Function at 0x50156e1a
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x620
push ebx
push esi
mov esi, dword [ebp + 0x70]
push edi
xor edi, edi
xor ebx, ebx
inc edi
mov eax, 0x14b
cmp esi, eax
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x5c], edi
ja 0x50157428
je case.0x50156e5e.226
lea eax, [esi - 0xf]
cmp eax, 0x13a
ja case.0x50157dcc.988
movzx eax, byte [eax + 0x50158511]
jmp dword [eax*4 + 0x5015845d]
push ebx
push 1
call fcn.50062782
mov ecx, eax
call fcn.50272bbe
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl case.0x50157464.338
jmp 0x50157485
call fcn.50062782
push ebx
push 0xffffffffffffffff
mov edi, eax
push ebx
mov dword [edi + 0x64], ebx
mov eax, dword [0x5028f95c]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x38]
cmp dword [edi + 0x64], ebx
mov dword [ebp + 0x64], eax
jne 0x50156eae
mov ecx, edi
call fcn.50272bbe
cmp dword [ebp + 0x64], ebx
mov dword [edi + 0x64], ebx
jmp 0x50157413
mov esi, dword [0x5028f95c]
call fcn.50062782
mov eax, dword [eax + 0x528]
mov ecx, dword [esi]
push eax
push 0xffffffffffffffff
push ebx
push 0x20000002
push esi
call dword [ecx + 0x38]
jmp 0x5015740e
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 1
call fcn.50272bbe
jmp 0x5015803a
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.50272bbe
jmp 0x5015803a
push ebx
push ebx
push 0x11
push dword [0x5029a6e4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je case.0x50157dcc.988
push ebx
push ebx
push 0x10
push dword [0x5028e668]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5015843e
push dword [ebp + 0x7c]
mov dword [0x5029692c], 0xdd
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push ebx
call fcn.50272bbe
jmp 0x50156f6a
push dword [ebp + 0x7c]
mov dword [0x5029692c], 0xde
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push esi
call fcn.50272bbe
mov dword [ebp + 0x64], eax
mov dword [0x5029692c], ebx
jmp case.0x50157464.338
call fcn.50272bbe
jmp 0x5015803a
cmp dword [ebp + 0x78], ebx
mov edi, dword [ebp + 0x7c]
jne 0x50156fc2
cmp edi, ebx
je 0x50156fc2
mov eax, dword [ebp + 0x74]
cmp ax, 3
jne 0x50156fc2
shr eax, 0x10
cmp ax, 1
jne 0x50156fc2
cmp esi, 0x61
mov word [edi], 8
je 0x50156fb7
cmp esi, 0x115
mov eax, 0x50017bbc
jne 0x50156fbc
mov eax, 0x50015cdc
push eax
jmp 0x50157a4e
push edi
push dword [ebp + 0x78]
push esi
call fcn.50272bbe
jmp 0x5015803a
cmp dword [ebp + 0x78], ebx
jne case.0x50157464.338
cmp dword [ebp + 0x7c], ebx
jne case.0x50157464.338
mov ecx, dword [0x5029a8bc]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], ebx
call fcn.501ade41
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl 0x501570ab
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x501570ab
lea edx, [ebp + 0x7c]
push edx
mov dword [ebp + 0x7c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl 0x501570a3
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x501570a3
xor eax, eax
lea edi, [ebp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi - 0x89]
cmp eax, ebx
je 0x5015704b
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x10]
test eax, eax
jl 0x501570a3
mov ecx, dword [ebp + 0x7c]
mov eax, dword [ecx]
push ebx
lea edx, [ebp + 0x1c]
push edx
push 1
push ecx
call dword [eax + 0xc]
cmp eax, ebx
mov dword [ebp + 0x64], eax
jne 0x501570a3
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp + 0x1c]
push ebx
lea edx, [ebp + 0x38]
push edx
push ebx
mov dword [ebp + 0x40], eax
mov eax, dword [0x5029a8bc]
push 0x89
mov word [ebp + 0x38], 3
mov eax, dword [eax + 0x2b8]
mov ecx, dword [eax]
push 0x50002390
push eax
call dword [ecx + 0x10]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp + 0x7c]
