Function at 0x469f3b
Capabilities:
Accept command line arguments
Allocate thread local storage
Encrypt data using speck
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8757
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3c38
call fcn.004a7e90
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2684], 0xb0cb
mov dword [ebp - 0x23c0], 0
mov dword [ebp - 0x23a0], 0xed3
mov dword [ebp - 0x28a8], 0xa7a8
mov dword [ebp - 0xbbc], 0x131e34f9
mov dword [ebp - 0xd80], 1
mov dword [ebp - 0x2c], 0
jmp 0x469fb0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x469fc6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x39b0], 0x49cec79e
jmp 0x469fa9
mov dword [ebp - 0x2c], 0
jmp 0x469fd6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x469fec
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2f10], 0x628405ce
jmp 0x469fcf
mov dword [ebp - 0x2c], 0
jmp 0x469ffc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x46a012
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd78], 9
jmp 0x469ff5
mov dword [ebp - 0x2c], 0
jmp 0x46a022
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x46a038
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3a0c], 1
jmp 0x46a01b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f10]
inc eax
mov dword [ebp - 0x23c4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x23c4]
mov dword [ebp + eax - 0x2f10], ecx
mov eax, dword [ebp - 0x2684]
sub eax, dword [ebp - 0x23c4]
cmp eax, dword [ebp - 0x28a8]
jne 0x46a07f
mov dword [ebp - 0x23b0], 1
jmp 0x46a086
and dword [ebp - 0x23b0], 0
mov eax, dword [ebp - 0xbbc]
mov ecx, dword [ebp - 0xbbc]
dec ecx
mov dword [ebp - 0xbbc], ecx
test eax, eax
je 0x46a0bb
cmp dword [ebp - 0x23c0], 0
je 0x46a0bb
cmp dword [ebp - 0x23a0], 0
je 0x46a0bb
mov dword [ebp - 0x2378], 1
jmp 0x46a0c2
and dword [ebp - 0x2378], 0
mov eax, dword [ebp - 0xd80]
cmp dword [ebp - 0x2378], eax
jl 0x46a0f4
cmp dword [ebp - 0xd80], 0
je 0x46a0f4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x39b0], 0
je 0x46a0f4
mov dword [ebp - 0x2380], 1
jmp 0x46a0fb
and dword [ebp - 0x2380], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd78]
mov dword [ebp - 0x28b0], eax
mov eax, dword [ebp - 0x2380]
mov dword [ebp - 0x28b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd78]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd78], eax
mov eax, dword [ebp - 0x28b0]
cmp eax, dword [ebp - 0x28b8]
jg 0x46a14f
mov dword [ebp - 0x2388], 1
jmp 0x46a156
and dword [ebp - 0x2388], 0
cmp dword [ebp - 0x2388], 0xf3e4
jg 0x46a16e
mov dword [ebp - 0x2390], 1
jmp 0x46a175
and dword [ebp - 0x2390], 0
cmp dword [ebp - 0x2390], 0xffffffff
jne 0x46a18a
mov dword [ebp - 0x2398], 1
jmp 0x46a191
and dword [ebp - 0x2398], 0
mov eax, dword [ebp - 0xd80]
cmp dword [ebp - 0x2398], eax
jge 0x46a1ab
mov dword [ebp - 0x23a8], 1
jmp 0x46a1b2
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0x23a0]
sub eax, dword [ebp - 0x23a8]
imul eax, dword [ebp - 0x23b0]
cmp eax, 0xaa2a
jg 0x46a1d8
mov dword [ebp - 0xb50], 1
jmp 0x46a1df
and dword [ebp - 0xb50], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb50]
mov dword [ebp + eax - 0x3a0c], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb50]
mov dword [ebp + eax - 0x39b0], ecx
cmp dword [ebp - 0xb50], 0xffffffff
jbe 0x46a218
mov dword [ebp - 0x23b8], 1
jmp 0x46a21f
and dword [ebp - 0x23b8], 0
mov eax, dword [ebp - 0x23b8]
mov dword [ebp - 0x23c0], eax
push 3
lea ecx, [ebp - 0x708]
call fcn.00430073
push 2
lea ecx, [ebp - 0x58c]
call fcn.00430073
mov dword [ebp - 0x488], 0xfffffffd
mov dword [ebp - 0x14c], 0
jmp 0x46a268
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x46a28a
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov dword [eax], 1
jmp 0x46a25b
mov dword [ebp - 0x14c], 0
jmp 0x46a2a3
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x46a2c5
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x58c]
call fcn.00430161
mov dword [eax], 0xfe7d8a87
jmp 0x46a296
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
mov dword [eax], 2
jmp 0x46a2fe
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
mov dword [ebp - 0x23c8], eax
mov eax, dword [ebp - 0x23c8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x23c8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
cmp dword [eax], 0
jl 0x46a96f
push 1
lea ecx, [ebp - 0xb60]
call fcn.00430073
mov dword [ebp - 0x13c], 0x60cbeb96
mov dword [ebp - 0x2438], 0x85b5f732
mov dword [ebp - 0x950], 0
jmp 0x46a34e
mov eax, dword [ebp - 0x950]
inc eax
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x950], 1
jge 0x46a370
push dword [ebp - 0x950]
lea ecx, [ebp - 0xb60]
call fcn.00430161
mov dword [eax], 0x73ff82ff
jmp 0x46a341
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
mov dword [eax], 2
jmp 0x46a3a9
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
mov dword [ebp - 0x23d0], eax
mov eax, dword [ebp - 0x23d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x23d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
cmp dword [eax], 0
jl 0x46a8e9
push 1
lea ecx, [ebp - 0x31bc]
call fcn.00430073
mov dword [ebp - 0x724], 0
jmp 0x46a3e5
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 1
jge 0x46a404
push dword [ebp - 0x724]
lea ecx, [ebp - 0x31bc]
call fcn.00430161
and dword [eax], 0
jmp 0x46a3d8
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov esi, eax
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x46a44c
mov dword [ebp - 0x23d8], 1
jmp 0x46a453
and dword [ebp - 0x23d8], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
imul eax, dword [eax], 3
cmp eax, dword [ebp - 0x23d8]
jge 0x46a484
mov dword [ebp - 0x28c0], 1
jmp 0x46a48b
and dword [ebp - 0x28c0], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x35b8], eax
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
cmp dword [ebp - 0x13c], 0
je 0x46a4e9
mov byte [ebp - 0x443], 0
movzx eax, byte [ebp - 0x443]
test eax, eax
je 0x46a4da
push 0
push 0x1713
push 0x10b5
push 0x24c6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x488], 1
