Function at 0x46d172
Capabilities:
Accept command line arguments
Get memory capacity
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
push esi
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0xa0], 0x9ba5f27a
mov dword [ebp - 0x450], 0x966c4779
mov dword [ebp - 0x168], 0
jmp 0x46d1b0
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x46d1c9
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x14], 0xffffffff
jmp 0x46d1a3
mov dword [ebp - 0x38], 0
jmp 0x46d1d9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x46d476
push 2
lea ecx, [ebp - 0x1ec]
call fcn.004013fc
mov dword [ebp - 0x6f8], 0xe01afec1
mov dword [ebp - 0x138], 0
jmp 0x46d213
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x46d235
push dword [ebp - 0x138]
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
mov dword [eax], 0xe80d68f9
jmp 0x46d206
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x14], 0
je 0x46d321
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
jne 0x46d274
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + eax*4 - 0x14]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
push 0
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
cmp dword [eax], 0
jne 0x46d299
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x14], 0
jne 0x46d299
and dword [ebp - 0x3bc], 0
jmp 0x46d2a3
mov dword [ebp - 0x3bc], 1
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
mov ecx, dword [ebp - 0x3bc]
cmp ecx, dword [eax]
jl 0x46d2c6
mov dword [ebp - 0x500], 1
jmp 0x46d2cd
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xa0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov ecx, dword [ebp - 0xa0]
lea eax, [ecx + eax + 0x5526]
mov ecx, dword [ebp - 0x38]
cmp dword [ebp + ecx*4 - 0x14], eax
jl 0x46d305
mov dword [ebp - 0x508], 1
jmp 0x46d30c
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0xfffffffe
jge 0x46d321
mov dword [ebp - 0x510], 1
jmp 0x46d328
and dword [ebp - 0x510], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
mov esi, dword [ebp - 0x510]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
cmp esi, dword [eax]
jg 0x46d35a
mov dword [ebp - 0x518], 1
jmp 0x46d361
and dword [ebp - 0x518], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [eax]
jge 0x46d384
mov dword [ebp - 0x520], 1
jmp 0x46d38b
and dword [ebp - 0x520], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax - 0x14], ecx
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x14]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004014ea
cmp esi, dword [eax]
jge 0x46d3c2
mov dword [ebp - 0x528], 1
jmp 0x46d3c9
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0xffffffff
jg 0x46d3de
mov dword [ebp - 0x448], 1
jmp 0x46d3e5
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0xa0], 0xfffffff5
jmp 0x46d40a
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffea
jle 0x46d466
mov dword [ebp - 0x6fc], 0xa81f6ed7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 1
jg 0x46d436
mov dword [ebp - 0x1fc], 1
jmp 0x46d43d
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x14], ecx
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x46d464
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x46d3fd
lea ecx, [ebp - 0x1ec]
call fcn.004014ce
jmp 0x46d1d2
mov dword [ebp - 0x450], 0x1d9d65fe
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46f5ef
mov dword [ebp - 0x71c], 0xae9714a0
mov dword [ebp - 0x724], 0xfffffff9
mov dword [ebp - 0x72c], 6
mov dword [ebp - 0x734], 0xf5cd53bc
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x744], 0xffffffff
mov dword [ebp - 0x74c], 0
mov dword [ebp - 0x754], 0x276b87d0
mov dword [ebp - 0x55c], 0x941fc9a5
mov dword [ebp - 0x75c], 0xd3f5047c
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x5a4], 1
mov dword [ebp - 0xf8], 0
jmp 0x46d51d
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 4
jge 0x46d539
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x87c], 0xffffffff
jmp 0x46d510
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x5a4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x5f8], eax
push 2
lea ecx, [ebp - 0x78]
call fcn.004013fc
mov dword [ebp - 0x18], 0x6f393842
mov dword [ebp - 0x3c], 0x3e2be8ca
mov dword [ebp - 0x140], 0
jmp 0x46d58c
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x46d5ab
push dword [ebp - 0x140]
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov dword [eax], 0x1824a8c6
jmp 0x46d57f
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
and dword [eax], 0
jmp 0x46d5db
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x458]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0xfffffffa
jne 0x46d928
mov dword [ebp - 0x1c], 0x9d01
mov dword [ebp - 0x490], 0x8592840c
mov dword [ebp - 0x184], 0xbde5
mov dword [ebp - 0x5c0], 0x1f8487b2
imul eax, dword [ebp - 0x1c], 0x17be
test eax, eax
jne 0x46d68b
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0
je 0x46d68b
mov eax, 0x1da7bc99
test eax, eax
je 0x46d660
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x764], eax
push 1
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0
jne 0x46d654
cmp dword [ebp - 0x1c], 0
je 0x46d660
mov dword [ebp - 0x20c], 1
jmp 0x46d667
and dword [ebp - 0x20c], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov ecx, dword [ebp - 0x20c]
imul ecx, dword [eax]
cmp ecx, 2
je 0x46d68b
mov dword [ebp - 0x460], 1
jmp 0x46d692
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 0xfffffff6
jl 0x46d6a7
mov dword [ebp - 0x214], 1
jmp 0x46d6ae
and dword [ebp - 0x214], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [eax]
jge 0x46d6ce
mov dword [ebp - 0x468], 1
jmp 0x46d6d5
and dword [ebp - 0x468], 0
imul eax, dword [ebp - 0x468], 0xcbe9
test eax, eax
jne 0x46d6f5
mov eax, 0x9150faeb
test eax, eax
jne 0x46d6f5
and dword [ebp - 0x21c], 0
jmp 0x46d6ff
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x21c], eax
je 0x46d716
mov dword [ebp - 0x470], 1
jmp 0x46d71d
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x470], eax
jge 0x46d734
mov dword [ebp - 0x224], 1
jmp 0x46d73b
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x774], eax
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0x5e3aa9c1
jge 0x46d774
mov dword [ebp - 0x478], 1
jmp 0x46d77b
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x478], eax
jge 0x46d792
mov dword [ebp - 0x22c], 1
jmp 0x46d799
and dword [ebp - 0x22c], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [eax]
jle 0x46d7b9
mov dword [ebp - 0x480], 1
jmp 0x46d7c0
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0xb8342836
je 0x46d7d8
mov dword [ebp - 0x234], 1
jmp 0x46d7df
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
inc eax
inc eax
mov dword [ebp - 0x490], eax
jne 0x46d801
cmp dword [ebp - 0x184], 0
jne 0x46d801
and dword [ebp - 0x23c], 0
jmp 0x46d80b
mov dword [ebp - 0x23c], 1
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp esi, dword [eax]
jne 0x46d831
mov dword [ebp - 0x5b8], 1
jmp 0x46d838
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x77c], eax
push 3
pop eax
test eax, eax
jne 0x46d857
cmp dword [ebp - 0x1c], 0
jne 0x46d857
and dword [ebp - 0x498], 0
jmp 0x46d861
mov dword [ebp - 0x498], 1
cmp dword [ebp - 0x498], 0xfffffffe
je 0x46d876
