Function at 0x518370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405216
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x404960
xor esi, esi
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xec], esi
call fcn.004f7780
call fcn.004a0f50
cmp dword [0x538c50], esi
je 0x519ef6
cmp word [ebp + 8], si
je 0x518430
cmp word [0x5398d4], si
je 0x519ef6
mov eax, dword [0x538bc8]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
push eax
push 0x42b908
call edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
push eax
mov eax, dword [0x538c50]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrUI1]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
mov ecx, dword [0x5390b8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
mov dl, byte [ecx + eax*4 + 0x16]
push edx
call ebx
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x54]
call esi
push eax
push 0x42b920
call edi
mov edx, eax
lea ecx, [ebp - 0x24]
call esi
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x50]
push eax
lea edx, [ebp - 0x4c]
push ecx
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
call fcn.0042efd0
test ax, ax
je 0x518613
cmp word [0x538a68], 0
je 0x518613
call fcn.00518290
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcGetPresentDate]
mov edx, dword [0x538bc8]
push edx
push 0x42b948
call edi
mov edx, eax
lea ecx, [ebp - 0x4c]
call esi
push eax
mov eax, dword [0x538c50]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
mov ecx, dword [0x5390b8]
shl edx, 6
add edx, eax
lea eax, [eax + edx*4]
mov dl, byte [ecx + eax*4 + 0x16]
push edx
call ebx
mov edx, eax
lea ecx, [ebp - 0x50]
call esi
push eax
call edi
mov edx, eax
lea ecx, [ebp - 0x54]
call esi
push eax
push 0x41d6d0
call edi
mov edi, 8
lea edx, [ebp - 0xc8]
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], edi
mov dword [ebp - 0xc0], 0x427e84
mov dword [ebp - 0xc8], edi
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
push 1
lea eax, [ebp - 0x78]
push 1
lea ecx, [ebp - 0x68]
push eax
lea edx, [ebp - 0x88]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcVarFromFormatVar]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x98]
push eax
lea edx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xd8], edi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push edx
push eax
mov dword [ebp - 0xd0], 0x42b920
call edi
lea ecx, [ebp - 0xd8]
push eax
lea edx, [ebp - 0xb8]
push ecx
push edx
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x58]
call esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaNameFile]
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x54]
push eax
lea edx, [ebp - 0x50]
push ecx
push edx
lea eax, [ebp - 0x4c]
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xa8]
push ecx
lea eax, [ebp - 0x88]
push edx
lea ecx, [ebp - 0x98]
push eax
lea edx, [ebp - 0x78]
push ecx
lea eax, [ebp - 0x68]
push edx
push eax
push 6
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x30
push 0
push 0x2625a00
push 1
push 0x11
push 0x539a44
push 1
push 0x80
call dword [sym.imp.MSVBVM60.DLL___vbaRedim]
add esp, 0x1c
mov dword [0x539a48], 0
push 0x539848
call fcn.005155f0
movsx ecx, word [0x539848]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x18], 1
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x18]
cmp eax, edx
jg 0x519aa4
mov eax, dword [0x539840]
lea ecx, [ebp - 0xe0]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x18]
sub eax, dword [ecx + 0x14]
mov edx, eax
shl edx, 5
add edx, eax
mov eax, dword [ecx + 0xc]
lea ebx, [eax + edx*8]
lea eax, [ebx + 0x100]
push eax
call fcn.00515490
mov al, byte [ebx + 0x100]
test al, al
jbe 0x518889
and eax, 0xff
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
jg 0x518889
mov eax, dword [ebx + 0x104]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
shl edx, 4
mov ecx, dword [edx + eax]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea edx, [ebp - 0x38]
mov byte [ebp - 0x38], al
push edx
call fcn.00515490
mov al, byte [ebp - 0x38]
test al, al
jbe 0x5187e7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], 1
