Function at 0x46623a
Capabilities:
Accept command line arguments
Create process on windows
Delete registry key
Get disk information
Get file system object information
Get graphical window text
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x17d8
call fcn.004b3360
push esi
push edi
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xfc], 0x2b79dc86
mov dword [ebp - 0xf94], 0x4656e2e3
mov dword [ebp - 0xf9c], 5
mov dword [ebp - 0xfa4], 0xffffffff
mov dword [ebp - 0x2a4], 0
jmp 0x466294
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x4662b0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x5b8], 0xffffffff
jmp 0x466287
mov dword [ebp - 0xf8], 0
jmp 0x4662c9
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jg 0x466551
mov dword [ebp - 0x78], 0xa772304b
mov dword [ebp - 0x78], 3
jmp 0x4662ed
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x4664e5
push 2
lea ecx, [ebp - 0x580]
call fcn.00416ef7
mov dword [ebp - 0xeec], 0xcedb7758
mov dword [ebp - 0x374], 0
jmp 0x466327
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 2
jge 0x466349
push dword [ebp - 0x374]
lea ecx, [ebp - 0x580]
call fcn.00416f95
mov dword [eax], 0xc0272a72
jmp 0x46631a
push 1
lea ecx, [ebp - 0x580]
call fcn.00416f95
mov dword [eax], 3
jmp 0x466382
push 1
lea ecx, [ebp - 0x580]
call fcn.00416f95
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xa18]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa18]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x580]
call fcn.00416f95
cmp dword [eax], 0
jl 0x4664cb
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x5b8]
mov dword [ebp - 0x167c], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0x5b8]
mov dword [ebp - 0x15e0], eax
push 0
lea ecx, [ebp - 0x580]
call fcn.00416f95
push 1
lea ecx, [ebp - 0x580]
call fcn.00416f95
cmp dword [eax], 0
jne 0x4663de
cmp dword [ebp - 0x78], 0
push 0
lea ecx, [ebp - 0x580]
call fcn.00416f95
cmp dword [ebp - 0x78], 0x231
jle 0x466400
mov dword [ebp - 0xd24], 1
jmp 0x466407
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x5b8]
cmp dword [ebp - 0xd24], eax
jg 0x466425
mov dword [ebp - 0xd2c], 1
jmp 0x46642c
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xd2c], eax
je 0x466443
mov dword [ebp - 0xd34], 1
jmp 0x46644a
and dword [ebp - 0xd34], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b8]
cmp dword [ebp - 0xd34], eax
jg 0x46646a
mov dword [ebp - 0xebc], 1
jmp 0x466471
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x14e0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0x15dc], eax
push 1
lea ecx, [ebp - 0x580]
call fcn.00416f95
cmp dword [eax], 0
jne 0x4664b0
mov eax, 0x4b5a
test eax, eax
jne 0x4664b0
and dword [ebp - 0xd3c], 0
jmp 0x4664ba
mov dword [ebp - 0xd3c], 1
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0xeec], eax
jmp 0x46635e
mov dword [ebp - 0xfc], 0xfffffff9
lea ecx, [ebp - 0x580]
call fcn.00416f90
jmp 0x4662e6
cmp dword [ebp - 0x78], 0
je 0x466507
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x466505
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x46654c
mov dword [ebp - 0xef4], 5
cmp dword [ebp - 0xef4], 0
je 0x466528
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
jmp 0x46654c
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x46654c
push 0x2230
push 0x12a3
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x4662bc
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0x14e8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0x15e4], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15f0], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15f4], eax
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0xfc]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x5b8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x5b8]
jne 0x4665e2
mov dword [ebp - 0xd44], 1
jmp 0x4665e9
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xd44], eax
jne 0x466603
mov dword [ebp - 0xd4c], 1
jmp 0x46660a
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x7d38c461
jg 0x46662e
mov dword [ebp - 0xefc], 1
jmp 0x466635
and dword [ebp - 0xefc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0x151c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5b8]
mov dword [ebp - 0x1658], eax
mov eax, dword [ebp - 0xf94]
dec eax
cmp eax, 6
jb 0x466673
mov dword [ebp - 0xd54], 1
jmp 0x46667a
and dword [ebp - 0xd54], 0
imul eax, dword [ebp - 0xd54], 0xffff
cmp eax, dword [ebp - 0xf9c]
jl 0x466698
mov dword [ebp - 0xd5c], 1
jmp 0x46669f
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xfa4], eax
push 2
lea ecx, [ebp - 0x574]
call fcn.00416ef7
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0xfac], 0xbc99
mov dword [ebp - 0xbc], 0
jmp 0x4666e5
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x466701
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x132c], 0x24a8
jmp 0x4666d8
mov dword [ebp - 0xbc], 0
jmp 0x46671a
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x46673c
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x574]
call fcn.00416f95
mov dword [eax], 0x6ce125d1
jmp 0x46670d
push 1
lea ecx, [ebp - 0x574]
call fcn.00416f95
and dword [eax], 0
jmp 0x466772
push 1
lea ecx, [ebp - 0x574]
call fcn.00416f95
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0xd64]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd64]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x574]
call fcn.00416f95
cmp dword [eax], 3
jge 0x4667a0
push 1
lea ecx, [ebp - 0x574]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x132c], 0
jmp 0x46674e
mov dword [ebp - 0x19c], 0x19
jmp 0x4667b9
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xfffffffd
jl 0x466a28
mov dword [ebp - 0x88], 4
mov dword [ebp - 0x13c0], 0xfffffffd
mov dword [ebp - 0x13bc], 0xfffffffd
mov dword [ebp - 0x13b8], 0xfffffffd
mov dword [ebp - 0x13b4], 0xfffffffd
cmp dword [ebp - 0x88], 1
je 0x46680d
mov dword [ebp - 0xd6c], 1
jmp 0x466814
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0xd6c]
imul esi, eax, 0xde46
push 0
lea ecx, [ebp - 0x574]
call fcn.00416f95
cmp esi, dword [eax]
jne 0x46684d
cmp dword [ebp - 0x88], 0
je 0x46684d
mov dword [ebp - 0xd74], 1
jmp 0x466854
and dword [ebp - 0xd74], 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00416f95
mov esi, dword [ebp - 0xd74]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x574]
call fcn.00416f95
cmp esi, dword [eax]
jg 0x466886
mov dword [ebp - 0xd7c], 1
jmp 0x46688d
and dword [ebp - 0xd7c], 0
cmp dword [ebp - 0xd7c], 0x54981c58
jne 0x4668a5
mov dword [ebp - 0xd84], 1
jmp 0x4668ac
and dword [ebp - 0xd84], 0
cmp dword [ebp - 0xd84], 0xbc23cea2
jne 0x4668c4
mov dword [ebp - 0xd8c], 1
jmp 0x4668cb
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0x19c]
add eax, dword [ebp - 0xd8c]
cmp eax, dword [ebp - 0x88]
jle 0x4668eb
mov dword [ebp - 0xd94], 1
jmp 0x4668f2
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xd94], eax
jne 0x46690c
mov dword [ebp - 0xd9c], 1
jmp 0x466913
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xd9c], eax
jl 0x46692d
mov dword [ebp - 0xda4], 1
jmp 0x466934
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0xfac]
cmp eax, dword [ebp - 0xda4]
jle 0x46694e
mov dword [ebp - 0xdac], 1
jmp 0x466955
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xdac], eax
jg 0x46696f
mov dword [ebp - 0xdb4], 1
jmp 0x466976
and dword [ebp - 0xdb4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x132c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x132c]
cmp eax, dword [ebp - 0xdb4]
jge 0x4669ae
cmp dword [ebp - 0x88], 0
je 0x4669ae
mov dword [ebp - 0xdbc], 1
jmp 0x4669b5
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0xdbc]
cmp eax, 0xae45
jle 0x4669dc
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x4669dc
mov dword [ebp - 0xe04], 1
jmp 0x4669e3
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0xe04]
sub eax, 0x264d9248
imul eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x19c]
jge 0x466a09
mov dword [ebp - 0xe0c], 1
jmp 0x466a10
and dword [ebp - 0xe0c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe0c]
mov dword [ebp + eax - 0x13c0], ecx
jmp 0x4667ac
lea ecx, [ebp - 0x574]
call fcn.00416f90
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x130c], 0x1dba
mov dword [ebp - 0x1308], 0x1dba
mov dword [ebp - 0x1304], 0x1dba
mov dword [ebp - 0x1300], 0x1dba
lea ecx, [ebp - 0x52b]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x12fc]
push eax
lea eax, [ebp - 0x130c]
push eax
lea ecx, [ebp - 0x1718]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x16b8]
call fcn.00416f6a
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x466ab9
push 0
push 0x1225
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x2ac], 0xffffffec
jmp 0x466ad2
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xffffffe2
jle 0x466b2f
mov dword [ebp - 0x3dc], 0xfffffff7
mov dword [ebp - 0x3dc], 3
jmp 0x466afe
mov eax, dword [ebp - 0x3dc]
dec eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0
jl 0x466b2d
mov byte [ebp - 0x13b], 0
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x466b2b
push 0
push 0x3ff
push 0x108c
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x466af1
jmp 0x466ac5
lea ecx, [ebp - 0x16b8]
call fcn.00416f90
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x1524], 0x8f3c34ee
mov dword [ebp - 0x15fc], 0
mov dword [ebp - 0x5c4], 0xfffffff7
mov dword [ebp - 0x2b4], 0xf
jmp 0x466b7b
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x14
jle 0x466bd2
mov dword [ebp - 0x152c], 0xffffffff
mov dword [ebp - 0x37c], 0
jmp 0x466ba7
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x466bc3
mov eax, dword [ebp - 0x37c]
mov dword [ebp + eax*4 - 0x16d8], 0x68c0aa39
jmp 0x466b9a
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
jmp 0x466b6e
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x13f0], 0
mov dword [ebp - 0x13ec], 0
mov dword [ebp - 0x13e8], 0
mov dword [ebp - 0x13e4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13f0], 0
je 0x466c92
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0xc0c], 0xffffffff
mov dword [ebp - 0xfb4], 0xa6e6f7fb
mov dword [ebp - 0x22c], 0xffffffe4
jmp 0x466c4b
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x16
je 0x466c6e
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xfb4], eax
jmp 0x466c3e
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x466c8d
push 0
push 0x181f
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x466d47
push 4
lea ecx, [ebp - 0x10a4]
call fcn.00416ef7
mov dword [ebp - 0x2bc], 0
jmp 0x466cb8
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x466cda
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x10a4]
call fcn.00416f95
mov dword [eax], 1
jmp 0x466cab
push 3
lea ecx, [ebp - 0x10a4]
call fcn.00416f95
mov dword [eax], 0x15
jmp 0x466d13
push 3
lea ecx, [ebp - 0x10a4]
call fcn.00416f95
