Function at 0x468386
Capabilities:
Delete directory
Extract resource via kernel32 functions
Hide graphical window
Identify system language via api
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x36e8
call fcn.0049f4f0
push esi
push edi
mov dword [ebp - 0x334], 0xdf99ff60
mov dword [ebp - 0x1ee0], 0
push 3
lea ecx, [ebp - 0x2a14]
call fcn.00431e27
mov dword [ebp - 0x150], 0
jmp 0x4683cf
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x4683eb
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x35d8], 0xe0c8
jmp 0x4683c2
mov dword [ebp - 0x150], 0
jmp 0x468404
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x468423
push dword [ebp - 0x150]
lea ecx, [ebp - 0x2a14]
call fcn.00431f15
or dword [eax], 0xffffffff
jmp 0x4683f7
mov dword [ebp - 0x334], 0
jmp 0x46843c
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0xffffffef
jg 0x4686f9
mov dword [ebp - 0x1dc], 0
push 4
lea ecx, [ebp - 0x29fc]
call fcn.00431e27
mov dword [ebp - 0x1ef0], 0xffffffff
mov dword [ebp - 0x60c], 0
jmp 0x468483
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 4
jge 0x4684a5
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x29fc]
call fcn.00431f15
mov dword [eax], 0x8ebdb88d
jmp 0x468476
cmp dword [ebp - 0x1dc], 0
je 0x468656
cmp dword [ebp - 0x1dc], 1
je 0x4684c7
mov dword [ebp - 0x215c], 1
jmp 0x4684ce
and dword [ebp - 0x215c], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x334], eax
jl 0x4684e8
mov dword [ebp - 0x21c4], 1
jmp 0x4684ef
and dword [ebp - 0x21c4], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x2d30], eax
mov eax, dword [ebp - 0x1dc]
add eax, dword [ebp - 0x1dc]
neg eax
cmp eax, 0xa21e1d82
jae 0x468656
mov dword [ebp - 0x1dc], 0x11
jmp 0x46852d
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xffffffe7
jge 0x468651
mov dword [ebp - 0x42c], 0xfffffffd
mov dword [ebp - 0x21cc], 0x68e10d32
mov dword [ebp - 0x42c], 3
jmp 0x468567
mov eax, dword [ebp - 0x42c]
dec eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jl 0x46864c
mov dword [ebp - 0x7b0], 0xffffffff
mov dword [ebp - 0x7b0], 0
jmp 0x468597
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 3
jg 0x4685bc
mov byte [ebp - 0x428], 0
movzx eax, byte [ebp - 0x428]
test eax, eax
je 0x4685ba
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x46858a
push 3
lea ecx, [ebp - 0x29fc]
call fcn.00431f15
mov dword [eax], 0x34e401d9
mov eax, dword [ebp - 0x42c]
cmp dword [ebp + eax*4 - 0x35d8], 0x34e401d9
je 0x4685ee
mov dword [ebp - 0x174c], 1
jmp 0x4685f5
and dword [ebp - 0x174c], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x174c], eax
jle 0x468615
cmp dword [ebp - 0x42c], 0
jne 0x468615
and dword [ebp - 0x1ed0], 0
jmp 0x46861f
mov dword [ebp - 0x1ed0], 1
cmp dword [ebp - 0x1ed0], 1
jbe 0x468634
mov dword [ebp - 0x1ed8], 1
jmp 0x46863b
and dword [ebp - 0x1ed8], 0
mov eax, dword [ebp - 0x1ed8]
mov dword [ebp - 0x21cc], eax
jmp 0x46855a
jmp 0x468520
jmp 0x4686e9
mov dword [ebp - 0x21d4], 0x380a
mov dword [ebp - 0x2fd8], 0x83312ef3
mov dword [ebp - 0x3464], 0xffffffff
mov dword [ebp - 0x2fe0], 6
mov dword [ebp - 0x3258], 1
mov dword [ebp - 0x2fe8], 0x8968f25c
mov dword [ebp - 0x33c8], 0xfffffff7
mov dword [ebp - 0x1ee0], 0xd88ca0e2
mov eax, dword [ebp - 0x1ee0]
cmp dword [ebp - 0x21d4], eax
jle 0x4686c0
mov dword [ebp - 0x1ee8], 1
jmp 0x4686c7
and dword [ebp - 0x1ee8], 0
push 0
lea ecx, [ebp - 0x2a14]
call fcn.00431f15
mov ecx, dword [ebp - 0x1ee8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1ef0]
inc eax
mov dword [ebp - 0x1ef0], eax
lea ecx, [ebp - 0x29fc]
call fcn.00431ef9
jmp 0x46842f
lea ecx, [ebp - 0x2a14]
call fcn.00431ef9
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x21dc], 0xda87b8b0
mov dword [ebp - 0x1f60], 0x50c19791
mov dword [ebp - 0x21e4], 0x43a64e78
mov dword [ebp - 0x2ff0], 0xfffffff8
mov dword [ebp - 0x158], 0
jmp 0x46874f
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x46876b
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x160], 0xfffb
jmp 0x468742
mov dword [ebp - 0x158], 0
jmp 0x468784
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 4
jge 0x4687a0
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x3408], 0xfffffff7
jmp 0x468777
mov dword [ebp - 0xac], 0
jmp 0x4687b9
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x4689f1
push 3
lea ecx, [ebp - 0x2714]
call fcn.00431e27
push 2
lea ecx, [ebp - 0x2584]
call fcn.00431e27
mov dword [ebp - 0x1e4], 0
jmp 0x4687f9
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x468818
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2714]
call fcn.00431f15
and dword [eax], 0
jmp 0x4687ec
mov dword [ebp - 0x1e4], 0
jmp 0x468831
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x468853
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2584]
call fcn.00431f15
mov dword [eax], 0x35d56974
jmp 0x468824
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x160]
mov dword [ebp - 0x3268], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x160], 0xef5d
jle 0x468885
mov dword [ebp - 0x1ef8], 1
jmp 0x46888c
and dword [ebp - 0x1ef8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
cmp eax, dword [ebp - 0x1ef8]
jne 0x4688ad
mov dword [ebp - 0x1f00], 1
jmp 0x4688b4
and dword [ebp - 0x1f00], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x160]
cmp dword [ebp - 0x1f00], eax
jge 0x4688d7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x160], 0
mov eax, 0x5801
cmp eax, 0xffff
je 0x4688ef
mov dword [ebp - 0x1f08], 1
jmp 0x4688f6
and dword [ebp - 0x1f08], 0
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x1f08]
jl 0x468910
mov dword [ebp - 0x1f10], 1
jmp 0x468917
and dword [ebp - 0x1f10], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1f10], eax
jge 0x468931
mov dword [ebp - 0x1f18], 1
jmp 0x468938
and dword [ebp - 0x1f18], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x160]
cmp dword [ebp - 0x1f18], eax
jg 0x468959
mov dword [ebp - 0x1f38], 1
jmp 0x468960
and dword [ebp - 0x1f38], 0
imul esi, dword [ebp - 0x1f38], 0xffff
push 1
lea ecx, [ebp - 0x2714]
call fcn.00431f15
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x2584]
call fcn.00431f15
and dword [eax], 0
jmp 0x4689af
push 0
lea ecx, [ebp - 0x2584]
call fcn.00431f15
mov dword [ebp - 0x1f40], eax
mov eax, dword [ebp - 0x1f40]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1f40]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2584]
call fcn.00431f15
cmp dword [eax], 0
jl 0x4689d6
push 0
lea ecx, [ebp - 0x2714]
call fcn.00431f15
mov dword [eax], 7
jmp 0x46898b
lea ecx, [ebp - 0x2584]
call fcn.00431ef9
lea ecx, [ebp - 0x2714]
call fcn.00431ef9
jmp 0x4687ac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3408], 0
jne 0x468b26
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
mov dword [ebp - 0x2ff8], eax
mov dword [ebp - 0xac], 0xfffffffc
cmp dword [ebp - 0xac], 0
jne 0x468a3d
cmp dword [ebp - 0x21dc], 0
jne 0x468a3d
and dword [ebp - 0x1f48], 0
jmp 0x468a47
mov dword [ebp - 0x1f48], 1
mov eax, dword [ebp - 0x1f48]
sub eax, 0xeb70
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x160]
jge 0x468a6d
mov dword [ebp - 0x1f50], 1
jmp 0x468a74
and dword [ebp - 0x1f50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3408]
cmp dword [ebp - 0x1f50], eax
je 0x468a95
mov dword [ebp - 0x1f58], 1
jmp 0x468a9c
and dword [ebp - 0x1f58], 0
mov eax, dword [ebp - 0x1f58]
mov dword [ebp - 0x1f60], eax
cmp dword [ebp - 0x1f60], 5
jge 0x468abd
mov dword [ebp - 0x1f68], 1
jmp 0x468ac4
and dword [ebp - 0x1f68], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3408]
cmp dword [ebp - 0x1f68], eax
jge 0x468ae5
mov dword [ebp - 0x1f70], 1
jmp 0x468aec
and dword [ebp - 0x1f70], 0
cmp dword [ebp - 0x1f70], 0
jne 0x468b01
mov dword [ebp - 0x1f78], 1
jmp 0x468b08
and dword [ebp - 0x1f78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
add eax, dword [ebp - 0x1f78]
jne 0x468b26
and dword [ebp - 0x1f80], 0
jmp 0x468b30
mov dword [ebp - 0x1f80], 1
mov eax, dword [ebp - 0x1f80]
mov dword [ebp - 0x21e4], eax
mov dword [ebp - 0x36c], 0xdf99ff60
mov dword [ebp - 0x978], 0x265ab3e9
mov dword [ebp - 0x1f88], 1
mov dword [ebp - 0x8e0], 0
mov dword [ebp - 0x21ec], 1
mov dword [ebp - 0xb64], 0xe17c1097
mov dword [ebp - 0x970], 0
mov dword [ebp - 0x21f4], 0x7af2c9a1
mov dword [ebp - 0x21fc], 0
mov dword [ebp - 0x620], 0
jmp 0x468baf
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 2
jge 0x468bcb
mov eax, dword [ebp - 0x620]
mov dword [ebp + eax*4 - 0x2248], 5
jmp 0x468ba2
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x1f88], eax
cmp dword [ebp - 0x1f88], 8
jbe 0x468bec
mov dword [ebp - 0x1fb0], 1
jmp 0x468bf3
and dword [ebp - 0x1fb0], 0
mov eax, dword [ebp - 0x978]
neg eax
mov dword [ebp - 0x1f90], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f90]
mov dword [ebp + eax - 0x2248], ecx
mov eax, dword [ebp - 0x970]
dec eax
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x970]
cmp dword [ebp - 0x1f90], eax
jge 0x468c3b
mov dword [ebp - 0x1f98], 1
jmp 0x468c42
and dword [ebp - 0x1f98], 0
mov eax, dword [ebp - 0x1f98]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x21ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2248]
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 0
jne 0x468c7d
cmp dword [ebp - 0xb64], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2248], 0xfffffffa
je 0x468c99
mov dword [ebp - 0x1fa0], 1
jmp 0x468ca0
and dword [ebp - 0x1fa0], 0
mov eax, dword [ebp - 0x1fa0]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0x21f4]
cmp dword [ebp - 0xb64], eax
jl 0x468cc6
mov dword [ebp - 0x1fa8], 1
jmp 0x468ccd
and dword [ebp - 0x1fa8], 0
mov eax, dword [ebp - 0x978]
cmp dword [ebp - 0x1fa8], eax
jle 0x468ce7
mov dword [ebp - 0x1fb8], 1
jmp 0x468cee
and dword [ebp - 0x1fb8], 0
mov eax, dword [ebp - 0x1fb0]
sub eax, dword [ebp - 0x1fb8]
jne 0x468d0e
mov eax, 0xf545
test eax, eax
jne 0x468d0e
and dword [ebp - 0x1fc0], 0
jmp 0x468d18
mov dword [ebp - 0x1fc0], 1
mov eax, dword [ebp - 0x1fc0]
