Function at 0x491000
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405216
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x402e70
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0xa4]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
xor ecx, ecx
cmp edi, ecx
mov dword [ebp - 0xa8], ecx
jne 0x49106b
cmp byte [0x538dfd], 2
jne 0x491065
movsx eax, word [0x538dd0]
push eax
call fcn.004a86f0
jmp 0x491dab
mov edi, dword [0x53a224]
mov eax, dword [0x538c50]
mov esi, 1
lea edx, [eax + eax*4]
lea edx, [eax + edx*8]
shl edx, 6
add edx, eax
cmp edi, esi
lea eax, [eax + edx*4]
mov edx, dword [0x5390b8]
lea ebx, [edx + eax*4]
jl 0x4912a9
cmp edi, 0x1f
jg 0x4912a9
cmp byte [0x538df4], 0x17
jne 0x4910b5
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0048ea20
jmp 0x491dab
lea ecx, [edi + edi*8 + 0x1b]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
lea edx, [edi + ecx*4 + 3]
lea eax, [ebx + edx*4]
mov dword [ebp - 0xf8], eax
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x41e754
call esi
mov ecx, dword [ebp - 0xf8]
push 0x538d98
push ecx
push 0x41e754
call esi
lea edx, [edi + edi*8]
lea eax, [edi + edx*4]
mov cl, byte [ebx + eax*4 + 0x218]
lea eax, [ebx + eax*4]
cmp cl, 1
mov dword [ebp - 0xfc], eax
jne 0x491196
mov ecx, eax
mov al, byte [ecx + 0x21c]
cmp al, 0xc
jne 0x491144
cmp byte [ebx + 0x9a0], 4
jbe 0x491196
lea eax, [ebx + 0x940]
lea edx, [ebp - 0xa4]
push eax
push edx
push 0x41e754
call esi
push 0x538e2c
lea eax, [ebx + 0x940]
jmp 0x49118e
cmp al, 4
jbe 0x491196
cmp word [ebx + 0xa0c], 0
jle 0x491196
cmp word [ebp - 0x6c], 0
lea eax, [ebx + 0x9d4]
push eax
jne 0x491168
lea eax, [ebp - 0xa4]
jmp 0x49117b
movsx eax, word [0x53a456]
add eax, 0x22
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*4]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call esi
push 0x538e2c
lea eax, [ebx + 0x9d4]
push eax
push 0x41e754
call esi
mov ecx, dword [ebp - 0xfc]
cmp byte [ecx + 0x218], 6
jne 0x4911e3
cmp byte [ebx + 0x874], 7
jne 0x4911e3
lea eax, [ebx + 0x818]
push eax
mov eax, dword [0x53a224]
lea edx, [eax + eax*8 - 0x87]
lea eax, [eax + edx*4 - 0xf]
lea ecx, [ebx + eax*4]
push ecx
push 0x41e754
call esi
lea eax, [ebx + 0x818]
push 0x538e2c
push eax
push 0x41e754
call esi
mov edx, dword [ebp - 0xfc]
cmp byte [edx + 0x218], 7
jne 0x49123f
cmp byte [ebx + 0xb58], 6
jne 0x49123f
cmp word [ebp - 0x6c], 0
lea eax, [ebx + 0xafc]
push eax
jne 0x491211
lea eax, [ebp - 0xa4]
jmp 0x491224
movsx eax, word [0x53a456]
add eax, 0x22
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*4]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call esi
lea eax, [ebx + 0xafc]
push 0x538e2c
push eax
push 0x41e754
call esi
mov ecx, dword [ebp - 0xfc]
cmp byte [ecx + 0x218], 2
jne 0x491ce1
cmp byte [ebx + 0x9a0], 4
jbe 0x491ce1
mov ecx, dword [0x53a224]
cmp ecx, 0x31
jle 0x491ce1
lea eax, [ebx + 0x940]
lea edx, [ecx + ecx*8 - 0x87]
mov dword [ebp - 0x100], eax
push eax
lea eax, [ecx + edx*4 - 0xf]
lea ecx, [ebx + eax*4]
push ecx
push 0x41e754
call esi
