Function at 0x1004627c
Capabilities:
Connect pipe
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084e17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push esi
push edi
push 3
lea ecx, [ebp - 0xf4]
call fcn.10026565
and dword [ebp - 4], 0
mov dword [ebp - 0x54], 0xfffa
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x40], 0x6af8
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0xe0], 0
jmp 0x100462ec
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x1004630e
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov dword [eax], 0x3dce9d05
jmp 0x100462df
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
cmp dword [eax], 0
jne 0x1004635f
mov esi, dword [ebp - 0x54]
sub esi, 5
push 0
lea ecx, [ebp - 0xf4]
call fcn.100265d2
cmp esi, dword [eax]
jle 0x10046343
mov dword [ebp - 0x1ec], 1
jmp 0x1004634a
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x1ec], 0xf6f0
jl 0x1004635f
and dword [ebp - 0x2a4], 0
jmp 0x10046369
mov dword [ebp - 0x2a4], 1
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov ecx, dword [ebp - 0x2a4]
cmp ecx, dword [eax]
jg 0x1004638c
mov dword [ebp - 0x2ac], 1
jmp 0x10046393
and dword [ebp - 0x2ac], 0
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov ecx, dword [ebp - 0x54]
cmp dword [eax], ecx
jle 0x100463b3
mov dword [ebp - 0x2b4], 1
jmp 0x100463ba
and dword [ebp - 0x2b4], 0
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov ecx, 0xfff7
sub ecx, dword [ebp - 0x2b4]
mov eax, dword [eax]
add eax, ecx
imul eax, eax, 0x2314
test eax, eax
je 0x10046759
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x130], 8
mov dword [ebp - 0x398], 0x54e7f13b
mov dword [ebp - 0x248], 0x89f2e072
mov dword [ebp - 0x2cc], 0x84365721
mov dword [ebp - 0x2c4], 0xc24489be
mov dword [ebp - 0x3c0], 1
push 3
lea ecx, [ebp - 0x3d4]
call fcn.10026565
mov byte [ebp - 4], 1
mov dword [ebp - 0x428], 0xfffffffc
mov dword [ebp - 0x2d4], 0xffffffff
mov dword [ebp - 0x2c], 0
jmp 0x1004645f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1004647b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3d4]
call fcn.100265d2
mov dword [eax], 0xfffffff8
jmp 0x10046458
mov dword [ebp - 0x2c], 0
jmp 0x1004648b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100464a1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x424], 0xd58e56a9
jmp 0x10046484
cmp dword [ebp - 0x130], 0
je 0x100466bb
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x2c4], 0
jne 0x100464cc
mov dword [ebp - 0x270], 1
jmp 0x100464d3
and dword [ebp - 0x270], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x424]
cmp dword [ebp - 0x270], eax
jge 0x100464f4
mov dword [ebp - 0x228], 1
jmp 0x100464fb
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x228], eax
jne 0x10046515
mov dword [ebp - 0x120], 1
jmp 0x1004651c
and dword [ebp - 0x120], 0
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x120]
jg 0x10046557
cmp dword [ebp - 0x70], 0
je 0x10046557
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
cmp dword [eax], 0
je 0x10046557
mov dword [ebp - 0x230], 1
jmp 0x1004655e
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0xe8]
cmp eax, 0x3645
jge 0x1004657d
mov dword [ebp - 0x128], 1
jmp 0x10046584
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x128], eax
je 0x1004659e
mov dword [ebp - 0x238], 1
jmp 0x100465a5
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0x3d57
jne 0x100465bd
mov dword [ebp - 0x240], 1
jmp 0x100465c4
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x240], eax
jle 0x100465de
mov dword [ebp - 0x138], 1
jmp 0x100465e5
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x7bbcec63
je 0x10046609
mov dword [ebp - 0x140], 1
jmp 0x10046610
and dword [ebp - 0x140], 0
cmp dword [ebp - 0x140], 2
jl 0x10046625
mov dword [ebp - 0x250], 1
jmp 0x1004662c
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0
je 0x10046641
mov dword [ebp - 0x10c], 1
jmp 0x10046648
and dword [ebp - 0x10c], 0
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov ecx, dword [ebp - 0x10c]
mov dword [eax], ecx
imul eax, dword [ebp - 0x10c], 0
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x70]
jge 0x10046678
mov dword [ebp - 0x148], 1
jmp 0x1004667f
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x148], eax
je 0x10046696
mov dword [ebp - 0x258], 1
jmp 0x1004669d
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x258]
jg 0x100466bb
mov dword [ebp - 0x150], 1
jmp 0x100466c2
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x150]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xe8], eax
