Function at 0x40fc50
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x57eb77
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x5e14a4]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e14a4]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x14], ebx
mov edi, ecx
mov dword [esp + 0x24], ebp
call fcn.00411190
push str.Value
add edi, 0x1094
push str.Property
push ebp
mov ecx, edi
mov dword [esp + 0x4c], edi
call fcn.004a3284
push 1
mov ecx, edi
call fcn.004a3340
push 1
mov ecx, edi
call fcn.004a4022
push 1
push 1
mov ecx, edi
call fcn.004a43a0
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], ebp
cmp esi, ebp
je 0x40fd26
push 0x5b4488
lea ecx, [esp + 0x1c]
call fcn.00411430
push ebp
push ebp
lea eax, [esp + 0x20]
mov byte [esp + 0xe8], 1
mov ebx, 1
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov edi, eax
jmp 0x40fd28
xor edi, edi
mov dword [esp + 0xe0], 0xffffffff
test bl, 1
je 0x40fd5f
mov eax, dword [esp + 0x18]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fd5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 3
cmp esi, ebp
je 0x40fdfd
mov ecx, 0xb
xor edx, edx
mov word [esp + 0x2c], cx
mov word [esp + 0x34], dx
lea eax, [esp + 0x2c]
mov byte [esp + 0xe0], 4
or ebx, 2
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 5
or ebx, 4
push 0x5b44c4
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push 0x5b4490
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x34]
or ebx, 8
mov dword [esp + 0xf8], 6
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
jmp 0x40fdff
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xe4], 9
call fcn.004a4573
mov dword [esp + 0xe0], 8
test bl, 8
je 0x40fe49
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fe49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x40fe62
lea ecx, [esp + 0x44]
and ebx, 0xfffffffb
push ecx
mov dword [esp + 0x18], ebx
call esi
mov dword [esp + 0xe0], 0xffffffff
test bl, 2
je 0x40fe80
lea edx, [esp + 0x2c]
and ebx, 0xfffffffd
push edx
mov dword [esp + 0x18], ebx
call esi
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0xa
cmp esi, ebp
je 0x40ff04
xor eax, eax
push 0x5b450c
lea ecx, [esp + 0x30]
mov word [esp + 0x30], ax
call fcn.004aa187
mov byte [esp + 0xe0], 0xb
or ebx, 0x10
push 0x5b4518
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push str.vQ_NKN
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x34]
or ebx, 0x20
mov dword [esp + 0xf8], 0xc
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
mov esi, eax
jmp 0x40ff06
xor esi, esi
mov dword [esp + 0xe0], 0xd
test bl, 0x20
je 0x40ff3d
mov eax, dword [esp + 0x1c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xe0], 0xffffffff
test bl, 0x10
je 0x40ff5f
lea ecx, [esp + 0x2c]
and ebx, 0xffffffef
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
push 0x5b4520
mov ecx, esi
call fcn.004a1bc4
push 1
push 0x5b4524
mov ecx, esi
call fcn.004a1bc4
push 1
push 0x5b4528
mov ecx, esi
call fcn.004a1bc4
push 1
push 0x5b4534
mov ecx, esi
call fcn.004a1bc4
push esi
mov ecx, edi
mov dword [esi + 0x64], ebp
call fcn.004a4573
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0xf
cmp esi, ebp
je 0x410060
mov edx, 8
push 0x5b455c
mov word [esp + 0x30], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x34], eax
cmp eax, ebp
jne 0x40ffef
push 0x8007000e
call fcn.0056b320
lea eax, [esp + 0x2c]
mov byte [esp + 0xe0], 0x10
or ebx, 0x40
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x11
or ebx, 0x80
push 0x5b4564
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push 0x5b4540
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x34]
or ebx, 0x100
mov dword [esp + 0xf8], 0x12
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
jmp 0x410062
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xe4], 0x15
call fcn.004a4573
mov dword [esp + 0xe0], 0x14
test ebx, 0x100
je 0x4100b2
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4100b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x4100cb
lea ecx, [esp + 0x44]
and ebx, 0xffffff7f
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xe0], 0xffffffff
test bl, 0x40
je 0x4100ed
lea edx, [esp + 0x2c]
and ebx, 0xffffffbf
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.004a4853
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x16
cmp esi, ebp
je 0x410150
push 0x5b456c
lea ecx, [esp + 0x20]
call fcn.00411430
push 1
push ebp
lea eax, [esp + 0x24]
or ebx, 0x200
mov byte [esp + 0xe8], 0x17
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov edi, eax
jmp 0x410152
xor edi, edi
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x200
je 0x41018f
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffdff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41018f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x19
cmp esi, ebp
je 0x41023d
mov ecx, 3
mov word [esp + 0x2c], cx
mov dword [esp + 0x34], 0xfa
lea edx, [esp + 0x2c]
mov byte [esp + 0xe0], 0x1a
or ebx, 0x400
push edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x1b
or ebx, 0x800
push 0x5b4588
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push 0x5b4578
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x30]
or ebx, 0x1000
push ecx
mov dword [esp + 0xfc], 0x1c
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
mov esi, eax
jmp 0x41023f
xor esi, esi
mov dword [esp + 0xe0], 0x1e
test ebx, 0x1000
je 0x41027c
mov eax, dword [esp + 0x18]
and ebx, 0xffffefff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41027c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x800
je 0x410299
lea ecx, [esp + 0x44]
and ebx, 0xfffff7ff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x400
je 0x4102c1
lea edx, [esp + 0x2c]
and ebx, 0xfffffbff
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x12c
push 0x32
push 1
mov ecx, esi
call fcn.004a1c0d
push esi
mov ecx, edi
call fcn.004a4573
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x20
cmp esi, ebp
je 0x410387
mov eax, 3
mov word [esp + 0x2c], ax
mov dword [esp + 0x34], 0x96
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0xe4], 0x21
or ebx, 0x2000
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x22
or ebx, 0x4000
push 0x5b45a0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push 0x5b4590
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x30]
or ebx, 0x8000
mov dword [esp + 0xf8], 0x23
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
mov esi, eax
jmp 0x410389
xor esi, esi
mov dword [esp + 0xe0], 0x25
test ebx, 0x8000
je 0x4103c6
mov eax, dword [esp + 0x18]
and ebx, 0xffff7fff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4103c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x4000
je 0x4103e3
lea ecx, [esp + 0x44]
and ebx, 0xffffbfff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x2000
je 0x41040b
lea edx, [esp + 0x2c]
and ebx, 0xffffdfff
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, esi
call fcn.004a1c0d
push esi
mov ecx, edi
call fcn.004a4573
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.004a4853
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x27
cmp esi, ebp
je 0x410485
push 0x5b45a8
lea ecx, [esp + 0x20]
call fcn.00411430
push ebp
push ebp
lea eax, [esp + 0x24]
or ebx, 0x10000
mov byte [esp + 0xe8], 0x28
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov edi, eax
jmp 0x410487
xor edi, edi
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x10000
je 0x4104c4
mov eax, dword [esp + 0x1c]
and ebx, 0xfffeffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4104c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.0044912a
mov edx, dword [eax + 4]
lea ecx, [esp + 0x74]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x5b45b0
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1a4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x2a
cmp esi, ebp
je 0x41055b
push 0x5b45d8
lea ecx, [esp + 0x1c]
call fcn.00411430
push 0xffffffffffffffff
push ebp
push 0x5b45c4
push 0x101
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x2c]
or ebx, 0x20000
mov byte [esp + 0xf4], 0x2b
push edx
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.004a9838
jmp 0x41055d
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xe4], 0x2c
call fcn.004a4573
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x20000
je 0x4105ad
mov eax, dword [esp + 0x18]
and ebx, 0xfffdffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4105ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x2d
cmp esi, ebp
je 0x410659
mov ecx, 0xb
or edx, 0xffffffff
mov word [esp + 0x2c], cx
mov word [esp + 0x34], dx
lea eax, [esp + 0x2c]
mov byte [esp + 0xe0], 0x2e
or ebx, 0x40000
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x2f
or ebx, 0x80000
push 0x5b4610
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push 0x5b45e0
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x30]
or ebx, 0x100000
mov dword [esp + 0xf8], 0x30
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
jmp 0x41065b
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xe4], 0x33
call fcn.004a4573
mov dword [esp + 0xe0], 0x32
test ebx, 0x100000
je 0x4106ab
mov eax, dword [esp + 0x18]
and ebx, 0xffefffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x80000
je 0x4106c8
lea ecx, [esp + 0x44]
and ebx, 0xfff7ffff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x40000
je 0x4106f0
lea edx, [esp + 0x2c]
and ebx, 0xfffbffff
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.004a4853
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x34
cmp esi, ebp
je 0x410752
push 0x5b4620
lea ecx, [esp + 0x20]
call fcn.00411430
push ebp
push ebp
lea eax, [esp + 0x24]
or ebx, 0x200000
mov byte [esp + 0xe8], 0x35
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov edi, eax
jmp 0x410754
xor edi, edi
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x200000
je 0x410791
mov eax, dword [esp + 0x1c]
and ebx, 0xffdfffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410791
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x37
cmp esi, ebp
je 0x410817
xor ecx, ecx
mov word [esp + 0x2c], cx
push 0x5b4628
lea ecx, [esp + 0x30]
call fcn.004aa187
mov byte [esp + 0xe0], 0x38
or ebx, 0x400000
push 0x5b4634
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x30]
or ebx, 0x800000
mov dword [esp + 0xf8], 0x39
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.004a90fb
mov esi, eax
jmp 0x410819
xor esi, esi
mov dword [esp + 0xe0], 0x3a
test ebx, 0x800000
je 0x410856
mov eax, dword [esp + 0x18]
and ebx, 0xff7fffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x400000
je 0x41087e
lea ecx, [esp + 0x2c]
and ebx, 0xffbfffff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ebp
mov ecx, esi
call fcn.004a254f
push esi
mov ecx, edi
call fcn.004a4573
push 0x118
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xe0], 0x3c
cmp esi, ebp
je 0x4108f4
push 0x5b4654
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], 0xfec0d2
call fcn.00411430
push ebp
push 0x5b4640
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
or ebx, 0x1000000
mov byte [esp + 0xf0], 0x3d
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.004a9464
mov esi, eax
jmp 0x4108f6
xor esi, esi
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x1000000
je 0x410933
mov eax, dword [esp + 0x18]
and ebx, 0xfeffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410933
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 1
push 0x5b4660
mov ecx, esi
call fcn.004a8ddc
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x5b466c
mov ecx, esi
call fcn.004a8dac
push esi
mov ecx, edi
call fcn.004a4573
push 0xf8
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x3f
cmp esi, ebp
je 0x4109ed
push 0x5b468c
lea ecx, [esp + 0x2c]
call fcn.00411430
mov byte [esp + 0xe0], 0x40
or ebx, 0x2000000
push 0x5b4690
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push 0x5b4674
push 0x5b7e10
push ebp
push 0x5b4684
lea ecx, [esp + 0x3c]
push ecx
push 1
lea edx, [esp + 0x34]
or ebx, 0x4000000
mov dword [esp + 0xfc], 0x41
push edx
mov ecx, esi
mov dword [esp + 0x34], ebx
call fcn.004a95dc
jmp 0x4109ef
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xe4], 0x43
call fcn.004a4573
mov dword [esp + 0xe0], 0x42
test ebx, 0x4000000
je 0x410a3f
mov eax, dword [esp + 0x18]
and ebx, 0xfbffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x2000000
je 0x410a7c
mov eax, dword [esp + 0x28]
and ebx, 0xfdffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf8
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x44
cmp esi, ebp
je 0x410af6
push 0x5b4698
lea ecx, [esp + 0x1c]
call fcn.00411430
mov byte [esp + 0xe0], 0x45
or ebx, 0x8000000
push 0x5b46a0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], ebx
call fcn.00411430
push ebp
push ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
or ebx, 0x10000000
mov dword [esp + 0xec], 0x46
push edx
mov ecx, esi
mov dword [esp + 0x24], ebx
call fcn.004a954d
jmp 0x410af8
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0xe4], 0x48
call fcn.004a4573
mov dword [esp + 0xe0], 0x47
test ebx, 0x10000000
je 0x410b48
mov eax, dword [esp + 0x28]
and ebx, 0xefffffff
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410b48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x8000000
je 0x410b81
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
and ebx, 0xf7ffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410b81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push 1
push 1
push edi
call fcn.004a4853
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0xe0], 0x49
cmp esi, ebp
je 0x410be9
push str.B_k
lea ecx, [esp + 0x2c]
call fcn.00411430
push 0
push 0
lea ecx, [esp + 0x30]
or ebx, 0x20000000
push ecx
mov byte [esp + 0xec], 0x4a
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov ebp, eax
mov dword [esp + 0x20], eax
jmp 0x410bef
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x20000000
je 0x410c28
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
and ebx, 0xdfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410c28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xe0], 0x4c
test esi, esi
je 0x410c7e
push 0x5b46b4
lea ecx, [esp + 0x20]
call fcn.00411430
push 0
push 0
lea ecx, [esp + 0x24]
or ebx, 0x40000000
push ecx
mov byte [esp + 0xec], 0x4d
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov edi, eax
jmp 0x410c80
xor edi, edi
mov dword [esp + 0xe0], 0xffffffff
test ebx, 0x40000000
je 0x410cb9
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
and ebx, 0xbfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410cb9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
mov ecx, ebp
call fcn.004a4573
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xe0], 0x4f
test esi, esi
je 0x410d17
push 0x5b46c0
lea ecx, [esp + 0x1c]
call fcn.00411430
push 0
push 0
lea ecx, [esp + 0x20]
or ebx, 0x80000000
push ecx
mov byte [esp + 0xec], 0x50
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004a4a69
mov ebp, eax
jmp 0x410d19
xor ebp, ebp
mov dword [esp + 0xe0], 0xffffffff
test ebx, ebx
jns 0x410d48
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410d48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
mov ecx, edi
call fcn.004a4573
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xe0], 0x52
test esi, esi
je 0x410e10
mov ecx, 8
push 0x5b46d8
mov word [esp + 0x30], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x410d9d
push 0x8007000e
call fcn.0056b320
lea edx, [esp + 0x2c]
mov byte [esp + 0xe0], 0x53
push edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], 1
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x54
push 0x5b46e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 3
call fcn.00411430
push 0
push 0
push 0
push 0
push 0x5b46cc
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0xfc], 0x55
mov ebx, 7
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.004a90fb
jmp 0x410e16
mov ebx, dword [esp + 0x24]
xor eax, eax
push eax
mov ecx, ebp
mov dword [esp + 0xe4], 0x58
call fcn.004a4573
mov dword [esp + 0xe0], 0x57
test bl, 4
je 0x410e60
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [esp + 0x24], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410e60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x410e79
lea ecx, [esp + 0x44]
and ebx, 0xfffffffd
push ecx
mov dword [esp + 0x28], ebx
call edi
mov dword [esp + 0xe0], 0xffffffff
test bl, 1
je 0x410e97
lea edx, [esp + 0x2c]
and ebx, 0xfffffffe
push edx
mov dword [esp + 0x28], ebx
call edi
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
mov dword [esp + 0xe0], 0x59
test esi, esi
je 0x410f53
mov eax, 8
push 0x5b46f4
mov word [esp + 0x30], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x410ee4
push 0x8007000e
call fcn.0056b320
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0xe4], 0x5a
or ebx, 8
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x5b
or ebx, 0x10
push 0x5b46fc
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], ebx
call fcn.00411430
push 0
push 0
push 0
push 0
push 0x5b46e8
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x34]
or ebx, 0x20
mov dword [esp + 0xf8], 0x5c
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.004a90fb
jmp 0x410f55
xor eax, eax
push eax
mov ecx, ebp
mov dword [esp + 0xe4], 0x5f
call fcn.004a4573
mov dword [esp + 0xe0], 0x5e
test bl, 0x20
je 0x410f9f
mov eax, dword [esp + 0x1c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [esp + 0x24], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410f9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 0x10
je 0x410fb2
lea ecx, [esp + 0x44]
and ebx, 0xffffffef
push ecx
mov dword [esp + 0x28], ebx
call edi
mov dword [esp + 0xe0], 0xffffffff
test bl, 8
je 0x410fd0
lea edx, [esp + 0x2c]
and ebx, 0xfffffff7
push edx
mov dword [esp + 0x28], ebx
call edi
push 0xe4
call fcn.0041165a
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0xe0], 0x60
test esi, esi
je 0x411092
mov eax, 8
push 0x5b4710
mov word [esp + 0x58], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x5c], eax
test eax, eax
jne 0x41101d
push 0x8007000e
call fcn.0056b320
lea ecx, [esp + 0x54]
push ecx
mov byte [esp + 0xe4], 0x61
or ebx, 0x40
lea ecx, [esp + 0x68]
mov dword [esp + 0x28], ebx
call fcn.004a9dfe
mov dword [esp + 0xe0], 0x62
or ebx, 0x80
push 0x5b4718
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], ebx
call fcn.00411430
push 0
push 0
push 0
push 0
push str.dk:N
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x54]
or ebx, 0x100
mov dword [esp + 0xf8], 0x63
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.004a90fb
jmp 0x411094
xor eax, eax
push eax
mov ecx, ebp
mov dword [esp + 0xe4], 0x66
call fcn.004a4573
mov dword [esp + 0xe0], 0x65
test ebx, 0x100
je 0x4110e4
mov eax, dword [esp + 0x3c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [esp + 0x24], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4110e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x4110f5
lea ecx, [esp + 0x64]
push ecx
and ebx, 0xffffff7f
call edi
mov dword [esp + 0xe0], 0xffffffff
test bl, 0x40
je 0x41110c
lea edx, [esp + 0x54]
push edx
call edi
mov esi, dword [esp + 0x20]
push 0
mov ecx, esi
call fcn.004a2375
mov ecx, dword [esp + 0x40]
push 1
push 1
push esi
call fcn.004a4853
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0054df46
add esp, 0xd0
ret