Function at 0x46a300
Capabilities:
Check for time delay via gettickcount
Encode data using base64
Get common file path
Get hostname
Get session user name
Print debug messages
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2fbc
call fcn.004a98b0
mov eax, dword [0x4dd52c]
push ebx
push esi
push edi
xor esi, esi
push 0xa
mov dword [ebp - 4], eax
xor eax, eax
pop ecx
push 0x20
lea edi, [ebp - 0x10a]
mov byte [ebp - 0x4dc], al
mov word [ebp - 0x10c], si
rep stosd dword es:[edi], eax
pop ecx
push 0x1f
lea edi, [ebp - 0x252]
mov word [ebp - 0x254], si
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x4db]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
push 0x40
mov ecx, 0x80
lea edi, [ebp - 0xefe]
mov word [ebp - 0xf00], 0x30
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x8ec], al
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x7e7]
mov byte [ebp - 0x7e8], 0x30
rep stosd dword es:[edi], eax
push 0x40
pop ecx
lea edi, [ebp - 0x8eb]
rep stosd dword es:[edi], eax
mov edx, 0x81
mov word [ebp - 0xaf4], si
mov ecx, edx
lea edi, [ebp - 0xaf2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0xcfc], si
mov ecx, edx
lea edi, [ebp - 0xcfa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp byte [ebx + 0x199fe], 2
mov word [ebp - 0x1f00], si
mov ecx, 0x3ff
lea edi, [ebp - 0x1efe]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2fb4], esi
mov dword [ebp - 0x2fbc], 0x101
mov dword [ebp - 0x2f9c], esi
mov dword [ebp - 0x2f84], esi
mov dword [ebp - 0x2fb0], esi
mov dword [ebp - 0x2f94], esi
stosw word es:[edi], ax
jne 0x46a482
mov ax, word [ebx + 0x8e5]
movsx ecx, ax
cmp word [ebx + ecx*2 + 0x19a00], 2
jne 0x46a455
cmp ax, 5
jne 0x46a449
cmp word [ebx + 0x19a08], 2
je 0x46a449
push 0x7b
push ebx
call fcn.004a53d4
xor edi, edi
inc edi
cmp eax, edi
jne 0x46a44c
mov word [ebx + 0x8e5], 4
jmp 0x46a458
xor edi, edi
inc edi
mov word [ebx + 0x8e5], si
jmp 0x46a458
xor edi, edi
inc edi
movsx eax, word [ebx + 0x8e5]
cmp word [ebx + eax*2 + 0x19a00], 4
jne 0x46a485
push 0x40e270
push ebx
call fcn.0043e17f
push 0x40ecbc
push ebx
call fcn.0043e17f
jmp 0x46a485
xor edi, edi
inc edi
push 0x3e
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46a497
mov dword [ebp - 0x2f9c], edi
push 0x3c
push ebx
call fcn.004a53d4
cmp eax, edi
je 0x46a4d7
push 0x3d
push ebx
call fcn.004a53d4
cmp eax, edi
je 0x46a4d7
push 0x39
push ebx
call fcn.004a53d4
cmp eax, edi
je 0x46a4cf
push 0x3a
push ebx
call fcn.004a53d4
cmp eax, edi
je 0x46a4cf
mov dword [ebp - 0x2f88], esi
jmp 0x46a4e1
mov dword [ebp - 0x2f88], edi
jmp 0x46a4e1
mov dword [ebp - 0x2f88], 2
push 0x3f
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46a4f9
mov dword [ebp - 0x2f8c], 2
jmp 0x46a50d
push 0x38
push ebx
call fcn.004a53d4
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2f8c], eax
xor eax, eax
mov ax, word [ebx + 0x18934]
cmp ax, 4
mov dword [ebp - 0x2f98], eax
jne 0x46a58b
cmp word [ebx + 0x68], di
jne 0x46a578
cmp word [ebx + 0x5a], di
jle 0x46a578
push esi
push ebx
call fcn.0045af60
push edi
lea eax, [ebp - 0x2f94]
push 0x40bdcc
push eax
call fcn.004ac2d4
lea eax, [ebp - 0x2f94]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46a553
sub eax, edi
push eax
lea eax, [ebp - 0x2f94]
push eax
push ebx
call fcn.0043dbe6
push 0x11a
push ebx
call fcn.0045af60
xor edi, edi
inc edi
cmp word [ebx + 0x57a], si
jle 0x46a597
push 0x7a
push ebx
call fcn.0045af60
jmp 0x46a597
cmp ax, 5
jne 0x46a5a4
push ebx
call fcn.0045eacf
push ebx
call fcn.00492b26
mov eax, edi
jmp 0x46d6e3
cmp word [ebx + 0xd8e], di
jne 0x46a5ed
push 0x40e270
push ebx
call fcn.0043e17f
cmp word [ebx + 0x5a], di
jne 0x46a5e2
mov ax, word [ebx + 0xdb1]
movsx ecx, word [ebx + 0xdd0]
movsx edx, ax
add ecx, edx
cmp ecx, edi
jne 0x46a5e2
cmp ax, di
jne 0x46a5e2
push 0x75
push ebx
call fcn.0045af60
push 0x40ec9c
push ebx
call fcn.0043e17f
lea eax, [ebp - 0x2fbc]
push eax
lea eax, [ebp - 0xf00]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x101
lea eax, [ebp - 0xf00]
push eax
lea eax, [ebp - 0x7e8]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x7e8]
push eax
lea eax, [ebp - 0x8ec]
push 0x40ec7c
push eax
call fcn.004ac2d4
add esp, 0xc
lea eax, [ebp - 0x8ec]
push eax
push ebx
call fcn.0043e17f
push 0x14
lea eax, [ebp - 0xf00]
push eax
lea eax, [ebp - 0xaf4]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
lea eax, [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xcfc]
push 0x40ec40
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x18
lea eax, [ebp - 0xcfc]
push eax
push ebx
call fcn.0045bfed
cmp dword [ebx + 0x1dfa8], 1
mov esi, 0x800
jne 0x46a7a9
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46a7a9
cmp eax, 3
jb 0x46a7a9
and word [ebp - 0x2f00], 0
push dword [ebx + 0x5014]
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x2efe]
rep stosd dword es:[edi], eax
push 0x40ec1c
stosw word es:[edi], ax
lea eax, [ebp - 0x2f00]
push esi
push eax
call fcn.00431bde
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46a7a9
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46a7a9
cmp eax, 3
jb 0x46a7a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2f00]
push eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46a78b
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46a7a9
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
mov edi, dword [sym.imp.msvcrt.dll_wcsncpy]
push 0x40
push dword [ebx + 0x5014]
lea eax, [ebp - 0xaf4]
push eax
call edi
add esp, 0xc
push 2
push 0x40ebf8
lea eax, [ebp - 0xaf4]
push eax
call fcn.0045afa5
test eax, eax
jne 0x46a8c2
cmp dword [ebx + 0x1dfa8], 1
jne 0x46a8a8
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46a8a8
cmp eax, 3
jb 0x46a8a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x40ebb0
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46a88a
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46a8a8
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
lea eax, [ebp - 0xaf4]
push 0x40eb9c
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcsncpy]
pop ecx
pop ecx
lea eax, [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xcfc]
push 0x40eb64
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0xcfc]
push eax
push ebx
call fcn.0045bfed
cmp dword [ebx + 0x5014], 0
je 0x46a92e
lea eax, [ebx + 0x90f]
push 0x40eb9c
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x46a924
lea eax, [ebx + 0x90f]
push 0x405a00
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46a92e
push 0x40
push dword [ebx + 0x5014]
jmp 0x46a937
push 0x40
lea eax, [ebx + 0x90f]
push eax
lea eax, [ebp - 0x254]
push eax
call edi
add esp, 0xc
cmp word [ebx + 0x8e5], 0
jne 0x46a96a
cmp dword [ebp - 0x2f9c], 1
jne 0x46a96a
push 0x40
push dword [ebx + 0x5014]
lea eax, [ebp - 0x254]
push eax
call edi
add esp, 0xc
and word [ebp - 0x2f80], 0
push 0x1f
pop ecx
xor eax, eax
cmp dword [ebp - 0x2f9c], 1
lea edi, [ebp - 0x2f7e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2f80]
push 0x80
push eax
jne 0x46a99a
push 0x73
jmp 0x46a99c
push 0x71
push ebx
call fcn.004a5ad4
push 0x40ebf8
lea eax, [ebp - 0x2f80]
push eax
push 0x40c920
