Function at 0x404ed0
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5ac
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0x28]
mov eax, dword [eax + 0x14]
mov dword [edi], 1
mov dword [edi + 0xc], 0x8000
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x53c], esi
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x560], eax
call eax
mov dword [edi + 0x10], 0
mov dword [edi + 8], eax
sub esp, 0xc
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x20], 0
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0
movzx eax, word [esi + 0x50]
cmp ax, 0xee
ja case.0x404f85.3
cmp ax, 0x7f
jbe 0x405260
lea edx, [eax - 0x80]
cmp dx, 0x6e
ja case.0x404f85.3
movzx edx, dx
jmp dword [edx*4 + 0x416bc0]
test byte [0x415010], 1
je 0x405266
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_charset__u_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405266
mov eax, 0x4e2
nop
mov dword [esp + 8], eax
mov dword [esp + 4], str._rtf1_ansi_ansicpg_ddeff0
lea eax, [ebp - 0x418]
mov dword [ebp - 0x544], eax
mov esi, eax
mov dword [esp], eax
call sym._sprintf
mov edx, esi
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x4051b3
mov edx, str._fonttbl
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x4051b3
mov eax, dword [ebp - 0x53c]
xor esi, esi
xor ebx, ebx
mov eax, dword [eax + 0x84]
test eax, eax
je 0x4051a3
mov dword [ebp + 0xc], edi
jmp 0x4050c9
mov dword [ebp - 0x540], str.roman
cmp cl, 0x10
je 0x405065
cmp cl, 0x20
mov edi, str.swiss
mov ecx, 0x4166f4
cmovne edi, ecx
mov dword [ebp - 0x540], edi
lea edi, [edx + 0x1c]
and eax, 0xf
mov dword [esp + 0x18], edi
movzx edx, byte [edx + 0x17]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [ebp - 0x540]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str._f_d_f_s_fprq_d_fcharset_d__s_
mov edi, dword [ebp - 0x544]
mov dword [esp], edi
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x4051b3
mov eax, dword [ebp - 0x53c]
add ebx, 1
add esi, 0x44
cmp ebx, dword [eax + 0x84]
jae 0x4051a0
mov eax, dword [ebp - 0x53c]
mov edx, dword [eax + 0x88]
add edx, esi
movzx eax, byte [edx + 0x1b]
mov edi, eax
and edi, 0xfffffff0
mov ecx, edi
cmp cl, 0x30
je 0x405190
jbe 0x405040
mov dword [ebp - 0x540], str.script
cmp cl, 0x40
je 0x405065
cmp cl, 0x50
mov edi, str.decor
mov ecx, 0x4166f4
cmovne edi, ecx
mov dword [ebp - 0x540], edi
jmp 0x405065
mov eax, 0x36a
jmp 0x404fd0
mov eax, 0x4e3
jmp 0x404fd0
mov eax, 0x4e9
jmp 0x404fd0
mov eax, 0x4e8
jmp 0x404fd0
mov eax, 0x4e7
jmp 0x404fd0
mov eax, 0x4ea
jmp 0x404fd0
mov eax, 0x4e6
jmp 0x404fd0
mov eax, 0x4e5
jmp 0x404fd0
mov eax, 0x3b6
jmp 0x404fd0
mov eax, 0x3a8
jmp 0x404fd0
mov eax, 0x3b5
jmp 0x404fd0
mov dword [ebp - 0x540], str.modern
jmp 0x405065
mov edi, dword [ebp + 0xc]
mov edx, 0x41658b
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4051c0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, str.colortbl___red0green128_blue0_
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x4051b3
mov eax, dword [ebp - 0x53c]
xor ebx, ebx
xor esi, esi
mov eax, dword [eax + 0x84]
test eax, eax
je 0x4052a6
mov dword [ebp + 0xc], edi
mov edi, dword [ebp - 0x53c]
jmp 0x40520a
add esi, 1
add ebx, 0x44
cmp esi, dword [edi + 0x84]
jae 0x4052a3
mov eax, dword [edi + 0x88]
mov eax, dword [eax + ebx + 0x40]
mov dword [esp + 4], str._red_dgreen_d_blue_d_
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov dword [esp + 0x10], edx
movzx edx, ah
movzx eax, al
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x544]
mov dword [esp], eax
call sym._sprintf
mov edx, dword [ebp - 0x544]
mov eax, dword [ebp + 0xc]
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4051f8
jmp 0x4051b3
cmp ax, 1
ja 0x405270
mov eax, 0x4e4
jmp 0x404fd0
cmp ax, 0x4d
jne case.0x404f85.3
mov dword [esp + 8], 0x41674c
mov dword [esp + 4], str._rtf1_sdeff0
jmp 0x404fdc
mov eax, 0x551
jmp 0x404fd0
mov eax, 0x3a4
jmp 0x404fd0
mov edi, dword [ebp + 0xc]
mov edx, 0x41658b
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x4051b3
mov eax, dword [ebp - 0x53c]
mov esi, dword [ebp - 0x558]
mov dword [ebp - 0x56c], 0
mov ecx, 0xffffffff
mov dword [ebp - 0x578], 0
movzx eax, word [eax + 0x4c]
lea ebx, [esi - 0xc]
mov word [ebp - 0x540], ax
cmp ax, 0x10
ja 0x405417
lea esi, [esi]
nop
mov eax, dword [ebp - 0x53c]
xor edx, edx
movzx esi, word [eax + 0x54]
mov eax, ebx
div esi
mov dword [ebp - 0x55c], eax
cmp eax, ecx
je 0x405328
cmp ecx, 0xffffffff
je 0x405328
mov dword [ebp - 0x558], ebx
sub edx, 0xc
mov eax, dword [ebp - 0x53c]
mov esi, dword [ebp - 0x55c]
cmp esi, dword [eax + 0x78]
jae 0x406498
mov esi, dword [ebp - 0x53c]
mov ebx, dword [ebp - 0x55c]
mov eax, dword [esi + 0x70]
add edx, dword [eax + ebx*4]
mov ebx, dword [esi + 0x74]
lea eax, [edx + 0x15]
mov dword [ebp - 0x54c], edx
mov dword [ebp - 0x574], eax
cmp eax, ebx
jae 0x406f53
cmp dword [ebp - 0x55c], ecx
mov ecx, 0
cmove ecx, dword [ebp - 0x56c]
mov esi, dword [ebp - 0x54c]
mov dword [ebp - 0x56c], ecx
mov ecx, dword [ebp - 0x54c]
