00415C80 	push	ebp
00415C81 	mov	ebp,esp
00415C83 	sub	esp,0Ch
00415C86 	push	00401476h
00415C8B 	mov	eax,fs:[00000000h]
00415C91 	push	eax
00415C92 	mov	fs:[00000000h],esp
00415C99 	sub	esp,0000018Ch
00415C9F 	push	ebx
00415CA0 	push	esi
00415CA1 	mov	esi,[ebp+00000008h]
00415CA4 	push	edi
00415CA5 	mov	eax,esi
00415CA7 	and	esi,FFFFFFFEh
00415CAA 	mov	[ebp-0000000Ch],esp
00415CAD 	and	eax,01h
00415CB0 	mov	ecx,[esi]

* Possible string reference 4012C0h ""
|
00415CB2 	mov	dword ptr [ebp-00000008h],004012C0h
00415CB9 	push	esi
00415CBA 	mov	[ebp-00000004h],eax
00415CBD 	mov	[ebp+00000008h],esi
00415CC0 	call	dword ptr [ecx+00000004h]
00415CC3 	mov	edx,[ebp+00000010h]
00415CC6 	xor	edi,edi
00415CC8 	mov	[ebp-00000024h],edi
00415CCB 	mov	[ebp-00000028h],edi
00415CCE 	cmp	word ptr [edx],FFFFFFFFh
00415CD2 	mov	[ebp-0000002Ch],edi
00415CD5 	mov	[ebp-00000030h],edi
00415CD8 	mov	[ebp-00000034h],edi
00415CDB 	mov	[ebp-00000038h],edi
00415CDE 	mov	[ebp-0000003Ch],edi
00415CE1 	mov	[ebp-00000040h],edi
00415CE4 	mov	[ebp-00000044h],edi
00415CE7 	mov	[ebp-00000048h],edi
00415CEA 	mov	[ebp-0000004Ch],edi
00415CED 	mov	[ebp-00000050h],edi
00415CF0 	mov	[ebp-00000054h],edi
00415CF3 	mov	[ebp-00000058h],edi
00415CF6 	mov	[ebp-0000005Ch],edi
00415CF9 	mov	[ebp-00000060h],edi
00415CFC 	mov	[ebp-00000064h],edi
00415CFF 	mov	[ebp-00000068h],edi
00415D02 	mov	[ebp-0000006Ch],edi
00415D05 	mov	[ebp-00000070h],edi
00415D08 	mov	[ebp-00000074h],edi
00415D0B 	mov	[ebp-00000078h],edi
00415D0E 	mov	[ebp-0000007Ch],edi
00415D11 	mov	[ebp-00000080h],edi
00415D14 	mov	[ebp-00000084h],edi
00415D1A 	mov	[ebp-00000088h],edi
00415D20 	mov	[ebp-0000008Ch],edi
00415D26 	mov	[ebp-0000009Ch],edi
00415D2C 	mov	[ebp-000000ACh],edi
00415D32 	mov	[ebp-000000BCh],edi
00415D38 	mov	[ebp-000000CCh],edi
00415D3E 	mov	[ebp-000000DCh],edi
00415D44 	mov	[ebp-000000ECh],edi
00415D4A 	mov	[ebp-0000011Ch],edi
00415D50 	jnz	00416703h
00415D56 	mov	eax,[esi]
00415D58 	push	esi
00415D59 	call	dword ptr [eax+00000328h]

* Reference to MSVBVM50.__vbaObjSet
|
00415D5F 	mov	ebx,[0041F23Ch]
00415D65 	lea	ecx,[ebp-0000005Ch]
00415D68 	push	eax
00415D69 	push	ecx
00415D6A 	call	ebx
00415D6C 	mov	edx,[eax]
00415D6E 	lea	ecx,[ebp-00000028h]
00415D71 	push	ecx
00415D72 	push	eax
00415D73 	mov	[ebp-00000120h],eax
00415D79 	call	dword ptr [edx+000000A0h]
00415D7F 	cmp	eax,edi
00415D81 	jnl	00415D9Bh
00415D83 	mov	edx,[ebp-00000120h]
00415D89 	push	000000A0h

* Possible string reference 409104h ""
|
00415D8E 	push	00409104h
00415D93 	push	edx
00415D94 	push	eax

* Reference to MSVBVM50.__vbaHresultCheckObj
|
00415D95 	call	dword ptr [0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415D81(C)
|
00415D9B 	mov	eax,[ebp-00000028h]
00415D9E 	push	eax

* Reference to MSVBVM50.__vbaLenBstr
|
00415D9F 	call	dword ptr [0041F1E4h]
00415DA5 	mov	edi,eax
00415DA7 	lea	ecx,[ebp-00000028h]
00415DAA 	dec	edi
00415DAB 	neg	edi
00415DAD 	sbb	edi,edi
00415DAF 	inc	edi
00415DB0 	neg	edi

* Reference to MSVBVM50.__vbaFreeStr
|
00415DB2 	call	dword ptr [0041F368h]
00415DB8 	lea	ecx,[ebp-0000005Ch]

* Reference to MSVBVM50.__vbaFreeObj
|
00415DBB 	call	dword ptr [0041F36Ch]
00415DC1 	test	di,di
00415DC4 	jz	00415ED0h
00415DCA 	mov	ecx,[esi]
00415DCC 	push	esi
00415DCD 	call	dword ptr [ecx+00000328h]
00415DD3 	lea	edx,[ebp-00000060h]
00415DD6 	push	eax
00415DD7 	push	edx
00415DD8 	call	ebx
00415DDA 	mov	eax,[esi]
00415DDC 	push	esi
00415DDD 	call	dword ptr [eax+00000328h]
00415DE3 	lea	ecx,[ebp-0000005Ch]
00415DE6 	push	eax
00415DE7 	push	ecx
00415DE8 	call	ebx
00415DEA 	mov	edi,eax
00415DEC 	lea	edx,[ebp-000000DCh]
00415DF2 	lea	ecx,[ebp-000000ACh]
00415DF8 	mov	[ebp-00000120h],edi