jmp 0x46a59e
mov byte [ebp - 0x480], 0
movzx eax, byte [ebp - 0x480]
test eax, eax
je 0x46a50d
push 0x158
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x13c], 2
jmp 0x46a526
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x46a59e
mov dword [ebp - 0x488], 0
jmp 0x46a548
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 2
jg 0x46a585
mov byte [ebp - 0x291], 0
movzx eax, byte [ebp - 0x291]
test eax, eax
je 0x46a583
push 0
push 0x2382
push 0x19c4
push 0
push 0x3ed
push 0x2692
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x46a53b
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
cmp dword [eax], 0
je 0x46a599
jmp 0x46a519
jmp 0x46a519
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
push 2
lea ecx, [ebp - 0x708]
call fcn.00430161
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
cmp dword [eax], 0xee6ee3e4
jbe 0x46a5f3
mov dword [ebp - 0x23e0], 1
jmp 0x46a5fa
and dword [ebp - 0x23e0], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [ebp - 0x23e0]
sub ecx, dword [eax]
je 0x46a638
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov esi, dword [ebp - 0x13c]
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
cmp esi, dword [eax]
jg 0x46a65b
mov dword [ebp - 0x23e8], 1
jmp 0x46a662
and dword [ebp - 0x23e8], 0
mov esi, dword [ebp - 0x23e8]
sub esi, 0x76419819
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
cmp esi, dword [eax]
jge 0x46a68b
mov dword [ebp - 0x23f0], 1
jmp 0x46a692
and dword [ebp - 0x23f0], 0
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
mov esi, eax
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
mov ecx, dword [ebp - 0x23f0]
imul ecx, dword [eax]
sub ecx, 0xfff6
cmp dword [esi], ecx
jle 0x46a6cd
mov dword [ebp - 0x23f8], 1
jmp 0x46a6d4
and dword [ebp - 0x23f8], 0
cmp dword [ebp - 0x23f8], 0x5fcb4448
jg 0x46a6ec
mov dword [ebp - 0x2400], 1
jmp 0x46a6f3
and dword [ebp - 0x2400], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [ebp - 0x2400]
cmp ecx, dword [eax]
jle 0x46a723
mov dword [ebp - 0x2408], 1
jmp 0x46a72a
and dword [ebp - 0x2408], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [ebp - 0x2408]
add ecx, dword [eax]
jne 0x46a75a
mov dword [ebp - 0x2410], 1
jmp 0x46a761
and dword [ebp - 0x2410], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [ebp - 0x2410]
cmp ecx, dword [eax]
jle 0x46a791
mov dword [ebp - 0x2418], 1
jmp 0x46a798
and dword [ebp - 0x2418], 0
mov eax, dword [ebp - 0x2418]
mov dword [ebp - 0x13c], eax
mov eax, 0x7078
test eax, eax
je 0x46a7d8
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
cmp dword [eax], 0
je 0x46a7d8
mov dword [ebp - 0x2420], 1
jmp 0x46a7df
and dword [ebp - 0x2420], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [ebp - 0x2420]
cmp ecx, dword [eax]
jl 0x46a80f
mov dword [ebp - 0x2428], 1
jmp 0x46a816
and dword [ebp - 0x2428], 0
cmp dword [ebp - 0x2428], 0
je 0x46a834
mov eax, 0xefc6e20b
test eax, eax
je 0x46a834
mov dword [ebp - 0x2430], 1
jmp 0x46a83b
and dword [ebp - 0x2430], 0
push 1
lea ecx, [ebp - 0x58c]
call fcn.00430161
mov ecx, dword [ebp - 0x2430]
sub ecx, dword [eax]
sub ecx, 0x6d9598de
mov dword [ebp - 0x2438], ecx
mov esi, dword [ebp - 0x2438]
push 0
lea ecx, [ebp - 0xb60]
call fcn.00430161
cmp esi, dword [eax]
jge 0x46a886
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46a886
mov dword [ebp - 0x2440], 1
jmp 0x46a88d
and dword [ebp - 0x2440], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
mov ecx, dword [ebp - 0x2440]
cmp ecx, dword [eax]
jne 0x46a8bd
mov dword [ebp - 0x2448], 1
jmp 0x46a8c4
and dword [ebp - 0x2448], 0
push 0
lea ecx, [ebp - 0x31bc]
call fcn.00430161
mov ecx, dword [ebp - 0x2448]
mov dword [eax], ecx
lea ecx, [ebp - 0x31bc]
call fcn.00430145
jmp 0x46a385
push 0
lea ecx, [ebp - 0x58c]
call fcn.00430161
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.00430161
cmp dword [eax], 1
je 0x46a914
mov dword [ebp - 0x2450], 1
jmp 0x46a91b
and dword [ebp - 0x2450], 0
push 1
lea ecx, [ebp - 0x58c]
call fcn.00430161
cmp dword [eax], 0
jne 0x46a93f
cmp dword [ebp - 0x488], 0
jg 0x46a93f
and dword [ebp - 0x2458], 0
jmp 0x46a949
mov dword [ebp - 0x2458], 1
mov eax, dword [ebp - 0x2450]
imul eax, dword [ebp - 0x2458]
imul eax, eax, 0xfffffff7
mov dword [ebp - 0x13c], eax
lea ecx, [ebp - 0xb60]
call fcn.00430145
jmp 0x46a2da
lea ecx, [ebp - 0x58c]
call fcn.00430145
lea ecx, [ebp - 0x708]
call fcn.00430145
mov dword [ebp - 0x2b20], 0xb0cb
mov dword [ebp - 0x1e20], 0
push 3
lea ecx, [ebp - 0x251c]
call fcn.00430073
mov dword [ebp - 0x2498], 0xfffffffe
push 2
lea ecx, [ebp - 0x2624]
call fcn.00430073
mov dword [ebp - 0x60c], 0xff54
mov dword [ebp - 0x6c], 0
jmp 0x46a9d7
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x46a9ed
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x3a84], 0xfffffffd
jmp 0x46a9d0
mov dword [ebp - 0x6c], 0
jmp 0x46a9fd
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x46aa19
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x251c]
call fcn.00430161
mov dword [eax], 0x9dada439
jmp 0x46a9f6
mov dword [ebp - 0x6c], 0
jmp 0x46aa29
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x46aa45
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x2624]
call fcn.00430161
mov dword [eax], 0xfffffff6
jmp 0x46aa22
push 1
lea ecx, [ebp - 0x251c]
call fcn.00430161
and dword [eax], 0
jmp 0x46aa7b
push 1
lea ecx, [ebp - 0x251c]
call fcn.00430161
mov dword [ebp - 0x2460], eax
mov eax, dword [ebp - 0x2460]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2460]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x251c]
call fcn.00430161
cmp dword [eax], 2
jg 0x46ad6b
mov dword [ebp - 0x490], 0x4cdb8faa
mov dword [ebp - 0x28d8], 0xaa32f3f6
mov dword [ebp - 0x28e8], 0x710dd013
mov dword [ebp - 0x34a8], 0xfffffffa
mov dword [ebp - 0x2680], 0
mov dword [ebp - 0x267c], 0
mov dword [ebp - 0x2678], 0
mov dword [ebp - 0x2674], 0
mov dword [ebp - 0x490], 2
jmp 0x46aafa
mov eax, dword [ebp - 0x490]
dec eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