and eax, 0xff
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x2c], eax
jg 0x5187e7
mov eax, dword [ebx + 0x104]
mov dword [ebp - 0x1c4], eax
push eax
lea eax, [ebp - 0x44]
push eax
call esi
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
shl ecx, 4
mov eax, dword [ecx + edx]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
lea ecx, [eax + edx*2]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x1c4]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
shl ecx, 4
mov eax, dword [ecx + edx]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
lea ecx, [eax + edx*2 + 1]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2c], ecx
jmp 0x518729
mov eax, dword [ebx + 0x104]
lea ecx, [ebp - 0x40]
push eax
push ecx
mov dword [ebp - 0x1c4], eax
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
shl edx, 4
lea ecx, [edx + eax + 0xc]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
shl edx, 4
lea ecx, [edx + eax + 4]
push ecx
call fcn.005155f0
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
shl edx, 4
lea ecx, [edx + eax + 8]
push ecx
call fcn.00515900
lea edx, [ebp - 0x40]
push edx
call edi
mov ecx, dword [ebp - 0x28]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x28], ecx
jmp 0x5186cc
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov eax, 8
cmp ecx, eax
jg 0x518933
mov eax, ecx
shl eax, 4
add eax, ebx
mov dword [ebp - 0x1c8], eax
add eax, 0x53
push eax
call fcn.00515490
mov ecx, dword [ebp - 0x1c8]
add ecx, 0x58
push ecx
call fcn.00515750
mov edx, dword [ebp - 0x28]
add edx, 5
shl edx, 4
add edx, ebx
push edx
call fcn.00515490
mov eax, dword [ebp - 0x1c8]
add eax, 0x54
push eax
call fcn.005155f0
mov ecx, dword [ebp - 0x1c8]
add ecx, 0x51
push ecx
call fcn.00515490
mov edx, dword [ebp - 0x1c8]
add edx, 0x52
push edx
call fcn.00515490
mov eax, dword [ebp - 0x1c8]
add eax, 0x5c
push eax
call fcn.00515750
mov ecx, dword [ebp - 0x1c8]
add ecx, 0x56
push ecx
call fcn.005155f0
mov ecx, dword [ebp - 0x28]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x28], ecx
jmp 0x518890
lea edx, [ebx + 0x28]
push edx
call fcn.005155f0
lea eax, [ebx + 0x1a]
push eax
call fcn.00515490
lea ecx, [ebx + 0x10]
push ecx
call fcn.00515900
lea edx, [ebx + 0x2e]
push edx
call fcn.005155f0
lea eax, [ebx + 0x32]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x4c]
push ecx
call fcn.00515750
lea edx, [ebx + 0x40]
push edx
call fcn.00515800
lea eax, [ebx + 0x48]
push eax
call fcn.00515750
lea ecx, [ebx + 0x44]
push ecx
call fcn.00515750
lea edx, [ebx + 0x2a]
push edx
call fcn.00515490
lea eax, [ebx + 0x38]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x3c]
push ecx
call fcn.00515750
lea edx, [ebx + 0x14]
push edx
call fcn.00515900
lea eax, [ebx + 0x34]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x3a]
push ecx
call fcn.005155f0
lea edx, [ebx + 0x2c]
push edx
call fcn.005155f0
lea eax, [ebx + 0x36]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x1c]
push ecx
call fcn.00515750
lea edx, [ebx + 0x24]
push edx
call fcn.005155f0
lea eax, [ebx + 0x26]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x20]
push ecx
call fcn.00515750
lea edx, [ebx + 0x30]
push edx
call fcn.005155f0
lea eax, [ebx + 8]
push eax
mov dword [ebp - 0x1cc], eax
call fcn.005155f0
push ebx
call fcn.00515900
lea eax, [ebx + 4]
push eax
call fcn.00515490
lea ecx, [ebx + 5]
push ecx
call fcn.00515490
add ebx, 6
push ebx
call fcn.00515490
mov edx, dword [ebp - 0x1cc]
mov ax, word [edx]
test ax, ax
jle 0x519a89
movsx eax, ax
mov ebx, 1
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x28], ebx
cmp ebx, dword [ebp - 0x134]
jg 0x519a89
mov ecx, dword [0x539840]
lea edx, [ebp - 0xe8]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x18]
sub eax, dword [ecx + 0x14]
mov edx, eax
shl edx, 5
add edx, eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*8 + 0xc]
lea edx, [ebp - 0xe4]
push ecx
push edx
call esi
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax + 0x14]
sub ebx, edx
mov edx, dword [eax + 0xc]
shl ebx, 7
add ebx, edx
mov dword [ebp - 0xf4], ebx
