Function at 0x46b6c5
Capabilities:
Accept command line arguments
Authenticate hmac
Check os version
Encrypt data using speck
Get disk information
Get disk size
Get file size
Get keyboard layout
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af01d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x28d0
call fcn.0049e750
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x124], 0xa8eac8b
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0x1a8], 0x451f1e28
mov dword [ebp - 0x124], 0x1d
jmp 0x46b725
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffffc
jle 0x46b752
mov byte [ebp - 0x1eb], 0
movzx eax, byte [ebp - 0x1eb]
test eax, eax
je 0x46b750
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x46b718
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2354], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2228], eax
mov dword [ebp - 0x124], 0x76e5b14f
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x124], eax
jge 0x46b78e
mov dword [ebp - 0x1630], 1
jmp 0x46b795
and dword [ebp - 0x1630], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x1630]
cmp eax, dword [ebp - 0xa4]
jle 0x46b7b6
mov dword [ebp - 0x178c], 1
jmp 0x46b7bd
and dword [ebp - 0x178c], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x24a0], eax
cmp dword [ebp - 0xa4], 0
je 0x46b7e7
cmp dword [ebp - 0xa4], 0
je 0x46b7e7
mov dword [ebp - 0x15e4], 1
jmp 0x46b7ee
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x15e4], eax
jl 0x46b808
mov dword [ebp - 0x15ec], 1
jmp 0x46b80f
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x15ec]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
sub eax, 0x57736d0c
je 0x46b83b
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x46b83b
mov dword [ebp - 0x15f4], 1
jmp 0x46b842
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x15f4], eax
jl 0x46b85c
mov dword [ebp - 0x15fc], 1
jmp 0x46b863
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x15fc]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
je 0x46b8db
mov byte [ebp - 0x16c], 0
movzx eax, byte [ebp - 0x16c]
test eax, eax
je 0x46b8aa
push 0
push 0x262
push 0x337
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov dword [ebp - 0x1a8], 5
jmp 0x46b8c3
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xb
jl 0x46b8d9
cmp dword [ebp - 0xa4], 0
je 0x46b8d7
jmp 0x46b8d9
jmp 0x46b8b6
jmp 0x46b929
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x46b90d
push 0
push 0x10f9
push 0x2134
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x46b929
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0x114], 0xa8eac8b
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x1b0], 0x451f1e28
mov dword [ebp - 0x114], 0x1d
jmp 0x46b960
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffffc
jle 0x46b98d
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x46b98b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x46b953
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2230], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x23a8], eax
mov dword [ebp - 0x114], 0x76e5b14f
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x114], eax
jge 0x46b9c9
mov dword [ebp - 0x1604], 1
jmp 0x46b9d0
and dword [ebp - 0x1604], 0
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x1604]
cmp eax, dword [ebp - 0xac]
jle 0x46b9f1
mov dword [ebp - 0x1938], 1
jmp 0x46b9f8
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2238], eax
cmp dword [ebp - 0xac], 0
je 0x46ba22
cmp dword [ebp - 0xac], 0
je 0x46ba22
mov dword [ebp - 0x160c], 1
jmp 0x46ba29
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x160c], eax
jl 0x46ba43
mov dword [ebp - 0x1614], 1
jmp 0x46ba4a
and dword [ebp - 0x1614], 0
mov eax, dword [ebp - 0x1614]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
sub eax, 0x57736d0c
je 0x46ba76
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x46ba76
mov dword [ebp - 0x161c], 1
jmp 0x46ba7d
and dword [ebp - 0x161c], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x161c], eax
jl 0x46ba97
mov dword [ebp - 0x1624], 1
jmp 0x46ba9e
and dword [ebp - 0x1624], 0
mov eax, dword [ebp - 0x1624]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
je 0x46bb16
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x46bae5
push 0
push 0x262
push 0x337
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov dword [ebp - 0x1b0], 5
jmp 0x46bafe
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xb
jl 0x46bb14
cmp dword [ebp - 0xac], 0
je 0x46bb12
jmp 0x46bb14
jmp 0x46baf1
jmp 0x46bb64
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x46bb48
push 0
push 0x10f9
push 0x2134
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
mov byte [ebp - 0x19b], 0
movzx eax, byte [ebp - 0x19b]
test eax, eax
je 0x46bb64
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0xc44], 0x4193
mov dword [ebp - 0x7e4], 0x462d5e48
mov dword [ebp - 0x7e4], 0x11
jmp 0x46bb91
mov eax, dword [ebp - 0x7e4]
dec eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 4
je 0x46bbbc
mov dword [ebp - 0x1940], 0x558bac04
mov dword [ebp - 0x1948], 0x5b4
mov eax, dword [ebp - 0x1940]
mov dword [ebp - 0x1948], eax
jmp 0x46bb84
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x46bbd6
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0xa9c], 0x1437
