Function at 0x469221
Capabilities:
Check os version
Enumerate gui resources
Get common file path
Get disk information
Get session user name
Hide graphical window
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37dc
call fcn.004a04f0
push esi
push edi
push 2
lea ecx, [ebp - 0x2b5c]
call fcn.004317a0
mov dword [ebp - 0x660], 8
mov dword [ebp - 0x678], 0
jmp 0x469260
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 2
jge 0x469282
push dword [ebp - 0x678]
lea ecx, [ebp - 0x2b5c]
call fcn.0043188e
mov dword [eax], 0xdf99ff60
jmp 0x469253
mov dword [ebp - 0x660], 0
jmp 0x46929b
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 1
jg 0x469419
mov dword [ebp - 0x1c4], 0x4696a485
mov dword [ebp - 0x1c4], 0
jmp 0x4692cb
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jg 0x4693aa
push 4
lea ecx, [ebp - 0x25c4]
call fcn.004317a0
mov dword [ebp - 0x65c], 0
jmp 0x4692fe
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 4
jge 0x469320
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x25c4]
call fcn.0043188e
mov dword [eax], 0x7161ab6e
jmp 0x4692f1
push 3
lea ecx, [ebp - 0x25c4]
call fcn.0043188e
and dword [eax], 0
jmp 0x469356
push 3
lea ecx, [ebp - 0x25c4]
call fcn.0043188e
mov dword [ebp - 0x17f4], eax
mov eax, dword [ebp - 0x17f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x17f4]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x25c4]
call fcn.0043188e
cmp dword [eax], 1
jg 0x46939a
mov byte [ebp - 0x47e], 0
movzx eax, byte [ebp - 0x47e]
test eax, eax
je 0x469398
push 0x1301
push 0x17ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x469332
lea ecx, [ebp - 0x25c4]
call fcn.00431872
jmp 0x4692be
mov dword [ebp - 0x1c4], 1
jmp 0x4693c3
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x469414
mov dword [ebp - 0x964], 0x6887e08a
mov dword [ebp - 0x964], 1
jmp 0x4693ef
mov eax, dword [ebp - 0x964]
dec eax
mov dword [ebp - 0x964], eax
cmp dword [ebp - 0x964], 0
jl 0x469412
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x2b5c]
call fcn.0043188e
cmp dword [eax], 0
je 0x469410
jmp 0x469412
jmp 0x4693e2
jmp 0x4693b6
jmp 0x46928e
lea ecx, [ebp - 0x2b5c]
call fcn.00431872
mov dword [ebp - 0x324], 0x124f01c0
mov dword [ebp - 0x2208], 0x8ec32687
mov dword [ebp - 0x324], 0
jmp 0x469451
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x1b
jne 0x4695e2
mov dword [ebp - 0x7ec], 0
mov dword [ebp - 0x1fb0], 0xfffffff6
mov dword [ebp - 0x31c], 0x26d8d383
mov dword [ebp - 0x664], 0
jmp 0x469495
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 3
jge 0x4694b1
mov eax, dword [ebp - 0x664]
mov dword [ebp + eax*4 - 0x35b0], 1
jmp 0x469488
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x2dc8], eax
cmp dword [ebp - 0x31c], 0x72d714f9
jne 0x4694d5
mov dword [ebp - 0x1fb8], 1
jmp 0x4694dc
and dword [ebp - 0x1fb8], 0
mov dword [ebp - 0x1fb0], 0xffffffff
mov eax, dword [ebp - 0x1fb0]
cmp eax, dword [ebp - 0x1fb8]
jle 0x469500
mov dword [ebp - 0x1fc0], 1
jmp 0x469507
and dword [ebp - 0x1fc0], 0
cmp dword [ebp - 0x1fc0], 0xffffffff
jne 0x46951c
mov dword [ebp - 0x1fc8], 1
jmp 0x469523
and dword [ebp - 0x1fc8], 0
mov eax, dword [ebp - 0x7ec]
cmp dword [ebp - 0x1fc8], eax
jle 0x46953d
mov dword [ebp - 0x1fd0], 1
jmp 0x469544
and dword [ebp - 0x1fd0], 0
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x1fd0], eax
jne 0x46955e
mov dword [ebp - 0x2020], 1
jmp 0x469565
and dword [ebp - 0x2020], 0
mov eax, dword [ebp - 0x7ec]
imul eax, dword [ebp - 0x2020]
sub eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x2208], eax
mov dword [ebp - 0x31c], 0
jmp 0x46959d
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jg 0x4695dd
mov eax, dword [ebp - 0x31c]
cmp dword [ebp + eax*4 - 0x35b0], 0
je 0x4695b8
jmp 0x4695dd
mov byte [ebp - 0x2cb], 0
movzx eax, byte [ebp - 0x2cb]
test eax, eax
je 0x4695db
push 0
push 0
push 0x1f76
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x469590
jmp 0x469444
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x66c], 0xfffffffd
mov dword [ebp - 0x538], 0x4cdb8faa
mov dword [ebp - 0x66c], 0
jmp 0x46961b
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0x16
jle 0x4696ff
push 3
lea ecx, [ebp - 0x2820]
call fcn.004317a0
mov dword [ebp - 0x8ac], 0
jmp 0x46964e
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 3
jge 0x469670
push dword [ebp - 0x8ac]
lea ecx, [ebp - 0x2820]
call fcn.0043188e
mov dword [eax], 0xc4b4e126
jmp 0x469641
push 0
lea ecx, [ebp - 0x2820]
call fcn.0043188e
mov eax, dword [eax]
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x538], 2
jmp 0x46969e
mov eax, dword [ebp - 0x538]
dec eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
jl 0x4696ef
mov dword [ebp - 0x5b8], 0x5950707d
mov dword [ebp - 0x5b8], 2
jmp 0x4696ca
mov eax, dword [ebp - 0x5b8]
dec eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0
jl 0x4696ed
push dword [ebp - 0x5b8]
lea ecx, [ebp - 0x2820]
call fcn.0043188e
cmp dword [eax], 0
je 0x4696eb
jmp 0x4696ed
jmp 0x4696bd
jmp 0x469691
lea ecx, [ebp - 0x2820]
call fcn.00431872
jmp 0x46960e
push 2
lea ecx, [ebp - 0x2bd4]
call fcn.004317a0
mov dword [ebp - 0x540], 0xfffffffc
mov dword [ebp - 0x2cb8], 0xffffffff
mov dword [ebp - 0x2cc0], 7
mov dword [ebp - 0x2cc8], 3
mov dword [ebp - 0x2cd0], 0xfa72c25f
mov dword [ebp - 0x2cd8], 0
mov dword [ebp - 0x2ce0], 0x33037736
mov dword [ebp - 0x2ce8], 0x4e665969
mov dword [ebp - 0x2cf0], 0xffffffff
mov dword [ebp - 0x2cf8], 0x26874be7
mov dword [ebp - 0x2d00], 0x6aeba4d3
mov dword [ebp - 0x2d08], 1
mov dword [ebp - 0x2028], 0x1e5d
mov dword [ebp - 0x170], 0
jmp 0x4697a7
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x4697c3
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2d10], 0xfffffff6
jmp 0x46979a
mov dword [ebp - 0x170], 0
jmp 0x4697dc
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x4697f8
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x3660], 0x93876a47
jmp 0x4697cf
mov dword [ebp - 0x540], 0
jmp 0x469811
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0x11
jg 0x469884
mov dword [ebp - 0x2d18], 0xffffffff
mov dword [ebp - 0x2d20], 9
mov dword [ebp - 0x2d28], 0x12e1dfe0
mov dword [ebp - 0x34b4], 0
mov dword [ebp - 0x34b0], 0
mov dword [ebp - 0x34ac], 0
mov dword [ebp - 0x34a8], 0
mov dword [ebp - 0x2d30], 0xffffffff
cmp dword [ebp - 0x540], 0
je 0x469875
jmp 0x469884
mov eax, dword [ebp - 0x2028]
dec eax
mov dword [ebp - 0x2028], eax
jmp 0x469804
mov dword [ebp - 0x68c], 8
mov dword [ebp - 0x1e0], 0xffffffff
mov dword [ebp - 0x158], 0xa26f3f17
mov dword [ebp - 0x674], 0
jmp 0x4698bb
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 1
jge 0x4698d7
mov eax, dword [ebp - 0x674]
mov dword [ebp + eax*4 - 0x490], 0x4a6847df
jmp 0x4698ae
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x469905
push 0
push 0xfb2
push 0x17d6
push 0x168b
push 0x170e
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x1e0], 0
jmp 0x46991e
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x469b6c
mov dword [ebp - 0x2328], 0xd015b01d
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x2d38], eax
mov dword [ebp - 0x158], 0xb21a35ca
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x2d40], eax
mov eax, 0xd0b0
neg eax
cmp eax, 0x531f
jl 0x46997d
mov dword [ebp - 0x2030], 1
jmp 0x469984
and dword [ebp - 0x2030], 0
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x490]
cmp eax, dword [ebp - 0x2030]
jne 0x4699a5
mov dword [ebp - 0x2320], 1
jmp 0x4699ac
and dword [ebp - 0x2320], 0
cmp dword [ebp - 0x158], 0
jne 0x4699c7
mov eax, 0xa30a4ccf
test eax, eax
jne 0x4699c7
and dword [ebp - 0x2038], 0
jmp 0x4699d1
mov dword [ebp - 0x2038], 1
cmp dword [ebp - 0x2038], 0xfffffffe
je 0x4699e6
mov dword [ebp - 0x2040], 1
jmp 0x4699ed
and dword [ebp - 0x2040], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x490]
imul eax, dword [ebp - 0x2040]
test eax, eax
jne 0x469a19
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp + eax*4 - 0x490], 0
je 0x469b37
mov dword [ebp - 0x2330], 0x4a93
mov dword [ebp - 0x2340], 8
mov dword [ebp - 0x158], 0
jmp 0x469a46
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x17
jge 0x469b35
mov dword [ebp - 0x2338], 0xe70
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x490], ecx
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp + eax*4 - 0x490], 0xfffd
jae 0x469a8f
mov dword [ebp - 0x2060], 1
jmp 0x469a96
and dword [ebp - 0x2060], 0
cmp dword [ebp - 0x2328], 1
jge 0x469aab
mov dword [ebp - 0x2048], 1
jmp 0x469ab2
and dword [ebp - 0x2048], 0
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x490]
cmp eax, dword [ebp - 0x2048]
jle 0x469ad3
mov dword [ebp - 0x2050], 1
jmp 0x469ada
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0x2330]
sub eax, dword [ebp - 0x2050]
cmp eax, dword [ebp - 0x2338]
jge 0x469afa
mov dword [ebp - 0x2058], 1
jmp 0x469b01
and dword [ebp - 0x2058], 0
mov eax, dword [ebp - 0x2058]
neg eax
cmp dword [ebp - 0x2060], eax
jge 0x469b1d
mov dword [ebp - 0x2068], 1
jmp 0x469b24
and dword [ebp - 0x2068], 0
mov eax, dword [ebp - 0x2068]
mov dword [ebp - 0x2340], eax
jmp 0x469a39
jmp 0x469b67
mov byte [ebp - 0x2cf], 0
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x469b67
push 0x1301
push 0x17ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x469911
mov dword [ebp - 0x9c], 0xf7fd
mov dword [ebp - 0x28], 0xb733c633
push 1
lea ecx, [ebp - 0x21c8]
call fcn.004317a0
mov dword [ebp - 0x32c], 0x3de81d53
mov dword [ebp - 0x684], 0x82b357f0
mov dword [ebp - 0x334], 3
mov dword [ebp - 0x1b58], 0xe27a8d2c
mov dword [ebp - 0x178], 0
jmp 0x469bcb
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x469bea
push dword [ebp - 0x178]
lea ecx, [ebp - 0x21c8]
call fcn.0043188e
and dword [eax], 0
jmp 0x469bbe
mov dword [ebp - 0x178], 0
jmp 0x469c03
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x469c1f
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x9a4], 5
jmp 0x469bf6
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x469d73
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2e84], eax
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x9c]
jle 0x469c5f
mov dword [ebp - 0x2070], 1
jmp 0x469c66
and dword [ebp - 0x2070], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x2070]
cmp eax, dword [ebp - 0x28]
je 0x469c84
mov dword [ebp - 0x2078], 1
jmp 0x469c8b
and dword [ebp - 0x2078], 0
mov eax, dword [ebp - 0x2078]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2080], eax
push 0
lea ecx, [ebp - 0x21c8]
call fcn.0043188e
mov ecx, dword [ebp - 0x2080]
mov dword [eax], ecx
cmp dword [ebp - 0x2080], 1
jne 0x469ccd
mov dword [ebp - 0x2088], 1
jmp 0x469cd4
and dword [ebp - 0x2088], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x2088], eax
jg 0x469cee
mov dword [ebp - 0x2090], 1
jmp 0x469cf5
and dword [ebp - 0x2090], 0
imul eax, dword [ebp - 0x2090], 0x9d58
add eax, 0x1649bc00
je 0x469d0a
cmp dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x28], eax
jg 0x469d24
cmp dword [ebp - 0x28], 0
jne 0x469d24
and dword [ebp - 0x2098], 0
jmp 0x469d2e
mov dword [ebp - 0x2098], 1
mov eax, dword [ebp - 0x2098]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x930f
jle 0x469d52
mov dword [ebp - 0x20a0], 1
jmp 0x469d59
and dword [ebp - 0x20a0], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x20a0]
je 0x469d73
mov dword [ebp - 0x20a8], 1
jmp 0x469d7a
and dword [ebp - 0x20a8], 0
mov eax, dword [ebp - 0x20a8]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x684], eax
jg 0x469da0
mov dword [ebp - 0xbac], 1
jmp 0x469da7
and dword [ebp - 0xbac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbac]
mov dword [ebp + eax - 0x9a4], ecx
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x2e8c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2e94], eax
cmp dword [ebp - 0x28], 0
je 0x46a16c
mov dword [ebp - 0xbc4], 0x5746
mov dword [ebp - 0x27f4], 1
mov dword [ebp - 0x27f0], 1
mov dword [ebp - 0x27ec], 1
mov dword [ebp - 0x27e8], 1
push 2
lea ecx, [ebp - 0x325c]
call fcn.004317a0
mov dword [ebp - 0x7f4], 0
jmp 0x469e40
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 2
jge 0x469e62
push dword [ebp - 0x7f4]
lea ecx, [ebp - 0x325c]
call fcn.0043188e
mov dword [eax], 0x47fe
jmp 0x469e33
mov dword [ebp - 0x28], 1
jmp 0x469e72
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x46a14f
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0xc38], 9
mov dword [ebp - 0x90c], 1
mov dword [ebp - 0x67c], 0
jmp 0x469eb3
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 2
jge 0x469ecf
mov eax, dword [ebp - 0x67c]
mov dword [ebp + eax*4 - 0x2d4c], 0xffffffff
jmp 0x469ea6
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x469ee7
call dword [sym.imp.GDI32.dll_GdiFlush]
cmp dword [ebp - 0x9c], 0x64f7d9fd
jne 0x469eff
mov dword [ebp - 0x207c], 1
jmp 0x469f06
and dword [ebp - 0x207c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27f4]
cmp dword [ebp - 0x207c], eax
jl 0x469f26
mov dword [ebp - 0x18fc], 1
jmp 0x469f2d
and dword [ebp - 0x18fc], 0
mov eax, dword [ebp - 0x18fc]
neg eax
cmp eax, 0xfffffff8
jl 0x469f46
mov dword [ebp - 0x1b20], 1
jmp 0x469f4d
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0x1b20]
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x9a4]
cmp dword [ebp - 0xc38], eax
jne 0x469f77
mov dword [ebp - 0x1b28], 1
jmp 0x469f7e
and dword [ebp - 0x1b28], 0
mov eax, dword [ebp - 0x684]
cmp dword [ebp - 0x1b28], eax
jg 0x469f98
mov dword [ebp - 0xbb4], 1
jmp 0x469f9f
and dword [ebp - 0xbb4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbb4]
mov dword [ebp + eax - 0x2d4c], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0xbb4], eax
jne 0x469fd7
xor eax, eax
je 0x469fd7
mov dword [ebp - 0xc40], 1
jmp 0x469fde
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0xbc4]
inc eax
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbc4]
neg eax
sub eax, dword [ebp - 0xc40]
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ebp + ecx*4 - 0x9a4]
je 0x46a011
mov dword [ebp - 0xc48], 1
jmp 0x46a018
and dword [ebp - 0xc48], 0
mov dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x1b30]
cmp eax, dword [ebp - 0xc48]
jle 0x46a03c
mov dword [ebp - 0x1b38], 1
jmp 0x46a043
and dword [ebp - 0x1b38], 0
mov eax, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x1b38], 5
mov eax, dword [ebp + eax*4 - 0x9a4]
add eax, ecx
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc50]
mov dword [ebp + eax*4 - 0x9a4], ecx
mov eax, dword [ebp - 0xc50]
sub eax, dword [ebp - 0x90c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x27f4]
jne 0x46a093
mov dword [ebp - 0x1b40], 1
jmp 0x46a09a
and dword [ebp - 0x1b40], 0
cmp dword [ebp - 0x1b40], 1
jle 0x46a0af
mov dword [ebp - 0xc58], 1
jmp 0x46a0b6
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0xc58], eax
jg 0x46a0d0
mov dword [ebp - 0x1b48], 1
jmp 0x46a0d7
and dword [ebp - 0x1b48], 0
cmp dword [ebp - 0x1b48], 0xad47
jge 0x46a0ef
mov dword [ebp - 0xc60], 1
jmp 0x46a0f6
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xc60]
sub eax, dword [ebp - 0x90c]
mov dword [ebp - 0x1b50], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b50]
mov dword [ebp + eax - 0x27f4], ecx
cmp dword [ebp - 0x1b50], 1
jl 0x46a12f
mov dword [ebp - 0xc68], 1
jmp 0x46a136
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xc68]
sub eax, dword [ebp - 0x90c]
neg eax
mov dword [ebp - 0x90c], eax
jmp 0x469e6b
mov eax, dword [ebp - 0x1b58]
dec eax
mov dword [ebp - 0x1b58], eax
lea ecx, [ebp - 0x325c]
call fcn.00431872
jmp 0x46a32f
mov dword [ebp - 0x1b68], 0x49fec891
mov dword [ebp - 0x2e9c], 1
mov dword [ebp - 0xc78], 0xbf4a26e3
mov dword [ebp - 0x32c], 0
jmp 0x46a1a3
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jg 0x46a32f
mov dword [ebp - 0x4e0], 8
mov dword [ebp - 0x2358], 0xffffffff
mov dword [ebp - 0x334], 0
jmp 0x46a1dd
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jg 0x46a201
push dword [ebp - 0x334]
lea ecx, [ebp - 0x21c8]
call fcn.0043188e
mov eax, dword [eax]
mov dword [ebp - 0x684], eax
jmp 0x46a1d0
xor eax, eax
jne 0x46a217
cmp dword [ebp - 0x4e0], 0
jne 0x46a217
and dword [ebp - 0x2348], 0
jmp 0x46a221
mov dword [ebp - 0x2348], 1
mov esi, dword [ebp - 0x4e0]
mov edi, dword [ebp - 0x4e0]
push 0
lea ecx, [ebp - 0x21c8]
call fcn.0043188e
imul edi, dword [eax]
cmp esi, edi
jg 0x46a24d
mov dword [ebp - 0xc70], 1
jmp 0x46a254
and dword [ebp - 0xc70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0xc70], eax
jl 0x46a272
cmp dword [ebp - 0x4e0], 0
je 0x46a287
cmp dword [ebp - 0x4e0], 0
je 0x46a287
mov dword [ebp - 0x1b60], 1
jmp 0x46a28e
and dword [ebp - 0x1b60], 0
cmp dword [ebp - 0x1b60], 0xfffc
jb 0x46a2a6
mov dword [ebp - 0x2350], 1
jmp 0x46a2ad
and dword [ebp - 0x2350], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x2ea4], eax
push 0
lea ecx, [ebp - 0x21c8]
call fcn.0043188e
mov eax, dword [eax]
sub eax, dword [ebp - 0x1b68]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x9a4]
mov dword [ebp - 0xc78], eax
jne 0x46a2f5
cmp dword [ebp - 0x1b68], 0
jne 0x46a2f5
and dword [ebp - 0xc80], 0
jmp 0x46a2ff
mov dword [ebp - 0xc80], 1
cmp dword [ebp - 0xc80], 0x4140
jl 0x46a317
mov dword [ebp - 0x1b70], 1
jmp 0x46a31e
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0x1b70]
mov dword [ebp - 0x2358], eax
jmp 0x46a196
lea ecx, [ebp - 0x21c8]
call fcn.00431872
mov dword [ebp - 0x7fc], 0
jmp 0x46a353
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 2
jge 0x46a375
push dword [ebp - 0x7fc]
lea ecx, [ebp - 0x2bd4]
call fcn.0043188e
mov dword [eax], 0xdf99ff60
jmp 0x46a346
push 1
lea ecx, [ebp - 0x20b8]
call fcn.004317a0
mov dword [ebp - 0xc90], 0x6a07563f
