Function at 0x4b9480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52c169
push eax
mov eax, 0x41d4
mov dword fs:[0], esp
call fcn.004c79b0
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x41e8]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ebx
cmp ecx, ebp
jl 0x4bb161
mov eax, dword [ebx + 0x40]
cmp eax, ebp
je 0x4bb161
mov edx, dword [ebx + 0x44]
sub edx, eax
mov eax, 0x78787879
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
jae 0x4bb161
mov eax, dword [ebx + 0x40]
mov edx, ecx
shl edx, 4
add edx, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
lea eax, [eax + edx*4]
mov dword [esp + 0x70], eax
call fcn.00442110
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x28]
cmp ecx, eax
je 0x4b9539
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
add ecx, 0x18
cmp eax, edx
je 0x4b9525
mov dword [eax], 0xffff
mov edx, dword [ecx]
add eax, 0x2c
cmp eax, edx
jne 0x4b9516
lea ecx, [esp + 0x28]
call fcn.0042b0a0
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x28]
cmp ecx, eax
jne 0x4b9509
mov eax, dword [0x572084]
push esi
cmp eax, 6
push edi
jl 0x4b9e50
mov dl, byte [esp + 0x13]
mov dword [esp + 0xd8], ebp
mov byte [esp + 0xd4], dl
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xe0], ebp
mov al, byte [esp + 0x13]
push ebp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x41f0], ebp
mov byte [esp + 0x3c], al
call fcn.0040d630
push 0x569bb8
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea ecx, [esp + 0x38]
push eax
push 0x569bb8
call fcn.0040fea0
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x41ec], 1
cmp eax, ebp
jne 0x4b95b4
mov eax, 0x535104
lea ecx, [esp + 0xd4]
push ecx
push eax
call fcn.004a1ee0
add esp, 8
test eax, eax
je 0x4b9e06
mov eax, dword [esp + 0xd8]
cmp eax, ebp
je 0x4b9e06
mov ecx, dword [esp + 0xdc]
mov edx, ecx
sub edx, eax
test edx, 0xfffffff0
je 0x4b9e06
mov esi, eax
cmp eax, ecx
mov dword [esp + 0x1c], esi
je 0x4b9e06
lea eax, [esp + 0x13]
lea ecx, [esp + 0x63]
push eax
push ebp
push ecx
lea ecx, [esp + 0x100]
call fcn.004bd210
mov eax, dword [esi + 4]
mov byte [esp + 0x41ec], 2
cmp eax, ebp
jne 0x4b962c
mov eax, 0x535104
push 0x10
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_wcstoul]
mov edi, dword [ebx + 4]
add esp, 0xc
mov dword [esp + 0x2c], eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, ebx
call fcn.004bbbf0
cmp dword [esp + 0x18], edi
jne 0x4b9670
lea ecx, [esp + 0xf4]
mov byte [esp + 0x41ec], 1
call fcn.004bb7b0
jmp 0x4b9df0
lea ecx, [esp + 0x12]
push ecx
lea ecx, [esp + 0x170]
call fcn.00454330
lea edx, [esp + 0x2c]
push eax
push edx
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x41f4], 3
call fcn.004bbc60
push eax
lea eax, [esp + 0x8c]
push eax
mov ecx, ebx
mov byte [esp + 0x41f4], 4
call fcn.004bba60
mov ecx, dword [eax]
mov byte [esp + 0x41ec], 3
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c0]
call fcn.004bb780
lea ecx, [esp + 0x16c]
mov byte [esp + 0x41ec], 2
call fcn.004bb780
lea edx, [esp + 0x38]
push esi
lea eax, [esp + 0x1a0]
push edx
push eax
call fcn.00413bf0
push 0x569b64
lea ecx, [esp + 0x60]
push eax
push ecx
mov byte [esp + 0x4204], 5
call fcn.00413ae0
add esp, 0x18
push 1
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x41f0], 7
call fcn.0040d630
mov dl, byte [esp + 0x12]
mov dword [esp + 0x94], ebp
mov byte [esp + 0x90], dl
mov dword [esp + 0x98], ebp
mov dword [esp + 0x9c], ebp
mov eax, dword [esp + 0x54]
mov byte [esp + 0x41ec], 8
cmp eax, ebp
jne 0x4b975a
mov eax, 0x535104
lea ecx, [esp + 0x90]
push ecx
push eax
call fcn.004a1ee0
mov ebp, dword [esp + 0x9c]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x98]
je 0x4b9d8a
xor edi, edi
cmp ebp, edi
je 0x4b9d8c
mov edx, eax
sub edx, ebp
test edx, 0xfffffff0
je 0x4b9d8c
cmp ebp, eax
je 0x4b9ac8
mov al, byte [esp + 0x12]
push 0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x7c], al
call fcn.0040d630
mov cl, byte [esp + 0x12]
push 0
mov byte [esp + 0x68], cl
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], 9
call fcn.0040d630
lea edx, [esp + 0x50]
push ebp
lea eax, [esp + 0x190]
push edx
push eax
mov byte [esp + 0x41f8], 0xa
call fcn.00413bf0
push 0x569b54
lea ecx, [esp + 0x16c]
push eax
push ecx
mov byte [esp + 0x4204], 0xb
call fcn.00413ae0
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [esp + 0x41ec], 0xc
test eax, eax
jne 0x4b981e
mov eax, 0x535104