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
movzx ecx, byte [ecx + 0x14]
mov byte [ebp - 0x544], al
mov eax, esi
movzx esi, byte [esi + 2]
movzx eax, byte [eax + 3]
cmp cl, 2
je 0x4054e0
jbe 0x405460
cmp cl, 0x20
je 0x405469
cmp cl, 0x23
je 0x405469
test byte [0x415010], 2
jne 0x4060a6
mov ebx, dword [ebp - 0x54c]
movzx eax, byte [ebx + 0xf]
movzx edx, byte [ebx + 0xe]
movzx ecx, byte [ebx + 0xc]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0xd]
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add eax, edx
cmp word [ebp - 0x540], 0x10
jbe 0x405430
mov dword [ebp - 0x558], eax
mov ecx, dword [ebp - 0x55c]
lea ebx, [eax - 0xc]
mov eax, ebx
and ebx, 0x3fff
shr eax, 0xe
mov edx, ebx
mov dword [ebp - 0x55c], eax
jmp 0x405328
add dword [ebp - 0x558], eax
mov esi, dword [ebp - 0x558]
test eax, eax
je 0x4064c5
cmp esi, 0xffffffff
je 0x4064c5
mov ecx, dword [ebp - 0x55c]
lea ebx, [esi - 0xc]
jmp 0x405300
cmp cl, 1
jne 0x4053c9
shl eax, 8
mov ecx, esi
shl edx, 8
movzx esi, cl
movzx ecx, byte [ebp - 0x544]
add eax, esi
add edx, ecx
shl eax, 0x10
mov ecx, dword [ebp - 0x54c]
movzx edx, dx
lea esi, [eax + edx]
lea eax, [ecx + esi]
cmp ebx, eax
cmovbe eax, ebx
lea ebx, [ecx + 0x19]
mov dword [ebp - 0x544], ebx
mov dword [ebp - 0x548], eax
cmp eax, ebx
jae 0x405500
test byte [0x415010], 4
je 0x4051b3
mov dword [esp + 0xc], str.header_too_small_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x4051b3
mov ebx, dword [ebp - 0x578]
test ebx, ebx
jne 0x4064c5
mov dword [ebp - 0x578], 1
jmp 0x4053d6
mov ecx, dword [ebp - 0x54c]
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add edx, eax
movzx eax, byte [ecx + 5]
movzx ecx, byte [ecx + 4]
shl edx, 0x10
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 0x54c]
movzx eax, ax
add eax, edx
movzx edx, byte [ecx + 0x12]
mov ebx, eax
movzx eax, byte [ecx + 0x13]
shl eax, 8
add edx, eax
movzx eax, byte [ecx + 0x11]
movzx ecx, byte [ecx + 0x10]
shl edx, 0x10
shl eax, 8
add eax, ecx
movzx eax, ax
add edx, eax
mov dword [ebp - 0x550], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov edx, dword [ebp - 0x560]
call edx
mov dword [ebp - 0x540], eax
sub esp, 0xc
test eax, eax
je 0x4051b3
mov edx, dword [ebp - 0x550]
mov ecx, dword [ebp - 0x54c]
sub esi, edx
add edx, ecx
cmp esi, ebx
jge 0x4067e5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
jne 0x406e73
mov ecx, dword [eax + 0x60]
test ecx, ecx
jne 0x406f89
test byte [0x415010], 1
jne 0x40706a
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov ebx, dword [ebp - 0x540]
mov dword [esp], ebx
call sym._memcpy
mov eax, ebx
add eax, esi
mov dword [ebp - 0x568], eax
mov esi, dword [ebp - 0x54c]
movzx eax, byte [esi + 0x13]
movzx edx, byte [esi + 0x12]
movzx ecx, byte [esi + 0x10]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0x11]
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add eax, edx
add eax, esi
mov dword [ebp - 0x564], eax
test byte [0x415010], 8
jne 0x406890
mov eax, dword [ebp - 0x54c]
movzx eax, byte [eax + 0x14]
cmp al, 0x20
je 0x4068c1
cmp al, 0x23
je 0x4068c1
mov dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x584], 1
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x540]
mov ebx, 0xffffffff
xor esi, esi
mov word [ebp - 0x588], bx
mov dword [ebp - 0x548], eax
mov word [ebp - 0x57c], si
mov esi, edi
test byte [0x415010], 8
jne 0x406140
mov edx, str.pard
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
mov eax, dword [ebp - 0x54c]
add word [ebp - 0x57c], 1
movzx edx, byte [eax + 0x14]
cmp dl, 0x23
je 0x4060e4
mov eax, dword [ebp - 0x544]
lea ecx, [eax + 6]
add eax, 4
cmp dl, 1
cmove eax, ecx
movzx ecx, byte [eax + 1]
movzx edx, byte [eax]
shl ecx, 8
lea ebx, [ecx + edx]
and edx, 1
mov word [ebp - 0x550], bx
jne 0x406280
add eax, 2
mov dword [ebp - 0x544], eax
test byte [ebp - 0x550], 2
jne 0x406200
test byte [ebp - 0x550], 4
jne 0x406186
test byte [ebp - 0x550], 8
jne 0x406298
test byte [ebp - 0x550], 0x10
jne 0x406398
test byte [ebp - 0x550], 0x20
jne 0x406318
test byte [ebp - 0x550], 0x40
jne 0x406418
test word [ebp - 0x550], 0x100
je 0x4057d2
mov eax, dword [ebp - 0x544]
movzx ebx, byte [eax]
test bl, 1
jne 0x406bb0
test bl, 2
jne 0x406b90
test bl, 4
jne 0x406b70
test bl, 8
jne 0x406b50
test bl, 0x10
jne 0x406b30
test bl, 0x20
je 0x4065b0
mov edx, str._brdrth
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
and ebx, 0x40
jne 0x406c60
mov eax, dword [ebp - 0x544]
movsx dx, byte [eax + 2]
movzx eax, byte [eax + 1]
shl edx, 8
add ax, dx
jne 0x406c0e
add dword [ebp - 0x544], 3
test word [ebp - 0x550], 0x200
jne 0x406c8d
movzx eax, word [ebp - 0x550]
and ax, 0xc00
cmp ax, 0x400
je 0x406610
cmp ax, 0x800
je 0x4065f0
test ax, ax
je 0x4065d0
test byte [0x415010], 1
jne 0x406fca
lea esi, [esi]
lea esi, [esi]
test word [ebp - 0x550], 0x1000
jne 0x406590
test word [ebp - 0x550], 0xe080
je 0x405847
test byte [0x415010], 1
jne 0x406dd7
mov ebx, dword [ebp - 0x568]
cmp dword [ebp - 0x548], ebx
jae 0x405908