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46acd1
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46aae2
cmp eax, 3
jb 0x46aae2
and word [ebp - 0x2f00], 0
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x2efe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2f80]
push eax
push 0x40eb28
lea eax, [ebp - 0x2f00]
push esi
push eax
call fcn.00431bde
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46acd1
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46aae2
cmp eax, 3
jb 0x46aae2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2f00]
push eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46aac4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46aae2
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46acd1
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46abac
cmp eax, 3
jb 0x46abac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x40eaec
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46ab8e
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46abac
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46acd1
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46acd1
cmp eax, 3
jb 0x46acd1
and word [ebp - 0x2f00], 0
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x2efe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x254]
push eax
push 0x40eacc
lea eax, [ebp - 0x2f00]
push esi
push eax
call fcn.00431bde
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46acd1
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46acd1
cmp eax, 3
jb 0x46acd1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2f00]
push eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46acb3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46acd1
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
movsx eax, word [ebp - 0x2f88]
push eax
mov dword [ebp - 0x2f90], eax
lea eax, [ebp - 0x2f80]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0045b06d
test eax, eax
jne 0x46ad0a
lea eax, [ebp - 0x254]
push 0x40eb9c
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [ebx + 0x1dfa8], 1
jne 0x46aef9
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46add4
cmp eax, 3
jb 0x46add4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x40ea90
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46adb6
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46add4
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46aef9
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46aef9
cmp eax, 3
jb 0x46aef9
and word [ebp - 0x2f00], 0
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x2efe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x254]
push eax
push 0x40eacc
lea eax, [ebp - 0x2f00]
push esi
push eax
call fcn.00431bde
add esp, 0x10
cmp dword [ebx + 0x1dfa8], 1
jne 0x46aef9
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46aef9
cmp eax, 3
jb 0x46aef9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2f00]
push eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46aedb
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46aef9
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
mov ax, word [ebx + 0x1977e]
xor edi, edi
inc edi
cmp ax, di
jne 0x46af7e
mov cx, word [ebx + 0x5a]
cmp cx, di
jle 0x46af7e
cmp word [ebx + 0x68], di
jne 0x46af48
mov ax, word [ebx + 0xdb1]
movsx edx, word [ebx + 0xdd0]
movsx eax, ax
add edx, eax
movsx eax, cx
cmp eax, edx
jne 0x46af48
cmp word [ebx + 0xa3f], di
jne 0x46af48
cmp word [ebx + 0xdb1], 0
jg 0x46b069
push 0
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x5a]
push eax
lea eax, [ebp - 0x2f88]
push 0x40bdcc
push eax
call fcn.004ac2d4
lea eax, [ebp - 0x2f88]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46af72
jmp 0x46b00e
cmp ax, 2
je 0x46af8d
test ax, ax
jne 0x46b020
push 0x31
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46b020
mov ax, word [ebx + 0x5a]
cmp ax, di
jle 0x46b069
cmp word [ebx + 0x68], di
jne 0x46afe1
mov cx, word [ebx + 0xdb1]
movsx edx, word [ebx + 0xdd0]
movsx ecx, cx
movsx eax, ax
add edx, ecx
cmp eax, edx
jne 0x46afe1
cmp word [ebx + 0xa3f], di
jne 0x46afe1
cmp word [ebx + 0xdb1], 0
jg 0x46b069
push 0
push ebx
call fcn.0045af60
push edi
lea eax, [ebp - 0x2f88]
push 0x40bdcc
push eax
call fcn.004ac2d4
lea eax, [ebp - 0x2f88]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46b007
sub eax, edi
push eax
lea eax, [ebp - 0x2f88]
push eax
push ebx
call fcn.0043dbe6
jmp 0x46b05e
cmp word [ebx + 0x1977e], 0
jne 0x46b042
cmp word [ebx + 0x5a], di
jle 0x46b046
push 0xca
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x5a]
push eax
jmp 0x46b054
cmp word [ebx + 0x5a], di
jne 0x46b069
push 0xca
push ebx
call fcn.0045af60
push edi
push edi
push ebx
call fcn.0043e1a8
add esp, 0xc
push 0x11a
push ebx
call fcn.0045af60
cmp word [ebx + 0x1977e], 2
jne 0x46b2a2
xor eax, eax
mov byte [ebp - 0xc], 0
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [ebx + 0x5a]
cmp ax, 2
jg 0x46b09a
jne 0x46b0a5
cmp word [ebx + 0xdb1], 1
je 0x46b0a5
push 0xd3
push ebx
call fcn.0045af60
push ebx
call fcn.0045db24
test eax, eax
jne 0x46b141
test byte [ebx + 0x16626], 1
je 0x46b2a2
push 0xd4
push ebx
call fcn.0045af60
cmp word [ebx + 0xd8e], 1
jne 0x46b0ff
push ebx
call fcn.0043db13
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
mov byte [ebp - 0xc], 0x1b
mov byte [ebp - 0xb], 0xf0
mov byte [ebp - 0xa], 0x10
mov byte [ebp - 9], 0xcc
call fcn.0043dbe6
push ebx
call fcn.0043db13
jmp 0x46b131
mov eax, dword [ebx + 0x5238]
and dword [ebp - 0x1c], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x16290]
mov byte [ebp - 0xc], 0x1b
mov byte [ebp - 0xb], 0xf0
mov byte [ebp - 0xa], 0x10
mov byte [ebp - 9], 0xdd
call fcn.004834eb
push 0x11a
push ebx
call fcn.0045af60
jmp 0x46b2a2
cmp dword [ebx + 0x1e068], 1
jne 0x46b2a2
cmp word [ebx + 0x68], 1
jne 0x46b18c
mov cx, word [ebx + 0xdb1]
movsx edx, word [ebx + 0xdd0]
mov ax, word [ebx + 0x5a]
movsx edi, cx
add edx, edi
movsx edi, ax
cmp edi, edx
jne 0x46b18c
cmp ax, 1
jle 0x46b18c
cmp word [ebx + 0xa3f], 1
jne 0x46b18c
test cx, cx
jg 0x46b2a2
push 0
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x5a]
push eax
lea eax, [ebp - 0x2f88]
push 0x40bdcc
push eax
call fcn.004ac2d4
lea eax, [ebp - 0x2f88]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46b1b6
sub eax, edi
push eax
lea eax, [ebp - 0x2f88]
push eax
push ebx
call fcn.0043dbe6
push 0x11a
push ebx
call fcn.0045af60
cmp dword [ebx + 0x1dfa8], 1
jne 0x46b2a2
mov eax, dword [ebx + 0x1dfac]
test eax, eax
je 0x46b2a2
cmp eax, 3
jb 0x46b2a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2fac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x40ea38
mov ecx, 0x400
lea edi, [ebp - 0x1f00]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x2f9e]
push 0x40ec00
push eax
movzx eax, word [ebp - 0x2fa0]
push eax
movzx eax, word [ebp - 0x2fa2]
push eax
movzx eax, word [ebp - 0x2fa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1f00]
push esi
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [ebx + 0x1dfa0], 1
lea eax, [ebp - 0x1f00]
push eax
jne 0x46b284
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46b2a2