mov dword [ebp - 0x21fc], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0xc44], 0x4dd03248
mov dword [ebp - 0xa90], 0x20dd93ba
and dword [ebp - 0x2918], 0
and dword [ebp - 0x2914], 0
and dword [ebp - 0x2910], 0
and dword [ebp - 0x290c], 0
lea ecx, [ebp - 0xab1]
call fcn.00431f24
push eax
lea eax, [ebp - 0x2908]
push eax
lea eax, [ebp - 0x2918]
push eax
lea ecx, [ebp - 0x3560]
call fcn.00431f27
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3154]
call fcn.00431ed3
mov dword [ebp - 0xc4c], 0xfffffff7
mov dword [ebp - 0x220c], 0x3418eb0b
mov dword [ebp - 0x1ec], 0
jmp 0x468dbd
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x468dd9
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x2c94], 8
jmp 0x468db0
mov dword [ebp - 0x1ec], 0
jmp 0x468df2
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x468e0e
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x2204], 1
jmp 0x468de5
cmp dword [ebp - 0x38], 0xffffffff
jle 0x468e20
mov dword [ebp - 0x1fc8], 1
jmp 0x468e27
and dword [ebp - 0x1fc8], 0
mov eax, dword [ebp - 0x1fc8]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jne 0x468e41
mov dword [ebp - 0x1fd0], 1
jmp 0x468e48
and dword [ebp - 0x1fd0], 0
cmp dword [ebp - 0x1fd0], 1
jb 0x468e5d
mov dword [ebp - 0x1fd8], 1
jmp 0x468e64
and dword [ebp - 0x1fd8], 0
mov eax, dword [ebp - 0x1fd8]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34bc], eax
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x3000], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3278], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jl 0x468ea5
mov dword [ebp - 0x2058], 1
jmp 0x468eac
and dword [ebp - 0x2058], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x2058]
test eax, eax
je 0x468ed5
cmp dword [ebp - 0xa90], 0
je 0x468ed5
cmp dword [ebp - 0x38], 0
je 0x468ed5
mov dword [ebp - 0x2044], 1
jmp 0x468edc
and dword [ebp - 0x2044], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2044], eax
jne 0x468ef3
mov dword [ebp - 0x104c], 1
jmp 0x468efa
and dword [ebp - 0x104c], 0
cmp dword [ebp - 0x104c], 0x2d38ca8c
jge 0x468f1b
mov eax, 0xc1e0f758
test eax, eax
je 0x468f1b
mov dword [ebp - 0x1ab8], 1
jmp 0x468f22
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1ab8], eax
jle 0x468f39
mov dword [ebp - 0xc3c], 1
jmp 0x468f40
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x38]
push 0xfffffffffffffffd
pop ecx
sub ecx, dword [ebp - 0xc3c]
sub ecx, dword [ebp - 0x38]
sub eax, ecx
jne 0x468f5f
mov dword [ebp - 0x980], 1
jmp 0x468f66
and dword [ebp - 0x980], 0
push 3
lea ecx, [ebp - 0x3154]
call fcn.00431f15
mov ecx, dword [ebp - 0x980]
mov dword [eax], ecx
mov eax, dword [ebp - 0x980]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jl 0x468f95
mov dword [ebp - 0x1ac0], 1
jmp 0x468f9c
and dword [ebp - 0x1ac0], 0
cmp dword [ebp - 0x1ac0], 0xfffffff9
jle 0x468fb1
mov dword [ebp - 0xb2c], 1
jmp 0x468fb8
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc44], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp + eax - 0x2c94], ecx
mov eax, dword [ebp - 0xc44]
cmp eax, dword [ebp - 0xb2c]
jg 0x468fee
mov dword [ebp - 0x1ac8], 1
jmp 0x468ff5
and dword [ebp - 0x1ac8], 0
mov eax, dword [ebp - 0x1ac8]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x1ad0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ad0]
mov dword [ebp + eax - 0x2204], ecx
mov eax, dword [ebp - 0x1ad0]
mov dword [ebp - 0x220c], eax
lea ecx, [ebp - 0x3154]
call fcn.00431ef9
mov dword [ebp - 0xf64], 0
push 3
lea ecx, [ebp - 0x2a5c]
call fcn.00431e27
mov dword [ebp - 0x268], 0xc443eb60
mov dword [ebp - 0x1ad8], 0xffffffff
mov dword [ebp - 0x2224], 0x3062a4b1
mov dword [ebp - 0x3008], 0xffffffff
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x268], eax
jg 0x469090
mov dword [ebp - 0xc54], 1
jmp 0x469097
and dword [ebp - 0xc54], 0
cmp dword [ebp - 0x268], 3
jne 0x4690ac
mov dword [ebp - 0x2214], 1
jmp 0x4690b3
and dword [ebp - 0x2214], 0
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x268]
imul ecx, dword [ebp - 0xc54]
imul ecx, ecx, 0x3c61
imul eax, ecx
mov dword [ebp - 0x1ad8], eax
mov eax, dword [ebp - 0x1ad8]
sub eax, 0xd70
cmp eax, dword [ebp - 0x268]
jl 0x4690f4
mov dword [ebp - 0x221c], 1
jmp 0x4690fb
and dword [ebp - 0x221c], 0
cmp dword [ebp - 0x268], 0
jg 0x469110
mov dword [ebp - 0xc5c], 1
jmp 0x469117
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xc5c]
sub eax, dword [ebp - 0x268]
je 0x46916d
cmp dword [ebp - 0x2224], 0
je 0x46916d
mov byte [ebp - 0x3f6], 0
movzx eax, byte [ebp - 0x3f6]
test eax, eax
je 0x46914c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov byte [ebp - 0x345], 0
movzx eax, byte [ebp - 0x345]
test eax, eax
je 0x46916b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x4691af
mov byte [ebp - 0x3f8], 0
movzx eax, byte [ebp - 0x3f8]
test eax, eax
je 0x469193
push 0
push 0x1272
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x4691af
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [ebp - 0x7b8], 0xfffffffe
mov dword [ebp - 0x33d0], 0xffffffff
push 2
lea ecx, [ebp - 0x3174]
call fcn.00431e27
mov dword [ebp - 0x3010], 1
mov dword [ebp - 0x628], 0
jmp 0x4691f3
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 2
jge 0x469215
push dword [ebp - 0x628]
lea ecx, [ebp - 0x3174]
call fcn.00431f15
mov dword [eax], 0x68044455
jmp 0x4691e6
mov byte [ebp - 0x3fa], 0
movzx eax, byte [ebp - 0x3fa]
test eax, eax
je 0x469246
push 0
push 0
push 0x1b82
push 0
push 0x568
push 0
push 0x1355
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x7b8], 0x14
jmp 0x46925f
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0x1d
je 0x46943e
mov dword [ebp - 0x630], 9
push 2
lea ecx, [ebp - 0x3164]
call fcn.00431e27
mov dword [ebp - 0x3288], 5
mov dword [ebp - 0x1ae0], 0xffff
mov dword [ebp - 0x168], 0
jmp 0x4692b0
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x4692cc
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x36bc], 1
jmp 0x4692a3
mov dword [ebp - 0x168], 0
jmp 0x4692e5
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x469307
push dword [ebp - 0x168]
lea ecx, [ebp - 0x3164]
call fcn.00431f15
mov dword [eax], 0xf93f8de9
jmp 0x4692d8
mov dword [ebp - 0x630], 0x18
jmp 0x469320
mov eax, dword [ebp - 0x630]
dec eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0xe
jg 0x46942e
mov dword [ebp - 0x3018], 0xffffffff
mov dword [ebp - 0x2c50], 0x82f80c34
mov dword [ebp - 0x2c58], 0x17c10977
mov dword [ebp - 0x2c60], 0xffffffff
mov dword [ebp - 0x2c68], 0x2f3f
mov dword [ebp - 0x2c70], 0xd0bb94d0
mov dword [ebp - 0x2c78], 0x71a0513
mov dword [ebp - 0x2c80], 0xc9a130df
mov dword [ebp - 0x2c88], 0
mov dword [ebp - 0x2d04], 0xffffffff
mov dword [ebp - 0x2d0c], 0xb91ee4c
mov dword [ebp - 0x2d14], 0xffffffff
mov dword [ebp - 0x2d1c], 0xaf9031ea
mov dword [ebp - 0x2d24], 0xdd3ed23c
mov dword [ebp - 0x2d2c], 0xbbe58ed0
mov dword [ebp - 0x2d34], 0
mov dword [ebp - 0x880], 0
jmp 0x4693e6
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 4
jge 0x469402
mov eax, dword [ebp - 0x880]
mov dword [ebp + eax*4 - 0x366c], 1
jmp 0x4693d9
mov eax, dword [ebp - 0x1ae0]
dec eax
mov dword [ebp - 0x1ae0], eax
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x469429
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x469313
lea ecx, [ebp - 0x3164]
call fcn.00431ef9
jmp 0x469252
lea ecx, [ebp - 0x3174]
call fcn.00431ef9
mov dword [ebp - 0x1fc], 0
jmp 0x469462
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x46947e
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x3600], 0xe0c8
jmp 0x469455
push 1
lea ecx, [ebp - 0x2a2c]
call fcn.00431e27
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x1f4], 0
jmp 0x4694b8
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x4694d4
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x170], 0x8abc
jmp 0x4694ab
mov dword [ebp - 0x1f4], 0
jmp 0x4694ed
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x46950f
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x2a2c]
call fcn.00431f15
mov dword [eax], 1
jmp 0x4694e0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
je 0x46955c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
mov dword [ebp - 0xc64], eax
push 0
lea ecx, [ebp - 0x2a2c]
call fcn.00431f15
mov ecx, dword [ebp - 0xc64]
mov dword [eax], ecx
cmp dword [ebp - 0xc64], 0
je 0x46955c
mov dword [ebp - 0x1af0], 1
jmp 0x469563
and dword [ebp - 0x1af0], 0
cmp dword [ebp - 0x33c], 8
jne 0x469578
mov dword [ebp - 0x1ae8], 1
jmp 0x46957f
and dword [ebp - 0x1ae8], 0
mov eax, dword [ebp - 0x638]
imul eax, dword [ebp - 0x1ae8]
cmp eax, dword [ebp - 0x33c]
je 0x4695a0
mov dword [ebp - 0xc6c], 1
jmp 0x4695a7
and dword [ebp - 0xc6c], 0
imul eax, dword [ebp - 0xc6c], 0xffff
cmp dword [ebp - 0x1af0], eax
jle 0x4695c5
mov dword [ebp - 0xc74], 1
jmp 0x4695cc
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0x638]
add eax, dword [ebp - 0xc74]
jne 0x4695f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
jne 0x4695f3
and dword [ebp - 0x1af8], 0
jmp 0x4695fd
mov dword [ebp - 0x1af8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp eax, dword [ebp - 0x1af8]
jl 0x46961e
mov dword [ebp - 0xc7c], 1
jmp 0x469625
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x638]
add eax, dword [ebp - 0xc7c]
jne 0x46963f
mov dword [ebp - 0x1b00], 1
jmp 0x469646
and dword [ebp - 0x1b00], 0
cmp dword [ebp - 0x1b00], 0
jne 0x469661
cmp dword [ebp - 0x638], 0
jne 0x469661
and dword [ebp - 0xc84], 0
jmp 0x46966b
mov dword [ebp - 0xc84], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0xc84], eax
jne 0x46968c
mov dword [ebp - 0x222c], 1
jmp 0x469693
and dword [ebp - 0x222c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
mov dword [ebp - 0x2d3c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0x50df
jge 0x4696c5
mov dword [ebp - 0x1b08], 1
jmp 0x4696cc
and dword [ebp - 0x1b08], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x1b08], eax
jle 0x469718
mov dword [ebp - 0x33c], 0
jmp 0x4696fa
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 1
jge 0x469716
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x170], 1