mov ebx, dword [ebp - 0x564]
cmp dword [ebp - 0x544], ebx
jae 0x405908
lea esi, [esi]
nop
test byte [0x415010], 8
jne 0x405f00
mov eax, dword [ebp - 0x548]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov edi, eax
test eax, eax
jne 0x405de8
add dword [ebp - 0x548], 1
mov eax, dword [ebp - 0x544]
movzx ebx, byte [eax]
cmp bl, 0xff
je 0x4067d9
cmp bl, 0xef
ja case.0x4058c6.4
test bl, bl
jns 0x406028
lea eax, [ebx - 0x80]
cmp al, 0x6f
ja case.0x4058c6.4
movzx eax, al
jmp dword [eax*4 + 0x416d7c]
test byte [0x415010], 4
jne 0x406630
add dword [ebp - 0x544], 1
lea esi, [esi]
mov ebx, dword [ebp - 0x564]
cmp dword [ebp - 0x544], ebx
jae 0x405908
mov ebx, dword [ebp - 0x568]
cmp dword [ebp - 0x548], ebx
jb 0x405870
movsx eax, word [ebp - 0x57c]
mov ecx, dword [ebp - 0x584]
cmp eax, ecx
jb 0x405687
mov edi, esi
mov esi, dword [ebp - 0x540]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x55c]
mov esi, dword [ebp - 0x56c]
sub esp, 0xc
shl eax, 0xf
add eax, esi
cmp eax, dword [ebp + 0x14]
jae 0x405965
mov eax, dword [edi + 0x10]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x53c]
mov esi, dword [ebp - 0x580]
add dword [ebp - 0x56c], esi
movzx eax, word [eax + 0x4c]
mov word [ebp - 0x540], ax
jmp 0x4053d6
mov eax, dword [ebp - 0x544]
lea ecx, [eax + 8]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x550], ecx
cmp al, 4
je 0x406e69
ja 0x4067ec
test al, al
je 0x406e5f
cmp al, 1
jne 0x406e0b
mov eax, dword [ebp - 0x544]
movsx ecx, byte [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 8]
mov dword [ebp - 0x550], eax
mov eax, ebx
shr bl, 2
mov dword [esp + 0x10], ecx
xor ebx, 1
mov dword [esp + 0xc], 0
not eax
and ebx, 1
mov edi, eax
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x544]
and edi, 1
movzx eax, byte [ebx + 7]
movzx edx, byte [ebx + 6]
movzx ecx, byte [ebx + 4]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 5]
mov dword [esp], 0xffffffff
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add eax, edx
mov edx, edi
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x550]
mov eax, esi
call dbg.HLPFILE_AllocLink
movzx eax, byte [ebx + 2]
movzx edx, byte [ebx + 1]
shl eax, 8
add eax, edx
movzx eax, ax
lea eax, [ebx + eax + 3]
mov dword [ebp - 0x544], eax
jmp 0x4058e8
test byte [0x415010], 4
jne 0x406748
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax + 8]
mov eax, ebx
shr bl, 2
mov dword [esp + 0x10], 0xffffffff
xor ebx, 1
not eax
mov dword [esp + 0xc], 0
and ebx, 1
mov edi, eax
mov dword [esp + 8], ebx
and edi, 1
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx + 4]
movzx edx, byte [ebx + 3]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 2]
movzx ebx, byte [ebx + 1]
mov dword [esp], 0xffffffff
shl eax, 0x10
shl edx, 8
add edx, ebx
movzx edx, dx
add eax, edx
mov edx, edi
mov dword [esp + 4], eax
mov eax, esi
call dbg.HLPFILE_AllocLink
add dword [ebp - 0x544], 5
jmp 0x4058e8
mov ecx, dword [ebp - 0x544]
movzx eax, byte [ecx + 1]
test byte [ecx + 2], 1
je 0x406544
mov ebx, dword [ecx + 2]
lea edi, [ecx + 6]
lea edx, [ebx - 0x80000000]
mov ebx, edx
shr ebx, 1
mov dword [ebp - 0x544], ebx
movzx ecx, byte [0x415010]
cmp al, 5
je 0x406bd0
cmp al, 0x22
je 0x4064df
cmp al, 3
je 0x4064ef
and ecx, 1
jne 0x40709f
lea esi, [esi]
lea eax, [edi + ebx]
mov dword [ebp - 0x544], eax
jmp 0x4058e8
test byte [0x415010], 4
jne 0x406686
mov eax, dword [ebp + 8]
not ebx
mov edi, ebx
mov eax, dword [eax + 0x28]
and edi, 1
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
jmp 0x405a90
mov eax, dword [ebp - 0x544]
lea edi, [eax + 3]
test byte [0x415010], 8
jne 0x4066de
shr bl, 2
mov dword [esp + 0x10], 0xffffffff
mov ecx, edi
xor ebx, 1
mov dword [esp + 0xc], 0
and ebx, 1
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx + 2]
movzx edx, byte [ebx + 1]
shl eax, 8
add eax, edx
mov edx, 2
movzx eax, ax
mov dword [esp], eax
jmp 0x405a2e
mov edx, 0x416b68
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
add dword [ebp - 0x544], 1
add dword [esi + 0x10], 1
jmp 0x4058e8
mov eax, dword [ebp - 0x54c]
cmp byte [eax + 0x14], 0x23
jne 0x40656f
mov eax, dword [ebp - 0x544]
cmp byte [eax + 1], 0xff
je 0x406abb
mov edx, str.parintbl
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
mov eax, dword [esi + 0x10]
add eax, 1
add dword [ebp - 0x544], 1
mov dword [esi + 0x10], eax
jmp 0x4058e8
mov edx, str.line
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405be8
mov esi, dword [ebp - 0x540]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4051b3
mov edx, 0x416b65
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405be8
jmp 0x405c4d
mov eax, dword [esi + 0x20]
add dword [ebp - 0x544], 1
test eax, eax
je 0x4067a0
mov edx, dword [esi + 0x10]
mov dword [eax + 0x18], edx
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
jmp 0x4058e8
mov edx, str._tab
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405be8
jmp 0x405c4d
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx + 2]
movzx edx, byte [ebx + 1]