jl 0x46ab26
mov byte [ebp - 0x482], 0
movzx eax, byte [ebp - 0x482]
test eax, eax
je 0x46ab24
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x46aaed
push 1
lea ecx, [ebp - 0x251c]
call fcn.00430161
mov eax, dword [eax]
sub eax, dword [ebp - 0x490]
cmp eax, 0xa906
jge 0x46ab4e
mov dword [ebp - 0x2488], 1
jmp 0x46ab55
and dword [ebp - 0x2488], 0
mov eax, dword [ebp - 0x60c]
mov ecx, dword [ebp - 0x60c]
dec ecx
mov dword [ebp - 0x60c], ecx
test eax, eax
jne 0x46acda
push 1
lea ecx, [ebp - 0x251c]
call fcn.00430161
mov ecx, dword [ebp - 0x60c]
cmp dword [eax], ecx
je 0x46ab93
mov dword [ebp - 0x2468], 1
jmp 0x46ab9a
and dword [ebp - 0x2468], 0
cmp dword [ebp - 0x2468], 1
je 0x46abaf
mov dword [ebp - 0x28c8], 1
jmp 0x46abb6
and dword [ebp - 0x28c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2680]
mov dword [ebp - 0x38b8], eax
push 1
lea ecx, [ebp - 0x2624]
call fcn.00430161
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x2680]
cmp dword [eax], ecx
je 0x46abf1
mov dword [ebp - 0x2470], 1
jmp 0x46abf8
and dword [ebp - 0x2470], 0
push 1
lea ecx, [ebp - 0x2624]
call fcn.00430161
mov ecx, dword [ebp - 0x2470]
cmp ecx, dword [eax]
jl 0x46ac1b
mov dword [ebp - 0x28d0], 1
jmp 0x46ac22
and dword [ebp - 0x28d0], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x34b0], eax
mov eax, dword [ebp - 0x2498]
mov dword [ebp - 0x372c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2680]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x2680]
cmp eax, 0xde90
jle 0x46ac65
mov dword [ebp - 0x2478], 1
jmp 0x46ac6c
and dword [ebp - 0x2478], 0
mov eax, dword [ebp - 0x28d8]
cmp dword [ebp - 0x2478], eax
je 0x46ac86
mov dword [ebp - 0x2480], 1
jmp 0x46ac8d
and dword [ebp - 0x2480], 0
cmp dword [ebp - 0x2480], 0x97e65fb
jle 0x46aca5
mov dword [ebp - 0x28e0], 1
jmp 0x46acac
and dword [ebp - 0x28e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a84]
mov dword [ebp - 0x34b8], eax
push 1
lea ecx, [ebp - 0x2624]
call fcn.00430161
cmp dword [eax], 0
jne 0x46acda
and dword [ebp - 0x2490], 0
jmp 0x46ace4
mov dword [ebp - 0x2490], 1
mov eax, dword [ebp - 0x2488]
imul eax, dword [ebp - 0x2490]
sub eax, dword [ebp - 0x2498]
cmp eax, 0x5188
jge 0x46ad19
mov eax, 0x4914
test eax, eax
jne 0x46ad19
cmp dword [ebp - 0x60c], 0
jne 0x46ad19
and dword [ebp - 0x24a0], 0
jmp 0x46ad23
mov dword [ebp - 0x24a0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2680]
cmp dword [ebp - 0x24a0], eax
jge 0x46ad44
mov dword [ebp - 0x24a8], 1
jmp 0x46ad4b
and dword [ebp - 0x24a8], 0
push 1
lea ecx, [ebp - 0x2624]
call fcn.00430161
mov ecx, dword [ebp - 0x24a8]
sub ecx, dword [eax]
mov dword [ebp - 0x28e8], ecx
jmp 0x46aa57
lea ecx, [ebp - 0x2624]
call fcn.00430145
lea ecx, [ebp - 0x251c]
call fcn.00430145
mov dword [ebp - 0x1e10], 0xed3
mov dword [ebp - 0x74], 0xf55e00fe
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x220], 0
jmp 0x46adb5
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x46add1
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x2e48], 0x39b6
jmp 0x46ada8
mov dword [ebp - 0x220], 0
jmp 0x46adea
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x46ae06
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xc4], 0xd837bc75
jmp 0x46addd
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x2e48]
mov dword [ebp + ecx - 0xc4], eax
mov dword [ebp - 0x74], 0
jmp 0x46ae30
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x46b2b8
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xc4], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0xc4]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x46aec2
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0xc4]
mov dword [ebp - 0x3970], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0xc4]
cmp dword [ebp - 0x74], eax
jne 0x46ae8c
mov dword [ebp - 0x24b0], 1
jmp 0x46ae93
and dword [ebp - 0x24b0], 0
mov eax, dword [ebp - 0x24b0]
mov dword [ebp - 0x8c], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46aec2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc4], 0
je 0x46aec2
mov dword [ebp - 0x24b8], 1
jmp 0x46aec9
and dword [ebp - 0x24b8], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0xc4]
cmp dword [ebp - 0x24b8], eax
jge 0x46aee7
mov dword [ebp - 0x24c0], 1
jmp 0x46aeee
and dword [ebp - 0x24c0], 0
cmp dword [ebp - 0x24c0], 0xfffe
jae 0x46af06
mov dword [ebp - 0x1ca8], 1
jmp 0x46af0d
and dword [ebp - 0x1ca8], 0
cmp dword [ebp - 0x1ca8], 1
jg 0x46af22
mov dword [ebp - 0x28f0], 1
jmp 0x46af29
and dword [ebp - 0x28f0], 0
xor eax, eax
inc eax
je 0x46af43
mov eax, 0xb667f5ae
test eax, eax
je 0x46af43
mov dword [ebp - 0x28f8], 1
jmp 0x46af4a
and dword [ebp - 0x28f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e48]
mov dword [ebp - 0x34c0], eax
xor eax, eax
inc eax
je 0x46b105
mov dword [ebp - 0x1cb0], 0xfffffffb
mov dword [ebp - 0x2a90], 5
mov dword [ebp - 0x8c], 0
jmp 0x46af93
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x46b100
mov dword [ebp - 0x2b4], 8
mov dword [ebp - 0x2b4], 0
jmp 0x46afc3
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jg 0x46b0fb
cmp dword [ebp - 0x1cb0], 0
jne 0x46afe6
xor eax, eax
jne 0x46afe6
and dword [ebp - 0xe90], 0
jmp 0x46aff0
mov dword [ebp - 0xe90], 1
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0xc4]
cmp eax, dword [ebp - 0xe90]
jge 0x46b011
mov dword [ebp - 0x2900], 1
jmp 0x46b018
and dword [ebp - 0x2900], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x373c], eax
mov eax, dword [ebp - 0x1cb0]
mov dword [ebp - 0x34c8], eax
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0xc4], 0
je 0x46b052
cmp dword [ebp - 0x2b4], 0
je 0x46b052
mov dword [ebp - 0xd88], 1
jmp 0x46b059
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xd88]
mov dword [ebp + eax*4 - 0xc4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2e48]
cmp dword [ebp - 0xd88], eax
jl 0x46b08a
mov dword [ebp - 0xe98], 1
jmp 0x46b091
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0x2e48]
cmp eax, dword [ebp - 0xe98]
je 0x46b0b2
mov dword [ebp - 0x1cb8], 1
