Function at 0x45f16c
Capabilities:
Allocate thread local storage
Check os version
Contain obfuscated stackstrings
Create pipe
Create process on windows
Enumerate gui resources
Get disk information
Get graphical window text
Get memory capacity
Hide graphical window
Modify service
Query or enumerate registry key
Resume thread
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5fe8
call fcn.004a87d0
push esi
mov dword [ebp - 0x160], 0xc03342eb
mov byte [ebp - 0x6c4], 0
movzx eax, byte [ebp - 0x6c4]
test eax, eax
je 0x45f19e
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x160], 0
jmp 0x45f1b7
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x12
je 0x45f4c1
mov dword [ebp - 0x26c], 0xfffffffa
mov dword [ebp - 0x43e8], 0x22263126
mov dword [ebp - 0x43e4], 0x22263126
mov dword [ebp - 0x43e0], 0x22263126
mov dword [ebp - 0x43dc], 0x22263126
mov dword [ebp - 0x9cc], 0
jmp 0x45f20f
mov eax, dword [ebp - 0x9cc]
inc eax
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 3
jge 0x45f22b
mov eax, dword [ebp - 0x9cc]
mov dword [ebp + eax*4 - 0x5c28], 0
jmp 0x45f202
mov dword [ebp - 0x26c], 9
jmp 0x45f244
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xffffffe2
jne 0x45f275
mov byte [ebp - 0x6c3], 0
movzx eax, byte [ebp - 0x6c3]
test eax, eax
je 0x45f273
push 0
push 0x1965
push 0
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x45f237
mov dword [ebp - 0x26c], 3
jmp 0x45f28e
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jl 0x45f4bc
push 2
lea ecx, [ebp - 0x40c0]
call fcn.004133eb
mov dword [ebp - 0x3948], 0xd1d9d65f
mov dword [ebp - 0xcf0], 0
jmp 0x45f2cb
mov eax, dword [ebp - 0xcf0]
inc eax
mov dword [ebp - 0xcf0], eax
cmp dword [ebp - 0xcf0], 2
jge 0x45f2ed
push dword [ebp - 0xcf0]
lea ecx, [ebp - 0x40c0]
call fcn.004134d9
mov dword [eax], 0xa5f27a41
jmp 0x45f2be
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x43e8], 0
je 0x45f3bb
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4e48], eax
push 0xfffffffffffffff7
pop eax
cmp eax, 0x4d25
je 0x45f323
mov dword [ebp - 0x2808], 1
jmp 0x45f32a
and dword [ebp - 0x2808], 0
imul eax, dword [ebp - 0x2808], 0x6d06
cmp eax, dword [ebp - 0x26c]
jne 0x45f348
mov dword [ebp - 0x3344], 1
jmp 0x45f34f
and dword [ebp - 0x3344], 0
imul eax, dword [ebp - 0x3344], 0x5bf7
dec eax
je 0x45f371
mov eax, 0x4353ea3a
test eax, eax
je 0x45f371
mov dword [ebp - 0x334c], 1
jmp 0x45f378
and dword [ebp - 0x334c], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x334c], eax
jge 0x45f392
mov dword [ebp - 0x3354], 1
jmp 0x45f399
and dword [ebp - 0x3354], 0
push 1
lea ecx, [ebp - 0x40c0]
call fcn.004134d9
mov eax, dword [eax]
sub eax, dword [ebp - 0x3354]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x43e8]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43e8]
mov dword [ebp - 0x5808], eax
push 1
lea ecx, [ebp - 0x40c0]
call fcn.004134d9
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x5290], eax
mov eax, 0x1177
test eax, eax
jne 0x45f401
cmp dword [ebp - 0x160], 0
jne 0x45f401
and dword [ebp - 0x335c], 0
jmp 0x45f40b
mov dword [ebp - 0x335c], 1
push 0
lea ecx, [ebp - 0x40c0]
call fcn.004134d9
mov ecx, dword [ebp - 0x335c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x58d4], eax
mov eax, dword [ebp - 0x3948]
cmp dword [ebp - 0x160], eax
jle 0x45f446
mov dword [ebp - 0x3364], 1
jmp 0x45f44d
and dword [ebp - 0x3364], 0
cmp dword [ebp - 0x3364], 0x7d900d29
jge 0x45f465
mov dword [ebp - 0x3a00], 1
jmp 0x45f46c
and dword [ebp - 0x3a00], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x5298], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5c28], 1
mov byte [ebp - 0x645], 0
movzx eax, byte [ebp - 0x645]
test eax, eax
je 0x45f4ac
push 0
push 0
push 0x1250
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0x40c0]
call fcn.004134bd
jmp 0x45f281
jmp 0x45f1aa
mov dword [ebp - 0x6ec], 0xfffffff7
mov dword [ebp - 0x9d4], 0
jmp 0x45f4e4
mov eax, dword [ebp - 0x9d4]
inc eax
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 3
jge 0x45f500
mov eax, dword [ebp - 0x9d4]
mov dword [ebp + eax*4 - 0x5474], 0xfffffffd
jmp 0x45f4d7
mov dword [ebp - 0x6ec], 2
jmp 0x45f519
mov eax, dword [ebp - 0x6ec]
dec eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0
jl 0x45f53e
mov eax, dword [ebp - 0x6ec]
mov ecx, dword [ebp - 0x6ec]
mov eax, dword [ebp + eax*4 - 0x5474]
mov dword [ebp + ecx*4 - 0x5474], eax
jmp 0x45f50c
mov dword [ebp - 0x48c], 0xb9f9b31
mov dword [ebp - 0x86c], 0xd686a37b
mov dword [ebp - 0x48c], 0xffffffe6
jmp 0x45f56b
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0xfffffff4
jle 0x45f9d5
mov dword [ebp - 0x494], 0xc6f1bf50
mov dword [ebp - 0x12c4], 0xffffffff
mov dword [ebp - 0x494], 0
jmp 0x45f5a5
mov eax, dword [ebp - 0x494]
dec eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xfffffffc
jne 0x45f9a5
mov dword [ebp - 0x49c], 0xffffffff
mov dword [ebp - 0x10bc], 0xfffe
push 4
lea ecx, [ebp - 0x40d0]
call fcn.004133eb
mov dword [ebp - 0xcf4], 0
jmp 0x45f5ec
mov eax, dword [ebp - 0xcf4]
inc eax
mov dword [ebp - 0xcf4], eax
cmp dword [ebp - 0xcf4], 4
jge 0x45f60e
push dword [ebp - 0xcf4]
lea ecx, [ebp - 0x40d0]
call fcn.004134d9
mov dword [eax], 0xe497d6a5
jmp 0x45f5df
mov eax, 0xa98815cb
sub eax, dword [ebp - 0x48c]
neg eax
je 0x45f6ee
cmp dword [ebp - 0x494], 0
jne 0x45f6b7
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x5818], eax
cmp dword [ebp - 0x48c], 0
cmp dword [ebp - 0x49c], 0xfffc
jne 0x45f659
mov dword [ebp - 0x336c], 1
jmp 0x45f660
and dword [ebp - 0x336c], 0
cmp dword [ebp - 0x336c], 0xe136dc99
ja 0x45f678
mov dword [ebp - 0x3374], 1
jmp 0x45f67f
and dword [ebp - 0x3374], 0
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x3374], eax
jne 0x45f699
mov dword [ebp - 0x337c], 1
jmp 0x45f6a0
and dword [ebp - 0x337c], 0
mov eax, dword [ebp - 0x337c]
sub eax, dword [ebp - 0x49c]
jne 0x45f6b7
and dword [ebp - 0x3440], 0
jmp 0x45f6c1
mov dword [ebp - 0x3440], 1
mov eax, dword [ebp - 0x49c]
imul eax, dword [ebp - 0x3440]
test eax, eax
jne 0x45f6d9
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x45f6ee
cmp dword [ebp - 0x10bc], 0
je 0x45f6ee
mov dword [ebp - 0x3448], 1
jmp 0x45f6f5
and dword [ebp - 0x3448], 0
mov eax, dword [ebp - 0x3448]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x52a0], eax
or eax, 0xffffffff
je 0x45f975
mov dword [ebp - 0x9dc], 0xffffffff
mov dword [ebp - 0x34b0], 0
mov byte [ebp - 0x6c5], 0
movzx eax, byte [ebp - 0x6c5]
test eax, eax
je 0x45f748
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
cmp dword [ebp - 0x49c], 0
jne 0x45f75d
mov dword [ebp - 0x3450], 1
jmp 0x45f764
and dword [ebp - 0x3450], 0
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x3450], eax
jne 0x45f77e
mov dword [ebp - 0x3458], 1
jmp 0x45f785
and dword [ebp - 0x3458], 0
mov eax, dword [ebp - 0x3458]
mov dword [ebp - 0x12c4], eax
cmp dword [ebp - 0x12c4], 0
je 0x45f7af
cmp dword [ebp - 0x48c], 0
je 0x45f7af
mov dword [ebp - 0x3460], 1
jmp 0x45f7b6
and dword [ebp - 0x3460], 0
cmp dword [ebp - 0x3460], 0x643d
je 0x45f7ce
mov dword [ebp - 0x3468], 1
jmp 0x45f7d5
and dword [ebp - 0x3468], 0
mov eax, dword [ebp - 0x3468]
shl eax, 2
cmp eax, dword [ebp - 0x86c]
jg 0x45f7fb
cmp dword [ebp - 0x9dc], 0
je 0x45f7fb
mov dword [ebp - 0x3470], 1
jmp 0x45f802
and dword [ebp - 0x3470], 0
push 2
lea ecx, [ebp - 0x40d0]
call fcn.004134d9
mov ecx, dword [ebp - 0x3470]
cmp ecx, dword [eax]
jne 0x45f825
mov dword [ebp - 0x3478], 1
jmp 0x45f82c
and dword [ebp - 0x3478], 0
mov eax, dword [ebp - 0x9dc]
imul eax, dword [ebp - 0x3478]
test eax, eax
je 0x45f852
cmp dword [ebp - 0x9dc], 0
je 0x45f852
mov dword [ebp - 0x3480], 1
jmp 0x45f859
and dword [ebp - 0x3480], 0
mov eax, dword [ebp - 0x10bc]
cmp eax, dword [ebp - 0x3480]
jl 0x45f873
mov dword [ebp - 0x3488], 1
jmp 0x45f87a
and dword [ebp - 0x3488], 0
mov eax, dword [ebp - 0x10bc]
imul eax, dword [ebp - 0x3488]
cmp dword [ebp - 0x9dc], eax
jg 0x45f8a1
cmp dword [ebp - 0x12c4], 0
jne 0x45f8a1
and dword [ebp - 0x3490], 0
jmp 0x45f8ab
mov dword [ebp - 0x3490], 1
cmp dword [ebp - 0x3490], 0xcda2
jg 0x45f8c3
mov dword [ebp - 0x3498], 1
jmp 0x45f8ca
and dword [ebp - 0x3498], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x3498], eax
jge 0x45f8e4
mov dword [ebp - 0x34a0], 1
jmp 0x45f8eb
and dword [ebp - 0x34a0], 0
push 2
lea ecx, [ebp - 0x40d0]
call fcn.004134d9
mov ecx, dword [ebp - 0x34a0]
cmp ecx, dword [eax]
jne 0x45f90e
mov dword [ebp - 0x34a8], 1
jmp 0x45f915
and dword [ebp - 0x34a8], 0
mov eax, dword [ebp - 0x49c]
add eax, dword [ebp - 0x34a8]
mov dword [ebp - 0x34b0], eax
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x34b0], eax
jge 0x45f941
mov dword [ebp - 0x34b8], 1
jmp 0x45f948
and dword [ebp - 0x34b8], 0
cmp dword [ebp - 0x34b8], 0xe3b9
je 0x45f960
mov dword [ebp - 0x34c0], 1
jmp 0x45f967
and dword [ebp - 0x34c0], 0
mov eax, dword [ebp - 0x34c0]
mov dword [ebp - 0x86c], eax
jmp 0x45f995
mov dword [ebp - 0x3a08], 0xc867
cmp dword [ebp - 0x3a08], 0
je 0x45f995
lea ecx, [ebp - 0x40d0]
call fcn.004134bd
jmp 0x45f9a5
lea ecx, [ebp - 0x40d0]
call fcn.004134bd
jmp 0x45f598
mov byte [ebp - 0x64d], 0
movzx eax, byte [ebp - 0x64d]
test eax, eax
je 0x45f9d0
push 0x2471
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x45f55e
mov dword [ebp - 0x140], 0xc03342eb
mov dword [ebp - 0x10c4], 0xfffffffa
mov dword [ebp - 0x34c8], 0xe76d238e
mov dword [ebp - 0x34e8], 0x8ef068cd
mov dword [ebp - 0xe0], 0xdedfc3e8
mov dword [ebp - 0xe98], 0
jmp 0x45fa20
mov eax, dword [ebp - 0xe98]
inc eax
mov dword [ebp - 0xe98], eax
cmp dword [ebp - 0xe98], 3
jge 0x45fa3c
mov eax, dword [ebp - 0xe98]
mov dword [ebp + eax*4 - 0x15d8], 0
jmp 0x45fa13
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x15d8], 0
je 0x45fb16
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x15d8], 0
je 0x45fa6a
mov dword [ebp - 0x34d0], 1
jmp 0x45fa71
and dword [ebp - 0x34d0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x15d8]
mov dword [ebp - 0x34c8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x15d8]
cmp dword [ebp - 0x34c8], eax
jle 0x45faa3
mov dword [ebp - 0x34d8], 1
jmp 0x45faaa
and dword [ebp - 0x34d8], 0
mov eax, dword [ebp - 0x34d0]
cmp eax, dword [ebp - 0x34d8]
jle 0x45fac4
mov dword [ebp - 0x34e0], 1
jmp 0x45facb
and dword [ebp - 0x34e0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x34e0]
mov dword [ebp + eax - 0x15d8], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x15d8]
mov dword [ebp - 0x34e8], eax
mov eax, dword [ebp - 0x34e8]
mov ecx, dword [ebp - 0xe0]
lea eax, [eax + ecx - 0x56a0b349]
cmp eax, 0xfc2e607d
jbe 0x45fb16
mov dword [ebp - 0x34f0], 1
jmp 0x45fb1d
and dword [ebp - 0x34f0], 0
cmp dword [ebp - 0x34f0], 0xfffb
je 0x45fb35
mov dword [ebp - 0x34f8], 1
jmp 0x45fb3c
and dword [ebp - 0x34f8], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x34f8], eax
je 0x45fb56
mov dword [ebp - 0x3500], 1
jmp 0x45fb5d
and dword [ebp - 0x3500], 0
mov eax, dword [ebp - 0x10c4]
mov dword [ebp - 0x10c4], eax
mov eax, dword [ebp - 0x10c4]
cmp eax, dword [ebp - 0x3500]
jle 0x45fb83
mov dword [ebp - 0x3508], 1
jmp 0x45fb8a
and dword [ebp - 0x3508], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x3508], eax
jle 0x45fba4
mov dword [ebp - 0x3510], 1
jmp 0x45fbab
and dword [ebp - 0x3510], 0
mov eax, dword [ebp - 0x3510]
neg eax
cmp eax, dword [ebp - 0xe0]
jg 0x45fbd3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x15d8], 0
jne 0x45fbd3
and dword [ebp - 0x3518], 0
jmp 0x45fbdd
mov dword [ebp - 0x3518], 1
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x3518], eax
jle 0x45fbf7
mov dword [ebp - 0x3520], 1
jmp 0x45fbfe
and dword [ebp - 0x3520], 0
mov eax, dword [ebp - 0x3520]
sub eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe0], 2
jmp 0x45fc29
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x45fc4e
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x15d8]