lea esi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [esi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [esi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
movzx eax, byte [ebx + 0xc9b]
dec eax
je 0x46b2b6
dec eax
jne 0x46b2c1
push 0xbe
jmp 0x46b2bb
push 0xbd
push ebx
call fcn.0045af60
movzx eax, byte [ebx + 0xcb1]
dec eax
je 0x46b2fd
dec eax
je 0x46b2f6
dec eax
je 0x46b2ef
dec eax
je 0x46b2e8
dec eax
je 0x46b2e1
dec eax
jne 0x46b308
push 0xc4
jmp 0x46b302
push 0xc3
jmp 0x46b302
push 0xc2
jmp 0x46b302
push 0xc1
jmp 0x46b302
push 0xc0
jmp 0x46b302
push 0xbf
push ebx
call fcn.0045af60
cmp word [ebx + 0xa3f], 1
jne 0x46b316
push 0x60
jmp 0x46b318
push 0x64
push ebx
call fcn.0045af60
push 0xa7
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46b37a
cmp byte [ebx + 0xc92], al
je 0x46b394
push 0x62
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x5e]
mov esi, 0x12c
cmp eax, esi
mov edi, 0x258
je 0x46b44c
cmp eax, edi
mov esi, 0x4b0
je 0x46b3a0
cmp eax, esi
jne 0x46b455
push 1
push ebx
call fcn.0045af60
and word [ebx + 0x142], 0
jmp 0x46b46d
push 0xa8
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46b33e
mov al, byte [ebx + 0xc92]
cmp al, 1
jne 0x46b398
push 0x61
jmp 0x46b338
cmp al, 2
jne 0x46b336
push 0x63
jmp 0x46b338
cmp word [ebx + 0xa29], 0x960
jne 0x46b3bb
push 1
push ebx
call fcn.0045af60
mov dword [ebp - 0x2f88], esi
jmp 0x46b3c9
push 2
push ebx
call fcn.0045af60
mov dword [ebp - 0x2f88], edi
movzx eax, word [ebx + 0xa29]
cmp eax, edi
je 0x46b41b
cmp eax, esi
jne 0x46b473
push 0
push ebx
call fcn.004a53d4
test eax, eax
jne 0x46b473
push 0x57
push ebx
call fcn.0045af60
push 0x4089ec
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
xor eax, eax
inc eax
mov dword [ebp - 0x2f84], eax
mov dword [ebp - 0x2f94], eax
jmp 0x46b473
push 0x57
push ebx
call fcn.0045af60
push 0x40ea34
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
and dword [ebp - 0x2f94], 0
mov dword [ebp - 0x2f84], 1
jmp 0x46b473
cmp word [ebx + 0xa29], di
jne 0x46b465
push 2
push ebx
call fcn.0045af60
mov dword [ebp - 0x2f88], edi
jmp 0x46b473
push 3
push ebx
call fcn.0045af60
mov dword [ebp - 0x2f88], esi
mov dx, word [ebx + 0xcca]
test dx, dx
mov esi, dword [sym.imp.msvcrt.dll__wtoi]
push 7
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x3e]
pop ecx
je 0x46b4f2
and word [ebp - 0x40], 0
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movsx eax, dx
push eax
mov dword [ebp - 0x2fb0], eax
lea eax, [ebp - 0x40]
push 0x40c24c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push 0x76
push ebx
call fcn.0045af60
push 0x10
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
jmp 0x46b5a6
and word [ebp - 0x40], 0
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movzx eax, word [ebx + 0xa29]
dec eax
je 0x46b541
dec eax
je 0x46b52d
dec eax
dec eax
jne 0x46b553
push 0x79
push ebx
call fcn.0045af60
mov dword [ebp - 0x2fb0], 4
jmp 0x46b553
push 0x78
push ebx
call fcn.0045af60
mov dword [ebp - 0x2fb0], 2
jmp 0x46b553
push 0x77
push ebx
call fcn.0045af60
mov dword [ebp - 0x2fb0], 1
push 0x10
lea eax, [ebp - 0x40]
push eax
movzx eax, byte [ebx + 0xccc]
push eax
push 0x66
push ebx
call fcn.004a5f06
test eax, eax
je 0x46b5a6
push 0x76
push ebx
call fcn.0045af60
push 0x10
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
lea eax, [ebp - 0x40]
push eax
call esi
pop ecx
mov dword [ebp - 0x2fb0], eax
and word [ebp - 0x40], 0
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x3e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp dword [ebp - 0x2f84], 0
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x46b622
push 0x10
lea eax, [ebp - 0x40]
push eax
movzx eax, byte [ebx + 0xccc]
push eax
push 0x65
push ebx
call fcn.004a5f06
test eax, eax
je 0x46b622
push 0x57
push ebx
call fcn.0045af60
push 0x10
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
lea eax, [ebp - 0x40]
push eax
call esi
pop ecx
mov dword [ebp - 0x2f94], eax
push 4
xor esi, esi
push ebx
mov dword [ebp - 0x2f84], esi
call fcn.004a53d4
cmp eax, 1
jne 0x46b889
push esi
push esi
push 4
push ebx
call fcn.004a6715
cmp eax, esi
je 0x46b68a
mov edi, eax
shl edi, 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x46b68a
push edi
push esi
push 4
push ebx
call fcn.004a6715
xor ecx, ecx
test eax, eax
jbe 0x46b683
cmp dword [esi + ecx*4], 3
je 0x46b679
inc ecx
cmp ecx, eax
jb 0x46b66c
jmp 0x46b683
mov dword [ebp - 0x2f84], 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
cmp byte [ebx + 0xdd3], 3
jne 0x46b69d
mov cl, byte [ebx + 0xdd2]
jmp 0x46b6a3
mov cl, byte [ebx + 0x1b84e]
cmp word [ebx + 0xc52], si
je 0x46b833
xor eax, eax
mov edx, 0x81
mov word [ebp - 0x45c], si
mov ecx, edx
lea edi, [ebp - 0x45a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x6e4], si
mov ecx, edx
lea edi, [ebp - 0x6e2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
push 0x208
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 8]
push eax
push 0x407bb0
push dword [ebx + 0x5010]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], 1
mov dword [ebp - 0x2f84], esi
call sub.WINSPOOL.DRV_GetPrinterDataW
test eax, eax
je 0x46b73e
lea edi, [ebx + 0x1a878]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x104
pop ecx
jae 0x46b748
lea eax, [ebp - 0x6e4]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x46b748
mov dword [ebp - 0x2f84], 1
cmp word [ebp - 0x6e4], si
je 0x46b7f2
lea eax, [ebp - 0x45c]
push eax
push esi
push esi
push 0x23
push esi
call sub.SHELL32.dll_SHGetFolderPathW
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x45c]
push 0x40ea1c
push eax
call edi
cmp dword [ebp - 0x2f84], esi
pop ecx
pop ecx
je 0x46b794
lea eax, [ebp - 0x45c]
push 0x40ea10
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x45c]
push eax
call edi
cmp word [ebx + 0xd8e], 1
pop ecx
pop ecx
je 0x46b7c1
cmp word [ebx + 0x18934], 2
je 0x46b7c1
push 0x40ea04
jmp 0x46b7c6
push 0x40e9f8
lea eax, [ebp - 0x45c]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebx + 0xc52]
push eax
lea eax, [ebp - 0x45c]
push eax
call edi
lea eax, [ebp - 0x45c]
push 0x40e9ec
push eax
call edi
add esp, 0x10
cmp word [ebx + 0xd8e], si
jne 0x46b810
lea edi, [ebx + 0x197b8]
mov ecx, 0x82
lea esi, [ebp - 0x45c]
rep movsd dword es:[edi], dword [esi]
jmp 0x46b889
lea eax, [ebp - 0x45c]
push eax
push ebx
call fcn.00497a93
push 0x5c
push ebx
call fcn.0045af60
push ebx
call fcn.0045c0e6
push ebx
call fcn.00497e6f
jmp 0x46b889
movsx eax, word [ebx + 0xa6b]
sub eax, esi
je 0x46b853
dec eax
je 0x46b84f
dec eax
je 0x46b84b
dec eax
jne 0x46b881
push 0x5b
jmp 0x46b883
push 0x5a
jmp 0x46b883
push 0x59
jmp 0x46b883
cmp dword [ebp - 0x2f84], 1
jne 0x46b881
movzx eax, cl
sub eax, esi
je 0x46b881
dec eax
je 0x46b87a
dec eax
je 0x46b873
dec eax
jne 0x46b889
push 0x95
jmp 0x46b883
push 0x94
jmp 0x46b883
push 0x93
jmp 0x46b883
push 0x58
push ebx
call fcn.0045af60
push 0x62
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46b914
and word [ebp - 0x2f80], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x2f7e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
pop ecx
