Function at 0x409310
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57610b
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x2612450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov edi, ecx
mov dword [ebp - 0x88], ebx
call fcn.0040a750
push 0x25e9270
lea esi, [edi + 0x1094]
push 0x25e927c
push ebx
mov ecx, esi
mov dword [ebp - 0xb4], esi
call fcn.0049c9c7
push 1
mov ecx, esi
call fcn.0049ca83
push 1
mov ecx, esi
call fcn.0049d765
push 1
push 1
mov ecx, esi
call fcn.0049dae3
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x4093d4
push 0x25e9290
lea ecx, [ebp - 0x78]
call fcn.0040a9f0
push 0
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 1
mov ebx, 1
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov dword [ebp - 0x84], eax
jmp 0x4093de
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40940f
mov eax, dword [ebp - 0x78]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40940f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 3
test edi, edi
je 0x4094a5
mov ecx, 0xb
xor edx, edx
mov word [ebp - 0xa0], cx
mov word [ebp - 0x98], dx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 4
or ebx, 2
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a3547
mov dword [ebp - 4], 5
or ebx, 4
push 0x25e92cc
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e9298
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 8
mov dword [ebp - 4], 6
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
jmp 0x4094a7
xor eax, eax
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049dcb8
mov dword [ebp - 4], 8
test bl, 8
je 0x4094eb
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4094eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x409505
lea ecx, [ebp - 0xb0]
and ebx, 0xfffffffb
push ecx
mov dword [ebp - 0x74], ebx
call edi
mov dword [ebp - 4], 0xffffffff
test bl, 2
je 0x409520
lea edx, [ebp - 0xa0]
and ebx, 0xfffffffd
push edx
mov dword [ebp - 0x74], ebx
call edi
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0xa
test edi, edi
je 0x40959d
xor eax, eax
push 0x25e9314
lea ecx, [ebp - 0xa0]
mov word [ebp - 0xa0], ax
call fcn.004a38d0
mov byte [ebp - 4], 0xb
or ebx, 0x10
push 0x25e9320
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e92d8
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 0x20
mov dword [ebp - 4], 0xc
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
mov edi, eax
jmp 0x40959f
xor edi, edi
mov dword [ebp - 4], 0xd
test bl, 0x20
je 0x4095d0
mov eax, dword [ebp - 0x80]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4095d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test bl, 0x10
je 0x4095ef
lea ecx, [ebp - 0xa0]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
push 0x25e9328
mov ecx, edi
call fcn.0049b310
push 1
push 0x25e932c
mov ecx, edi
call fcn.0049b310
push 1
push 0x25e9330
mov ecx, edi
call fcn.0049b310
push 1
push 0x25e9314
mov ecx, edi
call fcn.0049b310
mov ecx, dword [ebp - 0x84]
push edi
mov dword [edi + 0x64], 0
call fcn.0049dcb8
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0xf
test edi, edi
je 0x4096f0
mov edx, 8
push 0x25e9358
mov word [ebp - 0xa0], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x409686
push 0x8007000e
call fcn.00560e70
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x10
or ebx, 0x40
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a3547
mov dword [ebp - 4], 0x11
or ebx, 0x80
push 0x25e9360
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e933c
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 0x100
mov dword [ebp - 4], 0x12
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
jmp 0x4096f2
xor eax, eax
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049dcb8
mov dword [ebp - 4], 0x14
test ebx, 0x100
je 0x40973c
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40973c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x409756
lea ecx, [ebp - 0xb0]
and ebx, 0xffffff7f
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x409775
lea edx, [ebp - 0xa0]
and ebx, 0xffffffbf
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x84]
push 1
push 1
push eax
mov ecx, esi
call fcn.0049df98
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x16
test edi, edi
je 0x4097d1
push 0x25e9368
lea ecx, [ebp - 0x80]
call fcn.0040a9f0
push 1
push 0
lea ecx, [ebp - 0x80]
or ebx, 0x200
push ecx
mov byte [ebp - 4], 0x17
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov esi, eax
jmp 0x4097d3
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200
je 0x40980a
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffdff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40980a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x19
test edi, edi
