Function at 0x469196
Capabilities:
Create directory
Get file system object information
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
mov dword [ebp - 0x48], ecx
xor edi, edi
mov dword [ebp - 0x10], 0xa48bbca6
inc edi
mov dword [ebp - 0x24], edi
mov esi, edx
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], eax
jmp 0x4691d5
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1a4], 0xe62699ff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x4691c4
mov dword [ebp - 0x10], 0xfffffff3
cmp dword [ebp - 0x10], 6
push 0xffffffffffffffff
pop edx
jl 0x46931e
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
jmp 0x469204
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xbc], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4691f7
mov dword [ebp - 4], eax
jmp 0x469220
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xc0], 0x3ed2
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x46920f
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469236
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
mov ecx, dword [ebp - 0xb4]
cmp dword [ebp - 0xbc], ecx
jl 0x4692cd
mov dword [ebp - 0x1c], 0x412894f
mov dword [ebp - 0x14], 0x814b11f3
mov dword [ebp - 0x1c], edi
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
push 0
pop ecx
setg cl
mov edx, 0xffff
imul ecx, dword [ebp - 0x10]
push 0
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
sbb edx, edx
inc edx
cmp edx, ecx
mov edx, dword [ebp - 0x10]
pop ecx
setne cl
sub edx, ecx
imul edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x10]
add edx, 0x11b300eb
je 0x469297
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0xc0], 0xfffc
jbe 0x4692b9
mov esi, eax
cmp dword [ebp - 0x24], eax
je 0x4692bb
mov esi, edi
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp esi, ecx
setle dl
mov dword [ebp - 0xbc], edx
jmp 0x46930b
mov dword [ebp - 0xc], 0xfffffff8
mov dword [ebp - 0x14], edi
dec dword [ebp - 0x1a0]
mov dword [ebp - 0xc], eax
jmp 0x469305
mov dword [ebp - 0x14], eax
jmp 0x4692fc
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4692f9
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x4692e7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xe
jle 0x4692e2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
push 0xffffffffffffffff
pop edx
jge 0x4691ef
mov esi, dword [ebp - 0x34]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469331
push 0x68
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov dword [ebp - 0x1c], 0xfff8
mov dword [ebp - 0x20], 0x9827
mov dword [ebp - 0x1c], 0x4dbf0cf
mov dword [ebp - 0x24], 0x335c22c9
mov dword [ebp - 4], eax
jmp 0x469363
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xc8], 0xe8f21009
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x469352
mov dword [ebp - 4], eax
jmp 0x46937e
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xa0], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x46936d
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp edx, ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x1c], ecx
jne 0x469397
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x9c]
cmp ecx, edi
mov ecx, dword [ebp - 0x1c]
setge dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, 0xd04c
setge cl
xor edx, edx
cmp edx, ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x9c], ecx
mov ecx, dword [0xa939a0]
test cl, 1
jne 0x46946c
push eax
or ecx, edi
mov dword [0xa93980], eax
push eax
mov dword [0xa939a0], ecx
mov dword [0xa93984], eax
call fcn.00404223
mov ecx, eax
mov dword [0xa9399c], 0x3f800000
mov dword [0xa93980], ecx
xor eax, eax
mov dword [ebp - 0xac], ecx
lea ecx, [ebp - 0xac]
push ecx
push 0x10
push eax
mov dword [0xa93988], eax
mov ecx, 0xa93988
mov dword [0xa93990], eax
mov dword [0xa9398c], eax
lea eax, [ebp - 0x148]
push eax
call fcn.00403f59
push 0x499adc
mov dword [0xa93994], 7
mov dword [0xa93998], 8
call fcn.004838ff
pop ecx
xor eax, eax
imul ecx, dword [ebp - 0x48], 0x2710
push 4
add ecx, esi
mov dword [ebp - 0x70], ecx
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x24], 0x68dd2ac3
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x4694ae
mov edx, 0xffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1d4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x46949c
mov dword [ebp - 4], eax
jmp 0x4694ed
mov dword [ebp - 0x14], eax
jmp 0x4694c9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1fc], 0x7ca0029b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4694b8
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4694e2
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor eax, eax
cmp dword [ebp - 0x1f8], eax
jne 0x4694f3
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffa
jg 0x4694b3
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], eax
jne 0x469535
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
jge 0x469511
cmp dword [ebp - 0x10], eax
je 0x469513
mov eax, edi