lea edx, [esp + 0x78]
push edx
push eax
call fcn.004a2520
add esp, 8
lea ecx, [esp + 0x15c]
test eax, eax
push 1
mov byte [esp + 0x41f0], 0xb
sete bl
call fcn.0040d630
push 1
lea ecx, [esp + 0x190]
mov byte [esp + 0x41f0], 0xa
call fcn.0040d630
test bl, bl
jne 0x4b9a90
lea eax, [esp + 0x50]
push ebp
lea ecx, [esp + 0x1b0]
push eax
push ecx
call fcn.00413bf0
push 0x569b34
lea edx, [esp + 0x18c]
push eax
push edx
mov byte [esp + 0x4204], 0xd
call fcn.00413ae0
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [esp + 0x41ec], 0xe
test eax, eax
jne 0x4b98aa
mov eax, 0x535104
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.004a2910
add esp, 8
lea ecx, [esp + 0x17c]
test eax, eax
push 1
mov byte [esp + 0x41f0], 0xd
sete bl
call fcn.0040d630
push 1
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x41f0], 0xa
call fcn.0040d630
test bl, bl
jne 0x4b9a90
lea edx, [esp + 0x50]
push ebp
lea eax, [esp + 0xc4]
push edx
push eax
call fcn.00413bf0
push 0x569b20
lea ecx, [esp + 0x158]
push eax
push ecx
mov byte [esp + 0x4204], 0xf
call fcn.00413ae0
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [esp + 0x41ec], 0x10
test eax, eax
jne 0x4b9936
mov eax, 0x535104
lea edx, [esp + 0x64]
push edx
push eax
call fcn.004a2520
add esp, 8
lea ecx, [esp + 0x148]
test eax, eax
push 1
mov byte [esp + 0x41f0], 0xf
sete bl
call fcn.0040d630
push 1
lea ecx, [esp + 0xc4]
mov byte [esp + 0x41f0], 0xa
call fcn.0040d630
test bl, bl
jne 0x4b9a90
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x4b998a
mov ecx, 0x535104
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x4b9997
mov eax, 0x535104
mov edx, dword [esp + 0x34]
push edx
push ecx
push eax
lea eax, [esp + 0x1f0]
push 0x569b0c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [esp + 0x1f8]
push ecx
call dword [sym.imp.MSVCRT.dll__wcslwr]
mov dl, byte [esp + 0x2a]
add esp, 0x18
lea ecx, [esp + 0xe4]
mov byte [esp + 0xe4], dl
push 0
call fcn.0040d630
lea eax, [esp + 0x1e4]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea ecx, [esp + 0x1e4]
push eax
push ecx
lea ecx, [esp + 0xec]
call fcn.0040fea0
mov eax, dword [ebp + 4]
mov byte [esp + 0x41ec], 0x11
test eax, eax
mov edi, 0x535104
je 0x4b9a17
mov edi, eax
lea edx, [esp + 0x4c]
lea eax, [esp + 0xe4]
push edx
push eax
lea ecx, [esp + 0x1d8]
mov dword [esp + 0x54], 0
call fcn.004bc810
lea ecx, [esp + 0x108]
push eax
push ecx
lea ecx, [esp + 0xfc]
mov byte [esp + 0x41f4], 0x12
call fcn.004bd120
mov esi, dword [eax]
push 1
lea ecx, [esp + 0x1d4]
mov byte [esp + 0x41f0], 0x11
call fcn.0040d630
push edi
call dword [sym.imp.MSVCRT.dll__wtol]
add esp, 4
lea ecx, [esp + 0xe4]
mov dword [esi + 0x1c], eax
mov byte [esp + 0x41ec], 0xa
push 1
call fcn.0040d630
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], 9
call fcn.0040d630
push 1
lea ecx, [esp + 0x7c]
mov byte [esp + 0x41f0], 8
call fcn.0040d630
mov eax, dword [esp + 0x98]
add ebp, 0x10
cmp ebp, eax
jne 0x4b97a3
mov eax, dword [esp + 0x20]
mov ebp, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
cmp ebp, ecx
je 0x4b9cf4
mov edi, dword [sym.imp.ole32.dll_StringFromCLSID]
lea edx, [esp + 0x24]
lea esi, [ebp + 8]
xor ebx, ebx
push edx
push esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call edi
lea ecx, [esp + 0x28]
lea eax, [ebp + 0x18]
push ecx
push eax
call edi
mov edx, dword [ebp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
lea edx, [esp + 0x1f0]
push 0x569b0c
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x1f8]
push eax
call dword [sym.imp.MSVCRT.dll__wcslwr]
mov ecx, dword [esp + 0x3c]
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
add esp, 0x18
push ecx
call edi
mov edx, dword [esp + 0x28]
push edx
call edi
mov al, byte [esp + 0x12]
push ebx
lea ecx, [esp + 0xa4]
mov byte [esp + 0xa4], al
call fcn.0040d630
lea ecx, [esp + 0x1e4]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea edx, [esp + 0x1e4]
lea ecx, [esp + 0xa0]
push eax
push edx
call fcn.0040fea0
mov edi, dword [esp + 0xf8]
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x48]
push eax
push ecx
lea ecx, [esp + 0xfc]
mov byte [esp + 0x41f4], 0x13
call fcn.004bc740
mov edx, dword [esp + 0x48]
push 1
cmp edx, edi
lea ecx, [esp + 0xa4]
setne bl
mov byte [esp + 0x41f0], 8
call fcn.0040d630
test bl, bl
je 0x4b9c8c
mov dl, byte [esp + 0x12]
push 0
lea ecx, [esp + 0x114]
mov byte [esp + 0x114], dl