jge 0x100466e8
mov dword [ebp - 0x260], 1
jmp 0x100466ef
and dword [ebp - 0x260], 0
mov dword [ebp - 0x158], 0x86992f1e
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x260]
cmp dword [ebp - 0x158], eax
jge 0x10046717
mov dword [ebp - 0x268], 1
jmp 0x1004671e
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x268], eax
jl 0x10046735
mov dword [ebp - 0x160], 1
jmp 0x1004673c
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3d4]
call fcn.100265cd
jmp 0x10046998
mov dword [ebp - 0x10], 0xe2d7e08c
mov dword [ebp - 0x224], 0x586bc1af
mov dword [ebp - 0x194], 0xffffffff
cmp dword [ebp - 0x54], 0
jne 0x10046887
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100467aa
mov eax, 0xd117b57b
test eax, eax
je 0x100467aa
cmp dword [ebp - 0x10], 0
je 0x100467aa
mov dword [ebp - 0x274], 1
jmp 0x100467b1
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x274], eax
jle 0x100467c8
mov dword [ebp - 0x168], 1
jmp 0x100467cf
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x168], eax
jne 0x100467e6
mov dword [ebp - 0x27c], 1
jmp 0x100467ed
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x27c]
jne 0x10046804
mov dword [ebp - 0x170], 1
jmp 0x1004680b
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x170], eax
jg 0x10046822
mov dword [ebp - 0x284], 1
jmp 0x10046829
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x10]
je 0x10046843
mov dword [ebp - 0x178], 1
jmp 0x1004684a
and dword [ebp - 0x178], 0
cmp dword [ebp - 0x178], 0xffff
je 0x10046862
mov dword [ebp - 0x2e8], 1
jmp 0x10046869
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x384], eax
mov eax, 0x9240
test eax, eax
jne 0x10046887
and dword [ebp - 0x28c], 0
jmp 0x10046891
mov dword [ebp - 0x28c], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x28c], eax
jg 0x100468a8
mov dword [ebp - 0x180], 1
jmp 0x100468af
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x180]
je 0x100468cc
cmp dword [ebp - 0x10], 0
je 0x100468cc
mov dword [ebp - 0x294], 1
jmp 0x100468d3
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x294], eax
je 0x100468ea
mov dword [ebp - 0x29c], 1
jmp 0x100468f1
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x29c], eax
jl 0x10046908
mov dword [ebp - 0x18c], 1
jmp 0x1004690f
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x194], eax
jle 0x1004693e
mov dword [ebp - 0x26c], 1
jmp 0x10046945
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x26c], eax
jle 0x1004695c
mov dword [ebp - 0x19c], 1
jmp 0x10046963
and dword [ebp - 0x19c], 0
cmp dword [ebp - 0x19c], 1
jg 0x10046978
mov dword [ebp - 0x22c], 1
jmp 0x1004697f
and dword [ebp - 0x22c], 0
mov esi, dword [ebp - 0x54]
imul esi, dword [ebp - 0x22c]
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov dword [eax], esi
mov dword [ebp - 0x1c], 2
jmp 0x100469a8
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100469fd
push 1
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf4]
call fcn.100265d2
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x40], 0x1c
jmp 0x100469df
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x10
jg 0x100469fb
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x100469f9
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x100469d8
jmp 0x100469a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.100265cd
mov dword [ebp - 0xdc], 0xe0cf5720
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x10046a3e
push 0x3ef
push 0x15f5
push 0x1763
push 0x1f0d
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xdc], 0xffffffee
jmp 0x10046a57
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xffffffe5
jne 0x10046a76
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10046a74
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x10046a4a
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x1a4], 0xfffffffa
push 1
lea ecx, [ebp - 0x340]
call fcn.10026565
mov dword [ebp - 4], 2
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x2f8], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x10046ac9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10046adf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x104], 0xfce6bb2f
jmp 0x10046ac2
mov dword [ebp - 0x20], 0
jmp 0x10046aef
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10046b0b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x340]
call fcn.100265d2
mov dword [eax], 0xf57440e7
jmp 0x10046ae8
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x10046b2b
mov dword [ebp - 0x2b0], 1
jmp 0x10046b32
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2b0], eax