je 0x4098b0
mov ecx, 3
mov word [ebp - 0xa0], cx
mov dword [ebp - 0x98], 0xfa
lea edx, [ebp - 0xa0]
mov byte [ebp - 4], 0x1a
or ebx, 0x400
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a3547
mov dword [ebp - 4], 0x1b
or ebx, 0x800
push 0x25e9384
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e9374
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x78]
or ebx, 0x1000
push ecx
mov dword [ebp - 4], 0x1c
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
mov edi, eax
jmp 0x4098b2
xor edi, edi
mov dword [ebp - 4], 0x1e
test ebx, 0x1000
je 0x4098e9
mov eax, dword [ebp - 0x78]
and ebx, 0xffffefff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4098e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x800
je 0x409907
lea ecx, [ebp - 0xb0]
and ebx, 0xfffff7ff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400
je 0x40992c
lea edx, [ebp - 0xa0]
and ebx, 0xfffffbff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x12c
push 0x32
push 1
mov ecx, edi
call fcn.0049b359
push edi
mov ecx, esi
call fcn.0049dcb8
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x20
test edi, edi
je 0x4099ea
mov eax, 3
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x98], 0x96
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x21
or ebx, 0x2000
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a3547
mov dword [ebp - 4], 0x22
or ebx, 0x4000
push 0x25e939c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e938c
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x8000
mov dword [ebp - 4], 0x23
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
mov edi, eax
jmp 0x4099ec
xor edi, edi
mov dword [ebp - 4], 0x25
test ebx, 0x8000
je 0x409a23
mov eax, dword [ebp - 0x78]
and ebx, 0xffff7fff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409a23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x4000
je 0x409a41
lea ecx, [ebp - 0xb0]
and ebx, 0xffffbfff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000
je 0x409a66
lea edx, [ebp - 0xa0]
and ebx, 0xffffdfff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, edi
call fcn.0049b359
push edi
mov ecx, esi
call fcn.0049dcb8
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049df98
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x27
test edi, edi
je 0x409ad8
push 0x25e93a4
lea ecx, [ebp - 0x80]
call fcn.0040a9f0
push 0
push 0
lea eax, [ebp - 0x80]
or ebx, 0x10000
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov esi, eax
jmp 0x409ada
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x10000
je 0x409b11
mov eax, dword [ebp - 0x80]
and ebx, 0xfffeffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.004157ec
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x70]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x25e93ac
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1a4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x2a
test edi, edi
je 0x409b94
push 0x25e93a4
lea ecx, [ebp - 0x78]
call fcn.0040a9f0
push 0xffffffffffffffff
push 0
push 0x25e93c0
push 0x101
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x20000
mov byte [ebp - 4], 0x2b
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2f7d
jmp 0x409b96
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.0049dcb8
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000
je 0x409bdc
mov eax, dword [ebp - 0x78]
and ebx, 0xfffdffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bdc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x2d
test edi, edi
je 0x409c80
mov ecx, 0xb
or edx, 0xffffffff
mov word [ebp - 0xa0], cx
mov word [ebp - 0x98], dx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x2e
or ebx, 0x40000
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.004a3547
mov dword [ebp - 4], 0x2f
or ebx, 0x80000
push 0x25e9404
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e93d4
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x100000
mov dword [ebp - 4], 0x30
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
jmp 0x409c82
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.0049dcb8
mov dword [ebp - 4], 0x32
test ebx, 0x100000
je 0x409cc8
mov eax, dword [ebp - 0x78]
and ebx, 0xffefffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409cc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x80000
je 0x409ce6
lea ecx, [ebp - 0xb0]
and ebx, 0xfff7ffff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000
je 0x409d0b
lea edx, [ebp - 0xa0]
and ebx, 0xfffbffff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049df98
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x34
test edi, edi
je 0x409d65
push 0x25e9414
lea ecx, [ebp - 0x80]
call fcn.0040a9f0
push 0
push 0
lea eax, [ebp - 0x80]
or ebx, 0x200000