call fcn.0040d630
lea eax, [esp + 0x1e4]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea ecx, [esp + 0x1e4]
push eax
push ecx
lea ecx, [esp + 0x118]
call fcn.0040fea0
lea edx, [esp + 0x4c]
lea eax, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0x130]
mov byte [esp + 0x41f4], 0x14
mov dword [esp + 0x54], 0
call fcn.004bc810
lea ecx, [esp + 0xb0]
push eax
push ecx
lea ecx, [esp + 0xfc]
mov byte [esp + 0x41f4], 0x15
call fcn.004bd120
mov edi, dword [eax]
push 1
lea ecx, [esp + 0x12c]
mov byte [esp + 0x41f0], 0x14
call fcn.0040d630
mov edx, dword [edi + 0x1c]
push 1
lea ecx, [esp + 0x114]
mov dword [ebp], edx
mov byte [esp + 0x41f0], 8
call fcn.0040d630
cmp word [esp + 0x2c], 0x804
jne 0x4b9ce4
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 0x4c]
test cl, cl
je 0x4b9cb0
cmp dword [ebp + 0x28], 0x8040804
jne 0x4b9cb0
mov dword [ebp], 0xfffffffe
mov edx, dword [esp + 0x74]
mov ecx, dword [ebp + 0x28]
cmp ecx, dword [edx + 0x40]
jne 0x4b9ce4
mov eax, edx
mov ecx, 4
xor edx, edx
lea edi, [eax + 0x20]
repe cmpsd dword [esi], dword es:[edi]
jne 0x4b9ce4
mov ecx, 4
lea edi, [eax + 0x30]
lea esi, [ebp + 0x18]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x4b9ce4
mov dword [ebp], 0xffffffff
mov eax, dword [esp + 0x20]
add ebp, 0x2c
cmp ebp, dword [eax + 0x18]
jne 0x4b9ada
mov eax, dword [esp + 0x20]
xor esi, esi
push esi
push 0x4b9450
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
push ecx
push eax
call fcn.004c0410
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xa4]
add esp, 0x10
mov byte [esp + 0x41ec], 7
push ecx
push edx
lea ecx, [esp + 0x98]
call fcn.0040f810
mov eax, dword [esp + 0x94]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
push 1
mov dword [esp + 0xa0], esi
mov byte [esp + 0x41f0], 2
call fcn.0040d630
lea ecx, [esp + 0xf4]
mov byte [esp + 0x41ec], 1
call fcn.004bb7b0
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
jmp 0x4b9dee
xor edi, edi
push eax
push ebp
lea ecx, [esp + 0x98]
mov byte [esp + 0x41f4], 7
call fcn.0040f810
mov ecx, dword [esp + 0x94]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
push 1
mov dword [esp + 0xa0], edi
mov byte [esp + 0x41f0], 2
call fcn.0040d630
lea ecx, [esp + 0xf4]
mov byte [esp + 0x41ec], 1
call fcn.004bb7b0
xor ebp, ebp
mov eax, dword [esp + 0xdc]
add esi, 0x10
cmp esi, eax
mov dword [esp + 0x1c], esi
jne 0x4b9601
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x41f0], 0
call fcn.0040d630
mov edx, dword [esp + 0xdc]
mov eax, dword [esp + 0xd8]
push edx
push eax
lea ecx, [esp + 0xdc]
mov dword [esp + 0x41f4], 0xffffffff
call fcn.0040f810
mov ecx, dword [esp + 0xd8]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dl, byte [esp + 0x12]
mov dword [esp + 0xa4], ebp
mov byte [esp + 0xa0], dl
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xac], ebp
mov eax, dword [0x572084]
mov dword [esp + 0x41ec], 0x16
cmp eax, 6
jge 0x4ba261
lea eax, [esp + 0x12]
lea ecx, [esp + 0x63]
push eax
push 0
push ecx
lea ecx, [esp + 0x100]
call fcn.0042a0e0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 1
push edi
lea edx, [esp + 0x1e8]
push 0x569544
push edx
mov byte [esp + 0x41f8], 0x17
call esi
mov bl, byte [esp + 0x1e]
add esp, 0xc
lea ecx, [esp + 0x50]
mov byte [esp + 0x50], bl
push 0
call fcn.0040d630
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x41f0], 0x18
mov byte [esp + 0x3c], al
call fcn.0040d630
lea ecx, [esp + 0x50]
lea edx, [esp + 0x1e4]
push ecx
push edx
mov byte [esp + 0x41f4], 0x19
call fcn.004a2520
add esp, 8
test eax, eax
je 0x4ba07b
mov eax, dword [esp + 0x58]
mov ebp, 8
cmp eax, ebp
jne 0x4ba07b
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x4b9f38
mov eax, 0x535104
push eax
lea eax, [esp + 0x1e8]
push 0x5694f0
push eax
call esi
lea ecx, [esp + 0x44]
lea edx, [esp + 0x1f0]
push ecx
push edx
call fcn.004a2520
add esp, 0x14
test eax, eax
je 0x4b9f67
cmp dword [esp + 0x40], ebp
je 0x4b9f84
push 0x56f018
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea ecx, [esp + 0x38]
push eax
push 0x56f018
call fcn.0040fea0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x4b9f91
mov ecx, 0x535104
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x4b9f9e
mov eax, 0x535104
push ecx
mov ecx, dword [esp + 0x18]
push eax
call fcn.004bb540
test eax, eax
je 0x4ba07b
cmp ax, 0x804
lea ebp, [edi - 0x3e8]
je 0x4b9fbf
mov ebp, edi
mov dword [esp + 0x88], eax
