Function at 0x46f725
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create thread
Enumerate gui resources
Get common file path
Get disk information
Get file attributes
Get graphical window text
Hide graphical window
Identify system language via api
Query or enumerate registry value
Query service status
Set environment variable
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34ac
call fcn.004a5280
push esi
push 1
lea ecx, [ebp - 0xc58]
call fcn.0043492e
mov dword [ebp - 0x1b74], 0xfffffffb
push 2
lea ecx, [ebp - 0x2744]
call fcn.0043492e
mov dword [ebp - 8], 0
jmp 0x46f767
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x46f783
push dword [ebp - 8]
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
mov dword [eax], 9
jmp 0x46f760
mov dword [ebp - 8], 0
jmp 0x46f793
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x46f7a9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x226c], 0x585b7f3
jmp 0x46f78c
mov dword [ebp - 8], 0
jmp 0x46f7b9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x46f7d2
push dword [ebp - 8]
lea ecx, [ebp - 0x2744]
call fcn.00434a1c
or dword [eax], 0xffffffff
jmp 0x46f7b2
mov dword [ebp - 8], 0
jmp 0x46f7e2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x46f7f8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3308], 2
jmp 0x46f7db
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x46f94e
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x46f8fe
mov dword [ebp - 0x1b74], 9
mov eax, dword [ebp - 0x1b74]
mov dword [ebp - 0x1e48], eax
push 1
lea ecx, [ebp - 0x2744]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1e48]
mov dword [eax], ecx
cmp dword [ebp - 0x1e48], 0
jne 0x46f880
push 1
lea ecx, [ebp - 0x2744]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x46f880
and dword [ebp - 0x20f4], 0
jmp 0x46f88a
mov dword [ebp - 0x20f4], 1
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
mov eax, 0x9fa
cmp eax, 0xfffffff6
jle 0x46f8ad
mov dword [ebp - 0x1e50], 1
jmp 0x46f8b4
and dword [ebp - 0x1e50], 0
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1e50]
cmp ecx, dword [eax]
jl 0x46f8d7
mov dword [ebp - 0x1e58], 1
jmp 0x46f8de
and dword [ebp - 0x1e58], 0
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1e58]
sub ecx, dword [eax]
jne 0x46f8fe
and dword [ebp - 0x1e68], 0
jmp 0x46f908
mov dword [ebp - 0x1e68], 1
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x226c]
mov dword [ebp - 0x1e60], eax
push 0
lea ecx, [ebp - 0xc58]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1e60]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1e60]
mov eax, dword [eax]
imul eax, dword [ebp - 0x1e68]
test eax, eax
jne 0x46f94e
and dword [ebp - 0x1e70], 0
jmp 0x46f958
mov dword [ebp - 0x1e70], 1
cmp dword [ebp - 0x1e70], 0x1023
jle 0x46f970
mov dword [ebp - 0x1e78], 1
jmp 0x46f977
and dword [ebp - 0x1e78], 0
mov eax, dword [ebp - 0x1e78]
sub eax, 4
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3308], eax
lea ecx, [ebp - 0x2744]
call fcn.00434a00
lea ecx, [ebp - 0xc58]
call fcn.00434a00
push 4
lea ecx, [ebp - 0xb6c]
call fcn.0043492e
push 1
lea ecx, [ebp - 0x2a00]
call fcn.0043492e
mov dword [ebp - 0x5ac], 5
mov dword [ebp - 0x10c], 0
jmp 0x46f9e0
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x46fa02
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
mov dword [eax], 0x1647c2c9
jmp 0x46f9d3
mov dword [ebp - 0x10c], 0
jmp 0x46fa1b
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x46fa3d
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x2a00]
call fcn.00434a1c
mov dword [eax], 0x223b16aa
jmp 0x46fa0e
push 1
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
mov esi, eax
push 3
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x46fa6b
mov dword [ebp - 0x1e80], 1
jmp 0x46fa72
and dword [ebp - 0x1e80], 0
push 1
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1e80]
cmp ecx, dword [eax]
je 0x46fa95
mov dword [ebp - 0x1e88], 1
jmp 0x46fa9c
and dword [ebp - 0x1e88], 0
push 1
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
mov esi, dword [ebp - 0x1e88]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
cmp esi, dword [eax]
jl 0x46face
mov dword [ebp - 0x2274], 1
jmp 0x46fad5
and dword [ebp - 0x2274], 0
push 1
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
push 3
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
push 0
lea ecx, [ebp - 0xb6c]
call fcn.00434a1c
cmp dword [eax], 0x79cc099a
jl 0x46fb10
mov dword [ebp - 0x1e90], 1
jmp 0x46fb17
and dword [ebp - 0x1e90], 0
cmp dword [ebp - 0x1e90], 0x3d9532bb
jne 0x46fb2f
mov dword [ebp - 0x1e98], 1
jmp 0x46fb36
and dword [ebp - 0x1e98], 0
cmp dword [ebp - 0x1e98], 0xbb7a
jl 0x46fb4e
mov dword [ebp - 0x1ea0], 1
jmp 0x46fb55
and dword [ebp - 0x1ea0], 0
imul esi, dword [ebp - 0x1ea0], 0
push 0
lea ecx, [ebp - 0x2a00]
call fcn.00434a1c
mov dword [eax], esi
mov dword [ebp - 0x5ac], 0
jmp 0x46fb84
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0x13
jl 0x46fbb9
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x46fbb7
push 0
push 0x1ce
push 0
push 0
push 0x1227
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x46fb77
lea ecx, [ebp - 0x2a00]
call fcn.00434a00
lea ecx, [ebp - 0xb6c]
call fcn.00434a00