mov dword [ebp + ecx*4 - 0x15d8], eax
jmp 0x45fc1c
mov byte [ebp - 0x43a], 0
mov dword [ebp - 0x110], 0xfc07e17f
push 2
lea ecx, [ebp - 0x3598]
call fcn.004133eb
mov dword [ebp - 0x1488], 1
mov dword [ebp - 0x3560], 2
mov dword [ebp - 0x3578], 0xfffffff6
mov dword [ebp - 0x3a18], 0x46c8c5ce
mov dword [ebp - 0x58dc], 0xab136113
mov dword [ebp - 0x9e4], 0
jmp 0x45fcb7
mov eax, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x9e4], 2
jge 0x45fcd9
push dword [ebp - 0x9e4]
lea ecx, [ebp - 0x3598]
call fcn.004134d9
mov dword [eax], 0x23371247
jmp 0x45fcaa
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x52a8], eax
push 0
lea ecx, [ebp - 0x3598]
call fcn.004134d9
mov dword [eax], 0xfffffffe
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x45fd3a
push 0
lea ecx, [ebp - 0x3598]
call fcn.004134d9
cmp dword [eax], 0
je 0x45fd26
cmp dword [ebp - 0x110], 0
je 0x45fd26
mov dword [ebp - 0x3528], 1
jmp 0x45fd2d
and dword [ebp - 0x3528], 0
push 0
lea ecx, [ebp - 0x3598]
call fcn.004134d9
cmp dword [ebp - 0x110], 0xe008fb0b
jbe 0x45fd52
mov dword [ebp - 0x3548], 1
jmp 0x45fd59
and dword [ebp - 0x3548], 0
imul eax, dword [ebp - 0x3548], 0xffffffff
cmp eax, dword [ebp - 0x110]
je 0x45fd74
mov dword [ebp - 0x3a10], 1
jmp 0x45fd7b
and dword [ebp - 0x3a10], 0
push 0
lea ecx, [ebp - 0x3598]
call fcn.004134d9
cmp dword [eax], 0
je 0x45fda2
mov eax, 0x6bde64f6
test eax, eax
je 0x45fda2
mov dword [ebp - 0x3550], 1
jmp 0x45fda9
and dword [ebp - 0x3550], 0
mov eax, dword [ebp - 0x3550]
mov dword [ebp - 0x1488], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x5828], eax
cmp dword [ebp - 0x110], 1
jne 0x45fddc
cmp dword [ebp - 0x110], 0
jne 0x45fddc
and dword [ebp - 0x3558], 0
jmp 0x45fde6
mov dword [ebp - 0x3558], 1
mov eax, dword [ebp - 0x3558]
mov dword [ebp - 0x3560], eax
mov eax, dword [ebp - 0x3560]
mov dword [ebp - 0x52b0], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x58e4], eax
push 1
lea ecx, [ebp - 0x3598]
call fcn.004134d9
mov dword [ebp - 0x3568], eax
push 0
lea ecx, [ebp - 0x3598]
call fcn.004134d9
mov ecx, dword [ebp - 0x3568]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3568]
mov ecx, dword [ebp - 0x110]
imul ecx, dword [eax]
mov dword [ebp - 0x1488], ecx
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x1488], eax
jne 0x45fe63
mov dword [ebp - 0x3570], 1
jmp 0x45fe6a
and dword [ebp - 0x3570], 0
mov eax, dword [ebp - 0x110]
imul eax, dword [ebp - 0x3570]
imul eax, eax, 0x7a23
cmp eax, dword [ebp - 0x3578]
jne 0x45fe91
mov dword [ebp - 0x3580], 1
jmp 0x45fe98
and dword [ebp - 0x3580], 0
mov eax, dword [ebp - 0x3578]
cmp dword [ebp - 0x3580], eax
je 0x45feb2
mov dword [ebp - 0x3588], 1
jmp 0x45feb9
and dword [ebp - 0x3588], 0
mov eax, dword [ebp - 0x3588]
mov dword [ebp - 0x3a18], eax
lea ecx, [ebp - 0x3598]
call fcn.004134bd
movzx eax, byte [ebp - 0x43a]
test eax, eax
je 0x45ff8f
mov dword [ebp - 0x3a20], 0x1c08901f
mov dword [ebp - 0x83c], 0xffffffff
push 2
lea ecx, [ebp - 0x4c50]
call fcn.004133eb
mov dword [ebp - 0xcfc], 0
jmp 0x45ff19
mov eax, dword [ebp - 0xcfc]
inc eax
mov dword [ebp - 0xcfc], eax
cmp dword [ebp - 0xcfc], 2
jge 0x45ff38
push dword [ebp - 0xcfc]
lea ecx, [ebp - 0x4c50]
call fcn.004134d9
and dword [eax], 0
jmp 0x45ff0c
mov eax, dword [ebp - 0x3a20]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x83c], 0
jmp 0x45ff5d
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 2
jge 0x45ff7c
push dword [ebp - 0x83c]
lea ecx, [ebp - 0x4c50]
call fcn.004134d9
and dword [eax], 0
jmp 0x45ff50
lea ecx, [ebp - 0x4c50]
call fcn.004134bd
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 3
lea ecx, [ebp - 0x44e4]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x1524]
call fcn.004133eb
mov dword [ebp - 0x844], 1
mov dword [ebp - 0x378], 0
jmp 0x45ffcc
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 3
jge 0x45ffee
push dword [ebp - 0x378]
lea ecx, [ebp - 0x44e4]
call fcn.004134d9
mov dword [eax], 0xcff0
jmp 0x45ffbf
mov dword [ebp - 0x378], 0
jmp 0x460007
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 3
jge 0x460029
push dword [ebp - 0x378]
lea ecx, [ebp - 0x1524]
call fcn.004134d9
mov dword [eax], 0xd1e1e87d
jmp 0x45fffa
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
and dword [eax], 0
jmp 0x46005f
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
mov dword [ebp - 0x3720], eax
mov eax, dword [ebp - 0x3720]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3720]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
cmp dword [eax], 2
jg 0x46023b
mov dword [ebp - 0x3730], 7
mov dword [ebp - 0x3748], 0xc70ab227
mov dword [ebp - 0x362c], 0xfffffffd
push 2
lea ecx, [ebp - 0x4a40]
call fcn.004133eb
mov dword [ebp - 0x9ec], 0
jmp 0x4600b9
mov eax, dword [ebp - 0x9ec]
inc eax
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x9ec], 2
jge 0x4600db
push dword [ebp - 0x9ec]
lea ecx, [ebp - 0x4a40]
call fcn.004134d9
mov dword [eax], 1
jmp 0x4600ac
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
push dword [eax]
lea ecx, [ebp - 0x44e4]
call fcn.004134d9
cmp dword [ebp - 0x3730], 0
jne 0x460126
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
push dword [eax]
lea ecx, [ebp - 0x44e4]
call fcn.004134d9
cmp dword [eax], 0
jne 0x460126
and dword [ebp - 0x3728], 0
jmp 0x460130
mov dword [ebp - 0x3728], 1
mov eax, dword [ebp - 0x3728]
dec eax
cmp eax, dword [ebp - 0x3730]
jl 0x46014b
mov dword [ebp - 0x3738], 1
jmp 0x460152
and dword [ebp - 0x3738], 0
cmp dword [ebp - 0x3738], 1
jbe 0x460167
mov dword [ebp - 0x3740], 1
jmp 0x46016e
and dword [ebp - 0x3740], 0
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
mov ecx, dword [ebp - 0x3740]
sub ecx, dword [eax]
mov dword [ebp - 0x844], ecx
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x3748], eax
mov esi, dword [ebp - 0x3748]
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
cmp dword [eax], esi
jl 0x4601b8
mov dword [ebp - 0x3750], 1
jmp 0x4601bf
and dword [ebp - 0x3750], 0
mov eax, dword [ebp - 0x3750]
mov dword [ebp - 0x362c], eax
mov esi, dword [ebp - 0x362c]
push 0
lea ecx, [ebp - 0x1524]
call fcn.004134d9
cmp esi, dword [eax]
jg 0x4601ee
mov dword [ebp - 0x2f0c], 1
jmp 0x4601f5
and dword [ebp - 0x2f0c], 0
push 0
lea ecx, [ebp - 0x4a40]
call fcn.004134d9
mov ecx, dword [ebp - 0x2f0c]
mov dword [eax], ecx
mov byte [ebp - 0x43b], 0
movzx eax, byte [ebp - 0x43b]
test eax, eax
je 0x46022b
push 0
push 0x1e40
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x4a40]
call fcn.004134bd
jmp 0x46003b
mov dword [ebp - 0x844], 0
jmp 0x460254
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 1
je 0x460299
mov dword [ebp - 0x3a28], 0x1be360de
mov dword [ebp - 0x3a30], 0xffffffff
mov eax, dword [ebp - 0x3a28]
mov dword [ebp - 0x3a30], eax
mov byte [ebp - 0x43d], 0
movzx eax, byte [ebp - 0x43d]
test eax, eax
je 0x460297
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x460247
lea ecx, [ebp - 0x1524]
call fcn.004134bd
lea ecx, [ebp - 0x44e4]
call fcn.004134bd
mov dword [ebp - 0x140], 0
jmp 0x4602c8
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x12
je 0x46276d
mov dword [ebp - 0x52b8], 0
mov dword [ebp - 0x5838], 0x6db50520
mov dword [ebp - 0x52c0], 0x83c8fc55
mov dword [ebp - 0x58ec], 0xfffffffd
mov dword [ebp - 0x52c8], 0
mov dword [ebp - 0x5848], 0xbc370782
mov dword [ebp - 0x52d0], 0xffffffff
mov dword [ebp - 0x58f4], 0xfffffffd
mov dword [ebp - 0x52d8], 0xfffffff7
mov dword [ebp - 0x15f4], 0xfffffffa
mov byte [ebp - 0x43f], 0
movzx eax, byte [ebp - 0x43f]
test eax, eax
je 0x46035c
push 0x1381
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [ebp - 0x15f4]
dec eax
mov dword [ebp - 0x15f4], eax
mov dword [ebp - 0x2c0], 0xfffffffa
mov dword [ebp - 0x3ec], 1
mov dword [ebp - 0x1d8], 0x609c3fbb
push 3
lea ecx, [ebp - 0x5484]
call fcn.004133eb
mov dword [ebp - 0xe84], 0
jmp 0x4603ad
mov eax, dword [ebp - 0xe84]
inc eax
mov dword [ebp - 0xe84], eax
cmp dword [ebp - 0xe84], 3
jge 0x4603cf
push dword [ebp - 0xe84]
lea ecx, [ebp - 0x5484]
call fcn.004134d9
mov dword [eax], 1
jmp 0x4603a0
cmp dword [ebp - 0x3ec], 0
je 0x4603ed
cmp dword [ebp - 0x3ec], 0
je 0x4603ed
mov dword [ebp - 0x2f14], 1
jmp 0x4603f4
and dword [ebp - 0x2f14], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x2f14], eax
jg 0x46040e
mov dword [ebp - 0x15fc], 1
jmp 0x460415
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x1d8], eax
imul eax, dword [ebp - 0x1d8], 0xbb0c
imul eax, eax, 0xfffd
cmp eax, dword [ebp - 0x15fc]
jl 0x4604fe
mov dword [ebp - 0x1604], 0x13e13a6c
mov dword [ebp - 0x2f1c], 0x628405ce
mov dword [ebp - 0x9f4], 0
jmp 0x46046a
mov eax, dword [ebp - 0x9f4]
inc eax
mov dword [ebp - 0x9f4], eax
cmp dword [ebp - 0x9f4], 4
jge 0x460486
mov eax, dword [ebp - 0x9f4]
mov dword [ebp + eax*4 - 0x5e58], 0xfffffff6
jmp 0x46045d
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x5858], eax
mov eax, dword [ebp - 0x1604]
imul eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x2f1c], eax
cmp dword [ebp - 0x2f1c], 0
je 0x4604c3
mov eax, 0xffff
test eax, eax
je 0x4604c3
mov dword [ebp - 0x160c], 1
jmp 0x4604ca
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 0x1604]
mov dword [ebp - 0x2f24], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2f24]
mov dword [ebp + eax - 0x5e58], ecx
mov eax, dword [ebp - 0x2f24]
imul eax, dword [ebp - 0x160c]
mov dword [ebp - 0x1d8], eax
jmp 0x460564
mov dword [ebp - 0x1d8], 0xfffffff2
jmp 0x460517
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffed
jne 0x460564
mov dword [ebp - 0x3ec], 0
jmp 0x460539
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x14
jle 0x460562
mov byte [ebp - 0x441], 0
movzx eax, byte [ebp - 0x441]
test eax, eax
je 0x460560
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x46052c
jmp 0x46050a
lea ecx, [ebp - 0x5484]
call fcn.004134bd
mov dword [ebp - 0x43c8], 0x22263126
mov dword [ebp - 0x43c4], 0x22263126
mov dword [ebp - 0x43c0], 0x22263126
mov dword [ebp - 0x43bc], 0x22263126
mov dword [ebp - 0x870], 0xb26bdde0
mov dword [ebp - 0x870], 0xfffffffa
jmp 0x4605ba
mov eax, dword [ebp - 0x870]
dec eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 0xfffffff3
jne 0x4605ea
cmp dword [ebp - 0x870], 0
je 0x4605ce
jmp 0x4605ea
mov byte [ebp - 0x443], 0
movzx eax, byte [ebp - 0x443]
test eax, eax
je 0x4605e8
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4605ad
mov dword [ebp - 0x1b8], 0xa61928c1
mov dword [ebp - 0x1614], 8
mov dword [ebp - 0x162c], 0
mov byte [ebp - 0x445], 0
movzx eax, byte [ebp - 0x445]
test eax, eax
je 0x460629
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x1b8], 8
jmp 0x460642
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffe9
jne 0x460874
push 3
lea ecx, [ebp - 0x3894]
call fcn.004133eb
mov dword [ebp - 0x2f34], 2
mov dword [ebp - 0x2b8], 0
jmp 0x46067f
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x4606a1
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0x3894]
call fcn.004134d9
mov dword [eax], 3
jmp 0x460672
mov dword [ebp - 0x2b8], 0
jmp 0x4606ba
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x4606d6
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x5d18], 0x9281c1d9
jmp 0x4606ad
cmp dword [ebp - 0x1b8], 0
je 0x4606f4
cmp dword [ebp - 0x1614], 0
je 0x4606f4
mov dword [ebp - 0x3a38], 1
jmp 0x4606fb
and dword [ebp - 0x3a38], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x52e0], eax
mov eax, 0xd5de1fc6
test eax, eax
jne 0x46072b
push 0
lea ecx, [ebp - 0x3894]
call fcn.004134d9
cmp dword [eax], 0
jne 0x46072b
and dword [ebp - 0x2f2c], 0
jmp 0x460735
mov dword [ebp - 0x2f2c], 1
push 0
lea ecx, [ebp - 0x3894]
call fcn.004134d9
mov ecx, dword [ebp - 0x2f2c]
cmp ecx, dword [eax]
jg 0x460758
mov dword [ebp - 0x3a40], 1
jmp 0x46075f
and dword [ebp - 0x3a40], 0
mov esi, dword [ebp - 0x1614]
push 0
lea ecx, [ebp - 0x3894]
call fcn.004134d9
sub esi, dword [eax]
mov dword [ebp - 0x2f34], esi
