Function at 0x463f90
Capabilities:
Check os version
Compare security identifiers
Delete directory
Enumerate gui resources
Extract resource via kernel32 functions
Get keyboard layout
Modify service
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3478
call fcn.004994b0
push esi
push edi
mov dword [ebp - 0x74c], 0xd313dd33
push 2
lea ecx, [ebp - 0x28c4]
call fcn.0042e201
mov dword [ebp - 0x594], 0
jmp 0x463fcf
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 2
jge 0x463fee
push dword [ebp - 0x594]
lea ecx, [ebp - 0x28c4]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x463fc2
mov dword [ebp - 0x74c], 0xe
jmp 0x464007
mov eax, dword [ebp - 0x74c]
dec eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0xffffffec
je 0x464085
mov dword [ebp - 0x59c], 0xffffffff
mov dword [ebp - 0x59c], 3
jmp 0x464033
mov eax, dword [ebp - 0x59c]
dec eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0xfffffff9
jl 0x464080
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4f4], 0
jmp 0x46405f
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 2
jge 0x46407e
push dword [ebp - 0x4f4]
lea ecx, [ebp - 0x28c4]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x464052
jmp 0x464026
jmp 0x463ffa
lea ecx, [ebp - 0x28c4]
call fcn.0042e2d3
mov dword [ebp - 0x150], 0
mov dword [ebp - 0xe8c], 0xffffffff
mov dword [ebp - 0x5ac], 8
push 1
lea ecx, [ebp - 0x1dd4]
call fcn.0042e201
mov dword [ebp - 0x754], 0x8ac2
mov dword [ebp - 0xe4], 0
jmp 0x4640de
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x464100
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1dd4]
call fcn.0042e2ef
mov dword [eax], 9
jmp 0x4640d1
mov dword [ebp - 0xe4], 0
jmp 0x464119
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x464135
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xa54], 0xfffffffd
jmp 0x46410c
mov dword [ebp - 0x150], 0
jmp 0x46414e
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffe3
jl 0x464598
mov dword [ebp - 0x5a4], 0x1ab6ec79
mov dword [ebp - 0x1df4], 0xe0d1
mov dword [ebp - 0x2a64], 0xffffffff
mov dword [ebp - 0x2f8c], 0x2891ba8
mov dword [ebp - 0x2d0c], 1
mov dword [ebp - 0x2578], 0x401d
mov dword [ebp - 0x2574], 0x401d
mov dword [ebp - 0x2570], 0x401d
mov dword [ebp - 0x256c], 0x401d
lea ecx, [ebp - 0x959]
call fcn.0042e2fe
push eax
lea eax, [ebp - 0x2568]
push eax
lea eax, [ebp - 0x2578]
push eax
lea ecx, [ebp - 0x32d4]
call fcn.0042e301
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x27d4]
call fcn.0042e2ad
mov dword [ebp - 0x320c], 0
mov dword [ebp - 0x1b5c], 0xff68e10
mov dword [ebp - 0x1fd0], 1
mov dword [ebp - 0x2d14], 0xb400765e
mov dword [ebp - 0x2f9c], 1
mov dword [ebp - 0x26b8], 0x89e17716
mov dword [ebp - 0x26b4], 0x89e17716
mov dword [ebp - 0x26b0], 0x89e17716
mov dword [ebp - 0x26ac], 0x89e17716
lea ecx, [ebp - 0x969]
call fcn.0042e2fe
push eax
lea eax, [ebp - 0x26a8]
push eax
lea eax, [ebp - 0x26b8]
push eax
lea ecx, [ebp - 0x336c]
call fcn.0042e301
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2eb8]
call fcn.0042e2ad
push 1
lea ecx, [ebp - 0x2ea8]
call fcn.0042e201
mov dword [ebp - 0x1fc0], 0
mov dword [ebp - 0x844], 0
jmp 0x4642a9
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 1
jge 0x4642cb
push dword [ebp - 0x844]
lea ecx, [ebp - 0x2ea8]
call fcn.0042e2ef
mov dword [eax], 5
jmp 0x46429c
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x2d1c], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x3130], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x2d24], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x2fac], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x2d2c], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x31dc], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x2d34], eax
mov dword [ebp - 0xe8c], 0x1813f1a0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x150]
cmp dword [ebp - 0xe8c], eax
jge 0x464346
mov dword [ebp - 0x1b44], 1
jmp 0x46434d
and dword [ebp - 0x1b44], 0
mov eax, 0x4446
sub eax, dword [ebp - 0x1b44]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x1b4c], eax
push 0
lea ecx, [ebp - 0x1dd4]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1b4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b4c]
mov dword [ebp - 0x1df4], eax
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
jne 0x464531
push 0
lea ecx, [ebp - 0x27d4]
call fcn.0042e2ef
push 0
lea ecx, [ebp - 0x1dd4]
call fcn.0042e2ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa54]
mov dword [ebp - 0x2fbc], eax
xor eax, eax
inc eax
je 0x4643e5
cmp dword [ebp - 0x1b5c], 0
je 0x4643e5
mov dword [ebp - 0x1b54], 1
jmp 0x4643ec
and dword [ebp - 0x1b54], 0
mov eax, dword [ebp - 0x1fc0]
cmp eax, dword [ebp - 0x1b54]
je 0x464406
mov dword [ebp - 0x1fc8], 1
jmp 0x46440d
and dword [ebp - 0x1fc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa54]
mov dword [ebp - 0x2d3c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa54]
sub eax, dword [ebp - 0x1b5c]
cmp eax, dword [ebp - 0x5ac]
jge 0x464447
mov dword [ebp - 0x1b7c], 1
jmp 0x46444e
and dword [ebp - 0x1b7c], 0
cmp dword [ebp - 0x1b7c], 0x6c6c9a4a
jle 0x464466
mov dword [ebp - 0x1ba4], 1
jmp 0x46446d
and dword [ebp - 0x1ba4], 0
mov eax, dword [ebp - 0x1fd0]
cmp dword [ebp - 0x1ba4], eax
jge 0x464487
mov dword [ebp - 0x1bac], 1
jmp 0x46448e
and dword [ebp - 0x1bac], 0
cmp dword [ebp - 0x1bac], 0xfffffffa
je 0x4644a3
mov dword [ebp - 0x1fd8], 1
jmp 0x4644aa
and dword [ebp - 0x1fd8], 0
mov esi, dword [ebp - 0x754]
push 0
lea ecx, [ebp - 0x27d4]
call fcn.0042e2ef
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1dd4]
call fcn.0042e2ef
cmp esi, dword [eax]
jl 0x4644dc
mov dword [ebp - 0x1bb4], 1
jmp 0x4644e3
and dword [ebp - 0x1bb4], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x1bb4], eax
jg 0x4644fd
mov dword [ebp - 0x1bbc], 1
jmp 0x464504
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0x1bbc], eax
je 0x46451e
mov dword [ebp - 0x1bc4], 1
jmp 0x464525
and dword [ebp - 0x1bc4], 0
cmp dword [ebp - 0x1bc4], 0x2088c4b5
jg 0x464556
push 3
lea ecx, [ebp - 0x2eb8]
call fcn.0042e2ef
cmp dword [eax], 0
je 0x464556
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x464556
mov dword [ebp - 0x1bcc], 1
jmp 0x46455d
and dword [ebp - 0x1bcc], 0
push 0
lea ecx, [ebp - 0x1dd4]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1bcc]
mov dword [eax], ecx
lea ecx, [ebp - 0x2ea8]
call fcn.0042e2d3
lea ecx, [ebp - 0x2eb8]
call fcn.0042e2d3
lea ecx, [ebp - 0x27d4]
call fcn.0042e2d3
jmp 0x464141
lea ecx, [ebp - 0x1dd4]
call fcn.0042e2d3
mov dword [ebp - 0xac], 0xac204e2
mov dword [ebp - 0x3138], 1
mov dword [ebp - 0x2d44], 0xf9986e3
mov dword [ebp - 0x2fcc], 0xfffffff8
mov dword [ebp - 0x2d4c], 0x719d8726
mov dword [ebp - 0x1fe0], 0xd0811fc8
mov dword [ebp - 0x3234], 0x1b0cadfb
mov dword [ebp - 0x1bdc], 0x9338886a
mov dword [ebp - 0x2d54], 0x6cef3cf6
mov dword [ebp - 0x2fdc], 0xfffffff9
mov dword [ebp - 0x2d5c], 0
mov dword [ebp - 0xfc], 0
jmp 0x46462a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x464646
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x3250], 0xffff
jmp 0x46461d
mov dword [ebp - 0xfc], 0
jmp 0x46465f
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x46467b
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x33b4], 0x77b69c93
jmp 0x464652
mov dword [ebp - 0xac], 0x1d
jmp 0x464694
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffff7
jle 0x464723
mov dword [ebp - 0x5b4], 0x197f0a2
mov dword [ebp - 0x834], 0
jmp 0x4646c4
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 1
jge 0x4646e0
mov eax, dword [ebp - 0x834]
mov dword [ebp + eax*4 - 0x2978], 0x17ca
jmp 0x4646b7
mov dword [ebp - 0x5b4], 0
jmp 0x4646f9
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0
jg 0x46471e
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x46471c
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x4646ec
jmp 0x464687
mov dword [ebp - 0xac], 3
jmp 0x46473c
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x464976
mov dword [ebp - 0x1bfc], 3
mov dword [ebp - 0x5bc], 0x2206dd2c
push 2
lea ecx, [ebp - 0x222c]
call fcn.0042e201
mov dword [ebp - 0x24f8], 0x72157666
mov dword [ebp - 0x24f4], 0x72157666
mov dword [ebp - 0x24f0], 0x72157666
mov dword [ebp - 0x24ec], 0x72157666
mov dword [ebp - 0x458], 0xb6d700d1
mov dword [ebp - 0x75c], 0
jmp 0x4647b5
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 2
jge 0x4647d7
push dword [ebp - 0x75c]
lea ecx, [ebp - 0x222c]
call fcn.0042e2ef
mov dword [eax], 0xfa2ef703
jmp 0x4647a8
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2980], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24f8]
dec eax
mov dword [ebp - 0x1bd4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bd4]
mov dword [ebp + eax - 0x24f8], ecx
mov eax, dword [ebp - 0x1bd4]
mov dword [ebp - 0x1bdc], eax
mov eax, dword [ebp - 0x1bfc]
cmp dword [ebp - 0x1bdc], eax
jne 0x464830
mov dword [ebp - 0x1be4], 1
jmp 0x464837
and dword [ebp - 0x1be4], 0
push 0
lea ecx, [ebp - 0x222c]
call fcn.0042e2ef
push 1
lea ecx, [ebp - 0x222c]
call fcn.0042e2ef
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x3250]
sub eax, dword [ebp - 0x1be4]
neg eax
cmp eax, 0xd97
jl 0x464879
mov dword [ebp - 0x1bec], 1
jmp 0x464880
and dword [ebp - 0x1bec], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x3250]
cmp eax, dword [ebp - 0x1bec]
je 0x4648a7
cmp dword [ebp - 0x458], 0
jne 0x4648a7
and dword [ebp - 0x1bf4], 0
jmp 0x4648b1
mov dword [ebp - 0x1bf4], 1
cmp dword [ebp - 0x1bf4], 0xfffffffe
jl 0x4648c6
mov dword [ebp - 0x1c04], 1
jmp 0x4648cd
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0x1bfc]
cmp dword [ebp - 0x1c04], eax
jle 0x4648e7
mov dword [ebp - 0x1c0c], 1
jmp 0x4648ee
and dword [ebp - 0x1c0c], 0
push 1
lea ecx, [ebp - 0x222c]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1c0c]
mov dword [eax], ecx
mov dword [ebp - 0x5bc], 3
jmp 0x46491c
mov eax, dword [ebp - 0x5bc]
dec eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0
jl 0x464966
mov dword [ebp - 0x1fe0], 0x7d239f94
mov dword [ebp - 0x458], 0
jmp 0x464948
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 4
jge 0x464964
mov eax, dword [ebp - 0x458]
mov dword [ebp + eax*4 - 0x33b4], 0x31ec8e12
jmp 0x46493b
jmp 0x46490f
lea ecx, [ebp - 0x222c]
call fcn.0042e2d3
jmp 0x46472f
mov dword [ebp - 0x888], 0xd313dd33
push 2
lea ecx, [ebp - 0x2450]
call fcn.0042e201
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0x830], 0
jmp 0x4649b0
mov eax, dword [ebp - 0x830]
inc eax
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 2
jge 0x4649d2
push dword [ebp - 0x830]
lea ecx, [ebp - 0x2450]
call fcn.0042e2ef
mov dword [eax], 0xac64a684
jmp 0x4649a3
mov dword [ebp - 0x3dc], 0
jmp 0x4649eb
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 2
jge 0x464a0d
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0x2450]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x4649de
push 0
lea ecx, [ebp - 0x2450]
call fcn.0042e2ef
mov dword [ebp - 0x3dc], 0x1dba3399
lea ecx, [ebp - 0x2450]
call fcn.0042e2d3
push 2
lea ecx, [ebp - 0x287c]
call fcn.0042e201
mov dword [ebp - 0xad0], 0xffffffff
mov dword [ebp - 0x2bc], 0xfffffffd
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x41c], 0x5d764ce3
mov dword [ebp - 0x1b4], 0
jmp 0x464a7d
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x464a99