lea eax, [ebx + 0x64]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x66]
push ecx
call fcn.00515490
lea edx, [ebx + 4]
push edx
call fcn.005155f0
push ebx
call fcn.00515900
lea eax, [ebx + 0x5f]
push eax
call fcn.00515490
lea ecx, [ebx + 0x32]
push ecx
call fcn.00515490
lea edx, [ebx + 0x5e]
push edx
call fcn.00515490
lea eax, [ebx + 0x44]
push eax
call fcn.005156a0
lea ecx, [ebx + 0x22]
push ecx
call fcn.00515490
lea edx, [ebx + 0x36]
push edx
call fcn.00515490
lea eax, [ebx + 0x3a]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x3c]
push ecx
call fcn.005155f0
lea edx, [ebx + 0x3e]
push edx
call fcn.005155f0
lea eax, [ebx + 0x40]
push eax
call fcn.00515490
lea ecx, [ebx + 0x41]
push ecx
call fcn.00515490
lea edx, [ebx + 0x42]
push edx
call fcn.00515490
lea eax, [ebx + 0x35]
push eax
call fcn.00515490
lea eax, [ebx + 0x5c]
push eax
mov dword [ebp - 0x1d0], eax
call fcn.00515490
mov ecx, dword [ebp - 0x1d0]
mov al, byte [ecx]
test al, al
jbe 0x518c12
and eax, 0xff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x13c], eax
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
jg 0x518c12
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x1d4], eax
push eax
lea eax, [ebp - 0x40]
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push eax
call fcn.005155f0
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4 + 2]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4 + 3]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x518b6c
lea edx, [ebx + 0x48]
push edx
call fcn.00515490
lea eax, [ebx + 0x49]
push eax
call fcn.00515490
lea ecx, [ebx + 0x4a]
push ecx
call fcn.00515490
lea edx, [ebx + 0x28]
push edx
call fcn.005156a0
lea eax, [ebx + 0x37]
push eax
call fcn.00515490
lea ecx, [ebx + 0x1c]
push ecx
call fcn.00515490
lea eax, [ebx + 0x54]
push eax
call fcn.00515490
mov al, byte [ebx + 0x54]
test al, al
jbe 0x518d14
and eax, 0xff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
jg 0x518d14
mov eax, dword [ebx + 0x50]
mov dword [ebp - 0x1d8], eax
push eax
lea eax, [ebp - 0x40]
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*8 + 4]
push eax
call fcn.005155f0
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*8]
push eax
call fcn.005156a0
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*8 + 6]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x518c6e
lea edx, [ebx + 0x24]
push edx
call fcn.005155f0
lea eax, [ebx + 0x5d]
push eax
call fcn.00515490
lea ecx, [ebx + 0x30]
push ecx
call fcn.005155f0
lea edx, [ebx + 0x33]
push edx
call fcn.00515490
lea eax, [ebx + 0x38]
push eax
call fcn.00515490
lea ecx, [ebx + 0x34]
push ecx
call fcn.00515490
lea edx, [ebx + 0x1e]
push edx
call fcn.005155f0
lea eax, [ebx + 0x20]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x2c]
push ecx
call fcn.005156a0
lea edx, [ebx + 0x4c]
push edx
call fcn.005155f0
lea eax, [ebx + 0x10]
push eax
call fcn.00515490
lea ecx, [ebx + 0xf]
push ecx
call fcn.00515490
lea edx, [ebx + 0xe]
push edx
call fcn.00515490
lea eax, [ebx + 0xd]
push eax
call fcn.00515490
lea ecx, [ebx + 0xa]
push ecx
call fcn.00515490
lea edx, [ebx + 9]
push edx
call fcn.00515490
lea eax, [ebx + 8]
push eax
call fcn.00515490
lea ecx, [ebx + 0xc]
push ecx
call fcn.00515490
lea edx, [ebx + 0xb]
push edx
call fcn.00515490
lea eax, [ebx + 0x18]
push eax
call fcn.00515490
mov al, byte [ebx + 0x18]
test al, al
jbe 0x518e24
and eax, 0xff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x2c]
cmp ecx, eax
jg 0x518e24
mov ecx, dword [ebx + 0x14]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2]
push eax
call fcn.005155f0
lea ecx, [ebp - 0x40]
push ecx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x518de1
lea eax, [ebx + 0x60]
push eax
call fcn.0041fc68
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0xdc]
push edx
call fcn.00516e30
test ax, ax
je 0x518eea
mov eax, dword [ebx + 0x60]
push eax
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], al
push ecx
call fcn.00515490
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], 0
and eax, 0xff
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x154]
