Function at 0x472364
Capabilities:
Accept command line arguments
Compare security identifiers
Create directory
Create process on windows
Get common file path
Get disk information
Hide graphical window
Identify system language via api
Modify service
Read .ini file
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x394c
call fcn.004a9d20
push esi
push edi
push 2
lea ecx, [ebp - 0xb50]
call fcn.0043486b
mov dword [ebp - 0x58], 0xb02971c1
mov dword [ebp - 0x318], 7
mov dword [ebp - 0x5c4], 0
jmp 0x4723aa
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 2
jge 0x4723cc
push dword [ebp - 0x5c4]
lea ecx, [ebp - 0xb50]
call fcn.00434959
mov dword [eax], 1
jmp 0x47239d
mov dword [ebp - 0x58], 1
jmp 0x4723dc
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x4725f1
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
cmp dword [eax], 0
je 0x472414
mov eax, 0x21af
test eax, eax
je 0x472414
cmp dword [ebp - 0x58], 0
je 0x472414
mov dword [ebp - 0x1814], 1
jmp 0x47241b
and dword [ebp - 0x1814], 0
cmp dword [ebp - 0x1814], 0xc88e
jle 0x472433
mov dword [ebp - 0x1fd8], 1
jmp 0x47243a
and dword [ebp - 0x1fd8], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
mov ecx, dword [ebp - 0x1fd8]
cmp ecx, dword [eax]
jne 0x47245e
mov dword [ebp - 0x1fe0], 1
jmp 0x472465
and dword [ebp - 0x1fe0], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
push 0
lea ecx, [ebp - 0xb50]
call fcn.00434959
mov esi, dword [ebp - 0x58]
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
cmp esi, dword [eax]
jge 0x4724b7
mov byte [ebp - 0x2ba], 0
movzx eax, byte [ebp - 0x2ba]
test eax, eax
je 0x4724b2
push 0xe8d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x4725cb
mov dword [ebp - 0x774], 0x58efa97f
mov dword [ebp - 0x954], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 0
cmp dword [ebp - 0x318], 0xd2ae857b
jbe 0x472519
cmp dword [ebp - 0x774], 0
je 0x472519
mov dword [ebp - 0x1fe8], 1
jmp 0x472520
and dword [ebp - 0x1fe8], 0
cmp dword [ebp - 0x1fe8], 0
jne 0x472535
mov dword [ebp - 0x1ff0], 1
jmp 0x47253c
and dword [ebp - 0x1ff0], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
mov ecx, dword [ebp - 0x1ff0]
cmp ecx, dword [eax]
je 0x472560
mov dword [ebp - 0x1ff8], 1
jmp 0x472567
and dword [ebp - 0x1ff8], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb50]
call fcn.00434959
mov eax, dword [eax]
sub eax, dword [ebp - 0x1ff8]
cmp eax, 0xc0ec
jle 0x472590
mov dword [ebp - 0x225c], 1
jmp 0x472597
and dword [ebp - 0x225c], 0
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x351c], eax
cmp dword [ebp - 0x954], 0
ja 0x4725b8
mov dword [ebp - 0x2000], 1
jmp 0x4725bf
and dword [ebp - 0x2000], 0
mov eax, dword [ebp - 0x2000]
mov dword [ebp - 0x954], eax
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x4725ec
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
jmp 0x4723d5
mov dword [ebp - 0x318], 0x1b
jmp 0x47260a
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 9
jle 0x47263c
mov dword [ebp - 0x2384], 0x50c19791
mov dword [ebp - 0x238c], 0xdb956746
mov eax, dword [ebp - 0x2384]
neg eax
add eax, 0x14898d08
mov dword [ebp - 0x238c], eax
jmp 0x4725fd
lea ecx, [ebp - 0xb50]
call fcn.0043493d
mov dword [ebp - 0x2008], 6
mov dword [ebp - 0x18], 0x65e08ccc
mov dword [ebp - 0x5cc], 0x9b857552
mov dword [ebp - 0x2a04], 0xfcc8
mov dword [ebp - 0x2a00], 0xfcc8
mov dword [ebp - 0x29fc], 0xfcc8
mov dword [ebp - 0x29f8], 0xfcc8
lea ecx, [ebp - 0xadd]
call fcn.00434968
push eax
lea eax, [ebp - 0x29f4]
push eax
lea eax, [ebp - 0x2a04]
push eax
lea ecx, [ebp - 0x37d0]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2d78]
call fcn.00434917
mov dword [ebp - 0x239c], 0xe55b65ab
mov dword [ebp - 0x23a4], 0x1043
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x4726e7
mov dword [ebp - 0x201c], 1
jmp 0x4726ee
and dword [ebp - 0x201c], 0
mov dword [ebp - 0x2008], 0
mov eax, dword [ebp - 0x2008]
cmp eax, dword [ebp - 0x201c]
jge 0x472712
mov dword [ebp - 0x2034], 1
jmp 0x472719
and dword [ebp - 0x2034], 0
cmp dword [ebp - 0x18], 0
je 0x472787
mov eax, dword [ebp - 0x18]
add eax, 0x6b180fba
je 0x47273b
cmp dword [ebp - 0x18], 0
je 0x47273b
mov dword [ebp - 0x2394], 1
jmp 0x472742
and dword [ebp - 0x2394], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x352c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x321c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34cc], eax
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x3224], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x5cc]
je 0x472787
mov dword [ebp - 0x2024], 1
jmp 0x47278e
and dword [ebp - 0x2024], 0
cmp dword [ebp - 0x2024], 0
jl 0x4727a3
mov dword [ebp - 0x202c], 1
jmp 0x4727aa
and dword [ebp - 0x202c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x202c], eax
jl 0x4727c1
mov dword [ebp - 0x203c], 1
jmp 0x4727c8
and dword [ebp - 0x203c], 0
mov eax, dword [ebp - 0x2034]
cmp eax, dword [ebp - 0x203c]
jg 0x4727e2
mov dword [ebp - 0x2044], 1
jmp 0x4727e9
and dword [ebp - 0x2044], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2044]
add eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x18]
jg 0x47282d
mov dword [ebp - 0x18], 0
jmp 0x47280d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x47282b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2d78]
call fcn.00434959
mov eax, dword [eax]
mov dword [ebp - 0x239c], eax
jmp 0x472806
jmp 0x472861
push 1
lea ecx, [ebp - 0x2d78]
call fcn.00434959
cmp dword [eax], 0x35a7ab5b
jge 0x47284e
mov dword [ebp - 0x204c], 1
jmp 0x472855
and dword [ebp - 0x204c], 0
mov eax, dword [ebp - 0x204c]
mov dword [ebp - 0x23a4], eax
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x47288d
push 0x5cd
push 0x1ba9
push 0x14f5
push 0x262e
call dword [sym.imp.GDI32.dll_CreateRectRgn]
lea ecx, [ebp - 0x2d78]
call fcn.0043493d
mov dword [ebp - 0x480], 0xffffffff
mov dword [ebp - 0x4d0], 0xf3f6
mov dword [ebp - 0x5d4], 0xfffffffd
mov dword [ebp - 0x23b4], 0x5cc7c44d
mov dword [ebp - 0x207c], 0x7440271d
mov dword [ebp - 0x77c], 0
jmp 0x4728e3
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 2
jge 0x4728ff
mov eax, dword [ebp - 0x77c]
mov dword [ebp + eax*4 - 0x2eb8], 0
jmp 0x4728d6
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x47291d
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x3534], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x2e4c], eax
imul eax, dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], eax
je 0x472950
mov dword [ebp - 0x2054], 1
jmp 0x472957
and dword [ebp - 0x2054], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x2054], eax
jl 0x47296e
cmp dword [ebp - 0x5d4], 0
je 0x472977
mov eax, 0x90412894
test eax, eax
jne 0x472989
cmp dword [ebp - 0x480], 0
jne 0x472989
and dword [ebp - 0x205c], 0
jmp 0x472993
mov dword [ebp - 0x205c], 1
imul eax, dword [ebp - 0x205c], 0x14b1
cmp eax, 9
jge 0x4729ae
mov dword [ebp - 0x23ac], 1
jmp 0x4729b5
and dword [ebp - 0x23ac], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x2e54], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x2e5c], eax
cmp dword [ebp - 0x4d0], 3
jae 0x4729e2
mov dword [ebp - 0x2064], 1
jmp 0x4729e9
and dword [ebp - 0x2064], 0
mov eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x2064]
jl 0x472a03
mov dword [ebp - 0x206c], 1
jmp 0x472a0a
and dword [ebp - 0x206c], 0
mov eax, dword [ebp - 0x23b4]
cmp dword [ebp - 0x206c], eax
je 0x472a24
mov dword [ebp - 0x2074], 1
jmp 0x472a2b
and dword [ebp - 0x2074], 0
mov eax, dword [ebp - 0x2074]
mov dword [ebp - 0x207c], eax
cmp dword [ebp - 0x207c], 0
jne 0x472a52
mov eax, 0xebf3b8cf
test eax, eax
jne 0x472a52
and dword [ebp - 0x23bc], 0
jmp 0x472a5c
mov dword [ebp - 0x23bc], 1
mov eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0x5d4], eax
jle 0x472a76
mov dword [ebp - 0x2084], 1
jmp 0x472a7d
and dword [ebp - 0x2084], 0
mov eax, dword [ebp - 0x480]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2eb8]
cmp dword [ebp - 0x480], eax
jg 0x472ab6
mov byte [ebp - 0x2ad], 0
movzx eax, byte [ebp - 0x2ad]
test eax, eax
je 0x472ab4
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x472ad6
mov byte [ebp - 0x2af], 0
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x472ad6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 2
lea ecx, [ebp - 0xb44]
call fcn.0043486b
mov dword [ebp - 0x2204], 1
mov dword [ebp - 0x2200], 1
mov dword [ebp - 0x21fc], 1
mov dword [ebp - 0x21f8], 1
mov dword [ebp - 0x54c], 5
mov dword [ebp - 0x43c], 0xe7ed6f18
mov dword [ebp - 0x2548], 0xaea381e1
push 1
lea ecx, [ebp - 0x2b20]
call fcn.0043486b
mov dword [ebp - 0x1ac], 0
jmp 0x472b4f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 4
jge 0x472b6b
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x36dc], 0
jmp 0x472b42
mov dword [ebp - 0x1ac], 0
jmp 0x472b84
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x472ba6
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x2b20]
call fcn.00434959
mov dword [eax], 0xf8a4198f
jmp 0x472b77
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2204]
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x54c], 0
jmp 0x472bd2
mov eax, dword [ebp - 0x54c]
dec eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xfffffff0
jge 0x472ebd
mov dword [ebp - 0x850], 0xe39e3cf9
mov dword [ebp - 0x23c4], 4
mov dword [ebp - 0x5dc], 0xffffffff
mov dword [ebp - 0xbb8], 3
push 3
lea ecx, [ebp - 0x2874]
call fcn.0043486b
mov dword [ebp - 0x780], 0
jmp 0x472c2d
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 3
jge 0x472c4c
push dword [ebp - 0x780]
lea ecx, [ebp - 0x2874]
call fcn.00434959
and dword [eax], 0
jmp 0x472c20
mov eax, dword [ebp - 0x23c4]
cmp dword [ebp - 0x850], eax
jg 0x472c66
mov dword [ebp - 0x208c], 1
jmp 0x472c6d
and dword [ebp - 0x208c], 0
mov eax, dword [ebp - 0x208c]
mov dword [ebp - 0x43c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2204]
cmp eax, dword [ebp - 0x43c]
jg 0x472c9a
mov dword [ebp - 0x2094], 1
jmp 0x472ca1
and dword [ebp - 0x2094], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2204]
mov dword [ebp - 0x2e64], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2204]
mov dword [ebp - 0x2e6c], eax
mov eax, dword [ebp - 0x850]
imul eax, dword [ebp - 0x2094]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x5dc]
neg eax
cmp eax, dword [ebp - 0x5dc]
jne 0x472cf6
mov dword [ebp - 0x104c], 1
jmp 0x472cfd
and dword [ebp - 0x104c], 0
push 1
lea ecx, [ebp - 0x2874]
call fcn.00434959
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x5dc]
jne 0x472d23
mov dword [ebp - 0x2130], 1
jmp 0x472d2a
and dword [ebp - 0x2130], 0
mov eax, dword [ebp - 0x850]
add eax, dword [ebp - 0x2130]
cmp eax, 0xb49
jle 0x472d49
mov dword [ebp - 0x1b28], 1
jmp 0x472d50
and dword [ebp - 0x1b28], 0
mov eax, dword [ebp - 0x104c]
sub eax, dword [ebp - 0x1b28]
cmp eax, dword [ebp - 0x43c]
jle 0x472d70
mov dword [ebp - 0x2540], 1
jmp 0x472d77
and dword [ebp - 0x2540], 0
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x2e74], eax
push 1
lea ecx, [ebp - 0x2874]
call fcn.00434959
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2204]
mov dword [ebp - 0x2e7c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36dc]
mov dword [ebp - 0x2e84], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36dc]
cmp dword [ebp - 0x43c], eax
jl 0x472dd5
mov dword [ebp - 0xba8], 1
jmp 0x472ddc
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0xbb8]
cmp dword [ebp - 0xba8], eax
jg 0x472e03
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2204], 0
jne 0x472e03
and dword [ebp - 0x1b30], 0
jmp 0x472e0d
mov dword [ebp - 0x1b30], 1
cmp dword [ebp - 0x1b30], 0xfffffffa
jg 0x472e22
mov dword [ebp - 0xbb0], 1
jmp 0x472e29
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0xbb0], 0
je 0x472e3e
mov dword [ebp - 0x1b38], 1
jmp 0x472e45
and dword [ebp - 0x1b38], 0
mov eax, dword [ebp - 0x1b38]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0x1f17
jle 0x472e69
mov dword [ebp - 0x1b40], 1
jmp 0x472e70
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0xbb8]
imul eax, dword [ebp - 0x1b40]
cmp eax, dword [ebp - 0x2548]
jg 0x472e91
mov dword [ebp - 0xbc0], 1
jmp 0x472e98
and dword [ebp - 0xbc0], 0
push 0
lea ecx, [ebp - 0x2b20]
call fcn.00434959
mov ecx, dword [ebp - 0xbc0]
mov dword [eax], ecx
lea ecx, [ebp - 0x2874]
call fcn.0043493d
jmp 0x472bc5
lea ecx, [ebp - 0x2b20]
call fcn.0043493d
mov dword [ebp - 0x64], 0xb02971c1
mov dword [ebp - 0x320], 2
mov dword [ebp - 0x5e4], 0
jmp 0x472ef2
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 2
jge 0x472f0e
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x2ec4], 5
jmp 0x472ee5
mov dword [ebp - 0x320], 2
jmp 0x472f27
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jne 0x472fe4
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x788], 0
jmp 0x472f57
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 4
jge 0x472f73
mov eax, dword [ebp - 0x788]
mov dword [ebp + eax*4 - 0x36fc], 0x5db34e6d
jmp 0x472f4a
mov dword [ebp - 0x5ec], 0
jmp 0x472f8c
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0xffffffe7
jg 0x472fdf
mov dword [ebp - 0x3f4], 0xffffffff
mov dword [ebp - 0x3f4], 0
jmp 0x472fb8
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 3
jg 0x472fdd
mov eax, dword [ebp - 0x3f4]
mov ecx, dword [ebp - 0x3f4]
mov eax, dword [ebp + eax*4 - 0x36fc]
mov dword [ebp + ecx*4 - 0x36fc], eax
jmp 0x472fab
jmp 0x472f7f
jmp 0x472f1a
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x320], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x2ec4], ecx
mov dword [ebp - 0x340], 7
push 1
lea ecx, [ebp - 0x3358]
call fcn.0043486b
mov dword [ebp - 0x8b8], 0
jmp 0x473033
mov eax, dword [ebp - 0x8b8]
inc eax
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x8b8], 1
jge 0x473055
push dword [ebp - 0x8b8]
lea ecx, [ebp - 0x3358]
call fcn.00434959
mov dword [eax], 0xac8b13ec
jmp 0x473026
mov byte [ebp - 0x2b1], 0
movzx eax, byte [ebp - 0x2b1]
test eax, eax
je 0x47306f
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x2b3], 0
movzx eax, byte [ebp - 0x2b3]
test eax, eax
je 0x47308e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
lea ecx, [ebp - 0x3358]
call fcn.0043493d
mov dword [ebp - 0x5f4], 7
mov dword [ebp - 0x1b60], 0x2f76ec75
mov dword [ebp - 0x2e8c], 0x6c902da
mov dword [ebp - 0xbe8], 0x7084bc9c
