Function at 0x465265
Capabilities:
Contain obfuscated stackstrings
Delete registry value
Get disk information
Query or enumerate registry key
Resume thread
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x19a4
call fcn.00499e10
push esi
push edi
mov dword [ebp - 0x1e8], 0xe56f9b2c
mov dword [ebp - 0x1410], 0x999fb023
mov dword [ebp - 0x16ec], 0x5dae5a60
mov dword [ebp - 0x1540], 0xfffffffd
mov dword [ebp - 0x1754], 0xccb63e8e
mov dword [ebp - 0x1548], 0xffffffff
push 2
lea ecx, [ebp - 0x1594]
call fcn.00422862
mov dword [ebp - 0x71c], 0xfffffffd
mov dword [ebp - 0x3c], 0
jmp 0x4652d7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x4652ed
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1388], 0xde0bcd8c
jmp 0x4652d0
mov dword [ebp - 0x3c], 0
jmp 0x4652fd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x465319
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1594]
call fcn.00422927
mov dword [eax], 1
jmp 0x4652f6
mov dword [ebp - 0x3c], 0
jmp 0x465329
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x46533f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1910], 0x93d0
jmp 0x465322
mov dword [ebp - 0x1e8], 0
jmp 0x465358
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x465374
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x1388], 1
jmp 0x46534b
mov eax, dword [ebp - 0x71c]
inc eax
mov dword [ebp - 0x71c], eax
lea ecx, [ebp - 0x1594]
call fcn.00422922
mov dword [ebp - 0x230], 0x4bcd76ce
mov dword [ebp - 0x128], 2
mov dword [ebp - 0x16d8], 0xc629c4dd
mov dword [ebp - 0x1550], 0xc869
mov dword [ebp - 0x1378], 4
mov dword [ebp - 0x137c], 0xfffffffc
mov dword [ebp - 0x13a4], 0xffffffff
mov dword [ebp - 0x13ac], 9
mov dword [ebp - 0x13b4], 0xfffffff6
mov dword [ebp - 0x13bc], 0xffffffff
mov dword [ebp - 0x13c4], 0x8ff7673e
mov dword [ebp - 0x13cc], 0xe12fd89d
mov dword [ebp - 0x13d4], 0xbeb927ee
mov dword [ebp - 0x25c], 0
jmp 0x465427
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x465443
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x10a0], 0xfffffff8
jmp 0x46541a
mov eax, 0xa516
test eax, eax
je 0x46547d
cmp dword [ebp - 0x230], 0
jne 0x465461
mov dword [ebp - 0xdc0], 1
jmp 0x465468
and dword [ebp - 0xdc0], 0
cmp dword [ebp - 0x230], 0
je 0x46547d
mov dword [ebp - 0xcdc], 1
jmp 0x465484
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x230]
add eax, dword [ebp - 0xcdc]
cmp eax, 0x28f6
je 0x4654a3
mov dword [ebp - 0xe20], 1
jmp 0x4654aa
and dword [ebp - 0xe20], 0
imul eax, dword [ebp - 0x230], 0
add eax, dword [ebp - 0x230]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x128], 0
jmp 0x4654d6
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jg 0x465573
mov dword [ebp - 0x13dc], 0
mov dword [ebp - 0x13e4], 0x9229a275
mov dword [ebp - 0x13ec], 0x5211521f
mov dword [ebp - 0x13f4], 5
mov dword [ebp - 0x13fc], 3
mov dword [ebp - 0x1404], 0xafe44fa3
mov dword [ebp - 0x140c], 0x9716e289
mov dword [ebp - 0x1414], 0xffffffff
mov dword [ebp - 0x141c], 0x99e68fc7
mov dword [ebp - 0xce4], 0x6d4f509e
mov eax, dword [ebp - 0xce4]
inc eax
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0x10a0]
mov dword [ebp + ecx*4 - 0x10a0], eax
jmp 0x4654c9
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x264], 0x57440e70
mov dword [ebp - 0x968], 6
mov dword [ebp - 0x14], 0xfffffff8
jmp 0x4655a8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 6
jne 0x4655c7
mov dword [ebp - 0xcf8], 0x2cb51dba
mov eax, dword [ebp - 0xcf8]
dec eax
mov dword [ebp - 0xcf8], eax
jmp 0x4655a1
mov dword [ebp - 0x14], 0xffffffe9
jmp 0x4655d7
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe4
je 0x4659fe
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x330], 0
jmp 0x465604
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x46561d
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x58], 0xf90edcad
jmp 0x4655f7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x58], 0
jmp 0x465642
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58], 0xffffffff
jle 0x465989
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x570], 0xc7527853
cmp dword [ebp - 0x14], 2
je 0x465679
mov dword [ebp - 0xd00], 1
jmp 0x465680
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1424], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0xe0], eax
jne 0x4656a6
mov dword [ebp - 0xd08], 1
jmp 0x4656ad
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0xd00]
cmp eax, dword [ebp - 0xd08]
jl 0x4656c7
mov dword [ebp - 0xd10], 1
jmp 0x4656ce
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd10], eax
jge 0x4656e5
mov dword [ebp - 0xd18], 1
jmp 0x4656ec
and dword [ebp - 0xd18], 0
imul eax, dword [ebp - 0xd18], 0xffff
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x58]
jle 0x46570e
mov dword [ebp - 0xd20], 1
jmp 0x465715
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd20], eax
je 0x46572c
mov dword [ebp - 0xd28], 1
jmp 0x465733
and dword [ebp - 0xd28], 0
cmp dword [ebp - 0xd28], 0x8f585950
jbe 0x46574b
mov dword [ebp - 0xe28], 1
jmp 0x465752
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x142c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0x1434], eax
cmp dword [ebp - 0x14], 0
jne 0x46578a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58], 0
jne 0x46578a
and dword [ebp - 0xcd4], 0
jmp 0x465794
mov dword [ebp - 0xcd4], 1
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0xcd4], eax
je 0x4657ae
mov dword [ebp - 0x550], 1
jmp 0x4657b5
and dword [ebp - 0x550], 0
mov dword [ebp - 0x4c4], 0x1a35ca42
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x550]
jge 0x4657d9
mov dword [ebp - 0x95c], 1
jmp 0x4657e0
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x95c], eax
jne 0x4657fa
mov dword [ebp - 0x558], 1
jmp 0x465801
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x264], eax
mov eax, 0x254
test eax, eax
je 0x46594c
cmp dword [ebp - 0xe0], 0
je 0x465838
cmp dword [ebp - 0x264], 0
je 0x465838
mov dword [ebp - 0x958], 1
jmp 0x46583f
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x14], 0
je 0x465869
mov dword [ebp - 0xe30], 1
jmp 0x465870
and dword [ebp - 0xe30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0x143c], eax
push 7
pop eax
test eax, eax
jne 0x465899
cmp dword [ebp - 0x570], 0
jne 0x465899
and dword [ebp - 0x560], 0
jmp 0x4658a3
