Function at 0x407850
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x5842af
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x5e0930]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e0930]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x14], ebx
mov edi, ecx
mov dword [esp + 0x24], ebp
call fcn.00408d60
push str.Value
add edi, 0xf90
push str.Property
push ebp
mov ecx, edi
mov dword [esp + 0x4c], edi
call fcn.0048e483
push 1
mov ecx, edi
call fcn.0048e531
push 1
mov ecx, edi
call fcn.0048f102
push 1
push 1
mov ecx, edi
call fcn.0048f41f
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], ebp
cmp esi, ebp
je 0x407926
push 0x5ba6ac
lea ecx, [esp + 0x1c]
call fcn.00409040
push ebp
push ebp
lea eax, [esp + 0x20]
mov byte [esp + 0xc8], 1
mov ebx, 1
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov edi, eax
jmp 0x407928
xor edi, edi
mov dword [esp + 0xc0], 0xffffffff
test bl, 1
je 0x40795f
mov eax, dword [esp + 0x18]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40795f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 3
cmp esi, ebp
je 0x4079fd
mov ecx, 0xb
xor edx, edx
mov word [esp + 0x2c], cx
mov word [esp + 0x34], dx
lea eax, [esp + 0x2c]
mov byte [esp + 0xc0], 4
or ebx, 2
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 5
or ebx, 4
push 0x5ba6e8
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push 0x5ba6b4
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x34]
or ebx, 8
mov dword [esp + 0xd8], 6
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
jmp 0x4079ff
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xc4], 9
call fcn.0048f59d
mov dword [esp + 0xc0], 8
test bl, 8
je 0x407a49
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407a49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x407a62
lea ecx, [esp + 0x44]
and ebx, 0xfffffffb
push ecx
mov dword [esp + 0x18], ebx
call esi
mov dword [esp + 0xc0], 0xffffffff
test bl, 2
je 0x407a80
lea edx, [esp + 0x2c]
and ebx, 0xfffffffd
push edx
mov dword [esp + 0x18], ebx
call esi
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0xa
cmp esi, ebp
je 0x407b04
xor eax, eax
push str.Dialog_Frame
lea ecx, [esp + 0x30]
mov word [esp + 0x30], ax
call fcn.0049491e
mov byte [esp + 0xc0], 0xb
or ebx, 0x10
push 0x5ba758
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push 0x5ba6f8
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x34]
or ebx, 0x20
mov dword [esp + 0xd8], 0xc
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
mov esi, eax
jmp 0x407b06
xor esi, esi
mov dword [esp + 0xc0], 0xd
test bl, 0x20
je 0x407b3d
mov eax, dword [esp + 0x1c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xc0], 0xffffffff
test bl, 0x10
je 0x407b5f
lea ecx, [esp + 0x2c]
and ebx, 0xffffffef
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
push 0x5ba760
mov ecx, esi
call fcn.0048ce86
push 1
push str.Thin
mov ecx, esi
call fcn.0048ce86
push 1
push str.Resizable
mov ecx, esi
call fcn.0048ce86
push 1
push str.Dialog_Frame
mov ecx, esi
call fcn.0048ce86
push esi
mov ecx, edi
mov dword [esi + 0x64], ebp
call fcn.0048f59d
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0xf
cmp esi, ebp
je 0x407c51
mov edx, 8
push 0x5ba798
mov word [esp + 0x30], dx
call fcn.00540650
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2c]
mov byte [esp + 0xc0], 0x10
or ebx, 0x40
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 0x11
or ebx, 0x80
push 0x5ba7a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push 0x5ba77c
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x34]
or ebx, 0x100
mov dword [esp + 0xd8], 0x12
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
jmp 0x407c53
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xc4], 0x15
call fcn.0048f59d
mov dword [esp + 0xc0], 0x14
test ebx, 0x100
je 0x407ca3
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ca3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x407cbc
lea ecx, [esp + 0x44]
and ebx, 0xffffff7f
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xc0], 0xffffffff
test bl, 0x40
je 0x407cde
lea edx, [esp + 0x2c]
and ebx, 0xffffffbf
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.0048f839
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x16
cmp esi, ebp
je 0x407d41
push 0x5ba7a8
lea ecx, [esp + 0x20]
call fcn.00409040
push 1
push ebp
lea eax, [esp + 0x24]
or ebx, 0x200
mov byte [esp + 0xc8], 0x17
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov edi, eax
jmp 0x407d43
xor edi, edi
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x200
je 0x407d80
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffdff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407d80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x19
cmp esi, ebp
je 0x407e2e
mov ecx, 3
mov word [esp + 0x2c], cx
mov dword [esp + 0x34], 0xfa
lea edx, [esp + 0x2c]
mov byte [esp + 0xc0], 0x1a
or ebx, 0x400
push edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 0x1b
or ebx, 0x800
push 0x5ba7c4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push 0x5ba7b4
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x30]
or ebx, 0x1000
push ecx
mov dword [esp + 0xdc], 0x1c
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
mov esi, eax
jmp 0x407e30
xor esi, esi
mov dword [esp + 0xc0], 0x1e
test ebx, 0x1000
je 0x407e6d
mov eax, dword [esp + 0x18]
and ebx, 0xffffefff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407e6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x800
je 0x407e8a
lea ecx, [esp + 0x44]
and ebx, 0xfffff7ff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x400
je 0x407eb2
lea edx, [esp + 0x2c]
and ebx, 0xfffffbff
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x12c
push 0x32
push 1
mov ecx, esi
call fcn.0048cecf
push esi
mov ecx, edi
call fcn.0048f59d
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x20
cmp esi, ebp
je 0x407f78
mov eax, 3
mov word [esp + 0x2c], ax
mov dword [esp + 0x34], 0x96
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0xc4], 0x21
or ebx, 0x2000
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 0x22
or ebx, 0x4000
push 0x5ba7dc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push 0x5ba7cc
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x30]
or ebx, 0x8000
mov dword [esp + 0xd8], 0x23
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
mov esi, eax
jmp 0x407f7a
xor esi, esi
mov dword [esp + 0xc0], 0x25
test ebx, 0x8000
je 0x407fb7
mov eax, dword [esp + 0x18]
and ebx, 0xffff7fff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407fb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x4000
je 0x407fd4
lea ecx, [esp + 0x44]
and ebx, 0xffffbfff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x2000
je 0x407ffc
lea edx, [esp + 0x2c]
and ebx, 0xffffdfff
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, esi
call fcn.0048cecf
push esi
mov ecx, edi
call fcn.0048f59d
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.0048f839
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x27
cmp esi, ebp
je 0x408076
push 0x5ba7e4
lea ecx, [esp + 0x20]
call fcn.00409040
push ebp
push ebp
lea eax, [esp + 0x24]
or ebx, 0x10000
mov byte [esp + 0xc8], 0x28
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov edi, eax
jmp 0x408078
xor edi, edi
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x10000
je 0x4080b5
mov eax, dword [esp + 0x1c]
and ebx, 0xfffeffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4080b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.0043ff43
mov edx, dword [eax + 4]
lea ecx, [esp + 0x78]
push ecx
push 0x3c
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
push 0x5ba7ec
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x164
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x2a
cmp esi, ebp
je 0x40814c
push 0x5ba7e4
lea ecx, [esp + 0x1c]
call fcn.00409040
push 0xffffffffffffffff
push ebp
push 0x5ba7f8
push 0x101
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x2c]
or ebx, 0x20000
mov byte [esp + 0xd4], 0x2b
push edx
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.00494139
jmp 0x40814e
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xc4], 0x2c
call fcn.0048f59d
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x20000
je 0x40819e
mov eax, dword [esp + 0x18]
and ebx, 0xfffdffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40819e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x2d
cmp esi, ebp
je 0x40824a
mov ecx, 0xb
or edx, 0xffffffff
mov word [esp + 0x2c], cx
mov word [esp + 0x34], dx
lea eax, [esp + 0x2c]
mov byte [esp + 0xc0], 0x2e
or ebx, 0x40000
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 0x2f
or ebx, 0x80000
push 0x5ba830
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push 0x5ba80c
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x30]
or ebx, 0x100000
mov dword [esp + 0xd8], 0x30
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
jmp 0x40824c
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xc4], 0x33
call fcn.0048f59d
mov dword [esp + 0xc0], 0x32
test ebx, 0x100000
je 0x40829c
mov eax, dword [esp + 0x18]
and ebx, 0xffefffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40829c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x80000
je 0x4082b9
lea ecx, [esp + 0x44]
and ebx, 0xfff7ffff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x40000
je 0x4082e1
lea edx, [esp + 0x2c]
and ebx, 0xfffbffff
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.0048f839
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x34
cmp esi, ebp
je 0x408343
push 0x5ba840
lea ecx, [esp + 0x20]
call fcn.00409040
push ebp
push ebp
lea eax, [esp + 0x24]
or ebx, 0x200000
mov byte [esp + 0xc8], 0x35
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov edi, eax
jmp 0x408345
xor edi, edi
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x200000
je 0x408382
mov eax, dword [esp + 0x1c]
and ebx, 0xffdfffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408382
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x37
cmp esi, ebp
je 0x408408
xor ecx, ecx
mov word [esp + 0x2c], cx
push 0x5ba680
lea ecx, [esp + 0x30]
call fcn.0049491e
mov byte [esp + 0xc0], 0x38
or ebx, 0x400000
push 0x5ba848
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x30]
or ebx, 0x800000
mov dword [esp + 0xd8], 0x39
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00493d1b
mov esi, eax
jmp 0x40840a
xor esi, esi
mov dword [esp + 0xc0], 0x3a
test ebx, 0x800000
je 0x408447
mov eax, dword [esp + 0x18]
and ebx, 0xff7fffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408447
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x400000
je 0x40846f
lea ecx, [esp + 0x2c]
and ebx, 0xffbfffff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ebp
mov ecx, esi
call fcn.0048d875
push esi
mov ecx, edi
call fcn.0048f59d
push 0x118
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc0], 0x3c
cmp esi, ebp
je 0x4084e5
push 0x5ba864
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], 0xfec0d2
call fcn.00409040
push ebp
push 0x5ba850
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
or ebx, 0x1000000
mov byte [esp + 0xd0], 0x3d
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.00493f3e
mov esi, eax
jmp 0x4084e7
xor esi, esi
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x1000000
je 0x408524
mov eax, dword [esp + 0x18]
and ebx, 0xfeffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408524
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 1
push 0x5ba870
mov ecx, esi
call fcn.00493a61
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x5ba878
mov ecx, esi
call fcn.00493a31
push esi
mov ecx, edi
call fcn.0048f59d
push pe_nt_image_headers32
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x3f
cmp esi, ebp
je 0x4085de
push 0x5b8b64
lea ecx, [esp + 0x2c]
call fcn.00409040
mov byte [esp + 0xc0], 0x40
or ebx, 0x2000000
push 0x5ba894
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push 0x5ba880
push 0x5e2758
push ebp
push 0x5ba890
lea ecx, [esp + 0x3c]
push ecx
push 1
lea edx, [esp + 0x34]
or ebx, 0x4000000
mov dword [esp + 0xdc], 0x41
push edx
mov ecx, esi
mov dword [esp + 0x34], ebx
call fcn.00494081
jmp 0x4085e0
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xc4], 0x43
call fcn.0048f59d
mov dword [esp + 0xc0], 0x42
test ebx, 0x4000000
je 0x408630
mov eax, dword [esp + 0x18]
and ebx, 0xfbffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408630
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x2000000
je 0x40866d
mov eax, dword [esp + 0x28]
and ebx, 0xfdffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40866d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push pe_nt_image_headers32
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x44
cmp esi, ebp
je 0x4086e7
push 0x5ba89c
lea ecx, [esp + 0x1c]
call fcn.00409040
mov byte [esp + 0xc0], 0x45
or ebx, 0x8000000
push 0x5ba8a0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], ebx
call fcn.00409040
push ebp
push ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
or ebx, 0x10000000
mov dword [esp + 0xcc], 0x46
push edx
mov ecx, esi
mov dword [esp + 0x24], ebx
call fcn.0049400c
jmp 0x4086e9
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xc4], 0x48
call fcn.0048f59d
mov dword [esp + 0xc0], 0x47
test ebx, 0x10000000
je 0x408739
mov eax, dword [esp + 0x28]
and ebx, 0xefffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408739
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x8000000
je 0x408772
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
and ebx, 0xf7ffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408772
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.0048f839
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xc0], 0x49
cmp esi, ebp
je 0x4087da
push 0x5ba8a8
lea ecx, [esp + 0x2c]
call fcn.00409040
push 0
push 0
lea ecx, [esp + 0x30]
or ebx, 0x20000000
push ecx
mov byte [esp + 0xcc], 0x4a
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov ebp, eax
mov dword [esp + 0x20], eax
jmp 0x4087e0
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x20000000
je 0x408819
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
and ebx, 0xdfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408819
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc0], 0x4c
test esi, esi
je 0x40886f
push 0x5ba8b4
lea ecx, [esp + 0x20]
call fcn.00409040
push 0
push 0
lea ecx, [esp + 0x24]
or ebx, 0x40000000
push ecx
mov byte [esp + 0xcc], 0x4d
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov edi, eax
jmp 0x408871
xor edi, edi
mov dword [esp + 0xc0], 0xffffffff
test ebx, 0x40000000
je 0x4088aa
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
and ebx, 0xbfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4088aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
mov ecx, ebp
call fcn.0048f59d
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc0], 0x4f
test esi, esi
je 0x408908
push 0x5ba8c0
lea ecx, [esp + 0x1c]
call fcn.00409040
push 0
push 0
lea ecx, [esp + 0x20]
or ebx, 0x80000000
push ecx
mov byte [esp + 0xcc], 0x50
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.0048fa2a
mov ebp, eax
jmp 0x40890a
xor ebp, ebp
mov dword [esp + 0xc0], 0xffffffff
test ebx, ebx
jns 0x408939
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408939
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
mov ecx, edi
call fcn.0048f59d
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc0], 0x52
test esi, esi
je 0x4089f2
mov ecx, 8
push 0x5ba8d8
mov word [esp + 0x30], cx
call fcn.00540650
mov dword [esp + 0x34], eax
lea edx, [esp + 0x2c]
mov byte [esp + 0xc0], 0x53
push edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], 1
call fcn.0049469b
mov dword [esp + 0xc0], 0x54
push 0x5ba8e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 3
call fcn.00409040
push 0
push 0
push 0
push 0
push 0x5ba8cc
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0xdc], 0x55
mov ebx, 7
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.00493d1b
jmp 0x4089f8
mov ebx, dword [esp + 0x24]
xor eax, eax
push eax
mov ecx, ebp
mov dword [esp + 0xc4], 0x58
call fcn.0048f59d
mov dword [esp + 0xc0], 0x57
test bl, 4
je 0x408a42
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [esp + 0x24], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408a42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x408a5b
lea ecx, [esp + 0x44]
and ebx, 0xfffffffd
push ecx
mov dword [esp + 0x28], ebx
call edi
mov dword [esp + 0xc0], 0xffffffff
test bl, 1
je 0x408a79
lea edx, [esp + 0x2c]
and ebx, 0xfffffffe
push edx
mov dword [esp + 0x28], ebx
call edi
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc0], 0x59
test esi, esi
je 0x408b26
mov eax, 8
push 0x5ba8e8
mov word [esp + 0x30], ax
call fcn.00540650
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0xc4], 0x5a
or ebx, 8
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 0x5b
or ebx, 0x10
push 0x5ba8f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], ebx
call fcn.00409040
push 0
push 0
push 0
push 0
push 0x5ba8cc
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x34]
or ebx, 0x20
mov dword [esp + 0xd8], 0x5c
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.00493d1b
jmp 0x408b28
xor eax, eax
push eax
mov ecx, ebp
mov dword [esp + 0xc4], 0x5f
call fcn.0048f59d
mov dword [esp + 0xc0], 0x5e
test bl, 0x20
je 0x408b72
mov eax, dword [esp + 0x1c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [esp + 0x24], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 0x10
je 0x408b85
lea ecx, [esp + 0x44]
and ebx, 0xffffffef
push ecx
mov dword [esp + 0x28], ebx
call edi
mov dword [esp + 0xc0], 0xffffffff
test bl, 8
je 0x408ba3
lea edx, [esp + 0x2c]
and ebx, 0xfffffff7
push edx
mov dword [esp + 0x28], ebx
call edi
push 0xe4
call fcn.0040d64a
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc0], 0x60
test esi, esi
je 0x408c56
mov eax, 8
push 0x5ba8f8
mov word [esp + 0x58], ax
call fcn.00540650
mov dword [esp + 0x5c], eax
lea ecx, [esp + 0x54]
push ecx
mov byte [esp + 0xc4], 0x61
or ebx, 0x40
lea ecx, [esp + 0x6c]
mov dword [esp + 0x28], ebx
call fcn.0049469b
mov dword [esp + 0xc0], 0x62
or ebx, 0x80
push 0x5ba900
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], ebx
call fcn.00409040
push 0
push 0
push 0
push 0
push 0x5ba8cc
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x54]
or ebx, 0x100
mov dword [esp + 0xd8], 0x63
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.00493d1b
jmp 0x408c58
xor eax, eax
push eax
mov ecx, ebp
mov dword [esp + 0xc4], 0x66
call fcn.0048f59d
mov dword [esp + 0xc0], 0x65
test ebx, 0x100
je 0x408ca8
mov eax, dword [esp + 0x3c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [esp + 0x24], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ca8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x408cb9
lea ecx, [esp + 0x68]
push ecx
and ebx, 0xffffff7f
call edi
mov dword [esp + 0xc0], 0xffffffff
test bl, 0x40
je 0x408cd0
lea edx, [esp + 0x54]
push edx
call edi
mov esi, dword [esp + 0x20]
push 0
mov ecx, esi
call fcn.0048d6aa
mov ecx, dword [esp + 0x40]
push 1
push 1
push esi
call fcn.0048f839
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.005239a2
add esp, 0xb0
ret