shl eax, 8
add eax, edx
movzx eax, ax
mov dword [ebp - 0x550], eax
test byte [0x415010], 8
jne 0x40671b
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x18]
add dword [ebp - 0x544], 3
mov edx, dword [eax + 0x28]
imul eax, dword [ebp - 0x550], 0x44
add eax, dword [edx + 0x88]
mov edx, dword [eax]
lea ebx, [edx - 4]
mov dword [ebp - 0x554], ebx
test ecx, ecx
je 0x405d44
lea ebx, [edx + 4]
cmp ecx, 2
cmove edx, ebx
mov dword [ebp - 0x554], edx
cmp byte [eax + 0x16], 0
mov edx, str._strike
mov ebx, str._strike0
mov ecx, str.ul0
cmovne ebx, edx
cmp byte [eax + 0x15], 0
mov edx, 0x41671d
mov edi, 0x416726
cmovne ecx, edx
cmp byte [eax + 0x14], 0
mov edx, 0x416729
cmovne edx, edi
cmp dword [eax + 0x10], 0x191
mov edi, 0x41672d
mov dword [esp + 0x20], ebx
mov eax, 0x416730
mov dword [esp + 0x1c], ecx
cmovge eax, edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x554]
mov dword [esp + 0x10], eax
mov ebx, dword [ebp - 0x550]
mov dword [esp + 4], str._f_dcf_d_fs_d_s_s_s_s
lea eax, [ebx + 2]
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x518]
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._sprintf
mov edx, ebx
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4058e8
jmp 0x405c4d
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x405e14
mov eax, dword [esi + 0x20]
cmp dword [eax], 1
je 0x406050
mov edx, str.ulcf1
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
sete al
test al, al
jne 0x405c4d
mov edx, dword [esi]
test edx, edx
je 0x405fe6
mov edx, dword [ebp - 0x548]
movzx eax, byte [edx]
test al, al
je 0x406c80
mov dword [ebp - 0x570], edi
lea ebx, [edx + 1]
mov dword [ebp + 0xc], esi
jmp 0x405e9a
cmp al, 0x7b
je 0x405ef0
cmp al, 0x7d
je 0x405ee0
cmp al, 0x5c
jne 0x405e8a
mov esi, 2
mov edi, 0x416709
cmp ecx, edx
je 0x405e74
mov eax, dword [ebp + 0xc]
sub ecx, edx
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405c4d
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov edx, edi
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405c4d
mov edx, ebx
movzx eax, byte [ebx]
mov ecx, ebx
add ebx, 1
test al, al
je 0x405fc0
lea ecx, [ebx - 1]
test al, al
jns 0x405e40
mov dword [ebp - 0x554], edx
mov edi, section..bss
mov dword [ebp - 0x550], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._x
mov dword [esp], section..bss
call sym._sprintf
mov ecx, dword [ebp - 0x550]
mov edx, dword [ebp - 0x554]
mov esi, eax
jmp 0x405e5e
mov esi, 2
mov edi, 0x416706
jmp 0x405e5e
mov esi, 2
mov edi, 0x416703
jmp 0x405e5e
mov ebx, dword [ebp - 0x548]
mov eax, ebx
call sym._wine_dbgstr_an.constprop.0_1
mov ecx, dword [ebp - 0x564]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x544]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x568]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Got_text:__s___p__p____p__p__n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov edi, eax
test eax, eax
jne 0x405de8
test byte [0x415010], 8
je 0x405fa4
mov eax, dword [ebp - 0x544]
movzx eax, byte [eax]
mov dword [esp + 0xc], str.format0x_02x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x548]
lea eax, [eax + edi + 1]
mov dword [ebp - 0x548], eax
jmp 0x40589d
mov edi, dword [ebp - 0x570]
mov esi, dword [ebp + 0xc]
sub ecx, edx
mov eax, esi
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405c4d
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x406010
add dword [esi + 0x10], edi
jmp 0x405f6a
mov ecx, 1
mov edx, 0x416200
mov eax, esi
call dbg.HLPFILE_RtfAddRawString
test eax, eax
je 0x405c4d
mov dword [esi], 1
jmp 0x405e1e
mov edx, 0x41658b
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405fe1
jmp 0x405c4d
cmp bl, 0x20
je 0x406070
cmp bl, 0x21
jne case.0x4058c6.4
test byte [0x415010], 1
jne 0x40665d
add dword [ebp - 0x544], 3
jmp 0x4058e8
mov edx, str.uldcf1
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
sete al
jmp 0x405e0c
test byte [0x415010], 1
je 0x405acc
mov dword [esp + 0xc], str.NIY20_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405acc
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.buf_0x14____x_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x415010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x53c]
movzx eax, word [eax + 0x4c]
mov word [ebp - 0x540], ax
jmp 0x4053d6
mov ecx, dword [ebp - 0x544]
movsx ax, byte [ecx + 1]
movzx edx, byte [ecx]
shl eax, 8
add eax, edx
mov word [ebp - 0x57c], ax
cmp ax, 0xffff
je 0x40755f
mov edx, str.intbl
mov eax, esi
add dword [ebp - 0x544], 5
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
mov eax, dword [ebp - 0x54c]
movzx edx, byte [eax + 0x14]
movzx eax, word [ebp - 0x57c]
mov word [ebp - 0x588], ax
jmp 0x4056c3
movsx eax, word [ebp - 0x57c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x544]
mov ecx, dword [ebp - 0x574]
mov dword [esp + 0xc], str.looking_for_format_at_offset__Iu_in_column__d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
sub eax, ecx
mov dword [esp + 4], 0x415010
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x405694
mov ecx, dword [ebp - 0x544]
movzx eax, byte [ecx]
test al, 1
je 0x406a73
movzx edx, word [ecx]
add ecx, 2
mov dword [ebp - 0x544], ecx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ecx, dword [ebp + 8]
cwde
mov edx, dword [ecx + 0x28]
lea ecx, [ebp - 0x518]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._sa_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405715
jmp 0x405c4d
mov ecx, dword [ebp - 0x544]
movzx eax, byte [ecx]
test al, 1
je 0x406a5b
movzx edx, word [ecx]
add ecx, 2
mov dword [ebp - 0x544], ecx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ecx, dword [ebp + 8]
cwde
mov edx, dword [ecx + 0x28]
lea ecx, [ebp - 0x518]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._sb_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405708
jmp 0x405c4d
lea edx, [eax + 6]
lea ecx, [eax + 4]
test byte [eax + 2], 1
cmove edx, ecx
mov dword [ebp - 0x544], edx
jmp 0x4056fb
mov ecx, dword [ebp - 0x544]
movzx eax, byte [ecx]
test al, 1
je 0x406b00
movzx edx, word [ecx]
add ecx, 2
mov dword [ebp - 0x544], ecx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ecx, dword [ebp + 8]
cwde
mov edx, dword [ecx + 0x28]
lea ecx, [ebp - 0x518]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._sl_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405722
jmp 0x405c4d
mov ecx, dword [ebp - 0x544]
movzx eax, byte [ecx]
test al, 1
je 0x406b18
movzx edx, word [ecx]
add ecx, 2
mov dword [ebp - 0x544], ecx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x518]
cwde
mov edx, dword [ebx + 0x28]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._ri_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x40573c
jmp 0x405c4d
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx]
test al, 1
je 0x406aa3
movzx edx, word [ebx]
add ebx, 2
mov dword [ebp - 0x544], ebx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ecx, dword [ebp + 8]
cwde
mov edx, dword [ecx + 0x28]
lea ecx, [ebp - 0x518]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str.li_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x40572f
jmp 0x405c4d
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx]
test al, 1
je 0x406a8b
movzx edx, word [ebx]
add ebx, 2
mov dword [ebp - 0x544], ebx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
mov ecx, dword [ebp + 8]
cwde
mov edx, dword [ecx + 0x28]
lea ecx, [ebp - 0x518]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._fi_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405749
jmp 0x405c4d
test byte [0x415010], 4
je 0x4064c5
mov dword [esp + 0xc], str.maplen_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 8]
mov edx, 0x41658b
mov dword [esi + 8], eax
mov eax, edi
call dbg.HLPFILE_RtfAddControl
jmp 0x4051b5
xor edx, edx
test byte [edi], 1
mov eax, edi
setne dl
mov edi, edx
lea edi, [edi + eax + 1]
movsx ax, byte [edi + 1]
movzx edx, byte [edi]
shl eax, 8
add ax, dx
je 0x406ebc
cmp ax, 1
je 0x406e9a
and ecx, 1
je 0x405b30
cwde
mov dword [esp + 0xc], str._____u_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405b30
mov ebx, dword [ebp - 0x544]
movzx edx, word [ebx + 2]
lea edi, [ebx + 4]
sub edx, 0x8000
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, edx
sar ecx, 1
mov dword [ebp - 0x544], ecx
mov ebx, ecx
jmp 0x405b02
mov edx, str.par
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405c28
jmp 0x405c4d
mov edx, str.keep
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x40582f
jmp 0x405c4d
mov edx, str._brdrs
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4057a7
jmp 0x405c4d
mov edx, 0x4169d1
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405820
jmp 0x405c4d
mov edx, 0x4169d9
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405820
jmp 0x405c4d
mov edx, 0x4169d5
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405820
jmp 0x405c4d
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.format__02x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x4058dd
mov dword [esp + 0xc], str.NIY21_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x406043
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx + 4]
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 2]
mov dword [esp + 0xc], str.jump_topic_1____u_n
shl eax, 0x10
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
shl edx, 8
mov dword [esp + 4], 0x415010
add edx, ecx
mov dword [esp], 2
movzx edx, dx
add eax, edx
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0_1
movzx ebx, byte [ebx]
jmp 0x405b4b
mov eax, edi
call sym._wine_dbgstr_an.constprop.0_1
mov dword [esp + 0xc], str.macro____s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x544]
movzx ebx, byte [eax]
jmp 0x405b8e
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Changing_font_to__d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x405d09
mov ebx, dword [ebp - 0x544]
movzx eax, byte [ebx + 4]
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 2]
mov dword [esp + 0xc], str.jump_topic_1____u_n
shl eax, 0x10
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
shl edx, 8
mov dword [esp + 4], 0x415010
add edx, ecx
mov dword [esp], 2
movzx edx, dx
add eax, edx
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0_1
movzx ebx, byte [ebx]
jmp 0x405a61
test byte [0x415010], 1
je 0x405caa
mov dword [esp + 0xc], str.No_existing_link_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [esi + 0x20]
jmp 0x405caa
add dword [ebp - 0x544], 1
jmp 0x405908
mov esi, ebx
jmp 0x4055cd
cmp al, 6
jne 0x406e0b
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x28]
mov eax, dword [edx + 0x8c]
lea ecx, [eax - 1]
mov dword [ebp - 0x554], ecx
test ecx, ecx
js 0x407551
imul eax, eax, 0x68
mov edx, dword [edx + 0x90]
mov byte [ebp - 0x570], bl
mov ebx, ecx
mov dword [ebp + 0xc], esi
mov edi, dword [sym.imp.ucrtbase.dll_strcmp]
lea edx, [edx + eax - 0x5e]
mov esi, edx
jmp 0x406847
sub ebx, 1
sub esi, 0x68
cmp ebx, 0xffffffff
je 0x407001
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x550]
mov dword [esp], eax
call edi
test eax, eax
jne 0x406838
mov ecx, ebx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [ebp - 0x570]
mov edi, dword [ebp - 0x550]
mov dword [ebp - 0x554], ecx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ecx, dword [ebp - 0x554]
lea eax, [edi + eax + 1]
mov dword [ebp - 0x550], eax
jmp 0x4059d1
movzx eax, byte [esi + 0x14]
mov dword [esp + 0xc], str.Record_type__buf_0x14____0x_x_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x40562a
mov esi, dword [ebp - 0x54c]
lea edx, [esi + 0x17]
test byte [esi + 0x15], 1
cmovne edx, dword [ebp - 0x544]
mov dword [ebp - 0x544], edx
mov esi, edx
movzx edx, byte [edx]
test dl, 1
je 0x406f3a
movzx edx, word [esi]
add esi, 2
mov dword [ebp - 0x544], esi
shr dx, 1
movzx esi, dx
mov dword [ebp - 0x580], esi
cmp al, 0x23
jne 0x406a4c
mov esi, dword [ebp - 0x544]
mov edx, str._trowd
movzx eax, byte [esi]
mov byte [ebp - 0x550], al
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
movzx ebx, byte [esi + 1]
test bl, 0xfd
je 0x40746f
mov dword [ebp - 0x548], 0x7fff
add esi, 2
movzx eax, byte [ebp - 0x550]
mov dword [ebp - 0x584], eax
test byte [0x415010], 8
jne 0x40742e
cmp dword [ebp - 0x584], 1
ja 0x4071d6
test byte [0x415010], 8
jne 0x4074e8
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.kernel32.dll_MulDiv]
mov ecx, dword [eax + 0x28]
mov dword [esp + 8], 0x7fff
mov eax, dword [ebp - 0x548]
mov dword [esp + 4], eax
movsx ax, byte [esi + 1]
movzx edx, byte [esi]
shl eax, 8
add eax, edx
cwde
imul eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0xa8]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp + 8]
sub esp, 0xc
mov dword [ebp - 0x544], eax
mov ecx, dword [ecx + 0x28]
mov dword [esp + 8], 0x7fff
mov eax, dword [ebp - 0x548]
mov dword [esp + 4], eax
movsx ax, byte [esi + 3]
movzx edx, byte [esi + 2]
shl eax, 8
add eax, edx
cwde
imul eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0xa8]
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 0x544]
sub esp, 0xc
sub eax, 1
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x518]
mov dword [esp + 8], eax
mov dword [esp + 4], str._trleft_dcellx_d
mov dword [esp], ebx
call sym._sprintf
mov edx, ebx
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
mov eax, dword [ebp - 0x584]
lea esi, [esi + eax*4]
mov dword [ebp - 0x544], esi
test eax, eax
je 0x40591f
mov dword [ebp - 0x584], 1
jmp 0x405664
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x40622c
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x4061b2
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x406444
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x4063c4
mov ebx, dword [ebp - 0x544]
movsx ax, byte [ebx + 3]
movzx edx, byte [ebx + 2]
shl eax, 8
add eax, edx
cmp ax, 0xffff
je 0x407100
cmp ax, word [ebp - 0x588]
je 0x4070e7
mov edx, str.cellpard
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405c28
jmp 0x405c4d
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x4062c4
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x406344
mov edx, str._brdrr
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x40578a
jmp 0x405c4d
mov edx, str._brdrb
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405781
jmp 0x405c4d
mov edx, str._brdrl
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405778
jmp 0x405c4d
mov edx, str._brdrt
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x40576f
jmp 0x405c4d
mov edx, str._box
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405766
jmp 0x405c4d
and ecx, 1
je 0x405b30
lea eax, [edi + 6]
call sym._wine_dbgstr_an.constprop.0_1
mov dword [esp + 0xc], str.Got_an_embedded_element__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405b30
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x518]
cwde
mov edx, dword [ebx + 0x28]
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._brdrw_d
mov dword [ebp - 0x554], ecx
call sym._sprintf
mov edx, dword [ebp - 0x554]
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4057cb
jmp 0x405c4d
mov edx, str._brdrdb
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x4057b0
jmp 0x405c4d
mov edx, dword [ebp - 0x548]
xor ecx, ecx
jmp 0x405fcb
mov ecx, dword [ebp - 0x544]
movzx eax, byte [ecx]
test al, 1
je 0x406fb2
movzx edx, word [ecx]
add ecx, 2
mov dword [ebp - 0x544], ecx
sub edx, 0x8000
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movsx ebx, ax
mov dword [ebp - 0x554], ebx
test ax, ax
jle 0x4057e1
lea ecx, [ebp - 0x518]
mov dword [ebp + 0xc], esi
xor edi, edi
mov esi, dword [ebp - 0x544]
mov dword [ebp - 0x544], ecx
jmp 0x406da5
movzx eax, word [esi]
shr ax, 1
mov ebx, eax
and bx, 0x3fff
test ah, 0x40
je 0x406dc0
movzx eax, byte [esi + 2]
test al, 1
je 0x406dca
movzx eax, word [esi + 2]
add esi, 4
shr ax, 1
mov edx, str._tqr
cmp ax, 1
je 0x406d50
mov edx, str._tqc
cmp ax, 2
je 0x406d50
mov edx, 0x4166fd
test ax, ax
je 0x406d50
test byte [0x415010], 1
jne 0x40711f
mov edx, 0x4166fd
nop
mov eax, dword [ebp + 8]
movzx ebx, bx
mov eax, dword [eax + 0x28]
imul ebx, dword [eax + 0xa4]
sub ebx, dword [eax + 0xa8]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str._s_tx_d
mov ebx, dword [ebp - 0x544]
mov dword [esp], ebx
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, ebx
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
add edi, 1
cmp dword [ebp - 0x554], edi
je 0x406ff3
movzx ebx, byte [esi]
test bl, 1
jne 0x406cf0
shr bl, 1
add esi, 1
mov edx, 0x4166fd
movzx ebx, bl
jmp 0x406d50
add esi, 2
mov edx, 0x4166fd
jmp 0x406d50
shr al, 1
add esi, 3
movzx eax, al
jmp 0x406d1c
movzx eax, word [ebp - 0x550]
mov dword [esp + 0xc], str.Unsupported_bits__04x__potential_trouble_ahead_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405847
mov ecx, 0xffffffff
test byte [0x415010], 4
je 0x4059d1
mov dword [ebp - 0x554], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unknown_link_type__d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x544]
mov ecx, dword [ebp - 0x554]
movzx ebx, byte [eax]
jmp 0x4059d1
mov ecx, 0xffffffff
jmp 0x4059c2
mov ecx, 0xffffffff
jmp 0x4059d1
mov ecx, dword [ebp - 0x540]
mov esi, ebx
add esi, ecx
mov dword [ebp - 0x568], esi
mov dword [esp + 4], esi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x548]
call dbg.HLPFILE_Uncompress2
jmp 0x4055ed
and ecx, 1
jne 0x40714f
mov eax, dword [ebp + 8]
lea ecx, [edi + 2]
mov edx, dword [eax + 0x28]
mov eax, esi
call sym._HLPFILE_RtfAddGfxByAddr.isra.0
add dword [esi + 0x10], 1
jmp 0x405b30
movsx dx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl edx, 8
add edx, eax
mov eax, dword [ebp + 8]
and ecx, 8
movsx edx, dx
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x544], eax
jne 0x40719d
mov dword [esp + 8], edx
lea edx, [ebp - 0x528]
mov dword [esp], edx
mov dword [esp + 4], str.bm_u
call sym._sprintf
lea eax, [ebp - 0x52c]
lea ecx, [ebp - 0x530]
mov dword [esp], eax
mov eax, dword [ebp - 0x544]
lea edx, [ebp - 0x528]
call dbg.HLPFILE_FindSubFile
test eax, eax
jne 0x4070cc
test byte [0x415010], 4
jne 0x4074bf
add dword [esi + 0x10], 1
jmp 0x405b30
mov esi, dword [ebp - 0x544]
shr dl, 1
movzx edx, dl
add esi, 1
mov dword [ebp - 0x544], esi
jmp 0x4068f8
test byte [0x415010], 4
je 0x4064c5
mov dword [esp + 0xc], str.extra_n
mov dword [esp + 8], str.HLPFILE_BrowsePage
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x4064c5
mov esi, dword [ebp - 0x540]
mov ecx, ebx
mov ebx, dword [ebp - 0x548]
add ecx, esi
mov dword [ebp - 0x568], ecx
mov dword [esp], edx
mov edx, esi
mov dword [esp + 4], ebx
call sym._HLPFILE_Uncompress3.isra.0
jmp 0x4055ed
lea edx, [eax - 0x80]
add dword [ebp - 0x544], 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
jmp 0x406cb9
mov dword [esp + 0xc], str.Unsupported_alignment_0xC00_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405820
mov dword [ebp - 0x544], esi
mov esi, dword [ebp + 0xc]
jmp 0x4057e1
movzx ebx, byte [ebp - 0x570]
mov esi, dword [ebp + 0xc]
mov ecx, 0xffffffff
test byte [0x415010], 4
je 0x406866
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x554], ecx
call sym._wine_dbgstr_an.constprop.0_1
mov dword [esp + 0xc], 0x4164ec
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [ebp - 0x544]
mov ecx, dword [ebp - 0x554]
movzx ebx, byte [eax]
jmp 0x406866
mov dword [ebp - 0x548], edx
mov dword [esp + 0xc], str.Text_size_is_too_long__splitting_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x548]
jmp 0x4055cd
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Got_a_type__d_picture_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x405b30
mov eax, dword [ebp - 0x530]
mov edx, dword [ebp - 0x544]
lea ecx, [eax + 9]
mov eax, esi
call sym._HLPFILE_RtfAddGfxByAddr.isra.0
jmp 0x406f31
mov edx, str.parpard
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
jne 0x405c28
jmp 0x405c4d
mov edx, str.cellintbl_row
mov eax, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
mov eax, dword [esi + 0x10]
add eax, 2
jmp 0x405c2b
movzx eax, ax
mov dword [esp + 0xc], str.Unknown_tab_style__x_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x406d49
movsx ax, byte [edi + 3]
movzx ecx, byte [edi + 2]
shl eax, 8
add eax, ecx
cwde
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x544]
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.does_it_work______x__lu__u_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x406ea3
mov dword [esp + 0x10], edx
mov dword [ebp - 0x550], edx
mov dword [esp + 0xc], str.Loading_picture__d_n
mov dword [esp + 8], str.HLPFILE_RtfAddGfxByIndex
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x550]
jmp 0x406ee2
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x28]
mov dword [esp + 8], 0x7fff
mov eax, dword [ebp - 0x548]
mov dword [esp + 4], eax
movsx ax, byte [esi + 3]
movzx edx, byte [esi + 2]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 6]
movsx ecx, ax
movsx ax, byte [esi + 7]
shl eax, 8
add eax, edx
cwde
sub ecx, eax
mov eax, dword [sym.imp.kernel32.dll_MulDiv]
imul ecx, dword [ebx + 0xa4]
sub ecx, dword [ebx + 0xa8]
mov dword [esp], ecx
mov dword [ebp - 0x588], eax
call eax
mov ecx, dword [ebp + 8]
sub esp, 0xc
mov ebx, eax
mov ecx, dword [ecx + 0x28]
mov dword [esp + 8], 0x7fff
sub ebx, 1
mov edx, dword [ebp - 0x548]
mov dword [esp + 4], edx
movsx ax, byte [esi + 7]
movzx edx, byte [esi + 6]
shl eax, 8
add eax, edx
cwde
imul eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0x588]
call eax
sub esp, 0xc
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x518]
mov dword [esp + 8], eax
mov dword [esp + 4], str._trgaph_d_trleft_d
mov dword [esp], ebx
call sym._sprintf
mov edx, ebx
mov eax, edi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
movsx ax, byte [esi + 7]
movzx edx, byte [esi + 6]
mov dword [ebp + 0xc], edi
shl eax, 8
add edx, eax
shr ax, 0xf
add eax, edx
sar ax, 1
cwde
mov dword [ebp - 0x550], eax
xor eax, eax
mov word [ebp - 0x544], ax
jmp 0x407387
mov eax, dword [ebp - 0x57c]
mov ecx, dword [ebp - 0x570]
movsx ax, byte [eax]
movzx edx, byte [ecx]
mov ecx, dword [ebp - 0x554]
shl eax, 8
add eax, edx
movsx dx, byte [ecx]
movzx ecx, byte [edi]
cwde
shl edx, 8
add edx, ecx
mov ecx, dword [ebp + 8]
movsx edx, dx
add eax, edx
mov edx, dword [ecx + 0x28]
add dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [esp + 8], 0x7fff
mov ecx, dword [ebp - 0x548]
mov dword [esp + 4], ecx
imul eax, dword [edx + 0xa4]
sub eax, dword [edx + 0xa8]
mov dword [esp], eax
mov eax, dword [ebp - 0x588]
call eax
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], str.cellx_d
mov dword [esp], ebx
call sym._sprintf
mov eax, dword [ebp + 0xc]
mov edx, ebx
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
add word [ebp - 0x544], 1
mov ecx, dword [ebp - 0x584]
movzx eax, word [ebp - 0x544]
cmp eax, ecx
jae 0x407540
movsx edx, word [ebp - 0x544]
lea eax, [edx*4]
lea ecx, [esi + eax + 3]
lea edi, [esi + eax + 2]
mov dword [ebp - 0x554], ecx
lea ecx, [esi + eax]
lea eax, [esi + eax + 1]
mov dword [ebp - 0x570], ecx
mov dword [ebp - 0x57c], eax
test byte [0x415010], 8
je 0x4072d5
mov eax, dword [ebp - 0x554]
movzx ecx, byte [edi]
movsx ax, byte [eax]
shl eax, 8
add eax, ecx
cwde
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x57c]
mov ecx, dword [ebp - 0x570]
movsx ax, byte [eax]
movzx ecx, byte [ecx]
shl eax, 8
add eax, ecx
cwde
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x584]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.column__d__d__gap_d_width_d_n
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x4072d5
mov eax, dword [ebp - 0x548]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x584]
mov dword [esp + 0xc], str.New_table:_cols_d_type_x_width_d_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x406960
mov esi, dword [ebp - 0x544]
movzx eax, byte [esi + 2]
movzx edx, byte [esi + 3]
mov byte [ebp - 0x544], al
mov eax, edi
mov byte [ebp - 0x548], dl
mov edx, str._trqc
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
movzx eax, word [ebp - 0x548]
movzx edx, byte [ebp - 0x544]
add esi, 4
shl eax, 8
add eax, edx
cwde
mov dword [ebp - 0x548], eax
jmp 0x406946
mov dword [esp + 0xc], str.no_sub_file_n
mov dword [esp + 8], str.HLPFILE_RtfAddGfxByIndex
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x406f31
movsx ax, byte [esi + 3]
movzx edx, byte [esi + 2]
shl eax, 8
add eax, edx
cwde
mov dword [esp + 0x18], eax
movsx ax, byte [esi + 1]
movzx edx, byte [esi]
shl eax, 8
add eax, edx
cwde
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x584]
mov dword [esp + 0xc], str.column_0__d__gap_d_width_d_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.HLPFILE_BrowseParagraph
mov dword [esp + 4], 0x415010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x40697a
lea eax, [esi + ecx*4]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x544], eax
jmp 0x405664
cmp ecx, 0xffffffff
je 0x407010
jmp 0x406866
mov edx, str._row
mov eax, esi
mov edi, esi
call dbg.HLPFILE_RtfAddControl
test eax, eax
je 0x405c4d
add dword [esi + 0x10], 2
jmp 0x40591f