jne 0x46078e
cmp dword [ebp - 0x1b8], 0
jne 0x46078e
and dword [ebp - 0x161c], 0
jmp 0x460798
mov dword [ebp - 0x161c], 1
cmp dword [ebp - 0x161c], 0xfffffffb
jl 0x4607ad
mov dword [ebp - 0x2f3c], 1
jmp 0x4607b4
and dword [ebp - 0x2f3c], 0
cmp dword [ebp - 0x2f3c], 0xdb5cabfc
jae 0x4607cc
mov dword [ebp - 0x1624], 1
jmp 0x4607d3
and dword [ebp - 0x1624], 0
push 0
lea ecx, [ebp - 0x3894]
call fcn.004134d9
mov ecx, dword [ebp - 0x1624]
cmp ecx, dword [eax]
jne 0x4607f6
mov dword [ebp - 0x2f44], 1
jmp 0x4607fd
and dword [ebp - 0x2f44], 0
mov eax, dword [ebp - 0x2f44]
mov dword [ebp - 0x162c], eax
mov eax, dword [ebp - 0x162c]
add eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x1b8]
jg 0x460829
mov dword [ebp - 0x2f4c], 1
jmp 0x460830
and dword [ebp - 0x2f4c], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x2f4c], eax
je 0x46084a
mov dword [ebp - 0x1634], 1
jmp 0x460851
and dword [ebp - 0x1634], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1634]
mov dword [ebp + eax - 0x5d18], ecx
lea ecx, [ebp - 0x3894]
call fcn.004134bd
jmp 0x460635
mov dword [ebp - 0xd04], 0
jmp 0x46088d
mov eax, dword [ebp - 0xd04]
inc eax
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0xd04], 3
jge 0x4608a9
mov eax, dword [ebp - 0xd04]
mov dword [ebp + eax*4 - 0x5d30], 0
jmp 0x460880
mov dword [ebp - 0x10cc], 9
push 2
lea ecx, [ebp - 0x4b60]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x44fc]
call fcn.004133eb
mov dword [ebp - 0x2f6c], 0
mov dword [ebp - 0x1e0], 0
jmp 0x4608f0
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x460912
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x4b60]
call fcn.004134d9
mov dword [eax], 0x14c405b4
jmp 0x4608e3
mov dword [ebp - 0x1e0], 0
jmp 0x46092b
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x46094d
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x44fc]
call fcn.004134d9
mov dword [eax], 0xdcba
jmp 0x46091e
cmp dword [ebp - 0x10cc], 0
je 0x460975
mov byte [ebp - 0x447], 0
movzx eax, byte [ebp - 0x447]
test eax, eax
je 0x460970
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x460b06
mov dword [ebp - 0x1644], 0x61f66568
mov dword [ebp - 0x13d4], 1
mov dword [ebp - 0x2f5c], 0xfffffffb
mov dword [ebp - 0x9fc], 0
jmp 0x4609ac
mov eax, dword [ebp - 0x9fc]
inc eax
mov dword [ebp - 0x9fc], eax
cmp dword [ebp - 0x9fc], 1
jge 0x4609c8
mov eax, dword [ebp - 0x9fc]
mov dword [ebp + eax*4 - 0x12cc], 1
jmp 0x46099f
push 0
lea ecx, [ebp - 0x44fc]
call fcn.004134d9
mov dword [ebp - 0x2f54], eax
mov eax, dword [ebp - 0x2f54]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2f54]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10cc]
mov dword [ebp - 0x58fc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12cc], 0
je 0x460a49
cmp dword [ebp - 0x1644], 0
je 0x460a2c
push 1
lea ecx, [ebp - 0x4b60]
call fcn.004134d9
cmp dword [eax], 0
jne 0x460a2c
and dword [ebp - 0x163c], 0
jmp 0x460a36
mov dword [ebp - 0x163c], 1
mov eax, dword [ebp - 0x163c]
mov dword [ebp - 0x2f5c], eax
cmp dword [ebp - 0x2f5c], 0
mov esi, dword [ebp - 0x1644]
push 0
lea ecx, [ebp - 0x44fc]
call fcn.004134d9
cmp esi, dword [eax]
jge 0x460a6c
mov dword [ebp - 0x2f64], 1
jmp 0x460a73
and dword [ebp - 0x2f64], 0
mov eax, dword [ebp - 0x13d4]
cmp eax, dword [ebp - 0x2f64]
jge 0x460a8d
mov dword [ebp - 0x3a48], 1
jmp 0x460a94
and dword [ebp - 0x3a48], 0
cmp dword [ebp - 0x10cc], 0
je 0x460ab2
mov eax, 0xa5b04204
test eax, eax
je 0x460ab2
mov dword [ebp - 0x164c], 1
jmp 0x460ab9
and dword [ebp - 0x164c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12cc]
cmp dword [ebp - 0x164c], eax
jge 0x460ada
mov dword [ebp - 0x10d4], 1
jmp 0x460ae1
and dword [ebp - 0x10d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10d4]
mov dword [ebp + eax - 0x12cc], ecx
mov eax, dword [ebp - 0x10d4]
sub eax, dword [ebp - 0x13d4]
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x2f6c]
inc eax
mov dword [ebp - 0x2f6c], eax
lea ecx, [ebp - 0x44fc]
call fcn.004134bd
lea ecx, [ebp - 0x4b60]
call fcn.004134bd
mov dword [ebp - 0x2c0], 9
jmp 0x460b42
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xffffffe2
jne 0x461256
mov dword [ebp - 0x30], 0xf82d83d7
mov dword [ebp - 0x4a4], 0xd5467356
mov dword [ebp - 0x4ac], 0xffffffff
mov dword [ebp - 0x58], 0
jmp 0x460b7a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x460b90
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x14cc], 0xffffffff
jmp 0x460b73
mov dword [ebp - 0x58], 0
jmp 0x460ba0
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x460bb6
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x46ac], 0xffffffff
jmp 0x460b99
mov dword [ebp - 0x58], 0
jmp 0x460bc6
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x460bdc
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x4cd4], 0x76fbfcc0
jmp 0x460bbf
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x14cc], 0
je 0x460dd4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14cc], 0
jne 0x460c6f
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x14cc], 0
jne 0x460c1f
cmp dword [ebp - 0x30], 0
jne 0x460c1f
and dword [ebp - 0x1654], 0
jmp 0x460c29
mov dword [ebp - 0x1654], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x14cc]
cmp dword [ebp - 0x1654], eax
jle 0x460c4a
mov dword [ebp - 0x2f74], 1
jmp 0x460c51
and dword [ebp - 0x2f74], 0
mov eax, dword [ebp - 0x2f74]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0
jne 0x460c6f
and dword [ebp - 0x10dc], 0
jmp 0x460c79
mov dword [ebp - 0x10dc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10dc]
mov dword [ebp + eax - 0x46ac], ecx
mov eax, dword [ebp - 0x10dc]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x14cc]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x14cc]
je 0x460cc6
mov dword [ebp - 0x165c], 1
jmp 0x460ccd
and dword [ebp - 0x165c], 0
cmp dword [ebp - 0x165c], 0x6c0b
je 0x460ce5
mov dword [ebp - 0x2f7c], 1
jmp 0x460cec
and dword [ebp - 0x2f7c], 0
cmp dword [ebp - 0x2f7c], 0x3ee6
jne 0x460d04
mov dword [ebp - 0x1664], 1
jmp 0x460d0b
and dword [ebp - 0x1664], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1664]
sub ecx, dword [ebp + eax - 0x14cc]
mov dword [ebp - 0x2f84], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2f84]
mov dword [ebp + eax - 0x4cd4], ecx
mov eax, dword [ebp - 0x2f84]
add eax, 0x279e56
push 4
pop ecx
imul ecx, ecx, 3
cmp dword [ebp + ecx - 0x14cc], eax
jle 0x460d5d
mov dword [ebp - 0x166c], 1
jmp 0x460d64
and dword [ebp - 0x166c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x166c], eax
jge 0x460d7b
mov dword [ebp - 0x2f8c], 1
jmp 0x460d82
and dword [ebp - 0x2f8c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2f8c]
je 0x460d99
mov dword [ebp - 0x3a50], 1
jmp 0x460da0
and dword [ebp - 0x3a50], 0
mov eax, 0x6899
cmp eax, 1
jl 0x460db6
mov dword [ebp - 0x1674], 1
jmp 0x460dbd
and dword [ebp - 0x1674], 0
mov eax, dword [ebp - 0x1674]
sub eax, 7
je 0x460dd4
mov dword [ebp - 0x2f94], 1
jmp 0x460ddb
and dword [ebp - 0x2f94], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x14cc]
imul eax, dword [ebp - 0x2f94]
cmp eax, dword [ebp - 0x30]
jle 0x460dff
mov dword [ebp - 0x167c], 1
jmp 0x460e06
and dword [ebp - 0x167c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x167c]
mov dword [ebp + eax - 0x14cc], ecx
mov dword [ebp - 0x30], 0
jmp 0x460e29
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x46108b
mov dword [ebp - 0xfc4], 0x57e8f534
mov dword [ebp - 0x4ac], 3
jmp 0x460e56
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jl 0x461086
mov dword [ebp - 0x4b4], 0x5375bb79
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x14cc], 0
je 0x461046
mov dword [ebp - 0x2fac], 0xa8b036c8
mov dword [ebp - 0x4a4], 0
jmp 0x460ea1
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 3
jg 0x461044
mov eax, dword [ebp - 0xfc4]
neg eax
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ebp + ecx*4 - 0x46ac]
je 0x460ece
mov dword [ebp - 0x12d4], 1
jmp 0x460ed5
and dword [ebp - 0x12d4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x12d4]
mov dword [ebp + eax*4 - 0x14cc], ecx
cmp dword [ebp - 0x12d4], 0xfffffffb
jae 0x460efa
mov dword [ebp - 0x2f9c], 1
jmp 0x460f01
and dword [ebp - 0x2f9c], 0
mov eax, dword [ebp - 0xfc4]
cmp dword [ebp - 0x2f9c], eax
jl 0x460f1b
mov dword [ebp - 0x1684], 1
jmp 0x460f22
and dword [ebp - 0x1684], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x46ac]
sub eax, dword [ebp - 0x1684]
cmp eax, 0x6604
jge 0x460f45
mov dword [ebp - 0x3a58], 1
jmp 0x460f4c
and dword [ebp - 0x3a58], 0
mov eax, dword [ebp - 0x2fac]
mov dword [ebp - 0x52e8], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x5868], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x52f0], eax
mov eax, dword [ebp - 0xfc4]
mov dword [ebp - 0x5904], eax
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp + eax*4 - 0x4cd4], 0x14c7c747
jne 0x460f9b
mov dword [ebp - 0x2fa4], 1
jmp 0x460fa2
and dword [ebp - 0x2fa4], 0
cmp dword [ebp - 0x2fa4], 0xffffffff
jae 0x460fb7
mov dword [ebp - 0x10e4], 1
jmp 0x460fbe
and dword [ebp - 0x10e4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10e4]
mov dword [ebp + eax*4 - 0x4cd4], ecx
cmp dword [ebp - 0x10e4], 0
jne 0x460fed
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x14cc], 0
jne 0x460fed
and dword [ebp - 0x168c], 0
jmp 0x460ff7
mov dword [ebp - 0x168c], 1
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x168c]
sub ecx, dword [ebp + eax*4 - 0x46ac]
sub ecx, dword [ebp - 0xfc4]
imul ecx, dword [ebp - 0x4b4]
cmp ecx, dword [ebp - 0x2fac]
jle 0x461028
mov dword [ebp - 0x1694], 1
jmp 0x46102f
and dword [ebp - 0x1694], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1694]
mov dword [ebp + eax*4 - 0x46ac], ecx
jmp 0x460e94
jmp 0x461081
mov dword [ebp - 0x4b4], 3
jmp 0x46105f
mov eax, dword [ebp - 0x4b4]
dec eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0
jl 0x461081
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x4b4]
mov eax, dword [ebp + eax*4 - 0x4cd4]
mov dword [ebp + ecx*4 - 0x14cc], eax
jmp 0x461052
jmp 0x460e49
jmp 0x460e22
mov dword [ebp - 0x4948], 0xfffffffd
mov dword [ebp - 0x4944], 0xfffffffd
mov dword [ebp - 0x4940], 0xfffffffd
mov dword [ebp - 0x493c], 0xfffffffd
lea ecx, [ebp - 0x1421]
call fcn.004134e8
push eax
lea eax, [ebp - 0x4938]
push eax
lea eax, [ebp - 0x4948]
push eax
lea ecx, [ebp - 0x5d68]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x40e0]
call fcn.00413497
mov dword [ebp - 0x7f0], 0x184c506d
mov dword [ebp - 0x3a60], 0
mov dword [ebp - 0x7f0], 3
jmp 0x461115
mov eax, dword [ebp - 0x7f0]
dec eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 0
jl 0x461220
mov dword [ebp - 0x958], 0xfffffffb
mov dword [ebp - 0x958], 0
jmp 0x461145
mov eax, dword [ebp - 0x958]
inc eax
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x958], 3
jg 0x46121b
push dword [ebp - 0x7f0]
lea ecx, [ebp - 0x40e0]
call fcn.004134d9
cmp dword [eax], 0
jne 0x461190
push 0
lea ecx, [ebp - 0x40e0]
call fcn.004134d9
push 3
lea ecx, [ebp - 0x40e0]
call fcn.004134d9
cmp dword [eax], 0xffffffff
jl 0x461190
and dword [ebp - 0x2fb4], 0
jmp 0x46119a
mov dword [ebp - 0x2fb4], 1
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0x2fb4], eax
jle 0x4611b4
mov dword [ebp - 0x169c], 1
jmp 0x4611bb
and dword [ebp - 0x169c], 0
cmp dword [ebp - 0x169c], 0x8659
je 0x4611e6
push dword [ebp - 0x7f0]
lea ecx, [ebp - 0x40e0]
call fcn.004134d9
cmp dword [eax], 0
jne 0x4611e6
and dword [ebp - 0x2fbc], 0
jmp 0x4611f0
mov dword [ebp - 0x2fbc], 1
mov eax, dword [ebp - 0x2fbc]
mov dword [ebp - 0x3a60], eax
mov byte [ebp - 0x449], 0
movzx eax, byte [ebp - 0x449]
test eax, eax
je 0x461216
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x461138
jmp 0x461108
lea ecx, [ebp - 0x40e0]
call fcn.004134bd
mov byte [ebp - 0x44b], 0
movzx eax, byte [ebp - 0x44b]
test eax, eax
je 0x461251
push 0
push 0x1965
push 0