mov dword [ebp - 0x474], 3
mov dword [ebp - 0x5a4], 0
jmp 0x46fbf2
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 3
jge 0x46fc0e
mov eax, dword [ebp - 0x5a4]
mov dword [ebp + eax*4 - 0x3338], 1
jmp 0x46fbe5
mov dword [ebp - 0x474], 2
jmp 0x46fc27
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jl 0x46fd0e
push 2
lea ecx, [ebp - 0x2714]
call fcn.0043492e
mov dword [ebp - 0x1eb8], 0xfffffff8
mov dword [ebp - 0x598], 0
jmp 0x46fc64
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 2
jge 0x46fc86
push dword [ebp - 0x598]
lea ecx, [ebp - 0x2714]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x46fc57
push 1
lea ecx, [ebp - 0x2714]
call fcn.00434a1c
mov esi, eax
push 1
lea ecx, [ebp - 0x2714]
call fcn.00434a1c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x46fcb4
mov dword [ebp - 0x1ea8], 1
jmp 0x46fcbb
and dword [ebp - 0x1ea8], 0
mov eax, dword [ebp - 0x1eb8]
mov dword [ebp - 0x2eec], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3338]
add eax, dword [ebp - 0x1ea8]
cmp eax, 0xffffffff
jg 0x46fceb
mov dword [ebp - 0x1eb0], 1
jmp 0x46fcf2
and dword [ebp - 0x1eb0], 0
mov eax, dword [ebp - 0x1eb0]
mov dword [ebp - 0x1eb8], eax
lea ecx, [ebp - 0x2714]
call fcn.00434a00
jmp 0x46fc1a
mov dword [ebp - 0x474], 0x2733582f
push 1
lea ecx, [ebp - 0xc70]
call fcn.0043492e
mov dword [ebp - 0x45c], 9
mov dword [ebp - 0x1ec0], 1
mov dword [ebp - 0x45c], 0
jmp 0x46fd52
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 5
je 0x46fe8c
mov dword [ebp - 0xb00], 0xe9c96c79
mov dword [ebp - 0xaf8], 0xffffffff
push 4
lea ecx, [ebp - 0x2ab4]
call fcn.0043492e
mov dword [ebp - 0x718], 0
jmp 0x46fd99
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 4
jge 0x46fdbb
push dword [ebp - 0x718]
lea ecx, [ebp - 0x2ab4]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x46fd8c
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x1ec0], eax
mov dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0xb00], eax
jge 0x46fdeb
mov dword [ebp - 0x1ec8], 1
jmp 0x46fdf2
and dword [ebp - 0x1ec8], 0
cmp dword [ebp - 0x1ec0], 0
jle 0x46fe07
mov dword [ebp - 0x1ed0], 1
jmp 0x46fe0e
and dword [ebp - 0x1ed0], 0
mov eax, dword [ebp - 0x1ec8]
cmp eax, dword [ebp - 0x1ed0]
jle 0x46fe28
mov dword [ebp - 0x1ed8], 1
jmp 0x46fe2f
and dword [ebp - 0x1ed8], 0
mov eax, dword [ebp - 0xaf8]
imul eax, dword [ebp - 0x1ed8]
mov dword [ebp - 0xaf8], eax
cmp dword [ebp - 0xb00], 0
jne 0x46fe5d
cmp dword [ebp - 0x45c], 0
jne 0x46fe5d
and dword [ebp - 0x1ee0], 0
jmp 0x46fe67
mov dword [ebp - 0x1ee0], 1
push 0
lea ecx, [ebp - 0x2ab4]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1ee0]
mov dword [eax], ecx
lea ecx, [ebp - 0x2ab4]
call fcn.00434a00
jmp 0x46fd45
mov dword [ebp - 0x228c], 0xbd97a888
mov dword [ebp - 0x5a0], 0xfffffffb
mov dword [ebp - 0x2284], 0xf1d8987f
mov dword [ebp - 0x17c], 0
jmp 0x46fec3
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x46fedf
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x3398], 5
jmp 0x46feb6
mov dword [ebp - 0x17c], 0
jmp 0x46fef8
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x46ff14
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x22d0], 0xefa20bd0
jmp 0x46feeb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3398]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x22d0]
mov dword [ebp - 0x227c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22d0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x22d0], eax
cmp dword [ebp - 0x227c], 0
je 0x46ff77
mov byte [ebp - 0x25a], 0
movzx eax, byte [ebp - 0x25a]
test eax, eax
je 0x46ff75
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x46ffbc
mov dword [ebp - 0x2294], 4
mov dword [ebp - 0x5a0], 0xa
jmp 0x46ff9a
mov eax, dword [ebp - 0x5a0]
dec eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0xfffffffb
jle 0x46ffb0
cmp dword [ebp - 0x2284], 0
je 0x46ffae
jmp 0x46ffb0
jmp 0x46ff8d
mov eax, dword [ebp - 0x228c]
mov dword [ebp - 0x2294], eax
mov dword [ebp - 0x1b08], 0xfffffffb
mov dword [ebp - 0x4ec], 0xfffffff8
mov dword [ebp - 0x98], 0x12a30a4c
mov dword [ebp - 0x1f40], 0xd0cd8a6c
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x7d8], 0
jmp 0x470007
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 2
jge 0x470023
mov eax, dword [ebp - 0x7d8]
mov dword [ebp + eax*4 - 0x27b8], 0x7b59
jmp 0x46fffa
mov dword [ebp - 0x4ec], 0
jmp 0x47003c
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0xfffffff4
jge 0x47065d
mov dword [ebp - 0x720], 0x9ecf4a41
mov dword [ebp - 0x2894], 8
mov dword [ebp - 0x2890], 8
mov dword [ebp - 0x288c], 8
mov dword [ebp - 0x2888], 8
lea ecx, [ebp - 0xaed]
call fcn.00434a2b
push eax
lea eax, [ebp - 0x2884]
push eax
lea eax, [ebp - 0x2894]
push eax
lea ecx, [ebp - 0x344c]
call fcn.00434a2e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x88c]
call fcn.004349da
mov dword [ebp - 0x229c], 0x5b292197
mov dword [ebp - 0x5a8], 0
jmp 0x4700d3
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 2
jge 0x4700ef
mov eax, dword [ebp - 0x5a8]
mov dword [ebp + eax*4 - 0x3110], 0x9e61979b
jmp 0x4700c6
xor eax, eax
inc eax
je 0x4705c2
mov dword [ebp - 4], 0xfffffff8
mov dword [ebp - 0x1f18], 0xfffffffc
mov dword [ebp - 0xb08], 0x9ed994ad