jmp 0x46b0b9
and dword [ebp - 0x1cb8], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x1cb8], eax
jne 0x46b0e3
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0xc4], 0
je 0x46b0e3
mov dword [ebp - 0xea0], 1
jmp 0x46b0ea
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x2a90], eax
jmp 0x46afb6
jmp 0x46af86
jmp 0x46b2b3
mov dword [ebp - 0x608], 0
mov dword [ebp - 0x8c], 0xffffffef
jmp 0x46b128
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffff1
jge 0x46b2b3
mov dword [ebp - 0x2a98], 0x63b8
mov dword [ebp - 0xeb8], 5
mov dword [ebp - 0x1cc8], 0xb2c22b60
mov dword [ebp - 0x2aa8], 0x11abd849
mov dword [ebp - 0x2ab0], 0
mov eax, dword [ebp - 0x2a98]
mov dword [ebp - 0x38c0], eax
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp + eax*4 - 0xc4], 0x6ed4
cmp dword [ebp - 0x608], eax
jl 0x46b195
mov dword [ebp - 0x1cc0], 1
jmp 0x46b19c
and dword [ebp - 0x1cc0], 0
cmp dword [ebp - 0x1cc0], 0xf109
jg 0x46b1bd
cmp dword [ebp - 0xeb8], 0
je 0x46b1bd
mov dword [ebp - 0x2aa0], 1
jmp 0x46b1c4
and dword [ebp - 0x2aa0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0xc4], 0x983a5c25
ja 0x46b1e0
mov dword [ebp - 0xea8], 1
jmp 0x46b1e7
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0xea8]
mov dword [ebp - 0x1cc8], eax
mov eax, dword [ebp - 0x2aa8]
cmp dword [ebp - 0x1cc8], eax
jge 0x46b20d
mov dword [ebp - 0xeb0], 1
jmp 0x46b214
and dword [ebp - 0xeb0], 0
cmp dword [ebp - 0xeb0], 0xe151
jl 0x46b22c
mov dword [ebp - 0x1cd0], 1
jmp 0x46b233
and dword [ebp - 0x1cd0], 0
mov eax, dword [ebp - 0x1cd0]
sub eax, dword [ebp - 0xeb8]
cmp eax, 6
jne 0x46b250
mov dword [ebp - 0x1cd8], 1
jmp 0x46b257
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x1cd8]
mov dword [ebp - 0x2ab0], eax
mov dword [ebp - 0x608], 0xc
jmp 0x46b27c
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0x23
jg 0x46b2ae
mov byte [ebp - 0x293], 0
movzx eax, byte [ebp - 0x293]
test eax, eax
je 0x46b2ac
push 0
push 0
push 0x158
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x46b26f
jmp 0x46b11b
jmp 0x46ae29
mov dword [ebp - 0x2b28], 0xa7a8
push 2
lea ecx, [ebp - 0xdfc]
call fcn.00430073
mov dword [ebp - 0x12c], 0xd69f4288
mov dword [ebp - 0x958], 0
jmp 0x46b2f2
mov eax, dword [ebp - 0x958]
inc eax
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x958], 2
jge 0x46b314
push dword [ebp - 0x958]
lea ecx, [ebp - 0xdfc]
call fcn.00430161
mov dword [eax], 0x53d06ce1
jmp 0x46b2e5
mov dword [ebp - 0x12c], 1
jmp 0x46b32d
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x46b6d0
mov dword [ebp - 0x154], 0
jmp 0x46b353
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x46b36f
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x1cf8], 0x168aa2d3
jmp 0x46b346
mov dword [ebp - 0x154], 0
jmp 0x46b388
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x46b3a4
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x2e60], 0xa44198d7
jmp 0x46b37b
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xdfc]
call fcn.00430161
cmp dword [eax], 0
jne 0x46b3d9
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xdfc]
call fcn.00430161
mov eax, dword [eax]
dec eax
jne 0x46b3d9
and dword [ebp - 0xec8], 0
jmp 0x46b3e3
mov dword [ebp - 0xec8], 1
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x34d0], eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xdfc]
call fcn.00430161
cmp dword [eax], 0
je 0x46b41a
mov eax, 0xbc99
test eax, eax
je 0x46b41a
mov dword [ebp - 0xec0], 1
jmp 0x46b421
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xec0], eax
je 0x46b43b
mov dword [ebp - 0x1ce0], 1
jmp 0x46b442
and dword [ebp - 0x1ce0], 0
cmp dword [ebp - 0x1ce0], 1
jb 0x46b457
mov dword [ebp - 0x1ce8], 1
jmp 0x46b45e
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0xec8]
add eax, dword [ebp - 0x1ce8]
je 0x46b48a
push 1
lea ecx, [ebp - 0xdfc]
call fcn.00430161
cmp dword [eax], 0
je 0x46b48a
mov dword [ebp - 0xed0], 1
jmp 0x46b491
and dword [ebp - 0xed0], 0
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xdfc]
call fcn.00430161
mov ecx, dword [ebp - 0xed0]
cmp ecx, dword [eax]
jl 0x46b4b8
mov dword [ebp - 0x1cf0], 1
jmp 0x46b4bf
and dword [ebp - 0x1cf0], 0
cmp dword [ebp - 0x1cf0], 0xffffffff
jge 0x46b4d4
mov dword [ebp - 0xed8], 1
jmp 0x46b4db
and dword [ebp - 0xed8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xed8]
mov dword [ebp + eax - 0x1cf8], ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e60], 0
jmp 0x46b51c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e60]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e60], 1
jg 0x46b6cb
mov dword [ebp - 0x510], 0x150faeb3
mov byte [ebp - 0x463], 0
movzx eax, byte [ebp - 0x463]
test eax, eax
je 0x46b559
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0x510], 0
jmp 0x46b572
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 1
jg 0x46b6c6
mov dword [ebp - 0x2bc], 1
mov dword [ebp - 0x2bc], 0
jmp 0x46b5a2
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jg 0x46b6c1
mov dword [ebp - 0x1d00], 1
mov dword [ebp - 0x2ac0], 0x323fa9df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cf8], 0
je 0x46b6a9
push 0
lea ecx, [ebp - 0xdfc]
call fcn.00430161
cmp dword [ebp - 0x2bc], 0
je 0x46b60b
cmp dword [ebp - 0x2bc], 0
je 0x46b60b
mov eax, 0x2ae4
test eax, eax
je 0x46b60b
mov dword [ebp - 0xee0], 1
jmp 0x46b612
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0xee0]
mov dword [ebp - 0x1d00], eax
mov esi, dword [ebp - 0x1d00]
push 1
lea ecx, [ebp - 0xdfc]
call fcn.00430161
cmp esi, dword [eax]
jge 0x46b641
mov dword [ebp - 0xee8], 1
jmp 0x46b648
and dword [ebp - 0xee8], 0
cmp dword [ebp - 0xee8], 0xbe2d3d47
je 0x46b660
mov dword [ebp - 0x1d08], 1
jmp 0x46b667
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x1d08], eax
jg 0x46b681
mov dword [ebp - 0x2ab8], 1
jmp 0x46b688
and dword [ebp - 0x2ab8], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x374c], eax
cmp dword [ebp - 0x2bc], 0
je 0x46b6a9
mov dword [ebp - 0xef0], 1
jmp 0x46b6b0
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0xef0]