mov dword [ebp - 0x560], 1
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x560], eax
jg 0x4658bd
mov dword [ebp - 0xb50], 1
jmp 0x4658c4
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xb50], eax
jge 0x4658db
mov dword [ebp - 0x568], 1
jmp 0x4658e2
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x568]
jge 0x4658fc
mov dword [ebp - 0x960], 1
jmp 0x465903
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x960]
lea eax, [ecx + eax - 0x839b]
test eax, eax
jne 0x46592c
cmp dword [ebp - 0x570], 0
jne 0x46592c
and dword [ebp - 0xc64], 0
jmp 0x465936
mov dword [ebp - 0xc64], 1
mov eax, dword [ebp - 0xc64]
neg eax
je 0x46594c
mov dword [ebp - 0xe38], 1
jmp 0x465953
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x144c], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x1454], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0x4c4], eax
jmp 0x46562d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0x145c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58], 0
je 0x4659c4
cmp dword [ebp - 0xe0], 0
jne 0x4659b8
mov eax, 0x7b094c65
test eax, eax
je 0x4659c4
mov dword [ebp - 0x578], 1
jmp 0x4659cb
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
inc eax
cmp eax, dword [ebp - 0xe0]
je 0x4659e6
mov dword [ebp - 0xe40], 1
jmp 0x4659ed
and dword [ebp - 0xe40], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x968], eax
jmp 0x4655d0
mov dword [ebp - 0x1f0], 0xe56f9b2c
mov dword [ebp - 0x1464], 0x999fb023
mov dword [ebp - 0x146c], 0x5dae5a60
mov dword [ebp - 0x1a4], 5
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x588], 0x94b2ab76
mov dword [ebp - 0x5a0], 1
push 2
lea ecx, [ebp - 0x125c]
call fcn.00422862
mov dword [ebp - 0x334], 0
jmp 0x465a6a
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 2
jge 0x465a8c
push dword [ebp - 0x334]
lea ecx, [ebp - 0x125c]
call fcn.00422927
mov dword [eax], 0xfffffff8
jmp 0x465a5d
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xfffffffa
jb 0x465aad
mov dword [ebp - 0xc50], 1
jmp 0x465ab4
and dword [ebp - 0xc50], 0
cmp dword [ebp - 0x1a4], 0
je 0x465ad2
mov eax, 0xe4b7
test eax, eax
je 0x465ad2
mov dword [ebp - 0xb58], 1
jmp 0x465ad9
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x1a4], eax
je 0x465af3
mov dword [ebp - 0x580], 1
jmp 0x465afa
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0xfffffffe
jne 0x465b0f
mov dword [ebp - 0x970], 1
jmp 0x465b16
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
imul eax, dword [ebp - 0x970]
cmp eax, dword [ebp - 0x1a4]
jle 0x465b43
mov dword [ebp - 0x590], 1
jmp 0x465b4a
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x590], eax
jge 0x465b64
mov dword [ebp - 0x598], 1
jmp 0x465b6b
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0xc50]
cmp eax, dword [ebp - 0x598]
jl 0x465b85
mov dword [ebp - 0x978], 1
jmp 0x465b8c
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0
je 0x465bbb
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x465bb9
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x465c1f
mov dword [ebp - 0x138], 0
jmp 0x465bd4
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x465bf6
push dword [ebp - 0x138]
lea ecx, [ebp - 0x125c]
call fcn.00422927
mov dword [eax], 0x700d62e6
jmp 0x465bc7
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x465c1f
push 0
push 0x119e
push 0xe86
push 0x1dd7
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea ecx, [ebp - 0x125c]
call fcn.00422922
mov dword [ebp - 0x1474], 0xfffffffd
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x147c], 0xffffffff
mov dword [ebp - 0x274], 4
push 2
lea ecx, [ebp - 0x1364]
call fcn.00422862
mov dword [ebp - 0x34], 0
jmp 0x465c6f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x465c85
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1850], 0xf0ea
jmp 0x465c68
mov dword [ebp - 0x34], 0
jmp 0x465c95
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x465cb1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1364]
call fcn.00422927
mov dword [eax], 0x999d94b4
jmp 0x465c8e
mov dword [ebp - 0x34], 0
jmp 0x465cc1
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x465cd7
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x17c0], 0xffffffff
jmp 0x465cba
mov dword [ebp - 0x26c], 0
jmp 0x465cf0
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jg 0x465d84
mov dword [ebp - 0x1484], 0x5121
mov dword [ebp - 0x148c], 0xffffffff
mov dword [ebp - 0x1494], 0
mov dword [ebp - 0x149c], 0xfffffff6
mov dword [ebp - 0x14a4], 0x5b054dbb
mov dword [ebp - 0x394], 0
jmp 0x465d48
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 4
jge 0x465d64
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x19a4], 9
jmp 0x465d3b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x17c0], eax
jmp 0x465ce3
mov dword [ebp - 0x274], 0
jmp 0x465d9d
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jl 0x465e1e
push 2
lea ecx, [ebp - 0x12a4]
call fcn.00422862
mov dword [ebp - 0x33c], 0
jmp 0x465dcc
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 2
jge 0x465dee
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x12a4]
call fcn.00422927
mov dword [eax], 0xc58f5537
jmp 0x465dbf
push 1
lea ecx, [ebp - 0x12a4]
call fcn.00422927
mov esi, eax
push 0
lea ecx, [ebp - 0x1364]
call fcn.00422927
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x12a4]
call fcn.00422922
jmp 0x465d90
lea ecx, [ebp - 0x1364]
call fcn.00422922
mov dword [ebp - 0x14ac], 0xccb63e8e
mov dword [ebp - 0x14b4], 0xffffffff
mov dword [ebp - 0x1710], 0x48d327cb
mov dword [ebp - 0x170c], 0x48d327cb
mov dword [ebp - 0x1708], 0x48d327cb
mov dword [ebp - 0x1704], 0x48d327cb
mov dword [ebp - 0x14bc], 0x8fc558ba
mov dword [ebp - 0xb60], 2
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x465ea2
push 0
push 0x1aa6
push 0x8aa
push 0x1f72
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov eax, dword [ebp - 0xb60]
dec eax
mov dword [ebp - 0xb60], eax
push 2
lea ecx, [ebp - 0x15b4]
call fcn.00422862
mov dword [ebp - 0x20], 7
push 2
lea ecx, [ebp - 0x131c]
call fcn.00422862
push 3
lea ecx, [ebp - 0x12bc]
call fcn.00422862
mov dword [ebp - 0x514], 0x38425739
push 1
lea ecx, [ebp - 0xdb0]
call fcn.00422862
mov dword [ebp - 0x14c4], 7
mov dword [ebp - 0xc], 0
jmp 0x465f0e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x465f2a