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x167c], 0x3423637b
mov dword [ebp - 0x1958], 0xfffffffc
mov dword [ebp - 0x2538], 0xc5f93be4
mov dword [ebp - 0x7ec], 0
jmp 0x46bc21
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 1
jge 0x46bc3d
mov eax, dword [ebp - 0x7ec]
mov dword [ebp + eax*4 - 0x1950], 0xffffffff
jmp 0x46bc14
mov dword [ebp - 0x1b8], 0
jmp 0x46bc56
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xfffffff2
jge 0x46c02c
mov dword [ebp - 0x1788], 0x3c69aed2
mov dword [ebp - 0x1784], 0x3c69aed2
mov dword [ebp - 0x1780], 0x3c69aed2
mov dword [ebp - 0x177c], 0x3c69aed2
mov dword [ebp - 0x214], 1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1788], 0
jmp 0x46bcc0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1788]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1788], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1788], 0
jl 0x46bd69
mov dword [ebp - 0x780], 0x1a9565e0
mov dword [ebp - 0x780], 0
jmp 0x46bcf6
mov eax, dword [ebp - 0x780]
dec eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 0
jl 0x46bd3c
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x46bd20
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x46bd3a
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x46bce9
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x46bd64
push 0
push 0
push 0x18e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46bca7
mov dword [ebp - 0x214], 0
jmp 0x46bd82
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffed
jle 0x46c027
push 2
lea ecx, [ebp - 0x1e20]
call fcn.004291a2
mov dword [ebp - 0xfc], 0
jmp 0x46bdb5
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x46bdd1
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x97c], 0xfffc
jmp 0x46bda8
mov dword [ebp - 0xfc], 0
jmp 0x46bdea
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x46be0c
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x1e20]
call fcn.00429290
mov dword [eax], 4
jmp 0x46bddd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x97c], 0xb09b
je 0x46be2b
mov dword [ebp - 0x162c], 1
jmp 0x46be32
and dword [ebp - 0x162c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x97c]
cmp dword [ebp + eax - 0x97c], ecx
jle 0x46be5a
mov dword [ebp - 0x164c], 1
jmp 0x46be61
and dword [ebp - 0x164c], 0
mov eax, dword [ebp - 0x162c]
cmp eax, dword [ebp - 0x164c]
jle 0x46be7b
mov dword [ebp - 0x1654], 1
jmp 0x46be82
and dword [ebp - 0x1654], 0
cmp dword [ebp - 0x1654], 1
ja 0x46be97
mov dword [ebp - 0x165c], 1
jmp 0x46be9e
and dword [ebp - 0x165c], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x165c], eax
jg 0x46beb8
mov dword [ebp - 0x1664], 1
jmp 0x46bebf
and dword [ebp - 0x1664], 0
mov eax, dword [ebp - 0x1664]
sub eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x214], eax
jge 0x46bee5
mov dword [ebp - 0x166c], 1
jmp 0x46beec
and dword [ebp - 0x166c], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x166c], eax
jl 0x46bf06
mov dword [ebp - 0x1674], 1
jmp 0x46bf0d
and dword [ebp - 0x1674], 0
mov eax, dword [ebp - 0x1674]
mov dword [ebp - 0x167c], eax
mov eax, dword [ebp - 0x167c]
mov dword [ebp - 0x2240], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x97c]
push 1
lea ecx, [ebp - 0x1e20]
call fcn.00429290
cmp esi, dword [eax]
jl 0x46bf61
push 1
lea ecx, [ebp - 0x1e20]
call fcn.00429290
cmp dword [eax], 0
je 0x46bf61
mov dword [ebp - 0x1684], 1
jmp 0x46bf68
and dword [ebp - 0x1684], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x97c]
imul eax, dword [ebp - 0x1684]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x97c]
jg 0x46bf97
mov dword [ebp - 0x168c], 1
jmp 0x46bf9e
and dword [ebp - 0x168c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x97c]
sub eax, dword [ebp - 0x168c]
mov dword [ebp - 0x1694], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1694]
mov dword [ebp + eax - 0x1788], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1950]
cmp dword [ebp - 0x1694], eax
je 0x46bfea
mov dword [ebp - 0x9f4], 1
jmp 0x46bff1
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x1958], eax
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x46c017
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea ecx, [ebp - 0x1e20]
call fcn.00429274
jmp 0x46bd75
jmp 0x46bc49
mov dword [ebp - 0x3a4], 0x462d5e48
mov dword [ebp - 0x3a4], 0x11
jmp 0x46c04f
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 4
je 0x46c07a
mov dword [ebp - 0x1960], 0x558bac04
mov dword [ebp - 0x1968], 0x5b4
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x1968], eax
jmp 0x46c042
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x46c094
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x2cc], 0x6c3f
mov dword [ebp - 0xa04], 0xfffffffa
push 2
lea ecx, [ebp - 0x1cb4]
call fcn.004291a2
mov dword [ebp - 0x23b8], 0x9fe9a5a1
mov dword [ebp - 0xc4], 0
jmp 0x46c0d8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x46c0fa
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1cb4]
call fcn.00429290
mov dword [eax], 0xa0cd
jmp 0x46c0cb
mov dword [ebp - 0xc4], 0
jmp 0x46c113
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x46c12f
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x25cc], 0
jmp 0x46c106
cmp dword [ebp - 0x2cc], 1
jle 0x46c144