jg 0x10046b4b
xor eax, eax
inc eax
jne 0x10046b4b
and dword [ebp - 0x1ac], 0
jmp 0x10046b55
mov dword [ebp - 0x1ac], 1
cmp dword [ebp - 0x1ac], 0x31f145ba
jge 0x10046b6d
mov dword [ebp - 0x234], 1
jmp 0x10046b74
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x234], eax
jne 0x10046b8b
mov dword [ebp - 0x1b4], 1
jmp 0x10046b92
and dword [ebp - 0x1b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x1b4], eax
jle 0x10046bb3
mov dword [ebp - 0x278], 1
jmp 0x10046bba
and dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 9
jne 0x10046bcf
mov dword [ebp - 0x1bc], 1
jmp 0x10046bd6
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x1bc]
cmp eax, 0xbefa
jge 0x10046bf2
mov dword [ebp - 0x2f0], 1
jmp 0x10046bf9
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x394], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
mov dword [ebp - 0x39c], eax
xor eax, eax
inc eax
imul eax, eax, 0x491d
test eax, eax
je 0x10046c34
cmp dword [ebp - 0x30], 0
je 0x10046c34
mov dword [ebp - 0x23c], 1
jmp 0x10046c3b
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x23c], eax
je 0x10046c52
mov dword [ebp - 0xa0], 1
jmp 0x10046c59
and dword [ebp - 0xa0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa0]
mov dword [ebp + eax - 0x104], ecx
push 0
lea ecx, [ebp - 0x340]
call fcn.100265d2
mov ecx, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa0], eax
jle 0x10046c98
mov dword [ebp - 0x1c4], 1
jmp 0x10046c9f
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x30], eax
jg 0x10046cc2
mov dword [ebp - 0x1cc], 1
jmp 0x10046cc9
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x2f8], eax
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10046cf1
push 0x12d8
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.100265cd
push 1
lea ecx, [ebp - 0x100]
call fcn.10026565
mov dword [ebp - 4], 3
mov dword [ebp - 0x8c], 0x3f6a0837
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x3a4]
push eax
call fcn.1004188b
pop ecx
pop ecx
mov dword [ebp - 0xa8], 0x256915a
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0xd4], 0
jmp 0x10046d60
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x10046d7c
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x3b4], 0xffff
jmp 0x10046d53
mov byte [ebp - 0x47], 0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x10046d96
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov dword [ebp - 0xa8], 0
jmp 0x10046daf
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10046e0c
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0xb8], 0
jmp 0x10046ddb
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jg 0x10046e0a
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10046e08
push 0xb4e
push 0
push 0
push 0
push 0x96f
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x10046dce
jmp 0x10046da2
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
mov dword [eax], 0xffffffee
jmp 0x10046e45
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x244]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
cmp dword [eax], 0x12
jle 0x10047c3d
mov dword [ebp - 0x6c], 0xfffffff7
mov dword [ebp - 0x84], 0xf9b3198a
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x264], 0xd1299d62
mov dword [ebp - 0x3bc], 0x6402d6fa
mov dword [ebp - 0xb0], 0
jmp 0x10046ea3
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10046ebc
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x78], 4
jmp 0x10046e96
mov dword [ebp - 0x84], 0xffffffe9
jmp 0x10046ed5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x17
jg 0x1004731a
mov dword [ebp - 0x5c], 0x8bb4
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0x88], 0xa42bbd4a
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xd0], 0x23e6
mov dword [ebp - 0xc8], 0
jmp 0x10046f2e
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10046f4a
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x2e0], 0x413e458c
jmp 0x10046f21
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x5c], 0
jne 0x10046f71
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
jne 0x10046f71
and dword [ebp - 0x280], 0
jmp 0x10046f7b
mov dword [ebp - 0x280], 1
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2e0]
imul ecx, dword [ebp - 0x2c8]
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x78]
jl 0x10046fac
mov dword [ebp - 0x1d4], 1
jmp 0x10046fb3
and dword [ebp - 0x1d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x1d4], eax
jg 0x10046fd1
mov dword [ebp - 0x2d0], 1
jmp 0x10046fd8
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x410], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x78], 0xfffffffb