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5cc]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x10a4]
call fcn.00416f95
cmp dword [eax], 0xe
je 0x466d3c
mov dword [ebp - 0xfbc], 0x249a
cmp dword [ebp - 0xfbc], 0
je 0x466d3a
jmp 0x466d3c
jmp 0x466cef
lea ecx, [ebp - 0x10a4]
call fcn.00416f90
mov dword [ebp - 0x10c], 0x2b79dc86
push 3
lea ecx, [ebp - 0x210]
call fcn.00416ef7
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0xfc4], 0x11f64db2
mov dword [ebp - 0x418], 0
jmp 0x466d88
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 3
jge 0x466daa
push dword [ebp - 0x418]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov dword [eax], 0xff0ea75c
jmp 0x466d7b
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x466dd3
push 0
push 0x175
push 0x22d4
push 0xd9e
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x58], 2
jmp 0x466de3
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x467214
push 1
lea ecx, [ebp - 0x454]
call fcn.00416ef7
mov dword [ebp - 0x2c4], 0
jmp 0x466e13
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x466e35
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x454]
call fcn.00416f95
mov dword [eax], 0xf72d4ea6
jmp 0x466e06
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
mov dword [eax], 2
jmp 0x466e6e
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc14]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
cmp dword [eax], 0
jl 0x4670a7
mov dword [ebp - 0x384], 0
jmp 0x466e9d
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jge 0x466eb6
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x3c], 1
jmp 0x466e90
mov byte [ebp - 0x174], 0
movzx eax, byte [ebp - 0x174]
test eax, eax
je 0x466ed2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3c], 0
jmp 0x466ef7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 2
jg 0x4670a2
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
mov esi, eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov esi, dword [esi]
sub esi, dword [eax]
add esi, dword [ebp - 0x58]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
imul esi, dword [eax]
cmp esi, 9
jge 0x466f71
mov dword [ebp - 0x5d4], 1
jmp 0x466f78
and dword [ebp - 0x5d4], 0
push 2
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov esi, dword [eax]
sub esi, dword [ebp - 0x5d4]
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
sub esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
cmp esi, dword [eax]
jg 0x466fd8
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
cmp dword [eax], 0
jne 0x466fd8
and dword [ebp - 0xc1c], 0
jmp 0x466fe2
mov dword [ebp - 0xc1c], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov ecx, dword [ebp - 0xc1c]
cmp ecx, dword [eax]
jl 0x46700d
mov dword [ebp - 0x5dc], 1
jmp 0x467014
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 9
jbe 0x467029
mov dword [ebp - 0xc24], 1
jmp 0x467030
and dword [ebp - 0xc24], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov ecx, dword [ebp - 0xc24]
add ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x3c]
jge 0x467065
mov dword [ebp - 0x5e4], 1
jmp 0x46706c
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3c]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov ecx, dword [ebp - 0x5e4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
cmp dword [eax], 0
je 0x46709d
jmp 0x4670a2
jmp 0x466ee2
jmp 0x466e4a
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov esi, eax
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x4670f1
mov dword [ebp - 0x474], 1
jmp 0x4670f8
and dword [ebp - 0x474], 0
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
mov ecx, dword [ebp - 0x474]
mov dword [eax], ecx
mov esi, dword [ebp - 0x474]
sub esi, 0xd6ba
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
cmp esi, dword [eax]
jle 0x467137
mov dword [ebp - 0xc2c], 1
jmp 0x46713e
and dword [ebp - 0xc2c], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc2c]
jne 0x467162
mov dword [ebp - 0x5ec], 1
jmp 0x467169
and dword [ebp - 0x5ec], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov ecx, dword [ebp - 0x5ec]
cmp ecx, dword [eax]
jl 0x46718d
mov dword [ebp - 0xc34], 1
jmp 0x467194
and dword [ebp - 0xc34], 0
push 0
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov ecx, dword [ebp - 0xc34]
cmp ecx, dword [eax]
je 0x4671c6
push 0
lea ecx, [ebp - 0x454]
call fcn.00416f95
cmp dword [eax], 0
jne 0x4671c6
and dword [ebp - 0x5f4], 0
jmp 0x4671d0
mov dword [ebp - 0x5f4], 1
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
mov ecx, dword [ebp - 0x5f4]
sub ecx, dword [eax]
mov esi, 0x1f0ef2ed
sub esi, ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
call fcn.00416f95
imul esi, dword [eax]
mov dword [ebp - 0xfc4], esi
lea ecx, [ebp - 0x454]
call fcn.00416f90
jmp 0x466ddc
lea ecx, [ebp - 0x210]
call fcn.00416f90
mov dword [ebp - 0x1144], 0x4656e2e3
mov dword [ebp - 0x10f0], 5
mov dword [ebp - 0x25c], 5
mov dword [ebp - 0x2cc], 0
jmp 0x467256
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x467272
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x1764], 3
jmp 0x467249
mov dword [ebp - 0x25c], 2
jmp 0x46728b
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x4672f5
mov dword [ebp - 0x3e4], 0xede0b407
mov dword [ebp - 0x3e4], 0
jmp 0x4672b7
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 2
jg 0x4672f3
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x4672f1
push 0x10c7
push 0x9e0
push 0x21e3
push 0x782
push 0x1b8a
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x4672aa
jmp 0x46727e
mov dword [ebp - 0x25c], 7
mov dword [ebp - 0x1038], 0xffffffff
mov dword [ebp - 0x2d4], 0x7e2799ac
mov dword [ebp - 0xc3c], 0x8872fa4
mov dword [ebp - 0x2d4], 0
jmp 0x467336
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xa
jl 0x4673b3
mov dword [ebp - 0xfcc], 0x4d2edc75
mov dword [ebp - 0x234], 0xffff
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x234], 0
jmp 0x467378
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x1f
jge 0x4673ae
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x4673ac
push 0x24f3
push 0x24c5
push 0
push 0x1817
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x46736b
jmp 0x467329
mov eax, dword [ebp - 0xc3c]
dec eax
mov dword [ebp - 0xc3c], eax
mov dword [ebp - 0x50], 0x82062403
mov dword [ebp - 0x114], 0xfffffff9
mov dword [ebp - 0xe1c], 0
mov dword [ebp - 0xe18], 0
mov dword [ebp - 0xe14], 0
mov dword [ebp - 0xe10], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x50], 0
jmp 0x467413
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff1
jge 0x46794b
mov dword [ebp - 0xfd4], 0x60d2f38
mov dword [ebp - 0x2e4], 5
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x654], 1
mov dword [ebp - 0xfe4], 0xa277ebd0
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x47c], 0xac77
mov dword [ebp - 0x38c], 0
jmp 0x46747c
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 1
jge 0x467498
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x274], 0x9ab5c294
jmp 0x46746f
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1698], eax
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
je 0x467609
cmp dword [ebp - 0x2e4], 2
jle 0x4674c9
mov dword [ebp - 0x4f0], 1
jmp 0x4674d0
and dword [ebp - 0x4f0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f0]
mov dword [ebp + eax - 0xe1c], ecx
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x467508
xor eax, eax
je 0x467508
mov dword [ebp - 0x5fc], 1
jmp 0x46750f
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0xfd4]
push 4
pop eax
imul eax, eax, 3
imul eax, dword [ebp + eax - 0xe1c], 0x11e7
cmp dword [ebp - 0x50], eax
jne 0x467537
mov dword [ebp - 0xc44], 1
jmp 0x46753e
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xc44]
sub eax, dword [ebp - 0x2dc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x274]
jge 0x467565
mov dword [ebp - 0x604], 1
jmp 0x46756c
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x604], eax
je 0x467583
mov dword [ebp - 0xc4c], 1
jmp 0x46758a
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xc4c], eax
jge 0x4675a1
mov dword [ebp - 0x60c], 1
jmp 0x4675a8
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x60c], eax
jne 0x4675c2
mov dword [ebp - 0xc54], 1
jmp 0x4675c9
and dword [ebp - 0xc54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
cmp dword [ebp - 0xc54], eax
jg 0x4675ea
mov dword [ebp - 0x614], 1
jmp 0x4675f1
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xfffe
je 0x467609
mov dword [ebp - 0xc5c], 1
jmp 0x467610
and dword [ebp - 0xc5c], 0
cmp dword [ebp - 0xc5c], 0xc01e6e2b
jbe 0x46762c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x274], 0
jne 0x467645
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x274], 0
jne 0x467645
and dword [ebp - 0x61c], 0
jmp 0x46764f
mov dword [ebp - 0x61c], 1
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x61c], eax
jle 0x467669
mov dword [ebp - 0xc64], 1
jmp 0x467670
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x50], eax
jg 0x467693
mov dword [ebp - 0xfdc], 1
jmp 0x46769a
and dword [ebp - 0xfdc], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1534], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1604], eax
mov dword [ebp - 0x624], 0x25f8
mov eax, dword [ebp - 0xfe4]
cmp dword [ebp - 0x624], eax
jl 0x467898
mov dword [ebp - 0xc6c], 0xffffffff
mov dword [ebp - 0x414], 0xfffffffe
mov dword [ebp - 0x644], 0
cmp dword [ebp - 0x47c], 0xeff85a04
jae 0x4676fe
mov dword [ebp - 0xfec], 1
jmp 0x467705
and dword [ebp - 0xfec], 0
mov eax, dword [ebp - 0x50]
neg eax
cmp eax, dword [ebp - 0x2dc]
je 0x467720
xor eax, eax
inc eax
jne 0x467720
and dword [ebp - 0x62c], 0
jmp 0x46772a
mov dword [ebp - 0x62c], 1
mov dword [ebp - 0xc6c], 0x90c37c50
mov eax, dword [ebp - 0xc6c]
cmp eax, dword [ebp - 0x62c]
je 0x46774e
mov dword [ebp - 0xc74], 1
jmp 0x467755
and dword [ebp - 0xc74], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xe1c]
cmp dword [ebp - 0xc74], eax
jne 0x467776
mov dword [ebp - 0x634], 1
jmp 0x46777d
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0x634], eax
jg 0x467797
mov dword [ebp - 0xc7c], 1
jmp 0x46779e
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0xc7c], eax
jge 0x4677b8
mov dword [ebp - 0x63c], 1
jmp 0x4677bf
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xffffffff
jge 0x4677d5
xor eax, eax
jne 0x4677d5
and dword [ebp - 0xc84], 0
jmp 0x4677df
mov dword [ebp - 0xc84], 1
cmp dword [ebp - 0xc84], 0xbb8911f7
jne 0x4677f7
mov dword [ebp - 0xff4], 1
jmp 0x4677fe
and dword [ebp - 0xff4], 0
mov eax, dword [ebp - 0x414]
imul eax, dword [ebp - 0x23c]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
imul eax, dword [ebp - 0x644]
test eax, eax
je 0x46783e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe1c], 0
je 0x46783e
mov dword [ebp - 0xc8c], 1
jmp 0x467845
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0xc8c], eax
jne 0x46785f