cmp edi, eax
mov eax, dword [ebp - 4]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x6e3e
setg al
cmp eax, edi
jae 0x469535
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1cc]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x24], edi
push eax
call fcn.0046ab0f
xor edx, edx
inc edx
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xbb6748f6
mov dword [ebp - 0x18], 0x814b733c
mov dword [ebp - 0x18], 0x46b6eb6
mov dword [ebp - 0x1c], 0xb49d
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
jmp 0x46959e
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x154], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x46958d
dec dword [ebp - 0x1c]
test edi, edi
je 0x46973e
mov dword [ebp - 0x14], eax
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x6a08376f
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x24], 0x3d88101a
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x14], eax
jmp 0x4695e6
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x28], 0xf6af1124
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x4695d8
mov dword [ebp - 0x28], 0xffffffe2
cmp dword [ebp - 0x28], esi
jne 0x4696bc
or edi, 0xffffffff
mov dword [ebp - 0xc], 0x3d4e
mov dword [ebp - 0x34], 0xadf890ba
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x469620
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
imul edx, ecx
mov ecx, dword [ebp - 0xc]
push 0
cmp edx, ecx
pop ecx
setle cl
sub ecx, dword [ebp - 0xc]
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x49c9
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
pop edx
setne dl
cmp edx, ecx
mov ecx, dword [ebp - 0x28]
push 0
pop edx
setle dl
sub edx, ecx
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x34], edx
xor edx, edx
cmp dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x28]
setl dl
imul esi, edx
xor edx, edx
cmp esi, ecx
setg dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x54fd
setg dl
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x28], eax
jne 0x4696b6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
je 0x4695fe
mov edi, dword [ebp - 4]
xor edx, edx
inc edx
mov esi, dword [ebp + 8]
push 2
mov dword [ebp + 8], edx
mov dword [ebp + 8], eax
mov dword [esi], edi
pop edi
jmp 0x4696da
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x6c], 0x5c68ec0a
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x4696cc
mov dword [ebp - 0x6c], eax
jmp 0x46971b
mov dword [ebp + 8], 0x386cce57
mov dword [ebp + 8], eax
jmp 0x4696f9
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x1d
jle 0x4696f0
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x469718
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
dec dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0xfffffffe
jl 0x4696e4
mov dword [ebp + 8], eax
jmp 0x469734
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x6c], 6
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x469726
jmp 0x46aa98
mov ecx, dword [0xa939a0]
test cl, 2
jne 0x4697c8
push eax
or ecx, 2
mov dword [0xa93960], eax
push eax
mov dword [0xa939a0], ecx
mov dword [0xa93964], eax
call fcn.00404223
mov ecx, eax
mov dword [0xa9397c], 0x3f800000
mov dword [0xa93960], ecx
xor eax, eax
mov dword [ebp - 0xc4], ecx
lea ecx, [ebp - 0xc4]
push ecx
push 0x10
push eax
mov dword [0xa93968], eax
mov ecx, 0xa93968
mov dword [0xa93970], eax
mov dword [0xa9396c], eax
lea eax, [ebp - 0x174]
push eax
call fcn.00403f59
push 0x499ad7
mov dword [0xa93974], 7
mov dword [0xa93978], 8
call fcn.004838ff
pop ecx
xor eax, eax
xorps xmm0, xmm0
xor edi, edi
movdqu xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0xc], 0xc29000d4
inc edi
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], eax
jmp 0x469803
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x204], 0x13b91020
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4697f2
mov dword [ebp - 4], eax
jmp 0x46981f
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x220], 0x4dbf0cf
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x46980e
mov dword [ebp - 0xc], eax
jmp 0x4698b6
mov dword [ebp - 4], 0x62751c76
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], 0x65cd3860
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x91b0
mov dword [ebp - 0x14], eax
jmp 0x469861
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x22c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x469854
mov dword [ebp - 4], edi
cmp dword [ebp - 4], eax
jl 0x4698b3
mov dword [ebp - 0x18], 0xab59
mov dword [ebp - 0x18], 0x2a82a10a
mov dword [ebp - 0x14], eax
jmp 0x469893
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1dc], 0x4c38b6b0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x469882
inc dword [ebp - 0x1c]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4698ae
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor eax, eax
dec dword [ebp - 4]
jns 0x46986f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x46982d