mov dword [ebp - 0x2ac0], eax
jmp 0x46b595
jmp 0x46b565
jmp 0x46b501
jmp 0x46b320
mov byte [ebp - 0x295], 0
movzx eax, byte [ebp - 0x295]
test eax, eax
je 0x46b702
push 0
push 0xd6f
push 0x9f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
lea ecx, [ebp - 0xdfc]
call fcn.00430145
mov dword [ebp - 0x670], 0x53b26bdd
mov dword [ebp - 0x670], 0xffffffea
jmp 0x46b730
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 1
jne 0x46b764
mov byte [ebp - 0x445], 0
movzx eax, byte [ebp - 0x445]
test eax, eax
je 0x46b757
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
cmp dword [ebp - 0x670], 0
je 0x46b762
jmp 0x46b764
jmp 0x46b723
mov dword [ebp - 0xd20], 0x131e34f9
mov dword [ebp - 0xf10], 0x9bf9f361
mov dword [ebp - 0x498], 0xf703c576
mov dword [ebp - 0x2c4], 0xb56cef3
mov dword [ebp - 0xd98], 0xfffffff7
mov dword [ebp - 0xd90], 8
mov dword [ebp - 0x2ad0], 0xbecc33b
mov dword [ebp - 0x2ad8], 0x660b2563
cmp dword [ebp - 0x498], 0xfffffff6
jle 0x46b7c9
mov dword [ebp - 0x1d18], 1
jmp 0x46b7d0
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x1d18]
jl 0x46b7ea
mov dword [ebp - 0xef8], 1
jmp 0x46b7f1
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xef8]
add eax, 0x5184e4f4
je 0x46b813
cmp dword [ebp - 0x498], 0
je 0x46b813
mov dword [ebp - 0x1d20], 1
jmp 0x46b81a
and dword [ebp - 0x1d20], 0
mov eax, dword [ebp - 0x1d20]
dec eax
cmp eax, 0xffff
jbe 0x46b834
mov dword [ebp - 0xf00], 1
jmp 0x46b83b
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0xf00], eax
jne 0x46b855
mov dword [ebp - 0x1d28], 1
jmp 0x46b85c
and dword [ebp - 0x1d28], 0
mov eax, dword [ebp - 0x1d28]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x34d8], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x3948], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x34e0], eax
cmp dword [ebp - 0xd98], 0x92079655
jae 0x46b8a4
mov dword [ebp - 0x2ac8], 1
jmp 0x46b8ab
and dword [ebp - 0x2ac8], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x375c], eax
cmp dword [ebp - 0x2c4], 0xffff
jbe 0x46b8cf
mov dword [ebp - 0xf08], 1
jmp 0x46b8d6
and dword [ebp - 0xf08], 0
mov eax, dword [ebp - 0xd90]
cmp dword [ebp - 0xf08], eax
jl 0x46b8f0
mov dword [ebp - 0x1d30], 1
jmp 0x46b8f7
and dword [ebp - 0x1d30], 0
mov dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0xd90]
add eax, dword [ebp - 0x1d30]
cmp dword [ebp - 0xf10], eax
je 0x46b921
mov dword [ebp - 0x1d38], 1
jmp 0x46b928
and dword [ebp - 0x1d38], 0
mov eax, dword [ebp - 0xd98]
cmp dword [ebp - 0x1d38], eax
je 0x46b942
mov dword [ebp - 0xf18], 1
jmp 0x46b949
and dword [ebp - 0xf18], 0
mov eax, dword [ebp - 0xd90]
cmp dword [ebp - 0xf18], eax
jle 0x46b963
mov dword [ebp - 0x1d40], 1
jmp 0x46b96a
and dword [ebp - 0x1d40], 0
imul eax, dword [ebp - 0x1d40], 0x6cde
cmp eax, dword [ebp - 0x2c4]
jg 0x46b98e
cmp dword [ebp - 0xd98], 0
jne 0x46b98e
and dword [ebp - 0xf20], 0
jmp 0x46b998
mov dword [ebp - 0xf20], 1
mov eax, dword [ebp - 0xf20]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2ad0]
cmp dword [ebp - 0x2c4], eax
jg 0x46b9be
mov dword [ebp - 0x1d48], 1
jmp 0x46b9c5
and dword [ebp - 0x1d48], 0
mov eax, dword [ebp - 0x1d48]
mov dword [ebp - 0x2ad8], eax
mov byte [ebp - 0x297], 0
movzx eax, byte [ebp - 0x297]
test eax, eax
je 0x46b9e9
call dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0xce4], 1
mov dword [ebp - 0x54], 0x99cfe04
mov dword [ebp - 0x234], 0x4bc662a2
push 3
lea ecx, [ebp - 0x2e78]
call fcn.00430073
mov dword [ebp - 0xda8], 3
mov dword [ebp - 0xd64], 0x7a772be7
mov dword [ebp - 0x72c], 0
jmp 0x46ba3e
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 3
jge 0x46ba60
push dword [ebp - 0x72c]
lea ecx, [ebp - 0x2e78]
call fcn.00430161
mov dword [eax], 0x3740
jmp 0x46ba31
cmp dword [ebp - 0x54], 0x2b165808
je 0x46ba75
mov dword [ebp - 0xf28], 1
jmp 0x46ba7c
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xf28], eax
jl 0x46ba93
mov dword [ebp - 0x1d50], 1
jmp 0x46ba9a
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0x1d50]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x234], 9
jmp 0x46bac2
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x11
jge 0x46c006
mov dword [ebp - 0x2cc], 0x3d3b
mov dword [ebp - 0x2d4], 0x22d5fba2
mov dword [ebp - 0xbc4], 0x6eb3e198
mov dword [ebp - 0xf60], 7
mov dword [ebp - 0x2ae0], 0x5309f33d
mov dword [ebp - 0x1db8], 0xecbc59a6
mov dword [ebp - 0x54], 0
jmp 0x46bb1b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x46bcad
mov dword [ebp - 0x960], 0
jmp 0x46bb3e
mov eax, dword [ebp - 0x960]
inc eax
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x960], 1
jge 0x46bb5a
mov eax, dword [ebp - 0x960]
mov dword [ebp + eax*4 - 0xda0], 0xfffffffa
jmp 0x46bb31
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xda0]
mov dword [ebp - 0x34e8], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x38c8], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x34f0], eax
mov eax, dword [ebp - 0x2cc]
sub eax, dword [ebp - 0x2cc]
cmp eax, 0xf7d9
jle 0x46bba4
mov dword [ebp - 0xf30], 1
jmp 0x46bbab
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xf30], eax
jg 0x46bbc2
mov dword [ebp - 0x1d58], 1
jmp 0x46bbc9
and dword [ebp - 0x1d58], 0
cmp dword [ebp - 0x1d58], 0x84e
je 0x46bbe1
mov dword [ebp - 0xf38], 1
jmp 0x46bbe8
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0xf38], eax
je 0x46bc02
mov dword [ebp - 0x1d60], 1
jmp 0x46bc09
and dword [ebp - 0x1d60], 0
cmp dword [ebp - 0x1d60], 3
jne 0x46bc1e
mov dword [ebp - 0xf40], 1
jmp 0x46bc25
and dword [ebp - 0xf40], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xda0]
cmp eax, dword [ebp - 0xf40]
jle 0x46bc46
mov dword [ebp - 0x1d68], 1
jmp 0x46bc4d
and dword [ebp - 0x1d68], 0
mov eax, dword [ebp - 0x2cc]
add eax, dword [ebp - 0x1d68]
cmp eax, dword [ebp - 0x2d4]
jl 0x46bc6d
mov dword [ebp - 0xf48], 1
jmp 0x46bc74
and dword [ebp - 0xf48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xda0]
cmp eax, dword [ebp - 0xf48]
jg 0x46bc95
mov dword [ebp - 0x1d70], 1
jmp 0x46bc9c
and dword [ebp - 0x1d70], 0
mov eax, dword [ebp - 0x1d70]
mov dword [ebp - 0xda8], eax
jmp 0x46bb14
mov dword [ebp - 0x54], 0xa
jmp 0x46bcbd
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 7
jg 0x46c001
mov dword [ebp - 0xf50], 1
mov dword [ebp - 0x1db0], 0xbcb8161d
mov dword [ebp - 0xf90], 0
mov dword [ebp - 0x2ae8], 1
mov dword [ebp - 0x734], 0
jmp 0x46bd08
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 2
jge 0x46bd24
mov eax, dword [ebp - 0x734]
mov dword [ebp + eax*4 - 0x2570], 0xfffffff8
jmp 0x46bcfb
push 1
lea ecx, [ebp - 0x2e78]
call fcn.00430161
mov eax, dword [eax]
mov dword [ebp - 0xd64], eax
imul eax, dword [ebp - 0xd64], 0xc7b
mov dword [ebp - 0xf50], eax
cmp dword [ebp - 0xf50], 0
je 0x46bd65
push 4
pop eax
test eax, eax
je 0x46bd65
mov dword [ebp - 0x1d78], 1
jmp 0x46bd6c
and dword [ebp - 0x1d78], 0
mov eax, dword [ebp - 0x1d78]
add eax, 5
cmp eax, 0x23e24b13
jl 0x46bd88
mov dword [ebp - 0xf58], 1
jmp 0x46bd8f
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xf58], eax
jle 0x46bda9
mov dword [ebp - 0x1d80], 1
jmp 0x46bdb0
and dword [ebp - 0x1d80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2570]
add eax, dword [ebp - 0x1d80]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xf60]
cmp dword [ebp - 0xbc4], eax
je 0x46bdec
cmp dword [ebp - 0xf60], 0
je 0x46bdec
mov dword [ebp - 0x1d88], 1
jmp 0x46bdf3
and dword [ebp - 0x1d88], 0
push 2
lea ecx, [ebp - 0x2e78]
call fcn.00430161
mov ecx, dword [ebp - 0x1d88]
cmp ecx, dword [eax]
jg 0x46be16
mov dword [ebp - 0xf68], 1
jmp 0x46be1d
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xf68], eax
jge 0x46be34
mov dword [ebp - 0x1d90], 1
jmp 0x46be3b
and dword [ebp - 0x1d90], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1d90], eax
jge 0x46be52
mov dword [ebp - 0xf70], 1
jmp 0x46be59
and dword [ebp - 0xf70], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xf70], eax
jne 0x46be73
mov dword [ebp - 0x1d98], 1
jmp 0x46be7a
and dword [ebp - 0x1d98], 0
cmp dword [ebp - 0x1d98], 0xfffd
jb 0x46be92
mov dword [ebp - 0xf78], 1
jmp 0x46be99
and dword [ebp - 0xf78], 0
mov dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xda8]
cmp eax, dword [ebp - 0xf78]
je 0x46bebd
mov dword [ebp - 0x1da0], 1
jmp 0x46bec4
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1da0], eax
jle 0x46bedb
mov dword [ebp - 0xf80], 1
jmp 0x46bee2
and dword [ebp - 0xf80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2570]
cmp dword [ebp - 0xf80], eax
je 0x46bf03
mov dword [ebp - 0x1da8], 1
jmp 0x46bf0a
and dword [ebp - 0x1da8], 0
mov eax, dword [ebp - 0x1da8]
sub eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2ae0], eax
mov dword [ebp - 0x2d4], 0
jmp 0x46bf35
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jg 0x46bffc
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp + eax*4 - 0x2570]
mov dword [ebp - 0x376c], eax
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp + eax*4 - 0x2570]
cmp dword [ebp - 0xd64], eax
jg 0x46bf76
mov dword [ebp - 0xf88], 1
jmp 0x46bf7d
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0xbc4]
cmp dword [ebp - 0xf88], eax
je 0x46bf97
mov dword [ebp - 0xf98], 1
jmp 0x46bf9e
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x1db0], eax
mov eax, dword [ebp - 0x1db0]
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0xf90]
mov dword [ebp - 0x1db8], eax
mov eax, dword [ebp - 0x1db8]
imul ecx, dword [ebp - 0xf98], 0xfabe
sub eax, ecx
test eax, eax
jle 0x46bfe4
mov dword [ebp - 0x1dc0], 1
jmp 0x46bfeb
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 0x1dc0]
mov dword [ebp - 0x2ae8], eax
jmp 0x46bf28
jmp 0x46bcb6
jmp 0x46bab5
lea ecx, [ebp - 0x2e78]
call fcn.00430145
mov dword [ebp - 0x309c], 8
mov dword [ebp - 0x3098], 8
mov dword [ebp - 0x3094], 8
mov dword [ebp - 0x3090], 8
lea ecx, [ebp - 0xce5]
call fcn.00430170
push eax
lea eax, [ebp - 0x308c]
push eax
lea eax, [ebp - 0x309c]
push eax
lea ecx, [ebp - 0x3a98]
call fcn.00430173
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe44]
call fcn.0043011f
mov dword [ebp - 0xfa8], 2
mov dword [ebp - 0x2dc], 0x110e6b6c
mov dword [ebp - 0xcdc], 0xfffffffb
mov dword [ebp - 0x2b10], 0xfffffffb
mov dword [ebp - 0x34f8], 0
mov dword [ebp - 0x2b18], 0x2ce33a90
push 0
lea ecx, [ebp - 0xe44]
call fcn.00430161
cmp dword [eax], 0xfff6
je 0x46c0cb
mov dword [ebp - 0x2af0], 1
jmp 0x46c0d2
and dword [ebp - 0x2af0], 0
push 2
lea ecx, [ebp - 0xe44]
call fcn.00430161
cmp dword [eax], 0xfc2d
jl 0x46c0f3
mov dword [ebp - 0xfa0], 1
jmp 0x46c0fa
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0xfa0]
sub eax, 0xfc1d
cmp eax, dword [ebp - 0xfa8]
jle 0x46c119
mov dword [ebp - 0x2af8], 1
jmp 0x46c120
and dword [ebp - 0x2af8], 0
push 1
lea ecx, [ebp - 0xe44]
call fcn.00430161
mov ecx, dword [ebp - 0x2dc]
cmp dword [eax], ecx
jg 0x46c143
mov dword [ebp - 0x1dc8], 1
jmp 0x46c14a
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x1dc8]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xdfe4
jg 0x46c16f
xor eax, eax
jne 0x46c16f
and dword [ebp - 0x2b00], 0
jmp 0x46c179
mov dword [ebp - 0x2b00], 1
mov eax, dword [ebp - 0xfa8]
mov dword [ebp - 0x398c], eax
push 0
lea ecx, [ebp - 0xe44]
call fcn.00430161
mov ecx, dword [ebp - 0xcdc]
cmp dword [eax], ecx
jle 0x46c1a8
mov dword [ebp - 0x1dd0], 1
jmp 0x46c1af
and dword [ebp - 0x1dd0], 0
mov eax, dword [ebp - 0xcdc]
cmp dword [ebp - 0x1dd0], eax
jne 0x46c1c9
mov dword [ebp - 0xfb0], 1
jmp 0x46c1d0
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0xcdc]
cmp dword [ebp - 0xfb0], eax
jge 0x46c1f4
push 0
lea ecx, [ebp - 0xe44]
call fcn.00430161
cmp dword [eax], 0
je 0x46c3d1
mov dword [ebp - 0xfc0], 2
push 4
lea ecx, [ebp - 0x30e4]
call fcn.00430073
mov dword [ebp - 0x968], 0
jmp 0x46c224
mov eax, dword [ebp - 0x968]
inc eax
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x968], 4
jge 0x46c246
push dword [ebp - 0x968]
lea ecx, [ebp - 0x30e4]
call fcn.00430161
mov dword [eax], 6
jmp 0x46c217
mov dword [ebp - 0x2dc], 0
jmp 0x46c25f