xor eax, eax
mov byte [ebp - 0x60], 0
lea edi, [ebp - 0x5f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40
stosb byte es:[edi], al
lea eax, [ebp - 0x2f80]
push eax
movsx eax, word [ebx + 0xccd]
push eax
push 0x63
push ebx
call fcn.004a5f06
test eax, eax
je 0x46b914
cmp word [ebp - 0x2f80], 0
je 0x46b914
push 0x5d
push ebx
call fcn.0045af60
push 0x40
lea eax, [ebp - 0x2f80]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x60]
push eax
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
cmp dword [ebx + 0x1d8a4], 1
jne 0x46ba06
and dword [ebp - 0x2f84], 0
push 0x40e9d4
push dword [ebx + 0x1d8b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 8], eax
je 0x46b9fb
lea ecx, [ebp - 0x2f84]
push ecx
push 0
push dword [ebx + 0x1d8ac]
call eax
test eax, eax
jne 0x46ba06
mov eax, dword [ebp - 0x2f84]
test eax, eax
jbe 0x46ba06
lea eax, [eax*4 + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x2f84]
lea ecx, [ecx*4 + 4]
mov esi, eax
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x2f84]
push eax
push esi
push dword [ebx + 0x1d8ac]
call dword [ebp - 8]
test eax, eax
jne 0x46b9ee
mov eax, dword [ebp - 0x2f84]
lea eax, [eax + eax + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x2f84]
push edi
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push ebx
call fcn.0043e17f
test edi, edi
je 0x46b9ee
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x46ba06
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x46ba06
push 0x40e9bc
push ebx
call fcn.0043e17f
cmp dword [ebx + 0x1d8bc], 0
je 0x46baec
and dword [ebp - 0x2f84], 0
push 0x40e9d4
push dword [ebx + 0x1d8c0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x46baec
lea eax, [ebp - 0x2f84]
push eax
push 0
push dword [ebx + 0x1d8bc]
call dword [ebp - 0x1c]
test eax, eax
jne 0x46baec
mov eax, dword [ebp - 0x2f84]
test eax, eax
jbe 0x46baec
lea eax, [eax*4 + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x2f84]
lea ecx, [ecx*4 + 4]
mov esi, eax
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x2f84]
push eax
push esi
push dword [ebx + 0x1d8bc]
call dword [ebp - 0x1c]
test eax, eax
jne 0x46bae1
mov eax, dword [ebp - 0x2f84]
lea eax, [eax + eax + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x2f84]
push edi
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push ebx
call fcn.0043e17f
test edi, edi
je 0x46bae1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x46baec
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
inc esi
cmp dword [ebx + 0x1d8a4], esi
jne 0x46bb0a
cmp dword [ebx + 0x1d8b8], esi
jne 0x46bb0a
push 0x40e9bc
push ebx
call fcn.0043e17f
push ebx
call fcn.0045eacf
push 2
push ebx
call fcn.004a53d4
xor edi, edi
cmp eax, esi
jne 0x46bb50
cmp word [ebp - 0x2f98], di
movsx eax, word [ebx + 0x14e]
jne 0x46bb3d
sub eax, edi
je 0x46bb39
dec eax
jne 0x46bb50
push 0xa
jmp 0x46bb4a
push 0xb
jmp 0x46bb4a
sub eax, edi
je 0x46bb48
dec eax
jne 0x46bb50
push 8
jmp 0x46bb4a
push 9
push ebx
call fcn.0045af60
push 7
push ebx
call fcn.004a53d4
cmp eax, esi
jne 0x46bc30
cmp word [ebx + 0x9e7], si
je 0x46bc30
push 0x8d
push ebx
call fcn.004a53d4
cmp eax, esi
jne 0x46bc07
xor eax, eax
cmp word [ebx + 0x57a], ax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], 0
stosd dword es:[edi], eax
jne 0x46bb9d
push 0xd
push ebx
call fcn.0045af60
jmp 0x46bc03
cmp word [ebx + 0xd8e], 1
jne 0x46bbd1
push ebx
call fcn.0043db13
push 4
lea eax, [ebp - 0x20]
push eax
push ebx
mov byte [ebp - 0x20], 0x1b
mov byte [ebp - 0x1f], 0xf0
mov byte [ebp - 0x1e], 0x10
mov byte [ebp - 0x1d], 0xc9
call fcn.0043dbe6
push ebx
call fcn.0043db13
jmp 0x46bc03
mov eax, dword [ebx + 0x5238]
and dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 0x16290]
mov byte [ebp - 0x20], 0x1b
mov byte [ebp - 0x1f], 0xf0
mov byte [ebp - 0x1e], 0x10
mov byte [ebp - 0x1d], 0xd9
call fcn.004834eb
xor edi, edi
jmp 0x46bc73
movsx eax, word [ebx + 0x57a]
sub eax, edi
je 0x46bc6b
dec eax
je 0x46bc24
dec eax
jne 0x46bc73
push 0x10
push ebx
call fcn.0045af60
push 0xe
jmp 0x46bc6d
push 0x10
push ebx
call fcn.0045af60
push 0xf
jmp 0x46bc6d
movsx eax, word [ebx + 0x5da]
sub eax, edi
je 0x46bc6b
dec eax
je 0x46bc56
dec eax
jne 0x46bc73
push 0xc
push ebx
call fcn.0045af60
cmp word [ebx + 0xa2b], si
jne 0x46bc20
push 0x11
jmp 0x46bc6d
push 0xc
push ebx
call fcn.0045af60
cmp word [ebx + 0xa2b], si
jne 0x46bc2c
push 0x12
jmp 0x46bc6d
push 0xd
push ebx
call fcn.0045af60
push 0x15
push ebx
call fcn.004a53d4
test eax, eax
jne 0x46bca9
cmp word [ebx + 0x13a], 3
jne 0x46bca9
movsx eax, word [ebx + 0x13c]
sub eax, edi
je 0x46bca5
dec eax
je 0x46bca1
dec eax
je 0x46bca1
dec eax
jne 0x46bca5
push 6
jmp 0x46bce7
push 7
jmp 0x46bce7
push 5
jmp 0x46bce7
lea eax, [ebp - 0x2f80]
push eax
movsx eax, word [ebx + 0x13a]
push eax
push ebx
call fcn.004a6e0e
push 0x20
lea eax, [ebp - 0x2f80]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004ac4ed
push 4
push ebx
call fcn.0045af60
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.0043e17f
push 0x11a
push ebx
call fcn.0045af60
push 0x15
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46bd2c
movsx eax, word [ebx + 0x13c]
dec eax
je 0x46bd0e
dec eax
jne 0x46bd2c
push 0x91
jmp 0x46bd13
push 0x92
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x8e3]
push 0x90
push eax
push ebx
call fcn.0045b3a1
cmp word [ebp - 0x2f98], di
movsx eax, word [ebx + 0x142]
jne 0x46bd51
dec eax
je 0x46bd4d
dec eax
je 0x46bd49
dec eax
jne 0x46bd6a
push 0x18
jmp 0x46bd64
push 0x17
jmp 0x46bd64
push 0x16
jmp 0x46bd64
dec eax
je 0x46bd62
dec eax
je 0x46bd5e
dec eax
jne 0x46bd6a
push 0x15
jmp 0x46bd64
push 0x14
jmp 0x46bd64
push 0x13
push ebx
call fcn.0045af60
push 0x47
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46bdc6
movsx eax, word [ebx + 0x9c7]
cmp eax, 0xb
jg 0x46bdad
je 0x46bda9
mov ecx, eax
sub ecx, edi
je 0x46bdc6
dec ecx
je 0x46bdbe
dec ecx
je 0x46bda5
sub ecx, 7
je 0x46bda1
dec ecx
jne 0x46be20
push 0x1c
jmp 0x46bdc0
push 0x1b
jmp 0x46bdc0
push 0x19
jmp 0x46bdc0
push 0x1d
jmp 0x46bdc0
mov ecx, eax
sub ecx, 0xc
je 0x46bdbe
dec ecx
je 0x46be97
dec ecx
jne 0x46bd96
push 0x1a
push ebx
call fcn.0045af60
cmp dword [ebx + 0x1e594], 1
jne 0x46bdda
push 0x119
push ebx
call fcn.0045af60
push 0x49
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46bebe
movzx eax, byte [ebx + 0xc4f]
sub eax, edi
je 0x46beb3
dec eax
je 0x46beac
dec eax
je 0x46bea5
dec eax
je 0x46be9e
dec eax
jne 0x46bebe
push 0xb9
jmp 0x46beb8
push edi
push edi
push eax
push 0x48
push ebx
call fcn.004a61e2
cmp eax, edi
mov dword [ebp - 0x2f98], eax
jbe 0x46bdc6
mov edi, eax
add edi, edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp - 0x2f98]
mov esi, eax
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movsx eax, word [ebx + 0x9c7]
push esi
push eax
push 0x48
push ebx
call fcn.004a61e2
push 0x1f
push ebx
call fcn.0045af60
push esi
push ebx
call fcn.0045bfed
push 0x11a
push ebx
call fcn.0045af60
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor edi, edi
jmp 0x46bdc6
push 0x1e
jmp 0x46bdc0
push 0xb8
jmp 0x46beb8
push 0xb7
jmp 0x46beb8
push 0xb6
jmp 0x46beb8
