Function at 0x46d253
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file size
Get file system object information
Get graphical window text
Get session user name
Modify service
Query or enumerate registry key
Read .ini file
Resume thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x48f0
call fcn.004abe90
push esi
mov dword [ebp - 0xf0], 5
push 1
lea ecx, [ebp - 0x2864]
call fcn.00432a80
push 3
lea ecx, [ebp - 0x2b14]
call fcn.00432a80
mov dword [ebp - 0x738], 0x4322e7c6
mov dword [ebp - 0x928], 0x7a2d47e1
mov dword [ebp - 0x27bc], 0x6b01fe44
mov dword [ebp - 0x200], 0
jmp 0x46d2bc
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x46d2de
push dword [ebp - 0x200]
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
mov dword [eax], 0x6ec6e54e
jmp 0x46d2af
mov dword [ebp - 0x200], 0
jmp 0x46d2f7
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x46d319
push dword [ebp - 0x200]
lea ecx, [ebp - 0x2b14]
call fcn.00432b6e
mov dword [eax], 0x955a63a7
jmp 0x46d2ea
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1e68], eax
push 0
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
mov ecx, dword [ebp - 0x1e68]
mov dword [eax], ecx
cmp dword [ebp - 0x1e68], 0xb807cfaf
jne 0x46d38d
push 0
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
mov esi, eax
push 0
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x46d374
mov dword [ebp - 0x26c8], 1
jmp 0x46d37b
and dword [ebp - 0x26c8], 0
cmp dword [ebp - 0x26c8], 7
je 0x46d38d
and dword [ebp - 0x26d0], 0
jmp 0x46d397
mov dword [ebp - 0x26d0], 1
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x26d0], eax
jl 0x46d3b1
mov dword [ebp - 0x2b3c], 1
jmp 0x46d3b8
and dword [ebp - 0x2b3c], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x4508], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x3e7c], eax
imul eax, dword [ebp - 0xf0], 0xf381
cmp eax, dword [ebp - 0xf0]
jg 0x46d3ee
mov dword [ebp - 0x26d8], 1
jmp 0x46d3f5
and dword [ebp - 0x26d8], 0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x26d8]
sub ecx, dword [ebp - 0xf0]
add eax, ecx
cmp eax, dword [ebp - 0xf0]
jne 0x46d41d
mov dword [ebp - 0xba0], 1
jmp 0x46d424
and dword [ebp - 0xba0], 0
push 1
lea ecx, [ebp - 0x2b14]
call fcn.00432b6e
mov ecx, dword [ebp - 0xba0]
mov dword [eax], ecx
cmp dword [ebp - 0xba0], 0
je 0x46d68e
mov dword [ebp - 0x26e0], 0xcb7be74f
mov dword [ebp - 0x2b84], 1
mov dword [ebp - 0xd38], 0xa5c12438
mov dword [ebp - 0x4474], 5
mov dword [ebp - 0x2b7c], 0xffffffff
mov byte [ebp - 0x4f7], 0
movzx eax, byte [ebp - 0x4f7]
test eax, eax
je 0x46d4aa
push 0
push 0x7f8
push 0xf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov eax, dword [ebp - 0x26e0]
mov dword [ebp - 0x3e84], eax
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x26e0]
mov dword [ebp - 0x26e8], eax
push 0
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
mov ecx, dword [ebp - 0x26e8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x26e8]
mov dword [ebp - 0x2b74], eax
mov eax, dword [ebp - 0x738]
dec eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x2b74], 0xd869e772
ja 0x46d50e
mov dword [ebp - 0x275c], 1
jmp 0x46d515
and dword [ebp - 0x275c], 0
mov eax, 0xbbfe
test eax, eax
je 0x46d53c
push 1
lea ecx, [ebp - 0x2b14]
call fcn.00432b6e
cmp dword [eax], 0
je 0x46d53c
mov dword [ebp - 0x2764], 1
jmp 0x46d543
and dword [ebp - 0x2764], 0
mov eax, dword [ebp - 0x275c]
cmp eax, dword [ebp - 0x2764]
jl 0x46d55d
mov dword [ebp - 0x276c], 1
jmp 0x46d564
and dword [ebp - 0x276c], 0
mov eax, dword [ebp - 0x276c]
sub eax, 0x175d7278
jne 0x46d583
cmp dword [ebp - 0x738], 0
jne 0x46d583
and dword [ebp - 0x2774], 0
jmp 0x46d58d
mov dword [ebp - 0x2774], 1
cmp dword [ebp - 0x2774], 0x5f2f
je 0x46d5a5
mov dword [ebp - 0x277c], 1
jmp 0x46d5ac
and dword [ebp - 0x277c], 0
cmp dword [ebp - 0x277c], 1
jbe 0x46d5c1
mov dword [ebp - 0x2784], 1
jmp 0x46d5c8
and dword [ebp - 0x2784], 0
mov eax, dword [ebp - 0xd38]
cmp dword [ebp - 0x2784], eax
jl 0x46d5f1
push 1
lea ecx, [ebp - 0x2b14]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46d5f1
and dword [ebp - 0x278c], 0
jmp 0x46d5fb
mov dword [ebp - 0x278c], 1
imul eax, dword [ebp - 0x278c], 0x2614
imul eax, dword [ebp - 0x928]
cmp eax, 0x51f8
jle 0x46d61f
mov dword [ebp - 0x2794], 1
jmp 0x46d626
and dword [ebp - 0x2794], 0
mov eax, dword [ebp - 0x2b7c]
cmp dword [ebp - 0x2794], eax
jne 0x46d640
mov dword [ebp - 0x279c], 1
jmp 0x46d647
and dword [ebp - 0x279c], 0
imul eax, dword [ebp - 0x279c], 0xd890
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0xd38]
sub eax, 0x6d8b34f9
cmp eax, dword [ebp - 0xf0]
jle 0x46d676
mov dword [ebp - 0x27a4], 1
jmp 0x46d67d
and dword [ebp - 0x27a4], 0
mov eax, dword [ebp - 0x27a4]
mov dword [ebp - 0x2b84], eax
jmp 0x46d956
push 4
lea ecx, [ebp - 0x2854]
call fcn.00432a80
mov dword [ebp - 0xe4c], 0
or dword [ebp - 0x36cc], 0xffffffff
or dword [ebp - 0x36c8], 0xffffffff
or dword [ebp - 0x36c4], 0xffffffff
or dword [ebp - 0x36c0], 0xffffffff
lea ecx, [ebp - 0xe15]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x36bc]
push eax
lea eax, [ebp - 0x36cc]
push eax
lea ecx, [ebp - 0x47bc]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4054]
call fcn.00432b2c
mov dword [ebp - 0x194], 0
jmp 0x46d70f
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x46d731
push dword [ebp - 0x194]
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
mov dword [eax], 3
jmp 0x46d702
mov dword [ebp - 0x194], 0
jmp 0x46d74a
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x46d766
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x27cc], 0x3f861273
jmp 0x46d73d
push 2
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
or dword [eax], 0xffffffff
mov dword [ebp - 0xe4c], 0xffffffff
push 2
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46d7ad
push 2
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46d7ad
and dword [ebp - 0xba8], 0
jmp 0x46d7b7
mov dword [ebp - 0xba8], 1
push 2
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46d83c
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x4258], eax
push 2
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
push 1
lea ecx, [ebp - 0x4054]
call fcn.00432b6e
mov dword [eax], 0x67b2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x27cc], 0x67b2
imul esi, dword [ebp - 0x27bc], 0x67b2
push 0
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
cmp esi, dword [eax]
jg 0x46d83c
push 0
lea ecx, [ebp - 0x2864]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46d83c
and dword [ebp - 0x27ac], 0
jmp 0x46d846
mov dword [ebp - 0x27ac], 1
cmp dword [ebp - 0x27ac], 0x2f2f
jg 0x46d85e
mov dword [ebp - 0x27b4], 1
jmp 0x46d865
and dword [ebp - 0x27b4], 0
push 2