push dword [ebp - 0xc]
lea ecx, [ebp - 0x131c]
call fcn.00422927
mov dword [eax], 0xcb61d225
jmp 0x465f07
mov dword [ebp - 0xc], 0
jmp 0x465f3a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x465f56
push dword [ebp - 0xc]
lea ecx, [ebp - 0x12bc]
call fcn.00422927
mov dword [eax], 0x50faeb38
jmp 0x465f33
mov dword [ebp - 0xc], 0
jmp 0x465f66
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x465f82
push dword [ebp - 0xc]
lea ecx, [ebp - 0xdb0]
call fcn.00422927
mov dword [eax], 0xe2e4ed
jmp 0x465f5f
mov dword [ebp - 0xc], 0
jmp 0x465f92
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x465fa8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x17ec], 0xfffffffd
jmp 0x465f8b
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
je 0x465fbc
mov dword [ebp - 0x5a8], 1
jmp 0x465fc3
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 1
jg 0x465fd8
mov dword [ebp - 0x980], 1
jmp 0x465fdf
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
sub eax, 0x16
cmp eax, dword [ebp - 0x20]
jne 0x465ff9
mov dword [ebp - 0x5b0], 1
jmp 0x466000
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x20]
jg 0x46601b
mov dword [ebp - 0xcfc], 1
jmp 0x466022
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xcfc]
jl 0x466039
mov dword [ebp - 0x45c], 1
jmp 0x466040
and dword [ebp - 0x45c], 0
push 0
lea ecx, [ebp - 0x12bc]
call fcn.00422927
mov ecx, dword [ebp - 0x45c]
mov dword [eax], ecx
cmp dword [ebp - 0x45c], 0xfffffffc
jae 0x46606a
mov dword [ebp - 0x5b8], 1
jmp 0x466071
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x5b8], eax
je 0x466088
mov dword [ebp - 0x988], 1
jmp 0x46608f
and dword [ebp - 0x988], 0
push 1
lea ecx, [ebp - 0x131c]
call fcn.00422927
mov dword [eax], 0x66c93ee3
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x66c93ee3
jne 0x4660c6
mov dword [ebp - 0xe48], 1
jmp 0x4660cd
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14cc], eax
push 0
lea ecx, [ebp - 0xdb0]
call fcn.00422927
mov esi, eax
push 0
lea ecx, [ebp - 0xdb0]
call fcn.00422927
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x466105
push 0
lea ecx, [ebp - 0xdb0]
call fcn.00422927
push 0
lea ecx, [ebp - 0xdb0]
call fcn.00422927
mov ecx, dword [ebp - 0x20]
cmp dword [eax], ecx
je 0x466125
mov dword [ebp - 0x5c0], 1
jmp 0x46612c
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x46614d
cmp dword [ebp - 0x514], 0
jne 0x46614d
and dword [ebp - 0xb68], 0
jmp 0x466157
mov dword [ebp - 0xb68], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb68]
mov dword [ebp + eax - 0x17ec], ecx
mov dword [ebp - 0x20], 0
jmp 0x46617a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x4661a5
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x4661a3
push 0x224c
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x466173
lea ecx, [ebp - 0xdb0]
call fcn.00422922
lea ecx, [ebp - 0x12bc]
call fcn.00422922
lea ecx, [ebp - 0x131c]
call fcn.00422922
mov dword [ebp - 0x9a0], 0xfffffffd
mov dword [ebp - 0x28], 0
jmp 0x4661e0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x4661f6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1394], 0xde0bcd8c
jmp 0x4661d9
mov dword [ebp - 0x1ac], 0xffffffff
push 1
lea ecx, [ebp - 0x12d4]
call fcn.00422862
mov dword [ebp - 0x998], 0xfffffff8
mov dword [ebp - 0xf14], 1
mov dword [ebp - 0x27c], 0
jmp 0x46623a
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x46625c
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x12d4]
call fcn.00422927
mov dword [eax], 0xc405b401
jmp 0x46622d
cmp dword [ebp - 0x1ac], 0
je 0x4662a4
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x5c8], eax
push 0
lea ecx, [ebp - 0x12d4]
call fcn.00422927
mov ecx, dword [ebp - 0x5c8]
mov dword [eax], ecx
cmp dword [ebp - 0x5c8], 0
je 0x4662a4
cmp dword [ebp - 0x1ac], 0
je 0x4662a4
mov dword [ebp - 0x5d0], 1
jmp 0x4662ab
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x14d4], eax
cmp dword [ebp - 0x1ac], 0
jle 0x4662cc
mov dword [ebp - 0x990], 1
jmp 0x4662d3
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x990], eax
jge 0x4662ed
mov dword [ebp - 0xc58], 1
jmp 0x4662f4
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0xc58]
jg 0x46630e
mov dword [ebp - 0x5d8], 1
jmp 0x466315
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0xf14], eax
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x466349
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
lea ecx, [ebp - 0x12d4]
call fcn.00422922
mov dword [ebp - 0x28], 0
jmp 0x466364
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x466380
push dword [ebp - 0x28]
lea ecx, [ebp - 0x15b4]
call fcn.00422927
mov dword [eax], 1
jmp 0x46635d
mov dword [ebp - 0x28], 0
jmp 0x466390
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x4663a6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x18c0], 0x93d0
jmp 0x466389
mov dword [ebp - 0x3c8], 1
push 2
lea ecx, [ebp - 0x15a4]
call fcn.00422862
mov dword [ebp - 0x78], 0
jmp 0x4663cd
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x4663e9
push dword [ebp - 0x78]
lea ecx, [ebp - 0x15a4]
call fcn.00422927
mov dword [eax], 0x20fe6e32
jmp 0x4663c6
mov dword [ebp - 0x78], 0
jmp 0x4663f9
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x46640f
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x1858], 0
jmp 0x4663f2
mov dword [ebp - 0x3c8], 0
jmp 0x466428
mov eax, dword [ebp - 0x3c8]
dec eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0xfffffff7
jg 0x46655b
mov dword [ebp - 0x1018], 0xce1e2c0d
mov dword [ebp - 0x1014], 0xce1e2c0d
mov dword [ebp - 0x1010], 0xce1e2c0d
mov dword [ebp - 0x100c], 0xce1e2c0d
mov dword [ebp - 0x14dc], 6
mov dword [ebp - 0x344], 0x96c7979b
mov dword [ebp - 0xf1c], 0xfffffffc
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1018], 1
jmp 0x4664a9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1018]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1018], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1018], 0
jl 0x466527
mov dword [ebp - 0x284], 1
mov dword [ebp - 0x14e4], 0
mov dword [ebp - 0x284], 1
jmp 0x4664e6
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jl 0x466508
mov dword [ebp - 0x5e0], 0x7e71f09a
mov eax, dword [ebp - 0x5e0]
dec eax
mov dword [ebp - 0x5e0], eax
jmp 0x4664d9
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x466522