mov dword [ebp - 0x1b88], 0xc17c7747
mov dword [ebp - 0x2360], 0xfffffffd
mov dword [ebp - 0x2eac], 0x29a2a67f
mov dword [ebp - 0x1b90], 0xbe9
push 3
lea ecx, [ebp - 0x326c]
call fcn.004317a0
mov dword [ebp - 0x48], 0
jmp 0x46a3d1
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x46a3e7
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x2374], 1
jmp 0x46a3ca
mov dword [ebp - 0x48], 0
jmp 0x46a3f7
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x46a413
push dword [ebp - 0x48]
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
mov dword [eax], 1
jmp 0x46a3f0
mov dword [ebp - 0x48], 0
jmp 0x46a423
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x46a43f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x326c]
call fcn.0043188e
mov dword [eax], 0x678d5680
jmp 0x46a41c
push 0
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
mov dword [eax], 1
jmp 0x46a478
push 0
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp - 0xc88]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc88]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
cmp dword [eax], 0
jl 0x46a587
mov dword [ebp - 0x1b80], 0xfffffffe
push 0
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x2374]
push 0
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
mov eax, dword [eax]
add esi, dword [ebp + eax*4 - 0x2374]
jne 0x46a4df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2374], 0
jne 0x46a4df
and dword [ebp - 0x1b78], 0
jmp 0x46a4e9
mov dword [ebp - 0x1b78], 1
cmp dword [ebp - 0x1b78], 0
jne 0x46a550
mov dword [ebp - 0xc90], 0x71bc
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0x1b80], eax
cmp dword [ebp - 0x1b80], 0xfffffffd
jle 0x46a51d
mov dword [ebp - 0xc98], 1
jmp 0x46a524
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x1b88], eax
mov esi, dword [ebp - 0x1b88]
push 0
lea ecx, [ebp - 0x20b8]
call fcn.0043188e
cmp dword [eax], esi
je 0x46a550
and dword [ebp - 0xca0], 0
jmp 0x46a55a
mov dword [ebp - 0xca0], 1
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x2360], eax
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x46a582
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x46a454
mov eax, dword [ebp - 0x1b90]
inc eax
mov dword [ebp - 0x1b90], eax
lea ecx, [ebp - 0x326c]
call fcn.00431872
lea ecx, [ebp - 0x20b8]
call fcn.00431872
mov dword [ebp - 0x68c], 0
jmp 0x46a5c3
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 1
jg 0x46c382
and dword [ebp - 0x29d8], 0
and dword [ebp - 0x29d4], 0
and dword [ebp - 0x29d0], 0
and dword [ebp - 0x29cc], 0
lea ecx, [ebp - 0xb41]
call fcn.0043189d
push eax
lea eax, [ebp - 0x29c8]
push eax
lea eax, [ebp - 0x29d8]
push eax
lea ecx, [ebp - 0x36f0]
call fcn.004318a0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x28d4]
call fcn.0043184c
mov dword [ebp - 0x8b4], 0
jmp 0x46a63a
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 3
jge 0x46a656
mov eax, dword [ebp - 0x8b4]
mov dword [ebp + eax*4 - 0x372c], 0x1dbeccce
jmp 0x46a62d
push 0
lea ecx, [ebp - 0x28d4]
call fcn.0043188e
mov dword [eax], 0xffffffe7
jmp 0x46a68f
push 0
lea ecx, [ebp - 0x28d4]
call fcn.0043188e
mov dword [ebp - 0xca8], eax
mov eax, dword [ebp - 0xca8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xca8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x28d4]
call fcn.0043188e
cmp dword [eax], 5
jl 0x46a6f3
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x694], 2
jmp 0x46a6c4
mov eax, dword [ebp - 0x694]
dec eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0
jl 0x46a6ee
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x46a6ec
push 0xce9
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x46a6b7
jmp 0x46a66b
lea ecx, [ebp - 0x28d4]
call fcn.00431872
mov dword [ebp - 0x1e8], 0x4696a485
mov dword [ebp - 0x498], 0xfffffffe
push 2
lea ecx, [ebp - 0x28ec]
call fcn.004317a0
mov dword [ebp - 0x2368], 5
mov dword [ebp - 0xbcc], 1
mov dword [ebp - 0x1ba8], 0x7c7128ab
mov dword [ebp - 0x804], 0xffffffff
mov dword [ebp - 0x2484], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x46a76a
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x46a78c
push dword [ebp - 0x218]
lea ecx, [ebp - 0x28ec]
call fcn.0043188e
mov dword [eax], 0xfff9
jmp 0x46a75d
mov dword [ebp - 0x218], 0
jmp 0x46a7a5
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 4
jge 0x46a7c1
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x2994], 0xa017779a
jmp 0x46a798
mov dword [ebp - 0x498], 2
jmp 0x46a7da
mov eax, dword [ebp - 0x498]
dec eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0xffffffec
jle 0x46a82a
mov dword [ebp - 0x610], 0x86cce57b
mov dword [ebp - 0x610], 0
jmp 0x46a806
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 2
jge 0x46a828
push dword [ebp - 0x610]
lea ecx, [ebp - 0x28ec]
call fcn.0043188e
mov dword [eax], 0xcd53
jmp 0x46a7f9
jmp 0x46a7cd
mov eax, dword [ebp - 0x2368]
mov dword [ebp - 0x2eb4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2994]
mov dword [ebp - 0x2ebc], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x2994], 0xffffffff
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2994]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
add eax, 0x4ddb
or ecx, 0xffffffff
sub ecx, eax
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x2994]
jl 0x46a895
mov dword [ebp - 0x1b98], 1
jmp 0x46a89c
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x1b98]
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0xbcc], 0
jne 0x46a8c3
cmp dword [ebp - 0xbcc], 0
jne 0x46a8c3
and dword [ebp - 0xcb0], 0
jmp 0x46a8cd
mov dword [ebp - 0xcb0], 1
mov eax, dword [ebp - 0x1ba8]
cmp dword [ebp - 0xcb0], eax
jle 0x46a8e7
mov dword [ebp - 0x1ba0], 1
jmp 0x46a8ee
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x804]
cmp dword [ebp - 0x1ba0], eax
je 0x46a908
mov dword [ebp - 0xcb8], 1
jmp 0x46a90f
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xcb8]
sub eax, 0xfafb
cmp eax, dword [ebp - 0x804]
je 0x46a949
push 0
lea ecx, [ebp - 0x28ec]
call fcn.0043188e
cmp dword [eax], 0
je 0x46a949
cmp dword [ebp - 0x804], 0
je 0x46a949
mov dword [ebp - 0x247c], 1
jmp 0x46a950
and dword [ebp - 0x247c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2994]
mov dword [ebp - 0x2ec4], eax
imul eax, dword [ebp - 0x2484], 0xb187
add eax, dword [ebp - 0x804]
mov dword [ebp - 0x1ba8], eax
lea ecx, [ebp - 0x28ec]
call fcn.00431872
mov dword [ebp - 0x1e8], 0
jmp 0x46a99c
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jg 0x46bf95
mov dword [ebp - 0x69c], 0
mov dword [ebp - 0x69c], 0
jmp 0x46a9cc
mov eax, dword [ebp - 0x69c]
dec eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 0xffffffff
jne 0x46aabc
mov dword [ebp - 0x93c], 0
jmp 0x46a9f2
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 3
jge 0x46aa0e
mov eax, dword [ebp - 0x93c]
mov dword [ebp + eax*4 - 0x25d4], 4
jmp 0x46a9e5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x25d4], 0
jmp 0x46aa39
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x25d4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x25d4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x25d4], 0x1d
jge 0x46aab7
mov dword [ebp - 0x6a4], 0
jmp 0x46aa61
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 2
jge 0x46aa7d
mov eax, dword [ebp - 0x6a4]
mov dword [ebp + eax*4 - 0x2d58], 1
jmp 0x46aa54
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x25d4], 0xffffffff
jg 0x46aa98
mov dword [ebp - 0xcc0], 1
jmp 0x46aa9f
and dword [ebp - 0xcc0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp + eax - 0x2d58], ecx
jmp 0x46aa20
jmp 0x46a9bf
push 4
lea ecx, [ebp - 0x25f4]
call fcn.004317a0
mov dword [ebp - 0x548], 2
mov dword [ebp - 0x10c], 0x268f
push 4
lea ecx, [ebp - 0x9ec]
call fcn.004317a0
mov dword [ebp - 0x508], 0x4d258d03
mov dword [ebp - 0xec], 0xb0ce
mov dword [ebp - 0x70], 0x8e548e01
mov dword [ebp - 0x5c0], 0x4edb553a
mov dword [ebp - 0xbd4], 0x5f6
mov dword [ebp - 0x80c], 0
jmp 0x46ab32
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 4
jge 0x46ab51
push dword [ebp - 0x80c]
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
and dword [eax], 0
jmp 0x46ab25
mov byte [ebp - 0x2d7], 0
movzx eax, byte [ebp - 0x2d7]
test eax, eax
je 0x46ab69
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x10c], 0x95a5
jle 0x46ab8e
mov dword [ebp - 0x248c], 1
jmp 0x46ab95
and dword [ebp - 0x248c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2ecc], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x2ed4], eax
push 3
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
mov eax, dword [eax]
sub eax, 0xbb30
cmp eax, dword [ebp - 0x70]
jle 0x46abdb
mov eax, 0x183a0997
test eax, eax
je 0x46abdb
mov dword [ebp - 0x1bb0], 1
jmp 0x46abe2
and dword [ebp - 0x1bb0], 0
push 2
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
mov ecx, dword [ebp - 0x1bb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2edc], eax
cmp dword [ebp - 0x5c0], 0xed73
je 0x46ac18
mov dword [ebp - 0xcc8], 1
jmp 0x46ac1f
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0x548]
add eax, dword [ebp - 0xcc8]
cmp eax, 0xf985
je 0x46ac3e
mov dword [ebp - 0x2494], 1
jmp 0x46ac45
and dword [ebp - 0x2494], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x2ee4], eax
mov eax, dword [ebp - 0x5c0]
cmp dword [ebp - 0x10c], eax
je 0x46ac6b
mov dword [ebp - 0x1bb8], 1
jmp 0x46ac72
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1bb8], eax
jg 0x46ac8c
mov dword [ebp - 0xcd0], 1
jmp 0x46ac93
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xcd0], eax
jge 0x46acad
mov dword [ebp - 0x249c], 1
jmp 0x46acb4
and dword [ebp - 0x249c], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x2eec], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2ef4], eax
cmp dword [ebp - 0x5c0], 0xc040
jne 0x46ace4
mov dword [ebp - 0x1bc0], 1
jmp 0x46aceb
and dword [ebp - 0x1bc0], 0
mov eax, dword [ebp - 0x1bc0]
sub eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x5c0]
je 0x46ad12
mov dword [ebp - 0xcd8], 1
jmp 0x46ad19
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0xcd8], eax
jle 0x46ad33
mov dword [ebp - 0x1bc8], 1
jmp 0x46ad3a
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1bc8], eax
jg 0x46ad54
mov dword [ebp - 0xce0], 1
jmp 0x46ad5b
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x2efc], eax
push 3
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
mov eax, dword [eax]
inc eax
cmp eax, dword [ebp - 0xec]
jge 0x46ad97
mov dword [ebp - 0x1bd0], 1
jmp 0x46ad9e
and dword [ebp - 0x1bd0], 0
cmp dword [ebp - 0x1bd0], 0xb95d
jl 0x46adb6
mov dword [ebp - 0xce8], 1
jmp 0x46adbd
and dword [ebp - 0xce8], 0
cmp dword [ebp - 0xce8], 1
jle 0x46add2
mov dword [ebp - 0x1bd8], 1
jmp 0x46add9
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1bd8], eax
jl 0x46adf3
mov dword [ebp - 0xcf0], 1
jmp 0x46adfa
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0xcf0]
test eax, eax
je 0x46b062
mov dword [ebp - 0x108], 6
mov dword [ebp - 0x1be8], 0x8947de68
mov eax, dword [ebp - 0x108]
inc eax
jne 0x46aece
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2f04], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x2f0c], eax
push 3
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
push 2
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
cmp dword [eax], 0
jne 0x46ae6d
mov dword [ebp - 0x1be0], 1
jmp 0x46ae74
and dword [ebp - 0x1be0], 0
cmp dword [ebp - 0x1be0], 0x53593517
jge 0x46ae8c
mov dword [ebp - 0xcf8], 1
jmp 0x46ae93
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xcf8]
mov dword [ebp - 0x1be8], eax
mov eax, dword [ebp - 0x1be8]
mov dword [ebp - 0x2f14], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x2f1c], eax
mov eax, dword [ebp - 0xbd4]
cmp dword [ebp - 0x5c0], eax
jge 0x46aece
and dword [ebp - 0xd00], 0
jmp 0x46aed8
mov dword [ebp - 0xd00], 1
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0xd00], eax
je 0x46aef2
mov dword [ebp - 0x1bf0], 1
jmp 0x46aef9
and dword [ebp - 0x1bf0], 0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x1bf0]
add eax, dword [ebp - 0x108]
mov dword [ebp - 0xd08], eax
push 2
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
mov ecx, dword [ebp - 0xd08]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xd08], eax
jg 0x46af40
mov dword [ebp - 0x1bf8], 1
jmp 0x46af47
and dword [ebp - 0x1bf8], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x1bf8], eax
jge 0x46af61
mov dword [ebp - 0x24a4], 1
jmp 0x46af68
and dword [ebp - 0x24a4], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x2f24], eax
mov eax, dword [ebp - 0x108]
add eax, 0x510
imul eax, dword [ebp - 0x108]
sub eax, dword [ebp - 0x108]
je 0x46b01b
mov dword [ebp - 0x508], 0
jmp 0x46afab
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 3
jg 0x46b019
mov dword [ebp - 0x70], 0
jmp 0x46afc4
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x46afdd
push dword [ebp - 0x70]
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
and dword [eax], 0
jmp 0x46afbd
mov byte [ebp - 0x2d9], 0
movzx eax, byte [ebp - 0x2d9]
test eax, eax
je 0x46b017
push 0x25ec
push 0x939
push 0xc8c
push 0xc6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x46af9e
jmp 0x46b05d
mov dword [ebp - 0x10c], 0
jmp 0x46b034
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 9
jne 0x46b05d
mov byte [ebp - 0x2db], 0
movzx eax, byte [ebp - 0x2db]
test eax, eax
je 0x46b05b
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x46b027
jmp 0x46b132
mov dword [ebp - 0x70], 0
jmp 0x46b072
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x46b132
mov dword [ebp - 0x24ac], 1
mov dword [ebp - 0xec], 3
jmp 0x46b09f
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x46b12d
mov eax, 0x84746ba8
test eax, eax
je 0x46b0d7
push dword [ebp - 0xec]
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
cmp dword [eax], 0
je 0x46b0d7
mov dword [ebp - 0xd10], 1
jmp 0x46b0de
and dword [ebp - 0xd10], 0
push dword [ebp - 0xec]
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
mov ecx, dword [ebp - 0xd10]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x24ac]
jle 0x46b10b
mov dword [ebp - 0x1c00], 1
jmp 0x46b112
and dword [ebp - 0x1c00], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x9ec]
call fcn.0043188e
mov ecx, dword [ebp - 0x1c00]
mov dword [eax], ecx
jmp 0x46b092
jmp 0x46b06b
lea ecx, [ebp - 0x9ec]
call fcn.00431872
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x4a0], 0x57478144
cmp dword [ebp - 0x40], 1
jne 0x46b160
mov dword [ebp - 0x1c10], 1
jmp 0x46b167
and dword [ebp - 0x1c10], 0
cmp dword [ebp - 0x40], 0xffff
jne 0x46b17c
mov dword [ebp - 0xd18], 1
jmp 0x46b183
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xd18], eax
je 0x46b19a
mov dword [ebp - 0x1c08], 1
jmp 0x46b1a1
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1c08]
cmp eax, dword [ebp - 0x40]
jg 0x46b1bb
mov dword [ebp - 0xd20], 1
jmp 0x46b1c2
and dword [ebp - 0xd20], 0
cmp dword [ebp - 0xd20], 0
jae 0x46b1d7
mov dword [ebp - 0x24b4], 1
jmp 0x46b1de
and dword [ebp - 0x24b4], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2f2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2f34], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4a0], eax
imul eax, dword [ebp - 0x4a0], 0xfff7
cmp dword [ebp - 0x1c10], eax
jge 0x46b217
mov dword [ebp - 0xd28], 1
jmp 0x46b21e
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xd28], eax
jne 0x46b245
mov dword [ebp - 0x1c18], 0xfffffff9
mov eax, dword [ebp - 0x1c18]
dec eax
mov dword [ebp - 0x1c18], eax
jmp 0x46b411
mov dword [ebp - 0xbdc], 1
mov dword [ebp - 0x6ac], 0x85b
mov dword [ebp - 0x24c4], 0x2bab91ee
mov dword [ebp - 0x40], 0x19
jmp 0x46b273
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 9
jge 0x46b3d7
mov dword [ebp - 0x24bc], 0xa59c3cba
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0x2f3c], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x2f44], eax
mov eax, 0x836e
cmp eax, 0xffff
ja 0x46b2b7
mov dword [ebp - 0xd30], 1
jmp 0x46b2be
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0xd30]
sub eax, 3
cmp dword [ebp - 0xbdc], eax
jne 0x46b2e1
mov eax, 0xc1543f36
test eax, eax
jne 0x46b2e1
and dword [ebp - 0x1c20], 0
jmp 0x46b2eb
mov dword [ebp - 0x1c20], 1
cmp dword [ebp - 0x1c20], 1
jbe 0x46b300
mov dword [ebp - 0xd38], 1
jmp 0x46b307
and dword [ebp - 0xd38], 0
cmp dword [ebp - 0xd38], 0x2625
jne 0x46b31f
mov dword [ebp - 0x1c28], 1
jmp 0x46b326
and dword [ebp - 0x1c28], 0
cmp dword [ebp - 0x1c28], 0x15051aca
je 0x46b33e
mov dword [ebp - 0xd40], 1
jmp 0x46b345
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x4a0]
cmp eax, dword [ebp - 0xd40]
jne 0x46b35f
mov dword [ebp - 0x1c30], 1
jmp 0x46b366
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0x1c30]
sub eax, dword [ebp - 0x6ac]
je 0x46b389
cmp dword [ebp - 0x6ac], 0
je 0x46b389
mov dword [ebp - 0xd48], 1
jmp 0x46b390
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x24bc], eax
mov byte [ebp - 0x2dd], 0
movzx eax, byte [ebp - 0x2dd]
test eax, eax
je 0x46b3d2
push 0xe2
push 0
push 0
push 0
push 0
push 0x1685
push 0x1276
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
jmp 0x46b26c
cmp dword [ebp - 0x6ac], 0
je 0x46b400
mov eax, dword [ebp - 0x4a0]
imul eax, dword [ebp - 0xbdc]
test eax, eax
je 0x46b400
mov eax, dword [ebp - 0x6ac]
add eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x4a0]
mov eax, 0x97f1
imul eax, eax, 0xbcce
mov dword [ebp - 0x24c4], eax
mov dword [ebp - 0x8bc], 0
jmp 0x46b42a
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 4
jge 0x46b44c
push dword [ebp - 0x8bc]
lea ecx, [ebp - 0x25f4]
call fcn.0043188e
mov dword [eax], 0x7161ab6e
jmp 0x46b41d
mov dword [ebp - 0x4e8], 9