jg 0x10046ffa
mov dword [ebp - 0x1dc], 1
jmp 0x10047001
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x280]
add eax, dword [ebp - 0x1dc]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x78]
cmp eax, 0x1cd4
je 0x1004702a
mov dword [ebp - 0x24c], 1
jmp 0x10047031
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x24c], eax
jne 0x10047058
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2e0], 0
je 0x10047058
mov dword [ebp - 0x30c], 1
jmp 0x1004705f
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x94], 0x4485e09b
je 0x10047077
mov dword [ebp - 0x1e4], 1
jmp 0x1004707e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1e4], eax
jle 0x10047095
mov dword [ebp - 0x2a8], 1
jmp 0x1004709c
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x5c]
neg eax
imul eax, dword [ebp - 0x2a8]
cmp eax, 0xb06f8616
je 0x100470bb
mov dword [ebp - 0x114], 1
jmp 0x100470c2
and dword [ebp - 0x114], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x114], eax
jne 0x100470e0
mov dword [ebp - 0x2d8], 1
jmp 0x100470e7
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x84], eax
jne 0x10047110
mov dword [ebp - 0x254], 1
jmp 0x10047117
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x3c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x78]
test eax, eax
je 0x10047141
cmp dword [ebp - 0x18], 0
je 0x10047141
mov dword [ebp - 0x1f4], 1
jmp 0x10047148
and dword [ebp - 0x1f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f4]
sub ecx, dword [ebp + eax - 0x78]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x78], ecx
mov dword [ebp - 0x18], 1
jmp 0x10047172
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10047315
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x78], 0
je 0x100471bd
mov dword [ebp - 0x88], 0
jmp 0x1004719f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x100471b8
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x78], 0xfffffffd
jmp 0x10047192
jmp 0x100472fa
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x3c], 0
jmp 0x100471d7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x100472fa
mov dword [ebp - 0xd0], 1
jmp 0x100471fa
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x100472e1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x108]
cmp dword [ebp + eax*4 - 0x78], ecx
jle 0x10047222
mov dword [ebp - 0x288], 1
jmp 0x10047229
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xffffffff
jb 0x1004723e
mov dword [ebp - 0x1fc], 1
jmp 0x10047245
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0xffffffff
jg 0x1004725a
mov dword [ebp - 0x25c], 1
jmp 0x10047261
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x25c], eax
jge 0x10047278
mov dword [ebp - 0x204], 1
jmp 0x1004727f
and dword [ebp - 0x204], 0
imul eax, dword [ebp - 0x204], 0
cmp eax, dword [ebp - 0x108]
je 0x1004729a
mov dword [ebp - 0x2a0], 1
jmp 0x100472a1
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x108]
imul ecx, dword [ebp - 0x2a0]
cmp dword [ebp + eax*4 - 0x78], ecx
jg 0x100472c3
mov dword [ebp - 0x20c], 1
jmp 0x100472ca
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
neg eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x2e0], eax
jmp 0x100471ed
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x100472f5
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x100471d0
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10047310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1004716b
jmp 0x10046ec8
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x264], eax
push 3
lea ecx, [ebp - 0x328]
call fcn.10026565
mov byte [ebp - 4], 4
mov dword [ebp - 0x214], 0xf251d69f
push 3
lea ecx, [ebp - 0x3e4]
call fcn.10026565
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], 0
jmp 0x10047363
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10047379
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x434], 0
jmp 0x1004735c
mov dword [ebp - 0x24], 0
jmp 0x10047389
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100473a5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3e4]
call fcn.100265d2
mov dword [eax], 1
jmp 0x10047382
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x434]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x214], 0x37b1891f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3e4]
call fcn.100265cd
mov dword [ebp - 0x318], 0xeaba4a2c
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x1a0], 0x7ed6f186
mov dword [ebp - 0x110], 0x5a8b060d
mov dword [ebp - 0x190], 0xdde9ab5c