lea eax, [ebp - 0x48]
push eax
call fcn.0046ab71
push 2
pop edx
mov esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x24], 0xab274bf9
mov dword [ebp - 0x18], 0x86bd085
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x1a35
mov dword [ebp - 0x30], 0x2a26f3f1
mov dword [ebp - 0x30], 0x41637c1d
mov dword [ebp - 0x30], 0xd70512a3
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], eax
jmp 0x469926
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x170], 0xbc0d133f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x469915
mov dword [ebp - 0x10], 0x14
jmp 0x46998f
mov dword [ebp - 0x20], 0x3250e6da
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x50315362
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 0x32a17d0b
mov dword [ebp - 0x20], 0xba13b288
mov dword [ebp - 4], eax
jmp 0x469968
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1c4], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x46995b
mov dword [ebp - 4], eax
jmp 0x469983
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x23c], 0xc4a87fce
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x469972
dec dword [ebp - 0x1c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jg 0x469934
mov dword [ebp - 0x10], 0xfffffff3
cmp dword [ebp - 0x10], 0xffffffe6
jne 0x469a15
mov dword [ebp - 0x1c], 0x426ae69e
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0xfffffff7
cmp dword [ebp - 0x24], eax
jne 0x469a12
cmp dword [ebp - 0x1c], eax
jne 0x4699d8
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
cmp edx, ecx
push 0
pop ecx
setne cl
mov dword [ebp - 0x20], ecx
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x4699da
mov ecx, edi
add ecx, 0xffff03ad
xor edx, edx
imul ecx, ecx, 5
push 0
cmp ecx, esi
mov ecx, dword [ebp - 0x18]
setle dl
cmp ecx, edx
pop ecx
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x16c]
cmp dword [ebp - 0x1c], ecx
setge dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
je 0x4699a2
mov esi, dword [ebp - 0x14]
cmp byte [ebp + 0xc], al
jne 0x469a22
test esi, esi
jne 0x469f92
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0xc], eax
jmp 0x469a3c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x2c], 0x976ff55e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x469a2e
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x469a6b
push 0x129a
push eax
push eax
push eax
push eax
push 0x950
push 0x1334
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
imul ecx, dword [ebp - 0x2c], 0xcf95
sub ecx, 0x306bcf95
je 0x469a81
mov esi, edi
cmp dword [ebp - 0x2c], eax
jne 0x469a83
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, esi
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x2c]
setle dl
mov dword [ebp - 0x18], edx
xor edx, edx
cmp ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
setle dl
sub esi, edx
neg esi
sbb esi, esi
inc esi
imul ecx, esi
imul ecx, ecx, 0xfbd3
test ecx, ecx
je 0x469b58
mov dword [ebp - 0xc], 0x6df7e441
mov dword [ebp - 4], eax
jmp 0x469ad6
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1bc], 0xf1bb1300
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x469ac5
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0xc], eax
je 0x469b49
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp ecx, 0x424
mov ecx, dword [ebp - 0x2c]
push 0
setg dl
mov dword [ebp - 0x18], edx
xor edx, edx
cmp ecx, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, 0xffffffff
mov edx, 0xffff
setge cl
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
sbb edx, edx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
pop edx
setl dl
sub edx, 0x645a1f4e
cmp edx, ecx
push 0
pop ecx
setle cl
xor edx, edx
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x18], ecx
setg dl
cmp edx, dword [ebp - 0x2c]
jle 0x469b49
cmp dword [ebp - 0x2c], eax
jne 0x469b4e
cmp dword [ebp - 0x2c], eax
je 0x469b50
mov eax, edi
mov dword [ebp - 0x1b8], eax
jmp 0x469b7b
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469b78
push 0x1577
push 0x6d0
push eax
push 0x2177
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
dec dword [ebp - 0x1c]
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x24c]
mov ecx, dword [ebp - 0x48]
push eax
call fcn.004447ee
mov esi, eax
lea edi, [ebp - 0x98]
pop ecx
mov eax, 0xb55bb2c2
push 0xfffffffffffffff7
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
pop edi
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
xor eax, eax
push 3
mov dword [ebp - 4], edi
pop edx
mov dword [ebp - 4], edx
cmp dword [ebp - 4], eax
jl 0x469c0b
mov dword [ebp - 0xc], 0xe1879501
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], eax
jl 0x469c06
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469bec
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469bfe
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
xor eax, eax
dec dword [ebp - 0xc]
jns 0x469bd9
push 3
pop edx