push 0xb5
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x146]
sub eax, edi
je 0x46bed0
dec eax
jne 0x46bed0
push 0x23
jmp 0x46bed2
push 0x22
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x150]
sub eax, edi
je 0x46beea
dec eax
jne 0x46beea
push 0x21
jmp 0x46beec
push 0x20
push ebx
call fcn.0045af60
push ebx
call fcn.0045fb5c
lea esi, [ebx + 0x8e7]
push 0x405a00
push esi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
push 0x28
pop edi
jne 0x46bf21
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp word [ebx + 0x8e5], 0
jne 0x46bf42
cmp dword [ebp - 0x2f9c], 1
jne 0x46bf42
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
and word [ebp - 0x2f80], 0
push 0x1f
pop ecx
xor eax, eax
cmp dword [ebp - 0x2f9c], 1
lea edi, [ebp - 0x2f7e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2f80]
push 0x80
push eax
jne 0x46bf72
push 0x74
jmp 0x46bf74
push 0x72
push ebx
call fcn.004a5ad4
push 0x40ebf8
lea eax, [ebp - 0x2f80]
push eax
push 0x40c920
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x14
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x1c
push dword [ebp - 0x2f90]
lea eax, [ebp - 0x2f80]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0045afa5
test eax, eax
jne 0x46bfd6
lea eax, [ebp - 0x10c]
push 0x40e9ac
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push 0x3b
push ebx
call fcn.0045af60
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.0045bfed
mov esi, 0xcb
push esi
push ebx
call fcn.0045af60
push 0x53
push ebx
call fcn.0045af60
lea eax, [ebp - 0x254]
push eax
push ebx
call fcn.0045bfed
push esi
push ebx
call fcn.0045af60
and word [ebp - 0x6e4], 0
and dword [ebp - 0x2f98], 0
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x6e2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
xor edx, edx
pop ecx
xor eax, eax
mov word [ebp - 0x60], dx
lea edi, [ebp - 0x5e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 0x2f98]
push eax
push edx
push 1
mov dword [ebp - 0x2f9c], edx
call edi
lea eax, [ebp - 0x2f98]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 1
call edi
lea eax, [ebp - 0x6e4]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push pe_nt_image_headers32
push ebx
call fcn.0045af60
lea eax, [ebp - 0x6e4]
push eax
push ebx
call fcn.0045bfed
push esi
push ebx
call fcn.0045af60
lea eax, [ebp - 0x2f9c]
push eax
push 0
push 0
push 1
push dword [ebx + 0x19a18]
push dword [ebx + 0x5010]
call sub.WINSPOOL.DRV_GetJobW
test eax, eax
jne 0x46c12c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x46c12c
push dword [ebp - 0x2f9c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov esi, eax
lea eax, [ebp - 0x2f9c]
push eax
push dword [ebp - 0x2f9c]
mov dword [ebp - 0x2f90], esi
push esi
push 1
push dword [ebx + 0x19a18]
push dword [ebx + 0x5010]
call sub.WINSPOOL.DRV_GetJobW
push dword [ebx + 0x19a18]
add esi, 0x30
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x60]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call fcn.0045d38e
push dword [ebp - 0x2f90]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, 0xcb
push 0xe9
push ebx
call fcn.0045af60
lea eax, [ebp - 0x60]
push eax
push ebx
call fcn.0045bfed
push esi
push ebx
call fcn.0045af60
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebx + 0x1e7ac]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push ebx
call fcn.004676f4
movsx eax, word [ebx + 0x586]
push 2
pop esi
sub eax, esi
je 0x46c192
dec eax
je 0x46c18e
dec eax
je 0x46c18a
dec eax
je 0x46c186
dec eax
jne 0x46c19a
push 0x44
jmp 0x46c194
push 0x43
jmp 0x46c194
push 0x42
jmp 0x46c194
push 0x41
jmp 0x46c194
push 0x40
push ebx
call fcn.0045af60
push 0x40
push ebx
call fcn.004a53d4
xor edi, edi
inc edi
cmp eax, edi
jne 0x46c214
movsx eax, word [ebx + 0x148]
dec eax
je 0x46c1ba
dec eax
jne 0x46c1c2
push 0x71
jmp 0x46c1bc
push 0x70
push ebx
call fcn.0045af60
cmp word [ebx + 0x148], 0
je 0x46c214
movsx eax, word [ebx + 0x140]
dec eax
je 0x46c1fe
sub eax, esi
je 0x46c1fe
cmp word [ebx + 0x50], di
jne 0x46c204
push 0x6b
push ebx
call fcn.0045af60
movzx eax, byte [ebx + 0xde6]
sub eax, 0
je 0x46c20c
dec eax
je 0x46c208
dec eax
jne 0x46c214
push 0x6f
jmp 0x46c20e
cmp word [ebx + 0x50], di
jne 0x46c1e0
push 0x6c
jmp 0x46c1e2
push 0x6e
jmp 0x46c20e
push 0x6d
push ebx
call fcn.0045af60
push 0x41
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46c29d
movsx eax, word [ebx + 0x9ef]
cmp eax, edi
je 0x46c23b
cmp eax, esi
je 0x46c283
jle 0x46c243
cmp eax, 4
jle 0x46c27f
cmp eax, 5
jne 0x46c243
push 0x4a
push ebx
call fcn.0045af60
cmp word [ebx + 0x9ef], 0
je 0x46c29d
movsx eax, word [ebx + 0x140]
dec eax
je 0x46c287
sub eax, esi
je 0x46c287
cmp word [ebx + 0x50], di
jne 0x46c28d
push 0x45
push ebx
call fcn.0045af60
movzx eax, byte [ebx + 0xc51]
sub eax, 0
je 0x46c295
dec eax
je 0x46c291
dec eax
jne 0x46c29d
push 0x49
jmp 0x46c297
push 0x4c
jmp 0x46c23d
push 0x4b
jmp 0x46c23d
cmp word [ebx + 0x50], di
jne 0x46c261
push 0x46
jmp 0x46c263
push 0x48
jmp 0x46c297
push 0x47
push ebx
call fcn.0045af60
cmp word [ebx + 0x368], di
je 0x46c2b3
cmp byte [ebx + 0xd10], 0
jbe 0x46c35d
cmp word [ebx + 0x57a], 0
jne 0x46c35d
push 0xaa
xor eax, eax
mov byte [ebp - 0xc], 0
lea edi, [ebp - 0xb]
push ebx
stosd dword es:[edi], eax
call fcn.0045af60
push 0xab
push ebx
call fcn.0045af60
cmp word [ebx + 0xd8e], 1
jne 0x46c315
push ebx
call fcn.0043db13
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
mov byte [ebp - 0xc], 0x1b
mov byte [ebp - 0xb], 0xf0
mov byte [ebp - 0xa], 0x10
mov byte [ebp - 9], 0xbb
call fcn.0043dbe6
push ebx
call fcn.0043db13
jmp 0x46c34d
mov eax, dword [ebx + 0x5238]
and dword [ebp - 0x2f90], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2f90]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x16290]
mov byte [ebp - 0xc], 0x1b
mov byte [ebp - 0xb], 0xf0
mov byte [ebp - 0xa], 0x10
mov byte [ebp - 9], 0xbb
call fcn.004834eb
push 0x11a
push ebx
call fcn.0045af60
xor edi, edi
inc edi
jmp 0x46c3a3
cmp dword [ebx + 0x1d8a0], edi
jne 0x46c36c
push 0xaa
jmp 0x46c39d
lea esi, [ebx + 0x140]
cmp word [esi], 0
je 0x46c3a3
push 0xc7
push ebx
call fcn.0045af60
movsx eax, word [esi]
movzx eax, byte [eax + 0x4dcf40]
push eax
push edi
push ebx
call fcn.0043e1a8
add esp, 0xc
push 0x11a
push ebx
call fcn.0045af60
push 0x42
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46c3e9
cmp word [ebx + 0x368], 0
jne 0x46c3ca
cmp byte [ebx + 0xd10], 0
jne 0x46c3ca
cmp dword [ebx + 0x1d8a0], edi
jne 0x46c3e9
movzx eax, byte [ebx + 0xde5]
dec eax
je 0x46c3de
dec eax
jne 0x46c3e9
push 0xad
jmp 0x46c3e3
push 0xac
push ebx
call fcn.0045af60
push 0x53
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46c410
movzx eax, byte [ebx + 0xd91]
sub eax, 0
je 0x46c408
dec eax
jne 0x46c410
push 0x73
jmp 0x46c40a
push 0x72
push ebx
call fcn.0045af60
movzx ecx, word [ebx + 0x5dc]
mov eax, 0x104
sub ecx, eax
je 0x46c432
dec ecx
je 0x46c42e
movsx ecx, word [ebx + 0x5c]
sub ecx, eax
je 0x46c432
dec ecx
jne 0x46c43a
push 0x3c
jmp 0x46c434
push 0x3d
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x13e]
dec eax
je 0x46c450
dec eax
je 0x46c486
cmp byte [ebx + 0xdde], 0
je 0x46c458
push 0x24
push ebx
call fcn.0045af60
push 0x43
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46c4ab
movzx eax, word [ebx + 0x9d9]
sub eax, 0
je 0x46c4a3
dec eax
je 0x46c49f
dec eax
je 0x46c498
dec eax
je 0x46c491
dec eax
je 0x46c48a
dec eax
jne 0x46c4ab
push 0xb4
jmp 0x46c4a5
push 0x25
jmp 0x46c452
push 0xb3
jmp 0x46c4a5
push 0xb2
jmp 0x46c4a5
push 0xb1
jmp 0x46c4a5
push 0x55
jmp 0x46c4a5
push 0x54
push ebx
call fcn.0045af60
cmp word [ebx + 0xd8e], 0
jne 0x46c525
push 0xd
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46c525
lea edi, [ebx + 0xa25]
cmp word [edi], 0
je 0x46c51d
push 0x65
push ebx
call fcn.0045af60
push 0x67
push ebx
call fcn.0045af60
movzx eax, word [edi]
push eax
lea eax, [ebp - 0x2fb8]
push 0x40bdcc
push eax
call fcn.004ac2d4
lea eax, [ebp - 0x2fb8]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c4ff
sub eax, edi
push eax
lea eax, [ebp - 0x2fb8]
push eax
push ebx
call fcn.0043dbe6
push 0x11a
jmp 0x46c51f
push 0x66
push ebx
call fcn.0045af60
push 0xe
push ebx
call fcn.004a53d4
xor edi, edi
inc edi
xor esi, esi
cmp eax, edi
jne 0x46c557
movzx eax, word [ebx + 0xa27]
sub eax, esi
je 0x46c54f
dec eax
je 0x46c54b
dec eax
jne 0x46c557
push 0x6a
jmp 0x46c551
push 0x69
jmp 0x46c551
push 0x68
push ebx
call fcn.0045af60
cmp word [ebx + 0x368], si
jne 0x46c569
cmp byte [ebx + 0xd10], 0
jbe 0x46c5e8
cmp byte [ebx + 0xc95], 0
jne 0x46c5e8
cmp byte [ebx + 0xde5], 2
jne 0x46c5e8
cmp word [ebx + 0xd8e], di
jne 0x46c5ae
push ebx
call fcn.0043db13
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
mov byte [ebp - 0xc], 0x1b
mov byte [ebp - 0xb], 0xf0
mov byte [ebp - 0xa], 0x10
mov byte [ebp - 9], 0xe9
call fcn.0043dbe6
push ebx
call fcn.0043db13
jmp 0x46c5ee
mov eax, dword [ebx + 0x5238]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2f90]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x16290]
mov dword [ebp - 0x2f90], esi
mov byte [ebp - 0xc], 0x1b
mov byte [ebp - 0xb], 0xf0
mov byte [ebp - 0xa], 0x10
mov byte [ebp - 9], 0xe9
call fcn.004834eb
jmp 0x46c5ee
push ebx
call fcn.0045dd95
cmp dword [ebx + 0x19e38], edi
jne 0x46c925
push 0x40
pop ecx
xor eax, eax
mov word [ebp - 0x358], si
lea edi, [ebp - 0x356]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x2f42]
mov word [ebp - 0x2f44], si
rep stosd dword es:[edi], eax
push 8
mov byte [ebp - 0x44], al
pop ecx
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
movsx eax, word [ebx + 0xde3]
sub eax, esi
je 0x46c644
dec eax
jne 0x46c64f
push 0xa9
jmp 0x46c649
push 0xa8
push ebx
call fcn.0045af60
mov esi, 0x405a00
lea edi, [ebx + 0x1747]
push esi
push edi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46c680
lea eax, [ebp - 0x2f90]
push eax
push edi
mov dword [ebp - 0x2f90], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
and word [ebp - 0xe0], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xde]
rep stosd dword es:[edi], eax
push 0x80
stosw word es:[edi], ax
lea eax, [ebp - 0xe0]
push eax
push 0x76
push ebx
call fcn.004a5ad4
test eax, eax
jne 0x46c6c2
push 0x40
lea eax, [ebp - 0xe0]
push eax
push 0
push 0x76
push ebx
call fcn.004a5f06
push esi
lea eax, [ebp - 0xe0]
push eax
push 0x40c920
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebx + 0x1747]
push eax
lea eax, [ebp - 0x358]
push eax
call esi
movsx eax, word [ebp - 0x2f8c]
add esp, 0x18
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.0045afa5
test eax, eax
jne 0x46c71e
lea eax, [ebp - 0x358]
push 0x40e9ac
push eax
call esi
pop ecx
pop ecx
push 0x21
lea esi, [ebx + 0xac7]
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.004ac4ed
and word [ebp - 0xe0], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xde]
rep stosd dword es:[edi], eax
push 0x40
stosw word es:[edi], ax
lea eax, [ebp - 0xe0]
push eax
push 0
push 0x77
push ebx
call fcn.004a5f06
lea eax, [ebp - 0x2f44]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
movsx eax, word [ebp - 0x2f8c]
pop ecx
pop ecx
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2f44]
push eax
call fcn.0045afa5
test eax, eax
je 0x46cc72
push 0x20
pop ecx
xor eax, eax
mov byte [ebp - 0x1d0], 0
lea edi, [ebp - 0x1cf]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xf
pop ecx
xor eax, eax
xor esi, esi
mov word [ebp - 0xa0], si
lea edi, [ebp - 0x9e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
pop ecx
xor eax, eax
mov word [ebp - 0x14c], si
lea edi, [ebp - 0x14a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x82
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1d0]
push eax
mov dword [ebp - 0x2f98], 1
call fcn.004ac4ed
push 0x20
lea eax, [ebp - 0xa0]
push eax
push esi
push 0x84
push ebx
call fcn.004a5f06
push 0x20
mov edi, eax
lea eax, [ebp - 0x14c]
push eax
push esi
push 0xdf
push ebx
call fcn.004a5f06
test eax, eax
je 0x46c848
lea eax, [ebp - 0x14c]
push 0x40e9a0
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46c848
cmp byte [ebx + 0x2458], al
jne 0x46c848
mov dword [ebp - 0x2f98], esi
cmp edi, esi
je 0x46c8f8
cmp byte [ebx + 0xc93], 1
jne 0x46c898
lea eax, [ebp - 0xa0]
push 0x40e994
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46c898
cmp dword [ebx + 0x1d8a4], esi
jne 0x46c898
cmp dword [ebp - 0x2f98], 1
jne 0x46c898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1d0]
push eax
push ebx
call fcn.0045b7b3
jmp 0x46cc72
push 0x96
push ebx
call fcn.0045af60
lea eax, [ebp - 0x358]
push eax
push ebx
call fcn.0045bfed
mov esi, 0xcb
push esi
push ebx
call fcn.0045af60
cmp byte [ebx + 0xc93], 1
je 0x46c8e9
cmp dword [ebx + 0x1d8a4], 1
je 0x46c8e9
push 0x97
push ebx
call fcn.0045af60
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.0043e17f
push esi
jmp 0x46cb06
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.0045b545
jmp 0x46cc72
push 0x96
push ebx
call fcn.0045af60
lea eax, [ebp - 0x358]
push eax
push ebx
call fcn.0045bfed
mov esi, 0xcb
push esi
push ebx
call fcn.0045af60
cmp byte [ebx + 0xc93], 1
jmp 0x46c8cc
cmp dword [ebx + 0x19e3c], edi
jne 0x46cb11
push 0x40
xor eax, eax
mov word [ebp - 0x358], si
pop ecx
lea edi, [ebp - 0x356]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movsx eax, word [ebx + 0xde3]
sub eax, esi
je 0x46c95c
dec eax
jne 0x46c967
push 0xa9
jmp 0x46c961
push 0xa8
push ebx
call fcn.0045af60
lea esi, [ebx + 0x1747]
push 0x405a00
push esi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x46cc72
and word [ebp - 0x2f80], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x2f7e]
rep stosd dword es:[edi], eax
push 0x40
stosw word es:[edi], ax
lea eax, [ebp - 0x2f80]
push eax
push 1
push 0x78
push ebx
call fcn.004a5f06
push 0x405a00
lea eax, [ebp - 0x2f80]
push eax
push 0x40c920
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x81
lea eax, [ebp - 0x358]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
movsx eax, word [ebp - 0x2f8c]
add esp, 0x1c
push eax
lea eax, [ebp - 0x2f80]
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.0045afa5
cmp eax, 1
jne 0x46cc72
and word [ebp - 0x14c], 0
and word [ebp - 0xa0], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x14a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x20
pop ecx
xor eax, eax
mov byte [ebp - 0x1d0], 0
lea edi, [ebp - 0x1cf]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x9e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x82
lea eax, [ebp - 0x358]
push eax
xor esi, esi
lea eax, [ebp - 0x1d0]
inc esi
push eax
mov dword [ebp - 0x2f8c], esi
call fcn.004ac4ed
push 0x20
lea eax, [ebp - 0x14c]
push eax
push esi
push 0x84
push ebx
call fcn.004a5f06
push 0x20
mov dword [ebp - 0x2f90], eax
lea eax, [ebp - 0xa0]
push eax
push esi
push 0xe0
push ebx
call fcn.004a5f06
test eax, eax
mov edi, 0x40e9a0
je 0x46cabe
lea eax, [ebp - 0xa0]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46cabe
cmp byte [ebx + 0x2459], al
jne 0x46cabe
and dword [ebp - 0x2f8c], eax
cmp dword [ebp - 0x2f90], 0
je 0x46cadb
lea eax, [ebp - 0x14c]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46cae9
cmp dword [ebp - 0x2f8c], esi
jne 0x46cae9
push esi
jmp 0x46cc65
push 0x96
push ebx
call fcn.0045af60
lea eax, [ebp - 0x358]
push eax
push ebx
call fcn.0045bfed
push 0xcb
push ebx
call fcn.0045af60
jmp 0x46cc72
cmp dword [ebx + 0x19e40], edi
jne 0x46cc72
and word [ebp - 0x358], 0
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x356]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movsx eax, word [ebx + 0xde3]
sub eax, 0
je 0x46cb4a
dec eax
jne 0x46cb55
push 0xa9
jmp 0x46cb4f
push 0xa8
push ebx
call fcn.0045af60
lea esi, [ebx + 0x1747]
push 0x405a00
push esi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x46cc72
and word [ebp - 0x2f80], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x2f7e]
rep stosd dword es:[edi], eax
push 0x40
stosw word es:[edi], ax
lea eax, [ebp - 0x2f80]
push eax
push 2
push 0x78
push ebx
call fcn.004a5f06
push 0x405a00
lea eax, [ebp - 0x2f80]
push eax
push 0x40c920
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x81
lea eax, [ebp - 0x358]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
movsx eax, word [ebp - 0x2f8c]
add esp, 0x1c
push eax
lea eax, [ebp - 0x2f80]
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.0045afa5
cmp eax, 1
jne 0x46cc72
and word [ebp - 0xa0], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x9e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x20
pop ecx
xor eax, eax
mov byte [ebp - 0x1d0], 0
lea edi, [ebp - 0x1cf]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x82
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004ac4ed
push 0x20
lea eax, [ebp - 0xa0]
push eax
push 2
push 0x84
push ebx
call fcn.004a5f06
test eax, eax
je 0x46cc63
lea eax, [ebp - 0xa0]
push 0x40e9a0
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x46cc72
push 2
lea eax, [ebp - 0x1d0]
push eax
push ebx
call fcn.0045baf4
xor edi, edi
inc edi
cmp word [ebx + 0xd8e], di
jne 0x46ccc7
push 0x35
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46ccc7
movzx eax, byte [ebx + 0xddf]
dec eax
je 0x46ccbc
dec eax
je 0x46ccb5
dec eax
je 0x46ccae
dec eax
je 0x46cca7
dec eax
jne 0x46ccc7
push 0x9f
jmp 0x46ccc1
push 0x9e
jmp 0x46ccc1
push 0x9d
jmp 0x46ccc1
push 0x9c
jmp 0x46ccc1
push 0x9b
push ebx
call fcn.0045af60
push 0x8a
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46ccf6
mov al, byte [ebx + 0xd5f]
cmp al, 1
jne 0x46cce7
push 0xd5
jmp 0x46ccf0
test al, al
jne 0x46ccf6
push 0xd6
push ebx
call fcn.0045af60
push 0x8b
push ebx
call fcn.004a53d4
cmp eax, edi
mov esi, 0xe6
jne case.0x46cd16.7
movzx eax, byte [ebx + 0xd5e]
cmp eax, 0xa
ja case.0x46cd16.7
jmp dword [eax*4 + 0x46d6f2]
push 0xde
jmp 0x46cd5d
push 0xdf
jmp 0x46cd5d
push 0xe0
jmp 0x46cd5d
push 0xe1
jmp 0x46cd5d
push 0xe2
jmp 0x46cd5d
push 0xe3
jmp 0x46cd5d
push 0xe4
jmp 0x46cd5d
push 0xe5
jmp 0x46cd5d
push esi
jmp 0x46cd5d
push 0xe7
push ebx
call fcn.0045af60
push esi
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46cdb6
cmp byte [ebx + 0xd5e], 6
jne 0x46cdb6
movzx eax, byte [ebx + 0x245b]
sub eax, 0
je 0x46cdab
dec eax
je 0x46cda4
dec eax
je 0x46cd9d
dec eax
je 0x46cd96
dec eax
jne 0x46cdb6
push 0x118
jmp 0x46cdb0
push 0x117
jmp 0x46cdb0
push 0x116
jmp 0x46cdb0
push 0x115
jmp 0x46cdb0
push 0x114
push ebx
call fcn.0045af60
push 0x8c
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d051
cmp word [ebx + 0xa61], di
jne 0x46cf69
push 0x32
pop edi
cmp word [ebx + 0xa2d], di
jne 0x46ce13
cmp word [ebx + 0xa2f], di
jne 0x46ce13
cmp word [ebx + 0xa31], di
jne 0x46ce13
cmp word [ebx + 0xa33], di
jne 0x46ce13
cmp word [ebx + 0xa35], di
jne 0x46ce13
cmp word [ebx + 0xa37], di
je 0x46cf69
push 0xd7
push ebx
call fcn.0045af60
push 0xd8
push ebx
call fcn.0045af60
movzx eax, word [ebx + 0xa2d]
push eax
push 1
push ebx
call fcn.0043e1a8
add esp, 0xc
mov esi, 0x11a
push esi
push ebx
call fcn.0045af60
push 0xd9
push ebx
call fcn.0045af60
movzx eax, word [ebx + 0xa2f]
push eax
push 1
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
push 0xda
push ebx
call fcn.0045af60
movzx eax, word [ebx + 0xa31]
push eax
push 1
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
cmp byte [ebx + 0x1f3e], 0
jne 0x46cf0c
push 0xdb
push ebx
call fcn.0045af60
movzx eax, word [ebx + 0xa33]
push eax
push 1
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
push 0xdc
push ebx
call fcn.0045af60
movzx eax, word [ebx + 0xa35]
push eax
push 1
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
push 0xdd
push ebx
call fcn.0045af60
movzx eax, word [ebx + 0xa37]
push eax
push 1
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
jmp 0x46cf21
mov word [ebx + 0xa33], di
mov word [ebx + 0xa35], di
mov word [ebx + 0xa37], di
cmp word [ebx + 0xd8e], 1
je 0x46cf35
cmp word [ebx + 0x18934], 2
jne 0x46cf6e
and word [ebx + 0xa61], 0
mov word [ebx + 0xa2d], di
mov word [ebx + 0xa2f], di
mov word [ebx + 0xa31], di
mov word [ebx + 0xa33], di
mov word [ebx + 0xa35], di
mov word [ebx + 0xa37], di
jmp 0x46cf6e
mov esi, 0x11a
push 0xc8
push ebx
call fcn.004a53d4
cmp eax, 1
jne 0x46d056
cmp byte [ebx + 0x1f3e], al
jne 0x46d056
xor eax, eax
cmp word [ebx + 0x1f3f], ax
jne 0x46cfaf
cmp word [ebx + 0x1f41], ax
jne 0x46cfaf
cmp word [ebx + 0x1f43], ax
je 0x46d056
push 0x107
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x1f3f]
push eax
xor edi, edi
inc edi
push edi
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
push 0x108
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x1f41]
push eax
push edi
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
push 0x109
push ebx
call fcn.0045af60
movsx eax, word [ebx + 0x1f43]
push eax
push edi
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
push ebx
call fcn.0045af60
cmp word [ebx + 0xd8e], di
je 0x46d031
cmp word [ebx + 0x18934], 2
jne 0x46d056
xor eax, eax
mov byte [ebx + 0x1f3e], 0
mov word [ebx + 0x1f3f], ax
mov word [ebx + 0x1f41], ax
mov word [ebx + 0x1f43], ax
jmp 0x46d056
mov esi, 0x11a
xor edi, edi
inc edi
cmp word [ebx + 0xd8e], di
jne 0x46d0ac
push 0x36
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d0ac
mov ax, word [ebx + 0xd62]
cmp ax, di
jne 0x46d081
push 0xa0
jmp 0x46d0a6
cmp ax, 2
jne 0x46d08e
push 0xa1
jmp 0x46d0a6
cmp ax, 3
jne 0x46d09b
push 0xa2
jmp 0x46d0a6
cmp ax, 4
je 0x46d0ac
push 0xa3
push ebx
call fcn.0045af60
push 0x37
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d0d8
mov al, byte [ebx + 0xde0]
test al, al
jne 0x46d0c9
push 0xa5
jmp 0x46d0d2
cmp al, 1
jne 0x46d0d8
push 0xa4
push ebx
call fcn.0045af60
cmp byte [ebx + 0xd0e], 1
jne 0x46d0ec
push 0xbc
push ebx
call fcn.0045af60
cmp word [ebx + 0xd8e], di
jne 0x46d1b3
push 0x4a
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d1b3
mov al, byte [ebx + 0xb4d]
test al, al
je 0x46d11b
cmp al, 1
jne 0x46d1b3
lea edi, [ebx + 0xb4e]
push 0x405a00
push edi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x46d1b0
xor eax, eax
cmp word [ebx + 0x140], ax
jne 0x46d1b0
cmp word [ebx + 0x368], ax
jne 0x46d1b0
cmp byte [ebx + 0xd10], al
jne 0x46d1b0
cmp word [ebx + 0x36a], ax
jne 0x46d1b0
cmp word [ebx + 0x57a], ax
jne 0x46d1b0
cmp word [ebx + 0x584], ax
jne 0x46d1b0
mov al, byte [ebx + 0xb4d]
test al, al
jne 0x46d17b
push 0xba
jmp 0x46d184
cmp al, 1
jne 0x46d18a
push 0xbb
push ebx
call fcn.0045af60
push 0x80
push edi
lea eax, [ebp - 0x4dc]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x4dc]
push eax
push ebx
call fcn.0043e17f
push esi
push ebx
call fcn.0045af60
xor edi, edi
inc edi
push 0x44
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d1e8
movzx eax, byte [ebx + 0xc50]
dec eax
je 0x46d1dd
dec eax
je 0x46d1d6
dec eax
jne 0x46d1e8
push 0xb0
jmp 0x46d1e2
push 0xaf
jmp 0x46d1e2
push 0xae
push ebx
call fcn.0045af60
push 0x8e
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d212
cmp byte [ebx + 0xc94], 1
jne 0x46d207
push 0xc5
jmp 0x46d20c
push 0xc6
push ebx
call fcn.0045af60
push 0x57
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d23d
movzx eax, byte [ebx + 0xcb4]
dec eax
je 0x46d232
dec eax
jne 0x46d23d
push 0xc9
jmp 0x46d237
push 0xc8
push ebx
call fcn.0045af60
push 0x6f
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d273
movzx eax, byte [ebx + 0xcd5]
dec eax
je 0x46d268
dec eax
je 0x46d261
dec eax
dec eax
jne 0x46d273
push 0xcc
jmp 0x46d26d
push 0xce
jmp 0x46d26d
push 0xcd
push ebx
call fcn.0045af60
push 0x70
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d2b2
movzx eax, byte [ebx + 0xcd6]
dec eax
je 0x46d2a7
dec eax
je 0x46d2a0
dec eax
je 0x46d299
dec eax
jne 0x46d2b2
push 0xcf
jmp 0x46d2ac
push 0xd0
jmp 0x46d2ac
push 0xd2
jmp 0x46d2ac
push 0xd1
push ebx
call fcn.0045af60
push 0xb0
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d30c
movzx eax, byte [ebx + 0x1c99]
dec eax
je 0x46d306
dec eax
je 0x46d2d9
dec eax
jne 0x46d30c
push ebx
call fcn.0045d6bf
jmp 0x46d30c
xor eax, eax
mov byte [ebp - 0x10], 0
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xa
lea eax, [ebx + 0x1c9a]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004ac4ed
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.0046080c
xor edi, edi
inc edi
jmp 0x46d30c
push ebx
call fcn.0045d507
push 0xb1
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d3ec
mov al, byte [ebx + 0x1f37]
test al, al
jbe 0x46d3e1
movzx eax, al
dec eax
je 0x46d3ab
dec eax
je 0x46d399
dec eax
je 0x46d387
dec eax
je 0x46d375
dec eax
je 0x46d363
dec eax
jne 0x46d3e1
push 0x111
push ebx
call fcn.0045af60
push 0x113
push ebx
call fcn.0045af60
push 0xab
jmp 0x46d3c6
push 0x111
push ebx
call fcn.0045af60
push 0x112
jmp 0x46d356
push 0x100
push ebx
call fcn.0045af60
push 0x105
jmp 0x46d3bb
push 0x100
push ebx
call fcn.0045af60
push 0x104
jmp 0x46d3bb
push 0x100
push ebx
call fcn.0045af60
push 0x103
jmp 0x46d3bb
push 0x100
push ebx
call fcn.0045af60
push 0x102
push ebx
call fcn.0045af60
push 0x106
push ebx
call fcn.0045af60
movzx eax, byte [ebx + 0x1f38]
push eax
push edi
push ebx
call fcn.0043e1a8
add esp, 0xc
push esi
jmp 0x46d3e6
push 0x101
push ebx
call fcn.0045af60
push 0xcf
push ebx
call fcn.004a53d4
cmp eax, edi
jne 0x46d56a
movsx eax, word [ebx + 0x1f49]
dec eax
je 0x46d4d3
dec eax
jne 0x46d56a
xor eax, eax
mov word [ebp - 0x6e4], ax
mov dword [ebp - 0x2f90], eax
mov dword [ebp - 0x2f8c], eax
mov ecx, 0x81
lea edi, [ebp - 0x6e2]
rep stosd dword es:[edi], eax
push 0x10a
push ebx
stosw word es:[edi], ax
call fcn.0045af60
push 0x10c
push ebx
call fcn.0045af60
lea eax, [ebx + 0x1f4d]
push eax
push ebx
call fcn.0045c061
push 0xcb
push ebx
call fcn.0045af60
lea eax, [ebx + 0x1a468]
push eax
lea eax, [ebp - 0x6e4]
push 0x40c770
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebx + 0x19a24]
push eax
lea eax, [ebp - 0x2f8c]
push eax
call fcn.004806cf
test eax, eax
jne 0x46d56a
push 4
lea eax, [ebp - 0x2f90]
push eax
push 4
push 0
push 0x40e96c
push dword [ebp - 0x2f8c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2f8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46d56a
push 0x10b
push ebx
call fcn.0045af60
push 0x10d
push ebx
call fcn.0045af60
lea eax, [ebx + 0x1f4d]
push eax
push ebx
call fcn.0045c061
mov edi, 0xcb
push edi
push ebx
call fcn.0045af60
push 0x10e
push ebx
call fcn.0045af60
movzx eax, byte [ebx + 0x2155]
push eax
push ebx
call fcn.0045dce4
push esi
push ebx
call fcn.0045af60
cmp byte [ebx + 0x235e], 0
je 0x46d56a
push 0x10f
push ebx
call fcn.0045af60
lea eax, [ebx + 0x2156]
push eax
push ebx
call fcn.0045c061
push edi
push ebx
call fcn.0045af60
push 0x110
push ebx
call fcn.0045af60
movzx eax, byte [ebx + 0x235e]
push eax
push ebx
call fcn.0045dce4
push esi
push ebx
call fcn.0045af60
push dword [ebp - 0x2f94]
push dword [ebp - 0x2fb0]
push dword [ebp - 0x2f88]
push ebx
call fcn.0045c397
xor esi, esi
inc esi
cmp word [ebx + 0xd8e], si
jne 0x46d6da
push 0xad
push ebx
call fcn.004a53d4
cmp eax, esi
push ebx
jne 0x46d68a
call fcn.0047eafc
push esi
lea eax, [ebx + 0x5230]
push 0
push eax
mov dword [ebp - 0x2f94], eax
call fcn.004b6e7e
cmp word [ebx + 0x578], si
jne 0x46d6e0
cmp byte [ebx + 0x1f35], 0
push 5
pop ecx
mov esi, 0x40e958
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
je 0x46d62f
push 0x408a50
push ebx
mov dword [0x4e22f4], 1
call fcn.0047df12
push ebx
call fcn.0043db13
lea eax, [ebp - 0x18]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d604
lea ecx, [ebp - 0x2fb4]
push ecx
sub eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x16290]
call fcn.004834eb
push dword [ebp - 0x2f94]
call fcn.004b6e00
cmp byte [ebx + 0x1f36], 0
je 0x46d6e0
push 0x408a58
push ebx
call fcn.0047df12
push ebx
mov dword [0x4e22f4], 2
call fcn.0043db13
lea eax, [ebp - 0x18]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d65d
lea ecx, [ebp - 0x2fb4]
push ecx
sub eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x16290]
call fcn.004834eb
push dword [ebp - 0x2f94]
call fcn.004b6e00
jmp 0x46d6e0
call fcn.0047eafc
push esi
lea eax, [ebx + 0x5230]
push 0
push eax
mov dword [ebp - 0x2f94], eax
call fcn.004b6e7e
cmp word [ebx + 0x578], si
jne 0x46d6e0
push 5
pop ecx
push 0x408a50
mov esi, 0x40e958
lea edi, [ebp - 0x18]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0047df12
push ebx
call fcn.0043db13
lea eax, [ebp - 0x18]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d6d1
jmp 0x46d664
push ebx
call fcn.00492b26
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.004a9585
pop edi
pop esi
pop ebx
leave
ret 4