mov dword [ebp - 0x244], 1
jmp 0x46d87d
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0xc23cea2f
jbe 0x46d895
mov dword [ebp - 0x4a0], 1
jmp 0x46d89c
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
je 0x46d8bc
cmp dword [ebp - 0x3c], 0
je 0x46d8bc
mov dword [ebp - 0x24c], 1
jmp 0x46d8c3
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x184]
imul eax, dword [ebp - 0x24c]
test eax, eax
je 0x46d8e9
cmp dword [ebp - 0x184], 0
je 0x46d8e9
mov dword [ebp - 0x4a8], 1
jmp 0x46d8f0
and dword [ebp - 0x4a8], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov ecx, dword [ebp - 0x4a8]
cmp ecx, dword [eax]
je 0x46d910
mov dword [ebp - 0x254], 1
jmp 0x46d917
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x5c0], eax
jmp 0x46d5ba
mov dword [ebp - 0x18], 1
jmp 0x46d938
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x46dbda
mov dword [ebp - 0x4b0], 0xfffffff6
mov dword [ebp - 0x5c], 0xd99275a8
mov dword [ebp - 0x3c], 0
jmp 0x46d963
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x46d97d
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0
je 0x46d97b
jmp 0x46d97d
jmp 0x46d95c
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4b0]
add eax, dword [ebp - 0x5c]
je 0x46d9a7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov dword [eax], 0x1f04fecc
jmp 0x46dbd5
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x5d0], 0xffffffff
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x784], eax
mov esi, dword [ebp - 0x3c]
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp esi, dword [eax]
jl 0x46d9e4
mov dword [ebp - 0x25c], 1
jmp 0x46d9eb
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x18], eax
jne 0x46d9ff
mov dword [ebp - 0x4b8], 1
jmp 0x46da06
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x5c], eax
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0
jne 0x46da3d
mov eax, dword [ebp - 0x264]
neg eax
cmp eax, 0xffff
jae 0x46da5f
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0
je 0x46da5f
push 7
pop eax
test eax, eax
je 0x46da5f
mov dword [ebp - 0x4c0], 1
jmp 0x46da66
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 1
jbe 0x46da7b
mov dword [ebp - 0x26c], 1
jmp 0x46da82
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x26c]
jg 0x46daab
mov eax, 0x8dd93f87
test eax, eax
je 0x46daab
mov dword [ebp - 0x4c8], 1
jmp 0x46dab2
and dword [ebp - 0x4c8], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov ecx, dword [ebp - 0x4c8]
cmp ecx, dword [eax]
jle 0x46dad2
mov dword [ebp - 0x274], 1
jmp 0x46dad9
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 4
je 0x46daee
mov dword [ebp - 0x5c8], 1
jmp 0x46daf5
and dword [ebp - 0x5c8], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
cmp dword [eax], 0
je 0x46db15
or eax, 0xffffffff
je 0x46db15
mov dword [ebp - 0x4d0], 1
jmp 0x46db1c
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4d0], eax
jne 0x46db33
mov dword [ebp - 0x27c], 1
jmp 0x46db3a
and dword [ebp - 0x27c], 0
push 0
lea ecx, [ebp - 0x78]
call fcn.004014ea
mov ecx, dword [ebp - 0x27c]
cmp ecx, dword [eax]
je 0x46db5d
cmp dword [ebp - 0x5c], 0
jne 0x46db5d
and dword [ebp - 0x4d8], 0
jmp 0x46db67
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x90218fcd
jb 0x46db85
mov dword [ebp - 0x284], 1
jmp 0x46db8c
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x284], eax
jl 0x46dba3
mov dword [ebp - 0x4e0], 1
jmp 0x46dbaa
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0x2a8
jl 0x46dbc2
mov dword [ebp - 0x28c], 1
jmp 0x46dbc9
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x5d0], eax
jmp 0x46d931
lea ecx, [ebp - 0x78]
call fcn.004014ce
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x78c], 0xae9714a0
mov dword [ebp - 0x794], 0xfffffff9
mov dword [ebp - 0x79c], 6
mov dword [ebp - 0x7a4], 0xf5cd53bc
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x708], 0x276b87d0
mov dword [ebp - 0x5d8], 0x941fc9a5
mov dword [ebp - 0x808], 0xd3f5047c
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x5e0], 1
mov dword [ebp - 0x100], 0
jmp 0x46dc7c
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x46dc98
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x86c], 0xffffffff
jmp 0x46dc6f
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 0x148], 0
jmp 0x46dcdd
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x46dcf9
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x828], 0xffffffff
jmp 0x46dcd0
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x46dd15
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x108], 2
jmp 0x46dd2e
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x46dee6
push 2
lea ecx, [ebp - 0x610]
call fcn.004013fc
mov dword [ebp - 0x150], 0
jmp 0x46dd61
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x46dd83
push dword [ebp - 0x150]
lea ecx, [ebp - 0x610]
call fcn.004014ea
mov dword [eax], 3
jmp 0x46dd54
push 1
lea ecx, [ebp - 0x610]
call fcn.004014ea
and dword [eax], 0
jmp 0x46ddb9
push 1
lea ecx, [ebp - 0x610]
call fcn.004014ea
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x610]
call fcn.004014ea
cmp dword [eax], 2
jg 0x46ded6
mov dword [ebp - 0x110], 0xf8067e3
mov dword [ebp - 0x110], 2
jmp 0x46ddf2
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x46ded1
push 1
lea ecx, [ebp - 0x558]
call fcn.004013fc
mov dword [ebp - 0x158], 0
jmp 0x46de25
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x46de47
push dword [ebp - 0x158]
lea ecx, [ebp - 0x558]
call fcn.004014ea
mov dword [eax], 0xa1fa147b
jmp 0x46de18
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x46de5d
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
lea ecx, [ebp - 0x558]
call fcn.004014ea
and dword [eax], 0
jmp 0x46de93
push 0
lea ecx, [ebp - 0x558]
call fcn.004014ea
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4f0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x558]
call fcn.004014ea
cmp dword [eax], 3
jge 0x46dec1
push 0
lea ecx, [ebp - 0x558]
call fcn.004014ea
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x828], 0xe3cf9575
jmp 0x46de6f
lea ecx, [ebp - 0x558]
call fcn.004014ce
jmp 0x46dde5
jmp 0x46dd95
lea ecx, [ebp - 0x610]
call fcn.004014ce
jmp 0x46dd21
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x5e8], 4
mov dword [ebp - 0x3ec], 4
mov dword [ebp - 0x5f0], 0xf3e76e5b
push 1
lea ecx, [ebp - 0x7c4]
call fcn.004013fc
mov dword [ebp - 0x118], 0
jmp 0x46df34
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x46df56
push dword [ebp - 0x118]
lea ecx, [ebp - 0x7c4]
call fcn.004014ea
mov dword [eax], 0xfffffff9
jmp 0x46df27
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x46df74
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov dword [ebp - 0xc8], 0
jmp 0x46df8d
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffe6
jne 0x46e081
mov dword [ebp - 0x160], 0x64caf14c
cmp dword [ebp - 0x160], 0
jne 0x46dfb9
mov dword [ebp - 0x4f8], 1
jmp 0x46dfc0
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x160], 0x836b16b4
jae 0x46dfd8
mov dword [ebp - 0x2a0], 1
jmp 0x46dfdf
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0x2a0]
jg 0x46dff9
mov dword [ebp - 0x3e8], 1
jmp 0x46e000
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0xc8], eax
jle 0x46e032