mov dword [ebp - 0x14f4], 1
jmp 0x46c14b
and dword [ebp - 0x14f4], 0
cmp dword [ebp - 0x14f4], 0x3df2ef51
jle 0x46c167
xor eax, eax
jne 0x46c167
mov dword [ebp - 0x9fc], 1
jmp 0x46c16e
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
sub eax, 5
imul eax, eax, 0x20b5
test eax, eax
je 0x46c194
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x46c194
mov dword [ebp - 0x1970], 1
jmp 0x46c19b
and dword [ebp - 0x1970], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2248], eax
mov eax, dword [ebp - 0x2cc]
add eax, dword [ebp - 0x2cc]
cmp eax, 0xffff
jbe 0x46c1c6
mov dword [ebp - 0x14fc], 1
jmp 0x46c1cd
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x14fc]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0xa04]
mov ecx, dword [ebp - 0x2cc]
lea esi, [eax + ecx + 0x4ce3]
push 1
lea ecx, [ebp - 0x1cb4]
call fcn.00429290
cmp esi, dword [eax]
jge 0x46c209
mov dword [ebp - 0x1504], 1
jmp 0x46c210
and dword [ebp - 0x1504], 0
push 1
lea ecx, [ebp - 0x1cb4]
call fcn.00429290
mov ecx, dword [ebp - 0x1504]
cmp ecx, dword [eax]
jl 0x46c245
push 1
lea ecx, [ebp - 0x1cb4]
call fcn.00429290
cmp dword [eax], 0
je 0x46c245
mov dword [ebp - 0xa0c], 1
jmp 0x46c24c
and dword [ebp - 0xa0c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa0c]
mov dword [ebp + eax - 0x25cc], ecx
lea ecx, [ebp - 0x1cb4]
call fcn.00429274
mov dword [ebp - 0x1c3c], str.eftdtowv_hmfspdx_fzkt_tnpztk_mdyw_gsewbnqcf_hpa
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0xa2c], 0x3423637b
mov dword [ebp - 0x1980], 0xfffffffc
mov dword [ebp - 0x24a8], 0xc5f93be4
mov dword [ebp - 0x554], 0
jmp 0x46c2b5
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jge 0x46c2d1
mov eax, dword [ebp - 0x554]
mov dword [ebp + eax*4 - 0x1978], 0xffffffff
jmp 0x46c2a8
mov dword [ebp - 0x13c], 0
jmp 0x46c2ea
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xfffffff2
jge 0x46c6c0
mov dword [ebp - 0x1778], 0x3c69aed2
mov dword [ebp - 0x1774], 0x3c69aed2
mov dword [ebp - 0x1770], 0x3c69aed2
mov dword [ebp - 0x176c], 0x3c69aed2
mov dword [ebp - 0x290], 1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1778], 0
jmp 0x46c354
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1778]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1778], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1778], 0
jl 0x46c3fd
mov dword [ebp - 0x3ac], 0x1a9565e0
mov dword [ebp - 0x3ac], 0
jmp 0x46c38a
mov eax, dword [ebp - 0x3ac]
dec eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jl 0x46c3d0
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x46c3b4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov byte [ebp - 0x19f], 0
movzx eax, byte [ebp - 0x19f]
test eax, eax
je 0x46c3ce
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x46c37d
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x46c3f8
push 0
push 0
push 0x18e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46c33b
mov dword [ebp - 0x290], 0
jmp 0x46c416
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xffffffed
jle 0x46c6bb
push 2
lea ecx, [ebp - 0x1e80]
call fcn.004291a2
mov dword [ebp - 0xe4], 0
jmp 0x46c449
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x46c465
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x988], 0xfffc
jmp 0x46c43c
mov dword [ebp - 0xe4], 0
jmp 0x46c47e
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x46c4a0
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1e80]
call fcn.00429290
mov dword [eax], 4
jmp 0x46c471
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x988], 0xb09b
je 0x46c4bf
mov dword [ebp - 0x150c], 1
jmp 0x46c4c6
and dword [ebp - 0x150c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x988]
cmp dword [ebp + eax - 0x988], ecx
jle 0x46c4ee
mov dword [ebp - 0xa14], 1
jmp 0x46c4f5
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x150c]
cmp eax, dword [ebp - 0xa14]
jle 0x46c50f
mov dword [ebp - 0x1514], 1
jmp 0x46c516
and dword [ebp - 0x1514], 0
cmp dword [ebp - 0x1514], 1
ja 0x46c52b
mov dword [ebp - 0xa1c], 1
jmp 0x46c532
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0xa1c], eax
jg 0x46c54c
mov dword [ebp - 0x151c], 1
jmp 0x46c553
and dword [ebp - 0x151c], 0
mov eax, dword [ebp - 0x151c]
sub eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x290], eax
jge 0x46c579
mov dword [ebp - 0xa24], 1
jmp 0x46c580
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0xa24], eax
jl 0x46c59a
mov dword [ebp - 0x1524], 1
jmp 0x46c5a1
and dword [ebp - 0x1524], 0
mov eax, dword [ebp - 0x1524]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x2250], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x988]
push 1
lea ecx, [ebp - 0x1e80]
call fcn.00429290
cmp esi, dword [eax]
jl 0x46c5f5
push 1
lea ecx, [ebp - 0x1e80]
call fcn.00429290
cmp dword [eax], 0
je 0x46c5f5
mov dword [ebp - 0x152c], 1
jmp 0x46c5fc
and dword [ebp - 0x152c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x988]
imul eax, dword [ebp - 0x152c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x988]
jg 0x46c62b
mov dword [ebp - 0xa34], 1
jmp 0x46c632
and dword [ebp - 0xa34], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x988]
sub eax, dword [ebp - 0xa34]
mov dword [ebp - 0x1534], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1534]