* Possible string reference 409888h "00"
|
00415DFE 	mov	dword ptr [ebp-000000D4h],00409888h
00415E08 	mov	dword ptr [ebp-000000DCh],00000008h

* Reference to MSVBVM50.__vbaVarDup
|
00415E12 	call	dword ptr [0041F338h]
00415E18 	mov	eax,[ebp-00000060h]
00415E1B 	push	01h
00415E1D 	mov	[ebp-00000094h],eax
00415E23 	lea	edx,[ebp-000000ACh]
00415E29 	push	01h
00415E2B 	lea	eax,[ebp-0000009Ch]
00415E31 	push	edx
00415E32 	lea	ecx,[ebp-000000BCh]
00415E38 	push	eax
00415E39 	push	ecx
00415E3A 	mov	dword ptr [ebp-00000060h],00000000h
00415E41 	mov	dword ptr [ebp-0000009Ch],00000009h

* Reference to MSVBVM50.660
|
00415E4B 	call	dword ptr [0041F210h]
00415E51 	mov	edi,[edi]
00415E53 	lea	edx,[ebp-000000BCh]
00415E59 	lea	eax,[ebp-00000028h]
00415E5C 	push	edx
00415E5D 	push	eax

* Reference to MSVBVM50.__vbaStrVarVal
|
00415E5E 	call	dword ptr [0041F2D4h]
00415E64 	mov	[ebp-00000198h],edi
00415E6A 	mov	edi,[ebp-00000120h]
00415E70 	mov	ecx,[ebp-00000198h]
00415E76 	push	eax
00415E77 	push	edi
00415E78 	call	dword ptr [ecx+000000A4h]
00415E7E 	test	eax,eax
00415E80 	jnl	00415E94h
00415E82 	push	000000A4h

* Possible string reference 409104h ""
|
00415E87 	push	00409104h
00415E8C 	push	edi
00415E8D 	push	eax

* Reference to MSVBVM50.__vbaHresultCheckObj
|
00415E8E 	call	dword ptr [0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415E80(C)
|
00415E94 	lea	ecx,[ebp-00000028h]

* Reference to MSVBVM50.__vbaFreeStr
|
00415E97 	call	dword ptr [0041F368h]
00415E9D 	lea	edx,[ebp-00000060h]
00415EA0 	lea	eax,[ebp-0000005Ch]
00415EA3 	push	edx
00415EA4 	push	eax
00415EA5 	push	02h

* Reference to MSVBVM50.__vbaFreeObjList
|
00415EA7 	call	dword ptr [0041F1F8h]
00415EAD 	add	esp,0Ch
00415EB0 	lea	ecx,[ebp-000000BCh]
00415EB6 	lea	edx,[ebp-000000ACh]
00415EBC 	lea	eax,[ebp-0000009Ch]
00415EC2 	push	ecx
00415EC3 	push	edx
00415EC4 	push	eax
00415EC5 	push	03h

* Reference to MSVBVM50.__vbaFreeVarList
|
00415EC7 	call	dword ptr [0041F1F0h]
00415ECD 	add	esp,10h

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415DC4(C)
|
00415ED0 	mov	ecx,[esi]
00415ED2 	push	esi
00415ED3 	call	dword ptr [ecx+00000328h]
00415ED9 	lea	edx,[ebp-0000005Ch]
00415EDC 	push	eax
00415EDD 	push	edx
00415EDE 	call	ebx
00415EE0 	mov	edi,eax
00415EE2 	lea	ecx,[ebp-00000028h]
00415EE5 	push	ecx
00415EE6 	push	edi
00415EE7 	mov	eax,[edi]
00415EE9 	call	dword ptr [eax+000000A0h]
00415EEF 	test	eax,eax
00415EF1 	jnl	00415F05h
00415EF3 	push	000000A0h

* Possible string reference 409104h ""
|
00415EF8 	push	00409104h
00415EFD 	push	edi
00415EFE 	push	eax

* Reference to MSVBVM50.__vbaHresultCheckObj
|
00415EFF 	call	dword ptr [0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415EF1(C)
|
00415F05 	mov	edx,[esi]
00415F07 	push	esi
00415F08 	call	dword ptr [edx+00000328h]
00415F0E 	push	eax
00415F0F 	lea	eax,[ebp-00000060h]
00415F12 	push	eax
00415F13 	call	ebx
00415F15 	mov	edi,eax
00415F17 	lea	edx,[ebp-0000002Ch]
00415F1A 	push	edx
00415F1B 	push	edi
00415F1C 	mov	ecx,[edi]
00415F1E 	call	dword ptr [ecx+000000A0h]
00415F24 	test	eax,eax
00415F26 	jnl	00415F3Ah
00415F28 	push	000000A0h

* Possible string reference 409104h ""
|
00415F2D 	push	00409104h
00415F32 	push	edi
00415F33 	push	eax

* Reference to MSVBVM50.__vbaHresultCheckObj
|
00415F34 	call	dword ptr [0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415F26(C)
|
00415F3A 	mov	eax,[ebp-0000002Ch]
00415F3D 	push	eax

* Reference to MSVBVM50.581
|
00415F3E 	call	dword ptr [0041F370h]

* Reference to MSVBVM50.__vbaFpR8
|
00415F44 	call	dword ptr [0041F258h]
00415F4A 	fcomp	qword ptr [00401200h]
00415F50 	mov	dword ptr [ebp-0000019Ch],00000001h
00415F5A 	fstsw	ax
00415F5C 	test	ah,01h
00415F5F 	jnz	00415F6Bh
00415F61 	mov	dword ptr [ebp-0000019Ch],00000000h

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415F5F(C)
|
00415F6B 	mov	ecx,[esi]
00415F6D 	push	esi
00415F6E 	call	dword ptr [ecx+00000328h]
00415F74 	lea	edx,[ebp-00000064h]
00415F77 	push	eax
00415F78 	push	edx
00415F79 	call	ebx
00415F7B 	mov	edi,eax
00415F7D 	lea	ecx,[ebp-00000030h]
00415F80 	push	ecx
00415F81 	push	edi
00415F82 	mov	eax,[edi]
00415F84 	call	dword ptr [eax+000000A0h]
00415F8A 	test	eax,eax
00415F8C 	jnl	00415FA0h
00415F8E 	push	000000A0h

* Possible string reference 409104h ""
|
00415F93 	push	00409104h
00415F98 	push	edi
00415F99 	push	eax

* Reference to MSVBVM50.__vbaHresultCheckObj
|
00415F9A 	call	dword ptr [0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415F8C(C)
|
00415FA0 	mov	edx,[ebp-00000030h]
00415FA3 	push	edx

* Reference to MSVBVM50.581
|
00415FA4 	call	dword ptr [0041F370h]

* Reference to MSVBVM50.__vbaFpR8
|
00415FAA 	call	dword ptr [0041F258h]
00415FB0 	fcomp	qword ptr [00401208h]
00415FB6 	mov	dword ptr [ebp-000001A0h],00000001h
00415FC0 	fstsw	ax
00415FC2 	test	ah,41h
00415FC5 	jz	00415FD1h
00415FC7 	mov	dword ptr [ebp-000001A0h],00000000h

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415FC5(C)
|
00415FD1 	mov	eax,[ebp-00000028h]
00415FD4 	push	eax

* Reference to MSVBVM50.__vbaLenBstr
|
00415FD5 	call	dword ptr [0041F1E4h]
00415FDB 	mov	ecx,[ebp-000001A0h]
00415FE1 	mov	edi,eax
00415FE3 	mov	eax,[ebp-0000019Ch]
00415FE9 	lea	edx,[ebp-0000002Ch]
00415FEC 	neg	edi
00415FEE 	sbb	edi,edi
00415FF0 	neg	edi
00415FF2 	neg	eax
00415FF4 	neg	ecx
00415FF6 	neg	edi
00415FF8 	or	eax,ecx
00415FFA 	lea	ecx,[ebp-00000030h]
00415FFD 	and	edi,eax
00415FFF 	push	ecx
00416000 	lea	eax,[ebp-00000028h]
00416003 	push	edx
00416004 	push	eax
00416005 	push	03h

* Reference to MSVBVM50.__vbaFreeStrList
|
00416007 	call	dword ptr [0041F308h]
0041600D 	add	esp,10h
00416010 	lea	ecx,[ebp-00000064h]
00416013 	lea	edx,[ebp-00000060h]
00416016 	lea	eax,[ebp-0000005Ch]
00416019 	push	ecx
0041601A 	push	edx
0041601B 	push	eax
0041601C 	push	03h

* Reference to MSVBVM50.__vbaFreeObjList
|
0041601E 	call	dword ptr [0041F1F8h]
00416024 	add	esp,10h
00416027 	test	di,di
0041602A 	jz	00416140h

* Reference to MSVBVM50.__vbaVarDup
|
00416030 	mov	edi,[0041F338h]
00416036 	mov	ecx,80020004h
0041603B 	mov	[ebp-000000C4h],ecx
00416041 	mov	eax,0000000Ah
00416046 	mov	[ebp-000000B4h],ecx
0041604C 	lea	edx,[ebp-000000ECh]
00416052 	lea	ecx,[ebp-000000ACh]
00416058 	mov	[ebp-000000CCh],eax
0041605E 	mov	[ebp-000000BCh],eax

* Possible string reference 4098BCh "Horror"
|
00416064 	mov	dword ptr [ebp-000000E4h],004098BCh
0041606E 	mov	dword ptr [ebp-000000ECh],00000008h
00416078 	call	edi
0041607A 	lea	edx,[ebp-000000DCh]
00416080 	lea	ecx,[ebp-0000009Ch]

* Possible string reference 409894h "Error en el D"
|
00416086 	mov	dword ptr [ebp-000000D4h],00409894h
00416090 	mov	dword ptr [ebp-000000DCh],00000008h
0041609A 	call	edi
0041609C 	lea	ecx,[ebp-000000CCh]
004160A2 	lea	edx,[ebp-000000BCh]
004160A8 	push	ecx
004160A9 	lea	eax,[ebp-000000ACh]
004160AF 	push	edx
004160B0 	push	eax
004160B1 	lea	ecx,[ebp-0000009Ch]
004160B7 	push	10h
004160B9 	push	ecx

* Reference to MSVBVM50.595
|
004160BA 	call	dword ptr [0041F238h]
004160C0 	lea	edx,[ebp-0000011Ch]
004160C6 	lea	ecx,[ebp-00000024h]
004160C9 	mov	[ebp-00000114h],eax
004160CF 	mov	dword ptr [ebp-0000011Ch],00000003h

* Reference to MSVBVM50.__vbaVarMove
|
004160D9 	call	dword ptr [0041F1DCh]
004160DF 	lea	edx,[ebp-000000CCh]
004160E5 	lea	eax,[ebp-000000BCh]
004160EB 	push	edx
004160EC 	lea	ecx,[ebp-000000ACh]
004160F2 	push	eax
004160F3 	lea	edx,[ebp-0000009Ch]
004160F9 	push	ecx
004160FA 	push	edx
004160FB 	push	04h