mov edx, dword [ebp - 0x100]
push 0x538e2c
push edx
push 0x41e754
call esi
jmp 0x491ce1
cmp edi, 0x29
jne 0x49134f
push 0x538d98
call fcn.00462a10
test ax, ax
je 0x4912f4
mov eax, dword [0x538dc8]
push 0x15
dec eax
mov dword [0x538dc8], eax
mov eax, dword [0x538c08]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x4912f4
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538dc8]
test eax, eax
jle 0x491cdb
mov eax, dword [0x53a224]
push 0x538d98
cmp eax, 0xb
jge 0x49132e
lea ecx, [eax + eax*8 + 0x1b]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
lea edx, [eax + ecx*4 + 3]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call esi
jmp 0x491ce1
lea ecx, [eax + eax*8 + 0x21c]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
lea edx, [eax + ecx*4 + 0x3c]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call esi
jmp 0x491ce1
cmp edi, 0x2a
je 0x491cb3
cmp edi, 0x2b
je 0x491cb3
cmp edi, 0x2c
jne 0x491461
push ecx
mov cl, byte [0x538df5]
push ecx
call fcn.00527090
test ax, ax
mov eax, dword [0x538c08]
mov edx, dword [eax]
je 0x4913c4
push 3
push eax
call dword [edx + 0x60]
test eax, eax
fnclex
jge 0x4913a4
mov ecx, dword [0x538c08]
push 0x60
push 0x4222d8
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [0x53a230], 0xe6
mov dword [0x53a23c], 9
mov dword [0x53a234], 0x20
jmp 0x491403
push 4
push eax
call dword [edx + 0x60]
test eax, eax
fnclex
jge 0x4913e5
mov ecx, dword [0x538c08]
push 0x60
push 0x4222d8
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [0x53a230], 0x80
mov dword [0x53a23c], 0xa
mov dword [0x53a234], 0x1e
mov eax, dword [0x538dc8]
mov dword [0x53a22c], 0
dec eax
mov word [0x53a238], 0xc8
test eax, eax
mov word [0x53a240], 0xffff
mov dword [0x53a228], esi
mov dword [0x538dc8], eax
jle 0x491dab
mov eax, dword [0x53a224]
push 0x538d98
lea edx, [eax + eax*8 + 0x21c]
lea eax, [eax + edx*4 + 0x3c]
lea ecx, [ebx + eax*4]
push ecx
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
jmp 0x491dab
cmp edi, 0x2d
jne 0x491544
mov dl, byte [0x538df5]
push 0xffffffffffffffff
push edx
call fcn.00527090
test ax, ax
mov eax, dword [0x538c08]
mov ecx, dword [eax]
je 0x4914a7
push 3
push eax
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x491508
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
jmp 0x491508
push 4
push eax
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x4914c8
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [0x53a230], 0x80
mov dword [0x53a23c], 0xa
mov dword [0x53a234], 0x1e
mov dword [0x53a22c], 0
mov word [0x53a238], 0xc8
mov word [0x53a240], 0xffff
mov dword [0x53a228], esi
mov eax, dword [0x538dc8]
dec eax
test eax, eax
mov dword [0x538dc8], eax
jle 0x491dab
mov eax, dword [0x53a224]
push 0x538d98
lea ecx, [eax + eax*8 + 0x21c]
lea edx, [eax + ecx*4 + 0x3c]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
jmp 0x491dab
cmp edi, 0x2e
jne 0x491744
mov al, byte [0x538df5]
cmp al, 9
jne 0x49155d
call fcn.004950e0
jmp 0x491508
cmp al, 0xcd
jne 0x4915db
mov al, byte [ebx + 0x247]
test al, al
mov eax, dword [0x538c08]