mov dword [ebp + eax - 0x1778], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1978]
cmp dword [ebp - 0x1534], eax
je 0x46c67e
mov dword [ebp - 0xa3c], 1
jmp 0x46c685
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x1980], eax
mov byte [ebp - 0x1ed], 0
movzx eax, byte [ebp - 0x1ed]
test eax, eax
je 0x46c6ab
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea ecx, [ebp - 0x1e80]
call fcn.00429274
jmp 0x46c409
jmp 0x46c2dd
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0x968], 0x12e75507
mov dword [ebp - 0x360], 0x13
jmp 0x46c6ed
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xffffffe5
jg 0x46c83e
mov dword [ebp - 0xcc], 0xfffffffb
mov dword [ebp - 0x1990], 1
mov dword [ebp - 0xa44], 0x8b42
mov dword [ebp - 0xcc], 0
jmp 0x46c731
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 6
jle 0x46c839
mov dword [ebp - 0x1c0c], 0x64939e63
cmp dword [ebp - 0xcc], 0
jne 0x46c75d
mov dword [ebp - 0x1988], 1
jmp 0x46c764
and dword [ebp - 0x1988], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x23c8], eax
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x1990]
test eax, eax
jne 0x46c796
mov eax, 0x2a7b
test eax, eax
je 0x46c796
mov dword [ebp - 0x153c], 1
jmp 0x46c79d
and dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x153c], eax
jl 0x46c7bd
cmp dword [ebp - 0xa44], 0
jne 0x46c7bd
and dword [ebp - 0x1bfc], 0
jmp 0x46c7c7
mov dword [ebp - 0x1bfc], 1
cmp dword [ebp - 0xa44], 0
jne 0x46c7dc
mov dword [ebp - 0x1c04], 1
jmp 0x46c7e3
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x968], 0x10dd
mov eax, dword [ebp - 0x968]
sub eax, 0x7319
cmp eax, dword [ebp - 0xcc]
je 0x46c821
cmp dword [ebp - 0x968], 0
je 0x46c821
mov dword [ebp - 0x1544], 1
jmp 0x46c828
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1c0c], eax
jmp 0x46c724
jmp 0x46c6e0
cmp dword [ebp - 0xa9c], 0x1625
jle 0x46c8f7
and dword [ebp - 0x564], 0
jmp 0x46c864
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0x36c4
jge 0x46c8f7
and dword [ebp - 0x55c], 0
jmp 0x46c88a
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x476a
jge 0x46c8f2
and dword [ebp - 0x3b4], 0
jmp 0x46c8ac
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0x35d7
jge 0x46c8f0
mov eax, dword [ebp - 0x55c]
imul eax, dword [ebp - 0x3b4]
xor eax, dword [ebp - 0x564]
cdq
mov dword [ebp - 0x199c], eax
mov dword [ebp - 0x1998], edx
push dword [ebp - 0x1998]
push dword [ebp - 0x199c]
mov ecx, 0xab96a0
call fcn.0047e22e
jmp 0x46c89f
jmp 0x46c87d
jmp 0x46c857
push 3
lea ecx, [ebp - 0x210]
call fcn.004291a2
mov dword [ebp - 0x1c24], 0x1603
push 3
lea ecx, [ebp - 0x1f88]
call fcn.004291a2
mov dword [ebp - 0x5c], 0
jmp 0x46c92b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x46c947
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x210]
call fcn.00429290
mov dword [eax], 0x540d7f82
jmp 0x46c924
mov dword [ebp - 0x5c], 0
jmp 0x46c957
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x46c96d
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x9a8], 0xffffffff
jmp 0x46c950
mov dword [ebp - 0x5c], 0
jmp 0x46c97d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x46c999
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x1f88]
call fcn.00429290
mov dword [eax], 0xfffffff7
jmp 0x46c976
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
and dword [eax], 0
jmp 0x46c9cf
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa4c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
cmp dword [eax], 0xffffffed
jge 0x46ca58
push 3
lea ecx, [ebp - 0x1e2c]
call fcn.004291a2
mov dword [ebp - 0x3bc], 0
jmp 0x46ca07
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 3
jge 0x46ca29
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x1e2c]
call fcn.00429290
mov dword [eax], 1
jmp 0x46c9fa
push 1
lea ecx, [ebp - 0x1e2c]
call fcn.00429290
cmp dword [eax], 0
je 0x46ca48
lea ecx, [ebp - 0x1e2c]
call fcn.00429274
jmp 0x46ca58
lea ecx, [ebp - 0x1e2c]
call fcn.00429274
jmp 0x46c9ab
push 2
lea ecx, [ebp - 0x210]
call fcn.00429290
push 0
lea ecx, [ebp - 0x210]
call fcn.00429290
mov esi, dword [eax]
sub esi, 0x79dc
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
cmp esi, dword [eax]
jne 0x46ca97
mov dword [ebp - 0x154c], 1
jmp 0x46ca9e
and dword [ebp - 0x154c], 0
cmp dword [ebp - 0x154c], 0xb4b5a9ce
ja 0x46cab6
mov dword [ebp - 0xa54], 1
jmp 0x46cabd
and dword [ebp - 0xa54], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0xa54]
cmp ecx, dword [eax]
jge 0x46cae1
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
cmp dword [eax], 0
jne 0x46cb05
mov eax, 0x13bc
test eax, eax
jne 0x46cb05
and dword [ebp - 0x1554], 0
jmp 0x46cb0f
mov dword [ebp - 0x1554], 1
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0x1554]
cmp ecx, dword [eax]
jle 0x46cb32
mov dword [ebp - 0xa5c], 1
jmp 0x46cb39
and dword [ebp - 0xa5c], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0xa5c]
cmp ecx, dword [eax]
jge 0x46cb5c
mov dword [ebp - 0x155c], 1
jmp 0x46cb63
and dword [ebp - 0x155c], 0
cmp dword [ebp - 0x155c], 0x945cb81e
jb 0x46cb7b
mov dword [ebp - 0xa64], 1
jmp 0x46cb82
and dword [ebp - 0xa64], 0
cmp dword [ebp - 0xa64], 0xa984
jle 0x46cb9a
mov dword [ebp - 0x1564], 1
jmp 0x46cba1
and dword [ebp - 0x1564], 0
push 2