* Reference to MSVBVM50.__vbaFreeVarList
|
004160FD 	call	dword ptr [0041F1F0h]
00416103 	mov	eax,[ebp+00000010h]
00416106 	add	esp,14h
00416109 	mov	word ptr [eax],0000h
0041610E 	mov	ecx,[esi]
00416110 	push	esi
00416111 	call	dword ptr [ecx+00000328h]
00416117 	lea	edx,[ebp-0000005Ch]
0041611A 	push	eax
0041611B 	push	edx
0041611C 	call	ebx
0041611E 	mov	esi,eax
00416120 	push	esi
00416121 	mov	eax,[esi]
00416123 	call	dword ptr [eax+00000204h]
00416129 	test	eax,eax
0041612B 	jnl	004166F8h
00416131 	push	00000204h

* Possible string reference 409104h ""
|
00416136 	push	00409104h
0041613B 	jmp	004166F0h

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 0041602A(C)
|
00416140 	mov	ecx,[esi]
00416142 	push	esi
00416143 	call	dword ptr [ecx+0000031Ch]
00416149 	lea	edx,[ebp-0000005Ch]
0041614C 	push	eax
0041614D 	push	edx
0041614E 	call	ebx
00416150 	mov	edi,eax
00416152 	lea	ecx,[ebp-00000028h]
00416155 	push	ecx
00416156 	push	edi
00416157 	mov	eax,[edi]
00416159 	call	dword ptr [eax+000000A8h]
0041615F 	test	eax,eax
00416161 	jnl	00416179h
00416163 	push	000000A8h

* Possible string reference 409150h ""
|
00416168 	push	00409150h
0041616D 	push	edi

* Reference to MSVBVM50.__vbaHresultCheckObj
|
0041616E 	mov	edi,[0041F220h]
00416174 	push	eax
00416175 	call	edi
00416177 	jmp	0041617Fh

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416161(C)
|
* Reference to MSVBVM50.__vbaHresultCheckObj
|
00416179 	mov	edi,[0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416177(U)
|
0041617F 	mov	edx,[esi]
00416181 	push	esi
00416182 	call	dword ptr [edx+0000031Ch]
00416188 	push	eax
00416189 	lea	eax,[ebp-00000060h]
0041618C 	push	eax
0041618D 	call	ebx
0041618F 	mov	ecx,[eax]
00416191 	lea	edx,[ebp-0000002Ch]
00416194 	push	edx
00416195 	push	eax
00416196 	mov	[ebp-00000128h],eax
0041619C 	call	dword ptr [ecx+000000A8h]
004161A2 	test	eax,eax
004161A4 	jnl	004161BAh
004161A6 	mov	ecx,[ebp-00000128h]
004161AC 	push	000000A8h

* Possible string reference 409150h ""
|
004161B1 	push	00409150h
004161B6 	push	ecx
004161B7 	push	eax
004161B8 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 004161A4(C)
|
004161BA 	mov	edx,[esi]
004161BC 	push	esi
004161BD 	call	dword ptr [edx+0000031Ch]
004161C3 	push	eax
004161C4 	lea	eax,[ebp-00000064h]
004161C7 	push	eax
004161C8 	call	ebx
004161CA 	mov	ecx,[eax]
004161CC 	lea	edx,[ebp-00000030h]
004161CF 	push	edx
004161D0 	push	eax
004161D1 	mov	[ebp-00000130h],eax
004161D7 	call	dword ptr [ecx+000000A8h]
004161DD 	test	eax,eax
004161DF 	jnl	004161F5h
004161E1 	mov	ecx,[ebp-00000130h]
004161E7 	push	000000A8h

* Possible string reference 409150h ""
|
004161EC 	push	00409150h
004161F1 	push	ecx
004161F2 	push	eax
004161F3 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 004161DF(C)
|
004161F5 	mov	edx,[esi]
004161F7 	push	esi
004161F8 	call	dword ptr [edx+0000031Ch]
004161FE 	push	eax
004161FF 	lea	eax,[ebp-00000068h]
00416202 	push	eax
00416203 	call	ebx
00416205 	mov	ecx,[eax]
00416207 	lea	edx,[ebp-00000034h]
0041620A 	push	edx
0041620B 	push	eax
0041620C 	mov	[ebp-00000138h],eax
00416212 	call	dword ptr [ecx+000000A8h]
00416218 	test	eax,eax
0041621A 	jnl	00416230h
0041621C 	mov	ecx,[ebp-00000138h]
00416222 	push	000000A8h

* Possible string reference 409150h ""
|
00416227 	push	00409150h
0041622C 	push	ecx
0041622D 	push	eax
0041622E 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 0041621A(C)
|
00416230 	mov	edx,[esi]
00416232 	push	esi
00416233 	call	dword ptr [edx+0000031Ch]
00416239 	push	eax
0041623A 	lea	eax,[ebp-0000006Ch]
0041623D 	push	eax
0041623E 	call	ebx
00416240 	mov	ecx,[eax]
00416242 	lea	edx,[ebp-00000038h]
00416245 	push	edx
00416246 	push	eax
00416247 	mov	[ebp-00000140h],eax
0041624D 	call	dword ptr [ecx+000000A8h]
00416253 	test	eax,eax
00416255 	jnl	0041626Bh
00416257 	mov	ecx,[ebp-00000140h]
0041625D 	push	000000A8h