mov dword [ebp - 0x90], 0xc
jmp 0x10047430
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffffa
jne 0x1004744d
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x1004744b
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x10047423
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x90], eax
je 0x10047473
mov dword [ebp - 0x290], 1
jmp 0x1004747a
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x290]
lea eax, [ecx + eax + 0x176df7e4]
cmp dword [ebp - 0x1a0], eax
jne 0x100474a1
mov dword [ebp - 0x21c], 1
jmp 0x100474a8
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x21c]
jne 0x100474c2
mov dword [ebp - 0x184], 1
jmp 0x100474c9
and dword [ebp - 0x184], 0
cmp dword [ebp - 0x184], 0x93c1
jne 0x100474e3
or eax, 0xffffffff
jne 0x100474e3
and dword [ebp - 0x31c], 0
jmp 0x100474ed
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x188]
add eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x190]
jl 0x1004750d
mov dword [ebp - 0x198], 1
jmp 0x10047514
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x7c], 0
jmp 0x10047530
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10047546
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xc4], 0x3fa75c19
jmp 0x10047529
mov dword [ebp - 0xbc], 0x24a8c6a5
mov dword [ebp - 0xbc], 7
jmp 0x10047569
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x1a
jle 0x10047720
push 2
lea ecx, [ebp - 0x2c0]
call fcn.10026565
mov byte [ebp - 4], 6
mov dword [ebp - 0x28], 0
jmp 0x10047597
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100475ad
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3f4], 0xffffffff
jmp 0x10047590
mov dword [ebp - 0x28], 0
jmp 0x100475bd
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100475d6
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2c0]
call fcn.100265d2
and dword [eax], 0
jmp 0x100475b6
push 1
lea ecx, [ebp - 0x2c0]
call fcn.100265d2
mov dword [eax], 2
jmp 0x1004760f
push 1
lea ecx, [ebp - 0x2c0]
call fcn.100265d2
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2c0]
call fcn.100265d2
cmp dword [eax], 0
jl 0x100476ec
mov dword [ebp - 0xcc], 0xfffffffd
push 1
lea ecx, [ebp - 0x34c]
call fcn.10026565
mov byte [ebp - 4], 7
mov dword [ebp - 0xe4], 0
jmp 0x10047659
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1004767b
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x34c]
call fcn.100265d2
mov dword [eax], 8
jmp 0x1004764c
mov dword [ebp - 0xcc], 2
jmp 0x10047694
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x100476d8
push 1
lea ecx, [ebp - 0x2c0]
call fcn.100265d2
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x3f4]
push 0
lea ecx, [ebp - 0x34c]
call fcn.100265d2
mov dword [eax], esi
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x100476d6
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x10047687
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34c]
call fcn.100265cd
jmp 0x100475eb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f4], 0
je 0x1004770c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c0]
call fcn.100265cd
jmp 0x10047720
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c0]
call fcn.100265cd
jmp 0x1004755c
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x1004774c
push 0
push 0x1b43
push 0x83b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x328]
push eax
push 0x9a4
call fcn.100451f1
add esp, 0x10
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc4], 0
jmp 0x10047794
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc4], 0xfffffff1
jl 0x10047a79
mov dword [ebp - 0x418], 5
mov dword [ebp - 0x390], 0x94964a53
mov dword [ebp - 0x3e8], 0xffffffff
mov dword [ebp - 0x378], 1
mov dword [ebp - 0x40c], 0x849f845d
mov dword [ebp - 0x1b0], 0x3050
mov dword [ebp - 0x3a0], 0x30385d06
mov dword [ebp - 0x38], 0
jmp 0x100477fe
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10047814
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x464], 9
jmp 0x100477f7
mov dword [ebp - 0x38], 0
jmp 0x10047824
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1004783a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x470], 7
jmp 0x1004781d
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x64], 0x10
jmp 0x1004785e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x10
jge 0x1004787a
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
cmp dword [eax], 0
je 0x10047878
jmp 0x1004787a
jmp 0x10047857
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp - 0x3f8], eax
mov esi, dword [ebp - 0x64]
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