call fcn.501e21ba
lea ecx, [ebp + 0x78]
call fcn.501e21ba
jmp case.0x50157464.338
call fcn.500c253a
jmp case.0x50157464.338
push ebx
push 1
call fcn.50272bbe
jmp case.0x50157464.338
call fcn.50272bbe
jmp case.0x50157464.338
call fcn.5004ac6a
jmp case.0x50157464.338
push 0x50002070
push 0x500022c0
jmp 0x501570f9
push 0x50002040
push 0x500022d0
call fcn.50272bbe
jmp case.0x50157464.338
push 1
call fcn.5017b73d
jmp case.0x50157464.338
call fcn.5016db52
jmp case.0x50157464.338
call fcn.5004cabb
mov ecx, eax
call fcn.50272bbe
jmp case.0x50157464.338
push 0x50001f20
call fcn.50272bbe
jmp 0x5015803a
push 0x50001de0
jmp 0x5015712f
mov eax, dword [0x502898b8]
or eax, dword [0x5028e670]
jne case.0x50157464.338
push ebx
push ebx
push 0x227
jmp 0x501571c1
cmp dword [0x502898b8], ebx
je 0x50157174
push ebx
call fcn.50113ee1
test eax, eax
je case.0x50157464.338
push 1
jmp 0x5015719c
cmp dword [0x5028e670], ebx
jne case.0x50157464.338
push ebx
push 1
jmp 0x501571bc
cmp dword [0x502898b8], ebx
je 0x501571ae
push ebx
call fcn.50113ee1
test eax, eax
je case.0x50157464.338
push ebx
push ebx
call fcn.50113ee1
mov ecx, eax
call fcn.50115034
jmp case.0x50157464.338
cmp dword [0x5028e670], ebx
jne case.0x50157464.338
push ebx
push ebx
push 0x226
push dword [0x5029a6e8]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x50157464.338
call fcn.501b7afd
jmp case.0x50157464.338
call fcn.50272bbe
jmp case.0x50157464.338
lea eax, [ebp + 0x70]
push eax
mov eax, 0x5002bb04
push eax
push eax
mov dword [ebp + 0x70], ebx
call fcn.501a5bb0
cmp dword [ebp + 0x70], ebx
je 0x501572ec
lea eax, [ebp + 0x78]
push eax
mov eax, 0x5002a2c4
push eax
push eax
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x78], ebx
call fcn.501a5bb0
cmp dword [ebp + 0x78], ebx
je 0x50157299
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp + 0x78]
mov ecx, dword [eax]
lea edx, [ebp + 0x38]
push edx
push 0xffffdcd6
push eax
call dword [ecx + 0x10]
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl 0x5015728f
cmp word [ebp + 0x38], 8
jne 0x5015728f
push dword [ebp + 0x40]
lea ecx, [ebp + 0x74]
call fcn.500595e9
push 0x50017bb0
lea ecx, [ebp + 0x74]
call fcn.5007185e
push 0x20019
push dword [ebp + 0x74]
lea ecx, [ebp + 0x60]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.50272bbe
test eax, eax
jl 0x5015728f
lea eax, [ebp + 0x7c]
push eax
push 0x50017b98
lea ecx, [ebp + 0x60]
call fcn.50272bbe
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp + 0x7c]
call fcn.50046265
test eax, eax
jne 0x501572b2
push 0x50017b5c
lea ecx, [ebp + 0x7c]
call fcn.500595e9
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
push ebx
push 0x50001f20
push 0x411
push eax
call dword [ecx + 0xc]
lea ecx, [ebp + 0x78]
call fcn.501e21ba
lea ecx, [ebp + 0x60]
call fcn.50085374
push dword [ebp + 0x7c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [ebp + 0x74]
call edi
lea ecx, [ebp + 0x70]
jmp 0x50157e4d
push ebx
push ebx
push ebx
call fcn.500b19cf
jmp case.0x50157464.338
call fcn.50272bbe
jmp case.0x50157464.338
push esi
call fcn.50090a5a
jmp case.0x50157464.338
call fcn.5008e5e9
jmp case.0x50157464.338
call fcn.50272bbe
mov byte [0x50296928], al
call fcn.50154df1
mov byte [0x50296928], bl
jmp case.0x50157464.338
mov eax, 0x80004001
jmp 0x5015844d
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x5015738b
cmp word [eax], 8
jne 0x5015738b
mov edi, dword [eax + 8]
mov eax, edi
shr eax, 0x10
test ax, ax
je 0x5015737e
push edi
call fcn.5003ea47
lea eax, [eax + eax + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov eax, esp
push edi
push eax
call fcn.5024c79e
jmp 0x50157380
mov eax, edi
push eax
call fcn.500ba810
jmp case.0x50157464.338
mov esi, dword [ebp + 0x7c]
cmp esi, ebx
je case.0x50157464.338
cmp dword [ebp + 0x74], ebx
jne case.0x50157464.338
cmp word [esi], 8
jne case.0x50157464.338
push 0x3f
xor eax, eax
mov byte [ebp - 0x198], bl
pop ecx
lea edi, [ebp - 0x197]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x198]
push eax
call fcn.50272bbe
lea eax, [ebp - 0x198]
push eax
call fcn.50272bbe
jmp 0x50157afe
cmp dword [ebp + 0x74], ebx
jne case.0x50157464.338
mov esi, dword [ebp + 0x7c]
cmp word [esi], 0x2000
jne case.0x50157464.338
call fcn.50272bbe
jmp 0x50157afe
xor eax, eax
cmp esi, 0xe2
sete al
push eax
call fcn.500bf964
mov dword [ebp + 0x64], eax
cmp eax, ebx
jl case.0x50157464.338
push 0x37bc
call fcn.50272bbe
jmp case.0x50157464.338
mov eax, 0x2ac
cmp esi, eax
ja 0x501579a5
je 0x5015788c
mov eax, 0x1ac
cmp esi, eax
ja 0x501575b0
je 0x50157563
lea eax, [esi - 0x151]
cmp eax, 0x4e
ja case.0x50157dcc.988
movzx eax, byte [eax + 0x50158680]
jmp dword [eax*4 + 0x5015864c]
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push esi
call fcn.50272bbe
cmp eax, ebx
mov dword [ebp + 0x64], eax
jne case.0x50157464.338
call fcn.50272bbe
jmp case.0x50157464.338
call fcn.50272bbe
jmp 0x5015803a
call fcn.50272bbe
jmp 0x5015803a
push ebx
push 0x5015509f
push 0x1326
push dword [0x5029a6d4]
call fcn.50272bbe
jmp case.0x50157464.338
call fcn.500f4579
test eax, eax
jne case.0x50156e5e.232
push ebx
call fcn.500b31a9
jmp case.0x50157464.338
lea ecx, [ebp + 0x40]
call fcn.5004632e
push 0xffffffffffffffff
call fcn.500f8b49
cmp eax, ebx
jge 0x501574f0
push eax
call fcn.50069672
call fcn.500f7a49
push 0xffffffffffffffff
lea ecx, [ebp + 0x40]
call fcn.50042ed1
jmp case.0x50157464.338
call fcn.5012dae4
jmp case.0x50157464.338
cmp dword [0x502898b8], ebx
je case.0x50157464.338
push ebx
call fcn.50113ee1
test eax, eax
je case.0x50157464.338
push esi
push ebx
call fcn.50113ee1
mov ecx, eax
call fcn.5011507a
jmp case.0x50157464.338
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.50272bbe
jmp 0x5015803a
mov dword [0x50293eac], 1
jmp case.0x50157464.338
mov dword [0x50293eac], ebx
jmp case.0x50157464.338
mov eax, dword [ebp + 0x78]
cmp eax, ebx
jne 0x50157599
mov edi, dword [ebp + 0x7c]
cmp edi, ebx
je case.0x50157dcc.988
mov eax, dword [ebp + 0x74]
cmp ax, 3
jne case.0x50157dcc.988
shr eax, 0x10
cmp ax, 1
jne case.0x50157dcc.988
push 0x50017b50
jmp 0x50157a49
cmp word [eax], 8
jne case.0x50157dcc.988
push dword [eax + 8]
call fcn.50272bbe
jmp case.0x50157464.338
mov eax, 0x255
cmp esi, eax
ja 0x50157745
je 0x5015773a
mov eax, 0x1c2
cmp esi, eax
ja 0x5015760c
je 0x50157602
cmp esi, 0x1ad
je case.0x50157464.337
cmp esi, 0x1af
je 0x50157a73
cmp esi, 0x1b0
jbe case.0x50157dcc.988
cmp esi, 0x1b2
ja case.0x50157dcc.988
push dword [ebp + 0x7c]
jmp 0x50156fc3
call fcn.50272bbe
jmp 0x5015803a
cmp esi, 0x1c3
je 0x50157730
cmp esi, 0x239
jbe case.0x50157dcc.988
cmp esi, 0x251
jbe 0x50157650
cmp esi, 0x253
jne case.0x50157dcc.988
push ebx
push 0x501aa31d
push 0xfd9
push dword [0x5029a6d4]
call fcn.50272bbe
jmp 0x5015765c
mov eax, dword [esi*4 + 0x50299f40]
mov dword [0x5029778c], eax
push dword [0x5029778c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x50157464.338
cmp dword [0x5028e670], ebx
je 0x50157699
call fcn.50097c09
push 1
push dword [0x5029778c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x5029778c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x501576f5
cmp dword [0x502898b8], ebx
push ebx
je 0x501576c0
call fcn.50113ee1
test eax, eax
je 0x501576f5
push dword [0x5029778c]
push ebx
call fcn.50113ee1
mov ecx, eax
call fcn.50272bbe
jmp 0x501576f5
push dword [0x5029778c]
push 0x222
push dword [0x5029a6e8]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x5029778c]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x501576f5
push 9
push dword [0x5029778c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x5029778c]
call dword [sym.imp.USER32.dll_SetFocus]
call fcn.50272bbe
mov edi, eax
cmp edi, ebx
je case.0x50157464.338
push dword [0x5029778c]
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov eax, dword [edi]
push ebx
push ebx
push edi
call dword [eax + 0x1c]
mov eax, dword [edi]
push ebx
push edi
call dword [eax + 0xc]
jmp case.0x50157464.338
call fcn.50272bbe
jmp 0x5015803a
push ebx
call fcn.50090a86
jmp case.0x50157464.338
cmp esi, 0x28d
ja 0x5015785e
cmp esi, 0x276
jae 0x50157834
mov eax, 0x257
cmp esi, eax
je 0x50157829
jbe case.0x50157dcc.988
cmp esi, 0x26f
jbe 0x50157795
cmp esi, 0x272
jbe case.0x50157dcc.988
cmp esi, 0x275
jbe case.0x50156e5e.286
jmp case.0x50157dcc.988
mov ecx, dword [0x50289ae0]
lea eax, [esi - 0x258]
dec ecx
cmp eax, ecx
jg 0x50157d95
call fcn.50272bbe
test eax, eax
jne 0x50157d95
lea edi, [esi - 0x258]
call fcn.500e8e79
cmp eax, edi
jbe case.0x50157dcc.988
lea ecx, [ebp - 0x5b8]
call fcn.500a785c
lea eax, [ebp - 0x5b8]
push eax
push edi
call fcn.500e8e84
test eax, eax
je 0x50157d82
call fcn.50272bbe
mov edi, eax
cmp edi, ebx
je 0x501577fd
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x2c]
push 1
push 1
lea ecx, [ebp - 0x5b8]
call fcn.500a70fc
push eax
call fcn.50272bbe
cmp edi, ebx
mov dword [ebp + 0x64], eax
je 0x50157d85
mov eax, dword [edi]
push ebx
push edi
call dword [eax + 0x2c]
jmp 0x50157d85
push edi
call fcn.500d3395
jmp case.0x50157464.338
push ebx
push 0x50017a94
call fcn.50272bbe
lea ecx, [esi - 0x276]
cmp ecx, eax
jae case.0x50157464.338
add esi, 0xfffffd8a
push esi
call fcn.50272bbe
jmp 0x5015795e
mov eax, esi
sub eax, 0x28e
je 0x50157882
sub eax, 3
je case.0x50157dcc.979
dec eax
jne case.0x50157dcc.988
push esi
call fcn.50272bbe
jmp 0x5015803a
call fcn.50184fc3
jmp case.0x50157464.338
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x50157969
cmp word [eax], 8
jne 0x50157969
call fcn.50062782
test eax, eax
je case.0x50157464.338
call fcn.50062782
cmp dword [eax + 0x9c], ebx
je case.0x50157464.338
mov esi, 0x36e6
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x50157904
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
jmp 0x50157909
call fcn.5005698e
mov esi, dword [ebp + 0x78]
push eax
push dword [esi + 8]
call fcn.50272bbe
test eax, eax
jne 0x5015792a
call fcn.5004cabb
mov ecx, eax
call fcn.50052408
jmp 0x5015803a
push dword [esi + 8]
call fcn.5004cabb
mov ecx, eax
call fcn.5004d5dd
cmp eax, ebx
je 0x50157957
push 1
push eax
call fcn.5004cabb
mov ecx, eax
call fcn.50051872
push ebx
call fcn.500b3191
jmp case.0x50157464.338
push ebx
call dword [sym.imp.USER32.dll_MessageBeep]
push ebx
call fcn.501a9f99
jmp case.0x50157464.338
mov edi, dword [ebp + 0x7c]
cmp edi, ebx
je case.0x50157464.338
cmp dword [ebp + 0x74], ebx
jne case.0x50157464.338
cmp word [edi], 8
jne case.0x50157464.338
call fcn.5004cabb
cmp dword [eax + 0x24], ebx
je case.0x50157464.338
call fcn.5004cabb
mov eax, dword [eax + 0x24]
push dword [eax + 0x18]
jmp 0x50157a4e
cmp esi, 0x3c5
ja 0x50157da7
cmp esi, 0x3c0
jae 0x5015806e
cmp esi, 0x327
ja 0x50157b88
cmp esi, 0x308
jae 0x50157b55
mov eax, 0x303
cmp esi, eax
ja 0x50157b0e
je case.0x50157dcc.979
mov eax, esi
sub eax, 0x2ad
je 0x50157ac5
sub eax, 0x2c
je 0x50157a73
dec eax
dec eax
je 0x50157a18
dec eax
jne case.0x50157dcc.988
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.50272bbe
jmp 0x5015803a
mov eax, dword [ebp + 0x78]
cmp eax, ebx
jne 0x50157a5c
mov edi, dword [ebp + 0x7c]
cmp edi, ebx
je case.0x50157dcc.988
mov eax, dword [ebp + 0x74]
cmp ax, 3
jne case.0x50157dcc.988
shr eax, 0x10
cmp ax, 1
jne case.0x50157dcc.988
push 0x50015cdc
mov word [edi], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi + 8], eax
jmp case.0x50157464.338
cmp word [eax], 8
jne case.0x50157dcc.988
push dword [eax + 8]
call fcn.50272bbe
jmp case.0x50157464.338
lea eax, [ebp + 0x7c]
push eax
push 0x500084c0
push 0x5002a814
mov dword [ebp + 0x7c], ebx
call fcn.501a5bb0
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl 0x50157ab8
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl 0x50157ab8
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
xor edx, edx
cmp esi, 0x2d9
sete dl
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp + 0x64], eax
lea ecx, [ebp + 0x7c]
call fcn.501e21ba
jmp case.0x50157464.338
cmp dword [ebp + 0x74], ebx
jne case.0x50157464.338
mov esi, dword [ebp + 0x7c]
cmp word [esi], 0x2000
jne case.0x50157464.338
call fcn.50062782
test eax, eax
je 0x50157b06
call fcn.50062782
cmp dword [eax + 0x9c], ebx
je 0x50157b06
call fcn.5004cabb
mov ecx, eax
call fcn.50272bbe
mov dword [esi + 8], eax
jmp case.0x50157464.338
mov dword [esi + 8], ebx
jmp case.0x50157464.338
mov ecx, esi
mov eax, 0x304
sub ecx, eax
je 0x50157b41
dec ecx
je case.0x50156e5e.217
dec ecx
jne case.0x50157dcc.988
call fcn.50272bbe
jmp 0x5015803a
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push esi
call fcn.50272bbe
jmp 0x5015803a
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push eax
call fcn.50272bbe
jmp 0x5015803a
cmp dword [0x5029afd8], ebx
je case.0x50157464.338
push ebx
call fcn.501164e5
cmp eax, ebx
je case.0x50157464.338
add esi, 0xfffffcf8
push esi
push dword [0x5029afd8]
mov ecx, eax
call fcn.50115b3d
jmp case.0x50157464.338
cmp esi, 0x37f
ja 0x50157c9c
cmp esi, 0x372
jae case.0x50157dcc.979
mov ecx, 0x329
cmp esi, ecx
jb case.0x50157dcc.988
cmp esi, 0x32a
jbe 0x50157c5a
cmp esi, 0x34a
jbe 0x50157bfd
cmp esi, 0x34b
jbe case.0x50157dcc.988
cmp esi, 0x36b
ja case.0x50157dcc.988
mov eax, dword [0x5028d614]
cmp eax, ebx
je case.0x50157464.338
push ebx
add esi, 0xfffffcb4
push esi
add eax, 8
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x28]
jmp case.0x50157464.338
mov eax, dword [0x5029a8bc]
lea ecx, [ebp + 0x7c]
push ecx
push ebx
mov dword [ebp + 0x7c], ebx
mov eax, dword [eax + 0x2d8]
push ebx
push eax
call fcn.50272bbe
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl case.0x50157464.338
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je case.0x50157464.338
mov eax, dword [0x5028d614]
cmp eax, ebx
je case.0x50157464.338
mov ecx, dword [ecx + 0x10]
add esi, 0xfffffcd5
push esi
sub ecx, 0x310
push ecx
add eax, 8
mov edx, dword [eax]
push edi
push eax
call dword [edx + 0x28]
jmp 0x5015803a
mov eax, dword [0x5028d614]
cmp eax, ebx
je case.0x50157464.338
cmp esi, ecx
jne 0x50157c8e
lea ecx, [eax + 8]
call fcn.500441d4
test eax, eax
je case.0x50157464.338
mov eax, dword [0x5028d614]
add eax, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp case.0x50157464.338
add eax, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp case.0x50157464.338
cmp esi, 0x382
je 0x50157d9d
cmp esi, 0x383
jbe case.0x50157dcc.988
cmp esi, 0x39b
jbe 0x50157cd3
cmp esi, 0x3be
jne case.0x50157dcc.988
push esi
call fcn.50052484
jmp case.0x50157464.338
mov ecx, dword [0x50289ae0]
lea eax, [esi - 0x384]
dec ecx
cmp eax, ecx
jg 0x50157d95
call fcn.50272bbe
test eax, eax
jne 0x50157d95
add esi, 0xfffffc7c
mov dword [ebp + 0x78], esi
call fcn.500e8ea9
cmp eax, esi
jbe case.0x50157dcc.988
lea ecx, [ebp - 0x5b8]
call fcn.500a785c
mov esi, 0x50001f20
lea edi, [ebp + 0x1c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x7c]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x5b8]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 0x78]
movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x7c], ebx
call fcn.500e8ec9
test eax, eax
je 0x50157d82
call fcn.50272bbe
mov esi, eax
cmp esi, ebx
je 0x50157d53
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x2c]
lea ecx, [ebp - 0x5b8]
call fcn.500a70fc
push 0x50001f20
push dword [ebp + 0x7c]
lea ecx, [ebp + 0x1c]
push ecx
push 1
push eax
call fcn.50272bbe
cmp esi, ebx
mov dword [ebp + 0x64], eax
je 0x50157d85
mov eax, dword [esi]
push ebx
push esi
jmp 0x50157821
mov dword [ebp + 0x5c], ebx
lea ecx, [ebp - 0x5b8]
call fcn.501b7afc
jmp 0x5015843e
mov dword [ebp + 0x5c], ebx
jmp 0x5015843e
call fcn.50181d69
jmp 0x5015803a
mov eax, 0x400
cmp esi, eax
ja 0x50157e57
je 0x50157e17
lea eax, [esi - 0x3cb]
cmp eax, 0x34
ja case.0x50157dcc.988
movzx eax, byte [eax + 0x501586e7]
jmp dword [eax*4 + 0x501586cf]
push dword [ebp + 0x74]
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
call fcn.50272bbe
jmp 0x5015803a
call fcn.50272bbe
jmp case.0x50157464.338
push edi
call fcn.500ceefb
jmp case.0x50157464.338
push edi
call fcn.500d3395
lea eax, [ebp + 0x70]
push eax
push 0x50001d00
mov dword [ebp + 0x70], ebx
call fcn.500d2a95
jmp 0x50158098
lea eax, [ebp + 0x7c]
push eax
mov eax, 0x5002bb04
push eax
push eax
mov dword [ebp + 0x7c], ebx
call fcn.501a5bb0
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x50157e4a
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push 0x50017b30
push ebx
push 0x50001f20
push 0x411
push eax
call dword [ecx + 0xc]
lea ecx, [ebp + 0x7c]
call fcn.501e21ba
jmp case.0x50157464.338
cmp esi, 0x436
ja 0x50158042
cmp esi, 0x42e
jae 0x501580d2
mov eax, esi
sub eax, 0x40c
je 0x5015802e
dec eax
dec eax
je 0x50157fe9
sub eax, 6
jne case.0x50157dcc.988
lea eax, [ebp + 0x7c]
push eax
mov eax, 0x5002a2c4
push eax
push eax
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x78], ebx
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x7c], ebx
call fcn.501a5bb0
cmp dword [ebp + 0x7c], ebx
je 0x50157fc4
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp + 0x38]
push edx
push 0xffffdcd6
push eax
call dword [ecx + 0x10]
cmp eax, ebx
mov dword [ebp + 0x64], eax
jl 0x50157f23
cmp word [ebp + 0x38], 8
jne 0x50157f23
cmp dword [ebp + 0x40], ebx
je 0x50157f23
push dword [ebp + 0x40]
lea ecx, [ebp + 0x74]
call fcn.500595e9
push 0x50017b1c
lea ecx, [ebp + 0x74]
call fcn.5007185e
push 0x20019
push dword [ebp + 0x74]
lea ecx, [ebp + 0x70]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.50272bbe
test eax, eax
jl 0x50157f23
lea eax, [ebp + 0x78]
push eax
push 0x50017b04
lea ecx, [ebp + 0x70]
call fcn.50272bbe
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 0x78], ebx
je 0x50157fc4
push 0x18
pop ecx
push dword [0x5028fe58]
mov esi, 0x50017aa0
push dword [ebp + 0x78]
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x468]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.MSVCR70.dll_swprintf]
add esp, 0x10
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x34], 0x44
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov dword [ebp + 0x1c], ebx
lea edi, [ebp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x468]
push eax
push ebx
call dword [sym.imp.vsansi.dll_CreateProcessW]
test eax, eax
jne 0x50157fc4
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x50157fb2
call esi
jmp 0x50157fbe
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
call fcn.50069672
lea ecx, [ebp + 0x7c]
call fcn.501e21ba
lea ecx, [ebp + 0x70]
call fcn.50085374
push dword [ebp + 0x78]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp + 0x74]
call esi
jmp case.0x50157464.338
push ebx
mov esi, 0x40e
push esi
mov dword [ebp + 0x7c], ebx
call fcn.50272bbe
test eax, eax
je 0x50158004
push esi
call fcn.50272bbe
jmp 0x50158021
lea eax, [ebp + 0x7c]
push eax
mov eax, 0x5002bbe4
push eax
push eax
call fcn.501a5bb0
test eax, eax
jl 0x50158021
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
lea ecx, [ebp + 0x7c]
call fcn.501e21ba
jmp case.0x50157464.338
mov ecx, dword [0x5029a8bc]
push edi
call fcn.501ae5ed
mov dword [ebp + 0x64], eax
jmp case.0x50157464.338
cmp esi, 0x439
je 0x501580d2
cmp esi, 0x446
jbe case.0x50157dcc.988
cmp esi, 0x449
jbe 0x50158087
cmp esi, 0x451
ja case.0x50157dcc.988
push edi
call fcn.5017b73d
lea eax, [ebp + 0x70]
push eax
push 0x50001d00
mov dword [ebp + 0x70], ebx
call fcn.5017a839
jmp 0x50158098
lea eax, [ebp + 0x70]
push eax
push 0x50001d00
mov dword [ebp + 0x70], ebx
call fcn.50136d86
test eax, eax
jl 0x501580c5
push dword [ebp + 0x7c]
mov eax, dword [ebp + 0x70]
push dword [ebp + 0x78]
mov ecx, dword [eax]
push dword [ebp + 0x74]
push esi
push 0x50002390
push eax
call dword [ecx + 0x10]
lea ecx, [ebp + 0x70]
mov esi, eax
call fcn.501e21ba
mov eax, esi
jmp 0x5015844d
lea ecx, [ebp + 0x70]
call fcn.501e21ba
jmp case.0x50157464.338
or dword [ebp + 0x78], 0xffffffff
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x70], ebx
call fcn.50062782
mov edi, eax
lea eax, [ebp + 0x1c]
push eax
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x30], ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp + 0x34]
push eax
mov eax, 0x5002a384
push eax
push eax
call fcn.501a5bb0
test eax, eax
jl 0x501583e5
mov eax, dword [ebp + 0x34]
cmp eax, ebx
je 0x501583e5
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp + 0x78]
push edx
lea edx, [ebp + 0x7c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x501583e5
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x501583e5
cmp dword [ebp + 0x78], 0xffffffff
je 0x501583e5
cmp dword [ebp + 0x78], 0xfffffffe
je 0x501583e5
cmp dword [ebp + 0x78], 0xfffffffd
je 0x501583e5
mov ecx, dword [eax]
lea edx, [ebp + 0x50]
push edx
push 0x5002a004
push eax
call dword [ecx]
test eax, eax
jl 0x501583e5
cmp dword [ebp + 0x50], ebx
je 0x501583e5
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp + 0x60]
push edx
push 0x50029f94
push eax
call dword [ecx]
test eax, eax
jl 0x501583e5
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x501583e5
mov ecx, dword [eax]
lea edx, [ebp + 0x70]
push edx
push dword [ebp + 0x78]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x501583e5
cmp dword [ebp + 0x70], ebx
je 0x501583e5
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp + 0x1c]
push edx
push 0xfffff7f7
push dword [ebp + 0x78]
push eax
call dword [ecx + 0x24]
test eax, eax
jge 0x501581df
mov dword [ebp + 0x64], ebx
jmp 0x501581e9
cmp word [ebp + 0x24], bx
jne 0x501583e5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
cmp eax, ebx
mov dword [ebp + 0x48], eax
je 0x501583e8
mov edi, 0x50001f20
cmp esi, 0x439
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x58], ebx
je 0x5015821c
mov dword [ebp + 0x64], ebx
jmp 0x50158253
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x40]
push eax
push 0x50154f10
push 0x135c
push dword [0x5029a6d4]
mov dword [ebp + 0x30], 1
mov dword [ebp + 0x44], ebx
call fcn.50272bbe
mov eax, dword [ebp + 0x44]
cmp eax, ebx
je 0x50158384
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
push 0x50002380
add eax, 0x1c
push eax
call fcn.5003f10b
test eax, eax
je 0x50158384
mov eax, dword [ebp + 0x48]
mov eax, dword [eax + 0x4b4]
cmp eax, ebx
je 0x50158384
cmp eax, dword [ebp + 0x7c]
je 0x50158384
mov ecx, dword [eax]
lea edx, [ebp + 0x74]
push edx
push 0x50029fb4
push eax
call dword [ecx]
test eax, eax
jl 0x50158384
cmp dword [ebp + 0x74], ebx
je 0x50158384
inc dword [ebp + 0x2c]
cmp dword [ebp + 0x30], ebx
je 0x501582b2
mov dword [ebp + 0x64], ebx
jmp 0x501582c8
lea eax, [esi - 0x42d]
cmp dword [ebp + 0x2c], eax
jne 0x50158384
mov dword [ebp + 0x30], 1
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp + 0x54]
push edx
push 0x50029f34
push eax
call dword [ecx]
test eax, eax
jl 0x50158384
cmp dword [ebp + 0x54], ebx
je 0x50158384
lea eax, [ebp + 0x4c]
push eax
mov eax, 0x5002a204
push eax
push eax
call fcn.501a5bb0
test eax, eax
jl 0x50158384
mov eax, dword [ebp + 0x4c]
cmp eax, ebx
jne 0x50158311
mov dword [ebp + 0x64], ebx
jmp 0x50158398
mov ecx, dword [eax]
lea edx, [ebp + 0x18]
push edx
lea edx, [ebp + 0x58]
push edx
push ebx
push ebx
push 2
push edi
push dword [ebp + 0x70]
push dword [ebp + 0x78]
push dword [ebp + 0x54]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x50158384
cmp dword [ebp + 0x18], ebx
je 0x50158384
cmp dword [ebp + 0x58], ebx
je 0x50158384
mov eax, dword [ebp + 0x70]
lea edx, [ebp + 0x14]
push edx
push edi
push ebx
push edi
push ebx
push ebx
lea edx, [ebp + 0x10]
push edx
push 1
push ebx
push 1
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax]
push 0xfffffffffffffffe
push eax
call dword [ecx + 0x2c]
test eax, eax
jl 0x50158384
cmp dword [ebp + 0x14], 0xffffffff
jne 0x50158384
push dword [ebp + 0x58]
mov eax, dword [ebp + 0x50]
push dword [ebp + 0x70]
mov ecx, dword [eax]
push dword [ebp + 0x70]
push dword [ebp + 0x74]
push dword [ebp + 0x78]
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x50158387
mov dword [ebp + 0x64], ebx
cmp dword [ebp + 0x4c], ebx
je 0x50158398
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x4c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x54], ebx
je 0x501583a9
mov eax, dword [ebp + 0x54]
mov dword [ebp + 0x54], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x74], ebx
je 0x501583ba
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x74], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x58], ebx
je 0x501583cb
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x58], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x30], ebx
jne 0x501583eb
mov ecx, dword [ebp + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp eax, ebx
mov dword [ebp + 0x48], eax
jne 0x50158200
jmp 0x501583e8
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x5c], ebx
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0x34]
cmp eax, ebx
je 0x50158405
mov dword [ebp + 0x34], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x50158415
mov dword [ebp + 0x7c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x50158425
mov dword [ebp + 0x60], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x50158435
mov dword [ebp + 0x50], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + 0x70]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0x5c], ebx
jne case.0x50157464.338
mov dword [ebp + 0x64], 0x80040100
mov eax, dword [ebp + 0x64]
lea esp, [ebp - 0x5c4]
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10