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x93c], 8
jmp 0x464a70
mov dword [ebp - 0x1b4], 0
jmp 0x464ab2
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x464ace
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x5c4], 0x98b94be3
jmp 0x464aa5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x93c], 0
jne 0x464aee
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x464aee
and dword [ebp - 0x1c14], 0
jmp 0x464af8
mov dword [ebp - 0x1c14], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c14]
sub ecx, dword [ebp + eax - 0x93c]
mov dword [ebp - 0xad0], ecx
je 0x464b23
xor eax, eax
je 0x464b23
mov dword [ebp - 0x1c1c], 1
jmp 0x464b2a
and dword [ebp - 0x1c1c], 0
mov eax, dword [ebp - 0x1c1c]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jg 0x464b4b
mov dword [ebp - 0x1c24], 1
jmp 0x464b52
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1fc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x93c], 0
jne 0x464b7e
push 7
pop eax
test eax, eax
jne 0x464b7e
and dword [ebp - 0x1c2c], 0
jmp 0x464b88
mov dword [ebp - 0x1c2c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
cmp dword [ebp - 0x1c2c], eax
jne 0x464ba9
mov dword [ebp - 0x1c34], 1
jmp 0x464bb0
and dword [ebp - 0x1c34], 0
mov eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x464bd3
xor eax, eax
inc eax
jne 0x464bd3
and dword [ebp - 0x1fe8], 0
jmp 0x464bdd
mov dword [ebp - 0x1fe8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
mov dword [ebp - 0x2988], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x93c]
cmp dword [ebp + eax - 0x93c], ecx
jne 0x464c18
mov dword [ebp - 0x1aa4], 1
jmp 0x464c1f
and dword [ebp - 0x1aa4], 0
cmp dword [ebp - 0x1aa4], 1
je 0x464c34
mov dword [ebp - 0x97c], 1
jmp 0x464c3b
and dword [ebp - 0x97c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x97c]
mov dword [ebp + eax - 0x5c4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
cmp dword [ebp - 0x97c], eax
jle 0x464c6f
mov dword [ebp - 0x1ff0], 1
jmp 0x464c76
and dword [ebp - 0x1ff0], 0
mov eax, dword [ebp - 0xad0]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x93c]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x93c]
je 0x464cad
mov eax, 0xc321a078
test eax, eax
je 0x464cad
mov dword [ebp - 0xba4], 1
jmp 0x464cb4
and dword [ebp - 0xba4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x93c]
cmp dword [ebp - 0xba4], eax
je 0x464cd5
mov dword [ebp - 0x1aac], 1
jmp 0x464cdc
and dword [ebp - 0x1aac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
cmp eax, dword [ebp - 0x1aac]
jne 0x464d17
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x464d12
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x464e17
mov dword [ebp - 0x1ff8], 6
mov dword [ebp - 0x1fc], 0
jmp 0x464d3a
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x464e17
mov eax, dword [ebp - 0x1fc]
mov eax, dword [ebp + eax*4 - 0x5c4]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x1ff8], 0xee3199f2
jbe 0x464d72
mov dword [ebp - 0xbac], 1
jmp 0x464d79
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0x1fc]
mov ecx, dword [ebp - 0xbac]
neg ecx
cmp dword [ebp + eax*4 - 0x5c4], ecx
jle 0x464d9c
mov dword [ebp - 0x1ab4], 1
jmp 0x464da3
and dword [ebp - 0x1ab4], 0
mov eax, dword [ebp - 0x1fc]
mov ecx, dword [ebp - 0x1ab4]
mov dword [ebp + eax*4 - 0x5c4], ecx
mov dword [ebp - 0x2bc], 2
jmp 0x464dcf
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jl 0x464e12
mov dword [ebp - 0x41c], 0
jmp 0x464df1
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 2
jg 0x464e10
mov dword [ebp - 0x2000], 1
mov dword [ebp - 0x2000], 0xa051aaf1
jmp 0x464de4
jmp 0x464dc2
jmp 0x464d2d
mov dword [ebp - 0x24], 0xfffd
mov dword [ebp - 0xa5c], 0x16488a
push 3
lea ecx, [ebp - 0x1cc0]
call fcn.0042e201
mov dword [ebp - 0x98c], 0x16765654
mov dword [ebp - 0x1ac4], 8
mov dword [ebp - 0xbdc], 0x5e45db0f
mov dword [ebp - 0x209c], 3
mov dword [ebp - 0x764], 0
jmp 0x464e76
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 3
jge 0x464e98
push dword [ebp - 0x764]
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2ef
mov dword [eax], 0xfffffff6
jmp 0x464e69
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x464eac
mov dword [ebp - 0xbc4], 1
jmp 0x464eb3
and dword [ebp - 0xbc4], 0
mov eax, 0x40ed3c15
test eax, eax
je 0x465015
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
je 0x464ee7
mov eax, 0x3314
test eax, eax
je 0x464ee7
mov dword [ebp - 0xbb4], 1
jmp 0x464eee
and dword [ebp - 0xbb4], 0
push 2
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2ef
mov ecx, dword [ebp - 0xbb4]
cmp ecx, dword [eax]
jl 0x464f11
mov dword [ebp - 0x1abc], 1
jmp 0x464f18
and dword [ebp - 0x1abc], 0
push 2
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1abc]
cmp ecx, dword [eax]
je 0x464f3b
mov dword [ebp - 0x2008], 1
jmp 0x464f42
and dword [ebp - 0x2008], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2990], eax
push 0
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2ef
cmp dword [eax], 0xffff
jne 0x464f6c
mov dword [ebp - 0x984], 1
jmp 0x464f73
and dword [ebp - 0x984], 0
push 2
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x984]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x984], eax
jl 0x464f9f
mov dword [ebp - 0xbbc], 1
jmp 0x464fa6
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0xbbc]
cmp eax, dword [ebp - 0x24]
je 0x464fc3
cmp dword [ebp - 0x24], 0
jne 0x464fc3
and dword [ebp - 0x2094], 0
jmp 0x464fcd
mov dword [ebp - 0x2094], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2998], eax
mov eax, 0x15b45bea
neg eax
neg eax
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x2a38], eax
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0x1ac4], eax
cmp dword [ebp - 0x1ac4], 0xa340
jl 0x465015
mov dword [ebp - 0x1acc], 1
jmp 0x46501c
and dword [ebp - 0x1acc], 0
mov eax, dword [ebp - 0xbc4]
cmp eax, dword [ebp - 0x1acc]
jge 0x465036
mov dword [ebp - 0xbcc], 1
jmp 0x46503d
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xbcc], eax
je 0x465054
mov dword [ebp - 0x1ad4], 1
jmp 0x46505b
and dword [ebp - 0x1ad4], 0
cmp dword [ebp - 0x1ad4], 0xb03c3fa3
je 0x465073
mov dword [ebp - 0xbd4], 1
jmp 0x46507a
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xbd4], eax
jle 0x465091
mov dword [ebp - 0x1adc], 1
jmp 0x465098
and dword [ebp - 0x1adc], 0
mov eax, dword [ebp - 0x1adc]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xbdc], eax
jg 0x4650bb
mov dword [ebp - 0x1ae4], 1
jmp 0x4650c2
and dword [ebp - 0x1ae4], 0
cmp dword [ebp - 0x1ae4], 0x8a59
jl 0x4650da
mov dword [ebp - 0xbe4], 1
jmp 0x4650e1
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xbe4], eax
je 0x4650f8
mov dword [ebp - 0x1aec], 1
jmp 0x4650ff
and dword [ebp - 0x1aec], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1aec], eax
jl 0x465116
mov dword [ebp - 0xbec], 1
jmp 0x46511d
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x209c], eax
cmp dword [ebp - 0x24], 0
je 0x46514d
push 1
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2ef
cmp dword [eax], 0
je 0x46514d
mov dword [ebp - 0x1af4], 1
jmp 0x465154
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x1af4]
mov dword [ebp - 0x98c], eax
lea ecx, [ebp - 0x1cc0]
call fcn.0042e2d3
mov dword [ebp - 0x5cc], 0
jmp 0x465184
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 2
jge 0x4651a3
push dword [ebp - 0x5cc]
lea ecx, [ebp - 0x287c]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x465177
mov dword [ebp - 0x2a40], 0xa684
mov byte [ebp - 0x29f], 0
movzx eax, byte [ebp - 0x29f]
test eax, eax
je 0x4651cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov byte [ebp - 0x2a1], 0
movzx eax, byte [ebp - 0x2a1]
test eax, eax
je 0x465206
push 0x85b
push 0x1253
push 0x17af
push 0x17f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [ebp - 0x888], 0xe
jmp 0x46521f
mov eax, dword [ebp - 0x888]
dec eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0xffffffec
je 0x46603a
push 2
lea ecx, [ebp - 0x223c]
call fcn.0042e201
mov dword [ebp - 0xa8], 0xe7ccc895
mov dword [ebp - 0x5d4], 0
jmp 0x46525c
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 2
jge 0x46527e
push dword [ebp - 0x5d4]
lea ecx, [ebp - 0x223c]
call fcn.0042e2ef
mov dword [eax], 0xd4e06482
jmp 0x46524f
push 0
lea ecx, [ebp - 0x223c]
call fcn.0042e2ef
mov dword [eax], 0xffffffe2
jmp 0x4652b7
push 0
lea ecx, [ebp - 0x223c]
call fcn.0042e2ef
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0xbf4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xbf4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x223c]
call fcn.0042e2ef
cmp dword [eax], 0xfffffff4
jg 0x465466
push 2
lea ecx, [ebp - 0x1c44]
call fcn.0042e201
mov dword [ebp - 0x46c], 0x13fe662d
mov dword [ebp - 0x20ac], 0xeafb5d1c
mov dword [ebp - 0x76c], 0
jmp 0x465307
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 2
jge 0x465329
push dword [ebp - 0x76c]
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
mov dword [eax], 0xe5664dc9
jmp 0x4652fa
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x46c], eax
xor eax, eax
inc eax
je 0x465358
push 1
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
cmp dword [eax], 0
je 0x465358
mov dword [ebp - 0x20a4], 1
jmp 0x46535f
and dword [ebp - 0x20a4], 0
push 0
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x2a48], eax
push 0
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
push 0
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
mov esi, eax
mov edi, dword [ebp - 0xa8]
push 0
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
add edi, dword [eax]
imul eax, edi, 0xffff
mov esi, dword [esi]
sub esi, eax
push 0
lea ecx, [ebp - 0x1c44]
call fcn.0042e2ef
cmp esi, dword [eax]
jg 0x4653d0
mov dword [ebp - 0x1afc], 1
jmp 0x4653d7
and dword [ebp - 0x1afc], 0
mov eax, dword [ebp - 0x1afc]
mov dword [ebp - 0x20ac], eax
mov dword [ebp - 0x46c], 0xfffffffd
jmp 0x4653fc
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 5
jle 0x465456
mov dword [ebp - 0xa8], 0xfffffffd
jmp 0x46541e
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe2
jne 0x465454
mov byte [ebp - 0x2a3], 0
movzx eax, byte [ebp - 0x2a3]
test eax, eax
je 0x465452
push 0x24fc
push 0
push 0x29a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x465411
jmp 0x4653ef
lea ecx, [ebp - 0x1c44]
call fcn.0042e2d3
jmp 0x465293
mov dword [ebp - 0xa8], 0xfffffff1
jmp 0x46547f
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe3
je 0x4654aa
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x4654a8
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x465472
lea ecx, [ebp - 0x223c]
call fcn.0042e2d3
mov dword [ebp - 0x5dc], 0xffffffff
mov dword [ebp - 0x98], 0xfffffff7
mov dword [ebp - 0x2c4], 0xffff
mov dword [ebp - 0x23c], 0xeae21516
mov dword [ebp - 0x4fc], 0x2d50c857
mov dword [ebp - 0x53c], 0x3eb61943
mov dword [ebp - 0x47c], 0x898d08f4
cmp dword [ebp - 0x98], 0x1b35d569
jl 0x465513
mov dword [ebp - 0xbfc], 1
jmp 0x46551a
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0xbfc]
sub eax, dword [ebp - 0x2c4]
jne 0x465531
cmp dword [ebp - 0x2c4], 0
je 0x465546
cmp dword [ebp - 0x2c4], 0
je 0x465546
mov dword [ebp - 0x20b4], 1
jmp 0x46554d
and dword [ebp - 0x20b4], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2a50], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2a58], eax
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x98]
