Function at 0x403720
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
lea ebp, [esp - 0x148]
sub esp, 0x148
push 0xffffffffffffffff
push 0x617f22
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp + 0x144], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
jmp 0x4037c2
jmp 0x403828
lea eax, [ebp - 0x38]
push eax
call 0x40bb40
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x40389c
mov esi, 0xf
mov dword [ebp + 0x88], esi
mov dword [ebp + 0x84], ebx
mov byte [ebp + 0x74], bl
jmp 0x403916
mov dword [ebp + 0xc0], esi
mov dword [ebp + 0xbc], ebx
mov byte [ebp + 0xac], bl
jmp 0x40398e
mov dword [ebp + 0xa4], esi
mov dword [ebp + 0xa0], ebx
mov byte [ebp + 0x90], bl
push ebx
push ebx
mov byte [ebp - 4], 3
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x403a67
mov edi, 0x10
cmp dword [ebp + 0xa4], edi
jb 0x4039d0
mov ecx, dword [ebp + 0x90]
push ecx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0xa4], esi
mov dword [ebp + 0xa0], ebx
mov byte [ebp + 0x90], bl
cmp dword [ebp + 0xc0], edi
jb 0x4039f9
mov edx, dword [ebp + 0xac]
push edx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0xc0], esi
mov dword [ebp + 0xbc], ebx
mov byte [ebp + 0xac], bl
cmp dword [ebp + 0x88], edi
jb 0x403a1f
mov eax, dword [ebp + 0x74]
push eax
call fcn.005c0a50
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + 0x88], esi
mov dword [ebp + 0x84], ebx
mov byte [ebp + 0x74], bl
cmp eax, ebx
je 0x403a4d
mov ecx, dword [ebp - 0x58]
mov edi, dword [ebp - 0x28]
push ecx
call fcn.0040ef20
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005c0a50
add esp, 8
mov eax, dword [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.005c0a50
add esp, 4
jmp 0x406df0
jmp 0x403acd
jmp 0x403b33
lea ecx, [ebp - 0x14]
push ecx
push 0x6be3e8
push 1
push ebx
push 0x6be4b8
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
jmp 0x403bb3
cmp eax, ebx
jge 0x403c33
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, 0x10
cmp dword [ebp + 0xa4], edi
jb 0x403bd9
mov edx, dword [ebp + 0x90]
push edx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0xa4], esi
mov dword [ebp + 0xa0], ebx
mov byte [ebp + 0x90], bl
cmp dword [ebp + 0xc0], edi
jb 0x403c02
mov eax, dword [ebp + 0xac]
push eax
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0xc0], esi
mov dword [ebp + 0xbc], ebx
mov byte [ebp + 0xac], bl
cmp dword [ebp + 0x88], edi
jb 0x403c28
mov ecx, dword [ebp + 0x74]
push ecx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0x88], esi
jmp 0x406ddf
jmp 0x403c99
jmp 0x403cff
mov dword [ebp - 0x10], ebx
jmp 0x403d68
mov ecx, 0x43e738b6
lea eax, [ebp - 0x50]
call fcn.0040dfb0
lea edx, [ebp - 0x5c]
push edx
mov edi, eax
mov byte [ebp - 4], 4
call fcn.004028d0
mov byte [ebp - 4], 5
mov eax, dword [eax]
cmp eax, ebx
je 0x403d92
mov ecx, dword [eax]
jmp 0x403d94
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
lea esi, [ebp - 0x10]
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [ebp - 0x5c]
mov esi, eax
call fcn.00402970
mov byte [ebp - 4], 3
jmp 0x403e1e
cmp esi, ebx
jge 0x403e38
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40646b
jmp 0x403e9e
jmp 0x403f04
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
jmp 0x403f7e
cmp eax, ebx
jge 0x403fc1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp + 0x8c]
call fcn.0040b870
lea ecx, [ebp + 0xa8]
call fcn.0040b870
lea ecx, [ebp + 0x70]
call fcn.0040b870
jmp 0x406de8
jmp 0x404027
mov edi, 0x759dcc0
lea esi, [ebp - 0x8a]
mov dword [ebp - 0x1c], ebx
call fcn.0040e060
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.00402840
mov esi, eax
mov ecx, 0xa1
xor eax, eax
mov dl, byte [eax + 0x6c8f78]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x5c], dl
jns 0x40406d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 3
jl 0x404050
mov byte [ebp - 0x59], 0
lea eax, [ebp - 0x5c]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.00402840
mov byte [ebp - 4], 9
mov ecx, dword [esi]
test ecx, ecx
je 0x404095
mov ecx, dword [ecx]
jmp 0x404097
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x4040a1
mov edx, dword [eax]
jmp 0x4040a3
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
lea edi, [ebp - 0x1c]
push edi
push 0
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push edx
push eax
call ecx
lea edi, [ebp - 0x6c]
mov esi, eax
call fcn.00402970
lea edi, [ebp - 0x64]
mov dword [ebp - 0x5c], 0
call fcn.00402970
mov bl, 3
mov byte [ebp - 4], bl
jmp 0x40413c
xor ecx, ecx
cmp esi, ecx
jge 0x404181
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp + 0x8c]
call fcn.0040b870
lea ecx, [ebp + 0xa8]
call fcn.0040b870
lea ecx, [ebp + 0x70]
call fcn.0040b870
jmp 0x406de8
jmp 0x4041e7
mov dword [ebp - 0x18], ecx
jmp 0x404250
mov dword [ebp - 0x20], ecx
jmp 0x4042b9
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
je 0x40487c
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x18]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
jmp 0x40433e
cmp dword [ebp - 0x20], 0
je 0x40487c
jmp 0x4043ae
jmp 0x404414
mov ecx, 0x6c8f7c
sub ecx, 0x7e1ae418
push ecx
lea eax, [ebp - 0x88]
call fcn.0040e0a0
push 0
push 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x4c]
push esi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x404543
mov ax, word [ebp - 0x4c]
cmp ax, 1
je 0x404543
test ax, ax
je 0x404543
jmp 0x4044cd
mov ecx, dword [ebp - 0x44]
push ecx
lea edx, [ebp + 0xc4]
push 0x6c8f98
push edx
call fcn.005e5778
add esp, 0xc
lea eax, [ebp + 0xc4]
push eax
lea ecx, [ebp]
call fcn.0040b800
push 0xffffffffffffffff
push 0
lea ecx, [ebp]
push ecx
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0xb
call fcn.0040be90
push 0xffffffffffffffff
push 0
lea edx, [ebp]
push edx
lea ecx, [ebp + 0xa8]
call fcn.0040be90
push 0xffffffffffffffff
push 0
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x8c]
call fcn.0040be90
mov ecx, esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ecx
call esi
lea ecx, [ebp]
call fcn.0040b870
jmp 0x404549
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x4045af
jmp 0x404615
mov edx, 0x6c8f9c
sub edx, 0x278cbf8a
push edx
lea eax, [ebp - 0x90]
call fcn.0040e0f0
push 0
push 0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x4046d6
cmp word [ebp - 0x4c], 8
jne 0x4046d6
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0xd
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0xe
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0xf
call fcn.0040be90
lea ecx, [ebp]
call fcn.0040b870
lea ecx, [ebp - 0x4c]
push ecx
call esi
jmp 0x40473c
mov ecx, 0x6c8fc0
sub ecx, 0x3a66cc02
lea eax, [ebp + 0xa]
call 0x40e140
push 0
push 0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x404800
cmp word [ebp - 0x4c], 8
jne 0x404800
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0x11
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x12
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x13
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
lea ecx, [ebp - 0x4c]
push ecx
call esi
jmp 0x404866
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4042c4
jmp 0x4048e2
mov edi, 0x56c47ff9
lea esi, [ebp - 0x90]
call fcn.0040e200
push eax
lea ebx, [ebp - 0x58]
mov byte [ebp - 4], 0x14
call fcn.00402840
mov esi, eax
mov ecx, 0x6c8ff8
sub ecx, 0x127b1479
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x5c], ecx
call fcn.0040e1d0
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x16
call fcn.00402840
mov byte [ebp - 4], 0x17
mov ecx, dword [esi]
test ecx, ecx
je 0x404932
mov ecx, dword [ecx]
jmp 0x404934
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x40493e
mov edx, dword [eax]
jmp 0x404940
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
lea edi, [ebp - 0x1c]
push edi
push 0
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push edx
push eax
call ecx
lea edi, [ebp - 0x64]
mov esi, eax
call fcn.00402970
lea edi, [ebp - 0x58]
mov dword [ebp - 0x6c], 0
call fcn.00402970
mov bl, 3
mov byte [ebp - 4], bl
jmp 0x4049d9
test esi, esi
jl 0x404142
jmp 0x404a47
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404f08
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x18]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x20], 0
je 0x404f08
jmp 0x404ad6
mov ecx, 0x4989a8b4
lea eax, [ebp + 6]
call fcn.0040e240
push 0
push 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x4c]
push esi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x404b66
mov ax, word [ebp - 0x4c]
cmp ax, 1
je 0x404b66
test ax, ax
je 0x404b66
mov ecx, dword [ebp - 0x44]
push ecx
lea edx, [ebp + 0xc4]
push 0x6c9014
push edx
call fcn.005e5778
add esp, 0xc
lea eax, [ebp + 0xc4]
push eax
lea ecx, [ebp]
call fcn.0040b800
push 0xffffffffffffffff
push 0
lea ecx, [ebp]
push ecx
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x19
call fcn.0040be90
mov edx, esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push edx
call esi
lea ecx, [ebp]
call fcn.0040b870
jmp 0x404b6c
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x404bd2
mov eax, 0x6c9018
sub eax, 0x73407540
push eax
lea eax, [ebp - 0x8a]
call fcn.0040e2f0
push 0
push 0
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x404c92
cmp word [ebp - 0x4c], 8
jne 0x404c92
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0x1b
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x1c
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x1d
call fcn.0040be90
lea ecx, [ebp]
call fcn.0040b870
lea ecx, [ebp - 0x4c]
push ecx
call esi
jmp 0x404cf8
jmp 0x404d5e
jmp 0x404dc4
mov edx, 0x6c9038
sub edx, 0x78dc1078
push edx
lea eax, [ebp - 0x8a]
call fcn.0040e340
push 0
push 0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x404e8c
cmp word [ebp - 0x4c], 8
jne 0x404e8c
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0x1f
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x20
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x21
call fcn.0040be90
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040b870
lea ecx, [ebp - 0x4c]
push ecx
call esi
jmp 0x404ef2
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x404a52
jmp 0x404f6e
mov edi, 0x700e342d
lea esi, [ebp - 0x8a]
call 0x40e390
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x22
call fcn.00402840
mov esi, eax
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x62]
call fcn.0040e1d0
push eax
lea ebx, [ebp - 0x58]
mov byte [ebp - 4], 0x24
call fcn.00402840
mov byte [ebp - 4], 0x25
mov ecx, dword [esi]
test ecx, ecx
je 0x404fb3
mov ecx, dword [ecx]
jmp 0x404fb5
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x404fbf
mov edx, dword [eax]
jmp 0x404fc1
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
lea edi, [ebp - 0x1c]
push edi
push 0
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push edx
push eax
call ecx
lea edi, [ebp - 0x58]
mov esi, eax
call fcn.00402970
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x62], 0
call fcn.00402970
mov bl, 3
mov byte [ebp - 4], bl
jmp 0x40505a
test esi, esi
jl 0x404142
jmp 0x4050c8
jmp 0x40512e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40588d
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x18]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
jmp 0x4051b3
cmp dword [ebp - 0x20], 0
je 0x40588d
jmp 0x405223
jmp 0x405289
mov ecx, 0xec845cc
lea eax, [ebp + 0x10]
call 0x40e3d0
push 0
push 0
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x4c]
push esi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
xor ecx, ecx
movzx edx, cx
mov ecx, edx
shl edx, 0x10
or ecx, edx
mov byte [ebp - 4], bl
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], ecx
test eax, eax
jne 0x4053ab
cmp word [ebp - 0x4c], 8
jne 0x4053ab
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x27
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x28
call fcn.0040be90
lea ecx, [ebp - 0x88]
call fcn.0040b870
jmp 0x40539e
mov eax, esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call esi
jmp 0x4053b1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x405417
push 0x5b92ed4a
lea eax, [ebp - 0x88]
call fcn.0040e430
push 0
push 0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
test eax, eax
jne 0x4054b2
cmp word [ebp - 0x4c], 8
jne 0x4054b2
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x2a
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x2b
call fcn.0040be90
lea ecx, [ebp - 0x88]
call fcn.0040b870
lea ecx, [ebp - 0x4c]
push ecx
call esi
jmp 0x405518
mov edx, 0x6c90a0
sub edx, 0x4e801ce8
push edx
lea eax, [ebp - 0x8e]
call 0x40e480
push 0
push 0
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
jmp 0x4055b2
test eax, eax
jne 0x4056f4
cmp word [ebp - 0x4c], 8
jne 0x4056f4
jmp 0x40562b
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x2d
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
jmp 0x4056c1
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x2e
call fcn.0040be90
lea ecx, [ebp - 0x88]
call fcn.0040b870
lea ecx, [ebp - 0x4c]
push ecx
call esi
jmp 0x40575a
mov ecx, 0x6c90c4
sub ecx, 0x7fb01ae4
lea eax, [ebp - 0x68]
call fcn.0040e4d0
push 0
push 0
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp - 0x4c]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
xor ecx, ecx
movzx edx, cx
mov ecx, edx
shl edx, 0x10
or ecx, edx
mov byte [ebp - 4], bl
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov word [ebp - 0x60], cx
test eax, eax
jne 0x405811
cmp word [ebp - 0x4c], 8
jne 0x405811
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x30
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x31
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
lea eax, [ebp - 0x4c]
push eax
call esi
jmp 0x405877
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x405139
jmp 0x4058f3
mov edi, 0x2e042635
lea esi, [ebp - 0x8f]
call 0x40e520
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x32
call fcn.00402840
mov esi, eax
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x62]
call fcn.0040e1d0
push eax
lea ebx, [ebp - 0x58]
mov byte [ebp - 4], 0x34
call fcn.00402840
mov byte [ebp - 4], 0x35
mov ecx, dword [esi]
test ecx, ecx
je 0x405938
mov ecx, dword [ecx]
jmp 0x40593a
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x405944
mov edx, dword [eax]
jmp 0x405946
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
lea edi, [ebp - 0x1c]
push edi
push 0
push 0x30
push ecx
push edx
push eax
mov eax, dword [esi + 0x50]
call eax
lea edi, [ebp - 0x58]
mov esi, eax
call fcn.00402970
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x62], 0
call fcn.00402970
mov bl, 3
mov byte [ebp - 4], bl
jmp 0x4059df
test esi, esi
jge 0x405b3a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x405a58
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x405ac9
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x405b35
jmp 0x403f9e
jmp 0x405ba0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x406461
jmp 0x405bb0
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x18]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
jmp 0x405c2a
cmp dword [ebp - 0x20], 0
je 0x40645e
jmp 0x405c9a
jmp 0x405d00
mov ecx, 0x9423498
lea eax, [ebp - 0x4c]
call 0x40e560
push 0
push 0
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp + 0xc]
push esi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
mov esi, 8
test eax, eax
jne 0x405f07
cmp word [ebp + 0xc], si
jne 0x405f07
jmp 0x405da7
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0x37
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
jmp 0x405e3a
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x38
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
jmp 0x405ed0
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x39
call fcn.0040be90
lea ecx, [ebp - 0x88]
call fcn.0040b870
lea ecx, [ebp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x405f6d
push 0x393f0448
lea eax, [ebp - 0x54]
call 0x40e5e0
push 0
push 0
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
jmp 0x405ffd
test eax, eax
jne 0x4061a5
cmp word [ebp + 0xc], si
jne 0x4061a5
jmp 0x406075
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0x3b
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
jmp 0x406108
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x3c
call fcn.0040be90
lea ecx, [ebp - 0x88]
call fcn.0040b870
jmp 0x40619b
lea ecx, [ebp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40620b
push 0x4cbc16a4
lea eax, [ebp - 0x54]
call fcn.0040e630
push 0
push 0
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push 0
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
mov byte [ebp - 4], bl
jmp 0x40629b
test eax, eax
jne 0x4063e0
cmp word [ebp + 0xc], si
jne 0x4063e0
jmp 0x406313
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0x70]
mov byte [ebp - 4], 0x3e
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
jmp 0x4063a6
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00403500
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 0x3f
call fcn.0040be90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040b870
lea ecx, [ebp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x406446
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x405bb0
jmp 0x406461
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor ebx, ebx
jmp 0x4064d1
mov edi, 0x6c8f38
sub edi, 0x99cc67
mov ecx, edi
lea eax, [ebp - 0x66]
call fcn.0040de90
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x40
call fcn.0040b800
mov byte [ebp - 4], 0x42
xor eax, eax
mov dword [ebp - 0x66], eax
mov dword [ebp - 0x62], eax
cmp dword [ebp + 0x84], ebx
jbe 0x406542
sub esp, 0x1c
lea eax, [ebp + 0x70]
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.0040b840
lea ecx, [ebp - 0x88]
push ecx
call fcn.0040f670
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x43
call fcn.0040bf90
lea ecx, [ebp - 0x88]
call fcn.0040b870
jmp 0x4065a8
mov ecx, edi
lea eax, [ebp - 0x66]
call fcn.0040de90
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x44
call fcn.0040b800
mov byte [ebp - 4], 0x46
xor eax, eax
mov dword [ebp - 0x66], eax
mov dword [ebp - 0x62], eax
cmp dword [ebp + 0xbc], ebx
jbe 0x406611
sub esp, 0x1c
lea edx, [ebp + 0xa8]
mov ecx, esp
mov dword [ebp - 0x58], esp
push edx
call fcn.0040b840
lea eax, [ebp - 0x88]
push eax
call fcn.0040f670
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x47
call fcn.0040bf90
lea ecx, [ebp - 0x88]
call fcn.0040b870
jmp 0x406677
jmp 0x4066dd
jmp 0x406743
jmp 0x4067a9
jmp 0x40680f
mov ecx, edi
lea eax, [ebp - 0x66]
call fcn.0040de90
push eax
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0x48
call fcn.0040b800
mov byte [ebp - 4], 0x4a
xor eax, eax
mov dword [ebp - 0x66], eax
mov dword [ebp - 0x62], eax
cmp dword [ebp + 0xa0], ebx
jbe 0x40687c
sub esp, 0x1c
lea edx, [ebp + 0x8c]
mov ecx, esp
mov dword [ebp - 0x58], esp
push edx
call fcn.0040b840
lea eax, [ebp - 0x88]
push eax
call fcn.0040f670
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0x4b
call fcn.0040bf90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x4a
call fcn.0040b870
jmp 0x4068e2
push 0x41
push ebx
push 0x8e053c
call fcn.005e5820
add esp, 0xc
jmp 0x406958
push 0x41
push ebx
push 0x8e057d
call fcn.005e5820
add esp, 0xc
jmp 0x4069ce
push 0x41
push ebx
push 0x8e05be
call fcn.005e5820
add esp, 0xc
jmp 0x406a44
mov eax, dword [ebp + 0x20]
mov esi, 0x10
cmp dword [ebp + 0x34], esi
jae 0x406a54
lea eax, [ebp + 0x20]
mov ecx, dword [ebp + 0x30]
push ecx
push eax
push 0x8e053c
call fcn.005e4a20
add esp, 0xc
jmp 0x406acc
mov eax, dword [ebp + 0x58]
cmp dword [ebp + 0x6c], esi
jae 0x406ad7
lea eax, [ebp + 0x58]
mov edx, dword [ebp + 0x68]
push edx
push eax
push 0x8e057d
call fcn.005e4a20
add esp, 0xc
jmp 0x406b4f
mov eax, dword [ebp + 0x3c]
cmp dword [ebp + 0x50], esi
jae 0x406b5a
lea eax, [ebp + 0x3c]
mov ecx, dword [ebp + 0x4c]
push ecx
push eax
push 0x8e05be
call fcn.005e4a20
add esp, 0xc
jmp 0x406bd2
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x406c43
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x406cb4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x406d20
cmp dword [ebp + 0x50], esi
jb 0x406d31
mov eax, dword [ebp + 0x3c]
push eax
call fcn.005c0a50
add esp, 4
mov edi, 0xf
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 0x3c], bl
cmp dword [ebp + 0x6c], esi
jb 0x406d50
mov ecx, dword [ebp + 0x58]
push ecx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x58], bl
cmp dword [ebp + 0x34], esi
jb 0x406d6a
mov edx, dword [ebp + 0x20]
push edx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x30], ebx
mov byte [ebp + 0x20], bl
cmp dword [ebp + 0xa4], esi
jb 0x406d8a
mov eax, dword [ebp + 0x90]
push eax
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0xa4], edi
mov dword [ebp + 0xa0], ebx
mov byte [ebp + 0x90], bl
cmp dword [ebp + 0xc0], esi
jb 0x406db3
mov ecx, dword [ebp + 0xac]
push ecx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0xc0], edi
mov dword [ebp + 0xbc], ebx
mov byte [ebp + 0xac], bl
cmp dword [ebp + 0x88], esi
jb 0x406dd9
mov edx, dword [ebp + 0x74]
push edx
call fcn.005c0a50
add esp, 4
mov dword [ebp + 0x88], edi
mov dword [ebp + 0x84], ebx
mov byte [ebp + 0x74], bl
lea esi, [ebp - 0x38]
call fcn.0040bba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x144]
xor ecx, ebp
call fcn.005e4a11
add ebp, 0x148
mov esp, ebp
pop ebp
ret