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x46648e
mov dword [ebp - 0x344], 0
jmp 0x466540
mov eax, dword [ebp - 0x344]
dec eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0xfffffff3
jle 0x466556
cmp dword [ebp - 0xf1c], 0
je 0x466554
jmp 0x466556
jmp 0x466533
jmp 0x46641b
lea ecx, [ebp - 0x15a4]
call fcn.00422922
mov dword [ebp - 0x1f0], 0
jmp 0x46657f
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x4666fe
mov dword [ebp - 0x28c], 0
jmp 0x4665a5
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x4665c1
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xf24], 0
jmp 0x466598
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf24], 0
je 0x4665f6
mov dword [ebp - 0xf2c], 0x98a59c17
mov dword [ebp - 0xf34], 0xffffffff
mov eax, dword [ebp - 0xf2c]
mov dword [ebp - 0xf34], eax
jmp 0x4666e8
mov dword [ebp - 0xec], 7
mov dword [ebp - 0xec], 0xffffffe4
jmp 0x466619
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffee
je 0x46669b
push 1
lea ecx, [ebp - 0x1238]
call fcn.00422862
mov dword [ebp - 0x3a0], 0
jmp 0x466648
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jge 0x466667
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x1238]
call fcn.00422927
and dword [eax], 0
jmp 0x46663b
push 0
lea ecx, [ebp - 0x1238]
call fcn.00422927
mov dword [ebp - 0xb70], eax
mov eax, dword [ebp - 0xb70]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xb70]
mov dword [ecx], eax
lea ecx, [ebp - 0x1238]
call fcn.00422922
jmp 0x46660c
mov dword [ebp - 0xec], 0
jmp 0x4666b4
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 8
jle 0x4666e8
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x4666e6
push 0
push 0x119e
push 0xe86
push 0x1dd7
call dword [sym.imp.KERNEL32.dll_RaiseException]
jmp 0x4666a7
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x1394], 1
jmp 0x466572
mov dword [ebp - 0x220], 0x9dada439
mov dword [ebp - 0x294], 0
jmp 0x466721
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x46673d
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xfac], 1
jmp 0x466714
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x466761
push 0x2633
push 0x1080
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov dword [ebp - 0x220], 0
jmp 0x46677a
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jg 0x4668f2
xor eax, eax
je 0x4668c6
mov eax, dword [ebp - 0x220]
cmp dword [ebp + eax*4 - 0xfac], 0
je 0x4668ad
mov dword [ebp - 0x29c], 0xfffffff7
mov dword [ebp - 0x34c], 0
jmp 0x4667c6
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x4667e2
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0x520], 0
jmp 0x4667b9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x520], 2
jmp 0x466810
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x520]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x520], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x520], 0
jl 0x46686b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x520]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x520]
mov eax, dword [ebp + eax*4 - 0xfac]
mov dword [ebp + ecx*4 - 0xfac], eax
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x466869
push 0
push 0
push 0x1c11
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x4667f5
mov dword [ebp - 0x29c], 2
jmp 0x466884
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jl 0x4668ab
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x4668a9
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x466877
jmp 0x4668c4
mov dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
jmp 0x4668d8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfac], 0
je 0x4668d8
jmp 0x4668f2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfac], 0
je 0x4668ed
jmp 0x46676d
jmp 0x46676d
mov eax, dword [ebp - 0x9a0]
inc eax
mov dword [ebp - 0x9a0], eax
lea ecx, [ebp - 0x15b4]
call fcn.00422922
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x3e0], 0
jmp 0x46692d
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
jne 0x466961
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x46695f
push 0x270a
push 0
push 0xaf0
push 0x1502
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x466920
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x466982
push 0
push 0x3fd
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x1c4], 0x7f6af112
mov dword [ebp - 0x14ec], 0x9fb37b04
mov dword [ebp - 0x3a8], 0x9226c312
mov dword [ebp - 0xf74], 0xfffffffa
mov dword [ebp - 0x1f8], 0x14f98caf
mov dword [ebp - 0x240], 0x2d1a4e66
mov dword [ebp - 0x14f4], 0xec326874
mov dword [ebp - 0xf3c], 1
mov dword [ebp - 0xf7c], 0x30bd
push 2
lea ecx, [ebp - 0x15d4]
call fcn.00422862
mov dword [ebp - 0x2a4], 0
jmp 0x466a02
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x466a24
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x15d4]
call fcn.00422927
mov dword [eax], 0xfffffff9
jmp 0x4669f5
mov dword [ebp - 0x1c4], 0x1d
jmp 0x466a3d
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 6
je 0x467074
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x628], 0xfffffff9
mov dword [ebp - 0x148], 0x2db785b6
mov dword [ebp - 0x1d4], 0xfffffffd
mov dword [ebp - 0xf54], 0
mov dword [ebp - 0x4cc], 0xffffffff
mov dword [ebp - 0x354], 0
jmp 0x466a9f
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 2
jge 0x466abb
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0xd7c], 0x3fa75c19
jmp 0x466a92
mov dword [ebp - 0x1b4], 0
jmp 0x466ad4
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jg 0x466dae
mov dword [ebp - 0x14fc], 0x58a0
mov dword [ebp - 0xf44], 0xfffffffb
mov dword [ebp - 0x1504], 7
mov dword [ebp - 0x150c], 0x83303773
mov dword [ebp - 0x464], 5
push 3
lea ecx, [ebp - 0x1250]
call fcn.00422862
mov dword [ebp - 0xf5c], 0xfffffff6
mov dword [ebp - 0xf64], 0
mov dword [ebp - 0x2ac], 0
jmp 0x466b4d
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x466b6f
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0x1250]
call fcn.00422927
mov dword [eax], 0xfbfcc013
jmp 0x466b40
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x1d4]
neg eax
mov dword [ebp - 0xf3c], eax
xor eax, eax
jne 0x466c14
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1514], eax
mov eax, dword [ebp - 0xf44]
mov dword [ebp - 0x151c], eax
cmp dword [ebp - 0x1f8], 0xfff6
jbe 0x466bc5
mov dword [ebp - 0xf4c], 1