mov dword [ebp - 0x2a4], 1
jmp 0x46e039
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x160]
cmp dword [ebp - 0x3e8], eax
je 0x46e05a
xor eax, eax
jne 0x46e05a
and dword [ebp - 0x2ac], 0
jmp 0x46e064
mov dword [ebp - 0x2ac], 1
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x5f0], eax
jmp 0x46df80
lea ecx, [ebp - 0x7c4]
call fcn.004014ce
mov eax, dword [ebp - 0x5f8]
movzx eax, byte [eax]
test eax, eax
je 0x46eb31
mov dword [ebp - 0x10], 0x2971c1ec
mov dword [ebp - 4], 0xb8114768
push 3
lea ecx, [ebp - 0x64c]
call fcn.004013fc
mov dword [ebp - 0xac], 0xf4d21fd0
mov dword [ebp - 0x120], 0
jmp 0x46e0db
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x46e0fd
push dword [ebp - 0x120]
lea ecx, [ebp - 0x64c]
call fcn.004014ea
mov dword [eax], 1
jmp 0x46e0ce
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x46e111
mov dword [ebp - 0x2b4], 1
jmp 0x46e118
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xd
jmp 0x46e131
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2e
jne 0x46e8d9
mov dword [ebp - 0x580], 9
mov dword [ebp - 0x28], 0
jmp 0x46e155
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x46e16b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1e0], 0xffffffff
jmp 0x46e14e
mov dword [ebp - 0x28], 0
jmp 0x46e17b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x46e191
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x540], 0x396434d1
jmp 0x46e174
mov dword [ebp - 4], 2
jmp 0x46e1a1
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x46e61d
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x2c4], 0xe264
push 3
lea ecx, [ebp - 0x6a4]
call fcn.004013fc
push 1
lea ecx, [ebp - 0x54c]
call fcn.004013fc
mov dword [ebp - 0x570], 1
mov dword [ebp - 0x2c], 0
jmp 0x46e1f3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x46e20f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x6a4]
call fcn.004014ea
mov dword [eax], 0xfa7bb34e
jmp 0x46e1ec
mov dword [ebp - 0x2c], 0
jmp 0x46e21f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x46e238
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x54c]
call fcn.004014ea
and dword [eax], 0
jmp 0x46e218
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x46e253
push 0xb96
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, 0xee21afa9
test eax, eax
je 0x46e5c4
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1e0]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1e0]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x780], eax
push 2
pop eax
cmp eax, 0x75df1563
jl 0x46e2b7
mov dword [ebp - 0x600], 1
jmp 0x46e2be
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0]
mov dword [ebp - 0x814], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e0]
cmp dword [ebp - 0x10], eax
jne 0x46e2f7
mov dword [ebp - 0x4dc], 1
jmp 0x46e2fe
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0xd47cdd53
jae 0x46e316
mov dword [ebp - 0x1b0], 1
jmp 0x46e31d
and dword [ebp - 0x1b0], 0
push 1
lea ecx, [ebp - 0x64c]
call fcn.004014ea
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1b0], eax
jge 0x46e349
mov dword [ebp - 0x2bc], 1
jmp 0x46e350
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x2bc]
cmp eax, 0xb405
jge 0x46e36c
mov dword [ebp - 0x3f4], 1
jmp 0x46e373
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x3f4], eax
jle 0x46e38d
mov dword [ebp - 0x494], 1
jmp 0x46e394
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x494], eax
jl 0x46e3ae
mov dword [ebp - 0x2cc], 1
jmp 0x46e3b5
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0x3aabdc9a
jle 0x46e3cd
mov dword [ebp - 0x59c], 1
jmp 0x46e3d4
and dword [ebp - 0x59c], 0
push 2
lea ecx, [ebp - 0x6a4]
call fcn.004014ea
mov dword [eax], 0x6910c334
mov eax, 0x6910c334
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jg 0x46e400
mov dword [ebp - 0x3fc], 1
jmp 0x46e407
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1e0]
add eax, dword [ebp - 0x3fc]
je 0x46e432
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1e0], 0
je 0x46e432
mov dword [ebp - 0x568], 1
jmp 0x46e439
and dword [ebp - 0x568], 0
push 0
lea ecx, [ebp - 0x54c]
call fcn.004014ea
mov esi, dword [eax]
sub esi, 0x3fd53956
imul esi, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x54c]
call fcn.004014ea
cmp esi, dword [eax]
jge 0x46e46f
mov dword [ebp - 0x2d4], 1
jmp 0x46e476
and dword [ebp - 0x2d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e0]
cmp dword [ebp - 0x2d4], eax
je 0x46e497
mov dword [ebp - 0x504], 1
jmp 0x46e49e
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0]
cmp dword [ebp - 0x504], eax
jle 0x46e4bf
mov dword [ebp - 0x2dc], 1
jmp 0x46e4c6
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0x1d2cf1a5
jle 0x46e4de
mov dword [ebp - 0x404], 1
jmp 0x46e4e5
and dword [ebp - 0x404], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0]
add eax, dword [ebp - 0x404]
cmp eax, 0xa6c34309
je 0x46e50b
mov dword [ebp - 0x2e4], 1
jmp 0x46e512
and dword [ebp - 0x2e4], 0
push 0
lea ecx, [ebp - 0x54c]
call fcn.004014ea
mov ecx, dword [ebp - 0x2e4]
cmp ecx, dword [eax]
je 0x46e535
mov dword [ebp - 0x49c], 1
jmp 0x46e53c
and dword [ebp - 0x49c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x540]
imul eax, dword [ebp - 0x49c]
test eax, eax
jne 0x46e55f
mov dword [ebp - 0x5e4], 1
jmp 0x46e566
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0xac], 0
jne 0x46e587
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x540], 0
jne 0x46e587
and dword [ebp - 0x2ec], 0
jmp 0x46e591
mov dword [ebp - 0x2ec], 1
cmp dword [ebp - 0x2ec], 1
jge 0x46e5a6
mov dword [ebp - 0x40c], 1
jmp 0x46e5ad
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x40c], eax
jg 0x46e5c4
mov dword [ebp - 0x2f4], 1
jmp 0x46e5cb
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 2
jge 0x46e5e0
mov dword [ebp - 0x4e4], 1
jmp 0x46e5e7
and dword [ebp - 0x4e4], 0
push 0
lea ecx, [ebp - 0x54c]
call fcn.004014ea
mov ecx, dword [ebp - 0x4e4]
sub ecx, dword [eax]
mov dword [ebp - 0x570], ecx
lea ecx, [ebp - 0x54c]
call fcn.004014ce
lea ecx, [ebp - 0x6a4]
call fcn.004014ce
jmp 0x46e19a
mov dword [ebp - 0xac], 0xffffffec
jmp 0x46e636
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x35
jne 0x46e8d4
mov dword [ebp - 0xc4], 0
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x46e667
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [ebp - 4], 0xfffffff8
jmp 0x46e677
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jl 0x46e8cf
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x324], 1
cmp dword [ebp - 0x50], 0
je 0x46e69d
jmp 0x46e8cf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x540], 0
jne 0x46e7f7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e0], 0
jne 0x46e6d2
cmp dword [ebp - 0xc4], 0
jne 0x46e6d2
and dword [ebp - 0x63c], 0
jmp 0x46e6dc
mov dword [ebp - 0x63c], 1
mov eax, 0xfff6
cmp eax, 0xfffc
je 0x46e6f4
mov dword [ebp - 0x2fc], 1
jmp 0x46e6fb
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x2fc], eax
je 0x46e715
cmp dword [ebp - 0x50], 0
jne 0x46e715
and dword [ebp - 0x304], 0
jmp 0x46e71f
mov dword [ebp - 0x304], 1
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x414], eax
push 1
lea ecx, [ebp - 0x64c]
call fcn.004014ea
mov ecx, dword [ebp - 0x414]