* Possible string reference 409150h ""
|
00416262 	push	00409150h
00416267 	push	ecx
00416268 	push	eax
00416269 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416255(C)
|
0041626B 	mov	edx,[esi]
0041626D 	push	esi
0041626E 	call	dword ptr [edx+0000031Ch]
00416274 	push	eax
00416275 	lea	eax,[ebp-00000070h]
00416278 	push	eax
00416279 	call	ebx
0041627B 	mov	ecx,[eax]
0041627D 	lea	edx,[ebp-0000003Ch]
00416280 	push	edx
00416281 	push	eax
00416282 	mov	[ebp-00000148h],eax
00416288 	call	dword ptr [ecx+000000A8h]
0041628E 	test	eax,eax
00416290 	jnl	004162A6h
00416292 	mov	ecx,[ebp-00000148h]
00416298 	push	000000A8h

* Possible string reference 409150h ""
|
0041629D 	push	00409150h
004162A2 	push	ecx
004162A3 	push	eax
004162A4 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416290(C)
|
004162A6 	mov	edx,[esi]
004162A8 	push	esi
004162A9 	call	dword ptr [edx+0000031Ch]
004162AF 	push	eax
004162B0 	lea	eax,[ebp-00000074h]
004162B3 	push	eax
004162B4 	call	ebx
004162B6 	mov	ecx,[eax]
004162B8 	lea	edx,[ebp-00000040h]
004162BB 	push	edx
004162BC 	push	eax
004162BD 	mov	[ebp-00000150h],eax
004162C3 	call	dword ptr [ecx+000000A8h]
004162C9 	test	eax,eax
004162CB 	jnl	004162E1h
004162CD 	mov	ecx,[ebp-00000150h]
004162D3 	push	000000A8h

* Possible string reference 409150h ""
|
004162D8 	push	00409150h
004162DD 	push	ecx
004162DE 	push	eax
004162DF 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 004162CB(C)
|
004162E1 	mov	edx,[esi]
004162E3 	push	esi
004162E4 	call	dword ptr [edx+0000031Ch]
004162EA 	push	eax
004162EB 	lea	eax,[ebp-00000078h]
004162EE 	push	eax
004162EF 	call	ebx
004162F1 	mov	ecx,[eax]
004162F3 	lea	edx,[ebp-00000044h]
004162F6 	push	edx
004162F7 	push	eax
004162F8 	mov	[ebp-00000158h],eax
004162FE 	call	dword ptr [ecx+000000A8h]
00416304 	test	eax,eax
00416306 	jnl	0041631Ch
00416308 	mov	ecx,[ebp-00000158h]
0041630E 	push	000000A8h

* Possible string reference 409150h ""
|
00416313 	push	00409150h
00416318 	push	ecx
00416319 	push	eax
0041631A 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416306(C)
|
0041631C 	mov	edx,[esi]
0041631E 	push	esi
0041631F 	call	dword ptr [edx+0000031Ch]
00416325 	push	eax
00416326 	lea	eax,[ebp-0000007Ch]
00416329 	push	eax
0041632A 	call	ebx
0041632C 	mov	ecx,[eax]
0041632E 	lea	edx,[ebp-00000048h]
00416331 	push	edx
00416332 	push	eax
00416333 	mov	[ebp-00000160h],eax
00416339 	call	dword ptr [ecx+000000A8h]
0041633F 	test	eax,eax
00416341 	jnl	00416357h
00416343 	mov	ecx,[ebp-00000160h]
00416349 	push	000000A8h

* Possible string reference 409150h ""
|
0041634E 	push	00409150h
00416353 	push	ecx
00416354 	push	eax
00416355 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416341(C)
|
00416357 	mov	edx,[esi]
00416359 	push	esi
0041635A 	call	dword ptr [edx+0000031Ch]
00416360 	push	eax
00416361 	lea	eax,[ebp-00000080h]
00416364 	push	eax
00416365 	call	ebx
00416367 	mov	ecx,[eax]
00416369 	lea	edx,[ebp-0000004Ch]
0041636C 	push	edx
0041636D 	push	eax
0041636E 	mov	[ebp-00000168h],eax
00416374 	call	dword ptr [ecx+000000A8h]
0041637A 	test	eax,eax
0041637C 	jnl	00416392h
0041637E 	mov	ecx,[ebp-00000168h]
00416384 	push	000000A8h

* Possible string reference 409150h ""
|
00416389 	push	00409150h
0041638E 	push	ecx
0041638F 	push	eax
00416390 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 0041637C(C)
|
00416392 	mov	edx,[esi]
00416394 	push	esi
00416395 	call	dword ptr [edx+0000031Ch]
0041639B 	push	eax
0041639C 	lea	eax,[ebp-00000084h]
004163A2 	push	eax
004163A3 	call	ebx
004163A5 	mov	ecx,[eax]
004163A7 	lea	edx,[ebp-00000050h]
004163AA 	push	edx
004163AB 	push	eax
004163AC 	mov	[ebp-00000170h],eax
004163B2 	call	dword ptr [ecx+000000A8h]
004163B8 	test	eax,eax
004163BA 	jnl	004163D0h
004163BC 	mov	ecx,[ebp-00000170h]
004163C2 	push	000000A8h

* Possible string reference 409150h ""
|
004163C7 	push	00409150h
004163CC 	push	ecx
004163CD 	push	eax
004163CE 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 004163BA(C)
|
004163D0 	mov	edx,[esi]
004163D2 	push	esi
004163D3 	call	dword ptr [edx+0000031Ch]
004163D9 	push	eax
004163DA 	lea	eax,[ebp-00000088h]
004163E0 	push	eax
004163E1 	call	ebx
004163E3 	mov	ecx,[eax]
004163E5 	lea	edx,[ebp-00000054h]
004163E8 	push	edx
004163E9 	push	eax
004163EA 	mov	[ebp-00000178h],eax
004163F0 	call	dword ptr [ecx+000000A8h]
004163F6 	test	eax,eax
004163F8 	jnl	0041640Eh
004163FA 	mov	ecx,[ebp-00000178h]
00416400 	push	000000A8h