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x460b35
mov dword [ebp - 0x3a4], 0xffffffff
mov dword [ebp - 0x47b8], 0xc700
mov dword [ebp - 0x47b4], 0xc700
mov dword [ebp - 0x47b0], 0xc700
mov dword [ebp - 0x47ac], 0xc700
lea ecx, [ebp - 0x14a9]
call fcn.004134e8
push eax
lea eax, [ebp - 0x47a8]
push eax
lea eax, [ebp - 0x47b8]
push eax
lea ecx, [ebp - 0x5ec0]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4514]
call fcn.00413497
mov dword [ebp - 0x3a68], 0xffffffff
mov dword [ebp - 0x6f8], 1
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x3a4], eax
jne 0x4612eb
mov dword [ebp - 0x2fdc], 1
jmp 0x4612f2
and dword [ebp - 0x2fdc], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x52f8], eax
cmp dword [ebp - 0x3a4], 0xe19e95d1
jbe 0x46131f
cmp dword [ebp - 0x3a4], 0
je 0x46131f
mov dword [ebp - 0x16a4], 1
jmp 0x461326
and dword [ebp - 0x16a4], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x16a4], eax
jg 0x461340
mov dword [ebp - 0x2fc4], 1
jmp 0x461347
and dword [ebp - 0x2fc4], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x2fc4], eax
jl 0x461361
mov dword [ebp - 0x16ac], 1
jmp 0x461368
and dword [ebp - 0x16ac], 0
push 1
lea ecx, [ebp - 0x4514]
call fcn.004134d9
mov ecx, dword [ebp - 0x16ac]
cmp ecx, dword [eax]
jle 0x46138b
mov dword [ebp - 0x2fcc], 1
jmp 0x461392
and dword [ebp - 0x2fcc], 0
cmp dword [ebp - 0x2fcc], 0x6d21
jge 0x4613bc
push 1
lea ecx, [ebp - 0x4514]
call fcn.004134d9
cmp dword [eax], 0
je 0x4613bc
mov dword [ebp - 0x16b4], 1
jmp 0x4613c3
and dword [ebp - 0x16b4], 0
cmp dword [ebp - 0x16b4], 8
je 0x4613d8
mov dword [ebp - 0x2fd4], 1
jmp 0x4613df
and dword [ebp - 0x2fd4], 0
mov eax, dword [ebp - 0x3a68]
cmp dword [ebp - 0x2fd4], eax
jg 0x4613f9
mov dword [ebp - 0x16bc], 1
jmp 0x461400
and dword [ebp - 0x16bc], 0
mov eax, dword [ebp - 0x16bc]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x3a4]
imul eax, dword [ebp - 0x2fdc]
cmp eax, dword [ebp - 0x6f8]
je 0x46142d
mov dword [ebp - 0x16c4], 1
jmp 0x461434
and dword [ebp - 0x16c4], 0
push 1
lea ecx, [ebp - 0x4514]
call fcn.004134d9
mov ecx, dword [ebp - 0x16c4]
sub ecx, dword [eax]
je 0x461492
mov dword [ebp - 0x6f8], 0
jmp 0x461464
mov eax, dword [ebp - 0x6f8]
dec eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0xfffffff6
jne 0x461490
mov byte [ebp - 0x44d], 0
movzx eax, byte [ebp - 0x44d]
test eax, eax
je 0x46148e
push 0x23ad
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x461457
jmp 0x4614cc
mov byte [ebp - 0x44f], 0
movzx eax, byte [ebp - 0x44f]
test eax, eax
je 0x4614cc
push 0
push 0x8cf
push 0x2496
push 0x742
push 0x150e
push 0x6ed
push 0x53c
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 0x4514]
call fcn.004134bd
mov dword [ebp - 0x2c0], 3
jmp 0x4614f0
cmp dword [ebp - 0x2c0], 0
jl 0x462768
push 2
lea ecx, [ebp - 0x4100]
call fcn.004133eb
mov dword [ebp - 0x3dd8], 0xd1d9d65f
mov dword [ebp - 0x10ec], 1
push 3
lea ecx, [ebp - 0x1034]
call fcn.004133eb
mov dword [ebp - 0x1420], 0xd7d2
mov dword [ebp - 0x3004], 0xfffffffe
push 1
lea ecx, [ebp - 0x40f0]
call fcn.004133eb
mov dword [ebp - 0x300c], 0x21c760fc
mov dword [ebp - 0x3014], 0xd777
mov dword [ebp - 0x90], 0
jmp 0x461579
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x46159b
push dword [ebp - 0x90]
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov dword [eax], 0x5934215e
jmp 0x46156c
mov dword [ebp - 0x90], 0
jmp 0x4615b4
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x4615d0
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x3a74], 0x69376522
jmp 0x4615a7
mov dword [ebp - 0x90], 0
jmp 0x4615e9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x46160b
push dword [ebp - 0x90]
lea ecx, [ebp - 0x40f0]
call fcn.004134d9
mov dword [eax], 0xae5685e9
jmp 0x4615dc
mov eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x5878], eax
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov eax, dword [ebp - 0x1420]
mov dword [ebp - 0x5300], eax
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov esi, eax
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x10ec]
jne 0x461664
mov dword [ebp - 0x2fe4], 1
jmp 0x46166b
and dword [ebp - 0x2fe4], 0
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov ecx, dword [ebp - 0x2fe4]
cmp ecx, dword [eax]
jne 0x46168e
mov dword [ebp - 0x16cc], 1
jmp 0x461695
and dword [ebp - 0x16cc], 0
mov eax, dword [ebp - 0x16cc]
dec eax
je 0x4616b3
cmp dword [ebp - 0x1420], 0
je 0x4616b3
mov dword [ebp - 0x2fec], 1
jmp 0x4616ba
and dword [ebp - 0x2fec], 0
mov eax, dword [ebp - 0x1420]
cmp dword [ebp - 0x2fec], eax
je 0x4616d4
mov dword [ebp - 0x16d4], 1
jmp 0x4616db
and dword [ebp - 0x16d4], 0
push 2
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov ecx, dword [ebp - 0x16d4]
add ecx, dword [eax]
neg ecx
mov dword [ebp - 0x2ff4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ff4]
mov dword [ebp + eax - 0x3a74], ecx
cmp dword [ebp - 0x2ff4], 0xfffffffa
jg 0x461720
mov dword [ebp - 0x16dc], 1
jmp 0x461727
and dword [ebp - 0x16dc], 0
mov esi, dword [ebp - 0x16dc]
neg esi
push 2
lea ecx, [ebp - 0x1034]
call fcn.004134d9
cmp esi, dword [eax]
jl 0x461759
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a74], 0
jne 0x461759
and dword [ebp - 0x2ffc], 0
jmp 0x461763
mov dword [ebp - 0x2ffc], 1
cmp dword [ebp - 0x2ffc], 0xffffffff
je 0x461778
mov dword [ebp - 0x16e4], 1
jmp 0x46177f
and dword [ebp - 0x16e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a74]
mov dword [ebp - 0x3004], eax
mov eax, dword [ebp - 0x10ec]
cmp dword [ebp - 0x3004], eax
jl 0x4617ac
mov dword [ebp - 0x16ec], 1
jmp 0x4617b3
and dword [ebp - 0x16ec], 0
push 0
lea ecx, [ebp - 0x40f0]
call fcn.004134d9
mov ecx, dword [ebp - 0x16ec]
sub ecx, dword [eax]
mov dword [ebp - 0x300c], ecx
mov esi, dword [ebp - 0x300c]
push 0
lea ecx, [ebp - 0x40f0]
call fcn.004134d9
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x40f0]
call fcn.004134d9
cmp esi, dword [eax]
jge 0x461807
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x461807
mov dword [ebp - 0x16f4], 1
jmp 0x46180e
and dword [ebp - 0x16f4], 0
mov eax, dword [ebp - 0x16f4]
mov dword [ebp - 0x3014], eax
mov esi, dword [ebp - 0x3014]
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
cmp dword [eax], esi
je 0x46183d
mov dword [ebp - 0x16fc], 1
jmp 0x461844
and dword [ebp - 0x16fc], 0
imul esi, dword [ebp - 0x16fc], 0x6ea1
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
cmp esi, dword [eax]
je 0x46187b
mov dword [ebp - 0x301c], 1
jmp 0x461882
and dword [ebp - 0x301c], 0
push 1
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov esi, dword [ebp - 0x301c]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1034]
call fcn.004134d9
mov dword [eax], esi
lea ecx, [ebp - 0x40f0]
call fcn.004134bd
lea ecx, [ebp - 0x1034]
call fcn.004134bd
mov dword [ebp - 0xa04], 0
jmp 0x4618d5
mov eax, dword [ebp - 0xa04]
inc eax
mov dword [ebp - 0xa04], eax
cmp dword [ebp - 0xa04], 2
jge 0x4618f7
push dword [ebp - 0xa04]
lea ecx, [ebp - 0x4100]
call fcn.004134d9
mov dword [eax], 0xa5f27a41
jmp 0x4618c8
mov dword [ebp - 0x7a0], 0x862f
mov dword [ebp - 0x10f4], 0x5300ce3
mov dword [ebp - 0x3db0], 0xe26b5cfd
mov dword [ebp - 0x3dd0], 0x5c7e4ddb
mov dword [ebp - 0x3dc8], 0x255bb5fb
mov dword [ebp - 0x590c], 0x1b09c821
mov dword [ebp - 0x5358], 0x2da3bb1d
mov dword [ebp - 0x5b40], 1
mov dword [ebp - 0x3dc0], 0xfffffffb
push 3
lea ecx, [ebp - 0x4a58]
call fcn.004133eb
mov dword [ebp - 0x3db8], 0xfffffffa
mov dword [ebp - 0xd0c], 0
jmp 0x461981
mov eax, dword [ebp - 0xd0c]
inc eax
mov dword [ebp - 0xd0c], eax
cmp dword [ebp - 0xd0c], 3
jge 0x4619a3
push dword [ebp - 0xd0c]
lea ecx, [ebp - 0x4a58]
call fcn.004134d9
mov dword [eax], 0xfffffff9
jmp 0x461974
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x7a0], 0
jmp 0x4619c9
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 0x3a
jg 0x461d8c
mov dword [ebp - 0x878], 0x70ade21
push 3
lea ecx, [ebp - 0x35a8]
call fcn.004133eb
push 1
lea ecx, [ebp - 0x452c]
call fcn.004133eb
mov dword [ebp - 0x12dc], 0xe219
mov dword [ebp - 0x303c], 0xc710
mov dword [ebp - 0x328], 0
jmp 0x461a27
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x461a49
push dword [ebp - 0x328]
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
mov dword [eax], 0x367f
jmp 0x461a1a
mov dword [ebp - 0x328], 0
jmp 0x461a62
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x461a84
push dword [ebp - 0x328]
lea ecx, [ebp - 0x452c]
call fcn.004134d9
mov dword [eax], 0x21b78cd9
jmp 0x461a55
mov dword [ebp - 0x878], 0xfffffff9
jmp 0x461a9d
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 5
jne 0x461c22
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e8], 2
jmp 0x461acd
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x461c1d
mov byte [ebp - 0x451], 0
movzx eax, byte [ebp - 0x451]
test eax, eax
je 0x461b07
push 0x167e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x5360], eax
mov eax, 0x50bb
test eax, eax
jl 0x461b28
mov dword [ebp - 0x3da0], 1
jmp 0x461b2f
and dword [ebp - 0x3da0], 0
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
push 2
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
mov esi, dword [eax]
neg esi
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
sub esi, dword [eax]
jne 0x461b81
push 1
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
cmp dword [eax], 0
jne 0x461b81
and dword [ebp - 0x1704], 0
jmp 0x461b8b
mov dword [ebp - 0x1704], 1
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
mov eax, dword [eax]
add eax, dword [ebp - 0x1704]
cmp eax, 0xc75d
jge 0x461bb7
mov dword [ebp - 0x3da8], 1
jmp 0x461bbe
and dword [ebp - 0x3da8], 0
cmp dword [ebp - 0x10f4], 0
je 0x461be6
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x35a8]
call fcn.004134d9
cmp dword [eax], 0
jne 0x461be6
and dword [ebp - 0x3024], 0
jmp 0x461bf0
mov dword [ebp - 0x3024], 1
cmp dword [ebp - 0x3024], 0xfffffffd
jge 0x461c05
mov dword [ebp - 0x170c], 1
jmp 0x461c0c
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x170c]
mov dword [ebp - 0x3db0], eax
jmp 0x461ac0
jmp 0x461a90
mov eax, dword [ebp - 0x12dc]
dec eax
mov dword [ebp - 0x12dc], eax
je 0x461c67
cmp dword [ebp - 0x3db8], 3
jg 0x461c46
mov dword [ebp - 0x302c], 1
jmp 0x461c4d
and dword [ebp - 0x302c], 0
mov eax, dword [ebp - 0x3dc0]
cmp dword [ebp - 0x302c], eax
jl 0x461c67
mov dword [ebp - 0x1714], 1
jmp 0x461c6e
and dword [ebp - 0x1714], 0
mov eax, dword [ebp - 0x3dc8]
add eax, dword [ebp - 0x1714]
cmp eax, dword [ebp - 0x878]
jg 0x461c8e
mov dword [ebp - 0x3034], 1
jmp 0x461c95
and dword [ebp - 0x3034], 0
mov eax, dword [ebp - 0x10f4]
cmp eax, dword [ebp - 0x3034]
jl 0x461caf
mov dword [ebp - 0x171c], 1
jmp 0x461cb6
and dword [ebp - 0x171c], 0
mov eax, dword [ebp - 0x171c]
mov dword [ebp - 0x303c], eax
cmp dword [ebp - 0x303c], 1
jne 0x461cd7
mov dword [ebp - 0x1724], 1
jmp 0x461cde
and dword [ebp - 0x1724], 0
mov eax, dword [ebp - 0x10f4]
cmp eax, dword [ebp - 0x1724]
jne 0x461cf8
mov dword [ebp - 0x3044], 1
jmp 0x461cff
and dword [ebp - 0x3044], 0
mov eax, dword [ebp - 0x3dd0]
cmp dword [ebp - 0x3044], eax
jl 0x461d19
mov dword [ebp - 0x172c], 1
jmp 0x461d20
and dword [ebp - 0x172c], 0
push 0
lea ecx, [ebp - 0x452c]
call fcn.004134d9
mov ecx, dword [ebp - 0x172c]
sub ecx, dword [eax]
cmp ecx, 1
jge 0x461d46
mov dword [ebp - 0x304c], 1
jmp 0x461d4d
and dword [ebp - 0x304c], 0
push 0
lea ecx, [ebp - 0x452c]
call fcn.004134d9
mov esi, dword [ebp - 0x304c]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x4a58]
call fcn.004134d9
mov dword [eax], esi
lea ecx, [ebp - 0x452c]
call fcn.004134bd
lea ecx, [ebp - 0x35a8]
call fcn.004134bd
jmp 0x4619bc
lea ecx, [ebp - 0x4a58]
call fcn.004134bd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x43c8], 0
je 0x461e65
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x58e0], eax
push 0xfffffffffffffff7
pop eax
cmp eax, 0x4d25
je 0x461dcd