mov dword [eax], ecx
mov eax, dword [ebp - 0x414]
add eax, dword [ebp - 0x304]
cmp eax, 9
jle 0x46e75d
mov dword [ebp - 0x4a4], 1
jmp 0x46e764
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x4a4], eax
jge 0x46e77e
mov dword [ebp - 0x578], 1
jmp 0x46e785
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x50], eax
jne 0x46e7a8
mov dword [ebp - 0x30c], 1
jmp 0x46e7af
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
neg eax
imul eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jge 0x46e7cc
mov dword [ebp - 0x5ec], 1
jmp 0x46e7d3
and dword [ebp - 0x5ec], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e0]
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0xc4], 0
jne 0x46e7f7
and dword [ebp - 0x41c], 0
jmp 0x46e801
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x41c], eax
je 0x46e81b
mov dword [ebp - 0x314], 1
jmp 0x46e822
and dword [ebp - 0x314], 0
imul eax, dword [ebp - 0x314], 0
cmp eax, dword [ebp - 0x10]
jle 0x46e83a
mov dword [ebp - 0x524], 1
jmp 0x46e841
and dword [ebp - 0x524], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x524]
sub ecx, dword [ebp + eax - 0x540]
je 0x46e867
cmp dword [ebp - 0x50], 0
je 0x46e867
mov dword [ebp - 0x31c], 1
jmp 0x46e86e
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x31c], eax
je 0x46e885
mov dword [ebp - 0x424], 1
jmp 0x46e88c
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x324], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x540]
add ecx, dword [ebp - 0x324]
add ecx, dword [ebp + eax - 0x540]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x540]
add eax, ecx
mov dword [ebp - 0x580], eax
jmp 0x46e670
jmp 0x46e629
jmp 0x46e12a
lea ecx, [ebp - 0x64c]
call fcn.004014ce
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x4ec], eax
push 3
lea ecx, [ebp - 0x48c]
call fcn.004013fc
mov dword [ebp - 0x34], 0
mov dword [ebp - 0xbc], 0xc18ab9c2
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x700], 0x9843
mov dword [ebp - 0x16c], 0
jmp 0x46e947
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x46e969
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x48c]
call fcn.004014ea
mov dword [eax], 5
jmp 0x46e93a
mov dword [ebp - 0x34], 0
jmp 0x46e979
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x46eae0
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x628], 0x442e1191
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
push 0
lea ecx, [ebp - 0x48c]
call fcn.004014ea
cmp dword [eax], 3
jle 0x46e9c2
mov dword [ebp - 0x5f4], 1
jmp 0x46e9c9
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x48c]
call fcn.004014ea
imul eax, dword [ebp - 0x34], 0xd21c
cmp eax, dword [ebp - 0xcc]
jge 0x46e9f1
mov dword [ebp - 0x4ac], 1
jmp 0x46e9f8
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x70c], eax
mov esi, dword [ebp - 0xcc]
push 1
lea ecx, [ebp - 0x48c]
call fcn.004014ea
cmp esi, dword [eax]
jge 0x46ea33
mov dword [ebp - 0x590], 1
jmp 0x46ea3a
and dword [ebp - 0x590], 0
mov dword [ebp - 0x190], 0xfffffffb
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x34]
jg 0x46ea62
mov dword [ebp - 0x32c], 1
jmp 0x46ea69
and dword [ebp - 0x32c], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x48c]
call fcn.004014ea
mov ecx, dword [ebp - 0x32c]
sub ecx, dword [eax]
jne 0x46ea8d
mov dword [ebp - 0x42c], 1
jmp 0x46ea94
and dword [ebp - 0x42c], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x48c]
call fcn.004014ea
mov ecx, dword [ebp - 0x42c]
cmp ecx, dword [eax]
je 0x46eab8
mov dword [ebp - 0x334], 1
jmp 0x46eabf
and dword [ebp - 0x334], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x48c]
call fcn.004014ea
mov eax, dword [eax]
add eax, dword [ebp - 0x334]
mov dword [ebp - 0x628], eax
jmp 0x46e972
mov dword [ebp - 0xbc], 2
jmp 0x46eaf9
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x46eb0e
mov dword [ebp - 0x190], 0x712c5197
jmp 0x46eaec
lea ecx, [ebp - 0x48c]
call fcn.004014ce
mov eax, dword [ebp - 0x4ec]
mov eax, dword [eax]
add eax, 0x21
mov ecx, dword [ebp - 0x4ec]
mov dword [ecx], eax
jmp 0x46f5ea
mov dword [ebp - 0x4b4], 0xefa4
push 1
lea ecx, [ebp - 0x534]
call fcn.004013fc
push 2
lea ecx, [ebp - 0x670]
call fcn.004013fc
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x5fc], 0x982b357f
mov dword [ebp - 8], 0
jmp 0x46eb76
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x46eb92
push dword [ebp - 8]
lea ecx, [ebp - 0x534]
call fcn.004014ea
mov dword [eax], 0x9b69b2e4
jmp 0x46eb6f
mov dword [ebp - 8], 0
jmp 0x46eba2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x46ebbe
push dword [ebp - 8]
lea ecx, [ebp - 0x670]
call fcn.004014ea
mov dword [eax], 0xfffffff8
jmp 0x46eb9b
mov dword [ebp - 8], 0
jmp 0x46ebce
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x46ebe4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x35c], 0x1f8b
jmp 0x46ebc7
push 0
lea ecx, [ebp - 0x534]
call fcn.004014ea
cmp dword [eax], 0x3cc47d1a
jl 0x46ec05
mov dword [ebp - 0x33c], 1
jmp 0x46ec0c
and dword [ebp - 0x33c], 0
push 0
lea ecx, [ebp - 0x534]
call fcn.004014ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x33c]
jle 0x46ec2f
mov dword [ebp - 0x598], 1
jmp 0x46ec36
and dword [ebp - 0x598], 0
or eax, 0xffffffff
cmp eax, 0xc8d4675
ja 0x46ec4c
mov dword [ebp - 0x434], 1
jmp 0x46ec53
and dword [ebp - 0x434], 0
push 0
lea ecx, [ebp - 0x534]
call fcn.004014ea
mov ecx, dword [ebp - 0x434]
cmp ecx, dword [eax]
jge 0x46ec76
mov dword [ebp - 0x344], 1
jmp 0x46ec7d
and dword [ebp - 0x344], 0
push 0
lea ecx, [ebp - 0x670]
call fcn.004014ea
mov ecx, dword [ebp - 0x344]
add ecx, dword [eax]
je 0x46ecb2
push 0
lea ecx, [ebp - 0x534]
call fcn.004014ea
cmp dword [eax], 0
je 0x46ecb2
mov dword [ebp - 0x34c], 1
jmp 0x46ecb9
and dword [ebp - 0x34c], 0
mov dword [ebp - 0x4b4], 1
mov esi, dword [ebp - 0x4b4]
push 1
lea ecx, [ebp - 0x670]
call fcn.004014ea
mov ecx, dword [ebp - 0x34c]
imul ecx, dword [eax]
cmp esi, ecx
je 0x46ecf4
xor eax, eax
inc eax
je 0x46ecf4
mov dword [ebp - 0x43c], 1
jmp 0x46ecfb
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x534]
call fcn.004014ea
mov ecx, dword [ebp - 0x43c]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jle 0x46ed25
cmp dword [ebp - 0x20], 0
jne 0x46ed25
and dword [ebp - 0x354], 0
jmp 0x46ed2f
mov dword [ebp - 0x354], 1
mov eax, 0xc692
sub eax, dword [ebp - 0x354]
je 0x46ee3f
mov dword [ebp - 0x5a0], 0x4087b332
mov dword [ebp - 0x174], 0
jmp 0x46ed63
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x46ed7f
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x630], 0
jmp 0x46ed56
mov dword [ebp - 0x20], 0x12
jmp 0x46ed8f
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe2
je 0x46ee1f
mov dword [ebp - 0x714], 0x72c2
mov dword [ebp - 0x5a8], 0x11919b17
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x5a0], 1
jle 0x46edce
mov dword [ebp - 0x1b4], 1
jmp 0x46edd5
and dword [ebp - 0x1b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp + eax - 0x630], ecx
cmp dword [ebp - 0x1b4], 0
je 0x46ee06
mov eax, 0xcf2bba2d
test eax, eax
je 0x46ee06
mov dword [ebp - 0x50c], 1
jmp 0x46ee0d
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
dec eax
mov dword [ebp - 0x5a8], eax
jmp 0x46ed88
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x46ee3d