dec dword [ebp - 4]
jns 0x469bca
cmp byte [ebp + 0xc], 0
je 0x469f8c
cmp dword [ebp - 0x90], 0
je 0x469f8c
mov dword [ebp - 0x20], 0x8555145c
xor esi, esi
mov dword [ebp - 0x10], 0xdca27289
inc esi
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 4], eax
jmp 0x469c4d
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x3c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x469c3f
mov dword [ebp - 4], eax
jmp 0x469c68
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xf4], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x469c57
cmp dword [ebp - 0x3c], eax
jne 0x469c8b
cmp dword [ebp - 0x20], eax
jne 0x469c83
cmp dword [ebp - 0x10], eax
jne 0x469c83
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x469c85
mov ecx, esi
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, 0xffff3497
mov ecx, dword [ebp - 0x20]
setge dl
add ecx, edx
mov edx, 0xffff
cmp ecx, edx
sbb ecx, ecx
neg ecx
cmp ecx, 0xd1aa12af
ja 0x469d75
mov dword [ebp - 0x1c], 0x58d83f7c
mov dword [ebp - 4], eax
jmp 0x469ccf
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x5c], 0x122
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x469cc1
mov dword [ebp - 4], eax
jmp 0x469ce6
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x144], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x469cd9
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469d02
push 0x9b7
call dword [sym.imp.USER32.dll_GetQueueStatus]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
push 0
pop ecx
setle cl
push 0
lea edx, [ecx - 1]
mov ecx, dword [ebp - 0x3c]
cmp edx, ecx
mov ecx, dword [ebp - 0x5c]
pop edx
setne dl
cmp edx, ecx
push 0
pop edx
setl dl
mov dword [ebp - 0xec], edx
mov ecx, dword [ebp - 0x5c]
add ecx, edx
je 0x469d44
cmp dword [ebp - 0x3c], eax
jne 0x469d46
mov esi, eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, edx
push 0
pop ecx
setle cl
xor edx, edx
cmp ecx, esi
push 0
setge dl
sub edx, dword [ebp - 0x1c]
pop ecx
setns cl
xor esi, esi
mov dword [ebp - 0x140], ecx
inc esi
jmp 0x469d97
mov dword [ebp - 0x10], eax
jmp 0x469d91
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0xf4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xf4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x469d7a
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x469db0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
mov ecx, dword [ebp - 0x8c]
mov edi, dword [ebp + 8]
push 2
pop edx
mov dword [edi + 4], ecx
mov ecx, 0xad386cce
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0x10], 0x885dc1b6
mov dword [ebp - 4], 0x7d6b5922
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x469dff
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x13c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x469df2
mov dword [ebp - 0x10], eax
jmp 0x469e1a
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x114], 0xf06702e6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x469e09
mov dword [ebp - 0x10], eax
jmp 0x469e33
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x74], 0xd9140931
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x469e25
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jg 0x469f83
or edi, 0xffffffff
mov dword [ebp - 0xc], 0x83200138
mov dword [ebp - 0x18], 0x98a80146
mov dword [ebp - 0x18], 0x7f0936a
mov dword [ebp - 0xc], eax
jmp 0x469e74
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x78], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x469e6a
mov dword [ebp - 0x10], eax
jmp 0x469f52
mov dword [ebp - 0x20], 0xc8cbf698
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], eax
jmp 0x469ea1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xb0], 0x5fca
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x469e90
mov ecx, dword [ebp - 4]
cmp dword [ebp + ecx*4 - 0x110], eax
je 0x469f4a
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x110]
cmp ecx, dword [ebp - 0x138]
jge 0x469ed6
mov ecx, dword [ebp - 4]
mov edx, esi
cmp dword [ebp + ecx*4 - 0x110], eax
jne 0x469ed8
mov edx, eax
xor ecx, ecx
cmp edx, edi
push 0
setg cl
cmp edi, ecx
mov ecx, dword [ebp - 0x20]
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setg dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + ecx*4 - 0x110]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x5d2300b6
mov ecx, dword [ebp - 0x78]
setne dl
add esi, edx
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
cmp edx, 8
setle cl
lea edx, [ecx - 2]
mov ecx, dword [ebp - 0x78]
cmp edx, ecx
pop ecx
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xb0], ecx
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], ecx
setge dl
xor esi, esi
inc esi
mov ecx, esi
cmp edx, dword [ebp - 0x20]
jne 0x469f4c
mov ecx, eax
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x469e81
mov dword [ebp - 0xc], eax
jmp 0x469f6e
mov dword [ebp - 0x18], 9
dec dword [ebp - 0x74]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x469f61
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x469e50
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x90]
mov dword [edi + 8], ecx
mov esi, dword [ebp - 0x14]
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0xbb6748f6
mov dword [ebp - 0x18], 0x814b733c
mov dword [ebp - 0x18], 0x46b6eb6
mov dword [ebp - 0x1c], 0xb49d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
jmp 0x469fd4
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x160], 0xfffffffc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x469fc3
dec dword [ebp - 0x1c]
test esi, esi
jne 0x46a504
cmp dword [ebp - 0x98], esi
jle 0x46a504
mov dword [ebp - 0xc], 0xac204e2d
mov dword [ebp - 0x18], 0xe4438bea
mov dword [ebp - 0xc], eax
jmp 0x46a014
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x184], 0xfffffffd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46a003
mov dword [ebp - 0xc], 0xf
jmp 0x46a03f
mov dword [ebp - 0x18], 0x29bf3901
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x178], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x12
je 0x46a023
mov ecx, dword [ebp - 0x180]
or esi, 0xffffffff
mov dword [ebp - 0x178], ecx
mov ecx, 0x6ca2cb51
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x1c], 0x8fdadf86
mov dword [ebp - 0x30], esi
push 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
pop edx
jmp 0x46a097
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xa8], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x46a086
mov dword [ebp - 4], eax
jmp 0x46a0b2
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x150], 0x87e91c17
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x46a0a1
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x46a16d
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov esi, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xa4]
neg esi
cmp esi, ecx
setl dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x88]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x88]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x88]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x88]
mov dword [ebp - 0x30], edi
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x88]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x88]
cmp ecx, edi
setne dl
mov dword [ebp - 0x80], edx
lea ecx, [edx + 0xf8d3]
mov dword [ebp - 0x14c], ecx
dec dword [ebp - 0x10]
jns 0x46a0cd
push 2
pop edx
or esi, 0xffffffff
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x1c], 0x4f833fcb
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xfffffffd
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], eax
jmp 0x46a19a
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x50], 0x471dfd94
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x46a18c
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a1c5
push 0x63f
push 0x1497
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 2
xor eax, eax
pop edx
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x1c]
je 0x46a1fb
mov dword [ebp - 0x18], 0x6887
mov dword [ebp - 0xc], eax
jmp 0x46a1ea
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x25c], 0x210e164c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46a1d9
inc dword [ebp - 4]
inc dword [ebp - 0x50]
jmp 0x46a29a
mov dword [ebp - 4], eax
jmp 0x46a211
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x134], 0x11e0
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x46a200
mov dword [ebp - 4], eax
jmp 0x46a22d
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x15c], 0xa7ef23e4
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x46a21c
mov dword [ebp - 4], eax
jmp 0x46a295
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 0xc31e13ca
cmp dword [ebp - 4], eax
je 0x46a275
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 0x128]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x158], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x46a237
mov edi, dword [ebp - 0x94]
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0xc], eax
jmp 0x46a2ba
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x44], 0xd59e57ad
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x46a2ac
imul esi, dword [ebp - 0x40], 0x5a03
mov ecx, dword [ebp - 0x40]
push 0
dec esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [ebp - 0x44]
setle dl
add edx, ecx
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x40]
cmp ecx, edx
mov ecx, dword [ebp - 0x40]
pop edx
setne dl
cmp edx, ecx
push 0
pop ecx
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x18], ecx
push 0
setne dl
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x40]
imul edx, ecx
mov ecx, dword [ebp - 0x40]
cmp ecx, edx
pop ecx
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x18]
setle dl
mov dword [ebp - 0x40], edx
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a341
push 0x1184
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
test edi, edi
je 0x46a501
cmp dword [ebp - 0x30], 0
je 0x46a501
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0xc], 0xfffffff9
push 3
mov dword [ebp - 4], 0x1de9829c
mov dword [ebp - 0x14], eax
pop esi
jmp 0x46a388
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xd8], 0xbd42ca8c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x46a377
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
je 0x46a3a4
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xd4], 0x223f
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x79cc
je 0x46a3c5
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0xd4], eax
je 0x46a3dd
cmp dword [ebp - 0x10], eax
je 0x46a3dd
xor edx, edx
inc edx
jmp 0x46a3df
mov edx, eax
mov ecx, dword [ebp - 0x10]
imul ecx, edx
xor edx, edx
cmp ecx, 0x752
setne dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
jmp 0x46a499
mov dword [ebp - 0x1c], 0x71808adc
mov dword [ebp - 0xc], eax
jmp 0x46a473
mov dword [ebp - 0x14], eax
jmp 0x46a419
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1b0], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x46a40c
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a430
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov dword [ebp - 4], 0xa
jmp 0x46a46a
mov dword [ebp - 0x18], 0x77dfcc86
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1a8], 0xcbd4daed
mov ecx, dword [ebp - 0x18]
sub ecx, 0xb70d
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xd4], ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe6
jl 0x46a439
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jge 0x46a407
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x46a496
or edx, 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xd8], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x46a484
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x26
jne 0x46a3fb
mov ecx, edi
call fcn.00468f53
mov dword [ebp - 0xc], 0xe1757117
mov esi, eax
mov dword [ebp - 0x18], 0xe2c0d37a
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x46a4f0
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x46a4e7
push 0x119c
push 0
push 0xb3e
push 0x2066
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
jl 0x46a4c6
lea eax, [ebp - 0x48]
push eax
call fcn.0046ab71
mov dword [eax], esi
xor edi, edi
inc edi
mov dword [ebp - 0xc], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], 0xa4c8
mov dword [ebp - 0xc], 0xfffffffa
cmp dword [ebp - 0xc], 0x12
jl 0x46a69f
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0x1e1c5a3d
mov dword [ebp - 0x10], eax
jmp 0x46a54c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x168], 0x1188
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x46a53b
cmp dword [ebp - 0xc], eax
jne 0x46a563
cmp dword [ebp - 0x168], eax
jne 0x46a563
mov esi, eax
jmp 0x46a566
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
xor edx, edx
cmp ecx, 0x891c
setl dl
add edx, esi
je 0x46a58d
mov dword [ebp - 0x18], 0x32cf415d
cmp dword [ebp - 0x18], eax
jne 0x46a69f
jmp 0x46a692
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x46a5ad
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x214], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x46a5a0
mov ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp edx, ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x23a266d2
setl dl
imul ecx, edx, 0xb96
test ecx, ecx
je 0x46a610
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 4], 0xfffffff7
jmp 0x46a608
inc dword [ebp - 0x1c]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a605
push 0x1e3d
push eax
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jg 0x46a5e5
jmp 0x46a625
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a625
push 0x1c8d
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add ecx, 0xac1e
cmp ecx, eax
setl dl
xor eax, eax
add edx, 0xd2e9
cmp edx, 0x72d5
setl al
xor edx, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, 0x7d04
setl cl
xor eax, eax
cmp ecx, 0xfffffffd
setge al
imul eax, eax, 0x1c8
test eax, eax
je 0x46a688
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x46a68a
xor ecx, ecx
inc ecx
jmp 0x46a68c
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x214], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x12
jge 0x46a527
lea ecx, [ebp - 0x98]
call fcn.00445c79
mov dword [ebp - 4], 0xe0648261
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x87a5eafb
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0xfefb659b
mov dword [ebp - 0xc], eax
jmp 0x46a6da
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x58], 0x5e04a276
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x46a6cc
mov dword [ebp - 4], 0xffffffeb
jmp 0x46a818
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0x99da9727
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
sub edx, ecx
xor ecx, ecx
cmp edx, 0xa14c
setg cl
xor edx, edx
test ecx, ecx
mov ecx, dword [ebp - 0x18]
sets dl
add ecx, 4
add ecx, edx