jmp 0x4696ed
jmp 0x46972f
mov dword [ebp - 0xc8c], 5
mov eax, dword [ebp - 0xc8c]
inc eax
mov dword [ebp - 0xc8c], eax
lea ecx, [ebp - 0x2a2c]
call fcn.00431ef9
mov dword [ebp - 0x1fc], 0
jmp 0x469753
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x469772
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2a5c]
call fcn.00431f15
or dword [eax], 0xffffffff
jmp 0x469746
mov dword [ebp - 0x640], 0x1e559696
mov dword [ebp - 0x7c0], 0
jmp 0x469795
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 1
jge 0x4697b1
mov eax, dword [ebp - 0x7c0]
mov dword [ebp + eax*4 - 0x2d44], 0xfffd
jmp 0x469788
mov dword [ebp - 0x640], 0
jmp 0x4697ca
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jg 0x469834
mov dword [ebp - 0x938], 7
mov dword [ebp - 0x2234], 7
mov dword [ebp - 0x938], 0
jmp 0x469800
mov eax, dword [ebp - 0x938]
dec eax
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 0
jl 0x469832
mov byte [ebp - 0x3fc], 0
movzx eax, byte [ebp - 0x3fc]
test eax, eax
je 0x469826
push 0x14c3
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x2234], 0x56a3367f
jmp 0x4697f3
jmp 0x4697bd
mov byte [ebp - 0x35d], 0
movzx eax, byte [ebp - 0x35d]
test eax, eax
je 0x46985a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov dword [ebp - 0x36c], 0
jmp 0x469873
cmp dword [ebp - 0x36c], 0xffffffef
jg 0x46d70e
push 3
lea ecx, [ebp - 0xc14]
call fcn.00431e27
mov dword [ebp - 0x2d4c], 0xfffffff8
mov dword [ebp - 0x178], 0
jmp 0x4698b0
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x4698d2
push dword [ebp - 0x178]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
mov dword [eax], 1
jmp 0x4698a3
mov dword [ebp - 0x178], 0
jmp 0x4698eb
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x469907
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x5d4], 1
jmp 0x4698de
mov byte [ebp - 0x3fe], 0
movzx eax, byte [ebp - 0x3fe]
test eax, eax
je 0x469934
push 0x42b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5d4], 0
jmp 0x469962
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5d4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d4], 2
jg 0x469c39
mov dword [ebp - 0x344], 0xcd53bc6e
mov dword [ebp - 0x2d54], 0x128abf8b
mov dword [ebp - 0x344], 0
jmp 0x4699a3
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jg 0x469c12
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x4c8], 2
jmp 0x4699d3
mov eax, dword [ebp - 0x4c8]
dec eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0
jl 0x469c0d
mov dword [ebp - 0x648], 0x66941fc9
mov dword [ebp - 0x2d5c], 0xffffffff
push dword [ebp - 0x344]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
cmp dword [eax], 0
je 0x469a0f
jmp 0x469c0d
mov dword [ebp - 0x648], 0
jmp 0x469a28
mov eax, dword [ebp - 0x648]
inc eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 2
jg 0x469c08
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5d4]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x5d4]
cmp dword [eax], ecx
jne 0x469a6a
mov dword [ebp - 0x1b10], 1
jmp 0x469a71
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x1b10], eax
jle 0x469a8b
mov dword [ebp - 0x223c], 1
jmp 0x469a92
and dword [ebp - 0x223c], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x2d64], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5d4]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
mov eax, dword [eax]
inc eax
je 0x469ad0
mov eax, 0xe61780ee
test eax, eax
je 0x469ad0
mov dword [ebp - 0xc94], 1
jmp 0x469ad7
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0xc94], eax
jne 0x469af1
mov dword [ebp - 0x1b18], 1
jmp 0x469af8
and dword [ebp - 0x1b18], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5d4]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
mov ecx, dword [ebp - 0x1b18]
cmp ecx, dword [eax]
jle 0x469b2c
cmp dword [ebp - 0x344], 0
jne 0x469b2c
and dword [ebp - 0x2424], 0
jmp 0x469b36
mov dword [ebp - 0x2424], 1
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5d4]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
cmp dword [eax], 0
je 0x469bec
mov dword [ebp - 0x7c8], 0x4ddb84c6
mov dword [ebp - 0x7c8], 0
jmp 0x469b7a
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 2
jg 0x469bcb
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x469bc9
push 0
push 0x1af9
push 0x21d3
push 0xf04
push 0x1aa7
push 0x1fd5
push 0x227d
push 0x2217
push 0x1fc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x469b6d
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5d4]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
cmp dword [eax], 0
je 0x469bea
jmp 0x469c08
jmp 0x469c03
mov dword [ebp - 0xc9c], 0xfafbf261
mov eax, dword [ebp - 0xc9c]
inc eax
mov dword [ebp - 0xc9c], eax
jmp 0x469a1b
jmp 0x4699c6
jmp 0x469996
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5d4]
lea ecx, [ebp - 0xc14]
call fcn.00431f15
cmp dword [eax], 0
je 0x469c34
jmp 0x469947
jmp 0x469947
lea ecx, [ebp - 0xc14]
call fcn.00431ef9
mov dword [ebp - 0x214], 0
mov dword [ebp - 0xdc], 0xd4e06482
mov dword [ebp - 0x1b40], 0
mov dword [ebp - 0xca4], 7
mov dword [ebp - 0xccc], 1
mov dword [ebp - 0xdc], 3
jmp 0x469c8f
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 5
je 0x469ee4
mov dword [ebp - 0x4d0], 0xfc2285fa
push 3
lea ecx, [ebp - 0x2a44]
call fcn.00431e27
mov dword [ebp - 0x1b38], 0x3acb6d64
mov dword [ebp - 0x204], 0
jmp 0x469cd6
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x469cf2
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x242c], 0xc4e2bf5f
jmp 0x469cc9
mov dword [ebp - 0x204], 0
jmp 0x469d0b
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x469d2d
push dword [ebp - 0x204]
lea ecx, [ebp - 0x2a44]
call fcn.00431f15
mov dword [eax], 1
jmp 0x469cfe
cmp dword [ebp - 0xdc], 0
je 0x469d51
imul eax, dword [ebp - 0x4d0], 0xe30f
cmp eax, 0xffffffff
jae 0x469d51
mov dword [ebp - 0xcbc], 1
jmp 0x469d58
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], eax
jne 0x469d72
mov dword [ebp - 0x1b20], 1
jmp 0x469d79
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0x1b20]
sub eax, 6
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0x2d6c], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2d74], eax
cmp dword [ebp - 0x4d0], 0
jne 0x469dc4
cmp dword [ebp - 0x4d0], 0
jne 0x469dc4
cmp dword [ebp - 0x4d0], 0
jne 0x469dc4
and dword [ebp - 0x1b28], 0
jmp 0x469dce
mov dword [ebp - 0x1b28], 1
cmp dword [ebp - 0x1b28], 0xd1cb6a7f
jb 0x469de6
mov dword [ebp - 0xcac], 1
jmp 0x469ded
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0xcac]
imul eax, dword [ebp - 0xdc]
mov dword [ebp - 0x988], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x988]
mov dword [ebp + eax - 0x242c], ecx
push 0
lea ecx, [ebp - 0x2a44]
call fcn.00431f15
mov ecx, dword [ebp - 0x988]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x988], eax
jne 0x469e46
xor eax, eax
je 0x469e46
mov dword [ebp - 0x1b30], 1
jmp 0x469e4d
and dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x4d0]
cmp dword [ebp - 0x1b30], eax
jne 0x469e67
mov dword [ebp - 0xcb4], 1
jmp 0x469e6e
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0x1b38], eax
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x1b38], eax
jle 0x469e94
mov dword [ebp - 0xcc4], 1
jmp 0x469e9b
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0x1b40], eax
mov eax, dword [ebp - 0x1b40]
cmp eax, dword [ebp - 0xcc4]
jle 0x469ec1
mov dword [ebp - 0x1b48], 1
jmp 0x469ec8
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x1b48]
mov dword [ebp - 0x4d0], eax
lea ecx, [ebp - 0x2a44]
call fcn.00431ef9
jmp 0x469c82
mov eax, dword [ebp - 0xccc]
dec eax
mov dword [ebp - 0xccc], eax
push 4
lea ecx, [ebp - 0x29e4]
call fcn.00431e27
mov dword [ebp - 0x104], 0xfffffffb
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x650], 0
jmp 0x469f2b
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 2
jge 0x469f47
mov eax, dword [ebp - 0x650]
mov dword [ebp + eax*4 - 0xad0], 0xffffffff
jmp 0x469f1e
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x104], eax
jne 0x469f61
mov dword [ebp - 0xcd4], 1
jmp 0x469f68
and dword [ebp - 0xcd4], 0
cmp dword [ebp - 0x104], 0x5ee28fde
jl 0x469f80
mov dword [ebp - 0x1b50], 1
jmp 0x469f87
and dword [ebp - 0x1b50], 0
imul eax, dword [ebp - 0x1b50], 0xd9ba
sub eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xcd4], eax
jl 0x469fab
mov dword [ebp - 0x1b58], 1
jmp 0x469fb2
and dword [ebp - 0x1b58], 0
cmp dword [ebp - 0x1b58], 0xcfb6
jne 0x469fca
mov dword [ebp - 0xcdc], 1
jmp 0x469fd1
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x469fff
cmp dword [ebp - 0xcc], 0
je 0x469fff
xor eax, eax
je 0x469fff
mov dword [ebp - 0x1b60], 1
jmp 0x46a006
and dword [ebp - 0x1b60], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b60]
mov dword [ebp + eax - 0xad0], ecx
mov dword [ebp - 0x104], 0
jmp 0x46a032
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x15
jle 0x46a1c3
mov dword [ebp - 0xcc], 1
jmp 0x46a058
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x46a1be
mov dword [ebp - 0x2434], 0x3240
mov dword [ebp - 0xcf4], 0xf7e29192
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0xad0]
mov dword [ebp - 0x2d7c], eax
cmp dword [ebp - 0x2434], 2
jne 0x46a0a1
mov dword [ebp - 0xce4], 1
jmp 0x46a0a8
and dword [ebp - 0xce4], 0
cmp dword [ebp - 0x104], 6
jl 0x46a0bd
mov dword [ebp - 0x1b68], 1
jmp 0x46a0c4
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0xce4]
cmp eax, dword [ebp - 0x1b68]
jle 0x46a0de
mov dword [ebp - 0xcec], 1
jmp 0x46a0e5
and dword [ebp - 0xcec], 0
cmp dword [ebp - 0xcec], 0xff5ecce3
jb 0x46a0fd
mov dword [ebp - 0x1b70], 1
jmp 0x46a104
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0x1b70]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0xcc]
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0xcf4]
add edx, dword [ebp + ecx - 0xad0]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ebp + ecx*4 - 0xad0]
add ecx, edx
cmp ecx, dword [ebp + eax*4 - 0xad0]
jg 0x46a14d
mov dword [ebp - 0x1b78], 1
jmp 0x46a154