mov dword [ebp - 0x1734], 1
jmp 0x461dd4
and dword [ebp - 0x1734], 0
imul eax, dword [ebp - 0x1734], 0x6d06
cmp eax, dword [ebp - 0x2c0]
jne 0x461df2
mov dword [ebp - 0x3054], 1
jmp 0x461df9
and dword [ebp - 0x3054], 0
imul eax, dword [ebp - 0x3054], 0x5bf7
dec eax
je 0x461e1b
mov eax, 0x4353ea3a
test eax, eax
je 0x461e1b
mov dword [ebp - 0x173c], 1
jmp 0x461e22
and dword [ebp - 0x173c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x173c], eax
jge 0x461e3c
mov dword [ebp - 0x305c], 1
jmp 0x461e43
and dword [ebp - 0x305c], 0
push 1
lea ecx, [ebp - 0x4100]
call fcn.004134d9
mov eax, dword [eax]
sub eax, dword [ebp - 0x305c]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x43c8]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43c8]
mov dword [ebp - 0x5368], eax
push 1
lea ecx, [ebp - 0x4100]
call fcn.004134d9
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x5a5c], eax
mov eax, 0x1177
test eax, eax
jne 0x461eab
cmp dword [ebp - 0x140], 0
jne 0x461eab
and dword [ebp - 0x1744], 0
jmp 0x461eb5
mov dword [ebp - 0x1744], 1
push 0
lea ecx, [ebp - 0x4100]
call fcn.004134d9
mov ecx, dword [ebp - 0x1744]
mov dword [eax], ecx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x5370], eax
mov eax, dword [ebp - 0x3dd8]
cmp dword [ebp - 0x140], eax
jle 0x461ef0
mov dword [ebp - 0x3064], 1
jmp 0x461ef7
and dword [ebp - 0x3064], 0
cmp dword [ebp - 0x3064], 0x7d900d29
jge 0x461f0f
mov dword [ebp - 0x3de0], 1
jmp 0x461f16
and dword [ebp - 0x3de0], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x58e8], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5d30], 1
mov dword [ebp - 0xd4], 0x90ac204e
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x3e18], 0x584e
mov dword [ebp - 0x3e20], 0x3f04e266
mov dword [ebp - 0xd4], 0x13
jmp 0x461f74
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe9
jg 0x46216b
mov dword [ebp - 0x910], 0xf390197f
mov dword [ebp - 0xa0c], 0
jmp 0x461fa4
mov eax, dword [ebp - 0xa0c]
inc eax
mov dword [ebp - 0xa0c], eax
cmp dword [ebp - 0xa0c], 1
jge 0x461fc0
mov eax, dword [ebp - 0xa0c]
mov dword [ebp + eax*4 - 0x13dc], 0xffffffff
jmp 0x461f97
mov dword [ebp - 0x910], 0
jmp 0x461fd9
mov eax, dword [ebp - 0x910]
dec eax
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0
jl 0x462166
mov dword [ebp - 0x1f0], 0xffffffff
mov dword [ebp - 0x3df0], 1
mov dword [ebp - 0x1f0], 0
jmp 0x462013
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jg 0x462161
mov dword [ebp - 0x3de8], 0x2b90f998
mov byte [ebp - 0x453], 0
movzx eax, byte [ebp - 0x453]
test eax, eax
je 0x462058
push 0x1be
push 0x1d1f
push 0x521
push 0xa39
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x1f0], eax
jne 0x462072
mov dword [ebp - 0x174c], 1
jmp 0x462079
and dword [ebp - 0x174c], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp + eax*4 - 0x13dc], 0x1e01
jle 0x462098
mov dword [ebp - 0x306c], 1
jmp 0x46209f
and dword [ebp - 0x306c], 0
mov eax, dword [ebp - 0x174c]
cmp eax, dword [ebp - 0x306c]
jl 0x4620b9
mov dword [ebp - 0x1754], 1
jmp 0x4620c0
and dword [ebp - 0x1754], 0
mov eax, dword [ebp - 0x1754]
mov dword [ebp - 0x3de8], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x5378], eax
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x13dc], ecx
jg 0x4620f9
mov dword [ebp - 0x3074], 1
jmp 0x462100
and dword [ebp - 0x3074], 0
mov eax, dword [ebp - 0x3074]
add eax, 0x8f01
cmp eax, 0xfffffff7
jl 0x46211c
mov dword [ebp - 0x175c], 1
jmp 0x462123
and dword [ebp - 0x175c], 0
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp + eax*4 - 0x13dc]
add eax, dword [ebp - 0x175c]
cmp eax, 0xdd2cc910
jne 0x462149
mov dword [ebp - 0x307c], 1
jmp 0x462150
and dword [ebp - 0x307c], 0
mov eax, dword [ebp - 0x307c]
mov dword [ebp - 0x3df0], eax
jmp 0x462006
jmp 0x461fcc
jmp 0x461f67
cmp dword [ebp - 0xd4], 0
jne 0x462199
cmp dword [ebp - 0xd4], 0
jne 0x462199
mov eax, 0x1ac8
sub eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd4], eax
jne 0x462199
and dword [ebp - 0x3df8], 0
jmp 0x4621a3
mov dword [ebp - 0x3df8], 1
cmp dword [ebp - 0xd4], 0
jne 0x4621b8
mov dword [ebp - 0x1764], 1
jmp 0x4621bf
and dword [ebp - 0x1764], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x1764], eax
jne 0x4621d9
mov dword [ebp - 0x3e00], 1
jmp 0x4621e0
and dword [ebp - 0x3e00], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x5b98], eax
mov eax, 0xc37f20ba
test eax, eax
jne 0x462207
cmp dword [ebp - 0x180], 0
jne 0x462207
and dword [ebp - 0x3084], 0
jmp 0x462211
mov dword [ebp - 0x3084], 1
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x3084], eax
jle 0x462232
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x462232
mov dword [ebp - 0x176c], 1
jmp 0x462239
and dword [ebp - 0x176c], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x176c], eax
jg 0x462253
mov dword [ebp - 0x3e08], 1
jmp 0x46225a
and dword [ebp - 0x3e08], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x5380], eax
xor eax, eax
inc eax
je 0x462280
cmp dword [ebp - 0xd4], 0
je 0x462280
mov dword [ebp - 0x308c], 1
jmp 0x462287
and dword [ebp - 0x308c], 0
cmp dword [ebp - 0x308c], 0xb218
jl 0x46229f
mov dword [ebp - 0x1774], 1
jmp 0x4622a6
and dword [ebp - 0x1774], 0
cmp dword [ebp - 0x1774], 0xfffffffa
jle 0x4622bb
mov dword [ebp - 0x3094], 1
jmp 0x4622c2
and dword [ebp - 0x3094], 0
cmp dword [ebp - 0x3094], 0xfffffffe
jge 0x4622d7
mov dword [ebp - 0x177c], 1
jmp 0x4622de
and dword [ebp - 0x177c], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x177c], eax
jl 0x4622f8
mov dword [ebp - 0x3e10], 1
jmp 0x4622ff
and dword [ebp - 0x3e10], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0xd4], eax
je 0x462319
mov dword [ebp - 0x309c], 1
jmp 0x462320
and dword [ebp - 0x309c], 0
mov eax, dword [ebp - 0x3e18]
cmp dword [ebp - 0x309c], eax
jg 0x46233a
mov dword [ebp - 0x1784], 1
jmp 0x462341
and dword [ebp - 0x1784], 0
mov eax, dword [ebp - 0x1784]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x3e20], eax
mov dword [ebp - 0x48d0], 9
mov dword [ebp - 0x48cc], 9
mov dword [ebp - 0x48c8], 9
mov dword [ebp - 0x48c4], 9
lea ecx, [ebp - 0x1419]
call fcn.004134e8
push eax
lea eax, [ebp - 0x48c0]
push eax
lea eax, [ebp - 0x48d0]
push eax
lea ecx, [ebp - 0x5e38]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5494]
call fcn.00413497
mov dword [ebp - 0x880], 0xffffffff
mov dword [ebp - 0x3e28], 1
push 3
lea ecx, [ebp - 0x4bf0]
call fcn.004133eb
mov dword [ebp - 0xe8c], 0
jmp 0x4623f0
mov eax, dword [ebp - 0xe8c]
inc eax
mov dword [ebp - 0xe8c], eax
cmp dword [ebp - 0xe8c], 3
jge 0x462412
push dword [ebp - 0xe8c]
lea ecx, [ebp - 0x4bf0]
call fcn.004134d9
mov dword [eax], 0xfffffff6
jmp 0x4623e3
mov dword [ebp - 0x880], 3
jmp 0x46242b
cmp dword [ebp - 0x880], 0
jl 0x46245c
jmp 0x4602bb
mov dword [ebp - 0x3e30], 1
mov dword [ebp - 0x3e48], 0x37186542
mov dword [ebp - 0x3e38], 0x3580d416
mov dword [ebp - 0x12e4], 0xfffffff9
mov dword [ebp - 0x58f0], 0xf8b5
mov dword [ebp - 0x5388], 0xb9dbea52
mov dword [ebp - 0x5a64], 0x92bd42ca
mov dword [ebp - 0x5390], 0xe7b79f6a
mov dword [ebp - 0x30cc], 0x48b1647c
mov dword [ebp - 0x58f8], 0
push 2
lea ecx, [ebp - 0x4544]
call fcn.004133eb
mov dword [ebp - 0x5398], 0
mov dword [ebp - 0x10fc], 0x8700d35
mov dword [ebp - 0x3e40], 0xe5232406
mov dword [ebp - 0xf44], 0
jmp 0x462815
mov eax, dword [ebp - 0xf44]
inc eax
mov dword [ebp - 0xf44], eax
cmp dword [ebp - 0xf44], 2
jge 0x462834
push dword [ebp - 0xf44]
lea ecx, [ebp - 0x4544]
call fcn.004134d9
and dword [eax], 0
jmp 0x462808
mov eax, dword [ebp - 0x3e30]
mov dword [ebp - 0x5b48], eax
mov eax, dword [ebp - 0x10fc]
add eax, 0xc0e0752
mov ecx, dword [ebp - 0x10fc]
dec ecx
mov dword [ebp - 0x10fc], ecx
test eax, eax
je 0x462886
cmp dword [ebp - 0x12e4], 0
je 0x46286e
cmp dword [ebp - 0x3e38], 0xfffffff7
ja 0x46287c
or eax, 0xffffffff
jne 0x46287c
and dword [ebp - 0x17ac], 0
jmp 0x462886
mov dword [ebp - 0x17ac], 1
push 0
lea ecx, [ebp - 0x4544]
call fcn.004134d9
mov eax, dword [ebp - 0x3e40]
mov dword [ebp - 0x12e4], eax
mov eax, dword [ebp - 0x12e4]
mov dword [ebp - 0x30cc], eax
mov eax, dword [ebp - 0x30cc]
mov dword [ebp - 0x17b4], eax
push 1
lea ecx, [ebp - 0x4544]
call fcn.004134d9
mov ecx, dword [ebp - 0x17b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17b4]
mov dword [ebp - 0x3e48], eax
mov byte [ebp - 0x45b], 0
movzx eax, byte [ebp - 0x45b]
test eax, eax
je 0x462907
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xbd9
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
lea ecx, [ebp - 0x4544]
call fcn.004134bd
mov dword [ebp - 0xd1c], 0xfffffff9
mov dword [ebp - 0x30d4], 0x1b5f7a0d
mov dword [ebp - 0xa24], 0
jmp 0x46293f
mov eax, dword [ebp - 0xa24]
inc eax
mov dword [ebp - 0xa24], eax
cmp dword [ebp - 0xa24], 3
jge 0x46295b
mov eax, dword [ebp - 0xa24]
mov dword [ebp + eax*4 - 0x5efc], 0x5c96dd1e
jmp 0x462932
mov dword [ebp - 0xd1c], 0
jmp 0x462974
mov eax, dword [ebp - 0xd1c]
inc eax
mov dword [ebp - 0xd1c], eax
cmp dword [ebp - 0xd1c], 2
jg 0x4629cb
mov dword [ebp - 0x53a0], 1
mov dword [ebp - 0xa2c], 0
jmp 0x4629a0
mov eax, dword [ebp - 0xa2c]
inc eax
mov dword [ebp - 0xa2c], eax
cmp dword [ebp - 0xa2c], 2
jge 0x4629bc
mov eax, dword [ebp - 0xa2c]
mov dword [ebp + eax*4 - 0x5e60], 7
jmp 0x462993
mov eax, dword [ebp - 0x30d4]
inc eax
mov dword [ebp - 0x30d4], eax
jmp 0x462967
push 1
lea ecx, [ebp - 0x4110]
call fcn.004133eb
mov dword [ebp - 0xa34], 0xffffffff
mov dword [ebp - 0x3e50], 0x2a28
mov dword [ebp - 0x3e58], 7
mov dword [ebp - 0xe94], 0
jmp 0x462a0f
mov eax, dword [ebp - 0xe94]
inc eax
mov dword [ebp - 0xe94], eax
cmp dword [ebp - 0xe94], 1
jge 0x462a31
push dword [ebp - 0xe94]
lea ecx, [ebp - 0x4110]
call fcn.004134d9
mov dword [eax], 0x64a6
jmp 0x462a02
mov dword [ebp - 0xa34], 0
jmp 0x462a4a
mov eax, dword [ebp - 0xa34]
dec eax
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 0
jl 0x462c34
mov dword [ebp - 0x30ec], 0x362daab7
mov dword [ebp - 0x1468], 0
mov dword [ebp - 0x17bc], 0xffffffff
mov dword [ebp - 0x1104], 0x88586fd5
mov eax, dword [ebp - 0x1468]
mov dword [ebp - 0x17bc], eax
mov eax, dword [ebp - 0x17bc]
mov dword [ebp - 0x1104], eax
mov eax, dword [ebp - 0x30ec]
add eax, dword [ebp - 0x1104]
je 0x462b39
push 0
lea ecx, [ebp - 0x4110]
call fcn.004134d9
mov ecx, dword [ebp - 0x1104]
cmp dword [eax], ecx
je 0x462acc
mov dword [ebp - 0x30dc], 1
jmp 0x462ad3
and dword [ebp - 0x30dc], 0
push 0
lea ecx, [ebp - 0x4110]
call fcn.004134d9
mov eax, dword [eax]
cmp eax, dword [ebp - 0x30dc]
je 0x462af6
mov dword [ebp - 0x17c4], 1
jmp 0x462afd
and dword [ebp - 0x17c4], 0
cmp dword [ebp - 0x17c4], 0xfffffff6
jb 0x462b12
mov dword [ebp - 0x30e4], 1
jmp 0x462b19
and dword [ebp - 0x30e4], 0
push 0
lea ecx, [ebp - 0x4110]
call fcn.004134d9
mov ecx, dword [ebp - 0x30e4]
cmp ecx, dword [eax]
je 0x462b39
and dword [ebp - 0x17cc], 0
jmp 0x462b43
mov dword [ebp - 0x17cc], 1
mov eax, dword [ebp - 0x1468]
cmp dword [ebp - 0x17cc], eax
jge 0x462b61
xor eax, eax
je 0x462b61
mov dword [ebp - 0x17d4], 1
jmp 0x462b68
and dword [ebp - 0x17d4], 0
mov eax, dword [ebp - 0x30ec]
cmp eax, dword [ebp - 0x17d4]
jl 0x462b82
mov dword [ebp - 0x30f4], 1
jmp 0x462b89
and dword [ebp - 0x30f4], 0
cmp dword [ebp - 0x30f4], 0xfffffffc
jge 0x462b9f
xor eax, eax
jne 0x462b9f
and dword [ebp - 0x17dc], 0
jmp 0x462ba9
mov dword [ebp - 0x17dc], 1
mov eax, dword [ebp - 0x3e50]
cmp dword [ebp - 0x17dc], eax
jge 0x462bc3
mov dword [ebp - 0x30fc], 1
jmp 0x462bca
and dword [ebp - 0x30fc], 0
cmp dword [ebp - 0x30fc], 0
jne 0x462bdf
mov dword [ebp - 0x17e4], 1
jmp 0x462be6
and dword [ebp - 0x17e4], 0
cmp dword [ebp - 0x17e4], 1
je 0x462bfb
mov dword [ebp - 0x3104], 1
jmp 0x462c02
and dword [ebp - 0x3104], 0
mov eax, dword [ebp - 0x1468]
cmp dword [ebp - 0x3104], eax
jne 0x462c1c
mov dword [ebp - 0x17ec], 1
jmp 0x462c23
and dword [ebp - 0x17ec], 0
mov eax, dword [ebp - 0x17ec]