mov dword [ebp - 0x1f28], 0x8f3b1ad3
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
je 0x470134
cmp dword [ebp - 4], 0
jne 0x470134
and dword [ebp - 0x1ee8], 0
jmp 0x47013e
mov dword [ebp - 0x1ee8], 1
mov eax, dword [ebp - 0x720]
cmp dword [ebp - 0x1ee8], eax
jl 0x470158
mov dword [ebp - 0x1ef8], 1
jmp 0x47015f
and dword [ebp - 0x1ef8], 0
cmp dword [ebp - 0x98], 1
jg 0x470174
mov dword [ebp - 0x1ef0], 1
jmp 0x47017b
and dword [ebp - 0x1ef0], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1ef0], eax
je 0x470192
mov dword [ebp - 0x1f00], 1
jmp 0x470199
and dword [ebp - 0x1f00], 0
mov eax, dword [ebp - 0x1ef8]
cmp eax, dword [ebp - 0x1f00]
jle 0x4701b3
mov dword [ebp - 0x1f08], 1
jmp 0x4701ba
and dword [ebp - 0x1f08], 0
mov eax, dword [ebp - 0x720]
add eax, dword [ebp - 0x1f08]
cmp eax, dword [ebp - 0x98]
cmp dword [ebp - 0x720], 0xfff9
jae 0x4701e4
mov dword [ebp - 0x1f10], 1
jmp 0x4701eb
and dword [ebp - 0x1f10], 0
push 0
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1f10]
mov dword [eax], ecx
mov dword [ebp - 4], 0
jmp 0x470210
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x4705bd
mov dword [ebp - 0x1fa0], 0xe48991cd
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov dword [ebp - 0x1f18], 0x7127
mov eax, dword [ebp - 0x1f18]
mov dword [ebp - 0x30ac], eax
mov dword [ebp - 0xb08], 0x879a2734
mov esi, dword [ebp - 0xb08]
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
cmp esi, dword [eax]
jl 0x470276
mov dword [ebp - 0x1f20], 1
jmp 0x47027d
and dword [ebp - 0x1f20], 0
mov eax, dword [ebp - 0x1f20]
mov dword [ebp - 0x1f28], eax
cmp dword [ebp - 0x1f28], 1
ja 0x4702a4
cmp dword [ebp - 0x720], 0
jne 0x4702a4
and dword [ebp - 0x1f30], 0
jmp 0x4702ae
mov dword [ebp - 0x1f30], 1
cmp dword [ebp - 0x1f30], 2
jne 0x4702c3
mov dword [ebp - 0x1f38], 1
jmp 0x4702ca
and dword [ebp - 0x1f38], 0
mov eax, dword [ebp - 0x1f38]
mov dword [ebp - 0x1f40], eax
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x1f40], eax
jge 0x4702f0
mov dword [ebp - 0x1f48], 1
jmp 0x4702f7
and dword [ebp - 0x1f48], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1f48], eax
jg 0x47031a
cmp dword [ebp - 0x2bc], 0
je 0x47031a
mov dword [ebp - 0x1f50], 1
jmp 0x470321
and dword [ebp - 0x1f50], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1f50], eax
jle 0x470338
mov dword [ebp - 0x1f58], 1
jmp 0x47033f
and dword [ebp - 0x1f58], 0
cmp dword [ebp - 0x1f58], 0
jl 0x470354
mov dword [ebp - 0x1f60], 1
jmp 0x47035b
and dword [ebp - 0x1f60], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1f60], eax
jne 0x470375
mov dword [ebp - 0x1f68], 1
jmp 0x47037c
and dword [ebp - 0x1f68], 0
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1f68]
jne 0x4703c6
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
cmp dword [eax], 0
je 0x4703c6
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
cmp dword [eax], 0
je 0x4703c6
mov dword [ebp - 0x1f70], 1
jmp 0x4703cd
and dword [ebp - 0x1f70], 0
cmp dword [ebp - 0x1f70], 0xffffffff
jg 0x4703e2
mov dword [ebp - 0x1f78], 1
jmp 0x4703e9
and dword [ebp - 0x1f78], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1f78], eax
jne 0x470403
mov dword [ebp - 0x1f80], 1
jmp 0x47040a
and dword [ebp - 0x1f80], 0
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1f80]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 4]
jg 0x470431
mov dword [ebp - 0x1f88], 1
jmp 0x470438
and dword [ebp - 0x1f88], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1f88], eax
jge 0x47044f
mov dword [ebp - 0x1f90], 1
jmp 0x470456
and dword [ebp - 0x1f90], 0
mov eax, dword [ebp - 0x4ec]
imul eax, dword [ebp - 0x1f90]
mov dword [ebp - 0x2bc], eax
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
cmp dword [eax], 0
je 0x4704c8
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
cmp dword [eax], 3
jle 0x47049b
mov dword [ebp - 0x1f98], 1
jmp 0x4704a2
and dword [ebp - 0x1f98], 0
mov eax, dword [ebp - 0x1f98]
mov dword [ebp - 0x1fa0], eax
mov eax, dword [ebp - 0x229c]
cmp dword [ebp - 0x1fa0], eax
jle 0x4704c8
mov dword [ebp - 0x1fa8], 1
jmp 0x4704cf
and dword [ebp - 0x1fa8], 0
push 0
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1fa8]
cmp dword [eax], ecx
jg 0x4704f5
mov dword [ebp - 0xc88], 1
jmp 0x4704fc
and dword [ebp - 0xc88], 0
push 0
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov ecx, dword [ebp - 0xc88]
cmp ecx, dword [eax]
jne 0x47051f
mov dword [ebp - 0x1a20], 1
jmp 0x470526
and dword [ebp - 0x1a20], 0
cmp dword [ebp - 0x1a20], 0x40c5
jle 0x47053e
mov dword [ebp - 0xc90], 1
jmp 0x470545
and dword [ebp - 0xc90], 0
cmp dword [ebp - 0xc90], 7
je 0x47055a
mov dword [ebp - 0x1a28], 1
jmp 0x470561
and dword [ebp - 0x1a28], 0
push 2
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
mov esi, dword [eax]
imul esi, dword [ebp - 0x1a28]
push dword [ebp - 4]
lea ecx, [ebp - 0x88c]
call fcn.00434a1c
add esi, dword [eax]
cmp esi, dword [ebp - 4]
je 0x470598
mov dword [ebp - 0xc98], 1
jmp 0x47059f
and dword [ebp - 0xc98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3110]
add eax, dword [ebp - 0xc98]
mov dword [ebp - 0xb08], eax
jmp 0x470209
jmp 0x47064d
push 4
lea ecx, [ebp - 0x2a18]