* Possible string reference 409150h ""
|
00416405 	push	00409150h
0041640A 	push	ecx
0041640B 	push	eax
0041640C 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 004163F8(C)
|
0041640E 	mov	edx,[esi]
00416410 	push	esi
00416411 	call	dword ptr [edx+0000031Ch]
00416417 	push	eax
00416418 	lea	eax,[ebp-0000008Ch]
0041641E 	push	eax
0041641F 	call	ebx
00416421 	mov	ebx,eax
00416423 	lea	edx,[ebp-00000058h]
00416426 	push	edx
00416427 	push	ebx
00416428 	mov	ecx,[ebx]
0041642A 	call	dword ptr [ecx+000000A8h]
00416430 	test	eax,eax
00416432 	jnl	00416442h
00416434 	push	000000A8h

* Possible string reference 409150h ""
|
00416439 	push	00409150h
0041643E 	push	ebx
0041643F 	push	eax
00416440 	call	edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00416432(C)
|
00416442 	mov	eax,[ebp-00000058h]

* Reference to MSVBVM50.__vbaStrCmp
|
00416445 	mov	ebx,[0041F280h]
0041644B 	push	eax

* Possible string reference 4099A0h "Diciembre"
|
0041644C 	push	004099A0h
00416451 	call	ebx
00416453 	mov	ecx,[ebp-00000054h]
00416456 	mov	edi,eax
00416458 	neg	edi
0041645A 	sbb	edi,edi
0041645C 	push	ecx
0041645D 	neg	edi

* Possible string reference 409988h "Noviembre"
|
0041645F 	push	00409988h
00416464 	neg	edi
00416466 	call	ebx
00416468 	mov	edx,[ebp-00000050h]
0041646B 	neg	eax
0041646D 	sbb	eax,eax
0041646F 	push	edx
00416470 	neg	eax
00416472 	neg	eax

* Possible string reference 409974h "Octubre"
|
00416474 	push	00409974h
00416479 	and	edi,eax
0041647B 	call	ebx
0041647D 	neg	eax
0041647F 	sbb	eax,eax
00416481 	neg	eax
00416483 	neg	eax
00416485 	and	edi,eax
00416487 	mov	eax,[ebp-00000030h]
0041648A 	push	eax

* Possible string reference 4098E0h "Febrero"
|
0041648B 	push	004098E0h
00416490 	call	ebx
00416492 	mov	ecx,[ebp-00000038h]
00416495 	neg	eax
00416497 	sbb	eax,eax
00416499 	push	ecx
0041649A 	neg	eax
0041649C 	neg	eax

* Possible string reference 409904h "Abril"
|
0041649E 	push	00409904h
004164A3 	and	edi,eax
004164A5 	call	ebx
004164A7 	mov	edx,[ebp-00000048h]
004164AA 	neg	eax
004164AC 	sbb	eax,eax
004164AE 	push	edx
004164AF 	neg	eax
004164B1 	neg	eax

* Possible string reference 409944h "Agosto"
|
004164B3 	push	00409944h
004164B8 	and	edi,eax
004164BA 	call	ebx
004164BC 	neg	eax
004164BE 	sbb	eax,eax
004164C0 	neg	eax
004164C2 	neg	eax
004164C4 	and	edi,eax
004164C6 	mov	eax,[ebp-0000002Ch]
004164C9 	push	eax

* Possible string reference 4098D0h "Enero"
|
004164CA 	push	004098D0h
004164CF 	call	ebx
004164D1 	mov	ecx,[ebp-00000034h]
004164D4 	neg	eax
004164D6 	sbb	eax,eax
004164D8 	push	ecx
004164D9 	neg	eax
004164DB 	neg	eax

* Possible string reference 4098F4h "Marzo"
|
004164DD 	push	004098F4h
004164E2 	and	edi,eax
004164E4 	call	ebx
004164E6 	mov	edx,[ebp-0000003Ch]
004164E9 	neg	eax
004164EB 	sbb	eax,eax
004164ED 	push	edx
004164EE 	neg	eax
004164F0 	neg	eax

* Possible string reference 409914h "Mayo"
|
004164F2 	push	00409914h
004164F7 	and	edi,eax
004164F9 	call	ebx
004164FB 	neg	eax
004164FD 	sbb	eax,eax
004164FF 	neg	eax
00416501 	neg	eax
00416503 	and	edi,eax
00416505 	mov	eax,[ebp-00000044h]
00416508 	push	eax

* Possible string reference 409934h "Julio"
|
00416509 	push	00409934h
0041650E 	call	ebx
00416510 	mov	ecx,[ebp-0000004Ch]
00416513 	neg	eax
00416515 	sbb	eax,eax
00416517 	push	ecx
00416518 	neg	eax
0041651A 	neg	eax

* Possible string reference 409958h "Septiembre"
|
0041651C 	push	00409958h
00416521 	and	edi,eax
00416523 	call	ebx
00416525 	mov	edx,[ebp-00000040h]
00416528 	neg	eax
0041652A 	sbb	eax,eax
0041652C 	push	edx
0041652D 	neg	eax
0041652F 	neg	eax

* Possible string reference 409924h "Junio"
|
00416531 	push	00409924h
00416536 	and	edi,eax
00416538 	call	ebx
0041653A 	neg	eax
0041653C 	sbb	eax,eax
0041653E 	neg	eax
00416540 	neg	eax
00416542 	and	edi,eax
00416544 	mov	eax,[ebp-00000028h]
00416547 	push	eax