lea ecx, [ebp - 0x2854]
call fcn.00432b6e
mov ecx, dword [ebp - 0x27b4]
imul ecx, dword [eax]
test ecx, ecx
je 0x46d888
cmp dword [ebp - 0x27bc], 0
jne 0x46d89a
cmp dword [ebp - 0x928], 0
jne 0x46d89a
and dword [ebp - 0x27c4], 0
jmp 0x46d8a4
mov dword [ebp - 0x27c4], 1
cmp dword [ebp - 0x27c4], 0
jg 0x46d8b9
mov dword [ebp - 0x2b8c], 1
jmp 0x46d8c0
and dword [ebp - 0x2b8c], 0
push 2
lea ecx, [ebp - 0x2b14]
call fcn.00432b6e
mov ecx, dword [ebp - 0xba8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0xe4c]
mov dword [ebp - 0x3e8c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf0]
cmp dword [ebp + eax - 0x27cc], ecx
jl 0x46d90e
mov dword [ebp - 0x27d4], 1
jmp 0x46d915
and dword [ebp - 0x27d4], 0
cmp dword [ebp - 0x27d4], 0xc1b334fe
jb 0x46d92d
mov dword [ebp - 0x27dc], 1
jmp 0x46d934
and dword [ebp - 0x27dc], 0
mov eax, dword [ebp - 0x27dc]
mov dword [ebp - 0x928], eax
lea ecx, [ebp - 0x4054]
call fcn.00432b52
lea ecx, [ebp - 0x2854]
call fcn.00432b52
lea ecx, [ebp - 0x2b14]
call fcn.00432b52
lea ecx, [ebp - 0x2864]
call fcn.00432b52
mov dword [ebp - 0xa20], 0xb26bdde0
mov dword [ebp - 0x740], 0
jmp 0x46d98f
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 3
jge 0x46d9ab
mov eax, dword [ebp - 0x740]
mov dword [ebp + eax*4 - 0x4064], 0xb6318d58
jmp 0x46d982
mov dword [ebp - 0xa20], 0xffffffe6
jmp 0x46d9c4
mov eax, dword [ebp - 0xa20]
inc eax
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0xa20], 3
jne 0x46da44
mov dword [ebp - 0x5f8], 1
mov byte [ebp - 0x353], 0
movzx eax, byte [ebp - 0x353]
test eax, eax
je 0x46da02
push 0x6c1
push 0
push 0x1b35
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [ebp - 0x5f8], 2
jmp 0x46da1b
mov eax, dword [ebp - 0x5f8]
dec eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0
jl 0x46da3f
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5f8]
mov eax, dword [ebp + eax - 0x4064]
mov dword [ebp + ecx*4 - 0x4064], eax
jmp 0x46da0e
jmp 0x46d9b7
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x46da68
push 0x20d0
push 0x226c
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [ebp - 0xf8], 5
mov dword [ebp - 0x118], 5
push 1
lea ecx, [ebp - 0x2884]
call fcn.00432a80
push 3
lea ecx, [ebp - 0x2ac0]
call fcn.00432a80
mov dword [ebp - 0x748], 0x4322e7c6
mov dword [ebp - 0x930], 0x7a2d47e1
mov dword [ebp - 0x22f8], 0x6b01fe44
mov dword [ebp - 0x22c], 0
jmp 0x46dacd
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x46daef
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
mov dword [eax], 0x6ec6e54e
jmp 0x46dac0
mov dword [ebp - 0x22c], 0
jmp 0x46db08
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x46db2a
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x2ac0]
call fcn.00432b6e
mov dword [eax], 0x955a63a7
jmp 0x46dafb
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x27e4], eax
push 0
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
mov ecx, dword [ebp - 0x27e4]
mov dword [eax], ecx
cmp dword [ebp - 0x27e4], 0xb807cfaf
jne 0x46db9e
push 0
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
mov esi, eax
push 0
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x46db85
mov dword [ebp - 0x27ec], 1
jmp 0x46db8c
and dword [ebp - 0x27ec], 0
cmp dword [ebp - 0x27ec], 7
je 0x46db9e
and dword [ebp - 0x27f4], 0
jmp 0x46dba8
mov dword [ebp - 0x27f4], 1
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x27f4], eax
jl 0x46dbc2
mov dword [ebp - 0x2b94], 1
jmp 0x46dbc9
and dword [ebp - 0x2b94], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x4568], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3e94], eax
imul eax, dword [ebp - 0x118], 0xf381
cmp eax, dword [ebp - 0x118]
jg 0x46dbff
mov dword [ebp - 0x27fc], 1
jmp 0x46dc06
and dword [ebp - 0x27fc], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x27fc]
sub ecx, dword [ebp - 0x118]
add eax, ecx
cmp eax, dword [ebp - 0x118]
jne 0x46dc2e
mov dword [ebp - 0xbb0], 1
jmp 0x46dc35
and dword [ebp - 0xbb0], 0
push 1
lea ecx, [ebp - 0x2ac0]
call fcn.00432b6e
mov ecx, dword [ebp - 0xbb0]
mov dword [eax], ecx
cmp dword [ebp - 0xbb0], 0
je 0x46de9f
mov dword [ebp - 0x2804], 0xcb7be74f
mov dword [ebp - 0x2bac], 1
mov dword [ebp - 0xd40], 0xa5c12438
mov dword [ebp - 0x4268], 5
mov dword [ebp - 0x2ba4], 0xffffffff
mov byte [ebp - 0x357], 0
movzx eax, byte [ebp - 0x357]
test eax, eax
je 0x46dcbb
push 0
push 0x7f8
push 0xf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov eax, dword [ebp - 0x2804]
mov dword [ebp - 0x3e9c], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x2804]
mov dword [ebp - 0x280c], eax
push 0
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
mov ecx, dword [ebp - 0x280c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x280c]
mov dword [ebp - 0x2b9c], eax
mov eax, dword [ebp - 0x748]
dec eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x2b9c], 0xd869e772
ja 0x46dd1f
mov dword [ebp - 0x2814], 1
jmp 0x46dd26
and dword [ebp - 0x2814], 0
mov eax, 0xbbfe
test eax, eax
je 0x46dd4d
push 1
lea ecx, [ebp - 0x2ac0]
call fcn.00432b6e
cmp dword [eax], 0
je 0x46dd4d
mov dword [ebp - 0x281c], 1
jmp 0x46dd54
and dword [ebp - 0x281c], 0
mov eax, dword [ebp - 0x2814]
cmp eax, dword [ebp - 0x281c]
jl 0x46dd6e
mov dword [ebp - 0x2824], 1
jmp 0x46dd75
and dword [ebp - 0x2824], 0
mov eax, dword [ebp - 0x2824]
sub eax, 0x175d7278
jne 0x46dd94
cmp dword [ebp - 0x748], 0
jne 0x46dd94
and dword [ebp - 0x282c], 0
jmp 0x46dd9e
mov dword [ebp - 0x282c], 1
cmp dword [ebp - 0x282c], 0x5f2f
je 0x46ddb6
mov dword [ebp - 0x2834], 1
jmp 0x46ddbd
and dword [ebp - 0x2834], 0
cmp dword [ebp - 0x2834], 1
jbe 0x46ddd2
mov dword [ebp - 0x283c], 1
jmp 0x46ddd9
and dword [ebp - 0x283c], 0
mov eax, dword [ebp - 0xd40]
cmp dword [ebp - 0x283c], eax
jl 0x46de02
push 1
lea ecx, [ebp - 0x2ac0]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46de02
and dword [ebp - 0x2844], 0
jmp 0x46de0c
mov dword [ebp - 0x2844], 1
imul eax, dword [ebp - 0x2844], 0x2614
imul eax, dword [ebp - 0x930]
cmp eax, 0x51f8
jle 0x46de30
mov dword [ebp - 0x295c], 1
jmp 0x46de37
and dword [ebp - 0x295c], 0
mov eax, dword [ebp - 0x2ba4]
cmp dword [ebp - 0x295c], eax
jne 0x46de51
mov dword [ebp - 0x2964], 1
jmp 0x46de58
and dword [ebp - 0x2964], 0
imul eax, dword [ebp - 0x2964], 0xd890
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0xd40]
sub eax, 0x6d8b34f9
cmp eax, dword [ebp - 0x118]
jle 0x46de87
mov dword [ebp - 0x296c], 1
jmp 0x46de8e
and dword [ebp - 0x296c], 0
mov eax, dword [ebp - 0x296c]
mov dword [ebp - 0x2bac], eax
jmp 0x46e167
push 4
lea ecx, [ebp - 0x2874]
call fcn.00432a80
mov dword [ebp - 0xdf4], 0
or dword [ebp - 0x35b4], 0xffffffff
or dword [ebp - 0x35b0], 0xffffffff
or dword [ebp - 0x35ac], 0xffffffff