call fcn.0043492e
mov dword [ebp - 0x5b0], 0
jmp 0x4705e8
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 4
jge 0x47060a
push dword [ebp - 0x5b0]
lea ecx, [ebp - 0x2a18]
call fcn.00434a1c
mov dword [eax], 3
jmp 0x4705db
mov dword [ebp - 0x2bc], 0
jmp 0x470623
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xffffffe3
jne 0x470642
push 3
lea ecx, [ebp - 0x2a18]
call fcn.00434a1c
cmp dword [eax], 0
je 0x470640
jmp 0x470642
jmp 0x470616
lea ecx, [ebp - 0x2a18]
call fcn.00434a00
lea ecx, [ebp - 0x88c]
call fcn.00434a00
jmp 0x47002f
mov dword [ebp - 0x98], 0
jmp 0x470676
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jg 0x47069b
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp + eax*4 - 0x27b8]
mov dword [ebp + ecx*4 - 0x27b8], eax
jmp 0x470669
push 2
lea ecx, [ebp - 0x2774]
call fcn.0043492e
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb10], 1
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0xca0], 4
mov dword [ebp - 0xa68], 0xfffe
mov byte [ebp - 0x25c], 0
movzx eax, byte [ebp - 0x25c]
test eax, eax
je 0x470703
push 0x2677
push 0xc38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xb10], eax
je 0x470729
mov dword [ebp - 0xcb0], 1
jmp 0x470730
and dword [ebp - 0xcb0], 0
cmp dword [ebp - 0x1e0], 0
je 0x47076f
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x1e0], eax
jne 0x470753
mov dword [ebp - 0x1a30], 1
jmp 0x47075a
and dword [ebp - 0x1a30], 0
mov eax, dword [ebp - 0x1a30]
mov dword [ebp - 0xca0], eax
cmp dword [ebp - 0xca0], 0
jne 0x470781
cmp dword [ebp - 0x1e0], 0
jne 0x470781
and dword [ebp - 0x1a38], 0
jmp 0x47078b
mov dword [ebp - 0x1a38], 1
cmp dword [ebp - 0x1a38], 0xfc6088b9
ja 0x4707a3
mov dword [ebp - 0xca8], 1
jmp 0x4707aa
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xca8], eax
jge 0x4707c4
mov dword [ebp - 0x1a40], 1
jmp 0x4707cb
and dword [ebp - 0x1a40], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x1a40], eax
jle 0x4707e5
mov dword [ebp - 0x1a48], 1
jmp 0x4707ec
and dword [ebp - 0x1a48], 0
mov eax, dword [ebp - 0xcb0]
imul eax, dword [ebp - 0x1a48]
test eax, eax
jne 0x47080f
cmp dword [ebp - 0xa68], 0
jne 0x47080f
and dword [ebp - 0xcb8], 0
jmp 0x470819
mov dword [ebp - 0xcb8], 1
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xb18]
imul eax, dword [ebp - 0xcb8]
cmp eax, dword [ebp - 0xa68]
jl 0x470846
mov dword [ebp - 0x1a50], 1
jmp 0x47084d
and dword [ebp - 0x1a50], 0
mov eax, dword [ebp - 0x1a50]
add eax, 0x67f5
imul eax, dword [ebp - 0xa68]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x47c], 0x40d7f825
mov dword [ebp - 0x47c], 0
jmp 0x470888
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0x11
jge 0x4709a4
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x438], 0xfffffffd
jmp 0x4708b8
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0xffffffe8
jl 0x470994
mov dword [ebp - 0x920], 0x357257e
mov dword [ebp - 0x22a4], 0xffffffff
cmp dword [ebp - 0x438], 0
jne 0x4708ee
mov dword [ebp - 0xcc0], 1
jmp 0x4708f5
and dword [ebp - 0xcc0], 0
cmp dword [ebp - 0xcc0], 0xfffffffe
jne 0x47090a
mov dword [ebp - 0x1a60], 1
jmp 0x470911
and dword [ebp - 0x1a60], 0
cmp dword [ebp - 0x920], 1
jne 0x47092c
cmp dword [ebp - 0x920], 0
jne 0x47092c
and dword [ebp - 0x1a58], 0
jmp 0x470936
mov dword [ebp - 0x1a58], 1
cmp dword [ebp - 0x1a58], 0xba44
jle 0x47094e
mov dword [ebp - 0xcc8], 1
jmp 0x470955
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0xcc8]
sub eax, dword [ebp - 0x920]
cmp eax, dword [ebp - 0x438]
jg 0x470975
mov dword [ebp - 0xcd0], 1
jmp 0x47097c
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x1a60]
imul eax, dword [ebp - 0xcd0]
mov dword [ebp - 0x22a4], eax
jmp 0x4708ab
cmp dword [ebp - 0x47c], 0
je 0x47099f
jmp 0x4709a4
jmp 0x47087b
mov dword [ebp - 0x5b8], 0x75c9
mov dword [ebp - 0x524], 0x2f4a8b10
push 4
lea ecx, [ebp - 0x2fa8]
call fcn.0043492e
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x838], 0
jmp 0x4709e8
mov eax, dword [ebp - 0x838]
inc eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 4
jge 0x470a0a
push dword [ebp - 0x838]
lea ecx, [ebp - 0x2fa8]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x4709db
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x5b8], 0
jmp 0x470a30
mov eax, dword [ebp - 0x5b8]
dec eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0xfffffff3
jl 0x470ca6
mov dword [ebp - 0xe8], 7
mov dword [ebp - 0xce8], 5
mov dword [ebp - 0x524], 0
jmp 0x470a6a
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0xfffffffa
jl 0x470af0
mov dword [ebp - 0x114], 0
jmp 0x470a8c
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xc
je 0x470ade
mov dword [ebp - 0x728], 0
jmp 0x470aae
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 2
jge 0x470aca
mov eax, dword [ebp - 0x728]
mov dword [ebp + eax*4 - 0x2e9c], 0
jmp 0x470aa1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2e9c], 0
je 0x470adc
jmp 0x470ade
jmp 0x470a7f
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
jmp 0x470a5d
cmp dword [ebp - 0xe8], 0
je 0x470b0e
cmp dword [ebp - 0x524], 0
je 0x470b0e
mov dword [ebp - 0xce0], 1
jmp 0x470b15
and dword [ebp - 0xce0], 0
cmp dword [ebp - 0xe8], 0
jne 0x470b30
mov eax, 0xd8339896
test eax, eax