mov ecx, dword [eax]
jbe 0x49172f
push 3
push eax
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x491597
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538dc8]
dec eax
test eax, eax
mov dword [0x538dc8], eax
jle 0x4915ca
mov eax, dword [0x53a224]
push 0x538d98
lea ecx, [eax + eax*8 + 0x21c]
lea edx, [eax + ecx*4 + 0x3c]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
push 0
push 0x3b9ac9ff
call fcn.0045f970
jmp 0x491dab
cmp al, 0xce
jne 0x491681
push ecx
call fcn.00476200
test ax, ax
mov eax, dword [0x538c08]
je 0x49165c
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x491616
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [0x538dc8]
dec eax
test eax, eax
mov dword [0x538dc8], eax
jle 0x491649
mov eax, dword [0x53a224]
push 0x538d98
lea ecx, [eax + eax*8 + 0x21c]
lea edx, [eax + ecx*4 + 0x3c]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
movzx cx, byte [0x538dfa]
push ecx
call fcn.00476200
jmp 0x491dab
mov edx, dword [eax]
push 4
push eax
call dword [edx + 0x60]
test eax, eax
fnclex
jge 0x4914c8
mov ecx, dword [0x538c08]
push 0x60
push 0x4222d8
push ecx
jmp 0x4914c1
cmp al, 0xd0
jne 0x4916d9
mov eax, dword [0x538dc8]
dec eax
cmp eax, ecx
mov dword [0x538dc8], eax
jle 0x4916c7
mov eax, dword [0x53a224]
push 0x538d98
cmp eax, 0xb
jge 0x4916ad
lea edx, [eax + eax*8 + 0x1b]
lea eax, [eax + edx*4 + 3]
jmp 0x4916b8
lea edx, [eax + eax*8 + 0x21c]
lea eax, [eax + edx*4 + 0x3c]
lea ecx, [ebx + eax*4]
push ecx
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
movsx edx, word [0x538dd0]
push edx
call fcn.0049f4c0
jmp 0x491dab
push eax
call fcn.00490860
test ax, ax
mov eax, dword [0x538c08]
mov ecx, dword [eax]
je 0x49172f
push 3
push eax
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x49170c
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [0x53a230], 0xe6
mov dword [0x53a23c], 9
mov dword [0x53a234], 0x20
jmp 0x4914e6
push 4
push eax
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x4914c8
jmp 0x4914b3
cmp edi, 0x2f
jne 0x49176b
push 0x538d98
call fcn.00490e70
mov eax, dword [0x53a224]
push 0x538d98
cmp eax, 0xb
jl 0x49181b
jmp 0x491525
cmp edi, 0x30
jne 0x491837
push 0x538df8
push 0x538df5
push 0x538dfa
call fcn.00490d90
test ax, ax
jne 0x4917f5
mov eax, dword [0x538c08]
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x4917b5
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [0x53a230], 0x80
mov dword [0x53a23c], 0xa
mov dword [0x53a234], 0x1e
mov dword [0x53a22c], 0
mov word [0x53a238], 0xc8
mov word [0x53a240], 0xffff
mov dword [0x53a228], esi
mov eax, dword [0x538dc8]
dec eax
test eax, eax
mov dword [0x538dc8], eax
jle 0x491dab
mov eax, dword [0x53a224]
push 0x538d98
cmp eax, 0xb
jge 0x491525
lea ecx, [eax + eax*8 + 0x1b]
lea edx, [eax + ecx*4 + 3]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
jmp 0x491dab
cmp edi, 0x31
jne 0x49187d
mov eax, dword [0x53a224]
push 0x538d98
lea ecx, [eax + eax*8 + 0x4bf]
lea edx, [eax + ecx*4 + 0x87]
lea eax, [ebx + edx*4]
push eax
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