jmp 0x466bcc
and dword [ebp - 0xf4c], 0
mov eax, 0xa3d88101
test eax, eax
je 0x466bea
cmp dword [ebp - 0x3a8], 0
je 0x466bea
mov dword [ebp - 0x5f0], 1
jmp 0x466bf1
and dword [ebp - 0x5f0], 0
push 1
lea ecx, [ebp - 0x1250]
call fcn.00422927
mov eax, dword [eax]
imul eax, dword [ebp - 0x5f0]
test eax, eax
jne 0x466c14
and dword [ebp - 0xcc8], 0
jmp 0x466c1e
mov dword [ebp - 0xcc8], 1
mov eax, dword [ebp - 0xcc8]
neg eax
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x1c4]
neg eax
cmp dword [ebp - 0xf54], eax
jg 0x466c48
mov dword [ebp - 0x5f8], 1
jmp 0x466c4f
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 6
jb 0x466c64
mov dword [ebp - 0x9a8], 1
jmp 0x466c6b
and dword [ebp - 0x9a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd7c]
add eax, 0x409f8fea
imul eax, dword [ebp - 0x9a8]
cmp eax, 0x49dd
jg 0x466c97
mov dword [ebp - 0x600], 1
jmp 0x466c9e
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd7c]
imul eax, dword [ebp - 0x600]
cmp eax, 0x121adf56
jg 0x466cc5
mov dword [ebp - 0xb78], 1
jmp 0x466ccc
and dword [ebp - 0xb78], 0
cmp dword [ebp - 0xb78], 0x4c38
jge 0x466ce4
mov dword [ebp - 0x608], 1
jmp 0x466ceb
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x608], eax
jne 0x466d02
cmp dword [ebp - 0x148], 0
je 0x466d17
cmp dword [ebp - 0x464], 0
je 0x466d17
mov dword [ebp - 0x9b0], 1
jmp 0x466d1e
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x9b0], eax
jl 0x466d38
mov dword [ebp - 0x610], 1
jmp 0x466d3f
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0xf5c], eax
jge 0x466d65
mov dword [ebp - 0xc60], 1
jmp 0x466d6c
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x1f8]
add eax, dword [ebp - 0xc60]
cmp eax, 0x342bb1e5
jne 0x466d8b
mov dword [ebp - 0x618], 1
jmp 0x466d92
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0xf64], eax
lea ecx, [ebp - 0x1250]
call fcn.00422922
jmp 0x466ac7
mov dword [ebp - 0x148], 0
jmp 0x466dc7
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xf
jge 0x46706f
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x9c8], 0x1c63cc5d
mov dword [ebp - 0xf8c], 0x69bd
cmp dword [ebp - 0x140], 0
jne 0x466e07
mov dword [ebp - 0x9b8], 1
jmp 0x466e0e
and dword [ebp - 0x9b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd7c]
mov dword [ebp - 0x1524], eax
mov eax, 0xffff
test eax, eax
je 0x466e3f
cmp dword [ebp - 0x240], 0
je 0x466e3f
mov dword [ebp - 0x620], 1
jmp 0x466e46
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x9b8]
cmp eax, dword [ebp - 0x620]
jge 0x466e60
mov dword [ebp - 0xb80], 1
jmp 0x466e67
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0xb80]
jg 0x466e81
mov dword [ebp - 0xf6c], 1
jmp 0x466e88
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x152c], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0xf74]
mov dword [ebp - 0x1534], eax
mov dword [ebp - 0x1f8], 0x4c83b0f6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd7c]
cmp eax, dword [ebp - 0x1f8]
jne 0x466ed7
mov dword [ebp - 0xb88], 1
jmp 0x466ede
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x153c], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x1544], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0xf7c], eax
jl 0x466f25
cmp dword [ebp - 0x140], 0
je 0x466f25
mov dword [ebp - 0x9c0], 1
jmp 0x466f2c
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x628]
cmp dword [ebp - 0x9c0], eax
jle 0x466f46
mov dword [ebp - 0x630], 1
jmp 0x466f4d
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0x630]
cmp eax, dword [ebp - 0x140]
jg 0x466f6d
mov dword [ebp - 0xd24], 1
jmp 0x466f74
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0xd24], eax
jle 0x466f8e
mov dword [ebp - 0x638], 1
jmp 0x466f95
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 0xfffffffe
je 0x466fb6
mov dword [ebp - 0x640], 1
jmp 0x466fbd
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x640], eax
jle 0x466fd7
mov dword [ebp - 0xf84], 1
jmp 0x466fde
and dword [ebp - 0xf84], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0xf8c]
mov dword [ebp - 0x1564], eax
cmp dword [ebp - 0xb88], 5
jge 0x467017
mov dword [ebp - 0x648], 1
jmp 0x46701e
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x648], 0xfffa
jne 0x467036
mov dword [ebp - 0x9d0], 1
jmp 0x46703d
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x9d0], eax
jl 0x467057
mov dword [ebp - 0x650], 1
jmp 0x46705e
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x3a8], eax
jmp 0x466dba
jmp 0x466a30
mov dword [ebp - 0x240], 1
jmp 0x46708d
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x46711a
or dword [ebp - 0x1194], 0xffffffff
or dword [ebp - 0x1190], 0xffffffff
or dword [ebp - 0x118c], 0xffffffff
or dword [ebp - 0x1188], 0xffffffff
lea ecx, [ebp - 0x4a9]
call fcn.00401b47
push eax
lea eax, [ebp - 0x1184]
push eax
lea eax, [ebp - 0x1194]
push eax
lea ecx, [ebp - 0x1860]
call fcn.00422936
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15c4]
call fcn.004228fc
mov dword [ebp - 0xf94], 2
push 2
lea ecx, [ebp - 0x15c4]
call fcn.00422927
mov eax, dword [eax]
mov dword [ebp - 0xf94], eax
lea ecx, [ebp - 0x15c4]
call fcn.00422922
jmp 0x467080
lea ecx, [ebp - 0x15d4]
call fcn.00422922
mov dword [ebp - 0x200], 0x9b55bb2c
mov dword [ebp - 0x200], 0
jmp 0x467148
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xf
je 0x46718c
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b4], 0xb
jmp 0x467174
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0xffffffed
je 0x46718a
cmp dword [ebp - 0x200], 0
je 0x467188
jmp 0x46718a
jmp 0x467167
jmp 0x46713b
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x35c], 0x928c176b
mov dword [ebp - 0x35c], 0
jmp 0x4671b9
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x11
jl 0x4672c2
mov dword [ebp - 0x3d0], 8
push 4
lea ecx, [ebp - 0x1280]
call fcn.00422862
mov dword [ebp - 0x2bc], 0
jmp 0x4671f6
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x467218
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x1280]
call fcn.00422927
mov dword [eax], 0xfffffffc
jmp 0x4671e9
mov dword [ebp - 0x3d0], 0x18
jmp 0x467231
mov eax, dword [ebp - 0x3d0]
dec eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0xfffffffa
jg 0x4672b2
push 1
lea ecx, [ebp - 0x1268]
call fcn.00422862
mov dword [ebp - 0x2c4], 0
jmp 0x467260
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x467282