je 0x465585
mov dword [ebp - 0x20bc], 1
jmp 0x46558c
and dword [ebp - 0x20bc], 0
mov eax, dword [ebp - 0x2c4]
add eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x98]
jge 0x4655ac
mov dword [ebp - 0x1b04], 1
jmp 0x4655b3
and dword [ebp - 0x1b04], 0
mov eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp - 0x98], eax
jl 0x4655d9
mov dword [ebp - 0xc04], 1
jmp 0x4655e0
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xc04]
je 0x465603
cmp dword [ebp - 0x98], 0
je 0x465603
mov dword [ebp - 0x1b0c], 1
jmp 0x46560a
and dword [ebp - 0x1b0c], 0
imul eax, dword [ebp - 0x1b0c], 0xfffe
sub eax, dword [ebp - 0x98]
mov dword [ebp - 0x53c], eax
imul eax, dword [ebp - 0x53c], 0xdda8
cmp eax, 1
je 0x46563b
mov dword [ebp - 0xc0c], 1
jmp 0x465642
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0xc0c]
mov dword [ebp - 0x47c], eax
je 0x4658b9
mov dword [ebp - 0x474], 0x63b6910c
mov dword [ebp - 0x20c4], 0xde333b8f
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x23c], 0
jmp 0x465691
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x1a
jl 0x4658b4
mov dword [ebp - 0xacc], 1
mov dword [ebp - 0x20cc], 0x236c3428
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x4656e4
push 0
push 0x1eaf
push 0
push 0x23d2
push 0x1788
push 0
push 0xab6
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x2a60], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2a68], eax
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x2a70], eax
mov dword [ebp - 0x20c4], 0xffff
cmp dword [ebp - 0xacc], 6
jae 0x465727
mov dword [ebp - 0x1b14], 1
jmp 0x46572e
and dword [ebp - 0x1b14], 0
imul eax, dword [ebp - 0x1b14], 0x5e06
cmp eax, 0x8385
jge 0x46574b
mov dword [ebp - 0xc14], 1
jmp 0x465752
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x53c]
imul eax, dword [ebp - 0xc14]
sub eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0x474]
je 0x465779
mov dword [ebp - 0x1b1c], 1
jmp 0x465780
and dword [ebp - 0x1b1c], 0
mov eax, dword [ebp - 0x1b1c]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x53c], eax
jle 0x4657a6
mov dword [ebp - 0xc1c], 1
jmp 0x4657ad
and dword [ebp - 0xc1c], 0
cmp dword [ebp - 0xc1c], 0xffffffff
jle 0x4657c8
mov eax, 0x5372
test eax, eax
jne 0x4657c8
and dword [ebp - 0x1b24], 0
jmp 0x4657d2
mov dword [ebp - 0x1b24], 1
cmp dword [ebp - 0x1b24], 0x81ca8fd5
jne 0x4657ea
mov dword [ebp - 0xc24], 1
jmp 0x4657f1
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xc24], eax
jg 0x46580b
mov dword [ebp - 0x1b2c], 1
jmp 0x465812
and dword [ebp - 0x1b2c], 0
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x1b2c], eax
jne 0x465832
cmp dword [ebp - 0x47c], 0
jne 0x465832
and dword [ebp - 0xc2c], 0
jmp 0x46583c
mov dword [ebp - 0xc2c], 1
mov eax, dword [ebp - 0xc2c]
sub eax, 0x869
cmp eax, 0x21fd
jne 0x46585a
mov dword [ebp - 0x1b34], 1
jmp 0x465861
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x1b34], eax
je 0x46587b
mov dword [ebp - 0x1b3c], 1
jmp 0x465882
and dword [ebp - 0x1b3c], 0
mov eax, dword [ebp - 0xacc]
cmp dword [ebp - 0x1b3c], eax
jg 0x46589c
mov dword [ebp - 0xc34], 1
jmp 0x4658a3
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0x20cc], eax
jmp 0x465684
jmp 0x465a8c
mov dword [ebp - 0x57c], 1
mov dword [ebp - 0x25a0], 0x87c03c79
mov dword [ebp - 0x259c], 0x87c03c79
mov dword [ebp - 0x2598], 0x87c03c79
mov dword [ebp - 0x2594], 0x87c03c79
lea ecx, [ebp - 0xadd]
call fcn.0042e2fe
push eax
lea eax, [ebp - 0x2590]
push eax
lea eax, [ebp - 0x25a0]
push eax
lea ecx, [ebp - 0x3304]
call fcn.0042e301
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2ec8]
call fcn.0042e2ad
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x46594d
push 0x1e76
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebp - 0x57c], 0xffffbfd7
jg 0x465965
mov dword [ebp - 0xc84], 1
jmp 0x46596c
and dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0xc84]
neg eax
cmp dword [ebp - 0x57c], eax
jne 0x465988
mov dword [ebp - 0xc40], 1
jmp 0x46598f
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp - 0xc40], eax
je 0x4659be
cmp dword [ebp - 0x47c], 0
je 0x4659be
mov dword [ebp - 0x1460], 1
jmp 0x4659c5
and dword [ebp - 0x1460], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x1460], eax
jle 0x4659df
mov dword [ebp - 0xc48], 1
jmp 0x4659e6
and dword [ebp - 0xc48], 0
imul eax, dword [ebp - 0xc48], 0xb793
cmp eax, dword [ebp - 0x57c]
jl 0x465a04
mov dword [ebp - 0x20d4], 1
jmp 0x465a0b
and dword [ebp - 0x20d4], 0
cmp dword [ebp - 0x2c4], 0x5ced7c6c
jge 0x465a23
mov dword [ebp - 0x1870], 1
jmp 0x465a2a
and dword [ebp - 0x1870], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1870], eax
jg 0x465a44
mov dword [ebp - 0xc50], 1
jmp 0x465a4b
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0x57c]
cmp dword [ebp - 0xc50], eax
jge 0x465a65
mov dword [ebp - 0x1468], 1
jmp 0x465a6c
and dword [ebp - 0x1468], 0
push 3
lea ecx, [ebp - 0x2ec8]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1468]
mov dword [eax], ecx
lea ecx, [ebp - 0x2ec8]
call fcn.0042e2d3
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x465aa8
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov dword [ebp - 0x5dc], 3
jmp 0x465ac1
mov eax, dword [ebp - 0x5dc]
dec eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0xfffffff9
jl 0x466035
mov dword [ebp - 0x2a78], 0xc05baf43
mov dword [ebp - 0x2a80], 0x3d8da8e9
mov dword [ebp - 0x2a88], 0xb4074dd0
mov dword [ebp - 0x2a90], 0x6f5a9c4c
mov dword [ebp - 0x2a98], 2
mov dword [ebp - 0x2aa0], 0xfffffffe
mov dword [ebp - 0x2aa8], 0xfbf2121f
mov dword [ebp - 0x2ab0], 9
mov dword [ebp - 0x2ab8], 0xffffffff
mov dword [ebp - 0x2ac0], 0x20e32cf4
mov dword [ebp - 0x2ac8], 0
mov dword [ebp - 0x2ad0], 0x5720b963
mov dword [ebp - 0x2ad8], 0x6fe23a26
mov dword [ebp - 0x2ae0], 0x3bd6525
mov dword [ebp - 0x2ae8], 0xffffffff
mov dword [ebp - 0x2af0], 2
mov dword [ebp - 0x2af8], 0xb27fa3df
mov dword [ebp - 0x2b00], 1
mov dword [ebp - 0xc58], 1
mov eax, dword [ebp - 0xc58]
dec eax
mov dword [ebp - 0xc58], eax
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x104], 0
jmp 0x465bbc
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x465bd8
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x326c], 0
jmp 0x465baf
mov dword [ebp - 0x104], 0
jmp 0x465bf1
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x465c0d
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x2468], 0xffffffff
jmp 0x465be4
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2468], 0
jmp 0x465c38
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2468]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2468], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2468], 2
jg 0x465db1
mov dword [ebp - 0x838], 0x98311173
mov dword [ebp - 0x838], 2
jmp 0x465c6e
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
jl 0x465d92
mov dword [ebp - 0x5e4], 0
jmp 0x465c94
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 1
jge 0x465cb0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x774], 0xd0d3f7bf
jmp 0x465c87
mov byte [ebp - 0x2ad], 0
movzx eax, byte [ebp - 0x2ad]
test eax, eax
je 0x465cdd
push 0
push 0
push 0x22d3
push 0x914
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x774], 0
jmp 0x465d0b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x774]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x774], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x774], 2
jg 0x465d8d
mov dword [ebp - 0x5ec], 0x2513244d
mov dword [ebp - 0x5ec], 2
jmp 0x465d3e
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0
jl 0x465d88
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x484], 0
jmp 0x465d6a
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 3
jge 0x465d86
mov eax, dword [ebp - 0x484]
mov dword [ebp + eax*4 - 0x326c], 0xffaf0720
jmp 0x465d5d
jmp 0x465d31
jmp 0x465cf0
jmp 0x465c61
mov byte [ebp - 0x2af], 0
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x465dac
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x465c1f
mov dword [ebp - 0x504], 0
jmp 0x465dca
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 2
jge 0x466030
mov dword [ebp - 0x68], 0x4173
mov dword [ebp - 0x204], 0xfffffff7
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x8cc], 0x2c5b641b
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x2b08], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2b10], eax
cmp dword [ebp - 0x204], 0x4b064ba
jle 0x465e35
mov dword [ebp - 0x20dc], 1
jmp 0x465e3c
and dword [ebp - 0x20dc], 0
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x2b18], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x8cc], eax
jne 0x465e62
mov dword [ebp - 0x1a78], 1
jmp 0x465e69
and dword [ebp - 0x1a78], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x1a78], eax
jne 0x465e83
mov dword [ebp - 0xc60], 1
jmp 0x465e8a
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0x2cc], eax
mov eax, 0x74b6046e
add eax, 0x1b0fe2cf
je 0x465eab
cmp dword [ebp - 0x204], 0
jne 0x465eba
cmp dword [ebp - 0x68], 0
jne 0x465eba
and dword [ebp - 0x1470], 0
jmp 0x465ec4
mov dword [ebp - 0x1470], 1
cmp dword [ebp - 0x1470], 0x1a6e483b
jge 0x465edc
mov dword [ebp - 0xc68], 1
jmp 0x465ee3
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0xc68]
jl 0x465f03
cmp dword [ebp - 0x204], 0
je 0x465f03
mov dword [ebp - 0x1878], 1
jmp 0x465f0a
and dword [ebp - 0x1878], 0
mov eax, dword [ebp - 0x204]
imul eax, dword [ebp - 0x1878]
cmp eax, dword [ebp - 0x68]
jl 0x465f28
mov dword [ebp - 0xc70], 1
jmp 0x465f2f
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x8cc]
cmp dword [ebp - 0xc70], eax
jne 0x465f49
mov dword [ebp - 0x1478], 1
jmp 0x465f50
and dword [ebp - 0x1478], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x1478], eax
jl 0x465f80
mov dword [ebp - 0x20e4], 0x312b9482
mov dword [ebp - 0x2cc], 0xfffffffa
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x20e4], eax
jmp 0x465fbe
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x68], 0
jmp 0x465f9c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x26
jne 0x465fbe
mov byte [ebp - 0x2b1], 0
movzx eax, byte [ebp - 0x2b1]
test eax, eax
je 0x465fbc
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x465f95
mov dword [ebp - 0x68], 0xa
jmp 0x465fce
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x1a
jle 0x466017
mov dword [ebp - 0x20ec], 0
cmp dword [ebp - 0x20ec], 0
je 0x465fe9
jmp 0x466017
push 8
pop eax
test eax, eax
je 0x466002
cmp dword [ebp - 0x68], 0
je 0x466002
mov dword [ebp - 0xc78], 1
jmp 0x466009
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0x2cc], eax
jmp 0x465fc7
push dword [ebp - 0x504]
lea ecx, [ebp - 0x287c]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x465dbd
jmp 0x465ab4
jmp 0x465212
lea ecx, [ebp - 0x287c]
call fcn.0042e2d3
mov dword [ebp - 0x22c], 0x8b108f82
push 4
lea ecx, [ebp - 0x27ec]
call fcn.0042e201
mov dword [ebp - 0x20fc], 0x9333c7d2
mov dword [ebp - 0x17c], 0
jmp 0x46607f
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x46609b
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x20f4], 0x4a55f07c
jmp 0x466072
mov dword [ebp - 0x17c], 0
jmp 0x4660b4
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 4
jge 0x4660d6
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x27ec]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x4660a7
cmp dword [ebp - 0x22c], 0xb779c63c