mov dword [ebp - 0x2e94], 0xfffffff6
push 1
lea ecx, [ebp - 0x26a4]
call fcn.0043486b
mov dword [ebp - 0x2558], 0x934b0b4e
mov dword [ebp - 0x2d94], 0xbdd7
mov dword [ebp - 0x2d90], 0xbdd7
mov dword [ebp - 0x2d8c], 0xbdd7
mov dword [ebp - 0x2d88], 0xbdd7
mov dword [ebp - 0x2550], 0
mov dword [ebp - 0x140], 0
jmp 0x47312d
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x47314c
push dword [ebp - 0x140]
lea ecx, [ebp - 0x26a4]
call fcn.00434959
or dword [eax], 0xffffffff
jmp 0x473120
mov dword [ebp - 0x140], 0
jmp 0x473165
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x473181
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x3368], 0
jmp 0x473158
mov byte [ebp - 0x2b5], 0
movzx eax, byte [ebp - 0x2b5]
test eax, eax
je 0x4731a4
push 0xc6c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x2e9c], eax
cmp dword [ebp - 0x5f4], 0
jne 0x4732ab
push 2
pop eax
test eax, eax
je 0x4731eb
push 0
lea ecx, [ebp - 0x26a4]
call fcn.00434959
cmp dword [eax], 0
je 0x4731eb
mov eax, 0xbb1bb30b
test eax, eax
je 0x4731eb
mov dword [ebp - 0x1b48], 1
jmp 0x4731f2
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x2550]
cmp dword [ebp - 0x1b48], eax
je 0x47320c
mov dword [ebp - 0xbc8], 1
jmp 0x473213
and dword [ebp - 0xbc8], 0
cmp dword [ebp - 0xbc8], 0xffff
jb 0x473232
push 2
pop eax
test eax, eax
je 0x473232
mov dword [ebp - 0x1b50], 1
jmp 0x473239
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0x1b50], eax
jne 0x473253
mov dword [ebp - 0xbd0], 1
jmp 0x47325a
and dword [ebp - 0xbd0], 0
push 0
lea ecx, [ebp - 0x26a4]
call fcn.00434959
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbd0]
jg 0x47327d
mov dword [ebp - 0xbd8], 1
jmp 0x473284
and dword [ebp - 0xbd8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3368]
inc eax
mov dword [ebp - 0x1b58], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b58]
mov dword [ebp + eax - 0x3368], ecx
mov eax, dword [ebp - 0x2558]
mov dword [ebp - 0x1b60], eax
mov eax, dword [ebp - 0x1b60]
inc eax
cmp eax, 9
je 0x4732cf
mov dword [ebp - 0xbe0], 1
jmp 0x4732d6
and dword [ebp - 0xbe0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2d94]
cmp dword [ebp - 0xbe0], eax
jge 0x4732f6
mov dword [ebp - 0x1b68], 1
jmp 0x4732fd
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0xbe8], 0
je 0x473323
xor eax, eax
inc eax
je 0x473323
mov dword [ebp - 0x1b70], 1
jmp 0x47332a
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0x1b70], eax
je 0x473344
mov dword [ebp - 0xbf0], 1
jmp 0x47334b
and dword [ebp - 0xbf0], 0
push 0
lea ecx, [ebp - 0x26a4]
call fcn.00434959
mov ecx, dword [ebp - 0xbf0]
mov dword [eax], ecx
lea ecx, [ebp - 0x26a4]
call fcn.0043493d
mov dword [ebp - 0x790], 0
jmp 0x473384
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 2
jge 0x4733a6
push dword [ebp - 0x790]
lea ecx, [ebp - 0xb44]
call fcn.00434959
mov dword [eax], 1
jmp 0x473377
push 3
lea ecx, [ebp - 0x934]
call fcn.0043486b
mov dword [ebp - 0x98], 0xfffffff8
mov dword [ebp - 0x2570], 0xfbf68593
push 4
lea ecx, [ebp - 0x2b2c]
call fcn.0043486b
mov dword [ebp - 0x2560], 0x5e60d1f
mov dword [ebp - 0x2580], 0
mov dword [ebp - 0x1b8], 0
jmp 0x473401
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x473423
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x934]
call fcn.00434959
mov dword [eax], 0x7571177e
jmp 0x4733f4
mov dword [ebp - 0x1b8], 0
jmp 0x47343c
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x47345e
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x2b2c]
call fcn.00434959
mov dword [eax], 0x49ec71cb
jmp 0x47342f
mov dword [ebp - 0x98], 0
jmp 0x473477
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jg 0x4738a6
mov dword [ebp - 0xa4c], 0xfffe
mov dword [ebp - 0x2590], 0x81d4b4ea
mov dword [ebp - 0x148], 0
jmp 0x4734b1
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x4734cd
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x48c], 0xfffffffa
jmp 0x4734a4
mov dword [ebp - 0x148], 0
jmp 0x4734e6
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x473502
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x2578], 0x872a60d4
jmp 0x4734d9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x48c], 2
jmp 0x473530
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x48c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48c], 0
jl 0x4738a1
mov dword [ebp - 0x1ba0], 0xb2c57e71
mov dword [ebp - 0x2588], 0xb1d6a56c
push 1
lea ecx, [ebp - 0x934]
call fcn.00434959
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48c]
mov dword [ebp - 0x2ea4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x48c]
cmp dword [ebp + eax - 0x48c], ecx
je 0x4735a0
mov dword [ebp - 0x1b78], 1
jmp 0x4735a7
and dword [ebp - 0x1b78], 0
imul esi, dword [ebp - 0x1b78], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x48c]
lea ecx, [ebp - 0x934]
call fcn.00434959
cmp esi, dword [eax]
jl 0x4735d6
mov dword [ebp - 0xbf8], 1
jmp 0x4735dd
and dword [ebp - 0xbf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48c]
cmp dword [ebp - 0xbf8], eax
jle 0x4735fe
mov dword [ebp - 0x1b80], 1
jmp 0x473605
and dword [ebp - 0x1b80], 0
push 1
lea ecx, [ebp - 0x2b2c]
call fcn.00434959
mov ecx, dword [ebp - 0x1b80]
mov dword [eax], ecx
push dword [ebp - 0x98]
lea ecx, [ebp - 0x934]
call fcn.00434959
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48c], 0
je 0x473659
push 0
lea ecx, [ebp - 0x934]
call fcn.00434959
cmp dword [eax], 0
je 0x473659
mov dword [ebp - 0xc00], 1
jmp 0x473660
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x2560]
cmp dword [ebp - 0xc00], eax
jle 0x47367a
mov dword [ebp - 0x1b88], 1
jmp 0x473681
and dword [ebp - 0x1b88], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48c]
cmp dword [ebp - 0x1b88], eax
jl 0x4736bc
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x48c]
lea ecx, [ebp - 0x934]
call fcn.00434959
cmp dword [eax], 0
jne 0x4736bc
and dword [ebp - 0xc08], 0
jmp 0x4736c6
mov dword [ebp - 0xc08], 1
cmp dword [ebp - 0xc08], 0
je 0x4736db
mov dword [ebp - 0x2568], 1
jmp 0x4736e2
and dword [ebp - 0x2568], 0
mov eax, dword [ebp - 0x2570]
mov dword [ebp - 0x2eac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2578]
mov dword [ebp - 0x2ef8], eax
mov esi, dword [ebp - 0x2580]
push 0
lea ecx, [ebp - 0x934]
call fcn.00434959
cmp esi, dword [eax]
jge 0x473724
mov dword [ebp - 0x1b90], 1
jmp 0x47372b
and dword [ebp - 0x1b90], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x934]
call fcn.00434959
mov ecx, dword [ebp - 0x1b90]
add ecx, dword [eax]
jne 0x473758
mov eax, 0xffff
test eax, eax
jne 0x473758
and dword [ebp - 0xc10], 0
jmp 0x473762
mov dword [ebp - 0xc10], 1
mov eax, dword [ebp - 0xa4c]
dec eax
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
cmp eax, dword [ebp - 0xc10]
jne 0x473789
mov dword [ebp - 0x1b98], 1
jmp 0x473790
and dword [ebp - 0x1b98], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48c]
add eax, dword [ebp - 0x1b98]
cmp eax, dword [ebp - 0x98]
jl 0x4737c0
mov eax, 0xfffb
test eax, eax
je 0x4737c0
mov dword [ebp - 0xc18], 1
jmp 0x4737c7
and dword [ebp - 0xc18], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x934]
call fcn.00434959
mov eax, dword [eax]
mov dword [ebp - 0x1ba0], eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0x934]
call fcn.00434959
mov esi, dword [ebp - 0xc18]
imul esi, dword [eax]
mov edi, dword [ebp - 0x98]
add edi, dword [ebp - 0x1ba0]
push dword [ebp - 0x98]
lea ecx, [ebp - 0x934]
call fcn.00434959
imul edi, dword [eax]
cmp edi, esi
jne 0x47382a
mov dword [ebp - 0x95c], 1
jmp 0x473831
and dword [ebp - 0x95c], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x934]
call fcn.00434959
mov ecx, dword [ebp - 0x95c]
mov dword [eax], ecx
cmp dword [ebp - 0x95c], 0xfffffffb
jle 0x473865
mov eax, 0xffff
test eax, eax
jne 0x473865
and dword [ebp - 0xc20], 0
jmp 0x47386f
mov dword [ebp - 0xc20], 1
mov eax, dword [ebp - 0x2588]
cmp dword [ebp - 0xc20], eax
jne 0x473889
mov dword [ebp - 0x1ba8], 1
jmp 0x473890
and dword [ebp - 0x1ba8], 0
mov eax, dword [ebp - 0x1ba8]
mov dword [ebp - 0x2590], eax
jmp 0x473515
jmp 0x47346a
lea ecx, [ebp - 0x2b2c]
call fcn.0043493d
lea ecx, [ebp - 0x934]
call fcn.0043493d
mov dword [ebp - 0x64], 1
jmp 0x4738cc
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x47513e
mov dword [ebp - 0x4b4], 0xfffffff8
mov dword [ebp - 0xc28], 0x1d976ff5
mov dword [ebp - 0x4b4], 8
jmp 0x473903
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0x16
jle 0x47391a
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0xc28], eax
jmp 0x4738f6
cmp dword [ebp - 0xc28], 0
je 0x473953
mov byte [ebp - 0x2b7], 0
movzx eax, byte [ebp - 0x2b7]
test eax, eax
je 0x473951
push 0x1ed3
push 0x1274
push 0xa50
push 0x23f
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x473977
mov byte [ebp - 0x2e5], 0
movzx eax, byte [ebp - 0x2e5]
test eax, eax
je 0x473977
push 0x1e8c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x238], 1
mov dword [ebp - 0xc40], 0x6b903cfc
mov dword [ebp - 0xc48], 0x402095d7
mov dword [ebp - 0x1bd0], 0xffffffff
mov dword [ebp - 0x25a0], 8
mov dword [ebp - 0x5fc], 0
jmp 0x4739c2
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 1
jge 0x4739de
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0x328], 0xffffffff
jmp 0x4739b5
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1bb0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bb0]
mov dword [ebp + eax - 0x328], ecx
cmp dword [ebp - 0x1bb0], 0
je 0x473ab6
cmp dword [ebp - 0x238], 0x21dd2eb2
jle 0x473a22
mov dword [ebp - 0x2598], 1
jmp 0x473a29
and dword [ebp - 0x2598], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
mov dword [ebp - 0x2f00], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x328], 0x87a912e7
jae 0x473a5b
mov dword [ebp - 0xc30], 1
jmp 0x473a62
and dword [ebp - 0xc30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
cmp dword [ebp - 0xc30], eax
jge 0x473a83
mov dword [ebp - 0x1bb8], 1
jmp 0x473a8a
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x1bb8], eax
jl 0x473aa6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x328], 0
xor eax, eax
je 0x473ab6
mov dword [ebp - 0xc38], 1
jmp 0x473abd
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x238]
imul ecx, dword [ebp - 0xc38]
imul ecx, dword [ebp - 0x238]
add ecx, 0x63f76313
sub eax, ecx
jne 0x473af3
cmp dword [ebp - 0x238], 0
jne 0x473af3
and dword [ebp - 0x1bc0], 0
jmp 0x473afd
mov dword [ebp - 0x1bc0], 1
mov eax, dword [ebp - 0x1bc0]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0x2f08], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
add eax, dword [ebp - 0x238]
cmp eax, 0xfffa
ja 0x473b3b
mov dword [ebp - 0x1bc8], 1
jmp 0x473b42
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0x1bc8]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x1bd0], eax
cmp dword [ebp - 0x1bd0], 0
je 0x473b7f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x328], 0
je 0x473b7f
mov dword [ebp - 0xc50], 1
jmp 0x473b86
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0x25a0], eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
cmp dword [eax], 0
je 0x473bc0
mov eax, 0x21af
test eax, eax
je 0x473bc0
cmp dword [ebp - 0x64], 0
je 0x473bc0
mov dword [ebp - 0x1bd8], 1
jmp 0x473bc7
and dword [ebp - 0x1bd8], 0
cmp dword [ebp - 0x1bd8], 0xc88e
jle 0x473bdf
mov dword [ebp - 0xc58], 1
jmp 0x473be6
and dword [ebp - 0xc58], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
mov ecx, dword [ebp - 0xc58]
cmp ecx, dword [eax]
jne 0x473c0a
mov dword [ebp - 0x1be0], 1
jmp 0x473c11
and dword [ebp - 0x1be0], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
push 0
lea ecx, [ebp - 0xb44]
call fcn.00434959
mov esi, dword [ebp - 0x64]
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
cmp esi, dword [eax]
jge 0x473f98
mov byte [ebp - 0x2e7], 0
mov dword [ebp - 0x2f10], 0
mov dword [ebp - 0x2f18], 0xc8094a18
mov dword [ebp - 0x2f20], 1
mov dword [ebp - 0x2f28], 1
mov dword [ebp - 0x2f30], 0xfe5f36f6
mov dword [ebp - 0x2f38], 0x34d0069
mov dword [ebp - 0x2f40], 0xfffffffb
mov dword [ebp - 0x2f48], 0x923607a9
mov dword [ebp - 0x2f50], 0xcef054a2
mov dword [ebp - 0x2f58], 0xfffffffd
mov dword [ebp - 0x2f60], 9
mov dword [ebp - 0x2f68], 0xfffffffd
mov dword [ebp - 0x2f70], 0x868bb4a
mov dword [ebp - 0x2f78], 0
mov dword [ebp - 0x2f80], 0
mov dword [ebp - 0x2f88], 0xc3837ace
mov dword [ebp - 0x2f90], 0x82ca9683
mov dword [ebp - 0x2f98], 0
mov dword [ebp - 0x2fa0], 0xe637c5b1
mov dword [ebp - 0x2fa8], 0xd13d8c53
mov dword [ebp - 0x2fb0], 0xea7eb8e1
mov dword [ebp - 0x2fb8], 0x20c4365d
mov dword [ebp - 0x2fc0], 1
mov dword [ebp - 0x2fc8], 0x2a42bbd4
mov dword [ebp - 0x2fd0], 1
mov dword [ebp - 0x2fd8], 0x6a37bd55
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0x2fe0], 0xfffffffe
mov dword [ebp - 0x858], 0
jmp 0x473d7d
mov eax, dword [ebp - 0x858]
inc eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 2
jge 0x473d99
mov eax, dword [ebp - 0x858]
mov dword [ebp + eax*4 - 0x3800], 0xffffffff
jmp 0x473d70
mov eax, dword [ebp - 0xc60]
inc eax
mov dword [ebp - 0xc60], eax
movzx eax, byte [ebp - 0x2e7]
test eax, eax
je 0x473f93
mov dword [ebp - 0x2fe8], 0x3185
mov dword [ebp - 0x2ff0], 0xffffffff
mov dword [ebp - 0x798], 0xdc4b4e12
mov dword [ebp - 0x2ff8], 2
mov dword [ebp - 0xafc], 0x921ded68
mov dword [ebp - 0x25a8], 0x9a130dfd
mov dword [ebp - 0x604], 0
jmp 0x473e0a
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 3
jge 0x473e26
mov eax, dword [ebp - 0x604]
mov dword [ebp + eax*4 - 0x2b44], 0
jmp 0x473dfd
mov eax, dword [ebp - 0xafc]
inc eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0x798], 0
jmp 0x473e4c
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 0xf
jge 0x473f88
mov dword [ebp - 0xc0], 0xfffffffc
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xafc], eax
jg 0x473e81
xor eax, eax
je 0x473e81
mov dword [ebp - 0x1be8], 1
jmp 0x473e88
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x1be8]
jge 0x473ea2
mov dword [ebp - 0xc68], 1
jmp 0x473ea9
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0xc68]
cmp eax, dword [ebp - 0xc0]
jne 0x473eca
mov dword [ebp - 0x1bf0], 1
jmp 0x473ed1
and dword [ebp - 0x1bf0], 0
mov eax, dword [ebp - 0x1bf0]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc0], 0
jmp 0x473ef6