mov dword [ebp - 0x24e4], 0x7730f94f
mov dword [ebp - 0xd70], 0xfffffff6
mov dword [ebp - 0x1c48], 0x11accbad
mov dword [ebp - 0x33c], 0xfffffff8
mov dword [ebp - 0xd60], 0
mov dword [ebp - 0x24d4], 0x1de9829c
mov dword [ebp - 0x24dc], 2
mov dword [ebp - 0x6b4], 0
jmp 0x46b4b5
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 1
jge 0x46b4d1
mov eax, dword [ebp - 0x6b4]
mov dword [ebp + eax*4 - 0x24cc], 0
jmp 0x46b4a8
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x4e8], 0
je 0x46b5c3
mov eax, 0x7c2c
test eax, eax
je 0x46b5a2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24cc], 0xffffffff
mov eax, dword [ebp - 0x33c]
inc eax
cmp eax, dword [ebp - 0xd60]
jge 0x46b52d
mov eax, 0x6aac
test eax, eax
je 0x46b52d
mov dword [ebp - 0x1c38], 1
jmp 0x46b534
and dword [ebp - 0x1c38], 0
mov eax, dword [ebp - 0x4e8]
cmp dword [ebp - 0x1c38], eax
jne 0x46b54e
mov dword [ebp - 0xd50], 1
jmp 0x46b555
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x2f4c], eax
mov eax, dword [ebp - 0x4e8]
add eax, dword [ebp - 0xd50]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x2f54], eax
mov eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0x33c]
je 0x46b5a2
cmp dword [ebp - 0x24d4], 0
je 0x46b5a2
mov dword [ebp - 0x1c40], 1
jmp 0x46b5a9
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x1c40], eax
jg 0x46b5c3
mov dword [ebp - 0xd58], 1
jmp 0x46b5ca
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0x1c48], eax
cmp dword [ebp - 0x1c48], 0
jl 0x46b5eb
mov dword [ebp - 0x1c50], 1
jmp 0x46b5f2
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0xd60]
cmp dword [ebp - 0x1c50], eax
je 0x46b60c
mov dword [ebp - 0xd68], 1
jmp 0x46b613
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0xd68], eax
jne 0x46b62d
mov dword [ebp - 0x1c58], 1
jmp 0x46b634
and dword [ebp - 0x1c58], 0
mov eax, dword [ebp - 0x1c58]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x24dc]
cmp dword [ebp - 0xd70], eax
jne 0x46b65a
mov dword [ebp - 0x1c60], 1
jmp 0x46b661
and dword [ebp - 0x1c60], 0
mov eax, dword [ebp - 0x1c60]
mov dword [ebp - 0x24e4], eax
push 3
lea ecx, [ebp - 0x25f4]
call fcn.0043188e
and dword [eax], 0
jmp 0x46b6a3
push 3
lea ecx, [ebp - 0x25f4]
call fcn.0043188e
cmp dword [eax], 1
jg 0x46bf85
mov dword [ebp - 0x12c], 0x7230
mov dword [ebp - 0xbe4], 0x1705
mov dword [ebp - 0x1c68], 0
mov dword [ebp - 0x24f4], 0x6c84
mov dword [ebp - 0xd98], 1
mov dword [ebp - 0x24fc], 0xbb2c593c
cmp dword [ebp - 0x12c], 0xa66e
jle 0x46b70d
mov dword [ebp - 0x1c70], 1
jmp 0x46b714
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x12c], eax
je 0x46b72e
mov dword [ebp - 0x24ec], 1
jmp 0x46b735
and dword [ebp - 0x24ec], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x2f5c], eax
mov eax, dword [ebp - 0xbe4]
inc eax
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x1c68], eax
mov eax, dword [ebp - 0x1c68]
cmp dword [ebp - 0xbe4], eax
jle 0x46b774
mov dword [ebp - 0xd80], 1
jmp 0x46b77b
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0xd80]
cmp eax, dword [ebp - 0x12c]
jge 0x46b79b
mov dword [ebp - 0xd88], 1
jmp 0x46b7a2
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x1c70]
cmp eax, dword [ebp - 0xd88]
jge 0x46b7bc
mov dword [ebp - 0x1c78], 1
jmp 0x46b7c3
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x1c78], eax
jl 0x46b7e6
cmp dword [ebp - 0x24f4], 0
je 0x46b7e6
mov dword [ebp - 0xd90], 1
jmp 0x46b7ed
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0xd90]
cmp eax, dword [ebp - 0x12c]
jl 0x46b80d
mov dword [ebp - 0x1c80], 1
jmp 0x46b814
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0x1c80]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xd98], eax
jle 0x46b83a
mov dword [ebp - 0x1c88], 1
jmp 0x46b841
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x1c88]
mov dword [ebp - 0x24fc], eax
mov byte [ebp - 0x2df], 0
movzx eax, byte [ebp - 0x2df]
test eax, eax
je 0x46b871
push 0x51a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 2
lea ecx, [ebp - 0x960]
call fcn.004317a0
mov dword [ebp - 0x550], 0x6a58390a
mov dword [ebp - 0x814], 0
jmp 0x46b8a1
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 2
jge 0x46b8c3
push dword [ebp - 0x814]
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov dword [eax], 5
jmp 0x46b894
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov esi, eax
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x46b8f1
mov dword [ebp - 0x2504], 1
jmp 0x46b8f8
and dword [ebp - 0x2504], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov eax, dword [eax]
dec eax
jne 0x46b932
push 1
lea ecx, [ebp - 0x960]
call fcn.0043188e
cmp dword [eax], 0
jne 0x46b932
and dword [ebp - 0xda0], 0
jmp 0x46b93c
mov dword [ebp - 0xda0], 1
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov ecx, dword [ebp - 0xda0]
cmp ecx, dword [eax]
jl 0x46b95f
mov dword [ebp - 0x1c90], 1
jmp 0x46b966
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x1c90]
neg eax
je 0x46b99e
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x46b999
push 0x16f3
push 0x11fe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x46bd88
mov dword [ebp - 0x290], 0xed99ea7e
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x251c], 5
mov dword [ebp - 0x290], 0x1a
jmp 0x46b9d5
cmp dword [ebp - 0x290], 8
je 0x46bc28
mov dword [ebp - 0x27d4], 0xffffffff
mov dword [ebp - 0x27d0], 0xffffffff
mov dword [ebp - 0x27cc], 0xffffffff
mov dword [ebp - 0x27c8], 0xffffffff
mov dword [ebp - 0xaf8], 0xfffc
mov dword [ebp - 0x2514], 0xfffffffa
cmp dword [ebp - 0x5f8], 0
je 0x46ba3c
cmp dword [ebp - 0x5f8], 0
je 0x46ba3c
mov dword [ebp - 0xda8], 1
jmp 0x46ba43
and dword [ebp - 0xda8], 0
cmp dword [ebp - 0xda8], 1
je 0x46ba58
mov dword [ebp - 0x1c98], 1
jmp 0x46ba5f
and dword [ebp - 0x1c98], 0
cmp dword [ebp - 0x1c98], 0x1cad
jl 0x46ba84
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x27d4], 0
jne 0x46ba84
and dword [ebp - 0x250c], 0
jmp 0x46ba8e
mov dword [ebp - 0x250c], 1
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2f64], eax
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x2f6c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x27d4], 0
jne 0x46bacf
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x27d4], 0
jne 0x46bacf
and dword [ebp - 0xdb0], 0
jmp 0x46bad9
mov dword [ebp - 0xdb0], 1
mov eax, dword [ebp - 0xdb0]
sub eax, 9
cmp eax, dword [ebp - 0xaf8]
jg 0x46baf6
mov dword [ebp - 0x1ca0], 1
jmp 0x46bafd
and dword [ebp - 0x1ca0], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
imul ecx, dword [ebp - 0x1ca0], 0xedaa
cmp dword [eax], ecx
jle 0x46bb24
mov dword [ebp - 0xdb8], 1
jmp 0x46bb2b
and dword [ebp - 0xdb8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x27d4]
neg eax
cmp eax, dword [ebp - 0xdb8]
jg 0x46bb4e
mov dword [ebp - 0x1ca8], 1
jmp 0x46bb55
and dword [ebp - 0x1ca8], 0
push 1
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov ecx, dword [ebp - 0x1ca8]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xaf8]
jl 0x46bb7e
mov dword [ebp - 0xdc0], 1
jmp 0x46bb85
and dword [ebp - 0xdc0], 0
cmp dword [ebp - 0xdc0], 0x4577
jl 0x46bb9d
mov dword [ebp - 0x1cb0], 1
jmp 0x46bba4
and dword [ebp - 0x1cb0], 0
cmp dword [ebp - 0x1cb0], 5
je 0x46bbb9
mov dword [ebp - 0xdc8], 1
jmp 0x46bbc0
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0x5f8]
imul eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0
jne 0x46bbee
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2f74], eax
cmp dword [ebp - 0x550], 0
je 0x46bc5b
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
cmp dword [eax], 0
je 0x46bc5b
mov dword [ebp - 0x1cc0], 1
jmp 0x46bc62
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x1cc0], eax
jl 0x46bc7c
mov dword [ebp - 0xdd8], 1
jmp 0x46bc83
and dword [ebp - 0xdd8], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xdd8]
jg 0x46bca6
mov dword [ebp - 0x1cc8], 1
jmp 0x46bcad
and dword [ebp - 0x1cc8], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1cc8]
jle 0x46bcd0
mov dword [ebp - 0xde0], 1
jmp 0x46bcd7
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0xde0]
cmp eax, 0x686b464b
jge 0x46bcf6
mov dword [ebp - 0x1cd0], 1
jmp 0x46bcfd
and dword [ebp - 0x1cd0], 0
cmp dword [ebp - 0x1cd0], 0xfa81
jg 0x46bd15
mov dword [ebp - 0xde8], 1
jmp 0x46bd1c
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x5f8], eax
jge 0x46bd4b
mov eax, 0xfffb
test eax, eax
je 0x46bd4b
mov dword [ebp - 0x1cd8], 1
jmp 0x46bd52
and dword [ebp - 0x1cd8], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.0043188e
mov ecx, dword [ebp - 0x1cd8]
cmp ecx, dword [eax]
je 0x46bd75
mov dword [ebp - 0xdf0], 1
jmp 0x46bd7c
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x251c], eax
lea ecx, [ebp - 0x960]
call fcn.00431872
mov byte [ebp - 0x2e7], 0
mov dword [ebp - 0x6bc], 0x2e91a049
mov byte [ebp - 0x2e3], 0
movzx eax, byte [ebp - 0x2e3]
test eax, eax
je 0x46bdd1
push 0
push 0x15a7
push 0
push 0
push 0x1aa9
push 0x12f5
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x6bc], 0xffffffe4
jmp 0x46bdea
cmp dword [ebp - 0x6bc], 0xfffffff1
jge 0x46be18
lea ecx, [ebp - 0x25f4]
call fcn.00431872
jmp 0x46a98f
mov dword [ebp - 0x34c8], 0xffffffff
mov dword [ebp - 0x34c4], 0xffffffff
mov dword [ebp - 0x34c0], 0xffffffff
mov dword [ebp - 0x34bc], 0xffffffff
mov byte [ebp - 0x2eb], 0
movzx eax, byte [ebp - 0x2eb]
test eax, eax
je 0x46bfde
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x46c024
push 0
push 0xed
push 0x1644
push 0x24fa
push 0x1a28
push 0x1204
push 0x99b
push 0x26ef
push 0x203b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x1e8], 1
jmp 0x46c03d
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x46c37d
mov dword [ebp - 0x530], 8
push 3
lea ecx, [ebp - 0x2c1c]
call fcn.004317a0
mov dword [ebp - 0x2524], 0xfffffffc
mov dword [ebp - 0x6cc], 0
jmp 0x46c084
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 3
jge 0x46c0a6
push dword [ebp - 0x6cc]
lea ecx, [ebp - 0x2c1c]
call fcn.0043188e
mov dword [eax], 0xfffffff7
jmp 0x46c077
mov dword [ebp - 0x530], 0
jmp 0x46c0bf
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x1c
jge 0x46c10f
mov dword [ebp - 0x5c8], 0xffffffff
mov dword [ebp - 0x5c8], 0
jmp 0x46c0eb
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 3
jge 0x46c10d
push dword [ebp - 0x5c8]
lea ecx, [ebp - 0x2c1c]
call fcn.0043188e
mov dword [eax], 4
jmp 0x46c0de
jmp 0x46c0b2
mov eax, dword [ebp - 0x2524]
mov dword [ebp - 0x530], eax
lea ecx, [ebp - 0x2c1c]
call fcn.00431872
mov dword [ebp - 0x8c4], 0x6887e08a
mov dword [ebp - 0x2f7c], 0xa6318529
mov dword [ebp - 0x2f84], 0x39beb064
mov dword [ebp - 0x2f8c], 0xffffffff
mov dword [ebp - 0x2f94], 0xe90a624c
mov dword [ebp - 0x2f9c], 0xaeb9ae77
mov dword [ebp - 0x2fa4], 0xed680444
push 3
lea ecx, [ebp - 0x327c]
call fcn.004317a0
mov dword [ebp - 0x2fac], 0xd9e2a8d3
push 4
lea ecx, [ebp - 0x2b74]
call fcn.004317a0
mov dword [ebp - 0x180], 0
jmp 0x46c1a9
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x46c1c8
push dword [ebp - 0x180]
lea ecx, [ebp - 0x327c]
call fcn.0043188e
or dword [eax], 0xffffffff
jmp 0x46c19c
mov dword [ebp - 0x180], 0
jmp 0x46c1e1
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 4
jge 0x46c203
push dword [ebp - 0x180]
lea ecx, [ebp - 0x2b74]
call fcn.0043188e
mov dword [eax], 0x3c67ee39
jmp 0x46c1d4
push 2
lea ecx, [ebp - 0x2b74]
call fcn.0043188e
mov dword [ebp - 0x1ce0], eax
mov eax, dword [ebp - 0x1ce0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1ce0]
mov dword [ecx], eax
lea ecx, [ebp - 0x2b74]
call fcn.00431872
lea ecx, [ebp - 0x327c]
call fcn.00431872
mov dword [ebp - 0x8c4], 1
jmp 0x46c256
mov eax, dword [ebp - 0x8c4]
dec eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0
jl 0x46c378
mov dword [ebp - 0x268], 0xce125d16
mov dword [ebp - 0x6d4], 0
jmp 0x46c286
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 1
jge 0x46c2a2
mov eax, dword [ebp - 0x6d4]
mov dword [ebp + eax*4 - 0xa08], 0xffffffff
jmp 0x46c279
mov dword [ebp - 0x268], 0
jmp 0x46c2bb
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x46c2d8
mov eax, dword [ebp - 0x268]
cmp dword [ebp + eax*4 - 0xa08], 0
je 0x46c2d6
jmp 0x46c2d8
jmp 0x46c2ae
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa08]
neg eax
cmp dword [ebp - 0x268], eax
jne 0x46c2fb
mov dword [ebp - 0xdf8], 1
jmp 0x46c302
and dword [ebp - 0xdf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa08]
cmp dword [ebp - 0xdf8], eax
jl 0x46c323
mov dword [ebp - 0x1ce8], 1
jmp 0x46c32a
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0x268]
imul eax, dword [ebp - 0x1ce8]
cmp eax, 1
jle 0x46c348
mov dword [ebp - 0xe00], 1
jmp 0x46c34f
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0xe00]
mov dword [ebp - 0x268], eax
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x2bd4]
call fcn.0043188e
cmp dword [eax], 0
je 0x46c373
jmp 0x46c378
jmp 0x46c249
jmp 0x46c030
jmp 0x46a5b6
lea ecx, [ebp - 0x2bd4]
call fcn.00431872
mov dword [ebp - 0x344], 0xffffffff
mov dword [ebp - 0x90], 0xfffffff8
push 3
lea ecx, [ebp - 0x20c8]
call fcn.004317a0
mov dword [ebp - 0x252c], 0xffffffff
mov dword [ebp - 0x2534], 0xfffffff7
mov dword [ebp - 0x824], 0
jmp 0x46c3db
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 3
jge 0x46c3fd
push dword [ebp - 0x824]
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
mov dword [eax], 0xb583dc0e
jmp 0x46c3ce
cmp dword [ebp - 0x344], 0
jne 0x46c426
cmp dword [ebp - 0x344], 0
jne 0x46c426
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x344], eax
jl 0x46c426
and dword [ebp - 0x1cf0], 0
jmp 0x46c430
mov dword [ebp - 0x1cf0], 1
mov eax, dword [ebp - 0x344]
imul eax, dword [ebp - 0x344]
cmp eax, dword [ebp - 0x1cf0]
je 0x46c451
mov dword [ebp - 0xe08], 1
jmp 0x46c458
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0xe08]
sub eax, dword [ebp - 0x90]
je 0x46c47b
cmp dword [ebp - 0x344], 0
je 0x46c47b
mov dword [ebp - 0x1cf8], 1
jmp 0x46c482
and dword [ebp - 0x1cf8], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1cf8], eax
jne 0x46c49c
mov dword [ebp - 0xe10], 1
jmp 0x46c4a3
and dword [ebp - 0xe10], 0
cmp dword [ebp - 0xe10], 0x746a1c17
jne 0x46c4bb
mov dword [ebp - 0x1d00], 1
jmp 0x46c4c2
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x1d00]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xe18], eax
push 0
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
mov ecx, dword [ebp - 0xe18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0xe18]
mov dword [ebp - 0x252c], eax
mov dword [ebp - 0x90], 2
jmp 0x46c51a
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x46c5cd
mov esi, dword [ebp - 0x2534]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
cmp esi, dword [eax]
jge 0x46c54e
mov dword [ebp - 0x1d08], 1
jmp 0x46c555
and dword [ebp - 0x1d08], 0
push dword [ebp - 0x90]
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
mov eax, dword [eax]
add eax, 0x34ac
cmp eax, dword [ebp - 0x1d08]
jge 0x46c581
mov dword [ebp - 0xe20], 1
jmp 0x46c588
and dword [ebp - 0xe20], 0
push dword [ebp - 0x90]
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
mov esi, dword [eax]
imul esi, dword [ebp - 0xe20]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
add esi, dword [eax]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x20c8]
call fcn.0043188e
mov dword [eax], esi
jmp 0x46c50d
lea ecx, [ebp - 0x20c8]
call fcn.00431872
cmp dword [ebp + 8], 2
jl 0x476460
mov dword [ebp - 0x560], 0x47dc4b4e
push 4
lea ecx, [ebp - 0x328c]
call fcn.004317a0
mov dword [ebp - 0x6dc], 0
jmp 0x46c612
mov eax, dword [ebp - 0x6dc]
inc eax
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 4
jge 0x46c631
push dword [ebp - 0x6dc]
lea ecx, [ebp - 0x328c]
call fcn.0043188e
and dword [eax], 0
jmp 0x46c605
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x560], 0xfffffff0
jmp 0x46c654
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0x3a
jle 0x46c70e
mov dword [ebp - 0x954], 0x921ded68
mov dword [ebp - 0x954], 3
jmp 0x46c684
mov eax, dword [ebp - 0x954]
dec eax
mov dword [ebp - 0x954], eax
cmp dword [ebp - 0x954], 0
jl 0x46c709
mov dword [ebp - 0x6e4], 0xdbda7fe6
mov dword [ebp - 0x2fb4], 1
mov dword [ebp - 0x2fbc], 2
mov dword [ebp - 0x1d10], 7
mov byte [ebp - 0x2ef], 0
movzx eax, byte [ebp - 0x2ef]
test eax, eax
je 0x46c6d3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov dword [ebp - 0x6e4], 3
jmp 0x46c6ec
mov eax, dword [ebp - 0x6e4]
dec eax
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 0
jl 0x46c704
mov eax, dword [ebp - 0x1d10]
dec eax
mov dword [ebp - 0x1d10], eax
jmp 0x46c6df
jmp 0x46c677
jmp 0x46c647
lea ecx, [ebp - 0x328c]
call fcn.00431872
push 3
lea ecx, [ebp - 0x258]
call fcn.004317a0
mov dword [ebp - 4], 0x7d8a8701
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x82c], 0xfffffffa
mov dword [ebp - 0x188], 0
jmp 0x46c75a
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x46c779
push dword [ebp - 0x188]
lea ecx, [ebp - 0x258]
call fcn.0043188e
or dword [eax], 0xffffffff
jmp 0x46c74d
mov dword [ebp - 0x188], 0
jmp 0x46c792
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x46c7ae
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x2604], 0xfffffffe
jmp 0x46c785
mov dword [ebp - 4], 0
jmp 0x46c7be
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jg 0x46ce05
mov dword [ebp - 0xe30], 7
mov dword [ebp - 0xa0], 0xfffffff6
mov dword [ebp - 0x1d58], 6
mov dword [ebp - 0x253c], 0xad25
push 1
lea ecx, [ebp - 0x258]
call fcn.0043188e
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov esi, eax
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov eax, dword [eax]
dec eax
cmp dword [esi], eax
je 0x46c83c