movzx cx, byte [0x538df5]
push ecx
call fcn.004ba600
push 0xd
call fcn.00431010
jmp 0x491dab
cmp edi, 0x32
jl 0x491911
cmp edi, 0x7c
jg 0x491911
cmp byte [0x538dfd], 1
jne 0x49189f
mov byte [0x538dfd], 0
push esi
push 0x538d98
call fcn.0048cba0
mov al, byte [0x538df7]
test al, al
jne 0x4918c0
lea edx, [edi + edi*8 - 0x87]
lea eax, [edi + edx*4 - 0xf]
jmp 0x4918e7
cmp al, 1
jne 0x4918d1
lea edx, [edi + edi*8 + 0x21c]
lea eax, [edi + edx*4 + 0x3c]
jmp 0x4918e7
cmp al, 2
jne 0x491cdb
lea edx, [edi + edi*8 + 0x4bf]
lea eax, [edi + edx*4 + 0x87]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
lea ebx, [ebx + eax*4]
lea ecx, [ebp - 0xa4]
push ebx
push ecx
push 0x41e754
call esi
push 0x538d98
push ebx
push 0x41e754
call esi
jmp 0x491ce1
cmp edi, 0x7d
jl 0x491a31
cmp edi, 0xc7
jg 0x491a31
mov al, byte [0x538df7]
test al, al
jne 0x491998
mov ecx, dword [0x5390c4]
mov ebx, dword [0x53a21c]
mov eax, edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
sub eax, ebx
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
lea eax, [ebp - 0xa4]
push edx
push eax
push 0x41e754
call esi
mov ecx, dword [0x5390c4]
push 0x538d98
mov eax, edi
mov ebx, dword [ecx + 0x14]
mov edx, dword [0x53a21c]
sub eax, ebx
mov ecx, dword [ecx + 0xc]
sub eax, edx
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
push edx
push 0x41e754
call esi
jmp 0x491ce1
cmp al, 1
jne 0x4919e1
mov ecx, dword [0x5390c8]
mov ebx, dword [0x53a21c]
mov eax, edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
sub eax, ebx
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
lea eax, [ebp - 0xa4]
push edx
push eax
push 0x41e754
call esi
mov ecx, dword [0x5390c8]
push 0x538d98
mov eax, edi
jmp 0x491972
cmp al, 2
jne 0x491cdb
mov ecx, dword [0x5390cc]
mov ebx, dword [0x53a21c]
mov eax, edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
sub eax, ebx
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
lea eax, [ebp - 0xa4]
push edx
push eax
push 0x41e754
call esi
mov ecx, dword [0x5390cc]
push 0x538d98
mov eax, edi
jmp 0x491972
cmp edi, 0xc8
jne 0x491ab2
push 0x538d98
mov dword [0x53a230], 0xe6
mov dword [0x53a23c], 9
mov dword [0x53a234], 0x20
mov dword [0x53a22c], 0
mov word [0x53a238], di
mov word [0x53a240], 0xffff
mov dword [0x53a228], ecx
call fcn.0048f7c0
mov eax, dword [0x538c08]
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x491dab
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
jmp 0x491dab
cmp edi, 0xc9
jl 0x491b59
cmp edi, 0xe1
jg 0x491b59
cmp byte [0x538dfd], 3
jne 0x491ae3
mov eax, dword [0x53a224]
add eax, 0xffffff1f
push eax
call fcn.004a8790
mov edx, dword [0x53a290]
lea ecx, [edi + edi*8 - 0x711]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
lea ebx, [edi + ecx*4 - 0xc9]
lea ecx, [ebp - 0xa4]
shl ebx, 2
lea eax, [ebx + edx]
push eax
push ecx
push 0x41e754
call esi
mov edx, dword [0x53a290]
push 0x538d98
add ebx, edx
push ebx
push 0x41e754
call esi
mov edx, dword [0x53a290]
lea eax, [edi + edi*8]
lea ecx, [edi + eax*4]
lea eax, [edx + ecx*4 - 0x73cf]