cmp esi, dword [eax]
jge 0x100478ad
mov dword [ebp - 0x1d8], 1
jmp 0x100478b4
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfcc013ce
jae 0x100478d5
mov dword [ebp - 0x1b8], 1
jmp 0x100478dc
and dword [ebp - 0x1b8], 0
imul eax, dword [ebp - 0x1b8], 0xfff7
cmp eax, 0x279e56e
je 0x100478f9
mov dword [ebp - 0x1c0], 1
jmp 0x10047900
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c8], eax
push 2
lea ecx, [ebp - 0x328]
call fcn.100265d2
mov ecx, dword [ebp - 0x1c8]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [eax]
jle 0x10047944
cmp dword [ebp - 0x6c], 0
jne 0x10047952
or eax, 0xffffffff
jne 0x10047952
and dword [ebp - 0x1d0], 0
jmp 0x1004795c
mov dword [ebp - 0x1d0], 1
mov eax, dword [ebp - 0x1d0]
add eax, 0x9297
cmp dword [ebp - 0x1d8], eax
jne 0x1004797b
mov dword [ebp - 0x1e0], 1
jmp 0x10047982
and dword [ebp - 0x1e0], 0
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
mov ecx, dword [ebp - 0x1e0]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xc4]
jl 0x100479b3
mov dword [ebp - 0x1e8], 1
jmp 0x100479ba
and dword [ebp - 0x1e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x1e8], eax
jne 0x100479e1
cmp dword [ebp - 0x6c], 0
je 0x100479e1
mov dword [ebp - 0x1f0], 1
jmp 0x100479e8
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 1
jl 0x100479fd
mov dword [ebp - 0x2e4], 1
jmp 0x10047a04
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp - 0x3a8], eax
mov esi, dword [ebp - 0x318]
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
cmp esi, dword [eax]
jl 0x10047a3a
mov dword [ebp - 0x1f8], 1
jmp 0x10047a41
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x1f8], eax
jge 0x10047a64
cmp dword [ebp - 0x8c], 0
je 0x10047a64
mov dword [ebp - 0x200], 1
jmp 0x10047a6b
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x64], eax
jmp 0x10047779
mov dword [ebp - 0x414], 0x28c176b0
mov dword [ebp - 0x3b0], 0xfffffffb
mov dword [ebp - 0x408], 0x2b165808
mov dword [ebp - 0x98], 0xfffffff9
push 2
lea ecx, [ebp - 0x404]
call fcn.10026565
mov byte [ebp - 4], 8
mov dword [ebp - 0x208], 0x57863718
mov dword [ebp - 0x34], 0
jmp 0x10047acc
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10047ae2
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x44c], 0xfffffffb
jmp 0x10047ac5
mov dword [ebp - 0x34], 0
jmp 0x10047af2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10047b0e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x404]
call fcn.100265d2
mov dword [eax], 0xfffffffa
jmp 0x10047aeb
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x98], 0
jmp 0x10047b34
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x12
jl 0x10047b53
mov byte [ebp - 0x48], 0
movzx eax, byte [ebp - 0x48]
test eax, eax
je 0x10047b51
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
jmp 0x10047b27
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x404]
call fcn.100265cd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc4], 0x31234912
jne 0x10047bb3
push 0
lea ecx, [ebp - 0x100]
call fcn.100265d2
cmp dword [eax], 0
je 0x10047b97
xor eax, eax
je 0x10047b97
mov dword [ebp - 0x210], 1
jmp 0x10047b9e
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0xca5e
jl 0x10047bb3
and dword [ebp - 0x218], 0
jmp 0x10047bbd
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff7
jg 0x10047be1
mov eax, 0x700c0d3
test eax, eax
je 0x10047be1
mov dword [ebp - 0x220], 1
jmp 0x10047be8
and dword [ebp - 0x220], 0
imul eax, dword [ebp - 0x220], 0xe8f5
cmp dword [ebp - 0x8c], eax
jl 0x10047c06
mov dword [ebp - 0x118], 1
jmp 0x10047c0d
and dword [ebp - 0x118], 0
push 2
lea ecx, [ebp - 0x328]
call fcn.100265d2
mov ecx, dword [ebp - 0x118]
imul ecx, dword [eax]
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x328]
call fcn.100265cd
jmp 0x10046e21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.100265cd
push 2
lea ecx, [ebp - 0x358]
call fcn.10026565
mov dword [ebp - 4], 9
mov dword [ebp - 0x80], 0xfffffffc
mov dword [ebp - 0x9c], 0
jmp 0x10047c80
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10047ca2
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x358]
call fcn.100265d2
mov dword [eax], 0x42eb90da
jmp 0x10047c73
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x10047cb8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0x80], 0
jmp 0x10047cc8
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x10047d09
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x10047cf2
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push dword [ebp - 0x80]
lea ecx, [ebp - 0x358]