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0x1564]
cmp ecx, dword [eax]
jl 0x46cbc4
mov dword [ebp - 0xa6c], 1
jmp 0x46cbcb
and dword [ebp - 0xa6c], 0
cmp dword [ebp - 0xa6c], 0x2dd8607f
jne 0x46cbe3
mov dword [ebp - 0x970], 1
jmp 0x46cbea
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax - 0x9a8], ecx
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0x970]
cmp ecx, dword [eax]
jl 0x46cc20
mov dword [ebp - 0x1c14], 1
jmp 0x46cc27
and dword [ebp - 0x1c14], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a8]
mov dword [ebp - 0x24e8], eax
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
cmp dword [eax], 0
je 0x46cc75
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9a8], 0
je 0x46cc75
mov dword [ebp - 0x156c], 1
jmp 0x46cc7c
and dword [ebp - 0x156c], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0x156c]
sub ecx, dword [eax]
jne 0x46cca5
mov eax, 0xfffc
test eax, eax
jne 0x46cca5
and dword [ebp - 0x1c1c], 0
jmp 0x46ccaf
mov dword [ebp - 0x1c1c], 1
push 0
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0x1c24]
cmp dword [eax], ecx
jg 0x46ccd2
mov dword [ebp - 0xa74], 1
jmp 0x46ccd9
and dword [ebp - 0xa74], 0
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa74]
lea esi, [ecx + eax - 0x259c]
push 0
lea ecx, [ebp - 0x210]
call fcn.00429290
add esi, dword [eax]
mov dword [ebp - 0x1574], esi
push 1
lea ecx, [ebp - 0x210]
call fcn.00429290
mov ecx, dword [ebp - 0x1574]
mov dword [eax], ecx
cmp dword [ebp - 0x1574], 4
jb 0x46cd34
mov dword [ebp - 0xa7c], 1
jmp 0x46cd3b
and dword [ebp - 0xa7c], 0
push 2
lea ecx, [ebp - 0x1f88]
call fcn.00429290
mov ecx, dword [ebp - 0xa7c]
mov dword [eax], ecx
lea ecx, [ebp - 0x1f88]
call fcn.00429274
lea ecx, [ebp - 0x210]
call fcn.00429274
mov dword [ebp - 0x344], 0x6c3f
mov dword [ebp - 0xa8c], 0xfffffffa
push 2
lea ecx, [ebp - 0x1cc4]
call fcn.004291a2
mov dword [ebp - 0x2260], 0x9fe9a5a1
mov dword [ebp - 0xf4], 0
jmp 0x46cdaa
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x46cdcc
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1cc4]
call fcn.00429290
mov dword [eax], 0xa0cd
jmp 0x46cd9d
mov dword [ebp - 0xf4], 0
jmp 0x46cde5
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x46ce01
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x25e4], 0
jmp 0x46cdd8
cmp dword [ebp - 0x344], 1
jle 0x46ce16
mov dword [ebp - 0x157c], 1
jmp 0x46ce1d
and dword [ebp - 0x157c], 0
cmp dword [ebp - 0x157c], 0x3df2ef51
jle 0x46ce39
xor eax, eax
jne 0x46ce39
mov dword [ebp - 0xa84], 1
jmp 0x46ce40
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xa84]
sub eax, 5
imul eax, eax, 0x20b5
test eax, eax
je 0x46ce66
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x46ce66
mov dword [ebp - 0x1c2c], 1
jmp 0x46ce6d
and dword [ebp - 0x1c2c], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x23d8], eax
mov eax, dword [ebp - 0x344]
add eax, dword [ebp - 0x344]
cmp eax, 0xffff
jbe 0x46ce98
mov dword [ebp - 0x1584], 1
jmp 0x46ce9f
and dword [ebp - 0x1584], 0
mov eax, dword [ebp - 0x1584]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0x344]
lea esi, [eax + ecx + 0x4ce3]
push 1
lea ecx, [ebp - 0x1cc4]
call fcn.00429290
cmp esi, dword [eax]
jge 0x46cedb
mov dword [ebp - 0x158c], 1
jmp 0x46cee2
and dword [ebp - 0x158c], 0
push 1
lea ecx, [ebp - 0x1cc4]
call fcn.00429290
mov ecx, dword [ebp - 0x158c]
cmp ecx, dword [eax]
jl 0x46cf17
push 1
lea ecx, [ebp - 0x1cc4]
call fcn.00429290
cmp dword [eax], 0
je 0x46cf17
mov dword [ebp - 0xa94], 1
jmp 0x46cf1e
and dword [ebp - 0xa94], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa94]
mov dword [ebp + eax - 0x25e4], ecx
lea ecx, [ebp - 0x1cc4]
call fcn.00429274
mov dword [ebp - 0x1c34], 0xfffffffc
mov dword [ebp - 0x2268], 1
mov dword [ebp - 0x24b0], 2
mov dword [ebp - 0x2270], 0x1accbad8
mov dword [ebp - 0x23e8], 0xcb4c23af
mov dword [ebp - 0x2278], 0x5425a80e
mov dword [ebp - 0x2508], 0
mov dword [ebp - 0x2504], 0
mov dword [ebp - 0x2500], 0
mov dword [ebp - 0x24fc], 0
mov dword [ebp - 0x2520], 0x223f
mov dword [ebp - 0x2280], 0x72ba29f5
mov dword [ebp - 0x1594], 0xffff
mov dword [ebp - 0x56c], 0
jmp 0x46cfd7
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 3
jge 0x46cff3
mov eax, dword [ebp - 0x56c]
mov dword [ebp + eax*4 - 0x27bc], 1
jmp 0x46cfca
mov dword [ebp - 0x1c34], 1
mov eax, dword [ebp - 0x1594]
dec eax
mov dword [ebp - 0x1594], eax
mov dword [ebp - 0x17e4], str.egrv_hpmcl_vdgdi_gldvsu_dhbhrdu
and dword [ebp - 4], 0
cmp dword [ebp - 0xa9c], 0x1272
jge 0x46d034
mov edx, dword [ebp - 0x1c3c]
mov ecx, 0xab96a0
call fcn.0047f6dc
jmp 0x46d050
or dword [ebp - 4], 0xffffffff
jmp 0x46d05a
push 3
lea ecx, [ebp - 0x2374]
call fcn.004291a2
mov dword [ebp - 0x23f8], 0xfffffffc
mov dword [ebp - 0xd4], 0
jmp 0x46d08a
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x46d0ac
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x2374]
call fcn.00429290
mov dword [eax], 0xfdf99ff6
jmp 0x46d07d
mov dword [ebp - 0xd4], 0
jmp 0x46d0c5
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x46d0e1
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x1df4], 4
jmp 0x46d0b8
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1df4], 2
jmp 0x46d10f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1df4]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1df4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1df4], 0
jl 0x46d1c1
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x46d140
push 0xc73
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1df4], 0
je 0x46d1a7
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1df4], 0
je 0x46d1a7
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x3c4], 2
jmp 0x46d183
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
jl 0x46d1a5
mov dword [ebp - 0x159c], 2
mov eax, dword [ebp - 0x159c]
dec eax
mov dword [ebp - 0x159c], eax
jmp 0x46d176
jmp 0x46d1bc
mov dword [ebp - 0x1c44], 0xb2006887
cmp dword [ebp - 0x1c44], 0
je 0x46d1bc
jmp 0x46d1c1
jmp 0x46d0f4
lea ecx, [ebp - 0x2374]
call fcn.00429274
mov dword [ebp - 0x29c], 0xffffffff
mov dword [ebp - 0x9b0], 0x12e75507
mov dword [ebp - 0x29c], 0x13
jmp 0x46d1f9
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffe5
jg 0x46d34a
mov dword [ebp - 0xb4], 0xfffffffb
mov dword [ebp - 0x1c54], 1
mov dword [ebp - 0x15a4], 0x8b42
mov dword [ebp - 0xb4], 0
jmp 0x46d23d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 6
jle 0x46d345
mov dword [ebp - 0x1c6c], 0x64939e63
cmp dword [ebp - 0xb4], 0
jne 0x46d269
mov dword [ebp - 0x1c4c], 1
jmp 0x46d270
and dword [ebp - 0x1c4c], 0
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2288], eax
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x1c54]
test eax, eax
jne 0x46d2a2
mov eax, 0x2a7b
test eax, eax
je 0x46d2a2
mov dword [ebp - 0xaa4], 1
jmp 0x46d2a9
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xaa4], eax
jl 0x46d2c9
cmp dword [ebp - 0x15a4], 0
jne 0x46d2c9
and dword [ebp - 0x1c5c], 0
jmp 0x46d2d3
mov dword [ebp - 0x1c5c], 1
cmp dword [ebp - 0x15a4], 0
jne 0x46d2e8
mov dword [ebp - 0x1c64], 1
jmp 0x46d2ef
and dword [ebp - 0x1c64], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x24b8], eax
mov dword [ebp - 0x9b0], 0x10dd
mov eax, dword [ebp - 0x9b0]
sub eax, 0x7319
cmp eax, dword [ebp - 0xb4]
je 0x46d32d
cmp dword [ebp - 0x9b0], 0
je 0x46d32d
mov dword [ebp - 0xaac], 1
jmp 0x46d334
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0x1c6c], eax
jmp 0x46d230
jmp 0x46d1ec
mov dword [ebp - 0x9c0], 1
mov dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c0], 0
je 0x46d376
mov dword [ebp - 0x9c8], 0xffffffff
jmp 0x46d3ff
mov dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 1
je 0x46d39b
cmp dword [ebp - 0x9c0], 0
jne 0x46d39b
and dword [ebp - 0x15ac], 0
jmp 0x46d3a5
mov dword [ebp - 0x15ac], 1
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x15ac], eax
je 0x46d3bf
mov dword [ebp - 0xab4], 1
jmp 0x46d3c6
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0xab4], eax
jne 0x46d3e0
mov dword [ebp - 0x1c74], 1
jmp 0x46d3e7
and dword [ebp - 0x1c74], 0
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x2290], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0xc44], 0x4557
jle 0x46d899
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp - 0x594], 0
jmp 0x46d42f
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0x56f9
jge 0x46d885
mov dword [ebp - 0x15bc], 0x6eb7
mov dword [ebp - 0x1c8c], str.ciqeaawyf_uid_eifdx_amuexl_kevg_zbkwq_anmzkltsx_fdmbtlr_nxe_jkevr_wrdokv_kiu_yvbihzsvs_rneer
cmp dword [ebp - 0x15bc], 0x6fe8
jle 0x46d4fb
and dword [ebp - 0x574], 0
jmp 0x46d479
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0x44de
jge 0x46d4fb
and dword [ebp - 0x3cc], 0
jmp 0x46d49b
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x1cf1
jge 0x46d4f6
mov eax, dword [ebp - 0x574]
mov ecx, dword [ebp - 0x3cc]
shl eax, cl
cdq
mov dword [ebp - 0x19a8], eax
mov dword [ebp - 0x19a4], edx
push dword [ebp - 0x19a4]
push dword [ebp - 0x19a8]
lea ecx, [ebp - 0x27ec]
call fcn.00450edb
pop ecx
pop ecx
mov ecx, eax
call fcn.004028f3
push eax
call fcn.00482ed5
pop ecx
lea ecx, [ebp - 0x27ec]
call fcn.004026e0
jmp 0x46d48e
jmp 0x46d46c
and dword [ebp - 0x3ec], 0
jmp 0x46d511
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x3f84
jge 0x46d83b
mov dword [ebp - 0xabc], 0x24e2
mov dword [ebp - 0x1c84], str.kzngqyb_wqcwt_rjnepjjue_upymmcj_hqakwjyf_ybonf
cmp dword [ebp - 0xabc], 0x257c
jle 0x46d627
push 0
push 0
push 0xaa4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 0x584], 0
jmp 0x46d571
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0xf21
jge 0x46d627
and dword [ebp - 0x57c], 0
jmp 0x46d597
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0x3780
jge 0x46d622
and dword [ebp - 0x3d4], 0
jmp 0x46d5b9
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x2fc
jge 0x46d61d
mov eax, dword [ebp - 0x57c]
cdq
idiv dword [ebp - 0x3d4]
mov eax, dword [ebp - 0x584]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0x19b4], eax
mov dword [ebp - 0x19b0], edx
push dword [ebp - 0x19b0]
push dword [ebp - 0x19b4]
lea ecx, [ebp - 0x2708]
call fcn.00450edb
pop ecx
pop ecx
mov ecx, eax
call fcn.004028f3
push eax
call fcn.00482ed5
pop ecx
lea ecx, [ebp - 0x2708]
call fcn.004026e0
jmp 0x46d5ac
jmp 0x46d58a
jmp 0x46d564
and dword [ebp - 0x59c], 0
jmp 0x46d63d
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0x1b82
jge 0x46d7f1
mov dword [ebp - 0x15b4], 0x40e0
mov dword [ebp - 0x1c7c], str.vnfh_fxolql_wcgz_ihiwv_euoovj