push 0xdc0
push 0x2044
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x46ee7b
mov dword [ebp - 0x20], 0
jmp 0x46ee4f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x46ee7b
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x46ee79
push 0x150c
push 0x127d
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x46ee48
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x35c], eax
lea ecx, [ebp - 0x670]
call fcn.004014ce
lea ecx, [ebp - 0x534]
call fcn.004014ce
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x638], eax
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x12c], 0
jmp 0x46eedb
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x46eef7
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x710], 0
jmp 0x46eece
mov dword [ebp - 0xd8], 0xa8eac8b1
mov dword [ebp - 0xd8], 0
jmp 0x46ef1a
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jg 0x46ef6e
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x46ef4d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x46ef6c
push 0x2222
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x46ef0d
mov dword [ebp - 0xd0], 0xfffffffd
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x718], 0xd2f38d92
mov dword [ebp - 0x790], 0xfffffffd
mov dword [ebp - 0x720], 0xe3f0e26a
mov dword [ebp - 0x30], 0
jmp 0x46efb0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x46efc6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x7d4], 0x20624039
jmp 0x46efa9
mov dword [ebp - 0x30], 0
jmp 0x46efd6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x46efec
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x84c], 0x2280643b
jmp 0x46efcf
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x46f004
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0xd0], 0
jmp 0x46f01d
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jg 0x46f306
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x684], 0xdf7e4414
mov dword [ebp - 0x680], 0xdf7e4414
mov dword [ebp - 0x67c], 0xdf7e4414
mov dword [ebp - 0x678], 0xdf7e4414
lea ecx, [ebp - 0x1bd]
call fcn.004014f9
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x684]
push eax
lea ecx, [ebp - 0x854]
call fcn.004014fc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x840]
call fcn.004014a8
mov dword [ebp - 0x64], 0
jmp 0x46f09e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x46f2f6
mov dword [ebp - 0x6c], 3
mov dword [ebp - 0x698], 0xc01e6e2b
mov dword [ebp - 0x694], 0xc01e6e2b
mov dword [ebp - 0x690], 0xc01e6e2b
mov dword [ebp - 0x68c], 0xc01e6e2b
lea ecx, [ebp - 0x1a9]
call fcn.004014f9
push eax
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x85c]
call fcn.004014fc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x658]
call fcn.004014a8
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x6c], 0
jmp 0x46f126
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x46f2c6
mov dword [ebp - 0x728], 0xfffffffc
mov dword [ebp - 0x798], 0xfffffff8
push 3
lea ecx, [ebp - 0x7e4]
call fcn.004013fc
mov dword [ebp - 0x198], 0xf4b3
mov dword [ebp - 0x154], 0
jmp 0x46f174
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x46f196
push dword [ebp - 0x154]
lea ecx, [ebp - 0x7e4]
call fcn.004014ea
mov dword [eax], 0x849968cb
jmp 0x46f167
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0x7d4]
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x198]
dec ecx
mov dword [ebp - 0x198], ecx
test eax, eax
jne 0x46f1c7
cmp dword [ebp - 0x64], 0
je 0x46f27b
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x738], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x84c], 0xa9e1a0
jl 0x46f1fa
mov dword [ebp - 0x444], 1
jmp 0x46f201
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x444], eax
jg 0x46f218
mov dword [ebp - 0x364], 1
jmp 0x46f21f
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x364], eax
jle 0x46f236
mov dword [ebp - 0x4bc], 1
jmp 0x46f23d
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0x7d4]
cmp eax, dword [ebp - 0x4bc]
jle 0x46f25f
xor eax, eax
je 0x46f25f
mov dword [ebp - 0x5b4], 1
jmp 0x46f266
and dword [ebp - 0x5b4], 0
mov eax, 0x108fa7ad
test eax, eax
je 0x46f27b
mov dword [ebp - 0x36c], 1
jmp 0x46f282
and dword [ebp - 0x36c], 0
cmp dword [ebp - 0x36c], 0xe758
jge 0x46f29a
mov dword [ebp - 0x44c], 1
jmp 0x46f2a1
and dword [ebp - 0x44c], 0
push 1
lea ecx, [ebp - 0x658]
call fcn.004014ea
mov ecx, dword [ebp - 0x44c]
mov dword [eax], ecx
lea ecx, [ebp - 0x7e4]
call fcn.004014ce
jmp 0x46f11f
push 1
lea ecx, [ebp - 0x658]
call fcn.004014ea
mov esi, eax
push 1
lea ecx, [ebp - 0x658]
call fcn.004014ea
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x658]
call fcn.004014ce
jmp 0x46f097
lea ecx, [ebp - 0x840]
call fcn.004014ce
jmp 0x46f010
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0xc], 0x56a9ef72
push 1
lea ecx, [ebp - 0x1cc]
call fcn.004013fc
mov dword [ebp - 0x37c], 0
mov dword [ebp - 0x134], 0
jmp 0x46f349
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x46f368
push dword [ebp - 0x134]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x46f33c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x7a0], eax
imul eax, dword [ebp - 0xc], 9
cmp eax, 1
jne 0x46f386
mov dword [ebp - 0x374], 1
jmp 0x46f38d
and dword [ebp - 0x374], 0
mov esi, dword [ebp - 0x374]
sub esi, dword [ebp - 0xc]
push 0
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
mov dword [eax], esi
mov dword [ebp - 0xc], 0
jmp 0x46f3b5
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x46f5d3
mov dword [ebp - 0x1b8], 0
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x46f3e6
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
cmp dword [eax], 0
jge 0x46f514
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
cmp dword [eax], 0x80ebbd48
jae 0x46f41f
mov dword [ebp - 0x4f4], 1
jmp 0x46f426
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x46f45a
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
cmp dword [eax], 0
je 0x46f45a
mov dword [ebp - 0x454], 1
jmp 0x46f461
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 4
jne 0x46f476
mov dword [ebp - 0x384], 1
jmp 0x46f47d
and dword [ebp - 0x384], 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
mov ecx, dword [ebp - 0x384]
cmp ecx, dword [eax]
jne 0x46f4a1
mov dword [ebp - 0x4c4], 1
jmp 0x46f4a8
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0x809b4af7
jb 0x46f4c0
mov dword [ebp - 0x38c], 1
jmp 0x46f4c7
and dword [ebp - 0x38c], 0
push 0
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
mov ecx, dword [ebp - 0x38c]
cmp ecx, dword [eax]
jle 0x46f4ea
mov dword [ebp - 0x45c], 1
jmp 0x46f4f1
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x1b8], eax
imul eax, dword [ebp - 0x1b8], 0xfffa
test eax, eax
jne 0x46f514
and dword [ebp - 0x394], 0
jmp 0x46f51e
mov dword [ebp - 0x394], 1
push 0
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x394]
jge 0x46f541
mov dword [ebp - 0x51c], 1
jmp 0x46f548
and dword [ebp - 0x51c], 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x51c]
jl 0x46f56c
mov dword [ebp - 0x39c], 1
jmp 0x46f573
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
add eax, 0x22572478
je 0x46f595
cmp dword [ebp - 0x1b8], 0
je 0x46f595