mov dword [ebp - 0x3e58], eax
jmp 0x462a3d
mov byte [ebp - 0x45d], 0
movzx eax, byte [ebp - 0x45d]
test eax, eax
je 0x462c4e
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x4110]
call fcn.004134bd
push 3
lea ecx, [ebp - 0x458c]
call fcn.004133eb
mov dword [ebp - 0x110c], 9
push 2
lea ecx, [ebp - 0x49e0]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x455c]
call fcn.004133eb
mov dword [ebp - 0x3124], 0
mov dword [ebp - 0x360], 0
jmp 0x462cad
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 2
jge 0x462ccf
push dword [ebp - 0x360]
lea ecx, [ebp - 0x49e0]
call fcn.004134d9
mov dword [eax], 0x14c405b4
jmp 0x462ca0
mov dword [ebp - 0x360], 0
jmp 0x462ce8
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 3
jge 0x462d0a
push dword [ebp - 0x360]
lea ecx, [ebp - 0x455c]
call fcn.004134d9
mov dword [eax], 0xdcba
jmp 0x462cdb
cmp dword [ebp - 0x110c], 0
je 0x462d32
mov byte [ebp - 0x45f], 0
movzx eax, byte [ebp - 0x45f]
test eax, eax
je 0x462d2d
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x462ec3
mov dword [ebp - 0x17fc], 0x61f66568
mov dword [ebp - 0x13e4], 1
mov dword [ebp - 0x3114], 0xfffffffb
mov dword [ebp - 0xd24], 0
jmp 0x462d69
mov eax, dword [ebp - 0xd24]
inc eax
mov dword [ebp - 0xd24], eax
cmp dword [ebp - 0xd24], 1
jge 0x462d85
mov eax, dword [ebp - 0xd24]
mov dword [ebp + eax*4 - 0x12ec], 1
jmp 0x462d5c
push 0
lea ecx, [ebp - 0x455c]
call fcn.004134d9
mov dword [ebp - 0x310c], eax
mov eax, dword [ebp - 0x310c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x310c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x110c]
mov dword [ebp - 0x5900], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12ec], 0
je 0x462e06
cmp dword [ebp - 0x17fc], 0
je 0x462de9
push 1
lea ecx, [ebp - 0x49e0]
call fcn.004134d9
cmp dword [eax], 0
jne 0x462de9
and dword [ebp - 0x17f4], 0
jmp 0x462df3
mov dword [ebp - 0x17f4], 1
mov eax, dword [ebp - 0x17f4]
mov dword [ebp - 0x3114], eax
cmp dword [ebp - 0x3114], 0
mov esi, dword [ebp - 0x17fc]
push 0
lea ecx, [ebp - 0x455c]
call fcn.004134d9
cmp esi, dword [eax]
jge 0x462e29
mov dword [ebp - 0x311c], 1
jmp 0x462e30
and dword [ebp - 0x311c], 0
mov eax, dword [ebp - 0x13e4]
cmp eax, dword [ebp - 0x311c]
jge 0x462e4a
mov dword [ebp - 0x3e60], 1
jmp 0x462e51
and dword [ebp - 0x3e60], 0
cmp dword [ebp - 0x110c], 0
je 0x462e6f
mov eax, 0xa5b04204
test eax, eax
je 0x462e6f
mov dword [ebp - 0x1804], 1
jmp 0x462e76
and dword [ebp - 0x1804], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12ec]
cmp dword [ebp - 0x1804], eax
jge 0x462e97
mov dword [ebp - 0x1114], 1
jmp 0x462e9e
and dword [ebp - 0x1114], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1114]
mov dword [ebp + eax - 0x12ec], ecx
mov eax, dword [ebp - 0x1114]
sub eax, dword [ebp - 0x13e4]
mov dword [ebp - 0x13e4], eax
mov eax, dword [ebp - 0x3124]
inc eax
mov dword [ebp - 0x3124], eax
lea ecx, [ebp - 0x455c]
call fcn.004134bd
lea ecx, [ebp - 0x49e0]
call fcn.004134bd
push 3
lea ecx, [ebp - 0x1554]
call fcn.004133eb
mov dword [ebp - 0x414], 0xd4e06482
push 2
lea ecx, [ebp - 0x54b4]
call fcn.004133eb
mov dword [ebp - 0xa3c], 0
jmp 0x462f23
mov eax, dword [ebp - 0xa3c]
inc eax
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 2
jge 0x462f45
push dword [ebp - 0xa3c]
lea ecx, [ebp - 0x54b4]
call fcn.004134d9
mov dword [eax], 0x872d9ee1
jmp 0x462f16
mov dword [ebp - 0x414], 0
jmp 0x462f5e
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x1b
je 0x462f9f
mov dword [ebp - 0x3e68], 0xe446df3
mov byte [ebp - 0x461], 0
movzx eax, byte [ebp - 0x461]
test eax, eax
je 0x462f92
push 0
push 0x2545
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [ebp - 0x3e68], 0
je 0x462f9d
jmp 0x462f51
jmp 0x462f51
mov dword [ebp - 0x414], 0
jmp 0x462fb8
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x12
jl 0x463102
mov dword [ebp - 0xa44], 0xdc9ed9ba
push 4
lea ecx, [ebp - 0x4b78]
call fcn.004133eb
mov dword [ebp - 0xf9c], 0
jmp 0x462ff5
mov eax, dword [ebp - 0xf9c]
inc eax
mov dword [ebp - 0xf9c], eax
cmp dword [ebp - 0xf9c], 4
jge 0x463017
push dword [ebp - 0xf9c]
lea ecx, [ebp - 0x4b78]
call fcn.004134d9
mov dword [eax], 0xfffffffa
jmp 0x462fe8
mov dword [ebp - 0xa44], 0
jmp 0x463030
mov eax, dword [ebp - 0xa44]
inc eax
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 0x1d
jle 0x4630f2
push 2
lea ecx, [ebp - 0x4120]
call fcn.004133eb
mov dword [ebp - 0xd2c], 0
jmp 0x463063
mov eax, dword [ebp - 0xd2c]
inc eax
mov dword [ebp - 0xd2c], eax
cmp dword [ebp - 0xd2c], 2
jge 0x463085
push dword [ebp - 0xd2c]
lea ecx, [ebp - 0x4120]
call fcn.004134d9
mov dword [eax], 1
jmp 0x463056
push 1
lea ecx, [ebp - 0x4120]
call fcn.004134d9
and dword [eax], 0
jmp 0x4630bb
push 1
lea ecx, [ebp - 0x4120]
call fcn.004134d9
mov dword [ebp - 0x180c], eax
mov eax, dword [ebp - 0x180c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x180c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x4120]
call fcn.004134d9
cmp dword [eax], 1
jg 0x4630e2
push 2
lea ecx, [ebp - 0x4b78]
call fcn.004134d9
mov dword [eax], 0x6c2e7ccc
jmp 0x463097
lea ecx, [ebp - 0x4120]
call fcn.004134bd
jmp 0x463023
lea ecx, [ebp - 0x4b78]
call fcn.004134bd
jmp 0x462fab
lea ecx, [ebp - 0x54b4]
call fcn.004134bd
mov dword [ebp - 0x7f8], 1
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x4d74], 0x9729cf30
mov dword [ebp - 0x4d70], 0x9729cf30
mov dword [ebp - 0x4d6c], 0x9729cf30
mov dword [ebp - 0x4d68], 0x9729cf30
mov dword [ebp - 0x3154], 0x1eefb6f6
mov dword [ebp - 0x1814], 0xe6c8cac3
push 4
lea ecx, [ebp - 0x4130]
call fcn.004133eb
mov dword [ebp - 0x181c], 0xffffffff
mov dword [ebp - 0xa4c], 0
jmp 0x46318d
mov eax, dword [ebp - 0xa4c]
inc eax
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 4
jge 0x4631af
push dword [ebp - 0xa4c]
lea ecx, [ebp - 0x4130]
call fcn.004134d9
mov dword [eax], 0x8ed7c3b7
jmp 0x463180
mov byte [ebp - 0x463], 0
movzx eax, byte [ebp - 0x463]
test eax, eax
je 0x4631d0
push 0x1eaa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4d74], 0
cmp dword [ebp - 0x118], 0
jne 0x4631f6
mov dword [ebp - 0x1834], 1
jmp 0x4631fd
and dword [ebp - 0x1834], 0
mov eax, 0xffff
test eax, eax
je 0x46321b
cmp dword [ebp - 0x118], 0
je 0x46321b
mov dword [ebp - 0x312c], 1
jmp 0x463222
and dword [ebp - 0x312c], 0
mov eax, dword [ebp - 0x312c]
mov dword [ebp - 0x1814], eax
mov eax, dword [ebp - 0x1814]
imul eax, dword [ebp - 0x118]
mov dword [ebp - 0x3134], eax
push 1
lea ecx, [ebp - 0x4130]
call fcn.004134d9
mov ecx, dword [ebp - 0x3134]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3134]
mov dword [ebp - 0x181c], eax
mov eax, dword [ebp - 0x181c]
mov dword [ebp - 0x53a8], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x5a6c], eax
push 0xfffffffffffffffa
pop eax
neg eax
add eax, 0x4faf5ca5
sub eax, dword [ebp - 0x118]
je 0x4632aa
push 1
lea ecx, [ebp - 0x4130]
call fcn.004134d9
cmp dword [eax], 0
je 0x4632aa
mov dword [ebp - 0x313c], 1
jmp 0x4632b1
and dword [ebp - 0x313c], 0
mov eax, dword [ebp - 0x313c]
sub eax, dword [ebp - 0x118]
je 0x4632dd
push 1
lea ecx, [ebp - 0x4130]
call fcn.004134d9
cmp dword [eax], 0
je 0x4632dd
mov dword [ebp - 0x1824], 1
jmp 0x4632e4
and dword [ebp - 0x1824], 0
mov eax, dword [ebp - 0x1824]
add eax, 4
cmp eax, dword [ebp - 0x118]
jl 0x463301
mov dword [ebp - 0x3144], 1
jmp 0x463308
and dword [ebp - 0x3144], 0
cmp dword [ebp - 0x3144], 0xcc90
je 0x463320
mov dword [ebp - 0x182c], 1
jmp 0x463327
and dword [ebp - 0x182c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x182c], eax
jg 0x463341
mov dword [ebp - 0x314c], 1
jmp 0x463348
and dword [ebp - 0x314c], 0
mov eax, dword [ebp - 0x314c]
add eax, 0x35b263d1
cmp eax, dword [ebp - 0x118]
jle 0x463367
mov dword [ebp - 0x183c], 1
jmp 0x46336e
and dword [ebp - 0x183c], 0
mov eax, dword [ebp - 0x1834]
mov dword [ebp - 0x3154], eax
mov eax, dword [ebp - 0x3154]
imul eax, dword [ebp - 0x183c]
cmp eax, dword [ebp - 0x118]
jl 0x46339b
mov dword [ebp - 0x315c], 1
jmp 0x4633a2
and dword [ebp - 0x315c], 0
mov eax, dword [ebp - 0x315c]
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x4130]
call fcn.004134bd
push 2
lea ecx, [ebp - 0x15e4]
call fcn.004133eb
mov dword [ebp - 0xe9c], 0
jmp 0x4633df
mov eax, dword [ebp - 0xe9c]
inc eax
mov dword [ebp - 0xe9c], eax
cmp dword [ebp - 0xe9c], 2
jge 0x463401
push dword [ebp - 0xe9c]
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
mov dword [eax], 0x4f01c089
jmp 0x4633d2
push 0
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
cmp dword [eax], 0
je 0x4634d5
mov dword [ebp - 0xa54], 0x2159
mov eax, 0xc312fbb6
test eax, eax
je 0x46343f
cmp dword [ebp - 0xa54], 0
je 0x46343f
mov dword [ebp - 0x1844], 1
jmp 0x463446
and dword [ebp - 0x1844], 0
imul eax, dword [ebp - 0xa54], 0xf82d
imul eax, dword [ebp - 0x1844]
cmp dword [ebp - 0xa54], eax
jl 0x46346b
mov dword [ebp - 0x3e70], 1
jmp 0x463472
and dword [ebp - 0x3e70], 0
mov esi, dword [ebp - 0xa54]
push 1
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
cmp esi, dword [eax]
je 0x463495
mov dword [ebp - 0x3164], 1
jmp 0x46349c
and dword [ebp - 0x3164], 0
cmp dword [ebp - 0x3164], 0x2fd2
jl 0x4634b4
mov dword [ebp - 0x184c], 1
jmp 0x4634bb
and dword [ebp - 0x184c], 0
push 0
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
mov ecx, dword [ebp - 0x184c]
mov dword [eax], ecx
jmp 0x463594
mov dword [ebp - 0x3ac], 1
mov dword [ebp - 0x3ac], 1
jmp 0x4634f8
mov eax, dword [ebp - 0x3ac]
dec eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jl 0x463594
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
cmp dword [eax], 0
jne 0x46356c
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
cmp dword [eax], 0
je 0x463553
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
cmp dword [eax], 0
je 0x463553
mov dword [ebp - 0x316c], 1
jmp 0x46355a
and dword [ebp - 0x316c], 0
cmp dword [ebp - 0x316c], 1
jne 0x46356c
and dword [ebp - 0x1854], 0
jmp 0x463576
mov dword [ebp - 0x1854], 1
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x15e4]
call fcn.004134d9
mov ecx, dword [ebp - 0x1854]
mov dword [eax], ecx
jmp 0x4634eb
lea ecx, [ebp - 0x15e4]
call fcn.004134bd
mov dword [ebp - 0x1f8], 0
jmp 0x4635b8
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x4635da
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x458c]
call fcn.004134d9
mov dword [eax], 0xcff0
jmp 0x4635ab
mov dword [ebp - 0x1f8], 0
jmp 0x4635f3
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x463615
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1554]
call fcn.004134d9
mov dword [eax], 0xd1e1e87d
jmp 0x4635e6
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x3174], 0
mov dword [ebp - 0x185c], 1
mov dword [ebp - 0x3184], 0xffffffff
mov byte [ebp - 0x465], 0
movzx eax, byte [ebp - 0x465]
test eax, eax
je 0x46366a
push 0
push 0
push 0x21c1
push 0x1fa0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x3174], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x185c], eax
mov eax, dword [ebp - 0x3174]
add eax, dword [ebp - 0x185c]
cmp eax, dword [ebp - 0x4bc]
je 0x4636a2
mov dword [ebp - 0x317c], 1
jmp 0x4636a9
and dword [ebp - 0x317c], 0
mov eax, dword [ebp - 0x4bc]
cmp eax, dword [ebp - 0x317c]
je 0x4636c3
mov dword [ebp - 0x1864], 1
jmp 0x4636ca
and dword [ebp - 0x1864], 0
mov eax, dword [ebp - 0x1864]
sub eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x3184], eax
cmp dword [ebp - 0x3184], 0x6febfb2c
jg 0x4636f4
mov dword [ebp - 0x186c], 1
jmp 0x4636fb
and dword [ebp - 0x186c], 0
cmp dword [ebp - 0x186c], 0
jge 0x463710
mov dword [ebp - 0x318c], 1
jmp 0x463717
and dword [ebp - 0x318c], 0
mov eax, dword [ebp - 0x318c]
sub eax, 0x6388af7
cmp eax, 4
je 0x463733
mov dword [ebp - 0x1874], 1
jmp 0x46373a
and dword [ebp - 0x1874], 0
cmp dword [ebp - 0x1874], 0xdf11bbb4
jb 0x463752
mov dword [ebp - 0x3194], 1
jmp 0x463759
and dword [ebp - 0x3194], 0
mov eax, dword [ebp - 0x4bc]