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x1268]
call fcn.00422927
mov dword [eax], 0x5d811f07
jmp 0x467253
push 0
lea ecx, [ebp - 0x1268]
call fcn.00422927
mov esi, eax
push 2
lea ecx, [ebp - 0x1280]
call fcn.00422927
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x1268]
call fcn.00422922
jmp 0x467224
lea ecx, [ebp - 0x1280]
call fcn.00422922
jmp 0x4671ac
mov dword [ebp - 0x364], 0
jmp 0x4672db
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
jne 0x467ca3
push 4
lea ecx, [ebp - 0xd38]
call fcn.00422862
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0xc8], 0xfffffffc
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x2cc], 0
jmp 0x467333
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 4
jge 0x467355
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xd38]
call fcn.00422927
mov dword [eax], 4
jmp 0x467326
mov dword [ebp - 0x10], 3
jmp 0x467365
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x467669
mov dword [ebp - 0x150], 0xd013d0bb
push 2
lea ecx, [ebp - 0x540]
call fcn.00422862
mov dword [ebp - 0x3b0], 0
jmp 0x46739f
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 2
jge 0x4673c1
push dword [ebp - 0x3b0]
lea ecx, [ebp - 0x540]
call fcn.00422927
mov dword [eax], 0xfffffffd
jmp 0x467392
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd38]
call fcn.00422927
cmp dword [eax], 0
je 0x46755c
push 0
lea ecx, [ebp - 0xd38]
call fcn.00422927
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd38]
call fcn.00422927
mov dword [ebp - 0xc68], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd38]
call fcn.00422927
mov ecx, dword [ebp - 0xc68]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc68]
cmp dword [eax], 0
je 0x467469
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd38]
call fcn.00422927
cmp dword [eax], 0
jne 0x46743e
cmp dword [ebp - 0x10], 0
jne 0x46743e
and dword [ebp - 0x658], 0
jmp 0x467448
mov dword [ebp - 0x658], 1
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x467469
mov dword [ebp - 0x9d8], 1
jmp 0x467470
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x150], eax
mov esi, dword [ebp - 0x150]
push 1
lea ecx, [ebp - 0x540]
call fcn.00422927
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x540]
call fcn.00422927
add esi, dword [eax]
cmp esi, dword [ebp - 0x10]
jg 0x4674b2
mov dword [ebp - 0x660], 1
jmp 0x4674b9
and dword [ebp - 0x660], 0
push 0
lea ecx, [ebp - 0x540]
call fcn.00422927
mov ecx, dword [ebp - 0x660]
add ecx, dword [eax]
jne 0x4674dc
mov dword [ebp - 0x46c], 1
jmp 0x4674e3
and dword [ebp - 0x46c], 0
push 1
lea ecx, [ebp - 0x540]
call fcn.00422927
mov ecx, dword [ebp - 0x46c]
mov dword [eax], ecx
cmp dword [ebp - 0x46c], 0
je 0x467505
cmp dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x4128
jne 0x46751a
mov dword [ebp - 0xb90], 1
jmp 0x467521
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xb90]
cmp dword [ebp - 0x10], eax
jle 0x46753b
mov dword [ebp - 0x668], 1
jmp 0x467542
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x8c], eax
jne 0x467584
mov dword [ebp - 0xf9c], 0xffffffff
cmp dword [ebp - 0xf9c], 0
je 0x46757f
lea ecx, [ebp - 0x540]
call fcn.00422922
jmp 0x467669
jmp 0x467659
mov dword [ebp - 0xe18], 0xd37f4a1d
mov dword [ebp - 0x150], 1
jmp 0x4675a7
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x46764f
mov dword [ebp - 0x8c], 1
jmp 0x4675cd
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x46764a
push dword [ebp - 0x150]
lea ecx, [ebp - 0x540]
call fcn.00422927
cmp dword [eax], 0
je 0x4675ee
jmp 0x46764a
mov dword [ebp - 0xc8], 3
jmp 0x467607
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x467645
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x540]
call fcn.00422927
and dword [eax], 0
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x467643
push 0x1309
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x4675fa
jmp 0x4675c0
jmp 0x46759a
mov dword [ebp - 0xe18], 0xfffffffe
lea ecx, [ebp - 0x540]
call fcn.00422922
jmp 0x46735e
mov dword [ebp - 0xc8], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc8], eax
jle 0x46768a
mov dword [ebp - 0x9e0], 1
jmp 0x467691
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x9e0], eax
jle 0x4676ab
mov dword [ebp - 0x670], 1
jmp 0x4676b2
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x670], eax
jne 0x4676c9
mov dword [ebp - 0xcd0], 1
jmp 0x4676d0
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0xcd0]
jne 0x4676fc
cmp dword [ebp - 0xc8], 0
jne 0x4676fc
and dword [ebp - 0x678], 0
jmp 0x467706
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x678]
jge 0x46772c
push 0
lea ecx, [ebp - 0xd38]
call fcn.00422927
cmp dword [eax], 0
jne 0x46772c
and dword [ebp - 0x9e8], 0
jmp 0x467736
mov dword [ebp - 0x9e8], 1
mov eax, dword [ebp - 0x9e8]
sub eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x228]
jne 0x467756
mov dword [ebp - 0x680], 1
jmp 0x46775d
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xd38]
call fcn.00422922
mov byte [ebp - 0x161], 0
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x4f8], 6
mov dword [ebp - 0x2d4], 0
jmp 0x4677a2
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x4677be
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xe84], 1
jmp 0x467795
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x4677da
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x4c], 0
jmp 0x4677ea
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff5
je 0x467943
mov dword [ebp - 0x36c], 0xffffffff
mov dword [ebp - 0xc70], 0x9beab1d6
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jl 0x46781c
mov dword [ebp - 0xb98], 1
jmp 0x467823
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x156c], eax
cmp dword [ebp - 0x4c], 0xb441
je 0x467844
mov dword [ebp - 0x688], 1
jmp 0x46784b
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xb98]
cmp eax, dword [ebp - 0x688]
jg 0x467865
mov dword [ebp - 0xdcc], 1
jmp 0x46786c
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x4f8], 0xffffffff
cmp dword [ebp - 0x4f8], 0
je 0x4678af
cmp dword [ebp - 0x36c], 0
je 0x4678af
cmp dword [ebp - 0x4f8], 0
je 0x4678af
mov dword [ebp - 0x9f0], 1
jmp 0x4678b6
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x36c], eax
jg 0x4678d9
mov dword [ebp - 0x690], 1
jmp 0x4678e0