mov dword [ebp - 0x464], 1
jmp 0x46f59c
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 6
jl 0x46f5b1
mov dword [ebp - 0x3a4], 1
jmp 0x46f5b8
and dword [ebp - 0x3a4], 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1cc]
call fcn.004014ea
mov ecx, dword [ebp - 0x3a4]
mov dword [eax], ecx
jmp 0x46f3ae
lea ecx, [ebp - 0x1cc]
call fcn.004014ce
mov eax, dword [ebp - 0x5bc]
mov dword [eax], 0xe
jmp 0x470d14
mov dword [ebp - 0xb4], 0xfffffffb
mov dword [ebp - 0x3e4], 0xfffffff8
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x474], 0x84132d38
mov dword [ebp - 0x3dc], 3
mov dword [ebp - 0x2b0], 1
mov dword [ebp - 0x614], 0xfffffffe
mov dword [ebp - 0x164], 0
jmp 0x46f64e
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x46f66a
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0xe8], 0
jmp 0x46f641
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x46f67c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [ebp - 0xb4], 0
jne 0x46f691
mov dword [ebp - 0x3d4], 1
jmp 0x46f698
and dword [ebp - 0x3d4], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xe8]
cmp dword [ebp + eax - 0xe8], ecx
jne 0x46f6c0
mov dword [ebp - 0x4cc], 1
jmp 0x46f6c7
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
imul eax, dword [ebp - 0x4cc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xe8]
jne 0x46f6f6
mov dword [ebp - 0x3ac], 1
jmp 0x46f6fd
and dword [ebp - 0x3ac], 0
imul eax, dword [ebp - 0x3ac], 0xdd9
cmp eax, dword [ebp - 0xb4]
jle 0x46f71b
mov dword [ebp - 0x46c], 1
jmp 0x46f722
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x46c], eax
jge 0x46f73c
mov dword [ebp - 0x3b4], 1
jmp 0x46f743
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0x3b4], eax
jle 0x46f764
mov dword [ebp - 0x4fc], 1
jmp 0x46f76b
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x4fc], eax
jg 0x46f785
mov dword [ebp - 0x1f0], 1
jmp 0x46f78c
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x474], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x4fa72d50
sub ecx, dword [ebp + eax - 0xe8]
cmp ecx, dword [ebp - 0xb4]
jg 0x46f7be
mov dword [ebp - 0x3c4], 1
jmp 0x46f7c5
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x3c4]
jg 0x46f7f2
mov dword [ebp - 0x4d4], 1
jmp 0x46f7f9
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0x3c6f
jle 0x46f811
mov dword [ebp - 0x3cc], 1
jmp 0x46f818
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 1
jne 0x46f82d
mov dword [ebp - 0x47c], 1
jmp 0x46f834
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
add eax, 0x3747c914
imul eax, dword [ebp - 0xb4]
test eax, eax
jne 0x46f85c
cmp dword [ebp - 0x1a0], 0
jne 0x46f85c
and dword [ebp - 0x514], 0
jmp 0x46f866
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x3e4], eax
jne 0x46f898
mov dword [ebp - 0x29c], 1
jmp 0x46f89f
and dword [ebp - 0x29c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0x29c], eax
jle 0x46f8c6
mov eax, 0x535d
test eax, eax
jne 0x46f8c6
and dword [ebp - 0x298], 0
jmp 0x46f8d0
mov dword [ebp - 0x298], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp eax, dword [ebp - 0x298]
jge 0x46f8f1
mov dword [ebp - 0x2a8], 1
jmp 0x46f8f8
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x2a8], eax
jge 0x46f912
mov dword [ebp - 0x1bc], 1
jmp 0x46f919
and dword [ebp - 0x1bc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp + eax - 0xe8], ecx
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x15c], 0xb32a
mov dword [ebp - 0x1d4], 0xfffffff6
mov dword [ebp - 0x144], 0x779c
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0xa4], 0x7f39
mov dword [ebp - 0x7c], 0x36ae3d47
mov dword [ebp - 0x13c], 0
jmp 0x46f99c
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x46f9b8
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x5c4], 0x1b5f7a0d
jmp 0x46f98f
cmp dword [ebp - 0x24], 0
jne 0x46f9df
cmp dword [ebp - 0x24], 0
ja 0x46f9cd
mov eax, 0xbd4856cd
test eax, eax
jne 0x46f9df
cmp dword [ebp - 0x15c], 0
jne 0x46f9df
and dword [ebp - 0x2b8], 0
jmp 0x46f9e9
mov dword [ebp - 0x2b8], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2b8], eax
je 0x46fa00
mov dword [ebp - 0x2c0], 1
jmp 0x46fa07
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x24], eax
jl 0x46fa2a
mov dword [ebp - 0x2c8], 1
jmp 0x46fa31
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x2c8], eax
je 0x46fa4b
mov dword [ebp - 0x2d0], 1
jmp 0x46fa52
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
sub eax, 0xa
cmp eax, dword [ebp - 0x15c]
jle 0x46fa6f
mov dword [ebp - 0x2d8], 1
jmp 0x46fa76
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 0x4fd5
jne 0x46fa8e
mov dword [ebp - 0x2e0], 1
jmp 0x46fa95
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x2e0]
cmp eax, ecx
jne 0x46fac7
mov dword [ebp - 0x2e8], 1
jmp 0x46face
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x2e8]
cmp eax, 0x1f0ef2f3
jg 0x46faee
mov dword [ebp - 0x2f0], 1
jmp 0x46faf5
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x818], eax
mov eax, 0x9e14
cmp eax, 1
jne 0x46fb29
mov dword [ebp - 0x2f8], 1
jmp 0x46fb30
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2f8], eax
jg 0x46fb47
mov dword [ebp - 0x300], 1
jmp 0x46fb4e
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 8
je 0x46fb95
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x144]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5c4], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1d4], eax
jmp 0x46fc2e
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x46fbc3
push 0x1e6
push 0x6d8
push 0x90c
push 0x2576
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x24], 0
jmp 0x46fbd3
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3b
jge 0x46fc2e
mov dword [ebp - 0xa4], 0
jmp 0x46fbf2
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jne 0x46fc2c
mov dword [ebp - 0x308], 0xb3395cc9
mov dword [ebp - 0x7c], 0
jmp 0x46fc15
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x46fc2a
mov eax, dword [ebp - 0x308]
dec eax
mov dword [ebp - 0x308], eax
jmp 0x46fc0e
jmp 0x46fbe5
jmp 0x46fbcc
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x46fc46
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea eax, [ebp + 0x18]
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 0x640], 0xffff
push 1
lea ecx, [ebp - 0x6c8]
call fcn.004013fc
mov dword [ebp - 0xa8], 0xfffffff6
push 4
lea ecx, [ebp - 0x664]
call fcn.004013fc
mov dword [ebp - 0x40], 0
jmp 0x46fc8d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x46fca6
push dword [ebp - 0x40]
lea ecx, [ebp - 0x6c8]
call fcn.004014ea
and dword [eax], 0
jmp 0x46fc86
mov dword [ebp - 0x40], 0
jmp 0x46fcb6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x46fccf
push dword [ebp - 0x40]
lea ecx, [ebp - 0x664]
call fcn.004014ea
and dword [eax], 0
jmp 0x46fcaf
cmp dword [ebp - 0x640], 0
je 0x46fd70
push 1
lea ecx, [ebp - 0x804]
call fcn.004013fc
push 1
lea ecx, [ebp - 0x7f4]
call fcn.004013fc
mov dword [ebp - 0x48], 0
jmp 0x46fd06
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x46fd1f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x804]
call fcn.004014ea
and dword [eax], 0
jmp 0x46fcff
mov dword [ebp - 0x48], 0
jmp 0x46fd2f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x46fd48