cmp edx, eax
jg 0x518ef7
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x2c]
mov eax, 0x1e
cmp ecx, eax
jg 0x518edb
mov eax, dword [ebx + 0x60]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
sub eax, dword [ecx + 0x14]
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, dword [ebp - 0x2c]
add edx, eax
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*2]
push ecx
call fcn.005155f0
lea edx, [ebp - 0x40]
push edx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x518e8f
mov ecx, dword [ebp - 0x34]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x34], ecx
jmp 0x518e7b
lea eax, [ebp - 0x38]
mov byte [ebp - 0x38], 0xff
push eax
call fcn.00515490
lea ecx, [ebx + 7]
push ecx
call fcn.00515490
lea eax, [ebx + 0x68]
push eax
call fcn.0041fc68
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0xdc]
push edx
call fcn.00516e30
test ax, ax
je 0x518fc7
mov eax, dword [ebx + 0x68]
push eax
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push ecx
call fcn.005155f0
movsx edx, word [ebp - 0x14]
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x2c]
cmp ecx, eax
jg 0x518fd7
mov eax, dword [ebx + 0x68]
lea ecx, [ebp - 0x40]
push eax
push ecx
mov dword [ebp - 0x1dc], eax
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
lea ecx, [eax + edx*2]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
lea ecx, [eax + edx*2 + 1]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x518f53
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffff
push eax
call fcn.005155f0
lea eax, [ebx + 0x74]
push eax
call fcn.00515490
mov al, byte [ebx + 0x74]
test al, al
jbe 0x5190a3
and eax, 0xff
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
jg 0x5190a3
mov eax, dword [ebx + 0x70]
lea edx, [ebp - 0x40]
push eax
push edx
mov dword [ebp - 0x1e0], eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*8 + 4]
push eax
call fcn.005155f0
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*8]
push eax
call fcn.00515900
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*8 + 6]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov ecx, dword [ebp - 0x34]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x34], ecx
jmp 0x518ffd
lea edx, [ebx + 6]
push edx
call fcn.00515490
lea eax, [ebx + 0x6c]
push eax
call fcn.0041fc68
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0xdc]
push eax
call fcn.00516e30
test ax, ax
je 0x5195f5
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ecx + 0x6c]
lea eax, [ecx + 0x6c]
push edx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov byte [ebp - 0x38], al
lea eax, [ebp - 0x38]
push eax
call fcn.00515490
mov eax, dword [ebp - 0x38]
and eax, 0xff
xor ebx, ebx
mov dword [ebp - 0x174], eax
cmp ebx, dword [ebp - 0x174]
jg 0x519604
mov ecx, dword [ebp - 0xf4]
lea edx, [ebp - 0x40]
lea eax, [ecx + 0x6c]
mov eax, dword [ecx + 0x6c]
push eax
push edx
mov dword [ebp - 0x1e4], eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
push edx
call fcn.005155f0
lea eax, [ebp - 0x40]
push eax
call edi
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 + 8]
push edx
call fcn.00515490
lea eax, [ebp - 0x40]
push eax
call edi
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 + 2]
push edx
call fcn.005155f0
lea eax, [ebp - 0x40]
push eax
call edi
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 + 4]
push edx
call fcn.0041fc68
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x40]
push eax
call edi
mov ecx, dword [ebp - 0xdc]
push ecx
call fcn.00516e30
test ax, ax
je 0x5195dc
mov ecx, dword [ebp - 0x1e4]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea edx, [ebp - 0x20]
mov byte [ebp - 0x20], al
push edx
call fcn.00515490
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], 1
and eax, 0xff
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x30]
cmp ecx, eax
jg 0x5195e9
mov ecx, dword [ebp - 0xf4]
lea edx, [ebp - 0x44]
lea eax, [ecx + 0x6c]
mov eax, dword [ecx + 0x6c]
push eax
push edx
mov dword [ebp - 0x1e4], eax
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 2]
push ecx
call fcn.005155f0
