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0xca
push 0x280
push 0x309
push 0xa
push 0x154
push 0x50
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x496d3d
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x427844
lea ecx, [ebp - 0x40]
call esi
push 0x155
lea edx, [ebp - 0x40]
push 0x66
push edx
push 0xc
call fcn.00439580
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x40]
call ebx
mov edx, 0x427854
lea ecx, [ebp - 0x40]
call esi
push 0x155
lea eax, [ebp - 0x40]
push 0x106
push eax
push 0xc
call fcn.00439580
lea ecx, [ebp - 0x40]
call ebx
mov edx, 0x42786c
lea ecx, [ebp - 0x40]
call esi
push 0x155
lea ecx, [ebp - 0x40]
push 0x1a6
push ecx
push 0xc
call fcn.00439580
lea ecx, [ebp - 0x40]
call ebx
mov edx, 0x4276b8
lea ecx, [ebp - 0x40]
call esi
push 0x155
lea edx, [ebp - 0x40]
push 0x246
push edx
push 0xc
call fcn.00439580
lea ecx, [ebp - 0x40]
call ebx
mov eax, dword [ebp - 0x80]
cmp word [eax + 0x1a], 0
jle 0x496e59
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0xe
push 0x1c
push 0x4b
push 0x1ac
push 0x158
push 0xcf
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x496e22
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov edx, dword [ebp - 0x80]
mov ax, word [edx + 0x1a]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push 0x159
lea ecx, [ebp - 0x40]
push 0xea
push ecx
push 1
call fcn.004372e0
lea ecx, [ebp - 0x40]
call ebx
jmp 0x496e5f
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0x80]
cmp word [edx + 0x1c], 0
jle 0x496eda
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0xe
push 0x1c
push 0x4b
push 0x1ac
push 0x158
push 0x16f
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x496eab
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov edx, dword [ebp - 0x80]
mov ax, word [edx + 0x1c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push 0x159
lea ecx, [ebp - 0x40]
push 0x18a
push ecx
push 1
call fcn.004372e0
lea ecx, [ebp - 0x40]
call ebx
mov edx, dword [ebp - 0x80]
cmp word [edx + 0x1e], 0
jle 0x496f55
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0xe
push 0x1c
push 0x4b
push 0x1ac
push 0x158
push 0x20f
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x496f26
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov edx, dword [ebp - 0x80]
mov ax, word [edx + 0x1e]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push 0x159
lea ecx, [ebp - 0x40]
push 0x22a
push ecx
push 1
call fcn.004372e0
lea ecx, [ebp - 0x40]
call ebx
mov edx, dword [ebp - 0x80]
cmp word [edx + 0x20], 0
jle 0x496fd0
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0xe
push 0x1c
push 0x4b
push 0x1ac
push 0x158
push 0x2af
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x496fa1
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call edi
mov edx, dword [ebp - 0x80]
mov ax, word [edx + 0x20]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push 0x159
lea ecx, [ebp - 0x40]
push 0x2ca
push ecx
push 1
call fcn.004372e0
lea ecx, [ebp - 0x40]
call ebx
mov eax, 1
mov dword [ebp - 0x38], 0x55
mov dword [ebp - 0x30], 0x16a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
mov ecx, 0x14
cmp eax, ecx
jg 0x498a83
lea edx, [eax + eax*2]
mov eax, dword [ebp - 0x80]
lea ebx, [eax + edx*8 + 0xc]
mov al, byte [eax + edx*8 + 0x14]
test al, al
jbe 0x497215
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
mov edx, dword [ebp - 0x30]
mov ecx, dword [eax]
push 0x20
push edx
mov edx, dword [ebp - 0x38]
push edx
mov dl, byte [ebx]
push edx
push eax
call dword [ecx + 0xa0]
test eax, eax
fnclex
jge 0x497049
mov ecx, dword [0x538c1c]
push 0xa0
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
cmp word [ebp - 0x64], 0
je 0x49705d
mov edx, dword [ebp - 0x14]
add edx, 0x1e
mov word [0x53a220], dx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
push 0x7d
add ecx, 4
lea edi, [eax + 0x25]
push 0
push ecx
lea edx, [ebx + 4]
push edi
push edx
push 0x15
call fcn.0043a1d0
mov al, byte [ebx + 2]
test al, al
jne 0x4970b0
mov edx, 0x426a20
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x40]
add eax, 0x15
push eax
push edi
push ecx
push 0x15
call fcn.00439580
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
jmp 0x497139
mov dl, byte [ebx + 0x14]
push 0x427164
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
push eax
push 0x426868
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push eax
mov al, byte [ebx + 2]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x50]
add eax, 0x15
push eax
push edi
push ecx
push 0x15
call fcn.00439580
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x48]
push eax
lea edx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x40]
push edx
push eax
push 5
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x18
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
mov ecx, dword [ebp - 0x28]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
lea edx, [ecx + eax*2]
mov eax, dword [0x5390b8]
cmp word [eax + edx*2 + 0x18], 0
jle 0x497192
mov al, byte [ebx + 2]
mov cl, byte [ebx + 0x14]
cmp cl, al
jae 0x497192
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
add ecx, 0x12
push 0x29
add edx, 0x89
push ecx
push edx
call fcn.0043c630
test ax, ax
je 0x497192
mov eax, dword [ebp - 0x14]
add eax, 0xa
mov word [0x53a220], ax
mov al, byte [ebx + 0x15]
test al, al
jbe 0x497215
mov ecx, dword [0x538c1c]
lea edx, [ebp - 0x64]
fld dword [0x53a42c]
mov edi, dword [ecx]
push edx
push 0x3f800000
push 0x24
push 0x24
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fmul dword [0x402b30]