mov dword [ebp - 0xe28], 1
jmp 0x46c843
and dword [ebp - 0xe28], 0
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov ecx, dword [ebp - 0xe28]
cmp ecx, dword [eax]
je 0x46c867
mov dword [ebp - 0x1d18], 1
jmp 0x46c86e
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0x1d18]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0x2fc4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2fcc], eax
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov eax, dword [eax]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1d58], eax
mov esi, dword [ebp - 4]
push 2
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp esi, dword [eax]
jl 0x46c8d1
mov dword [ebp - 0x1d20], 1
jmp 0x46c8d8
and dword [ebp - 0x1d20], 0
cmp dword [ebp - 0x1d20], 5
jle 0x46c8ed
mov dword [ebp - 0xe38], 1
jmp 0x46c8f4
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xe38], eax
jl 0x46c90b
mov dword [ebp - 0x1d28], 1
jmp 0x46c912
and dword [ebp - 0x1d28], 0
cmp dword [ebp - 0x1d28], 0xf06e85fc
je 0x46c92a
mov dword [ebp - 0xe40], 1
jmp 0x46c931
and dword [ebp - 0xe40], 0
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov esi, dword [ebp - 0xe40]
add esi, dword [eax]
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp esi, dword [eax]
jg 0x46c965
mov dword [ebp - 0x1d30], 1
jmp 0x46c96c
and dword [ebp - 0x1d30], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1d30]
jg 0x46c983
mov dword [ebp - 0xe48], 1
jmp 0x46c98a
and dword [ebp - 0xe48], 0
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov esi, dword [eax]
imul esi, dword [ebp - 0xe48]
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp esi, dword [eax]
jne 0x46c9bf
mov dword [ebp - 0x1d38], 1
jmp 0x46c9c6
and dword [ebp - 0x1d38], 0
cmp dword [ebp - 0x1d38], 0x40fc0272
jne 0x46c9de
mov dword [ebp - 0xe50], 1
jmp 0x46c9e5
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
je 0x46ccaa
mov dword [ebp - 0x240], 0
jmp 0x46ca17
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x46ca33
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x35bc], 1
jmp 0x46ca0a
mov dword [ebp - 0x240], 0
jmp 0x46ca4c
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x46ca68
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x2380], 7
jmp 0x46ca3f
mov dword [ebp - 0xa0], 2
jmp 0x46ca81
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x46cca5
mov dword [ebp - 0x2a28], 1
mov dword [ebp - 0x2a24], 1
mov dword [ebp - 0x2a20], 1
mov dword [ebp - 0x2a1c], 1
lea ecx, [ebp - 0xb29]
call fcn.0043189d
push eax
lea eax, [ebp - 0x2a18]
push eax
lea eax, [ebp - 0x2a28]
push eax
lea ecx, [ebp - 0x3678]
call fcn.004318a0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x329c]
call fcn.0043184c
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x258]
call fcn.0043188e
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2380]
mov dword [ebp - 0x2fd4], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2380]
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp esi, dword [eax]
jle 0x46cb4b
mov dword [ebp - 0x1d40], 1
jmp 0x46cb52
and dword [ebp - 0x1d40], 0
push 1
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov ecx, dword [ebp - 0x1d40]
cmp ecx, dword [eax]
jl 0x46cb77
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov esi, dword [eax]
neg esi
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
sub esi, dword [eax]
mov dword [ebp - 0x82c], esi
mov esi, dword [ebp - 0x82c]
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp esi, dword [eax]
je 0x46cbc6
mov dword [ebp - 0x1d48], 1
jmp 0x46cbcd
and dword [ebp - 0x1d48], 0
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x35bc]
mov dword [ebp - 0xe58], eax
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov ecx, dword [ebp - 0xe58]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xe58]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1d48]
jge 0x46cc17
mov dword [ebp - 0xe60], 1
jmp 0x46cc1e
and dword [ebp - 0xe60], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x258]
call fcn.0043188e
mov ecx, dword [ebp - 0x34c]
imul ecx, dword [ebp - 0xe60]
cmp dword [eax], ecx
jle 0x46cc4c
mov dword [ebp - 0x1d50], 1
jmp 0x46cc53
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1d50]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2380]
jl 0x46cc79
mov dword [ebp - 0xe68], 1
jmp 0x46cc80
and dword [ebp - 0xe68], 0
push 1
lea ecx, [ebp - 0x329c]
call fcn.0043188e
mov ecx, dword [ebp - 0xe68]
mov dword [eax], ecx
lea ecx, [ebp - 0x329c]
call fcn.00431872
jmp 0x46ca74
jmp 0x46ce00
mov dword [ebp - 0xe78], 0xfffffff7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2604]
mov dword [ebp - 0x2fdc], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x2fe4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2604]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2604], eax
mov eax, dword [ebp - 0x253c]
cmp dword [ebp - 0x1d58], eax
jle 0x46cd08
mov dword [ebp - 0xe70], 1
jmp 0x46cd0f
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0xe70]
cmp eax, dword [ebp - 4]
jle 0x46cd2a
mov dword [ebp - 0x2544], 1
jmp 0x46cd31
and dword [ebp - 0x2544], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2604], 1
ja 0x46cd60
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp dword [eax], 0
je 0x46cd60
mov dword [ebp - 0x1d60], 1
jmp 0x46cd67
and dword [ebp - 0x1d60], 0
cmp dword [ebp - 0x1d60], 0xcde216d7
jbe 0x46cd7f
mov dword [ebp - 0x254c], 1
jmp 0x46cd86
and dword [ebp - 0x254c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe78]
cmp dword [ebp + eax - 0x2604], ecx
jge 0x46cda7
mov dword [ebp - 0x2554], 1
jmp 0x46cdae
and dword [ebp - 0x2554], 0
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
push dword [ebp - 4]
lea ecx, [ebp - 0x258]
call fcn.0043188e
cmp dword [eax], 8
jge 0x46cddb
mov dword [ebp - 0x255c], 1
jmp 0x46cde2
and dword [ebp - 0x255c], 0
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0x2fec], eax
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x82c]
mov dword [ebp - 0xa0], eax
jmp 0x46c7b7
mov dword [ebp - 0x34c], 0
jmp 0x46ce1e
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jg 0x46ce40
mov dword [ebp - 0x1d68], 1
mov eax, dword [ebp - 0x1d68]
dec eax
mov dword [ebp - 0x1d68], eax
jmp 0x46ce11
lea ecx, [ebp - 0x258]
call fcn.00431872
mov dword [ebp - 0xfc0], 1
mov dword [ebp - 0x6ec], 9
mov dword [ebp - 0x6ec], 0x16
jmp 0x46ce78
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0x1c
jge 0x46d049
push 1
lea ecx, [ebp - 0x2204]
call fcn.004317a0
mov dword [ebp - 0x35c], 0x1265ab3e
mov dword [ebp - 0x8cc], 0
jmp 0x46ceb5
mov eax, dword [ebp - 0x8cc]
inc eax
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 1
jge 0x46ced7
push dword [ebp - 0x8cc]
lea ecx, [ebp - 0x2204]
call fcn.0043188e
mov dword [eax], 0xfffffffa
jmp 0x46cea8
mov dword [ebp - 0x35c], 0
jmp 0x46cef0
mov eax, dword [ebp - 0x35c]
dec eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jl 0x46d023
mov dword [ebp - 0x354], 0xb3921ded
mov dword [ebp - 0x354], 0
jmp 0x46cf20
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
jl 0x46d01e
mov dword [ebp - 0x6f4], 0xa18e418a
push dword [ebp - 0x354]
lea ecx, [ebp - 0x2204]
call fcn.0043188e
mov ecx, dword [ebp - 0x354]
cmp dword [eax], ecx
jl 0x46cf5e
mov dword [ebp - 0xe80], 1
jmp 0x46cf65
and dword [ebp - 0xe80], 0
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x2204]
call fcn.0043188e
mov ecx, dword [ebp - 0xe80]
mov dword [eax], ecx
mov dword [ebp - 0x6f4], 0
jmp 0x46cf97
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0
jg 0x46d019
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x834], 0
jmp 0x46cfc3
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
jg 0x46d014
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x2204]
call fcn.0043188e
cmp dword [eax], 0
je 0x46cfef
cmp dword [ebp - 0x354], 0
je 0x46cfed
jmp 0x46d014
jmp 0x46d012
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x46d012
push 0
push 0x3db
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x46cfb6
jmp 0x46cf8a
jmp 0x46cf13
jmp 0x46cee3
cmp dword [ebp - 0x35c], 0
je 0x46d039
lea ecx, [ebp - 0x2204]
call fcn.00431872
jmp 0x46d049
lea ecx, [ebp - 0x2204]
call fcn.00431872
jmp 0x46ce6b
mov dword [ebp - 0xa28], 0x9ee1c974
mov dword [ebp - 0x36c], 3
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x36c], 0xe
jmp 0x46d080
mov eax, dword [ebp - 0x36c]
dec eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0xfffffff6
je 0x46d592
mov dword [ebp - 0x364], 0x3248c66
mov dword [ebp - 0x256c], 0x77f0a061
mov dword [ebp - 0x6fc], 0
jmp 0x46d0ba
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 1
jge 0x46d0d6
mov eax, dword [ebp - 0x6fc]
mov dword [ebp + eax*4 - 0xbd0], 1
jmp 0x46d0ad
mov dword [ebp - 0x364], 0
jmp 0x46d0ef
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
jg 0x46d58d
mov dword [ebp - 0x190], 9
push 2
lea ecx, [ebp - 0x20d8]
call fcn.004317a0
mov dword [ebp - 0x2574], 0x903a798b
mov dword [ebp - 0x91c], 0
jmp 0x46d136
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 2
jge 0x46d158
push dword [ebp - 0x91c]
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
mov dword [eax], 0xf1912530
jmp 0x46d129
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x2ff4], eax
push 0
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
cmp dword [eax], 0
je 0x46d18d
push 1
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
mov ecx, dword [ebp - 0x140]
cmp dword [eax], ecx
jne 0x46d19f
cmp dword [ebp - 0x140], 0
jne 0x46d19f
and dword [ebp - 0x1d70], 0
jmp 0x46d1a9
mov dword [ebp - 0x1d70], 1
push 0
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
mov ecx, dword [ebp - 0x1d70]
cmp ecx, dword [eax]
jge 0x46d1cc
mov dword [ebp - 0xe88], 1
jmp 0x46d1d3
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xe88], eax
jge 0x46d1ed
mov dword [ebp - 0x2564], 1
jmp 0x46d1f4
and dword [ebp - 0x2564], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x2ffc], eax
cmp dword [ebp - 0x140], 0
jne 0x46d21b
mov eax, 0xbb086619
test eax, eax
jne 0x46d21b
and dword [ebp - 0x1d78], 0
jmp 0x46d225
mov dword [ebp - 0x1d78], 1
mov eax, dword [ebp - 0x1d78]
sub eax, dword [ebp - 0x36c]
cmp eax, 0xffffffff
jae 0x46d242
mov dword [ebp - 0xe90], 1
jmp 0x46d249
and dword [ebp - 0xe90], 0
cmp dword [ebp - 0xe90], 0xd6c5
jl 0x46d261
mov dword [ebp - 0x1d80], 1
jmp 0x46d268
and dword [ebp - 0x1d80], 0
cmp dword [ebp - 0x1d80], 0xffffffff
jne 0x46d27d
mov dword [ebp - 0xe98], 1
jmp 0x46d284
and dword [ebp - 0xe98], 0
push 0
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
mov ecx, dword [ebp - 0xe98]
cmp ecx, dword [eax]
jl 0x46d2a7
mov dword [ebp - 0x1d88], 1
jmp 0x46d2ae
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x1d88]
jge 0x46d2d4
mov dword [ebp - 0xea0], 1
jmp 0x46d2db
and dword [ebp - 0xea0], 0
push 0
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
mov ecx, dword [ebp - 0xea0]
mov dword [eax], ecx
mov dword [ebp - 0x190], 0
jmp 0x46d309
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x46d57d
push 1
lea ecx, [ebp - 0x2614]
call fcn.004317a0
mov dword [ebp - 0x704], 0
jmp 0x46d33c
mov eax, dword [ebp - 0x704]
inc eax
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 1
jge 0x46d35e
push dword [ebp - 0x704]
lea ecx, [ebp - 0x2614]
call fcn.0043188e
mov dword [eax], 0x7eedf667
jmp 0x46d32f
mov dword [ebp - 0x140], 0
jmp 0x46d377
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jg 0x46d56d
mov dword [ebp - 0x1d90], 1
mov byte [ebp - 0x2f3], 0
movzx eax, byte [ebp - 0x2f3]
test eax, eax
je 0x46d3af
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x3004], eax
mov dword [ebp - 0x1d90], 0
cmp dword [ebp - 0x1d90], 0xfff7
jae 0x46d3dd
mov dword [ebp - 0xeb8], 1
jmp 0x46d3e4
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x300c], eax
push 0
lea ecx, [ebp - 0x20d8]
call fcn.0043188e
cmp dword [eax], 0
jne 0x46d414
cmp dword [ebp - 0x140], 0
jne 0x46d414
and dword [ebp - 0xea8], 0
jmp 0x46d41e
mov dword [ebp - 0xea8], 1
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xea8], eax
jl 0x46d438
mov dword [ebp - 0x1d98], 1
jmp 0x46d43f
and dword [ebp - 0x1d98], 0
imul eax, dword [ebp - 0x1d98], 0x2ba1
cmp eax, dword [ebp - 0x364]
je 0x46d45d
mov dword [ebp - 0xeb0], 1
jmp 0x46d464
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0xeb0], eax
jl 0x46d47e
mov dword [ebp - 0x1da0], 1
jmp 0x46d485
and dword [ebp - 0x1da0], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xbd0]
imul esi, dword [ebp - 0x1da0]
push 0
lea ecx, [ebp - 0x2614]
call fcn.0043188e
sub esi, dword [eax]
imul esi, dword [ebp - 0xeb8]
test esi, esi
jne 0x46d4ce
push 0
lea ecx, [ebp - 0x2614]
call fcn.0043188e
cmp dword [eax], 0
jne 0x46d4ce
and dword [ebp - 0x1da8], 0
jmp 0x46d4d8
mov dword [ebp - 0x1da8], 1
push 0
lea ecx, [ebp - 0x2614]
call fcn.0043188e
mov ecx, dword [ebp - 0x1da8]
cmp ecx, dword [eax]
jge 0x46d4fb
mov dword [ebp - 0xec0], 1
jmp 0x46d502
and dword [ebp - 0xec0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd0]
cmp dword [ebp - 0xec0], eax
jg 0x46d523
mov dword [ebp - 0x1db0], 1
jmp 0x46d52a
and dword [ebp - 0x1db0], 0
cmp dword [ebp - 0x1db0], 0x3747
jge 0x46d542
mov dword [ebp - 0xec8], 1
jmp 0x46d549
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0xec8]
mov dword [ebp - 0x256c], eax
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x2574]
mov dword [ebp + eax*4 - 0xbd0], ecx
jmp 0x46d36a
lea ecx, [ebp - 0x2614]
call fcn.00431872
jmp 0x46d2fc
lea ecx, [ebp - 0x20d8]
call fcn.00431872
jmp 0x46d0e2
jmp 0x46d073
mov dword [ebp - 0x83c], 0
jmp 0x46d5ab
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 1
jge 0x46d5c7
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x4a8], 3
jmp 0x46d59e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4a8], 0
jmp 0x46d5f5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4a8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4a8], 0x11
jne 0x46d6df
mov dword [ebp - 0x1db8], 0x6158d32f
mov dword [ebp - 0x257c], 0x2ee6d058
mov dword [ebp - 0xed0], 4
mov dword [ebp - 0x2584], 0xf6285890
mov eax, dword [ebp - 0x1db8]
inc eax
mov dword [ebp - 0x1db8], eax
mov eax, dword [ebp - 0x257c]
mov dword [ebp - 0x3014], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4a8]
sub eax, 0x9214
mov dword [ebp - 0xed0], eax
cmp dword [ebp - 0xed0], 5
jge 0x46d677
mov dword [ebp - 0x1dc0], 1
jmp 0x46d67e
and dword [ebp - 0x1dc0], 0
cmp dword [ebp - 0x1dc0], 0x35a23e86
jle 0x46d696
mov dword [ebp - 0xed8], 1
jmp 0x46d69d
and dword [ebp - 0xed8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4a8]
cmp dword [ebp - 0xed8], eax
jl 0x46d6c7
mov eax, 0x1c58
test eax, eax
je 0x46d6c7
mov dword [ebp - 0x1dc8], 1
jmp 0x46d6ce
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x1dc8]
mov dword [ebp - 0x2584], eax
jmp 0x46d5da
mov dword [ebp - 0x221c], 0xffffffff
push 3
lea ecx, [ebp - 0x2ba4]
call fcn.004317a0
mov dword [ebp - 0xa10], 1
mov dword [ebp - 0xee8], 0xc40a98ce
mov dword [ebp - 0x1de0], 0xee91b76
mov dword [ebp - 0x258c], 0xa61940c9
mov dword [ebp - 0x1f0], 0
jmp 0x46d737
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x46d753
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x2a8], 7
jmp 0x46d72a
mov dword [ebp - 0x1f0], 0
jmp 0x46d76c
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x46d78e
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x2ba4]
call fcn.0043188e
mov dword [eax], 0x8f5f4990
jmp 0x46d75f
mov dword [ebp - 0xa10], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp eax, dword [ebp - 0xa10]
jle 0x46d7c9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a8], 0
je 0x46d7c9
mov dword [ebp - 0xee0], 1
jmp 0x46d7d0
and dword [ebp - 0xee0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
imul eax, dword [ebp - 0xee0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2a8]
je 0x46d7ff
mov dword [ebp - 0x1dd0], 1
jmp 0x46d806
and dword [ebp - 0x1dd0], 0
mov eax, dword [ebp - 0x1dd0]
mov dword [ebp - 0xee8], eax
cmp dword [ebp - 0xee8], 1
je 0x46d82d
cmp dword [ebp - 0xa10], 0
jne 0x46d82d
and dword [ebp - 0x1dd8], 0
jmp 0x46d837
mov dword [ebp - 0x1dd8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp dword [ebp - 0x1dd8], eax
jl 0x46d858
mov dword [ebp - 0xef0], 1
jmp 0x46d85f
and dword [ebp - 0xef0], 0
push 0
lea ecx, [ebp - 0x2ba4]
call fcn.0043188e
mov dword [eax], 0xf737a9a9
mov eax, dword [ebp - 0xef0]
mov dword [ebp - 0x1de0], eax
mov eax, dword [ebp - 0x1de0]
sub eax, 8
mov ecx, 0xf737a9a9
sub ecx, eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a8], ecx
jg 0x46d8a9
mov dword [ebp - 0xef8], 1
jmp 0x46d8b0
and dword [ebp - 0xef8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
mov ecx, dword [ebp - 0xef8]
lea eax, [ecx + eax - 1]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2a8]
jge 0x46d8e2
mov dword [ebp - 0x1de8], 1
jmp 0x46d8e9
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0x1de8]
mov dword [ebp - 0x258c], eax
lea ecx, [ebp - 0x2ba4]
call fcn.00431872
mov dword [ebp - 0x198], 0xcda2
mov dword [ebp - 0xb4], 0x3b372ba2
mov dword [ebp - 0xf08], 0x9a2b82c4
mov dword [ebp - 0xf4], 6
mov dword [ebp - 0x1e00], 0x4859bb7a
mov dword [ebp - 0x528], 1
push 3
lea ecx, [ebp - 0x2904]
call fcn.004317a0
mov dword [ebp - 0x70c], 0
jmp 0x46d962
mov eax, dword [ebp - 0x70c]
inc eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 3
jge 0x46d984
push dword [ebp - 0x70c]
lea ecx, [ebp - 0x2904]
call fcn.0043188e
mov dword [eax], 0xe81
jmp 0x46d955
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x301c], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x3024], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x46d9c9