mov dword [ebp - 0x64c], 1
jmp 0x467866
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x64c], eax
jl 0x467880
mov dword [ebp - 0xc94], 1
jmp 0x467887
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0x114], eax
jmp 0x467946
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x153c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xe1c]
cmp dword [ebp - 0x2e4], eax
jl 0x4678c5
mov dword [ebp - 0xffc], 1
jmp 0x4678cc
and dword [ebp - 0xffc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
mov dword [ebp - 0x114], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe1c]
cmp eax, dword [ebp - 0x114]
jle 0x467900
mov dword [ebp - 0x1004], 1
jmp 0x467907
and dword [ebp - 0x1004], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1660], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1544], eax
mov dword [ebp - 0x654], 0xffffffff
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x654]
mov dword [ebp + eax - 0xe1c], ecx
cmp dword [ebp - 0x47c], 0
je 0x467946
jmp 0x46794b
jmp 0x46740c
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x46796d
push 0xf0a
push 0x1023
call dword [sym.imp.GDI32.dll_RestoreDC]
mov dword [ebp - 0x394], 0
jmp 0x467986
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 4
jge 0x4679a2
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x5a8], 0xffffffff
jmp 0x467979
mov dword [ebp - 0x1e0], 0xfffffffd
mov dword [ebp - 0x2ec], 0
jmp 0x4679c5
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 4
jge 0x4679e1
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0x1798], 0x82062403
jmp 0x4679b8
mov dword [ebp - 0x1e0], 3
jmp 0x4679fa
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x467a1d
mov byte [ebp - 0x176], 0
movzx eax, byte [ebp - 0x176]
test eax, eax
je 0x467a1b
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x4679ed
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0xb0], 0
jmp 0x467a42
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x46918c
mov dword [ebp - 0x3ec], 0x13dd33a4
mov dword [ebp - 0x3ec], 0xffffffe3
jmp 0x467a72
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0xfffffff9
jg 0x467aeb
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0x2f4], 0xfffffff3
jmp 0x467a9e
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xffffffed
jge 0x467ae6
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x467aca
push 0
push 0
push 0
push 0x91e
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x467ae4
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x467a91
jmp 0x467a65
mov dword [ebp - 0x68], 0xa772304b
mov dword [ebp - 0x68], 3
jmp 0x467b02
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x46875b
mov dword [ebp - 0x18], 0xae97
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x467b2a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2a
jge 0x467d0a
mov dword [ebp - 0x2fc], 5
push 3
lea ecx, [ebp - 0x1398]
call fcn.00416ef7
mov dword [ebp - 0x39c], 0
jmp 0x467b64
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 3
jge 0x467b86
push dword [ebp - 0x39c]
lea ecx, [ebp - 0x1398]
call fcn.00416f95
mov dword [eax], 1
jmp 0x467b57
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x467ba2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x160c], eax
cmp dword [ebp - 0x18], 0xe617
jge 0x467bc3
mov dword [ebp - 0xc9c], 1
jmp 0x467bca
and dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc9c], eax
jl 0x467be1
mov dword [ebp - 0x65c], 1
jmp 0x467be8
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x65c], eax
jg 0x467bff
mov dword [ebp - 0xca4], 1
jmp 0x467c06
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0xca4], eax
jne 0x467c20
mov dword [ebp - 0x664], 1
jmp 0x467c27
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x664]
jge 0x467c3e
mov dword [ebp - 0x100c], 1
jmp 0x467c45
and dword [ebp - 0x100c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x467c59
mov dword [ebp - 0xcac], 1
jmp 0x467c60
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0xcac], eax
jge 0x467c7a
mov dword [ebp - 0x66c], 1
jmp 0x467c81
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x66c], eax
jg 0x467c9b
mov dword [ebp - 0x1014], 1
jmp 0x467ca2
and dword [ebp - 0x1014], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jge 0x467cbf
mov dword [ebp - 0xcb4], 1
jmp 0x467cc6
and dword [ebp - 0xcb4], 0
cmp dword [ebp - 0xcb4], 1
jg 0x467cdb
mov dword [ebp - 0x674], 1
jmp 0x467ce2
and dword [ebp - 0x674], 0
mov esi, dword [ebp - 0x674]
sub esi, dword [ebp - 0x18]
push 1
lea ecx, [ebp - 0x1398]
call fcn.00416f95
mov dword [eax], esi
lea ecx, [ebp - 0x1398]
call fcn.00416f90
jmp 0x467b23
push 2
lea ecx, [ebp - 0x598]
call fcn.00416ef7
mov dword [ebp - 0x1064], 0xcedb7758
mov dword [ebp - 0x1408], 1
mov dword [ebp - 0x140c], 0xa876e6ba
mov dword [ebp - 0x1414], 0x444696a4
mov dword [ebp - 0x101c], 0xfffffffd
mov dword [ebp - 0x141c], 8
mov dword [ebp - 0xcbc], 0xffffffff
mov dword [ebp - 0x424], 0
jmp 0x467d76
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 3
jge 0x467d92
mov eax, dword [ebp - 0x424]
mov dword [ebp + eax*4 - 0x177c], 0xbeb7161a
jmp 0x467d69
mov eax, dword [ebp - 0xcbc]
dec eax
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0x101c], 0
push 2
lea ecx, [ebp - 0x568]
call fcn.00416ef7
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x1024], 0xbc99
mov dword [ebp - 0xec], 0
jmp 0x467de3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x467dff
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x13b0], 0x24a8
jmp 0x467dd6
mov dword [ebp - 0xec], 0
jmp 0x467e18
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x467e3a
push dword [ebp - 0xec]
lea ecx, [ebp - 0x568]
call fcn.00416f95
mov dword [eax], 0x6ce125d1
jmp 0x467e0b
push 1
lea ecx, [ebp - 0x568]
call fcn.00416f95
and dword [eax], 0
jmp 0x467e70
push 1
lea ecx, [ebp - 0x568]
call fcn.00416f95
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x67c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x568]
call fcn.00416f95
cmp dword [eax], 3
jge 0x467e9e
push 1
lea ecx, [ebp - 0x568]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x13b0], 0
jmp 0x467e4c
mov dword [ebp - 0x1d0], 0x19
jmp 0x467eb7
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xfffffffd
jl 0x468126
mov dword [ebp - 0xa0], 4
mov dword [ebp - 0x13d0], 0xfffffffd
mov dword [ebp - 0x13cc], 0xfffffffd
mov dword [ebp - 0x13c8], 0xfffffffd
mov dword [ebp - 0x13c4], 0xfffffffd
cmp dword [ebp - 0xa0], 1
je 0x467f0b
mov dword [ebp - 0xcc4], 1
jmp 0x467f12
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0xcc4]
imul esi, eax, 0xde46
push 0
lea ecx, [ebp - 0x568]
call fcn.00416f95
cmp esi, dword [eax]
jne 0x467f4b
cmp dword [ebp - 0xa0], 0
je 0x467f4b
mov dword [ebp - 0x684], 1
jmp 0x467f52
and dword [ebp - 0x684], 0
push 1
lea ecx, [ebp - 0x568]
call fcn.00416f95
mov esi, dword [ebp - 0x684]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x568]
call fcn.00416f95
cmp esi, dword [eax]
jg 0x467f84
mov dword [ebp - 0xccc], 1
jmp 0x467f8b
and dword [ebp - 0xccc], 0
cmp dword [ebp - 0xccc], 0x54981c58
jne 0x467fa3
mov dword [ebp - 0x68c], 1
jmp 0x467faa
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0xbc23cea2
jne 0x467fc2
mov dword [ebp - 0xcd4], 1
jmp 0x467fc9
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0x1d0]
add eax, dword [ebp - 0xcd4]
cmp eax, dword [ebp - 0xa0]
jle 0x467fe9
mov dword [ebp - 0x694], 1
jmp 0x467ff0
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x694], eax
jne 0x46800a
mov dword [ebp - 0xcdc], 1
jmp 0x468011
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xcdc], eax
jl 0x46802b
mov dword [ebp - 0x69c], 1
jmp 0x468032
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x1024]
cmp eax, dword [ebp - 0x69c]
jle 0x46804c
mov dword [ebp - 0xce4], 1
jmp 0x468053
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xce4], eax
jg 0x46806d
mov dword [ebp - 0x6a4], 1
jmp 0x468074
and dword [ebp - 0x6a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13b0]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x13b0]
cmp eax, dword [ebp - 0x6a4]
jge 0x4680ac
cmp dword [ebp - 0xa0], 0
je 0x4680ac
mov dword [ebp - 0xcec], 1
jmp 0x4680b3
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0xcec]
cmp eax, 0xae45
jle 0x4680da
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x4680da
mov dword [ebp - 0x6ac], 1
jmp 0x4680e1
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
sub eax, 0x264d9248
imul eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x1d0]
jge 0x468107
mov dword [ebp - 0xcf4], 1
jmp 0x46810e
and dword [ebp - 0xcf4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcf4]
mov dword [ebp + eax - 0x13d0], ecx
jmp 0x467eaa
lea ecx, [ebp - 0x568]
call fcn.00416f90
mov dword [ebp - 0x304], 0
jmp 0x46814a
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 2
jge 0x46816c
push dword [ebp - 0x304]
lea ecx, [ebp - 0x598]
call fcn.00416f95
mov dword [eax], 0xc0272a72
jmp 0x46813d
mov dword [ebp - 0x6c4], 0x2263126f
mov dword [ebp - 0x520], 0x18e9
mov dword [ebp - 0x484], 0x89bdd777
mov dword [ebp - 0x6f4], 4
mov dword [ebp - 0x1044], 0x5ab4d258
mov dword [ebp - 0x3a4], 0
jmp 0x4681b7
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 2
jge 0x4681d3
mov eax, dword [ebp - 0x3a4]
mov dword [ebp + eax*4 - 0xe64], 0xffffffff
jmp 0x4681aa
cmp dword [ebp - 0x6c4], 0xbbd0
jl 0x4681eb
mov dword [ebp - 0x6b4], 1
jmp 0x4681f2
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x84bc9c3
jle 0x46820a
mov dword [ebp - 0x102c], 1
jmp 0x468211
and dword [ebp - 0x102c], 0
cmp dword [ebp - 0x520], 0x4b0b
jge 0x468229
mov dword [ebp - 0xcfc], 1
jmp 0x468230
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0xffff
jb 0x468248
mov dword [ebp - 0x1034], 1
jmp 0x46824f
and dword [ebp - 0x1034], 0
mov eax, 0xe80d
cmp eax, 1
je 0x468265
mov dword [ebp - 0x6bc], 1
jmp 0x46826c
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x6bc], eax
jg 0x468286
mov dword [ebp - 0xd04], 1
jmp 0x46828d
and dword [ebp - 0xd04], 0
cmp dword [ebp - 0xd04], 2
jbe 0x4682a2
mov dword [ebp - 0xd0c], 1
jmp 0x4682a9
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0xd0c]
jge 0x4682c3
mov dword [ebp - 0x6cc], 1
jmp 0x4682ca
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 2
jle 0x4682df
mov dword [ebp - 0xd14], 1
jmp 0x4682e6
and dword [ebp - 0xd14], 0
cmp dword [ebp - 0xd14], 0xf27a4129
jb 0x4682fe
mov dword [ebp - 0x103c], 1
jmp 0x468305
and dword [ebp - 0x103c], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe64], 1
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xe64]
sub eax, dword [ebp + ecx - 0xe64]
mov dword [ebp - 0xd1c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp + eax - 0xe64], ecx
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0xd1c], eax
jg 0x468363
mov dword [ebp - 0x714], 1
jmp 0x46836a
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x520]