mov byte [ebp - 4], 0x35
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov esi, eax
jmp 0x409d67
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200000
je 0x409d9e
mov eax, dword [ebp - 0x80]
and ebx, 0xffdfffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409d9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x37
test edi, edi
je 0x409e1e
xor ecx, ecx
mov word [ebp - 0xa0], cx
push 0x25e9258
lea ecx, [ebp - 0xa0]
call fcn.004a38d0
mov byte [ebp - 4], 0x38
or ebx, 0x400000
push 0x25e941c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x800000
mov dword [ebp - 4], 0x39
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2840
mov edi, eax
jmp 0x409e20
xor edi, edi
mov dword [ebp - 4], 0x3a
test ebx, 0x800000
je 0x409e57
mov eax, dword [ebp - 0x78]
and ebx, 0xff7fffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409e57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400000
je 0x409e7c
lea ecx, [ebp - 0xa0]
and ebx, 0xffbfffff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
mov ecx, edi
call fcn.0049bc92
push edi
mov ecx, esi
call fcn.0049dcb8
push 0x118
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x3c
test edi, edi
je 0x409eed
push 0x25e943c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xb8], 0xfec0d2
call fcn.0040a9f0
push 0
push 0x25e9428
push 0
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x1000000
mov byte [ebp - 4], 0x3d
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2ba9
mov edi, eax
jmp 0x409eef
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x1000000
je 0x409f26
mov eax, dword [ebp - 0x78]
and ebx, 0xfeffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409f26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 1
push 0x25e9448
mov ecx, edi
call fcn.004a2521
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x25e9454
mov ecx, edi
call fcn.004a24f1
push edi
mov ecx, esi
call fcn.0049dcb8
push 0xf8
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x3f
test edi, edi
je 0x409fd5
push 0x25e9d18
lea ecx, [ebp - 0x84]
call fcn.0040a9f0
mov byte [ebp - 4], 0x40
or ebx, 0x2000000
push 0x25e94bc
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0x25e94a4
push 0x25e9460
push 0
push 0x25e94b4
lea ecx, [ebp - 0x84]
push ecx
push 1
lea edx, [ebp - 0x78]
or ebx, 0x4000000
mov dword [ebp - 4], 0x41
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2d21
jmp 0x409fd7
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.0049dcb8
mov dword [ebp - 4], 0x42
test ebx, 0x4000000
je 0x40a01d
mov eax, dword [ebp - 0x78]
and ebx, 0xfbffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a01d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000000
je 0x40a057
mov eax, dword [ebp - 0x84]
and ebx, 0xfdffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a057
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf8
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x44
test edi, edi
je 0x40a0c6
push 0x25e94c4
lea ecx, [ebp - 0x84]
call fcn.0040a9f0
mov byte [ebp - 4], 0x45
or ebx, 0x8000000
push 0x25e94cc
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040a9f0
push 0
push 0
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x10000000
mov dword [ebp - 4], 0x46
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.004a2c92
jmp 0x40a0c8
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x48
call fcn.0049dcb8
mov dword [ebp - 4], 0x47
test ebx, 0x10000000
je 0x40a10e
mov eax, dword [ebp - 0x78]
and ebx, 0xefffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a10e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x8000000
je 0x40a145
mov eax, dword [ebp - 0x84]
add eax, 0xfffffff0
and ebx, 0xf7ffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a145
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049df98
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x49
test edi, edi
je 0x40a1a0
push 0x25e94d4
lea ecx, [ebp - 0x80]
call fcn.0040a9f0
push 0
push 0
lea ecx, [ebp - 0x80]
or ebx, 0x20000000
push ecx
mov byte [ebp - 4], 0x4a
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov dword [ebp - 0x78], eax
jmp 0x40a1a7
mov dword [ebp - 0x78], 0
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000000
je 0x40a1db
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
and ebx, 0xdfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a1db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x4c
test edi, edi
je 0x40a22b
push 0x25e94e0
lea ecx, [ebp - 0x8c]
call fcn.0040a9f0
push 0
push 0
lea ecx, [ebp - 0x8c]
or ebx, 0x40000000
push ecx
mov byte [ebp - 4], 0x4d
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov esi, eax
jmp 0x40a22d
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000000