jae 0x4660ee
mov dword [ebp - 0x1b9c], 1
jmp 0x4660f5
and dword [ebp - 0x1b9c], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x1b9c], eax
jl 0x46610f
mov dword [ebp - 0xc80], 1
jmp 0x466116
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0xc80], eax
jne 0x466130
mov dword [ebp - 0x1480], 1
jmp 0x466137
and dword [ebp - 0x1480], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x1480], eax
jl 0x466151
mov dword [ebp - 0xc88], 1
jmp 0x466158
and dword [ebp - 0xc88], 0
cmp dword [ebp - 0xc88], 0xfff6
jae 0x466179
cmp dword [ebp - 0x22c], 0
je 0x466179
mov dword [ebp - 0x994], 1
jmp 0x466180
and dword [ebp - 0x994], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x994]
mov dword [ebp + eax - 0x20f4], ecx
mov eax, dword [ebp - 0x22c]
imul eax, dword [ebp - 0x994]
add eax, dword [ebp - 0x22c]
je 0x4661c6
push 3
lea ecx, [ebp - 0x27ec]
call fcn.0042e2ef
cmp dword [eax], 0
je 0x4661c6
mov dword [ebp - 0x1880], 1
jmp 0x4661cd
and dword [ebp - 0x1880], 0
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x1880]
jne 0x4661e7
mov dword [ebp - 0xc90], 1
jmp 0x4661ee
and dword [ebp - 0xc90], 0
cmp dword [ebp - 0xc90], 0x1438
jge 0x466206
mov dword [ebp - 0x1488], 1
jmp 0x46620d
and dword [ebp - 0x1488], 0
mov eax, dword [ebp - 0x1488]
mov dword [ebp - 0x20fc], eax
mov byte [ebp - 0x2b3], 0
movzx eax, byte [ebp - 0x2b3]
test eax, eax
je 0x466250
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12d7
push 0xa96
push 0x1511
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [ebp - 0x27ec]
call fcn.0042e2d3
cmp dword [ebp + 8], 2
jl 0x47156e
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x2d4], 8
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x2b20], eax
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jne 0x4662ac
mov eax, 0x29c1464f
test eax, eax
jne 0x4662ac
and dword [ebp - 0xc98], 0
jmp 0x4662b6
mov dword [ebp - 0xc98], 1
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0xc98], eax
jl 0x4662d0
mov dword [ebp - 0x1a80], 1
jmp 0x4662d7
and dword [ebp - 0x1a80], 0
cmp dword [ebp - 0x1a80], 0x32b1cecb
jge 0x4662ef
mov dword [ebp - 0xca0], 1
jmp 0x4662f6
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0xca0], eax
jl 0x466364
mov dword [ebp - 0x2d4], 0
jmp 0x46631d
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xffffffff
jne 0x466362
mov byte [ebp - 0x2b5], 0
movzx eax, byte [ebp - 0x2b5]
test eax, eax
je 0x466360
push 0x85b
push 0x1253
push 0x17af
push 0x17f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x466310
jmp 0x466394
mov dword [ebp - 0x2104], 3
mov eax, dword [ebp - 0x2104]
mov dword [ebp - 0x2d4], eax
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x466394
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 1
lea eax, [ebp - 0x342c]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.004606c7
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x32c0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x32c0]
lea edi, [ebp - 0x2480]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2dc], 0xe91a049f
mov dword [ebp - 0x77c], 0xeb987642
mov dword [ebp - 0xca8], 0x1654
mov dword [ebp - 0x1490], 0x52509e71
mov dword [ebp - 0x2114], 0x16b5
mov dword [ebp - 0x2dc], 0xffffffe5
jmp 0x46640e
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xfffffffa
jl 0x4664de
mov dword [ebp - 0x48c], 0xe21afa9b
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x77c], eax
je 0x466475
cmp dword [ebp - 0xca8], 0
je 0x466454
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x48c]
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x2b28], eax
cmp dword [ebp - 0x77c], 0
je 0x466475
mov dword [ebp - 0x210c], 1
jmp 0x46647c
and dword [ebp - 0x210c], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2b30], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2b38], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x1490], eax
mov eax, dword [ebp - 0x1490]
mov dword [ebp - 0x2b40], eax
mov eax, dword [ebp - 0xca8]
cmp dword [ebp - 0x48c], eax
jge 0x4664c6
mov dword [ebp - 0x1888], 1
jmp 0x4664cd
and dword [ebp - 0x1888], 0
mov eax, dword [ebp - 0x1888]
mov dword [ebp - 0x2114], eax
jmp 0x466401
cmp dword [ebp - 0x2480], 0
je 0x4664fb
push 0
push dword [ebp - 0x2478]
push dword [ebp - 0x247c]
call dword [ebp - 0x2480]
mov dword [ebp - 0xcb8], 0x4210
mov dword [ebp - 0x5fc], 0
jmp 0x46651e
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 1
jge 0x46653a
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0xb8], 0xfffffff9
jmp 0x466511
xor eax, eax
inc eax
je 0x4665b4
mov dword [ebp - 0x840], 0
jmp 0x466558
mov eax, dword [ebp - 0x840]
inc eax
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 2
jge 0x466574
mov eax, dword [ebp - 0x840]
mov dword [ebp + eax*4 - 0x29a4], 0x876942a1
jmp 0x46654b
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcb8]
cmp dword [ebp + eax - 0x29a4], ecx
jne 0x466595
mov dword [ebp - 0xcb0], 1
jmp 0x46659c
and dword [ebp - 0xcb0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcb0]
mov dword [ebp + eax - 0xb8], ecx
jmp 0x46683e
mov dword [ebp - 0x2e4], 0x5358
push 1
lea ecx, [ebp - 0x28f4]
call fcn.0042e201
mov dword [ebp - 0x2134], 0x9cbde6b7
mov dword [ebp - 0xcd8], 0xfffffffb
mov dword [ebp - 0x604], 0
jmp 0x4665f8
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 1
jge 0x466617
push dword [ebp - 0x604]
lea ecx, [ebp - 0x28f4]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x4665eb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e4]
sub ecx, dword [ebp - 0x2e4]
cmp dword [ebp + eax - 0xb8], ecx
je 0x46663e
mov dword [ebp - 0x14a0], 1
jmp 0x466645
and dword [ebp - 0x14a0], 0
cmp dword [ebp - 0x2e4], 0
jne 0x46666d
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2b48], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2b50], eax
cmp dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xb8]
cmp eax, 0x86e1
je 0x46669a
mov dword [ebp - 0x1498], 1
jmp 0x4666a1
and dword [ebp - 0x1498], 0
cmp dword [ebp - 0x1498], 0xfffa
je 0x4666b9
mov dword [ebp - 0x211c], 1
jmp 0x4666c0
and dword [ebp - 0x211c], 0
push 0
lea ecx, [ebp - 0x28f4]
call fcn.0042e2ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0xcb8], eax
jg 0x4666ee
mov dword [ebp - 0x1b88], 1
jmp 0x4666f5
and dword [ebp - 0x1b88], 0
cmp dword [ebp - 0x1b88], 0x4a219909
jne 0x46670d
mov dword [ebp - 0x2124], 1
jmp 0x466714
and dword [ebp - 0x2124], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2b58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
add eax, 0xb2d5
cmp eax, 0xffff
jb 0x466745
mov dword [ebp - 0xcc0], 1
jmp 0x46674c
and dword [ebp - 0xcc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0xcc0], eax
jg 0x46676d
mov dword [ebp - 0xcc8], 1
jmp 0x466774
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0x14a0]
cmp eax, dword [ebp - 0xcc8]
jle 0x46678e
mov dword [ebp - 0x212c], 1
jmp 0x466795
and dword [ebp - 0x212c], 0
mov eax, dword [ebp - 0x2134]
mov dword [ebp - 0x2b60], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb8]
cmp dword [ebp + eax - 0xb8], ecx
jle 0x4667c9
mov dword [ebp - 0x1890], 1
jmp 0x4667d0
and dword [ebp - 0x1890], 0
cmp dword [ebp - 0x1890], 5
jle 0x4667e5
mov dword [ebp - 0xcd0], 1
jmp 0x4667ec
and dword [ebp - 0xcd0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0xcd0], eax
jg 0x46680d
mov dword [ebp - 0x14a8], 1
jmp 0x466814
and dword [ebp - 0x14a8], 0
mov eax, dword [ebp - 0x14a8]
mov dword [ebp - 0xcd8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcd8]
mov dword [ebp + eax - 0xb8], ecx
lea ecx, [ebp - 0x28f4]
call fcn.0042e2d3
mov dword [ebp - 0x2b68], 0x61f9c28a
mov dword [ebp - 0x2b70], 0x9be1d925
mov dword [ebp - 0x2b78], 0xdf37d45d
mov dword [ebp - 0x2b80], 0x4f2887cf
mov dword [ebp - 0x2b88], 0xffffffff
mov dword [ebp - 0x2b90], 0x4fc2285f
push 2
lea ecx, [ebp - 0x2ed8]
call fcn.0042e201
mov dword [ebp - 0x2b98], 0x30c4e2bf
mov dword [ebp - 0x1a88], 0xb752
mov dword [ebp - 0x784], 0
jmp 0x4668b4
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 2
jge 0x4668d6
push dword [ebp - 0x784]
lea ecx, [ebp - 0x2ed8]
call fcn.0042e2ef
mov dword [eax], 0x872d9ee1
jmp 0x4668a7
mov byte [ebp - 0x254], 0
movzx eax, byte [ebp - 0x254]
test eax, eax
je 0x4668f0
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [ebp - 0x1a88]
inc eax
mov dword [ebp - 0x1a88], eax
lea ecx, [ebp - 0x2ed8]
call fcn.0042e2d3
mov dword [ebp - 0x10c], 0x1928c176
mov dword [ebp - 0xce0], 0x515466b
mov dword [ebp - 0x60c], 0
jmp 0x466935
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 2
jge 0x466951
mov eax, dword [ebp - 0x60c]
mov dword [ebp + eax*4 - 0x2014], 0xffffffff
jmp 0x466928
mov dword [ebp - 0x10c], 0
jmp 0x46696a
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffee
jg 0x46699b
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x466999
push 0
push 0xe72
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x46695d
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2ba0], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], eax
jg 0x466a0f
mov dword [ebp - 0xce0], 0xe124dc41
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x2ba8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2014]
mov dword [ebp - 0x2bb0], eax
push 0xfffffffffffffff6
pop eax
cmp eax, 0xfffffff6
jbe 0x4669f2
mov dword [ebp - 0x14b0], 1
jmp 0x4669f9
and dword [ebp - 0x14b0], 0
cmp dword [ebp - 0x14b0], 0
je 0x466a0f
xor eax, eax
jne 0x466a0f
and dword [ebp - 0xce8], 0
jmp 0x466a19
mov dword [ebp - 0xce8], 1
cmp dword [ebp - 0xce8], 0xfffffffe
jl 0x466a2e
mov dword [ebp - 0x1898], 1
jmp 0x466a35
and dword [ebp - 0x1898], 0
cmp dword [ebp - 0x1898], 1
jbe 0x466a4a
mov dword [ebp - 0xcf0], 1
jmp 0x466a51
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xcf0]
sub eax, 0x38d06721
cmp dword [ebp - 0x10c], eax
jne 0x466a70
mov dword [ebp - 0x14b8], 1
jmp 0x466a77
and dword [ebp - 0x14b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2014]
cmp dword [ebp - 0x14b8], eax
jg 0x466a98
mov dword [ebp - 0x213c], 1
jmp 0x466a9f
and dword [ebp - 0x213c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2014]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x1038], 0xffffffff
mov dword [ebp - 0x544], 0x921e
mov dword [ebp - 0xd18], 0x57863718
push 2
lea ecx, [ebp - 0x2498]
call fcn.0042e201
mov dword [ebp - 0x1d4], 0
jmp 0x466b00
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x466b1c
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x890], 0xc3099cfe
jmp 0x466af3
mov dword [ebp - 0x1d4], 0
jmp 0x466b35
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x466b57
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2498]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x466b28
cmp dword [ebp - 0x544], 0
jne 0x466b93
cmp dword [ebp - 0x544], 0xfffffff7
jge 0x466b75
mov dword [ebp - 0xcf8], 1
jmp 0x466b7c
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xcf8]
sub eax, dword [ebp - 0x544]
jne 0x466b93
and dword [ebp - 0x1bf8], 0
jmp 0x466b9d
mov dword [ebp - 0x1bf8], 1
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x1bf8], eax
jge 0x466bb7
mov dword [ebp - 0xd00], 1
jmp 0x466bbe
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd18]
imul eax, dword [ebp - 0xd00]
cmp eax, 0x270f9e3d
je 0x466bde
mov dword [ebp - 0x14c0], 1
jmp 0x466be5