or dword [ebp - 0x35a8], 0xffffffff
lea ecx, [ebp - 0xe1d]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x35a4]
push eax
lea eax, [ebp - 0x35b4]
push eax
lea ecx, [ebp - 0x46e4]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4074]
call fcn.00432b2c
mov dword [ebp - 0x19c], 0
jmp 0x46df20
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x46df42
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
mov dword [eax], 3
jmp 0x46df13
mov dword [ebp - 0x19c], 0
jmp 0x46df5b
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x46df77
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2300], 0x3f861273
jmp 0x46df4e
push 2
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
or dword [eax], 0xffffffff
mov dword [ebp - 0xdf4], 0xffffffff
push 2
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46dfbe
push 2
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46dfbe
and dword [ebp - 0xbb8], 0
jmp 0x46dfc8
mov dword [ebp - 0xbb8], 1
push 2
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46e04d
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x4488], eax
push 2
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
push 1
lea ecx, [ebp - 0x4074]
call fcn.00432b6e
mov dword [eax], 0x67b2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2300], 0x67b2
imul esi, dword [ebp - 0x22f8], 0x67b2
push 0
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
cmp esi, dword [eax]
jg 0x46e04d
push 0
lea ecx, [ebp - 0x2884]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x46e04d
and dword [ebp - 0x27a8], 0
jmp 0x46e057
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0x2f2f
jg 0x46e06f
mov dword [ebp - 0xf80], 1
jmp 0x46e076
and dword [ebp - 0xf80], 0
push 2
lea ecx, [ebp - 0x2874]
call fcn.00432b6e
mov ecx, dword [ebp - 0xf80]
imul ecx, dword [eax]
test ecx, ecx
je 0x46e099
cmp dword [ebp - 0x22f8], 0
jne 0x46e0ab
cmp dword [ebp - 0x930], 0
jne 0x46e0ab
and dword [ebp - 0xf88], 0
jmp 0x46e0b5
mov dword [ebp - 0xf88], 1
cmp dword [ebp - 0xf88], 0
jg 0x46e0ca
mov dword [ebp - 0x2bb4], 1
jmp 0x46e0d1
and dword [ebp - 0x2bb4], 0
push 2
lea ecx, [ebp - 0x2ac0]
call fcn.00432b6e
mov ecx, dword [ebp - 0xbb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x3ea4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x118]
cmp dword [ebp + eax - 0x2300], ecx
jl 0x46e11f
mov dword [ebp - 0xf90], 1
jmp 0x46e126
and dword [ebp - 0xf90], 0
cmp dword [ebp - 0xf90], 0xc1b334fe
jb 0x46e13e
mov dword [ebp - 0x2308], 1
jmp 0x46e145
and dword [ebp - 0x2308], 0
mov eax, dword [ebp - 0x2308]
mov dword [ebp - 0x930], eax
lea ecx, [ebp - 0x4074]
call fcn.00432b52
lea ecx, [ebp - 0x2874]
call fcn.00432b52
lea ecx, [ebp - 0x2ac0]
call fcn.00432b52
lea ecx, [ebp - 0x2884]
call fcn.00432b52
push 1
lea ecx, [ebp - 0x28c4]
call fcn.00432a80
push 2
lea ecx, [ebp - 0x4084]
call fcn.00432a80
mov dword [ebp - 0xa98], 0x4ffb871c
mov dword [ebp - 0x750], 0
jmp 0x46e1ba
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 2
jge 0x46e1dc
push dword [ebp - 0x750]
lea ecx, [ebp - 0x4084]
call fcn.00432b6e
mov dword [eax], 0xa684
jmp 0x46e1ad
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x46e1f8
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xa98], 0
jmp 0x46e211
mov eax, dword [ebp - 0xa98]
inc eax
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0xa98], 1
jg 0x46e277
mov byte [ebp - 0x35b], 0
movzx eax, byte [ebp - 0x35b]
test eax, eax
je 0x46e275
push 0
push 0x1f3e
push 0x232e
push 0x1b38
push 0x2330
push 0x797
push 0x9c8
push 0x253b
push 0x1ba6
push 0x262d
push 0x7a6
push 0x1fce
push 0x181a
push 0xf8b
call dword [sym.imp.GDI32.dll_CreateFontA]
jmp 0x46e204
lea ecx, [ebp - 0x4084]
call fcn.00432b52
push 3
lea ecx, [ebp - 0x2b08]
call fcn.00432a80
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x5ec], 0x94ff5452
mov dword [ebp - 0xfa8], 0x3799040c
mov dword [ebp - 0xbc0], 0
push 4
lea ecx, [ebp - 0x38c4]
call fcn.00432a80
mov dword [ebp - 0x2bc4], 0xe80a7c6d
mov dword [ebp - 0x758], 0
jmp 0x46e2e7
mov eax, dword [ebp - 0x758]
inc eax
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 4
jge 0x46e306
push dword [ebp - 0x758]
lea ecx, [ebp - 0x38c4]
call fcn.00432b6e
and dword [eax], 0
jmp 0x46e2da
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff9
jb 0x46e3f6
cmp dword [ebp - 0xc4], 0x85e0710
jl 0x46e337
mov dword [ebp - 0xf98], 1
jmp 0x46e33e
and dword [ebp - 0xf98], 0
cmp dword [ebp - 0xf98], 0xf4f23013
jb 0x46e356
mov dword [ebp - 0x2bbc], 1
jmp 0x46e35d
and dword [ebp - 0x2bbc], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x4278], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
add ecx, 0xe071
imul eax, ecx
add eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc4]
jne 0x46e398
mov dword [ebp - 0x2310], 1
jmp 0x46e39f
and dword [ebp - 0x2310], 0
mov eax, dword [ebp - 0x2310]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0xc4], eax
jle 0x46e3ce
cmp dword [ebp - 0x5ec], 0
je 0x46e3ce
mov dword [ebp - 0xfa0], 1
jmp 0x46e3d5
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0xfa0], eax
jne 0x46e3ef
mov dword [ebp - 0x2318], 1
jmp 0x46e3f6
and dword [ebp - 0x2318], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0xbc0]
cmp dword [ebp - 0xfa8], eax
jge 0x46e428
mov dword [ebp - 0x2320], 1
jmp 0x46e42f
and dword [ebp - 0x2320], 0
mov eax, dword [ebp - 0xbc0]
cmp dword [ebp - 0x2320], eax
jg 0x46e449
mov dword [ebp - 0xfb0], 1
jmp 0x46e450
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xfb0]
cmp eax, 0xebf3
jge 0x46e470
mov dword [ebp - 0xd48], 1
jmp 0x46e477
and dword [ebp - 0xd48], 0
push 3
lea ecx, [ebp - 0x38c4]
call fcn.00432b6e
mov ecx, dword [ebp - 0xd48]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x2bc4], eax
mov byte [ebp - 0x35d], 0
movzx eax, byte [ebp - 0x35d]
test eax, eax
je 0x46e4c9
push 0
push 0
push 0x21de
push 0
push 0x155b
push 0
push 0xa42
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea ecx, [ebp - 0x38c4]
call fcn.00432b52
mov dword [ebp - 0x798], 0x4322e7c6
mov dword [ebp - 0x760], 6
mov dword [ebp - 0x3eac], 0xffffffff
mov dword [ebp - 0x938], 0
jmp 0x46e50b
mov eax, dword [ebp - 0x938]
inc eax
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 3
jge 0x46e527
mov eax, dword [ebp - 0x938]
mov dword [ebp + eax*4 - 0x4658], 0x85f70ad6
jmp 0x46e4fe
mov dword [ebp - 0x760], 2
jmp 0x46e540
mov eax, dword [ebp - 0x760]
dec eax
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 0
jl 0x46e688
mov dword [ebp - 0x2cc], 0xfffffffd
push 1
lea ecx, [ebp - 0x4094]
call fcn.00432a80
mov dword [ebp - 0xa28], 0
jmp 0x46e57d
mov eax, dword [ebp - 0xa28]
inc eax
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0xa28], 1
jge 0x46e59f