je 0x40a264
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
and ebx, 0xbfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a264
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x78]
push esi
call fcn.0049dcb8
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x4f
test edi, edi
je 0x40a2c1
push 0x25e94ec
lea ecx, [ebp - 0xb8]
call fcn.0040a9f0
push 0
push 0
lea ecx, [ebp - 0xb8]
or ebx, 0x80000000
push ecx
mov byte [ebp - 4], 0x50
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049e1ae
mov dword [ebp - 0x84], eax
jmp 0x40a2cb
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
jns 0x40a2f8
mov eax, dword [ebp - 0xb8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a2f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x84]
push ecx
mov ecx, esi
call fcn.0049dcb8
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x52
test edi, edi
je 0x40a3c9
mov edx, 8
push 0x25e9504
mov word [ebp - 0xa0], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x40a352
push 0x8007000e
call fcn.00560e70
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], 1
call fcn.004a3547
mov dword [ebp - 4], 0x54
push 0x25e950c
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], 3
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e94f8
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x8c]
mov dword [ebp - 4], 0x55
mov ebx, 7
push edx
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.004a2840
jmp 0x40a3d1
mov ebx, dword [ebp - 0x88]
xor eax, eax
mov dword [ebp - 4], 0x58
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049dcb8
mov dword [ebp - 4], 0x57
test bl, 4
je 0x40a41b
mov eax, dword [ebp - 0x8c]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a41b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x40a438
lea ecx, [ebp - 0xb0]
and ebx, 0xfffffffd
push ecx
mov dword [ebp - 0x88], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40a456
lea edx, [ebp - 0xa0]
and ebx, 0xfffffffe
push edx
mov dword [ebp - 0x88], ebx
call esi
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x59
test edi, edi
je 0x40a515
mov eax, 8
push 0x25e9514
mov word [ebp - 0xa0], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x40a4a2
push 0x8007000e
call fcn.00560e70
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x5a
or ebx, 8
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], ebx
call fcn.004a3547
mov dword [ebp - 4], 0x5b
or ebx, 0x10
push 0x25e951c
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e94f8
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x8c]
or ebx, 0x20
mov dword [ebp - 4], 0x5c
push eax
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.004a2840
jmp 0x40a517
xor eax, eax
mov dword [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049dcb8
mov dword [ebp - 4], 0x5e
test bl, 0x20
je 0x40a561
mov eax, dword [ebp - 0x8c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a561
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 0x10
je 0x40a578
lea ecx, [ebp - 0xb0]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x88], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x40a596
lea edx, [ebp - 0xa0]
and ebx, 0xfffffff7
push edx
mov dword [ebp - 0x88], ebx
call esi
push 0xe4
call fcn.0040ac2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x8c], edi
mov dword [ebp - 4], 0x60
test edi, edi
je 0x40a658
mov eax, 8
push 0x25e9524
mov word [ebp - 0xc8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xc0], eax
test eax, eax
jne 0x40a5e5
push 0x8007000e
call fcn.00560e70
lea ecx, [ebp - 0xc8]
push ecx
mov byte [ebp - 4], 0x61
or ebx, 0x40
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x88], ebx
call fcn.004a3547
mov dword [ebp - 4], 0x62
or ebx, 0x80
push 0x25e952c
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x88], ebx
call fcn.0040a9f0
push 0
push 0
push 0
push 0
push 0x25e94f8
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0x7c]
or ebx, 0x100
mov dword [ebp - 4], 0x63
push eax
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.004a2840
jmp 0x40a65a
xor eax, eax
mov dword [ebp - 4], 0x66
mov ecx, dword [ebp - 0x84]
push eax
call fcn.0049dcb8
mov dword [ebp - 4], 0x65
test ebx, 0x100
je 0x40a6a7
mov eax, dword [ebp - 0x7c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a6a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x40a6ba
lea ecx, [ebp - 0xd8]
push ecx
and ebx, 0xffffff7f
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x40a6cf
lea edx, [ebp - 0xc8]
push edx
call esi
mov esi, dword [ebp - 0x78]
push 0
mov ecx, esi
call fcn.0049bab8
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.0049df98
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054774f
mov esp, ebp
pop ebp
ret