Function at 0x459030
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c693d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x250
mov eax, dword [0x4ff080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x180], ecx
mov byte [ebp - 0x174], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 4], 1
sub esp, 8
lea ecx, [ebp - 0x1ac]
call fcn.0045fe80
lea ecx, [ebp - 0x15c]
push ecx
push 0x4dd32c
mov eax, dword [eax + 8]
push 1
push 0
push 0x4dd34c
call eax
test eax, eax
jns 0x4590e3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x1e8]
mov eax, dword [ebp - 0x15c]
mov ecx, esp
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x45915c
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
mov dword [ebp - 0x160], 0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x15c]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4591c7
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459196
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
mov dword [ebp - 0x168], 0
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 0x160]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x459247
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x459202
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459216
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x1bc]
mov dword [ebp - 0x1bc], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4592c1
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45927c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459290
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
xor esi, esi
lea ecx, [esi + 3]
cmp dword [ebp - 0x1bc], esi
jle 0x459566
nop dword [eax]
nop word [eax + eax]
mov word [ebp - 0x1e8], cx
lea eax, [esi + 1]
mov dword [ebp - 0x1e0], eax
lea ecx, [ebp - 0x170]
movups xmm0, xmmword [ebp - 0x1e8]
mov esi, eax
mov dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x168]
push ecx
sub esp, 0x10
mov dword [ebp - 0x19c], esi
mov ecx, esp
mov edx, dword [eax]
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x20]
test eax, eax
js 0x459554
mov esi, dword [ebp - 0x170]
push 0xc
call fcn.004a9ec5
mov edi, eax
add esp, 4
mov dword [ebp - 0x1a0], edi
mov byte [ebp - 4], 0x11
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x12
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_ITaskFolder__.0
mov dword [edi + 4], 0x46478d
mov dword [edi + 8], esi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1fc], edi
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x16c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x45953b
mov esi, dword [ebp - 0x16c]
push 0xc
call fcn.004a9ec5
mov edi, eax
add esp, 4
mov dword [ebp - 0x200], edi
mov byte [ebp - 4], 0x14
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x15
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [edi + 4], eax
mov dword [edi + 8], esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1f8], edi
mov byte [ebp - 4], 0x16
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x45a541
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x158]
mov esi, dword [ebp - 0x17c]
push esi
call fcn.00460f10
test al, al
jne 0x45943c
test esi, esi
jne 0x45941b
xor ecx, ecx
jmp 0x45942f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459420
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x158]
call fcn.00461270
mov byte [ebp - 4], 0x18
mov ecx, 0x4e8858
mov eax, dword [ebp - 0x158]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x459476
test dx, dx
je 0x459472
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x459476
add eax, 4
add ecx, 4
test dx, dx
jne 0x459450
xor eax, eax
jmp 0x45947b
sbb eax, eax
or eax, 1
test eax, eax
je 0x459491
push 1
push 0x4e8858
lea ecx, [ebp - 0x158]
call fcn.00461460
mov edx, dword [ebp - 0x16c]
test edx, edx
jne 0x45949f
xor ecx, ecx
jmp 0x4594b3
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4594a4
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x158]
call fcn.00461460
mov esi, dword [ebp - 0x158]
cmp dword [esi - 4], 1
jle 0x4594e0
push dword [esi - 0xc]
lea ecx, [ebp - 0x158]
call fcn.00460fd0
mov esi, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.00459030
mov ecx, dword [ebp - 0x174]
test al, al
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x174], ecx
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x459522
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov edi, dword [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov esi, dword [ebp - 0x19c]
cmp esi, dword [ebp - 0x1bc]
jge 0x459566
mov ecx, 3
jmp 0x4592e0
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x184]
push edx
mov dword [ebp - 0x184], 0
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
test eax, eax
jns 0x4595e2
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45959d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x4595b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
mov esi, dword [ebp - 0x184]
push 0xc
call fcn.004a9ec5
mov edi, eax
add esp, 4
mov dword [ebp - 0x1fc], edi
mov byte [ebp - 4], 0x1d
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x1e
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IRegisteredTaskCollection__.0
mov dword [edi + 4], 0x46478d
mov dword [edi + 8], esi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x238], edi
mov byte [ebp - 4], 0x1f
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1d0], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4596b3
mov byte [ebp - 4], 0xa
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45966e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x459682
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x45a516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45a516
xor eax, eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1d0], eax
jle 0x45a4b3
nop word [eax + eax]
inc eax
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x1e0], eax
mov ecx, 3
mov word [ebp - 0x1e8], cx
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0x184]
movups xmm0, xmmword [ebp - 0x1e8]
push eax
sub esp, 0x10
mov edx, dword [ecx]
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x20]
test eax, eax
js 0x45a494
mov esi, dword [ebp - 0x188]
push 0xc
call fcn.004a9ec5
mov edi, eax
add esp, 4
mov dword [ebp - 0x200], edi
mov byte [ebp - 4], 0x23
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x24
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IRegisteredTask__.0
mov dword [edi + 4], 0x46478d
mov dword [edi + 8], esi
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x254], edi
mov byte [ebp - 4], 0x25
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x194], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x45a481
mov esi, dword [ebp - 0x194]
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x170], eax
mov byte [ebp - 4], 0x26
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x27