push dword [ebp - 0x48]
lea ecx, [ebp - 0x7f4]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x46fd28
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0x7f4]
call fcn.004014ce
lea ecx, [ebp - 0x804]
call fcn.004014ce
jmp 0x46feab
mov dword [ebp - 0x188], 0x5d2d
mov dword [ebp - 0x5cc], 0x488a
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x46fdac
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0xa8], 0
jmp 0x46fdc5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x14
jl 0x46feab
mov dword [ebp - 0x170], 0xfffffff6
push 0
lea ecx, [ebp - 0x664]
call fcn.004014ea
mov dword [ebp - 0x170], 1
cmp dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x188]
test eax, eax
jne 0x46fe1d
cmp dword [ebp - 0x170], 0
jne 0x46fe1d
and dword [ebp - 0x318], 0
jmp 0x46fe27
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x188]
mov dword [ebp - 0x310], eax
push 0
lea ecx, [ebp - 0x6c8]
call fcn.004014ea
mov ecx, dword [ebp - 0x310]
mov dword [eax], ecx
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x318]
jle 0x46fe69
mov dword [ebp - 0x320], 1
jmp 0x46fe70
and dword [ebp - 0x320], 0
push 1
lea ecx, [ebp - 0x664]
call fcn.004014ea
mov ecx, dword [ebp - 0x320]
cmp ecx, dword [eax]
jg 0x46fe93
mov dword [ebp - 0x328], 1
jmp 0x46fe9a
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x5cc], eax
jmp 0x46fdb8
lea ecx, [ebp - 0x664]
call fcn.004014ce
lea ecx, [ebp - 0x6c8]
call fcn.004014ce
mov eax, dword [ebp + 8]
mov dword [ebp - 0x584], eax
mov dword [ebp - 0x124], 0x73eb905d
mov dword [ebp - 0x350], 9
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x624], 0xb7228d
mov dword [ebp - 0x748], 0xcc41
mov dword [ebp - 0x348], 0xc50133ec
mov dword [ebp - 0x18c], 0xe92
mov dword [ebp - 0x14c], 0
jmp 0x46ff29
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x46ff45
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x5b0], 0xeb606930
jmp 0x46ff1c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5b0]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x124], eax
jle 0x46ff7e
mov dword [ebp - 0x330], 1
jmp 0x46ff85
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5b0]
cmp dword [ebp - 0x330], eax
jl 0x46ffa6
mov dword [ebp - 0x338], 1
jmp 0x46ffad
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x124], eax
jge 0x470004
mov dword [ebp - 0x358], 1
jmp 0x47000b
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x358]
jge 0x470025
mov dword [ebp - 0x360], 1
jmp 0x47002c
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x624]
cmp dword [ebp - 0x360], eax
je 0x470046
mov dword [ebp - 0x368], 1
jmp 0x47004d
and dword [ebp - 0x368], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x368]
mov dword [ebp + eax - 0x5b0], ecx
mov eax, dword [ebp - 0x5d4]
movzx eax, byte [eax]
test eax, eax
je 0x470967
mov dword [ebp - 0x7b0], 0xfffffff8
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x47009c
push 0x1c78
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x4700b6
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x8c], 0xf43b7c7c
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0xb8], 4
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x84], 0xed1d25bb
mov dword [ebp - 0x3f0], 0xfffffffd
mov dword [ebp - 0xc0], 0xf3b0639e
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x4c], 6
push 2
lea ecx, [ebp - 0x620]
call fcn.004013fc
mov dword [ebp - 0x560], 0
mov dword [ebp - 0xec], 0
jmp 0x470146
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x470168
push dword [ebp - 0xec]
lea ecx, [ebp - 0x620]
call fcn.004014ea
mov dword [eax], 0x1f88
jmp 0x470139
mov dword [ebp - 0x8c], 0xfffffff7
jmp 0x470181
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffff5
je 0x4703fe
mov dword [ebp - 0xd4], 0xd6b65720
mov dword [ebp - 0x128], 0x3b1dab55
mov dword [ebp - 0x194], 0xffff
cmp dword [ebp - 0xd4], 0
jne 0x470263
cmp dword [ebp - 0x8c], 0
jne 0x470247
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x8c]
cmp eax, 0xfffffffe
jl 0x4701e0
mov dword [ebp - 0x370], 1
jmp 0x4701e7
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x370], eax
jg 0x470201
mov dword [ebp - 0x378], 1
jmp 0x470208
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x378]
jne 0x470227
cmp dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x84], eax
jne 0x470247
and dword [ebp - 0x380], 0
jmp 0x470251
mov dword [ebp - 0x380], 1
cmp dword [ebp - 0x380], 0
ja 0x470263
and dword [ebp - 0x388], 0
jmp 0x47026d
mov dword [ebp - 0x388], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x388], eax
jle 0x470284
mov dword [ebp - 0x390], 1
jmp 0x47028b
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x390], eax
jle 0x4702a5
mov dword [ebp - 0x398], 1
jmp 0x4702ac
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x398], eax
jne 0x4702cf
mov eax, 0x18eb
test eax, eax
je 0x4702cf
mov dword [ebp - 0x3a0], 1
jmp 0x4702d6
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
sub eax, dword [ebp - 0xb8]
jne 0x4702f6
cmp dword [ebp - 0x128], 0
jne 0x4702f6
and dword [ebp - 0x3a8], 0
jmp 0x470300
mov dword [ebp - 0x3a8], 1
cmp dword [ebp - 0x3a8], 0x40b319b
jge 0x470318
mov dword [ebp - 0x3b0], 1
jmp 0x47031f
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0x8ba79672
jb 0x470337
mov dword [ebp - 0x3b8], 1
jmp 0x47033e
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0xd4]
inc eax
inc eax
sub eax, dword [ebp - 0x44]
cmp eax, 1
jge 0x470381
cmp dword [ebp - 0x44], 0
jne 0x470381
and dword [ebp - 0x3c0], 0
jmp 0x47038b
mov dword [ebp - 0x3c0], 1
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3c0], eax
jl 0x4703a5
mov dword [ebp - 0x3c8], 1
jmp 0x4703ac
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0xb6f2
jne 0x4703c8
push 6
pop eax
test eax, eax
jne 0x4703c8
and dword [ebp - 0x3d0], 0
jmp 0x4703d2
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3d0], eax
jne 0x4703e9
mov dword [ebp - 0x3d8], 1
jmp 0x4703f0
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x44], eax
jmp 0x470174
cmp dword [ebp - 0xc0], 0
je 0x47062e
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0xb0], eax
je 0x47042e
cmp dword [ebp - 0xb0], 0
je 0x470443
cmp dword [ebp - 0x84], 0
je 0x470443
mov dword [ebp - 0x3e0], 1
jmp 0x47044a
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
sub eax, 8
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x470481
cmp dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xb0], eax
jge 0x47049b
mov dword [ebp - 0x3f8], 1
jmp 0x4704a2
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
add eax, 0x68191e7b
cmp eax, dword [ebp - 0x4c]
jge 0x4704c7
cmp dword [ebp - 0xb0], 0
je 0x4704c7
mov dword [ebp - 0x5dc], 1
jmp 0x4704ce
and dword [ebp - 0x5dc], 0
push 0
lea ecx, [ebp - 0x620]
call fcn.004014ea
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x4c], 1
jne 0x4704f9
mov dword [ebp - 0x400], 1
jmp 0x470500
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x4c]
cmp eax, 0xce086565
ja 0x470523
mov dword [ebp - 0x408], 1
jmp 0x47052a
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0xc26b
jne 0x470542
mov dword [ebp - 0x410], 1
jmp 0x470549
and dword [ebp - 0x410], 0
push 1
lea ecx, [ebp - 0x620]
call fcn.004014ea
mov ecx, dword [ebp - 0x410]