je 0x46a720
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp edx, ecx
push 0
pop ecx
setg cl
xor edx, edx
cmp ecx, 4
mov ecx, dword [ebp - 0x10]
push 0
setle dl
cmp edx, ecx
pop ecx
setge cl
xor edx, edx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x18]
setge dl
cmp edx, dword [ebp - 0x10]
jge 0x46a768
cmp dword [ebp - 0xc], eax
je 0x46a768
xor ecx, ecx
inc ecx
jmp 0x46a76a
mov ecx, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x46a77b
cmp dword [ebp - 0x10], eax
jne 0x46a77b
mov edx, eax
jmp 0x46a77e
xor edx, edx
inc edx
or esi, 0xffffffff
mov dword [ebp - 0x58], edx
mov ecx, esi
sub ecx, edx
mov dword [ebp - 0xc], ecx
je 0x46a797
cmp dword [ebp - 0x58], eax
je 0x46a797
xor ecx, ecx
inc ecx
jmp 0x46a799
mov ecx, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x58], eax
je 0x46a7df
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a815
push eax
push 0xd2d
push 0x2052
push 0x167b
push 0x21e2
push 0x1e8a
push 0xf5e
push 0xac9
push 0x1cde
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
jmp 0x46a815
mov dword [ebp - 0x10], eax
jmp 0x46a80f
mov dword [ebp - 0xc], eax
jmp 0x46a7f6
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1ec], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46a7e9
mov ecx, dword [ebp - 0x1e4]
xor edx, edx
cmp ecx, esi
setl dl
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jle 0x46a7e4
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff2
jg 0x46a6ec
push 0x13
pop esi
mov dword [ebp - 4], esi
jmp 0x46a848
cmp dword [ebp - 0x20], eax
jne 0x46a84d
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a845
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x46a82a
cmp dword [ebp - 0x14], 0
je 0x46aa08
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 4], 0x55fd0a32
mov dword [ebp - 0x18], 0x94fe874d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x46a89c
or edx, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x38], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x46a88c
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], eax
jl 0x46a99c
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp + ecx*4 - 0xe8]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
cmp dword [ebp + ecx*4 - 0xe8], 5
je 0x46a97e
mov dword [ebp - 0xc], 0x1a80d1c1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a904
push 0x1d95
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
test ecx, ecx
sets dl
imul edx, dword [ebp - 0xc]
imul edx, dword [ebp - 4]
test edx, edx
jne 0x46a929
cmp dword [ebp - 0x120], eax
jne 0x46a929
mov edx, eax
jmp 0x46a92c
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x38]
add edx, 0xfffffff7
cmp edx, ecx
push 0
pop ecx
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], ecx
setne dl
sub edx, 0x1665
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
inc edx
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfd8b26de
setne cl
cmp ecx, dword [ebp - 0xc]
jge 0x46a977
cmp dword [ebp - 4], eax
je 0x46a977
xor ecx, ecx
inc ecx
jmp 0x46a979
mov ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x46a993
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x46a993
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x46a8ac
push dword [ebp - 0x34]
push dword [ebp - 0x14]
call fcn.00444703
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
pop ecx
mov dword [ebp + 8], edi
mov dword [esi], eax
xor eax, eax
pop ecx
mov dword [ebp + 8], eax
jmp 0x46a9c8
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0xcc], edi
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x46a9bb
mov dword [ebp + 8], eax
cmp dword [ebp + 8], eax
jl 0x46a9e6
mov ecx, dword [ebp + 8]
cmp dword [ebp + ecx*4 - 0xcc], eax
jne 0x46a9e6
dec dword [ebp + 8]
jns 0x46a9d5
mov dword [ebp + 8], eax
jmp 0x46a9f3
cmp dword [ebp + 8], eax
jne 0x46a9f9
dec dword [ebp + 8]
cmp dword [ebp + 8], 0xffffffe3
jl 0x46a9eb
lea eax, [ebp - 0x70]
push eax
call fcn.0046ab0f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x46aa0e
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp + 8], 0xfffffff6
mov dword [ebp + 8], eax
jmp 0x46aa26
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x64], edi
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x46aa1c
mov dword [ebp + 8], eax
jmp 0x46aa3f
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x54], 0x3c633843
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x46aa31
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x54], ecx
test ecx, ecx
je 0x46aa62
cmp dword [ebp - 0x64], eax
je 0x46aa56
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
mov dword [ebp + 8], 0xfffffffb
mov dword [ebp + 8], 0x10
jmp 0x46aa82
mov dword [ebp - 0x34], 0xcad
inc dword [ebp - 0x34]
dec dword [ebp + 8]
cmp dword [ebp + 8], 0xfffffff1
jge 0x46aa75
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], al
je 0x46aa98
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret