Function at 0x406f72
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffcf
je 0x406d02
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffe2
jne 0x406d42
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffcf
jne 0x406d19
push 0xffffffffffffffd0
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
jmp 0x406d3b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
call fcn.00416bdf
cmp eax, 0xffffffcd
jne 0x406d3b
call fcn.00419289
push 0xffffffffffffffce
push dword [ebp + 8]
call fcn.0041aeeb
pop ecx
pop ecx
call fcn.00419289
jmp 0x406cf0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x28], ecx
call fcn.00416b9c
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffd1
jne 0x406f8c
call fcn.00419289
push 2
push 0xfffffffffffffffd
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041ea20
pop ecx
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041c371
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x406dd8
push 1
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041bf62
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
call fcn.00419289
push 1
push 1
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00409b6d
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x406f8a
cmp dword [ebp - 0x14], 0
je 0x406f3a
push 0x10
call fcn.0041a65d
pop ecx
mov dword [ebp - 0x38], eax
call fcn.00419289
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041f3cd
pop ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
jmp 0x406e28
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x406ec0
push dword [ebp - 0x38]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push dword [eax + 8]
call fcn.004078f5
add esp, 0xc
test eax, eax
je 0x406e79
push dword [ebp + 8]
call fcn.0041b12a
pop ecx
jmp 0x406f10
cmp dword [ebp - 0x14], 0
je 0x406eb2
push dword [ebp - 0x34]
call fcn.0041efe8
pop ecx
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffe2
jne 0x406ea7
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0041f3cd
pop ecx
mov dword [ebp - 0x34], eax
jmp 0x406eb2
push dword [ebp + 8]
call fcn.0041b12a
pop ecx
jmp 0x406f10
push dword [ebp - 0x38]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x406e21
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffd1
je 0x406ed9
push dword [ebp + 8]
call fcn.0041b12a
pop ecx
jmp 0x406f10
movzx eax, word [ebp - 0x30]
cmp eax, 9
jne 0x406f10
push 1
push 1
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00409b6d
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x28]
call fcn.00407d1d
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x38], 0
je 0x406f29
push dword [ebp - 0x38]
call fcn.0041efe8
pop ecx
cmp dword [ebp - 0x34], 0
je 0x406f38
push dword [ebp - 0x34]
call fcn.0041efe8
pop ecx
jmp 0x406f8a
call fcn.00419289
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0xffffffd1
jne 0x406f7c
push 1
push 1
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00409b6d
add esp, 0x10
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x406f8a
push str.error_in_expression
push 1
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x406fb1
push 0
push 1
push 8
lea eax, [ebp - 0x10]
push eax
call fcn.00409b6d
add esp, 0x10
push dword [ebp - 8]
call fcn.004083d1
pop ecx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
leave
ret