lea eax, [esp + 0x88]
lea ecx, [esp + 0x108]
push eax
push ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x94], 0
call fcn.0040dbf0
mov eax, dword [eax]
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x41f0], 0x18
mov dword [eax + 0x10], ebp
call fcn.0040d630
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x41f0], 0x17
call fcn.0040d630
inc edi
lea edx, [esp + 0x1e4]
push edi
push 0x569544
push edx
call esi
add esp, 0xc
lea ecx, [esp + 0x50]
mov byte [esp + 0x50], bl
push 0
call fcn.0040d630
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x41f0], 0x18
mov byte [esp + 0x3c], al
call fcn.0040d630
lea ecx, [esp + 0x50]
lea edx, [esp + 0x1e4]
push ecx
push edx
mov byte [esp + 0x41f4], 0x19
call fcn.004a2520
add esp, 8
test eax, eax
jne 0x4b9f1a
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x41f0], 0x18
call fcn.0040d630
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x41f0], 0x17
call fcn.0040d630
mov al, byte [esp + 0x12]
mov byte [esp + 0xb0], al
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x41ec], 0x1a
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [esp + 0x1c], eax
je 0x4ba1ae
mov ebx, dword [esp + 0x14]
mov edi, dword [eax + 0x14]
lea esi, [eax + 0x18]
mov eax, dword [eax + 0x18]
cmp edi, eax
je 0x4ba196
mov edx, dword [edi + 0x28]
mov ebp, dword [esp + 0xf8]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x50], edx
call fcn.0040d950
cmp dword [esp + 0x18], ebp
je 0x4ba145
mov edx, dword [edi + 0x28]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x50], edx
call fcn.0040d950
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x10]
mov dword [edi], eax
mov al, byte [ebx + 0x4c]
test al, al
je 0x4ba15b
cmp dword [edi + 0x28], 0x8040804
jne 0x4ba15b
mov dword [edi], 0xfffffc16
mov edx, dword [esp + 0x74]
mov ecx, dword [edi + 0x28]
cmp ecx, dword [edx + 0x40]
jne 0x4ba16d
mov dword [edi], 0xfffffc17
mov eax, dword [edi + 0x28]
test eax, eax
je 0x4ba189
mov eax, dword [esp + 0xb8]
push edi
push eax
lea ecx, [esp + 0xb8]
call fcn.004bbcf0
mov eax, dword [esi]
add edi, 0x2c
cmp edi, eax
jne 0x4ba0f5
lea ecx, [esp + 0x1c]
call fcn.0042b0a0
mov ecx, dword [ebx + 4]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jne 0x4ba0e4
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
xor esi, esi
push esi
push 0x4b9450
push ecx
push edx
call fcn.004c0410
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0xc8]
add esp, 0x10
cmp edi, eax
je 0x4ba20d
mov ecx, dword [esp + 0xa8]
lea eax, [edi + 0x28]
push eax
push ecx
lea ecx, [esp + 0xa8]
call fcn.004bd280
mov eax, dword [esp + 0xb8]
add edi, 0x2c
cmp edi, eax
jne 0x4ba1e0
mov edi, dword [esp + 0xb4]
push eax
push edi
lea ecx, [esp + 0xb8]
mov byte [esp + 0x41f4], 0x17
call fcn.0040d6e0
mov edx, dword [esp + 0xb4]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0xf4]
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov byte [esp + 0x41ec], 0x16
call fcn.0040dce0
jmp 0x4ba865
push str._nq4E
call fcn.004a37c0
push 0x569a78
call fcn.004a37c0
push 0x569a28
call fcn.004a37c0
mov al, byte [ebx + 0x4c]
add esp, 0xc
test al, al
je 0x4ba2ca
push ebp
push 0x569248
push 0x56942c
call fcn.004a2cd0
push ebp
push 0x569248
push 0x569298
call fcn.004a2cd0
push 0x8040804
push 0x56935c
call fcn.004a3090
push 0x5699b8
call fcn.004a3450
add esp, 0x24
jmp 0x4ba353
mov ebx, dword [esp + 0x74]
mov edi, dword [sym.imp.ole32.dll_StringFromCLSID]
lea eax, [esp + 0x24]
xor ebp, ebp
lea ecx, [ebx + 0x20]
push eax
push ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call edi
lea edx, [esp + 0x28]
lea esi, [ebx + 0x30]
push edx
push esi
call edi
mov eax, dword [esp + 0x24]
push ebp
push eax
push 0x56942c
call fcn.004a2cd0
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push 0x569298
call fcn.004a2cd0
add esp, 0x18
mov ecx, 4
mov edi, 0x53b90c
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x4ba32c
mov ebx, dword [ebx + 0x40]
jmp 0x4ba331
mov ebx, 0x8040804
push ebx
push 0x56935c
call fcn.004a3090
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
add esp, 8
push eax
call esi
mov ecx, dword [esp + 0x28]
push ecx
call esi
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x4ba388
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x48]
lea eax, [esp + 0x124]
push edx
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x804
call fcn.004bbbf0