cmp dword [ebp - 0x15b4], 0x4122
jle 0x46d747
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
and dword [ebp - 0x3e4], 0
jmp 0x46d693
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0x271f
jge 0x46d747
and dword [ebp - 0x3dc], 0
jmp 0x46d6b9
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x47d3
jge 0x46d742
and dword [ebp - 0x58c], 0
jmp 0x46d6db
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0x5c5f
jge 0x46d73d
mov eax, dword [ebp - 0x3dc]
cdq
idiv dword [ebp - 0x58c]
and edx, dword [ebp - 0x3e4]
mov eax, edx
cdq
mov dword [ebp - 0x19c0], eax
mov dword [ebp - 0x19bc], edx
push dword [ebp - 0x19bc]
push dword [ebp - 0x19c0]
lea ecx, [ebp - 0x266c]
call fcn.00450edb
pop ecx
pop ecx
mov ecx, eax
call fcn.004028f3
push eax
call fcn.00482ed5
pop ecx
lea ecx, [ebp - 0x266c]
call fcn.004026e0
jmp 0x46d6ce
jmp 0x46d6ac
jmp 0x46d686
and dword [ebp - 0x3f4], 0
jmp 0x46d75d
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x6897
jge 0x46d7a7
mov eax, dword [ebp - 0x594]
imul eax, dword [ebp - 0x3ec]
and eax, dword [ebp - 0x59c]
xor eax, dword [ebp - 0x3f4]
cdq
mov dword [ebp - 0x19cc], eax
mov dword [ebp - 0x19c8], edx
push dword [ebp - 0x19c8]
push dword [ebp - 0x19cc]
mov ecx, 0xab96a0
call fcn.0047e22e
jmp 0x46d750
mov dword [ebp - 4], 2
cmp dword [ebp - 0x15b4], 0x405c
jge 0x46d7c6
push dword [ebp - 0x1c7c]
call fcn.00482ed5
pop ecx
jmp 0x46d7e2
or dword [ebp - 4], 0xffffffff
jmp 0x46d7ec
jmp 0x46d630
mov dword [ebp - 4], 4
cmp dword [ebp - 0xabc], 0x233c
jge 0x46d810
push dword [ebp - 0x1c84]
call fcn.00482ed5
pop ecx
jmp 0x46d82c
or dword [ebp - 4], 0xffffffff
jmp 0x46d836
jmp 0x46d504
mov dword [ebp - 4], 6
cmp dword [ebp - 0x15bc], 0x6e32
jge 0x46d85a
push dword [ebp - 0x1c8c]
call fcn.00482ed5
pop ecx
jmp 0x46d876
or dword [ebp - 4], 0xffffffff
jmp 0x46d880
jmp 0x46d422
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov dword [ebp - 0x1c0], 0x9000d4e7
mov dword [ebp - 0x3c], 0x62751c76
mov dword [ebp - 0x994], 0x777bab6e
mov dword [ebp - 0x9d8], 0xffff
mov dword [ebp - 0xae4], 0
push 3
lea ecx, [ebp - 0x172c]
call fcn.004291a2
mov dword [ebp - 0x5a4], 0
jmp 0x46d8ee
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 3
jge 0x46d910
push dword [ebp - 0x5a4]
lea ecx, [ebp - 0x172c]
call fcn.00429290
mov dword [eax], 0xfffffffc
jmp 0x46d8e1
cmp dword [ebp - 0x1c0], 0
jne 0x46d951
cmp dword [ebp - 0x1c0], 0
jg 0x46d92e
mov dword [ebp - 0xac4], 1
jmp 0x46d935
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0xac4]
sub eax, dword [ebp - 0x1c0]
cmp eax, 0x82a10aa4
jbe 0x46d951
and dword [ebp - 0x15c4], 0
jmp 0x46d95b
mov dword [ebp - 0x15c4], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x15c4]
jle 0x46dcca
mov dword [ebp - 0x5ac], 0x51ad5b48
mov dword [ebp - 0x974], 0xa33ed863
mov dword [ebp - 0x3fc], 0
jmp 0x46d9a7
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 1
jge 0x46d9c3
mov eax, dword [ebp - 0x3fc]
mov dword [ebp + eax*4 - 0x134], 0x51a9
jmp 0x46d99a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x134], 0xfffffffc
jl 0x46d9df
mov dword [ebp - 0x1c94], 1
jmp 0x46d9e6
and dword [ebp - 0x1c94], 0
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x134]
je 0x46da06
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x134], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
neg eax
js 0x46da23
mov dword [ebp - 0xacc], 1
jmp 0x46da2a
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0xacc]
sub eax, dword [ebp - 0x3c]
cmp eax, 0xb913
jge 0x46da46
mov dword [ebp - 0x15cc], 1
jmp 0x46da4d
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0x15cc]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
add eax, dword [ebp - 0x1c0]
je 0x46da73
mov dword [ebp - 0xad4], 1
jmp 0x46da7a
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0xad4], eax
jle 0x46da94
mov dword [ebp - 0x1c9c], 1
jmp 0x46da9b
and dword [ebp - 0x1c9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
mov dword [ebp - 0x2408], eax
xor eax, eax
je 0x46dac4
cmp dword [ebp - 0x3c], 0
je 0x46dac4
mov dword [ebp - 0x1ca4], 1
jmp 0x46dacb
and dword [ebp - 0x1ca4], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2298], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
mov dword [ebp - 0x244c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x134], 2
jbe 0x46db03
mov dword [ebp - 0x15d4], 1
jmp 0x46db0a
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0x15d4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x9d8], 1
je 0x46db3d
mov dword [ebp - 0x15dc], 1
jmp 0x46db44
and dword [ebp - 0x15dc], 0
mov eax, dword [ebp - 0x9d8]
imul eax, dword [ebp - 0x15dc]
cmp eax, dword [ebp - 0x3c]
jge 0x46db62
mov dword [ebp - 0xae0], 1
jmp 0x46db69
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub eax, 0x738f5e69
mov dword [ebp - 0xae4], eax
cmp dword [ebp - 0xae4], 3
jb 0x46db95
mov dword [ebp - 0x9d0], 1
jmp 0x46db9c
and dword [ebp - 0x9d0], 0
push 2
lea ecx, [ebp - 0x172c]
call fcn.00429290
mov ecx, dword [ebp - 0x9d0]
mov dword [eax], ecx
cmp dword [ebp - 0x9d0], 0x500c330e
jne 0x46dbc9
mov dword [ebp - 0x1718], 1
jmp 0x46dbd0
and dword [ebp - 0x1718], 0
mov eax, dword [ebp - 0x994]
cmp eax, dword [ebp - 0x1718]
jne 0x46dbea
mov dword [ebp - 0xaec], 1
jmp 0x46dbf1
