use32
pushad

      mov  esi, $401000       ;WARNING: DEFAULT IMAGEBASE + SECTION SIZE
@@:   lodsd                   ;EAX = [EDI];EDI+=4
      test eax, eax           ;Did we reach the end?
     je    .exit
      cmp  DWORD[eax], $83EC8B55
     jne   @B
      cmp  DWORD[eax+4], $8D560CEC
     jne   @B                 ;> Opcode matching, is it DllFunctionCall()?

      cdq                     ;EDX = 0
      push edx                ;v
      push edx                ;v
      push edx                ;> buffer
      push esp                ;Pointer to buffer
      push $40000             ;Reserved
      push DWORD[esp+$40]     ;Fnc
      push DWORD[esp+$40]     ;Lib

      push esp                ;APICall structure made in stack
      call eax                ;DllFunctionCall(APICall)
      add  esp, 7*4           ;Clear stack

      mov  edx, [esp+$24]     ;&SAFEARRAY
      mov  edx, [edx]         ;SAFEARRAY
      test edx, edx
     jz    .call
      mov  ecx, [edx+$10]     ;SAFEARRAY size Elements
      mov  esi, [edx+$C]      ;SAFEARRAY.pvData
      imul edi, ecx, $10      ;v
      add  esi, edi           ;>last variant
@@:   sub  esi, $10           ;ESI = prev variant
      mov  ebx, [esi+$8]      ;EAX = VARIANT.lVal
      push ebx
      loopne @B               ;Repeat

.call:call eax

.exit:mov  [esp-$1C], eax     ;Save return

popad
ret 4*4