mov ecx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [eax], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1c0], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
test eax, eax
js 0x45a468
mov esi, dword [ebp - 0x1c0]
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 4], 0x29
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x2a
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_ITaskDefinition__.0
mov dword [eax + 4], 0x46478d
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x18c], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x45a44f
mov esi, dword [ebp - 0x18c]
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x19c], eax
mov byte [ebp - 4], 0x2c
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x2d
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IActionCollection__.0
mov dword [eax + 4], 0x46478d
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0x2e
lea edx, [ebp - 0x1cc]
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1cc], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x45a436
xor eax, eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1cc], eax
jle 0x45a436
nop dword [eax + eax]
mov ecx, dword [ebp - 0x18c]
lea esi, [ebp - 0x178]
push esi
mov dword [ebp - 0x178], 0
inc eax
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x20]
test eax, eax
js 0x45a417
mov esi, dword [ebp - 0x178]
push 0xc
call fcn.004a9ec5
mov edi, eax
add esp, 4
mov dword [ebp - 0x240], edi
mov byte [ebp - 4], 0x2f
mov dword [edi], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x30
mov dword [edi], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IAction__.0
mov dword [edi + 4], 0x46478d
mov dword [edi + 8], esi
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x234], edi
mov byte [ebp - 4], 0x31
lea edx, [ebp - 0x204]
mov eax, dword [ebp - 0x178]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x45a404
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x459df0
cmp eax, 5
jne 0x45a404
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x164]
push edx
mov dword [ebp - 0x164], 0
push 0x4dd33c
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x45a404
mov esi, dword [ebp - 0x164]
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x208], eax
mov byte [ebp - 4], 0x4c
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x4d
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IComHandlerAction__.0
mov dword [eax + 4], 0x46478d
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x31
mov esi, eax
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x190], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x45a3f1
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a3f1
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 0x4f
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x50
mov ecx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x154]
mov dword [eax], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [eax + 8], ecx
mov byte [ebp - 4], 0x4e
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x22c], eax
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x45a541
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x228], eax
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x45a541
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1b8], 2
test eax, eax
je 0x459adf
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x459ad0
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x1b4]
call fcn.00461270
mov edx, dword [ebp - 0x194]
test edx, edx
jne 0x459aff
xor ecx, ecx
jmp 0x459b23
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459b10
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1b0]
call fcn.00461270
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
push str.InprocServer32
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x90], 0
movups xmmword [ebp - 0xa4], xmm0
call fcn.00463250
mov byte [ebp - 4], 0x57
xorps xmm0, xmm0
mov edx, dword [ebp - 0x190]
mov ecx, edx
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459b93
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xbc]
call fcn.00463250
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0xa4]
push eax
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x134]
call fcn.0045b660
add esp, 4
mov byte [ebp - 4], 0x59
cmp dword [eax + 0x14], 7
jbe 0x459bde
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x14c]
call fcn.00457690
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x1b8]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a5d0
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x14c]
call fcn.00460bf0
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x134]
call fcn.00460bf0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0xbc]
call fcn.00460bf0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0xa4]
call fcn.00460bf0
cmp byte [ebp - 0x14d], 0
jne 0x459d73
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
push str.InprocServer32
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x74], xmm0
call fcn.00463250
mov byte [ebp - 4], 0x5b
xorps xmm0, xmm0
mov edx, dword [ebp - 0x190]
mov ecx, edx
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459ca6
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x8c]
call fcn.00463250
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xec]
call fcn.0045b660
add esp, 4
mov byte [ebp - 4], 0x5d
cmp dword [eax + 0x14], 7
jbe 0x459cee
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x11c]
call fcn.00457690
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x1b8]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a5d0
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x11c]
call fcn.00460bf0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0xec]
call fcn.00460bf0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x8c]
call fcn.00460bf0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x74]
call fcn.00460bf0
mov edx, dword [ebp - 0x174]
mov ecx, 1
cmp byte [ebp - 0x14d], 0
movzx eax, dl
cmovne eax, ecx
mov byte [ebp - 0x174], al
mov byte [ebp - 4], 0x5f
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0x5f
or eax, 0xffffffff
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x459da5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0x51
or eax, 0xffffffff
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x459dd7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x1ec]
jmp 0x45a3ea
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x164]
push edx
mov dword [ebp - 0x164], 0
push str.MbLk
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x45a404
mov esi, dword [ebp - 0x164]
push 0xc
call fcn.004a9ec5
add esp, 4
mov dword [ebp - 0x1f8], eax
mov byte [ebp - 4], 0x32
mov dword [eax], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x33
mov dword [eax], vtable.StartupAreas::FreeMemberFuncPtr_unsigned_short_int____cdecl_IUnknown::__unsigned_long_int__void___struct_IExecAction__.0
