Function at 0x40bc40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574dfb
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x5d544c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov edi, ecx
mov dword [ebp - 0x88], ebx
call fcn.0040d080
push str.Value
lea esi, [edi + 0x1094]
push str.Property
push ebx
mov ecx, esi
mov dword [ebp - 0xb4], esi
call fcn.004942df
push 1
mov ecx, esi
call fcn.0049439b
push 1
mov ecx, esi
call fcn.0049507d
push 1
push 1
mov ecx, esi
call fcn.004953fb
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x40bd04
push 0x5abd88
lea ecx, [ebp - 0x78]
call fcn.0040d320
push 0
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 1
mov ebx, 1
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov dword [ebp - 0x84], eax
jmp 0x40bd0e
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40bd3f
mov eax, dword [ebp - 0x78]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 3
test edi, edi
je 0x40bdd5
mov ecx, 0xb
xor edx, edx
mov word [ebp - 0xa0], cx
mov word [ebp - 0x98], dx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 4
or ebx, 2
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 5
or ebx, 4
push 0x5abdc4
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push 0x5abd90
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 8
mov dword [ebp - 4], 6
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
jmp 0x40bdd7
xor eax, eax
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x84]
push eax
call fcn.004955a1
mov dword [ebp - 4], 8
test bl, 8
je 0x40be1b
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 4
je 0x40be35
lea ecx, [ebp - 0xb0]
and ebx, 0xfffffffb
push ecx
mov dword [ebp - 0x74], ebx
call edi
mov dword [ebp - 4], 0xffffffff
test bl, 2
je 0x40be50
lea edx, [ebp - 0xa0]
and ebx, 0xfffffffd
push edx
mov dword [ebp - 0x74], ebx
call edi
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0xa
test edi, edi
je 0x40becd
xor eax, eax
push 0x5abe0c
lea ecx, [ebp - 0xa0]
mov word [ebp - 0xa0], ax
call fcn.0049b223
mov byte [ebp - 4], 0xb
or ebx, 0x10
push 0x5abe18
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push str.vQ_NKN
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 0x20
mov dword [ebp - 4], 0xc
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
mov edi, eax
jmp 0x40becf
xor edi, edi
mov dword [ebp - 4], 0xd
test bl, 0x20
je 0x40bf00
mov eax, dword [ebp - 0x80]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bf00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test bl, 0x10
je 0x40bf1f
lea ecx, [ebp - 0xa0]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
push 0x5abe20
mov ecx, edi
call fcn.00492bde
push 1
push 0x5abe24
mov ecx, edi
call fcn.00492bde
push 1
push 0x5abe28
mov ecx, edi
call fcn.00492bde
push 1
push 0x5abe0c
mov ecx, edi
call fcn.00492bde
mov ecx, dword [ebp - 0x84]
push edi
mov dword [edi + 0x64], 0
call fcn.004955a1
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0xf
test edi, edi
je 0x40c020
mov edx, 8
push 0x5abe50
mov word [ebp - 0xa0], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x40bfb6
push 0x8007000e
call fcn.00562420
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x10
or ebx, 0x40
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 0x11
or ebx, 0x80
push 0x5abe58
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push 0x5abe34
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x80]
or ebx, 0x100
mov dword [ebp - 4], 0x12
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
jmp 0x40c022
xor eax, eax
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x84]
push eax
call fcn.004955a1
mov dword [ebp - 4], 0x14
test ebx, 0x100
je 0x40c06c
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c06c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x40c086
lea ecx, [ebp - 0xb0]
and ebx, 0xffffff7f
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x40c0a5
lea edx, [ebp - 0xa0]
and ebx, 0xffffffbf
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x84]
push 1
push 1
push eax
mov ecx, esi
call fcn.00495881
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x16
test edi, edi
je 0x40c101
push 0x5abe60
lea ecx, [ebp - 0x80]
call fcn.0040d320
push 1
push 0
lea ecx, [ebp - 0x80]
or ebx, 0x200
push ecx
mov byte [ebp - 4], 0x17
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov esi, eax
jmp 0x40c103
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200
je 0x40c13a
mov eax, dword [ebp - 0x80]
and ebx, 0xfffffdff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c13a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x19
test edi, edi
je 0x40c1e0
mov ecx, 3
mov word [ebp - 0xa0], cx
mov dword [ebp - 0x98], 0xfa
lea edx, [ebp - 0xa0]
mov byte [ebp - 4], 0x1a
or ebx, 0x400
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 0x1b
or ebx, 0x800
push 0x5abe7c
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push 0x5abe6c
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x78]
or ebx, 0x1000
push ecx
mov dword [ebp - 4], 0x1c
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
mov edi, eax
jmp 0x40c1e2
xor edi, edi
mov dword [ebp - 4], 0x1e
test ebx, 0x1000
je 0x40c219
mov eax, dword [ebp - 0x78]
and ebx, 0xffffefff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c219
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x800
je 0x40c237
lea ecx, [ebp - 0xb0]
and ebx, 0xfffff7ff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400
je 0x40c25c
lea edx, [ebp - 0xa0]
and ebx, 0xfffffbff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x12c
push 0x32
push 1
mov ecx, edi
call fcn.00492c27
push edi
mov ecx, esi
call fcn.004955a1
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x20
test edi, edi
je 0x40c31a
mov eax, 3
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x98], 0x96
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x21
or ebx, 0x2000
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 0x22
or ebx, 0x4000
push 0x5abe94
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push 0x5abe84
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x8000
mov dword [ebp - 4], 0x23
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
mov edi, eax
jmp 0x40c31c
xor edi, edi
mov dword [ebp - 4], 0x25
test ebx, 0x8000
je 0x40c353
mov eax, dword [ebp - 0x78]
and ebx, 0xffff7fff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c353
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x4000
je 0x40c371
lea ecx, [ebp - 0xb0]
and ebx, 0xffffbfff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000
je 0x40c396
lea edx, [ebp - 0xa0]
and ebx, 0xffffdfff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xc8
push 0x32
push 1
mov ecx, edi
call fcn.00492c27
push edi
mov ecx, esi
call fcn.004955a1
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.00495881
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x27
test edi, edi
je 0x40c408
push 0x5abe9c
lea ecx, [ebp - 0x80]
call fcn.0040d320
push 0
push 0
lea eax, [ebp - 0x80]
or ebx, 0x10000
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov esi, eax
jmp 0x40c40a
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x10000
je 0x40c441
mov eax, dword [ebp - 0x80]
and ebx, 0xfffeffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c441
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call fcn.00445bd5
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x70]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x5abea4
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1a4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x2a
test edi, edi
je 0x40c4c4
push 0x5abe9c
lea ecx, [ebp - 0x78]
call fcn.0040d320
push 0xffffffffffffffff
push 0
push 0x5abeb8
push 0x101
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x20000
mov byte [ebp - 4], 0x2b
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a866
jmp 0x40c4c6
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.004955a1
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000
je 0x40c50c
mov eax, dword [ebp - 0x78]
and ebx, 0xfffdffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c50c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x2d
test edi, edi
je 0x40c5b0
mov ecx, 0xb
or edx, 0xffffffff
mov word [ebp - 0xa0], cx
mov word [ebp - 0x98], dx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x2e
or ebx, 0x40000
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 0x2f
or ebx, 0x80000
push 0x5abefc
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push 0x5abecc
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x100000
mov dword [ebp - 4], 0x30
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
jmp 0x40c5b2
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.004955a1
mov dword [ebp - 4], 0x32
test ebx, 0x100000
je 0x40c5f8
mov eax, dword [ebp - 0x78]
and ebx, 0xffefffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c5f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, 0x80000
je 0x40c616
lea ecx, [ebp - 0xb0]
and ebx, 0xfff7ffff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000
je 0x40c63b
lea edx, [ebp - 0xa0]
and ebx, 0xfffbffff
push edx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.00495881
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x34
test edi, edi
je 0x40c695
push 0x5abf0c
lea ecx, [ebp - 0x80]
call fcn.0040d320
push 0
push 0
lea eax, [ebp - 0x80]
or ebx, 0x200000
mov byte [ebp - 4], 0x35
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov esi, eax
jmp 0x40c697
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200000
je 0x40c6ce
mov eax, dword [ebp - 0x80]
and ebx, 0xffdfffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c6ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x37
test edi, edi
je 0x40c74e
xor ecx, ecx
mov word [ebp - 0xa0], cx
push 0x5abd50
lea ecx, [ebp - 0xa0]
call fcn.0049b223
mov byte [ebp - 4], 0x38
or ebx, 0x400000
push 0x5abf14
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x800000
mov dword [ebp - 4], 0x39
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a129
mov edi, eax
jmp 0x40c750
xor edi, edi
mov dword [ebp - 4], 0x3a
test ebx, 0x800000
je 0x40c787
mov eax, dword [ebp - 0x78]
and ebx, 0xff7fffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c787
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400000
je 0x40c7ac
lea ecx, [ebp - 0xa0]
and ebx, 0xffbfffff
push ecx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
mov ecx, edi
call fcn.004935b5
push edi
mov ecx, esi
call fcn.004955a1
push 0x118
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x3c
test edi, edi
je 0x40c81d
push 0x5abf34
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xb8], 0xfec0d2
call fcn.0040d320
push 0
push 0x5abf20
push 0
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0x78]
or ebx, 0x1000000
mov byte [ebp - 4], 0x3d
push eax
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a492
mov edi, eax
jmp 0x40c81f
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x1000000
je 0x40c856
mov eax, dword [ebp - 0x78]
and ebx, 0xfeffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 1
push 0x5abf40
mov ecx, edi
call fcn.00499e0a
push 1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x5abf4c
mov ecx, edi
call fcn.00499dda
push edi
mov ecx, esi
call fcn.004955a1
push pe_nt_image_headers32
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x3f
test edi, edi
je 0x40c905
push 0x5ac810
lea ecx, [ebp - 0x84]
call fcn.0040d320
mov byte [ebp - 4], 0x40
or ebx, 0x2000000
push 0x5abfb4
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0x5abf9c
push 0x5abf58
push 0
push 0x5abfac
lea ecx, [ebp - 0x84]
push ecx
push 1
lea edx, [ebp - 0x78]
or ebx, 0x4000000
mov dword [ebp - 4], 0x41
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a60a
jmp 0x40c907
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.004955a1
mov dword [ebp - 4], 0x42
test ebx, 0x4000000
je 0x40c94d
mov eax, dword [ebp - 0x78]
and ebx, 0xfbffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c94d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x2000000
je 0x40c987
mov eax, dword [ebp - 0x84]
and ebx, 0xfdffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c987
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push pe_nt_image_headers32
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x44
test edi, edi
je 0x40c9f6
push 0x5abfbc
lea ecx, [ebp - 0x84]
call fcn.0040d320
mov byte [ebp - 4], 0x45
or ebx, 0x8000000
push 0x5abfc4
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
call fcn.0040d320
push 0
push 0
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x78]
or ebx, 0x10000000
mov dword [ebp - 4], 0x46
push edx
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.0049a57b
jmp 0x40c9f8
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0x48
call fcn.004955a1
mov dword [ebp - 4], 0x47
test ebx, 0x10000000
je 0x40ca3e
mov eax, dword [ebp - 0x78]
and ebx, 0xefffffff
add eax, 0xfffffff0
mov dword [ebp - 0x74], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ca3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
test ebx, 0x8000000
je 0x40ca75
mov eax, dword [ebp - 0x84]
add eax, 0xfffffff0
and ebx, 0xf7ffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ca75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.00495881
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x49
test edi, edi
je 0x40cad0
push 0x5abfcc
lea ecx, [ebp - 0x80]
call fcn.0040d320
push 0
push 0
lea ecx, [ebp - 0x80]
or ebx, 0x20000000
push ecx
mov byte [ebp - 4], 0x4a
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov dword [ebp - 0x78], eax
jmp 0x40cad7
mov dword [ebp - 0x78], 0
mov dword [ebp - 4], 0xffffffff
test ebx, 0x20000000
je 0x40cb0b
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
and ebx, 0xdfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cb0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x4c
test edi, edi
je 0x40cb5b
push 0x5abfd8
lea ecx, [ebp - 0x8c]
call fcn.0040d320
push 0
push 0
lea ecx, [ebp - 0x8c]
or ebx, 0x40000000
push ecx
mov byte [ebp - 4], 0x4d
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov esi, eax
jmp 0x40cb5d
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test ebx, 0x40000000
je 0x40cb94
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
and ebx, 0xbfffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cb94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x78]
push esi
call fcn.004955a1
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x4f
test edi, edi
je 0x40cbf1
push 0x5abfe4
lea ecx, [ebp - 0xb8]
call fcn.0040d320
push 0
push 0
lea ecx, [ebp - 0xb8]
or ebx, 0x80000000
push ecx
mov byte [ebp - 4], 0x50
mov ecx, edi
mov dword [ebp - 0x74], ebx
call fcn.00495a97
mov dword [ebp - 0x84], eax
jmp 0x40cbfb
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
jns 0x40cc28
mov eax, dword [ebp - 0xb8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cc28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x84]
push ecx
mov ecx, esi
call fcn.004955a1
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x52
test edi, edi
je 0x40ccf9
mov edx, 8
push 0x5abffc
mov word [ebp - 0xa0], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x40cc82
push 0x8007000e
call fcn.00562420
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], 1
call fcn.0049ae5b
mov dword [ebp - 4], 0x54
push 0x5ac004
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], 3
call fcn.0040d320
push 0
push 0
push 0
push 0
push str.dk:N
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x8c]
mov dword [ebp - 4], 0x55
mov ebx, 7
push edx
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.0049a129
jmp 0x40cd01
mov ebx, dword [ebp - 0x88]
xor eax, eax
mov dword [ebp - 4], 0x58
mov ecx, dword [ebp - 0x84]
push eax
call fcn.004955a1
mov dword [ebp - 4], 0x57
test bl, 4
je 0x40cd4b
mov eax, dword [ebp - 0x8c]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test bl, 2
je 0x40cd68
lea ecx, [ebp - 0xb0]
and ebx, 0xfffffffd
push ecx
mov dword [ebp - 0x88], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x40cd86
lea edx, [ebp - 0xa0]
and ebx, 0xfffffffe
push edx
mov dword [ebp - 0x88], ebx
call esi
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0x59
test edi, edi
je 0x40ce45
mov eax, 8
push 0x5ac00c
mov word [ebp - 0xa0], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x40cdd2
push 0x8007000e
call fcn.00562420
lea ecx, [ebp - 0xa0]
push ecx
mov byte [ebp - 4], 0x5a
or ebx, 8
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 0x5b
or ebx, 0x10
push 0x5ac014
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push str.dk:N
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x8c]
or ebx, 0x20
mov dword [ebp - 4], 0x5c
push eax
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.0049a129
jmp 0x40ce47
xor eax, eax
mov dword [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x84]
push eax
call fcn.004955a1
mov dword [ebp - 4], 0x5e
test bl, 0x20
je 0x40ce91
mov eax, dword [ebp - 0x8c]
and ebx, 0xffffffdf
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 0x10
je 0x40cea8
lea ecx, [ebp - 0xb0]
and ebx, 0xffffffef
push ecx
mov dword [ebp - 0x88], ebx
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x40cec6
lea edx, [ebp - 0xa0]
and ebx, 0xfffffff7
push edx
mov dword [ebp - 0x88], ebx
call esi
push 0xe4
call fcn.0040e1ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x8c], edi
mov dword [ebp - 4], 0x60
test edi, edi
je 0x40cf88
mov eax, 8
push 0x5ac01c
mov word [ebp - 0xc8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xc0], eax
test eax, eax
jne 0x40cf15
push 0x8007000e
call fcn.00562420
lea ecx, [ebp - 0xc8]
push ecx
mov byte [ebp - 4], 0x61
or ebx, 0x40
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x88], ebx
call fcn.0049ae5b
mov dword [ebp - 4], 0x62
or ebx, 0x80
push 0x5ac024
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x88], ebx
call fcn.0040d320
push 0
push 0
push 0
push 0
push str.dk:N
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0x7c]
or ebx, 0x100
mov dword [ebp - 4], 0x63
push eax
mov ecx, edi
mov dword [ebp - 0x88], ebx
call fcn.0049a129
jmp 0x40cf8a
xor eax, eax
mov dword [ebp - 4], 0x66
mov ecx, dword [ebp - 0x84]
push eax
call fcn.004955a1
mov dword [ebp - 4], 0x65
test ebx, 0x100
je 0x40cfd7
mov eax, dword [ebp - 0x7c]
and ebx, 0xfffffeff
add eax, 0xfffffff0
mov dword [ebp - 0x88], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cfd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jns 0x40cfea
lea ecx, [ebp - 0xd8]
push ecx
and ebx, 0xffffff7f
call esi
mov dword [ebp - 4], 0xffffffff
test bl, 0x40
je 0x40cfff
lea edx, [ebp - 0xc8]
push edx
call esi
mov esi, dword [ebp - 0x78]
push 0
mov ecx, esi
call fcn.004933db
mov ecx, dword [ebp - 0xb4]
push 1
push 1
push esi
call fcn.00495881
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054aaae
mov esp, ebp
pop ebp
ret