lea eax, [esp + 0x124]
jmp 0x4ba39f
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov dword [esp + 0x120], eax
lea eax, [esp + 0x120]
mov eax, dword [eax]
mov ecx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x20], eax
je 0x4ba71f
cmp ebx, 1
jne 0x4ba3e6
lea ecx, [esp + 0x34]
lea edx, [esp + 0xd4]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov dword [esp + 0x3c], 0x804
call fcn.004bbbf0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xd4]
cmp eax, ecx
je 0x4ba703
mov edx, dword [eax + 0x14]
test edx, edx
je 0x4ba703
mov ecx, dword [eax + 0x18]
mov eax, 0x2e8ba2e9
sub ecx, edx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
je 0x4ba703
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, ebp
push eax
lea ecx, [esp + 0x1e8]
inc ebp
push str.Go_Z
push ecx
mov dword [esp + 0x94], ebp
call esi
mov eax, dword [esp + 0x2c]
xor edx, edx
add esp, 0xc
lea ecx, [esp + 0x21e4]
mov dx, word [eax + 0xc]
push edx
push 0x569944
push ecx
call esi
lea edx, [esp + 0x21f0]
push 0
lea eax, [esp + 0x1f4]
push edx
push eax
call fcn.004a2cd0
mov eax, dword [esp + 0x38]
add esp, 0x18
xor edi, edi
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
lea edx, [eax + 0x18]
cmp ecx, esi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x108], edx
je 0x4ba6ff
mov edx, dword [esp + 0x14]
add edx, 0x14
add ecx, 0x28
mov dword [esp + 0x90], edx
mov dword [esp + 0x24], ecx
jmp 0x4ba4a1
mov eax, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov cx, word [eax + 0xc]
push edi
push ecx
lea edx, [esp + 0x1ec]
push 0x56986c
push edx
call ebp
mov eax, dword [esp + 0x34]
mov ebx, dword [sym.imp.ole32.dll_StringFromCLSID]
add esp, 0x10
lea ecx, [esp + 0x2c]
lea esi, [eax - 0x10]
push ecx
lea edx, [esi - 0x10]
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x1e8]
push eax
push ecx
call fcn.004a2cd0
mov eax, dword [esp + 0x2c]
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0x1e4]
mov dx, word [eax + 0xc]
push edi
push edx
push 0x569790
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x28]
push edx
push esi
call ebx
mov eax, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x1e8]
push eax
push ecx
call fcn.004a2cd0
mov eax, dword [esp + 0x2c]
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0x1e4]
mov dx, word [eax + 0xc]
push edi
push edx
push 0x5696a4
push ecx
call ebp
mov edx, dword [esp + 0x3c]
push 0x569248
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 0x18
test eax, eax
jne 0x4ba56f
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx]
jmp 0x4ba575
mov ebx, dword [esp + 0x24]
xor eax, eax
push eax
lea eax, [esp + 0x1e8]
push eax
call fcn.004a3090
add esp, 8
add esi, 0xffffffec
lea ecx, [esp + 0x4c]
push esi
push ecx
mov ecx, dword [esp + 0x98]
call fcn.004bbbf0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x4c]
mov eax, dword [edx + 0x18]
cmp ecx, eax
je 0x4ba6a0
mov al, byte [esp + 0x12]
mov esi, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x114]
mov byte [esp + 0x114], al
call fcn.0040d630
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
call ebp
add esp, 4
lea ecx, [esp + 0x110]
push eax
push esi
call fcn.0040fea0
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x110]
lea eax, [esp + 0x1c]
push edx
add ecx, 0x10
push eax
mov byte [esp + 0x41f4], 0x1b
call fcn.004bc740
push 1
lea ecx, [esp + 0x114]
mov byte [esp + 0x41f0], 0x16
call fcn.0040d630
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
je 0x4ba6a0
mov dl, byte [esp + 0x12]
mov esi, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x68], dl
call fcn.0040d630
push esi
call ebp
add esp, 4
lea ecx, [esp + 0x64]
push eax
push esi
call fcn.0040fea0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x64]
push edx
mov byte [esp + 0x41f0], 0x1c
lea ecx, [eax + 0x1c]
lea eax, [esp + 0xb4]
push eax
call fcn.004bc740
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], 0x16
call fcn.0040d630
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x20]
mov ecx, dword [esp + 0xb0]
cmp ecx, eax
je 0x4ba6a0
or dword [ecx + 0x1c], 0x10000
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
push edx
call esi
mov eax, dword [esp + 0x28]
push eax
call esi
cmp dword [ebx], 0
je 0x4ba6d0
mov ecx, dword [esp + 0xa8]
push ebx
push 1
push ecx
lea ecx, [esp + 0xac]
call fcn.004588f0
mov edx, dword [esp + 0x108]
mov eax, dword [esp + 0x34]
add eax, 0x2c
add ebx, 0x2c