sub eax, dword [ebp - 0x3194]
mov dword [ebp - 0x4bc], eax
push 0
lea ecx, [ebp - 0x1554]
call fcn.004134d9
and dword [eax], 0
jmp 0x4637a1
push 0
lea ecx, [ebp - 0x1554]
call fcn.004134d9
cmp dword [eax], 2
jg 0x464d4c
mov dword [ebp - 0x40], 0x9ae77ab3
mov dword [ebp - 0x158], 0x11f3813b
mov dword [ebp - 0x2c8], 0xea4c5706
mov dword [ebp - 0xd34], 0
jmp 0x4637eb
mov eax, dword [ebp - 0xd34]
inc eax
mov dword [ebp - 0xd34], eax
cmp dword [ebp - 0xd34], 1
jge 0x463807
mov eax, dword [ebp - 0xd34]
mov dword [ebp + eax*4 - 0x200], 0x80c3414b
jmp 0x4637de
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x200]
mov dword [ebp - 0x319c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x319c]
mov dword [ebp + eax - 0x200], ecx
cmp dword [ebp - 0x319c], 0
je 0x463851
mov eax, 0xa124
test eax, eax
je 0x463851
mov dword [ebp - 0x1884], 1
jmp 0x463858
and dword [ebp - 0x1884], 0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x1884]
jl 0x4638e1
cmp dword [ebp - 0x40], 0
je 0x46387e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x200], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x200]
sub eax, 0x39e0
cmp eax, 1
jne 0x4638a1
mov dword [ebp - 0x31a4], 1
jmp 0x4638a8
and dword [ebp - 0x31a4], 0
cmp dword [ebp - 0x31a4], 4
jle 0x4638bd
mov dword [ebp - 0x188c], 1
jmp 0x4638c4
and dword [ebp - 0x188c], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x188c]
cmp eax, 0xae974ca7
jb 0x4638e1
mov dword [ebp - 0x31ac], 1
jmp 0x4638e8
and dword [ebp - 0x31ac], 0
cmp dword [ebp - 0x31ac], 6
jb 0x463900
cmp dword [ebp - 0x40], 0
jne 0x463900
and dword [ebp - 0x1894], 0
jmp 0x46390a
mov dword [ebp - 0x1894], 1
mov eax, dword [ebp - 0x1894]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x2c8]
jg 0x463936
mov dword [ebp - 0x31b4], 1
jmp 0x46393d
and dword [ebp - 0x31b4], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x31b4], eax
jg 0x463957
mov dword [ebp - 0x189c], 1
jmp 0x46395e
and dword [ebp - 0x189c], 0
cmp dword [ebp - 0x189c], 7
jae 0x463973
mov dword [ebp - 0x31bc], 1
jmp 0x46397a
and dword [ebp - 0x31bc], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x31bc], eax
je 0x463994
mov dword [ebp - 0x18a4], 1
jmp 0x46399b
and dword [ebp - 0x18a4], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x18a4], eax
jge 0x463adc
mov dword [ebp - 0x31c4], 0xbf5b
mov dword [ebp - 0x12f4], 1
mov dword [ebp - 0x40], 3
jmp 0x4639d1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 7
je 0x463ad7
mov dword [ebp - 0x111c], 0xffffffff
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x53b0], eax
mov eax, dword [ebp - 0x31c4]
mov dword [ebp - 0x4d7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x200]
cmp dword [ebp - 0x12f4], eax
jg 0x463a27
cmp dword [ebp - 0x111c], 0
je 0x463a27
mov dword [ebp - 0x18ac], 1
jmp 0x463a2e
and dword [ebp - 0x18ac], 0
mov eax, dword [ebp - 0x31c4]
add eax, dword [ebp - 0x18ac]
cmp eax, dword [ebp - 0x12f4]
jl 0x463a4e
mov dword [ebp - 0x3e78], 1
jmp 0x463a55
and dword [ebp - 0x3e78], 0
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x4d84], eax
mov eax, dword [ebp - 0x111c]
cmp dword [ebp - 0x12f4], eax
jne 0x463a7b
mov dword [ebp - 0x31cc], 1
jmp 0x463a82
and dword [ebp - 0x31cc], 0
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x31cc]
jge 0x463a9c
mov dword [ebp - 0x18b4], 1
jmp 0x463aa3
and dword [ebp - 0x18b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18b4]
mov dword [ebp + eax - 0x200], ecx
mov byte [ebp - 0x467], 0
movzx eax, byte [ebp - 0x467]
test eax, eax
je 0x463ad2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x4639ca
jmp 0x463bb8
mov dword [ebp - 0x2c8], 0
jmp 0x463af5
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jg 0x463bb8
mov byte [ebp - 0x469], 0
movzx eax, byte [ebp - 0x469]
test eax, eax
je 0x463b1a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x158], 0
jmp 0x463b33
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jg 0x463bb3
mov dword [ebp - 0x40], 0
jmp 0x463b4c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jg 0x463bae
mov dword [ebp - 0xa5c], 0xffffffff
mov dword [ebp - 0xa5c], 0
jmp 0x463b75
mov eax, dword [ebp - 0xa5c]
inc eax
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
jg 0x463b9a
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp + eax*4 - 0x200]
mov dword [ebp + ecx*4 - 0x200], eax
jmp 0x463b68
mov eax, dword [ebp - 0x158]
cmp dword [ebp + eax*4 - 0x200], 0
je 0x463bac
jmp 0x463b45
jmp 0x463b45
jmp 0x463b26
jmp 0x463ae8
mov dword [ebp - 0x323c], 7
mov dword [ebp - 0x830], 0x9b3198a8
mov dword [ebp - 0x700], 0x98815cbc
mov dword [ebp - 0x18bc], 0xd13d8c53
mov dword [ebp - 0x3e88], 0xea311c3f
mov dword [ebp - 0x830], 0
jmp 0x463c03
mov eax, dword [ebp - 0x830]
inc eax
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0x1b
je 0x463d67
mov dword [ebp - 0x980], 0xa7eb8e13
mov dword [ebp - 0xf4c], 0
jmp 0x463c33
mov eax, dword [ebp - 0xf4c]
inc eax
mov dword [ebp - 0xf4c], eax
cmp dword [ebp - 0xf4c], 2
jge 0x463c4f
mov eax, dword [ebp - 0xf4c]
mov dword [ebp + eax*4 - 0x3388], 0x36f6
jmp 0x463c26
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x700], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3388]
mov dword [ebp - 0x4d8c], eax
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x4d94], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3388]
cmp dword [ebp - 0x700], eax
jge 0x463c9b
mov dword [ebp - 0x31d4], 1
jmp 0x463ca2
and dword [ebp - 0x31d4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x31d4]
sub ecx, dword [ebp + eax - 0x3388]
je 0x463cc7
xor eax, eax
je 0x463cc7
mov dword [ebp - 0x3e80], 1
jmp 0x463cce
and dword [ebp - 0x3e80], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x4d9c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3388]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x4da4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3388]
mov dword [ebp - 0x18bc], eax
mov eax, dword [ebp - 0x18bc]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x3e88], eax
mov dword [ebp - 0x980], 0
jmp 0x463d3d
mov eax, dword [ebp - 0x980]
inc eax
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 5
je 0x463d62
mov byte [ebp - 0x46b], 0
movzx eax, byte [ebp - 0x46b]
test eax, eax
je 0x463d60
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x463d30
jmp 0x463bf6
mov dword [ebp - 0x192c], 0xc70ab227
mov dword [ebp - 0x1428], 1
push 3
lea ecx, [ebp - 0x1028]
call fcn.004133eb
mov dword [ebp - 0x1124], 0xd7d2
mov dword [ebp - 0x31fc], 0xfffffffe
push 1
lea ecx, [ebp - 0x4140]
call fcn.004133eb
mov dword [ebp - 0x3204], 0x21c760fc
mov dword [ebp - 0x320c], 0xd777
mov dword [ebp - 0x60], 0
jmp 0x463dcd
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x463de9
push dword [ebp - 0x60]
lea ecx, [ebp - 0x1028]
call fcn.004134d9
mov dword [eax], 0x5934215e
jmp 0x463dc6
mov dword [ebp - 0x60], 0
jmp 0x463df9
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x463e0f
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x3a80], 0x69376522
jmp 0x463df2
mov dword [ebp - 0x60], 0
jmp 0x463e1f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x463e3b
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4140]
call fcn.004134d9
mov dword [eax], 0xae5685e9
jmp 0x463e18
mov eax, dword [ebp - 0x1428]
mov dword [ebp - 0x4dac], eax
push 0
lea ecx, [ebp - 0x1028]
call fcn.004134d9
mov eax, dword [ebp - 0x1124]
mov dword [ebp - 0x4db4], eax
push 0
lea ecx, [ebp - 0x1028]
call fcn.004134d9
mov esi, eax
push 0
lea ecx, [ebp - 0x1028]
call fcn.004134d9
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x1428]
jne 0x463e94
mov dword [ebp - 0x31dc], 1
jmp 0x463e9b
and dword [ebp - 0x31dc], 0
push 0
lea ecx, [ebp - 0x1028]
call fcn.004134d9
mov ecx, dword [ebp - 0x31dc]
cmp ecx, dword [eax]
jne 0x463ebe
mov dword [ebp - 0x18c4], 1
jmp 0x463ec5
and dword [ebp - 0x18c4], 0
mov eax, dword [ebp - 0x18c4]
dec eax
je 0x463ee3
cmp dword [ebp - 0x1124], 0
je 0x463ee3
mov dword [ebp - 0x31e4], 1
jmp 0x463eea
and dword [ebp - 0x31e4], 0
mov eax, dword [ebp - 0x1124]
cmp dword [ebp - 0x31e4], eax
je 0x463f04
mov dword [ebp - 0x18cc], 1
jmp 0x463f0b
and dword [ebp - 0x18cc], 0
push 2
lea ecx, [ebp - 0x1028]
call fcn.004134d9
mov ecx, dword [ebp - 0x18cc]
add ecx, dword [eax]
neg ecx
mov dword [ebp - 0x31ec], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x31ec]
mov dword [ebp + eax - 0x3a80], ecx
cmp dword [ebp - 0x31ec], 0xfffffffa
jg 0x463f50
mov dword [ebp - 0x18d4], 1
jmp 0x463f57
and dword [ebp - 0x18d4], 0
mov esi, dword [ebp - 0x18d4]
neg esi
push 2
lea ecx, [ebp - 0x1028]
call fcn.004134d9
cmp esi, dword [eax]
jl 0x463f89
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a80], 0
jne 0x463f89
mov dword [ebp - 0x31f4], 1
cmp dword [ebp - 0x31f4], 0xffffffff
je 0x463fa8
mov dword [ebp - 0xd4c], 0xb26bdde0
mov dword [ebp - 0xd4c], 0xfffffff2
jmp 0x464d6f
mov eax, dword [ebp - 0xd4c]
inc eax
mov dword [ebp - 0xd4c], eax
cmp dword [ebp - 0xd4c], 0xffffffff
jle 0x464de1
mov dword [ebp - 0x327c], 0xd5816210
mov dword [ebp - 0x3ed0], 0x23ed15d
mov dword [ebp - 0xa8c], 0
jmp 0x464da5
mov eax, dword [ebp - 0xa8c]
inc eax
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 4
jge 0x464dc1
mov eax, dword [ebp - 0xa8c]
mov dword [ebp + eax*4 - 0x5dc0], 0x37c04ccb
jmp 0x464d98
mov eax, dword [ebp - 0x327c]
mov dword [ebp - 0x3ed0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x327c]
mov dword [ebp + eax - 0x5dc0], ecx
jmp 0x464d62
mov dword [ebp - 0x7f8], 0
jmp 0x464dfa
cmp dword [ebp - 0x7f8], 1
je 0x46612c
push 3
lea ecx, [ebp - 0x4574]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x1530]
call fcn.004133eb
mov dword [ebp - 0x718], 1
mov dword [ebp - 0x208], 0
jmp 0x464e44
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x464e66
push dword [ebp - 0x208]
lea ecx, [ebp - 0x4574]
call fcn.004134d9
mov dword [eax], 0xcff0
jmp 0x464e37
mov dword [ebp - 0x208], 0
jmp 0x464e7f
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x464ea1
push dword [ebp - 0x208]
lea ecx, [ebp - 0x1530]
call fcn.004134d9
mov dword [eax], 0xd1e1e87d
jmp 0x464e72
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
and dword [eax], 0
jmp 0x464ed7
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
mov dword [ebp - 0x1964], eax
mov eax, dword [ebp - 0x1964]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1964]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
cmp dword [eax], 2
jg 0x4650b3
mov dword [ebp - 0x196c], 7
mov dword [ebp - 0x3294], 0xc70ab227
mov dword [ebp - 0x329c], 0xfffffffd
push 2
lea ecx, [ebp - 0x4a70]
call fcn.004133eb
mov dword [ebp - 0xeac], 0
jmp 0x464f31
mov eax, dword [ebp - 0xeac]
inc eax
mov dword [ebp - 0xeac], eax
cmp dword [ebp - 0xeac], 2
jge 0x464f53
push dword [ebp - 0xeac]
lea ecx, [ebp - 0x4a70]
call fcn.004134d9
mov dword [eax], 1
jmp 0x464f24
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
push dword [eax]
lea ecx, [ebp - 0x4574]
call fcn.004134d9
cmp dword [ebp - 0x196c], 0
jne 0x464f9e
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
push dword [eax]
lea ecx, [ebp - 0x4574]
call fcn.004134d9
cmp dword [eax], 0
jne 0x464f9e
and dword [ebp - 0x3284], 0
jmp 0x464fa8
mov dword [ebp - 0x3284], 1
mov eax, dword [ebp - 0x3284]
dec eax
cmp eax, dword [ebp - 0x196c]
jl 0x464fc3
mov dword [ebp - 0x328c], 1
jmp 0x464fca
and dword [ebp - 0x328c], 0
cmp dword [ebp - 0x328c], 1
jbe 0x464fdf
mov dword [ebp - 0x1974], 1
jmp 0x464fe6
and dword [ebp - 0x1974], 0
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
mov ecx, dword [ebp - 0x1974]
sub ecx, dword [eax]
mov dword [ebp - 0x718], ecx
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x3294], eax
mov esi, dword [ebp - 0x3294]
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
cmp dword [eax], esi
jl 0x465030
mov dword [ebp - 0x197c], 1
jmp 0x465037
and dword [ebp - 0x197c], 0