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xfffffff7
je 0x46c3c4
mov dword [ebp - 0x610], 0xb47e0fa1
mov dword [ebp - 0xfb8], 1
cmp dword [ebp - 0xfc0], 0x3d478254
jl 0x46c298
mov dword [ebp - 0xfc8], 1
jmp 0x46c29f
and dword [ebp - 0xfc8], 0
mov esi, dword [ebp - 0x610]
push 0
lea ecx, [ebp - 0xe44]
call fcn.00430161
mov eax, dword [eax]
sub eax, 0x56201118
imul esi, eax
push 0
lea ecx, [ebp - 0xe44]
call fcn.00430161
cmp esi, dword [eax]
jge 0x46c2d9
mov dword [ebp - 0xbcc], 1
jmp 0x46c2e0
and dword [ebp - 0xbcc], 0
push 1
lea ecx, [ebp - 0x30e4]
call fcn.00430161
mov ecx, dword [ebp - 0xbcc]
mov dword [eax], ecx
cmp dword [ebp - 0xbcc], 0xffffffff
jle 0x46c30a
mov dword [ebp - 0x1dd8], 1
jmp 0x46c311
and dword [ebp - 0x1dd8], 0
mov eax, dword [ebp - 0x1dd8]
mov dword [ebp - 0xfb8], eax
cmp dword [ebp - 0xfb8], 0
jl 0x46c332
mov dword [ebp - 0x1de0], 1
jmp 0x46c339
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x1de0], eax
jle 0x46c353
mov dword [ebp - 0x1de8], 1
jmp 0x46c35a
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0xfc0]
cmp dword [ebp - 0x1de8], eax
jle 0x46c374
mov dword [ebp - 0x1df0], 1
jmp 0x46c37b
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0xfc8]
cmp eax, dword [ebp - 0x1df0]
jne 0x46c395
mov dword [ebp - 0x2b08], 1
jmp 0x46c39c
and dword [ebp - 0x2b08], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x3500], eax
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x2b10], eax
cmp dword [ebp - 0x610], 0
je 0x46c3bf
jmp 0x46c3c4
jmp 0x46c252
lea ecx, [ebp - 0x30e4]
call fcn.00430145
jmp 0x46c430
mov dword [ebp - 0xfd0], 0xa3e2
mov eax, dword [ebp - 0xfd0]
inc eax
mov dword [ebp - 0xfd0], eax
mov byte [ebp - 0x473], 0
movzx eax, byte [ebp - 0x473]
test eax, eax
je 0x46c430
push 0x1170
push 0
push 0xd90
push 0xd4e
push 0x1b17
push 0
push 0xfd0
push 0x4f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0
lea ecx, [ebp - 0xe44]
call fcn.00430161
mov eax, dword [eax]
mov dword [ebp - 0x2b18], eax
lea ecx, [ebp - 0xe44]
call fcn.00430145
mov dword [ebp - 0x24], 0
jmp 0x46c460
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x46c476
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x39f0], 0x49cec79e
jmp 0x46c459
mov dword [ebp - 0x24], 0
jmp 0x46c486
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x46c49c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2f88], 0x628405ce
jmp 0x46c47f
push 2
lea ecx, [ebp - 0x3698]
call fcn.00430073
mov dword [ebp - 0x970], 1
mov dword [ebp - 0x73c], 0
jmp 0x46c4cc
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 2
jge 0x46c4eb
push dword [ebp - 0x73c]
lea ecx, [ebp - 0x3698]
call fcn.00430161
or dword [eax], 0xffffffff
jmp 0x46c4bf
mov dword [ebp - 0x970], 0
jmp 0x46c504
mov eax, dword [ebp - 0x970]
inc eax
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 1
jg 0x46c52f
mov byte [ebp - 0x299], 0
movzx eax, byte [ebp - 0x299]
test eax, eax
je 0x46c52d
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
jmp 0x46c4f7
lea ecx, [ebp - 0x3698]
call fcn.00430145
mov dword [ebp - 0x24], 0
jmp 0x46c54a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x46c560
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbd4], 9
jmp 0x46c543
mov dword [ebp - 0x24], 0
jmp 0x46c570
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46c586
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3a3c], 1
jmp 0x46c569
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f88]
inc eax
mov dword [ebp - 0x1df8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1df8]
mov dword [ebp + eax - 0x2f88], ecx
mov eax, dword [ebp - 0x2b20]
sub eax, dword [ebp - 0x1df8]
cmp eax, dword [ebp - 0x2b28]
jne 0x46c5cd
mov dword [ebp - 0x1e18], 1
jmp 0x46c5d4
and dword [ebp - 0x1e18], 0
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xd20]
dec ecx
mov dword [ebp - 0xd20], ecx
test eax, eax
je 0x46c609
cmp dword [ebp - 0x1e20], 0
je 0x46c609
cmp dword [ebp - 0x1e10], 0
je 0x46c609
mov dword [ebp - 0xfd8], 1
jmp 0x46c610
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0xfd8], eax
jl 0x46c642
cmp dword [ebp - 0xce4], 0
je 0x46c642
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x39f0], 0
je 0x46c642
mov dword [ebp - 0x1e00], 1
jmp 0x46c649
and dword [ebp - 0x1e00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd4]
mov dword [ebp - 0x2b30], eax
mov eax, dword [ebp - 0x1e00]
mov dword [ebp - 0x2b38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbd4], eax
mov eax, dword [ebp - 0x2b30]
cmp eax, dword [ebp - 0x2b38]
jg 0x46c69d
mov dword [ebp - 0xfe0], 1
jmp 0x46c6a4
and dword [ebp - 0xfe0], 0
cmp dword [ebp - 0xfe0], 0xf3e4
jg 0x46c6bc
mov dword [ebp - 0x1e08], 1
jmp 0x46c6c3
and dword [ebp - 0x1e08], 0
cmp dword [ebp - 0x1e08], 0xffffffff
jne 0x46c6d8
mov dword [ebp - 0xfe8], 1
jmp 0x46c6df
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0xfe8], eax
jge 0x46c6f9
mov dword [ebp - 0xff0], 1
jmp 0x46c700
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x1e10]
sub eax, dword [ebp - 0xff0]
imul eax, dword [ebp - 0x1e18]
cmp eax, 0xaa2a
jg 0x46c726
mov dword [ebp - 0x744], 1
jmp 0x46c72d
and dword [ebp - 0x744], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x744]
mov dword [ebp + eax - 0x3a3c], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x744]
mov dword [ebp + eax - 0x39f0], ecx
cmp dword [ebp - 0x744], 0xffffffff
jbe 0x46c766
mov dword [ebp - 0xff8], 1
jmp 0x46c76d
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x1e20], eax
mov dword [ebp - 0x9c], 0xda7fe64f
mov dword [ebp - 0x978], 0
push 1
lea ecx, [ebp - 0x2cb4]
call fcn.00430073
mov dword [ebp - 0x2b48], 0xfffffff7
mov dword [ebp - 0x2b40], 0x520a
mov dword [ebp - 0x377c], 0x21779538
mov dword [ebp - 0x2b58], 2
mov dword [ebp - 0x34], 0
jmp 0x46c7d2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x46c7ee
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2cb4]
call fcn.00430161
mov dword [eax], 0x3f8de905
jmp 0x46c7cb
mov dword [ebp - 0x34], 0
jmp 0x46c7fe
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x46c814
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x36a8], 8
jmp 0x46c7f7
mov dword [ebp - 0x34], 0
jmp 0x46c824
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x46c83a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x39c0], 0xfffffff6
jmp 0x46c81d
mov dword [ebp - 0x34], 0
jmp 0x46c84a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x46c860
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x353c], 0
jmp 0x46c843
cmp dword [ebp - 0x9c], 0
je 0x46c8c5
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x9c]
je 0x46c889
mov dword [ebp - 0x1000], 1
jmp 0x46c890
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x1000]
cmp eax, dword [ebp - 0x9c]
jle 0x46c8b1
mov dword [ebp - 0x1e28], 1
jmp 0x46c8b8
and dword [ebp - 0x1e28], 0
mov eax, dword [ebp - 0x1e28]
inc eax
cmp eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0
jne 0x46c8da
mov dword [ebp - 0x1008], 1
jmp 0x46c8e1
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1008], eax
jge 0x46c904
cmp dword [ebp - 0x9c], 0
je 0x46c904
mov dword [ebp - 0x1e30], 1
jmp 0x46c90b
and dword [ebp - 0x1e30], 0
cmp dword [ebp - 0x1e30], 1
ja 0x46c920
mov dword [ebp - 0x1010], 1
jmp 0x46c927
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x978], eax
push 3
pop eax
test eax, eax
je 0x46ca79
cmp dword [ebp - 0x9c], 0
jne 0x46c9ec
mov eax, dword [ebp - 0x2b40]
mov dword [ebp - 0x3508], eax
mov esi, dword [ebp - 0x2b48]
dec esi
push 0
lea ecx, [ebp - 0x2cb4]
call fcn.00430161
cmp esi, dword [eax]
jne 0x46c97b
mov dword [ebp - 0x1e38], 1
jmp 0x46c982
and dword [ebp - 0x1e38], 0
mov eax, dword [ebp - 0x978]
imul eax, dword [ebp - 0x1e38]
cmp eax, dword [ebp - 0x9c]
jl 0x46c9a3
mov dword [ebp - 0x1018], 1
jmp 0x46c9aa
and dword [ebp - 0x1018], 0
push 0
lea ecx, [ebp - 0x2cb4]
call fcn.00430161
mov ecx, dword [ebp - 0x1018]
sub ecx, dword [eax]
mov dword [ebp - 0x1e40], ecx
push 0
lea ecx, [ebp - 0x2cb4]
call fcn.00430161
mov ecx, dword [ebp - 0x1e40]
mov dword [eax], ecx
cmp dword [ebp - 0x1e40], 0
jne 0x46c9ec
and dword [ebp - 0x2b50], 0
jmp 0x46c9f6
mov dword [ebp - 0x2b50], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9c]
cmp dword [ebp + eax - 0x36a8], ecx
jle 0x46ca16
mov dword [ebp - 0x1020], 1
jmp 0x46ca1d
and dword [ebp - 0x1020], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x39c0]
imul eax, dword [ebp - 0x1020]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x353c]
jg 0x46ca4b
mov dword [ebp - 0xbdc], 1
jmp 0x46ca52
and dword [ebp - 0xbdc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp + eax - 0x39c0], ecx
cmp dword [ebp - 0xbdc], 0
je 0x46ca79
mov dword [ebp - 0x1e48], 1
jmp 0x46ca80
and dword [ebp - 0x1e48], 0
mov eax, dword [ebp - 0x1e48]
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0
je 0x46cab0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x36a8], 0
je 0x46cab0
mov dword [ebp - 0x1028], 1
jmp 0x46cab7
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x1028]
sub eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2b58], eax
lea ecx, [ebp - 0x2cb4]
call fcn.00430145
mov dword [ebp - 0x2148], 0x7eb5
mov dword [ebp - 0x38d0], 0
mov byte [ebp - 0x447], 0
movzx eax, byte [ebp - 0x447]
test eax, eax
je 0x46cb02
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp - 0x29b], 0
movzx eax, byte [ebp - 0x29b]
test eax, eax
je 0x46cb1a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x254], 0x24a8c6a5
mov dword [ebp - 0x988], 9
mov dword [ebp - 0x980], 0x958900fd
mov dword [ebp - 0x754], 1
mov dword [ebp - 0x74c], 0
jmp 0x46cb5b
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 1
jge 0x46cb77
mov eax, dword [ebp - 0x74c]
mov dword [ebp + eax*4 - 0x2b68], 0xfaeb382e
jmp 0x46cb4e
mov dword [ebp - 0x254], 0
jmp 0x46cb90
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x17
jle 0x46cbbc
mov byte [ebp - 0x465], 0
movzx eax, byte [ebp - 0x465]
test eax, eax
je 0x46cbba
push 0x917
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x46cb83
cmp dword [ebp - 0x988], 0
je 0x46cc17
cmp dword [ebp - 0x254], 0
je 0x46cc17
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x980], eax
jge 0x46cbe8
mov dword [ebp - 0x1e50], 1
jmp 0x46cbef
and dword [ebp - 0x1e50], 0
mov eax, dword [ebp - 0x1e50]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x7540
jg 0x46cc0b
xor eax, eax
je 0x46cc17
mov dword [ebp - 0x1030], 1
jmp 0x46cc1e
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x1030], eax
jne 0x46cc38
mov dword [ebp - 0x1e58], 1
jmp 0x46cc3f
and dword [ebp - 0x1e58], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x1e58], eax
jl 0x46cc59
mov dword [ebp - 0x2b60], 1
jmp 0x46cc60
and dword [ebp - 0x2b60], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x3510], eax
mov eax, dword [ebp - 0x988]
add eax, dword [ebp - 0x980]
mov dword [ebp - 0x754], eax
jne 0x46cc87
cmp dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x988], eax
jl 0x46cca1
mov dword [ebp - 0x1038], 1
jmp 0x46cca8
and dword [ebp - 0x1038], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1038]
mov dword [ebp + eax - 0x2b68], ecx
mov dword [ebp - 0x7c], 0xda7fe64f
mov dword [ebp - 0x6d0], 0xfffffff7
cmp dword [ebp - 0x6d0], 0
je 0x46ccfb
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x46ccf6
push 0xa33
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x46cdf3
mov dword [ebp - 0x75c], 0
jmp 0x46cd14
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 1
jge 0x46cd30
mov eax, dword [ebp - 0x75c]
mov dword [ebp + eax*4 - 0x2b70], 0x57ad95e1
jmp 0x46cd07
mov dword [ebp - 0x6d0], 0
jmp 0x46cd49
cmp dword [ebp - 0x6d0], 0
jg 0x46cdf3
mov dword [ebp - 0x990], 0x90be4438
mov dword [ebp - 0x378c], 0xad8530de
mov dword [ebp - 0x3518], 0xfffffff7
mov dword [ebp - 0x1e60], 0xffff
mov dword [ebp - 0x990], 0
jmp 0x46cd97
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0x23c], 0x53aa
push 2
lea ecx, [ebp - 0x327c]
call fcn.00430073
push 3
lea ecx, [ebp - 0x31d4]
call fcn.00430073
mov dword [ebp - 0x2b78], 1
mov dword [ebp - 0x1e4], 0
jmp 0x46ce44