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x1b78], eax
jl 0x46a174
cmp dword [ebp - 0xcc], 0
jne 0x46a174
and dword [ebp - 0xcfc], 0
jmp 0x46a17e
mov dword [ebp - 0xcfc], 1
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0xad0]
add eax, dword [ebp - 0xcfc]
jne 0x46a19f
mov dword [ebp - 0x1b80], 1
jmp 0x46a1a6
and dword [ebp - 0x1b80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b80]
mov dword [ebp + eax - 0xad0], ecx
jmp 0x46a04b
jmp 0x46a025
mov dword [ebp - 0xf7c], 0xffffffff
mov dword [ebp - 0x888], 0
jmp 0x46a1e6
mov eax, dword [ebp - 0x888]
inc eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 3
jge 0x46a202
mov eax, dword [ebp - 0x888]
mov dword [ebp + eax*4 - 0x2594], 1
jmp 0x46a1d9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2594], 0
jmp 0x46a22d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2594]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2594], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2594], 0
jle 0x46a399
push 1
lea ecx, [ebp - 0x25a4]
call fcn.00431e27
push 2
lea ecx, [ebp - 0x1fe8]
call fcn.00431e27
mov dword [ebp - 0x180], 0
jmp 0x46a273
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x46a295
push dword [ebp - 0x180]
lea ecx, [ebp - 0x25a4]
call fcn.00431f15
mov dword [eax], 0x9b2cfb63
jmp 0x46a266
mov dword [ebp - 0x180], 0
jmp 0x46a2ae
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x46a2d0
push dword [ebp - 0x180]
lea ecx, [ebp - 0x1fe8]
call fcn.00431f15
mov dword [eax], 0xfffffffe
jmp 0x46a2a1
push 1
lea ecx, [ebp - 0x1fe8]
call fcn.00431f15
and dword [eax], 0
jmp 0x46a306
push 1
lea ecx, [ebp - 0x1fe8]
call fcn.00431f15
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0xd04]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd04]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1fe8]
call fcn.00431f15
cmp dword [eax], 0
jg 0x46a354
push 1
lea ecx, [ebp - 0x1fe8]
call fcn.00431f15
push dword [eax]
lea ecx, [ebp - 0x25a4]
call fcn.00431f15
mov esi, eax
push 1
lea ecx, [ebp - 0x1fe8]
call fcn.00431f15
push dword [eax]
lea ecx, [ebp - 0x25a4]
call fcn.00431f15
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x46a2e2
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2594], 0
je 0x46a37e
lea ecx, [ebp - 0x1fe8]
call fcn.00431ef9
lea ecx, [ebp - 0x25a4]
call fcn.00431ef9
jmp 0x46a214
lea ecx, [ebp - 0x1fe8]
call fcn.00431ef9
lea ecx, [ebp - 0x25a4]
call fcn.00431ef9
jmp 0x46a214
mov dword [ebp - 0x188], 1
push 3
lea ecx, [ebp - 0x3184]
call fcn.00431e27
mov dword [ebp - 0x1b88], 0
mov dword [ebp - 0x243c], 0x53f3ac9d
mov dword [ebp - 0x20c], 0
jmp 0x46a3dd
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x46a3f9
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xd0c], 0x689351f2
jmp 0x46a3d0
mov dword [ebp - 0x20c], 0
jmp 0x46a412
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x46a434
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x3184]
call fcn.00431f15
mov dword [eax], 6
jmp 0x46a405
mov dword [ebp - 0x188], 0
jmp 0x46a44d
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x1c
jne 0x46a4a3
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x434], 0
jmp 0x46a479
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jg 0x46a496
mov eax, dword [ebp - 0x434]
cmp dword [ebp + eax*4 - 0xd0c], 0
je 0x46a494
jmp 0x46a496
jmp 0x46a46c
cmp dword [ebp - 0x434], 0
je 0x46a4a1
jmp 0x46a4a3
jmp 0x46a440
mov eax, dword [ebp - 0x1b88]
inc eax
mov dword [ebp - 0x1b88], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0c], 0xbdac
jne 0x46a4cf
mov dword [ebp - 0x1b90], 1
jmp 0x46a4d6
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0x243c]
mov dword [ebp - 0x2d84], eax
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x1b90]
test eax, eax
je 0x46a53a
mov dword [ebp - 0x188], 2
jmp 0x46a50c
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x46a538
mov byte [ebp - 0x400], 0
movzx eax, byte [ebp - 0x400]
test eax, eax
je 0x46a536
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x46a4ff
jmp 0x46a56a
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x46a56a
push 0x1800
push 0xa7a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
lea ecx, [ebp - 0x3184]
call fcn.00431ef9
mov dword [ebp - 0x658], 0
jmp 0x46a58e
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 4
jge 0x46a5b0
push dword [ebp - 0x658]
lea ecx, [ebp - 0x29e4]
call fcn.00431f15
mov dword [eax], 0x8ebdb88d
jmp 0x46a581
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x118], 0xcadd635
mov dword [ebp - 0x2454], 0xffffffff
mov dword [ebp - 0x2d8c], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2d94], eax
cmp dword [ebp - 0x44], 0
jne 0x46a60f
cmp dword [ebp - 0x44], 1
je 0x46a5f6
mov dword [ebp - 0x2444], 1
jmp 0x46a5fd
and dword [ebp - 0x2444], 0
push 0xfffffffffffffffe
pop eax
inc eax
cmp eax, dword [ebp - 0x44]
jne 0x46a60f
and dword [ebp - 0xd14], 0
jmp 0x46a619
mov dword [ebp - 0xd14], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xd14], eax
je 0x46a630
mov dword [ebp - 0x244c], 1
jmp 0x46a637
and dword [ebp - 0x244c], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2d9c], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jge 0x46a654
mov dword [ebp - 0x1b98], 1
jmp 0x46a65b
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1b98], eax
je 0x46a672
mov dword [ebp - 0xd1c], 1
jmp 0x46a679
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xd1c], eax
jg 0x46a690
mov dword [ebp - 0x1ba0], 1
jmp 0x46a697
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x1ba0]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xce96f8f
jg 0x46a6bb
mov dword [ebp - 0xd24], 1
jmp 0x46a6c2
and dword [ebp - 0xd24], 0
cmp dword [ebp - 0xd24], 0xd02e889e
jbe 0x46a6d4
cmp dword [ebp - 0x44], 0
jne 0x46a6e6
cmp dword [ebp - 0x118], 0
jne 0x46a6e6
and dword [ebp - 0x1ba8], 0
jmp 0x46a6f0
mov dword [ebp - 0x1ba8], 1
cmp dword [ebp - 0x1ba8], 1
je 0x46a705
mov dword [ebp - 0xd2c], 1
jmp 0x46a70c
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xd2c]
je 0x46a738
mov byte [ebp - 0x402], 0
movzx eax, byte [ebp - 0x402]
test eax, eax
je 0x46a736
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
jmp 0x46a742
mov dword [ebp - 0x118], 0x881826fb
cmp dword [ebp - 0x118], 0
je 0x46a75d
cmp dword [ebp - 0x44], 0
je 0x46a75d
mov dword [ebp - 0x1bb0], 1
jmp 0x46a764
and dword [ebp - 0x1bb0], 0
cmp dword [ebp - 0x44], 0xd538
jl 0x46a779
mov dword [ebp - 0xd34], 1
jmp 0x46a780
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x1bb0]
cmp eax, dword [ebp - 0xd34]
jl 0x46a79a
mov dword [ebp - 0x1bb8], 1
jmp 0x46a7a1
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1bb8], eax
jge 0x46a7b8
mov dword [ebp - 0xd3c], 1
jmp 0x46a7bf
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xd3c], eax
jne 0x46a7d9
mov dword [ebp - 0x1bc0], 1
jmp 0x46a7e0
and dword [ebp - 0x1bc0], 0
mov eax, dword [ebp - 0x1bc0]
sub eax, dword [ebp - 0x118]
cmp dword [ebp - 0x118], eax
jle 0x46a800
mov dword [ebp - 0xd44], 1
jmp 0x46a807
and dword [ebp - 0xd44], 0
cmp dword [ebp - 0xd44], 0x712bad47
jle 0x46a81f
mov dword [ebp - 0x1bc8], 1
jmp 0x46a826
and dword [ebp - 0x1bc8], 0
cmp dword [ebp - 0x1bc8], 0xfffffffa
jl 0x46a83b
mov dword [ebp - 0xd4c], 1
jmp 0x46a842
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x2454]
cmp dword [ebp - 0xd4c], eax
je 0x46a85c
mov dword [ebp - 0x1bd0], 1
jmp 0x46a863
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1bd0], eax
jl 0x46a87d
lea ecx, [ebp - 0x2a5c]
call fcn.00431ef9
mov dword [ebp - 0x138], 0x41e5
push 2
lea ecx, [ebp - 0x31a4]
call fcn.00431e27
mov dword [ebp - 0x6b0], 0
jmp 0x46d749
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 2
jge 0x46d768
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x31a4]
call fcn.00431f15
and dword [eax], 0
jmp 0x46d73c
mov byte [ebp - 0x3a5], 0
movzx eax, byte [ebp - 0x3a5]
test eax, eax
je 0x46d782
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
cmp dword [ebp - 0x138], 0
je 0x46d880
push 3
lea ecx, [ebp - 0x2a74]
call fcn.00431e27
mov dword [ebp - 0x1a8], 0
jmp 0x46d7b5
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x46d7d7
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x2a74]
call fcn.00431f15
mov dword [eax], 0x9807
jmp 0x46d7a8
mov dword [ebp - 0x1a8], 0
jmp 0x46d7f0
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x46d80c
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x3540], 6
jmp 0x46d7e3
push 1
lea ecx, [ebp - 0x2a74]
call fcn.00431f15
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [eax]
mov dword [ebp + ecx - 0x3540], eax
mov dword [ebp - 0x138], 0xfffffff4
jmp 0x46d841
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x33
jne 0x46d870
mov byte [ebp - 0x410], 0
movzx eax, byte [ebp - 0x410]
test eax, eax
je 0x46d86e
push 0x1f45
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x46d834
lea ecx, [ebp - 0x2a74]
call fcn.00431ef9
jmp 0x46d9b8
mov dword [ebp - 0x9d8], 1
mov dword [ebp - 0xf84], 0xfebfb2c4
mov dword [ebp - 0x231c], 0x99cdf9c7
mov dword [ebp - 0x138], 0
jmp 0x46d8b7
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jg 0x46d95a
mov dword [ebp - 0x4d4], 8
mov eax, dword [ebp - 0x4d4]
dec eax
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x4d4], 0
jmp 0x46d8f4
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 1
jg 0x46d955
mov dword [ebp - 0x8a0], 0x4eb4c8f0
mov dword [ebp - 0x8a0], 0
jmp 0x46d920
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 1
jg 0x46d953
mov byte [ebp - 0x3ad], 0
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x46d951
push 0x1bc9
push 0
push 0
push 0x1f73
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x46d913
jmp 0x46d8e7
jmp 0x46d8aa
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x21bc], eax
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x2168], eax
mov eax, dword [ebp - 0x9d8]
dec eax
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x21bc]
cmp eax, dword [ebp - 0x2168]
jge 0x46d999
mov dword [ebp - 0x1e00], 1
jmp 0x46d9a0
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x1e00]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0xf84]
mov dword [ebp - 0x231c], eax
lea ecx, [ebp - 0x31a4]
call fcn.00431ef9
cmp dword [ebp + 8], 2
jl 0x47930f
mov dword [ebp - 0x2c4], 0xd67a4bed
mov dword [ebp - 0x1e08], 0
push 2
lea ecx, [ebp - 0x2a8c]
call fcn.00431e27
mov dword [ebp - 0xac0], 0x46773196
mov dword [ebp - 0x9e0], 0xb903cfcb
mov dword [ebp - 0x1e10], 0xf551
mov dword [ebp - 0xf9c], 0xe01e6e83
mov dword [ebp - 0x2178], 0xf6a1
mov dword [ebp - 0x6b8], 0
jmp 0x46da39
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 2
jge 0x46da5b
push dword [ebp - 0x6b8]
lea ecx, [ebp - 0x2a8c]
call fcn.00431f15
mov dword [eax], 0x26c12a7b
jmp 0x46da2c
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2ebc], eax
mov dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2ec4], eax
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x2ecc], eax
push 1
lea ecx, [ebp - 0x2a8c]
call fcn.00431f15
mov dword [eax], 0xac7a8cf1
mov eax, 0x6ff18ee8
sub eax, 8
sub eax, dword [ebp - 0x2c4]
cmp eax, 0xac7a8cf1
jl 0x46dabd
mov dword [ebp - 0x2170], 1
jmp 0x46dac4
and dword [ebp - 0x2170], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2ed4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2edc], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x1e08], eax
mov eax, dword [ebp - 0x1e08]
mov dword [ebp - 0x2ee4], eax
cmp dword [ebp - 0x2c4], 2
jae 0x46db12
cmp dword [ebp - 0x9e0], 0
je 0x46db12
mov dword [ebp - 0xf8c], 1
jmp 0x46db19
and dword [ebp - 0xf8c], 0
mov eax, dword [ebp - 0xf8c]
mov dword [ebp - 0x1e10], eax
mov eax, dword [ebp - 0xf9c]
cmp dword [ebp - 0x1e10], eax
je 0x46db3f
mov dword [ebp - 0xf94], 1
jmp 0x46db46
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0xf94]
neg eax
cmp dword [ebp - 0x2c4], eax
jl 0x46db62
mov dword [ebp - 0x1e18], 1
jmp 0x46db69
and dword [ebp - 0x1e18], 0
cmp dword [ebp - 0x1e18], 0xe40
jl 0x46db81
mov dword [ebp - 0x2324], 1
jmp 0x46db88
and dword [ebp - 0x2324], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x2eec], eax
mov eax, dword [ebp - 0xf9c]
mov dword [ebp - 0x2ef4], eax
mov eax, dword [ebp - 0xac0]
neg eax
cmp eax, 0x1372
jg 0x46dbc2
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x46dbc2
mov dword [ebp - 0x1e20], 1
jmp 0x46dbc9
and dword [ebp - 0x1e20], 0
mov eax, dword [ebp - 0x9e0]
cmp dword [ebp - 0x1e20], eax
jle 0x46dbe3
mov dword [ebp - 0xfa4], 1
jmp 0x46dbea
and dword [ebp - 0xfa4], 0
mov eax, dword [ebp - 0xfa4]
mov dword [ebp - 0x2178], eax
lea ecx, [ebp - 0x2a8c]
call fcn.00431ef9
mov dword [ebp - 0x800], 0xd6c05baf
mov dword [ebp - 0x2efc], 7
mov dword [ebp - 0x800], 0xffffffe5
jmp 0x46dc2e
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 0x11
jl 0x46dcd8
push 1
lea ecx, [ebp - 0x2ae0]
call fcn.00431e27
mov dword [ebp - 0x584], 0xfffffff7
mov dword [ebp - 0x6c0], 0
jmp 0x46dc6b
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 1
jge 0x46dc8d
push dword [ebp - 0x6c0]
lea ecx, [ebp - 0x2ae0]
call fcn.00431f15
mov dword [eax], 1
jmp 0x46dc5e
mov dword [ebp - 0x584], 0
jmp 0x46dca6
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 1
jge 0x46dcc8
push dword [ebp - 0x584]
lea ecx, [ebp - 0x2ae0]
call fcn.00431f15
mov dword [eax], 0x3248c66f
jmp 0x46dc99
lea ecx, [ebp - 0x2ae0]
call fcn.00431ef9
jmp 0x46dc21
mov dword [ebp - 0x6c8], 0x3367f5ed
mov dword [ebp - 0x49c], 4
mov dword [ebp - 0x1e28], 1
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x930], 0
jmp 0x46dd19
mov eax, dword [ebp - 0x930]
inc eax
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x930], 2
jge 0x46dd35
mov eax, dword [ebp - 0x930]
mov dword [ebp + eax*4 - 0x20b8], 0
jmp 0x46dd0c
mov eax, dword [ebp - 0x6c8]
cmp dword [ebp - 0x6c8], eax
jge 0x46dd4f
mov dword [ebp - 0x232c], 1
jmp 0x46dd56
and dword [ebp - 0x232c], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x6c8], eax
jle 0x46dd7c
mov dword [ebp - 0x2180], 1
jmp 0x46dd83
and dword [ebp - 0x2180], 0
mov dword [ebp - 0x1e28], 0xffffffff
mov eax, dword [ebp - 0x1e28]
mov dword [ebp - 0x2f04], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2f0c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2f14], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2f1c], eax
push 4
pop eax
shl eax, 0
mov ecx, 0xb66f
sub ecx, dword [ebp + eax - 0x20b8]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x20b8]
je 0x46de70
mov dword [ebp - 0x44c], 0x4f5a
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x9c], 0
jmp 0x46de11
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jg 0x46de6e
mov dword [ebp - 0x44c], 0
jmp 0x46de33
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 1
jg 0x46de6c
mov eax, dword [ebp - 0x44c]
cmp dword [ebp + eax*4 - 0x20b8], 0
je 0x46de4e
jmp 0x46de6c
mov byte [ebp - 0x412], 0
movzx eax, byte [ebp - 0x412]
test eax, eax
je 0x46de6a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x46de26
jmp 0x46de04
jmp 0x46deca
mov dword [ebp - 0x49c], 0
jmp 0x46de89
mov eax, dword [ebp - 0x49c]
dec eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0xfffffff9
jg 0x46deca
mov dword [ebp - 0x9c], 0
jmp 0x46deab
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jg 0x46dec8
mov eax, dword [ebp - 0x9c]
cmp dword [ebp + eax*4 - 0x20b8], 0
je 0x46dec6
jmp 0x46dec8
jmp 0x46de9e
jmp 0x46de7c
mov dword [ebp - 0x708], 0x25b9b55b
mov dword [ebp - 0x1b0], 2
mov dword [ebp - 0xfb4], 0xfffffffc
mov dword [ebp - 0x2334], 5
mov dword [ebp - 0x2f24], 0xc82f744e
mov dword [ebp - 0x2f2c], 0
mov dword [ebp - 0x2f34], 0
mov dword [ebp - 0x2f3c], 1
mov dword [ebp - 0x2f44], 0xc6a687e9
mov dword [ebp - 0x2f4c], 0
mov dword [ebp - 0x2f54], 9
mov dword [ebp - 0x2f5c], 1
mov dword [ebp - 0x2f64], 0x96354d18
mov dword [ebp - 0x341c], 0xe38e
mov dword [ebp - 0x3418], 0xe38e
mov dword [ebp - 0x3414], 0xe38e
mov dword [ebp - 0x3410], 0xe38e
mov dword [ebp - 0x2f6c], 0xd14a
mov dword [ebp - 0x1e58], 9
mov dword [ebp - 0x234], 0
jmp 0x46dfa1
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x46dfbd
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x3624], 0xefc7127b
jmp 0x46df94
mov dword [ebp - 0x234], 0
jmp 0x46dfd6
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x46dff2
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x3618], 0x5ac8
jmp 0x46dfc9
mov dword [ebp - 0x1b0], 0x12
jmp 0x46e00b
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffec
jge 0x46e256
mov dword [ebp - 0x2828], 0xab27
mov dword [ebp - 0x2824], 0xab27
mov dword [ebp - 0x2820], 0xab27
mov dword [ebp - 0x281c], 0xab27
lea ecx, [ebp - 0xa99]
call fcn.00431f24
push eax
lea eax, [ebp - 0x2818]
push eax
lea eax, [ebp - 0x2828]
push eax
lea ecx, [ebp - 0x35a0]
call fcn.00431f27
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2130]
call fcn.00431ed3
mov dword [ebp - 0x52c], 0xddac
push 0
lea ecx, [ebp - 0x2130]
call fcn.00431f15
mov eax, dword [ebp - 0x52c]
imul eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x1b0]
jne 0x46e0b6
mov eax, 0xf9db
test eax, eax
je 0x46e0b6
mov dword [ebp - 0xfac], 1
jmp 0x46e0bd
and dword [ebp - 0xfac], 0
mov eax, dword [ebp - 0x52c]
add eax, dword [ebp - 0xfac]
cmp eax, dword [ebp - 0x1b0]
jge 0x46e0dd
mov dword [ebp - 0x1e30], 1
jmp 0x46e0e4
and dword [ebp - 0x1e30], 0
mov eax, dword [ebp - 0x1e30]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0xfb4], eax
jl 0x46e10a
mov dword [ebp - 0x1e38], 1
jmp 0x46e111
and dword [ebp - 0x1e38], 0
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0x1e38], eax
jne 0x46e134
cmp dword [ebp - 0x52c], 0
je 0x46e134
mov dword [ebp - 0xfbc], 1
jmp 0x46e13b
and dword [ebp - 0xfbc], 0
push 2
lea ecx, [ebp - 0x2130]
call fcn.00431f15
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfbc]
jl 0x46e15e
mov dword [ebp - 0x1e40], 1
jmp 0x46e165
and dword [ebp - 0x1e40], 0
cmp dword [ebp - 0x1e40], 0xabef
jg 0x46e17d
mov dword [ebp - 0xfc4], 1
jmp 0x46e184
and dword [ebp - 0xfc4], 0
push 1
lea ecx, [ebp - 0x2130]
call fcn.00431f15
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfc4]
jle 0x46e1a7
mov dword [ebp - 0x1e48], 1
jmp 0x46e1ae
and dword [ebp - 0x1e48], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x1e48], eax
jl 0x46e1c8
mov dword [ebp - 0xfcc], 1
jmp 0x46e1cf
and dword [ebp - 0xfcc], 0
mov eax, dword [ebp - 0x52c]
imul eax, dword [ebp - 0xfcc]
test eax, eax
jne 0x46e1f2
mov eax, 0x1d9
test eax, eax
jne 0x46e1f2
and dword [ebp - 0x1e50], 0
jmp 0x46e1fc
mov dword [ebp - 0x1e50], 1
push 1
lea ecx, [ebp - 0x2130]
call fcn.00431f15
mov eax, dword [eax]
add eax, 0x86bd
cmp eax, dword [ebp - 0x1e50]
je 0x46e224
mov dword [ebp - 0xfd4], 1
jmp 0x46e22b
and dword [ebp - 0xfd4], 0
push 1
lea ecx, [ebp - 0x2130]
call fcn.00431f15
mov ecx, dword [ebp - 0xfd4]
add ecx, dword [eax]
mov dword [ebp - 0x2334], ecx
lea ecx, [ebp - 0x2130]
call fcn.00431ef9
jmp 0x46dffe
mov eax, dword [ebp - 0x1e58]
inc eax
mov dword [ebp - 0x1e58], eax
mov dword [ebp - 0x2f74], 0x77cce45d
push 1
lea ecx, [ebp - 0x2774]
call fcn.00431e27
mov dword [ebp - 0x454], 0x8094a188
mov dword [ebp - 0x808], 0
jmp 0x46e29d
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 1
jge 0x46e2bf
push dword [ebp - 0x808]
lea ecx, [ebp - 0x2774]
call fcn.00431f15
mov dword [eax], 0x9f9b3198
jmp 0x46e290
mov dword [ebp - 0x454], 0
jmp 0x46e2d8
mov eax, dword [ebp - 0x454]
dec eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x46e30b
push dword [ebp - 0x454]
lea ecx, [ebp - 0x2774]
call fcn.00431f15
mov esi, eax
push dword [ebp - 0x454]
lea ecx, [ebp - 0x2774]
call fcn.00431f15
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x46e2cb
lea ecx, [ebp - 0x2774]
call fcn.00431ef9
mov dword [ebp - 0x2f7c], 0x95ff79fa
mov dword [ebp - 0x2f84], 0x1151c3c3
mov dword [ebp - 0x2f8c], 0x9f6d4a0d
mov dword [ebp - 0x2f94], 0xfffffffb
mov dword [ebp - 0x2f9c], 0x80fc3a06
mov dword [ebp - 0x2fa4], 0x8f4f823a
mov dword [ebp - 0x2fac], 0xfffffffa
push 1
lea ecx, [ebp - 0x31b4]
call fcn.00431e27
mov dword [ebp - 0x23c], 0
jmp 0x46e382
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x46e39e