cmp dword [ebp - 0x198], 0x79cd
jl 0x46d9c9
mov dword [ebp - 0xf00], 1
jmp 0x46d9d0
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0xf00], eax
jne 0x46d9ea
mov dword [ebp - 0x1df0], 1
jmp 0x46d9f1
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0x1df0]
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0xf08]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x46da27
cmp dword [ebp - 0xf4], 0
je 0x46da27
mov dword [ebp - 0x1df8], 1
jmp 0x46da2e
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x1df8], eax
jl 0x46da4e
cmp dword [ebp - 0xb4], 0
jne 0x46da4e
and dword [ebp - 0xf10], 0
jmp 0x46da58
mov dword [ebp - 0xf10], 1
mov eax, dword [ebp - 0xf10]
mov dword [ebp - 0x1e00], eax
mov eax, dword [ebp - 0x1e00]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x302c], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x3034], eax
cmp dword [ebp - 0x198], 0x9535
jl 0x46daa0
mov dword [ebp - 0xf18], 1
jmp 0x46daa7
and dword [ebp - 0xf18], 0
mov eax, dword [ebp - 0x198]
imul eax, dword [ebp - 0xf18]
imul eax, eax, 0xd35
imul eax, eax, 0xa0c0
test eax, eax
je 0x46dba7
mov dword [ebp - 0x528], 0
jmp 0x46dae1
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 2
jg 0x46dba5
mov dword [ebp - 0xf4], 0
jmp 0x46db07
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x46db49
mov byte [ebp - 0x2f5], 0
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x46db47
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x251f
push 0x1dd5
push 0x125
push 0x8dd
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x46dafa
mov dword [ebp - 0xb4], 2
jmp 0x46db62
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x46dba0
mov byte [ebp - 0x2f7], 0
movzx eax, byte [ebp - 0x2f7]
test eax, eax
je 0x46db8a
push 0x5a2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 1
lea ecx, [ebp - 0x2904]
call fcn.0043188e
cmp dword [eax], 0
je 0x46db9e
jmp 0x46dba0
jmp 0x46db55
jmp 0x46dad4
jmp 0x46dbca
mov byte [ebp - 0x2f9], 0
movzx eax, byte [ebp - 0x2f9]
test eax, eax
je 0x46dbca
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0xf4], 0
jmp 0x46dbe3
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffeb
je 0x46dc45
mov dword [ebp - 0xb4], 0
jmp 0x46dc05
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x46dc27
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x2904]
call fcn.0043188e
mov dword [eax], 0xfffffffe
jmp 0x46dbf8
mov byte [ebp - 0x2fb], 0
movzx eax, byte [ebp - 0x2fb]
test eax, eax
je 0x46dc43
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x46dbd6
lea ecx, [ebp - 0x2904]
call fcn.00431872
mov dword [ebp - 0x8d4], 0
jmp 0x46dc69
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 3
jge 0x46dc85
mov eax, dword [ebp - 0x8d4]
mov dword [ebp + eax*4 - 0x35e0], 0xb6fd43dd
jmp 0x46dc5c
mov dword [ebp - 0x18], 0xf3c34eea
push 4
lea ecx, [ebp - 0x9d4]
call fcn.004317a0
mov dword [ebp - 0x4b0], 0xffffffff
mov dword [ebp - 0x564], 0x3e52509e
mov dword [ebp - 0x25a4], 0
mov dword [ebp - 0x303c], 0xfffffff6
mov dword [ebp - 0x714], 0
jmp 0x46dcda
mov eax, dword [ebp - 0x714]
inc eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 4
jge 0x46dcfc
push dword [ebp - 0x714]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
mov dword [eax], 0xfffffffa
jmp 0x46dccd
cmp dword [ebp - 0x18], 0
jne 0x46dd6e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3044], eax
mov esi, dword [ebp - 0x18]
push 3
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
mov dword [eax], esi
cmp dword [ebp - 0x18], 1
jle 0x46dd2f
mov dword [ebp - 0xb00], 1
jmp 0x46dd36
and dword [ebp - 0xb00], 0
push 0
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
mov ecx, dword [ebp - 0xb00]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb00]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x18], eax
je 0x46dd6e
and dword [ebp - 0x2594], 0
jmp 0x46dd78
mov dword [ebp - 0x2594], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x304c], eax
mov eax, 0x9dce
cmp eax, 0xffff
jb 0x46dd99
mov dword [ebp - 0x1e08], 1
jmp 0x46dda0
and dword [ebp - 0x1e08], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1e08], eax
jge 0x46ddb7
mov dword [ebp - 0xf20], 1
jmp 0x46ddbe
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xf20], eax
jne 0x46ddd5
mov dword [ebp - 0x1e10], 1
jmp 0x46dddc
and dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x1e10]
mov dword [ebp - 0x564], eax
mov dword [ebp - 0x564], 9
jmp 0x46de01
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0xb
jg 0x46e1d0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xf38], 0xfffffff9
cmp dword [ebp - 0x20], 0
je 0x46de2a
jmp 0x46e1d0
mov dword [ebp - 0x18], 3
jmp 0x46de3a
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x46e1cb
mov dword [ebp - 0x2c38], 0
mov dword [ebp - 0x2c34], 0
mov dword [ebp - 0x2c30], 0
mov dword [ebp - 0x2c2c], 0
mov byte [ebp - 0x2fd], 0
movzx eax, byte [ebp - 0x2fd]
test eax, eax
je 0x46de84
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x4b0], 3
jmp 0x46de9d
mov eax, dword [ebp - 0x4b0]
dec eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0
jl 0x46e1c6
push 1
lea ecx, [ebp - 0x291c]
call fcn.004317a0
mov dword [ebp - 0xa18], 0x597fb6f8
mov dword [ebp - 0x844], 0
jmp 0x46deda
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 1
jge 0x46defc
push dword [ebp - 0x844]
lea ecx, [ebp - 0x291c]
call fcn.0043188e
mov dword [eax], 0xa36fe543
jmp 0x46decd
mov dword [ebp - 0x20], 0
jmp 0x46df0c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x46df57
mov dword [ebp - 0x71c], 0xfeae2151
mov dword [ebp - 0x71c], 3
jmp 0x46df35
mov eax, dword [ebp - 0x71c]
dec eax
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x46df55
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
cmp dword [eax], 0
je 0x46df53
jmp 0x46df55
jmp 0x46df28
jmp 0x46df05
mov dword [ebp - 0x20], 0
jmp 0x46df67
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x46e1b6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
push 0
lea ecx, [ebp - 0x291c]
call fcn.0043188e
cmp dword [eax], 1
jg 0x46df9d
mov dword [ebp - 0xf28], 1
jmp 0x46dfa4
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0xf28]
sub eax, 0x518d
jne 0x46dfcd
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
cmp dword [eax], 0
jne 0x46dfcd
and dword [ebp - 0x259c], 0
jmp 0x46dfd7
mov dword [ebp - 0x259c], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3054], eax
push 0
lea ecx, [ebp - 0x291c]
call fcn.0043188e
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x46e012
cmp dword [ebp - 0x20], 0
jne 0x46e012
and dword [ebp - 0xf30], 0
jmp 0x46e01c
mov dword [ebp - 0xf30], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1e18], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1e18]
mov dword [ebp + eax - 0x2c38], ecx
mov eax, dword [ebp - 0x1e18]
cmp eax, dword [ebp - 0xf30]
jge 0x46e052
mov dword [ebp - 0x1e20], 1
jmp 0x46e059
and dword [ebp - 0x1e20], 0
mov eax, dword [ebp - 0x1e20]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0xf38], eax
mov esi, dword [ebp - 0xf38]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
cmp esi, dword [eax]
jne 0x46e08c
mov dword [ebp - 0x1e28], 1
jmp 0x46e093
and dword [ebp - 0x1e28], 0
mov eax, dword [ebp - 0x1e28]
mov dword [ebp - 0x25a4], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x46e0bb
cmp dword [ebp - 0xa18], 0
je 0x46e0bb
mov dword [ebp - 0xf40], 1
jmp 0x46e0c2
and dword [ebp - 0xf40], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
mov ecx, dword [ebp - 0xf40]
cmp ecx, dword [eax]
jne 0x46e0e6
mov dword [ebp - 0x1e30], 1
jmp 0x46e0ed
and dword [ebp - 0x1e30], 0
mov eax, dword [ebp - 0xa18]
imul eax, dword [ebp - 0x1e30]
cmp eax, 1
je 0x46e10b
mov dword [ebp - 0xf48], 1
jmp 0x46e112
and dword [ebp - 0xf48], 0
cmp dword [ebp - 0xf48], 3
jge 0x46e127
mov dword [ebp - 0x1e38], 1
jmp 0x46e12e
and dword [ebp - 0x1e38], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1e38], eax
jle 0x46e145
mov dword [ebp - 0xf50], 1
jmp 0x46e14c
and dword [ebp - 0xf50], 0
mov esi, dword [ebp - 0x20]
imul esi, dword [ebp - 0xf50]
push 3
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
cmp esi, dword [eax]
jge 0x46e173
mov dword [ebp - 0x1e40], 1
jmp 0x46e17a
and dword [ebp - 0x1e40], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d4]
call fcn.0043188e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1e40]
jge 0x46e19e
mov dword [ebp - 0xf58], 1
jmp 0x46e1a5
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0xf58]
mov dword [ebp - 0xa18], eax
jmp 0x46df60
lea ecx, [ebp - 0x291c]
call fcn.00431872
jmp 0x46de90
jmp 0x46de33
jmp 0x46ddf4
lea ecx, [ebp - 0x9d4]
call fcn.00431872
mov dword [ebp - 0x724], 0xfffffffc
mov dword [ebp - 0x305c], 0xffffffff
mov dword [ebp - 0xb7c], 0xfffffff6
mov dword [ebp - 0x944], 0
jmp 0x46e212
mov eax, dword [ebp - 0x944]
inc eax
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 4
jge 0x46e22e
mov eax, dword [ebp - 0x944]
mov dword [ebp + eax*4 - 0x34dc], 0x2fe81720
jmp 0x46e205
mov dword [ebp - 0x724], 0
jmp 0x46e247
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 9
jg 0x46e660
mov dword [ebp - 0x4f0], 0
and dword [ebp - 0x2a78], 0
and dword [ebp - 0x2a74], 0
and dword [ebp - 0x2a70], 0
and dword [ebp - 0x2a6c], 0
lea ecx, [ebp - 0xb5d]
call fcn.0043189d
push eax
lea eax, [ebp - 0x2a68]
push eax
lea eax, [ebp - 0x2a78]
push eax
lea ecx, [ebp - 0x3688]
call fcn.004318a0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x32ac]
call fcn.0043184c
mov dword [ebp - 0x25b4], 1
mov dword [ebp - 0x84c], 0
jmp 0x46e2d2
mov eax, dword [ebp - 0x84c]
inc eax
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 2
jge 0x46e2ee
mov eax, dword [ebp - 0x84c]
mov dword [ebp + eax*4 - 0x2d64], 1
jmp 0x46e2c5
mov byte [ebp - 0x2ff], 0
movzx eax, byte [ebp - 0x2ff]
test eax, eax
je 0x46e306
call dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x4f0], 0
jmp 0x46e31f
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0
jle 0x46e650
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0xf60], 7
mov dword [ebp - 0x220], 0
jmp 0x46e359
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x46e375
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x35c8], 7
jmp 0x46e34c
mov dword [ebp - 0x220], 0
jmp 0x46e38e
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x46e3aa
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x27b8], 6
jmp 0x46e381
mov dword [ebp - 0x270], 0
jmp 0x46e3c3
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x19
jg 0x46e64b
mov dword [ebp - 0x27c0], 0x8c443eb6
mov dword [ebp - 0xf80], 0x9fa8bc07
mov dword [ebp - 0x72c], 0
jmp 0x46e3fd
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 2
jge 0x46e419
mov eax, dword [ebp - 0x72c]
mov dword [ebp + eax*4 - 0x2d70], 0xfffffff9
jmp 0x46e3f0
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x46e5b9
mov eax, 0x9973
test eax, eax
je 0x46e4b1
mov eax, dword [ebp - 0xf80]
mov dword [ebp - 0x3064], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x34dc]
mov dword [ebp - 0x306c], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp + eax - 0x35c8], ecx
push 0
lea ecx, [ebp - 0x32ac]
call fcn.0043188e
mov ecx, dword [ebp - 0x8dc]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp + eax - 0x2d64], ecx
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x8dc], eax
jge 0x46e4b1
mov dword [ebp - 0x1e48], 1
jmp 0x46e4b8
and dword [ebp - 0x1e48], 0
mov eax, dword [ebp - 0x1e48]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0xf60]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x34dc]
shl eax, 2
cmp eax, dword [ebp - 0x4f0]
jl 0x46e4ed
mov dword [ebp - 0x1e50], 1
jmp 0x46e4f4
and dword [ebp - 0x1e50], 0
cmp dword [ebp - 0x1e50], 1
jb 0x46e509
mov dword [ebp - 0xf68], 1
jmp 0x46e510
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0xb7c]
inc eax
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb7c]
cmp eax, dword [ebp - 0xf68]
jne 0x46e537
mov dword [ebp - 0x1e58], 1
jmp 0x46e53e
and dword [ebp - 0x1e58], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34dc]
cmp dword [ebp - 0x1e58], eax
jle 0x46e55e
mov dword [ebp - 0xf70], 1
jmp 0x46e565
and dword [ebp - 0xf70], 0
cmp dword [ebp - 0xf70], 0x6ff52912
jg 0x46e57d
mov dword [ebp - 0x25ac], 1
jmp 0x46e584
and dword [ebp - 0x25ac], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x3074], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d70]
mov dword [ebp - 0x307c], eax
mov eax, dword [ebp - 0x25b4]
neg eax
je 0x46e5b9
mov dword [ebp - 0x1e60], 1
jmp 0x46e5c0
and dword [ebp - 0x1e60], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x1e60], eax
jne 0x46e5da
mov dword [ebp - 0xa20], 1
jmp 0x46e5e1
and dword [ebp - 0xa20], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa20]
mov dword [ebp + eax - 0x27b8], ecx
cmp dword [ebp - 0xa20], 0
je 0x46e612
cmp dword [ebp - 0x270], 0
je 0x46e612
mov dword [ebp - 0xf78], 1
jmp 0x46e619
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0x27c0]
cmp eax, dword [ebp - 0xf78]
jge 0x46e633
mov dword [ebp - 0x1e68], 1
jmp 0x46e63a
and dword [ebp - 0x1e68], 0
mov eax, dword [ebp - 0x1e68]
mov dword [ebp - 0xf80], eax
jmp 0x46e3b6
jmp 0x46e312
lea ecx, [ebp - 0x32ac]
call fcn.00431872
jmp 0x46e23a
mov byte [ebp - 0x301], 0
movzx eax, byte [ebp - 0x301]
test eax, eax
je 0x46e696
push 0x622
push 0
push 0
push 0x15f8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x114], 0x7230
mov dword [ebp - 0xb08], 0x1705
mov dword [ebp - 0x1e70], 0
mov dword [ebp - 0x2214], 0x6c84
mov dword [ebp - 0xfa0], 1
mov dword [ebp - 0x2540], 0xbb2c593c
cmp dword [ebp - 0x114], 0xa66e
jle 0x46e6ea
mov dword [ebp - 0x1e78], 1
jmp 0x46e6f1
and dword [ebp - 0x1e78], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x114], eax
je 0x46e70b
mov dword [ebp - 0x2318], 1
jmp 0x46e712
and dword [ebp - 0x2318], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x3084], eax
mov eax, dword [ebp - 0xb08]
inc eax
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1e70], eax
mov eax, dword [ebp - 0x1e70]
cmp dword [ebp - 0xb08], eax
jle 0x46e751
mov dword [ebp - 0xf88], 1
jmp 0x46e758
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0xf88]
cmp eax, dword [ebp - 0x114]
jge 0x46e778
mov dword [ebp - 0xf90], 1
jmp 0x46e77f
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0x1e78]
cmp eax, dword [ebp - 0xf90]
jge 0x46e799
mov dword [ebp - 0x1e80], 1
jmp 0x46e7a0
and dword [ebp - 0x1e80], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1e80], eax
jl 0x46e7c3
cmp dword [ebp - 0x2214], 0
je 0x46e7c3
mov dword [ebp - 0xf98], 1
jmp 0x46e7ca
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0x114]
sub eax, dword [ebp - 0xf98]
cmp eax, dword [ebp - 0x114]
jl 0x46e7ea
mov dword [ebp - 0x1e88], 1
jmp 0x46e7f1
and dword [ebp - 0x1e88], 0
mov eax, dword [ebp - 0x1e88]
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xfa0], eax
jle 0x46e817
mov dword [ebp - 0x1e90], 1
jmp 0x46e81e
and dword [ebp - 0x1e90], 0
mov eax, dword [ebp - 0x1e90]
mov dword [ebp - 0x2540], eax
mov byte [ebp - 0x303], 0
movzx eax, byte [ebp - 0x303]
test eax, eax
je 0x46e84e
push 0x51a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [ebp - 0xfc0], 0x9310c13f
je 0x46e866
mov dword [ebp - 0xfa8], 1
jmp 0x46e86d
and dword [ebp - 0xfa8], 0
cmp dword [ebp - 0xfa8], 0
jg 0x46e882
mov dword [ebp - 0x1e98], 1
jmp 0x46e889
and dword [ebp - 0x1e98], 0
cmp dword [ebp - 0x1e98], 0xd963
jle 0x46e8a1
mov dword [ebp - 0xfb0], 1
jmp 0x46e8a8
and dword [ebp - 0xfb0], 0
cmp dword [ebp - 0xfb0], 0x5145ccb9
jle 0x46e8c0
mov dword [ebp - 0x1ea0], 1
jmp 0x46e8c7
and dword [ebp - 0x1ea0], 0
mov eax, dword [ebp - 0xa28]
cmp eax, dword [ebp - 0x1ea0]
je 0x46e8e6
xor eax, eax
inc eax
je 0x46e8e6
mov dword [ebp - 0xfb8], 1
jmp 0x46e8ed
and dword [ebp - 0xfb8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xfb8]
mov dword [ebp + eax - 0x35e0], ecx
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x308c], eax
xor eax, eax
inc eax
cmp eax, 5
jb 0x46e91f
mov dword [ebp - 0x1ea8], 1
jmp 0x46e926
and dword [ebp - 0x1ea8], 0
mov eax, dword [ebp - 0xa28]
cmp dword [ebp - 0x1ea8], eax
jg 0x46e940
mov dword [ebp - 0x1eb0], 1
jmp 0x46e947
and dword [ebp - 0x1eb0], 0
mov eax, dword [ebp - 0xfc0]
imul eax, dword [ebp - 0x1eb0]
mov dword [ebp - 0x221c], eax
mov dword [ebp - 0x734], 0xfffffffd
mov dword [ebp - 0x620], 0x4cdb8faa
mov dword [ebp - 0x734], 0
jmp 0x46e987
cmp dword [ebp - 0x734], 0x16
jle 0x46ea6b
push 3
lea ecx, [ebp - 0x2934]
call fcn.004317a0
mov dword [ebp - 0x854], 0
jmp 0x46e9ba
mov eax, dword [ebp - 0x854]
inc eax
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 3
jge 0x46e9dc
push dword [ebp - 0x854]
lea ecx, [ebp - 0x2934]
call fcn.0043188e
mov dword [eax], 0xc4b4e126
jmp 0x46e9ad
push 0
lea ecx, [ebp - 0x2934]
call fcn.0043188e
mov eax, dword [eax]
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x620], 2
jmp 0x46ea0a
cmp dword [ebp - 0x620], 0
jl 0x46ea5b
mov dword [ebp - 0x570], 0x5950707d
mov dword [ebp - 0x570], 2
jmp 0x46ea36
lea ecx, [ebp - 0x2934]
call fcn.00431872
jmp 0x46e97a
push 1
lea eax, [ebp - 0x3798]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0046589c
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x35f8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x35f8]
lea edi, [ebp - 0x2838]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x73c], 0x1928c176
mov byte [ebp - 0x305], 0
movzx eax, byte [ebp - 0x305]
test eax, eax
je 0x46eac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0x73c], 0
jmp 0x46ead9
cmp dword [ebp - 0x73c], 0x1a
jg 0x46ec00
mov dword [ebp - 0x298], 9
mov dword [ebp - 0xfd8], 0xe1fc6578
mov dword [ebp - 0x2798], 3
cmp dword [ebp - 0x298], 0xfffffffa
jle 0x46eb19
mov dword [ebp - 0xfc8], 1
jmp 0x46eb20
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0xfc8]
dec eax
cmp eax, 7
jl 0x46eb3e
mov dword [ebp - 0x3c], 0xa1f9
mov dword [ebp - 0xb90], 0xd3b0cf5a
mov dword [ebp - 0xa30], 7
mov dword [ebp - 0x5d0], 1
mov dword [ebp - 0x3094], 0xb6930509
mov dword [ebp - 0x309c], 0x30385d06
mov dword [ebp - 0x924], 0
jmp 0x46ec52
cmp dword [ebp - 0x924], 3
jge 0x46ec6e
cmp dword [ebp + 8], 1
jne 0x480055
mov dword [ebp - 0x274], 0xd
mov dword [ebp - 0xb50], 0x74c38b6b
mov dword [ebp - 0x1e6c], 0xb552bf33
mov dword [ebp - 0x1b9c], 0x55467101
mov dword [ebp - 0x1604], 2
mov dword [ebp - 0x243c], 0xbf4d39d9
push 2
lea ecx, [ebp - 0x32fc]
call fcn.004317a0
mov dword [ebp - 0x698], 0
jmp 0x4764cc
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 2
jge 0x4764ee
push dword [ebp - 0x698]
lea ecx, [ebp - 0x32fc]
call fcn.0043188e
mov dword [eax], 0x9b50
jmp 0x4764bf
cmp dword [ebp - 0x274], 0
je 0x4765b5
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2e34], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0x1e6c], eax
mov eax, dword [ebp - 0x1e6c]
cmp dword [ebp - 0x274], eax
jg 0x476539
mov dword [ebp - 0x15f4], 1
jmp 0x476540
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x274]
add eax, dword [ebp - 0x15f4]
mov dword [ebp - 0x1b9c], eax
cmp dword [ebp - 0x1b9c], 0xfffffff9
jl 0x476567
mov dword [ebp - 0x15fc], 1
jmp 0x47656e
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x15fc], eax
jl 0x476588
mov dword [ebp - 0x2008], 1
jmp 0x47658f
and dword [ebp - 0x2008], 0
mov eax, dword [ebp - 0x2008]
mov dword [ebp - 0x1604], eax
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x1604], eax
jl 0x4765b5
mov dword [ebp - 0x1ba4], 1
jmp 0x4765bc
and dword [ebp - 0x1ba4], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x1ba4]
jne 0x4765df
cmp dword [ebp - 0xb50], 0
je 0x4765df
mov dword [ebp - 0x160c], 1
jmp 0x4765e6
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 0x160c]
mov dword [ebp - 0x243c], eax
lea ecx, [ebp - 0x32fc]
call fcn.00431872
mov dword [ebp - 0x6a0], 0x2e91a049
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x476634
push 0
push 0x15a7
push 0
push 0
push 0x1aa9
push 0x12f5
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x6a0], 0xffffffe4
jmp 0x47664d
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0xfffffff1
jge 0x47667b
mov byte [ebp - 0x2de], 0
movzx eax, byte [ebp - 0x2de]
test eax, eax
je 0x476679
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x476640
mov dword [ebp - 0x6a8], 0
jmp 0x476694
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 2
jge 0x4766b0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp + eax*4 - 0x3720], 0xae9
jmp 0x476687
mov byte [ebp - 0x35d], 0
movzx eax, byte [ebp - 0x35d]
test eax, eax
je 0x4766c8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov byte [ebp - 0x2e0], 0
movzx eax, byte [ebp - 0x2e0]
test eax, eax
je 0x4766ff
push 0x18e6
push 0
push 0x642
push 0x1c6e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x1c], 0xf3c34eea
push 4
lea ecx, [ebp - 0x9e0]
call fcn.004317a0
mov dword [ebp - 0x48c], 0xffffffff
mov dword [ebp - 0x594], 0x3e52509e
mov dword [ebp - 0x236c], 0
mov dword [ebp - 0x2d8c], 0xfffffff6
mov dword [ebp - 0x6b0], 0
jmp 0x47675e
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 4
jge 0x476780
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
mov dword [eax], 0xfffffffa
jmp 0x476751
cmp dword [ebp - 0x1c], 0
jne 0x4767f2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2e3c], eax
mov esi, dword [ebp - 0x1c]
push 3
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
mov dword [eax], esi
cmp dword [ebp - 0x1c], 1
jle 0x4767b3
mov dword [ebp - 0xab8], 1
jmp 0x4767ba
and dword [ebp - 0xab8], 0
push 0
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
mov ecx, dword [ebp - 0xab8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x1c], eax
je 0x4767f2
and dword [ebp - 0x2364], 0
jmp 0x4767fc
mov dword [ebp - 0x2364], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2d98], eax
mov eax, 0x9dce
cmp eax, 0xffff
jb 0x47681d
mov dword [ebp - 0x1e74], 1
jmp 0x476824
and dword [ebp - 0x1e74], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1e74], eax
jge 0x47683b
mov dword [ebp - 0x1614], 1
jmp 0x476842
and dword [ebp - 0x1614], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1614], eax
jne 0x476859
mov dword [ebp - 0x1bac], 1
jmp 0x476860
and dword [ebp - 0x1bac], 0
mov eax, dword [ebp - 0x1bac]
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x594], 9
jmp 0x476885
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0xb
jg 0x476c54
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x162c], 0xfffffff9
cmp dword [ebp - 0x30], 0
je 0x4768ae
jmp 0x476c54
mov dword [ebp - 0x1c], 3
jmp 0x4768be
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x476c4f
mov dword [ebp - 0x2c48], 0
mov dword [ebp - 0x2c44], 0
mov dword [ebp - 0x2c40], 0
mov dword [ebp - 0x2c3c], 0
mov byte [ebp - 0x45d], 0
movzx eax, byte [ebp - 0x45d]
test eax, eax
je 0x476908
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x48c], 3
jmp 0x476921
mov eax, dword [ebp - 0x48c]
dec eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0
jl 0x476c4a
push 1
lea ecx, [ebp - 0x28b0]
call fcn.004317a0
mov dword [ebp - 0xbc8], 0x597fb6f8
mov dword [ebp - 0x6b8], 0
jmp 0x47695e
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 1
jge 0x476980
push dword [ebp - 0x6b8]
lea ecx, [ebp - 0x28b0]
call fcn.0043188e
mov dword [eax], 0xa36fe543
jmp 0x476951
mov dword [ebp - 0x30], 0
jmp 0x476990
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x4769db
mov dword [ebp - 0x6c0], 0xfeae2151
mov dword [ebp - 0x6c0], 3
jmp 0x4769b9
mov eax, dword [ebp - 0x6c0]
dec eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
jl 0x4769d9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
cmp dword [eax], 0
je 0x4769d7
jmp 0x4769d9
jmp 0x4769ac
jmp 0x476989
mov dword [ebp - 0x30], 0
jmp 0x4769eb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x476c3a
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
push 0
lea ecx, [ebp - 0x28b0]
call fcn.0043188e
cmp dword [eax], 1
jg 0x476a21
mov dword [ebp - 0x161c], 1
jmp 0x476a28
and dword [ebp - 0x161c], 0
mov eax, dword [ebp - 0x161c]
sub eax, 0x518d
jne 0x476a51
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
cmp dword [eax], 0
jne 0x476a51
and dword [ebp - 0x2444], 0
jmp 0x476a5b
mov dword [ebp - 0x2444], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2e44], eax
push 0
lea ecx, [ebp - 0x28b0]
call fcn.0043188e
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x476a96
cmp dword [ebp - 0x30], 0
jne 0x476a96
and dword [ebp - 0x1624], 0
jmp 0x476aa0
mov dword [ebp - 0x1624], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1fe0], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1fe0]
mov dword [ebp + eax - 0x2c48], ecx
mov eax, dword [ebp - 0x1fe0]
cmp eax, dword [ebp - 0x1624]
jge 0x476ad6
mov dword [ebp - 0x1bb4], 1
jmp 0x476add
and dword [ebp - 0x1bb4], 0
mov eax, dword [ebp - 0x1bb4]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x162c], eax
mov esi, dword [ebp - 0x162c]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
cmp esi, dword [eax]
jne 0x476b10
mov dword [ebp - 0x1e7c], 1
jmp 0x476b17
and dword [ebp - 0x1e7c], 0
mov eax, dword [ebp - 0x1e7c]
mov dword [ebp - 0x236c], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x476b3f
cmp dword [ebp - 0xbc8], 0
je 0x476b3f
mov dword [ebp - 0x1634], 1
jmp 0x476b46
and dword [ebp - 0x1634], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
mov ecx, dword [ebp - 0x1634]
cmp ecx, dword [eax]
jne 0x476b6a
mov dword [ebp - 0x1bbc], 1
jmp 0x476b71
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0xbc8]
imul eax, dword [ebp - 0x1bbc]
cmp eax, 1
je 0x476b8f
mov dword [ebp - 0x163c], 1
jmp 0x476b96
and dword [ebp - 0x163c], 0
cmp dword [ebp - 0x163c], 3
jge 0x476bab
mov dword [ebp - 0x2010], 1
jmp 0x476bb2
and dword [ebp - 0x2010], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2010], eax
jle 0x476bc9
mov dword [ebp - 0x1644], 1
jmp 0x476bd0
and dword [ebp - 0x1644], 0
mov esi, dword [ebp - 0x30]
imul esi, dword [ebp - 0x1644]
push 3
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
cmp esi, dword [eax]
jge 0x476bf7
mov dword [ebp - 0x1bc4], 1
jmp 0x476bfe
and dword [ebp - 0x1bc4], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9e0]
call fcn.0043188e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1bc4]
jge 0x476c22
mov dword [ebp - 0x164c], 1
jmp 0x476c29
and dword [ebp - 0x164c], 0
mov eax, dword [ebp - 0x164c]
mov dword [ebp - 0xbc8], eax
jmp 0x4769e4
lea ecx, [ebp - 0x28b0]
call fcn.00431872
jmp 0x476914
jmp 0x4768b7
jmp 0x476878
lea ecx, [ebp - 0x9e0]
call fcn.00431872
mov dword [ebp - 0x14c], 0xa26f3f17
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x6c8], 0
jmp 0x476c8c
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 1
jge 0x476ca8
mov eax, dword [ebp - 0x6c8]
mov dword [ebp + eax*4 - 0x244c], 0x8eac8b13
jmp 0x476c7f
mov dword [ebp - 0x18c], 0
jmp 0x476cc1
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x476cdd
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x244c], 0xb50bf34f
jmp 0x476cb4
mov dword [ebp - 0x18c], 0xe
jmp 0x476cf6
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x14
jne 0x476d48
mov byte [ebp - 0x2e2], 0
movzx eax, byte [ebp - 0x2e2]
test eax, eax
je 0x476d1b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x476d46
push 0x20ae
push 0x24b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
jmp 0x476ce9
mov dword [ebp - 0x2c68], 0x48d327cb
mov dword [ebp - 0x2c64], 0x48d327cb
mov dword [ebp - 0x2c60], 0x48d327cb
mov dword [ebp - 0x2c5c], 0x48d327cb
push 1
lea ecx, [ebp - 0x21a4]
call fcn.004317a0
mov dword [ebp - 0x6d0], 0
jmp 0x476d96
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 1
jge 0x476db8
push dword [ebp - 0x6d0]
lea ecx, [ebp - 0x21a4]
call fcn.0043188e
mov dword [eax], 0x683c8fc5
jmp 0x476d89
push 0
lea ecx, [ebp - 0x21a4]
call fcn.0043188e
and dword [eax], 0
jmp 0x476dee
push 0
lea ecx, [ebp - 0x21a4]
call fcn.0043188e
mov dword [ebp - 0x1e84], eax
mov eax, dword [ebp - 0x1e84]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1e84]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x21a4]
call fcn.0043188e
cmp dword [eax], 3
jg 0x476ecf
mov dword [ebp - 0x6d8], 3
mov dword [ebp - 0x6d8], 0
jmp 0x476e27
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 3
jg 0x476eaf
mov dword [ebp - 0x6e0], 3
mov dword [ebp - 0x6e0], 3
jmp 0x476e53
mov eax, dword [ebp - 0x6e0]
dec eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
jl 0x476eaa
mov byte [ebp - 0x2e4], 0
movzx eax, byte [ebp - 0x2e4]
test eax, eax
je 0x476e87
push 0x223c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov byte [ebp - 0x3f5], 0
movzx eax, byte [ebp - 0x3f5]
test eax, eax
je 0x476ea8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x476e46
jmp 0x476e1a
push 0
lea ecx, [ebp - 0x21a4]
call fcn.0043188e
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2c68], 0
je 0x476eca
jmp 0x476ecf
jmp 0x476dca
mov byte [ebp - 0x2e6], 0
movzx eax, byte [ebp - 0x2e6]
test eax, eax
je 0x476eeb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x21a4]
call fcn.00431872
mov dword [ebp - 0x6e8], 0
jmp 0x476f0f
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 1
jge 0x476f2b
mov eax, dword [ebp - 0x6e8]
mov dword [ebp + eax*4 - 0x4c4], 0x4a6847df
jmp 0x476f02
mov dword [ebp - 0xc0], 0xbe8e56f9
mov dword [ebp - 0x166c], 0x4bae914
mov dword [ebp - 0x2da4], 0x6e88f3c2
mov dword [ebp - 0x2e4c], 0xcce71c9e
mov dword [ebp - 0x2db0], 0x5f1c2b46
mov dword [ebp - 0x2e54], 0x2ce4
mov dword [ebp - 0x2dbc], 0x94a7
push 1
lea ecx, [ebp - 0x2b98]
call fcn.004317a0
mov dword [ebp - 0x44], 0
jmp 0x476f8e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x476fa4
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xb58], 0x26bdde0b
jmp 0x476f87
mov dword [ebp - 0x44], 0
jmp 0x476fb4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x476fca
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x37c0], 0xfffffffa
jmp 0x476fad
mov dword [ebp - 0x44], 0
jmp 0x476fda
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x476ff6
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2b98]
call fcn.0043188e
mov dword [eax], 0x4743e03e
jmp 0x476fd3
mov dword [ebp - 0xc0], 0
jmp 0x47700f
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x47742d
mov dword [ebp - 0xdc], 0x10b999fb
mov dword [ebp - 0x27c], 0xffffffff
push 3
lea ecx, [ebp - 0x2694]
call fcn.004317a0
mov dword [ebp - 0x1e8c], 0x2c3cc8c9
mov dword [ebp - 0x6f0], 0
jmp 0x477060
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 3
jge 0x477082
push dword [ebp - 0x6f0]
lea ecx, [ebp - 0x2694]
call fcn.0043188e
mov dword [eax], 9
jmp 0x477053
mov dword [ebp - 0xdc], 0
jmp 0x47709b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x477304
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0xb58], 0
je 0x477262
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb58]
mov ecx, dword [ebp - 0xc0]
imul eax, dword [ebp + ecx*4 - 0xb58]
cmp eax, 0xffffffff
jle 0x4770f2
mov dword [ebp - 0x1654], 1
jmp 0x4770f9
and dword [ebp - 0x1654], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb58]
mov dword [ebp - 0x2e5c], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x2c6c], eax
cmp dword [ebp - 0xdc], 0xe24307a3
jae 0x47713c
mov dword [ebp - 0x1bcc], 1
jmp 0x477143
and dword [ebp - 0x1bcc], 0
mov eax, dword [ebp - 0x1654]
cmp eax, dword [ebp - 0x1bcc]
jne 0x477262
mov dword [ebp - 0x2454], 0x19ae86a6
imul eax, dword [ebp - 0xc0], 0xfffe
add eax, dword [ebp - 0xdc]
sub eax, dword [ebp - 0x3ec]
jne 0x477183
mov dword [ebp - 0x165c], 1
jmp 0x47718a
and dword [ebp - 0x165c], 0
cmp dword [ebp - 0x165c], 0x26c4
je 0x4771a2
mov dword [ebp - 0x2378], 1
jmp 0x4771a9
and dword [ebp - 0x2378], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2e64], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x2dd4], eax
mov eax, 0x4dcd6a9b
test eax, eax
je 0x4771d3
mov eax, 0x52ded145
test eax, eax
jne 0x4771ec
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0xb58], 0
jne 0x4771ec
and dword [ebp - 0x2018], 0
jmp 0x4771f6
mov dword [ebp - 0x2018], 1
mov eax, dword [ebp - 0x2454]
cmp dword [ebp - 0x2018], eax
jge 0x477210
mov dword [ebp - 0x1664], 1
jmp 0x477217
and dword [ebp - 0x1664], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb58]
mov ecx, dword [ebp - 0x1664]
lea eax, [eax + ecx + 0x1023]
test eax, eax
jne 0x477247
mov eax, 0xe82a74db
test eax, eax
jne 0x477247
and dword [ebp - 0x1bd4], 0
jmp 0x477251
mov dword [ebp - 0x1bd4], 1
mov eax, dword [ebp - 0x1bd4]
mov dword [ebp - 0x27c], eax
jmp 0x4772ff
mov dword [ebp - 0x3ec], 0
jmp 0x47727b
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 1
jg 0x4772d6
mov dword [ebp - 0x27c], 0
jmp 0x47729d
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jg 0x4772c0
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x4772be
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x477290
push 1
lea ecx, [ebp - 0x2694]
call fcn.0043188e
cmp dword [eax], 0
je 0x4772d4
jmp 0x47726e
jmp 0x47726e
mov byte [ebp - 0x2e8], 0
movzx eax, byte [ebp - 0x2e8]
test eax, eax
je 0x4772ff
push 0x18c
push 0x6c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x47708e
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x166c], eax
mov eax, dword [ebp - 0x166c]
mov dword [ebp - 0x1e8c], eax
mov eax, dword [ebp - 0x1e8c]
mov dword [ebp - 0x2e6c], eax
cmp dword [ebp - 0xc0], 0xb22c
jne 0x477340
mov dword [ebp - 0x1674], 1
jmp 0x477347
and dword [ebp - 0x1674], 0
push 1
lea ecx, [ebp - 0x2694]
call fcn.0043188e
mov ecx, dword [ebp - 0x1674]
cmp ecx, dword [eax]
jge 0x47736a
mov dword [ebp - 0x1bdc], 1
jmp 0x477371
and dword [ebp - 0x1bdc], 0
push 1
lea ecx, [ebp - 0x2694]
call fcn.0043188e
mov ecx, dword [ebp - 0x1bdc]
cmp ecx, dword [eax]
jle 0x477394
mov dword [ebp - 0x167c], 1
jmp 0x47739b
and dword [ebp - 0x167c], 0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x27c]
imul ecx, dword [ebp - 0x167c]
inc ecx
imul eax, ecx
cmp eax, 0x9bdd
jg 0x4773c5
mov dword [ebp - 0x1fec], 1
jmp 0x4773cc
and dword [ebp - 0x1fec], 0
mov eax, dword [ebp - 0x1fec]
add eax, 0x3da5
mov dword [ebp - 0x1684], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x1684]
mov dword [ebp + eax*4 - 0xb58], ecx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x1684]
jge 0x47740a
mov dword [ebp - 0x1be4], 1
jmp 0x477411
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0x1be4]
mov dword [ebp - 0x27c], eax
lea ecx, [ebp - 0x2694]
call fcn.00431872
jmp 0x477002
push 0
lea ecx, [ebp - 0x2b98]
call fcn.0043188e
mov dword [ebp - 0x168c], eax
mov eax, dword [ebp - 0x168c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x168c]
mov dword [ecx], eax
lea ecx, [ebp - 0x2b98]
call fcn.00431872
mov dword [ebp - 0x6f8], 0
jmp 0x477475
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 1
jge 0x477491
mov eax, dword [ebp - 0x6f8]
mov dword [ebp + eax*4 - 0x494], 3
jmp 0x477468
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x494], 0
jmp 0x4774bf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x494], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x494], 0x11
jne 0x4775a9
mov dword [ebp - 0x1e94], 0x6158d32f
mov dword [ebp - 0x2384], 0x2ee6d058
mov dword [ebp - 0x1694], 4
mov dword [ebp - 0x245c], 0xf6285890
mov eax, dword [ebp - 0x1e94]
inc eax
mov dword [ebp - 0x1e94], eax
mov eax, dword [ebp - 0x2384]
mov dword [ebp - 0x2de0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
sub eax, 0x9214
mov dword [ebp - 0x1694], eax
cmp dword [ebp - 0x1694], 5
jge 0x477541
mov dword [ebp - 0x1bec], 1
jmp 0x477548
and dword [ebp - 0x1bec], 0
cmp dword [ebp - 0x1bec], 0x35a23e86
jle 0x477560
mov dword [ebp - 0x169c], 1
jmp 0x477567
and dword [ebp - 0x169c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
cmp dword [ebp - 0x169c], eax
jl 0x477591
mov eax, 0x1c58
test eax, eax
je 0x477591
mov dword [ebp - 0x212c], 1
jmp 0x477598
and dword [ebp - 0x212c], 0
mov eax, dword [ebp - 0x212c]
mov dword [ebp - 0x245c], eax
jmp 0x4774a4
mov byte [ebp - 0x43d], 0
mov dword [ebp - 0x700], 0xd5e48d32
mov dword [ebp - 0x3504], 1
mov dword [ebp - 0x3500], 1
mov dword [ebp - 0x34fc], 1
mov dword [ebp - 0x34f8], 1
mov dword [ebp - 0x16a4], 0x5d367296
mov dword [ebp - 0x700], 0
jmp 0x477605
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 0x16
je 0x477670
mov dword [ebp - 0x2e74], 0x40194ddb
mov dword [ebp - 0x2e7c], 0x9a971867
mov dword [ebp - 0x33f8], 0
mov dword [ebp - 0x708], 0
jmp 0x477645
mov eax, dword [ebp - 0x708]
inc eax
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 3
jge 0x477661
mov eax, dword [ebp - 0x708]
mov dword [ebp + eax*4 - 0x375c], 0x2fdcba86
jmp 0x477638
mov eax, dword [ebp - 0x16a4]
inc eax
mov dword [ebp - 0x16a4], eax
jmp 0x4775f8
movzx eax, byte [ebp - 0x43d]
test eax, eax
je 0x4778b8
push 1
lea ecx, [ebp - 0x21f8]
call fcn.004317a0
mov dword [ebp - 0x1e9c], 0x2ab76d60
push 2
lea ecx, [ebp - 0x2bb0]
call fcn.004317a0
mov dword [ebp - 0x2390], 1
mov dword [ebp - 0x4c], 0
jmp 0x4776bd
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x4776d9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x21f8]
call fcn.0043188e
mov dword [eax], 0xfffffff7
jmp 0x4776b6
mov dword [ebp - 0x4c], 0
jmp 0x4776e9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x477705
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2bb0]
call fcn.0043188e
mov dword [eax], 0x3f7e813a
jmp 0x4776e2
mov dword [ebp - 0x4c], 0
jmp 0x477715
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x47772b
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xac0], 0xd7bc3524
jmp 0x47770e
push 0
lea ecx, [ebp - 0x21f8]
call fcn.0043188e
push 0
lea ecx, [ebp - 0x21f8]
call fcn.0043188e
cmp dword [eax], 0xfff9
jne 0x477759
mov dword [ebp - 0x1bf4], 1
jmp 0x477760
and dword [ebp - 0x1bf4], 0
push 1
lea ecx, [ebp - 0x2bb0]
call fcn.0043188e
mov dword [eax], 0xa0a5
push 0
lea ecx, [ebp - 0x21f8]
call fcn.0043188e
cmp dword [eax], 0xa0a5
jne 0x477794
mov dword [ebp - 0x16ac], 1
jmp 0x47779b
and dword [ebp - 0x16ac], 0
mov eax, dword [ebp - 0x1bf4]
mov dword [ebp - 0x1e9c], eax
imul eax, dword [ebp - 0x16ac], 0x251c
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xac0]
cmp dword [ebp - 0x1e9c], eax
jl 0x4777d3
mov dword [ebp - 0x16b4], 1
jmp 0x4777da
and dword [ebp - 0x16b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac0]
cmp dword [ebp - 0x16b4], eax
jl 0x4777fb
mov dword [ebp - 0x1bfc], 1
jmp 0x477802
and dword [ebp - 0x1bfc], 0
push 0
lea ecx, [ebp - 0x21f8]
call fcn.0043188e
mov ecx, dword [ebp - 0x1bfc]
cmp ecx, dword [eax]
jne 0x477825
mov dword [ebp - 0xb5c], 1
jmp 0x47782c
and dword [ebp - 0xb5c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb5c]
mov dword [ebp + eax - 0xac0], ecx
cmp dword [ebp - 0xb5c], 0x67d92612
jl 0x477857
mov dword [ebp - 0x16bc], 1
jmp 0x47785e
and dword [ebp - 0x16bc], 0
cmp dword [ebp - 0x16bc], 1
jge 0x477873
mov dword [ebp - 0x1ff4], 1
jmp 0x47787a
and dword [ebp - 0x1ff4], 0
mov eax, dword [ebp - 0x1ff4]
mov dword [ebp - 0x2390], eax
lea ecx, [ebp - 0x2bb0]
call fcn.00431872
lea ecx, [ebp - 0x21f8]
call fcn.00431872
push 0
push 0xfb2
push 0x17d6
push 0x168b
push 0x170e
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x1ea4], 0xfffffffa
mov dword [ebp - 0x16ec], 0x5f432603
mov dword [ebp - 0x2464], 9
mov byte [ebp - 0x2ea], 0
movzx eax, byte [ebp - 0x2ea]
test eax, eax
je 0x477900
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0xc8], 0
je 0x477a07
cmp dword [ebp - 0xc8], 0
jne 0x477958
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x2df0], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x3150], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x2df8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x33b0], eax
cmp dword [ebp - 0xc8], 0
jne 0x477958
and dword [ebp - 0x16c4], 0
jmp 0x477962
mov dword [ebp - 0x16c4], 1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x16c4], eax
jne 0x47797c
mov dword [ebp - 0x1c04], 1
jmp 0x477983
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x1c04]
jg 0x47799d
mov dword [ebp - 0x16cc], 1
jmp 0x4779a4
and dword [ebp - 0x16cc], 0
mov eax, dword [ebp - 0x1ea4]
cmp dword [ebp - 0x16cc], eax
jl 0x4779be
mov dword [ebp - 0x16d4], 1
jmp 0x4779c5
and dword [ebp - 0x16d4], 0
mov eax, dword [ebp - 0x1ea4]
imul eax, dword [ebp - 0x16d4]
cmp eax, 7
jne 0x4779e3
mov dword [ebp - 0x1c0c], 1
jmp 0x4779ea
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x1c0c]
neg eax
dec eax
sub eax, dword [ebp - 0xc8]
je 0x477a07
mov dword [ebp - 0x16dc], 1
jmp 0x477a0e
and dword [ebp - 0x16dc], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x16dc], eax
jg 0x477a28
mov dword [ebp - 0x2084], 1
jmp 0x477a2f
and dword [ebp - 0x2084], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x2084], eax
jge 0x477a49
mov dword [ebp - 0x16e4], 1
jmp 0x477a50
and dword [ebp - 0x16e4], 0
cmp dword [ebp - 0x16e4], 0xffff
ja 0x477a68
mov dword [ebp - 0x1c14], 1
jmp 0x477a6f
and dword [ebp - 0x1c14], 0
mov eax, dword [ebp - 0x1c14]
mov dword [ebp - 0x16ec], eax
mov eax, dword [ebp - 0x16ec]
mov dword [ebp - 0x2464], eax
mov dword [ebp - 0x1ac], 0
jmp 0x477aa0
cmp dword [ebp - 0x1ac], 0
jl 0x479419
mov dword [ebp - 0x2814], 1
mov dword [ebp - 0x2810], 1
mov dword [ebp - 0x280c], 1
mov dword [ebp - 0x2808], 1
mov dword [ebp - 0x59c], 0xa4137d6c
mov dword [ebp - 0x23a8], 0x49c4b05e
mov dword [ebp - 0x2e00], 0xfffffffe
mov dword [ebp - 0x194], 0
jmp 0x477b0c
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x477b28
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x21b0], 3
jmp 0x477aff
mov dword [ebp - 0x194], 0
jmp 0x477b41
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x477b5d
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0xbf4], 0xffffffff
jmp 0x477b34
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbf4], 2
jmp 0x477b8b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbf4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbf4], 0
jl 0x477d7f
mov dword [ebp - 0xac8], 0x4039ee49
mov dword [ebp - 0x1704], 0x2e91c841
mov dword [ebp - 0x2474], 0xa8c98aac
xor eax, eax
jne 0x477c73
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf4]
mov eax, dword [ebp + eax*4 - 0x21b0]
mov dword [ebp - 0x239c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x239c]
mov dword [ebp + eax - 0x2814], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf4]
mov dword [ebp - 0x3158], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2814]
mov dword [ebp - 0x2e08], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xbf4], 0xffff
ja 0x477c37
mov dword [ebp - 0x1eac], 1
jmp 0x477c3e
and dword [ebp - 0x1eac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf4]
mov eax, dword [ebp + eax*4 - 0x21b0]
cmp eax, dword [ebp - 0x1eac]
je 0x477c73
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21b0], 0
jne 0x477c73
and dword [ebp - 0x16f4], 0
jmp 0x477c7d
mov dword [ebp - 0x16f4], 1
mov eax, dword [ebp - 0x16f4]
mov dword [ebp - 0xac8], eax
cmp dword [ebp - 0xac8], 0
jge 0x477c9e
mov dword [ebp - 0x1c1c], 1
jmp 0x477ca5
and dword [ebp - 0x1c1c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf4]
cmp dword [ebp - 0x1c1c], eax
jne 0x477cc6
mov dword [ebp - 0x246c], 1
jmp 0x477ccd
and dword [ebp - 0x246c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf4]
cmp dword [ebp + eax*4 - 0x21b0], 0xdab551fa
je 0x477cf7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbf4], 0
jne 0x477d00
cmp dword [ebp - 0xac8], 0
je 0x477d13
push 4
pop eax
test eax, eax
je 0x477d13
mov dword [ebp - 0x16fc], 1
jmp 0x477d1a
and dword [ebp - 0x16fc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x16fc]
sub ecx, dword [ebp + eax - 0xbf4]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbf4]
imul ecx, dword [ebp + eax*4 - 0x21b0]
test ecx, ecx
jne 0x477d58
cmp dword [ebp - 0x59c], 0
jne 0x477d58
and dword [ebp - 0x1ffc], 0
jmp 0x477d62
mov dword [ebp - 0x1ffc], 1
mov eax, dword [ebp - 0x1ffc]
mov dword [ebp - 0x1704], eax
mov eax, dword [ebp - 0x1704]
mov dword [ebp - 0x2474], eax
jmp 0x477b70
mov eax, dword [ebp - 0x23a8]
mov dword [ebp - 0x3400], eax
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x1c24], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c24]
mov dword [ebp + eax - 0xbf4], ecx
mov eax, dword [ebp - 0x59c]
cmp eax, dword [ebp - 0x1c24]
jle 0x477dc3
mov dword [ebp - 0x170c], 1
jmp 0x477dca
and dword [ebp - 0x170c], 0
imul eax, dword [ebp - 0x170c], 0xffffffff
cmp eax, 0xfffffffc
jbe 0x477de2
mov dword [ebp - 0x1eb4], 1
jmp 0x477de9
and dword [ebp - 0x1eb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21b0]
cmp dword [ebp - 0x1eb4], eax
jle 0x477e0a
mov dword [ebp - 0x1714], 1
jmp 0x477e11
and dword [ebp - 0x1714], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1714]
sub ecx, dword [ebp - 0x59c]
inc ecx
cmp dword [ebp + eax - 0x2814], ecx
je 0x477e39
mov dword [ebp - 0x1c2c], 1
jmp 0x477e40
and dword [ebp - 0x1c2c], 0
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x23d0], 0xd015b01d
mov dword [ebp - 0xad0], 0x78dc2a82
mov dword [ebp - 0xb64], 0xfffffffa
mov dword [ebp - 0xba8], 0xb1b5
mov dword [ebp - 0x171c], 0xfffffffe
push 1
lea ecx, [ebp - 0x2154]
call fcn.004317a0
mov dword [ebp - 0x172c], 5
push 1
lea ecx, [ebp - 0x2108]
call fcn.004317a0
mov dword [ebp - 0x278c], 0xfffffffc
mov dword [ebp - 0x2004], 0xffffffff
push 2
lea ecx, [ebp - 0x2bc8]
call fcn.004317a0
mov dword [ebp - 0x54], 0
jmp 0x477ed3
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x477eef
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2154]
call fcn.0043188e
mov dword [eax], 0x1c9b6cd0
jmp 0x477ecc
mov dword [ebp - 0x54], 0
jmp 0x477eff
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x477f1b
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2108]
call fcn.0043188e
mov dword [eax], 0x4284
jmp 0x477ef8
mov dword [ebp - 0x54], 0
jmp 0x477f2b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x477f47
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2bc8]
call fcn.0043188e
mov dword [eax], 2
jmp 0x477f24
cmp dword [ebp - 0xad0], 0
jne 0x477f7c
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0x171c], eax
mov eax, dword [ebp - 0x171c]
mov ecx, dword [ebp - 0xba8]
inc ecx
mov dword [ebp - 0xba8], ecx
test eax, eax
jne 0x477f7c
and dword [ebp - 0x1c3c], 0
jmp 0x477f86
mov dword [ebp - 0x1c3c], 1
push 3
pop eax
test eax, eax
je 0x477fd8
cmp dword [ebp - 0xad0], 0x75da2ca3
jg 0x477fa5
mov dword [ebp - 0x20ec], 1
jmp 0x477fac
and dword [ebp - 0x20ec], 0
mov eax, dword [ebp - 0xb64]
add eax, dword [ebp - 0x20ec]
jne 0x477fcc
push 0
lea ecx, [ebp - 0x2154]
call fcn.0043188e
cmp dword [eax], 0
je 0x477fd8
mov dword [ebp - 0x2598], 1
jmp 0x477fdf
and dword [ebp - 0x2598], 0
push 0
lea ecx, [ebp - 0x2154]
call fcn.0043188e
cmp dword [eax], 0xa83a
jne 0x478000
mov dword [ebp - 0x1724], 1
jmp 0x478007
and dword [ebp - 0x1724], 0
mov eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0x1724]
jl 0x478021
mov dword [ebp - 0x1c34], 1
jmp 0x478028
and dword [ebp - 0x1c34], 0
mov eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x172c], eax
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x172c], eax
jge 0x47804e
mov dword [ebp - 0x1ebc], 1
jmp 0x478055
and dword [ebp - 0x1ebc], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x1ebc], eax
jge 0x47806f
mov dword [ebp - 0x23b0], 1
jmp 0x478076
and dword [ebp - 0x23b0], 0
push 0
lea ecx, [ebp - 0x2154]
call fcn.0043188e
push 0
lea ecx, [ebp - 0x2108]
call fcn.0043188e
cmp dword [ebp - 0x278c], 0x5987
jge 0x4780a8
mov dword [ebp - 0x1734], 1
jmp 0x4780af
and dword [ebp - 0x1734], 0
push 0
lea ecx, [ebp - 0x2108]
call fcn.0043188e
mov ecx, dword [ebp - 0x1734]
imul ecx, dword [eax]
test ecx, ecx
jne 0x4780e4
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x284], 0xf5bfb66f
mov dword [ebp - 0xb6c], 0x1bbb4f5a
mov dword [ebp - 0xae0], 0x6ac3a608
mov dword [ebp - 0x3180], 0x7ec5
mov dword [ebp - 0x748], 0
jmp 0x479461
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 2
jge 0x47947d
mov eax, dword [ebp - 0x748]
mov dword [ebp + eax*4 - 0x1fdc], 0x856dfc9b
jmp 0x479454
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x479491
mov dword [ebp - 0x2024], 1
jmp 0x479498
and dword [ebp - 0x2024], 0
mov eax, dword [ebp - 0x2024]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x24], eax
jg 0x4794bb
mov dword [ebp - 0x1844], 1
jmp 0x4794c2
and dword [ebp - 0x1844], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1844]
je 0x4794df
cmp dword [ebp - 0x284], 0
je 0x4794df
and dword [ebp - 0x1cc4], 0
jmp 0x4794e9
mov dword [ebp - 0x1cc4], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1cc4], eax
jg 0x479500
mov dword [ebp - 0x184c], 1
jmp 0x479507
and dword [ebp - 0x184c], 0
mov eax, dword [ebp - 0x184c]
mov dword [ebp - 0xb6c], eax
cmp dword [ebp - 0x24], 0xfffffffc
jg 0x479525
mov dword [ebp - 0x1f04], 1
jmp 0x47952c
and dword [ebp - 0x1f04], 0
mov eax, dword [ebp - 0x1f04]
neg eax
mov dword [ebp - 0x1854], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1854]
mov dword [ebp + eax - 0x1fdc], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1854], eax
je 0x479564
mov dword [ebp - 0x1ccc], 1
jmp 0x47956b
and dword [ebp - 0x1ccc], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1ccc]
jne 0x479582
mov dword [ebp - 0x185c], 1
jmp 0x479589
and dword [ebp - 0x185c], 0
cmp dword [ebp - 0x185c], 0xc0de450b
jbe 0x4795a1
mov dword [ebp - 0x209c], 1
jmp 0x4795a8
and dword [ebp - 0x209c], 0
cmp dword [ebp - 0x209c], 0x64d07ddb
jge 0x4795c0
mov dword [ebp - 0x1864], 1
jmp 0x4795c7
and dword [ebp - 0x1864], 0
mov eax, dword [ebp - 0x1864]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xae0], eax
jl 0x4795ed
mov dword [ebp - 0x1cd4], 1
jmp 0x4795f4
and dword [ebp - 0x1cd4], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1cd4]
jge 0x47960b
mov dword [ebp - 0x186c], 1
jmp 0x479612
and dword [ebp - 0x186c], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x186c]
je 0x4796a1
mov dword [ebp - 0x24], 1
jmp 0x479631
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x47969c
mov byte [ebp - 0x47d], 0
movzx eax, byte [ebp - 0x47d]
test eax, eax
je 0x47965f
push 1
push 0
push 0xf4c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0x284], 0
jmp 0x479678
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jg 0x47969a
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1fdc]
mov dword [ebp + ecx*4 - 0x1fdc], eax
jmp 0x47966b
jmp 0x47962a
jmp 0x479748
mov dword [ebp - 0x25b8], 1
mov dword [ebp - 0x1874], 0
cmp dword [ebp - 0xae0], 0x6652
jg 0x4796cd
mov dword [ebp - 0x2750], 1
jmp 0x4796d4
and dword [ebp - 0x2750], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fdc]
sub eax, 0x7b4d
mov dword [ebp - 0xb6c], eax
cmp dword [ebp - 0xb6c], 0xffffffff
jbe 0x479701
mov dword [ebp - 0x23e8], 1
jmp 0x479708
and dword [ebp - 0x23e8], 0
cmp dword [ebp - 0x25b8], 3
je 0x47971d
mov dword [ebp - 0x1f0c], 1
jmp 0x479724
and dword [ebp - 0x1f0c], 0
mov eax, dword [ebp - 0x1f0c]
mov dword [ebp - 0x1874], eax
mov eax, dword [ebp - 0x1874]
add eax, 0xc147
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1fdc], eax
mov byte [ebp - 0x2f2], 0
movzx eax, byte [ebp - 0x2f2]
test eax, eax
je 0x479762
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
call fcn.0046602e
push 4
lea ecx, [ebp - 0x640]
call fcn.004317a0
mov dword [ebp - 0x2794], 0x43ee
mov dword [ebp - 0x5c], 0
jmp 0x47978e
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x4797a4
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2910], 0
jmp 0x479787
mov dword [ebp - 0x5c], 0
jmp 0x4797b4
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x4797d0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x640]
call fcn.0043188e
mov dword [eax], 0xca4f833f
jmp 0x4797ad
mov dword [ebp - 0x5c], 0
jmp 0x4797e0
cmp dword [ebp - 0x5c], 4
jge 0x4797f6
push 1
lea ecx, [ebp - 0x2714]
call fcn.004317a0
mov dword [ebp - 0x3058], 0x1e3ff14e
mov dword [ebp - 0x3508], 0x714ad38
push 1
lea ecx, [ebp - 0x33bc]
call fcn.004317a0
mov dword [ebp - 0x244], 0
jmp 0x48009c
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x4800be
push dword [ebp - 0x244]
lea ecx, [ebp - 0x2714]
call fcn.0043188e
mov dword [eax], 0x477862f
jmp 0x48008f
mov dword [ebp - 0x244], 0
jmp 0x4800d7
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x4800f6
push dword [ebp - 0x244]
lea ecx, [ebp - 0x33bc]
call fcn.0043188e
and dword [eax], 0
jmp 0x4800ca
mov byte [ebp - 0x3bd], 0
movzx eax, byte [ebp - 0x3bd]
test eax, eax
je 0x48011e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
lea ecx, [ebp - 0x2714]
call fcn.0043188e
mov dword [eax], 0xb
jmp 0x480157
push 0
lea ecx, [ebp - 0x2714]
call fcn.0043188e
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc4c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc4c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2714]
call fcn.0043188e
cmp dword [eax], 0xf
jne 0x48023b
mov dword [ebp - 0x8d0], 0xde2167fa
mov dword [ebp - 0x3060], 0x3ba20b95
mov dword [ebp - 0x32c0], 0xfffffffc
mov dword [ebp - 0x8d0], 0xfffffffa
jmp 0x4801a4
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 8
jle 0x480236
mov dword [ebp - 0x8d8], 0x3367f5ed
mov dword [ebp - 0x3068], 0xffffffff
mov dword [ebp - 0x8d8], 0xffffffec
jmp 0x4801de
mov eax, dword [ebp - 0x8d8]
inc eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 0xb
jne 0x480231
mov dword [ebp - 0xc54], 0x3aaf
mov eax, dword [ebp - 0xc54]
inc eax
mov dword [ebp - 0xc54], eax
mov byte [ebp - 0x310], 0
movzx eax, byte [ebp - 0x310]
test eax, eax
je 0x48022f
push 0
push 0
push 0x330
push 0
push 0x756
push 0
push 0x26b1
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x4801d1
jmp 0x480197
jmp 0x480133
lea ecx, [ebp - 0x33bc]
call fcn.00431872
lea ecx, [ebp - 0x2714]
call fcn.00431872
push 1
lea ecx, [ebp - 0x2118]
call fcn.004317a0
mov dword [ebp - 0xc6c], 0x6a07563f
mov dword [ebp - 0xc84], 0xc17c7747
mov dword [ebp - 0x220c], 0xfffffffd
mov dword [ebp - 0x3464], 0x29a2a67f
mov dword [ebp - 0xc94], 0xbe9
push 3
lea ecx, [ebp - 0x33cc]
call fcn.004317a0
mov dword [ebp - 0x7c], 0
jmp 0x4802ad
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x4802c3
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2398], 1
jmp 0x4802a6
mov dword [ebp - 0x7c], 0
jmp 0x4802d3
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x4802ef
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x2118]
call fcn.0043188e
mov dword [eax], 1
jmp 0x4802cc
mov dword [ebp - 0x7c], 0
jmp 0x4802ff
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x48031b
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x33cc]
call fcn.0043188e
mov dword [eax], 0x678d5680
jmp 0x4802f8
push 0
lea ecx, [ebp - 0x2118]
call fcn.0043188e
mov dword [eax], 1
jmp 0x480354
push 0
lea ecx, [ebp - 0x2118]
call fcn.0043188e
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc5c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc5c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2118]
call fcn.0043188e
cmp dword [eax], 0
jl 0x480463
mov dword [ebp - 0xc74], 0xfffffffe
push 0
lea ecx, [ebp - 0x2118]
call fcn.0043188e
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x2398]
push 0
lea ecx, [ebp - 0x2118]
call fcn.0043188e
mov eax, dword [eax]
add esi, dword [ebp + eax*4 - 0x2398]
jne 0x4803bb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2398], 0
jne 0x4803bb
and dword [ebp - 0xc64], 0
jmp 0x4803c5
mov dword [ebp - 0xc64], 1
cmp dword [ebp - 0xc64], 0
jne 0x48042c
mov dword [ebp - 0xc6c], 0x71bc
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0xc74], eax
cmp dword [ebp - 0xc74], 0xfffffffd
jle 0x4803f9
mov dword [ebp - 0xc7c], 1
jmp 0x480400
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0xc84], eax
mov esi, dword [ebp - 0xc84]
push 0
lea ecx, [ebp - 0x2118]
call fcn.0043188e
cmp dword [eax], esi
je 0x48042c
and dword [ebp - 0xc8c], 0
jmp 0x480436
mov dword [ebp - 0xc8c], 1
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0x220c], eax
mov byte [ebp - 0x475], 0
movzx eax, byte [ebp - 0x475]
test eax, eax
je 0x48045e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x480330
mov eax, dword [ebp - 0xc94]
inc eax
mov dword [ebp - 0xc94], eax
lea ecx, [ebp - 0x33cc]
call fcn.00431872
lea ecx, [ebp - 0x2118]
call fcn.00431872
mov dword [ebp - 0xccc], 0xffffffff
mov dword [ebp - 0xcac], 0x4543beb7
mov dword [ebp - 0x3070], 0xffffffff
mov dword [ebp - 0x32d0], 8
mov dword [ebp - 0x3078], 0xffffffff
mov dword [ebp - 0x2218], 0x1d91e66c
mov dword [ebp - 0xcec], 0xffffffff
mov dword [ebp - 0xcfc], 5
mov dword [ebp - 0x3570], 0xa3cc92ea
mov dword [ebp - 0x3080], 0x2c32b96c
mov dword [ebp - 0x32e0], 0xfffffffc
push 3
lea ecx, [ebp - 0x288c]
call fcn.004317a0
mov dword [ebp - 0x3088], 0x2de9e5a9
mov dword [ebp - 0x346c], 5
mov dword [ebp - 0x3090], 1
push 4
lea ecx, [ebp - 0x33dc]
call fcn.004317a0
mov dword [ebp - 0xaec], 0xfffffff8
mov dword [ebp - 0x2228], 0xd7d9c74e
mov dword [ebp - 0x2230], 0x208
mov dword [ebp - 0x84], 0
jmp 0x480563
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x480585
push dword [ebp - 0x84]
lea ecx, [ebp - 0x288c]
call fcn.0043188e
mov dword [eax], 0x378f1e0c
jmp 0x480556
mov dword [ebp - 0x84], 0
jmp 0x48059e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x4805ba
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x2974], 0x3473
jmp 0x480591
mov dword [ebp - 0x84], 0
jmp 0x4805d3
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x4805f5
push dword [ebp - 0x84]
lea ecx, [ebp - 0x33dc]
call fcn.0043188e
mov dword [eax], 0xb8ac29ba
jmp 0x4805c6
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0xcac], eax
push 1
lea ecx, [ebp - 0x288c]
call fcn.0043188e
and dword [eax], 0
cmp dword [ebp - 0xcec], 0
jne 0x480626
mov dword [ebp - 0xc9c], 1
jmp 0x48062d
and dword [ebp - 0xc9c], 0
cmp dword [ebp - 0xc9c], 0
jae 0x480642
mov dword [ebp - 0x2210], 1
jmp 0x480649
and dword [ebp - 0x2210], 0
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x32f0], eax
mov eax, 0x7709
cmp eax, 0x3db
jl 0x48066d
mov dword [ebp - 0x2220], 1
jmp 0x480674
and dword [ebp - 0x2220], 0
mov esi, dword [ebp - 0x2228]
push 0
lea ecx, [ebp - 0x288c]
call fcn.0043188e
cmp esi, dword [eax]
je 0x480697
mov dword [ebp - 0xca4], 1
jmp 0x48069e
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0xca4]
add eax, 3
imul eax, eax, 0xffff
cmp eax, dword [ebp - 0xcac]
je 0x4806c1
mov dword [ebp - 0xcb4], 1
jmp 0x4806c8
and dword [ebp - 0xcb4], 0
cmp dword [ebp - 0xcb4], 0xfffffffe
jle 0x4806dd
mov dword [ebp - 0xcbc], 1
jmp 0x4806e4
and dword [ebp - 0xcbc], 0
cmp dword [ebp - 0xcbc], 0xfff6
jb 0x4806fc
mov dword [ebp - 0xcc4], 1
jmp 0x480703
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0xaec]
inc eax
mov dword [ebp - 0xaec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2974]
add eax, dword [ebp - 0xcc4]
cmp dword [ebp - 0xaec], eax
jle 0x480737
mov dword [ebp - 0xcd4], 1
jmp 0x48073e
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0xccc]
add eax, dword [ebp - 0xcd4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2974]
jne 0x480765
mov dword [ebp - 0xcdc], 1
jmp 0x48076c
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x2230]
cmp dword [ebp - 0xcdc], eax
jle 0x480786
mov dword [ebp - 0xce4], 1
jmp 0x48078d
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xcfc]
imul eax, dword [ebp - 0xce4]
add eax, 0xb95d01
cmp eax, dword [ebp - 0xcec]
jl 0x4807b3
mov dword [ebp - 0xcf4], 1
jmp 0x4807ba
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0xcfc], eax
lea ecx, [ebp - 0x33dc]
call fcn.00431872
lea ecx, [ebp - 0x288c]
call fcn.00431872
xor ecx, ecx
call fcn.00431b0b
push eax
call fcn.00484cc3
pop ecx
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xd14], 0x5fa2ef7
mov dword [ebp - 0x2240], 0xffffffff
mov dword [ebp - 0xd24], 0x7263b0a6
mov dword [ebp - 0x8e0], 0
jmp 0x48082b
mov eax, dword [ebp - 0x8e0]
inc eax
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 2
jge 0x480847
mov eax, dword [ebp - 0x8e0]
mov dword [ebp + eax*4 - 0x2dd0], 0xcadfb1af
jmp 0x48081e
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x3098], eax
xor eax, eax
jne 0x480869
cmp dword [ebp - 0xc4], 0
jne 0x480869
and dword [ebp - 0x2238], 0
jmp 0x480873
mov dword [ebp - 0x2238], 1
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x351c], eax
mov eax, dword [ebp - 0xc4]
add eax, 0xf99
sub eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc4]
jge 0x4808b3
cmp dword [ebp - 0xc4], 0
jne 0x4808b3
cmp dword [ebp - 0xc4], 0
jne 0x4808b3
and dword [ebp - 0xd04], 0
jmp 0x4808bd
mov dword [ebp - 0xd04], 1
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xd04], eax
jne 0x4808d7
mov dword [ebp - 0xd0c], 1
jmp 0x4808de
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0xd14], eax
mov eax, dword [ebp - 0x2240]
cmp dword [ebp - 0xd14], eax
jne 0x480904
mov dword [ebp - 0xd1c], 1
jmp 0x48090b
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0xd24]
cmp dword [ebp - 0xc4], eax
jg 0x480931
mov dword [ebp - 0xd2c], 1
jmp 0x480938
and dword [ebp - 0xd2c], 0
imul eax, dword [ebp - 0xc4], 0xf390
mov ecx, dword [ebp - 0xd2c]
sub ecx, dword [ebp - 0xc4]
cmp eax, ecx
jg 0x48095e
mov dword [ebp - 0xd34], 1
jmp 0x480965
and dword [ebp - 0xd34], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd34]
mov dword [ebp + eax - 0x2dd0], ecx
mov byte [ebp - 0x312], 0
movzx eax, byte [ebp - 0x312]
test eax, eax
je 0x480996
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
and dword [ebp - 0x2a00], 0
and dword [ebp - 0x29fc], 0
and dword [ebp - 0x29f8], 0
and dword [ebp - 0x29f4], 0
lea ecx, [ebp - 0xb39]
call fcn.0043189d
push eax
lea eax, [ebp - 0x29f0]
push eax
lea eax, [ebp - 0x2a00]
push eax
lea ecx, [ebp - 0x36c0]
call fcn.004318a0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x28a4]
call fcn.0043184c
mov dword [ebp - 0x8e8], 0
jmp 0x480a00
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 3
jge 0x480a1c
mov eax, dword [ebp - 0x8e8]
mov dword [ebp + eax*4 - 0x3768], 0x1dbeccce
jmp 0x4809f3
push 0
lea ecx, [ebp - 0x28a4]
call fcn.0043188e
mov dword [eax], 0xffffffe7
jmp 0x480a55
push 0
lea ecx, [ebp - 0x28a4]
call fcn.0043188e
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0xd3c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd3c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x28a4]
call fcn.0043188e
cmp dword [eax], 5
jl 0x480ab9
mov dword [ebp - 0x8f0], 1
mov dword [ebp - 0x8f0], 2
jmp 0x480a8a
mov eax, dword [ebp - 0x8f0]
dec eax
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 0
jl 0x480ab4
mov byte [ebp - 0x3c5], 0
movzx eax, byte [ebp - 0x3c5]
test eax, eax
je 0x480ab2
push 0xce9
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x480a7d
jmp 0x480a31
lea ecx, [ebp - 0x28a4]
call fcn.00431872
mov dword [ebp - 0xd74], 1
mov dword [ebp - 0xaf4], 0x9ee1c974
mov dword [ebp - 0x2248], 0xffffffff
mov dword [ebp - 0x8f8], 0
jmp 0x480afb
mov eax, dword [ebp - 0x8f8]
inc eax
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 3
jge 0x480b17
mov eax, dword [ebp - 0x8f8]
mov dword [ebp + eax*4 - 0x364c], 0xb6fd43dd
jmp 0x480aee
mov byte [ebp - 0x314], 0
movzx eax, byte [ebp - 0x314]
test eax, eax
je 0x480b4d
push 0x622
push 0
push 0
push 0x15f8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
cmp dword [ebp - 0xd74], 0x9310c13f
je 0x480b65
mov dword [ebp - 0xd44], 1
jmp 0x480b6c
and dword [ebp - 0xd44], 0
cmp dword [ebp - 0xd44], 0
jg 0x480b81
mov dword [ebp - 0xd4c], 1
jmp 0x480b88
and dword [ebp - 0xd4c], 0
cmp dword [ebp - 0xd4c], 0xd963
jle 0x480ba0
mov dword [ebp - 0xd54], 1
jmp 0x480ba7
and dword [ebp - 0xd54], 0
cmp dword [ebp - 0xd54], 0x5145ccb9
jle 0x480bbf
mov dword [ebp - 0xd5c], 1
jmp 0x480bc6
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xaf4]
cmp eax, dword [ebp - 0xd5c]
je 0x480be5
xor eax, eax
inc eax
je 0x480be5
mov dword [ebp - 0xd64], 1
jmp 0x480bec
and dword [ebp - 0xd64], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd64]
mov dword [ebp + eax - 0x364c], ecx
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x30a0], eax
xor eax, eax
inc eax
cmp eax, 5
jb 0x480c1e
mov dword [ebp - 0xd6c], 1
jmp 0x480c25
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0xaf4]
cmp dword [ebp - 0xd6c], eax
jg 0x480c3f
mov dword [ebp - 0xd7c], 1
jmp 0x480c46
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd74]
imul eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x51c], 0xfffffffe
push 2
lea ecx, [ebp - 0x28bc]
call fcn.004317a0
mov dword [ebp - 0x2250], 5
mov dword [ebp - 0xafc], 1
mov dword [ebp - 0xda4], 0x7c7128ab
mov dword [ebp - 0x900], 0xffffffff
mov dword [ebp - 0x2260], 0xffffffff
mov dword [ebp - 0x24c], 0
jmp 0x480cbb
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x480cdd
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x28bc]
call fcn.0043188e
mov dword [eax], 0xfff9
jmp 0x480cae
mov dword [ebp - 0x24c], 0
jmp 0x480cf6
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x480d12
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x2984], 0xa017779a
jmp 0x480ce9
mov dword [ebp - 0x51c], 2
jmp 0x480d2b
mov eax, dword [ebp - 0x51c]
dec eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0xffffffec
jle 0x480d7b
mov dword [ebp - 0x614], 0x86cce57b
mov dword [ebp - 0x614], 0
jmp 0x480d57
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 2
jge 0x480d79
push dword [ebp - 0x614]
lea ecx, [ebp - 0x28bc]
call fcn.0043188e
mov dword [eax], 0xcd53
jmp 0x480d4a
jmp 0x480d1e
mov eax, dword [ebp - 0x2250]
mov dword [ebp - 0x3300], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2984]
mov dword [ebp - 0x30a8], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x2984], 0xffffffff
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2984]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
add eax, 0x4ddb
or ecx, 0xffffffff
sub ecx, eax
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x2984]
jl 0x480de6
mov dword [ebp - 0xd84], 1
jmp 0x480ded
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0xafc], eax
cmp dword [ebp - 0xafc], 0
jne 0x480e14
cmp dword [ebp - 0xafc], 0
jne 0x480e14
and dword [ebp - 0xd8c], 0
jmp 0x480e1e
mov dword [ebp - 0xd8c], 1
mov eax, dword [ebp - 0xda4]
cmp dword [ebp - 0xd8c], eax
jle 0x480e38
mov dword [ebp - 0xd94], 1
jmp 0x480e3f
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0xd94], eax
je 0x480e59
mov dword [ebp - 0xd9c], 1
jmp 0x480e60
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
sub eax, 0xfafb
cmp eax, dword [ebp - 0x900]
je 0x480e9a
push 0
lea ecx, [ebp - 0x28bc]
call fcn.0043188e
cmp dword [eax], 0
je 0x480e9a
cmp dword [ebp - 0x900], 0
je 0x480e9a
mov dword [ebp - 0x2258], 1
jmp 0x480ea1
and dword [ebp - 0x2258], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2984]
mov dword [ebp - 0x3474], eax
imul eax, dword [ebp - 0x2260], 0xb187
add eax, dword [ebp - 0x900]
mov dword [ebp - 0xda4], eax
lea ecx, [ebp - 0x28bc]
call fcn.00431872
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xa9baec
push 0xa9baec
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0x3554], 0xffffffff
mov dword [ebp - 0x3550], 0xffffffff
mov dword [ebp - 0x354c], 0xffffffff
mov dword [ebp - 0x3548], 0xffffffff
mov byte [ebp - 0x425], 0
movzx eax, byte [ebp - 0x425]
test eax, eax
je 0x480f50
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x316], 0
movzx eax, byte [ebp - 0x316]
test eax, eax
je 0x480f96
push 0
push 0xed
push 0x1644
push 0x24fa
push 0x1a28
push 0x1204
push 0x99b
push 0x26ef
push 0x203b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 5
push dword [ebp - 0xb14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x908], 0
mov dword [ebp - 0x908], 0
jmp 0x480fc7
mov eax, dword [ebp - 0x908]
dec eax
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 0xffffffff
jne 0x4810b7
mov dword [ebp - 0x910], 0
jmp 0x480fed
mov eax, dword [ebp - 0x910]
inc eax
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 3
jge 0x481009
mov eax, dword [ebp - 0x910]
mov dword [ebp + eax*4 - 0x2724], 4
jmp 0x480fe0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2724], 0
jmp 0x481034
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2724], 0x1d
jge 0x4810b2
mov dword [ebp - 0x918], 0
jmp 0x48105c
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 2
jge 0x481078
mov eax, dword [ebp - 0x918]
mov dword [ebp + eax*4 - 0x2ddc], 1
jmp 0x48104f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2724], 0xffffffff
jg 0x481093
mov dword [ebp - 0xdac], 1
jmp 0x48109a
and dword [ebp - 0xdac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdac]
mov dword [ebp + eax - 0x2ddc], ecx
jmp 0x48101b
jmp 0x480fba
push dword [ebp - 0xb14]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x61c], 2
mov dword [ebp - 0x130], 0x268f
push 4
lea ecx, [ebp - 0x9b0]
call fcn.004317a0
mov dword [ebp - 0x524], 0x4d258d03
mov dword [ebp - 0xe4], 0xb0ce
mov dword [ebp - 0x8c], 0x8e548e01
mov dword [ebp - 0x624], 0x4edb553a
mov dword [ebp - 0xb04], 0x5f6
mov dword [ebp - 0x920], 0
jmp 0x48112f
mov eax, dword [ebp - 0x920]
inc eax
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 4
jge 0x48114e
push dword [ebp - 0x920]
lea ecx, [ebp - 0x9b0]
call fcn.0043188e
and dword [eax], 0
jmp 0x481122
mov byte [ebp - 0x3cd], 0
movzx eax, byte [ebp - 0x3cd]
test eax, eax
je 0x481166
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x130], 0x95a5
jle 0x48118b
mov dword [ebp - 0x2268], 1
jmp 0x481192
and dword [ebp - 0x2268], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x30b0], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3310], eax
push 3
lea ecx, [ebp - 0x9b0]
call fcn.0043188e
mov eax, dword [eax]
sub eax, 0xbb30
cmp eax, dword [ebp - 0x8c]
jle 0x4811db
mov eax, 0x183a0997
test eax, eax
je 0x4811db
mov dword [ebp - 0xdb4], 1
jmp 0x4811e2
and dword [ebp - 0xdb4], 0
push 2
lea ecx, [ebp - 0x9b0]
call fcn.0043188e
mov ecx, dword [ebp - 0xdb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x30b8], eax
cmp dword [ebp - 0x624], 0xed73
je 0x48121b
mov dword [ebp - 0xdbc], 1
jmp 0x481222
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x61c]
add eax, dword [ebp - 0xdbc]
cmp eax, 0xf985
je 0x481241
mov dword [ebp - 0x2270], 1
jmp 0x481248
and dword [ebp - 0x2270], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x3598], eax
mov eax, dword [ebp - 0x624]
cmp dword [ebp - 0x130], eax
je 0x48126e