* Reference to MSVBVM50.__vbaLenBstr
|
00416548 	call	dword ptr [0041F1E4h]
0041654E 	neg	eax
00416550 	sbb	eax,eax
00416552 	lea	ecx,[ebp-00000058h]
00416555 	neg	eax
00416557 	neg	eax
00416559 	and	edi,eax
0041655B 	lea	edx,[ebp-00000054h]
0041655E 	push	ecx
0041655F 	lea	eax,[ebp-00000050h]
00416562 	push	edx
00416563 	lea	ecx,[ebp-0000004Ch]
00416566 	push	eax
00416567 	lea	edx,[ebp-00000048h]
0041656A 	push	ecx
0041656B 	lea	eax,[ebp-00000044h]
0041656E 	push	edx
0041656F 	lea	ecx,[ebp-00000040h]
00416572 	push	eax
00416573 	lea	edx,[ebp-0000003Ch]
00416576 	push	ecx
00416577 	lea	eax,[ebp-00000038h]
0041657A 	push	edx
0041657B 	lea	ecx,[ebp-00000034h]
0041657E 	push	eax
0041657F 	lea	edx,[ebp-00000030h]
00416582 	push	ecx
00416583 	lea	eax,[ebp-0000002Ch]
00416586 	push	edx
00416587 	lea	ecx,[ebp-00000028h]
0041658A 	push	eax
0041658B 	push	ecx
0041658C 	push	0Dh

* Reference to MSVBVM50.__vbaFreeStrList
|
0041658E 	call	dword ptr [0041F308h]
00416594 	add	esp,38h
00416597 	lea	edx,[ebp-0000008Ch]
0041659D 	lea	eax,[ebp-00000088h]
004165A3 	lea	ecx,[ebp-00000084h]
004165A9 	push	edx
004165AA 	push	eax
004165AB 	lea	edx,[ebp-00000080h]
004165AE 	push	ecx
004165AF 	lea	eax,[ebp-0000007Ch]
004165B2 	push	edx
004165B3 	lea	ecx,[ebp-00000078h]
004165B6 	push	eax
004165B7 	lea	edx,[ebp-00000074h]
004165BA 	push	ecx
004165BB 	lea	eax,[ebp-00000070h]
004165BE 	push	edx
004165BF 	push	eax
004165C0 	lea	ecx,[ebp-0000006Ch]
004165C3 	lea	edx,[ebp-00000068h]
004165C6 	push	ecx
004165C7 	lea	eax,[ebp-00000064h]
004165CA 	push	edx
004165CB 	lea	ecx,[ebp-00000060h]
004165CE 	push	eax
004165CF 	lea	edx,[ebp-0000005Ch]
004165D2 	push	ecx
004165D3 	push	edx
004165D4 	push	0Dh

* Reference to MSVBVM50.__vbaFreeObjList
|
004165D6 	call	dword ptr [0041F1F8h]
004165DC 	add	esp,38h
004165DF 	test	di,di
004165E2 	jz	00416701h

* Reference to MSVBVM50.__vbaVarDup
|
004165E8 	mov	edi,[0041F338h]
004165EE 	mov	ecx,80020004h
004165F3 	mov	[ebp-000000C4h],ecx
004165F9 	mov	eax,0000000Ah
004165FE 	mov	[ebp-000000B4h],ecx
00416604 	mov	ebx,00000008h
00416609 	lea	edx,[ebp-000000ECh]
0041660F 	lea	ecx,[ebp-000000ACh]
00416615 	mov	[ebp-000000CCh],eax
0041661B 	mov	[ebp-000000BCh],eax

* Possible string reference 4098BCh "Horror"
|
00416621 	mov	dword ptr [ebp-000000E4h],004098BCh
0041662B 	mov	[ebp-000000ECh],ebx
00416631 	call	edi
00416633 	lea	edx,[ebp-000000DCh]
00416639 	lea	ecx,[ebp-0000009Ch]

* Possible string reference 4099B8h "Error en el Mes.."
|
0041663F 	mov	dword ptr [ebp-000000D4h],004099B8h
00416649 	mov	[ebp-000000DCh],ebx
0041664F 	call	edi
00416651 	lea	eax,[ebp-000000CCh]
00416657 	lea	ecx,[ebp-000000BCh]
0041665D 	push	eax
0041665E 	lea	edx,[ebp-000000ACh]
00416664 	push	ecx
00416665 	push	edx
00416666 	lea	eax,[ebp-0000009Ch]
0041666C 	push	10h
0041666E 	push	eax

* Reference to MSVBVM50.595
|
0041666F 	call	dword ptr [0041F238h]
00416675 	lea	edx,[ebp-0000011Ch]
0041667B 	lea	ecx,[ebp-00000024h]
0041667E 	mov	[ebp-00000114h],eax
00416684 	mov	dword ptr [ebp-0000011Ch],00000003h

* Reference to MSVBVM50.__vbaVarMove
|
0041668E 	call	dword ptr [0041F1DCh]
00416694 	lea	ecx,[ebp-000000CCh]
0041669A 	lea	edx,[ebp-000000BCh]
004166A0 	push	ecx
004166A1 	lea	eax,[ebp-000000ACh]
004166A7 	push	edx
004166A8 	lea	ecx,[ebp-0000009Ch]
004166AE 	push	eax
004166AF 	push	ecx
004166B0 	push	04h

* Reference to MSVBVM50.__vbaFreeVarList
|
004166B2 	call	dword ptr [0041F1F0h]
004166B8 	mov	edx,[ebp+00000010h]
004166BB 	add	esp,14h
004166BE 	mov	word ptr [edx],0000h
004166C3 	mov	eax,[esi]
004166C5 	push	esi
004166C6 	call	dword ptr [eax+0000031Ch]
004166CC 	lea	ecx,[ebp-0000005Ch]
004166CF 	push	eax
004166D0 	push	ecx

* Reference to MSVBVM50.__vbaObjSet
|
004166D1 	call	dword ptr [0041F23Ch]
004166D7 	mov	esi,eax
004166D9 	push	esi
004166DA 	mov	edx,[esi]
004166DC 	call	dword ptr [edx+000001F4h]
004166E2 	test	eax,eax
004166E4 	jnl	004166F8h
004166E6 	push	000001F4h

* Possible string reference 409150h ""
|
004166EB 	push	00409150h

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 0041613B(U)
|
004166F0 	push	esi
004166F1 	push	eax

* Reference to MSVBVM50.__vbaHresultCheckObj
|
004166F2 	call	dword ptr [0041F220h]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 0041612B(C), 004166E4(C)
|
004166F8 	lea	ecx,[ebp-0000005Ch]

* Reference to MSVBVM50.__vbaFreeObj
|
004166FB 	call	dword ptr [0041F36Ch]

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 004165E2(C)
|
00416701 	xor	edi,edi

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 00415D50(C)
|
00416703 	mov	[ebp-00000004h],edi
00416706 	wait

* Possible string reference 4167CAh ""
|
00416707 	push	004167CAh
0041670C 	jmp	004167C0h
00416711 	lea	eax,[ebp-00000058h]
00416714 	lea	ecx,[ebp-00000054h]
00416717 	push	eax
00416718 	lea	edx,[ebp-00000050h]
0041671B 	push	ecx
0041671C 	lea	eax,[ebp-0000004Ch]
0041671F 	push	edx
00416720 	lea	ecx,[ebp-00000048h]
00416723 	push	eax
00416724 	lea	edx,[ebp-00000044h]
00416727 	push	ecx
00416728 	lea	eax,[ebp-00000040h]
0041672B 	push	edx
0041672C 	lea	ecx,[ebp-0000003Ch]
0041672F 	push	eax
00416730 	lea	edx,[ebp-00000038h]
00416733 	push	ecx
00416734 	lea	eax,[ebp-00000034h]
00416737 	push	edx
00416738 	lea	ecx,[ebp-00000030h]
0041673B 	push	eax
0041673C 	lea	edx,[ebp-0000002Ch]
0041673F 	push	ecx
00416740 	lea	eax,[ebp-00000028h]
00416743 	push	edx
00416744 	push	eax
00416745 	push	0Dh

* Reference to MSVBVM50.__vbaFreeStrList
|
00416747 	call	dword ptr [0041F308h]
0041674D 	add	esp,38h
00416750 	lea	ecx,[ebp-0000008Ch]
00416756 	lea	edx,[ebp-00000088h]
0041675C 	lea	eax,[ebp-00000084h]
00416762 	push	ecx
00416763 	push	edx
00416764 	lea	ecx,[ebp-00000080h]
00416767 	push	eax
00416768 	lea	edx,[ebp-0000007Ch]
0041676B 	push	ecx
0041676C 	lea	eax,[ebp-00000078h]
0041676F 	push	edx
00416770 	lea	ecx,[ebp-00000074h]
00416773 	push	eax
00416774 	lea	edx,[ebp-00000070h]
00416777 	push	ecx
00416778 	lea	eax,[ebp-0000006Ch]
0041677B 	push	edx
0041677C 	lea	ecx,[ebp-00000068h]
0041677F 	push	eax
00416780 	lea	edx,[ebp-00000064h]
00416783 	push	ecx
00416784 	lea	eax,[ebp-00000060h]
00416787 	push	edx
00416788 	lea	ecx,[ebp-0000005Ch]
0041678B 	push	eax
0041678C 	push	ecx
0041678D 	push	0Dh

* Reference to MSVBVM50.__vbaFreeObjList
|
0041678F 	call	dword ptr [0041F1F8h]
00416795 	add	esp,38h
00416798 	lea	edx,[ebp-000000CCh]
0041679E 	lea	eax,[ebp-000000BCh]
004167A4 	lea	ecx,[ebp-000000ACh]
004167AA 	push	edx
004167AB 	push	eax
004167AC 	lea	edx,[ebp-0000009Ch]
004167B2 	push	ecx
004167B3 	push	edx
004167B4 	push	04h

* Reference to MSVBVM50.__vbaFreeVarList
|
004167B6 	call	dword ptr [0041F1F0h]
004167BC 	add	esp,14h
004167BF 	ret

* Referenced by a (U)nconditional or (C)onditional Jump or (c)all at Address:
| 0041670C(U)
|
004167C0 	lea	ecx,[ebp-00000024h]

* Reference to MSVBVM50.__vbaFreeVar
|
004167C3 	jmp	dword ptr [0041F1E0h]
004167C9 	ret
004167CA 	mov	eax,[ebp+00000008h]
004167CD 	push	eax
004167CE 	mov	ecx,[eax]
004167D0 	call	dword ptr [ecx+00000008h]
004167D3 	mov	ecx,[ebp-00000014h]
004167D6 	mov	eax,[ebp-00000004h]
004167D9 	pop	edi
004167DA 	pop	esi
004167DB 	mov	fs:[00000000h],ecx
004167E2 	pop	ebx
004167E3 	mov	esp,ebp
004167E5 	pop	ebp
004167E6 	ret	000Ch
004167E9 	nop
004167EA 	nop
004167EB 	nop
004167EC 	nop
004167ED 	nop
004167EE 	nop
004167EF 	nop