mov eax, dword [ebp - 0x197c]
mov dword [ebp - 0x329c], eax
mov esi, dword [ebp - 0x329c]
push 0
lea ecx, [ebp - 0x1530]
call fcn.004134d9
cmp esi, dword [eax]
jg 0x465066
mov dword [ebp - 0x1984], 1
jmp 0x46506d
and dword [ebp - 0x1984], 0
push 0
lea ecx, [ebp - 0x4a70]
call fcn.004134d9
mov ecx, dword [ebp - 0x1984]
mov dword [eax], ecx
mov byte [ebp - 0x479], 0
movzx eax, byte [ebp - 0x479]
test eax, eax
je 0x4650a3
push 0
push 0x1e40
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x4a70]
call fcn.004134bd
jmp 0x464eb3
mov dword [ebp - 0x718], 0
jmp 0x4650cc
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 1
je 0x465111
mov dword [ebp - 0x3ed8], 0x1be360de
mov dword [ebp - 0x3ee0], 0xffffffff
mov eax, dword [ebp - 0x3ed8]
mov dword [ebp - 0x3ee0], eax
mov byte [ebp - 0x47b], 0
movzx eax, byte [ebp - 0x47b]
test eax, eax
je 0x46510f
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4650bf
lea ecx, [ebp - 0x1530]
call fcn.004134bd
lea ecx, [ebp - 0x4574]
call fcn.004134bd
mov dword [ebp - 0x3f08], 0x1be360de
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x1994], 0xffffffff
mov dword [ebp - 0xa94], 0
jmp 0x46515e
mov eax, dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 1
jge 0x46517a
mov eax, dword [ebp - 0xa94]
mov dword [ebp + eax*4 - 0xd54], 0
jmp 0x465151
mov dword [ebp - 0x2d0], 0
jmp 0x465193
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jg 0x4652f1
mov dword [ebp - 0x32a4], 0xb963ab19
mov dword [ebp - 0x3ee8], 0xfad5
mov dword [ebp - 0x3ef8], 1
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp + eax*4 - 0xd54]
imul ecx, dword [ebp - 0x2d0], 0x7249
sub eax, ecx
mov dword [ebp - 0x32a4], eax
cmp dword [ebp - 0x32a4], 0xfff7
jbe 0x4651f5
mov dword [ebp - 0x198c], 1
jmp 0x4651fc
and dword [ebp - 0x198c], 0
mov eax, dword [ebp - 0x2d0]
imul eax, dword [ebp - 0x198c]
cmp eax, dword [ebp - 0x3ee8]
jge 0x46521d
mov dword [ebp - 0x3ef0], 1
jmp 0x465224
and dword [ebp - 0x3ef0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd54], 0xffffffff
jb 0x465240
mov dword [ebp - 0x32ac], 1
jmp 0x465247
and dword [ebp - 0x32ac], 0
mov eax, dword [ebp - 0x32ac]
mov dword [ebp - 0x1994], eax
cmp dword [ebp - 0x1994], 0xfffffff8
jg 0x465268
mov dword [ebp - 0x32b4], 1
jmp 0x46526f
and dword [ebp - 0x32b4], 0
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp + eax*4 - 0xd54]
cmp dword [ebp - 0x32b4], eax
jg 0x465290
mov dword [ebp - 0x199c], 1
jmp 0x465297
and dword [ebp - 0x199c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd54]
cmp dword [ebp - 0x199c], eax
jg 0x4652b8
mov dword [ebp - 0x32bc], 1
jmp 0x4652bf
and dword [ebp - 0x32bc], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x32bc], eax
je 0x4652d9
mov dword [ebp - 0x19a4], 1
jmp 0x4652e0
and dword [ebp - 0x19a4], 0
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0x3ef8], eax
jmp 0x465186
mov byte [ebp - 0x47d], 0
movzx eax, byte [ebp - 0x47d]
test eax, eax
je 0x465312
push 0
push 1
push 0x403
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x3f10], 0xffffffff
push 3
lea ecx, [ebp - 0x38ac]
call fcn.004133eb
mov dword [ebp - 0x4768], 0xe672ca3c
mov dword [ebp - 0x4764], 0xe672ca3c
mov dword [ebp - 0x4760], 0xe672ca3c
mov dword [ebp - 0x475c], 0xe672ca3c
lea ecx, [ebp - 0x131d]
call fcn.004134e8
push eax
lea eax, [ebp - 0x4758]
push eax
lea eax, [ebp - 0x4768]
push eax
lea ecx, [ebp - 0x5e88]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5514]
call fcn.00413497
mov dword [ebp - 0x4ec4], 2
mov dword [ebp - 0x13ec], 0xfffffff7
mov dword [ebp - 0x4ecc], 0xfffffffe
mov dword [ebp - 0x3f00], 0x9733147f
mov dword [ebp - 0x32dc], 0
mov dword [ebp - 0x12fc], 0xfffffff6
mov dword [ebp - 0xa9c], 0
jmp 0x4653db
mov eax, dword [ebp - 0xa9c]
inc eax
mov dword [ebp - 0xa9c], eax
cmp dword [ebp - 0xa9c], 3
jge 0x4653fd
push dword [ebp - 0xa9c]
lea ecx, [ebp - 0x38ac]
call fcn.004134d9
mov dword [eax], 0xb110c93b
jmp 0x4653ce
push 2
lea ecx, [ebp - 0x38ac]
call fcn.004134d9
and dword [eax], 0
jmp 0x465433
push 2
lea ecx, [ebp - 0x38ac]
call fcn.004134d9
mov dword [ebp - 0x32c4], eax
mov eax, dword [ebp - 0x32c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x32c4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x38ac]
call fcn.004134d9
cmp dword [eax], 8
jge 0x4656f4
mov dword [ebp - 0x888], 0x17633efc
push 3
lea ecx, [ebp - 0x5504]
call fcn.004133eb
mov dword [ebp - 0xf54], 0
jmp 0x465479
mov eax, dword [ebp - 0xf54]
inc eax
mov dword [ebp - 0xf54], eax
cmp dword [ebp - 0xf54], 3
jge 0x465498
push dword [ebp - 0xf54]
lea ecx, [ebp - 0x5504]
call fcn.004134d9
or dword [eax], 0xffffffff
jmp 0x46546c
mov dword [ebp - 0x888], 0
jmp 0x4654b1
cmp dword [ebp - 0x888], 1
jle 0x4656e4
mov dword [ebp - 0xaa4], 1
mov dword [ebp - 0x1134], 0xfffffff8
mov eax, dword [ebp - 0x1134]
cmp dword [ebp - 0x13ec], eax
jl 0x4654ec
mov dword [ebp - 0x19ac], 1
jmp 0x4654f3
and dword [ebp - 0x19ac], 0
cmp dword [ebp - 0x19ac], 0xfffffff7
jne 0x465508
lea ecx, [ebp - 0x5504]
call fcn.004134bd
jmp 0x46540f
lea ecx, [ebp - 0x5514]
call fcn.004134bd
lea ecx, [ebp - 0x38ac]
call fcn.004134bd
mov eax, dword [ebp - 0x3f08]
mov dword [ebp - 0x3f10], eax
push 1
lea ecx, [ebp - 0x35b8]
call fcn.004133eb
mov dword [ebp - 0x7b0], 0xfffffffa
mov dword [ebp - 0x3314], 0x79df9481
mov dword [ebp - 0x331c], 0xa955a63a
mov dword [ebp - 0x19fc], 0x426f3791
mov dword [ebp - 0xd5c], 0
jmp 0x465764
mov eax, dword [ebp - 0xd5c]
inc eax
mov dword [ebp - 0xd5c], eax
cmp dword [ebp - 0xd5c], 1
jge 0x465786
push dword [ebp - 0xd5c]
lea ecx, [ebp - 0x35b8]
call fcn.004134d9
mov dword [eax], 0x5b57fd54
jmp 0x465757
mov dword [ebp - 0x7b0], 0
jmp 0x46579f
cmp dword [ebp - 0x7b0], 0
jl 0x465b89
mov dword [ebp - 0x210], 0x807cfaf4
mov dword [ebp - 0xaac], 0
jmp 0x4657cf
cmp dword [ebp - 0xaac], 1
jge 0x4657eb
lea ecx, [ebp - 0x35b8]
call fcn.004134bd
mov dword [ebp - 0x960], 0xb26bdde0
mov dword [ebp - 0x960], 0xfffffffa
jmp 0x465bb7
cmp dword [ebp - 0x960], 0xfffffff3
jne 0x465be7
lea ecx, [ebp - 0x1554]
call fcn.004134bd
lea ecx, [ebp - 0x458c]
call fcn.004134bd
mov dword [ebp - 0xd6c], 0xa860
mov dword [ebp - 0xacc], 5
push 4
lea ecx, [ebp - 0x3794]
call fcn.004133eb
mov dword [ebp - 0x3f28], 0xfaab39e
mov dword [ebp - 0x1a60], 1
mov dword [ebp - 0xac4], 0x34a938f7
mov dword [ebp - 0x3f40], 0x8bee6da
mov dword [ebp - 0xfa4], 0
jmp 0x4661a4
mov eax, dword [ebp - 0xfa4]
inc eax
mov dword [ebp - 0xfa4], eax
cmp dword [ebp - 0xfa4], 4
jge 0x4661c6
push dword [ebp - 0xfa4]
lea ecx, [ebp - 0x3794]
call fcn.004134d9
mov dword [eax], 0xaab72b21
jmp 0x466197
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xacc], 0x85c9e53
push 2
lea ecx, [ebp - 0x3794]
call fcn.004134d9
mov ecx, dword [ebp - 0xacc]
cmp dword [eax], ecx
jl 0x4661ff
mov dword [ebp - 0x28c0], 1
jmp 0x466206
and dword [ebp - 0x28c0], 0
push 2
lea ecx, [ebp - 0x3794]
call fcn.004134d9
cmp dword [eax], 0xd8bc
jg 0x466242
cmp dword [ebp - 0x3f28], 0
je 0x466242
push 2
lea ecx, [ebp - 0x3794]
call fcn.004134d9
cmp dword [eax], 0
je 0x466242
mov dword [ebp - 0x1a58], 1
jmp 0x466249
and dword [ebp - 0x1a58], 0
push 3
lea ecx, [ebp - 0x3794]
call fcn.004134d9
mov ecx, dword [ebp - 0x1a58]
cmp ecx, dword [eax]
jle 0x46626c
mov dword [ebp - 0x3410], 1
jmp 0x466273
and dword [ebp - 0x3410], 0
mov eax, dword [ebp - 0x3410]
mov dword [ebp - 0x1a60], eax
mov eax, dword [ebp - 0x1a60]
mov dword [ebp - 0x4f14], eax
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x4f1c], eax
mov dword [ebp - 0xac4], 0xdf860956
cmp dword [ebp - 0xac4], 0
je 0x4662bf
cmp dword [ebp - 0xac4], 0
je 0x4662bf
mov dword [ebp - 0x3f30], 1
jmp 0x4662c6
and dword [ebp - 0x3f30], 0
push 2
lea ecx, [ebp - 0x3794]
call fcn.004134d9
cmp dword [ebp - 0xac4], 0xfffffffa
je 0x4662ec
push 7
pop eax
test eax, eax
jne 0x4662ec
and dword [ebp - 0x1a68], 0
jmp 0x4662f6
mov dword [ebp - 0x1a68], 1
mov eax, dword [ebp - 0x28c0]
imul eax, dword [ebp - 0x1a68]
cmp eax, dword [ebp - 0xd6c]
je 0x466317
mov dword [ebp - 0x3f38], 1
jmp 0x46631e
and dword [ebp - 0x3f38], 0
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x4f24], eax
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x3f40], eax
lea ecx, [ebp - 0x3794]
call fcn.004134bd
mov dword [ebp - 0x38], 0x9ae77ab3
mov dword [ebp - 0x128], 0x11f3813b
mov dword [ebp - 0x388], 0xea4c5706
mov dword [ebp - 0xebc], 0
jmp 0x466375
mov eax, dword [ebp - 0xebc]
inc eax
mov dword [ebp - 0xebc], eax
cmp dword [ebp - 0xebc], 1
jge 0x466391
mov eax, dword [ebp - 0xebc]
mov dword [ebp + eax*4 - 0x218], 0x80c3414b
jmp 0x466368
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
mov dword [ebp - 0x2ff0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ff0]
mov dword [ebp + eax - 0x218], ecx
cmp dword [ebp - 0x2ff0], 0
je 0x4663db
mov eax, 0xa124
test eax, eax
je 0x4663db
mov dword [ebp - 0x1a70], 1
jmp 0x4663e2
and dword [ebp - 0x1a70], 0
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x1a70]
jl 0x46646b
cmp dword [ebp - 0x38], 0
je 0x466408
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x218], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
sub eax, 0x39e0
cmp eax, 1
jne 0x46642b
mov dword [ebp - 0x28c8], 1
jmp 0x466432
and dword [ebp - 0x28c8], 0
cmp dword [ebp - 0x28c8], 4
jle 0x466447
mov dword [ebp - 0x1a78], 1
jmp 0x46644e
and dword [ebp - 0x1a78], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x1a78]
cmp eax, 0xae974ca7
jb 0x46646b
mov dword [ebp - 0x338c], 1
jmp 0x466472
and dword [ebp - 0x338c], 0
cmp dword [ebp - 0x338c], 6
jb 0x46648a
cmp dword [ebp - 0x38], 0
jne 0x46648a
and dword [ebp - 0x1a80], 0
jmp 0x466494
mov dword [ebp - 0x1a80], 1
mov eax, dword [ebp - 0x1a80]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x388]
jg 0x4664c0
mov dword [ebp - 0x28d0], 1
jmp 0x4664c7
and dword [ebp - 0x28d0], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x28d0], eax
jg 0x4664e1
mov dword [ebp - 0x1a88], 1
jmp 0x4664e8
and dword [ebp - 0x1a88], 0
cmp dword [ebp - 0x1a88], 7
jae 0x4664fd
mov dword [ebp - 0x2ff8], 1
jmp 0x466504
and dword [ebp - 0x2ff8], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x2ff8], eax
je 0x46651e
mov dword [ebp - 0x1a90], 1
jmp 0x466525
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x1a90], eax
jge 0x466666
mov dword [ebp - 0x28d8], 0xbf5b
mov dword [ebp - 0x14a8], 1
mov dword [ebp - 0x38], 3
jmp 0x46655b
cmp dword [ebp - 0x38], 7
je 0x466661
mov dword [ebp - 0x1144], 0xffffffff
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x4f2c], eax
mov eax, dword [ebp - 0x28d8]
mov dword [ebp - 0x4f34], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
cmp dword [ebp - 0x14a8], eax
jg 0x4665b1
cmp dword [ebp - 0x1144], 0
je 0x4665b1
mov dword [ebp - 0x1a98], 1
jmp 0x4665b8
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0x28d8]
add eax, dword [ebp - 0x1a98]
cmp eax, dword [ebp - 0x14a8]
jl 0x4665d8
mov dword [ebp - 0x3f48], 1
jmp 0x4665df
and dword [ebp - 0x3f48], 0
mov eax, dword [ebp - 0x1144]
mov dword [ebp - 0x4f3c], eax
mov eax, dword [ebp - 0x1144]
cmp dword [ebp - 0x14a8], eax
jne 0x466605
jmp 0x466742
mov dword [ebp - 0x388], 0
jmp 0x46667f
cmp dword [ebp - 0x388], 0
jg 0x466742
mov byte [ebp - 0x6c7], 0
movzx eax, byte [ebp - 0x6c7]
test eax, eax
je 0x4666a4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x128], 0
jmp 0x4666bd
cmp dword [ebp - 0x128], 0
jg 0x46673d
mov dword [ebp - 0x720], 1
mov dword [ebp - 0x720], 0
jmp 0x466765
cmp dword [ebp - 0x720], 0xf
jg 0x466a4b
mov dword [ebp - 0x898], 9
mov dword [ebp - 0x3f70], 0x1871
mov byte [ebp - 0x43c], 0
movzx eax, byte [ebp - 0x43c]
test eax, eax
je 0x4667ab
mov dword [ebp - 0x9a0], 0xec2db221
mov dword [ebp - 0xb8], 0xfffffffb
mov dword [ebp - 0x130c], 1
mov dword [ebp - 0x1ac8], 0xb74a71a6
push 4
lea ecx, [ebp - 0x45a4]
call fcn.004133eb
mov dword [ebp - 0xf5c], 0
jmp 0x466a99