mov cl, byte [edx + ecx*4 - 0x73cf]
test cl, cl
jne 0x491b48
mov byte [eax], 1
cmp byte [eax], 3
jne 0x491ce1
mov byte [eax], 2
jmp 0x491ce1
cmp edi, 0xe2
jl 0x491b83
cmp edi, 0xff
jg 0x491b83
cmp word [0x538dd0], 2
jne 0x491cdb
push 2
call fcn.004a86f0
jmp 0x491cdb
cmp edi, 0x100
jl 0x491cdb
cmp edi, 0x14a
jg 0x491cdb
call fcn.004b4990
mov dword [0x538e14], eax
mov al, byte [0x538df7]
test al, al
jne 0x491bf3
mov ecx, dword [0x5395f8]
mov eax, edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
sub eax, 0xff
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
lea eax, [ebp - 0xa4]
push edx
push eax
push 0x41e754
call esi
mov ecx, dword [0x5395f8]
push 0x538d98
mov eax, edi
jmp 0x491c7d
cmp al, 1
jne 0x491c39
mov ecx, dword [0x5395fc]
mov eax, edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
sub eax, 0xff
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
lea eax, [ebp - 0xa4]
push edx
push eax
push 0x41e754
call esi
mov ecx, dword [0x5395fc]
push 0x538d98
mov eax, edi
jmp 0x491c7d
cmp al, 2
jne 0x491ca4
mov ecx, dword [0x539600]
mov eax, edi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, edx
sub eax, 0xff
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
lea eax, [ebp - 0xa4]
push edx
push eax
push 0x41e754
call esi
mov ecx, dword [0x539600]
push 0x538d98
mov eax, edi
mov ebx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub eax, ebx
sub eax, 0xff
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
lea edx, [ecx + eax*4]
push edx
push 0x41e754
call esi
mov dword [ebp - 0x28], 0
jmp 0x491ce1
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov dword [ebp - 0x28], 0
jmp 0x491ce1
mov eax, dword [0x538c08]
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
test eax, eax
fnclex
jge 0x491cdb
mov edx, dword [0x538c08]
push 0x60
push 0x4222d8
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x491da4
mov ax, word [ebp - 0x6c]
test ax, ax
je 0x491da4
cmp word [0x538dd0], ax
jne 0x491d4e
cmp byte [0x538df4], 0x12
jbe 0x491d6d
mov al, byte [0x538dfd]
test al, al
je 0x491d46
cmp al, 1
je 0x491d46
cmp al, 2
jne 0x491d24
cmp byte [ebp - 0x3f], 2
jne 0x491d6d
jmp 0x491d2e
cmp al, 3
jne 0x491d6d
cmp byte [ebp - 0x3f], 1
jbe 0x491d6d
mov eax, dword [ebp - 0x74]
mov ecx, dword [0x538dc8]
mov edx, dword [ebp + 0xc]
add eax, ecx
push eax
push edx
push edi
call fcn.004902d0
jmp 0x491dab
cmp byte [ebp - 0x3f], 2
jae 0x491d6d
jmp 0x491d2e
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x53a224]
push eax
push ecx
call fcn.00490440
movsx ebx, ax
test ebx, ebx
jle 0x491d73
add ebx, dword [0x538dc8]
jmp 0x491d73
mov ebx, dword [ebp - 0xa8]
lea edx, [ebp - 0xa4]
push edx
push 0x538d98
push 0x41e754
call esi
mov esi, dword [ebp + 0xc]
mov eax, dword [0x53a224]
push edi
push esi
push eax
call fcn.00491000
test ebx, ebx
jle 0x491dab
push ebx
push esi
push edi
call fcn.004902d0
jmp 0x491dab
push 0
call fcn.0048cbd0
wait
push 0x491dc4
lea ecx, [ebp - 0xa4]
push ecx
push 0x41e754
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
ret