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x25b4], 0xfffffffd
jmp 0x46e375
mov dword [ebp - 0x23c], 0
jmp 0x46e3b7
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x46e3d9
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x31b4]
call fcn.00431f15
mov dword [eax], 1
jmp 0x46e3aa
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x25b4], 3
jmp 0x46e404
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x25b4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x25b4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x25b4], 8
jg 0x46e549
mov dword [ebp - 0x6d0], 1
mov dword [ebp - 0x2fb4], 0xf5ed9a92
mov dword [ebp - 0x2fbc], 0x963ba20b
mov dword [ebp - 0x2fc4], 3
mov dword [ebp - 0x2fcc], 0xf0d0714a
mov dword [ebp - 0x2fd4], 0xebfb2c41
mov dword [ebp - 0x2fdc], 1
mov dword [ebp - 0x2fe4], 0x9cb0befc
mov dword [ebp - 0x2fec], 0xb4f5ac3d
mov dword [ebp - 0x2ff4], 0
mov dword [ebp - 0x2ffc], 0x335c
mov dword [ebp - 0x28a0], 2
mov dword [ebp - 0x289c], 2
mov dword [ebp - 0x2898], 2
mov dword [ebp - 0x2894], 2
lea ecx, [ebp - 0xaa1]
call fcn.00431f24
push eax
lea eax, [ebp - 0x2890]
push eax
lea eax, [ebp - 0x28a0]
push eax
lea ecx, [ebp - 0x35e8]
call fcn.00431f27
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3558]
call fcn.00431ed3
mov dword [ebp - 0x3004], 0xa08b
mov dword [ebp - 0xfdc], 1
mov dword [ebp - 0x6d0], 0xffffffe9
jmp 0x46e50f
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0x12
jle 0x46e52c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25b4], 0
je 0x46e52a
jmp 0x46e52c
jmp 0x46e502
mov eax, dword [ebp - 0xfdc]
inc eax
mov dword [ebp - 0xfdc], eax
lea ecx, [ebp - 0x3558]
call fcn.00431ef9
jmp 0x46e3eb
lea ecx, [ebp - 0x31b4]
call fcn.00431ef9
mov dword [ebp - 0x300c], 1
mov dword [ebp - 0x3014], 0xc34ccbb2
mov dword [ebp - 0x2188], 0xd3f7bf48
mov dword [ebp - 0x8a8], 0
jmp 0x46e58b
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 3
jge 0x46e5a7
mov eax, dword [ebp - 0x8a8]
mov dword [ebp + eax*4 - 0x25c4], 5
jmp 0x46e57e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x25c4], 4
jmp 0x46e5d5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x25c4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x25c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25c4], 0xfffffffe
je 0x46e6a7
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0x6d8], 0
jmp 0x46e60c
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 2
jge 0x46e628
mov eax, dword [ebp - 0x6d8]
mov dword [ebp + eax*4 - 0x2ca0], 1
jmp 0x46e5ff
mov dword [ebp - 0x5ac], 1
jmp 0x46e641
cmp dword [ebp - 0x5ac], 0
jl 0x46e690
mov byte [ebp - 0x3b5], 0
movzx eax, byte [ebp - 0x3b5]
test eax, eax
je 0x46e67c
push 0xe03
push 0xf09
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp + eax*4 - 0x2ca0], 0
je 0x46e68e
jmp 0x46e690
jmp 0x46e634
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x25c4]
mov dword [ebp - 0x2188], eax
jmp 0x46e5ba
mov dword [ebp - 0x301c], 0xc321a078
mov dword [ebp - 0xd4], 0xfffffff7
mov dword [ebp - 0x26cc], 0
mov dword [ebp - 0x26c8], 0
mov dword [ebp - 0x26c4], 0
mov dword [ebp - 0x26c0], 0
mov dword [ebp - 0x9e8], 0xffffffff
mov dword [ebp - 0x1e88], 8
mov dword [ebp - 0x2198], 0xffffffff
mov dword [ebp - 0xd4], 0
jmp 0x46e71a
cmp dword [ebp - 0xd4], 0x1b
je 0x46ed47
push 1
lea ecx, [ebp - 0x2018]
call fcn.00431e27
push 2
lea ecx, [ebp - 0xb94]
call fcn.00431e27
mov dword [ebp - 0x1b8], 0
jmp 0x46e75a
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x46e779
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x2018]
call fcn.00431f15
or dword [eax], 0xffffffff
jmp 0x46e74d
mov dword [ebp - 0x1b8], 0
jmp 0x46e792
cmp dword [ebp - 0x1b8], 2
jge 0x46e7b4
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0xb94]
call fcn.00431f15
mov dword [eax], 0x377963f6
jmp 0x46e785
push 0
lea ecx, [ebp - 0x2018]
call fcn.00431f15
mov dword [eax], 0x18
jmp 0x46e7ed
mov dword [ebp - 0x302c], 0xfffffffb
mov dword [ebp - 0x6e0], 0xc204e2db
mov byte [ebp - 0x414], 0
movzx eax, byte [ebp - 0x414]
test eax, eax
je 0x46ed7e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x6e0], 0xfffffffa
jmp 0x46ed97
cmp dword [ebp - 0x6e0], 0x14
jge 0x46eddb
mov byte [ebp - 0x3bd], 0
movzx eax, byte [ebp - 0x3bd]
test eax, eax
je 0x46edbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov byte [ebp - 0x416], 0
movzx eax, byte [ebp - 0x416]
test eax, eax
je 0x46edd9
mov dword [ebp - 0x3034], 0xaa83fb18
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x8f8], 0
jmp 0x46ee08
cmp dword [ebp - 0x8f8], 3
jge 0x46ee24
cmp dword [ebp + 8], 1
jne 0x47ba71
push 2
lea ecx, [ebp - 0x29f0]
call fcn.00431e27
push 3
lea ecx, [ebp - 0x210c]
call fcn.00431e27
mov dword [ebp - 0x148], 0
jmp 0x47934c
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x47936b
push dword [ebp - 0x148]
lea ecx, [ebp - 0x29f0]
call fcn.00431f15
and dword [eax], 0
jmp 0x47933f
mov dword [ebp - 0x148], 0
jmp 0x479384
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x4793a6
push dword [ebp - 0x148]
lea ecx, [ebp - 0x210c]
call fcn.00431f15
mov dword [eax], 0xade19d29
jmp 0x479377
mov byte [ebp - 0x30f], 0
movzx eax, byte [ebp - 0x30f]
test eax, eax
je 0x4793c2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
lea ecx, [ebp - 0x210c]
call fcn.00431f15
and dword [eax], 0
jmp 0x4793f8
push 1
lea ecx, [ebp - 0x210c]
call fcn.00431f15
mov dword [ebp - 0x1120], eax
mov eax, dword [ebp - 0x1120]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1120]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x210c]
call fcn.00431f15
cmp dword [eax], 2
jge 0x47942c
push 1
lea ecx, [ebp - 0x210c]
call fcn.00431f15
push dword [eax]
lea ecx, [ebp - 0x29f0]
call fcn.00431f15
mov dword [eax], 1
jmp 0x4793d4
lea ecx, [ebp - 0x210c]
call fcn.00431ef9
lea ecx, [ebp - 0x29f0]
call fcn.00431ef9
mov dword [ebp - 0x73c], 1
mov dword [ebp - 0x73c], 0
jmp 0x479465
mov eax, dword [ebp - 0x73c]
dec eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0xfffffff3
jge 0x47948a
mov byte [ebp - 0x413], 0
movzx eax, byte [ebp - 0x413]
test eax, eax
je 0x479488
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x479458
mov byte [ebp - 0x311], 0
movzx eax, byte [ebp - 0x311]
test eax, eax
je 0x4794a4
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x3cc], 0xa4a1
mov dword [ebp - 0x744], 0
mov dword [ebp - 0x538], 0xe263
mov dword [ebp - 0x3d4], 8
mov dword [ebp - 0x1198], 0xf7f77771
mov eax, dword [ebp - 0x3cc]
add eax, 6
mov dword [ebp - 0x744], eax
je 0x479501
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x479501
mov dword [ebp - 0x1160], 1
jmp 0x479508
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x538]
add eax, 0x574b
cmp eax, dword [ebp - 0x538]
jg 0x479527
mov dword [ebp - 0x1128], 1
jmp 0x47952e
and dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x1128], eax
jl 0x479551
cmp dword [ebp - 0x3cc], 0
je 0x479551
mov dword [ebp - 0x1130], 1
jmp 0x479558
and dword [ebp - 0x1130], 0
mov eax, dword [ebp - 0x538]
cmp eax, dword [ebp - 0x1130]
jg 0x479572
mov dword [ebp - 0x1138], 1
jmp 0x479579
and dword [ebp - 0x1138], 0
cmp dword [ebp - 0x1138], 0x4a71a6e4
jne 0x479591
mov dword [ebp - 0x1140], 1
jmp 0x479598
and dword [ebp - 0x1140], 0
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x1140], eax
jge 0x4795b2
mov dword [ebp - 0x1148], 1
jmp 0x4795b9
and dword [ebp - 0x1148], 0
mov eax, dword [ebp - 0x3d4]
imul eax, dword [ebp - 0x1148]
sub eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x538]
cmp eax, dword [ebp - 0x3d4]
jg 0x4795ea
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x4795ea
and dword [ebp - 0x24c0], 0
jmp 0x4795f4
mov dword [ebp - 0x24c0], 1
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x2dc8], eax
cmp dword [ebp - 0x3cc], 0x8214
jne 0x479618
mov dword [ebp - 0x1150], 1
jmp 0x47961f
and dword [ebp - 0x1150], 0
cmp dword [ebp - 0x1150], 0
jl 0x47963d
cmp dword [ebp - 0x3d4], 0
je 0x47963d
mov dword [ebp - 0x1158], 1
jmp 0x479644
and dword [ebp - 0x1158], 0
cmp dword [ebp - 0x1158], 0x4d02
je 0x47965c
mov dword [ebp - 0x1168], 1
jmp 0x479663
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x1160]
cmp eax, dword [ebp - 0x1168]
jle 0x47967d
mov dword [ebp - 0x1170], 1
jmp 0x479684
and dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x1170]
neg eax
jne 0x479697
cmp dword [ebp - 0x3cc], 0
je 0x4796b2
mov dword [ebp - 0x2368], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x2368], eax
jmp 0x479791
mov dword [ebp - 0x74c], 0x5701832d
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x3338], eax
mov eax, dword [ebp - 0x74c]
cmp dword [ebp - 0x538], eax
jne 0x4796e2
mov dword [ebp - 0x1178], 1
jmp 0x4796e9
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x74c]
imul eax, dword [ebp - 0x1178]
cmp eax, 0xfffffff6
jae 0x479707
mov dword [ebp - 0x1180], 1
jmp 0x47970e
and dword [ebp - 0x1180], 0
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0x1180], eax
jle 0x479728
mov dword [ebp - 0x1188], 1
jmp 0x47972f
and dword [ebp - 0x1188], 0
mov eax, dword [ebp - 0x74c]
mov ecx, dword [ebp - 0x3d4]
add ecx, dword [ebp - 0x1188]
imul ecx, dword [ebp - 0x3d4]
imul eax, ecx
cmp eax, dword [ebp - 0x1198]
jle 0x47975f
mov dword [ebp - 0x2570], 1
jmp 0x479766
and dword [ebp - 0x2570], 0
cmp dword [ebp - 0x74c], 0x485bdf60
je 0x47977e
mov dword [ebp - 0x1190], 1
jmp 0x479785
and dword [ebp - 0x1190], 0
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x1458], 0x4dd03248
mov dword [ebp - 0x9e4], 0x20dd93ba
mov dword [ebp - 0x754], 0xec79e672
mov dword [ebp - 0x11b8], 0xbf90a233
mov dword [ebp - 0x438], 9
mov dword [ebp - 0x75c], 9
mov dword [ebp - 0x11d8], 0xae73
push 4
lea ecx, [ebp - 0x2798]
call fcn.00431e27
mov dword [ebp - 0x2624], 0xffffffff
mov dword [ebp - 0x2dd0], 0xfffe
mov dword [ebp - 0x14c], 0
jmp 0x479811
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x47982d
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x984], 0xfffffffa
jmp 0x479804
mov dword [ebp - 0x14c], 0
jmp 0x479846
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x479868
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x2798]
call fcn.00431f15
mov dword [eax], 0x5189d9e6
jmp 0x479839
xor eax, eax
inc eax
je 0x479882
cmp dword [ebp - 0x438], 0
je 0x479882
mov dword [ebp - 0x11a0], 1
jmp 0x479889
and dword [ebp - 0x11a0], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x11a0], eax
jle 0x4798a3
mov dword [ebp - 0x11a8], 1
jmp 0x4798aa
and dword [ebp - 0x11a8], 0
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0
je 0x4798d4
cmp dword [ebp - 0x75c], 0
je 0x4798d4
mov dword [ebp - 0x11b0], 1
jmp 0x4798db
and dword [ebp - 0x11b0], 0
mov eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0x11b0]
jl 0x4798f5
mov dword [ebp - 0x2370], 1
jmp 0x4798fc
and dword [ebp - 0x2370], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x30c8], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x2dd8], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x11b8], eax
jle 0x47993a
mov dword [ebp - 0x11c0], 1
jmp 0x479941
and dword [ebp - 0x11c0], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x11c0], eax
jle 0x47995b
mov dword [ebp - 0x11c8], 1
jmp 0x479962
and dword [ebp - 0x11c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x984]
cmp dword [ebp - 0x11c8], eax
jl 0x479983
mov dword [ebp - 0x11d0], 1
jmp 0x47998a
and dword [ebp - 0x11d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x984]
cmp dword [ebp - 0x11d0], eax
jl 0x4799ab
mov dword [ebp - 0x24c8], 1
jmp 0x4799b2
and dword [ebp - 0x24c8], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x336c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x984], 1
mov dword [ebp - 0x11d8], 1
mov eax, dword [ebp - 0x11d8]
mov dword [ebp - 0x11e0], eax
push 0
lea ecx, [ebp - 0x2798]
call fcn.00431f15
mov ecx, dword [ebp - 0x11e0]
mov dword [eax], ecx
cmp dword [ebp - 0x11e0], 0
jne 0x479a15
cmp dword [ebp - 0x75c], 0
jne 0x479a15
and dword [ebp - 0x2378], 0
jmp 0x479a1f
mov dword [ebp - 0x2378], 1
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x2de0], eax
push 0
lea ecx, [ebp - 0x2798]
call fcn.00431f15
mov eax, dword [eax]
mov dword [ebp - 0x2624], eax
lea ecx, [ebp - 0x2798]
call fcn.00431ef9
and dword [ebp - 0x28dc], 0
and dword [ebp - 0x28d8], 0
and dword [ebp - 0x28d4], 0
and dword [ebp - 0x28d0], 0
lea ecx, [ebp - 0xb3d]
call fcn.00431f24
push eax
lea eax, [ebp - 0x28cc]
push eax
lea eax, [ebp - 0x28dc]
push eax
lea ecx, [ebp - 0x3580]
call fcn.00431f27
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x32a4]
call fcn.00431ed3
mov dword [ebp - 0xe0], 0xd4e06482
mov dword [ebp - 0x1228], 0
mov dword [ebp - 0x11f0], 7
mov dword [ebp - 0x1240], 1
mov dword [ebp - 0xe0], 3
jmp 0x479add
cmp dword [ebp - 0xe0], 5
je 0x479d32
mov dword [ebp - 0x440], 0xfc2285fa
push 3
lea ecx, [ebp - 0x2b1c]
call fcn.00431e27
mov dword [ebp - 0x1218], 0x3acb6d64
mov dword [ebp - 0x154], 0
jmp 0x479b24
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x479b40
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x2380], 0xc4e2bf5f
jmp 0x479b17
mov dword [ebp - 0x154], 0
jmp 0x479b59
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x479b7b
push dword [ebp - 0x154]
lea ecx, [ebp - 0x2b1c]
call fcn.00431f15
mov dword [eax], 1
jmp 0x479b4c
cmp dword [ebp - 0xe0], 0
je 0x479b9f
imul eax, dword [ebp - 0x440], 0xe30f
cmp eax, 0xffffffff
jae 0x479b9f
and dword [ebp - 0x1220], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], eax
jne 0x479bc0
mov eax, dword [ebp - 0x1240]
dec eax
mov dword [ebp - 0x1240], eax
mov dword [ebp - 0x2814], 0xfffffffa
mov dword [ebp - 0x2810], 0xfffffffa
mov dword [ebp - 0x280c], 0xfffffffa
mov dword [ebp - 0x2808], 0xfffffffa
mov dword [ebp - 0x124], 0x53d8da8e
push 2
lea ecx, [ebp - 0x2a08]
call fcn.00431e27
mov dword [ebp - 0x764], 0
jmp 0x479d97
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 2
jge 0x479db9
push dword [ebp - 0x764]
lea ecx, [ebp - 0x2a08]
call fcn.00431f15
mov dword [eax], 0xfffffffc
jmp 0x479d8a
mov dword [ebp - 0x124], 0
jmp 0x479dd2
cmp dword [ebp - 0x124], 3
jg 0x47a0de
push 1
lea ecx, [ebp - 0x2088]
call fcn.00431e27
mov dword [ebp - 0x76c], 0x6f7fbf21
mov dword [ebp - 0x24d0], 1
mov dword [ebp - 0x5fc], 0
jmp 0x479e19
cmp dword [ebp - 0x5fc], 1
jge 0x479e3b
mov dword [ebp - 0x124], 0xfffffff4
jmp 0x47a0f7
cmp dword [ebp - 0x124], 0xffffffeb
jl 0x47a121
push 3
lea ecx, [ebp - 0x2bac]
call fcn.00431e27
mov dword [ebp - 0x2e40], 0x9be1d925
mov dword [ebp - 0x7c4], 0
push 3
lea ecx, [ebp - 0x32d4]
call fcn.00431e27
mov dword [ebp - 0x550], 0xfe662db8
mov dword [ebp - 0x15b0], 6
mov dword [ebp - 0x78], 0
jmp 0x47bac3
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x47badf
push dword [ebp - 0x78]
lea ecx, [ebp - 0x2bac]
call fcn.00431f15
mov dword [eax], 0xfffffffe
jmp 0x47babc
mov dword [ebp - 0x78], 0
jmp 0x47baef
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x47bb05
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x365c], 0xdf37d45d
jmp 0x47bae8
mov dword [ebp - 0x78], 0
jmp 0x47bb15
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x47bb31
push dword [ebp - 0x78]
lea ecx, [ebp - 0x32d4]
call fcn.00431f15
mov dword [eax], 0x9ee1c974
jmp 0x47bb0e
mov eax, dword [ebp - 0x15b0]
dec eax
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x7c4], 1
jmp 0x47bb57
mov eax, dword [ebp - 0x7c4]
dec eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0xfffffff5
jl 0x47bcbb
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x23c0], 2
mov dword [ebp - 0x550], 0
jmp 0x47bb91
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 8
jne 0x47bc95
mov dword [ebp - 0x27dc], 0x9a02
mov dword [ebp - 0x27d8], 0x9a02
mov dword [ebp - 0x27d4], 0x9a02
mov dword [ebp - 0x27d0], 0x9a02
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
jne 0x47bbe7
mov dword [ebp - 0xa0c], 1
jmp 0x47bbee
and dword [ebp - 0xa0c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa0c]
mov dword [ebp + eax - 0x27dc], ecx
cmp dword [ebp - 0xa0c], 0
je 0x47bc3b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x27dc], 0
je 0x47bc3b
push 2
lea ecx, [ebp - 0x2bac]
call fcn.00431f15
mov ecx, dword [ebp - 0x558]
cmp dword [eax], ecx
jge 0x47bc3b
mov dword [ebp - 0x15b8], 1
jmp 0x47bc42
and dword [ebp - 0x15b8], 0
mov eax, dword [ebp - 0x558]
cmp dword [ebp - 0x15b8], eax
jle 0x47bc5c
mov dword [ebp - 0x15c0], 1
jmp 0x47bc63
and dword [ebp - 0x15c0], 0
mov eax, dword [ebp - 0x558]
cmp eax, dword [ebp - 0x15c0]
jle 0x47bc7d
mov dword [ebp - 0x15c8], 1
jmp 0x47bc84
and dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c8]
mov dword [ebp - 0x23c0], eax
jmp 0x47bb84
mov byte [ebp - 0x317], 0
movzx eax, byte [ebp - 0x317]
test eax, eax
je 0x47bcb6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
jmp 0x47bb4a
lea ecx, [ebp - 0x32d4]
call fcn.00431ef9
lea ecx, [ebp - 0x2bac]
call fcn.00431ef9
mov dword [ebp - 0x3100], 1
mov byte [ebp - 0x415], 0
movzx eax, byte [ebp - 0x415]
test eax, eax
je 0x47bcf5
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x319], 0
movzx eax, byte [ebp - 0x319]
test eax, eax
je 0x47bd0f
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x2c8], 0xc443eb60
mov dword [ebp - 0x560], 0xea5d6c05
mov dword [ebp - 0x7dc], 0
mov dword [ebp - 0x15f8], 0
mov dword [ebp - 0x7cc], 0
jmp 0x47bd50
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 1
jge 0x47bd6c
mov eax, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0x24f0], 7
jmp 0x47bd43
mov dword [ebp - 0x560], 0
jmp 0x47bd85
mov eax, dword [ebp - 0x560]
dec eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0xfffffff8
jl 0x47bf63
mov dword [ebp - 0x7d4], 0
jmp 0x47bdab
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 2
jge 0x47bdc7
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0x226c], 1
jmp 0x47bd9e
mov eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x560], eax
je 0x47bde1
mov dword [ebp - 0xa14], 1
jmp 0x47bde8
and dword [ebp - 0xa14], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa14]
mov dword [ebp + eax - 0x24f0], ecx
cmp dword [ebp - 0xa14], 0
jne 0x47be16
mov eax, 0x7fa3
test eax, eax
jne 0x47be16
and dword [ebp - 0x15d0], 0
jmp 0x47be20
mov dword [ebp - 0x15d0], 1
mov eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x15d0], eax
jle 0x47be3a
mov dword [ebp - 0x15d8], 1
jmp 0x47be41
and dword [ebp - 0x15d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x226c]
cmp eax, dword [ebp - 0x15d8]
jge 0x47be62
mov dword [ebp - 0x15e0], 1
jmp 0x47be69
and dword [ebp - 0x15e0], 0
mov eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x15e0], eax
je 0x47be83
mov dword [ebp - 0x15e8], 1
jmp 0x47be8a
and dword [ebp - 0x15e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x226c]
cmp dword [ebp - 0x15e8], eax
jge 0x47beab
mov dword [ebp - 0x23c8], 1
jmp 0x47beb2
and dword [ebp - 0x23c8], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x2e48], eax
xor eax, eax
inc eax
cmp eax, 0xf4039ee4
jae 0x47bed4
mov dword [ebp - 0x15f0], 1
jmp 0x47bedb
and dword [ebp - 0x15f0], 0
cmp dword [ebp - 0x15f0], 0
je 0x47bf32
mov dword [ebp - 0x3360], 1
mov dword [ebp - 0x7e4], 0
jmp 0x47bf07
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 3
jge 0x47bf23
mov eax, dword [ebp - 0x7e4]
mov dword [ebp + eax*4 - 0x3630], 1
jmp 0x47befa
mov eax, dword [ebp - 0x15f8]
inc eax
mov dword [ebp - 0x15f8], eax
jmp 0x47bf5e
mov byte [ebp - 0x403], 0
movzx eax, byte [ebp - 0x403]
test eax, eax
je 0x47bf4c
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x226c], 0
je 0x47bf5e
jmp 0x47bf63
jmp 0x47bd78
mov dword [ebp - 0x17c0], 0xffffffff
push 2
lea ecx, [ebp - 0x2100]
call fcn.00431e27
push 3
lea ecx, [ebp - 0xba0]
call fcn.00431e27
mov dword [ebp - 0x2598], 0x77f1
mov dword [ebp - 0x1658], 0xfffffff8
mov dword [ebp - 0x1698], 0x39032f82
mov dword [ebp - 0x2e50], 0xbf567d71
mov dword [ebp - 0x174], 0
jmp 0x47bfc8
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x47bfea
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2100]
call fcn.00431f15
mov dword [eax], 0xfffffffd
jmp 0x47bfbb
mov dword [ebp - 0x174], 0
jmp 0x47c003
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x47c022
push dword [ebp - 0x174]
lea ecx, [ebp - 0xba0]
call fcn.00431f15
and dword [eax], 0
jmp 0x47bff6
push 1
lea ecx, [ebp - 0xba0]
call fcn.00431f15
mov dword [eax], 1
jmp 0x47c05b
push 1
lea ecx, [ebp - 0xba0]
call fcn.00431f15
mov dword [ebp - 0x1600], eax
mov eax, dword [ebp - 0x1600]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1600]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xba0]
call fcn.00431f15
cmp dword [eax], 0
jl 0x47c4e0
mov dword [ebp - 0x2b8], 0xffffffff
mov dword [ebp - 0xa24], 6
mov dword [ebp - 0x2b8], 1
jmp 0x47c09e
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x47c4db
mov dword [ebp - 0x134], 0xf1d8987f
mov dword [ebp - 0x28f0], 0x758185f1
mov dword [ebp - 0x28ec], 0x758185f1
mov dword [ebp - 0x28e8], 0x758185f1
mov dword [ebp - 0x28e4], 0x758185f1
lea ecx, [ebp - 0xb45]
call fcn.00431f24
push eax
lea eax, [ebp - 0x28e0]
push eax
lea eax, [ebp - 0x28f0]
push eax
lea ecx, [ebp - 0x35b8]
call fcn.00431f27
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2960]
call fcn.00431ed3
mov dword [ebp - 0x1680], 0xfffffff6
mov dword [ebp - 0x134], 1
jmp 0x47c135
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x47c3e0
mov dword [ebp - 0x25e4], 0xffffffff
mov dword [ebp - 0x25e0], 0xffffffff
mov dword [ebp - 0x25dc], 0xffffffff
mov dword [ebp - 0x25d8], 0xffffffff
push dword [ebp - 0x134]
lea ecx, [ebp - 0x2100]
call fcn.00431f15
cmp dword [eax], 0
jne 0x47c3c5
cmp dword [ebp - 0x134], 0
jne 0x47c199
mov dword [ebp - 0x1608], 1
jmp 0x47c1a0
and dword [ebp - 0x1608], 0
push 1
lea ecx, [ebp - 0x2100]
call fcn.00431f15
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1608]
jge 0x47c1c3
mov dword [ebp - 0x1610], 1
jmp 0x47c1ca
and dword [ebp - 0x1610], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x3108], eax
mov eax, dword [ebp - 0x2598]
mov dword [ebp - 0x2e58], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x33f8], eax
push 2
lea ecx, [ebp - 0xba0]
call fcn.00431f15
mov ecx, dword [ebp - 0x1610]
cmp ecx, dword [eax]
jl 0x47c211
mov dword [ebp - 0x1618], 1
jmp 0x47c218
and dword [ebp - 0x1618], 0
mov eax, dword [ebp - 0x1618]
sub eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x1620], eax
push 1
lea ecx, [ebp - 0xba0]
call fcn.00431f15
push dword [eax]
lea ecx, [ebp - 0x2100]
call fcn.00431f15
mov ecx, dword [ebp - 0x1620]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25e4]
cmp dword [ebp - 0x1620], eax
je 0x47c26d
mov dword [ebp - 0x1628], 1
jmp 0x47c274
and dword [ebp - 0x1628], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25e4]
cmp dword [ebp - 0x1628], eax
jge 0x47c295
mov dword [ebp - 0x1630], 1
jmp 0x47c29c
and dword [ebp - 0x1630], 0
cmp dword [ebp - 0x1630], 0xfffffff9
ja 0x47c2b1
mov dword [ebp - 0x1638], 1
jmp 0x47c2b8
and dword [ebp - 0x1638], 0
cmp dword [ebp - 0x1638], 1
jge 0x47c2cd
mov dword [ebp - 0x1640], 1
jmp 0x47c2d4
and dword [ebp - 0x1640], 0
mov dword [ebp - 0xa24], 0x7e813a3d
mov eax, dword [ebp - 0xa24]
mov ecx, dword [ebp - 0x1640]
add ecx, 0x28f0
add eax, ecx
cmp eax, 2
jl 0x47c303
mov dword [ebp - 0x1648], 1
jmp 0x47c30a
and dword [ebp - 0x1648], 0
push 1
lea ecx, [ebp - 0xba0]
call fcn.00431f15
mov ecx, dword [ebp - 0x1648]
cmp ecx, dword [eax]
je 0x47c32d
mov dword [ebp - 0x1650], 1
jmp 0x47c334
and dword [ebp - 0x1650], 0
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0x1658], eax
cmp dword [ebp - 0x1658], 0
je 0x47c357
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x25e4], 0
cmp dword [ebp - 0x134], 0x73a151cd
jle 0x47c36f
mov dword [ebp - 0x1660], 1
jmp 0x47c376
and dword [ebp - 0x1660], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x25e4]
cmp dword [ebp - 0x1660], eax
jl 0x47c397
mov dword [ebp - 0xa1c], 1
jmp 0x47c39e
and dword [ebp - 0xa1c], 0
push 3
lea ecx, [ebp - 0x2960]
call fcn.00431f15
mov ecx, dword [ebp - 0xa1c]
mov dword [eax], ecx
cmp dword [ebp - 0xa1c], 0
jne 0x47c3c5
and dword [ebp - 0x1668], 0
jmp 0x47c3cf
mov dword [ebp - 0x1668], 1
mov eax, dword [ebp - 0x1668]
mov dword [ebp - 0x1698], eax
jmp 0x47c128
push 1
lea ecx, [ebp - 0xba0]
call fcn.00431f15
cmp dword [eax], 0
jne 0x47c43a
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x1670], eax
push 1
lea ecx, [ebp - 0x2100]
call fcn.00431f15
mov ecx, dword [ebp - 0x1670]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1670]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x47c43a
cmp dword [ebp - 0xa24], 0
jne 0x47c43a
and dword [ebp - 0x1678], 0
jmp 0x47c444
mov dword [ebp - 0x1678], 1
imul eax, dword [ebp - 0x1678], 0x3018
mov dword [ebp - 0x1680], eax
mov eax, dword [ebp - 0x1680]
neg eax
neg eax
neg eax
mov esi, dword [ebp - 0x2b8]
sub esi, eax
push 2
lea ecx, [ebp - 0x2960]
call fcn.00431f15
cmp dword [eax], esi
jl 0x47c48b
mov eax, 0x5324
test eax, eax
jne 0x47c48b
and dword [ebp - 0x1688], 0
jmp 0x47c495
mov dword [ebp - 0x1688], 1
push 2
lea ecx, [ebp - 0xba0]
call fcn.00431f15
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1688]
jle 0x47c4b8
mov dword [ebp - 0x1690], 1
jmp 0x47c4bf
and dword [ebp - 0x1690], 0
mov eax, dword [ebp - 0x1690]
mov dword [ebp - 0x1698], eax
lea ecx, [ebp - 0x2960]
call fcn.00431ef9
jmp 0x47c091
jmp 0x47c037
lea ecx, [ebp - 0xba0]
call fcn.00431ef9
lea ecx, [ebp - 0x2100]
call fcn.00431ef9
mov dword [ebp - 0x23e8], 0x3062a4b1
push 1
lea ecx, [ebp - 0x2780]
call fcn.00431e27
mov dword [ebp - 0x458], 0x8094a188
mov dword [ebp - 0x7ec], 0
jmp 0x47c530
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 1
jge 0x47c552
push dword [ebp - 0x7ec]
lea ecx, [ebp - 0x2780]
call fcn.00431f15
mov dword [eax], 0x9f9b3198
jmp 0x47c523
mov dword [ebp - 0x458], 0
jmp 0x47c56b
mov eax, dword [ebp - 0x458]
dec eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
jl 0x47c59e
push dword [ebp - 0x458]
lea ecx, [ebp - 0x2780]
call fcn.00431f15
mov esi, eax
push dword [ebp - 0x458]
lea ecx, [ebp - 0x2780]
call fcn.00431f15
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x47c55e
lea ecx, [ebp - 0x2780]
call fcn.00431ef9
mov dword [ebp - 0x2e60], 0xffffffff
mov dword [ebp - 4], 6
mov dword [ebp - 0x98], 0xfd06bde6
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3110], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2e68], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 4]
cmp eax, 0xfffd
je 0x47c62c
mov eax, 0x1a82
test eax, eax
je 0x47c62c
mov dword [ebp - 0x16a0], 1
jmp 0x47c633
and dword [ebp - 0x16a0], 0
mov eax, dword [ebp - 0x16a0]
add eax, 0xfff7
cmp eax, 0xda18
je 0x47c651
mov dword [ebp - 0x16a8], 1
jmp 0x47c658
and dword [ebp - 0x16a8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x16a8], eax
jle 0x47c66f
mov dword [ebp - 0x16b0], 1
jmp 0x47c676
and dword [ebp - 0x16b0], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x16b0], eax
jle 0x47c68d
mov dword [ebp - 0x16b8], 1
jmp 0x47c694
and dword [ebp - 0x16b8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x16b8], eax
jle 0x47c6ab
mov dword [ebp - 0x16c0], 1
jmp 0x47c6b2
and dword [ebp - 0x16c0], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x16c0]
test eax, eax
jge 0x47c6d5
mov eax, 0xc134
test eax, eax
je 0x47c6d5
mov dword [ebp - 0x16c8], 1
jmp 0x47c6dc
and dword [ebp - 0x16c8], 0
cmp dword [ebp - 0x16c8], 0xadf1adb2
ja 0x47c6f4
mov dword [ebp - 0x16d0], 1
jmp 0x47c6fb
and dword [ebp - 0x16d0], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x16d0]
cmp eax, dword [ebp - 4]
jge 0x47c71f
cmp dword [ebp - 0x98], 0
je 0x47c71f
mov dword [ebp - 0x16d8], 1
jmp 0x47c726
and dword [ebp - 0x16d8], 0
cmp dword [ebp - 0x16d8], 0
jne 0x47c73b
mov dword [ebp - 0x16e0], 1
jmp 0x47c742
and dword [ebp - 0x16e0], 0
cmp dword [ebp - 0x16e0], 1
ja 0x47c760
cmp dword [ebp - 0x98], 0
je 0x47c760
mov dword [ebp - 0x16e8], 1
jmp 0x47c767
and dword [ebp - 0x16e8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x16e8], eax
jg 0x47c77e
mov dword [ebp - 0x16f0], 1
jmp 0x47c785
and dword [ebp - 0x16f0], 0
push 9
pop eax
sub eax, dword [ebp - 0x16f0]
je 0x47c7af
mov byte [ebp - 0x31b], 0
movzx eax, byte [ebp - 0x31b]
test eax, eax
je 0x47c7aa
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x47cce8
mov dword [ebp - 0x568], 0xd423cb8e
mov dword [ebp - 0x460], 0x9f4802d1
mov dword [ebp - 0x1770], 0x839ca31b
push 1
lea ecx, [ebp - 0x2b4c]
call fcn.00431e27
mov dword [ebp - 0x7f4], 0
jmp 0x47c7f3
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 1
jge 0x47c815
push dword [ebp - 0x7f4]
lea ecx, [ebp - 0x2b4c]
call fcn.00431f15
mov dword [eax], 0xfffffffa
jmp 0x47c7e6
mov dword [ebp - 0x98], 0x14
jmp 0x47c82e
cmp dword [ebp - 0x98], 0xffffffef
jle 0x47cbb6
push 4
lea ecx, [ebp - 0x618]
call fcn.00431e27
mov dword [ebp - 0x1710], 0xc34f9703
mov dword [ebp - 0x1720], 0x2aec7f51
mov dword [ebp - 0x2c0], 0x7941993e
mov dword [ebp - 0x7fc], 0
jmp 0x47c87f
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 4
jge 0x47c89e
push dword [ebp - 0x7fc]
lea ecx, [ebp - 0x618]
call fcn.00431f15
or dword [eax], 0xffffffff
jmp 0x47c872
push 2
lea ecx, [ebp - 0x618]
call fcn.00431f15
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x3368], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x2e70], eax
push 1
lea ecx, [ebp - 0x618]
call fcn.00431f15
cmp dword [eax], 0
je 0x47c8de
cmp dword [ebp - 0x460], 0
jne 0x47c8f0
mov eax, 0x26b4
test eax, eax
jne 0x47c8f0
mov dword [ebp - 4], 0
jmp 0x47cbc6
cmp dword [ebp - 4], 3
jg 0x47ccdd
mov dword [ebp - 0x1780], 0xffffffff
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x504], 0
je 0x47cc48
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x2e78], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x504], 0x37aee56c
je 0x47cc0f
push 0
lea ecx, [ebp - 0x2b4c]
call fcn.00431f15
cmp dword [eax], 0
jne 0x47cc69
lea ecx, [ebp - 0x2b4c]
call fcn.00431ef9
mov dword [ebp - 4], 0
jmp 0x47ccf8
cmp dword [ebp - 4], 3
jg 0x47cebd