cmp eax, dword [ebp - 0x714]
jne 0x468384
mov dword [ebp - 0xde0], 1
jmp 0x46838b
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x1424], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
mov ecx, dword [ebp - 0xde0]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x1044], eax
push 1
lea ecx, [ebp - 0x598]
call fcn.00416f95
mov dword [eax], 3
jmp 0x4683f2
push 1
lea ecx, [ebp - 0x598]
call fcn.00416f95
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6f0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x598]
call fcn.00416f95
cmp dword [eax], 0
jl 0x468741
mov dword [ebp - 0xa78], 0x5546
mov dword [ebp - 0xa70], 1
push 2
lea ecx, [ebp - 0x1150]
call fcn.00416ef7
mov dword [ebp - 0x700], 0x1162f630
push 3
lea ecx, [ebp - 0xe88]
call fcn.00416ef7
mov dword [ebp - 0x1054], 0x21c9b6cd
mov dword [ebp - 0x20], 0
jmp 0x46845a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x468470
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf08], 0xfffd
jmp 0x468453
mov dword [ebp - 0x20], 0
jmp 0x468480
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x46849c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1150]
call fcn.00416f95
mov dword [eax], 0x27359b50
jmp 0x468479
mov dword [ebp - 0x20], 0
jmp 0x4684ac
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x4684c8
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe88]
call fcn.00416f95
mov dword [eax], 0xabb75da2
jmp 0x4684a5
mov dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xa78]
dec eax
sub eax, dword [ebp - 0xa70]
cmp eax, 0x4c38b6b0
jle 0x4684f2
mov dword [ebp - 0x6f8], 1
jmp 0x4684f9
and dword [ebp - 0x6f8], 0
mov esi, 0xdc2a82a1
sub esi, dword [ebp - 0x6f8]
push 0
lea ecx, [ebp - 0x1150]
call fcn.00416f95
cmp esi, dword [eax]
je 0x468521
mov dword [ebp - 0xc30], 1
jmp 0x468528
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 0
je 0x468546
cmp dword [ebp - 0xa78], 0
jne 0x468561
push 0
lea ecx, [ebp - 0x1150]
call fcn.00416f95
cmp dword [eax], 0
jne 0x468561
and dword [ebp - 0x708], 0
jmp 0x46856b
mov dword [ebp - 0x708], 1
push 2
lea ecx, [ebp - 0xe88]
call fcn.00416f95
mov ecx, dword [ebp - 0x708]
cmp ecx, dword [eax]
jl 0x46858e
mov dword [ebp - 0x104c], 1
jmp 0x468595
and dword [ebp - 0x104c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf08]
mov dword [ebp - 0x142c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf08]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf08], eax
push 1
lea ecx, [ebp - 0xe88]
call fcn.00416f95
mov esi, eax
push 2
lea ecx, [ebp - 0xe88]
call fcn.00416f95
mov esi, dword [esi]
add esi, dword [eax]
push 2
lea ecx, [ebp - 0xe88]
call fcn.00416f95
add esi, dword [eax]
mov dword [ebp - 0x1054], esi
lea ecx, [ebp - 0xe88]
call fcn.00416f90
lea ecx, [ebp - 0x1150]
call fcn.00416f90
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x5a8]
mov dword [ebp - 0x1434], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x5a8]
mov dword [ebp - 0x143c], eax
push 0
lea ecx, [ebp - 0x598]
call fcn.00416f95
push 1
lea ecx, [ebp - 0x598]
call fcn.00416f95
cmp dword [eax], 0
jne 0x468654
cmp dword [ebp - 0x68], 0
push 0
lea ecx, [ebp - 0x598]
call fcn.00416f95
cmp dword [ebp - 0x68], 0x231
jle 0x468676
mov dword [ebp - 0xd10], 1
jmp 0x46867d
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x5a8]
cmp dword [ebp - 0xd10], eax
jg 0x46869b
mov dword [ebp - 0x710], 1
jmp 0x4686a2
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x710], eax
je 0x4686b9
mov dword [ebp - 0xa80], 1
jmp 0x4686c0
and dword [ebp - 0xa80], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp - 0xa80], eax
jg 0x4686e0
mov dword [ebp - 0x105c], 1
jmp 0x4686e7
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1444], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x144c], eax
push 1
lea ecx, [ebp - 0x598]
call fcn.00416f95
cmp dword [eax], 0
jne 0x468726
mov eax, 0x4b5a
test eax, eax
jne 0x468726
and dword [ebp - 0x718], 0
jmp 0x468730
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x1064], eax
jmp 0x4683ce
mov dword [ebp - 0x10c], 0xfffffff9
lea ecx, [ebp - 0x598]
call fcn.00416f90
jmp 0x467afb
cmp dword [ebp - 0x68], 0
je 0x468f43
mov dword [ebp - 0x3f4], 0x5c8094a
mov dword [ebp - 0x1454], 1
mov dword [ebp - 0x145c], 0x6f6dd8d1
mov dword [ebp - 0x30c], 0
jmp 0x46879c
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x4687b8
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x1464], 0x9b31
jmp 0x46878f
mov dword [ebp - 0x3f4], 0
jmp 0x4687d1
mov eax, dword [ebp - 0x3f4]
dec eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
jl 0x468853
push 3
lea ecx, [ebp - 0x1338]
call fcn.00416ef7
mov dword [ebp - 0x314], 0
jmp 0x468800
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jge 0x46881f
push dword [ebp - 0x314]
lea ecx, [ebp - 0x1338]
call fcn.00416f95
and dword [eax], 0
jmp 0x4687f3
push 1
lea ecx, [ebp - 0x1338]
call fcn.00416f95
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0xc38]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc38]
mov dword [ecx], eax
lea ecx, [ebp - 0x1338]
call fcn.00416f90
jmp 0x4687c4
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x1a8], 0
push 2
lea ecx, [ebp - 0x15a8]
call fcn.00416ef7
mov dword [ebp - 0x3ac], 0
jmp 0x46888d
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x4688af
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x15a8]
call fcn.00416f95
mov dword [eax], 1
jmp 0x468880
mov dword [ebp - 0x140], 0xfffffff4
jmp 0x4688c8
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xfffffffa
jne 0x4689fc
mov dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
add eax, 0xf737
cmp dword [ebp - 0x4f8], eax
jge 0x46890a
mov dword [ebp - 0x720], 1
jmp 0x468911
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x146c], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x1474], eax
cmp dword [ebp - 0x140], 0xcc2fdcb
jg 0x468941
mov dword [ebp - 0xa88], 1
jmp 0x468948
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x720]
sub eax, dword [ebp - 0xa88]
je 0x468996
cmp dword [ebp - 0x4f8], 0
je 0x468964
jmp 0x4689fc
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x468994
push 0x30a
push 0
push 0xa80
push 0x158
push 0
push 0x22c9
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
jmp 0x4689f7
mov dword [ebp - 0x728], 0x4ba8b35e
mov dword [ebp - 0x1a8], 0
jmp 0x4689b9
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jg 0x4689ec
mov byte [ebp - 0x178], 0
movzx eax, byte [ebp - 0x178]
test eax, eax
je 0x4689df
push 0x232c
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp dword [ebp - 0x728], 0
je 0x4689ea
jmp 0x4689ec
jmp 0x4689ac
cmp dword [ebp - 0x728], 0
je 0x4689f7
jmp 0x4689fc
jmp 0x4688bb
lea ecx, [ebp - 0x15a8]
call fcn.00416f90
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x468f3e
mov dword [ebp - 0x1294], 0xfffffffc
mov dword [ebp - 0x1290], 0xfffffffc
mov dword [ebp - 0x128c], 0xfffffffc
mov dword [ebp - 0x1288], 0xfffffffc
lea ecx, [ebp - 0x52a]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x1284]
push eax
lea eax, [ebp - 0x1294]
push eax
lea ecx, [ebp - 0x1728]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11bc]
call fcn.00416f6a
mov dword [ebp - 0x148], 0xdbda7fe6
mov dword [ebp - 0x758], 0xfffffff6
mov dword [ebp - 0xc4], 9
mov dword [ebp - 0x1074], 0xdb2097e6
mov dword [ebp - 0x31c], 0
jmp 0x468abb
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jge 0x468ad7
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0x120c], 0xbca6
jmp 0x468aae
push 2
lea ecx, [ebp - 0x11bc]
call fcn.00416f95
mov dword [eax], 1
jmp 0x468b10
push 2
lea ecx, [ebp - 0x11bc]
call fcn.00416f95
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xd80]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd80]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x11bc]
call fcn.00416f95
cmp dword [eax], 0
jl 0x468f2b
mov dword [ebp - 0x220], 0xfffffffe
push 2
lea ecx, [ebp - 0xea0]
call fcn.00416ef7
mov dword [ebp - 0x41c], 0
jmp 0x468b56
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 2
jge 0x468b78
push dword [ebp - 0x41c]
lea ecx, [ebp - 0xea0]
call fcn.00416f95
mov dword [eax], 0xed680444
jmp 0x468b49
mov dword [ebp - 0x220], 1
jmp 0x468b91
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x468e0f
mov dword [ebp - 0x147c], 0xfffffffb
mov dword [ebp - 0x1230], 8
mov dword [ebp - 0x122c], 8
mov dword [ebp - 0x1228], 8
mov dword [ebp - 0x1224], 8
lea ecx, [ebp - 0x529]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x1230]
push eax
lea ecx, [ebp - 0x1750]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1350]
call fcn.00416f6a
mov dword [ebp - 0x324], 0
jmp 0x468c1e
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 2
jge 0x468c3a
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x1720], 0x245c
jmp 0x468c11
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc4], 0
jmp 0x468c60
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x468dff
mov dword [ebp - 0x3b4], 0
jmp 0x468c86
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jge 0x468ca2
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0x106c], 0xfffffffb
jmp 0x468c79
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x120c], 4
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x106c]
mov dword [ebp - 0x730], eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xea0]
call fcn.00416f95
mov ecx, dword [ebp - 0x730]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x730]
cmp dword [eax], 4
jne 0x468d08
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x120c], 0
je 0x468d08
mov dword [ebp - 0xa90], 1
jmp 0x468d0f
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0xa90]
jge 0x468d29
mov dword [ebp - 0x738], 1
jmp 0x468d30
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0xd9964974
jbe 0x468d48
mov dword [ebp - 0xc40], 1
jmp 0x468d4f
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0xc40], 0xbcab
jle 0x468d67
mov dword [ebp - 0x740], 1
jmp 0x468d6e
and dword [ebp - 0x740], 0
push 0
lea ecx, [ebp - 0x1350]
call fcn.00416f95
mov eax, dword [eax]
cmp eax, dword [ebp - 0x740]
jle 0x468d91
mov dword [ebp - 0xa98], 1
jmp 0x468d98
and dword [ebp - 0xa98], 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xea0]
call fcn.00416f95
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa98]
jg 0x468dbf
mov dword [ebp - 0x748], 1
jmp 0x468dc6
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 0x3b8c
jle 0x468dde
mov dword [ebp - 0xd18], 1
jmp 0x468de5
and dword [ebp - 0xd18], 0
push 0
lea ecx, [ebp - 0x1350]
call fcn.00416f95
mov ecx, dword [ebp - 0xd18]
mov dword [eax], ecx
jmp 0x468c53
lea ecx, [ebp - 0x1350]
call fcn.00416f90
jmp 0x468b84
mov dword [ebp - 0x148], 0
jmp 0x468e28
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x468f1b
mov dword [ebp - 0x1484], 9
mov dword [ebp - 0x32c], 0
jmp 0x468e58
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 4
jge 0x468e74
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x1654], 0xf4a1d2da
jmp 0x468e4b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1654]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1654], eax
push dword [ebp - 0x148]
lea ecx, [ebp - 0xea0]
call fcn.00416f95
mov eax, dword [eax]
add eax, 0x76d89b6a
cmp eax, dword [ebp - 0xc4]
jl 0x468ebb
mov dword [ebp - 0x750], 1
jmp 0x468ec2
and dword [ebp - 0x750], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1654]
cmp eax, dword [ebp - 0x750]
jle 0x468ee3
mov dword [ebp - 0xaa0], 1
jmp 0x468eea
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0
push dword [ebp - 0x148]
lea ecx, [ebp - 0xea0]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp - 0x1074], eax
jmp 0x468e1b
lea ecx, [ebp - 0xea0]
call fcn.00416f90
jmp 0x468aec
lea ecx, [ebp - 0x11bc]
call fcn.00416f90
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x469187
mov dword [ebp - 0x107c], 5
cmp dword [ebp - 0x107c], 0
je 0x468f67
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10c], eax
jmp 0x469187
mov dword [ebp - 0x3fc], 0x13dd33a4
mov dword [ebp - 0x3fc], 0xffffffe3
jmp 0x468f8a
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0xfffffff9
jg 0x469003
mov dword [ebp - 0x334], 1
mov dword [ebp - 0x334], 0xfffffff3
jmp 0x468fb6
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0xffffffed
jge 0x468ffe
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x468fe2
push 0
push 0
push 0
push 0x91e
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x468ffc
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x468fa9
jmp 0x468f7d
mov dword [ebp - 0x148c], 0xfffffff7
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x46902e
push 0
push 0x1601
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x469048
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov byte [ebp - 0x12c], 0
mov dword [ebp - 0x1244], 0xfffffffb
mov dword [ebp - 0x1240], 0xfffffffb
mov dword [ebp - 0x123c], 0xfffffffb
mov dword [ebp - 0x1238], 0xfffffffb
lea ecx, [ebp - 0x531]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x1234]
push eax
lea eax, [ebp - 0x1244]
push eax
lea ecx, [ebp - 0x16f0]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1368]
call fcn.00416f6a
mov dword [ebp - 0x264], 6
mov dword [ebp - 0x264], 0
jmp 0x4690cf
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jg 0x46915f
mov dword [ebp - 0x244], 0xfffffffa
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x469106
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x244], 0
jmp 0x46911f
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jg 0x46915a
push dword [ebp - 0x264]
lea ecx, [ebp - 0x1368]
call fcn.00416f95
cmp dword [eax], 0
je 0x469140
jmp 0x46915a
push dword [ebp - 0x244]
lea ecx, [ebp - 0x1368]
call fcn.00416f95
cmp dword [eax], 0
je 0x469158
jmp 0x469112
jmp 0x469112
jmp 0x4690c2
lea ecx, [ebp - 0x1368]
call fcn.00416f90
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x469187
push 0x2230
push 0x12a3
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x467a35
mov dword [ebp - 0x150], 4
mov dword [ebp - 0x1084], 0x2466e9f0
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x4691ba
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x150], 0
jmp 0x4691d3
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xfffffffa
jle 0x46939a
push 3
lea ecx, [ebp - 0xeb8]
call fcn.00416ef7
mov dword [ebp - 0xaa8], 0x8cf4c59c
mov dword [ebp - 0x1094], 0x7f4ea14c
mov dword [ebp - 0x1134], 0xe13f5e3
mov dword [ebp - 0x3bc], 0
jmp 0x469224
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 3
jge 0x469246
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0xeb8]
call fcn.00416f95
mov dword [eax], 0x64dc
jmp 0x469217
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x469262
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 1
lea ecx, [ebp - 0xeb8]
call fcn.00416f95
cmp dword [eax], 0
jne 0x469284
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x469284
and dword [ebp - 0x760], 0
jmp 0x46928e
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1494], eax
push 1
lea ecx, [ebp - 0xeb8]
call fcn.00416f95
cmp dword [eax], 1
jl 0x4692b8
mov dword [ebp - 0xc48], 1
jmp 0x4692bf
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x1084]
cmp dword [ebp - 0xc48], eax
jne 0x4692d9
mov dword [ebp - 0x108c], 1
jmp 0x4692e0
and dword [ebp - 0x108c], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x149c], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
xor ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
jne 0x469323
push 1
lea ecx, [ebp - 0xeb8]
call fcn.00416f95
cmp dword [eax], 0
jne 0x469323
and dword [ebp - 0x768], 0
jmp 0x46932d
mov dword [ebp - 0x768], 1
push 1
lea ecx, [ebp - 0xeb8]
call fcn.00416f95
mov eax, dword [eax]
cmp eax, dword [ebp - 0x768]
je 0x469350
mov dword [ebp - 0xdb8], 1
jmp 0x469357
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x1094]
cmp dword [ebp - 0xdb8], eax
jle 0x469371
mov dword [ebp - 0x770], 1
jmp 0x469378
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
sub eax, dword [ebp - 0x150]
mov dword [ebp - 0x1134], eax
lea ecx, [ebp - 0xeb8]
call fcn.00416f90
jmp 0x4691c6
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x14a4], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x14ac], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x14b4], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x14bc], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x14c4], eax
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x10c]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x5a8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x5a8]
jne 0x46942b
mov dword [ebp - 0xab0], 1
jmp 0x469432
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xab0], eax
jne 0x46944c
mov dword [ebp - 0x778], 1
jmp 0x469453
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x7d38c461
jg 0x469477
mov dword [ebp - 0x113c], 1
jmp 0x46947e
and dword [ebp - 0x113c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x14cc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x1144]
dec eax
cmp eax, 6
jb 0x4694bc
mov dword [ebp - 0xc50], 1
jmp 0x4694c3
and dword [ebp - 0xc50], 0
imul eax, dword [ebp - 0xc50], 0xffff
cmp eax, dword [ebp - 0x10f0]
jl 0x4694e1
mov dword [ebp - 0x780], 1
jmp 0x4694e8
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x1038], eax
mov dword [ebp - 4], 0xb1891f78
mov dword [ebp - 0x7a8], 0x6ccb0362
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x1258], 1
mov dword [ebp - 0x1254], 1
mov dword [ebp - 0x1250], 1
mov dword [ebp - 0x124c], 1
lea ecx, [ebp - 0x539]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x1248]
push eax
lea eax, [ebp - 0x1258]
push eax
lea ecx, [ebp - 0x1740]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11d4]
call fcn.00416f6a
mov dword [ebp - 0x1dc], 0x1c443818
mov dword [ebp - 0x48c], 0xbf7a
mov dword [ebp - 0xcc], 0xe8236511
mov dword [ebp - 0x538], 0xa4045238
mov dword [ebp - 0x7c0], 1
cmp dword [ebp - 4], 0xfffffff7
jle 0x4695b0
mov dword [ebp - 0xee4], 1
jmp 0x4695b7
and dword [ebp - 0xee4], 0
cmp dword [ebp - 4], 0
je 0x469670
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14dc], eax
push 1
lea ecx, [ebp - 0x11d4]
call fcn.00416f95
mov dword [eax], 0xa2ff3e14
push 1
lea ecx, [ebp - 0x11d4]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x469613
cmp dword [ebp - 4], 0
je 0x469613
cmp dword [ebp - 4], 0
je 0x469613
mov dword [ebp - 0xab8], 1
jmp 0x46961a
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0xab8], 0x3428
jne 0x469632
mov dword [ebp - 0x788], 1
jmp 0x469639
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 0x44bb
jge 0x469651
mov dword [ebp - 0xd20], 1
jmp 0x469658
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0xd20]
sub eax, dword [ebp - 4]
je 0x469670
push 1
lea ecx, [ebp - 0x11d4]
call fcn.00416f95
mov eax, dword [ebp - 4]
neg eax
imul eax, dword [ebp - 4]
test eax, eax
je 0x469692
mov eax, 0x1c73b017
test eax, eax
je 0x469692
mov dword [ebp - 0x790], 1
jmp 0x469699
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x790], eax
jge 0x4696b0
mov dword [ebp - 0xac0], 1
jmp 0x4696b7
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xac0], eax
jg 0x4696ce
mov dword [ebp - 0x798], 1
jmp 0x4696d5
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 4]
imul eax, eax, 0xfffd
test eax, eax
je 0x4696fa
cmp dword [ebp - 4], 0
je 0x4696fa
mov dword [ebp - 0xc58], 1
jmp 0x469701
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x48c], eax
jg 0x469727
mov dword [ebp - 0x7a0], 1
jmp 0x46972e
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x7a0]
mov ecx, dword [ebp - 0xcc]
lea eax, [eax + ecx + 0x2502870b]
test eax, eax
je 0x469753
cmp dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x14e4], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x48c], eax
jg 0x469776
mov dword [ebp - 0xac8], 1
jmp 0x46977d
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0xac8]
test eax, eax
je 0x4697a3
cmp dword [ebp - 0x538], 0
je 0x4697a3
mov dword [ebp - 0xd88], 1
jmp 0x4697aa
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
sub eax, dword [ebp - 0xd88]
imul eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x538]
je 0x469853
mov dword [ebp - 0x1dc], 0xe
jmp 0x4697f0
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 8
jle 0x46984e
mov dword [ebp - 0xcc], 0
jmp 0x469812
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x469832
mov dword [ebp - 0xec8], 3
cmp dword [ebp - 0xec8], 0
je 0x469830
jmp 0x469832
jmp 0x469805
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x46984c
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4697e3
jmp 0x469945
mov dword [ebp - 0x500], 0xfffffffe
mov dword [ebp - 0x33c], 0
jmp 0x469876
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 2
jge 0x469892
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x14fc], 0xffffffff
jmp 0x469869
cmp dword [ebp - 0x500], 0x36352b72
jle 0x4698a5
cmp dword [ebp - 0x500], 0
cmp dword [ebp - 0x494], 0
jl 0x4698ba
mov dword [ebp - 0x7b0], 1
jmp 0x4698c1
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
sub eax, dword [ebp - 0x500]
cmp eax, 0x5f26
jne 0x4698e0
mov dword [ebp - 0xad0], 1
jmp 0x4698e7
and dword [ebp - 0xad0], 0
cmp dword [ebp - 0xad0], 0x70b7
jne 0x4698ff
mov dword [ebp - 0x7b8], 1
jmp 0x469906
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0x95d0
jne 0x46991e
mov dword [ebp - 0xc60], 1
jmp 0x469925
and dword [ebp - 0xc60], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc60]
mov dword [ebp + eax - 0x14fc], ecx
mov eax, dword [ebp - 0x7c0]
dec eax
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 4], 0
jmp 0x469955
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x469987
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x469985
push 0x196e
push 0
push 0
push 0
push 0
push 0xef
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x46994e
lea ecx, [ebp - 0x11d4]
call fcn.00416f90
push 1
lea ecx, [ebp - 0x510]
call fcn.00416ef7
mov dword [ebp - 0x49c], 0xfffffff6
mov dword [ebp - 0xee0], 0xffffffff
mov dword [ebp - 0x528], 0xea0d0a06
mov dword [ebp - 0xf4], 0
jmp 0x4699d6
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x4699f8
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov dword [eax], 0xb26bdde0
jmp 0x4699c9
mov dword [ebp - 0xf4], 0
jmp 0x469a11
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x469a2d
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x11ec], 0xffffffff
jmp 0x469a04
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov dword [eax], 6
jmp 0x469a66
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xad8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xad8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
cmp dword [eax], 0xffffffef
jne 0x46a071
mov dword [ebp - 0x70], 0xfb023ed1
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x808], 0
mov dword [ebp - 0xd30], 0x3e44e821
mov dword [ebp - 0x40c], 0
jmp 0x469aba
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jge 0x469ad6
mov eax, dword [ebp - 0x40c]
mov dword [ebp + eax*4 - 0x4c4], 0x18d5
jmp 0x469aad
mov dword [ebp - 0x70], 0
jmp 0x469ae6
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x469d75
mov dword [ebp - 0x1280], 0xfb26c4f3
mov dword [ebp - 0x127c], 0xfb26c4f3
mov dword [ebp - 0x1278], 0xfb26c4f3
mov dword [ebp - 0x1274], 0xfb26c4f3
lea ecx, [ebp - 0x469]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x1270]
push eax
lea eax, [ebp - 0x1280]
push eax
lea ecx, [ebp - 0x1700]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1380]
call fcn.00416f6a
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0x4c4], 0x7c04
je 0x469b7c
mov dword [ebp - 0xf44], 0xffff
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xf44]
mov dword [ebp + eax*4 - 0x4c4], ecx
jmp 0x469d65
mov dword [ebp - 0x344], 0xcc5d9b4e
mov dword [ebp - 0xf4c], 0xfffffff8
mov dword [ebp - 0x344], 0xfffffffa
jmp 0x469ba9
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 1
jg 0x469d65
mov dword [ebp - 0x27c], 0xffffffff
mov dword [ebp - 0xc68], 1
mov dword [ebp - 0x27c], 0
jmp 0x469be3
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x469d60
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0xed0], 0x8c658163
mov dword [ebp - 0x24c], 0
jmp 0x469c1d
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x1d
jle 0x469d5b
cmp dword [ebp - 0x70], 0
je 0x469c3c
mov dword [ebp - 0x7d0], 1
jmp 0x469c43
and dword [ebp - 0x7d0], 0
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
cmp dword [eax], 0
jne 0x469c6a
cmp dword [ebp - 0x27c], 0
je 0x469c6a
mov dword [ebp - 0x7c8], 1
jmp 0x469c71
and dword [ebp - 0x7c8], 0
push 3
lea ecx, [ebp - 0x1380]
call fcn.00416f95
mov ecx, dword [ebp - 0x7c8]
cmp ecx, dword [eax]
jg 0x469c94
mov dword [ebp - 0xd28], 1
jmp 0x469c9b
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0x24c]
imul eax, dword [ebp - 0xd28]
test eax, eax
jne 0x469cbe
mov eax, 0x35a12a2e
test eax, eax
jne 0x469cbe
and dword [ebp - 0xae0], 0
jmp 0x469cc8
mov dword [ebp - 0xae0], 1
mov eax, dword [ebp - 0x7d0]
cmp eax, dword [ebp - 0xae0]
je 0x469ce2
mov dword [ebp - 0x7d8], 1
jmp 0x469ce9
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0xc68], eax
mov esi, dword [ebp - 0xc68]
push 3
lea ecx, [ebp - 0x1380]
call fcn.00416f95
add esi, dword [eax]
jne 0x469d1e
cmp dword [ebp - 0xed0], 0
jne 0x469d1e
and dword [ebp - 0x7e0], 0
jmp 0x469d28
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0xf4c], eax
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x469d56
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x469c10
jmp 0x469bd6
jmp 0x469b9c
lea ecx, [ebp - 0x1380]
call fcn.00416f90
jmp 0x469adf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c4]
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x49c], 0
mov esi, dword [ebp - 0x49c]
push 4
pop eax
shl eax, 0
add esi, dword [ebp + eax - 0x4c4]
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
cmp esi, dword [eax]
jl 0x469dc2
mov dword [ebp - 0xae8], 1
jmp 0x469dc9
and dword [ebp - 0xae8], 0
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov ecx, dword [ebp - 0xae8]
cmp ecx, dword [eax]
je 0x469dec
mov dword [ebp - 0x7e8], 1
jmp 0x469df3
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0
jge 0x469e0e
cmp dword [ebp - 0x49c], 0
jne 0x469e0e
and dword [ebp - 0xed8], 0
jmp 0x469e18
mov dword [ebp - 0xed8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c4]
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1500], eax
xor eax, eax
cmp eax, 0xfffd
jne 0x469e49
mov dword [ebp - 0xe00], 1
jmp 0x469e50
and dword [ebp - 0xe00], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c4]
cmp dword [ebp - 0xe00], eax
je 0x469e71
mov dword [ebp - 0x7f0], 1
jmp 0x469e78
and dword [ebp - 0x7f0], 0
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7f0]
jg 0x469e9b
mov dword [ebp - 0xf54], 1
jmp 0x469ea2
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x150c], eax
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp - 0xee0], eax
cmp dword [ebp - 0x3c4], 1
jg 0x469ed5
mov dword [ebp - 0xf5c], 1
jmp 0x469edc
and dword [ebp - 0xf5c], 0
mov dword [ebp - 0x70], 0xfffffff6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c4]
cmp dword [ebp - 0x70], eax
je 0x469f01
mov dword [ebp - 0xaf0], 1
jmp 0x469f08
and dword [ebp - 0xaf0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x11ec]
imul eax, dword [ebp - 0xaf0]
cmp eax, dword [ebp - 0x808]
je 0x469f2f
mov dword [ebp - 0x7f8], 1
jmp 0x469f36
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x7f8], eax
je 0x469f50
mov dword [ebp - 0xee8], 1
jmp 0x469f57
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x1680], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x1510], eax
push 9
pop eax
sub eax, dword [ebp - 0x528]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x11ec]
je 0x469f92
mov dword [ebp - 0xc70], 1
jmp 0x469f99
and dword [ebp - 0xc70], 0
cmp dword [ebp - 0xc70], 0x2c1d3a0c
jg 0x469fb1
mov dword [ebp - 0x800], 1
jmp 0x469fb8
and dword [ebp - 0x800], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x11ec]
add eax, dword [ebp - 0x800]
cmp eax, dword [ebp - 0x3c4]
jne 0x469fde
mov dword [ebp - 0xaf8], 1
jmp 0x469fe5
and dword [ebp - 0xaf8], 0
push 0
lea ecx, [ebp - 0x510]
call fcn.00416f95
mov ecx, dword [ebp - 0xaf8]
cmp ecx, dword [eax]
jl 0x46a011
cmp dword [ebp - 0x528], 0
je 0x46a011
mov dword [ebp - 0xf64], 1
jmp 0x46a018
and dword [ebp - 0xf64], 0
mov eax, dword [ebp - 0x808]
cmp dword [ebp - 0xd30], eax
jge 0x46a032
mov dword [ebp - 0x810], 1
jmp 0x46a039
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0xd30]
cmp dword [ebp - 0x810], eax
jg 0x46a053
mov dword [ebp - 0xb00], 1
jmp 0x46a05a
and dword [ebp - 0xb00], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb00]
mov dword [ebp + eax - 0x11ec], ecx
jmp 0x469a42
lea ecx, [ebp - 0x510]
call fcn.00416f90
mov dword [ebp - 0x10], 0xb1891f78
push 1
lea ecx, [ebp - 0x290]
call fcn.00416ef7
mov dword [ebp - 0x1b0], 0x23b26d5d
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x98], 0x9342bb1e
mov dword [ebp - 0xd4], 0
jmp 0x46a0c4
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x46a0e6
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov dword [eax], 0xf6af1124
jmp 0x46a0b7
mov dword [ebp - 0xd4], 0
jmp 0x46a0ff
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x46a11b
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0xa8], 0xffffffff
jmp 0x46a0f2
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
and dword [eax], 0
jmp 0x46a151
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x818]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
cmp dword [eax], 0xfffffff6
jg 0x46a9be
mov dword [ebp - 0x54], 0x49c9fb37
mov dword [ebp - 0xe8], 0xffffffff
mov dword [ebp - 0x254], 8
push 1
lea ecx, [ebp - 0x58c]
call fcn.00416ef7
mov dword [ebp - 0xef8], 0x73dd6028
mov dword [ebp - 0x880], 0x8b872472
mov dword [ebp - 0x34c], 0
jmp 0x46a1bc
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 1
jge 0x46a1de
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x58c]
call fcn.00416f95
mov dword [eax], 0xd5e8
jmp 0x46a1af
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1518], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1528], eax
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
cmp dword [eax], 0xfffffffa
jl 0x46a217
mov dword [ebp - 0xc78], 1
jmp 0x46a21e
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xc78], eax
jg 0x46a235
mov dword [ebp - 0xef0], 1
jmp 0x46a23c
and dword [ebp - 0xef0], 0
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov ecx, dword [ebp - 0x54]
cmp dword [eax], ecx
je 0x46a269
mov dword [ebp - 0x820], 1
jmp 0x46a270
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 0x8376fbfc
je 0x46a288
mov dword [ebp - 0xb08], 1
jmp 0x46a28f
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xe8], eax
je 0x46a2b2
mov dword [ebp - 0x828], 1
jmp 0x46a2b9
and dword [ebp - 0x828], 0
imul eax, dword [ebp - 0x828], 0x279
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jne 0x46a2de
mov dword [ebp - 0xd90], 1
jmp 0x46a2e5
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0xd90], eax
jl 0x46a2ff
mov dword [ebp - 0x830], 1
jmp 0x46a306
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x30], eax
imul eax, dword [ebp - 0x30], 0xffffffff
test eax, eax
jne 0x46a323
mov dword [ebp - 0xb10], 1
jmp 0x46a32a
and dword [ebp - 0xb10], 0
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov ecx, dword [ebp - 0xb10]
cmp ecx, dword [eax]
jg 0x46a353
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
cmp dword [eax], 0
jne 0x46a365
cmp dword [ebp - 0x1b0], 0
jne 0x46a365
and dword [ebp - 0x838], 0
jmp 0x46a36f
mov dword [ebp - 0x838], 1
cmp dword [ebp - 0x838], 0x1aedf47
jl 0x46a38d
mov eax, 0x96121589
test eax, eax
jne 0x46a38d
and dword [ebp - 0xc80], 0
jmp 0x46a397
mov dword [ebp - 0xc80], 1
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x54], eax
jle 0x46a3ba
mov dword [ebp - 0x840], 1
jmp 0x46a3c1
and dword [ebp - 0x840], 0
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov ecx, dword [ebp - 0x840]
cmp ecx, dword [eax]
jl 0x46a3e4
mov dword [ebp - 0xb18], 1
jmp 0x46a3eb
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0xb18]
cmp eax, 0x2c6e
jl 0x46a453
mov dword [ebp - 0x404], 3
mov dword [ebp - 0xf6c], 0
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov eax, dword [ebp - 0x404]
imul eax, dword [ebp - 0x404]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xa8]
add eax, dword [ebp - 0x404]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x1b0], eax
jmp 0x46a584
mov dword [ebp - 0x26c], 0x3fca5eb5
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x1530], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1538], eax
cmp dword [ebp - 0x26c], 0
jne 0x46a48d
cmp dword [ebp - 0x254], 0
jne 0x46a48d
and dword [ebp - 0x848], 0
jmp 0x46a497
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x848]
jle 0x46a4ba
mov dword [ebp - 0xd38], 1
jmp 0x46a4c1
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0x26c]
add eax, dword [ebp - 0xd38]
cmp eax, 0xfffffff6
jne 0x46a4de
mov dword [ebp - 0x850], 1
jmp 0x46a4e5
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x850], eax
jge 0x46a4ff
mov dword [ebp - 0xb20], 1
jmp 0x46a506
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0xb20], eax
jne 0x46a529
cmp dword [ebp - 0x98], 0
je 0x46a529
mov dword [ebp - 0x858], 1
jmp 0x46a530
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0xa7b
jl 0x46a551
cmp dword [ebp - 0x98], 0
je 0x46a551
mov dword [ebp - 0xc88], 1
jmp 0x46a558
and dword [ebp - 0xc88], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc88]
mov dword [ebp + eax - 0xa8], ecx
cmp dword [ebp - 0xe8], 0
je 0x46a584
lea ecx, [ebp - 0x58c]
call fcn.00416f90
jmp 0x46a9be
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x254], eax
jle 0x46a59e
mov dword [ebp - 0x888], 1
jmp 0x46a5a5
and dword [ebp - 0x888], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00416f95
cmp dword [eax], 0
je 0x46a5fd
cmp dword [ebp - 0x30], 0xfffffff9
jl 0x46a5c9
mov dword [ebp - 0x4a4], 1
jmp 0x46a5d0
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp + eax - 0xa8], ecx
mov eax, dword [ebp - 0xef8]
sub eax, dword [ebp - 0x4a4]
je 0x46a5fd
mov dword [ebp - 0x860], 1
jmp 0x46a604
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x860], eax
jl 0x46a62e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa8], 0
je 0x46a62e
mov dword [ebp - 0xb28], 1
jmp 0x46a635
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x46a665
push 0
lea ecx, [ebp - 0x58c]
call fcn.00416f95
cmp dword [eax], 0
jne 0x46a665
and dword [ebp - 0x868], 0
jmp 0x46a66f
mov dword [ebp - 0x868], 1
push 0
lea ecx, [ebp - 0x58c]
call fcn.00416f95
mov ecx, dword [ebp - 0x868]
cmp ecx, dword [eax]
jg 0x46a692
mov dword [ebp - 0xdc0], 1
jmp 0x46a699
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
je 0x46a6cc
push 0
lea ecx, [ebp - 0x58c]
call fcn.00416f95
cmp dword [eax], 0
je 0x46a6cc
mov dword [ebp - 0x870], 1
jmp 0x46a6d3
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x46a6ee
mov dword [ebp - 0xb30], 1
jmp 0x46a6f5
and dword [ebp - 0xb30], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00416f95
mov ecx, dword [ebp - 0xb30]
cmp ecx, dword [eax]
jge 0x46a718
mov dword [ebp - 0x878], 1
jmp 0x46a71f
and dword [ebp - 0x878], 0
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
mov ecx, dword [ebp - 0x878]
cmp ecx, dword [eax]
jne 0x46a754
push 0
lea ecx, [ebp - 0x58c]
call fcn.00416f95
cmp dword [eax], 0
je 0x46a754
mov dword [ebp - 0xc90], 1
jmp 0x46a75b
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0x880], eax
mov esi, dword [ebp - 0x880]
add esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0x290]
call fcn.00416f95
cmp esi, dword [eax]
jg 0x46a78d
mov dword [ebp - 0xb38], 1
jmp 0x46a794
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x888], eax
jne 0x46a985
mov dword [ebp - 0xf74], 0x76403ec6
mov dword [ebp - 0xf0c], 0xdfe8548d
mov dword [ebp - 0x98], 0
jmp 0x46a7d9
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x46a983
mov dword [ebp - 0xf00], 0xfffffffe
mov dword [ebp - 0x8a0], 0x7904212e
mov dword [ebp - 0x30], 0
jmp 0x46a80a
cmp dword [ebp - 0x30], 0
jl 0x46a97e
mov dword [ebp - 0xc98], 0x34d3be1f
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xa8], 0xfffffffc
jne 0x46a837
mov dword [ebp - 0xd40], 1
jmp 0x46a83e
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
sub eax, 0x6712
je 0x46a852
jmp 0x46a7cc
jmp 0x46a9ae
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x46a9ae
push 0
push 0x1eb5
push 0x19c1
push 0x1340
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
lea ecx, [ebp - 0x58c]
call fcn.00416f90
jmp 0x46a12d
lea ecx, [ebp - 0x290]
call fcn.00416f90
mov dword [ebp - 0xbb8], 0x6ccb0362
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x12a8], 0x324ec2e0
mov dword [ebp - 0x12a4], 0x324ec2e0
mov dword [ebp - 0x12a0], 0x324ec2e0
mov dword [ebp - 0x129c], 0x324ec2e0
lea ecx, [ebp - 0x461]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x12a8]
push eax
lea ecx, [ebp - 0x1730]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x198]
call fcn.00416f6a
mov dword [ebp - 0x40], 0
push 1
lea ecx, [ebp - 0xdcc]
call fcn.00416ef7
mov dword [ebp - 0xf18], 0xfffffff9
mov dword [ebp - 0x1130], 0xffffffff
mov dword [ebp - 0x354], 0
jmp 0x46aa7b
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 1
jge 0x46aa9d
push dword [ebp - 0x354]
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
mov dword [eax], 0x9a56718e
jmp 0x46aa6e
push 0
lea ecx, [ebp - 0x198]
call fcn.00416f95
and dword [eax], 0
jmp 0x46aad3
push 0
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x8a8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp dword [eax], 0xffffffe6
je 0x46ab0b
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x46ab09
push 0x1a9e
push 0x216a
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
jmp 0x46aaaf
mov dword [ebp - 0x40], 0
jmp 0x46ab1b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x46afba
mov dword [ebp - 0xca0], 0xb3a00d0e
mov dword [ebp - 0xf8c], 0xd847
mov dword [ebp - 0x8d0], 0xffffffff
mov dword [ebp - 0x1040], 0
push 3
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp dword [eax], 0
jne 0x46ab6d
or eax, 0xffffffff
jne 0x46ab6d
and dword [ebp - 0x4d0], 0
jmp 0x46ab77
mov dword [ebp - 0x4d0], 1
push 0
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
mov ecx, dword [ebp - 0x4d0]
mov dword [eax], ecx
mov esi, dword [ebp - 0xca0]
push 1
lea ecx, [ebp - 0x198]
call fcn.00416f95
imul esi, dword [eax]
cmp esi, dword [ebp - 0x4d0]
jge 0x46abb6
mov dword [ebp - 0xd98], 1
jmp 0x46abbd
and dword [ebp - 0xd98], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0xd98]
cmp ecx, dword [eax]
jg 0x46abe1
mov dword [ebp - 0x8b0], 1
jmp 0x46abe8
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0x6aac8953
jne 0x46ac00
mov dword [ebp - 0xb50], 1
jmp 0x46ac07
and dword [ebp - 0xb50], 0
push 1
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov eax, dword [eax]
imul eax, dword [ebp - 0xb50]
cmp eax, 0xc7153413
jbe 0x46ac30
mov dword [ebp - 0x8b8], 1
jmp 0x46ac37
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 6
jne 0x46ac4c
mov dword [ebp - 0xf84], 1
jmp 0x46ac53
and dword [ebp - 0xf84], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x1558], eax
cmp dword [ebp - 0xf8c], 0x61ac
jge 0x46ac77
mov dword [ebp - 0x8c0], 1
jmp 0x46ac7e
and dword [ebp - 0x8c0], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0x8c0]
cmp ecx, dword [eax]
je 0x46acb4
push 0
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp dword [eax], 0
je 0x46acb4
mov dword [ebp - 0xb58], 1
jmp 0x46acbb
and dword [ebp - 0xb58], 0
cmp dword [ebp - 0xb58], 0x8cc19583
jae 0x46acd3
mov dword [ebp - 0x8c8], 1
jmp 0x46acda
and dword [ebp - 0x8c8], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0x8c8]
cmp ecx, dword [eax]
je 0x46acfe
mov dword [ebp - 0xd48], 1
jmp 0x46ad05
and dword [ebp - 0xd48], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0xd48]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp dword [eax], 0
jne 0x46ad39
mov dword [ebp - 0x8f0], 1
jmp 0x46ad40
and dword [ebp - 0x8f0], 0
xor eax, eax
jne 0x46ad53
cmp dword [ebp - 0x40], 0
jne 0x46ad53
and dword [ebp - 0xb60], 0
jmp 0x46ad5d
mov dword [ebp - 0xb60], 1
push 2
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp - 0x8d0], eax
mov esi, dword [ebp - 0x8d0]
sub esi, dword [ebp - 0xb60]
push 0
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
add esi, dword [eax]
cmp esi, 1
jae 0x46ad9e
mov dword [ebp - 0x8d8], 1
jmp 0x46ada5
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0xf18]
cmp dword [ebp - 0x8d8], eax
jne 0x46adce
push 0
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
cmp dword [eax], 0
jne 0x46adce
and dword [ebp - 0xca8], 0
jmp 0x46add8
mov dword [ebp - 0xca8], 1
push 0
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
mov ecx, dword [ebp - 0xca8]
sub ecx, dword [eax]
cmp ecx, 1
je 0x46adfe
mov dword [ebp - 0x8e0], 1
jmp 0x46ae05
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 5
jge 0x46ae1a
mov dword [ebp - 0xb68], 1
jmp 0x46ae21
and dword [ebp - 0xb68], 0
mov esi, dword [ebp - 0xb68]
inc esi
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp esi, dword [eax]
je 0x46ae46
mov dword [ebp - 0x8e8], 1
jmp 0x46ae4d
and dword [ebp - 0x8e8], 0
push 0
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
mov ecx, dword [ebp - 0x8e8]
cmp ecx, dword [eax]
jle 0x46ae83
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp dword [eax], 0
je 0x46ae83
mov dword [ebp - 0xdf0], 1
jmp 0x46ae8a
and dword [ebp - 0xdf0], 0
cmp dword [ebp - 0xdf0], 5
jb 0x46ae9f
mov dword [ebp - 0xb70], 1
jmp 0x46aea6
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x8f0]
cmp eax, dword [ebp - 0xb70]
jne 0x46aec0
mov dword [ebp - 0x8f8], 1
jmp 0x46aec7
and dword [ebp - 0x8f8], 0
push 0
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0x8f8]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x1130]
jl 0x46aef5
xor eax, eax
inc eax
je 0x46aef5
mov dword [ebp - 0xcb0], 1
jmp 0x46aefc
and dword [ebp - 0xcb0], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0xcb0]
cmp ecx, dword [eax]
jge 0x46af20
mov dword [ebp - 0xf20], 1
jmp 0x46af27
and dword [ebp - 0xf20], 0
push 0
lea ecx, [ebp - 0xdcc]
call fcn.00416f95
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x46af5c
mov eax, 0x575e7e8e
test eax, eax
jne 0x46af5c
and dword [ebp - 0x4ac], 0
jmp 0x46af66
mov dword [ebp - 0x4ac], 1
push 0
lea ecx, [ebp - 0x198]
call fcn.00416f95
mov ecx, dword [ebp - 0x4ac]
mov dword [eax], ecx
cmp dword [ebp - 0x4ac], 0
je 0x46afa2
push 3
lea ecx, [ebp - 0x198]
call fcn.00416f95
cmp dword [eax], 0
je 0x46afa2
mov dword [ebp - 0x900], 1
jmp 0x46afa9
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x1040], eax
jmp 0x46ab14
lea ecx, [ebp - 0xdcc]
call fcn.00416f90
lea ecx, [ebp - 0x198]
call fcn.00416f90
mov dword [ebp - 0x12d0], 1
mov dword [ebp - 0x12cc], 1
mov dword [ebp - 0x12c8], 1
mov dword [ebp - 0x12c4], 1
lea ecx, [ebp - 0x4b5]
call fcn.00416fa4
push eax
lea eax, [ebp - 0x12c0]
push eax
lea eax, [ebp - 0x12d0]
push eax
lea ecx, [ebp - 0x16e0]
call fcn.00416fa7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1198]
call fcn.00416f6a
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x3cc], 0
jmp 0x46b050
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 3