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xc70], eax
jge 0x467903
mov dword [ebp - 0x698], 1
jmp 0x46790a
and dword [ebp - 0x698], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x698]
mov dword [ebp + eax - 0xe84], ecx
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x46793e
push 0
push 0x34d
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x4677e3
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x467c9e
push 3
lea ecx, [ebp - 0x418]
call fcn.00422862
mov dword [ebp - 0x208], 0xcd9d7540
mov dword [ebp - 0x64], 0xe55a
mov dword [ebp - 0x2dc], 0
jmp 0x467989
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x4679ab
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x418]
call fcn.00422927
mov dword [eax], 1
jmp 0x46797c
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
cmp dword [eax], 0
jne 0x467aa8
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1584], eax
mov esi, dword [ebp - 0x208]
imul esi, dword [ebp - 0x64]
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
cmp esi, dword [eax]
jge 0x467a0f
cmp dword [ebp - 0x208], 0
je 0x467a0f
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
cmp dword [eax], 0
je 0x467a0f
mov dword [ebp - 0x9f8], 1
jmp 0x467a16
and dword [ebp - 0x9f8], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
mov ecx, dword [ebp - 0x9f8]
cmp ecx, dword [eax]
jg 0x467a39
mov dword [ebp - 0xdd4], 1
jmp 0x467a40
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x16f4], eax
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
xor eax, eax
inc eax
cmp eax, 0xf393
je 0x467a6f
mov dword [ebp - 0x6a0], 1
jmp 0x467a76
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x6a0], eax
jne 0x467a8d
mov dword [ebp - 0xba0], 1
jmp 0x467a94
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0xba0]
sub eax, 6
jne 0x467aa8
and dword [ebp - 0x6a8], 0
jmp 0x467ab2
mov dword [ebp - 0x6a8], 1
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
mov ecx, dword [ebp - 0x6a8]
cmp ecx, dword [eax]
je 0x467ad5
mov dword [ebp - 0xe8c], 1
jmp 0x467adc
and dword [ebp - 0xe8c], 0
cmp dword [ebp - 0x64], 0
jne 0x467af0
or eax, 0xffffffff
jne 0x467af0
and dword [ebp - 0xa00], 0
jmp 0x467afa
mov dword [ebp - 0xa00], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xa00], eax
jne 0x467b15
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x467b15
and dword [ebp - 0x6b0], 0
jmp 0x467b1f
mov dword [ebp - 0x6b0], 1
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6b0]
lea eax, [ecx + eax - 6]
test eax, eax
je 0x467bdd
push 3
lea ecx, [ebp - 0x1298]
call fcn.00422862
mov dword [ebp - 0xddc], 0x37d437f1
mov dword [ebp - 0x3f0], 0
jmp 0x467b70
cmp dword [ebp - 0x3f0], 3
jge 0x467b92
mov dword [ebp - 0x6b8], 0x9dfeee83
mov dword [ebp - 0x474], 0x404e5477
push 0
lea ecx, [ebp - 0x418]
call fcn.00422927
cmp dword [eax], 0
je 0x467c16
mov dword [ebp - 0x6b8], 0x83428364
cmp dword [ebp - 0x6b8], 0
jne 0x467c25
cmp dword [ebp - 0x64], 0
jne 0x467c25
jmp 0x4672ce
mov dword [ebp - 0x158], 7
mov dword [ebp - 0x16fc], 0xfffffffb
push 4
lea ecx, [ebp - 0x15f4]
call fcn.00422862
mov dword [ebp - 0x2e4], 0
jmp 0x467cdd
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 4
jge 0x467cff
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x15f4]
call fcn.00422927
mov dword [eax], 0xfcfbce00
jmp 0x467cd0
mov dword [ebp - 0x158], 0xffffffe2
jmp 0x467d18
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x16
je 0x467f50
push 2
lea ecx, [ebp - 0x1038]
call fcn.00422862
mov dword [ebp - 0x94], 0
jmp 0x467d4b
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x467d67
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x1930], 0x9c3f
jmp 0x467d3e
mov dword [ebp - 0x94], 0
jmp 0x467d80
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x467da2
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1038]
call fcn.00422927
mov dword [eax], 0x23371247
jmp 0x467d73
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1930], 0
jne 0x467dc0
or eax, 0xffffffff
jne 0x467dc0
and dword [ebp - 0xba8], 0
jmp 0x467dca
mov dword [ebp - 0xba8], 1
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x6c0], eax
push 0
lea ecx, [ebp - 0x1038]
call fcn.00422927
mov ecx, dword [ebp - 0x6c0]
mov dword [eax], ecx
cmp dword [ebp - 0x6c0], 0xfff6
ja 0x467e04
mov dword [ebp - 0x6c8], 1
jmp 0x467e0b
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0xba8]
cmp eax, dword [ebp - 0x6c8]
jg 0x467e25
mov dword [ebp - 0xa10], 1
jmp 0x467e2c
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0xa10]
je 0x467e6a
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x467e65
push 0
push 0
push 0
push 0
push 0
push 0
push 0x9ee
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x467f2a
mov dword [ebp - 0x1740], 0xe012d2c8
mov dword [ebp - 0x1748], 7
mov dword [ebp - 0x1750], 0xd40a1650
mov dword [ebp - 0x1758], 0x1a7a81a8
push 3
lea ecx, [ebp - 0x15e4]
call fcn.00422862
mov dword [ebp - 0x6d0], 0x25189d9e
mov dword [ebp - 0x374], 0
jmp 0x467ec2
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 3
jge 0x467ee4
push dword [ebp - 0x374]
lea ecx, [ebp - 0x15e4]
call fcn.00422927
mov dword [eax], 0xf84255eb
jmp 0x467eb5
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x467f12
push 0xfe0
push 0x835
push 0xa40
push 0xee5
push 0
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x6d0]
dec eax
mov dword [ebp - 0x6d0], eax
lea ecx, [ebp - 0x15e4]
call fcn.00422922
cmp dword [ebp - 0x158], 0
je 0x467f40
lea ecx, [ebp - 0x1038]
call fcn.00422922
jmp 0x467f50
lea ecx, [ebp - 0x1038]
call fcn.00422922
jmp 0x467d0b
lea ecx, [ebp - 0x15f4]
call fcn.00422922
mov dword [ebp - 0xe94], 0xb0f7
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0xde4], 1
push 4
lea ecx, [ebp - 0x12c8]
call fcn.00422862
mov dword [ebp - 0x47c], 0xdcb0c7b2
mov dword [ebp - 0x1760], 0xfd90538e
mov dword [ebp - 0x1768], 0x6aece011
mov dword [ebp - 0x111c], 0x22354120
mov dword [ebp - 0x1118], 0x22354120
mov dword [ebp - 0x1114], 0x22354120
mov dword [ebp - 0x1110], 0x22354120
lea ecx, [ebp - 0x439]
call fcn.00401b47
push eax
lea eax, [ebp - 0x110c]
push eax
lea eax, [ebp - 0x111c]
push eax
lea ecx, [ebp - 0x1870]
call fcn.00422936
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfbc]
call fcn.004228fc
and dword [ebp - 0x11e4], 0
and dword [ebp - 0x11e0], 0