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0xc8], 0x6008
lea ecx, [eax + edx*4 + 4]
lea edx, [ebp - 0xc8]
push edx
mov dword [ebp - 0xc0], ecx
call fcn.00420704
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x40]
push eax
call edi
lea ecx, [ebp - 0x44]
push ecx
call edi
mov edx, dword [ebp - 0xdc]
push edx
call fcn.00516e30
test ax, ax
je 0x519453
mov eax, dword [ebp - 0xf4]
add eax, 0x6c
mov ecx, dword [eax]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
mov eax, dword [ebp - 0x30]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea edx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
push edx
call fcn.00515490
movzx ax, byte [ebp - 0x1c]
mov word [ebp - 0x104], ax
mov dword [ebp - 0x14], 0
mov cx, word [ebp - 0x14]
cmp cx, word [ebp - 0x104]
jg 0x519460
mov edx, dword [ebp - 0xf4]
lea ecx, [ebp - 0x48]
lea eax, [edx + 0x6c]
mov eax, dword [edx + 0x6c]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x48]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
movsx ecx, word [ebp - 0x14]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
push eax
call fcn.00515900
lea ecx, [ebp - 0x40]
push ecx
call edi
lea edx, [ebp - 0x44]
push edx
call edi
lea eax, [ebp - 0x48]
push eax
call edi
mov ecx, dword [ebp - 0x14]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x14], ecx
jmp 0x5193be
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], 0xff
push ecx
call fcn.00515490
mov edx, dword [ebp - 0xf4]
lea eax, [edx + 0x6c]
mov eax, dword [edx + 0x6c]
mov dword [ebp - 0x1e4], eax
push eax
lea eax, [ebp - 0x44]
push eax
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 + 8]
push edx
call fcn.0041fc68
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x40]
push eax
call edi
lea ecx, [ebp - 0x44]
push ecx
call edi
mov edx, dword [ebp - 0xdc]
push edx
call fcn.00516e30
test ax, ax
je 0x5195bd
mov ecx, dword [ebp - 0x1e4]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov ecx, dword [ecx + eax*4 + 4]
mov eax, dword [ebp - 0x30]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 8]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea edx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
push edx
call fcn.00515490
movzx ax, byte [ebp - 0x1c]
mov word [ebp - 0x10c], ax
mov dword [ebp - 0x14], 0
mov cx, word [ebp - 0x14]
cmp cx, word [ebp - 0x10c]
jg 0x5195ca
mov edx, dword [ebp - 0xf4]
lea ecx, [ebp - 0x48]
lea eax, [edx + 0x6c]
mov eax, dword [edx + 0x6c]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x48]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 8]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
sub ecx, edx
movsx edx, word [ebp - 0x14]
add ecx, edx
push ecx
call fcn.00515490
lea eax, [ebp - 0x40]
push eax
call edi
lea ecx, [ebp - 0x44]
push ecx
call edi
lea edx, [ebp - 0x48]
push edx
call edi
mov ecx, dword [ebp - 0x14]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x14], ecx
jmp 0x519529
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x1c], 0xff
push eax
call fcn.00515490
mov ecx, dword [ebp - 0x30]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x30], ecx
jmp 0x519232
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], 0
push ecx
call fcn.00515490
mov eax, 1
add ebx, eax
jmp 0x519107
lea edx, [ebp - 0x38]
mov byte [ebp - 0x38], 0xff
push edx
call fcn.00515490
jmp 0x51960a
mov ebx, dword [ebp - 0xf4]
add ebx, 0x7c
push ebx
call fcn.00515490
mov al, byte [ebx]
test al, al
jbe 0x519a63
and eax, 0xff
mov ebx, 1
mov dword [ebp - 0x184], eax
cmp ebx, dword [ebp - 0x184]
jg 0x519a63
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0x40]
mov eax, dword [eax + 0x78]
push eax
push ecx
mov dword [ebp - 0x1e8], eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 1]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 0xc]
push ecx
call fcn.005156a0
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 0x14]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 0x12]
push ecx
call fcn.005155f0
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 0x10]
push ecx
call fcn.005155f0