jne 0x470b30
and dword [ebp - 0x1a68], 0
jmp 0x470b3a
mov dword [ebp - 0x1a68], 1
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x1a68]
jg 0x470b54
mov dword [ebp - 0xcd8], 1
jmp 0x470b5b
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xcd8], eax
jne 0x470b75
mov dword [ebp - 0x1a70], 1
jmp 0x470b7c
and dword [ebp - 0x1a70], 0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x1a70]
sub eax, ecx
sub eax, dword [ebp - 0xe8]
cmp eax, 2
je 0x470ba7
mov dword [ebp - 0x1a78], 1
jmp 0x470bae
and dword [ebp - 0x1a78], 0
mov eax, dword [ebp - 0xce0]
cmp eax, dword [ebp - 0x1a78]
je 0x470bf3
mov byte [ebp - 0x25e], 0
movzx eax, byte [ebp - 0x25e]
test eax, eax
je 0x470bee
push 0
push 0x60d
push 0x1cd9
push 0
push 0x25f2
push 0xba8
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x470ca1
mov dword [ebp - 0x22ac], 0x1f0ef2f3
mov dword [ebp - 0x22b4], 0xffffffff
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x2e38], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x3294], eax
imul eax, dword [ebp - 0x114], 5
imul eax, dword [ebp - 0x114]
add eax, 0x5c958829
mov dword [ebp - 0xce8], eax
cmp dword [ebp - 0xce8], 0
jg 0x470c4d
mov dword [ebp - 0x1a80], 1
jmp 0x470c54
and dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0x22ac]
cmp eax, dword [ebp - 0x1a80]
je 0x470c6e
mov dword [ebp - 0xcf0], 1
jmp 0x470c75
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x22b4], eax
mov byte [ebp - 0x260], 0
movzx eax, byte [ebp - 0x260]
test eax, eax
je 0x470ca1
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x470a23
lea ecx, [ebp - 0x2fa8]
call fcn.00434a00
mov dword [ebp - 0xc], 0
jmp 0x470cc1
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x470cdd
push dword [ebp - 0xc]
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
mov dword [eax], 9
jmp 0x470cba
mov dword [ebp - 0x184], 0x3f4f46db
mov dword [ebp - 0x3d0], 0xfac1
mov dword [ebp - 0x5c0], 0
jmp 0x470d0a
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 3
jge 0x470d26
mov eax, dword [ebp - 0x5c0]
mov dword [ebp + eax*4 - 0x2a24], 0xffffffff
jmp 0x470cfd
mov dword [ebp - 0x184], 0
jmp 0x470d3f
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jg 0x470e34
mov dword [ebp - 0x2e40], 1
mov dword [ebp - 0x30bc], 0xc3707822
mov eax, dword [ebp - 0x184]
cmp dword [ebp + eax*4 - 0x2a24], 0
je 0x470dd4
mov dword [ebp - 0x2e48], 1
mov dword [ebp - 0x3238], 0xffffffff
mov dword [ebp - 0x3234], 0xffffffff
mov dword [ebp - 0x3230], 0xffffffff
mov dword [ebp - 0x322c], 0xffffffff
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
mov byte [ebp - 0x262], 0
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x470dd2
push 0
push 1
push 0xf6f
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
jmp 0x470e2f
mov dword [ebp - 0x3200], 0
mov dword [ebp - 0x22bc], 0xc8b166c1
mov byte [ebp - 0x264], 0
movzx eax, byte [ebp - 0x264]
test eax, eax
je 0x470e00
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2a24], 1
jge 0x470e1c
mov dword [ebp - 0x1a88], 1
jmp 0x470e23
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1a88]
mov dword [ebp - 0x22bc], eax
jmp 0x470d32
mov dword [ebp - 0x3d0], 0xfffffff0
jmp 0x470e4d
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x3c
jge 0x470f9a
mov dword [ebp - 0x184], 0
jmp 0x470e73
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jg 0x470f95
push 2
lea ecx, [ebp - 0x2530]
call fcn.0043492e
mov dword [ebp - 0x7e0], 0
jmp 0x470ea6
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 2
jge 0x470ec8
push dword [ebp - 0x7e0]
lea ecx, [ebp - 0x2530]
call fcn.00434a1c
mov dword [eax], 0x8ceef9a8
jmp 0x470e99
push 1
lea ecx, [ebp - 0x2530]
call fcn.00434a1c
mov dword [eax], 2
jmp 0x470f01
push 1
lea ecx, [ebp - 0x2530]
call fcn.00434a1c
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0xcf8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xcf8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2530]
call fcn.00434a1c
cmp dword [eax], 0
jl 0x470f85
mov dword [ebp - 0x5c8], 0x67b38eb1
mov dword [ebp - 0x5c8], 2
jmp 0x470f36
mov eax, dword [ebp - 0x5c8]
dec eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 0
jl 0x470f80
mov dword [ebp - 0x484], 0xffffffff
mov dword [ebp - 0x484], 0
jmp 0x470f62
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 3
jge 0x470f7e
mov eax, dword [ebp - 0x484]
mov dword [ebp + eax*4 - 0x2a24], 2
jmp 0x470f55
jmp 0x470f29
jmp 0x470edd
lea ecx, [ebp - 0x2530]
call fcn.00434a00
jmp 0x470e66
jmp 0x470e40
mov dword [ebp - 0xc], 0
jmp 0x470faa
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x470fc0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2344], 0x585b7f3
jmp 0x470fa3
push 1
lea ecx, [ebp - 0xc1c]
call fcn.0043492e
mov dword [ebp - 0x22c4], 0x198ab79
mov dword [ebp - 0x2e50], 0xffffffff
mov dword [ebp - 0x30cc], 0x702377d6
mov dword [ebp - 0x2e58], 0x9a2a67f6
mov dword [ebp - 0x3298], 0x6a1c3d07
mov dword [ebp - 0x2e60], 0xffffffff
mov dword [ebp - 0x1ab0], 0xe30eca6d
mov dword [ebp - 0x730], 0
jmp 0x47102c
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 1
jge 0x47104e
push dword [ebp - 0x730]
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
mov dword [eax], 0xdb3ae355
jmp 0x47101f