and dword [ebp - 0x11dc], 0
and dword [ebp - 0x11d8], 0
lea ecx, [ebp - 0x505]
call fcn.00401b47
push eax
lea eax, [ebp - 0x11d4]
push eax
lea eax, [ebp - 0x11e4]
push eax
lea ecx, [ebp - 0x1880]
call fcn.00422936
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1604]
call fcn.004228fc
mov dword [ebp - 0x1770], 0xcdb5cf63
mov dword [ebp - 0x1778], 0xb2933530
mov dword [ebp - 0xea4], 0
mov dword [ebp - 0xd8], 0
jmp 0x468089
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x4680a5
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x12b0], 0xf07b4bc6
jmp 0x46807c
mov dword [ebp - 0xd8], 0
jmp 0x4680be
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x4680e0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x12c8]
call fcn.00422927
mov dword [eax], 0x422d
jmp 0x4680b1
cmp dword [ebp - 0xe94], 0
je 0x46824b
mov dword [ebp - 0x160], 0xfffffff7
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x468115
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
jne 0x46814b
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0xde4], eax
jne 0x468142
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x12b0], 0
jne 0x46814b
and dword [ebp - 0xe9c], 0
jmp 0x468155
mov dword [ebp - 0xe9c], 1
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1780], eax
cmp dword [ebp - 0x160], 0
jne 0x468176
mov dword [ebp - 0xc78], 1
jmp 0x46817d
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0xc78], eax
jle 0x468197
mov dword [ebp - 0x6d8], 1
jmp 0x46819e
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x6d8], eax
jle 0x4681b8
mov dword [ebp - 0xa18], 1
jmp 0x4681bf
and dword [ebp - 0xa18], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x12b0]
cmp eax, dword [ebp - 0xa18]
jle 0x4681df
mov dword [ebp - 0x6e0], 1
jmp 0x4681e6
and dword [ebp - 0x6e0], 0
imul eax, dword [ebp - 0x6e0], 0xffff
test eax, eax
jne 0x468200
mov dword [ebp - 0xdec], 1
jmp 0x468207
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1788], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x160], eax
jle 0x46822d
mov dword [ebp - 0xbb0], 1
jmp 0x468234
and dword [ebp - 0xbb0], 0
push 2
lea ecx, [ebp - 0x12c8]
call fcn.00422927
mov ecx, dword [ebp - 0xbb0]
mov dword [eax], ecx
jmp 0x46828d
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x46826e
push 0
push 0
push 0
push 0x4ee
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x46828d
push 0x37d
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 3
lea ecx, [ebp - 0xfbc]
call fcn.00422927
mov eax, dword [eax]
inc eax
jne 0x4682b1
push 0
lea ecx, [ebp - 0xfbc]
call fcn.00422927
cmp dword [eax], 0
je 0x4682ca
push 3
lea ecx, [ebp - 0xfbc]
call fcn.00422927
cmp dword [eax], 0
je 0x4682ca
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x4682ee
mov eax, 0xffff
test eax, eax
jne 0x4682ee
push 0
lea ecx, [ebp - 0x1604]
call fcn.00422927
cmp dword [eax], 0
jne 0x4682ee
and dword [ebp - 0x6e8], 0
jmp 0x4682f8
mov dword [ebp - 0x6e8], 1
mov eax, dword [ebp - 0x47c]
imul eax, dword [ebp - 0x6e8]
sub eax, dword [ebp - 0xea4]
jne 0x468319
mov dword [ebp - 0x4d4], 1
jmp 0x468320
and dword [ebp - 0x4d4], 0
push 1
lea ecx, [ebp - 0xfbc]
call fcn.00422927
mov ecx, dword [ebp - 0x4d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x47c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x47c]
mov dword [ebp + eax - 0x12b0], ecx
lea ecx, [ebp - 0x1604]
call fcn.00422922
lea ecx, [ebp - 0xfbc]
call fcn.00422922
lea ecx, [ebp - 0x12c8]
call fcn.00422922
mov byte [ebp - 0x194], 0
mov dword [ebp - 0x3b8], 0x928c176b
mov dword [ebp - 0x3b8], 0
jmp 0x46839f
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0x11
jl 0x4684a8
mov dword [ebp - 0x37c], 8
push 4
lea ecx, [ebp - 0x12f8]
call fcn.00422862
mov dword [ebp - 0x2f4], 0
jmp 0x4683dc
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 4
jge 0x4683fe
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x12f8]
call fcn.00422927
mov dword [eax], 0xfffffffc
jmp 0x4683cf
mov dword [ebp - 0x37c], 0x18
jmp 0x468417
mov eax, dword [ebp - 0x37c]
dec eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0xfffffffa
jg 0x468498
push 1
lea ecx, [ebp - 0x12e0]
call fcn.00422862
mov dword [ebp - 0x2fc], 0
jmp 0x468446
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x468468
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0x12e0]
call fcn.00422927
mov dword [eax], 0x5d811f07
jmp 0x468439
push 0
lea ecx, [ebp - 0x12e0]
call fcn.00422927
mov esi, eax
push 2
lea ecx, [ebp - 0x12f8]
call fcn.00422927
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x12e0]
call fcn.00422922
jmp 0x46840a
lea ecx, [ebp - 0x12f8]
call fcn.00422922
jmp 0x468392
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x4684c2
push 0
push 0x3fd
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], 0x30f94f37
mov dword [ebp - 0x4fc], 8
mov dword [ebp - 0xcd8], 0xca8cda2a
mov dword [ebp - 0xa20], 0xcd329b3a
mov dword [ebp - 0x1144], 0x13f08700
mov dword [ebp - 0x1140], 0x13f08700
mov dword [ebp - 0x113c], 0x13f08700
mov dword [ebp - 0x1138], 0x13f08700
lea ecx, [ebp - 0x441]
call fcn.00401b47
push eax
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x1144]
push eax
lea ecx, [ebp - 0x1890]
call fcn.00422936
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1614]
call fcn.004228fc
cmp dword [ebp - 0x2c], 0
je 0x468568
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0xa20], 0
je 0x468568
mov dword [ebp - 0x6f0], 1
jmp 0x46856f
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6f0], eax
jl 0x468589
cmp dword [ebp - 0x2c], 0
jne 0x468589
and dword [ebp - 0xdf4], 0
jmp 0x468593
mov dword [ebp - 0xdf4], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
neg eax
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xcd8], eax
je 0x4685c1
mov dword [ebp - 0x6f8], 1
jmp 0x4685c8
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6f8], eax
jge 0x4685df
mov dword [ebp - 0xa28], 1
jmp 0x4685e6
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 0x99a56718
jb 0x4685fe
mov dword [ebp - 0x700], 1
jmp 0x468605
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
sub eax, dword [ebp - 0x2c]
cmp eax, 0x52487223
jg 0x468621
mov dword [ebp - 0xbb8], 1
jmp 0x468628
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0xbb8]
test eax, eax
jne 0x468643