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 0x1c]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 2]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 3]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 4]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x40]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 8]
push ecx
call fcn.00515900
lea edx, [ebp - 0x40]
push edx
call edi
mov ecx, dword [ebp - 0x1e8]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*8]
mov al, byte [ecx + eax*4 + 0x1c]
test al, al
jbe 0x5198ab
and eax, 0xff
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x18c], eax
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x34]
cmp eax, edx
jg 0x5198ab
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x44]
push eax
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 0x20]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x34]
sub ecx, edx
add ecx, eax
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x34]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x34], ecx
jmp 0x519847
mov ecx, dword [ebp - 0x1e8]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*8]
lea edx, [ecx + eax*4 + 0x18]
push edx
call fcn.0041fc68
mov dword [ebp - 0xdc], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x40]
push eax
call edi
mov ecx, dword [ebp - 0xdc]
push ecx
call fcn.00516e30
test ax, ax
je 0x519a4a
mov ecx, dword [ebp - 0x1e8]
mov eax, ebx
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 0x18]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
lea edx, [ebp - 0x38]
mov byte [ebp - 0x38], al
push edx
call fcn.00515490
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], 1
and eax, 0xff
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x34]
cmp ecx, eax
jg 0x519a57
mov ecx, dword [ebp - 0xf4]
lea edx, [ebp - 0x44]
mov eax, dword [ecx + 0x78]
push eax
push edx
mov dword [ebp - 0x1e8], eax
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*8]
mov edx, dword [ecx + eax*4 + 0x18]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 8]
push ecx
call fcn.005155f0
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x1e8]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*8]
mov edx, dword [ecx + eax*4 + 0x18]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 4]
push ecx
call fcn.005156a0
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x1e8]
lea edx, [ebp - 0x44]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, ebx
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*8]
mov edx, dword [ecx + eax*4 + 0x18]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x40]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call edi
mov ecx, dword [ebp - 0x34]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x34], ecx
jmp 0x519938
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], 0
push ecx
call fcn.00515490
mov eax, 1
add ebx, eax
jmp 0x51962d
lea edx, [ebp - 0xe4]
push edx
call edi
lea eax, [ebp - 0xe8]
push eax
call edi
mov ecx, dword [ebp - 0x28]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x28], ecx
mov ebx, ecx
jmp 0x518a4c
lea ecx, [ebp - 0xe0]
push ecx
call edi
mov ecx, dword [ebp - 0x18]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x518667
push 0x539864
call fcn.005155f0
mov ax, word [0x539864]
test ax, ax
jle 0x519e34
movsx edx, ax
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
jg 0x519e34
mov ecx, dword [0x539860]
lea edx, [ebp - 0xec]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, ebx
lea eax, [eax + eax*4]
lea ebx, [ecx + eax*8]
mov dword [ebp - 0xf8], ebx
lea eax, [ebx + 0xc]
push eax
call fcn.00515490
mov al, byte [ebx + 0xc]
test al, al
jbe 0x519ba5
and eax, 0xff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x1a4], eax
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
jg 0x519ba5
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1ec], eax
push eax
lea eax, [ebp - 0x40]
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2 + 1]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x519b31
lea eax, [ebx + 4]
push eax
call fcn.00515490
mov al, byte [ebx + 4]
test al, al