push dword [ebp - 0xa28]
lea ecx, [ebp - 0x4094]
call fcn.00432b6e
mov dword [eax], 0xca9f8d1
jmp 0x46e570
mov dword [ebp - 0x2cc], 0
jmp 0x46e5b8
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jg 0x46e625
mov dword [ebp - 0x5fc], 0x11d962ee
mov byte [ebp - 0x35f], 0
movzx eax, byte [ebp - 0x35f]
test eax, eax
je 0x46e5ee
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x5fc], 0
jmp 0x46e607
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 3
jge 0x46e623
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0x4658], 0x58a835a
jmp 0x46e5fa
jmp 0x46e5ab
mov dword [ebp - 0x2cc], 0
jmp 0x46e63e
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jg 0x46e678
mov dword [ebp - 0x2328], 0xffffffff
mov eax, dword [ebp - 0x2328]
dec eax
mov dword [ebp - 0x2328], eax
mov byte [ebp - 0x361], 0
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x46e676
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
jmp 0x46e631
lea ecx, [ebp - 0x4094]
call fcn.00432b52
jmp 0x46e533
mov dword [ebp - 0x7c0], 0x7a2d47e1
mov dword [ebp - 0x1248], 0x6b01fe44
mov dword [ebp - 0x304], 0x1897a4a1
mov dword [ebp - 0x52c], 0x7e280bfe
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0xfd0], 0xae50714b
mov dword [ebp - 0x2348], 0xd56a4262
mov dword [ebp - 0x768], 0
jmp 0x46e6e7
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 2
jge 0x46e703
mov eax, dword [ebp - 0x768]
mov dword [ebp + eax*4 - 0x2c28], 0xffffffff
jmp 0x46e6da
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2bcc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bcc]
mov dword [ebp + eax - 0x2c28], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c28], 0
jne 0x46e73e
mov dword [ebp - 0x2bd4], 1
jmp 0x46e745
and dword [ebp - 0x2bd4], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x45d8], eax
or eax, 0xffffffff
je 0x46e772
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c28], 0
je 0x46e772
mov dword [ebp - 0xfb8], 1
jmp 0x46e779
and dword [ebp - 0xfb8], 0
cmp dword [ebp - 0xfb8], 1
jae 0x46e78e
mov dword [ebp - 0x2330], 1
jmp 0x46e795
and dword [ebp - 0x2330], 0
cmp dword [ebp - 0x2330], 0xfffffff9
jne 0x46e7aa
mov dword [ebp - 0xfc0], 1
jmp 0x46e7b1
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x304]
add eax, dword [ebp - 0xfc0]
je 0x46e7d4
mov eax, 0xf591
test eax, eax
je 0x46e7d4
mov dword [ebp - 0x2338], 1
jmp 0x46e7db
and dword [ebp - 0x2338], 0
mov eax, dword [ebp - 0x2338]
sub eax, dword [ebp - 0x304]
add eax, dword [ebp - 0x304]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0xfc8], eax
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0xfc8], eax
jge 0x46e820
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x46e820
mov dword [ebp - 0x2bdc], 1
jmp 0x46e827
and dword [ebp - 0x2bdc], 0
mov eax, 0xe011b55e
cmp eax, 0xb948214d
je 0x46e83f
mov dword [ebp - 0x2340], 1
jmp 0x46e846
and dword [ebp - 0x2340], 0
mov eax, dword [ebp - 0x2340]
sub eax, dword [ebp - 0x304]
mov dword [ebp - 0xfd0], eax
mov eax, dword [ebp - 0xfd0]
cmp dword [ebp - 0x304], eax
je 0x46e8a8
mov dword [ebp - 0x52c], 0x13
jmp 0x46e87f
mov eax, dword [ebp - 0x52c]
dec eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xffffffe4
jle 0x46e8a6
mov byte [ebp - 0x363], 0
movzx eax, byte [ebp - 0x363]
test eax, eax
je 0x46e8a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x46e872
jmp 0x46e8d9
mov dword [ebp - 0x3eb4], 8
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x46e8cc
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x2348]
inc eax
mov dword [ebp - 0x2348], eax
mov byte [ebp - 0x367], 0
movzx eax, byte [ebp - 0x367]
test eax, eax
je 0x46e8ff
push 0x90f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x376c], 0xfe0a8eac
mov dword [ebp - 0x3768], 0xfe0a8eac
mov dword [ebp - 0x3764], 0xfe0a8eac
mov dword [ebp - 0x3760], 0xfe0a8eac
lea ecx, [ebp - 0xe25]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x375c]
push eax
lea eax, [ebp - 0x376c]
push eax
lea ecx, [ebp - 0x47cc]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2ad8]
call fcn.00432b2c
mov dword [ebp - 0x5e0], 0xe164caf1
push 0
lea ecx, [ebp - 0x2ad8]
call fcn.00432b6e
and dword [eax], 0
jmp 0x46e99c
push 0
lea ecx, [ebp - 0x2ad8]
call fcn.00432b6e
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0xfd8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xfd8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2ad8]
call fcn.00432b6e
cmp dword [eax], 0x17
jne 0x46ea52
mov dword [ebp - 0x2be4], 0xfffffff8
cmp dword [ebp - 0x2be4], 0
je 0x46e9dd
mov dword [ebp - 0x2bec], 9
mov eax, dword [ebp - 0x2bec]
mov dword [ebp - 0x5e0], eax
jmp 0x46ea26
mov dword [ebp - 0x2350], 0xf65e790e
mov dword [ebp - 0x5e0], 0
jmp 0x46ea00
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 7
jle 0x46ea26
mov esi, dword [ebp - 0x2350]
push 0
lea ecx, [ebp - 0x2ad8]
call fcn.00432b6e
sub esi, dword [eax]
mov dword [ebp - 0x2350], esi
jmp 0x46e9f3
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x46ea4d
push 0x186d
push 0x2041
push 0xb09
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x46e978
mov esi, dword [ebp - 0x5e0]
push 1
lea ecx, [ebp - 0x2ad8]
call fcn.00432b6e
mov dword [eax], esi
lea ecx, [ebp - 0x2ad8]
call fcn.00432b52
mov dword [ebp - 0x29c], 0
jmp 0x46ea8b
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x46eaad
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x28c4]
call fcn.00432b6e
mov dword [eax], 0x6ec6e54e
jmp 0x46ea7e
mov dword [ebp - 0xbc8], 0xfffffffb
mov dword [ebp - 0x2bf4], 0xfffffffa
mov dword [ebp - 0x2c0c], 5
mov dword [ebp - 0x4288], 0x9781
mov dword [ebp - 0x2c14], 1
mov dword [ebp - 0xe70], 0xde4bf748
mov dword [ebp - 0x940], 0
jmp 0x46eb02
mov eax, dword [ebp - 0x940]
inc eax
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 3
jge 0x46eb1e
mov eax, dword [ebp - 0x940]
mov dword [ebp + eax*4 - 0x46a0], 0
jmp 0x46eaf5
mov eax, dword [ebp - 0xbc8]
inc eax
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0x2bf4]
mov dword [ebp - 0x3ebc], eax
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x2bfc], eax
push 8
pop eax
sub eax, dword [ebp - 0xe70]
mov dword [ebp - 0x2c04], eax
mov eax, dword [ebp - 0xe70]
inc eax
mov dword [ebp - 0xe70], eax
mov eax, dword [ebp - 0x2bfc]
cmp eax, dword [ebp - 0x2c04]
je 0x46eb79
mov dword [ebp - 0xfe0], 1
jmp 0x46eb80
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0x2c0c]
mov dword [ebp - 0x449c], eax
mov eax, dword [ebp - 0x2c14]
imul eax, dword [ebp - 0xfe0]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x46a0], eax
mov dword [ebp - 0x29c], 0
jmp 0x46ebbe
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x46ebe0
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x2b08]
call fcn.00432b6e
mov dword [eax], 0x955a63a7
jmp 0x46ebb1
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x2358], eax
push 0
lea ecx, [ebp - 0x28c4]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2358]
mov dword [eax], ecx
cmp dword [ebp - 0x2358], 0xb807cfaf
jne 0x46ec54
push 0
lea ecx, [ebp - 0x28c4]
call fcn.00432b6e
mov esi, eax
push 0
lea ecx, [ebp - 0x28c4]
call fcn.00432b6e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x46ec3b
mov dword [ebp - 0xfe8], 1
jmp 0x46ec42
and dword [ebp - 0xfe8], 0
cmp dword [ebp - 0xfe8], 7
je 0x46ec54
and dword [ebp - 0x2360], 0
jmp 0x46ec5e
mov dword [ebp - 0x2360], 1
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x2360], eax
jl 0x46ec78
mov dword [ebp - 0x2c1c], 1
jmp 0x46ec7f
and dword [ebp - 0x2c1c], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x3ec4], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x4298], eax
imul eax, dword [ebp - 0xf8], 0xf381
cmp eax, dword [ebp - 0xf8]
jg 0x46ecb5
mov dword [ebp - 0xff0], 1
jmp 0x46ecbc
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xff0]
sub ecx, dword [ebp - 0xf8]
add eax, ecx
cmp eax, dword [ebp - 0xf8]
jne 0x46ece4
mov dword [ebp - 0xbd0], 1
jmp 0x46eceb
and dword [ebp - 0xbd0], 0
push 1
lea ecx, [ebp - 0x2b08]
call fcn.00432b6e
mov ecx, dword [ebp - 0xbd0]
mov dword [eax], ecx
cmp dword [ebp - 0xbd0], 0
je 0x470b73
mov dword [ebp - 0x770], 8
mov byte [ebp - 0x36b], 0
movzx eax, byte [ebp - 0x36b]
test eax, eax
je 0x46ed49
push 0
push 0x157a
push 0
push 0xce
push 0x6a7
push 0
push 0x1442
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [ebp - 0x770], 0xffffffff
jmp 0x46ed62
mov eax, dword [ebp - 0x770]
dec eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0xfffffff4
jge 0x46ee61
push 1
lea ecx, [ebp - 0x310c]
call fcn.00432a80
mov dword [ebp - 0xab0], 0
jmp 0x46ed95
mov eax, dword [ebp - 0xab0]
inc eax
mov dword [ebp - 0xab0], eax
cmp dword [ebp - 0xab0], 1
jge 0x46edb7
push dword [ebp - 0xab0]
lea ecx, [ebp - 0x310c]
call fcn.00432b6e
mov dword [eax], 0x1f665683
jmp 0x46ed88
push 0
lea ecx, [ebp - 0x310c]
call fcn.00432b6e
mov dword [eax], 0x13
jmp 0x46edf0
push 0
lea ecx, [ebp - 0x310c]
call fcn.00432b6e
mov dword [ebp - 0x2368], eax
mov eax, dword [ebp - 0x2368]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2368]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x310c]
call fcn.00432b6e
cmp dword [eax], 0xe
jg 0x46ee51
mov dword [ebp - 0x778], 0xfffffffa
mov dword [ebp - 0x778], 0
jmp 0x46ee25
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 3
jg 0x46ee4c
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x46ee4a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x46ee18
jmp 0x46edcc
lea ecx, [ebp - 0x310c]
call fcn.00432b52
jmp 0x46ed55
mov dword [ebp - 0x1160], 0xcb7be74f
mov dword [ebp - 0x3ecc], 0xffffffff
mov dword [ebp - 0x4570], 0x5ab3e90a
mov dword [ebp - 0x3ed4], 5
mov dword [ebp - 0x42a8], 0xae77ab39
mov dword [ebp - 0x3edc], 0x80444555
mov dword [ebp - 0x44b0], 0xd9edbda7
mov dword [ebp - 0xff8], 0x6497
mov dword [ebp - 0x180], 0
jmp 0x46eeca
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x46eee6
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x3f08], 0
jmp 0x46eebd
mov dword [ebp - 0x180], 0
jmp 0x46eeff
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x46ef1b
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x4860], 1
jmp 0x46eef2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3f08], 1
mov eax, dword [ebp - 0xff8]
dec eax
mov dword [ebp - 0xff8], eax
mov dword [ebp - 0x2f74], 1
mov dword [ebp - 0x394], 0x94643cdf
mov dword [ebp - 0x2370], 1
mov dword [ebp - 0xd50], 7
mov dword [ebp - 0x1010], 0
push 1
lea ecx, [ebp - 0x399c]
call fcn.00432a80
mov dword [ebp - 0x1a4], 0
jmp 0x46ef91
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x46efad
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x948], 0x2840
jmp 0x46ef84
mov dword [ebp - 0x1a4], 0
jmp 0x46efc6
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x46efe8
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x399c]
call fcn.00432b6e
mov dword [eax], 0xfffffff9
jmp 0x46efb9
cmp dword [ebp - 0x394], 0
jne 0x46f145
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x2370], eax
cmp dword [ebp - 0x2370], 2
je 0x46f016
mov dword [ebp - 0x1000], 1
jmp 0x46f01d
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0xd50]
add eax, dword [ebp - 0x1000]
cmp eax, 1
je 0x46f03a
mov dword [ebp - 0x2378], 1
jmp 0x46f041
and dword [ebp - 0x2378], 0
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x2378]
jne 0x46f05b
mov dword [ebp - 0x1008], 1
jmp 0x46f062
and dword [ebp - 0x1008], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0x1008], eax
jge 0x46f083
mov dword [ebp - 0x2380], 1
jmp 0x46f08a
and dword [ebp - 0x2380], 0
mov eax, dword [ebp - 0x2380]
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x1010]
sub eax, dword [ebp - 0x394]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x948]
cmp eax, 0xe77e
jge 0x46f0c2
mov dword [ebp - 0x2388], 1
jmp 0x46f0c9
and dword [ebp - 0x2388], 0
cmp dword [ebp - 0x2388], 0xa184
jne 0x46f0e1
mov dword [ebp - 0x1018], 1
jmp 0x46f0e8
and dword [ebp - 0x1018], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0x1018], eax
jge 0x46f109
mov dword [ebp - 0x2390], 1
jmp 0x46f110
and dword [ebp - 0x2390], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2390]
imul ecx, dword [ebp + eax - 0x948]
mov dword [ebp - 0x1020], ecx
push 0
lea ecx, [ebp - 0x399c]
call fcn.00432b6e
mov ecx, dword [ebp - 0x1020]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd50]
mov eax, dword [ebp - 0x394]
sub eax, dword [ebp - 0xd50]
cmp dword [ebp - 0x394], eax
je 0x46f165
mov dword [ebp - 0x2398], 1
jmp 0x46f16c
and dword [ebp - 0x2398], 0
mov eax, dword [ebp - 0x2398]
mov dword [ebp - 0x394], eax
lea ecx, [ebp - 0x399c]
call fcn.00432b52
mov dword [ebp - 0xc00], 0xa5c12438
mov dword [ebp - 0x3ee4], 5
push 2
lea ecx, [ebp - 0xe7c]
call fcn.00432a80
mov dword [ebp - 0x70], 0x2ee76f50
push 3
lea ecx, [ebp - 0x38dc]
call fcn.00432a80
mov dword [ebp - 0x42b8], 0
mov dword [ebp - 0x2eac], 1
mov dword [ebp - 0x23d8], 0x6aae11e5
mov dword [ebp - 0x2eb4], 0xec160668
mov dword [ebp - 0x234], 0
jmp 0x46f1f9
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x46f218
push dword [ebp - 0x234]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
and dword [eax], 0
jmp 0x46f1ec
mov dword [ebp - 0x234], 0
jmp 0x46f231
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x46f253
push dword [ebp - 0x234]
lea ecx, [ebp - 0x38dc]
call fcn.00432b6e
mov dword [eax], 0x8bfa0855
jmp 0x46f224
mov dword [ebp - 0x70], 1
jmp 0x46f263
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x46f71b
mov dword [ebp - 0xbd8], 0x8bdfadf6
push 4
lea ecx, [ebp - 0x33a0]
call fcn.00432a80
mov dword [ebp - 0x3eec], 0x2da0d3d7
mov dword [ebp - 0x23d0], 2
mov dword [ebp - 0x1ac], 0
jmp 0x46f2b1
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x46f2cd
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x2894], 0xc3ad3b31
jmp 0x46f2a4
mov dword [ebp - 0x1ac], 0
jmp 0x46f2e6
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 4
jge 0x46f305
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x33a0]
call fcn.00432b6e
and dword [eax], 0
jmp 0x46f2d9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2894], 1
jmp 0x46f333
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2894]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2894], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2894], 0
jl 0x46f691
mov dword [ebp - 0x23c0], 0xfffffff7
mov dword [ebp - 0x1050], 0xf0c3da55
mov dword [ebp - 0x27c], 0
jmp 0x46f374
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x46f390
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x311c], 0x62ee6d05
jmp 0x46f367
mov dword [ebp - 0x27c], 0
jmp 0x46f3a9
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x46f3c5
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x4844], 0xfffffffc
jmp 0x46f39c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x311c], 1
jmp 0x46f3f3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x311c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x311c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x311c], 0
jl 0x46f61f
mov dword [ebp - 0x1030], 6
mov dword [ebp - 0x1038], 0x60d743cc
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
cmp dword [eax], 0
je 0x46f433
jmp 0x46f61f
cmp dword [ebp - 0x70], 0xcde9
jg 0x46f448
mov dword [ebp - 0x1028], 1
jmp 0x46f44f
and dword [ebp - 0x1028], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2894]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbd8]
imul eax, dword [ebp - 0x1028]
test eax, eax
jne 0x46f5fb
mov eax, dword [ebp - 0x70]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2894]
jg 0x46f496
mov dword [ebp - 0x23a0], 1
jmp 0x46f49d
and dword [ebp - 0x23a0], 0
mov eax, dword [ebp - 0x23a0]
mov dword [ebp - 0x1030], eax
cmp dword [ebp - 0x1030], 0x95a2
jle 0x46f4c1
mov dword [ebp - 0x23a8], 1
jmp 0x46f4c8
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0x23a8]
sub eax, 7
mov dword [ebp - 0x1038], eax
mov esi, dword [ebp - 0x1038]
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
cmp esi, dword [eax]
jg 0x46f4fb
mov dword [ebp - 0x23b0], 1
jmp 0x46f502
and dword [ebp - 0x23b0], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x23b0], eax
jg 0x46f519
mov dword [ebp - 0x1040], 1
jmp 0x46f520
and dword [ebp - 0x1040], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
mov ecx, dword [ebp - 0x1040]
cmp ecx, dword [eax]
jge 0x46f544
mov dword [ebp - 0x2ea4], 1
jmp 0x46f54b
and dword [ebp - 0x2ea4], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
cmp dword [eax], 0x3212
jle 0x46f57b
mov dword [ebp - 0x1058], 1
push 0
lea ecx, [ebp - 0x33a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x1058]
mov dword [eax], ecx
jmp 0x46f3d8
push 0
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x45b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2894]
mov dword [ebp - 0x23d0], eax
cmp dword [ebp - 0x23d0], 0xe5fa
jg 0x46f663
mov dword [ebp - 0x1060], 1
jmp 0x46f66a
and dword [ebp - 0x1060], 0
push 2
lea ecx, [ebp - 0x33a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x1060]
add ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x311c], ecx
jmp 0x46f318
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe7c]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2eac]
add ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x46f6b8
mov dword [ebp - 0xdfc], 1
jmp 0x46f6bf
and dword [ebp - 0xdfc], 0
push 1
lea ecx, [ebp - 0x38dc]
call fcn.00432b6e
mov ecx, dword [ebp - 0xdfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0x23d8], eax
mov eax, dword [ebp - 0x23d8]
mov dword [ebp - 0x1068], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1068]
mov dword [ebp + eax - 0x2894], ecx
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x2eb4], eax
lea ecx, [ebp - 0x33a0]
call fcn.00432b52
jmp 0x46f25c
lea ecx, [ebp - 0x38dc]
call fcn.00432b52
lea ecx, [ebp - 0xe7c]
call fcn.00432b52
mov dword [ebp - 0x2f6c], 0xffffffff
push 2
lea ecx, [ebp - 0x51c]
call fcn.00432a80
push 2
lea ecx, [ebp - 0x29b8]
call fcn.00432a80
mov dword [ebp - 0x10a8], 7
mov dword [ebp - 0x2c], 0
jmp 0x46f76f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x46f78b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
mov dword [eax], 1
jmp 0x46f768
mov dword [ebp - 0x2c], 0
jmp 0x46f79b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x46f7b7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x29b8]
call fcn.00432b6e
mov dword [eax], 0x69a22db7
jmp 0x46f794
mov dword [ebp - 0x2c], 0
jmp 0x46f7c7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x46f7dd
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x26f4], 0xfff6
jmp 0x46f7c0
mov dword [ebp - 0x2c], 0
jmp 0x46f7ed
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x46f803
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xbe8], 0xffffffff
jmp 0x46f7e6
push 1
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
cmp dword [eax], 1
jle 0x46f821
mov dword [ebp - 0x23e0], 1
jmp 0x46f828
and dword [ebp - 0x23e0], 0
push 0
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
mov ecx, dword [ebp - 0x23e0]
sub ecx, dword [eax]
cmp ecx, 0xd383
jl 0x46f851
mov dword [ebp - 0x2ebc], 1
jmp 0x46f858
and dword [ebp - 0x2ebc], 0
push 1
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
push 0
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
mov esi, eax
push 1
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x46f893
mov dword [ebp - 0x2ec4], 1
jmp 0x46f89a
and dword [ebp - 0x2ec4], 0
push 0
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
push 0
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
cmp dword [eax], 0
je 0x46f8d7
push 1
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
cmp dword [eax], 0
je 0x46f8d7
mov dword [ebp - 0x1070], 1
jmp 0x46f8de
and dword [ebp - 0x1070], 0
push 0
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1070]
jle 0x46f90a
push 0
lea ecx, [ebp - 0x29b8]
call fcn.00432b6e
and dword [eax], 0
jmp 0x46ff3e
mov dword [ebp - 0xd4], 0xfffffff8
push 2
lea ecx, [ebp - 0x28a4]
call fcn.00432a80
mov dword [ebp - 0x10a0], 0xb26d8f9c
mov dword [ebp - 0x674], 0xec6ea3d8
mov dword [ebp - 0xd58], 0xfffffff7
mov dword [ebp - 0x2ee4], 0xfffc
mov dword [ebp - 0x780], 0
jmp 0x46f962
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 2
jge 0x46f984
push dword [ebp - 0x780]
lea ecx, [ebp - 0x28a4]
call fcn.00432b6e
mov dword [eax], 0x376fbfcc
jmp 0x46f955
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], eax
je 0x46f99e
mov dword [ebp - 0x23e8], 1
jmp 0x46f9a5
and dword [ebp - 0x23e8], 0
push 1
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
cmp dword [eax], 0x3ee67684
jge 0x46f9c6
mov dword [ebp - 0xbe0], 1
jmp 0x46f9cd
and dword [ebp - 0xbe0], 0
push 0
lea ecx, [ebp - 0x28a4]
call fcn.00432b6e
mov ecx, dword [ebp - 0xbe0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x23e8]
cmp eax, dword [ebp - 0xbe0]
jle 0x46f9fc
mov dword [ebp - 0x1078], 1
jmp 0x46fa03
and dword [ebp - 0x1078], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x1078]
je 0x46fa1d
mov dword [ebp - 0x23f0], 1
jmp 0x46fa24
and dword [ebp - 0x23f0], 0
push 1
lea ecx, [ebp - 0x29b8]
call fcn.00432b6e
mov ecx, dword [ebp - 0x23f0]
cmp ecx, dword [eax]
jg 0x46fa47
mov dword [ebp - 0x2ecc], 1
jmp 0x46fa4e
and dword [ebp - 0x2ecc], 0
push 1
lea ecx, [ebp - 0x51c]
call fcn.00432b6e
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x3ef4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x42c8], eax
cmp dword [ebp - 0x10a0], 0xfffffffe
jb 0x46fa88
lea ecx, [ebp - 0x29b8]
call fcn.00432b52
lea ecx, [ebp - 0x51c]
call fcn.00432b52
mov dword [ebp - 0x39c], 0x13b91020
mov dword [ebp - 0x39c], 0xffffffe7
jmp 0x46ff77
cmp dword [ebp - 0x39c], 0xfffffff5
jl 0x47010a
mov dword [ebp - 0xe54], 0x67101392
mov dword [ebp - 0x10d8], 0xfffffffe
push 4
lea ecx, [ebp - 0x3a5c]
call fcn.00432a80
mov dword [ebp - 0x2458], 0x9be5411a
mov dword [ebp - 0x2f04], 0xca335c22
mov dword [ebp - 0xa30], 0
jmp 0x46ffd2
mov eax, dword [ebp - 0xa30]
inc eax
mov dword [ebp - 0xa30], eax
cmp dword [ebp - 0xa30], 4
jge 0x46fff1
push dword [ebp - 0xa30]
lea ecx, [ebp - 0x3a5c]
call fcn.00432b6e
and dword [eax], 0
jmp 0x46ffc5
cmp dword [ebp - 0xe54], 1
jne 0x470006
mov dword [ebp - 0x2efc], 1
jmp 0x47000d
and dword [ebp - 0x2efc], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3f60], eax
mov eax, dword [ebp - 0xe54]
mov dword [ebp - 0x44ec], eax
mov dword [ebp - 0x10d8], 0xa421e0be
mov eax, dword [ebp - 0xe54]
cmp dword [ebp - 0x10d8], eax
je 0x470049
mov dword [ebp - 0xbf0], 1
jmp 0x470050
and dword [ebp - 0xbf0], 0
push 0
lea ecx, [ebp - 0x3a5c]
call fcn.00432b6e
mov ecx, dword [ebp - 0xbf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0xbf0], eax
jl 0x47007f
mov byte [ebp - 0x371], 0
push 3
lea ecx, [ebp - 0x29d0]
call fcn.00432a80
push 4
lea ecx, [ebp - 0x33b8]
call fcn.00432a80
mov dword [ebp - 0x2f24], 0xe82ca96
mov dword [ebp - 0xd60], 0xd8c53784
mov dword [ebp - 0x2f14], 0xfffffffc
mov dword [ebp - 0xbf8], 0xffffffff
mov dword [ebp - 0x2478], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x470176
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x470198
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x29d0]
call fcn.00432b6e
mov dword [eax], 0x93e9
jmp 0x470169
mov dword [ebp - 0xa8], 0
jmp 0x4701b1
cmp dword [ebp - 0xa8], 4
jge 0x4701d3
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x33b8]
call fcn.00432b6e
mov dword [eax], 0x6e348cc3
jmp 0x4701a4
mov dword [ebp - 0xa8], 0
jmp 0x4701ec
mov dword [ebp - 0x5e8], 0
mov dword [ebp - 0x6b8], 0xed7c6ae4
mov dword [ebp - 0x958], 0xd64c9d8
mov dword [ebp - 0x11a0], 0xb4743079
mov dword [ebp - 0x2520], 7
mov dword [ebp - 0x2f8c], 1
mov dword [ebp - 0x1b4], 0
jmp 0x470bc8
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x470be4
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x3804], 0x17ca4e86
jmp 0x470bbb
mov dword [ebp - 0x1b4], 0
jmp 0x470bfd
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x470c19
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x42dc], 0x1465ee6
jmp 0x470bf0
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x4504], eax
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x1190], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1190]
mov dword [ebp + eax - 0x3804], ecx
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0
je 0x470d01
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0x958], eax
jl 0x470c83
mov dword [ebp - 0x2508], 1
jmp 0x470c8a
and dword [ebp - 0x2508], 0
mov eax, dword [ebp - 0x2508]
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0
je 0x470cab
mov dword [ebp - 0x1198], 1
jmp 0x470cb2
and dword [ebp - 0x1198], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x3804], 0x80f2
neg eax
cmp eax, dword [ebp - 0x1198]
jle 0x470cd9
mov dword [ebp - 0x2510], 1
jmp 0x470ce0
and dword [ebp - 0x2510], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3804]
cmp dword [ebp - 0x2510], eax
jl 0x470d01
mov dword [ebp - 0xd68], 1
jmp 0x470d08
and dword [ebp - 0xd68], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd68]
mov dword [ebp + eax - 0x42dc], ecx
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0x11a0], eax
cmp dword [ebp - 0x11a0], 0xb5a7dd9a
jne 0x470d3f
mov dword [ebp - 0x2f7c], 1
jmp 0x470d46
and dword [ebp - 0x2f7c], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x3f88], eax
cmp dword [ebp - 0x5e8], 0
ja 0x470d6d
mov eax, 0x6286c8a8
test eax, eax
jne 0x470d6d
and dword [ebp - 0x2518], 0
jmp 0x470d77
mov dword [ebp - 0x2518], 1
cmp dword [ebp - 0x2518], 0x4417f95e
je 0x470d8f
mov dword [ebp - 0x11a8], 1
jmp 0x470d96
and dword [ebp - 0x11a8], 0
mov eax, dword [ebp - 0x958]
imul eax, dword [ebp - 0x11a8]
cmp eax, 0xead2214c
ja 0x470db3
cmp dword [ebp - 0x6b8], 0
je 0x470dc8
cmp dword [ebp - 0x2520], 0
je 0x470dc8
mov dword [ebp - 0x2f84], 1
jmp 0x470dcf
and dword [ebp - 0x2f84], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x4370], eax
cmp dword [ebp - 0x2520], 0x9e77
jl 0x470df3
mov dword [ebp - 0x11b0], 1
jmp 0x470dfa
and dword [ebp - 0x11b0], 0
cmp dword [ebp - 0x11b0], 0xbfef
jne 0x470e12
mov dword [ebp - 0x2528], 1
jmp 0x470e19
and dword [ebp - 0x2528], 0
mov eax, dword [ebp - 0x2528]
mov dword [ebp - 0x2f8c], eax
push 4
lea ecx, [ebp - 0x28b4]
call fcn.00432a80
mov dword [ebp - 0xc08], 0x4981ff29
mov dword [ebp - 0x11b8], 0
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x36f4], 0xfffffffc
mov dword [ebp - 0x36f0], 0xfffffffc
mov dword [ebp - 0x36ec], 0xfffffffc
mov dword [ebp - 0x36e8], 0xfffffffc
lea ecx, [ebp - 0xdea]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x36e4]
push eax
lea eax, [ebp - 0x36f4]
push eax
lea ecx, [ebp - 0x483c]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe94]
call fcn.00432b2c
mov dword [ebp - 0x2548], 0x104353e
mov dword [ebp - 0x2fac], 0x93be
mov byte [ebp - 0x379], 0
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x470ef8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x228f
push 0x39a
push 0x1a65
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0x11b8], eax
cmp dword [ebp - 0x11b8], 0xfffffffe
jle 0x470f25
mov dword [ebp - 0x2f94], 1
jmp 0x470f2c
and dword [ebp - 0x2f94], 0
cmp dword [ebp - 0x534], 0
jne 0x470f47
cmp dword [ebp - 0x534], 0
jne 0x470f47
and dword [ebp - 0x2530], 0
jmp 0x470f51
mov dword [ebp - 0x2530], 1
cmp dword [ebp - 0x2530], 0xf928
jg 0x470f69
mov dword [ebp - 0x2f9c], 1
jmp 0x470f70
and dword [ebp - 0x2f9c], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x3f90], eax
cmp dword [ebp - 0x534], 1
jne 0x470f91
mov dword [ebp - 0x11c0], 1
jmp 0x470f98
and dword [ebp - 0x11c0], 0
mov eax, 0xa7b7e80d
sub eax, dword [ebp - 0x11c0]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x44f8], eax
push 0
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
push 3
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
cmp dword [eax], 1
jae 0x470fe0
mov dword [ebp - 0x2538], 1
jmp 0x470fe7
and dword [ebp - 0x2538], 0
push 1
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2538]
cmp ecx, dword [eax]
jge 0x47100a
mov dword [ebp - 0x11c8], 1
jmp 0x471011
and dword [ebp - 0x11c8], 0
push 0
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c8]
lea eax, [ecx + eax + 0x3637b304]
cmp eax, 0x28eaf608
jg 0x471040
mov dword [ebp - 0x2540], 1
jmp 0x471047
and dword [ebp - 0x2540], 0
push 3
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2540]
imul ecx, dword [eax]
test ecx, ecx
jne 0x47106d
mov dword [ebp - 0x2fa4], 1
jmp 0x471074
and dword [ebp - 0x2fa4], 0
push 3
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
push 0
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
push 0
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
mov dword [ebp - 0x11d0], eax
push 2
lea ecx, [ebp - 0xe94]
call fcn.00432b6e
mov ecx, dword [ebp - 0x11d0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2548]
mov ecx, dword [ebp - 0x11d0]
cmp dword [ecx], eax
jle 0x4710d4
mov dword [ebp - 0x11d8], 1
jmp 0x4710db
and dword [ebp - 0x11d8], 0
mov eax, dword [ebp - 0x2548]
cmp dword [ebp - 0x11d8], eax
jle 0x4710f5
mov dword [ebp - 0x2550], 1
jmp 0x4710fc
and dword [ebp - 0x2550], 0
mov eax, dword [ebp - 0x2550]
mov dword [ebp - 0x2fac], eax
lea ecx, [ebp - 0xe94]
call fcn.00432b52
mov dword [ebp - 0xc10], 0
mov dword [ebp - 0x2d4], 0xac64a684
mov dword [ebp - 0x2d4], 0xb
jmp 0x471140
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xd
jne 0x47129a
mov dword [ebp - 0x60c], 1
push 2
lea ecx, [ebp - 0x33d0]
call fcn.00432a80
mov dword [ebp - 0x7a0], 0
jmp 0x47117d
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 2
jge 0x47119f
push dword [ebp - 0x7a0]
lea ecx, [ebp - 0x33d0]
call fcn.00432b6e
mov dword [eax], 5
jmp 0x471170
cmp dword [ebp - 0x60c], 0
jne 0x4711ba
cmp dword [ebp - 0x60c], 1
je 0x4711ba
and dword [ebp - 0x11e0], 0
jmp 0x4711c4
mov dword [ebp - 0x11e0], 1
cmp dword [ebp - 0x11e0], 0xfffffff9
je 0x4711df
cmp dword [ebp - 0x60c], 0
jne 0x4711df
and dword [ebp - 0x2558], 0
jmp 0x4711e9
mov dword [ebp - 0x2558], 1
push 0
lea ecx, [ebp - 0x33d0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2558]
cmp ecx, dword [eax]
jge 0x47120c
mov dword [ebp - 0x11e8], 1
jmp 0x471213
and dword [ebp - 0x11e8], 0
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x11e8], eax
je 0x47122d
mov dword [ebp - 0x2fb4], 1
jmp 0x471234
and dword [ebp - 0x2fb4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x3f98], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x4378], eax
push 0xfffffffffffffffa
pop eax
cmp eax, 0xbb2f1448
ja 0x471262
mov dword [ebp - 0x2fbc], 1
jmp 0x471269
and dword [ebp - 0x2fbc], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x3b20], eax
mov esi, dword [ebp - 0x2d4]
push 0
lea ecx, [ebp - 0x33d0]
call fcn.00432b6e
mov dword [eax], esi
lea ecx, [ebp - 0x33d0]
call fcn.00432b52
jmp 0x471133
mov dword [ebp - 0x2d4], 0xdac0faab
or dword [ebp - 0x3604], 0xffffffff
or dword [ebp - 0x3600], 0xffffffff
or dword [ebp - 0x35fc], 0xffffffff
or dword [ebp - 0x35f8], 0xffffffff
lea ecx, [ebp - 0xb5d]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x35f4]
push eax
lea eax, [ebp - 0x3604]
push eax
lea ecx, [ebp - 0x47e4]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x40f4]
call fcn.00432b2c
push 3
lea ecx, [ebp - 0x40c4]
call fcn.00432a80
mov dword [ebp - 0x3b28], 0
mov dword [ebp - 0x3b30], 3
mov dword [ebp - 0x3b38], 0x2304b25b
mov dword [ebp - 0x11f0], 0x82ff40fc
mov dword [ebp - 0x3b40], 0
push 1
lea ecx, [ebp - 0x40b4]
call fcn.00432a80
push 1
lea ecx, [ebp - 0x40a4]
call fcn.00432a80
mov dword [ebp - 0x2560], 0xfffffffd
mov dword [ebp - 0x34], 0
jmp 0x471368
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x471381
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40c4]
call fcn.00432b6e
and dword [eax], 0
jmp 0x471361
mov dword [ebp - 0x34], 0
jmp 0x471391
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x4713ad
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40b4]
call fcn.00432b6e
mov dword [eax], 0xa66e58d0
jmp 0x47138a
mov dword [ebp - 0x34], 0
jmp 0x4713bd
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x4713d9
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40a4]
call fcn.00432b6e
mov dword [eax], 0x8421
jmp 0x4713b6
mov dword [ebp - 0x34], 0
jmp 0x4713e9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x4713ff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3b48], 0xfff6
jmp 0x4713e2
mov eax, dword [ebp - 0x2560]
dec eax
mov dword [ebp - 0x2560], eax
mov eax, dword [ebp - 0x11f0]
mov dword [ebp - 0x11f0], eax
lea ecx, [ebp - 0x40a4]
call fcn.00432b52
lea ecx, [ebp - 0x40b4]
call fcn.00432b52
lea ecx, [ebp - 0x40c4]
call fcn.00432b52
mov dword [ebp - 0xa38], 0xfffffff6
push 3
lea ecx, [ebp - 0x40d4]
call fcn.00432a80
mov dword [ebp - 0x23c], 0
jmp 0x471469
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 4
jge 0x471485
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x48b4], 1
jmp 0x47145c
mov dword [ebp - 0x23c], 0
jmp 0x47149e
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x4714bd
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x40d4]
call fcn.00432b6e
and dword [eax], 0
jmp 0x471491
mov dword [ebp - 0xa38], 4
jmp 0x4714d6
cmp dword [ebp - 0xa38], 0xfffffff7
jl 0x471604
mov dword [ebp - 0x960], 0xf5cd53bc
mov dword [ebp - 0x7a8], 0
jmp 0x471506
lea ecx, [ebp - 0x40d4]
call fcn.00432b52
mov dword [ebp - 0x44], 0x1449c9fb
mov dword [ebp - 0x7b8], 0xa31c0a9c
push 1
lea ecx, [ebp - 0x384c]
call fcn.00432a80
mov dword [ebp - 0xadc], 0
jmp 0x471646