mov dword [eax + 4], 0x46478d
mov dword [eax + 8], esi
mov byte [ebp - 4], 0x31
mov esi, eax
mov dword [ebp - 0x214], esi
mov byte [ebp - 4], 0x34
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x198], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x45a3f1
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a3f1
push 0xc
call fcn.004a9ec5
mov ecx, eax
add esp, 4
mov dword [ebp - 0x158], ecx
mov byte [ebp - 4], 0x35
mov dword [ecx], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x36
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [ecx], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [ecx + 8], eax
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 0x37
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x164]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
test eax, eax
js 0x45a3d6
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a3d6
push 0xc
call fcn.004a9ec5
mov ecx, eax
add esp, 4
mov dword [ebp - 0x16c], ecx
mov byte [ebp - 4], 0x38
mov dword [ecx], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x39
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [ecx], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [ecx + 8], eax
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x258], ecx
mov byte [ebp - 4], 0x3a
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x164]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x45a3bb
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x154], eax
test eax, eax
je 0x45a3bb
push 0xc
call fcn.004a9ec5
mov ecx, eax
add esp, 4
mov dword [ebp - 0x1f0], ecx
mov byte [ebp - 4], 0x3b
mov dword [ecx], vtable.StartupAreas::IFreeProcPtr.0
mov byte [ebp - 4], 0x3c
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [ecx], vtable.StartupAreas::FreeProcPtr_void____stdcall___unsigned_short_int____unsigned_short_int__.0
mov dword [ecx + 8], eax
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x20c], ecx
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x210], eax
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x45a541
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x25c], eax
call fcn.00456f30
mov ecx, eax
test ecx, ecx
je 0x45a541
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1ac], 2
test eax, eax
jne 0x45a04d
xor ecx, ecx
jmp 0x45a067
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a052
mov eax, dword [ebp - 0x17c]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00461270
mov edx, dword [ebp - 0x194]
test edx, edx
jne 0x45a082
xor ecx, ecx
jmp 0x45a0a3
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a090
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1a4]
call fcn.00461270
mov edx, dword [ebp - 0x1c4]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a0d6
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00463250
mov byte [ebp - 4], 0x43
cmp dword [ebp - 0x198], 0
je 0x45a1c3
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push 0x4e9ec4
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
call fcn.00463250
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 7
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x34]
cmova eax, dword [ebp - 0x44]
push eax
call fcn.00460d90
mov byte [ebp - 4], 0x43
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x45a181
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45a177
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a53c
push ecx
push edx
call fcn.004aa25b
add esp, 8
mov edx, dword [ebp - 0x198]
xor eax, eax
mov ecx, edx
mov word [ebp - 0x44], ax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a1a6
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00460d90
mov eax, dword [ebp - 0x1c8]
mov edx, 0x4e88e8
test eax, eax
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
cmovne edx, eax
mov ecx, edx
movups xmmword [ebp - 0x5c], xmm0
lea eax, [ecx + 2]
mov dword [ebp - 0x154], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a1f3
sub ecx, dword [ebp - 0x154]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.00463250
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
push eax
call fcn.00460d90
cmp dword [ebp - 0x48], 7
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0xd4]
cmova edx, dword [ebp - 0x5c]
call fcn.00457690
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x1ac]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a5d0
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xd4]
call fcn.00460bf0
cmp byte [ebp - 0x14d], 0
jne 0x45a2de
cmp dword [ebp - 0x18], 7
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x104]
cmova edx, dword [ebp - 0x2c]
call fcn.00457690
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1ac]
mov edx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.0045a5d0
add esp, 4
mov byte [ebp - 0x14d], al
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x104]
call fcn.00460bf0
mov edx, dword [ebp - 0x174]
mov eax, 1
cmp byte [ebp - 0x14d], 0
movzx ecx, dl
cmovne ecx, eax
mov byte [ebp - 0x174], cl
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x5c]
call fcn.00460bf0
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x45a328
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45a31e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a53c
push ecx
push edx
call fcn.004aa25b
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x218], eax
mov byte [ebp - 4], 0x48
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45a36e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x3d
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45a3a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x1f0]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x1f0]
push 1
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x16c]
push 1
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x31
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x2e
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp eax, dword [ebp - 0x1cc]
jl 0x4598d0
mov edi, dword [ebp - 0x200]
mov byte [ebp - 4], 0x2b
mov esi, dword [ebp - 0x19c]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x28
mov esi, dword [ebp - 0x1d4]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x25
mov esi, dword [ebp - 0x170]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 0x1f
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp eax, dword [ebp - 0x1d0]
jl 0x4596d0
mov edi, dword [ebp - 0x1fc]
mov byte [ebp - 4], 0xa
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x45a4da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x45a4ee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x15c]
test ecx, ecx
je 0x45a516
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov edx, dword [ebp - 0x174]
mov al, dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a9b96
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b35c4
push 0x80004005
call fcn.00456c80
int3