mov ecx, dword [edx]
inc edi
cmp eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ebx
jne 0x4ba49d
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x88]
test ebx, ebx
je 0x4ba71f
lea ecx, [esp + 0x20]
call fcn.0042b0a0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x4ba3b0
inc ebx
cmp ebx, 2
mov dword [esp + 0x18], ebx
jl 0x4ba35b
mov eax, dword [esp + 0x74]
mov ecx, 4
mov edi, 0x53b90c
xor edx, edx
lea esi, [eax + 0x20]
repe cmpsd dword [esi], dword es:[edi]
je 0x4ba77c
mov ecx, 4
mov edi, 0x53b90c
lea esi, [eax + 0x30]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4ba77c
mov ecx, dword [eax + 0x40]
test ecx, ecx
jne 0x4ba77c
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push edx
push 0x4b9470
push eax
push ecx
call fcn.004c0900
add esp, 0x10
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
mov edi, dword [eax]
cmp edi, eax
mov dword [esp + 0x30], edi
je 0x4ba865
mov eax, dword [edi + 0x14]
mov edx, dword [eax]
mov dword [esp + 0x1c], edx
mov eax, dword [edi + 0x14]
cmp edx, eax
je 0x4ba849
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov ecx, dword [edx + 0x20]
cmp eax, ecx
je 0x4ba82d
jmp 0x4ba7bb
mov edi, dword [esp + 0x30]
mov ecx, dword [eax + 0x1c]
mov esi, ecx
shr esi, 0x10
cmp cx, si
je 0x4ba815
mov eax, dword [eax + 0x10]
mov ecx, 0x535104
test eax, eax
je 0x4ba7d6
mov ecx, eax
mov eax, dword [edx + 0x10]
test eax, eax
jne 0x4ba7e2
mov eax, 0x535104
push ecx
xor ecx, ecx
mov cx, word [edi + 0xc]
lea edx, [esp + 0x1e8]
push ecx
push eax
push 0x569618
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
and esi, 0xffff
lea eax, [esp + 0x1f8]
push esi
push eax
call fcn.004a3090
add esp, 0x1c
lea ecx, [esp + 0x18]
call fcn.0042b0a0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + 0x20]
cmp eax, ecx
jne 0x4ba7b7
lea ecx, [esp + 0x1c]
call fcn.0042bb40
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 0x14]
cmp edx, eax
jne 0x4ba7a5
lea ecx, [esp + 0x30]
call fcn.0042b0f0
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
mov eax, dword [ecx + 0x18]
cmp edi, eax
jne 0x4ba791
push 0x5695dc
call fcn.004a37c0
push 0x569598
call fcn.004a37c0
mov dl, byte [esp + 0x1a]
mov al, byte [esp + 0x1a]
add esp, 8
lea ecx, [esp + 0xc0]
mov byte [esp + 0xc0], dl
mov byte [esp + 0xc1], al
mov byte [esp + 0xcc], 0
call fcn.004bdd90
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
cmp eax, ecx
mov byte [esp + 0x41ec], 0x1d
mov edi, eax
je 0x4ba9e9
mov ebp, dword [sym.imp.MSVCRT.dll__wcsnicmp]
mov bl, 0x1e
mov cl, byte [esp + 0x12]
push 0
mov byte [esp + 0x7c], cl
lea ecx, [esp + 0x7c]
call fcn.0040d630
mov dl, byte [esp + 0x12]
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], bl
mov byte [esp + 0x68], dl
call fcn.0040d630
lea eax, [esp + 0x13]
lea ecx, [esp + 0x64]
push eax
mov eax, dword [edi]
lea edx, [esp + 0x7c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x41fc], 0x1f
call fcn.004bb250
test al, al
je 0x4ba9ab
mov al, byte [esp + 0x13]
test al, al
jne 0x4ba9ab
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x4ba93b
mov eax, 0x535104
push 4
push 0x568a30
push eax
call ebp
add esp, 0xc
test eax, eax
jne 0x4ba9ab
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0xf8]
call fcn.004a6510
mov dword [esp + 0x104], 0
lea edx, [esp + 0xf4]
lea eax, [esp + 0x88]
push edx
push eax
lea ecx, [esp + 0xc8]
mov byte [esp + 0x41f4], 0x20
call fcn.004bd120
mov esi, dword [eax]
push 1
lea ecx, [esp + 0xf8]
mov byte [esp + 0x41f0], 0x1f
call fcn.0040d630
mov dword [esi + 0x1c], 1
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], bl
call fcn.0040d630
push 1
lea ecx, [esp + 0x7c]
mov byte [esp + 0x41f0], 0x1d
call fcn.0040d630
mov ecx, dword [esp + 0xa8]
add edi, 4
cmp edi, ecx
jne 0x4ba8ce
mov eax, dword [esp + 0xa4]
mov dl, byte [esp + 0x12]
mov byte [esp + 0xe4], dl
xor edx, edx
mov dword [esp + 0xe8], edx
mov dword [esp + 0xec], edx
mov dword [esp + 0xf0], edx
cmp eax, ecx
mov byte [esp + 0x41ec], 0x21
mov ebx, eax
je 0x4baf4b
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
mov al, byte [esp + 0x12]
push 0
lea ecx, [esp + 0x54]
mov byte [esp + 0x54], al
call fcn.0040d630
mov cl, byte [esp + 0x12]
push 0
mov byte [esp + 0x68], cl
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], 0x22
call fcn.0040d630
lea edx, [esp + 0x13]
lea eax, [esp + 0x64]
push edx
mov edx, dword [ebx]
lea ecx, [esp + 0x54]