fadd dword [0x402f04]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
push eax
movzx ax, byte [ebx + 0x15]
lea eax, [eax + eax*8]
lea ecx, [eax*4 + 0x11c]
mov eax, dword [ebp - 0x30]
movsx edx, cx
mov ecx, dword [ebp - 0x38]
add eax, 0xfffffffe
push edx
mov edx, dword [0x538c1c]
add ecx, 0xfffffffe
push eax
push ecx
push 2
push edx
call dword [edi + 0x78]
test eax, eax
fnclex
jge 0x497215
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x30]
add eax, 0x24
cmp eax, 0x21c
mov dword [ebp - 0x30], eax
jle 0x49723f
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
add ecx, 0xa0
inc eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0x16a
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x14], ecx
mov eax, ecx
jmp 0x496fe9
cmp al, 4
jne 0x498a7d
mov eax, dword [0x538c1c]
lea ecx, [ebp - 0x64]
push ecx
push 0x3f800000
mov edx, dword [eax]
push 0xf5
push 0xca
push 0xa5d
push 0
push 0x44
push 0x12b
push 7
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4972a0
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov esi, 0x52
mov ebx, 0x158
mov edi, 1
mov eax, 0x78
cmp edi, eax
jg 0x4973dd
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0x1b
push 0x1b
push 0x2ab
push 0x320
push ebx
push esi
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x4972fd
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
movsx edx, word [0x539768]
cmp edi, edx
jg 0x4973be
lea eax, [ebp - 0x64]
mov ecx, dword [0x538c1c]
push eax
lea eax, [edi + edi*4]
push 0x3f800000
push 0x19
lea eax, [eax + eax*4]
mov edx, dword [ecx]
push 0x19
push eax
lea eax, [ebx + 1]
push 0x327
push eax
lea eax, [esi + 1]
push eax
push 7
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x497356
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538ae4]
cmp eax, esi
jl 0x4973be
lea edx, [esi + 0x1c]
cmp eax, edx
jge 0x4973be
mov eax, dword [0x538ae8]
cmp eax, ebx
jl 0x4973be
lea ecx, [ebx + 0x1c]
cmp eax, ecx
jge 0x4973be
mov eax, dword [0x538c1c]
lea ecx, [ebp - 0x64]
push ecx
push 0x3f800000
mov edx, dword [eax]
push 0x1b
push 0x1b
push 0x2c6
push 0x320
push ebx
push esi
push 2
push eax
mov word [0x53a430], di
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4973be
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
add esi, 0x20
cmp esi, 0x2bc
jle 0x4973d1
mov esi, 0x52
add ebx, 0x21
mov eax, 1
add edi, eax
jmp 0x4972af
cmp word [0x53a430], 0
jle 0x498a7d
mov eax, dword [0x539764]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
lea ecx, [ebp - 0x78]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x78]
movsx eax, word [0x53a430]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ebx, [eax + edx*4]
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
mov dword [ebp - 0x88], ebx
mov ecx, dword [eax]
push edx
push 0x3f800000
push 0x52
push 0x52
push 0x998
push 0x20b
push 0x4b
push 0x130
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x49745f
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x538c1c]
mov eax, dword [0x53a430]
mov ecx, dword [edx]
lea edi, [eax + eax*2]
lea edx, [ebp - 0x64]
shl edi, 4
push edx
add edi, eax
movzx dx, byte [ebx + 8]
shl edi, 1
push 0x3f800000
push 0x52
lea eax, [edx + edi - 0x62]
push 0x52
movsx edx, ax
movzx ax, byte [ebx + 7]
add eax, 0x2c5
push edx
movsx edx, ax
mov eax, dword [0x538c1c]
push edx
push 0x4b
push 0x130
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x4974cb
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
movsx eax, word [0x53a430]
lea edx, [eax + eax*2]
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
mov ecx, dword [0x5390b8]
lea eax, [ecx + eax*4]
mov cl, byte [eax + edx*4 + 0x9a8f]
test cl, cl
jne 0x4975e5
mov ecx, dword [0x53976c]
lea edx, [ebp - 0x3c]
push ecx
push edx
call esi
mov eax, dword [ebx]
push 0x90
push 0x3a3
push 0x4d
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
shl ecx, 3
sub edx, ecx
push 0x185
movsx ecx, word [edx]
mov edx, dword [ebp - 0x3c]
sub ecx, dword [edx + 0x14]
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
push edx
call fcn.00436840
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x3c]
push eax
call edi
mov eax, dword [0x538c1c]
lea edx, [ebp - 0x64]
push edx
push 0x3f800000
mov ecx, dword [eax]
push 0x52
push 0x52
push 0x6b0
push 0x1e0
push 0x4b
push 0x130
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x49759c
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x538f1c]
lea eax, [ebp - 0x3c]
push edx
push eax
call esi
mov eax, dword [ebp - 0x3c]
mov ecx, 3
push 0x90
push 0x9b
mov edx, dword [eax + 0x14]
push 0x58
sub ecx, edx
mov edx, dword [eax + 0xc]
push 0x185
lea eax, [edx + ecx*4]
push eax
call fcn.00436840
lea ecx, [ebp - 0x3c]
push ecx
call edi
mov dword [ebp - 0x28], 0
jmp 0x49767f
mov edx, dword [0x53976c]
lea eax, [ebp - 0x3c]
push edx
push eax
call esi
mov eax, dword [ebx]
push 0x90
push 0x9b
push 0x4d
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
shl ecx, 3
sub edx, ecx
push 0x185
movsx ecx, word [edx]
mov edx, dword [ebp - 0x3c]
sub ecx, dword [edx + 0x14]
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
push edx
call fcn.00436840
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x3c]
push eax
call edi
mov ecx, dword [0x538f1c]
lea edx, [ebp - 0x3c]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x3c]
mov ecx, 2
push 0x90
push 0x9b
mov edx, dword [eax + 0x14]
push 0x58
sub ecx, edx
mov edx, dword [eax + 0xc]
push 0x185
lea eax, [edx + ecx*4]
push eax
call fcn.00436840
lea ecx, [ebp - 0x3c]
push ecx