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x473f83
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x473f33
push 0x1d6a
push 0x241b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x2b44], 0
jne 0x473f61
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x25a8]
cmp dword [ebp + eax*4 - 0x2b44], ecx
jle 0x473f61
and dword [ebp - 0xc70], 0
jmp 0x473f6b
mov dword [ebp - 0xc70], 1
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc70]
mov dword [ebp + eax*4 - 0x2b44], ecx
jmp 0x473ee9
jmp 0x473e3f
push 0xe8d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x4744c4
mov dword [ebp - 0x614], 0x58efa97f
mov dword [ebp - 0x464], 0xfffffffe
mov dword [ebp - 0x964], 0
mov dword [ebp - 0x25b8], 0
mov dword [ebp - 0x464], 0
jmp 0x473fd9
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 9
je 0x474148
mov dword [ebp - 0x118], 1
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3000], eax
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x118], eax
jge 0x474016
mov dword [ebp - 0x1bf8], 1
jmp 0x47401d
and dword [ebp - 0x1bf8], 0
cmp dword [ebp - 0x1bf8], 0xa7b7
jl 0x47403b
cmp dword [ebp - 0x118], 0
jne 0x47403b
and dword [ebp - 0x25b0], 0
jmp 0x474045
mov dword [ebp - 0x25b0], 1
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3008], eax
cmp dword [ebp - 0x118], 2
jne 0x47406c
cmp dword [ebp - 0x118], 0
jne 0x47406c
and dword [ebp - 0xc78], 0
jmp 0x474076
mov dword [ebp - 0xc78], 1
mov eax, dword [ebp - 0x964]
cmp eax, dword [ebp - 0xc78]
jge 0x474090
mov dword [ebp - 0x1c00], 1
jmp 0x474097
and dword [ebp - 0x1c00], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1c00], eax
jge 0x4740b1
mov dword [ebp - 0xc80], 1
jmp 0x4740b8
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0x964]
add eax, dword [ebp - 0xc80]
cmp dword [ebp - 0x118], eax
jne 0x4740d8
mov dword [ebp - 0x1c08], 1
jmp 0x4740df
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x964]
cmp dword [ebp - 0x1c08], eax
je 0x4740f9
mov dword [ebp - 0xc88], 1
jmp 0x474100
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0xc88]
add eax, 0x5bed647b
cmp eax, dword [ebp - 0x464]
jg 0x47411f
mov dword [ebp - 0x1c10], 1
jmp 0x474126
and dword [ebp - 0x1c10], 0
mov eax, dword [ebp - 0x1c10]
sub eax, dword [ebp - 0x118]
mov dword [ebp - 0x25b8], eax
cmp dword [ebp - 0x464], 0
je 0x474143
jmp 0x474148
jmp 0x473fcc
mov byte [ebp - 0x2eb], 0
movzx eax, byte [ebp - 0x2eb]
test eax, eax
je 0x47417a
push 0
push 0xa08
push 0xa3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov dword [ebp - 0xa54], 0
mov dword [ebp - 0x210], 0
push 1
lea ecx, [ebp - 0x2b5c]
call fcn.0043486b
mov dword [ebp - 0xc98], 0
mov dword [ebp - 0x60c], 0
jmp 0x4741be
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 1
jge 0x4741e0
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x2b5c]
call fcn.00434959
mov dword [eax], 0xa733e34b
jmp 0x4741b1
mov dword [ebp - 0x210], 0
jmp 0x4741f9
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffec
je 0x474393
mov dword [ebp - 0x910], 0x101a
mov dword [ebp - 0x1c18], 0x1a1f0506
mov dword [ebp - 0x1c38], 0xb66efe0c
mov dword [ebp - 0x25c8], 0x80bfe737
cmp dword [ebp - 0x210], 0
je 0x47436f
cmp dword [ebp - 0x210], 0
jne 0x474256
cmp dword [ebp - 0x910], 0
jne 0x474256
and dword [ebp - 0x25c0], 0
jmp 0x474260
mov dword [ebp - 0x25c0], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x3010], eax
mov eax, 0x2632c5b6
test eax, eax
je 0x47428a
cmp dword [ebp - 0x210], 0
je 0x47428a
mov dword [ebp - 0xc90], 1
jmp 0x474291
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x1c20], eax
push 0
lea ecx, [ebp - 0x2b5c]
call fcn.00434959
mov ecx, dword [ebp - 0x1c20]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0x1c18], eax
mov eax, dword [ebp - 0x1c18]
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0xc98]
cmp dword [ebp - 0x1c20], eax
jg 0x4742e4
mov dword [ebp - 0xca0], 1
jmp 0x4742eb
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x910]
cmp dword [ebp - 0xca0], eax
jl 0x474305
mov dword [ebp - 0x1c28], 1
jmp 0x47430c
and dword [ebp - 0x1c28], 0
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x1c28]
cmp eax, 0x56574b60
jg 0x474331
cmp dword [ebp - 0x910], 0
jne 0x474331
and dword [ebp - 0xca8], 0
jmp 0x47433b
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 1
je 0x474350
mov dword [ebp - 0x1c30], 1
jmp 0x474357
and dword [ebp - 0x1c30], 0
cmp dword [ebp - 0x1c30], 0xffff
jb 0x47436f
mov dword [ebp - 0xcb0], 1
jmp 0x474376
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0x1c38], eax
mov eax, dword [ebp - 0x1c38]
mov dword [ebp - 0x25c8], eax
jmp 0x4741ec
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x4743b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
lea ecx, [ebp - 0x2b5c]
call fcn.0043493d
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0
cmp dword [ebp - 0x340], 0xd2ae857b
jbe 0x474412
cmp dword [ebp - 0x614], 0
je 0x474412
mov dword [ebp - 0xcb8], 1
jmp 0x474419
and dword [ebp - 0xcb8], 0
cmp dword [ebp - 0xcb8], 0
jne 0x47442e
mov dword [ebp - 0x1c40], 1
jmp 0x474435
and dword [ebp - 0x1c40], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
mov ecx, dword [ebp - 0x1c40]
cmp ecx, dword [eax]
je 0x474459
mov dword [ebp - 0xcc0], 1
jmp 0x474460
and dword [ebp - 0xcc0], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb44]
call fcn.00434959
mov eax, dword [eax]
sub eax, dword [ebp - 0xcc0]
cmp eax, 0xc0ec
jle 0x474489
mov dword [ebp - 0x25d0], 1
jmp 0x474490
and dword [ebp - 0x25d0], 0
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0x3018], eax
cmp dword [ebp - 0xa54], 0
ja 0x4744b1
mov dword [ebp - 0x1c48], 1
jmp 0x4744b8
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x1c48]
mov dword [ebp - 0xa54], eax
push 2
lea ecx, [ebp - 0x3388]
call fcn.0043486b
mov dword [ebp - 0x61c], 0x2236432a
mov dword [ebp - 0x3020], 1
mov dword [ebp - 0x3028], 3
mov dword [ebp - 0x3030], 0x8bd4dfbd
mov dword [ebp - 0x3038], 0xe5e81a7e
mov dword [ebp - 0x3040], 0xac46ddcd
mov dword [ebp - 0x3048], 1
mov dword [ebp - 0x3050], 0x564c7b7f
mov dword [ebp - 0x3058], 3
mov dword [ebp - 0x3060], 0x94e8fe75
mov dword [ebp - 0x3068], 0xb0ad8ea5
mov dword [ebp - 0x3070], 9
mov dword [ebp - 0x3078], 0xffffffff
mov dword [ebp - 0x7a0], 0
jmp 0x47456c
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 2
jge 0x47458e
push dword [ebp - 0x7a0]
lea ecx, [ebp - 0x3388]
call fcn.00434959
mov dword [eax], 0x9b55bb2c
jmp 0x47455f
mov dword [ebp - 0x61c], 1
jmp 0x4745a7
mov eax, dword [ebp - 0x61c]
dec eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0
jl 0x474634
mov dword [ebp - 0x3080], 0
mov dword [ebp - 0x3088], 0xffffffff
push 2
lea ecx, [ebp - 0x3378]
call fcn.0043486b
mov dword [ebp - 0xcc8], 0xef51ae9a
mov dword [ebp - 0x860], 0
jmp 0x4745f8
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 2
jge 0x474617
push dword [ebp - 0x860]
lea ecx, [ebp - 0x3378]
call fcn.00434959
and dword [eax], 0
jmp 0x4745eb
mov eax, dword [ebp - 0xcc8]
inc eax
mov dword [ebp - 0xcc8], eax
lea ecx, [ebp - 0x3378]
call fcn.0043493d
jmp 0x47459a
lea ecx, [ebp - 0x3388]
call fcn.0043493d
mov dword [ebp - 0x4cc], 0x13b91020
mov dword [ebp - 0x25f0], 0x7d8e6e83
mov dword [ebp - 0x25e0], 0
mov dword [ebp - 0x25e8], 0x20859495
mov dword [ebp - 0x3090], 0x452a2c7a
mov dword [ebp - 0x3098], 0xfffffffb
mov dword [ebp - 0x4cc], 0
jmp 0x474694
mov eax, dword [ebp - 0x4cc]
dec eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0xfffffffb
je 0x4748f7
mov dword [ebp - 0x3fc], 0xe55059b8
mov dword [ebp - 0x2acc], 5
mov dword [ebp - 0x2ac8], 5
mov dword [ebp - 0x2ac4], 5
mov dword [ebp - 0x2ac0], 5
lea ecx, [ebp - 0xae5]
call fcn.00434968
push eax
lea eax, [ebp - 0x2abc]
push eax
lea eax, [ebp - 0x2acc]
push eax
lea ecx, [ebp - 0x3858]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3708]
call fcn.00434917
mov dword [ebp - 0x25d8], 0x4dbf0cf
mov dword [ebp - 0xcd0], 0x84cbed56
mov dword [ebp - 0x30a0], 8
mov dword [ebp - 0x30a8], 0xfc353271
mov dword [ebp - 0x30b0], 0x4d91b059
mov dword [ebp - 0xcf0], 0xd070
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3fc], 0
jmp 0x47476a
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 3
jg 0x4748e7
mov dword [ebp - 0xce8], 0x63069be5
mov dword [ebp - 0x30b8], 0xa218f0ed
mov dword [ebp - 0x30c0], 0xb91300d
mov dword [ebp - 0x30c8], 6
mov dword [ebp - 0x624], 0
jmp 0x4747b8
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 3
jge 0x4747d4
mov eax, dword [ebp - 0x624]
mov dword [ebp + eax*4 - 0x38e4], 0xe35fe57b
jmp 0x4747ab
cmp dword [ebp - 0x4cc], 0xbec0
jle 0x4747ec
mov dword [ebp - 0x1c58], 1
jmp 0x4747f3
and dword [ebp - 0x1c58], 0
mov eax, dword [ebp - 0xce8]
cmp dword [ebp - 0x25d8], eax
je 0x47480d
mov dword [ebp - 0x1c50], 1
jmp 0x474814
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0x1c50]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0xcd0]
cmp dword [ebp - 0x1c58], eax
jge 0x47483a
mov dword [ebp - 0xcd8], 1
jmp 0x474841
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0x25e0], eax
cmp dword [ebp - 0x25e8], 0xbb75da2c
je 0x474865
mov dword [ebp - 0x1c60], 1
jmp 0x47486c
and dword [ebp - 0x1c60], 0
cmp dword [ebp - 0x1c60], 1
je 0x474881
mov dword [ebp - 0xce0], 1
jmp 0x474888
and dword [ebp - 0xce0], 0
cmp dword [ebp - 0xce0], 0x3c225155
jne 0x4748a0
mov dword [ebp - 0x1c68], 1
jmp 0x4748a7
and dword [ebp - 0x1c68], 0
imul eax, dword [ebp - 0x1c68], 0xfffffffc
cmp eax, dword [ebp - 0xce8]
jge 0x4748c2
mov dword [ebp - 0x1c70], 1
jmp 0x4748c9
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0x1c70]
mov dword [ebp - 0x25f0], eax
mov eax, dword [ebp - 0xcf0]
dec eax
mov dword [ebp - 0xcf0], eax
jmp 0x47475d
lea ecx, [ebp - 0x3708]
call fcn.0043493d
jmp 0x474687
mov byte [ebp - 0x2ef], 0
mov dword [ebp - 0x270], 2
mov dword [ebp - 0x30d0], 0xf0b101aa
mov dword [ebp - 0x974], 0x34b64b5c
mov dword [ebp - 0xacc], 0xffffffff
mov dword [ebp - 0x96c], 2
mov dword [ebp - 0x7a8], 0
jmp 0x474949
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 1
jge 0x474965
mov eax, dword [ebp - 0x7a8]
mov dword [ebp + eax*4 - 0x2614], 0
jmp 0x47493c
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x270], eax
jl 0x47497f
mov dword [ebp - 0x1c78], 1
jmp 0x474986
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x30d8], eax
mov eax, dword [ebp - 0x1c78]
mov dword [ebp - 0x25f8], eax
mov eax, dword [ebp - 0x96c]
add eax, dword [ebp - 0x974]
mov dword [ebp - 0x260c], eax
mov eax, dword [ebp - 0x96c]
inc eax
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x25f8]
cmp eax, dword [ebp - 0x260c]
jge 0x4749d7
mov dword [ebp - 0xcf8], 1
jmp 0x4749de
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xcf8]
add eax, 7
cmp eax, 0x5067
jge 0x4749fa
mov dword [ebp - 0x1c80], 1
jmp 0x474a01
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0xacc]
add eax, dword [ebp - 0x1c80]
cmp eax, 9
jne 0x474a1e
mov dword [ebp - 0xd00], 1
jmp 0x474a25
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0xd00], eax
je 0x474a3f
mov dword [ebp - 0x1c88], 1
jmp 0x474a46
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x1c88]
je 0x474a69
cmp dword [ebp - 0xacc], 0
je 0x474a69
mov dword [ebp - 0xd08], 1
jmp 0x474a70
and dword [ebp - 0xd08], 0
cmp dword [ebp - 0xd08], 0xa6e8f591
jb 0x474a88
mov dword [ebp - 0x1c90], 1
jmp 0x474a8f
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x1c90]
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x270], 0
jmp 0x474ab4
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x474ad0
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x2614], 0
jmp 0x474aa7
movzx eax, byte [ebp - 0x2ef]
test eax, eax
je 0x475139
mov dword [ebp - 0x444], 0xe76f5020
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x150], 0
jmp 0x474b0c
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x474b28
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x21f4], 0xdc85
jmp 0x474aff
mov dword [ebp - 0x150], 0
jmp 0x474b41
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x474b5d
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x2dd4], 1
jmp 0x474b34
mov dword [ebp - 0x444], 3
jmp 0x474b76
mov eax, dword [ebp - 0x444]
dec eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
jl 0x47512a
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x97c], 4
mov dword [ebp - 0x1cc8], 0xddfdaf0b
mov dword [ebp - 0x2624], 0xffff
mov dword [ebp - 0x262c], 3
mov dword [ebp - 0x84], 3
jmp 0x474bce
cmp dword [ebp - 0x84], 0
jl 0x4750ef
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x8c0], 0x20b2de47
mov dword [ebp - 0x330], 3
jmp 0x474c08
mov eax, dword [ebp - 0x330]
dec eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jl 0x474c32
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x474c30
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x474bfb
mov eax, 0x4b7c7008
test eax, eax
je 0x474d3a
xor eax, eax
inc eax
je 0x474c59
cmp dword [ebp - 0x444], 0
je 0x474c59
mov dword [ebp - 0xd10], 1
jmp 0x474c60
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0xd10], eax
jge 0x474c7a
mov dword [ebp - 0x1c98], 1
jmp 0x474c81
and dword [ebp - 0x1c98], 0
mov eax, dword [ebp - 0x1c98]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x21f4]
cmp dword [ebp - 0x330], eax
jne 0x474cae
mov dword [ebp - 0xd18], 1
jmp 0x474cb5
and dword [ebp - 0xd18], 0
cmp dword [ebp - 0xd18], 0x5c6a
jne 0x474ccd
mov dword [ebp - 0x1ca0], 1
jmp 0x474cd4
and dword [ebp - 0x1ca0], 0
mov eax, dword [ebp - 0x1ca0]
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x97c]
sub eax, dword [ebp - 0x444]
cmp eax, 0xe712c519
jne 0x474cff
mov dword [ebp - 0xa5c], 1
jmp 0x474d06
and dword [ebp - 0xa5c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa5c]
mov dword [ebp + eax - 0x2dd4], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x21f4]
add eax, dword [ebp - 0xa5c]
je 0x474d3a
mov dword [ebp - 0xd20], 1
jmp 0x474d41
and dword [ebp - 0xd20], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
cmp dword [ebp - 0xd20], eax
jg 0x474d61
mov dword [ebp - 0x1ca8], 1
jmp 0x474d68
and dword [ebp - 0x1ca8], 0
cmp dword [ebp - 0x1ca8], 0x9b34
jne 0x474d80
mov dword [ebp - 0x261c], 1
jmp 0x474d87
and dword [ebp - 0x261c], 0
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x21f4]
mov dword [ebp - 0x30e0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21f4]
mov dword [ebp - 0x30e8], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x21f4]
mov dword [ebp - 0x30f0], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x30f8], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x3100], eax
mov dword [ebp - 0x338], 0xdfa90ef8
cmp dword [ebp - 0x338], 0
je 0x474ff9
push 1
lea ecx, [ebp - 0x2b74]
call fcn.0043486b
mov dword [ebp - 0x524], 0xcf9e8bfa
mov dword [ebp - 0x62c], 0
jmp 0x474e1f
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 1
jge 0x474e3e
push dword [ebp - 0x62c]
lea ecx, [ebp - 0x2b74]
call fcn.00434959
or dword [eax], 0xffffffff
jmp 0x474e12
push 0
lea ecx, [ebp - 0x2b74]
call fcn.00434959
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0xd28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd28]
mov dword [ecx], eax
cmp dword [ebp - 0x524], 0xffffffff
jbe 0x474e77
mov dword [ebp - 0xd38], 1
jmp 0x474e7e
and dword [ebp - 0xd38], 0
cmp dword [ebp - 0x524], 0x3d35555d
jne 0x474ea2
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2dd4], 0
jne 0x474ea2
and dword [ebp - 0x1cb0], 0
jmp 0x474eac
mov dword [ebp - 0x1cb0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2dd4]
imul eax, dword [ebp - 0x1cb0]
cmp eax, dword [ebp - 0x524]
jg 0x474ed4
mov dword [ebp - 0xd30], 1
jmp 0x474edb
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0xd30]
add eax, 0x3e27
jne 0x474efa
cmp dword [ebp - 0x97c], 0
jne 0x474efa
mov dword [ebp - 0x1cb8], 1
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x21f4]
add eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x8c0], eax
jle 0x474f37
mov dword [ebp - 0xd60], 1
cmp dword [ebp - 0x84], 0
je 0x475021
cmp dword [ebp - 0x2624], 0
je 0x475021
mov dword [ebp - 0xd50], 1
jmp 0x475028
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0xd60]
cmp dword [ebp - 0xd50], eax
jl 0x475042
mov dword [ebp - 0x1cd8], 1
jmp 0x475049
and dword [ebp - 0x1cd8], 0
imul eax, dword [ebp - 0x1cd8], 0
cmp eax, dword [ebp - 0x8c0]
je 0x475064
mov dword [ebp - 0xd58], 1
jmp 0x47506b
and dword [ebp - 0xd58], 0
cmp dword [ebp - 0xd58], 0xb805
jl 0x475095
cmp dword [ebp - 0x262c], 0
je 0x475095
mov eax, 0xedc2
test eax, eax
je 0x475095
mov dword [ebp - 0x1ce0], 1
jmp 0x47509c
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x8c0]
cmp eax, dword [ebp - 0x1ce0]
jg 0x4750b6
mov dword [ebp - 0x1ce8], 1
jmp 0x4750bd
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0xd60]
cmp dword [ebp - 0x1ce8], eax
jle 0x4750d7
mov dword [ebp - 0xd68], 1
jmp 0x4750de
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0x330], eax
jmp 0x474bc1
mov dword [ebp - 0x338], 3
jmp 0x475108
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jl 0x475125
mov eax, dword [ebp - 0x338]
cmp dword [ebp + eax*4 - 0x21f4], 0
je 0x475123
jmp 0x475125
jmp 0x4750fb
jmp 0x474b69
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
jmp 0x4738c5
mov dword [ebp - 0x240], 0xbac64a68
push 3
lea ecx, [ebp - 0x3398]
call fcn.0043486b
mov dword [ebp - 0x634], 0
jmp 0x47516e
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 3
jge 0x475190
push dword [ebp - 0x634]
lea ecx, [ebp - 0x3398]
call fcn.00434959
mov dword [eax], 0xa3399244
jmp 0x475161
mov dword [ebp - 0x240], 0
jmp 0x4751a9
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xfffffff5
jl 0x4751ce
mov byte [ebp - 0x2f5], 0
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x4751cc
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x47519c
mov dword [ebp - 0x240], 0
jmp 0x4751e7
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x47521d
mov byte [ebp - 0x2f7], 0
movzx eax, byte [ebp - 0x2f7]
test eax, eax
je 0x47521b
push 0
push 0x542
push 0
push 0x2305
push 0x1c5e
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x4751da
lea ecx, [ebp - 0x3398]
call fcn.0043493d
mov dword [ebp - 0x340], 0x1b
jmp 0x475241
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 9
jle 0x475988
push 3
lea ecx, [ebp - 0x20a4]
call fcn.0043486b
mov dword [ebp - 0xa0], 0x7df2f4a8
mov dword [ebp - 0x4d4], 0xffffffff
mov dword [ebp - 0x1d08], 0xe24b2e80
mov dword [ebp - 0x7b0], 0
jmp 0x475292
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 3
jge 0x4752b4
push dword [ebp - 0x7b0]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
mov dword [eax], 0xff0ea75c
jmp 0x475285
mov dword [ebp - 0xa0], 2
jmp 0x4752cd
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x47563e
mov dword [ebp - 0x2a2c], 0xf0ef
mov dword [ebp - 0x2a28], 0xf0ef
mov dword [ebp - 0x2a24], 0xf0ef
mov dword [ebp - 0x2a20], 0xf0ef
lea ecx, [ebp - 0xb15]
call fcn.00434968
push eax
lea eax, [ebp - 0x2a1c]
push eax
lea eax, [ebp - 0x2a2c]
push eax
lea ecx, [ebp - 0x3868]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x291c]
call fcn.00434917
mov dword [ebp - 0xb14], 0
push 2
lea ecx, [ebp - 0x2b8c]
call fcn.0043486b
mov dword [ebp - 0x63c], 0
jmp 0x475367
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 2
jge 0x475389
push dword [ebp - 0x63c]
lea ecx, [ebp - 0x2b8c]
call fcn.00434959
mov dword [eax], 7
jmp 0x47535a
mov dword [ebp - 0x4d4], 4
mov dword [ebp - 0x4d4], 0
jmp 0x4753ac
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 2
jg 0x475623
mov dword [ebp - 0x298], 0x13281d21
mov dword [ebp - 0x2644], 3
mov dword [ebp - 0x298], 2
jmp 0x4753e6
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jl 0x475409
push dword [ebp - 0x298]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
cmp dword [eax], 0
je 0x475407
jmp 0x475409
jmp 0x4753d9
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
cmp dword [ebp - 0x1d08], 0
jne 0x4754ad
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
mov esi, eax
push 2
lea ecx, [ebp - 0x291c]
call fcn.00434959
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x475459
mov dword [ebp - 0x1cf0], 1
jmp 0x475460
and dword [ebp - 0x1cf0], 0
mov eax, dword [ebp - 0xb14]
cmp dword [ebp - 0x1cf0], eax
jge 0x47547a
mov dword [ebp - 0xd70], 1
jmp 0x475481
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0xd70]
jg 0x4754ad
cmp dword [ebp - 0xa0], 0
jne 0x4754ad
and dword [ebp - 0x1cf8], 0
jmp 0x4754b7
mov dword [ebp - 0x1cf8], 1
cmp dword [ebp - 0x1cf8], 0x9e1
jge 0x4754cf
mov dword [ebp - 0xd78], 1
jmp 0x4754d6
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0xd78]
mov dword [ebp - 0xb14], eax
mov esi, dword [ebp - 0xb14]
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
cmp esi, dword [eax]
je 0x475509
mov dword [ebp - 0x2634], 1
jmp 0x475510
and dword [ebp - 0x2634], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x3108], eax
push 2
lea ecx, [ebp - 0x291c]
call fcn.00434959
push 2
lea ecx, [ebp - 0x291c]
call fcn.00434959
cmp dword [eax], 0xcdc0
jle 0x47554a
mov dword [ebp - 0x263c], 1
jmp 0x475551
and dword [ebp - 0x263c], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
cmp dword [ebp - 0xa0], 4
jl 0x475570
or eax, 0xffffffff
je 0x475585
mov eax, 0xa4a1
test eax, eax
je 0x475585
mov dword [ebp - 0x1d00], 1
jmp 0x47558c
and dword [ebp - 0x1d00], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x20a4]
call fcn.00434959
mov eax, dword [eax]
imul eax, dword [ebp - 0x1d00]
test eax, eax
jl 0x4755b6
mov dword [ebp - 0xd80], 1
jmp 0x4755bd
and dword [ebp - 0xd80], 0
cmp dword [ebp - 0xd80], 0xf6c5
jg 0x4755d5
mov dword [ebp - 0xd88], 1
jmp 0x4755dc
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x1d08]
cmp dword [ebp - 0xd88], eax
jl 0x4755f6
mov dword [ebp - 0x984], 1
jmp 0x4755fd
and dword [ebp - 0x984], 0
push 1
lea ecx, [ebp - 0x2b8c]
call fcn.00434959
mov ecx, dword [ebp - 0x984]
mov dword [eax], ecx
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x2644], eax
jmp 0x47539f
lea ecx, [ebp - 0x2b8c]
call fcn.0043493d
lea ecx, [ebp - 0x291c]
call fcn.0043493d
jmp 0x4752c0
lea ecx, [ebp - 0x20a4]
call fcn.0043493d
mov dword [ebp - 0x264c], 0x50c19791
mov dword [ebp - 0x868], 0xfffffffb
push 1
lea ecx, [ebp - 0x2c34]
call fcn.0043486b
mov dword [ebp - 0x128], 0
jmp 0x475683
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x47569f
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x38b4], 0xba2a
jmp 0x475676
mov dword [ebp - 0x128], 0
jmp 0x4756b8
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x4756da
push dword [ebp - 0x128]
lea ecx, [ebp - 0x2c34]
call fcn.00434959
mov dword [eax], 8
jmp 0x4756ab
mov dword [ebp - 0x868], 0xb
jmp 0x4756f3
mov eax, dword [ebp - 0x868]
dec eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 0xfffffff1
jg 0x475801
mov dword [ebp - 0x404], 0x888adae8
mov byte [ebp - 0x2f9], 0
movzx eax, byte [ebp - 0x2f9]
test eax, eax
je 0x475744
push 0xf21
push 0x1d30
push 0x529
push 0xd2a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x404], 0
jmp 0x47575d
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 2
jg 0x4757fc
mov dword [ebp - 0x1d10], 0xa5852835
mov eax, 0xbd035c57
test eax, eax
je 0x4757db
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x1d10], eax
cmp dword [ebp - 0x1d10], 1
je 0x47579e
mov dword [ebp - 0xd90], 1
jmp 0x4757a5
and dword [ebp - 0xd90], 0
cmp dword [ebp - 0xd90], 0
ja 0x4757ba
mov dword [ebp - 0x1d18], 1
jmp 0x4757c1
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x1d18]
je 0x4757db
mov dword [ebp - 0xd98], 1
jmp 0x4757e2
and dword [ebp - 0xd98], 0
push 0
lea ecx, [ebp - 0x2c34]
call fcn.00434959
mov ecx, dword [ebp - 0xd98]
mov dword [eax], ecx
jmp 0x475750
jmp 0x4756e6
lea ecx, [ebp - 0x2c34]
call fcn.0043493d
mov dword [ebp - 0x2654], 0xdb956746
mov dword [ebp - 0x3110], 0
mov dword [ebp - 0x3118], 0xc8094a18
mov dword [ebp - 0x3120], 1
mov dword [ebp - 0x3128], 1
mov dword [ebp - 0x3130], 0xfe5f36f6
mov dword [ebp - 0x3138], 0x34d0069
mov dword [ebp - 0x3140], 0xfffffffb
mov dword [ebp - 0x3148], 0x923607a9
mov dword [ebp - 0x3150], 0xcef054a2
mov dword [ebp - 0x3158], 0xfffffffd
mov dword [ebp - 0x3160], 9
mov dword [ebp - 0x3168], 0xfffffffd
mov dword [ebp - 0x3170], 0x868bb4a
mov dword [ebp - 0x3178], 0
mov dword [ebp - 0x3180], 0
mov dword [ebp - 0x3188], 0xc3837ace
mov dword [ebp - 0x3190], 0x82ca9683
mov dword [ebp - 0x3198], 0
mov dword [ebp - 0x31a0], 0xe637c5b1
mov dword [ebp - 0x31a8], 0xd13d8c53
mov dword [ebp - 0x31b0], 0xea7eb8e1
mov dword [ebp - 0x31b8], 0x20c4365d
mov dword [ebp - 0x31c0], 1
mov dword [ebp - 0x31c8], 0x2a42bbd4
mov dword [ebp - 0x31d0], 1
mov dword [ebp - 0x31d8], 0x6a37bd55
mov dword [ebp - 0x1d20], 0
mov dword [ebp - 0x31e0], 0xfffffffe
mov dword [ebp - 0x644], 0
jmp 0x475947
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 2
jge 0x475963
mov eax, dword [ebp - 0x644]
mov dword [ebp + eax*4 - 0x3878], 0xffffffff
jmp 0x47593a
mov eax, dword [ebp - 0x1d20]
inc eax
mov dword [ebp - 0x1d20], eax
mov eax, dword [ebp - 0x264c]
neg eax
add eax, 0x14898d08
mov dword [ebp - 0x2654], eax
jmp 0x475234
lea ecx, [ebp - 0xb44]
call fcn.0043493d
push 3
lea ecx, [ebp - 0x26b4]
call fcn.0043486b
push 1
lea ecx, [ebp - 0x20b4]
call fcn.0043486b
mov dword [ebp - 0x1c0], 0
jmp 0x4759c6
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x4759e8
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x26b4]
call fcn.00434959
mov dword [eax], 0x10c93b4e
jmp 0x4759b9
mov dword [ebp - 0x1c0], 0
jmp 0x475a01
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x475a23
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x20b4]
call fcn.00434959
mov dword [eax], 1
jmp 0x4759f4
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00434959
mov dword [eax], 2
jmp 0x475a5c
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00434959
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0xda0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xda0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00434959
cmp dword [eax], 0
jl 0x475c45
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x278], 0
jmp 0x475a95
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jg 0x475bd4
mov dword [ebp - 0x248], 0xe3e63e31
mov dword [ebp - 0x248], 2
jmp 0x475ac5
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x475b4b
xor eax, eax
je 0x475b16
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x26b4]
call fcn.00434959
cmp dword [eax], 0
je 0x475af3
jmp 0x475b4b
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x26b4]
call fcn.00434959
cmp dword [eax], 0
je 0x475b14
jmp 0x475b4b
jmp 0x475b46
mov byte [ebp - 0x2fb], 0
movzx eax, byte [ebp - 0x2fb]
test eax, eax
je 0x475b46
push 0x1d6a
push 0x241b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x475ab8
mov dword [ebp - 0x248], 0
jmp 0x475b64
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jg 0x475bcf
mov dword [ebp - 0x7b8], 0xc40ed3c1
mov dword [ebp - 0x7b8], 2
jmp 0x475b90
mov eax, dword [ebp - 0x7b8]
dec eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0
jl 0x475bcd
mov byte [ebp - 0x2fd], 0
movzx eax, byte [ebp - 0x2fd]
test eax, eax
je 0x475bcb
push 0
push 0xa08
push 0xa3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x475b83
jmp 0x475b57
jmp 0x475a88
mov dword [ebp - 0x278], 2
jmp 0x475bed
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jl 0x475c40
mov byte [ebp - 0x2ff], 0
movzx eax, byte [ebp - 0x2ff]
test eax, eax
je 0x475c1d
push 0x146
push 0x2510
push 0x1b53
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x26b4]
call fcn.00434959
cmp dword [eax], 0
je 0x475c3e
jmp 0x475c40
jmp 0x475be0
jmp 0x475a38
lea ecx, [ebp - 0x20b4]
call fcn.0043493d
lea ecx, [ebp - 0x26b4]
call fcn.0043493d
cmp dword [ebp + 8], 2
jl 0x482ec1
mov dword [ebp - 0x64c], 7
push 2
lea ecx, [ebp - 0x2c4c]
call fcn.0043486b
mov dword [ebp - 0x158], 0
jmp 0x475c95
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x475cb7
push dword [ebp - 0x158]
lea ecx, [ebp - 0x2c4c]
call fcn.00434959
mov dword [eax], 0xfe6e3245
jmp 0x475c88
mov dword [ebp - 0x158], 0
jmp 0x475cd0
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x475cec
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x2ed0], 0xfffffffc
jmp 0x475cc3
mov dword [ebp - 0x64c], 0xfffffffb
jmp 0x475d05
mov eax, dword [ebp - 0x64c]
dec eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0xfffffff5
jl 0x475e61
mov dword [ebp - 0x484], 0x1e2c0d37
mov dword [ebp - 0x484], 0
jmp 0x475d35
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 1
jg 0x475e3f
mov dword [ebp - 0x1f8], 0x3e64f147
mov dword [ebp - 0x1f8], 1
jmp 0x475d65
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jl 0x475de7
mov dword [ebp - 0x8f0], 8
mov dword [ebp - 0x8f0], 1
jmp 0x475d91
mov eax, dword [ebp - 0x8f0]
dec eax
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 0
jl 0x475de2
mov dword [ebp - 0x654], 0xf6802998
mov dword [ebp - 0x654], 1
jmp 0x475dbd
mov eax, dword [ebp - 0x654]
dec eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0
jl 0x475de0
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x2c4c]
call fcn.00434959
cmp dword [eax], 0
je 0x475dde
jmp 0x475de0
jmp 0x475db0
jmp 0x475d84
jmp 0x475d58
mov dword [ebp - 0x1f8], 1
jmp 0x475e00
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jl 0x475e3a
mov byte [ebp - 0x301], 0
movzx eax, byte [ebp - 0x301]
test eax, eax
je 0x475e38
push 0
push 0xc53
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x475df3
jmp 0x475d28
mov dword [ebp - 0x484], 0xffffffff
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x484]
mov dword [ebp + eax - 0x2ed0], ecx
jmp 0x475cf8
lea ecx, [ebp - 0x2c4c]
call fcn.0043493d
mov dword [ebp - 0xa64], 1
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x265c], 0x28d9ba5f
push 1
lea ecx, [ebp - 0x26d4]
call fcn.0043486b
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x31e8], 0xffffffff
mov dword [ebp - 0x7c0], 0
jmp 0x475ec4
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 1
jge 0x475ee6
push dword [ebp - 0x7c0]
lea ecx, [ebp - 0x26d4]
call fcn.00434959
mov dword [eax], 3
jmp 0x475eb7
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x476168
mov dword [ebp - 0x1d38], 0xbd0a7084
mov dword [ebp - 0x2664], 0xfffffffb
mov dword [ebp - 0x266c], 9
mov dword [ebp - 0x1d50], 0xc295
mov dword [ebp - 0xf8], 0xfffffff9
jmp 0x475f40
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x1a
jge 0x4760c2
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x1d30], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x31f0], eax
mov eax, dword [ebp - 0x265c]
mov dword [ebp - 0x1d28], eax
push 0
lea ecx, [ebp - 0x26d4]
call fcn.00434959
mov ecx, dword [ebp - 0x1d28]
mov dword [eax], ecx
cmp dword [ebp - 0x1d28], 0
jne 0x475f9e
cmp dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0
je 0x475fb0
cmp dword [ebp - 0x2664], 0
jne 0x475fc2
cmp dword [ebp - 0x250], 0
jne 0x475fc2
and dword [ebp - 0xda8], 0
jmp 0x475fcc
mov dword [ebp - 0xda8], 1
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0xda8], eax
je 0x475fe6
mov dword [ebp - 0xdb0], 1
jmp 0x475fed
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1d38], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1d30], eax
mov eax, dword [ebp - 0x1d30]
sub eax, dword [ebp - 0xdb0]
mov ecx, dword [ebp - 0x1d38]
imul ecx, eax
cmp ecx, dword [ebp - 0x266c]
jg 0x476037
cmp dword [ebp - 0xa64], 0
je 0x476037
mov dword [ebp - 0xdb8], 1
jmp 0x47603e
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0xdb8], eax
jg 0x476058
mov dword [ebp - 0x1d40], 1
jmp 0x47605f
and dword [ebp - 0x1d40], 0
mov eax, dword [ebp - 0x1d40]
mov dword [ebp - 0x348], eax
imul eax, dword [ebp - 0x348], 0x966c
cmp eax, dword [ebp - 0xa64]
jge 0x476089
mov dword [ebp - 0xdc0], 1
jmp 0x476090
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0xdc0], eax
jge 0x4760aa
mov dword [ebp - 0x1d48], 1
jmp 0x4760b1
and dword [ebp - 0x1d48], 0
mov eax, dword [ebp - 0x1d48]
mov dword [ebp - 0x250], eax
jmp 0x475f33
push 0
lea ecx, [ebp - 0x26d4]
call fcn.00434959
cmp dword [eax], 1
jge 0x4760e0
mov dword [ebp - 0xdc8], 1
jmp 0x4760e7
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0xdc8], 0xffffffff
je 0x476105
cmp dword [ebp - 0x1d50], 0
je 0x476105
mov dword [ebp - 0xdd0], 1
jmp 0x47610c
and dword [ebp - 0xdd0], 0
imul eax, dword [ebp - 0x1d50], 9
cmp eax, dword [ebp - 0xdd0]
je 0x476127
mov dword [ebp - 0x1d58], 1
jmp 0x47612e
and dword [ebp - 0x1d58], 0
cmp dword [ebp - 0x1d58], 4
jg 0x476149
mov eax, 0xae11771b
test eax, eax
jne 0x476149
and dword [ebp - 0xdd8], 0
jmp 0x476153
mov dword [ebp - 0xdd8], 1
imul eax, dword [ebp - 0xdd8], 0x618d
mov dword [ebp - 0xf8], eax
jmp 0x476420
mov dword [ebp - 0x267c], 0xfffffffe
mov dword [ebp - 0x870], 0x40c8e82
mov dword [ebp - 0x564], 0xdc4d7e3c
push 2
lea ecx, [ebp - 0x26c4]
call fcn.0043486b
mov dword [ebp - 0x65c], 0
jmp 0x4761ac
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 2
jge 0x4761ce
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x26c4]
call fcn.00434959
mov dword [eax], 8
jmp 0x47619f
mov dword [ebp - 0x348], 0
jmp 0x4761e7
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
jl 0x476415
mov dword [ebp - 0x2674], 4
mov dword [ebp - 0x35f8], 1
mov dword [ebp - 0x35f4], 1
mov dword [ebp - 0x35f0], 1
mov dword [ebp - 0x35ec], 1
mov dword [ebp - 0x98c], 0xe429b053
mov eax, dword [ebp - 0x98c]
dec eax
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x31f8], eax
cmp dword [ebp - 0x348], 0x6ff57863
jg 0x47625c
cmp dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x2674]
mov dword [ebp - 0x3200], eax
mov eax, dword [ebp - 0x267c]
mov dword [ebp - 0x3208], eax
cmp dword [ebp - 0x870], 9
jne 0x476289
mov dword [ebp - 0x1d60], 1
jmp 0x476290
and dword [ebp - 0x1d60], 0
mov eax, 0x54b4
sub eax, dword [ebp - 0x1d60]
jne 0x4762af
mov eax, 0x14abdc48
test eax, eax
jne 0x4762af
and dword [ebp - 0xde0], 0
jmp 0x4762b9
mov dword [ebp - 0xde0], 1
push 1
lea ecx, [ebp - 0x26c4]
call fcn.00434959
mov ecx, dword [ebp - 0xde0]
imul ecx, dword [eax]
cmp ecx, 1
jge 0x4762e0
mov dword [ebp - 0x1d68], 1
jmp 0x4762e7
and dword [ebp - 0x1d68], 0
mov eax, dword [ebp - 0x564]
cmp dword [ebp - 0x1d68], eax
jle 0x476301
mov dword [ebp - 0xde8], 1
jmp 0x476308
and dword [ebp - 0xde8], 0
mov esi, dword [ebp - 0x564]
imul esi, dword [ebp - 0xde8]
push 1
lea ecx, [ebp - 0x26c4]
call fcn.00434959
imul esi, dword [eax]
cmp esi, 2
jle 0x476336
mov dword [ebp - 0x1d70], 1
jmp 0x47633d
and dword [ebp - 0x1d70], 0
mov eax, dword [ebp - 0x870]
add eax, dword [ebp - 0x1d70]
cmp eax, 0xb29a
jle 0x47635c
mov dword [ebp - 0xdf0], 1
jmp 0x476363
and dword [ebp - 0xdf0], 0
push 0
lea ecx, [ebp - 0x26c4]
call fcn.00434959
mov ecx, dword [ebp - 0xdf0]
cmp ecx, dword [eax]
jl 0x476386
mov dword [ebp - 0x1d78], 1
jmp 0x47638d
and dword [ebp - 0x1d78], 0
mov eax, dword [ebp - 0x1d78]
mov dword [ebp - 0xf8], eax
push 0xfffffffffffffff7
pop eax
inc eax
jne 0x4763b1
cmp dword [ebp - 0x870], 0
jne 0x4763b1
and dword [ebp - 0x2684], 0
jmp 0x4763bb
mov dword [ebp - 0x2684], 1
mov eax, dword [ebp - 0x564]
cmp dword [ebp - 0x564], eax
jl 0x4763d5
mov dword [ebp - 0xdf8], 1
jmp 0x4763dc
and dword [ebp - 0xdf8], 0
push 0
lea ecx, [ebp - 0x26d4]
call fcn.00434959
mov ecx, dword [ebp - 0xdf8]
cmp ecx, dword [eax]
je 0x4763ff
mov dword [ebp - 0x268c], 1
jmp 0x476406
and dword [ebp - 0x268c], 0
mov dword [ebp - 0x870], 0xfff35779
jmp 0x4761da
lea ecx, [ebp - 0x26c4]
call fcn.0043493d
lea ecx, [ebp - 0x26d4]
call fcn.0043493d
mov dword [ebp - 0x160], 7
mov dword [ebp - 0x664], 0
jmp 0x47644e
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 3
jge 0x47646a
mov eax, dword [ebp - 0x664]
mov dword [ebp + eax*4 - 0x3720], 0x3b91
jmp 0x476441
mov dword [ebp - 0x160], 0
jmp 0x476483
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x47649f
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x3720], 0xfffb
jmp 0x476476
mov dword [ebp - 0x160], 0xfffffff7
jmp 0x4764b8
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffea
jge 0x4764f5
mov byte [ebp - 0x303], 0
movzx eax, byte [ebp - 0x303]
test eax, eax
je 0x4764f3
push 0
push 0xa08
push 0xa3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x4764ab
mov dword [ebp - 0x170], 0xffffffff
push 3
lea ecx, [ebp - 0x4a4]
call fcn.0043486b
push 3
lea ecx, [ebp - 0x59c]
call fcn.0043486b
mov dword [ebp - 0x2858], 6
mov dword [ebp - 0x237c], 0
mov dword [ebp - 0x2860], 0xf576
mov dword [ebp - 0x282c], 0x83dcdcbd
mov dword [ebp - 0x1c8], 0
jmp 0x47655a
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x47657c
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov dword [eax], 0x3342eb90
jmp 0x47654d
mov dword [ebp - 0x1c8], 0
jmp 0x476595
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x4765b7
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x59c]
call fcn.00434959
mov dword [eax], 0xfffffff7
jmp 0x476588
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
and dword [eax], 0
jmp 0x4765ed
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
mov dword [ebp - 0x1d80], eax
mov eax, dword [ebp - 0x1d80]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1d80]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
cmp dword [eax], 2
jg 0x476c56
mov dword [ebp - 0xa8], 0x182eac45
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x7c8], 0
jmp 0x476630
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 3
jge 0x47664c
mov eax, dword [ebp - 0x7c8]
mov dword [ebp + eax*4 - 0x2c7c], 1
jmp 0x476623
mov dword [ebp - 0xa8], 0
jmp 0x476665
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x4768b8
mov dword [ebp - 0x40c], 0x565e08cc
mov dword [ebp - 0x40c], 0
jmp 0x476695
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jg 0x4768b3
mov dword [ebp - 0x66c], 0
jmp 0x4766bb
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 3
jge 0x4766d7
mov eax, dword [ebp - 0x66c]
mov dword [ebp + eax*4 - 0x26e4], 0x6a205b29
jmp 0x4766ae
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov esi, eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [esi]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x26e4], 2
jmp 0x476736
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x26e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26e4], 0
jl 0x4768ae
mov dword [ebp - 0x2694], 1
push 2
lea ecx, [ebp - 0x2c64]
call fcn.0043486b
mov dword [ebp - 0x8c8], 0
jmp 0x47677a
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 2
jge 0x47679c
push dword [ebp - 0x8c8]
lea ecx, [ebp - 0x2c64]
call fcn.00434959
mov dword [eax], 0x9b857552
jmp 0x47676d
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov esi, eax
push 2
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x476834
mov eax, dword [ebp - 0x2694]
mov dword [ebp - 0xd8], eax
push 0
lea ecx, [ebp - 0x2c64]
call fcn.00434959
mov dword [ebp - 0xe00], eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [ebp - 0xe00]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xe00]
cmp dword [eax], 0
je 0x47681f
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x26e4]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
cmp dword [ebp - 0xd8], 0
je 0x476834
mov dword [ebp - 0x2850], 1
jmp 0x47683b
and dword [ebp - 0x2850], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov esi, eax
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x47688b
mov dword [ebp - 0x1d88], 1
jmp 0x476892
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x1d88]
mov dword [ebp - 0x2858], eax
lea ecx, [ebp - 0x2c64]
call fcn.0043493d
jmp 0x47671b
jmp 0x476688
jmp 0x476658
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
cmp dword [eax], 0xe548
jge 0x4768e6
mov dword [ebp - 0xe18], 1
jmp 0x4768ed
and dword [ebp - 0xe18], 0
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov esi, eax
push 2
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x476931
cmp dword [ebp - 0xa8], 0
je 0x476931
mov dword [ebp - 0xe08], 1
jmp 0x476938
and dword [ebp - 0xe08], 0
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
mov ecx, dword [ebp - 0xe08]
cmp ecx, dword [eax]
jle 0x47695b
mov dword [ebp - 0x1d90], 1
jmp 0x476962
and dword [ebp - 0x1d90], 0
push 0
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [ebp - 0x1d90]
cmp ecx, dword [eax]
jle 0x47698e
cmp dword [ebp - 0xd8], 0
je 0x47698e
mov dword [ebp - 0xe10], 1
jmp 0x476995
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xe10]
sub eax, dword [ebp - 0xd8]
cmp eax, 0xa828c040
jne 0x4769b4
mov dword [ebp - 0x1d98], 1
jmp 0x4769bb
and dword [ebp - 0x1d98], 0
mov eax, dword [ebp - 0x1d98]
sub eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xe18], eax
jne 0x4769db
mov dword [ebp - 0x1da0], 1
jmp 0x4769e2
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x1da0]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x476a09
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
cmp dword [eax], 0
je 0x476a34
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
cmp dword [eax], 0
je 0x476a34
mov dword [ebp - 0xe20], 1
jmp 0x476a3b
and dword [ebp - 0xe20], 0
push 0
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [ebp - 0xe20]
cmp ecx, dword [eax]
je 0x476a5e
mov dword [ebp - 0x1da8], 1
jmp 0x476a65
and dword [ebp - 0x1da8], 0
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
mov ecx, dword [ebp - 0x1da8]
cmp ecx, dword [eax]
jg 0x476a91
cmp dword [ebp - 0x2860], 0
je 0x476a91
mov dword [ebp - 0xe28], 1
jmp 0x476a98
and dword [ebp - 0xe28], 0
push 0
lea ecx, [ebp - 0x59c]
call fcn.00434959
mov ecx, dword [ebp - 0xe28]
cmp ecx, dword [eax]
jge 0x476abb
mov dword [ebp - 0x1db0], 1
jmp 0x476ac2
and dword [ebp - 0x1db0], 0
cmp dword [ebp - 0x1db0], 8
jl 0x476ad7
mov dword [ebp - 0xe30], 1
jmp 0x476ade
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe30]
add eax, 0xfff8
jne 0x476af8
xor eax, eax
jne 0x476af8
and dword [ebp - 0x2868], 0
jmp 0x476b02
mov dword [ebp - 0x2868], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2c7c]
mov dword [ebp - 0x3210], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2c7c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2c7c], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x282c], eax
mov dword [ebp - 0xd8], 0
jmp 0x476b52
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jg 0x476c51
mov dword [ebp - 0x2268], 0x172abf77
mov dword [ebp - 0xa8], 0
jmp 0x476b82
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x476c4c
mov dword [ebp - 0xe40], 0x784865e5
push 2
lea ecx, [ebp - 0x4a4]
call fcn.00434959
cmp dword [eax], 0
jne 0x476c16
cmp dword [ebp - 0xe40], 0
jne 0x476bc2
xor eax, eax
inc eax
jne 0x476bc2
and dword [ebp - 0xe38], 0
jmp 0x476bcc
mov dword [ebp - 0xe38], 1
push 2
lea ecx, [ebp - 0x59c]
call fcn.00434959
push dword [eax]
lea ecx, [ebp - 0x4a4]
call fcn.00434959
mov ecx, dword [ebp - 0x237c]
cmp dword [eax], ecx
jge 0x476bfc
mov dword [ebp - 0x1db8], 1
jmp 0x476c03
and dword [ebp - 0x1db8], 0
mov eax, dword [ebp - 0x1db8]
add eax, 0x4a9ff1db
cmp dword [ebp - 0xe38], eax
je 0x476c34
mov eax, 0x9cf94a22
test eax, eax
je 0x476c34
cmp dword [ebp - 0x2268], 0
je 0x476c34
mov dword [ebp - 0x1dc0], 1
jmp 0x476c3b
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 0x1dc0]
mov dword [ebp - 0xe40], eax
jmp 0x476b75
jmp 0x476b45
jmp 0x4765c9
lea ecx, [ebp - 0x59c]
call fcn.0043493d
lea ecx, [ebp - 0x4a4]
call fcn.0043493d
mov dword [ebp - 0x170], 0
jmp 0x476c85
cmp dword [ebp - 0x170], 0xffffffe6
je 0x4789ae
mov dword [ebp - 0x7d0], 1
mov dword [ebp - 0x3218], 0x32a27689
mov dword [ebp - 0x2270], 0xffffffff
mov dword [ebp - 0x2808], 0xfffffffc
mov dword [ebp - 0x44c], 0xffff
mov dword [ebp - 0x674], 0
jmp 0x476cdd
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 1
jge 0x476cf9
mov eax, dword [ebp - 0x674]
mov dword [ebp + eax*4 - 0x3220], 0xd6c3f0bc
jmp 0x476cd0
mov dword [ebp - 0x7d0], 0
jmp 0x476d12
mov eax, dword [ebp - 0x7d0]
inc eax
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 0xb
jg 0x476e29
mov dword [ebp - 0x3228], 1
push 2
lea ecx, [ebp - 0x33a8]
call fcn.0043486b
mov dword [ebp - 0x168], 0
jmp 0x476d4f
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x476d6b
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x3914], 0x7a73d2d6
jmp 0x476d42
mov dword [ebp - 0x168], 0
jmp 0x476d84
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x476da6
push dword [ebp - 0x168]
lea ecx, [ebp - 0x33a8]
call fcn.00434959
mov dword [eax], 1
jmp 0x476d77
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x44c], 0xffffffe5
jmp 0x476dcc
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0x13
jl 0x476e19
mov dword [ebp - 0x25ec], 9
imul eax, dword [ebp - 0x25ec], 0x266d
mov ecx, 0xd73df2ef
sub ecx, eax
cmp ecx, dword [ebp - 0x2270]
je 0x476e04
mov dword [ebp - 0x1dc8], 1
jmp 0x476e0b
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x1dc8]
mov dword [ebp - 0x2808], eax
jmp 0x476dbf
lea ecx, [ebp - 0x33a8]
call fcn.0043493d
jmp 0x476d05
mov dword [ebp - 0x358], 8
mov dword [ebp - 0xfd0], 1
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x350], 0x4456e348
mov dword [ebp - 0x6c], 0x6836
push 2
lea ecx, [ebp - 0x2228]
call fcn.0043486b
mov dword [ebp - 0x1e38], 0xffffffff
mov dword [ebp - 0xe90], 1
mov dword [ebp - 0x994], 0x72bf
mov dword [ebp - 0x2280], 0xb67c402
mov dword [ebp - 0x2e14], 0
mov dword [ebp - 0x2e10], 0
mov dword [ebp - 0x2e0c], 0
mov dword [ebp - 0x2e08], 0
mov dword [ebp - 0x67c], 0
jmp 0x476ecb
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 2
jge 0x476eed
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x2228]
call fcn.00434959
mov dword [eax], 0xeb8e136d
jmp 0x476ebe
mov eax, 0x3d1b
test eax, eax
je 0x476f7f
push 6
pop eax
test eax, eax
je 0x476f13
cmp dword [ebp - 0x50], 0
je 0x476f13
mov dword [ebp - 0xe48], 1
jmp 0x476f1a
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xe48], eax
jle 0x476f31
mov dword [ebp - 0x1dd0], 1
jmp 0x476f38
and dword [ebp - 0x1dd0], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x1dd0]
jl 0x476f4f
mov dword [ebp - 0xe50], 1
jmp 0x476f56
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x350], eax
jle 0x476f7f
cmp dword [ebp - 0x6c], 0
je 0x476f7f
mov dword [ebp - 0x1dd8], 1
jmp 0x476f86
and dword [ebp - 0x1dd8], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x1dd8]
mov ecx, dword [ebp - 0x6c]
lea eax, [eax + ecx + 0x1d7219c9]
test eax, eax
je 0x476fb0
cmp dword [ebp - 0x50], 0
je 0x476fb0
mov dword [ebp - 0xe58], 1
jmp 0x476fb7
and dword [ebp - 0xe58], 0
cmp dword [ebp - 0xe58], 0xffffffff
jne 0x476fcc
mov dword [ebp - 0x1de0], 1
jmp 0x476fd3
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x1de0]
add eax, 0x5c8
jne 0x476fed
mov eax, 0x8470
test eax, eax
je 0x47706d
mov dword [ebp - 0x2278], 0x2bbd4aa4
mov dword [ebp - 0x50], 1
jmp 0x477007
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x477068
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2228]
call fcn.00434959
mov eax, dword [eax]
mov dword [ebp - 0x2278], eax
mov dword [ebp - 0x6c], 0
jmp 0x477033
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jg 0x477066
mov byte [ebp - 0x305], 0
movzx eax, byte [ebp - 0x305]
test eax, eax
je 0x477064
push 0x20d2
push 0
push 0x1809
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x47702c
jmp 0x477000
jmp 0x47750c
mov dword [ebp - 0x414], 0x4fe874d4
mov dword [ebp - 0x4dc], 0x5ffff323
mov dword [ebp - 0x1e28], 0x24175c8f
mov dword [ebp - 0x2788], 0
mov dword [ebp - 0x1e20], 0xf7b6068b
mov dword [ebp - 0x3230], 0x916dc91e
mov dword [ebp - 0x878], 0
jmp 0x4770c2
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 4
jge 0x4770de
mov eax, dword [ebp - 0x878]
mov dword [ebp + eax*4 - 0x360c], 0xffffffff
jmp 0x4770b5
mov dword [ebp - 0x6c], 0
jmp 0x4770ee
cmp dword [ebp - 0x6c], 0x38
jl 0x477294
mov dword [ebp - 0x290], 0x275cf8b8
push 3
pop eax
test eax, eax
je 0x47715e
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x88afb1ca
jne 0x477133
cmp dword [ebp - 0x290], 0
jne 0x477133
and dword [ebp - 0xe60], 0
jmp 0x47713d
mov dword [ebp - 0xe60], 1
mov eax, dword [ebp - 0x290]
mov ecx, 0x16658069
sub ecx, dword [ebp - 0xe60]
sub eax, ecx
je 0x47715e
mov dword [ebp - 0x1de8], 1
jmp 0x477165
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x1de8], eax
je 0x47717f
mov dword [ebp - 0xe68], 1
jmp 0x477186
and dword [ebp - 0xe68], 0
imul eax, dword [ebp - 0xe68], 0x9bad
cmp eax, dword [ebp - 0x290]
jg 0x4771a4
mov dword [ebp - 0x1df0], 1
jmp 0x4771ab
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x1df0], eax
jl 0x4771c5
mov dword [ebp - 0xe70], 1
jmp 0x4771cc
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0xe70], eax
jne 0x4771e6
mov dword [ebp - 0x1df8], 1
jmp 0x4771ed
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x1df8]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x3238], eax
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x290], eax
jg 0x47721f
mov dword [ebp - 0xe78], 1
jmp 0x477226
and dword [ebp - 0xe78], 0
push 1
lea ecx, [ebp - 0x2228]
call fcn.00434959
mov ecx, dword [ebp - 0xe78]
mov dword [eax], ecx
mov dword [ebp - 0x290], 0
jmp 0x477254
cmp dword [ebp - 0x290], 1
jg 0x47728f
mov dword [ebp - 0x50], 0
jmp 0x47726d
jmp 0x4770e7
push 0
lea ecx, [ebp - 0x2228]
call fcn.00434959
cmp dword [eax], 0
je 0x477431
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x360c], 0x299d621d
jne 0x4772c9
mov dword [ebp - 0xad4], 1
jmp 0x4772d0
and dword [ebp - 0xad4], 0
push 1
lea ecx, [ebp - 0x2228]
call fcn.00434959
mov ecx, dword [ebp - 0xad4]
mov dword [eax], ecx
imul eax, dword [ebp - 0x994], 0x8187
sub eax, dword [ebp - 0xad4]
mov dword [ebp - 0x25f4], eax
mov eax, dword [ebp - 0x994]
inc eax
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x25f4], 1
ja 0x47731d
mov dword [ebp - 0x1e00], 1
jmp 0x477324
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x414]
imul eax, dword [ebp - 0x1e00]
cmp eax, dword [ebp - 0x350]
je 0x477345
mov dword [ebp - 0xe80], 1
jmp 0x47734c
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0xe80]
mov dword [ebp - 0x2280], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3240], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x3248], eax
mov eax, dword [ebp - 0x1e20]
mov dword [ebp - 0x1e08], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e08]
mov dword [ebp + eax - 0x2e14], ecx
mov eax, dword [ebp - 0xe90]
add eax, dword [ebp - 0x1e08]
cmp eax, dword [ebp - 0x6c]
jle 0x4773a9
mov dword [ebp - 0xe88], 1
jmp 0x4773b0
and dword [ebp - 0xe88], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x360c]
imul eax, dword [ebp - 0xe88]
cmp eax, dword [ebp - 0x414]
je 0x4773d7
mov dword [ebp - 0x1e10], 1
jmp 0x4773de
and dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x1e10]
mov dword [ebp - 0x2788], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x360c]
add eax, dword [ebp - 0xe90]
cmp eax, dword [ebp - 0x1e38]
jge 0x477410
mov dword [ebp - 0x1e18], 1
jmp 0x477417
and dword [ebp - 0x1e18], 0
mov eax, dword [ebp - 0x1e28]
cmp dword [ebp - 0x1e18], eax
jge 0x477431
mov dword [ebp - 0xe98], 1
jmp 0x477438
and dword [ebp - 0xe98], 0
cmp dword [ebp - 0xe98], 0xcd0122bf
jb 0x477450
mov dword [ebp - 0xea0], 1
jmp 0x477457
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0x1e20]
cmp dword [ebp - 0xea0], eax
je 0x477471
mov dword [ebp - 0xea8], 1
jmp 0x477478
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0x1e28]
cmp dword [ebp - 0xea8], eax
jne 0x477492
mov dword [ebp - 0x1e30], 1
jmp 0x477499
and dword [ebp - 0x1e30], 0
cmp dword [ebp - 0x1e30], 0xb01f
jne 0x4774b1
mov dword [ebp - 0xeb0], 1
jmp 0x4774b8
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0xeb0]
cmp eax, dword [ebp - 0x1e38]
jl 0x4774d8
mov dword [ebp - 0xeb8], 1
jmp 0x4774df
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0xeb8], eax
jne 0x4774f9
mov dword [ebp - 0x1e40], 1
jmp 0x477500
and dword [ebp - 0x1e40], 0
mov eax, dword [ebp - 0x1e40]
mov dword [ebp - 0x4dc], eax
lea ecx, [ebp - 0x2228]
call fcn.0043493d
mov dword [ebp - 0xadc], 0x9ea5d840
push 3
lea ecx, [ebp - 0xb6c]
call fcn.0043486b
mov dword [ebp - 0x220], 0
jmp 0x477547
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x477569
push dword [ebp - 0x220]
lea ecx, [ebp - 0xb6c]
call fcn.00434959
mov dword [eax], 0x334
jmp 0x47753a
mov dword [ebp - 0x220], 0
jmp 0x477582
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x47759e
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x4c4], 0xfffffffb
jmp 0x477575
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4c4], 0
jmp 0x4775cc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4c4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c4], 2
jg 0x4775f6
mov byte [ebp - 0x309], 0
movzx eax, byte [ebp - 0x309]
test eax, eax
je 0x4775f4
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x4775b1
push 2
lea ecx, [ebp - 0xb6c]
call fcn.00434959
cmp dword [eax], 0
jne 0x477631
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c4], 0
jne 0x477631
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c4], 0
jne 0x477631
and dword [ebp - 0xec0], 0
jmp 0x47763b
mov dword [ebp - 0xec0], 1
push 0
lea ecx, [ebp - 0xb6c]
call fcn.00434959
mov ecx, dword [ebp - 0xec0]
cmp ecx, dword [eax]
jne 0x47765e
mov dword [ebp - 0x1e48], 1
jmp 0x477665
and dword [ebp - 0x1e48], 0
push 1
lea ecx, [ebp - 0xb6c]
call fcn.00434959
mov ecx, dword [ebp - 0x1e48]
cmp ecx, dword [eax]
jl 0x477688
mov dword [ebp - 0xec8], 1
jmp 0x47768f
and dword [ebp - 0xec8], 0
cmp dword [ebp - 0xec8], 0x7b722ba7
jle 0x4776a7
mov dword [ebp - 0x1e50], 1
jmp 0x4776ae
and dword [ebp - 0x1e50], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e50]
mov dword [ebp + eax - 0x4c4], ecx
push 3
pop eax
cmp eax, 9
jb 0x4776d5
mov dword [ebp - 0x7e8], 0xfffffffb
push 1
lea ecx, [ebp - 0x2c94]
call fcn.0043486b
mov dword [ebp - 0x1d0], 0
jmp 0x4789de
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x4789fa
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x38d8], 0xba2a
jmp 0x4789d1
mov dword [ebp - 0x1d0], 0
jmp 0x478a13
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x478a35
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x2c94]
call fcn.00434959
mov dword [eax], 8
jmp 0x478a06
mov dword [ebp - 0x7e8], 0xb
jmp 0x478a4e
mov eax, dword [ebp - 0x7e8]
dec eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 0xfffffff1
jg 0x478b5c
mov dword [ebp - 0x41c], 0x888adae8
mov byte [ebp - 0x30d], 0
movzx eax, byte [ebp - 0x30d]
test eax, eax
je 0x478a9f
push 0xf21
push 0x1d30
push 0x529
push 0xd2a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x41c], 0
jmp 0x478ab8
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 2
jg 0x478b57
mov dword [ebp - 0x1008], 0xa5852835
mov eax, 0xbd035c57
test eax, eax
je 0x478b36
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 1
je 0x478af9
mov dword [ebp - 0x1f90], 1
jmp 0x478b00
and dword [ebp - 0x1f90], 0
cmp dword [ebp - 0x1f90], 0
ja 0x478b15
mov dword [ebp - 0x1010], 1
jmp 0x478b1c
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x1010]
je 0x478b36
mov dword [ebp - 0x1f98], 1
jmp 0x478b3d
and dword [ebp - 0x1f98], 0
push 0
lea ecx, [ebp - 0x2c94]
call fcn.00434959
mov ecx, dword [ebp - 0x1f98]
mov dword [eax], ecx
jmp 0x478aab
jmp 0x478a41
lea ecx, [ebp - 0x2c94]
call fcn.0043493d
push 1
lea eax, [ebp - 0x38f0]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0046e84c
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3768]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3768]
lea edi, [ebp - 0x2940]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x32f0], 0xffffffff
mov dword [ebp - 0x32f8], 0xe3245f1d
mov dword [ebp - 0x3300], 0xe2c0d37a
mov dword [ebp - 0x3308], 0xdcb363f9
mov dword [ebp - 0x3310], 0xfffffff9
push 1
lea ecx, [ebp - 0x33d8]
call fcn.0043486b
push 4
lea ecx, [ebp - 0x2cac]
call fcn.0043486b
mov dword [ebp - 0x38], 0
jmp 0x478bf2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x478c08
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3908], 0
jmp 0x478beb
mov dword [ebp - 0x38], 0
jmp 0x478c18
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x478c34
push dword [ebp - 0x38]
lea ecx, [ebp - 0x33d8]
call fcn.00434959
mov dword [eax], 0xfffffff7
jmp 0x478c11
mov dword [ebp - 0x38], 0
jmp 0x478c44
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x478c60
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2cac]
call fcn.00434959
mov dword [eax], 0xfffc
jmp 0x478c3d
push 1
lea ecx, [ebp - 0x2cac]
call fcn.00434959
mov dword [ebp - 0x1018], eax
mov eax, dword [ebp - 0x1018]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1018]
mov dword [ecx], eax
lea ecx, [ebp - 0x2cac]
call fcn.0043493d
lea ecx, [ebp - 0x33d8]
call fcn.0043493d
push 4
lea ecx, [ebp - 0x2160]
call fcn.0043486b
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x6ac], 0
jmp 0x478cca
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 4
jge 0x478cec
push dword [ebp - 0x6ac]
lea ecx, [ebp - 0x2160]
call fcn.00434959
mov dword [eax], 0x4e2
jmp 0x478cbd
push 2
lea ecx, [ebp - 0x2160]
call fcn.00434959
mov dword [ebp - 0x1fa0], eax
mov eax, dword [ebp - 0x1fa0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1fa0]
mov dword [ecx], eax
mov dword [ebp - 0x534], 3
jmp 0x478d29
mov eax, dword [ebp - 0x534]
dec eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
jl 0x478fc2
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x4f4], 0xa22e974a
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x178], 0
jmp 0x478d70
cmp dword [ebp - 0x178], 3
jg 0x478fbd
mov dword [ebp - 0x454], 0x2b90f998
mov dword [ebp - 0x2428], 2
push dword [ebp - 0x178]
lea ecx, [ebp - 0x2160]
call fcn.00434959
mov dword [ebp - 0x1020], eax
push dword [ebp - 0x178]
lea ecx, [ebp - 0x2160]
call fcn.00434959
mov ecx, dword [ebp - 0x1020]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1020]
mov eax, dword [eax]
neg eax
cmp eax, 0x28ea3888
jl 0x478de0
mov dword [ebp - 0x1fa8], 1
jmp 0x478de7
and dword [ebp - 0x1fa8], 0
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x1fa8], eax
jle 0x478e01
mov dword [ebp - 0x1fb0], 1
jmp 0x478e08
and dword [ebp - 0x1fb0], 0
push 3
pop eax
test eax, eax
je 0x478e24
cmp dword [ebp - 0x534], 0
je 0x478e24
mov dword [ebp - 0x1028], 1
jmp 0x478e2b
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x1028], eax
je 0x478e45
mov dword [ebp - 0x1030], 1
jmp 0x478e4c
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x1fb0]
cmp eax, dword [ebp - 0x1030]
jle 0x478e66
mov dword [ebp - 0x1fb8], 1
jmp 0x478e6d
and dword [ebp - 0x1fb8], 0
cmp dword [ebp - 0x1fb8], 0
jge 0x478e82
jmp 0x478d1c
lea ecx, [ebp - 0x2160]
call fcn.0043493d
mov dword [ebp - 0x6b4], 0xfffffff8
mov dword [ebp - 0x3318], 0xc5534bf8
mov dword [ebp - 0x3320], 0xffffffff
mov dword [ebp - 0x3328], 0xffffffff
mov dword [ebp - 0x3330], 3
mov dword [ebp - 0x3338], 0x844a7543
mov dword [ebp - 0x3340], 0xf415d724
mov dword [ebp - 0x3348], 0
push 3
lea ecx, [ebp - 0x33f8]
call fcn.0043486b
mov dword [ebp - 0x356c], 0x1253
mov dword [ebp - 0x3574], 0x46b4
mov dword [ebp - 0x357c], 0xd25bb086
mov dword [ebp - 0x2a54], 3
mov dword [ebp - 0x2a50], 3
mov dword [ebp - 0x2a4c], 3
mov dword [ebp - 0x2a48], 3
lea ecx, [ebp - 0xb0d]
call fcn.00434968
push eax
lea eax, [ebp - 0x2a44]
push eax
lea eax, [ebp - 0x2a54]
push eax
lea ecx, [ebp - 0x3898]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x33e8]
call fcn.00434917
mov dword [ebp - 0x8d0], 0
jmp 0x4790be
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 3
jge 0x4790e0
push dword [ebp - 0x8d0]
lea ecx, [ebp - 0x33f8]
call fcn.00434959
mov dword [eax], 0xb1943c6f
jmp 0x4790b1
mov dword [ebp - 0x6b4], 0
jmp 0x4790f9
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 7
jg 0x479162
mov dword [ebp - 0x7f0], 0x97eede0b
mov dword [ebp - 0x7f0], 0
jmp 0x479125
cmp dword [ebp - 0x7f0], 0xffffffe2
jg 0x479160
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
test eax, eax
je 0x47915e
push 0
push 0x84
push 0x588
push 0x16aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
jmp 0x479118
jmp 0x4790ec
push 2
lea ecx, [ebp - 0x33e8]
call fcn.00434959
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0x1040]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1040]
mov dword [ecx], eax
lea ecx, [ebp - 0x33e8]
call fcn.0043493d
lea ecx, [ebp - 0x33f8]
call fcn.0043493d
mov dword [ebp - 0x368], 7
mov dword [ebp - 0xb0], 0xfffffff8
mov dword [ebp - 0x7c], 8
push 1
lea ecx, [ebp - 0x2714]
call fcn.0043486b
mov dword [ebp - 0x110], 0x9d707d8e
mov dword [ebp - 0x9b4], 0x1f7ee045
mov dword [ebp - 0x200], 0
jmp 0x4791f1
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x479213
push dword [ebp - 0x200]
lea ecx, [ebp - 0x2714]
call fcn.00434959
mov dword [eax], 0x60df3928
jmp 0x4791e4
mov dword [ebp - 0x200], 0
jmp 0x47922c
cmp dword [ebp - 0x200], 1
jge 0x479248
cmp dword [ebp + 8], 1
jne 0x487c58
mov dword [ebp - 0x2ae0], 0x39b642c7
mov dword [ebp - 0x2adc], 0x39b642c7
mov dword [ebp - 0x2ad8], 0x39b642c7
mov dword [ebp - 0x2ad4], 0x39b642c7
lea ecx, [ebp - 0xa7d]
call fcn.00434968
push eax
lea eax, [ebp - 0x2ad0]
push eax
lea eax, [ebp - 0x2ae0]
push eax
lea ecx, [ebp - 0x3870]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3744]
call fcn.00434917
mov dword [ebp - 0x3558], 0x9869
mov dword [ebp - 0x2fdc], 0xe6e2bfbd
mov dword [ebp - 0x32ec], 0xe6d3
mov dword [ebp - 0x2fe4], 0xffffffff
mov dword [ebp - 0x1050], 0xfffffffb
mov byte [ebp - 0x2dc], 0
movzx eax, byte [ebp - 0x2dc]
test eax, eax
je 0x482f81
push 0
push 0x17be
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x1050]
dec eax
mov dword [ebp - 0x1050], eax
lea ecx, [ebp - 0x3744]
call fcn.0043493d
mov dword [ebp - 0x1080], 1
mov dword [ebp - 0x284c], 8
mov dword [ebp - 0x24e4], 0xffff
push 1
lea ecx, [ebp - 0x3478]
call fcn.0043486b
mov dword [ebp - 0x164], 0
jmp 0x482fdd
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x482ff9
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x6c8], 0x8ec0ae97
jmp 0x482fd0
mov dword [ebp - 0x164], 0
jmp 0x483012
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x483034
push dword [ebp - 0x164]
lea ecx, [ebp - 0x3478]
call fcn.00434959
mov dword [eax], 0xdc1b6eab
jmp 0x483005
mov byte [ebp - 0x3a9], 0
movzx eax, byte [ebp - 0x3a9]
test eax, eax
je 0x48305c
push 0x1ee1
push 0
push 0
push 0x12af
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6c8], 0xffffffef
jmp 0x48308a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x6c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c8], 0xfffffffc
je 0x4831b0
mov dword [ebp - 0x1044], 0x5542afa0
mov dword [ebp - 0x6d0], 0
jmp 0x4830c1
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 2
jge 0x4830dd
mov eax, dword [ebp - 0x6d0]
mov dword [ebp + eax*4 - 0x2994], 1
jmp 0x4830b4
mov byte [ebp - 0x2e0], 0
movzx eax, byte [ebp - 0x2e0]
test eax, eax
je 0x4830fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2994]
cmp dword [ebp - 0x1080], eax
jle 0x48311d
mov dword [ebp - 0x1058], 1
jmp 0x483124
and dword [ebp - 0x1058], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2994], 1
jne 0x483140
mov dword [ebp - 0x1060], 1
jmp 0x483147
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x1058]
cmp eax, dword [ebp - 0x1060]
jle 0x483161
mov dword [ebp - 0x1068], 1
jmp 0x483168
and dword [ebp - 0x1068], 0
imul eax, dword [ebp - 0x1068], 0xffff
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x284c]
cmp dword [ebp - 0x1044], eax
jle 0x483192
mov dword [ebp - 0x1078], 1
jmp 0x483199
and dword [ebp - 0x1078], 0
mov eax, dword [ebp - 0x1078]
sub eax, dword [ebp - 0x24e4]
mov dword [ebp - 0x1080], eax
jmp 0x48306f
lea ecx, [ebp - 0x3478]
call fcn.0043493d
mov dword [ebp - 0x34], 0xf0b96ca2
mov dword [ebp - 0x4f0], 0xffffffff
mov dword [ebp - 0x10b0], 1
mov dword [ebp - 0x978], 1
mov dword [ebp - 0x10e8], 2
mov dword [ebp - 0x24f4], 0
mov dword [ebp - 0x2690], 0xffffffff
mov dword [ebp - 0x24fc], 0x4ad4db1d
mov dword [ebp - 0x6d8], 0
jmp 0x483221
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 1
jge 0x48323d
mov eax, dword [ebp - 0x6d8]
mov dword [ebp + eax*4 - 0x10d8], 7
jmp 0x483214
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3688], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0
jne 0x483273
cmp dword [ebp - 0x4f0], 0
jne 0x483273
mov eax, 0xf860
test eax, eax
jne 0x483273
and dword [ebp - 0x1088], 0
jmp 0x48327d
mov dword [ebp - 0x1088], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1088], eax
je 0x483294
mov dword [ebp - 0x1090], 1
jmp 0x48329b
and dword [ebp - 0x1090], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1090], eax
je 0x4832b2
mov dword [ebp - 0x2688], 1
jmp 0x4832b9
and dword [ebp - 0x2688], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4f0], eax
jle 0x4832d6
mov eax, 0x3abefa02
test eax, eax
jne 0x4832d6
and dword [ebp - 0x1098], 0
jmp 0x4832e0
mov dword [ebp - 0x1098], 1
cmp dword [ebp - 0x1098], 0xc5604491
jne 0x4832f8
mov dword [ebp - 0x10a0], 1
jmp 0x4832ff
and dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x10a0]
sub eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jg 0x483319
mov dword [ebp - 0x10a8], 1
jmp 0x483320
and dword [ebp - 0x10a8], 0
mov eax, dword [ebp - 0x10a8]
neg eax
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x10b0], eax
jne 0x483345
mov dword [ebp - 0x24ec], 1
jmp 0x48334c
and dword [ebp - 0x24ec], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2fec], eax
mov dword [ebp - 0x978], 0x5744
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x978], eax
je 0x483376
mov dword [ebp - 0x10b8], 1
jmp 0x48337d
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x10e8]
cmp dword [ebp - 0x10b8], eax
jne 0x483397
mov dword [ebp - 0x10c0], 1
jmp 0x48339e
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x10c0], eax
jne 0x4833b5
mov dword [ebp - 0x27fc], 1
jmp 0x4833bc
and dword [ebp - 0x27fc], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x32f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10d8]
mov dword [ebp - 0x2ff4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3560], eax
mov eax, dword [ebp - 0x24f4]
cmp dword [ebp - 0x4f0], eax
jge 0x4833fb
mov dword [ebp - 0x10c8], 1
jmp 0x483402
and dword [ebp - 0x10c8], 0
cmp dword [ebp - 0x10c8], 0
je 0x48341d
cmp dword [ebp - 0x978], 0
jne 0x48341d
and dword [ebp - 0x10d0], 0
jmp 0x483427
mov dword [ebp - 0x10d0], 1
cmp dword [ebp - 0x10d0], 0
jg 0x48343c
mov dword [ebp - 0x10e0], 1
jmp 0x483443
and dword [ebp - 0x10e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10d8]
cmp dword [ebp - 0x10e0], eax
jne 0x48346d
cmp dword [ebp - 0x10e8], 0
je 0x48346d
mov dword [ebp - 0x10f0], 1
jmp 0x483474
and dword [ebp - 0x10f0], 0
mov eax, dword [ebp - 0x2690]
cmp dword [ebp - 0x10f0], eax
jl 0x48348e
mov dword [ebp - 0x10f8], 1
jmp 0x483495
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x10f8]
cmp eax, 4
jae 0x4834af
mov dword [ebp - 0x1100], 1
jmp 0x4834b6
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x24fc], eax
mov byte [ebp - 0x314], 0
movzx eax, byte [ebp - 0x314]
test eax, eax
je 0x4834da
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 0x3b0], 2
mov dword [ebp - 0x10c], 0xba339924
mov dword [ebp - 0x6e8], 0x38f738f5
mov dword [ebp - 0x274], 0xe6da
mov dword [ebp - 0x2e24], 2
mov dword [ebp - 0x2e20], 2
mov dword [ebp - 0x2e1c], 2
mov dword [ebp - 0x2e18], 2
mov dword [ebp - 0x1170], 0xc89d693c
mov dword [ebp - 0x1198], 0xa684085e
push 4
lea ecx, [ebp - 0x2bbc]
call fcn.0043486b
mov dword [ebp - 0x6e0], 0
jmp 0x483564
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 4
jge 0x483586
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0x2bbc]
call fcn.00434959
mov dword [eax], 0xa2181788
jmp 0x483557
mov byte [ebp - 0x2e2], 0
movzx eax, byte [ebp - 0x2e2]
test eax, eax
je 0x4835a2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 0x10c], 0x4105fda2
jge 0x4835ba
mov dword [ebp - 0x1108], 1
jmp 0x4835c1
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
imul eax, dword [ebp - 0x1108]
add eax, 0x2ad0
cmp eax, 0x9935
je 0x4835f2
mov dword [ebp - 0x2834], 1
jmp 0x4835f9
and dword [ebp - 0x2834], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2ffc], eax
cmp dword [ebp - 0x6e8], 0x744e
jg 0x48361d
mov dword [ebp - 0x1110], 1
jmp 0x483624
and dword [ebp - 0x1110], 0
cmp dword [ebp - 0x1110], 0xffffffff
jg 0x48363f
cmp dword [ebp - 0x6e8], 0
jne 0x48363f
and dword [ebp - 0x1118], 0
jmp 0x483649
mov dword [ebp - 0x1118], 1
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1118], eax
jg 0x483663
mov dword [ebp - 0x1120], 1
jmp 0x48366a
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1120], eax
jge 0x483684
mov dword [ebp - 0x980], 1
jmp 0x48368b
and dword [ebp - 0x980], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x980]
mov dword [ebp + eax - 0x2e24], ecx
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x980], eax
jne 0x4836b7
mov dword [ebp - 0x2504], 1
jmp 0x4836be
and dword [ebp - 0x2504], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], eax
jle 0x4836da
or eax, 0xffffffff
jne 0x4836da
and dword [ebp - 0x2698], 0
jmp 0x4836e4
mov dword [ebp - 0x2698], 1
mov eax, dword [ebp - 0x274]
add eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x274]
jg 0x483704
mov dword [ebp - 0x1128], 1
jmp 0x48370b
and dword [ebp - 0x1128], 0
cmp dword [ebp - 0x1128], 0xffff
je 0x483723
mov dword [ebp - 0x1130], 1
jmp 0x48372a
and dword [ebp - 0x1130], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x1130], eax
jl 0x483744
mov dword [ebp - 0x1138], 1
jmp 0x48374b
and dword [ebp - 0x1138], 0
cmp dword [ebp - 0x1138], 0xfffffff9
jle 0x483760
mov dword [ebp - 0x1140], 1
jmp 0x483767
and dword [ebp - 0x1140], 0
cmp dword [ebp - 0x1140], 3
jae 0x48377c
mov dword [ebp - 0x1148], 1
jmp 0x483783
and dword [ebp - 0x1148], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1148], eax
jge 0x48379d
mov dword [ebp - 0x1150], 1
jmp 0x4837a4
and dword [ebp - 0x1150], 0
cmp dword [ebp - 0x1150], 0xffffffff
jge 0x4837b9
mov dword [ebp - 0x1158], 1
jmp 0x4837c0
and dword [ebp - 0x1158], 0
cmp dword [ebp - 0x1158], 0xce2e
jne 0x4837d8
mov dword [ebp - 0x1160], 1
jmp 0x4837df
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x1160]
jge 0x4837f9
mov dword [ebp - 0x1168], 1
jmp 0x483800
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x1168]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x1170], 0xdc32
jge 0x483824
mov dword [ebp - 0x1178], 1
jmp 0x48382b
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x274]
add eax, dword [ebp - 0x1178]
sub eax, dword [ebp - 0x10c]
cmp eax, 0xfce4a839
je 0x483850
mov dword [ebp - 0x1180], 1
jmp 0x483857
and dword [ebp - 0x1180], 0
mov eax, dword [ebp - 0x1180]
add eax, 0x16e149f7
cmp dword [ebp - 0x10c], eax
jl 0x483876
mov dword [ebp - 0x2aa4], 1
mov dword [ebp - 0x2aa0], 1
mov dword [ebp - 0x2a9c], 1
mov dword [ebp - 0x2a98], 1
lea ecx, [ebp - 0xa8d]
call fcn.00434968
push eax
lea eax, [ebp - 0x2a94]
push eax
lea eax, [ebp - 0x2aa4]
push eax
lea ecx, [ebp - 0x3890]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2184]
call fcn.00434917
mov dword [ebp - 0x1898], 1
mov dword [ebp - 0x25d4], 0xd0e75d5f
mov dword [ebp - 0x18a0], 0x953526c7
mov dword [ebp - 0x854], 0
jmp 0x487cec
mov eax, dword [ebp - 0x854]
inc eax
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 1
jge 0x487d08
mov eax, dword [ebp - 0x854]
mov dword [ebp + eax*4 - 0x2768], 0xc099a567
jmp 0x487cdf
push 0
lea ecx, [ebp - 0x2184]
call fcn.00434959
cmp dword [eax], 0xfff6
jbe 0x487d29
mov dword [ebp - 0x27f8], 1
jmp 0x487d30
and dword [ebp - 0x27f8], 0
push 2
lea ecx, [ebp - 0x2184]
call fcn.00434959
push 3
lea ecx, [ebp - 0x2184]
call fcn.00434959
cmp dword [eax], 0xffffffff
jle 0x487d5b
mov dword [ebp - 0x1878], 1
jmp 0x487d62
and dword [ebp - 0x1878], 0
push 0
lea ecx, [ebp - 0x2184]
call fcn.00434959
mov ecx, dword [ebp - 0x1878]
add ecx, dword [eax]
mov dword [ebp - 0x1898], ecx
push 0xfffffffffffffffd
pop eax
cmp eax, 0x9f58382b
jbe 0x487d93
mov dword [ebp - 0x1880], 1
jmp 0x487d9a
and dword [ebp - 0x1880], 0
mov eax, dword [ebp - 0x25d4]
imul eax, dword [ebp - 0x1880]
cmp eax, 0x75ee4c20
jne 0x487dba
mov dword [ebp - 0x1888], 1
jmp 0x487dc1
and dword [ebp - 0x1888], 0
cmp dword [ebp - 0x1888], 0xffffffff
jg 0x487dd6
mov dword [ebp - 0x1890], 1
jmp 0x487ddd
and dword [ebp - 0x1890], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2768]
cmp dword [ebp - 0x1890], eax
jge 0x487dfe
mov dword [ebp - 0x25dc], 1
jmp 0x487e05
and dword [ebp - 0x25dc], 0
push 0
lea ecx, [ebp - 0x2184]
call fcn.00434959
mov esi, dword [ebp - 0x1898]
push 0
lea ecx, [ebp - 0x2184]
call fcn.00434959
mov dword [eax], esi
mov dword [ebp - 0x18a0], 1
mov dword [ebp - 0x18a0], 1
lea ecx, [ebp - 0x2184]
call fcn.0043493d
mov dword [ebp - 0x874], 7
mov dword [ebp - 0xdc], 0xac204e2d
mov dword [ebp - 0x85c], 0
jmp 0x487e73
mov eax, dword [ebp - 0x85c]
inc eax
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 1
jge 0x487e8f
mov eax, dword [ebp - 0x85c]
mov dword [ebp + eax*4 - 0x2800], 0xdfba22e9
jmp 0x487e66
mov dword [ebp - 0xdc], 0
jmp 0x487ea8
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xffffffe3
jge 0x487f80
mov dword [ebp - 0x18c0], 0x985a9576
mov dword [ebp - 0x18d8], 1
mov dword [ebp - 0x18a8], 0xffff
cmp dword [ebp - 0xdc], 0
je 0x487eed
xor eax, eax
inc eax
je 0x487eed
mov dword [ebp - 0x18b8], 1
jmp 0x487ef4
and dword [ebp - 0x18b8], 0
cmp dword [ebp - 0x18d8], 0
jne 0x487f38
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x18a8]
cmp eax, 6
jl 0x487f1a
mov dword [ebp - 0x18b0], 1
jmp 0x487f21
and dword [ebp - 0x18b0], 0
mov eax, dword [ebp - 0x18a8]
cmp eax, dword [ebp - 0x18b0]
jne 0x487f38
and dword [ebp - 0x18c8], 0
jmp 0x487f42
mov dword [ebp - 0x18c8], 1
mov eax, dword [ebp - 0x18b8]
mov dword [ebp - 0x18c0], eax
mov eax, dword [ebp - 0x18c0]
cmp eax, dword [ebp - 0x18c8]
jl 0x487f68
mov dword [ebp - 0x18d0], 1
jmp 0x487f6f
and dword [ebp - 0x18d0], 0
mov eax, dword [ebp - 0x18d0]
mov dword [ebp - 0x18d8], eax
jmp 0x487e9b
mov dword [ebp - 0xdc], 0
jmp 0x487f99
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x487fb5
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x2800], 0x274952f
jmp 0x487f8c
mov dword [ebp - 0x19b0], 0x2f76ec75
push 4
lea ecx, [ebp - 0xb78]
call fcn.0043486b
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0xa08], 0
mov dword [ebp - 0x18f8], 0x5943e2f7
mov dword [ebp - 0x25e4], 0
mov dword [ebp - 0x864], 0
jmp 0x48800d
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 4
jge 0x48802f
push dword [ebp - 0x864]
lea ecx, [ebp - 0xb78]
call fcn.00434959
mov dword [eax], 0xc0ae
jmp 0x488000
push 2
lea ecx, [ebp - 0xb78]
call fcn.00434959
mov dword [ebp - 0x18e0], eax
mov eax, dword [ebp - 0x18e0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x18e0]
mov dword [ecx], eax
cmp dword [ebp - 0x1cc], 0
je 0x48815c
push 0
lea ecx, [ebp - 0xb78]
call fcn.00434959
mov ecx, dword [ebp - 0x1cc]
cmp dword [eax], ecx
je 0x488083
mov dword [ebp - 0x18e8], 1
jmp 0x48808a
and dword [ebp - 0x18e8], 0
cmp dword [ebp - 0x1cc], 7
jbe 0x48809a
cmp dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x18e8]
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0xa08], eax
jge 0x4880c9
cmp dword [ebp - 0xa08], 0
je 0x4880c9
mov dword [ebp - 0x18f0], 1
jmp 0x4880d0
and dword [ebp - 0x18f0], 0
mov eax, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f8], eax
mov esi, dword [ebp - 0x18f8]
push 3
lea ecx, [ebp - 0xb78]
call fcn.00434959
add esi, dword [eax]
jne 0x48810e
push 2
lea ecx, [ebp - 0xb78]
call fcn.00434959
cmp dword [eax], 0
jne 0x48810e
and dword [ebp - 0x1900], 0
jmp 0x488118
mov dword [ebp - 0x1900], 1
push 2
lea ecx, [ebp - 0xb78]
call fcn.00434959
mov ecx, dword [ebp - 0x1900]
cmp ecx, dword [eax]
jl 0x48813b
mov dword [ebp - 0x1908], 1
jmp 0x488142
and dword [ebp - 0x1908], 0
mov eax, dword [ebp - 0x1908]
sub eax, dword [ebp - 0x1cc]
je 0x48815c
mov dword [ebp - 0x1910], 1
jmp 0x488163
and dword [ebp - 0x1910], 0
imul eax, dword [ebp - 0x1910], 0x4442
cmp dword [ebp - 0x1cc], eax
je 0x488181
mov dword [ebp - 0x1918], 1
jmp 0x488188
and dword [ebp - 0x1918], 0
cmp dword [ebp - 0x1918], 1
jle 0x48819d
mov dword [ebp - 0x1920], 1
jmp 0x4881a4
and dword [ebp - 0x1920], 0
push 3
lea ecx, [ebp - 0xb78]
call fcn.00434959
mov ecx, dword [ebp - 0x1920]
cmp ecx, dword [eax]
jg 0x4881c7
mov dword [ebp - 0x1928], 1
jmp 0x4881ce
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x1928]
mov dword [ebp - 0x1cc], eax
mov esi, dword [ebp - 0x1cc]
push 2
lea ecx, [ebp - 0xb78]
call fcn.00434959
cmp esi, dword [eax]
jle 0x4881fd
mov dword [ebp - 0x1930], 1
jmp 0x488204
and dword [ebp - 0x1930], 0
mov eax, dword [ebp - 0x1930]
mov dword [ebp - 0x25e4], eax
lea ecx, [ebp - 0xb78]
call fcn.0043493d
mov dword [ebp - 0x35a8], 0x6c902da
push 4
lea ecx, [ebp - 0x219c]
call fcn.0043486b
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x86c], 0
jmp 0x488255
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 4
jge 0x488277
push dword [ebp - 0x86c]
lea ecx, [ebp - 0x219c]
call fcn.00434959
mov dword [eax], 0x4e2
jmp 0x488248
push 2
lea ecx, [ebp - 0x219c]
call fcn.00434959
mov dword [ebp - 0x1938], eax
mov eax, dword [ebp - 0x1938]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1938]
mov dword [ecx], eax
mov dword [ebp - 0x548], 3
jmp 0x4882b4
mov eax, dword [ebp - 0x548]
dec eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
jl 0x48854d
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x550], 0xa22e974a
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d4], 0
jmp 0x4882fb
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jg 0x488548
mov dword [ebp - 0x440], 0x2b90f998
mov dword [ebp - 0x2778], 2
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x219c]
call fcn.00434959
mov dword [ebp - 0x1940], eax
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x219c]
call fcn.00434959
mov ecx, dword [ebp - 0x1940]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1940]
mov eax, dword [eax]
neg eax
cmp eax, 0x28ea3888
jl 0x48836b
mov dword [ebp - 0x1948], 1
jmp 0x488372
and dword [ebp - 0x1948], 0
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x1948], eax
jle 0x48838c
mov dword [ebp - 0x1958], 1
jmp 0x488393
and dword [ebp - 0x1958], 0
push 3
pop eax
test eax, eax
je 0x4883af
cmp dword [ebp - 0x548], 0
je 0x4883af
mov dword [ebp - 0x1950], 1
jmp 0x4883b6
and dword [ebp - 0x1950], 0
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x1950], eax
je 0x4883d0
mov dword [ebp - 0x1960], 1
jmp 0x4883d7
and dword [ebp - 0x1960], 0
mov eax, dword [ebp - 0x1958]
cmp eax, dword [ebp - 0x1960]
jle 0x4883f1
mov dword [ebp - 0x1968], 1
jmp 0x4883f8
and dword [ebp - 0x1968], 0
cmp dword [ebp - 0x1968], 0
jge 0x48840d
mov dword [ebp - 0x1970], 1
jmp 0x488414
and dword [ebp - 0x1970], 0
cmp dword [ebp - 0x1970], 0xfffffffb
jne 0x4884fa
mov byte [ebp - 0x3c9], 0
movzx eax, byte [ebp - 0x3c9]
test eax, eax
je 0x488441
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x440], 3
jmp 0x48845a
mov eax, dword [ebp - 0x440]
dec eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jl 0x4884f8
mov dword [ebp - 0x550], 0
jmp 0x488480
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 3
jg 0x4884d6
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x219c]
call fcn.00434959
cmp dword [eax], 0
je 0x4884c1
push dword [ebp - 0x440]
lea ecx, [ebp - 0x219c]
call fcn.00434959
cmp dword [eax], 0
je 0x4884c1
mov dword [ebp - 0x1978], 1
jmp 0x4884c8
and dword [ebp - 0x1978], 0
mov eax, dword [ebp - 0x1978]
mov dword [ebp - 0x2778], eax
jmp 0x488473
mov byte [ebp - 0x2f8], 0
movzx eax, byte [ebp - 0x2f8]
test eax, eax
je 0x4884f3
push 0x4e3
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x48844d
jmp 0x48851a
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x48851a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0x2fa], 0
movzx eax, byte [ebp - 0x2fa]
test eax, eax
je 0x488543
push 0xade
push 0x1f59
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x4882ee
jmp 0x4882a7
lea ecx, [ebp - 0x219c]
call fcn.0043493d
mov dword [ebp - 0x19c8], 0x7084bc9c
mov dword [ebp - 0x311c], 0xfffffff6
push 1
lea ecx, [ebp - 0x27b4]
call fcn.0043486b
mov dword [ebp - 0x2264], 0x934b0b4e
mov dword [ebp - 0x2df4], 0xbdd7
mov dword [ebp - 0x2df0], 0xbdd7
mov dword [ebp - 0x2dec], 0xbdd7
mov dword [ebp - 0x2de8], 0xbdd7
mov dword [ebp - 0x2260], 0
mov dword [ebp - 0x1dc], 0
jmp 0x4885ce
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x4885ed
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x27b4]
call fcn.00434959
or dword [eax], 0xffffffff
jmp 0x4885c1
mov dword [ebp - 0x1dc], 0
jmp 0x488606
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x488622
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x34d8], 0
jmp 0x4885f9
mov byte [ebp - 0x391], 0
movzx eax, byte [ebp - 0x391]
test eax, eax
je 0x488645
push 0xc6c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x33cc], eax
cmp dword [ebp - 0x874], 0
jne 0x48874c
push 2
pop eax
test eax, eax
je 0x48868c
push 0
lea ecx, [ebp - 0x27b4]
call fcn.00434959
cmp dword [eax], 0
je 0x48868c
mov eax, 0xbb1bb30b
test eax, eax
je 0x48868c
mov dword [ebp - 0x1980], 1
jmp 0x488693
and dword [ebp - 0x1980], 0
mov eax, dword [ebp - 0x2260]
cmp dword [ebp - 0x1980], eax
je 0x4886ad
mov dword [ebp - 0x1988], 1
jmp 0x4886b4
and dword [ebp - 0x1988], 0
cmp dword [ebp - 0x1988], 0xffff
jb 0x4886d3
push 2
pop eax
test eax, eax
je 0x4886d3
mov dword [ebp - 0x1990], 1
jmp 0x4886da
and dword [ebp - 0x1990], 0
mov eax, dword [ebp - 0x874]
cmp dword [ebp - 0x1990], eax
jne 0x4886f4
mov dword [ebp - 0x1998], 1
jmp 0x4886fb
and dword [ebp - 0x1998], 0
push 0
lea ecx, [ebp - 0x27b4]
call fcn.00434959
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1998]
jg 0x48871e
mov dword [ebp - 0x19a8], 1
jmp 0x488725
and dword [ebp - 0x19a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34d8]
inc eax
mov dword [ebp - 0x19a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19a0]
mov dword [ebp + eax - 0x34d8], ecx
mov eax, dword [ebp - 0x2264]
mov dword [ebp - 0x19b0], eax
mov eax, dword [ebp - 0x19b0]
inc eax
cmp eax, 9
je 0x488770
mov dword [ebp - 0x19b8], 1
jmp 0x488777
and dword [ebp - 0x19b8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2df4]
cmp dword [ebp - 0x19b8], eax
jge 0x488797
mov dword [ebp - 0x19c0], 1
jmp 0x48879e
and dword [ebp - 0x19c0], 0
mov eax, dword [ebp - 0x19c0]
mov dword [ebp - 0x19c8], eax
cmp dword [ebp - 0x19c8], 0
je 0x4887c4
xor eax, eax
inc eax
je 0x4887c4
mov dword [ebp - 0x19d0], 1
jmp 0x4887cb
and dword [ebp - 0x19d0], 0
mov eax, dword [ebp - 0x874]
cmp dword [ebp - 0x19d0], eax
je 0x4887e5
mov dword [ebp - 0x19d8], 1
jmp 0x4887ec
and dword [ebp - 0x19d8], 0
push 0
lea ecx, [ebp - 0x27b4]
call fcn.00434959
mov ecx, dword [ebp - 0x19d8]
mov dword [eax], ecx
lea ecx, [ebp - 0x27b4]
call fcn.0043493d
xor ecx, ecx
call fcn.00434bd6
push eax
call fcn.0048e4a3
pop ecx
mov dword [ebp - 8], 6
mov dword [ebp - 0xc4], 0x5cc48b16
push 4
lea ecx, [ebp - 0x21b4]
call fcn.0043486b
mov dword [ebp - 0x1a80], 8
push 1
lea ecx, [ebp - 0x2cd0]
call fcn.0043486b
mov dword [ebp - 0x1e4], 0
jmp 0x488868
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x48888a
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x21b4]
call fcn.00434959
mov dword [eax], 1
jmp 0x48885b
mov dword [ebp - 0x1e4], 0
jmp 0x4888a3
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x4888c5
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2cd0]
call fcn.00434959
mov dword [eax], 0x11945b4e
jmp 0x488896
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xc2c9ebf4
jae 0x4888e6
mov dword [ebp - 0x19e0], 1
jmp 0x4888ed
and dword [ebp - 0x19e0], 0
mov eax, dword [ebp - 0x19e0]
sub eax, dword [ebp - 8]
je 0x48890a
cmp dword [ebp - 8], 0
je 0x48890a
mov dword [ebp - 0x19e8], 1
jmp 0x488911
and dword [ebp - 0x19e8], 0
mov eax, dword [ebp - 0x19e8]
sub eax, dword [ebp - 8]
cmp eax, 0xcd329b3a
jb 0x48892d
mov dword [ebp - 0x226c], 1
jmp 0x488934
and dword [ebp - 0x226c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3124], eax
cmp dword [ebp - 8], 0
je 0x488954
xor eax, eax
inc eax
je 0x488954
mov dword [ebp - 0x19f0], 1
jmp 0x48895b
and dword [ebp - 0x19f0], 0
cmp dword [ebp - 0x19f0], 0xffffffff
jbe 0x488970
mov dword [ebp - 0x19f8], 1
jmp 0x488977
and dword [ebp - 0x19f8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x19f8]
jg 0x48898e
mov dword [ebp - 0x1a00], 1
jmp 0x488995
and dword [ebp - 0x1a00], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x1a00]
cmp eax, dword [ebp - 8]
je 0x4889b0
mov dword [ebp - 0x1a08], 1
jmp 0x4889b7
and dword [ebp - 0x1a08], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1a08], eax
jl 0x4889ce
mov dword [ebp - 0x1a10], 1
jmp 0x4889d5
and dword [ebp - 0x1a10], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1a10]
jg 0x488a0e
mov byte [ebp - 0x2fc], 0
movzx eax, byte [ebp - 0x2fc]
test eax, eax
je 0x488a09
push 0x41d
push 0x814
push 0x267c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x488b63
mov dword [ebp - 0x87c], 8
mov dword [ebp - 0x1a18], 0x77dfcc86
mov dword [ebp - 0x2274], 0xad8e65dd
mov dword [ebp - 0x1a48], 8
cmp dword [ebp - 0x87c], 0
jae 0x488a4b
mov dword [ebp - 0x1a30], 1
jmp 0x488a52
and dword [ebp - 0x1a30], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x1a18], eax
mov eax, dword [ebp - 0x1a18]
mov dword [ebp - 0x3660], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x312c], eax
cmp dword [ebp - 8], 0x67bc6200
jge 0x488a88