push eax
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov byte [esp + 0x41fc], 0x23
call fcn.004bb250
test al, al
jne 0x4baaa3
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0x41f0], 0x22
call fcn.0040d630
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x41f0], 0x21
call fcn.0040d630
jmp 0x4baf2b
mov al, byte [esp + 0x12]
push 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x3c], al
call fcn.0040d630
mov cl, byte [esp + 0x12]
push 0
mov byte [esp + 0x7c], cl
lea ecx, [esp + 0x7c]
mov byte [esp + 0x41f0], 0x24
call fcn.0040d630
mov al, byte [esp + 0x13]
mov byte [esp + 0x41ec], 0x25
test al, al
je 0x4baccb
mov esi, dword [esp + 0xc4]
lea edx, [esp + 0x50]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0xc8]
call fcn.004bdce0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc4]
cmp eax, ecx
je 0x4bab28
add eax, 0xc
lea ecx, [esp + 0x50]
push eax
call fcn.004c0330
test eax, eax
jl 0x4bab28
lea eax, [esp + 0x18]
jmp 0x4bab3d
mov ecx, dword [esp + 0xc4]
lea eax, [esp + 0x88]
mov dword [esp + 0x88], ecx
cmp dword [eax], esi
jne 0x4babbd
lea edx, [esp + 0x50]
lea ecx, [esp + 0xf4]
push edx
call fcn.004a6510
xor edi, edi
mov dword [esp + 0x104], edi
lea eax, [esp + 0xf4]
lea ecx, [esp + 0x108]
push eax
push ecx
lea ecx, [esp + 0xc8]
mov byte [esp + 0x41f4], 0x26
call fcn.004bda90
lea edx, [esp + 0x10c]
lea eax, [esp + 0x108]
push edx
push eax
lea ecx, [esp + 0x98]
call fcn.00411bc0
mov esi, dword [esp + 0x90]
push 1
lea ecx, [esp + 0xf8]
mov byte [esp + 0x41f0], 0x25
call fcn.0040d630
mov dword [esi + 0x1c], edi
jmp 0x4babbf
xor edi, edi
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x14c]
call fcn.004a6510
mov dword [esp + 0x158], edi
lea edx, [esp + 0x148]
lea eax, [esp + 0xb0]
push edx
push eax
lea ecx, [esp + 0xc8]
mov byte [esp + 0x41f4], 0x27
call fcn.004bda90
lea ecx, [esp + 0xb4]
lea edx, [esp + 0xb0]
push ecx
push edx
lea ecx, [esp + 0xdc]
call fcn.00411bc0
mov esi, dword [esp + 0xd4]
push 1
lea ecx, [esp + 0x14c]
mov byte [esp + 0x41f0], 0x25
call fcn.0040d630
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 1]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x54]
cmp ecx, edi
jne 0x4bac4a
mov ecx, 0x535104
push ecx
push eax
neg eax
sbb eax, eax
lea edx, [esp + 0x1ec]
and eax, 0x34
add eax, 0x30
and eax, 0xffff
push eax
push 0x569584
push edx
call ebp
lea eax, [esp + 0x1f8]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x18
mov esi, eax
lea ecx, [esp + 0x38]
push 1
push esi
call fcn.0040ff60
test al, al
je 0x4bacb0
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x1e4]
push esi
push ecx
push edx
call fcn.0040db00
mov eax, dword [esp + 0x48]
mov dword [esp + 0x4c], esi
add esp, 0xc
mov word [eax + esi*2], di
mov ecx, dword [0x535110]
lea edx, [esp + 0x64]
push ecx
push edi
push edx
lea ecx, [esp + 0x84]
call fcn.0040fca0
jmp 0x4bace3
mov eax, dword [0x535110]
lea ecx, [esp + 0x64]
push eax
push 0
push ecx
lea ecx, [esp + 0x44]
call fcn.0040fca0
xor edi, edi
mov ecx, dword [esp + 0xa4]
mov edx, ebx
sub edx, ecx
lea eax, [esp + 0x1e4]
sar edx, 2
inc edx
push edx
push 0x569544
push eax
call ebp
mov eax, dword [esp + 0x48]
add esp, 0xc
cmp eax, edi
jne 0x4bad12
mov eax, 0x535104
push edi
lea ecx, [esp + 0x1e8]
push eax
push ecx
call fcn.004a2cd0
mov eax, dword [esp + 0x8c]
add esp, 0xc
cmp eax, edi
jbe 0x4bad71
mov eax, dword [esp + 0x3c]
cmp eax, edi
jne 0x4bad3c
mov eax, 0x535104
push eax
lea edx, [esp + 0x1e8]
push 0x5694f0
push edx
call ebp
mov eax, dword [esp + 0x88]
add esp, 0xc
cmp eax, edi
jne 0x4bad5f
mov eax, 0x535104
push edi
push eax
lea eax, [esp + 0x1ec]
push eax
call fcn.004a2cd0
add esp, 0xc
mov cl, byte [esp + 0x38]
push edi
mov byte [esp + 0x12c], cl
lea ecx, [esp + 0x12c]
call fcn.0040d630
mov edx, dword [0x535110]
lea eax, [esp + 0x38]
push edx
push edi
push eax
lea ecx, [esp + 0x134]
call fcn.0040fca0
mov cl, byte [esp + 0x78]
push edi
mov byte [esp + 0x13c], cl
lea ecx, [esp + 0x13c]
mov byte [esp + 0x41f0], 0x28
call fcn.0040d630
mov edx, dword [0x535110]
lea eax, [esp + 0x78]
push edx
push edi
push eax
lea ecx, [esp + 0x144]
call fcn.0040fca0
mov edx, dword [esp + 0xec]
lea ecx, [esp + 0x128]
push ecx
push 1
push edx
lea ecx, [esp + 0xf0]
mov byte [esp + 0x41f8], 0x29
call fcn.004bddf0
push 1
lea ecx, [esp + 0x13c]
mov byte [esp + 0x41f0], 0x2a
call fcn.0040d630