and dword [ebp - 0x14c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x890]
cmp dword [ebp - 0x14c0], eax
jg 0x466c0f
cmp dword [ebp - 0x544], 0
je 0x466c0f
mov dword [ebp - 0xd08], 1
jmp 0x466c16
and dword [ebp - 0xd08], 0
cmp dword [ebp - 0xd08], 0xa38d0672
ja 0x466c3d
push 1
lea ecx, [ebp - 0x2498]
call fcn.0042e2ef
cmp dword [eax], 0
jne 0x466c3d
and dword [ebp - 0x18a0], 0
jmp 0x466c47
mov dword [ebp - 0x18a0], 1
cmp dword [ebp - 0x18a0], 5
jne 0x466c5c
mov dword [ebp - 0xd10], 1
jmp 0x466c63
and dword [ebp - 0xd10], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x890]
imul esi, dword [ebp - 0xd10]
push 1
lea ecx, [ebp - 0x2498]
call fcn.0042e2ef
sub esi, dword [eax]
cmp esi, 0xabf7
jle 0x466c9a
mov dword [ebp - 0x14c8], 1
jmp 0x466ca1
and dword [ebp - 0x14c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14c8]
add ecx, 0x260d
cmp dword [ebp + eax - 0x890], ecx
jle 0x466cc8
mov dword [ebp - 0x2144], 1
jmp 0x466ccf
and dword [ebp - 0x2144], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x890]
mov dword [ebp - 0xd18], eax
lea ecx, [ebp - 0x2498]
call fcn.0042e2d3
mov dword [ebp - 0x7d4], 8
mov dword [ebp - 0xa64], 0xfffffff7
mov dword [ebp - 0x61c], 0xffffffff
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0x2640], 6
mov dword [ebp - 0x263c], 6
mov dword [ebp - 0x2638], 6
mov dword [ebp - 0x2634], 6
lea ecx, [ebp - 0x971]
call fcn.0042e2fe
push eax
lea eax, [ebp - 0x2630]
push eax
lea eax, [ebp - 0x2640]
push eax
lea ecx, [ebp - 0x335c]
call fcn.0042e301
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1cf0]
call fcn.0042e2ad
mov dword [ebp - 0x99c], 0xffffffff
mov dword [ebp - 0x14d0], 0x91f0
mov dword [ebp - 0xd38], 8
mov dword [ebp - 0x614], 0
jmp 0x466da9
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 2
jge 0x466dc5
mov eax, dword [ebp - 0x614]
mov dword [ebp + eax*4 - 0x29b0], 0xffffffff
jmp 0x466d9c
mov dword [ebp - 0xa64], 0x6fe7d8a8
cmp dword [ebp - 0xa64], 0
jne 0x466feb
cmp dword [ebp - 0x78c], 0xfffffffa
jne 0x466df1
mov dword [ebp - 0x214c], 1
jmp 0x466df8
and dword [ebp - 0x214c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x2bb8], eax
push 1
lea ecx, [ebp - 0x1cf0]
call fcn.0042e2ef
mov eax, dword [eax]
mov dword [ebp - 0x99c], eax
mov esi, dword [ebp - 0x99c]
push 1
lea ecx, [ebp - 0x1cf0]
call fcn.0042e2ef
cmp esi, dword [eax]
je 0x466e3c
mov dword [ebp - 0x1a90], 1
jmp 0x466e43
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x78c]
imul eax, dword [ebp - 0x1a90]
imul eax, eax, 0x45cb
test eax, eax
je 0x466e6f
cmp dword [ebp - 0x14d0], 0
je 0x466e6f
and dword [ebp - 0xd20], 0
mov esi, dword [ebp - 0xd20]
sub esi, dword [ebp - 0x14d0]
push 3
lea ecx, [ebp - 0x1cf0]
call fcn.0042e2ef
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x1cf0]
call fcn.0042e2ef
cmp esi, dword [eax]
jle 0x466eae
mov dword [ebp - 0xd48], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd48]
mov dword [ebp + eax - 0x29b0], ecx
lea ecx, [ebp - 0x1cf0]
call fcn.0042e2d3
push 1
lea ecx, [ebp - 0x1da4]
call fcn.0042e201
mov dword [ebp - 4], 0
mov dword [ebp - 0x9a4], 0
push 2
lea ecx, [ebp - 0x1c54]
call fcn.0042e201
mov dword [ebp - 0x2ec], 3
mov dword [ebp - 0x848], 0
jmp 0x467061
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 2
jge 0x467083
push dword [ebp - 0x848]
lea ecx, [ebp - 0x1c54]
call fcn.0042e2ef
mov dword [eax], 0x76270e7a
jmp 0x467054
mov eax, dword [ebp - 4]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x9a4]
cmp eax, 0xffffffff
je 0x4670a6
mov dword [ebp - 0xd68], 1
jmp 0x4670ad
and dword [ebp - 0xd68], 0
cmp dword [ebp - 4], 0xb0cf
jge 0x4670c2
cmp dword [ebp + 8], 1
jne 0x477a8d
mov dword [ebp - 0x200], 2
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0xd84], 0xb372ba29
mov dword [ebp - 0xad8], 0xdb979cd3
mov dword [ebp - 0x950], 0xfffffffe
mov dword [ebp - 0x5c8], 0x2b82c447
mov dword [ebp - 0xd44], 0xffffffff
mov dword [ebp - 0x958], 0xf80366e5
mov dword [ebp - 0x2a3c], 8
mov dword [ebp - 0x31ec], 0x2e46a6f
mov dword [ebp - 0x5c0], 0
jmp 0x4715ff
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 2
jge 0x47161b
mov eax, dword [ebp - 0x5c0]
mov dword [ebp + eax*4 - 0x24c8], 0x15e1b460
jmp 0x4715f2
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x2a44], eax
mov eax, dword [ebp - 0x5c8]
dec eax
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0xad8]
cmp dword [ebp - 0x5c8], eax
jg 0x47170c
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0x200], eax
jg 0x471660
mov dword [ebp - 0xd3c], 1
jmp 0x471667
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x5c8]
add eax, dword [ebp - 0xd3c]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0xad8]
cmp dword [ebp - 0xd44], eax
je 0x471693
mov dword [ebp - 0xd4c], 1
jmp 0x47169a
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0xd4c], eax
je 0x4716ba
cmp dword [ebp - 0x958], 0
jne 0x4716ba
and dword [ebp - 0xd54], 0
jmp 0x4716c4
mov dword [ebp - 0xd54], 1
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0xd54]
cmp eax, 1
jne 0x4716e2
mov dword [ebp - 0x2150], 1
jmp 0x4716e9
and dword [ebp - 0x2150], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x2db4], eax
mov eax, dword [ebp - 0x5d0]
sub eax, dword [ebp - 0x958]
jne 0x47170c
and dword [ebp - 0xd5c], 0
jmp 0x471716
mov dword [ebp - 0xd5c], 1
mov eax, dword [ebp - 0x950]
add eax, dword [ebp - 0xd5c]
add eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0xad8]
jl 0x47173c
mov dword [ebp - 0xd64], 1
jmp 0x471743
and dword [ebp - 0xd64], 0
cmp dword [ebp - 0xd64], 4
jne 0x471758
mov dword [ebp - 0xd6c], 1
jmp 0x47175f
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0xd6c], eax
jle 0x471779
mov dword [ebp - 0xd74], 1
jmp 0x471780
and dword [ebp - 0xd74], 0
cmp dword [ebp - 0xd74], 0xfff7
jne 0x471798
mov dword [ebp - 0xd7c], 1
jmp 0x47179f
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0x5d0]
test eax, eax
jne 0x4717da
cmp dword [ebp - 0x200], 0
jne 0x4717da
and dword [ebp - 0xd8c], 0
jmp 0x4717e4
mov dword [ebp - 0xd8c], 1
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
sub eax, dword [ebp - 0x5d8]
cmp eax, dword [ebp - 0x958]
jge 0x471810
mov dword [ebp - 0xd94], 1
jmp 0x471817
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xd94], eax
jge 0x471831
mov dword [ebp - 0xd9c], 1
jmp 0x471838
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0x200], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24c8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24c8], eax
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x5e0], 0xfffffffc
mov dword [ebp - 0xdb4], 0x8e045dce
mov dword [ebp - 0x22e0], 0xffffffff
mov dword [ebp - 0x490], 0
jmp 0x4718a0
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 1
jl 0x471a52
mov dword [ebp - 0xdc4], 0xb5c6f8b8
mov byte [ebp - 0x2dd], 0
movzx eax, byte [ebp - 0x2dd]
test eax, eax
je 0x4718df
push 0
push 0
push 0x22d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x2a4c], eax
cmp dword [ebp - 0x5e0], 0xb064
jle 0x471903
mov dword [ebp - 0xda4], 1
jmp 0x47190a
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0xda4]
dec eax
cmp eax, dword [ebp - 0xdc4]
jge 0x471925
mov dword [ebp - 0xdac], 1
jmp 0x47192c
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0xdb4], 0
je 0x471956
mov eax, 0xe283
test eax, eax
je 0x471956
mov dword [ebp - 0xdbc], 1
jmp 0x47195d
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 2
je 0x471972
mov dword [ebp - 0xdcc], 1
jmp 0x471979
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xdc4]
imul eax, dword [ebp - 0xdcc]
push 9
pop ecx
sub ecx, eax
cmp ecx, 0xffffffff
ja 0x47199c
mov dword [ebp - 0xdd4], 1
jmp 0x4719a3
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x5e0]
sub eax, dword [ebp - 0xdd4]
jne 0x4719bf
xor eax, eax
inc eax
jne 0x4719bf
and dword [ebp - 0xddc], 0
jmp 0x4719c9
mov dword [ebp - 0xddc], 1
cmp dword [ebp - 0xddc], 1
jg 0x4719de
mov dword [ebp - 0x1f8c], 1
jmp 0x4719e5
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x5e0], eax
jne 0x4719ff
mov dword [ebp - 0xde4], 1
jmp 0x471a06
and dword [ebp - 0xde4], 0
cmp dword [ebp - 0xde4], 0x467b
jne 0x471a1e
mov dword [ebp - 0xdec], 1
jmp 0x471a25
and dword [ebp - 0xdec], 0
cmp dword [ebp - 0xdec], 0xffffffff
jg 0x471a3a
mov dword [ebp - 0xdf4], 1
jmp 0x471a41
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x22e0], eax
jmp 0x471893
mov dword [ebp - 0x454], 0xffffffff
push 1
lea ecx, [ebp - 0x22ac]
call fcn.0042e201
mov dword [ebp - 0xe04], 5
mov dword [ebp - 0x960], 0xacda2a4f
push 3
lea ecx, [ebp - 0x28d0]
call fcn.0042e201
mov dword [ebp - 0x120], 0
jmp 0x471aa3
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x471ac5
push dword [ebp - 0x120]
lea ecx, [ebp - 0x22ac]
call fcn.0042e2ef
mov dword [eax], 0xae28de63
jmp 0x471a96
mov dword [ebp - 0x120], 0
jmp 0x471ade
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x471b00
push dword [ebp - 0x120]
lea ecx, [ebp - 0x28d0]
call fcn.0042e2ef
mov dword [eax], 0xfffffffc
jmp 0x471ad1
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0xdfc], eax
push 0
lea ecx, [ebp - 0x22ac]
call fcn.0042e2ef
mov ecx, dword [ebp - 0xdfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0xe04], eax
cmp dword [ebp - 0xe04], 0x3d8c5378
jge 0x471b45
mov dword [ebp - 0xe0c], 1
jmp 0x471b4c
and dword [ebp - 0xe0c], 0
cmp dword [ebp - 0x454], 0
jne 0x471b61
mov dword [ebp - 0xe14], 1
jmp 0x471b68
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe0c]
cmp eax, dword [ebp - 0xe14]
je 0x471b9a
mov eax, 0xbd55
test eax, eax
jne 0x471b9a
push 0
lea ecx, [ebp - 0x22ac]
call fcn.0042e2ef
cmp dword [eax], 0
jne 0x471b9a
and dword [ebp - 0xe1c], 0
jmp 0x471ba4
mov dword [ebp - 0xe1c], 1
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0xe1c], eax
jg 0x471bbe
mov dword [ebp - 0xe24], 1
jmp 0x471bc5
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xe24]
dec eax
sub eax, dword [ebp - 0x454]
cmp eax, 0x38b93373
jne 0x471be5
mov dword [ebp - 0xe2c], 1
jmp 0x471bec
and dword [ebp - 0xe2c], 0
cmp dword [ebp - 0xe2c], 0xb275cf8
je 0x471c04
mov dword [ebp - 0xe34], 1
jmp 0x471c0b
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0xe34]
sub eax, dword [ebp - 0x454]
cmp eax, 0xffffffff
jge 0x471c2e
cmp dword [ebp - 0x960], 0
jne 0x471c2e
and dword [ebp - 0xe3c], 0
jmp 0x471c38
mov dword [ebp - 0xe3c], 1
mov eax, dword [ebp - 0xe3c]
sub eax, 8
jne 0x471c50
push 0
lea ecx, [ebp - 0x22ac]
call fcn.0042e2ef
mov eax, dword [ebp - 0x960]
cmp dword [ebp - 0x960], eax
jle 0x471c6a
mov dword [ebp - 0xe44], 1
jmp 0x471c71
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0xe44], eax
jne 0x471c8b
mov dword [ebp - 0xe4c], 1
jmp 0x471c92
and dword [ebp - 0xe4c], 0
push 0
lea ecx, [ebp - 0x28d0]
call fcn.0042e2ef
mov ecx, dword [ebp - 0xe4c]
mov dword [eax], ecx
lea ecx, [ebp - 0x28d0]
call fcn.0042e2d3
lea ecx, [ebp - 0x22ac]
call fcn.0042e2d3
mov dword [ebp - 0x988], 0xffffffff
mov dword [ebp - 0x4a0], 0xdf99ff60
mov dword [ebp - 0xe5c], 0x1e1d82c3
mov dword [ebp - 0x5e8], 0
jmp 0x471cf4
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 3
jge 0x471d10
mov eax, dword [ebp - 0x5e8]
mov dword [ebp + eax*4 - 0x1d8c], 0xfffffff7
jmp 0x471ce7
mov dword [ebp - 0x4a0], 0xfffffff3
jmp 0x471d29
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0xfffffff5
jl 0x472177
mov dword [ebp - 0x208], 0
push 4
lea ecx, [ebp - 0x28e8]