jbe 0x519c3e
and eax, 0xff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x1ac], eax
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
jg 0x519c3e
mov eax, dword [ebx]
mov dword [ebp - 0x1f0], eax
push eax
lea eax, [ebp - 0x40]
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov edx, dword [ebp - 0x1f0]
lea eax, [ebp - 0x40]
push edx
push eax
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2 + 1]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x519bcb
lea edx, [ebx + 0x10]
push edx
call fcn.00515490
lea eax, [ebx + 0x12]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x1a]
push ecx
call fcn.005155f0
lea edx, [ebx + 0x1c]
push edx
call fcn.005155f0
lea eax, [ebx + 0x14]
push eax
call fcn.005155f0
lea ecx, [ebx + 0x16]
push ecx
call fcn.005155f0
lea edx, [ebx + 0x18]
push edx
call fcn.005155f0
add ebx, 0x24
push ebx
call fcn.00515490
mov al, byte [ebx]
test al, al
jbe 0x519e19
and eax, 0xff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x2c]
cmp ecx, eax
jg 0x519e19
mov ecx, dword [ebp - 0xf8]
lea edx, [ebp - 0x40]
mov ebx, dword [ecx + 0x20]
push ebx
push edx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
push edx
call fcn.005155f0
lea eax, [ebp - 0x40]
push eax
call edi
lea ecx, [ebp - 0x40]
push ebx
push ecx
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 2]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
lea ecx, [eax + edx*4 + 8]
push ecx
call fcn.00515490
lea edx, [ebp - 0x40]
push edx
call edi
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0xc]
sub eax, edx
lea eax, [eax + eax*2]
mov al, byte [ecx + eax*4 + 8]
test al, al
jbe 0x519e07
and eax, 0xff
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1bc], eax
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x28]
cmp eax, edx
jg 0x519e07
lea eax, [ebp - 0x44]
push ebx
push eax
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
lea edx, [ebp - 0x44]
push edx
call edi
lea eax, [ebp - 0x44]
push ebx
push eax
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ecx + 0x14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4 + 4]
lea edx, [ebp - 0x40]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
sub ecx, edx
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*2 + 1]
push eax
call fcn.00515490
lea ecx, [ebp - 0x40]
push ecx
call edi
lea edx, [ebp - 0x44]
push edx
call edi
mov ecx, dword [ebp - 0x28]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x28], ecx
jmp 0x519d5b
mov ecx, dword [ebp - 0x2c]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x519ca2
lea eax, [ebp - 0xec]
push eax
call edi
mov ecx, dword [ebp - 0x18]
mov eax, 1
add ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x519acd
mov ecx, dword [0x539a48]
push 0
push ecx
push 1
push 0x11
push 0x539a44
push 1
push 0x80
call dword [sym.imp.MSVBVM60.DLL___vbaRedimPreserve]
add esp, 0x1c
lea edx, [ebp - 0x68]
mov dword [ebp - 0x60], 0x80020004
mov dword [ebp - 0x68], 0xa
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcFreeFile]
lea ecx, [ebp - 0x68]
mov word [0x539612], ax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea eax, [ebp - 0x24]
push eax
call fcn.0042efd0
test ax, ax
je 0x519eab
lea edx, [ebp - 0xc8]
lea ecx, [ebp - 0x24]
push edx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xc8], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcKillFiles]
mov eax, dword [ebp - 0x24]
mov cx, word [0x539612]
push eax
push ecx
push 0xffffffffffffffff
push 0x220
call dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
mov dx, word [0x539612]
push edx
push 0x539a44
push 0x4206c0
call dword [sym.imp.MSVBVM60.DLL___vbaPutOwner3]
mov ax, word [0x539612]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
push 0x539a44
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaErase]
push 0x519f91
jmp 0x519f5d
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea edx, [ebp - 0xe0]
push edx
call esi
lea eax, [ebp - 0xe4]
push eax
call esi
lea ecx, [ebp - 0xe8]
push ecx
call esi
lea edx, [ebp - 0xec]
push edx
call esi
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret