Function at 0x464480
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f0d5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x638
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5cc], edi
mov eax, dword [ebx + 8]
lea ecx, [edi + 0x2e8]
mov dword [ebp - 0x5fc], eax
mov eax, dword [edi + 0xbc]
cmp eax, 0xffffffff
jne 0x4644e5
mov eax, dword [ecx]
mov edx, dword [edi + 0x2e4]
test edx, edx
je 0x467223
cmp eax, 1
jl 0x467223
cmp eax, dword [ecx]
jg 0x467223
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x467223
cmp dword [edx + eax*8], 0xf
jne 0x467223
push 2
push 0xffffffffffffffff
push 0x100c
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x610], eax
test eax, eax
js 0x467223
push ecx
push dword [edi + 0xd8]
lea ecx, [edi + 0x2a8]
call fcn.00416520
mov dword [ebp - 0x614], eax
lea ecx, [edi + 0x2a8]
test eax, eax
jns 0x464577
push ecx
push 0x1c2
push 0x96
push ecx
push 0
push 0x4c93b8
jmp 0x46723c
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x20], 1
mov dword [ebp - 4], 0
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x3c], 1
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x4c], 1
xor edx, edx
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x5d4], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x30], 1
movq qword [ebp - 0x84], xmm0
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x84], edx
mov byte [ebp - 0x7c], 1
push 4
push eax
mov byte [ebp - 4], 4
push dword [edi + 0xd8]
call fcn.00416470
mov dword [ebp - 0x5d8], eax
mov edx, 2
mov dword [ebp - 0x40], 0
test eax, eax
jne 0x464660
mov byte [ebp - 0x3c], al
xor ecx, ecx
mov eax, 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x5d8], eax
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 0x3c], 1
mov dword [ebp - 0x44], eax
cmp eax, 0x4c21c0
je 0x464699
test eax, eax
je 0x464737
mov esi, 0x4c21c0
sub eax, esi
mov dword [ebp - 0x578], eax
movzx eax, word [eax + esi]
mov ecx, eax
test ax, ax
jne 0x4646e6
cmp word [esi], ax
jne 0x4646eb
mov edi, dword [ebp - 0x5cc]
push ecx
push 0x1c2
push 0x96
lea eax, [edi + 0x2a8]
mov ecx, edi
push eax
push 0
push 0x4c9c90
call fcn.00432b40
or esi, 0xffffffff
mov eax, dword [ebp - 0x5d8]
test eax, eax
je 0x4646cf
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4646df
push eax
call fcn.00489ed3
add esp, 4
mov eax, esi
jmp 0x467246
cmp ax, word [esi]
je 0x464723
xor edx, edx
cmp dx, ax
jne 0x4646f6
xor edi, edi
jmp 0x464702
push ecx
call fcn.0048e154
add esp, 4
movzx edi, ax
movzx eax, word [esi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x464712
xor eax, eax
jmp 0x46471e
push ecx
call fcn.0048e154
add esp, 4
movzx eax, ax
cmp di, ax
jne 0x464731
mov eax, dword [ebp - 0x578]
add esi, 2
jmp 0x464683
mov edi, dword [ebp - 0x5cc]
mov ecx, edi
call fcn.0042eef0
push 3
push dword [ebp - 0x610]
lea ecx, [edi + 0x2a8]
push dword [edi + 0xbc]
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x28]
test esi, esi
jne 0x4647b1
test eax, eax
je 0x46476d
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x4647a3
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x464790
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
jmp 0x4647c6
test eax, eax
je 0x4647be
push eax
call fcn.00489ed3
add esp, 4
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 1
test esi, esi
je 0x4647f7
test eax, eax
jne 0x4647e4
cmp word [esi], ax
je 0x4647df
inc eax
cmp word [esi + eax*2], 0
jne 0x4647d7
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x4647f7
push esi
mov byte [ebp - 0x20], 1
call fcn.0048e06c
add esp, 4
mov edi, eax
jmp 0x4647fd
mov byte [ebp - 0x20], 0
xor edi, edi
mov eax, dword [ebp - 0x5cc]
push 4
push dword [ebp - 0x614]
push dword [eax + 0xd8]
lea ecx, [eax + 0x2a8]
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x5d8]
test esi, esi
jne 0x464853
test eax, eax
je 0x464835
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
call fcn.0048a28e
mov ecx, eax
add esp, 4
xor eax, eax
mov word [ecx], ax
jmp 0x464869
test eax, eax
je 0x464860
push eax
call fcn.00489ed3
add esp, 4
mov ecx, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x5d8], ecx
test ecx, ecx
je 0x4648a6
xor eax, eax
cmp word [ecx], ax
je 0x464888
nop dword [eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x464880
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x4648a6
push ecx
mov byte [ebp - 0x3c], 1
call fcn.0048e06c
mov ecx, dword [ebp - 0x5d8]
add esp, 4
mov esi, eax
jmp 0x4648ac
mov byte [ebp - 0x3c], 0
xor esi, esi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4671f8
cmp word [eax], 0
je 0x4671f8
test ecx, ecx
je 0x4671f8
cmp word [ecx], 0
je 0x4671f8
mov ecx, dword [ebp - 0x5cc]
push esi
push edi
call fcn.0042f400
test eax, eax
je 0x4671f8
xorps xmm0, xmm0
movups xmmword [ebp - 0xa4], xmm0
mov dword [ebp - 0xa4], 0
movups xmmword [ebp - 0x94], xmm0
mov eax, dword [ebp - 0x5cc]
push ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa4]
movaps xmm0, xmmword [0x4cd010]
push 0
push dword [eax + 0x54]
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x8c], 0xd
push dword [eax + 0x44]
add eax, 0x2a8
mov dword [ebp - 0x88], 0
push eax
call fcn.00417480
push 0
push esi
mov esi, dword [ebp - 0x5cc]
mov ecx, esi
push edi
mov byte [ebp - 4], 6
call fcn.0042f260
mov dword [ebp - 0x578], eax
test eax, eax
je 0x46499a
push 0
push 0x4c23a4
lea ecx, [esi + 0x1a0]
call fcn.0041b250
mov byte [ebp - 0x4c], 0
mov edi, eax
test eax, eax
je 0x4649a0
xor esi, esi
cmp word [eax], si
je 0x4649a2
nop dword [eax + eax]
inc esi
cmp word [eax + esi*2], 0
jne 0x464990
jmp 0x4649a2
xor edi, edi
mov byte [ebp - 0x4c], 0
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x50], esi
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x54], eax
test esi, esi
jle 0x4649e3
mov ecx, eax
sub edi, eax
mov edx, esi
nop
mov ax, word [edi + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
jne 0x4649d0
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov byte [ebp - 0x4c], 1
mov word [eax + esi*2], cx
mov esi, dword [ebp - 0x5cc]
push 0x4c2178
lea ecx, [esi + 0x168]
call fcn.0041b170
cmp byte [esi + 0x198], 0
jne 0x464a16
xor edi, edi
mov dword [ebp - 0x2c], edi
jmp 0x464ac6
cmp word [esi + 0x178], 8
jne 0x464a33
push dword [esi + 0x180]
call fcn.0048e06c
add esp, 4
movzx edi, ax
jmp 0x464a3a
movzx edi, word [esi + 0x180]
mov dword [ebp - 0x2c], edi
test di, di
je 0x464ac6
mov byte [ebp - 0x30], 0
xor esi, esi
nop dword [eax]
inc esi
cmp word [esi*2 + 0x4c0540], 0
jne 0x464a50
xor ecx, ecx
mov dword [ebp - 0x5d4], esi
lea eax, [esi + 1]
mov dword [ebp - 0x34], esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x38], eax
test esi, esi
jle 0x464ab9
mov edx, dword [ebp - 0x5d4]
mov esi, 0x4c0540
mov ecx, eax
sub esi, eax
nop word [eax + eax]
mov ax, word [esi + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
jne 0x464aa0
mov esi, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov byte [ebp - 0x30], 1
mov word [eax + esi*2], cx
mov word [eax], di
mov esi, dword [ebp - 0x5cc]
push dword [esi + 0x4d8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x464ae4
mov edi, dword [esi + 0x4d8]
jmp 0x464ae6
xor edi, edi
push 0x268
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.0048b9e0
add esp, 0xc
mov word [ebp - 0x2d8], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x200], 0
mov byte [ebp - 0x1f8], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x310]
push 1
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
call fcn.00417000
push ecx
push edi
push 0xffffffffffffffff
push SysReAllocString
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x136
push 0x23a
add esi, 0x22c
lea eax, [ebp - 0x310]
push 0x4ca26c
cmovne eax, esi
lea ecx, [ebp - 0x310]
push 0x4c3cf8
mov dword [ebp - 0x150], eax
call fcn.0040bf80
push ecx
push 0xc
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xff000000
push 0x136
push 0x23a
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 8
call fcn.004167f0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x620], eax
test edi, edi
je 0x464c1e
mov edi, dword [ebp - 0x5cc]
xor esi, esi
add edi, 0x2f8
nop dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x464bfc
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x464bfc
inc esi
add edi, 4
cmp esi, 0x30
jl 0x464be0
jmp 0x464c1e
mov eax, dword [ebp - 0x5cc]
mov ecx, dword [ebp - 0x620]
mov dword [eax + esi*4 + 0x2f8], ecx
inc esi
cmp esi, dword [eax + 0x2f4]
jle 0x464c1e
mov dword [eax + 0x2f4], esi
movsd xmm0, qword [0x4cc778]
xor eax, eax
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0xffffff
movsd qword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x198], 0x2bc
mov byte [ebp - 0x194], 1
mov byte [ebp - 0x152], 0
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x464c60
inc eax
push eax
push 0x4bff50
lea eax, [ebp - 0x192]
push 0x20
push eax
call fcn.0048d183
add esp, 0x10
mov dword [ebp - 0x120], 0x1400
lea ecx, [ebp - 0x310]
call fcn.00416d40
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x464d0c
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x1c
push 0x216
push 5
and eax, 1
push 5
shl eax, 0x11
add eax, 0x50000300
push eax
push 0x4ca2a8
push 0x4c018c
push 0
call esi
test eax, eax
je 0x464d0c
push eax
push 0xd
lea ecx, [ebp - 0x310]
call fcn.00416ab0
movaps xmm0, xmmword [0x4cce40]
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x2d4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0xff000000
sub esp, 8
lea ecx, [ebp - 0x310]
push 7
push 0x21b
call fcn.00411850
movsd xmm0, qword [0x4cc768]
mov dword [ebp - 0x614], eax
xor eax, eax
movsd qword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x198], 0x190
mov byte [ebp - 0x194], 1
mov byte [ebp - 0x152], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x464d60
inc eax
push eax
push 0x4bff50
lea eax, [ebp - 0x192]
push 0x20
push eax
call fcn.0048d183
add esp, 0x10
mov dword [ebp - 0x120], 0x400
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x464e03
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x12
push 0x6e
push 0x34
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4ca300
push 0x4c018c
push 0
call esi
test eax, eax
je 0x464e03
push eax
push 0xd
lea ecx, [ebp - 0x310]
call fcn.00416ab0
movaps xmm0, xmmword [0x4cca60]
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x2d4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
lea ecx, [ebp - 0x310]
mov byte [ebp - 0x4c], 1
call fcn.00416d40
test al, al
jne 0x464e25
mov dword [ebp - 0x624], 0
jmp 0x464ea8
test byte [ebp - 0xc8], 1
mov eax, 0x50020080
push 0
push dword [ebp - 0x1f4]
mov ecx, 0x50000080
cmovne ecx, eax
mov eax, dword [ebp - 0x2d0]
inc eax
or ecx, 0x10000
push eax
push dword [ebp - 0xdc]
push 0x14
push 0xd2
push 0x32
push 0x87
push ecx
push dword [ebp - 0x54]
push 0x4c0220
push 0x200
call esi
test eax, eax
jne 0x464e7f
mov dword [ebp - 0x624], eax
jmp 0x464ea8
push eax
push 0xc
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
movaps xmm0, xmmword [0x4ccce0]
mov dword [ebp - 0x624], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
cmp dword [ebp - 0xe0], 0
je 0x464f35
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x464f35
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x16
push 0x46
push 0x31
and eax, 1
push 0x15e
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ca324
push 0x4c019c
push 0
call esi
test eax, eax
je 0x464f35
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
movaps xmm0, xmmword [0x4ccd10]
mov dword [ebp - 0x628], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x464f3f
mov dword [ebp - 0x628], 0
cmp dword [ebp - 0x578], 0
jne 0x464f57
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x310]
call fcn.00414360
lea ecx, [ebp - 0x44]
call fcn.0041e330
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x464fd4
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x12
push 0x6e
push 0x5d
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4ca330
push 0x4c018c
push 0
call esi
test eax, eax
je 0x464fd4
push eax
push 0xd
lea ecx, [ebp - 0x310]
call fcn.00416ab0
movaps xmm0, xmmword [0x4cca70]
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x2d4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x5d8], eax
test eax, eax
jne 0x464ffc
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x5d8], eax
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov word [eax], cx
sub esp, 0x10
mov byte [ebp - 0x3c], 1
lea ecx, [ebp - 0x310]
push 0x5a
push 0x5a
push 0x87
push eax
call fcn.00411c70
cmp dword [ebp - 0xe0], 0
mov dword [ebp - 0x610], eax
je 0x4650a3
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x4650a3
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x19
push 0x46
push 0x59
and eax, 1
push 0xe6
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ca324
push 0x4c019c
push 0
call esi
test eax, eax
je 0x4650a3
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
mov edi, eax
movaps xmm0, xmmword [0x4ccd40]
lea edx, [edi + edi*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4650a5
xor edi, edi
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x60c], edi
cmp ecx, 0x4c1e58
je 0x4650ee
test ecx, ecx
je 0x465112
mov esi, 0x4c1e58
mov eax, ecx
sub eax, esi
mov dword [ebp - 0x578], eax
nop dword [eax]
movzx eax, word [eax + esi]
mov ecx, eax
test ax, ax
jne 0x465289
cmp word [esi], ax
jne 0x46528e
mov edi, dword [ebp - 0x60c]
push 0x40
push dword [ebp - 0x610]
lea ecx, [ebp - 0x310]
call fcn.00414360
push 0x40
push edi
lea ecx, [ebp - 0x310]
call fcn.00414360
mov ecx, dword [ebp - 0x38]
cmp word [ebp - 0x2c], 0
je 0x4652d8
test ecx, ecx
jne 0x465140
push 2
call fcn.0048a28e
mov ecx, eax
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], ecx
xor edx, edx
mov dword [ebp - 0x5d4], edx
mov word [ecx], ax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x28]
mov edi, ecx
mov byte [ebp - 0x30], 1
xor esi, esi
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
inc esi
cmp word [esi*2 + 0x4ca354], 0
jne 0x465163
test ecx, ecx
je 0x46518a
xor eax, eax
cmp word [ecx], ax
je 0x465188
nop word [eax + eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x465180
add esi, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4bfc74], 0
jne 0x465190
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x600], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, dword [ebp - 0x28]
add esp, 4
mov dword [ebp - 0x578], eax
mov ecx, eax
test edx, edx
je 0x4651e8
movzx eax, word [edx]
test ax, ax
je 0x4651e8
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x4651d7
mov esi, 0x4ca354
mov edx, 0x52
sub esi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x4651f4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x465227
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x465227
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x465216
mov eax, 0x29
mov esi, 0x4bfc74
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
lea ecx, [ecx + 2]
test ax, ax
jne 0x465231
mov esi, dword [ebp - 0x600]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x46525d
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x20], 1
test eax, eax
je 0x465351
push eax
call fcn.00489ed3
add esp, 4
jmp 0x465351
cmp ax, word [esi]
je 0x4652ca
xor edx, edx
cmp dx, ax
jne 0x465299
xor edi, edi
jmp 0x4652a5
push ecx
call fcn.0048e154
add esp, 4
movzx edi, ax
movzx eax, word [esi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x4652b5
xor eax, eax
jmp 0x4652c1
push ecx
call fcn.0048e154
add esp, 4
movzx eax, ax
cmp di, ax
jne 0x46510f
mov eax, dword [ebp - 0x578]
add esi, 2
jmp 0x4650d0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4652e8
push eax
call fcn.00489ed3
add esp, 4
mov byte [ebp - 0x20], 0
xor eax, eax
nop
inc eax
cmp word [eax*2 + 0x4ca384], 0
jne 0x4652f0
mov dword [ebp - 0x24], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x465347
nop word [eax + eax]
mov ax, word [ecx*2 + 0x4ca384]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x465330
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x20], 1
cmp dword [ebp - 0x28], 0
jne 0x46536c
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0xe0], 0
mov esi, dword [ebp - 0x28]
mov byte [ebp - 0x20], 1
je 0x465405
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x465405
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x19
push 0xc8
push 0x59
and eax, 1
push 0x15e
shl eax, 0x11
add eax, 0x50010000
push eax
push esi
push 0x4c019c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x465405
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
mov esi, eax
movaps xmm0, xmmword [0x4ccdb0]
mov dword [ebp - 0x608], esi
lea edx, [esi + esi*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x46540f
mov dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x46541c
cmp word [eax], 0
jne 0x46542b
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x310]
call fcn.00414360
movsd xmm0, qword [0x4cc760]
xor eax, eax
movsd qword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x198], 0x190
mov byte [ebp - 0x194], 1
mov byte [ebp - 0x152], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x465460
inc eax
push eax
push 0x4bff50
lea eax, [ebp - 0x192]
push 0x20
push eax
call fcn.0048d183
add esp, 0x10
lea ecx, [ebp - 0x310]
push 0xffffffffffffffff
push 0x1080000d
push 0x78
push 0x145
push 0x87
push 0x14
push 0
push 0x4ca3bc
call fcn.004120f0
mov edi, dword [ebp - 0x5cc]
push 0x4c7100
mov dword [ebp - 0x604], eax
lea ecx, [edi + 0x168]
call fcn.0041b170
mov cx, word [edi + 0x178]
mov eax, 0x2000
and cx, ax
xor eax, eax
cmp ax, cx
jne 0x4654e9
mov dword [ebp - 0x48], 1
jmp 0x4655aa
mov esi, dword [edi + 0x180]
test esi, esi
je 0x4654dd
cmp dword [esi + 0xc], eax
je 0x4654dd
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 1
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_VarR8FromUI1]
cmp dword [esi + 0xc], 0
je 0x4655aa
cmp word [ebp - 0x48], 8
jne 0x4655aa
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x46552f
push eax
call fcn.00489ed3
add esp, 4
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 1
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x2c], 0
test edi, edi
jle 0x4655a4
nop
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
test eax, eax
jne 0x465599
mov ecx, dword [ebp - 0x578]
test ecx, ecx
je 0x465599
cmp word [ecx], ax
je 0x465599
inc eax
cmp word [ecx + eax*2], 0
jne 0x465575
cmp eax, 3
jle 0x465599
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
lea ecx, [ebp - 0x310]
call fcn.004160e0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, edi
jl 0x465550
mov edi, dword [ebp - 0x5cc]
movsd xmm0, qword [0x4cc768]
xor eax, eax
movsd qword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x198], 0x190
mov byte [ebp - 0x194], 1
mov byte [ebp - 0x152], 0
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x4655d4
inc eax
push eax
push 0x4bff50
lea eax, [ebp - 0x192]
push 0x20
push eax
call fcn.0048d183
add esp, 0x10
cmp dword [ebp - 0xe0], 0
je 0x465691
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x465691
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x19
push 0xc8
push 0x8c
and eax, 1
push 0x15e
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ca3e8
push 0x4c019c
push 0
call esi
test eax, eax
je 0x465697
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
movaps xmm0, xmmword [0x4ccdc0]
mov dword [ebp - 0x61c], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4656a1
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x61c], 0
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x310]
call fcn.00414360
cmp dword [ebp - 0xe0], 0
je 0x465743
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x465743
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x19
push 0xc8
push 0xaa
and eax, 1
push 0x15e
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ca420
push 0x4c019c
push 0
call esi
test eax, eax
je 0x465743
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
movaps xmm0, xmmword [0x4ccdd0]
mov dword [ebp - 0x618], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x46574d
mov dword [ebp - 0x618], 0
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x310]
call fcn.00414360
cmp dword [ebp - 0xe0], 0
je 0x4657ec
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x4657ec
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x19
push 0xc8
push 0xc8
and eax, 1
push 0x15e
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ca454
push 0x4c019c
push 0
call esi
test eax, eax
je 0x4657ec
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
movaps xmm0, xmmword [0x4ccde0]
mov dword [ebp - 0x2c], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4657f3
mov dword [ebp - 0x2c], 0
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x310]
call fcn.00414360
cmp dword [ebp - 0xe0], 0
je 0x465895
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x465895
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x19
push 0xc8
push 0xe6
and eax, 1
push 0x15e
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ca48c
push 0x4c019c
push 0
call esi
test eax, eax
je 0x465895
push eax
push 3
lea ecx, [ebp - 0x310]
call fcn.00416ab0
mov ecx, dword [ebp - 0x2d4]
movaps xmm0, xmmword [0x4ccdf0]
mov dword [ebp - 0x600], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x46589f
mov dword [ebp - 0x600], 0
lea ecx, [ebp - 0x310]
call fcn.00416d40
test al, al
je 0x46591a
mov eax, dword [ebp - 0x2d0]
push 0
push dword [ebp - 0x1f4]
inc eax
push eax
push dword [ebp - 0xdc]
movzx eax, byte [ebp - 0xc8]
push 0x28
push 0x212
push 0x104
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4ca4b8
push 0x4c018c
push 0
call esi
test eax, eax
je 0x46591a
push eax
push 0xd
lea ecx, [ebp - 0x310]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccf90]
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x2d4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, 0x1b
mov byte [ebp - 0x1c], 1
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x614]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x70], 1
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x574], 0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x46596c
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
xor ecx, ecx
cmp eax, 0xffffffff
push 1
cmove eax, ecx
lea ecx, [ebp - 0x310]
push 1
mov dword [ebp - 0xcc], eax
call fcn.0040db40
mov esi, dword [ebp - 0x5fc]
test esi, esi
je 0x4659d3
xor eax, eax
cmp word [esi], ax
je 0x4659d3
inc eax
cmp word [esi + eax*2], 0
jne 0x4659a6
test eax, eax
je 0x4659d3
call fcn.00403550
push ecx
push 0x1c2
push 0xaa
lea eax, [ebp - 0x310]
mov ecx, edi
push eax
push 4
push esi
call fcn.00432b40
push 0
mov ecx, edi
call fcn.004284d0
test eax, eax
je 0x46712e
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [edi + 0x22c]
cmp eax, 0xfffffffa
je 0x467129
lea ecx, [ebp - 0x310]
cmp dword [edi + 0x25c], ecx
jne 0x4670b1
cmp eax, dword [ebp - 0x614]
je 0x467129
cmp eax, dword [ebp - 0x628]
jne 0x465cee
push dword [ebp - 0x624]
call fcn.00415800
mov esi, eax
mov eax, dword [ebp - 0x28]
test esi, esi
jne 0x465a8b
test eax, eax
je 0x465a4a
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x465a83
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x465a70
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x465aa2
test eax, eax
je 0x465a98
push eax
call fcn.00489ed3
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
push 0
push 0
push 0x4bfbd0
push 0x4bfc48
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x20], 1
call fcn.00402f10
mov dword [ebp - 0x5f8], 0
xor eax, eax
mov byte [ebp - 0x5f0], 0
nop
inc eax
cmp word [eax*2 + 0x4c23a4], 0
jne 0x465ad0
mov dword [ebp - 0x5f4], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x5f4]
xor ecx, ecx
mov dword [ebp - 0x5f8], edx
test eax, eax
jle 0x465b2d
mov ax, word [ecx*2 + 0x4c23a4]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x5f4]
mov edx, dword [ebp - 0x5f8]
cmp ecx, eax
jl 0x465b10
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x5f0], 1
mov byte [ebp - 4], 0x11
mov esi, dword [ebp - 0x28]
test esi, esi
jne 0x465b5d
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov eax, 8
mov byte [ebp - 0x20], 1
push esi
mov word [ebp - 0x5e8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x5e0], eax
test eax, eax
jne 0x465b86
test esi, esi
jne 0x467266
lea eax, [ebp - 0x5f8]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x78]
call fcn.00401560
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x467270
lea eax, [ebp - 0x5e8]
mov byte [ebp - 4], 0xa
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call edi
mov eax, dword [ebp - 0x5f8]
test eax, eax
je 0x465bd8
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x465be8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0
push eax
push 1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x5cc]
push 0x4ca55c
mov edx, dword [eax + 0x1a8]
mov ecx, dword [eax + 0x1a0]
call fcn.0041a9b0
test al, al
je 0x465c99
mov esi, dword [ebp - 0x574]
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x588]
mov byte [ebp - 4], 0x13
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x465cbd
mov eax, dword [esi]
lea ecx, [ebp - 0x588]
push 0
push 0
push ecx
push 0
push 0x4c04c0
push esi
call dword [eax + 0x10]
shr eax, 0x1f
xor al, 1
je 0x465cbd
cmp word [ebp - 0x588], 8
jne 0x465c82
push dword [ebp - 0x580]
call fcn.0048e06c
add esp, 4
mov esi, eax
jmp 0x465c88
mov esi, dword [ebp - 0x580]
lea eax, [ebp - 0x588]
mov byte [ebp - 4], 0xa
push eax
call edi
test esi, esi
je 0x465cca
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4ca5d0
jmp 0x4670ac
lea eax, [ebp - 0x588]
mov byte [ebp - 4], 0xa
push eax
call edi
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4ca588
jmp 0x4670ac
cmp eax, dword [ebp - 0x60c]
jne 0x466197
push dword [ebp - 0x610]
lea ecx, [ebp - 0x310]
call fcn.00415800
mov esi, eax
mov eax, dword [ebp - 0x28]
test esi, esi
jne 0x465d62
test eax, eax
je 0x465d21
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x465d57
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x465d44
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x28]
jmp 0x465d79
test eax, eax
je 0x465d6f
push eax
call fcn.00489ed3
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 1
test esi, esi
je 0x4670b1
cmp word [esi], 0
je 0x4670b1
mov esi, dword [ebp - 0x5d4]
test esi, esi
jne 0x465dc7
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x465da5
mov dword [ebp - 0x34], eax
jmp 0x465df6
xor esi, esi
mov dword [ebp - 0x5d4], esi
cmp word [eax], si
je 0x465dc0
inc esi
cmp word [eax + esi*2], 0
jne 0x465db2
mov dword [ebp - 0x5d4], esi
mov dword [ebp - 0x34], esi
test esi, esi
je 0x465df6
push ecx
push 0x1c2
push 0x96
lea eax, [ebp - 0x310]
mov ecx, edi
push eax
push 1
push 0x4ca620
call fcn.00432b40
test eax, eax
je 0x4670b1
test esi, esi
jne 0x465e20
mov eax, dword [ebp - 0x38]
xor esi, esi
mov dword [ebp - 0x5d4], esi
test eax, eax
je 0x465e15
cmp word [eax], si
je 0x465e15
inc esi
cmp word [eax + esi*2], 0
jne 0x465e07
mov dword [ebp - 0x5d4], esi
mov dword [ebp - 0x34], esi
test esi, esi
je 0x465f87
mov dword [ebp - 0x648], 0
xor eax, eax
mov byte [ebp - 0x640], 0
inc eax
cmp word [eax*2 + 0x4c31f4], 0
jne 0x465e33
mov dword [ebp - 0x644], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x644]
xor ecx, ecx
mov dword [ebp - 0x648], edx
test eax, eax
jle 0x465e90
mov ax, word [ecx*2 + 0x4c31f4]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x644]
mov edx, dword [ebp - 0x648]
cmp ecx, eax
jl 0x465e73
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x640], 1
mov byte [ebp - 4], 0x14
mov esi, dword [ebp - 0x38]
test esi, esi
jne 0x465ec7
push 2
call fcn.0048a28e
mov esi, eax
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], esi
xor edx, edx
mov dword [ebp - 0x5d4], edx
mov word [esi], ax
mov dword [ebp - 0x34], edx
mov eax, 8
mov byte [ebp - 0x30], 1
push esi
mov word [ebp - 0x638], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x630], eax
test eax, eax
jne 0x465ef0
test esi, esi
jne 0x467266
lea eax, [ebp - 0x648]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x78]
call fcn.00401560
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x467270
lea eax, [ebp - 0x638]
mov byte [ebp - 4], 0xa
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call edi
mov eax, dword [ebp - 0x648]
test eax, eax
je 0x465f42
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x465f52
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0
push eax
push 1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x5cc]
push 0x4c32f4
mov edx, dword [eax + 0x170]
mov ecx, dword [eax + 0x168]
call fcn.0041a9b0
jmp 0x465f8d
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x5f8], 0
xor eax, eax
mov byte [ebp - 0x5f0], 0
inc eax
cmp word [eax*2 + 0x4c31f4], 0
jne 0x465fa0
mov dword [ebp - 0x5f4], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x5f4]
xor ecx, ecx
mov dword [ebp - 0x5f8], edx
test eax, eax
jle 0x465ffd
mov ax, word [ecx*2 + 0x4c31f4]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x5f4]
mov edx, dword [ebp - 0x5f8]
cmp ecx, eax
jl 0x465fe0
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x5f0], 1
mov byte [ebp - 4], 0x16
mov esi, dword [ebp - 0x28]
test esi, esi
jne 0x46602d
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov eax, 8
mov byte [ebp - 0x20], 1
push esi
mov word [ebp - 0x5e8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x5e0], eax
test eax, eax
jne 0x466056
test esi, esi
jne 0x467266
lea eax, [ebp - 0x5f8]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x78]
call fcn.00401560
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x467270
lea eax, [ebp - 0x5e8]
mov byte [ebp - 4], 0xa
push eax
call edi
mov eax, dword [ebp - 0x5f8]
test eax, eax
je 0x4660a2
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x4660b2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0
push eax
push 1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x5cc]
push 0x4c320c
mov edx, dword [eax + 0x170]
mov ecx, dword [eax + 0x168]
call fcn.0041a9b0
test al, al
je 0x466173
mov esi, dword [ebp - 0x574]
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 0x18
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x4670d1
mov eax, dword [esi]
lea ecx, [ebp - 0x5b8]
push 0
push 0
push ecx
push 0
push 0x4c04c0
push esi
call dword [eax + 0x10]
shr eax, 0x1f
xor al, 1
je 0x4670d1
cmp word [ebp - 0x5b8], 8
jne 0x466158
push dword [ebp - 0x5b0]
call fcn.0048e06c
add esp, 4
mov esi, eax
jmp 0x46615e
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 0xa
push eax
call edi
test esi, esi
je 0x4670de
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4ca6e0
jmp 0x4670ac
cmp eax, dword [ebp - 0x608]
jne 0x4663cd
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x4670b1
cmp word [esi], 0
je 0x4670b1
push ecx
push 0x1c2
push 0x96
lea eax, [ebp - 0x310]
mov ecx, edi
push eax
push 1
push 0x4ca740
call fcn.00432b40
test eax, eax
je 0x4670b1
mov dword [ebp - 0x5f8], 0
xor eax, eax
mov byte [ebp - 0x5f0], 0
inc eax
cmp word [eax*2 + 0x4c31f4], 0
jne 0x4661f3
mov dword [ebp - 0x5f4], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x5f4]
xor ecx, ecx
mov dword [ebp - 0x5f8], edx
test eax, eax
jle 0x466250
mov ax, word [ecx*2 + 0x4c31f4]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x5f4]
mov edx, dword [ebp - 0x5f8]
cmp ecx, eax
jl 0x466233
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x5f0], 1
mov byte [ebp - 4], 0x1c
mov eax, 8
push esi
mov byte [ebp - 0x30], 1
mov word [ebp - 0x5e8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x5e0], eax
test eax, eax
je 0x467266
lea eax, [ebp - 0x5f8]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x78]
call fcn.00401560
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x467270
lea eax, [ebp - 0x5e8]
mov byte [ebp - 4], 0xa
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call edi
mov eax, dword [ebp - 0x5f8]
test eax, eax
je 0x4662d8
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x4662e8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0
push eax
push 1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x5cc]
push 0x4c32f4
mov edx, dword [eax + 0x170]
mov ecx, dword [eax + 0x168]
call fcn.0041a9b0
test al, al
je 0x4663a9
mov esi, dword [ebp - 0x574]
lea eax, [ebp - 0x5c8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x5c8]
mov byte [ebp - 4], 0x1e
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x4670fd
mov eax, dword [esi]
lea ecx, [ebp - 0x5c8]
push 0
push 0
push ecx
push 0
push 0x4c04c0
push esi
call dword [eax + 0x10]
shr eax, 0x1f
xor al, 1
je 0x4670fd
cmp word [ebp - 0x5c8], 8
jne 0x46638e
push dword [ebp - 0x5c0]
call fcn.0048e06c
add esp, 4
mov esi, eax
jmp 0x466394
mov esi, dword [ebp - 0x5c0]
lea eax, [ebp - 0x5c8]
mov byte [ebp - 4], 0xa
push eax
call edi
test esi, esi
je 0x46710a
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4ca810
jmp 0x4670ac
cmp eax, 0xffffffd3
je 0x4663db
cmp eax, 0xffffffd2
jne 0x466479
mov esi, dword [ebp - 0x604]
cmp dword [edi + 0x238], esi
jne 0x46647f
mov edx, dword [ebp - 0x2d0]
cmp esi, 0xffffffff
mov ecx, dword [ebp - 0x2d4]
mov eax, esi
cmove eax, edx
test ecx, ecx
je 0x466435
cmp eax, 1
jl 0x466435
cmp eax, edx
jg 0x466435
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x466435
cmp dword [ecx + eax*8], 0xf
jne 0x466435
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
jmp 0x466438
or esi, 0xffffffff
sar esi, 0x1f
lea ecx, [ebp - 0x310]
and esi, 0x20
add esi, 0x20
push esi
push dword [ebp - 0x61c]
call fcn.00414360
push esi
push dword [ebp - 0x618]
lea ecx, [ebp - 0x310]
call fcn.00414360
push esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x310]
call fcn.00414360
jmp 0x4670b1
mov esi, dword [ebp - 0x604]
cmp eax, dword [ebp - 0x61c]
jne 0x4665b9
mov edx, dword [ebp - 0x2d0]
cmp esi, 0xffffffff
mov ecx, dword [ebp - 0x2d4]
mov eax, esi
cmove eax, edx
test ecx, ecx
je 0x46659b
cmp eax, 1
jl 0x46659b
cmp eax, edx
jg 0x46659b
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x46659b
cmp dword [ecx + eax*8], 0xf
jne 0x46659b
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x46659b
push 0
push eax
push esi
lea ecx, [ebp - 0x310]
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x28]
test esi, esi
jne 0x466551
test eax, eax
je 0x466510
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x466546
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x466533
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x28]
jmp 0x466568
test eax, eax
je 0x46655e
push eax
call fcn.00489ed3
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 1
test esi, esi
jne 0x466588
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
sub esp, 0xc
mov byte [ebp - 0x20], 1
mov ecx, esi
call fcn.00408360
jmp 0x4670b1
push ecx
push 0x1c2
push 0x96
lea eax, [ebp - 0x310]
push eax
push 4
push 0x4ca870
jmp 0x4670aa
cmp eax, dword [ebp - 0x618]
jne 0x466789
mov edx, dword [ebp - 0x2d0]
cmp esi, 0xffffffff
mov ecx, dword [ebp - 0x2d4]
mov eax, esi
cmove eax, edx
test ecx, ecx
je 0x46676b
cmp eax, 1
jl 0x46676b
cmp eax, edx
jg 0x46676b
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x46676b
cmp dword [ecx + eax*8], 0xf
jne 0x46676b
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x46676b
push 0
push eax
push esi
lea ecx, [ebp - 0x310]
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x28]
test esi, esi
jne 0x46668e
test eax, eax
je 0x46664a
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x466683
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x466670
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x28]
jmp 0x4666a5
test eax, eax
je 0x46669b
push eax
call fcn.00489ed3
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 1
test esi, esi
jne 0x4666c5
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
push dword [ebp - 0x620]
mov byte [ebp - 0x20], 1
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4670b1
call dword [sym.imp.USER32.dll_EmptyClipboard]
test esi, esi
je 0x466757
xor eax, eax
cmp word [esi], ax
je 0x4666fa
inc eax
cmp word [esi + eax*2], 0
jne 0x4666f2
lea eax, [eax*2 + 2]
mov dword [ebp - 0x5fc], eax
test eax, eax
je 0x466757
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x466760
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x5fc]
push esi
push eax
call fcn.0048b460
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x466760
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4670b1
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4670b1
push ecx
push 0x1c2
push 0xaa
lea eax, [ebp - 0x310]
push eax
push 4
push 0x4ca870
jmp 0x4670aa
cmp eax, dword [ebp - 0x2c]
jne 0x466b71
mov edx, dword [ebp - 0x2d0]
cmp esi, 0xffffffff
mov ecx, dword [ebp - 0x2d4]
mov eax, esi
cmove eax, edx
test ecx, ecx
je 0x46676b
cmp eax, 1
jl 0x46676b
cmp eax, edx
jg 0x46676b
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x46676b
cmp dword [ecx + eax*8], 0xf
jne 0x46676b
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
mov dword [ebp - 0x578], esi
test esi, esi
js 0x46676b
push ecx
push 0x1c2
push 0xaa
lea eax, [ebp - 0x310]
mov ecx, edi
push eax
push 1
push 0x4ca8b8
call fcn.00432b40
test eax, eax
je 0x4670b1
mov dword [ebp - 0x5f8], 0
xor eax, eax
mov byte [ebp - 0x5f0], 0
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c31f4], 0
jne 0x466820
mov dword [ebp - 0x5f4], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x5f4]
xor ecx, ecx
mov dword [ebp - 0x5f8], edx
test eax, eax
jle 0x46687d
mov ax, word [ecx*2 + 0x4c31f4]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x5f4]
mov edx, dword [ebp - 0x5f8]
cmp ecx, eax
jl 0x466860
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x5f0], 1
push ecx
mov ecx, dword [ebp - 0x604]
push esi
push ecx
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x22
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x28]
test esi, esi
jne 0x4668fe
test eax, eax
je 0x4668bc
push eax
call fcn.00489ed3
add esp, 4
push 2
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x4668f3
nop
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
cmp ecx, eax
jl 0x4668e0
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x28]
jmp 0x466915
test eax, eax
je 0x46690b
push eax
call fcn.00489ed3
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 1
test esi, esi
jne 0x466935
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov eax, 8
mov byte [ebp - 0x20], 1
push esi
mov word [ebp - 0x5e8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x5e0], eax
test eax, eax
jne 0x46695e
test esi, esi
jne 0x467266
lea eax, [ebp - 0x5f8]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x78]
call fcn.00401560
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x467270
lea eax, [ebp - 0x5e8]
mov byte [ebp - 4], 0xa
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call edi
mov eax, dword [ebp - 0x5f8]
test eax, eax
je 0x4669b0
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x4669c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0
push eax
push 1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x5cc]
push 0x4c32f4
mov edx, dword [eax + 0x170]
mov ecx, dword [eax + 0x168]
call fcn.0041a9b0
test al, al
je 0x466a7d
mov esi, dword [ebp - 0x574]
lea eax, [ebp - 0x598]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x598]
mov byte [ebp - 4], 0x24
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x466aa1
mov eax, dword [esi]
lea ecx, [ebp - 0x598]
push 0
push 0
push ecx
push 0
push 0x4c04c0
push esi
call dword [eax + 0x10]
shr eax, 0x1f
xor al, 1
je 0x466aa1
cmp word [ebp - 0x598], 8
jne 0x466a66
push dword [ebp - 0x590]
call fcn.0048e06c
add esp, 4
mov esi, eax
jmp 0x466a6c
mov esi, dword [ebp - 0x590]
lea eax, [ebp - 0x598]
mov byte [ebp - 4], 0xa
push eax
call edi
test esi, esi
je 0x466aae
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4ca978
jmp 0x4670ac
lea eax, [ebp - 0x598]
mov byte [ebp - 4], 0xa
push eax
call edi
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4ca920
call fcn.00432b40
mov ecx, dword [ebp - 0x604]
cmp ecx, 0xffffffff
mov edx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
cmove ecx, edx
mov dword [ebp - 0x5fc], ecx
test eax, eax
je 0x4670b1
cmp ecx, 1
jl 0x4670b1
cmp ecx, edx
jg 0x4670b1
lea edi, [ecx + ecx*8]
cmp dword [eax + edi*8 + 0xc], 0
je 0x4670b1
cmp dword [eax + edi*8], 0xf
jne 0x4670b1
mov esi, dword [ebp - 0x578]
push 0
push esi
push 0x1008
push dword [eax + edi*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
dec esi
cmp esi, dword [ebp - 0x578]
jl 0x466b4a
mov eax, dword [ebp - 0x2d4]
jmp 0x466b27
mov eax, dword [ebp - 0x5fc]
push 0
push 0
push 0x1016
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x2d4]
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4670b1
cmp eax, dword [ebp - 0x600]
jne 0x4670b1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x466b8d
push eax
call fcn.00489ed3
add esp, 4
push dword [ebp - 0x620]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
sub esp, 0xc
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 1
call fcn.00408510
test al, al
je 0x4670b1
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x466bdb
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x466bd8
cmp word [ecx], ax
je 0x466bd8
nop dword [eax + eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x466bd0
mov dword [ebp - 0x24], eax
cmp eax, 4
jl 0x467091
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x466c08
push 2
call fcn.0048a28e
xor ecx, ecx
mov dword [ebp - 0x38], eax
add esp, 4
xor edx, edx
mov dword [ebp - 0x5d4], edx
mov word [eax], cx
mov dword [ebp - 0x34], edx
push 0
push 1
push 1
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x30], 1
call fcn.004025a0
cmp eax, 1
je 0x467091
push 0x260
lea eax, [ebp - 0x570]
push 0
push eax
call fcn.0048b9e0
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test eax, eax
jne 0x466c5e
xor eax, eax
test ecx, ecx
je 0x466c59
cmp word [ecx], ax
je 0x466c59
inc eax
cmp word [ecx + eax*2], 0
jne 0x466c51
mov dword [ebp - 0x24], eax
test eax, eax
setg byte [ebp - 0x20]
test eax, eax
jle 0x466c82
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x466c82
dec eax
xor edx, edx
mov dword [ebp - 0x24], eax
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
test eax, eax
jne 0x466c66
mov byte [ebp - 0x20], 0
test eax, eax
jne 0x466c9e
test ecx, ecx
je 0x466c9b
cmp word [ecx], ax
je 0x466c9b
inc eax
cmp word [ecx + eax*2], 0
jne 0x466c93
mov dword [ebp - 0x24], eax
xor ecx, ecx
inc ecx
cmp word [ecx*2 + 0x4bfc80], 0
jne 0x466ca0
add eax, ecx
mov edx, 2
mov dword [ebp - 0x5fc], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, dword [ebp - 0x28]
add esp, 4
mov edi, eax
mov ecx, edi
test edx, edx
je 0x466cf4
movzx esi, word [edx]
test si, si
je 0x466cf4
mov eax, esi
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x466ce3
mov edx, 0x4bfc80
mov esi, 0x5c
sub edx, ecx
mov word [ecx], si
add ecx, 2
movzx eax, word [edx + ecx]
mov esi, eax
test ax, ax
jne 0x466d00
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x466d26
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x5fc]
push 0x250
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x570]
push 0
push eax
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x20], 1
call fcn.0048b9e0
add esp, 0xc
lea eax, [ebp - 0x570]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x320], eax
cmp eax, 0xffffffff
je 0x466d80
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x31c], 0
call fcn.00401370
mov eax, dword [ebp - 0x320]
mov byte [ebp - 4], 0x25
cmp eax, 0xffffffff
je 0x466da7
push ecx
push 0x1c2
push 0xaa
lea eax, [ebp - 0x310]
push eax
push 4
push 0x4caac8
jmp 0x466ff2
mov eax, dword [ebp - 0x24]
mov edx, 2
mov ecx, dword [ebp - 0x28]
test eax, eax
jne 0x466dcc
xor eax, eax
test ecx, ecx
je 0x466dc9
cmp word [ecx], ax
je 0x466dc9
inc eax
cmp word [ecx + eax*2], 0
jne 0x466dc1
mov dword [ebp - 0x24], eax
cmp eax, 2
mov byte [ebp - 0x20], 1
cmovle edx, eax
test eax, eax
je 0x466de5
sub eax, edx
xor edx, edx
mov dword [ebp - 0x24], eax
mov word [ecx + eax*2], dx
mov dword [ebp - 0x5f8], 0
xor eax, eax
mov byte [ebp - 0x5f0], 0
nop dword [eax + eax]
inc eax
cmp word [eax*2 + 0x4c31f4], 0
jne 0x466e00
mov dword [ebp - 0x5f4], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a28e
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x5f4]
xor ecx, ecx
mov dword [ebp - 0x5f8], edx
test eax, eax
jle 0x466e5d
mov ax, word [ecx*2 + 0x4c31f4]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x5f4]
mov edx, dword [ebp - 0x5f8]
cmp ecx, eax
jl 0x466e40
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [ebp - 0x5f0], 1
mov byte [ebp - 4], 0x26
mov esi, dword [ebp - 0x28]
test esi, esi
jne 0x466e8d
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov eax, 8
mov byte [ebp - 0x20], 1
push esi
mov word [ebp - 0x5e8], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x5e0], eax
test eax, eax
jne 0x466eb6
test esi, esi
jne 0x467266
lea eax, [ebp - 0x5f8]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x78]
call fcn.00401560
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x467270
lea eax, [ebp - 0x5e8]
mov byte [ebp - 4], 0x25
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call edi
mov eax, dword [ebp - 0x5f8]
test eax, eax
je 0x466f08
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x466f18
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0
push eax
push 1
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x5cc]
push 0x4c320c
mov edx, dword [eax + 0x170]
mov ecx, dword [eax + 0x168]
call fcn.0041a9b0
test al, al
je 0x466fd9
mov esi, dword [ebp - 0x574]
lea eax, [ebp - 0x5a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x5a8]
mov byte [ebp - 4], 0x28
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x46701c
mov eax, dword [esi]
lea ecx, [ebp - 0x5a8]
push 0
push 0
push ecx
push 0
push 0x4c04c0
push esi
call dword [eax + 0x10]
shr eax, 0x1f
xor al, 1
je 0x46701c
cmp word [ebp - 0x5a8], 8
jne 0x466fbe
push dword [ebp - 0x5a0]
call fcn.0048e06c
add esp, 4
mov esi, eax
jmp 0x466fc4
mov esi, dword [ebp - 0x5a0]
lea eax, [ebp - 0x5a8]
mov byte [ebp - 4], 0x25
push eax
call edi
test esi, esi
je 0x467029
push ecx
push 0x1c2
push 0xaa
lea eax, [ebp - 0x310]
push eax
push 4
push 0x4caba0
mov ecx, dword [ebp - 0x5cc]
call fcn.00432b40
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x320]
cmp eax, 0xffffffff
je 0x4670b1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4670b1
lea eax, [ebp - 0x5a8]
mov byte [ebp - 4], 0x25
push eax
call edi
push ecx
mov ecx, dword [ebp - 0x5cc]
lea eax, [ebp - 0x310]
push 0x1c2
push 0xaa
push eax
push 4
push 0x4cab50
call fcn.00432b40
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x46706c
push 2
call fcn.0048a28e
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
push ecx
mov ecx, dword [ebp - 0x604]
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x310]
mov byte [ebp - 0x20], 1
call fcn.004160e0
jmp 0x466ffd
push ecx
push 0x1c2
push 0xaa
lea eax, [ebp - 0x310]
push eax
push 4
push 0x4caa58
mov ecx, edi
call fcn.00432b40
mov ecx, dword [ebp - 0x5cc]
push 0
call fcn.004284d0
test eax, eax
je 0x46712e
mov edi, dword [ebp - 0x5cc]
jmp 0x4659f0
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 0xa
push eax
call edi
lea ecx, [ebp - 0x310]
call fcn.0040c540
mov ecx, dword [ebp - 0x5cc]
push 0x4ca688
call fcn.00464480
mov esi, eax
jmp 0x467133
lea eax, [ebp - 0x5c8]
mov byte [ebp - 4], 0xa
push eax
call edi
lea ecx, [ebp - 0x310]
call fcn.0040c540
mov ecx, dword [ebp - 0x5cc]
push 0x4ca7b8
call fcn.00464480
mov esi, eax
jmp 0x467133
or esi, 0xffffffff
jmp 0x467133
mov esi, 1
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x574]
test eax, eax
je 0x467147
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x467161
push eax
call fcn.00489ed3
add esp, 4
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x2a
call fcn.0040c540
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x467183
push eax
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x200]
test eax, eax
je 0x467196
push eax
call fcn.00489ed3
add esp, 4
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x88]
mov edi, dword [ebp - 0xa4]
test ecx, ecx
je 0x4671cb
test edi, edi
je 0x4671d8
push dword [ebp - 0x8c]
lea eax, [ebp - 0xa4]
push dword [ebp - 0x9c]
push eax
call fcn.0040c930
call fcn.00403550
test edi, edi
je 0x4671d8
push edi
call fcn.00489ed3
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4671e8
push eax
call fcn.00489ed3
add esp, 4
push dword [ebp - 0x54]
call fcn.00489ed3
add esp, 4
jmp 0x4646bc
push ecx
mov ecx, dword [ebp - 0x5cc]
push 0x1c2
push 0x96
lea eax, [ecx + 0x2a8]
push eax
push 0
push 0x4ca200
call fcn.00432b40
xor esi, esi
jmp 0x4646bc
push ecx
push 0x1c2
push 0x96
lea eax, [edi + 0x2a8]
push eax
push 0
push 0x4c3bf0
mov ecx, edi
call fcn.00432b40
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00489ec5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 0x8007000e
call fcn.00489b60
push eax
call fcn.00489b60
int3