call fcn.0042e201
mov dword [ebp - 0x2604], 8
mov dword [ebp - 0x2600], 8
mov dword [ebp - 0x25fc], 8
mov dword [ebp - 0x25f8], 8
lea ecx, [ebp - 0xab1]
call fcn.0042e2fe
push eax
lea eax, [ebp - 0x25f4]
push eax
lea eax, [ebp - 0x2604]
push eax
lea ecx, [ebp - 0x33a4]
call fcn.0042e301
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x22cc]
call fcn.0042e2ad
mov dword [ebp - 0x1f94], 0
mov dword [ebp - 0x128], 0
jmp 0x471dcd
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x471def
push dword [ebp - 0x128]
lea ecx, [ebp - 0x28e8]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x471dc0
mov dword [ebp - 0x128], 0
jmp 0x471e08
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x471e24
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x2934], 0xfffffffc
jmp 0x471dfb
mov dword [ebp - 0x208], 2
jmp 0x471e3d
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x47215c
mov dword [ebp - 0x498], 0xc79cf181
mov dword [ebp - 0x364], 1
push 2
lea ecx, [ebp - 0x22bc]
call fcn.0042e201
mov dword [ebp - 0x5f0], 0
jmp 0x471e84
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 2
jge 0x471ea6
push dword [ebp - 0x5f0]
lea ecx, [ebp - 0x22bc]
call fcn.0042e2ef
mov dword [eax], 0x863cc1da
jmp 0x471e77
mov dword [ebp - 0x498], 2
jmp 0x471ebf
mov eax, dword [ebp - 0x498]
dec eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jl 0x472016
mov dword [ebp - 0x303c], 0x1c2e9378
mov dword [ebp - 0x2a54], 0xffffffff
mov eax, dword [ebp - 0x498]
cmp dword [ebp + eax*4 - 0x1d8c], 0
je 0x471f2c
push 0
lea ecx, [ebp - 0x22cc]
call fcn.0042e2ef
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x968]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x968]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0x968]
mov dword [edx], ecx
test eax, eax
je 0x471f2c
mov dword [ebp - 0xe54], 1
jmp 0x471f33
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0x1f94]
cmp dword [ebp - 0xe54], eax
jne 0x471f4d
mov dword [ebp - 0x970], 1
jmp 0x471f54
and dword [ebp - 0x970], 0
mov dword [ebp - 0xe5c], 1
mov esi, dword [ebp - 0xe5c]
push 1
lea ecx, [ebp - 0x28e8]
call fcn.0042e2ef
cmp dword [eax], esi
je 0x471f8d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d8c], 0
jne 0x471f8d
and dword [ebp - 0xe64], 0
jmp 0x471f97
mov dword [ebp - 0xe64], 1
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0xe64], eax
jne 0x471fb1
mov dword [ebp - 0xe6c], 1
jmp 0x471fb8
and dword [ebp - 0xe6c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax - 0x2934], ecx
mov esi, dword [ebp - 0x970]
imul esi, dword [ebp - 0xe6c]
push 1
lea ecx, [ebp - 0x22bc]
call fcn.0042e2ef
cmp esi, dword [eax]
je 0x471ff5
mov dword [ebp - 0xe74], 1
jmp 0x471ffc
and dword [ebp - 0xe74], 0
push 1
lea ecx, [ebp - 0x22bc]
call fcn.0042e2ef
mov ecx, dword [ebp - 0xe74]
mov dword [eax], ecx
jmp 0x471eb2
mov dword [ebp - 0x364], 0
jmp 0x47202f
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 2
jg 0x47214c
push 3
pop eax
test eax, eax
je 0x472102
push dword [ebp - 0x208]
lea ecx, [ebp - 0x22cc]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x364]
mov ecx, dword [ebp + ecx*4 - 0x1d8c]
cmp dword [eax], ecx
je 0x47207b
mov eax, 0xffff
test eax, eax
jne 0x47207b
and dword [ebp - 0x2158], 0
jmp 0x472085
mov dword [ebp - 0x2158], 1
mov eax, dword [ebp - 0x364]
mov eax, dword [ebp + eax*4 - 0x1d8c]
mov dword [ebp - 0x2dbc], eax
push dword [ebp - 0x208]
lea ecx, [ebp - 0x22cc]
call fcn.0042e2ef
push 1
lea ecx, [ebp - 0x22bc]
call fcn.0042e2ef
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1d8c]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x208]
jne 0x4720da
mov dword [ebp - 0xe7c], 1
jmp 0x4720e1
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0x364]
mov eax, dword [ebp + eax*4 - 0x1d8c]
cmp eax, dword [ebp - 0xe7c]
jl 0x472102
mov dword [ebp - 0xe84], 1
jmp 0x472109
and dword [ebp - 0xe84], 0
cmp dword [ebp - 0xe84], 0xa82b5dfe
jne 0x472121
mov dword [ebp - 0xb98], 1
jmp 0x472128
and dword [ebp - 0xb98], 0
imul esi, dword [ebp - 0xb98], 0x77cb
mov eax, dword [ebp - 0x208]
inc eax
push eax
lea ecx, [ebp - 0x22cc]
call fcn.0042e2ef
mov dword [eax], esi
jmp 0x472022
lea ecx, [ebp - 0x22bc]
call fcn.0042e2d3
jmp 0x471e30
lea ecx, [ebp - 0x22cc]
call fcn.0042e2d3
lea ecx, [ebp - 0x28e8]
call fcn.0042e2d3
jmp 0x471d1c
mov dword [ebp - 0x37c], 0xfffffffd
mov dword [ebp - 0x3e0], 0x887cf2e5
mov dword [ebp - 0x978], 0xed9ba07e
mov dword [ebp - 0x3d8], 0xffffffff
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0xeac], 2
mov dword [ebp - 0xecc], 1
mov dword [ebp - 0x1fa4], 0x2095e04a
mov dword [ebp - 0x2a5c], 0x7fefb659
mov dword [ebp - 0x317c], 0x75015e0c
mov dword [ebp - 0x292c], 9
mov dword [ebp - 0x2dc4], 0x83f7cd3e
mov dword [ebp - 0x2a6c], 0x69b41dbc
mov dword [ebp - 0x304c], 0xc8fa1b44
mov dword [ebp - 0x2a74], 0x307b364f
mov dword [ebp - 0x2dcc], 0xfffffff7
push 1
lea ecx, [ebp - 0x2fb8]
call fcn.0042e201
mov dword [ebp - 0xedc], 0xfff7
mov dword [ebp - 0x130], 0
jmp 0x472247
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x472263
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x2940], 0x34e1
jmp 0x47223a
mov dword [ebp - 0x130], 0
jmp 0x47227c
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x47229b
push dword [ebp - 0x130]
lea ecx, [ebp - 0x2fb8]
call fcn.0042e2ef
or dword [eax], 0xffffffff
jmp 0x47226f
mov dword [ebp - 0x3d8], 0xffffffff
cmp dword [ebp - 0x3d8], 0
je 0x472375
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x2a7c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x3d8], eax
jle 0x4722ed
cmp dword [ebp - 0x3d8], 0
je 0x4722ed
mov dword [ebp - 0xe94], 1
jmp 0x4722f4
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x36c]
imul eax, dword [ebp - 0xe94]
test eax, eax
je 0x47231a
cmp dword [ebp - 0x3e0], 0
je 0x47231a
mov dword [ebp - 0xe9c], 1
jmp 0x472321
and dword [ebp - 0xe9c], 0
mov eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0xe9c], eax
jl 0x47233b
mov dword [ebp - 0xea4], 1
jmp 0x472342
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0xeac], eax
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0xeac], eax
je 0x472368
mov dword [ebp - 0xeb4], 1
jmp 0x47236f
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0x36c]
mov eax, 0xd1aa
test eax, eax
jne 0x472390
cmp dword [ebp - 0x3e0], 0
jne 0x472390
and dword [ebp - 0x1f9c], 0
jmp 0x47239a
mov dword [ebp - 0x1f9c], 1
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0x36c]
neg eax
mov dword [ebp - 0xebc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xebc]
mov dword [ebp + eax - 0x2940], ecx
mov eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0xebc], eax
jg 0x4723db
mov dword [ebp - 0xec4], 1
jmp 0x4723e2
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x978], eax
mov eax, dword [ebp - 0x978]
cmp eax, dword [ebp - 0xec4]
jl 0x472411
cmp dword [ebp - 0x978], 0
je 0x472411
mov dword [ebp - 0x2220], 1
jmp 0x472418
and dword [ebp - 0x2220], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x322c], eax
mov eax, dword [ebp - 0xecc]
add eax, dword [ebp - 0xecc]
cmp eax, 8
je 0x472441
mov dword [ebp - 0xed4], 1
jmp 0x472448
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 0xed4]
mov dword [ebp - 0x1fa4], eax
mov eax, dword [ebp - 0xedc]
inc eax
mov dword [ebp - 0xedc], eax
lea ecx, [ebp - 0x2fb8]
call fcn.0042e2d3
mov dword [ebp - 0x220], 0
push 2
lea ecx, [ebp - 0x1d44]
call fcn.0042e201
mov dword [ebp - 0x2160], 0xd1d8f8f5
mov dword [ebp - 0x5f8], 0
jmp 0x4724a6
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 2
jge 0x4724c8
push dword [ebp - 0x5f8]
lea ecx, [ebp - 0x1d44]
call fcn.0042e2ef
mov dword [eax], 0x42eb90da
jmp 0x472499
push 1
lea ecx, [ebp - 0x1d44]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x4724fe
push 1
lea ecx, [ebp - 0x1d44]
call fcn.0042e2ef
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0xee4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xee4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1d44]
call fcn.0042e2ef
cmp dword [eax], 0xfffffffe
je 0x4725d7
push 4
lea ecx, [ebp - 0x22dc]
call fcn.0042e201
mov dword [ebp - 0x600], 0
jmp 0x47253a
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 4
jge 0x47255c
push dword [ebp - 0x600]
lea ecx, [ebp - 0x22dc]
call fcn.0042e2ef
mov dword [eax], 0xfffffff7
jmp 0x47252d
push 1
lea ecx, [ebp - 0x22dc]
call fcn.0042e2ef
mov dword [eax], 0x18
jmp 0x472595
push 1
lea ecx, [ebp - 0x22dc]
call fcn.0042e2ef
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0xeec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xeec]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x22dc]
call fcn.0042e2ef
cmp dword [eax], 0x14
jne 0x4725c7
mov byte [ebp - 0x286], 0
movzx eax, byte [ebp - 0x286]
test eax, eax
je 0x4725c5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x472571
lea ecx, [ebp - 0x22dc]
call fcn.0042e2d3
jmp 0x4724da
push 0
lea ecx, [ebp - 0x1d44]
call fcn.0042e2ef
mov dword [eax], 0xfffffffb
mov dword [ebp - 0x2160], 0xfffffffb
lea ecx, [ebp - 0x1d44]
call fcn.0042e2d3
mov dword [ebp - 0x408], 0x5d764ce3
push 2
lea ecx, [ebp - 0x242c]
call fcn.0042e201
mov dword [ebp - 0x608], 0
jmp 0x47262f
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 2
jge 0x472651
push dword [ebp - 0x608]
lea ecx, [ebp - 0x242c]
call fcn.0042e2ef
mov dword [eax], 0xdb58e469
jmp 0x472622
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x472672
push 0xfc5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0
lea ecx, [ebp - 0x242c]
call fcn.0042e2ef
mov esi, eax
push 0
lea ecx, [ebp - 0x242c]
call fcn.0042e2ef
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x242c]
call fcn.0042e2d3
mov dword [ebp - 0x2a84], 0x64a6847d
mov byte [ebp - 0x288], 0
movzx eax, byte [ebp - 0x288]
test eax, eax
je 0x4726bf
call dword [sym.imp.USER32.dll_WaitMessage]
mov byte [ebp - 0x2e5], 0
movzx eax, byte [ebp - 0x2e5]
test eax, eax
je 0x4726de
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 2
lea ecx, [ebp - 0x2fc8]
call fcn.0042e201
mov dword [ebp - 0x618], 0x9bdba76a
mov dword [ebp - 0x610], 0
jmp 0x47270e
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 2
jge 0x472730
push dword [ebp - 0x610]
lea ecx, [ebp - 0x2fc8]
call fcn.0042e2ef
mov dword [eax], 0xfffffff7
jmp 0x472701
mov dword [ebp - 0x618], 0
jmp 0x472749
cmp dword [ebp - 0x618], 1
jg 0x4727ec
mov dword [ebp - 0x620], 0x88adae8c
mov dword [ebp - 0x2dd4], 0x4b2ab76d
mov dword [ebp - 0x2a8c], 0x44accb24
mov dword [ebp - 0x305c], 0x9eeda585
mov dword [ebp - 0x620], 0
jmp 0x472797
cmp dword [ebp - 0x620], 1
jg 0x4727e7
mov dword [ebp - 0x628], 0xb5a5efa2
mov dword [ebp - 0x628], 1
jmp 0x4727c3
jmp 0x47273c
lea ecx, [ebp - 0x2fc8]
call fcn.0042e2d3
mov dword [ebp - 0x138], 0
jmp 0x472810
cmp dword [ebp - 0x138], 3
jge 0x47282c
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x918], 8
jmp 0x472803
push 4
lea ecx, [ebp - 0xb58]
call fcn.0042e201
mov dword [ebp - 0xa4], 0x32fe2236
mov dword [ebp - 0xf14], 0xedad94e8
mov dword [ebp - 0x630], 0
jmp 0x472866
mov dword [ebp - 0x4f0], 0xfffffffb
mov dword [ebp - 0x4f0], 0
jmp 0x477ab0
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0x16
jge 0x477c91
push 1
lea ecx, [ebp - 0x1ca8]
call fcn.0042e201
mov dword [ebp - 0x16fc], 0x509e71b3
mov dword [ebp - 0x7b8], 0
jmp 0x477aed
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 1
jge 0x477b0f
push dword [ebp - 0x7b8]
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2ef
mov dword [eax], 0xdb22124f
jmp 0x477ae0
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2ef
mov dword [eax], 7
jmp 0x477b48
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2ef
mov dword [ebp - 0x16cc], eax
mov eax, dword [ebp - 0x16cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x16cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2ef
cmp dword [eax], 0xffffffe6
jg 0x477c81
mov dword [ebp - 0x1e98], 0xedf0ebf9
mov eax, 0x2a3b3f36
test eax, eax
je 0x477b86
cmp dword [ebp - 0x4f0], 0
je 0x477b86
mov dword [ebp - 0x1704], 1
jmp 0x477b8d
and dword [ebp - 0x1704], 0
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2ef
cmp dword [eax], 0
jne 0x477bba
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2ef
cmp dword [eax], 0
jne 0x477bba
and dword [ebp - 0x16d4], 0
jmp 0x477bc4
mov dword [ebp - 0x16d4], 1
cmp dword [ebp - 0x16d4], 0x97515801
jb 0x477bdc
mov dword [ebp - 0x16dc], 1
jmp 0x477be3
and dword [ebp - 0x16dc], 0
cmp dword [ebp - 0x16dc], 0xfa9b64fc
jl 0x477bfb
mov dword [ebp - 0x16e4], 1
jmp 0x477c02
and dword [ebp - 0x16e4], 0
cmp dword [ebp - 0x16e4], 0xfffffffb
jbe 0x477c20
mov eax, 0xe34edf6b
test eax, eax
je 0x477c20
mov dword [ebp - 0x16ec], 1
jmp 0x477c27
and dword [ebp - 0x16ec], 0
cmp dword [ebp - 0x16ec], 7
jle 0x477c3c
mov dword [ebp - 0x16f4], 1
jmp 0x477c43
and dword [ebp - 0x16f4], 0
mov eax, dword [ebp - 0x16f4]
mov dword [ebp - 0x16fc], eax
mov eax, dword [ebp - 0x16fc]
cmp dword [ebp - 0x1704], eax
jl 0x477c69
mov dword [ebp - 0x170c], 1
jmp 0x477c70
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x170c]
mov dword [ebp - 0x1e98], eax
jmp 0x477b24
lea ecx, [ebp - 0x1ca8]
call fcn.0042e2d3
jmp 0x477aa3
push 4
lea ecx, [ebp - 0x28dc]
call fcn.0042e201
mov dword [ebp - 0x38c], 9
mov dword [ebp - 0x198], 0
jmp 0x477cc1
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x477ce3
push dword [ebp - 0x198]
lea ecx, [ebp - 0x28dc]
call fcn.0042e2ef
mov dword [eax], 0x313d
jmp 0x477cb4
mov dword [ebp - 0x198], 0
jmp 0x477cfc
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x477d18
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x334c], 0xfffffff7
jmp 0x477cef
mov dword [ebp - 0x38c], 0
jmp 0x477d31
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 3
jg 0x477e9d
mov dword [ebp - 0x4f8], 0xfffffff6
mov dword [ebp - 0x1ea0], 1
cmp dword [ebp - 0x4f8], 0
je 0x477dc4
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x2e6c], eax
push 0
lea ecx, [ebp - 0x28dc]
call fcn.0042e2ef
cmp dword [ebp - 0x38c], 0
jne 0x477d89
mov dword [ebp - 0x1714], 1
jmp 0x477d90
and dword [ebp - 0x1714], 0
cmp dword [ebp - 0x1714], 0x7bc3
jg 0x477da8
mov dword [ebp - 0x171c], 1
jmp 0x477daf
and dword [ebp - 0x171c], 0
cmp dword [ebp - 0x171c], 0
ja 0x477dc4
mov dword [ebp - 0x1724], 1
jmp 0x477dcb
and dword [ebp - 0x1724], 0
cmp dword [ebp - 0x1724], 1
jne 0x477de9
cmp dword [ebp - 0x4f8], 0
je 0x477de9
mov dword [ebp - 0x172c], 1
jmp 0x477df0
and dword [ebp - 0x172c], 0
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x172c], eax
je 0x477e0a
mov dword [ebp - 0x1734], 1
jmp 0x477e11
and dword [ebp - 0x1734], 0
mov eax, dword [ebp - 0x1734]
sub eax, dword [ebp - 0x38c]
add eax, dword [ebp - 0x4f8]
jne 0x477e32
xor eax, eax
jne 0x477e32
and dword [ebp - 0x173c], 0
jmp 0x477e3c
mov dword [ebp - 0x173c], 1
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x173c], eax
jle 0x477e56
mov dword [ebp - 0x1744], 1
jmp 0x477e5d
and dword [ebp - 0x1744], 0
mov eax, dword [ebp - 0x1744]
add eax, 0x5a5efa20
imul eax, eax, 0xfffffffe
cmp eax, dword [ebp - 0x1ea0]
jl 0x477e7f
mov dword [ebp - 0x174c], 1
jmp 0x477e86
and dword [ebp - 0x174c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x174c]
mov dword [ebp + eax - 0x334c], ecx
jmp 0x477d24
lea ecx, [ebp - 0x28dc]
call fcn.0042e2d3
push 2
lea ecx, [ebp - 0xaf4]
call fcn.0042e201
mov dword [ebp - 0xb4], 0xa66fe7d8
mov dword [ebp - 0x2bbc], 0xffffffff
mov dword [ebp - 0x30d8], 0xfffffff7
mov dword [ebp - 0x7c0], 0
jmp 0x477eec
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 2
jge 0x477f0e
push dword [ebp - 0x7c0]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x477edf
mov dword [ebp - 0xb4], 1
jmp 0x477f27
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x4780d3
mov dword [ebp - 0x2bc4], 0xffffffff
mov dword [ebp - 0x2e74], 0xffffffff
mov dword [ebp - 0x176c], 0x6991
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
push 1
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
cmp dword [eax], 1
jg 0x477f94
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
cmp dword [eax], 0
jne 0x477f94
and dword [ebp - 0x1754], 0
jmp 0x477f9e
mov dword [ebp - 0x1754], 1
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1754]
add ecx, dword [eax]
je 0x477fce
cmp dword [ebp - 0xb4], 0
je 0x477fce
mov dword [ebp - 0x175c], 1
jmp 0x477fd5
and dword [ebp - 0x175c], 0
mov esi, dword [ebp - 0x175c]
add esi, 0x10bd1
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
cmp esi, dword [eax]
jne 0x478002
mov dword [ebp - 0x1ea8], 1
jmp 0x478009
and dword [ebp - 0x1ea8], 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
push 0
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
cmp dword [eax], 0
je 0x478041
mov eax, 0x5a945cb8
test eax, eax
je 0x478041
mov dword [ebp - 0x1764], 1
jmp 0x478048
and dword [ebp - 0x1764], 0
cmp dword [ebp - 0x1764], 7
jbe 0x4780a9
mov dword [ebp - 0x500], 0x2a83a0f0
mov dword [ebp - 0x500], 1
jmp 0x478074
mov eax, dword [ebp - 0x500]
dec eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0
jl 0x4780a7
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
mov esi, eax
push dword [ebp - 0x500]
lea ecx, [ebp - 0xaf4]
call fcn.0042e2ef
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x478067
jmp 0x4780c1
mov byte [ebp - 0x32d], 0
movzx eax, byte [ebp - 0x32d]
test eax, eax
je 0x4780c1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [ebp - 0x176c]
dec eax
mov dword [ebp - 0x176c], eax
jmp 0x477f1a
lea ecx, [ebp - 0xaf4]
call fcn.0042e2d3
mov dword [ebp - 0x2bcc], 0xa684
mov dword [ebp - 0x510], 0xdf99ff60
mov dword [ebp - 0x177c], 0x1e1d82c3
mov dword [ebp - 0x7c8], 0
jmp 0x478115
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 3
jge 0x478131
mov eax, dword [ebp - 0x7c8]
mov dword [ebp + eax*4 - 0x1db0], 0xfffffff7
jmp 0x478108
mov dword [ebp - 0x510], 0xfffffff3
jmp 0x47814a
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0xfffffff5
jl 0x478598
mov dword [ebp - 0x238], 0
push 4
lea ecx, [ebp - 0x2738]
call fcn.0042e201
mov dword [ebp - 0x26a4], 8
mov dword [ebp - 0x26a0], 8
mov dword [ebp - 0x269c], 8
mov dword [ebp - 0x2698], 8
lea ecx, [ebp - 0xafd]
call fcn.0042e2fe
push eax
lea eax, [ebp - 0x2694]
push eax
lea eax, [ebp - 0x26a4]
push eax
lea ecx, [ebp - 0x32e4]
call fcn.0042e301
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x233c]
call fcn.0042e2ad
mov dword [ebp - 0x1eb0], 0
mov dword [ebp - 0x1a0], 0
jmp 0x4781ee
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 4
jge 0x478210
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x2738]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x4781e1
mov dword [ebp - 0x1a0], 0
jmp 0x478229
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jge 0x478245
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x2964], 0xfffffffc
jmp 0x47821c
mov dword [ebp - 0x238], 2
jmp 0x47825e
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jl 0x47857d
mov dword [ebp - 0x508], 0xc79cf181
mov dword [ebp - 0x394], 1
push 2
lea ecx, [ebp - 0x232c]
call fcn.0042e201
mov dword [ebp - 0x7d0], 0
jmp 0x4782a5
mov eax, dword [ebp - 0x7d0]
inc eax
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 2
jge 0x4782c7
push dword [ebp - 0x7d0]
lea ecx, [ebp - 0x232c]
call fcn.0042e2ef
mov dword [eax], 0x863cc1da
jmp 0x478298
mov dword [ebp - 0x508], 2
jmp 0x4782e0
mov eax, dword [ebp - 0x508]
dec eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
jl 0x478437
mov dword [ebp - 0x321c], 0x1c2e9378
mov dword [ebp - 0x2bd4], 0xffffffff
mov eax, dword [ebp - 0x508]
cmp dword [ebp + eax*4 - 0x1db0], 0
je 0x47834d
push 0
lea ecx, [ebp - 0x233c]
call fcn.0042e2ef
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xa18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa18]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0xa18]
mov dword [edx], ecx
test eax, eax
je 0x47834d
mov dword [ebp - 0x1774], 1
jmp 0x478354
and dword [ebp - 0x1774], 0
mov eax, dword [ebp - 0x1eb0]
cmp dword [ebp - 0x1774], eax
jne 0x47836e
mov dword [ebp - 0xa20], 1
jmp 0x478375
and dword [ebp - 0xa20], 0
mov dword [ebp - 0x177c], 1
mov esi, dword [ebp - 0x177c]
push 1
lea ecx, [ebp - 0x2738]
call fcn.0042e2ef
cmp dword [eax], esi
je 0x4783ae
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1db0], 0
jne 0x4783ae
and dword [ebp - 0x1784], 0
jmp 0x4783b8
mov dword [ebp - 0x1784], 1
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x1784], eax
jne 0x4783d2
mov dword [ebp - 0x178c], 1
jmp 0x4783d9
and dword [ebp - 0x178c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa20]
mov dword [ebp + eax - 0x2964], ecx
mov esi, dword [ebp - 0xa20]
imul esi, dword [ebp - 0x178c]
push 1
lea ecx, [ebp - 0x232c]
call fcn.0042e2ef
cmp esi, dword [eax]
je 0x478416
mov dword [ebp - 0x1794], 1
jmp 0x47841d
and dword [ebp - 0x1794], 0
push 1
lea ecx, [ebp - 0x232c]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x1794]
mov dword [eax], ecx
jmp 0x4782d3
mov dword [ebp - 0x394], 0
jmp 0x478450
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 2
jg 0x47856d
push 3
pop eax
test eax, eax
je 0x478523
push dword [ebp - 0x238]
lea ecx, [ebp - 0x233c]
call fcn.0042e2ef
mov ecx, dword [ebp - 0x394]
mov ecx, dword [ebp + ecx*4 - 0x1db0]
cmp dword [eax], ecx
je 0x47849c
mov eax, 0xffff
test eax, eax
jne 0x47849c
and dword [ebp - 0x1eb8], 0
jmp 0x4784a6
mov dword [ebp - 0x1eb8], 1
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp + eax*4 - 0x1db0]
mov dword [ebp - 0x2e7c], eax
push dword [ebp - 0x238]
lea ecx, [ebp - 0x233c]
call fcn.0042e2ef
push 1
lea ecx, [ebp - 0x232c]
call fcn.0042e2ef
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1db0]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x238]
jne 0x4784fb
mov dword [ebp - 0x179c], 1
jmp 0x478502
and dword [ebp - 0x179c], 0
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp + eax*4 - 0x1db0]
cmp eax, dword [ebp - 0x179c]
jl 0x478523
mov dword [ebp - 0x17a4], 1
jmp 0x47852a
and dword [ebp - 0x17a4], 0
cmp dword [ebp - 0x17a4], 0xa82b5dfe
jne 0x478542
mov dword [ebp - 0x17ac], 1
jmp 0x478549
and dword [ebp - 0x17ac], 0
imul esi, dword [ebp - 0x17ac], 0x77cb
mov eax, dword [ebp - 0x238]
inc eax
push eax
lea ecx, [ebp - 0x233c]
call fcn.0042e2ef
mov dword [eax], esi
jmp 0x478443
lea ecx, [ebp - 0x232c]
call fcn.0042e2d3
jmp 0x478251
lea ecx, [ebp - 0x233c]
call fcn.0042e2d3
lea ecx, [ebp - 0x2738]
call fcn.0042e2d3
jmp 0x47813d
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x39c], 8
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x2bdc], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0
jne 0x4785df
mov eax, 0x29c1464f
test eax, eax
jne 0x4785df
and dword [ebp - 0x17b4], 0
jmp 0x4785e9
mov dword [ebp - 0x17b4], 1
mov eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x17b4], eax
jl 0x478603
mov dword [ebp - 0x17bc], 1
jmp 0x47860a
and dword [ebp - 0x17bc], 0
cmp dword [ebp - 0x17bc], 0x32b1cecb
jge 0x478622
mov dword [ebp - 0x17c4], 1
jmp 0x478629
and dword [ebp - 0x17c4], 0
mov eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x17c4], eax
jl 0x478697
mov dword [ebp - 0x39c], 0
jmp 0x478650
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xffffffff
jne 0x478695
mov byte [ebp - 0x2ae], 0
movzx eax, byte [ebp - 0x2ae]
test eax, eax
je 0x478693
push 0x85b
push 0x1253
push 0x17af
push 0x17f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x478643
jmp 0x4786c7
mov dword [ebp - 0x1ec0], 3
mov eax, dword [ebp - 0x1ec0]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x37d], 0
movzx eax, byte [ebp - 0x37d]
test eax, eax
je 0x4786c7
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebp - 0x2b0]
test eax, eax
je 0x4786e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x7e0], 0
jmp 0x478709
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 2
jge 0x478725
mov eax, dword [ebp - 0x7e0]
mov dword [ebp + eax*4 - 0x2970], 0x92beaa32
jmp 0x4786fc
mov dword [ebp - 0x1a8], 1
jmp 0x47873e
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x47889a
push 1
lea ecx, [ebp - 0x1dc8]
call fcn.0042e201
mov dword [ebp - 0x1ec8], 0xffffffff
mov dword [ebp - 0x7e8], 0
jmp 0x47877b
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 1
jge 0x47879d
push dword [ebp - 0x7e8]
lea ecx, [ebp - 0x1dc8]
call fcn.0042e2ef
mov dword [eax], 0xb733c633
jmp 0x47876e
push 0
lea ecx, [ebp - 0x1dc8]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x4787d6
push 0
lea ecx, [ebp - 0x1dc8]
call fcn.0042e2ef
mov dword [ebp - 0x17cc], eax
mov eax, dword [ebp - 0x17cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x17cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1dc8]
call fcn.0042e2ef
cmp dword [eax], 0
jl 0x478828
mov byte [ebp - 0x335], 0
movzx eax, byte [ebp - 0x335]
test eax, eax
je 0x478807
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov byte [ebp - 0x2b2], 0
movzx eax, byte [ebp - 0x2b2]
test eax, eax
je 0x478826
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
jmp 0x4787b2
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp + eax*4 - 0x2970], 0
jne 0x478855
push 0
lea ecx, [ebp - 0x1dc8]
call fcn.0042e2ef
and dword [eax], 0
xor eax, eax
jne 0x478855
and dword [ebp - 0x17d4], 0
jmp 0x47885f
mov dword [ebp - 0x17d4], 1
cmp dword [ebp - 0x17d4], 0x4c86
jne 0x478877
mov dword [ebp - 0x17dc], 1
jmp 0x47887e
and dword [ebp - 0x17dc], 0
mov eax, dword [ebp - 0x17dc]
mov dword [ebp - 0x1ec8], eax
lea ecx, [ebp - 0x1dc8]
call fcn.0042e2d3
jmp 0x478731
mov dword [ebp - 0x1a8], 1
jmp 0x4788b3
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x47890d
mov byte [ebp - 0x3a5], 0
movzx eax, byte [ebp - 0x3a5]
test eax, eax
je 0x4788e3
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov byte [ebp - 0x2b4], 0
movzx eax, byte [ebp - 0x2b4]
test eax, eax
je 0x47890b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x4788a6
mov byte [ebp - 0x26e], 0
movzx eax, byte [ebp - 0x26e]
test eax, eax
je 0x478947
push 0x85b
push 0x1253
push 0x17af
push 0x17f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor ecx, ecx
call fcn.0042e56c
push eax
call fcn.0047dcb3
pop ecx
push 2
lea ecx, [ebp - 0x1de0]
call fcn.0042e201
mov dword [ebp - 0x428], 8
mov dword [ebp - 0x30e0], 0xf1912530
mov dword [ebp - 0x1b0], 0
jmp 0x47898f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x4789ae
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x1de0]
call fcn.0042e2ef
or dword [eax], 0xffffffff
jmp 0x478982
mov dword [ebp - 0x1b0], 0
jmp 0x4789c7
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x4789e3
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x33fc], 0x203bd652
jmp 0x4789ba
push 0
lea ecx, [ebp - 0x1de0]
call fcn.0042e2ef
and dword [eax], 0
jmp 0x478a19
push 0
lea ecx, [ebp - 0x1de0]
call fcn.0042e2ef
mov dword [ebp - 0x17e4], eax
mov eax, dword [ebp - 0x17e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x17e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1de0]
call fcn.0042e2ef
cmp dword [eax], 0xf
jl 0x478bad
mov dword [ebp - 0x7f0], 0
jmp 0x478a48
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 1
jge 0x478a64
mov eax, dword [ebp - 0x7f0]
mov dword [ebp + eax*4 - 0xa28], 0x4074dd03
jmp 0x478a3b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa28], 0
je 0x478ac4
mov dword [ebp - 0x518], 0xfffffffa
mov dword [ebp - 0x518], 0
jmp 0x478a97
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0
jl 0x478abf
mov eax, dword [ebp - 0x518]
mov eax, dword [ebp + eax*4 - 0xa28]
mov dword [ebp - 0x2be4], eax
mov dword [ebp - 0x428], 0xffff0cf9
jmp 0x478a8a
jmp 0x478ba8
push 1
lea ecx, [ebp - 0x2744]
call fcn.0042e201
mov dword [ebp - 0x7f8], 0
jmp 0x478aea
mov eax, dword [ebp - 0x7f8]
inc eax
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 1
jge 0x478b0c
push dword [ebp - 0x7f8]
lea ecx, [ebp - 0x2744]
call fcn.0042e2ef
mov dword [eax], 0xb963ab1
jmp 0x478add
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa28], 0
je 0x478b2c
lea ecx, [ebp - 0x2744]
call fcn.0042e2d3
jmp 0x478bad
mov dword [ebp - 0x428], 0
jmp 0x478b45
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x16
jne 0x478b9d
mov dword [ebp - 0x17ec], 0xd49598aa
mov eax, dword [ebp - 0x17ec]
inc eax
mov dword [ebp - 0x17ec], eax
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x478b9b
push 0xee0
push 0
push 0
push 0x12af
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x478b38
lea ecx, [ebp - 0x2744]
call fcn.0042e2d3
jmp 0x4789f5
mov esi, dword [ebp - 0x428]
push 0
lea ecx, [ebp - 0x1de0]
call fcn.0042e2ef
mov dword [eax], esi
lea ecx, [ebp - 0x1de0]
call fcn.0042e2d3
push 2
lea ecx, [ebp - 0x234c]
call fcn.0042e201
mov dword [ebp - 0xbc], 0xe7ccc895
mov dword [ebp - 0x800], 0
jmp 0x478bfd
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 2
jge 0x478c1f
push dword [ebp - 0x800]
lea ecx, [ebp - 0x234c]
call fcn.0042e2ef
mov dword [eax], 0xd4e06482
jmp 0x478bf0
push 0
lea ecx, [ebp - 0x234c]
call fcn.0042e2ef
mov dword [eax], 0xffffffe2
jmp 0x478c58
push 0
lea ecx, [ebp - 0x234c]
call fcn.0042e2ef
mov dword [ebp - 0x17f4], eax
mov eax, dword [ebp - 0x17f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x17f4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x234c]
call fcn.0042e2ef
cmp dword [eax], 0xfffffff4
jg 0x478e07
push 2
lea ecx, [ebp - 0x1c60]
call fcn.0042e201
mov dword [ebp - 0x520], 0x13fe662d
mov dword [ebp - 0x1ed8], 0xeafb5d1c
mov dword [ebp - 0x808], 0
jmp 0x478ca8
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 2
jge 0x478cca
push dword [ebp - 0x808]
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
mov dword [eax], 0xe5664dc9
jmp 0x478c9b
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x520], eax
xor eax, eax
inc eax
je 0x478cf9
push 1
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
cmp dword [eax], 0
je 0x478cf9
mov dword [ebp - 0x1ed0], 1
jmp 0x478d00
and dword [ebp - 0x1ed0], 0
push 0
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x2e84], eax
push 0
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
push 0
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
mov esi, eax
mov edi, dword [ebp - 0xbc]
push 0
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
add edi, dword [eax]
imul eax, edi, 0xffff
mov esi, dword [esi]
sub esi, eax
push 0
lea ecx, [ebp - 0x1c60]
call fcn.0042e2ef
cmp esi, dword [eax]
jg 0x478d71
mov dword [ebp - 0x17fc], 1
jmp 0x478d78
and dword [ebp - 0x17fc], 0
mov eax, dword [ebp - 0x17fc]
mov dword [ebp - 0x1ed8], eax
mov dword [ebp - 0x520], 0xfffffffd
jmp 0x478d9d
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 5
jle 0x478df7
mov dword [ebp - 0xbc], 0xfffffffd
jmp 0x478dbf
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe2
jne 0x478df5
mov byte [ebp - 0x271], 0
movzx eax, byte [ebp - 0x271]
test eax, eax
je 0x478df3
push 0x24fc
push 0
push 0x29a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x478db2
jmp 0x478d90
lea ecx, [ebp - 0x1c60]
call fcn.0042e2d3
jmp 0x478c34
mov dword [ebp - 0xbc], 0xfffffff1
jmp 0x478e20
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe3
je 0x478e4b
mov byte [ebp - 0x252], 0
movzx eax, byte [ebp - 0x252]
test eax, eax
je 0x478e49
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x478e13
lea ecx, [ebp - 0x234c]
call fcn.0042e2d3
mov dword [ebp - 0x430], 0xd5e48d32
push 2
lea ecx, [ebp - 0x275c]
call fcn.0042e201
push 1
lea ecx, [ebp - 0x2420]
call fcn.0042e201
mov dword [ebp - 0x438], 0
push 3
lea ecx, [ebp - 0x2750]
call fcn.0042e201
mov dword [ebp - 0x1ef0], 0x2e26
mov dword [ebp - 0x40], 0
jmp 0x478eab
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x478ec7
push dword [ebp - 0x40]
lea ecx, [ebp - 0x275c]
call fcn.0042e2ef
mov dword [eax], 0xf5f49900
jmp 0x478ea4
mov dword [ebp - 0x40], 0
jmp 0x478ed7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x478ef3
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2420]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x478ed0
mov dword [ebp - 0x40], 0
jmp 0x478f03
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x478f1f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2750]
call fcn.0042e2ef
mov dword [eax], 7
jmp 0x478efc
mov byte [ebp - 0x253], 0
movzx eax, byte [ebp - 0x253]
test eax, eax
je 0x478f37
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x430], 6
jmp 0x478f50
mov eax, dword [ebp - 0x430]
dec eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 5
jg 0x479450
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1ee0], 1
mov dword [ebp - 0x528], 0xfffffff7
mov dword [ebp - 0x1c0], 0
jmp 0x478f94
cmp dword [ebp - 0x1c0], 0xfffffff8
jne 0x47944b
push 2
lea ecx, [ebp - 0xb64]
call fcn.0042e201
push 2
lea ecx, [ebp - 0x235c]
call fcn.0042e201
mov dword [ebp - 0x530], 0x828e972c
mov dword [ebp - 0x1b8], 0
jmp 0x478fde
cmp dword [ebp - 0x1b8], 2
jge 0x479000
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0xb64]
call fcn.0042e2ef
mov dword [eax], 0x5fc1
jmp 0x478fd1
mov dword [ebp - 0x1b8], 0
jmp 0x479019
jmp 0x478f43
lea ecx, [ebp - 0x2750]
call fcn.0042e2d3
lea ecx, [ebp - 0x2420]
call fcn.0042e2d3
lea ecx, [ebp - 0x275c]
call fcn.0042e2d3
push 2
lea ecx, [ebp - 0x3068]
call fcn.0042e201
mov dword [ebp - 0x818], 0x9bdba76a
mov dword [ebp - 0x810], 0
jmp 0x4794a1
mov eax, dword [ebp - 0x810]
inc eax
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 2
jge 0x4794c3
push dword [ebp - 0x810]
lea ecx, [ebp - 0x3068]
call fcn.0042e2ef
mov dword [eax], 0xfffffff7
jmp 0x479494
mov dword [ebp - 0x818], 0
jmp 0x4794dc
cmp dword [ebp - 0x818], 1
jg 0x47957f
mov dword [ebp - 0x820], 0x88adae8c
mov dword [ebp - 0x2bec], 0x4b2ab76d
mov dword [ebp - 0x31b4], 0x44accb24
mov dword [ebp - 0x2bf4], 0x9eeda585
mov dword [ebp - 0x820], 0
jmp 0x47952a
lea ecx, [ebp - 0x3068]
call fcn.0042e2d3
mov dword [ebp - 0x90], 0xfffffff7
mov dword [ebp - 0x3a4], 0xffff
mov dword [ebp - 0x240], 0xeae21516
mov dword [ebp - 0x548], 0x2d50c857
mov dword [ebp - 0x538], 0x3eb61943
mov dword [ebp - 0x550], 0x898d08f4
cmp dword [ebp - 0x90], 0x1b35d569
jl 0x4795de