mov ecx, dword [esp + 0x12c]
cmp ecx, edi
je 0x4bae40
mov al, byte [ecx - 1]
test al, al
je 0x4bae34
cmp al, 0xff
je 0x4bae34
dec al
mov byte [ecx - 1], al
jmp 0x4bae40
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x12c], edi
cmp ecx, edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x134], edi
je 0x4bae7b
mov al, byte [ecx - 1]
test al, al
je 0x4bae6f
cmp al, 0xff
je 0x4bae6f
dec al
mov byte [ecx - 1], al
jmp 0x4bae7b
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x7c], edi
cmp ecx, edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], edi
je 0x4baeb3
mov al, byte [ecx - 1]
test al, al
je 0x4baea7
cmp al, 0xff
je 0x4baea7
dec al
mov byte [ecx - 1], al
jmp 0x4baeb3
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x3c], edi
cmp ecx, edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
je 0x4baee5
mov al, byte [ecx - 1]
test al, al
je 0x4baed9
cmp al, 0xff
je 0x4baed9
dec al
mov byte [ecx - 1], al
jmp 0x4baee5
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x68], edi
cmp ecx, edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov byte [esp + 0x41ec], 0x21
je 0x4baf1f
mov al, byte [ecx - 1]
test al, al
je 0x4baf13
cmp al, 0xff
je 0x4baf13
dec al
mov byte [ecx - 1], al
jmp 0x4baf1f
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov eax, dword [esp + 0xa8]
add ebx, 4
cmp ebx, eax
jne 0x4baa23
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0xec]
cmp edx, dword [esp + 0xe8]
je 0x4baf97
mov edi, dword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
lea esi, [edx - 0x1c]
xor ebp, ebp
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
cmp eax, ebp
jne 0x4baf6d
mov eax, 0x535104
xor edx, edx
cmp edx, ecx
sbb ecx, ecx
and ecx, 2
add ecx, 8
push ecx
push eax
call edi
mov eax, dword [esp + 0xe8]
sub esi, 0x20
lea edx, [esi + 0x1c]
cmp edx, eax
jne 0x4baf5f
mov eax, dword [esp + 0xa4]
jmp 0x4baf99
xor ebp, ebp
push 2
push eax
push ebp
push 0x5a
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp + 0xec]
mov esi, dword [esp + 0xe8]
cmp esi, eax
mov edi, eax
mov dword [esp + 0x88], esi
je 0x4bb045
mov bl, 0x2b
push 1
lea ecx, [esi + 0x10]
mov byte [esp + 0x41f0], bl
call fcn.0040d630
mov eax, dword [esi + 4]
mov byte [esp + 0x41ec], 0x1d
cmp eax, ebp
je 0x4bb027
push eax
mov ecx, esi
call fcn.004bd420
cmp byte [eax], 0
je 0x4bb012
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.004bd420
cmp byte [eax], 0xff
je 0x4bb012
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.004bd420
dec byte [eax]
jmp 0x4bb027
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
add edx, 2
sub eax, 2
push edx
push eax
mov ecx, esi
call fcn.004bba50
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
add esi, 0x20
cmp esi, edi
mov dword [esp + 0x88], esi
jne 0x4bafc6
mov esi, dword [esp + 0xe8]
push esi
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0xc8]
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0xec], ebp
mov dword [esp + 0xf0], ebp
mov dword [esp + 0xf4], ebp
mov eax, dword [esi]
add esp, 4
cmp ecx, ebp
mov byte [esp + 0x41ec], 0x16
mov dword [esp + 0x18], eax
je 0x4bb0f0
mov ecx, eax
cmp eax, ecx
jne 0x4bb0f0
mov edi, dword [esi + 4]
mov eax, dword [esp + 0xc8]
cmp edi, eax
mov esi, edi
je 0x4bb0ca
mov ecx, dword [esi + 8]
push ecx
lea ecx, [esp + 0xc4]
call fcn.004bdd50
mov esi, dword [esi]
push ebp
lea ecx, [edi + 0xc]
call fcn.00512700
push edi
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0xcc]
add esp, 4
cmp esi, eax
mov edi, esi
jne 0x4bb099
mov edx, dword [esp + 0xc4]
mov dword [edx + 4], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xd0], ebp
mov dword [eax], eax
mov eax, dword [esp + 0xc4]
mov dword [eax + 8], eax
jmp 0x4bb11c
cmp eax, esi
je 0x4bb11c
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.0042b0a0
lea eax, [esp + 0x88]
push edi
push eax
lea ecx, [esp + 0xc8]
call fcn.0042bcb0
mov eax, dword [esp + 0x18]
cmp eax, esi
jne 0x4bb0f4
mov ecx, dword [esp + 0xc4]
push ecx
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0xcc]
mov dword [esp + 0xc8], ebp
push edx
mov dword [esp + 0xd8], ebp
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0xac]
mov dword [esp + 0xd0], ebp
push eax
call sub.MFC42.DLL_operatordelete
add esp, 0xc
mov al, 1
pop edi
pop esi
jmp 0x4bb163
xor al, al
mov ecx, dword [esp + 0x41dc]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x41e0
ret 4