jge 0x46b06c
mov eax, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x1788], 0xffffffff
jmp 0x46b043
mov dword [ebp - 0x35c], 0
jmp 0x46b085
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jg 0x46b0f0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x410], 2
jmp 0x46b0b1
mov eax, dword [ebp - 0x410]
dec eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jl 0x46b0ee
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x46b0ec
push 0
push 0x1ee2
push 0x1488
push 0
push 0x23cb
push 0x1b9b
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x46b0a4
jmp 0x46b078
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x46b112
push 0xa73
push 0x219a
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov dword [ebp - 0x1b8], 0x1c443818
push 2
lea ecx, [ebp - 0xe28]
call fcn.00416ef7
mov dword [ebp - 0x364], 0x13638ecf
mov dword [ebp - 0xdc], 0
jmp 0x46b14c
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x46b16e
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xe28]
call fcn.00416f95
mov dword [eax], 0x342eb90d
jmp 0x46b13f
mov dword [ebp - 0xdc], 0
jmp 0x46b187
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x46b1a3
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x10f8], 0x68f62c4d
jmp 0x46b17a
mov dword [ebp - 0x364], 0
jmp 0x46b1bc
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 1
jg 0x46b45f
mov dword [ebp - 0x3d4], 0
jmp 0x46b1e2
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 3
jge 0x46b1fe
mov eax, dword [ebp - 0x3d4]
mov dword [ebp + eax*4 - 0xddc], 4
jmp 0x46b1d5
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x46b216
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xddc], 0
jmp 0x46b244
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xddc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xddc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xddc], 1
jg 0x46b45a
mov dword [ebp - 0x1d8], 0xfffffffd
mov dword [ebp - 0xf28], 0xec7516a2
mov dword [ebp - 0x1d8], 0
jmp 0x46b285
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jg 0x46b455
mov dword [ebp - 0xb78], 0xa4129b85
mov dword [ebp - 0x920], 6
mov dword [ebp - 0xf28], 0x576c5165
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xddc]
lea ecx, [ebp - 0xe28]
call fcn.00416f95
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xddc], 0
jne 0x46b3bf
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xddc]
lea ecx, [ebp - 0xe28]
call fcn.00416f95
cmp dword [eax], 1
jg 0x46b305
mov dword [ebp - 0x4cc], 1
jmp 0x46b30c
and dword [ebp - 0x4cc], 0
mov dword [ebp - 0xb78], 0x8d9b
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp + eax - 0x10f8], ecx
mov eax, dword [ebp - 0xb78]
cmp eax, dword [ebp - 0x4cc]
jl 0x46b343
mov dword [ebp - 0x908], 1
jmp 0x46b34a
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0xffffffff
jl 0x46b35f
mov dword [ebp - 0xd50], 1
jmp 0x46b366
and dword [ebp - 0xd50], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xddc]
lea ecx, [ebp - 0xe28]
call fcn.00416f95
mov ecx, dword [ebp - 0xd50]
cmp ecx, dword [eax]
je 0x46b394
mov dword [ebp - 0x910], 1
jmp 0x46b39b
and dword [ebp - 0x910], 0
push 1
lea ecx, [ebp - 0xe28]
call fcn.00416f95
mov ecx, dword [ebp - 0x910]
imul ecx, dword [eax]
cmp ecx, 0xfffffff6
jb 0x46b3bf
and dword [ebp - 0xb80], 0
jmp 0x46b3c9
mov dword [ebp - 0xb80], 1
cmp dword [ebp - 0xb80], 1
jg 0x46b3de
mov dword [ebp - 0x918], 1
jmp 0x46b3e5
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 0x8af95342
jbe 0x46b3fd
mov dword [ebp - 0xcb8], 1
jmp 0x46b404
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
neg eax
cmp eax, dword [ebp - 0x1d8]
jge 0x46b42c
mov dword [ebp - 0xb88], 1
jmp 0x46b433
and dword [ebp - 0xb88], 0
imul esi, dword [ebp - 0xb88], 0xbbd0
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xe28]
call fcn.00416f95
mov dword [eax], esi
jmp 0x46b278
jmp 0x46b229
jmp 0x46b1af
lea ecx, [ebp - 0xe28]
call fcn.00416f90
mov dword [ebp - 0x4dc], 0xbf7a
mov dword [ebp - 0x158], 0xfffffffa
mov dword [ebp - 0xda0], 0x15898f01
mov dword [ebp - 0x8c], 0x8884515f
mov dword [ebp - 0x1048], 0xffffffff
mov dword [ebp - 0x36c], 0
jmp 0x46b4b5
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 4
jge 0x46b4d1
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0x17c8], 0x889e022a
jmp 0x46b4a8
cmp dword [ebp - 0x158], 0
je 0x46b53d
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x46b510
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x46b510
mov dword [ebp - 0x928], 1
jmp 0x46b517
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xda0], eax
jle 0x46b53d
mov dword [ebp - 0x930], 1
jmp 0x46b544
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 3
jle 0x46b559
mov dword [ebp - 0xf30], 1
jmp 0x46b560
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1568], eax
imul eax, dword [ebp - 0x8c], 0x3411
cmp eax, dword [ebp - 0x8c]
jg 0x46b596
mov dword [ebp - 0xb90], 1
jmp 0x46b59d
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0xb90]
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x8c], 0
jmp 0x46b5c9
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x46b608
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x46b5ec
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x46b606
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
jmp 0x46b5bc
mov dword [ebp - 0xf0], 0xe8236511
mov dword [ebp - 0x4bc], 0xa4045238
mov dword [ebp - 0x224], 0xad313dd3
mov dword [ebp - 0xb98], 0x90f1
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x1570], 0x4b2ab76d
mov dword [ebp - 0xf38], 0x24ce5545
push 4
lea ecx, [ebp - 0x1204]
call fcn.00416ef7
mov dword [ebp - 0xf40], 5
mov dword [ebp - 0x29c], 0
jmp 0x46b67e
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 4
jge 0x46b6a0
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x1204]
call fcn.00416f95
mov dword [eax], 0x58528353
jmp 0x46b671
mov dword [ebp - 0x224], 0x14
jmp 0x46b6b9
cmp dword [ebp - 0x224], 0x1a
jge 0x46b91d
mov dword [ebp - 0xcc0], 0xffffffff
mov dword [ebp - 0x950], 0x735e4b78
mov dword [ebp - 0x1578], 2
mov dword [ebp - 0x1580], 1
mov dword [ebp - 0x1588], 4
push 3
lea ecx, [ebp - 0xe94]
call fcn.00416ef7
mov dword [ebp - 0x1590], 0xfffffff8
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x2a0], 0
jmp 0x46b732
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jge 0x46b754
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xe94]
call fcn.00416f95
mov dword [eax], 0xfffffffe
jmp 0x46b725
cmp dword [ebp - 0xb98], 0
jne 0x46b77d
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0x4b4]
inc ecx
mov dword [ebp - 0x4b4], ecx
test eax, eax
jne 0x46b77d
and dword [ebp - 0xba0], 0
jmp 0x46b787
mov dword [ebp - 0xba0], 1
mov eax, 0xffff
cmp eax, 0xffff
jb 0x46b79f
mov dword [ebp - 0x938], 1
jmp 0x46b7a6
and dword [ebp - 0x938], 0
push 1
lea ecx, [ebp - 0xe94]
call fcn.00416f95
mov eax, dword [eax]
sub eax, dword [ebp - 0x938]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xf38]
cmp dword [ebp - 0xcc0], eax
jge 0x46b7db
mov dword [ebp - 0x940], 1
jmp 0x46b7e2
and dword [ebp - 0x940], 0
cmp dword [ebp - 0x940], 1
je 0x46b7f7
mov dword [ebp - 0x1120], 1
jmp 0x46b7fe
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x1598], eax
mov esi, dword [ebp - 0xf40]
push 2
lea ecx, [ebp - 0x1204]
call fcn.00416f95
imul esi, dword [eax]
test esi, esi
jne 0x46b836
cmp dword [ebp - 0x1050], 0
jne 0x46b836
and dword [ebp - 0x948], 0
jmp 0x46b840
mov dword [ebp - 0x948], 1
cmp dword [ebp - 0x948], 2
jle 0x46b855
mov dword [ebp - 0xd58], 1
jmp 0x46b85c
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x15f8], eax
push 1
lea ecx, [ebp - 0xe94]
call fcn.00416f95
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1600], eax
push 1
lea ecx, [ebp - 0xe94]
call fcn.00416f95
push 0
lea ecx, [ebp - 0x1204]
call fcn.00416f95
cmp dword [eax], 0
jg 0x46b8b8
mov dword [ebp - 0x958], 1
jmp 0x46b8bf
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xba0]
cmp eax, dword [ebp - 0x958]
jge 0x46b8d9
mov dword [ebp - 0xcc8], 1
jmp 0x46b8e0
and dword [ebp - 0xcc8], 0
push 1
lea ecx, [ebp - 0xe94]
call fcn.00416f95
mov ecx, dword [ebp - 0xcc8]
mov dword [eax], ecx
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x46b90d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0xe94]
call fcn.00416f90
jmp 0x46b6ac
lea ecx, [ebp - 0x1204]
call fcn.00416f90
mov dword [ebp - 0x6fc], 1
cmp dword [ebp - 0x10], 0xfffffff7
jle 0x46b944
mov dword [ebp - 0xf48], 1
jmp 0x46b94b
and dword [ebp - 0xf48], 0
cmp dword [ebp - 0x10], 0
je 0x46ba04
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1608], eax
push 1
lea ecx, [ebp - 0x1198]
call fcn.00416f95
mov dword [eax], 0xa2ff3e14
push 1
lea ecx, [ebp - 0x1198]
call fcn.00416f95
mov eax, dword [eax]
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
je 0x46b9a7
cmp dword [ebp - 0x10], 0
je 0x46b9a7
cmp dword [ebp - 0x10], 0
je 0x46b9a7
mov dword [ebp - 0x960], 1
jmp 0x46b9ae
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0x3428
jne 0x46b9c6
mov dword [ebp - 0xba8], 1
jmp 0x46b9cd
and dword [ebp - 0xba8], 0
cmp dword [ebp - 0xba8], 0x44bb
jge 0x46b9e5
mov dword [ebp - 0x968], 1
jmp 0x46b9ec
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
sub eax, dword [ebp - 0x10]
je 0x46ba04
push 1
lea ecx, [ebp - 0x1198]
call fcn.00416f95
mov eax, dword [ebp - 0x10]
neg eax
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x46ba26
mov eax, 0x1c73b017
test eax, eax
je 0x46ba26
mov dword [ebp - 0xdd0], 1
jmp 0x46ba2d
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xdd0], eax
jge 0x46ba44
mov dword [ebp - 0x970], 1
jmp 0x46ba4b
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x970], eax
jg 0x46ba62
mov dword [ebp - 0xbb0], 1
jmp 0x46ba69
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xbb0]
sub eax, dword [ebp - 0x10]
imul eax, eax, 0xfffd
test eax, eax
je 0x46ba8e
cmp dword [ebp - 0x10], 0
je 0x46ba8e
mov dword [ebp - 0x978], 1
jmp 0x46ba95
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x4dc], eax
jg 0x46babb
mov dword [ebp - 0xcd0], 1
jmp 0x46bac2
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp - 0xcd0]
mov ecx, dword [ebp - 0xf0]
lea eax, [eax + ecx + 0x2502870b]
test eax, eax
je 0x46bae7
cmp dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x1610], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4dc], eax
jg 0x46bb0a
mov dword [ebp - 0x980], 1
jmp 0x46bb11
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp - 0x980]
test eax, eax
je 0x46bb37
cmp dword [ebp - 0x4bc], 0
je 0x46bb37
mov dword [ebp - 0x988], 1
jmp 0x46bb3e
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
sub eax, dword [ebp - 0x988]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x4bc]
je 0x46cb2d
mov dword [ebp - 0x1b8], 0xe
jmp 0x46bb88
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x2f0], 0x1c
jmp 0x46cb50