sub ecx, dword [eax]
jne 0x47056c
mov dword [ebp - 0x418], 1
jmp 0x470573
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x418], eax
jge 0x47058d
mov dword [ebp - 0x420], 1
jmp 0x470594
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x84], eax
jl 0x4705ba
mov dword [ebp - 0x428], 1
jmp 0x4705c1
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x560]
jle 0x4705de
mov dword [ebp - 0x430], 1
jmp 0x4705e5
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x47060c
mov eax, 0x6f59
test eax, eax
jne 0x47060c
and dword [ebp - 0x438], 0
jmp 0x470616
mov dword [ebp - 0x438], 1
cmp dword [ebp - 0x438], 0xfe45
jg 0x47062e
mov dword [ebp - 0x440], 1
jmp 0x470635
and dword [ebp - 0x440], 0
mov dword [ebp - 0x44], 0x242e
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x440]
jle 0x470676
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x470671
push 0x21cd
push 0xcf1
push 0
push 0
push 0x1897
push 0x208d
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0x47093f
mov dword [ebp - 0xf4], 7
mov dword [ebp - 0x19c], 0xfffffff6
mov dword [ebp - 0xf0], 0x3aa5b3e5
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x130], 0
jmp 0x4706b7
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x4706d3
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x6bc], 5
jmp 0x4706aa
cmp dword [ebp - 0xc0], 0
je 0x470701
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0xf4], 1
jbe 0x4706fa
mov dword [ebp - 0x1f4], 1
jmp 0x470701
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xf4], eax
je 0x47071b
mov dword [ebp - 0x1f8], 1
jmp 0x470722
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1f8], eax
jge 0x470739
mov dword [ebp - 0x200], 1
jmp 0x470740
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x470764
cmp dword [ebp - 0x4c], 0
jne 0x470764
and dword [ebp - 0x208], 0
jmp 0x47076e
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x208]
cmp eax, 0xfff9
ja 0x47078d
mov dword [ebp - 0x210], 1
jmp 0x470794
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x218], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x218]
mov dword [ebp + eax - 0x6bc], ecx
mov eax, dword [ebp - 0x218]
add eax, 0x846
cmp eax, dword [ebp - 0xf0]
jle 0x4707de
mov dword [ebp - 0x220], 1
jmp 0x4707e5
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x220], eax
jl 0x4707ff
mov dword [ebp - 0x228], 1
jmp 0x470806
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xc7f14991
jbe 0x47081e
mov dword [ebp - 0x230], 1
jmp 0x470825
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], 0xa875637
jl 0x47083d
mov dword [ebp - 0x238], 1
jmp 0x470844
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x470875
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6bc], 0
je 0x470875
mov dword [ebp - 0x564], 1
jmp 0x47087c
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x6d4], eax
or eax, 0xffffffff
je 0x4708c3
mov dword [ebp - 0x240], 2
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x4708b4
push 0
push 0
push 0x1d13
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
jmp 0x47093f
mov dword [ebp - 0x6dc], 1
mov dword [ebp - 0x56c], 0xfffffff9
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x6e4], eax
push 2
pop eax
test eax, eax
je 0x4708ff
cmp dword [ebp - 0x19c], 0
je 0x4708ff
mov dword [ebp - 0x248], 1
jmp 0x470906
and dword [ebp - 0x248], 0
push 0
lea ecx, [ebp - 0x620]
call fcn.004014ea
mov eax, dword [eax]
imul eax, dword [ebp - 0x248]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x56c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6bc], 0xfffffffd
lea ecx, [ebp - 0x620]
call fcn.004014ce
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x57c]
mov dword [eax], 0x23
jmp 0x470d14
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0xfc], 0
jmp 0x470996
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x4709b2
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x6ec], 0
jmp 0x470989
mov dword [ebp - 0xe0], 0xa8eac8b1
mov dword [ebp - 0xe0], 0
jmp 0x4709d5
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jg 0x470a23
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x470a02
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x470a21
push 0x2222
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x4709c8
push 1
lea ecx, [ebp - 0x180]
call fcn.004013fc
mov dword [ebp - 0x104], 0
jmp 0x470a49
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x470a6b
push dword [ebp - 0x104]
lea ecx, [ebp - 0x180]
call fcn.004014ea
mov dword [eax], 0x5b57fd54
jmp 0x470a3c
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
and dword [eax], 0
jmp 0x470aa1
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
cmp dword [eax], 0x17
jge 0x470c52
mov dword [ebp - 0x114], 0x9cc25fa
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x10c], 0
jmp 0x470ae4
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x470b00
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x834], 0x4adf2985
jmp 0x470ad7
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
mov eax, dword [eax]
sub eax, dword [ebp - 0x114]
jne 0x470b72
cmp dword [ebp - 0x114], 0
jne 0x470b48
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
cmp dword [eax], 0
jne 0x470b48
and dword [ebp - 0x260], 0
jmp 0x470b52
mov dword [ebp - 0x260], 1
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
mov ecx, dword [ebp - 0x260]
cmp ecx, dword [eax]
jne 0x470b72
and dword [ebp - 0x268], 0
jmp 0x470b7c
mov dword [ebp - 0x268], 1
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
mov ecx, dword [ebp - 0x268]
cmp ecx, dword [eax]
jge 0x470b9f
mov dword [ebp - 0x270], 1
jmp 0x470ba6
and dword [ebp - 0x270], 0
mov esi, dword [ebp - 0x270]
sub esi, 8
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
cmp esi, dword [eax]
jl 0x470bcc
mov dword [ebp - 0x278], 1
jmp 0x470bd3
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x280], eax
jl 0x470c00
push 7
pop eax
test eax, eax
je 0x470c00
mov dword [ebp - 0x288], 1
jmp 0x470c07
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x288]
jne 0x470c30
push 0
lea ecx, [ebp - 0x180]
call fcn.004014ea
cmp dword [eax], 0
jne 0x470c30
and dword [ebp - 0x290], 0
jmp 0x470c3a
mov dword [ebp - 0x290], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x290]
mov dword [ebp + eax - 0x834], ecx
jmp 0x470a7d
lea ecx, [ebp - 0x180]
call fcn.004014ce
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x1a4], eax
push 2
lea ecx, [ebp - 0x6b0]
call fcn.004013fc
mov dword [ebp - 0x594], 0x925b0e44
mov dword [ebp - 0x11c], 0
jmp 0x470c99
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x470cbb
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x6b0]
call fcn.004014ea
mov dword [eax], 1
jmp 0x470c8c
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x470cd2
push 0x1336
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
lea ecx, [ebp - 0x6b0]
call fcn.004014ea
mov eax, dword [eax]
mov dword [ebp - 0x594], eax
lea ecx, [ebp - 0x6b0]
call fcn.004014ce
mov eax, dword [ebp - 0x1a4]
cmp dword [eax], 0
jge 0x470d14
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
add eax, 0x100
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx], eax
jmp 0x470cf2
pop esi
mov esp, ebp
pop ebp
ret