call edi
mov dword [ebp - 0x28], 1
movsx eax, word [0x53a430]
lea edx, [eax + eax*2]
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
mov ecx, dword [0x5390b8]
lea eax, [ecx + eax*4]
mov cl, byte [eax + edx*4 + 0x9a8e]
test cl, cl
jbe 0x497ced
mov al, byte [ebx + 5]
cmp al, 1
jb 0x497892
cmp al, 0x37
ja 0x497892
mov ecx, dword [0x538f18]
lea edx, [ebp - 0x3c]
push ecx
push edx
call esi
xor eax, eax
push 0x90
mov al, byte [ebx + 5]
push 0x9b
mov ecx, eax
mov eax, dword [ebp - 0x3c]
push 0x81
push 0x185
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push eax
call fcn.00436840
lea ecx, [ebp - 0x3c]
push ecx
call edi
movsx eax, word [0x53a430]
push 0x538a0c
push 1
lea edx, [eax + eax*2]
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
mov ecx, dword [0x5390b8]
lea eax, [ecx + eax*4]
mov cl, byte [eax + edx*4 + 0x9a8e]
mov al, byte [ebx + 6]
cmp cl, al
jne 0x4977b2
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
mov dl, byte [ebx + 6]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push 0x90
push 0x9b
push 0x8c
lea eax, [ebp - 0x48]
push 0x185
push eax
call fcn.00436840
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x40]
push edx
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
jmp 0x497cf9
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push eax
movsx eax, word [0x53a430]
lea ecx, [eax + eax*2]
mov eax, dword [0x538c50]
lea edx, [eax + eax*4]
lea edx, [eax + edx*8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
mov edx, dword [0x5390b8]
lea eax, [edx + eax*4]
mov cl, byte [eax + ecx*4 + 0x9a8e]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push eax
mov eax, dword [0x538f1c]
mov edx, 7
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
mov ecx, dword [eax + edx*4]
push ecx
call edi
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
mov dl, byte [ebx + 6]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x54]
call esi
push 0x90
push 0x9b
push 0x8c
lea eax, [ebp - 0x54]
push 0x185
push eax
call fcn.00436840
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x48]
push eax
lea edx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x40]
push edx
push eax
push 6
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x1c
jmp 0x497cf9
cmp al, 0x65
jb 0x497af3
cmp al, 0x9b
ja 0x497af3
mov ecx, dword [0x538f18]
lea edx, [ebp - 0x3c]
push ecx
push edx
call esi
movzx ax, byte [ebx + 5]
sub eax, 0x64
push 0x90
movsx ecx, ax
mov eax, dword [ebp - 0x3c]
push 0x9b
push 0x81
push 0x185
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push eax
call fcn.00436840
lea ecx, [ebp - 0x3c]
push ecx
call edi
movsx eax, word [0x53a430]
push 0x538a0c
push 1
lea edx, [eax + eax*2]
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
mov ecx, dword [0x5390b8]
lea eax, [ecx + eax*4]
mov cl, byte [eax + edx*4 + 0x9a8e]
mov al, byte [ebx + 6]
cmp cl, al
jne 0x4979cc
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
push 0x424388
call edi
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
mov dl, byte [ebx + 6]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
push eax
mov eax, dword [0x538f1c]
mov ecx, 9
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
push 0x90
push 0x9b
push 0x8c
lea ecx, [ebp - 0x50]
push 0x185
push ecx
call fcn.00436840
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x48]
push eax
lea edx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x40]
push edx
push eax
push 5
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x18
jmp 0x497cf9
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
push 0x424388
call edi
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
push eax
movsx eax, word [0x53a430]
lea ecx, [eax + eax*2]
mov eax, dword [0x538c50]
lea edx, [eax + eax*4]
lea edx, [eax + edx*8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
mov edx, dword [0x5390b8]
lea eax, [edx + eax*4]
mov cl, byte [eax + ecx*4 + 0x9a8e]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
push eax
mov eax, dword [0x538f1c]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
shl edx, 2
sub eax, edx
mov ecx, dword [eax]
push ecx
call edi
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
push eax
push 0x424388
call edi
mov edx, eax
lea ecx, [ebp - 0x54]
call esi
mov dl, byte [ebx + 6]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
mov edx, eax
lea ecx, [ebp - 0x58]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x5c]
call esi
push eax
mov eax, dword [0x538f1c]
mov ecx, 9
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x60]
call esi
push 0x90
push 0x9b
push 0x8c
push 0x185
lea ecx, [ebp - 0x60]
push ecx
call fcn.00436840
lea edx, [ebp - 0x60]
lea eax, [ebp - 0x5c]
push edx
lea ecx, [ebp - 0x58]
push eax
lea edx, [ebp - 0x54]
push ecx
lea eax, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x48]
push ecx
lea eax, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x40]
push eax
push ecx
push 9
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x28
jmp 0x497cf9
cmp al, 0xc9
jb 0x497ced
cmp al, 0xff
ja 0x497ced
mov edx, dword [0x538f18]
lea eax, [ebp - 0x3c]
push edx
push eax
call esi
movzx cx, byte [ebx + 5]
mov eax, dword [ebp - 0x3c]
sub ecx, 0xc8
movsx edx, cx
mov esi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, esi
push 0x90
push 0x9b
push 0x81
lea ecx, [eax + edx*4]
push 0x185
push ecx
call fcn.00436840
lea edx, [ebp - 0x3c]
push edx
call edi
movsx eax, word [0x53a430]
lea ecx, [eax + eax*2]
mov eax, dword [0x538c50]
lea edx, [eax + eax*4]
lea edx, [eax + edx*8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
mov edx, dword [0x5390b8]
lea eax, [edx + eax*4]
mov al, byte [eax + ecx*4 + 0x9a8e]
mov cl, byte [ebx + 6]
cmp al, cl
jne 0x497c0a
push ecx
call fcn.00492ba0
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
mov edi, dword [ebp - 0x4c]
push 0x538a0c
push 1
mov dword [ebp - 0x4c], 0
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push eax
mov edx, edi
lea ecx, [ebp - 0x44]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push 0x90
push 0x9b
push 0x8c
lea ecx, [ebp - 0x48]
push 0x185
push ecx
call fcn.00436840
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
push eax
lea edx, [ebp - 0x40]
push ecx
push edx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
jmp 0x497cf9
push eax
call fcn.00492ba0
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x58]
call esi
mov al, byte [ebx + 6]
push eax
call fcn.00492ba0
mov edx, eax
lea ecx, [ebp - 0x5c]
call esi
mov ecx, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x58]
xor eax, eax
push 0x538a0c
push 1
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x5c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push eax
mov edx, edi
lea ecx, [ebp - 0x44]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push eax
mov eax, dword [0x538f1c]
mov edx, 7
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
mov ecx, dword [eax + edx*4]
push ecx
call edi
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
mov edx, dword [ebp - 0x108]
push eax
lea ecx, [ebp - 0x50]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x54]
call esi
push 0x90
push 0x9b
push 0x8c
lea edx, [ebp - 0x54]
push 0x185
push edx
call fcn.00436840
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x58]
push eax
lea edx, [ebp - 0x54]
push ecx
lea eax, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x48]
push ecx
lea eax, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x40]
push eax
push ecx
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x24
jmp 0x497cf9
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
xor edx, edx
mov dword [ebp - 0x38], 0x130
mov dl, byte [ebx + 4]
mov dword [ebp - 0x30], 0xa1
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jg 0x49801f
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x7c]
mov edx, dword [ecx]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, ebx
mov eax, dword [0x538c1c]
lea ebx, [edx + ecx*8]
lea edx, [ebp - 0x64]
push edx
mov edx, dword [ebp - 0x30]
push 0x3f800000
mov ecx, dword [eax]
push 0x1a
push 0x1a
push 0x2e1
push 0x320
push edx
mov edx, dword [ebp - 0x38]
push edx
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x497d95
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538c50]
lea edx, [eax + eax*4]
lea ecx, [eax + edx*8]
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*4]
mov eax, dword [0x5390b8]
movsx ecx, word [ebx]
mov eax, dword [eax + edx*4 + 0x9a88]
mov edx, ecx
sub edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
cmp dword [eax + edx*8 + 4], 0
jle 0x497f96
mov edx, dword [0x538ae4]
mov eax, dword [ebp - 0x38]
cmp edx, eax
jle 0x497e05
mov eax, dword [0x538ae8]
mov edx, dword [ebp - 0x30]
cmp eax, edx
jle 0x497e05
mov edx, dword [ebp - 0x38]
mov eax, dword [0x538ae4]
add edx, 0x1a
cmp eax, edx
jge 0x497e05
mov eax, dword [ebp - 0x30]
mov edx, dword [0x538ae8]
add eax, 0x1a
cmp edx, eax
jge 0x497e05
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x64]
mov eax, dword [0x538c1c]
push edx
mov dx, word [ebx + 2]
imul dx, dx, 0x18
movsx edx, dx
push 0x3f800000
push 0x18
push 0x18
push edx
xor edx, edx
mov ecx, dword [eax]
mov dl, byte [ebx + 4]
add edx, 0x27d
push edx
mov edx, dword [ebp - 0x30]
inc edx
push edx
mov edx, dword [ebp - 0x38]
inc edx
push edx
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x497e5c
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
movsx eax, word [0x53a430]
lea edx, [eax + eax*2]
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
mov ecx, dword [0x5390b8]
lea eax, [ecx + eax*4]
lea ecx, [eax + edx*4]
mov edx, dword [ebp - 0x14]
mov al, byte [ecx + edx + 0x9a8f]
test al, al
jne 0x497f3a
lea edx, [ebp - 0x64]
mov eax, dword [0x538c1c]
push edx
mov edx, dword [ebp - 0x30]
push 0x3f800000
mov ecx, dword [eax]
push 0x1a
push 0x1a
push 0x6b0
push 0x1e0
push edx
mov edx, dword [ebp - 0x38]
push edx
push 7
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x497ede
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x53976c]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov cl, byte [ebx + 6]
mov dl, byte [ebx + 5]
mov eax, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x3c]
add eax, 2
push 0x3a3
add ecx, 0x1d
push eax
mov eax, dword [edx + 0x14]
push ecx
movsx ecx, word [ebx]
sub ecx, eax
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
push edx
call fcn.00436650
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
jmp 0x497fdc
mov ecx, dword [0x53976c]
lea edx, [ebp - 0x3c]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov al, byte [ebx + 6]
mov cl, byte [ebx + 5]
mov edx, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x38]
push ecx
movsx ecx, word [ebx]
add edx, 2
push 0x9b
push edx
mov edx, dword [ebp - 0x3c]
add eax, 0x1d
push eax
mov eax, dword [edx + 0x14]
sub ecx, eax
mov edx, dword [edx + 0xc]
mov eax, ecx
shl eax, 4
add eax, ecx
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*4]
push eax
call fcn.00436650
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
inc dword [ebp - 0x28]
jmp 0x497fdc
lea ecx, [ebp - 0x64]
mov eax, dword [0x538c1c]
push ecx
mov ecx, dword [ebp - 0x30]
push 0x3f800000
push 0x18
push 0x18
mov edx, dword [eax]
push 0
inc ecx
push 0x327
push ecx
mov ecx, dword [ebp - 0x38]
inc ecx
push ecx
push 7
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x497fdc
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x38]
mov eax, 0x130
cmp ecx, eax
jne 0x497ff1
mov dword [ebp - 0x38], 0x190
jmp 0x497ffd
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
add eax, 0x1e
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x88]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x14], ecx
jmp 0x497d19
mov ecx, dword [0x538f1c]
lea edx, [ebp - 0x3c]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x3c]
mov ecx, 0x37
push 0x90
push 0x9b
mov edx, dword [eax + 0x14]
push 0x67
sub ecx, edx
mov edx, dword [eax + 0xc]
push 0x185
lea eax, [edx + ecx*4]
push eax
call fcn.00436840
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dl, byte [ebx + 4]
cmp eax, edx
jle 0x4980c3
mov eax, dword [0x538f1c]
lea ecx, [ebp - 0x3c]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [ebp - 0x3c]
mov edx, 0x36
push 0x90
push 0x9b
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, edi
push 0x72
push 0x185
lea ecx, [eax + edx*4]
push ecx
call fcn.00436840
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
jmp 0x498a83
push 0x538a0c
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x48]
call esi
push eax
mov eax, dword [0x538f1c]
mov ecx, 7
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ecx*4]
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
movzx cx, byte [ebx + 4]
inc ecx
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x54]
call esi
push 0x90
push 0x9b
push 0x72
lea edx, [ebp - 0x54]
push 0x185
push edx
call fcn.00436840
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x50]
push eax
lea edx, [ebp - 0x4c]
push ecx
lea eax, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
push eax
lea edx, [ebp - 0x40]
push ecx
push edx
push 6
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x1c
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
jmp 0x498a83
cmp dword [0x53a44c], ecx
jne 0x498593
mov ecx, dword [0x538f3c]
mov esi, 1
mov eax, 0x1f
cmp esi, eax
jg 0x4982d3
cmp word [ebp - 0x1c], 0
lea ebx, [ecx + 0x14]
lea edi, [ecx + 0xc]
je 0x4981e1
mov eax, dword [ecx + 0x14]
mov edx, esi
sub edx, eax
mov eax, dword [ecx + 0xc]
shl edx, 4
xor ecx, ecx
push esi
mov cl, byte [edx + eax + 0xc]
push ecx
call fcn.0048fa50
mov ecx, dword [ebx]
mov edx, esi
sub edx, ecx
mov ecx, dword [edi]
shl edx, 4
mov word [edx + ecx + 0xe], ax
mov ecx, dword [0x538f3c]
jmp 0x4981f3
mov eax, dword [ebx]
mov edx, esi
sub edx, eax
mov eax, dword [edi]
shl edx, 4
mov word [edx + eax + 0xe], 0xffff
mov eax, dword [ebx]
mov edx, esi
sub edx, eax
mov eax, dword [edi]
shl edx, 4
cmp word [edx + eax + 0xe], 0
je 0x4982c1
push esi
call fcn.00492050
test ax, ax
je 0x49825e
mov eax, dword [0x538f3c]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, edi
lea edi, [ebp - 0x64]
shl ecx, 4
push edi
push 0x3f800000
movsx edi, word [ecx + edx + 4]
lea eax, [ecx + edx]
mov ecx, dword [0x538c1c]
push 0x28
push 0x28
mov edx, dword [ecx]
push 0
push edi
movsx edi, word [eax + 2]
movsx eax, word [eax]
push edi
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4982bb
jmp 0x4982a6
mov eax, dword [0x538f3c]
mov edx, esi
mov ecx, dword [0x538c1c]
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, edi
lea edi, [ebp - 0x64]
shl edx, 4
add eax, edx
mov edx, dword [ecx]
push edi
push 0x3f800000
movsx edi, word [eax + 2]
movsx eax, word [eax]
push 0x28
push 0x28
push 0x347
push 0x320
push edi
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x4982bb
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [0x538f3c]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, 1
add esi, eax
jmp 0x498195
mov edx, dword [ebp - 0x80]
mov al, byte [edx + 0x234]
cmp al, 1
mov eax, dword [0x538c1c]
jne 0x498324
lea edx, [ebp - 0x64]
mov ecx, dword [eax]
push edx
push 0x3f800000
push 0xd1
push 0xa0
push 0xec
push 0
push 0x5a
push 0x14a
push 2
push eax
call dword [ecx + 0x78]
test eax, eax
fnclex
jge 0x498367
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
jmp 0x498364
lea ecx, [ebp - 0x64]
mov edx, dword [eax]
push ecx
push 0x3f800000
push 0xd1
push 0xa0
push 0xec
push 0xa0
push 0x56
push 0x14d
push 2
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x498367
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call edi
mov esi, 1
mov eax, 0x1f
cmp esi, eax
jg 0x498593
mov eax, dword [0x538f3c]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, edi
shl ecx, 4
add ecx, edx
cmp word [ecx + 0xe], 0
je 0x498587
mov dx, word [ecx]
mov eax, dword [0x538ae4]
movsx edi, dx
cmp eax, edi
jle 0x4983d1
lea edi, [edx + 0x28]
movsx edi, di
cmp eax, edi
jge 0x4983d1
mov ax, word [ecx + 2]
mov ebx, dword [0x538ae8]
movsx edi, ax
cmp ebx, edi
jle 0x4983d1
add eax, 0x28
mov edi, ebx
movsx eax, ax
cmp edi, eax
jge 0x4983d1
mov dword [ebp - 0x18], esi
mov edi, dword [ebp - 0x80]
lea eax, [esi + esi*8]
lea eax, [esi + eax*4]
cmp word [edi + eax*4 + 0x1f4], 0
lea edi, [edi + eax*4]
je 0x4983ef
cmp word [ebp - 0x1c], 0
je 0x498407
cmp byte [0x538df4], 0x17
jne 0x498497
cmp word [ebp - 0x1c], 0xffff
jne 0x498497
mov cx, word [ecx + 2]
mov eax, dword [0x538c1c]
sub cx, 3
push 0x2e
movsx ecx, cx
mov ebx, dword [eax]
add edx, 0xfffffffd
push 0x3f800000
push ecx
movsx ecx, word [edi + 0x1f6]
movsx edx, dx
push edx
push ecx
push eax
call dword [ebx + 0x9c]
test eax, eax
fnclex
jge 0x498455
mov edx, dword [0x538c1c]
push 0x9c
push 0x420690
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
cmp dword [ebp - 0x18], esi
jne 0x498587
cmp word [0x538dd0], 0
jne 0x498587
mov edx, dword [ebp - 0x80]
lea eax, [esi + esi*8 + 0x1b]
lea ecx, [esi + eax*4 + 3]
lea eax, [edx + ecx*4]
push eax
push 0x538d98
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov eax, 1
add esi, eax
jmp 0x49836c
cmp esi, 0xe
jne 0x4984a6
cmp word [0x53a27c], 0
jne 0x4984c4
cmp esi, 0x10
jne 0x4984b5
cmp word [0x53a27e], 0
jne 0x4984c4
cmp esi, 0x1e
jne 0x498523
cmp word [0x538cb8], 0
jne 0x498523
mov cx, word [ecx + 2]
mov eax, dword [0x538c1c]
lea ebx, [ebp - 0x64]
add cx, 0xd
mov edi, dword [eax]
push ebx
push 0x3f800000
add edx, 0xe
push 0x10
push 0xc
movsx ecx, cx
movsx edx, dx
push 0x13
push 0x190
push ecx
push edx
push 2
push eax
call dword [edi + 0x78]
test eax, eax
fnclex
jge 0x498587
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, 1
add esi, eax
jmp 0x49836c
mov edx, dword [0x538f3c]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [0x538f3c]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, edi
shl ecx, 4
lea eax, [ecx + edx]
mov cx, word [ecx + edx + 2]
mov ax, word [eax]
add cx, 4
add ax, 4
movsx edx, cx
movsx ecx, ax
mov eax, dword [ebp - 0x3c]
push edx
mov edx, esi
push ecx
mov ebx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ebx
shl edx, 4
lea ecx, [edx + eax + 8]
push ecx
push 9
call fcn.00439580
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, 1
add esi, eax
jmp 0x49836c
cmp dword [0x53a44c], 4
jne 0x4986fd
mov edi, 1
mov word [0x53a450], 0
mov esi, edi
mov eax, 0xa
cmp esi, eax
jg 0x4986fd
mov eax, dword [0x538f3c]
mov ecx, esi
push esi
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
shl ecx, 4
xor eax, eax
mov al, byte [ecx + edx + 0xc]
push eax
call fcn.0048fa50
test ax, ax
je 0x4986f6
mov eax, dword [0x538f3c]
mov ecx, esi
mov ebx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, ebx
lea ebx, [ebp - 0x64]
shl ecx, 4
push ebx
push 0x3f800000
movsx ebx, word [ecx + edx + 4]
lea eax, [ecx + edx]
mov ecx, dword [0x538c1c]
push 0x28
push 0x28
mov edx, dword [ecx]
push 0
push ebx
movsx ebx, word [eax + 2]
movsx eax, word [eax]
push ebx
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x498641
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x538f3c]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov eax, dword [0x538f3c]
mov ecx, esi
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
shl ecx, 4
lea eax, [ecx + edx]
mov cx, word [ecx + edx + 2]
mov ax, word [eax]
add cx, 4
add ax, 4
movsx edx, cx
movsx ecx, ax
mov eax, dword [ebp - 0x3c]
push edx
push ecx
mov edx, esi
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
shl edx, 4
lea ecx, [edx + eax + 8]
push ecx
push 9
call fcn.00439580
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [0x538f3c]
mov ecx, esi
mov ebx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
sub ecx, ebx
shl ecx, 4
lea eax, [ecx + edx]
mov edx, dword [0x538ae4]
mov cx, word [eax]
movsx ebx, cx
cmp edx, ebx
jle 0x4986f6
add ecx, 0x28
movsx ecx, cx
cmp edx, ecx
jge 0x4986f6
mov ax, word [eax + 2]
mov ecx, dword [0x538ae8]
movsx edx, ax
cmp ecx, edx
jle 0x4986f6
add eax, 0x28
movsx eax, ax
cmp ecx, eax
jge 0x4986f6
mov word [0x53a450], si
add esi, edi
jmp 0x4985b0
mov esi, 0x32
mov eax, 0x7c
cmp esi, eax
jg 0x498a6d
mov cl, byte [0x53a218]
push ecx
push esi
call fcn.00491de0
cmp word [ebp - 0x1c], 0
mov dword [ebp - 0x34], eax
je 0x498791
cmp dword [0x53a224], 0x20
jge 0x498771
test ax, ax
mov eax, dword [0x538f3c]
lea ebx, [eax + 0x14]
lea edi, [eax + 0xc]
jne 0x49875d
mov dl, byte [0x53a218]
push edx
call fcn.004921f0
mov edx, dword [ebx]
mov ecx, esi
sub ecx, edx
mov edx, dword [edi]
shl ecx, 4
mov word [ecx + edx + 0xe], ax
jmp 0x4987af
mov edx, dword [ebx]
mov ecx, dword [edi]
mov eax, esi
sub eax, edx
shl eax, 4
mov word [eax + ecx + 0xe], 0
jmp 0x4987af
mov eax, dword [0x538f3c]
mov edx, esi
mov ecx, dword [eax + 0x14]
lea ebx, [eax + 0x14]
lea edi, [eax + 0xc]
sub edx, ecx
shl edx, 4
mov eax, dword [edi]
mov word [edx + eax + 0xe], 0xffff
jmp 0x4987af
mov eax, dword [0x538f3c]
mov ecx, esi
mov edx, dword [eax + 0x14]
lea ebx, [eax + 0x14]
lea edi, [eax + 0xc]
sub ecx, edx
shl ecx, 4
mov edx, dword [edi]
mov word [ecx + edx + 0xe], 0xffff
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
mov ecx, dword [edi]
shl eax, 4
add eax, ecx
cmp word [eax + 0xe], 0
je 0x498a61
mov ecx, dword [0x538c1c]
cmp word [ebp - 0x34], 0
lea edi, [ebp - 0x64]
mov edx, dword [ecx]
push edi
push 0x3f800000
push 0x28
push 0x28
jne 0x498801
movsx edi, word [eax + 2]
movsx eax, word [eax]
push 0
push 0x1c8
push edi
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x498835
jmp 0x498820
movsx edi, word [ebp - 0x34]
push 0x31f
push edi
movsx edi, word [eax + 2]
movsx eax, word [eax]
push edi
push eax
push 2
push ecx
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x498835
mov ecx, dword [0x538c1c]
push 0x78
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538f3c]
mov edx, esi
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, edi
shl edx, 4
add eax, edx
mov edx, dword [0x538ae4]
mov cx, word [eax]
movsx edi, cx
cmp edx, edi
jle 0x498881
lea edi, [ecx + 0x28]
movsx edi, di
cmp edx, edi
jge 0x498881
mov dx, word [eax + 2]
mov edi, dword [0x538ae8]
movsx ebx, dx
cmp edi, ebx
jle 0x498881
add edx, 0x28
movsx edx, dx
cmp edi, edx
jge 0x498881
mov dword [ebp - 0x18], esi
mov dl, byte [0x53a218]
test dl, dl
jne 0x498920
mov edi, dword [ebp - 0x80]
lea edx, [esi + esi*8]
lea edx, [esi + edx*4]
cmp word [edi + edx*4 - 0x874], 0
lea edi, [edi + edx*4]
je 0x498a61
mov ax, word [eax + 2]
mov edx, dword [0x538c1c]
sub ax, 3
push 0x2e
movsx eax, ax
mov ebx, dword [edx]
add ecx, 0xfffffffd
push 0x3f800000
push eax
movsx eax, word [edi - 0x872]
movsx ecx, cx
push ecx
push eax
push edx
call dword [ebx + 0x9c]
test eax, eax
fnclex
jge 0x4988f9
mov ecx, dword [0x538c1c]
push 0x9c
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
cmp dword [ebp - 0x18], esi
jne 0x498a61
cmp word [0x538dd0], 0
jne 0x498a61
lea edx, [esi + esi*8 - 0x87]
lea eax, [esi + edx*4 - 0xf]
jmp 0x498a4a
cmp dl, 1
jne 0x4989ba
mov edi, dword [ebp - 0x80]
lea edx, [esi + esi*8]
lea edx, [esi + edx*4]
cmp word [edi + edx*4 + 0x22e8], 0
lea edi, [edi + edx*4]
je 0x498a61
mov ax, word [eax + 2]
mov edx, dword [0x538c1c]
sub ax, 3
push 0x2e
movsx eax, ax
mov ebx, dword [edx]
add ecx, 0xfffffffd
push 0x3f800000
push eax
movsx eax, word [edi + 0x22ea]
movsx ecx, cx
push ecx
push eax
push edx
call dword [ebx + 0x9c]
test eax, eax
fnclex
jge 0x498993
mov ecx, dword [0x538c1c]
push 0x9c
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
cmp dword [ebp - 0x18], esi
jne 0x498a61
cmp word [0x538dd0], 0
jne 0x498a61
lea edx, [esi + esi*8 + 0x21c]
lea eax, [esi + edx*4 + 0x3c]
jmp 0x498a4a
cmp dl, 2
jne 0x498a61
mov edi, dword [ebp - 0x80]
lea edx, [esi + esi*8]
lea edx, [esi + edx*4]
cmp word [edi + edx*4 + 0x4e44], 0
lea edi, [edi + edx*4]
je 0x498a61
mov ax, word [eax + 2]
mov edx, dword [0x538c1c]
sub ax, 3
push 0x2e
movsx eax, ax
mov ebx, dword [edx]
add ecx, 0xfffffffd
push 0x3f800000
push eax
movsx eax, word [edi + 0x4e46]
movsx ecx, cx
push ecx
push eax
push edx
call dword [ebx + 0x9c]
test eax, eax
fnclex
jge 0x498a2d
mov ecx, dword [0x538c1c]
push 0x9c
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
cmp dword [ebp - 0x18], esi
jne 0x498a61
cmp word [0x538dd0], 0
jne 0x498a61
lea edx, [esi + esi*8 + 0x4bf]
lea eax, [esi + edx*4 + 0x87]
mov ecx, dword [ebp - 0x80]
lea edx, [ecx + eax*4]
push edx
push 0x538d98
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov eax, 1
add esi, eax
jmp 0x498702
cmp word [ebp - 0x1c], 0
je 0x498a7d
push 0x7c
push 0x32
call fcn.0049d810
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
cmp word [ebp - 0x1c], 0
jne 0x498c5d
cmp word [0x538a66], 0
je 0x498ab2
call fcn.0049bba0
mov eax, dword [ebp - 0x80]
mov ax, word [eax + 0x18]
test ax, ax
jle 0x498bb2
jmp 0x498b86
mov edi, dword [ebp - 0x80]
cmp word [edi + 0x18], 0
jle 0x498bb2
mov eax, dword [0x538c1c]
lea ecx, [ebp - 0x64]
push ecx
push 0x3f800000
mov edx, dword [eax]
push 0xd
push 0x17
push 0x29
push 0x190
push 0xd1
push 0xff
push 2
push eax
call dword [edx + 0x78]
test eax, eax
fnclex
jge 0x498b06
mov edx, dword [0x538c1c]
push 0x78
push 0x420690
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
push 0x29
push 0xe6
push 0x10a
call fcn.0043c630
test ax, ax
je 0x498b25
mov word [0x53a220], 7
push 0x29
push 0xf8
push 0x10a
call fcn.0043c630
test ax, ax
je 0x498b44
mov word [0x53a220], 8
push 0x29
push 0x10a
push 0x10a
call fcn.0043c630
test ax, ax
je 0x498b63
mov word [0x53a220], 9
push 0x29
push 0x11c
push 0x10a
call fcn.0043c630
test ax, ax
je 0x498b82
mov word [0x53a220], 0xa
mov ax, word [edi + 0x18]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push 0xd3
lea ecx, [ebp - 0x40]
push 0x114
push ecx
push 8
call fcn.004372e0
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov ebx, 4
mov edi, 1
xor esi, esi
cmp esi, ebx
jg 0x498c48
mov edx, dword [0x53a218]
and edx, 0xff
cmp esi, edx
jne 0x498bdd
mov eax, 0x137
jmp 0x498c26
mov edx, dword [0x538ae4]
lea eax, [esi + esi*4]
shl eax, 3
sub eax, esi
lea ecx, [eax + 0x12f]
cmp edx, ecx
jle 0x498c21
add eax, 0x157
mov ecx, edx
cmp ecx, eax
jge 0x498c21
mov eax, dword [0x538ae8]
cmp eax, 0x140
jle 0x498c21
cmp eax, 0x151
jge 0x498c21
mov eax, 0x15d
mov word [0x53a220], si
jmp 0x498c26
mov eax, 0x14a
lea edx, [esi + esi*4]
push 0x13f
shl edx, 3
sub edx, esi
add edx, 0x12f
push edx
push eax
push esi
call fcn.0043c380
add esi, edi
jmp 0x498bbe
cmp byte [0x53a218], 3
jae 0x498c5d
push 0xfffffffffffffff7
push 0x154
call fcn.00493860
cmp word [0x538a5c], 0
je 0x498d38
cmp word [ebp - 0x1c], 0
je 0x498cc4
mov edx, dword [0x538ae8]
mov eax, dword [0x538c1c]
push 0x2e
push 0x3f800000
mov ecx, dword [eax]
push edx
mov edx, dword [0x538ae4]
push edx
movsx edx, word [0x538dd2]
push edx
push eax
call dword [ecx + 0x9c]
test eax, eax
fnclex
jge 0x499162
mov ecx, dword [0x538c1c]
push 0x9c
push 0x420690
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
jmp 0x499162
cmp word [0x538dd0], 0
je 0x499162
cmp word [0x538c14], 2
jne 0x498d23
cmp dword [0x538dc8], 1
jle 0x498d23
mov al, byte [0x538df7]
test al, al
jbe 0x498d23
fild dword [0x538dc8]
fdiv qword [0x401520]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [0x538dc8]
mov dl, byte [0x53a218]
sub ecx, eax
mov dword [0x538dc8], eax
mov eax, dword [ebp - 0x18]
push ecx
push edx
push eax
call fcn.004902d0
jmp 0x499162
mov cl, byte [0x53a218]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.004900d0
jmp 0x499162
cmp word [ebp - 0x1c], 0
je 0x498d5a
mov al, byte [0x53a218]
mov ecx, dword [ebp - 0x18]
push 0
push eax
push ecx
call fcn.00491000
mov dword [0x538ab8], 4
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x499159
cmp word [0x538dd0], 0
je 0x499159
push 0
push 0x538d98
call fcn.004da1f0
cmp word [0x538a7a], 0
je 0x498d98
mov dx, word [0x538dd0]
push 1
push edx
call fcn.004dff90
cmp word [0x538a78], 0
je 0x499159
mov al, byte [0x538df4]
cmp al, 1
jne 0x498dc1
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0xd
call fcn.004925c0
jmp 0x499159
cmp al, 2
jne 0x498dd7
mov ecx, dword [ebp - 0x18]
push 0
push ecx
push 0xe
call fcn.004925c0
jmp 0x499159
cmp al, 3
jne 0x498ded
mov edx, dword [ebp - 0x18]
push 0
push edx
push 0xf
call fcn.004925c0
jmp 0x499159
cmp al, 4
jne 0x498e03
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0x1b
call fcn.004925c0
jmp 0x499159
cmp al, 5
jne 0x498e19
mov ecx, dword [ebp - 0x18]
push 0xffffffffffffffff
push ecx
push 0xb
call fcn.004925c0
jmp 0x499159
cmp al, 6
jne 0x498e2f
mov edx, dword [ebp - 0x18]
push 0xffffffffffffffff
push edx
push 0x10
call fcn.004925c0
jmp 0x499159
cmp al, 7
jne 0x498e45
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffff
push eax
push 0xb
call fcn.004925c0
jmp 0x499159
cmp al, 8
jne 0x498e5b
mov ecx, dword [ebp - 0x18]
push 0
push ecx
push 0x15
call fcn.004925c0
jmp 0x499159
cmp al, 9
jne 0x498e71
mov edx, dword [ebp - 0x18]
push 0
push edx
push 0x19
call fcn.004925c0
jmp 0x499159
cmp al, 0xa
jne 0x498e87
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0x18
call fcn.004925c0
jmp 0x499159
cmp al, 0xb
jne 0x498e9d
mov ecx, dword [ebp - 0x18]
push 0
push ecx
push 0x1a
call fcn.004925c0
jmp 0x499159
cmp al, 0xc
jne 0x498eb3
mov edx, dword [ebp - 0x18]
push 0
push edx
push 0x12
call fcn.004925c0
jmp 0x499159
cmp al, 0xd
jne 0x498ec9
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0xc
call fcn.004925c0
jmp 0x499159
cmp al, 0xe
jne 0x498edf
mov ecx, dword [ebp - 0x18]
push 0
push ecx
push 0x11
call fcn.004925c0
jmp 0x499159
cmp al, 0xf
jne 0x498ef5
mov edx, dword [ebp - 0x18]
push 0
push edx
push 0x1c
call fcn.004925c0
jmp 0x499159
cmp al, 0x10
jne 0x498f0b
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0x1d
call fcn.004925c0
jmp 0x499159
cmp al, 0x11
jne 0x498f21
mov ecx, dword [ebp - 0x18]
push 0
push ecx
push 0x14
call fcn.004925c0
jmp 0x499159
cmp al, 0x12
jne 0x498f37
mov edx, dword [ebp - 0x18]
push 0
push edx
push 0x1f
call fcn.004925c0
jmp 0x499159
cmp al, 0x13
jne 0x498f4d
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0x1e
call fcn.004925c0
jmp 0x499159
cmp al, 0x14
jne 0x498f63
mov ecx, dword [ebp - 0x18]
push 0
push ecx
push 1
call fcn.004925c0
jmp 0x499159
cmp al, 0x1a
jne 0x498f86
cmp byte [0x538df6], 0x19
jne 0x499159
mov edx, dword [ebp - 0x18]
push 0
push edx
push 1
call fcn.004925c0
jmp 0x499159
cmp al, 0x15
jne 0x498fb1
cmp byte [0x538df6], 1
jne 0x499159
movzx ax, byte [0x538df5]
push eax
call fcn.004ba600
push 0xd
call fcn.00431010
jmp 0x499159
cmp al, 0x16
jne 0x499022
cmp word [0x538dd4], 0
jne 0x499159
call fcn.0048f8c0
test ax, ax
je 0x499159
push 0
push 0
push 0xc8
call fcn.00491000
mov eax, dword [ebp - 0x18]
push 0x538e2c
lea ecx, [eax + eax*8 + 0x21c]
lea edx, [eax + ecx*4 + 0x3c]
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
mov ecx, dword [0x5390b8]
lea eax, [ecx + eax*4]
lea ecx, [eax + edx*4]
push ecx
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
jmp 0x499159
cmp al, 0x17
jne 0x499159
mov dl, byte [0x538df9]
mov eax, dword [0x538c50]
mov edi, dword [0x5390b8]
mov esi, 0xa
mov dword [ebp - 0x24], 0
lea ecx, [eax + eax*4]
inc esi
lea ecx, [eax + ecx*8]
lea ebx, [esi + esi*8]
shl ecx, 6
add ecx, eax
lea ebx, [esi + ebx*4]
lea ecx, [eax + ecx*4]
lea ebx, [edi + ebx*4]
lea ecx, [ebx + ecx*4]
cmp byte [ecx + 0x218], dl
jne 0x499087
mov bl, byte [ecx + 0x21f]
test bl, bl
jbe 0x499087
cmp dl, 1
jne 0x49908e
mov bl, byte [0x538df5]
cmp bl, byte [ecx + 0x219]
je 0x49908e
cmp esi, 0x1d
je 0x499093
jmp 0x499047
or ebx, 0xffffffff
jmp 0x499096
mov ebx, dword [ebp - 0x24]
test bx, bx
jne 0x49913f
lea edx, [eax + eax*4]
lea ecx, [eax + edx*8]
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*4]
mov cl, byte [edi + edx*4 + 0x1093]
test cl, cl
jbe 0x4990f2
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x68]
push eax
lea edx, [ebp - 0x64]
push ecx
push edx
push 0x538df9
mov byte [ebp - 0x6c], 0xff
mov byte [ebp - 0x68], 0xcb
mov byte [ebp - 0x64], 0xca
call fcn.00499220
test ax, ax
je 0x4990e7
or ebx, 0xffffffff
mov esi, 0x19
mov eax, dword [0x538c50]
mov edi, dword [0x5390b8]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
cmp word [edi + eax*4 + 0xd84], 0
jle 0x49913a
lea ecx, [ebp - 0x6c]
lea edx, [ebp - 0x68]
push ecx
lea eax, [ebp - 0x64]
push edx
push eax
push 0x538df9
mov byte [ebp - 0x6c], 0xce
mov byte [ebp - 0x68], 0xcd
mov byte [ebp - 0x64], 0xcc
call fcn.00499220
test ax, ax
je 0x49913a
or ebx, 0xffffffff
mov esi, 0x14
test bx, bx
je 0x499159
mov cl, byte [0x53a218]
mov ebx, dword [ebp - 0x18]
push ecx
push ebx
call fcn.004900d0
sub bl, 0x31
push ebx
push esi
call fcn.0048ea20
mov word [0x538dd0], 0
cmp word [0x538a7a], 0
mov word [0x538a78], 0
je 0x49917c
push 0x10
call fcn.00431010
cmp word [0x53a220], 0x1e
jle 0x49919a
mov edx, dword [0x53a220]
push 0
add edx, 0xffffffe2
movsx eax, dx
push eax
call fcn.0048e040
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x4991a9
mov ecx, eax
push ecx
call fcn.004d0f50
call fcn.0043dc40
wait
push 0x499203
jmp 0x4991f0
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x78]
push eax
call esi
lea ecx, [ebp - 0x7c]
push ecx
call esi
ret