and dword [ebp - 0xaec], 0
cmp dword [ebp - 0xaec], 0xec334572
jbe 0x46dc09
mov dword [ebp - 0x10f8], 1
jmp 0x46dc10
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x10f8]
neg eax
cmp eax, dword [ebp - 0x9d8]
jne 0x46dc2c
mov dword [ebp - 0xaf4], 1
jmp 0x46dc33
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0x96db
jg 0x46dc57
mov dword [ebp - 0x13f8], 1
jmp 0x46dc5e
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x13f8]
cmp eax, 0xfffffffe
jle 0x46dc7b
mov dword [ebp - 0xafc], 1
jmp 0x46dc82
and dword [ebp - 0xafc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp dword [ebp - 0xafc], eax
je 0x46dcb2
push 1
lea ecx, [ebp - 0x172c]
call fcn.00429290
cmp dword [eax], 0
jne 0x46dcb2
and dword [ebp - 0x1100], 0
jmp 0x46dcbc
mov dword [ebp - 0x1100], 1
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x994], eax
jmp 0x46dd21
mov dword [ebp - 0x3c], 0
jmp 0x46dcda
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x46dd04
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x172c]
call fcn.00429290
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x172c]
call fcn.00429290
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x46dcd3
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x46dd21
push 0x1cf9
call dword [sym.imp.USER32.dll_GetSysColorBrush]
lea ecx, [ebp - 0x172c]
call fcn.00429274
push 3
lea ecx, [ebp - 0x204]
call fcn.004291a2
mov dword [ebp - 0x1dd4], 0x1603
push 3
lea ecx, [ebp - 0x2000]
call fcn.004291a2
mov dword [ebp - 0x74], 0
jmp 0x46dd60
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x46dd7c
push dword [ebp - 0x74]
lea ecx, [ebp - 0x204]
call fcn.00429290
mov dword [eax], 0x540d7f82
jmp 0x46dd59
mov dword [ebp - 0x74], 0
jmp 0x46dd8c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x46dda2
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x854], 0xffffffff
jmp 0x46dd85
mov dword [ebp - 0x74], 0
jmp 0x46ddb2
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x46ddce
push dword [ebp - 0x74]
lea ecx, [ebp - 0x2000]
call fcn.00429290
mov dword [eax], 0xfffffff7
jmp 0x46ddab
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
and dword [eax], 0
jmp 0x46de04
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xb04]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xb04]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
cmp dword [eax], 0xffffffed
jge 0x46de8d
push 3
lea ecx, [ebp - 0x1e44]
call fcn.004291a2
mov dword [ebp - 0x404], 0
jmp 0x46de3c
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 3
jge 0x46de5e
push dword [ebp - 0x404]
lea ecx, [ebp - 0x1e44]
call fcn.00429290
mov dword [eax], 1
jmp 0x46de2f
push 1
lea ecx, [ebp - 0x1e44]
call fcn.00429290
cmp dword [eax], 0
je 0x46de7d
lea ecx, [ebp - 0x1e44]
call fcn.00429274
jmp 0x46de8d
lea ecx, [ebp - 0x1e44]
call fcn.00429274
jmp 0x46dde0
push 2
lea ecx, [ebp - 0x204]
call fcn.00429290
push 0
lea ecx, [ebp - 0x204]
call fcn.00429290
mov esi, dword [eax]
sub esi, 0x79dc
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
cmp esi, dword [eax]
jne 0x46decc
mov dword [ebp - 0x1578], 1
jmp 0x46ded3
and dword [ebp - 0x1578], 0
cmp dword [ebp - 0x1578], 0xb4b5a9ce
ja 0x46deeb
mov dword [ebp - 0xb0c], 1
jmp 0x46def2
and dword [ebp - 0xb0c], 0
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0xb0c]
cmp ecx, dword [eax]
jge 0x46df16
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
cmp dword [eax], 0
jne 0x46df3a
mov eax, 0x13bc
test eax, eax
jne 0x46df3a
and dword [ebp - 0x1108], 0
jmp 0x46df44
mov dword [ebp - 0x1108], 1
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0x1108]
cmp ecx, dword [eax]
jle 0x46df67
mov dword [ebp - 0xb14], 1
jmp 0x46df6e
and dword [ebp - 0xb14], 0
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0xb14]
cmp ecx, dword [eax]
jge 0x46df91
mov dword [ebp - 0x1400], 1
jmp 0x46df98
and dword [ebp - 0x1400], 0
cmp dword [ebp - 0x1400], 0x945cb81e
jb 0x46dfb0
mov dword [ebp - 0xb1c], 1
jmp 0x46dfb7
and dword [ebp - 0xb1c], 0
cmp dword [ebp - 0xb1c], 0xa984
jle 0x46dfcf
mov dword [ebp - 0x1110], 1
jmp 0x46dfd6
and dword [ebp - 0x1110], 0
push 2
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0x1110]
cmp ecx, dword [eax]
jl 0x46dff9
mov dword [ebp - 0xb24], 1
jmp 0x46e000
and dword [ebp - 0xb24], 0
cmp dword [ebp - 0xb24], 0x2dd8607f
jne 0x46e018
mov dword [ebp - 0x914], 1
jmp 0x46e01f
and dword [ebp - 0x914], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x914]
mov dword [ebp + eax - 0x854], ecx
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0x914]
cmp ecx, dword [eax]
jl 0x46e055
mov dword [ebp - 0x1dc4], 1
jmp 0x46e05c
and dword [ebp - 0x1dc4], 0
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x854]
mov dword [ebp - 0x22a0], eax
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
cmp dword [eax], 0
je 0x46e0aa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x854], 0
je 0x46e0aa
mov dword [ebp - 0x163c], 1
jmp 0x46e0b1
and dword [ebp - 0x163c], 0
push 1
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0x163c]
sub ecx, dword [eax]
jne 0x46e0da
mov eax, 0xfffc
test eax, eax
jne 0x46e0da
mov dword [ebp - 0x1dcc], 1
push 0
lea ecx, [ebp - 0x204]
call fcn.00429290
mov ecx, dword [ebp - 0x1dd4]
cmp dword [eax], ecx
jg 0x46e107