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
and dword [eax], 0
jmp 0x471084
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
mov dword [ebp - 0x1a90], eax
mov eax, dword [ebp - 0x1a90]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a90]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
cmp dword [eax], 0xa
jle 0x47127c
mov dword [ebp - 0x1ec], 0x59d5
mov dword [ebp - 0x1a98], 5
mov dword [ebp - 0x2334], 0
mov dword [ebp - 0x30dc], 0xffffffff
push 2
lea ecx, [ebp - 0x2fb8]
call fcn.0043492e
mov dword [ebp - 0x5d0], 0
jmp 0x4710e8
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 2
jge 0x47110a
push dword [ebp - 0x5d0]
lea ecx, [ebp - 0x2fb8]
call fcn.00434a1c
mov dword [eax], 0x3acdd711
jmp 0x4710db
cmp dword [ebp - 0x1ec], 0
jne 0x47121f
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x1ec], eax
jle 0x471131
mov dword [ebp - 0xd00], 1
jmp 0x471138
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0x1a98], eax
mov eax, dword [ebp - 0x1a98]
inc eax
mov esi, dword [ebp - 0x1ec]
sub esi, eax
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
cmp esi, dword [eax]
jl 0x471182
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
cmp dword [eax], 0
je 0x471182
mov dword [ebp - 0xd08], 1
jmp 0x471189
and dword [ebp - 0xd08], 0
mov esi, dword [ebp - 0x1ec]
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
mov ecx, dword [ebp - 0xd08]
imul ecx, dword [eax]
imul esi, ecx
imul esi, dword [ebp - 0x22c4]
cmp esi, dword [ebp - 0x1ec]
jne 0x4711c3
mov dword [ebp - 0x1aa0], 1
jmp 0x4711ca
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x1aa0], eax
jne 0x4711e4
mov dword [ebp - 0xd10], 1
jmp 0x4711eb
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0xd10]
inc eax
cmp eax, dword [ebp - 0x1ec]
jge 0x471206
mov dword [ebp - 0x232c], 1
jmp 0x47120d
and dword [ebp - 0x232c], 0
mov eax, 0x2a3
test eax, eax
jne 0x47121f
and dword [ebp - 0x1aa8], 0
jmp 0x471229
mov dword [ebp - 0x1aa8], 1
push 0
lea ecx, [ebp - 0xc1c]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1aa8]
cmp ecx, dword [eax]
jne 0x47124c
mov dword [ebp - 0xd18], 1
jmp 0x471253
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0x2334], eax
mov eax, dword [ebp - 0x1ab0]
dec eax
mov dword [ebp - 0x1ab0], eax
lea ecx, [ebp - 0x2fb8]
call fcn.00434a00
jmp 0x471060
lea ecx, [ebp - 0xc1c]
call fcn.00434a00
mov dword [ebp - 0xc], 0
jmp 0x471297
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x4712b0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x2774]
call fcn.00434a1c
or dword [eax], 0xffffffff
jmp 0x471290
mov dword [ebp - 0x418], 0xfffffff6
mov dword [ebp - 0x418], 0
jmp 0x4712d3
mov eax, dword [ebp - 0x418]
dec eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xffffffed
jl 0x471316
mov byte [ebp - 0x266], 0
movzx eax, byte [ebp - 0x266]
test eax, eax
je 0x4712f6
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov byte [ebp - 0x268], 0
movzx eax, byte [ebp - 0x268]
test eax, eax
je 0x471314
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x4712c6
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2e68], eax
mov dword [ebp - 0x418], 0x8f8256a
mov dword [ebp - 0xc], 0
jmp 0x47133c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x471352
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3350], 2
jmp 0x471335
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x5d8], 0xfffffffb
mov dword [ebp - 0xa98], 0xfffffffc
mov dword [ebp - 0x1ae0], 0xc7a2e428
mov dword [ebp - 0x1ae8], 0xe35fe57b
push 1
lea ecx, [ebp - 0x2a30]
call fcn.0043492e
mov dword [ebp - 0x868], 0
jmp 0x4713a7
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 1
jge 0x4713c9
push dword [ebp - 0x868]
lea ecx, [ebp - 0x2a30]
call fcn.00434a1c
mov dword [eax], 0xea3821c7
jmp 0x47139a
mov eax, 0x92085949
test eax, eax
je 0x4713e4
cmp dword [ebp - 0x24], 0
je 0x4713e4
mov dword [ebp - 0xd20], 1
jmp 0x4713eb
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5d8], eax
jg 0x47140e
mov dword [ebp - 0x1ab8], 1
jmp 0x471415
and dword [ebp - 0x1ab8], 0
cmp dword [ebp - 0x1ab8], 0xcd04
jge 0x47142d
mov dword [ebp - 0xd28], 1
jmp 0x471434
and dword [ebp - 0xd28], 0
cmp dword [ebp - 0xd28], 0xffffffff
je 0x471449
mov dword [ebp - 0x1ac0], 1
jmp 0x471450
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1ac0], eax
je 0x47146b
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x47146b
and dword [ebp - 0xd30], 0
jmp 0x471475
mov dword [ebp - 0xd30], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd30], eax
jge 0x47148c
mov dword [ebp - 0x1ac8], 1
jmp 0x471493
and dword [ebp - 0x1ac8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1ac8], eax
jg 0x4714aa
mov dword [ebp - 0xd38], 1
jmp 0x4714b1
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd38], eax
jge 0x4714c8
mov dword [ebp - 0x1ad0], 1
jmp 0x4714cf
and dword [ebp - 0x1ad0], 0
cmp dword [ebp - 0x1ad0], 0xffffffff
jge 0x4714e4
mov dword [ebp - 0xd40], 1
jmp 0x4714eb
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd40], eax
jl 0x471502
mov dword [ebp - 0x1ad8], 1
jmp 0x471509
and dword [ebp - 0x1ad8], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1ad8]
jg 0x471520
mov dword [ebp - 0xd48], 1
jmp 0x471527
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x1ae0], eax
mov eax, dword [ebp - 0x1ae0]
mov dword [ebp - 0x3208], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5d8], eax
je 0x471562
mov dword [ebp - 0xd50], 1
jmp 0x471569
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0xd50]
mov dword [ebp - 0x1ae8], eax
mov eax, dword [ebp - 0x1ae8]
cmp dword [ebp - 0x24], eax
jne 0x471598
cmp dword [ebp - 0x5d8], 0
je 0x471598
mov dword [ebp - 0xd58], 1
jmp 0x47159f
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd58], eax
jge 0x4715b6
mov dword [ebp - 0x1af0], 1
jmp 0x4715bd
and dword [ebp - 0x1af0], 0
cmp dword [ebp - 0x1af0], 0xffff
jne 0x4715d5
mov dword [ebp - 0xd60], 1
jmp 0x4715dc
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0xd60]
add eax, dword [ebp - 0x24]
je 0x471600
cmp dword [ebp - 0xa98], 0
je 0x471600
mov dword [ebp - 0x1af8], 1
jmp 0x471607
and dword [ebp - 0x1af8], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1af8]
jg 0x47161e
mov dword [ebp - 0xd68], 1
jmp 0x471625
and dword [ebp - 0xd68], 0
push 0
lea ecx, [ebp - 0x2a30]
call fcn.00434a1c
mov ecx, dword [ebp - 0xd68]
mov dword [eax], ecx
mov eax, 0x273942
cmp eax, 0x3ed86378
jg 0x471652
mov dword [ebp - 0x1b00], 1
jmp 0x471659
and dword [ebp - 0x1b00], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1b00], eax
jge 0x471670
mov dword [ebp - 0xd70], 1
jmp 0x471677
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0xd70]
add eax, 0x18d38
je 0x4716a2
mov byte [ebp - 0x26a], 0
movzx eax, byte [ebp - 0x26a]
test eax, eax
je 0x4716a0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x4716c3
mov byte [ebp - 0x26c], 0
movzx eax, byte [ebp - 0x26c]
test eax, eax
je 0x4716c3
push 0x26b8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [ebp - 0x2a30]
call fcn.00434a00
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x471824
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x4717d4
mov dword [ebp - 0x1b08], 9
mov eax, dword [ebp - 0x1b08]
mov dword [ebp - 0xd78], eax
push 1
lea ecx, [ebp - 0x2774]
call fcn.00434a1c
mov ecx, dword [ebp - 0xd78]
mov dword [eax], ecx
cmp dword [ebp - 0xd78], 0
jne 0x471756
push 1
lea ecx, [ebp - 0x2774]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x471756
and dword [ebp - 0x233c], 0
jmp 0x471760
mov dword [ebp - 0x233c], 1
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
mov eax, 0x9fa
cmp eax, 0xfffffff6
jle 0x471783
mov dword [ebp - 0x1b10], 1
jmp 0x47178a
and dword [ebp - 0x1b10], 0
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1b10]
cmp ecx, dword [eax]
jl 0x4717ad
mov dword [ebp - 0xd80], 1
jmp 0x4717b4
and dword [ebp - 0xd80], 0
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
mov ecx, dword [ebp - 0xd80]
sub ecx, dword [eax]
jne 0x4717d4
and dword [ebp - 0xd88], 0
jmp 0x4717de
mov dword [ebp - 0xd88], 1
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x2344]
mov dword [ebp - 0x1b18], eax
push 0
lea ecx, [ebp - 0xc70]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1b18]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1b18]
mov eax, dword [eax]
imul eax, dword [ebp - 0xd88]
test eax, eax
jne 0x471824
and dword [ebp - 0x1b20], 0
jmp 0x47182e
mov dword [ebp - 0x1b20], 1
cmp dword [ebp - 0x1b20], 0x1023
jle 0x471846
mov dword [ebp - 0xd90], 1
jmp 0x47184d
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
sub eax, 4
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3350], eax
lea ecx, [ebp - 0x2774]
call fcn.00434a00
lea ecx, [ebp - 0xc70]
call fcn.00434a00
xor ecx, ecx
call fcn.00434c99
push eax
call fcn.00489a23
pop ecx
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0xa70], 6
push 3
lea ecx, [ebp - 0x291c]
call fcn.0043492e
mov dword [ebp - 0xdb8], 0xfffffffd
push 4
lea ecx, [ebp - 0x2910]
call fcn.0043492e
mov dword [ebp - 0x11c], 0
jmp 0x4718d5
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x4718f7
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x291c]
call fcn.00434a1c
mov dword [eax], 0xad901516
jmp 0x4718c8
mov dword [ebp - 0x11c], 0
jmp 0x471910
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x471932
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x2910]
call fcn.00434a1c
mov dword [eax], 0xdf2ab2bc
jmp 0x471903
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0xa70], 0
jne 0x47195a
mov eax, 0x5792
test eax, eax
jne 0x47195a
and dword [ebp - 0xda8], 0
jmp 0x471964
mov dword [ebp - 0xda8], 1
cmp dword [ebp - 0x40], 0
je 0x471985
mov eax, 0x2092
test eax, eax
je 0x471985
cmp dword [ebp - 0x40], 0
je 0x471985
mov dword [ebp - 0x234c], 1
jmp 0x47198c
and dword [ebp - 0x234c], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2e70], eax
cmp dword [ebp - 0x40], 0xfff7
je 0x4719aa
mov dword [ebp - 0x1b28], 1
jmp 0x4719b1
and dword [ebp - 0x1b28], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x1b28]
cmp eax, dword [ebp - 0x40]
jne 0x4719cc
mov dword [ebp - 0xd98], 1
jmp 0x4719d3
and dword [ebp - 0xd98], 0
cmp dword [ebp - 0xd98], 0
jne 0x4719eb
cmp dword [ebp - 0x40], 0
jne 0x4719eb
and dword [ebp - 0x1b30], 0
jmp 0x4719f5
mov dword [ebp - 0x1b30], 1
cmp dword [ebp - 0x1b30], 1
jne 0x471a0a
mov dword [ebp - 0xda0], 1
jmp 0x471a11
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0xda0]
cmp eax, dword [ebp - 0x40]
jle 0x471a2c
mov dword [ebp - 0x1b38], 1
jmp 0x471a33
and dword [ebp - 0x1b38], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1b38], eax
jg 0x471a53
mov eax, 0x881826fb
test eax, eax
je 0x471a53
mov dword [ebp - 0x928], 1
jmp 0x471a5a
and dword [ebp - 0x928], 0
push 0
lea ecx, [ebp - 0x291c]
call fcn.00434a1c
mov ecx, dword [ebp - 0x928]
mov dword [eax], ecx
cmp dword [ebp - 0x928], 0
jne 0x471a8a
mov eax, 0x4a2c930f
test eax, eax
jne 0x471a8a
and dword [ebp - 0x1b40], 0
jmp 0x471a94
mov dword [ebp - 0x1b40], 1
mov eax, dword [ebp - 0xda8]
cmp eax, dword [ebp - 0x1b40]
jge 0x471aae
mov dword [ebp - 0xdb0], 1
jmp 0x471ab5
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xdb0], eax
jg 0x471acc
mov dword [ebp - 0x1b48], 1
jmp 0x471ad3
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x1b48]
neg eax
mov dword [ebp - 0xdb8], eax
mov eax, dword [ebp - 0xdb8]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x2354], 1
jmp 0x471afd
imul esi, dword [ebp - 0xa70], 0xfffffff6
push 1
lea ecx, [ebp - 0x2910]
call fcn.00434a1c
mov dword [eax], esi
lea ecx, [ebp - 0x2910]
call fcn.00434a00
lea ecx, [ebp - 0x291c]
call fcn.00434a00
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x6c], 0xfffffffd
mov dword [ebp - 0x224], 1
mov dword [ebp - 0xa8], 0
jmp 0x471b5d
cmp dword [ebp - 0xa8], 7
jg 0x471fcd
mov dword [ebp - 0x2c4], 4
mov dword [ebp - 0x738], 0
jmp 0x471b8d
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 3
jge 0x471ba9
mov eax, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0xbe4], 0
jmp 0x471b80
mov eax, dword [ebp - 0xa8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xbe4]
jne 0x471bca
mov dword [ebp - 0x1b50], 1
jmp 0x471bd1
and dword [ebp - 0x1b50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe4]
imul eax, dword [ebp - 0x1b50]
test eax, eax
jne 0x471bfb
mov eax, 0x1b713623
test eax, eax
jne 0x471bfb
and dword [ebp - 0x235c], 0
jmp 0x471c05
mov dword [ebp - 0x235c], 1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x30ec], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe4]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x6c], eax
jge 0x471c38
mov dword [ebp - 0xdc0], 1
jmp 0x471c3f
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0xdc0]
jne 0x471c59
mov dword [ebp - 0x1b58], 1
jmp 0x471c60
and dword [ebp - 0x1b58], 0
cmp dword [ebp - 0x1b58], 0x1c33c017
jg 0x471c78
mov dword [ebp - 0xdc8], 1
jmp 0x471c7f
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xdc8], eax
jl 0x471c99
mov dword [ebp - 0x2364], 1
jmp 0x471ca0
and dword [ebp - 0x2364], 0
cmp dword [ebp - 0x6c], 0xe3f2f34e
jbe 0x471cb5
mov dword [ebp - 0x930], 1
jmp 0x471cbc
and dword [ebp - 0x930], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x930]
mov dword [ebp + eax - 0xbe4], ecx
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x930]
jne 0x471cef
mov dword [ebp - 0x5e0], 0xdb3ae355
mov dword [ebp - 0x48c], 0xeb905d09
mov dword [ebp - 0x5e0], 0
jmp 0x471ffa
mov eax, dword [ebp - 0x5e0]
dec eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0xffffffee
je 0x4720d7
mov dword [ebp - 0xaa0], 1
mov eax, dword [ebp - 0xaa0]
dec eax
mov dword [ebp - 0xaa0], eax
je 0x47204d
cmp dword [ebp - 0x48c], 0
je 0x47202e
jmp 0x4720d7
mov byte [ebp - 0x270], 0
movzx eax, byte [ebp - 0x270]
test eax, eax
je 0x472048
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x4720d2
mov dword [ebp - 0x48c], 0
jmp 0x472066
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0xe
je 0x4720d2
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x4720d0
push 0xf72
push 0x1ea3
push 0x1bfe
push 0xfe3
push 0x1aef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x11db
push 0x25e0
push 0x1d5a
push 0x1dc5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x472059
jmp 0x471fed
mov dword [ebp - 0x2394], 0xbd97a888
mov dword [ebp - 0x7e8], 0xfffffffb
mov dword [ebp - 0x238c], 0xf1d8987f
mov dword [ebp - 0x18c], 0
jmp 0x47210e
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x47212a
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x3380], 5
jmp 0x472101
mov dword [ebp - 0x18c], 0
jmp 0x472143
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x47215f
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x22dc], 0xefa20bd0
jmp 0x472136
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3380]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x22dc]
mov dword [ebp - 0x2384], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22dc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x22dc], eax
cmp dword [ebp - 0x2384], 0
je 0x4721c2
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x4721c0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x472207
mov dword [ebp - 0x239c], 4
mov dword [ebp - 0x7e8], 0xa
jmp 0x4721e5
cmp dword [ebp - 0x7e8], 0xfffffffb
jle 0x4721fb
cmp dword [ebp - 0x238c], 0
je 0x4721f9
mov eax, dword [ebp - 0x2394]
mov dword [ebp - 0x239c], eax
mov dword [ebp - 0x48], 0xfffffffa
push 1
lea ecx, [ebp - 0x578]
call fcn.0043492e
mov dword [ebp - 0x20], 0x2971c1ec
mov dword [ebp - 0x1b88], 0x4951162d
mov dword [ebp - 0x5e8], 0
jmp 0x472245