call fcn.100265d2
cmp dword [eax], 0
je 0x10047d07
jmp 0x10047cc1
jmp 0x10047cc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x358]
call fcn.100265cd
push 1
lea eax, [ebp - 0x458]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.10026296
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x440]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x440]
lea edi, [ebp - 0x334]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xc558
push 2
lea ecx, [ebp - 0x364]
call fcn.10026565
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x314], 0xad3380ee
mov dword [ebp - 0xa4], 0
jmp 0x10047d85
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10047da7
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x364]
call fcn.100265d2
mov dword [eax], 1
jmp 0x10047d78
cmp dword [ebp - 0x14], 0
jne 0x10047dbf
mov eax, 0xc04ee7d2
test eax, eax
jne 0x10047dbf
and dword [ebp - 0x164], 0
jmp 0x10047dc9
mov dword [ebp - 0x164], 1
cmp dword [ebp - 0x14], 0xffffffff
jne 0x10047de4
mov eax, 0x3af7
test eax, eax
je 0x10047de4
mov dword [ebp - 0x11c], 1
jmp 0x10047deb
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x11c], eax
jg 0x10047e02
mov dword [ebp - 0x124], 1
jmp 0x10047e09
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x124], eax
je 0x10047e20
mov dword [ebp - 0x12c], 1
jmp 0x10047e27
and dword [ebp - 0x12c], 0
cmp dword [ebp - 0x12c], 0x5f7919ad
je 0x10047e3f
mov dword [ebp - 0x134], 1
jmp 0x10047e46
and dword [ebp - 0x134], 0
cmp dword [ebp - 0x134], 0x2134
jle 0x10047e5e
mov dword [ebp - 0x13c], 1
jmp 0x10047e65
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x13c], eax
jg 0x10047e7c
mov dword [ebp - 0x310], 1
jmp 0x10047e83
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x14], 0xf9f7c8b1
jbe 0x10047ea1
mov dword [ebp - 0x144], 1
jmp 0x10047ea8
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x144], eax
jge 0x10047ebf
mov dword [ebp - 0x14c], 1
jmp 0x10047ec6
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x14]
cmp eax, 0xa369
jg 0x10047ee2
mov dword [ebp - 0x154], 1
jmp 0x10047ee9
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
sub eax, 0x9c23
mov dword [ebp - 0x15c], eax
push 1
lea ecx, [ebp - 0x364]
call fcn.100265d2
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x15c], eax
jg 0x10047f26
mov dword [ebp - 0x2f4], 1
jmp 0x10047f2d
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x164], 0xffffffff
je 0x10047f4b
mov dword [ebp - 0x16c], 1
jmp 0x10047f52
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x16c], eax
je 0x10047f69
mov dword [ebp - 0x174], 1
jmp 0x10047f70
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x314], eax
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x10047f94
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.100265cd
mov dword [ebp - 0xac], 7
mov dword [ebp - 0xac], 0
jmp 0x10047fc6
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffb
je 0x10048138
push 2
lea ecx, [ebp - 0x308]
call fcn.10026565
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x374], 0x8d13
mov dword [ebp - 0x370], 0x8d13
mov dword [ebp - 0x36c], 0x8d13
mov dword [ebp - 0x368], 0x8d13
mov dword [ebp - 0x2fc], 0xa37bb008
mov dword [ebp - 0xb4], 0
jmp 0x10048032
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x10048054
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x308]
call fcn.100265d2
mov dword [eax], 0xa18885c6
jmp 0x10048025
push 1
lea ecx, [ebp - 0x308]
call fcn.100265d2
and dword [eax], 0
jmp 0x1004808a
push 1
lea ecx, [ebp - 0x308]
call fcn.100265d2
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x17c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x308]
call fcn.100265d2
cmp dword [eax], 0x14
jle 0x10048124
mov dword [ebp - 0x68], 0x23d1bca9
mov dword [ebp - 0x68], 3
jmp 0x100480b7
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10048117
mov dword [ebp - 0xd8], 0xfffffff6
mov dword [ebp - 0xd8], 3
jmp 0x100480e0
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x10048106
push 1
push 0x5246
push 0x6fd7
lea eax, [ebp - 0x2fc]
push eax
call fcn.100451f1
add esp, 0x10
jmp 0x100480d3
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x374], 0
je 0x10048115
jmp 0x100480b0
jmp 0x100480b0
cmp dword [ebp - 0x68], 0
je 0x1004811f
jmp 0x10048124
jmp 0x10048066
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x308]
call fcn.100265cd
jmp 0x10047fb9
cmp dword [ebp - 0x334], 0
je 0x10048155
push 1
push dword [ebp - 0x32c]
push dword [ebp - 0x330]
call dword [ebp - 0x334]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret