Function at 0x479630
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Get common file path
Get disk information
Get file system object information
Identify system language via api
Query or enumerate registry key
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c99e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3ed4
call fcn.004b90b0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1214], 0x756f
mov dword [ebp - 0x26c], 0x4f833fcb
mov dword [ebp - 0x734], 0
jmp 0x479686
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 1
jge 0x4796a2
mov eax, dword [ebp - 0x734]
mov dword [ebp + eax*4 - 0x5f0], 0xffffffff
jmp 0x479679
mov dword [ebp - 0x26c], 0
jmp 0x4796bb
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jg 0x479932
mov dword [ebp - 0xe10], 1
mov dword [ebp - 0x29dc], 0xfffffff8
mov dword [ebp - 0x9c8], 0
jmp 0x4796f5
mov eax, dword [ebp - 0x9c8]
inc eax
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 2
jge 0x479711
mov eax, dword [ebp - 0x9c8]
mov dword [ebp + eax*4 - 0x2514], 0x77dd6887
jmp 0x4796e8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2514], 0
jmp 0x47973f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2514]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2514], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2514], 0
jl 0x47992d
mov dword [ebp - 0xe18], 0xc31e13ca
mov dword [ebp - 0x2a8c], 0x9339b884
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x5f0], 1
mov dword [ebp - 0xe10], 1
cmp dword [ebp - 0xe10], 0
je 0x47986e
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp + eax*4 - 0x5f0]
cmp dword [ebp - 0x29dc], eax
jle 0x4797b0
mov dword [ebp - 0x1ad4], 1
jmp 0x4797b7
and dword [ebp - 0x1ad4], 0
cmp dword [ebp - 0x1ad4], 0x8451f1e2
jb 0x4797cf
mov dword [ebp - 0x24c0], 1
jmp 0x4797d6
and dword [ebp - 0x24c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x26c]
mov ecx, dword [ebp + ecx*4 - 0x5f0]
imul ecx, dword [ebp - 0x24c0]
cmp dword [ebp + eax - 0x5f0], ecx
jg 0x479805
mov dword [ebp - 0x24c8], 1
jmp 0x47980c
and dword [ebp - 0x24c8], 0
mov eax, dword [ebp - 0x26c]
add eax, dword [ebp - 0x24c8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5f0]
jg 0x479833
mov dword [ebp - 0x24d0], 1
jmp 0x47983a
and dword [ebp - 0x24d0], 0
mov eax, dword [ebp - 0x24d0]
mov dword [ebp - 0xe18], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2514]
mov eax, dword [ebp + eax*4 - 0x5f0]
cmp eax, dword [ebp - 0xe18]
jl 0x47986e
mov dword [ebp - 0x24d8], 1
jmp 0x479875
and dword [ebp - 0x24d8], 0
cmp dword [ebp - 0x24d8], 0x54e5
jle 0x47988d
mov dword [ebp - 0x2a84], 1
jmp 0x479894
and dword [ebp - 0x2a84], 0
mov eax, 0x39c9d940
test eax, eax
je 0x4798b2
cmp dword [ebp - 0xe10], 0
je 0x4798b2
mov dword [ebp - 0x24e0], 1
jmp 0x4798b9
and dword [ebp - 0x24e0], 0
cmp dword [ebp - 0x24e0], 4
jbe 0x4798ce
mov dword [ebp - 0x24e8], 1
jmp 0x4798d5
and dword [ebp - 0x24e8], 0
cmp dword [ebp - 0x24e8], 0xaf14
jl 0x4798f6
cmp dword [ebp - 0xe18], 0
je 0x4798f6
mov dword [ebp - 0x24f0], 1
jmp 0x4798fd
and dword [ebp - 0x24f0], 0
cmp dword [ebp - 0x24f0], 0x451d
je 0x479915
mov dword [ebp - 0x24f8], 1
jmp 0x47991c
and dword [ebp - 0x24f8], 0
mov eax, dword [ebp - 0x24f8]
mov dword [ebp - 0x2a8c], eax
jmp 0x479724
jmp 0x4796ae
mov byte [ebp - 0x4fe], 0
movzx eax, byte [ebp - 0x4fe]
test eax, eax
je 0x47994c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xe4], 0x5c8094a
mov dword [ebp - 0x3a4], 0x6ca0cec5
mov dword [ebp - 0x73c], 0
jmp 0x479979
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 2
jge 0x479995
mov eax, dword [ebp - 0x73c]
mov dword [ebp + eax*4 - 0xc48], 0xf9b3
jmp 0x47996c
mov dword [ebp - 0xe4], 1
jmp 0x4799ae
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x479e85
mov dword [ebp - 0x5f8], 0xffffffff
mov dword [ebp - 0xb54], 0
mov dword [ebp - 0x744], 0xfffffffc
mov dword [ebp - 0x262c], 0x6e19ccd2
mov dword [ebp - 0x2aa4], 1
mov eax, dword [ebp - 0xe4]
cmp dword [ebp + eax*4 - 0xc48], 0
je 0x479a02
jmp 0x479e85
mov dword [ebp - 0x5f8], 0
jmp 0x479a1b
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 1
jg 0x479e80
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x9a4], 1
mov byte [ebp - 0x316], 0
movzx eax, byte [ebp - 0x316]
test eax, eax
je 0x479a51
call dword [sym.imp.USER32.dll_DestroyCaret]
mov eax, dword [ebp - 0x5f8]
cmp dword [ebp - 0x74], eax
je 0x479a68
mov dword [ebp - 0x2a94], 1
jmp 0x479a6f
and dword [ebp - 0x2a94], 0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0xc48], ecx
jne 0x479a8d
mov dword [ebp - 0x2500], 1
jmp 0x479a94
and dword [ebp - 0x2500], 0
cmp dword [ebp - 0x2500], 0x413e
jle 0x479aac
mov dword [ebp - 0x2508], 1
jmp 0x479ab3
and dword [ebp - 0x2508], 0
cmp dword [ebp - 0x2508], 2
jne 0x479ac8
mov dword [ebp - 0x25ac], 1
jmp 0x479acf
and dword [ebp - 0x25ac], 0
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp + eax*4 - 0xc48]
cmp dword [ebp - 0x25ac], eax
jg 0x479af0
mov dword [ebp - 0x25b4], 1
jmp 0x479af7
and dword [ebp - 0x25b4], 0
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x25b4]
add eax, 8
cmp eax, 0xfffffff9
jg 0x479b14
mov dword [ebp - 0x25bc], 1
jmp 0x479b1b
and dword [ebp - 0x25bc], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x25bc], eax
jle 0x479b32
mov dword [ebp - 0x25c4], 1
jmp 0x479b39
and dword [ebp - 0x25c4], 0
mov eax, dword [ebp - 0x5f8]
imul eax, dword [ebp - 0x25c4]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9a4]
add eax, 0x79a1e402
cmp eax, 1
ja 0x479b68
mov dword [ebp - 0x25cc], 1
jmp 0x479b6f
and dword [ebp - 0x25cc], 0
mov eax, dword [ebp - 0x25cc]
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x3a4], eax
jg 0x479b92
mov dword [ebp - 0x25d4], 1
jmp 0x479b99
and dword [ebp - 0x25d4], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x25d4]
add eax, 0x76bd
mov ecx, dword [ebp - 0xe4]
cmp eax, dword [ebp + ecx*4 - 0xc48]
jge 0x479bc3
mov dword [ebp - 0x25dc], 1
jmp 0x479bca
and dword [ebp - 0x25dc], 0
mov eax, dword [ebp - 0x25dc]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x3a4], 0
je 0x479bf1
cmp dword [ebp - 0x74], 0
je 0x479bf1
mov dword [ebp - 0x25e4], 1
jmp 0x479bf8
and dword [ebp - 0x25e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc48]
cmp dword [ebp - 0x25e4], eax
je 0x479c19
mov dword [ebp - 0x25ec], 1
jmp 0x479c20
and dword [ebp - 0x25ec], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x25ec], eax
jg 0x479c3a
mov dword [ebp - 0x25f4], 1
jmp 0x479c41
and dword [ebp - 0x25f4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0xb54]
cmp eax, dword [ebp - 0x25f4]
jg 0x479c67
mov dword [ebp - 0x25fc], 1
jmp 0x479c6e
and dword [ebp - 0x25fc], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x25fc]
jl 0x479e70
mov dword [ebp - 0xe20], 0x6068be3e
mov dword [ebp - 0x2aac], 0x73ca56b7
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x262c]
cmp dword [ebp - 0x9a4], eax
jne 0x479cb7
mov dword [ebp - 0x2604], 1
jmp 0x479cbe
and dword [ebp - 0x2604], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x2604], eax
jne 0x479cd5
mov dword [ebp - 0x260c], 1
jmp 0x479cdc
and dword [ebp - 0x260c], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x260c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xc48]
je 0x479d00
mov dword [ebp - 0x2a9c], 1
jmp 0x479d07
and dword [ebp - 0x2a9c], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3c08], eax
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x3a58], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x37b0], eax
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp - 0x2aa4]
cmp dword [ebp + eax*4 - 0xc48], ecx
jne 0x479d4f
mov dword [ebp - 0x2614], 1
jmp 0x479d56
and dword [ebp - 0x2614], 0
mov eax, dword [ebp - 0x2614]
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x3c38], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x37b8], eax
imul eax, dword [ebp - 0xe20], 0xc535
cmp eax, 0xa52c43da
jbe 0x479d94
mov dword [ebp - 0x261c], 1
jmp 0x479d9b
and dword [ebp - 0x261c], 0
cmp dword [ebp - 0x261c], 0x2eed
jg 0x479db3
mov dword [ebp - 0x2624], 1
jmp 0x479dba
and dword [ebp - 0x2624], 0
xor eax, eax
sub eax, dword [ebp - 0x2624]
sub eax, dword [ebp - 0xb54]
imul eax, dword [ebp - 0x262c]
mov ecx, dword [ebp - 0xe4]
sub eax, dword [ebp + ecx*4 - 0xc48]
dec eax
cmp eax, dword [ebp - 0xe20]
jl 0x479df1
mov dword [ebp - 0x2634], 1
jmp 0x479df8
and dword [ebp - 0x2634], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x2634], eax
jge 0x479e0f
mov dword [ebp - 0x263c], 1
jmp 0x479e16
and dword [ebp - 0x263c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x263c], eax
jge 0x479e2d
mov dword [ebp - 0x2644], 1
jmp 0x479e34
and dword [ebp - 0x2644], 0
mov eax, dword [ebp - 0x2644]
sub eax, dword [ebp - 0xe20]
mov dword [ebp - 0x271c], 1
jmp 0x479e53
mov eax, dword [ebp - 0x271c]
sub eax, 7
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x2aac], eax
jmp 0x479e7b
cmp dword [ebp - 0x3a4], 0
je 0x479e7b
jmp 0x479e80
jmp 0x479a0e
jmp 0x4799a1
mov dword [ebp - 0x1c], 0x2971
mov dword [ebp - 0x2abc], 0xd58
mov dword [ebp - 0x2ac4], 0
mov dword [ebp - 0x1c], 0xe91a049f
cmp dword [ebp - 0x1c], 0
je 0x47a052
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x479ec9
mov dword [ebp - 0x26b0], 1
jmp 0x479ed0
and dword [ebp - 0x26b0], 0
cmp dword [ebp - 0x26b0], 0xefa97f51
jne 0x479ee8
mov dword [ebp - 0x2640], 1
jmp 0x479eef
and dword [ebp - 0x2640], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2640], eax
jle 0x479f06
mov dword [ebp - 0x2364], 1
jmp 0x479f0d
and dword [ebp - 0x2364], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2364], eax
jg 0x479f24
mov dword [ebp - 0x1dc8], 1
jmp 0x479f2b
and dword [ebp - 0x1dc8], 0
cmp dword [ebp - 0x1dc8], 0x6b3e713e
jle 0x479f43
mov dword [ebp - 0xf48], 1
jmp 0x479f4a
and dword [ebp - 0xf48], 0
cmp dword [ebp - 0xf48], 0xfff7
je 0x479f62
mov dword [ebp - 0x1dd0], 1
jmp 0x479f69
and dword [ebp - 0x1dd0], 0
cmp dword [ebp - 0x1dd0], 0x54c9
je 0x479f81
mov dword [ebp - 0xf50], 1
jmp 0x479f88
and dword [ebp - 0xf50], 0
cmp dword [ebp - 0xf50], 3
ja 0x479f9d
mov dword [ebp - 0x2ab4], 1
jmp 0x479fa4
and dword [ebp - 0x2ab4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3a68], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x37c0], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
je 0x479fca
mov dword [ebp - 0x1dd8], 1
jmp 0x479fd1
and dword [ebp - 0x1dd8], 0
cmp dword [ebp - 0x1dd8], 1
je 0x479fe6
mov dword [ebp - 0xf58], 1
jmp 0x479fed
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xf58]
sub eax, dword [ebp - 0x1c]
cmp eax, 1
jg 0x47a00b
mov dword [ebp - 0x1de0], 1
jmp 0x47a012
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1de0], eax
jl 0x47a029
mov dword [ebp - 0xf60], 1
jmp 0x47a030
and dword [ebp - 0xf60], 0
mov eax, dword [ebp - 0xf60]
sub eax, dword [ebp - 0x1c]
jne 0x47a03f
cmp dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3b90], eax
mov eax, dword [ebp - 0x2abc]
imul eax, dword [ebp - 0x1c]
or eax, 0xffffffff
je 0x47a062
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2ac4], eax
jmp 0x47a092
mov byte [ebp - 0x353], 0
movzx eax, byte [ebp - 0x353]
test eax, eax
je 0x47a092
push 0x2226
push 0x1649
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x1df0], 0x2364
mov dword [ebp - 0xe88], 0xd4df
mov dword [ebp - 0xe90], 0xfffffffc
mov dword [ebp - 0xed8], 0xffffffff
mov dword [ebp - 0xed4], 0xffffffff
mov dword [ebp - 0xed0], 0xffffffff
mov dword [ebp - 0xecc], 0xffffffff
push 1
lea ecx, [ebp - 0x2964]
call fcn.00438263
mov dword [ebp - 0x754], 0xffffffff
mov dword [ebp - 0xf80], 0xfffffff8
mov dword [ebp - 0xe98], 1
mov dword [ebp - 0x2c60], 0xfffffffc
mov dword [ebp - 0x2c78], 1
mov dword [ebp - 0x74c], 0
jmp 0x47a130
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 1
jge 0x47a152
push dword [ebp - 0x74c]
lea ecx, [ebp - 0x2964]
call fcn.00438351
mov dword [eax], 0x9a07b304
jmp 0x47a123
cmp dword [ebp - 0x1df0], 0
je 0x47a2e9
cmp dword [ebp - 0xe88], 0
je 0x47a27e
or eax, 0xffffffff
je 0x47a186
cmp dword [ebp - 0xe90], 0
je 0x47a186
mov dword [ebp - 0x1de8], 1
jmp 0x47a18d
and dword [ebp - 0x1de8], 0
push 0
lea ecx, [ebp - 0x2964]
call fcn.00438351
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp - 0xe78]
mov eax, dword [eax]
mov dword [ebp - 0x2acc], eax
mov eax, dword [ebp - 0x1de8]
mov dword [ebp - 0x2ad4], eax
mov eax, dword [ebp - 0xe78]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe78]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2acc]
cmp eax, dword [ebp - 0x2ad4]
jl 0x47a1e5
mov dword [ebp - 0xf68], 1
jmp 0x47a1ec
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0xe88]
cmp eax, dword [ebp - 0xf68]
jle 0x47a218
push 0
lea ecx, [ebp - 0x2964]
call fcn.00438351
cmp dword [eax], 0
je 0x47a218
mov dword [ebp - 0xf70], 1
jmp 0x47a21f
and dword [ebp - 0xf70], 0
mov eax, dword [ebp - 0x1df0]
cmp dword [ebp - 0xf70], eax
jg 0x47a239
mov dword [ebp - 0x1df8], 1
jmp 0x47a240
and dword [ebp - 0x1df8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1df8]
sub ecx, dword [ebp + eax - 0xed8]
jne 0x47a267
cmp dword [ebp - 0x754], 0
jne 0x47a267
and dword [ebp - 0xf78], 0
jmp 0x47a271
mov dword [ebp - 0xf78], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed8]
mov eax, dword [ebp - 0xe98]
cmp dword [ebp - 0xf80], eax
jne 0x47a298
mov dword [ebp - 0x1e00], 1
jmp 0x47a29f
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x1e00]
dec eax
cmp eax, dword [ebp - 0xf80]
je 0x47a2ba
mov dword [ebp - 0xe80], 1
jmp 0x47a2c1
and dword [ebp - 0xe80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe80]
mov dword [ebp + eax - 0xed8], ecx
cmp dword [ebp - 0xe80], 0
je 0x47a2e9
mov dword [ebp - 0x1e08], 1
jmp 0x47a2f0
and dword [ebp - 0x1e08], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x1e08], eax
jge 0x47a335
mov byte [ebp - 0x318], 0
movzx eax, byte [ebp - 0x318]
test eax, eax
je 0x47a330
push 0x6e3
push 0x1733
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x47a7bf
mov dword [ebp - 0x220], 0xad33d2af
mov dword [ebp - 0x618], 0xfffffff9
mov dword [ebp - 0x718], 0xfffffffd
mov dword [ebp - 0x2c70], 0xf620
push 0
lea ecx, [ebp - 0x2964]
call fcn.00438351
cmp dword [eax], 0
jne 0x47a440
mov eax, dword [ebp - 0xe88]
cmp dword [ebp - 0x220], eax
jne 0x47a38f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xed8], 0
mov eax, 0xc71837de
test eax, eax
jne 0x47a3a6
xor eax, eax
inc eax
jne 0x47a3a6
and dword [ebp - 0x2adc], 0
jmp 0x47a3b0
mov dword [ebp - 0x2adc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xed8]
dec eax
mov dword [ebp - 0xf88], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf88]
mov dword [ebp + eax - 0xed8], ecx
mov eax, dword [ebp - 0x754]
imul eax, dword [ebp - 0xf88]
cmp eax, 0xffffffff
jle 0x47a3f5
mov dword [ebp - 0x2ae4], 1
jmp 0x47a3fc
and dword [ebp - 0x2ae4], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x37c8], eax
xor eax, eax
inc eax
jne 0x47a41f
cmp dword [ebp - 0x220], 0
jne 0x47a41f
and dword [ebp - 0x1e10], 0
jmp 0x47a429
mov dword [ebp - 0x1e10], 1
mov eax, dword [ebp - 0xe98]
cmp dword [ebp - 0x1e10], eax
jle 0x47a440
and dword [ebp - 0x2aec], 0
jmp 0x47a44a
mov dword [ebp - 0x2aec], 1
cmp dword [ebp - 0x220], 0x51ad
jne 0x47a462
mov dword [ebp - 0xf90], 1
jmp 0x47a469
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xe90], eax
imul eax, dword [ebp - 0xf90], 9
mov ecx, dword [ebp - 0x618]
add ecx, dword [ebp - 0xe90]
cmp ecx, eax
jge 0x47a4a4
mov dword [ebp - 0x1e18], 1
jmp 0x47a4ab
and dword [ebp - 0x1e18], 0
cmp dword [ebp - 0x1e18], 0x961f
jl 0x47a4c3
mov dword [ebp - 0xf98], 1
jmp 0x47a4ca
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0xf98]
mov dword [ebp - 0x718], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed8], 0
je 0x47a529
mov dword [ebp - 0x1e20], 0x2865603b
mov eax, dword [ebp - 0x1e20]
mov dword [ebp - 0x3a78], eax
mov eax, dword [ebp - 0xe98]
xor ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1e20]
sub ecx, 0x280b7bc8
lea eax, [eax + ecx + 0x65d6]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xed8], eax
jmp 0x47a7bf
mov dword [ebp - 0x9ac], 8
mov dword [ebp - 0x2c68], 0xcc4b
mov dword [ebp - 0xfb8], 0x7343453d
mov dword [ebp - 0x2c90], 0x36de7ca8
cmp dword [ebp - 0x9ac], 0
jne 0x47a615
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xed8]
cmp dword [ebp - 0x220], eax
jg 0x47a57f
mov dword [ebp - 0x2af4], 1
jmp 0x47a586
and dword [ebp - 0x2af4], 0
cmp dword [ebp - 0x9ac], 0x6106a478
jl 0x47a59e
mov dword [ebp - 0x2afc], 1
jmp 0x47a5a5
and dword [ebp - 0x2afc], 0
mov eax, dword [ebp - 0x2c60]
mov dword [ebp - 0x37d0], eax
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x718], eax
imul eax, dword [ebp - 0x718], 0xe97b
sub eax, 0x483a1010
cmp eax, 0x33f8a1c3
jne 0x47a5df
mov dword [ebp - 0xfa0], 1
jmp 0x47a5e6
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0x9ac]
cmp dword [ebp - 0xfa0], eax
jle 0x47a600
mov dword [ebp - 0x1e28], 1
jmp 0x47a607
and dword [ebp - 0x1e28], 0
imul eax, dword [ebp - 0x1e28], 0x3de9
test eax, eax
ja 0x47a62a
cmp dword [ebp - 0x2c68], 0
je 0x47a62a
mov dword [ebp - 0xfa8], 1
jmp 0x47a631
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0xfa8]
je 0x47a654
cmp dword [ebp - 0x2c70], 0
je 0x47a654
mov dword [ebp - 0x1e30], 1
jmp 0x47a65b
and dword [ebp - 0x1e30], 0
cmp dword [ebp - 0x1e30], 0xc451
jne 0x47a673
mov dword [ebp - 0xfb0], 1
jmp 0x47a67a
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0xfb0]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x2c78]
sub eax, 0x4f7330a3
cmp dword [ebp - 0x618], eax
jle 0x47a6a5
mov dword [ebp - 0x1e38], 1
jmp 0x47a6ac
and dword [ebp - 0x1e38], 0
mov eax, dword [ebp - 0x718]
cmp dword [ebp - 0x1e38], eax
jl 0x47a6c6
mov dword [ebp - 0x1e40], 1
jmp 0x47a6cd
and dword [ebp - 0x1e40], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x3bf0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xed8], 0
jne 0x47a6fb
cmp dword [ebp - 0x618], 0
jne 0x47a6fb
and dword [ebp - 0x2c80], 0
jmp 0x47a705
mov dword [ebp - 0x2c80], 1
cmp dword [ebp - 0x220], 0
jne 0x47a720
mov eax, 0xdea92552
test eax, eax
jne 0x47a720
and dword [ebp - 0x2c88], 0
jmp 0x47a72a
mov dword [ebp - 0x2c88], 1
mov dword [ebp - 0xfb8], 0xc90b
mov eax, dword [ebp - 0xfb8]
cmp dword [ebp - 0x1e40], eax
je 0x47a74e
mov dword [ebp - 0xfc0], 1
jmp 0x47a755
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x718]
cmp dword [ebp - 0xfc0], eax
jne 0x47a76f
mov dword [ebp - 0x1e48], 1
jmp 0x47a776
and dword [ebp - 0x1e48], 0
push 0
lea ecx, [ebp - 0x2964]
call fcn.00438351
mov ecx, dword [ebp - 0x1e48]
cmp ecx, dword [eax]
je 0x47a799
mov dword [ebp - 0xea0], 1
jmp 0x47a7a0
and dword [ebp - 0xea0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xea0]
mov dword [ebp + eax - 0xed8], ecx
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x2c90], eax
lea ecx, [ebp - 0x2964]
call fcn.00438335
mov dword [ebp - 0x2c0], 0x4f833fcb
mov dword [ebp - 0x600], 0xd5e48d32
mov dword [ebp - 0x2c98], 0xfffffff6
mov dword [ebp - 0x1e60], 1
mov dword [ebp - 0x600], 0x16
jmp 0x47a80b
mov eax, dword [ebp - 0x600]
dec eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0x11
je 0x47aa46
mov dword [ebp - 0xea8], 0xb39523dd
mov dword [ebp - 0x1e68], 0x38eb16e2
mov dword [ebp - 0x2ca8], 0xd8d955a6
mov dword [ebp - 0x180], 0
jmp 0x47a84f
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 4
jge 0x47a86b
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x3d8c], 0
jmp 0x47a842
mov dword [ebp - 0x180], 0
jmp 0x47a884
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x47a8a0
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x594], 1
jmp 0x47a877
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x594], 3
jmp 0x47a8ce
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x594], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0
jl 0x47aa41
mov dword [ebp - 0xfd8], 0xfff9
mov dword [ebp - 0x1e58], 0xcb5af9f7
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x47a912
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x2c98]
mov dword [ebp - 0x37d8], eax
cmp dword [ebp - 0x600], 0x65e3
jg 0x47a936
mov dword [ebp - 0xfe0], 1
jmp 0x47a93d
and dword [ebp - 0xfe0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d8c], 0
jae 0x47a959
mov dword [ebp - 0xfc8], 1
jmp 0x47a960
and dword [ebp - 0xfc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp eax, dword [ebp - 0xfc8]
jne 0x47a987
mov eax, 0x5f79
test eax, eax
jne 0x47a987
and dword [ebp - 0x1e50], 0
jmp 0x47a991
mov dword [ebp - 0x1e50], 1
mov eax, dword [ebp - 0xfd8]
cmp dword [ebp - 0x1e50], eax
jle 0x47a9ab
mov dword [ebp - 0xfd0], 1
jmp 0x47a9b2
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0xfd0]
mov dword [ebp - 0x1e58], eax
mov eax, dword [ebp - 0x1e58]
mov dword [ebp - 0x3a88], eax
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x37e0], eax
mov eax, 0xe3ca3691
sub eax, dword [ebp - 0x600]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0xea8]
mov dword [ebp - 0x1e60], eax
mov eax, dword [ebp - 0x1e60]
add eax, dword [ebp - 0xfe0]
je 0x47aa1d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0
je 0x47aa1d
mov dword [ebp - 0x2ca0], 1
jmp 0x47aa24
and dword [ebp - 0x2ca0], 0
mov eax, dword [ebp - 0xea8]
mov dword [ebp - 0x1e68], eax
mov eax, dword [ebp - 0x1e68]
mov dword [ebp - 0x2ca8], eax
jmp 0x47a8b3
jmp 0x47a7fe
mov dword [ebp - 0x134], 0xfffffff9
push 1
lea ecx, [ebp - 0x2988]
call fcn.00438263
mov dword [ebp - 0xeb0], 0xffffffff
push 3
lea ecx, [ebp - 0x3398]
call fcn.00438263
mov dword [ebp - 0x228], 0
jmp 0x47aa8d
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x47aaaf
push dword [ebp - 0x228]
lea ecx, [ebp - 0x2988]
call fcn.00438351
mov dword [eax], 0xbbb66efe
jmp 0x47aa80
mov dword [ebp - 0x228], 0
jmp 0x47aac8
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x47aaea
push dword [ebp - 0x228]
lea ecx, [ebp - 0x3398]
call fcn.00438351
mov dword [eax], 0x2d89188b
jmp 0x47aabb
mov dword [ebp - 0x134], 0
jmp 0x47ab03
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffe7
jle 0x47abf7
mov dword [ebp - 0xacc], 0
jmp 0x47ab29
mov eax, dword [ebp - 0xacc]
inc eax
mov dword [ebp - 0xacc], eax
cmp dword [ebp - 0xacc], 4
jge 0x47ab45
mov eax, dword [ebp - 0xacc]
mov dword [ebp + eax*4 - 0x34bc], 5
jmp 0x47ab1c
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x34bc], 0
jmp 0x47ab73
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x34bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x34bc], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x34bc], 0x11
jg 0x47abd5
mov dword [ebp - 0x75c], 0
jmp 0x47ab9c
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 2
jge 0x47abb8
mov eax, dword [ebp - 0x75c]
mov dword [ebp + eax*4 - 0x3200], 0xffffffff
jmp 0x47ab8f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3200]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3200], eax
jmp 0x47ab58
mov byte [ebp - 0x31a], 0
movzx eax, byte [ebp - 0x31a]
test eax, eax
je 0x47abf2
push 0x485
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x47aaf6
mov dword [ebp - 0x134], 0
jmp 0x47ac10
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x16
je 0x47af1a
mov dword [ebp - 0x1e70], 0xb5f0b101
mov dword [ebp - 0x30b0], 4
mov dword [ebp - 0x30ac], 4
mov dword [ebp - 0x30a8], 4
mov dword [ebp - 0x30a4], 4
mov dword [ebp - 0x9b4], 0
jmp 0x47ac68
mov eax, dword [ebp - 0x9b4]
inc eax
mov dword [ebp - 0x9b4], eax
cmp dword [ebp - 0x9b4], 4
jge 0x47ac84
mov eax, dword [ebp - 0x9b4]
mov dword [ebp + eax*4 - 0x3c4c], 0xc0e2632c
jmp 0x47ac5b
mov eax, dword [ebp - 0x1e70]
mov dword [ebp - 0x3adc], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3c4c], 0
xor eax, eax
cmp eax, 0x4adca1a1
jg 0x47acc3
push 6
pop eax
test eax, eax
jne 0x47acc3
cmp dword [ebp - 0x134], 0
jne 0x47acc3
and dword [ebp - 0x2cb0], 0
jmp 0x47accd
mov dword [ebp - 0x2cb0], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x30b0], 0xdcefbde2
ja 0x47aceb
mov dword [ebp - 0xfe8], 1
jmp 0x47acf2
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0xfe8], eax
jne 0x47ad0c
mov dword [ebp - 0xff0], 1
jmp 0x47ad13
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x1e70]
cmp dword [ebp - 0xff0], eax
jle 0x47ad2d
mov dword [ebp - 0x1e78], 1
jmp 0x47ad34
and dword [ebp - 0x1e78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30b0]
cmp dword [ebp - 0x1e78], eax
jge 0x47ad9a
mov dword [ebp - 0x37e8], 0
mov dword [ebp - 0x764], 0
jmp 0x47ad6c
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 3
jge 0x47ad88
mov eax, dword [ebp - 0x764]
mov dword [ebp + eax*4 - 0x3e18], 0xeab3ae5d
jmp 0x47ad5f
mov eax, dword [ebp - 0xeb0]
dec eax
mov dword [ebp - 0xeb0], eax
jmp 0x47af15
mov dword [ebp - 0xeb8], 0x37e8f884
mov dword [ebp - 0x2cb8], 0xc25470e9
push 0
lea ecx, [ebp - 0x2988]
call fcn.00438351
push 1
lea ecx, [ebp - 0x3398]
call fcn.00438351
mov dword [eax], 0xf84
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x30b0], 0xf84
jg 0x47aded
mov dword [ebp - 0xff8], 1
jmp 0x47adf4
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xeb0]
cmp dword [ebp - 0xff8], eax
jne 0x47ae1d
push 0
lea ecx, [ebp - 0x2988]
call fcn.00438351
cmp dword [eax], 0
jne 0x47ae1d
and dword [ebp - 0x1e80], 0
jmp 0x47ae27
mov dword [ebp - 0x1e80], 1
cmp dword [ebp - 0x1e80], 0x2c82f3c0
je 0x47ae3f
mov dword [ebp - 0x1000], 1
jmp 0x47ae46
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x1000]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x2cb8]
cmp dword [ebp - 0xeb8], eax
jge 0x47ae6c
mov dword [ebp - 0x2cc0], 1
jmp 0x47ae73
and dword [ebp - 0x2cc0], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3c4c], 0
jne 0x47ae89
cmp dword [ebp - 0xeb8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30b0], 0xaddbfd33
jbe 0x47aea8
mov dword [ebp - 0x1e88], 1
jmp 0x47aeaf
and dword [ebp - 0x1e88], 0
push 0
lea ecx, [ebp - 0x2988]
call fcn.00438351
imul eax, dword [eax], 0x2570
cmp eax, dword [ebp - 0x1e88]
je 0x47aed6
mov dword [ebp - 0x1008], 1
jmp 0x47aedd
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x1008]
sub eax, 0xfff6
cmp eax, 0xffffffff
jbe 0x47aef9
mov dword [ebp - 0x1e90], 1
jmp 0x47af00
and dword [ebp - 0x1e90], 0
push 0
lea ecx, [ebp - 0x2988]
call fcn.00438351
mov ecx, dword [ebp - 0x1e90]
mov dword [eax], ecx
jmp 0x47ac03
lea ecx, [ebp - 0x3398]
call fcn.00438335
lea ecx, [ebp - 0x2988]
call fcn.00438335
mov dword [ebp - 0xb9c], 0
jmp 0x47af49
mov eax, dword [ebp - 0xb9c]
inc eax
mov dword [ebp - 0xb9c], eax
cmp dword [ebp - 0xb9c], 1
jge 0x47af65
mov eax, dword [ebp - 0xb9c]
mov dword [ebp + eax*4 - 0x524], 0xffffffff
jmp 0x47af3c
mov dword [ebp - 0xc30], 0
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0xc28], 0
mov dword [ebp - 0xc24], 0
mov dword [ebp - 0x30c], 0xffffffff
push 3
lea ecx, [ebp - 0x29a0]
call fcn.00438263
mov dword [ebp - 0x2ce8], 0x73c04290
mov dword [ebp - 0x188], 0
jmp 0x47afc7
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x47afe9
push dword [ebp - 0x188]
lea ecx, [ebp - 0x29a0]
call fcn.00438351
mov dword [eax], 0x55b65ab4
jmp 0x47afba
mov dword [ebp - 0x188], 0
jmp 0x47b002
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x47b01e
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x2b08], 0x2ef3
jmp 0x47aff5
mov byte [ebp - 0x357], 0
movzx eax, byte [ebp - 0x357]
test eax, eax
je 0x47b049
push 0xbda
push 0x233
push 1
push 0
push 0x5fd
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc30], 0
jne 0x47b1da
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x30c]
cmp dword [ebp + eax - 0xc30], ecx
jge 0x47b07d
mov dword [ebp - 0x1010], 1
jmp 0x47b084
and dword [ebp - 0x1010], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc30]
cmp dword [ebp - 0x1010], eax
jg 0x47b0a5
mov dword [ebp - 0x1e98], 1
jmp 0x47b0ac
and dword [ebp - 0x1e98], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1e98]
sub ecx, dword [ebp + eax - 0xc30]
cmp ecx, dword [ebp - 0x30c]
jl 0x47b0d2
mov dword [ebp - 0x1018], 1
jmp 0x47b0d9
and dword [ebp - 0x1018], 0
mov eax, dword [ebp - 0x1018]
sub eax, 0x77dcda72
cmp eax, 0x7b09b37d
jne 0x47b0f7
mov dword [ebp - 0x1ea0], 1
jmp 0x47b0fe
and dword [ebp - 0x1ea0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc30]
sub eax, dword [ebp - 0x1ea0]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc30]
lea eax, [eax + ecx - 0x8e3b]
cmp eax, dword [ebp - 0x30c]
jle 0x47b138
mov dword [ebp - 0x1020], 1
jmp 0x47b13f
and dword [ebp - 0x1020], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc30]
imul eax, dword [ebp - 0x1020]
cmp eax, 0x3196
jg 0x47b165
mov dword [ebp - 0x2cc8], 1
jmp 0x47b16c
and dword [ebp - 0x2cc8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc30]
mov dword [ebp - 0x3a98], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc30]
cmp dword [ebp + eax - 0xc30], ecx
jl 0x47b1a6
mov dword [ebp - 0x2cd0], 1
jmp 0x47b1ad
and dword [ebp - 0x2cd0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc30]
mov dword [ebp - 0x37f0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc30], 0x2718
je 0x47b1da
and dword [ebp - 0x1ea8], 0
jmp 0x47b1e4
mov dword [ebp - 0x1ea8], 1
push 0
lea ecx, [ebp - 0x29a0]
call fcn.00438351
mov ecx, dword [ebp - 0x1ea8]
cmp ecx, dword [eax]
jl 0x47b4a6
xor eax, eax
inc eax
jne 0x47b4a6
mov eax, 0xab5b
test eax, eax
jne 0x47b4a6
mov dword [ebp - 0xddc], 9
mov dword [ebp - 0x1028], 9
mov dword [ebp - 0x1040], 1
mov dword [ebp - 0x2cd8], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc30]
mov dword [ebp - 0x1028], eax
mov eax, dword [ebp - 0x1028]
cmp dword [ebp - 0xddc], eax
jl 0x47b26a
mov dword [ebp - 0x1048], 1
jmp 0x47b271
and dword [ebp - 0x1048], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc30], 0xffffffff
jb 0x47b28d
mov dword [ebp - 0x1eb0], 1
jmp 0x47b294
and dword [ebp - 0x1eb0], 0
cmp dword [ebp - 0x1eb0], 0x95dd
jl 0x47b2ac
mov dword [ebp - 0x1030], 1
jmp 0x47b2b3
and dword [ebp - 0x1030], 0
cmp dword [ebp - 0x1030], 0x2c9aa6f
jg 0x47b2cb
mov dword [ebp - 0x1eb8], 1
jmp 0x47b2d2
and dword [ebp - 0x1eb8], 0
cmp dword [ebp - 0x1eb8], 0x105f61ca
jl 0x47b2f3
cmp dword [ebp - 0x1040], 0
je 0x47b2f3
mov dword [ebp - 0x1038], 1
jmp 0x47b2fa
and dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x2cd8]
cmp dword [ebp - 0x1038], eax
jg 0x47b314
mov dword [ebp - 0x1ec0], 1
jmp 0x47b31b
and dword [ebp - 0x1ec0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b08]
cmp dword [ebp - 0x1ec0], eax
jne 0x47b33c
mov dword [ebp - 0x1ec8], 1
jmp 0x47b343
and dword [ebp - 0x1ec8], 0
mov eax, dword [ebp - 0x1040]
cmp dword [ebp - 0x1ec8], eax
jl 0x47b35d
mov dword [ebp - 0x1ed0], 1
jmp 0x47b364
and dword [ebp - 0x1ed0], 0
mov eax, dword [ebp - 0x1048]
cmp eax, dword [ebp - 0x1ed0]
jle 0x47b37e
mov dword [ebp - 0x1050], 1
jmp 0x47b385
and dword [ebp - 0x1050], 0
mov eax, dword [ebp - 0x1050]
neg eax
cmp eax, dword [ebp - 0xddc]
jle 0x47b3a1
mov dword [ebp - 0x1ed8], 1
jmp 0x47b3a8
and dword [ebp - 0x1ed8], 0
cmp dword [ebp - 0x1ed8], 0x6225
jl 0x47b3c0
mov dword [ebp - 0x1058], 1
jmp 0x47b3c7
and dword [ebp - 0x1058], 0
mov eax, dword [ebp - 0x1058]
sub eax, 9
cmp eax, 0xe0e2
je 0x47b3e3
mov dword [ebp - 0x1ee0], 1
jmp 0x47b3ea
and dword [ebp - 0x1ee0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b08]
cmp dword [ebp - 0x1ee0], eax
jl 0x47b40b
mov dword [ebp - 0x2ce0], 1
jmp 0x47b412
and dword [ebp - 0x2ce0], 0
mov eax, dword [ebp - 0xddc]
mov dword [ebp - 0x3ae4], eax
push 0
lea ecx, [ebp - 0x29a0]
call fcn.00438351
mov esi, eax
push 0
lea ecx, [ebp - 0x29a0]
call fcn.00438351
mov ecx, dword [esi]
imul ecx, dword [eax]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x2b08]
jg 0x47b45a
mov dword [ebp - 0x1060], 1
jmp 0x47b461
and dword [ebp - 0x1060], 0
cmp dword [ebp - 0x1060], 0xe4a9ff1d
je 0x47b479
mov dword [ebp - 0x1ee8], 1
jmp 0x47b480
and dword [ebp - 0x1ee8], 0
mov eax, dword [ebp - 0x1ee8]
mov dword [ebp - 0x2ce8], eax
mov byte [ebp - 0x31c], 0
movzx eax, byte [ebp - 0x31c]
test eax, eax
je 0x47b4a4
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x47b50a
mov dword [ebp - 0x30c], 0
jmp 0x47b4bf
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jg 0x47b50a
mov dword [ebp - 0x2cf0], 0x5e429b05
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x29a0]
call fcn.00438351
cmp dword [eax], 9
jne 0x47b4f4
mov dword [ebp - 0x1068], 1
jmp 0x47b4fb
and dword [ebp - 0x1068], 0
imul eax, dword [ebp - 0x1068], 7
mov dword [ebp - 0x2cf0], eax
jmp 0x47b4b2
lea ecx, [ebp - 0x29a0]
call fcn.00438335
mov dword [ebp - 0x2c0], 0
jmp 0x47b52e
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
jg 0x47cdd2
mov dword [ebp - 0x37f8], 1
push 1
lea ecx, [ebp - 0x3964]
call fcn.00438263
mov dword [ebp - 0x1ef0], 0xfff7
mov dword [ebp - 0x76c], 0
jmp 0x47b575
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 1
jge 0x47b594
push dword [ebp - 0x76c]
lea ecx, [ebp - 0x3964]
call fcn.00438351
and dword [eax], 0
jmp 0x47b568
mov eax, dword [ebp - 0x1ef0]
inc eax
mov dword [ebp - 0x1ef0], eax
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x47b5cc
push 0xbf6
push 0x1ef5
push 0
push 0x2656
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x3964]
call fcn.00438335
mov dword [ebp - 0x620], 0xfffffffa
mov dword [ebp - 0x9bc], 0
jmp 0x47b5fa
mov eax, dword [ebp - 0x9bc]
inc eax
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x9bc], 2
jge 0x47b616
mov eax, dword [ebp - 0x9bc]
mov dword [ebp + eax*4 - 0x3868], 0xb57f
jmp 0x47b5ed
mov dword [ebp - 0x620], 0
jmp 0x47b62f
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 1
jg 0x47b64c
mov eax, dword [ebp - 0x620]
cmp dword [ebp + eax*4 - 0x3868], 0
je 0x47b64a
jmp 0x47b64c
jmp 0x47b622
mov dword [ebp - 0xdb4], 1
mov dword [ebp - 0xf4], 0x55e00fe1
mov dword [ebp - 0x3ac], 0x1f2e9667
mov dword [ebp - 0x104], 0x8b060d2f
mov dword [ebp - 0x6a0], 0x7cd95329
mov dword [ebp - 0xdac], 1
cmp dword [ebp - 0xf4], 0
mov dword [ebp - 0x3ac], 0xbe39
cmp dword [ebp - 0x3ac], 0x7ed6
jne 0x47b6b1
mov dword [ebp - 0x1070], 1
jmp 0x47b6b8
and dword [ebp - 0x1070], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1070], eax
jle 0x47b6d2
mov dword [ebp - 0x1ef8], 1
jmp 0x47b6d9
and dword [ebp - 0x1ef8], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1ef8], eax
jge 0x47b6f3
mov dword [ebp - 0x1078], 1
jmp 0x47b6fa
and dword [ebp - 0x1078], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x1078]
jl 0x47b714
mov dword [ebp - 0x1f08], 1
jmp 0x47b71b
and dword [ebp - 0x1f08], 0
cmp dword [ebp - 0x1f08], 0xffffffff
jbe 0x47b730
mov dword [ebp - 0x1080], 1
jmp 0x47b737
and dword [ebp - 0x1080], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1080], eax
je 0x47b751
mov dword [ebp - 0x1f10], 1
jmp 0x47b758
and dword [ebp - 0x1f10], 0
mov eax, dword [ebp - 0x1f10]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xf4], 3
jmp 0x47b77d
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x23
jl 0x47bcb3
mov dword [ebp - 0x608], 1
mov dword [ebp - 0x1f40], 0xffffffff
mov dword [ebp - 0x2d08], 0xffffffff
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3aa8], eax
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x608]
jne 0x47b7d4
mov dword [ebp - 0x2cf8], 1
jmp 0x47b7db
and dword [ebp - 0x2cf8], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3800], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x3aec], eax
cmp dword [ebp - 0x3ac], 0
jne 0x47b808
mov dword [ebp - 0x1088], 1
jmp 0x47b80f
and dword [ebp - 0x1088], 0
cmp dword [ebp - 0x1088], 0x967684ab
jbe 0x47b827
mov dword [ebp - 0x1f18], 1
jmp 0x47b82e
and dword [ebp - 0x1f18], 0
cmp dword [ebp - 0x1f18], 4
jbe 0x47b843
mov dword [ebp - 0x1090], 1
jmp 0x47b84a
and dword [ebp - 0x1090], 0
mov dword [ebp - 0x6a0], 0x79c9
mov eax, dword [ebp - 0x6a0]
cmp eax, dword [ebp - 0x1090]
jge 0x47b86e
mov dword [ebp - 0x1f20], 1
jmp 0x47b875
and dword [ebp - 0x1f20], 0
cmp dword [ebp - 0x1f20], 0xe3f0
jg 0x47b88d
mov dword [ebp - 0x1098], 1
jmp 0x47b894
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x1098]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x47b8bb
mov eax, 0x1ce094bf
test eax, eax
jne 0x47b8bb
and dword [ebp - 0x2d00], 0
jmp 0x47b8c5
mov dword [ebp - 0x2d00], 1
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3808], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xdac], eax
cmp dword [ebp - 0xdac], 0x81e1
je 0x47b8fe
cmp dword [ebp - 0x608], 0
je 0x47b8fe
mov dword [ebp - 0x1f28], 1
jmp 0x47b905
and dword [ebp - 0x1f28], 0
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x1f28]
jle 0x47b91f
mov dword [ebp - 0x10a0], 1
jmp 0x47b926
and dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x10a0], eax
jne 0x47b958
cmp dword [ebp - 0x608], 0
jne 0x47b958
cmp dword [ebp - 0x104], 0
jne 0x47b958
mov eax, 0xfffe
test eax, eax
jne 0x47b958
and dword [ebp - 0x1f30], 0
jmp 0x47b962
mov dword [ebp - 0x1f30], 1
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x1f30], eax
jl 0x47b97c
mov dword [ebp - 0x10a8], 1
jmp 0x47b983
and dword [ebp - 0x10a8], 0
imul eax, dword [ebp - 0x10a8], 0xfffc
sub eax, 6
je 0x47b999
cmp dword [ebp - 0x1f40], 0
cmp dword [ebp - 0x104], 0
je 0x47b9b7
mov eax, 0x779e46ed
test eax, eax
je 0x47b9b7
mov dword [ebp - 0x1f38], 1
jmp 0x47b9be
and dword [ebp - 0x1f38], 0
cmp dword [ebp - 0x1f38], 0
je 0x47bc77
mov dword [ebp - 0xc84], 0xffffffff
mov dword [ebp - 0x774], 0
jmp 0x47b9ee
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 4
jge 0x47ba0a
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x3268], 0xd06d0c81
jmp 0x47b9e1
mov byte [ebp - 0x31e], 0
movzx eax, byte [ebp - 0x31e]
test eax, eax
je 0x47ba2e
push 0x5ba
push 0xb39
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp dword [ebp - 0xf4], 0
je 0x47bbbb
cmp dword [ebp - 0x6a0], 0
je 0x47bb6b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3268]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3268]
dec ecx
push 4
pop edx
shl edx, 0
mov dword [ebp + edx - 0x3268], ecx
test eax, eax
jne 0x47bae6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3268], 0xffffffff
je 0x47ba90
mov dword [ebp - 0x10b0], 1
jmp 0x47ba97
and dword [ebp - 0x10b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x10b0]
sub ecx, dword [ebp + eax - 0x3268]
cmp ecx, 0x6f469371
je 0x47babe
mov dword [ebp - 0x10b8], 1
jmp 0x47bac5
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x1f40]
cmp dword [ebp - 0x10b8], eax
jl 0x47badf
mov dword [ebp - 0x1f48], 1
jmp 0x47bae6
and dword [ebp - 0x1f48], 0
cmp dword [ebp - 0x104], 0
je 0x47bb04
mov eax, 0xb773b032
test eax, eax
je 0x47bb04
mov dword [ebp - 0x10c0], 1
jmp 0x47bb0b
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0xc84]
imul eax, dword [ebp - 0x10c0]
cmp eax, 0xfffffff7
je 0x47bb29
mov dword [ebp - 0x1f50], 1
jmp 0x47bb30
and dword [ebp - 0x1f50], 0
mov eax, dword [ebp - 0x6a0]
cmp dword [ebp - 0x1f50], eax
je 0x47bb4a
mov dword [ebp - 0x10c8], 1
jmp 0x47bb51
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0xc84]
cmp dword [ebp - 0x10c8], eax
jge 0x47bb6b
mov dword [ebp - 0x1f58], 1
jmp 0x47bb72
and dword [ebp - 0x1f58], 0
mov eax, dword [ebp - 0x1f58]
sub eax, dword [ebp - 0x2d08]
cmp eax, dword [ebp - 0xf4]
jne 0x47bb92
mov dword [ebp - 0x10d0], 1
jmp 0x47bb99
and dword [ebp - 0x10d0], 0
mov eax, dword [ebp - 0x10d0]
add eax, 0x96e5
je 0x47bbbb
mov eax, 0x753c
test eax, eax
je 0x47bbbb
mov dword [ebp - 0x1f60], 1
jmp 0x47bbc2
and dword [ebp - 0x1f60], 0
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x1f60], eax
jge 0x47bbdc
mov dword [ebp - 0x10d8], 1
jmp 0x47bbe3
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x10d8]
je 0x47bc06
mov eax, 0x4487f17e
test eax, eax
je 0x47bc06
mov dword [ebp - 0x1f68], 1
jmp 0x47bc0d
and dword [ebp - 0x1f68], 0
cmp dword [ebp - 0x1f68], 0x9d776076
ja 0x47bc25
mov dword [ebp - 0x10e0], 1
jmp 0x47bc2c
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0xc84]
cmp dword [ebp - 0x10e0], eax
jge 0x47bc46
mov dword [ebp - 0x1f70], 1
jmp 0x47bc4d
and dword [ebp - 0x1f70], 0
cmp dword [ebp - 0x1f70], 6
jne 0x47bc62
mov dword [ebp - 0x10e8], 1
jmp 0x47bc69
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0xdac], eax
jmp 0x47bcae
mov dword [ebp - 0x2d10], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x6a0], eax
je 0x47bc9b
mov dword [ebp - 0x1f78], 1
jmp 0x47bca2
and dword [ebp - 0x1f78], 0
mov eax, dword [ebp - 0x1f78]
mov dword [ebp - 0x2d10], eax
jmp 0x47b770
mov dword [ebp - 0x2d48], 0xfffffff8
mov dword [ebp - 0x628], 2
mov dword [ebp - 0x9c4], 0xf5b1b6fd
mov dword [ebp - 0x2d20], 0xfffffffa
mov dword [ebp - 0x3848], 0xa276ac11
mov byte [ebp - 0x35b], 0
movzx eax, byte [ebp - 0x35b]
test eax, eax
je 0x47bcfd
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x628], 0xa
jmp 0x47bd16
mov eax, dword [ebp - 0x628]
dec eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0xffffffee
jge 0x47c03e
mov dword [ebp - 0x1f88], 0x72737ae9
push 2
lea ecx, [ebp - 0x33d4]
call fcn.00438263
mov dword [ebp - 0x230], 0
jmp 0x47bd53
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 4
jge 0x47bd6f
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x3120], 0x6d4f2887
jmp 0x47bd46
mov dword [ebp - 0x230], 0
jmp 0x47bd88
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x47bda7
push dword [ebp - 0x230]
lea ecx, [ebp - 0x33d4]
call fcn.00438351
and dword [eax], 0
jmp 0x47bd7b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3120], 0
jne 0x47bec2
mov dword [ebp - 0xad4], 0
jmp 0x47bdd4
mov eax, dword [ebp - 0xad4]
inc eax
mov dword [ebp - 0xad4], eax
cmp dword [ebp - 0xad4], 3
jge 0x47bdf0
mov eax, dword [ebp - 0xad4]
mov dword [ebp + eax*4 - 0x2f30], 0x9ba07e4f
jmp 0x47bdc7
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2f30], 3
jmp 0x47be1b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f30]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2f30], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2f30], 0
jl 0x47bec0
mov dword [ebp - 0x77c], 9
mov byte [ebp - 0x320], 0
movzx eax, byte [ebp - 0x320]
test eax, eax
je 0x47be5f
push 0xe66
push 0xdcd
push 0x16c8
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x77c], 0
jmp 0x47be78
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 3
jg 0x47bebb
mov byte [ebp - 0x35d], 0
movzx eax, byte [ebp - 0x35d]
test eax, eax
je 0x47bea7
push 0
push 0x1c71
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f30], 0
je 0x47beb9
jmp 0x47be6b
jmp 0x47be6b
jmp 0x47be02
jmp 0x47bf06
mov byte [ebp - 0x322], 0
movzx eax, byte [ebp - 0x322]
test eax, eax
je 0x47bf06
push 0x10f
push 0x1a19
push 0x1046
push 0x2351
push 0x30b
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3120]
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0x9c4], 0
jne 0x47bfed
cmp dword [ebp - 0x9c4], 0
jne 0x47bfc0
cmp dword [ebp - 0x9c4], 1
jne 0x47bf48
mov dword [ebp - 0x10f0], 1
jmp 0x47bf4f
and dword [ebp - 0x10f0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3120]
cmp dword [ebp - 0x10f0], eax
jle 0x47bf70
mov dword [ebp - 0x1f80], 1
jmp 0x47bf77
and dword [ebp - 0x1f80], 0
cmp dword [ebp - 0x1f80], 0xb6d6
je 0x47bf8f
mov dword [ebp - 0x10f8], 1
jmp 0x47bf96
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x10f8]
mov dword [ebp - 0x1f88], eax
mov eax, dword [ebp - 0x1f88]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x3120]
jne 0x47bfc0
and dword [ebp - 0x1100], 0
jmp 0x47bfca
mov dword [ebp - 0x1100], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3120]
add eax, dword [ebp - 0x1100]
add eax, dword [ebp - 0x628]
jne 0x47bfed
and dword [ebp - 0x2d18], 0
jmp 0x47bff7
mov dword [ebp - 0x2d18], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3120]
mov dword [ebp - 0x1f90], eax
push 1
lea ecx, [ebp - 0x33d4]
call fcn.00438351
mov ecx, dword [ebp - 0x1f90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1f90]
add eax, 8
mov dword [ebp - 0x2d20], eax
lea ecx, [ebp - 0x33d4]
call fcn.00438335
jmp 0x47bd09
mov dword [ebp - 0x784], 0
jmp 0x47c057
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 2
jge 0x47c073
mov eax, dword [ebp - 0x784]
mov dword [ebp + eax*4 - 0x2520], 0x77dd6887
jmp 0x47c04a
mov dword [ebp - 0xe84], 9
mov dword [ebp - 0x78c], 0xfffffff9
mov dword [ebp - 0x2d28], 0xc62e
mov dword [ebp - 0x1108], 0xb95ae64
mov dword [ebp - 0x2d30], 0xa0d461e3
mov dword [ebp - 0x1118], 3
mov dword [ebp - 0x2d38], 0xffff
mov dword [ebp - 0xc8c], 1
push 2
lea ecx, [ebp - 0x2f40]
call fcn.00438263
mov dword [ebp - 0x1130], 0x6081
mov dword [ebp - 0xb5c], 0
jmp 0x47c0f3
mov eax, dword [ebp - 0xb5c]
inc eax
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 2
jge 0x47c115
push dword [ebp - 0xb5c]
lea ecx, [ebp - 0x2f40]
call fcn.00438351
mov dword [eax], 3
jmp 0x47c0e6
mov eax, dword [ebp - 0xe84]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x2d28], eax
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x1108], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x2d30], eax
mov eax, dword [ebp - 0x2d38]
cmp dword [ebp - 0x78c], eax
jg 0x47c15f
mov dword [ebp - 0x1f98], 1
jmp 0x47c166
and dword [ebp - 0x1f98], 0
mov eax, dword [ebp - 0xc8c]
cmp dword [ebp - 0x1f98], eax
jle 0x47c180
mov dword [ebp - 0x1110], 1
jmp 0x47c187
and dword [ebp - 0x1110], 0
push 0
lea ecx, [ebp - 0x2f40]
call fcn.00438351
mov ecx, dword [ebp - 0x1110]
cmp ecx, dword [eax]
jne 0x47c1b0
mov eax, 0x86335c0
test eax, eax
jne 0x47c1b0
and dword [ebp - 0x1fa0], 0
jmp 0x47c1ba
mov dword [ebp - 0x1fa0], 1
mov eax, dword [ebp - 0x1118]
cmp eax, dword [ebp - 0x1fa0]
jle 0x47c1da
cmp dword [ebp - 0x1118], 0
jne 0x47c1da
and dword [ebp - 0x1fa8], 0
jmp 0x47c1e4
mov dword [ebp - 0x1fa8], 1
cmp dword [ebp - 0x1fa8], 0
jle 0x47c1f9
mov dword [ebp - 0x1120], 1
jmp 0x47c200
and dword [ebp - 0x1120], 0
push 1
lea ecx, [ebp - 0x2f40]
call fcn.00438351
mov ecx, dword [ebp - 0x1120]
cmp ecx, dword [eax]
je 0x47c223
mov dword [ebp - 0x1fb0], 1
jmp 0x47c22a
and dword [ebp - 0x1fb0], 0
mov eax, dword [ebp - 0x1fb0]
sub eax, 9
cmp dword [ebp - 0xe84], eax
jl 0x47c247
mov dword [ebp - 0x1128], 1
jmp 0x47c24e
and dword [ebp - 0x1128], 0
push 0
lea ecx, [ebp - 0x2f40]
call fcn.00438351
mov ecx, dword [ebp - 0x1128]
cmp ecx, dword [eax]
jne 0x47c271
mov dword [ebp - 0x1fb8], 1
jmp 0x47c278
and dword [ebp - 0x1fb8], 0
mov eax, dword [ebp - 0x1fb8]
mov dword [ebp - 0x1130], eax
mov eax, dword [ebp - 0x1130]
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xe84], eax
lea ecx, [ebp - 0x2f40]
call fcn.00438335
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2520], 0
jmp 0x47c2d5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2520]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2520], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2520], 0
jl 0x47cdcd
mov dword [ebp - 0x630], 0
mov dword [ebp - 0xc94], 0x9aa810d2
mov dword [ebp - 0x1138], 2
mov dword [ebp - 0x6a8], 0x75405732
push 1
lea ecx, [ebp - 0x33ec]
call fcn.00438263
push 1
lea ecx, [ebp - 0x2728]
call fcn.00438263
mov dword [ebp - 0x1fc8], 0x2ae45661
mov dword [ebp - 0xb4], 0
jmp 0x47c34e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x47c370
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x33ec]
call fcn.00438351
mov dword [eax], 0x8afc1da7
jmp 0x47c341
mov dword [ebp - 0xb4], 0
jmp 0x47c389
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x47c3ab
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x2728]
call fcn.00438351
mov dword [eax], 0xfffb
jmp 0x47c37c
mov dword [ebp - 0xb4], 0
jmp 0x47c3c4
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x47c3e0
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x29d8], 1
jmp 0x47c3b7
mov dword [ebp - 0x630], 0xffffffe8
jmp 0x47c3f9
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0xa
jne 0x47c52b
push 2
lea ecx, [ebp - 0x3374]
call fcn.00438263
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x3810], 0
mov dword [ebp - 0x384c], 0x283066c9
push 2
lea ecx, [ebp - 0x3974]
call fcn.00438263
mov dword [ebp - 0x190], 0
jmp 0x47c457
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x47c476
push dword [ebp - 0x190]
lea ecx, [ebp - 0x3374]
call fcn.00438351
and dword [eax], 0
jmp 0x47c44a
mov dword [ebp - 0x190], 0
jmp 0x47c48f
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x47c4b1
push dword [ebp - 0x190]
lea ecx, [ebp - 0x3974]
call fcn.00438351
mov dword [eax], 0xcb61d225
jmp 0x47c482
mov dword [ebp - 0x6e0], 0
jmp 0x47c4ca
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 2
jge 0x47c4ec
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0x3374]
call fcn.00438351
mov dword [eax], 0xfff7
jmp 0x47c4bd
push 0
lea ecx, [ebp - 0x2728]
call fcn.00438351
mov dword [ebp - 0x1fc0], eax
mov eax, dword [ebp - 0x1fc0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1fc0]
mov dword [ecx], eax
lea ecx, [ebp - 0x3974]
call fcn.00438335
lea ecx, [ebp - 0x3374]
call fcn.00438335
jmp 0x47c3ec
push 0
lea ecx, [ebp - 0x2728]
call fcn.00438351
mov eax, dword [eax]
mov dword [ebp - 0x1138], eax
mov eax, dword [ebp - 0x1138]
mov dword [ebp - 0x1fc8], eax
mov eax, dword [ebp - 0x6a8]
add eax, dword [ebp - 0x1fc8]
jne 0x47c5d7
mov eax, dword [ebp - 0x6a8]
add eax, 0x7c52146c
cmp eax, 0xe3aa9c1c
jae 0x47c578
mov dword [ebp - 0x1140], 1
jmp 0x47c57f
and dword [ebp - 0x1140], 0
mov eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0x1140], eax
je 0x47c599
mov dword [ebp - 0x1fd0], 1
jmp 0x47c5a0
and dword [ebp - 0x1fd0], 0
imul eax, dword [ebp - 0x1fd0], 0x48e6
mov dword [ebp - 0x1148], eax
push 0
lea ecx, [ebp - 0x33ec]
call fcn.00438351
mov ecx, dword [ebp - 0x1148]
mov dword [eax], ecx
cmp dword [ebp - 0x1148], 0
jne 0x47c5d7
and dword [ebp - 0x1fd8], 0
jmp 0x47c5e1
mov dword [ebp - 0x1fd8], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x29d8]
cmp dword [ebp - 0x1fd8], eax
jne 0x47c602
mov dword [ebp - 0x1150], 1
jmp 0x47c609
and dword [ebp - 0x1150], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x29d8]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x29d8]
mov dword [ebp - 0x3818], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x29d8]
imul eax, dword [ebp - 0x630]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x29d8]
push 0
lea ecx, [ebp - 0x2728]
call fcn.00438351
cmp dword [eax], 0xfffffff7
jne 0x47c667
mov dword [ebp - 0x1fe0], 1
jmp 0x47c66e
and dword [ebp - 0x1fe0], 0
mov eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0x1fe0], eax
je 0x47c688
mov dword [ebp - 0x1158], 1
jmp 0x47c68f
and dword [ebp - 0x1158], 0
push 0
lea ecx, [ebp - 0x2728]
call fcn.00438351
mov ecx, dword [ebp - 0x1158]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xc94]
jne 0x47c6b8
mov dword [ebp - 0x1fe8], 1
jmp 0x47c6bf
and dword [ebp - 0x1fe8], 0
push 0
lea ecx, [ebp - 0x2728]
call fcn.00438351
mov ecx, dword [ebp - 0x1fe8]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x29d8]
jne 0x47c6f0
mov dword [ebp - 0x1160], 1
jmp 0x47c6f7
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x1160]
mov dword [ebp - 0xc94], eax
cmp dword [ebp - 0xc94], 0xd34caa8e
je 0x47c71b
mov dword [ebp - 0x1ff0], 1
jmp 0x47c722
and dword [ebp - 0x1ff0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x29d8]
cmp dword [ebp - 0x1ff0], eax
jl 0x47c743
mov dword [ebp - 0x1168], 1
jmp 0x47c74a
and dword [ebp - 0x1168], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29d8]
cmp dword [ebp - 0x1168], eax
jg 0x47c76b
mov dword [ebp - 0x1ff8], 1
jmp 0x47c772
and dword [ebp - 0x1ff8], 0
mov eax, dword [ebp - 0x1ff8]
mov dword [ebp - 0x6a8], eax
lea ecx, [ebp - 0x2728]
call fcn.00438335
lea ecx, [ebp - 0x33ec]
call fcn.00438335
mov dword [ebp - 0xc9c], 0xc31e13ca
mov dword [ebp - 0x2008], 0x863718bd
push 3
lea ecx, [ebp - 0x3174]
call fcn.00438263
mov dword [ebp - 0x3b4], 0x5d76270e
mov dword [ebp - 0x7c], 0
jmp 0x47c7cf
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x47c7e5
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xe2c], 0
jmp 0x47c7c8
mov dword [ebp - 0x7c], 0
jmp 0x47c7f5
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x47c80e
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3174]
call fcn.00438351
and dword [eax], 0
jmp 0x47c7ee
mov dword [ebp - 0x7c], 0
jmp 0x47c81e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x47c834
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x3de4], 0x260df392
jmp 0x47c817
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe2c], 0x15
jmp 0x47c862
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe2c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe2c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe2c], 0x1c
jl 0x47c9c8
mov dword [ebp - 0x638], 0x2baef6e2
mov dword [ebp - 0x2d40], 0x84edc022
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x3854], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x3820], eax
cmp dword [ebp - 0x638], 1
je 0x47c8b7
mov dword [ebp - 0x1170], 1
jmp 0x47c8be
and dword [ebp - 0x1170], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe2c]
cmp eax, dword [ebp - 0x1170]
jg 0x47c8df
mov dword [ebp - 0x2000], 1
jmp 0x47c8e6
and dword [ebp - 0x2000], 0
mov eax, 0xe056
sub eax, dword [ebp - 0x2000]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xe2c]
jg 0x47c90c
mov dword [ebp - 0x1178], 1
jmp 0x47c913
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x1178]
mov dword [ebp - 0x2008], eax
mov eax, dword [ebp - 0x2008]
neg eax
mov dword [ebp - 0x1180], eax
push 2
lea ecx, [ebp - 0x3174]
call fcn.00438351
mov ecx, dword [ebp - 0x1180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1180]
add eax, 0xcabf
mov dword [ebp - 0x3b4], eax
je 0x47c961
mov dword [ebp - 0x2010], 1
jmp 0x47c968
and dword [ebp - 0x2010], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe2c]
cmp dword [ebp - 0x2010], eax
jg 0x47c989
mov dword [ebp - 0x1188], 1
jmp 0x47c990
and dword [ebp - 0x1188], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x1188], eax
jge 0x47c9aa
mov dword [ebp - 0x2018], 1
jmp 0x47c9b1
and dword [ebp - 0x2018], 0
mov eax, dword [ebp - 0x638]
add eax, dword [ebp - 0x2018]
mov dword [ebp - 0x2d40], eax
jmp 0x47c847
mov dword [ebp - 0x3b4], 2
jmp 0x47c9e1
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
jl 0x47ca03
push dword [ebp - 0x3b4]
lea ecx, [ebp - 0x3174]
call fcn.00438351
mov dword [eax], 1
jmp 0x47c9d4
lea ecx, [ebp - 0x3174]
call fcn.00438335
mov dword [ebp - 0x2d58], 0x9339b884
push 4
lea ecx, [ebp - 0x3984]
call fcn.00438263
mov dword [ebp - 0x794], 7
mov dword [ebp - 0x9cc], 0
jmp 0x47ca48
mov eax, dword [ebp - 0x9cc]
inc eax
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 4
jge 0x47ca6a
push dword [ebp - 0x9cc]
lea ecx, [ebp - 0x3984]
call fcn.00438351
mov dword [eax], 0xc0ae
jmp 0x47ca3b
mov byte [ebp - 0x35f], 0
movzx eax, byte [ebp - 0x35f]
test eax, eax
je 0x47ca88
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x794], 0
jmp 0x47caa1
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 3
jg 0x47cbfc
mov dword [ebp - 0xadc], 0xe57bf5cd
mov dword [ebp - 0xadc], 3
jmp 0x47cad1
mov eax, dword [ebp - 0xadc]
dec eax
mov dword [ebp - 0xadc], eax
cmp dword [ebp - 0xadc], 0
jl 0x47cbf7
mov dword [ebp - 0x79c], 8
mov dword [ebp - 0x79c], 3
jmp 0x47cb01
mov eax, dword [ebp - 0x79c]
dec eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0
jl 0x47cbf2
mov dword [ebp - 0x9d4], 0x4aa0d722
mov dword [ebp - 0x9d4], 0
jmp 0x47cb31
mov eax, dword [ebp - 0x9d4]
inc eax
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 3
jg 0x47cbed
mov dword [ebp - 0x7a4], 0x57b5bf2d
mov dword [ebp - 0x7a4], 0
jmp 0x47cb61
cmp dword [ebp - 0x7a4], 3
jg 0x47cbe8
mov dword [ebp - 0xbec], 0x6ce4a6f4
mov dword [ebp - 0xbec], 0
jmp 0x47cb8d
cmp dword [ebp - 0xbec], 3
jg 0x47cbe3
jmp 0x47cb24
jmp 0x47caf4
jmp 0x47cac4
jmp 0x47ca94
lea ecx, [ebp - 0x3984]
call fcn.00438335
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x524], 1
mov dword [ebp - 0xdb4], 1
cmp dword [ebp - 0xdb4], 0
je 0x47cd0e
mov eax, dword [ebp - 0x2c0]
mov eax, dword [ebp + eax*4 - 0x524]
cmp dword [ebp - 0x2d48], eax
jle 0x47cc50
mov dword [ebp - 0x1190], 1
jmp 0x47cc57
and dword [ebp - 0x1190], 0
cmp dword [ebp - 0x1190], 0x8451f1e2
jb 0x47cc6f
mov dword [ebp - 0x2020], 1
jmp 0x47cc76
and dword [ebp - 0x2020], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c0]
mov ecx, dword [ebp + ecx*4 - 0x524]
imul ecx, dword [ebp - 0x2020]
cmp dword [ebp + eax - 0x524], ecx
jg 0x47cca5
mov dword [ebp - 0x1198], 1
jmp 0x47ccac
and dword [ebp - 0x1198], 0
mov eax, dword [ebp - 0x2c0]
add eax, dword [ebp - 0x1198]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x524]
jg 0x47ccd3
mov dword [ebp - 0x2028], 1
jmp 0x47ccda
and dword [ebp - 0x2028], 0
mov eax, dword [ebp - 0x2028]
mov dword [ebp - 0xc9c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2520]
mov eax, dword [ebp + eax*4 - 0x524]
cmp eax, dword [ebp - 0xc9c]
jl 0x47cd0e
mov dword [ebp - 0x11a0], 1
jmp 0x47cd15
and dword [ebp - 0x11a0], 0
cmp dword [ebp - 0x11a0], 0x54e5
jle 0x47cd2d
mov dword [ebp - 0x2d50], 1
jmp 0x47cd34
and dword [ebp - 0x2d50], 0
mov eax, 0x39c9d940
test eax, eax
je 0x47cd52
cmp dword [ebp - 0xdb4], 0
je 0x47cd52
mov dword [ebp - 0x2030], 1
jmp 0x47cd59
and dword [ebp - 0x2030], 0
cmp dword [ebp - 0x2030], 4
jbe 0x47cd6e
mov dword [ebp - 0x11a8], 1
jmp 0x47cd75
and dword [ebp - 0x11a8], 0
cmp dword [ebp - 0x11a8], 0xaf14
jl 0x47cd96
cmp dword [ebp - 0xc9c], 0
je 0x47cd96
mov dword [ebp - 0x2038], 1
jmp 0x47cd9d
and dword [ebp - 0x2038], 0
cmp dword [ebp - 0x2038], 0x451d
je 0x47cdb5
mov dword [ebp - 0x11b0], 1
jmp 0x47cdbc
and dword [ebp - 0x11b0], 0
mov eax, dword [ebp - 0x11b0]
mov dword [ebp - 0x2d58], eax
jmp 0x47c2ba
jmp 0x47b521
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0xdd8], 0x43e62c90
cmp dword [ebp - 0x3bc], 0
je 0x47cfca
push 3
lea ecx, [ebp - 0x31bc]
call fcn.00438263
mov dword [ebp - 0x7ac], 0
jmp 0x47ce19
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 3
jge 0x47ce38
push dword [ebp - 0x7ac]
lea ecx, [ebp - 0x31bc]
call fcn.00438351
and dword [eax], 0
jmp 0x47ce0c
mov dword [ebp - 0x3bc], 0
jmp 0x47ce51
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 2
jg 0x47cfba
mov dword [ebp - 0x5ec], 0xffffffff
mov dword [ebp - 0x385c], 0xfffffffd
mov dword [ebp - 0x5ec], 2
jmp 0x47ce8b
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0
jl 0x47cf94
mov dword [ebp - 0x700], 0xfffffffc
mov dword [ebp - 0x2d60], 1
mov byte [ebp - 0x326], 0
movzx eax, byte [ebp - 0x326]
test eax, eax
je 0x47cecd
push 0
push 0x251d
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov dword [ebp - 0x700], 2
jmp 0x47cee6
mov eax, dword [ebp - 0x700]
dec eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 0
jl 0x47cf8f
mov dword [ebp - 0x3828], 0x1c6076fd
mov dword [ebp - 0x3850], 0xffffffff
push dword [ebp - 0x700]
lea ecx, [ebp - 0x31bc]
call fcn.00438351
mov dword [ebp - 0x2040], eax
push dword [ebp - 0x5ec]
lea ecx, [ebp - 0x31bc]
call fcn.00438351
mov ecx, dword [ebp - 0x2040]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2040]
cmp dword [eax], 1
je 0x47cf50
mov dword [ebp - 0x11b8], 1
jmp 0x47cf57
and dword [ebp - 0x11b8], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x11b8], eax
jg 0x47cf71
mov dword [ebp - 0x2048], 1
jmp 0x47cf78
and dword [ebp - 0x2048], 0
mov eax, dword [ebp - 0x5ec]
add eax, dword [ebp - 0x2048]
mov dword [ebp - 0x2d60], eax
jmp 0x47ced9
jmp 0x47ce7e
mov byte [ebp - 0x363], 0
movzx eax, byte [ebp - 0x363]
test eax, eax
je 0x47cfb5
push 0
push 0x1b83
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x47ce44
lea ecx, [ebp - 0x31bc]
call fcn.00438335
jmp 0x47d143
mov dword [ebp - 0x9dc], 0x844b
mov dword [ebp - 0x2050], 0x5dda
mov dword [ebp - 0x2d68], 1
mov dword [ebp - 0x2d78], 0xa29add92
mov eax, dword [ebp - 0xdd8]
mov dword [ebp - 0x3af4], eax
mov eax, 0xefce06df
cmp eax, 2
jbe 0x47d014
mov dword [ebp - 0x11c0], 1
jmp 0x47d01b
and dword [ebp - 0x11c0], 0
cmp dword [ebp - 0x11c0], 0x9191d4d0
jbe 0x47d02e
cmp dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x2050]
cmp dword [ebp - 0x2050], eax
jge 0x47d048
mov dword [ebp - 0x11c8], 1
jmp 0x47d04f
and dword [ebp - 0x11c8], 0
mov eax, dword [ebp - 0x9dc]
imul eax, dword [ebp - 0x11c8]
imul eax, eax, 0x7847
cmp eax, 0xffff
jbe 0x47d075
mov dword [ebp - 0x2058], 1
jmp 0x47d07c
and dword [ebp - 0x2058], 0
mov eax, dword [ebp - 0x2058]
add eax, 0xa
cmp eax, dword [ebp - 0x2d68]
je 0x47d099
mov dword [ebp - 0x2d70], 1
jmp 0x47d0a0
and dword [ebp - 0x2d70], 0
mov eax, 0xfffa
sub eax, 0xede5
cmp eax, dword [ebp - 0x9dc]
jle 0x47d0be
mov dword [ebp - 0x11d0], 1
jmp 0x47d0c5
and dword [ebp - 0x11d0], 0
imul eax, dword [ebp - 0x11d0], 0xb82
test eax, eax
je 0x47d0e8
cmp dword [ebp - 0xdd8], 0
je 0x47d0e8
mov dword [ebp - 0x2060], 1
jmp 0x47d0ef
and dword [ebp - 0x2060], 0
mov eax, dword [ebp - 0xdd8]
cmp dword [ebp - 0x2060], eax
je 0x47d109
mov dword [ebp - 0x11d8], 1
jmp 0x47d110
and dword [ebp - 0x11d8], 0
mov eax, dword [ebp - 0x9dc]
mov ecx, dword [ebp - 0x3bc]
add ecx, dword [ebp - 0x11d8]
add eax, ecx
mov dword [ebp - 0x2068], 1
jmp 0x47d137
mov eax, dword [ebp - 0x2068]
mov dword [ebp - 0x2d78], eax
mov byte [ebp - 0x365], 0
mov dword [ebp - 0x14], 0x2971
mov dword [ebp - 0x2d88], 0xd58
mov dword [ebp - 0x2d90], 0
mov dword [ebp - 0x14], 0xe91a049f
cmp dword [ebp - 0x14], 0
je 0x47d317
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x47d18e
mov dword [ebp - 0x11e0], 1
jmp 0x47d195
and dword [ebp - 0x11e0], 0
cmp dword [ebp - 0x11e0], 0xefa97f51
jne 0x47d1ad
mov dword [ebp - 0x2070], 1
jmp 0x47d1b4
and dword [ebp - 0x2070], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2070], eax
jle 0x47d1cb
mov dword [ebp - 0x11e8], 1
jmp 0x47d1d2
and dword [ebp - 0x11e8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x11e8], eax
jg 0x47d1e9
mov dword [ebp - 0x2078], 1
jmp 0x47d1f0
and dword [ebp - 0x2078], 0
cmp dword [ebp - 0x2078], 0x6b3e713e
jle 0x47d208
mov dword [ebp - 0x11f0], 1
jmp 0x47d20f
and dword [ebp - 0x11f0], 0
cmp dword [ebp - 0x11f0], 0xfff7
je 0x47d227
mov dword [ebp - 0x2080], 1
jmp 0x47d22e
and dword [ebp - 0x2080], 0
cmp dword [ebp - 0x2080], 0x54c9
je 0x47d246
mov dword [ebp - 0x11f8], 1
jmp 0x47d24d
and dword [ebp - 0x11f8], 0
cmp dword [ebp - 0x11f8], 3
ja 0x47d262
mov dword [ebp - 0x2d80], 1
jmp 0x47d269
and dword [ebp - 0x2d80], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3858], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3ac8], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x47d28f
mov dword [ebp - 0x2088], 1
jmp 0x47d296
and dword [ebp - 0x2088], 0
cmp dword [ebp - 0x2088], 1
je 0x47d2ab
mov dword [ebp - 0x1200], 1
jmp 0x47d2b2
and dword [ebp - 0x1200], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x1200]
sub eax, dword [ebp - 0x14]
cmp eax, 1
jg 0x47d2d0
mov dword [ebp - 0x2090], 1
jmp 0x47d2d7
and dword [ebp - 0x2090], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2090], eax
jl 0x47d2ee
mov dword [ebp - 0x1208], 1
jmp 0x47d2f5
and dword [ebp - 0x1208], 0
mov eax, dword [ebp - 0x1208]
sub eax, dword [ebp - 0x14]
jne 0x47d304
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3860], eax
mov eax, dword [ebp - 0x2d88]
imul eax, dword [ebp - 0x14]
or eax, 0xffffffff
je 0x47d327
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2d90], eax
jmp 0x47d357
mov byte [ebp - 0x328], 0
movzx eax, byte [ebp - 0x328]
test eax, eax
je 0x47d357
push 0x2226
push 0x1649
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x47d4ed
mov dword [ebp - 0x154], 0x324ec2e0
mov dword [ebp - 0xca4], 0
mov dword [ebp - 0x2d98], 0xffffffff
mov dword [ebp - 0x154], 0xffffffe9
jmp 0x47d39d
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jg 0x47d3ce
mov byte [ebp - 0x32a], 0
movzx eax, byte [ebp - 0x32a]
test eax, eax
je 0x47d3cc
push 0
push 0x1416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x47d390
cmp dword [ebp - 0x154], 7
jle 0x47d3e3
mov dword [ebp - 0x2098], 1
jmp 0x47d3ea
and dword [ebp - 0x2098], 0
mov eax, dword [ebp - 0x2098]
sub eax, dword [ebp - 0xca4]
cmp eax, 0xc099
jle 0x47d409
mov dword [ebp - 0x1210], 1
jmp 0x47d410
and dword [ebp - 0x1210], 0
cmp dword [ebp - 0x1210], 1
jne 0x47d425
mov dword [ebp - 0x20a0], 1
jmp 0x47d42c
and dword [ebp - 0x20a0], 0
cmp dword [ebp - 0x20a0], 0x718e
jne 0x47d44a
cmp dword [ebp - 0xca4], 0
jne 0x47d44a
and dword [ebp - 0x1218], 0
jmp 0x47d454
mov dword [ebp - 0x1218], 1
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x1218]
cmp eax, 4
jne 0x47d471
mov dword [ebp - 0x20a8], 1
jmp 0x47d478
and dword [ebp - 0x20a8], 0
mov eax, dword [ebp - 0x20a8]
sub eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0xca4]
jl 0x47d49e
mov dword [ebp - 0x1220], 1
jmp 0x47d4a5
and dword [ebp - 0x1220], 0
imul eax, dword [ebp - 0x1220], 0x5425
test eax, eax
jne 0x47d4c6
push 9
pop eax
test eax, eax
je 0x47d4c6
mov dword [ebp - 0x20b0], 1
jmp 0x47d4cd
and dword [ebp - 0x20b0], 0
mov eax, dword [ebp - 0x20b0]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x2d98], eax
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x1994], 0x2f33
mov dword [ebp - 0x2c], 0
or eax, 0xffffffff
je 0x47d539
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jne 0x47d51a
mov dword [ebp - 0x1228], 1
jmp 0x47d521
and dword [ebp - 0x1228], 0
cmp dword [ebp - 0x1228], 0x44ad72d7
jg 0x47d539
mov dword [ebp - 0x20b8], 1
jmp 0x47d540
and dword [ebp - 0x20b8], 0
mov eax, dword [ebp - 0x20b8]
add eax, 0x5dce
je 0x47d5b9
mov dword [ebp - 0x2c], 0
jmp 0x47d55d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe
jg 0x47d5b4
mov dword [ebp - 0x7b4], 1
mov dword [ebp - 0x7b4], 0xffffffe2
jmp 0x47d586
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 0xffffffe5
jle 0x47d5b2
mov byte [ebp - 0x367], 0
movzx eax, byte [ebp - 0x367]
test eax, eax
je 0x47d5b0
push 0
push 0
push 0x22f1
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x47d579
jmp 0x47d556
jmp 0x47d87b
mov dword [ebp - 0x7bc], 0xa8cf1d65
mov dword [ebp - 0x640], 0xd7c1543f
mov dword [ebp - 0x1240], 0xffffffff
mov dword [ebp - 0x2da8], 0xfffffff6
mov dword [ebp - 0x2c], 0
jmp 0x47d5f1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x29
jg 0x47d87b
push 2
lea ecx, [ebp - 0x2654]
call fcn.00438263
mov dword [ebp - 0x20c8], 0x4d9faba
mov dword [ebp - 0xae4], 0
jmp 0x47d62b
mov eax, dword [ebp - 0xae4]
inc eax
mov dword [ebp - 0xae4], eax
cmp dword [ebp - 0xae4], 2
jge 0x47d64a
push dword [ebp - 0xae4]
lea ecx, [ebp - 0x2654]
call fcn.00438351
and dword [eax], 0
jmp 0x47d61e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3afc], eax
cmp dword [ebp - 0x7bc], 0xed857289
jae 0x47d66b
mov dword [ebp - 0x2da0], 1
jmp 0x47d672
and dword [ebp - 0x2da0], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x386c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3ad8], eax
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x3878], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3b04], eax
push 0
lea ecx, [ebp - 0x2654]
call fcn.00438351
push 1
lea ecx, [ebp - 0x2654]
call fcn.00438351
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3880], eax
push 0
lea ecx, [ebp - 0x2654]
call fcn.00438351
mov ecx, dword [ebp - 0x640]
cmp dword [eax], ecx
je 0x47d6df
mov dword [ebp - 0x1230], 1
jmp 0x47d6e6
and dword [ebp - 0x1230], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1230]
jle 0x47d6fd
mov dword [ebp - 0x20c0], 1
jmp 0x47d704
and dword [ebp - 0x20c0], 0
push 0
lea ecx, [ebp - 0x2654]
call fcn.00438351
mov ecx, dword [ebp - 0x20c0]
cmp ecx, dword [eax]
je 0x47d727
mov dword [ebp - 0x1238], 1
jmp 0x47d72e
and dword [ebp - 0x1238], 0
mov eax, dword [ebp - 0x1238]
mov dword [ebp - 0x20c8], eax
mov eax, dword [ebp - 0x20c8]
mov dword [ebp - 0x1240], eax
mov esi, dword [ebp - 0x1240]
push 0
lea ecx, [ebp - 0x2654]
call fcn.00438351
cmp esi, dword [eax]
jg 0x47d769
mov dword [ebp - 0x20d0], 1
jmp 0x47d770
and dword [ebp - 0x20d0], 0
mov eax, dword [ebp - 0x7bc]
cmp eax, dword [ebp - 0x20d0]
jl 0x47d78a
mov dword [ebp - 0x1248], 1
jmp 0x47d791
and dword [ebp - 0x1248], 0
mov eax, dword [ebp - 0x2da8]
cmp dword [ebp - 0x1248], eax
jge 0x47d7ab
mov dword [ebp - 0x20d8], 1
jmp 0x47d7b2
and dword [ebp - 0x20d8], 0
push 0
lea ecx, [ebp - 0x2654]
call fcn.00438351
mov ecx, dword [ebp - 0x20d8]
cmp ecx, dword [eax]
jge 0x47d7d8
cmp dword [ebp - 0x2c], 0
jne 0x47d7d8
and dword [ebp - 0x1250], 0
jmp 0x47d7e2
mov dword [ebp - 0x1250], 1
cmp dword [ebp - 0x1250], 2
je 0x47d7f7
mov dword [ebp - 0x20e0], 1
jmp 0x47d7fe
and dword [ebp - 0x20e0], 0
mov eax, dword [ebp - 0x20e0]
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x640], 0
jmp 0x47d823
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0xd
jle 0x47d86b
mov byte [ebp - 0x32c], 0
movzx eax, byte [ebp - 0x32c]
test eax, eax
je 0x47d848
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x47d869
push 0
push 0x1b83
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x47d816
lea ecx, [ebp - 0x2654]
call fcn.00438335
jmp 0x47d5ea
mov dword [ebp - 0x2bd8], str.ddl_daz_ctlrvd_lzyozdvei_brmycoqxy_deaxkrgyk_pmqtkswec_xfrpaqmav_gkoq_hxjcrcjzt_kxvh_vnbol
mov dword [ebp - 0x3c4], 0xb3e90a62
push 2
lea ecx, [ebp - 0x283c]
call fcn.00438263
mov dword [ebp - 0x20e8], 0
push 2
lea ecx, [ebp - 0x29b8]
call fcn.00438263
mov dword [ebp - 0x238], 0
jmp 0x47d8cc
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x47d8ee
push dword [ebp - 0x238]
lea ecx, [ebp - 0x283c]
call fcn.00438351
mov dword [eax], 0xb58e17c1
jmp 0x47d8bf
mov dword [ebp - 0x238], 0
jmp 0x47d907
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x47d929
push dword [ebp - 0x238]
lea ecx, [ebp - 0x29b8]
call fcn.00438351
mov dword [eax], 0x6085e071
jmp 0x47d8fa
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3b0c], eax
mov esi, dword [ebp - 0x3c4]
push 0
lea ecx, [ebp - 0x283c]
call fcn.00438351
cmp esi, dword [eax]
je 0x47d958
mov dword [ebp - 0x1258], 1
jmp 0x47d95f
and dword [ebp - 0x1258], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x1258], eax
jle 0x47d979
mov dword [ebp - 0x2db0], 1
jmp 0x47d980
and dword [ebp - 0x2db0], 0
push 1
lea ecx, [ebp - 0x283c]
call fcn.00438351
mov esi, dword [ebp - 0x3c4]
push 0
lea ecx, [ebp - 0x283c]
call fcn.00438351
add esi, dword [eax]
mov dword [ebp - 0x20e8], esi
mov eax, dword [ebp - 0x20e8]
mov dword [ebp - 0x1260], eax
push 1
lea ecx, [ebp - 0x29b8]
call fcn.00438351
mov ecx, dword [ebp - 0x1260]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x283c]
call fcn.00438351
mov ecx, dword [ebp - 0x1260]
cmp ecx, dword [eax]
jne 0x47d9ec
mov dword [ebp - 0x20f0], 1
jmp 0x47d9f3
and dword [ebp - 0x20f0], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x20f0], eax
jge 0x47da43
mov byte [ebp - 0x32e], 0
movzx eax, byte [ebp - 0x32e]
test eax, eax
je 0x47da1d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov byte [ebp - 0x36b], 0
movzx eax, byte [ebp - 0x36b]
test eax, eax
je 0x47da3e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x47dc64
mov dword [ebp - 0x7c4], 0xfffb
mov dword [ebp - 0x52c], 0xfffa
mov dword [ebp - 0xb64], 1
cmp dword [ebp - 0x7c4], 0
je 0x47dae3
cmp dword [ebp - 0x52c], 0
je 0x47dae3
mov dword [ebp - 0x52c], 0
jmp 0x47da8c
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x3c
jl 0x47dade
mov dword [ebp - 0x9e4], 0
jmp 0x47daae
mov eax, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x9e4], 3
jge 0x47daca
mov eax, dword [ebp - 0x9e4]
mov dword [ebp + eax*4 - 0x3c88], 0xf58a
jmp 0x47daa1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3c88], 0
je 0x47dadc
jmp 0x47dade
jmp 0x47da7f
jmp 0x47dc64
mov dword [ebp - 0xdbc], 1
mov dword [ebp - 0x2dc0], 1
cmp dword [ebp - 0xdbc], 0
jne 0x47dc33
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x3888], eax
cmp dword [ebp - 0x7c4], 8
jbe 0x47db85
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0xb64], eax
jne 0x47db33
mov dword [ebp - 0x1268], 1
jmp 0x47db3a
and dword [ebp - 0x1268], 0
mov eax, dword [ebp - 0xdbc]
cmp dword [ebp - 0x1268], eax
jne 0x47db54
mov dword [ebp - 0x20f8], 1
jmp 0x47db5b
and dword [ebp - 0x20f8], 0
cmp dword [ebp - 0x20f8], 0xdb2097e6
jbe 0x47db85
cmp dword [ebp - 0x3c4], 0
je 0x47db85
cmp dword [ebp - 0xb64], 0
je 0x47db85
mov dword [ebp - 0x1270], 1
jmp 0x47db8c
and dword [ebp - 0x1270], 0
push 1
lea ecx, [ebp - 0x283c]
call fcn.00438351
mov esi, dword [ebp - 0x1270]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x29b8]
call fcn.00438351
cmp esi, dword [eax]
jle 0x47dbbe
mov dword [ebp - 0x2100], 1
jmp 0x47dbc5
and dword [ebp - 0x2100], 0
push 1
lea ecx, [ebp - 0x29b8]
call fcn.00438351
mov ecx, dword [ebp - 0x2100]
cmp ecx, dword [eax]
jg 0x47dbe8
mov dword [ebp - 0x1278], 1
jmp 0x47dbef
and dword [ebp - 0x1278], 0
mov eax, dword [ebp - 0x1278]
sub eax, dword [ebp - 0xdbc]
cmp eax, 0x59f32f52
jne 0x47dc0e
mov dword [ebp - 0x2db8], 1
jmp 0x47dc15
and dword [ebp - 0x2db8], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3b98], eax
cmp dword [ebp - 0x7c4], 0
jne 0x47dc33
and dword [ebp - 0x2108], 0
jmp 0x47dc3d
mov dword [ebp - 0x2108], 1
push 1
lea ecx, [ebp - 0x29b8]
call fcn.00438351
mov ecx, dword [ebp - 0x2108]
add ecx, dword [eax]
mov dword [ebp - 0xb64], ecx
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x2dc0], eax
lea ecx, [ebp - 0x29b8]
call fcn.00438335
lea ecx, [ebp - 0x283c]
call fcn.00438335
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1288], 0xaaeb9ae7
mov dword [ebp - 0x2dd0], 0xffffffff
mov dword [ebp - 0x7d4], 0xfffffffd
mov dword [ebp - 0xde0], 6
mov dword [ebp - 0x2158], 0xb58e17c1
mov dword [ebp - 0x12b8], 8
mov dword [ebp - 0x6b0], 2
mov dword [ebp - 0x30c4], 0x4a90611b
mov dword [ebp - 0x30c0], 0x4a90611b
mov dword [ebp - 0x30bc], 0x4a90611b
mov dword [ebp - 0x30b8], 0x4a90611b
mov dword [ebp - 0x278], 5
mov dword [ebp - 0x2138], 0x5452fa81
mov dword [ebp - 0xcac], 0xfffffffb
mov dword [ebp - 0x3cc], 0xffffffff
mov dword [ebp - 0x34ec], 0x80bfd780
mov dword [ebp - 0x34e8], 0x80bfd780
mov dword [ebp - 0x34e4], 0x80bfd780
mov dword [ebp - 0x34e0], 0x80bfd780
mov eax, dword [ebp - 0x1288]
mov dword [ebp - 0x3514], eax
imul eax, dword [ebp - 0x3cc], 0
test eax, eax
jne 0x47dd71
cmp dword [ebp - 0xde0], 0
je 0x47dd71
cmp dword [ebp - 0x3cc], 0
je 0x47dd71
and dword [ebp - 0x1280], 0
jmp 0x47dd7b
mov dword [ebp - 0x1280], 1
mov eax, dword [ebp - 0xcac]
dec eax
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xcac]
cmp eax, dword [ebp - 0x1280]
jle 0x47dda2
mov dword [ebp - 0x2110], 1
jmp 0x47dda9
and dword [ebp - 0x2110], 0
mov eax, dword [ebp - 0xde0]
cmp dword [ebp - 0x2110], eax
jl 0x47ddc3
mov dword [ebp - 0x2dc8], 1
jmp 0x47ddca
and dword [ebp - 0x2dc8], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x351c], eax
mov eax, 0xf816
test eax, eax
je 0x47ddf4
cmp dword [ebp - 0x7d4], 0
je 0x47ddf4
mov dword [ebp - 0x2118], 1
jmp 0x47ddfb
and dword [ebp - 0x2118], 0
mov eax, dword [ebp - 0x1288]
sub eax, dword [ebp - 0x2118]
cmp eax, dword [ebp - 0x2158]
jge 0x47de1b
mov dword [ebp - 0x1290], 1
jmp 0x47de22
and dword [ebp - 0x1290], 0
cmp dword [ebp - 0x1290], 0xb281
je 0x47de3a
mov dword [ebp - 0x2120], 1
jmp 0x47de41
and dword [ebp - 0x2120], 0
mov eax, dword [ebp - 0x2138]
add eax, dword [ebp - 0x2120]
cmp eax, 0xffffffff
jle 0x47de5e
mov dword [ebp - 0x1298], 1
jmp 0x47de65
and dword [ebp - 0x1298], 0
mov eax, dword [ebp - 0x1298]
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x3cc], 0
jmp 0x47de8a
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0xfffffff0
je 0x47e1ed
mov dword [ebp - 0x59c], 0xc840
mov dword [ebp - 0x2de8], 0x155d2618
mov dword [ebp - 0x7cc], 0
jmp 0x47dec4
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 3
jge 0x47dee0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0x3ce8], 0xc348fb8a
jmp 0x47deb7
mov dword [ebp - 0x6b0], 0xfffffff7
jmp 0x47def9
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0x11
jle 0x47e08c
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x2148], 0x13236c21
cmp dword [ebp - 0x59c], 0
je 0x47df5c
xor eax, eax
inc eax
je 0x47df3d
cmp dword [ebp - 0x9ec], 0
je 0x47df3d
mov dword [ebp - 0x2128], 1
jmp 0x47df44
and dword [ebp - 0x2128], 0
cmp dword [ebp - 0x2128], 0xb2cf
jl 0x47df5c
mov dword [ebp - 0x12a0], 1
jmp 0x47df63
and dword [ebp - 0x12a0], 0
cmp dword [ebp - 0x12a0], 0x6954eb85
jle 0x47df7b
mov dword [ebp - 0x2130], 1
jmp 0x47df82
and dword [ebp - 0x2130], 0
cmp dword [ebp - 0x2130], 0xffffffff
jl 0x47df97
mov dword [ebp - 0x12a8], 1
jmp 0x47df9e
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0x59c]
cmp dword [ebp - 0x12a8], eax
jg 0x47dfb8
mov dword [ebp - 0x12b0], 1
jmp 0x47dfbf
and dword [ebp - 0x12b0], 0
mov eax, dword [ebp - 0x2138]
imul eax, dword [ebp - 0x12b0]
mov dword [ebp - 0x2dd0], eax
cmp dword [ebp - 0x6b0], 0
je 0x47e074
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x3524], eax
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x352c], eax
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x3534], eax
mov eax, dword [ebp - 0x9ec]
cmp dword [ebp - 0x59c], eax
jne 0x47e01d
mov dword [ebp - 0x2140], 1
jmp 0x47e024
and dword [ebp - 0x2140], 0
mov eax, dword [ebp - 0x2140]
mov dword [ebp - 0x12b8], eax
mov eax, dword [ebp - 0x12b8]
mov dword [ebp - 0x2148], eax
cmp dword [ebp - 0x2148], 0x5cd4
jge 0x47e054
mov dword [ebp - 0x12c0], 1
jmp 0x47e05b
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x12c0]
add eax, 0x71a104b8
je 0x47e074
mov dword [ebp - 0x2150], 1
jmp 0x47e07b
and dword [ebp - 0x2150], 0
mov eax, dword [ebp - 0x2150]
mov dword [ebp - 0xde0], eax
jmp 0x47deec
mov dword [ebp - 0x278], 3
jmp 0x47e0a5
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jl 0x47e1e8
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp + eax*4 - 0x30c4]
cmp dword [ebp - 0x7d4], eax
jg 0x47e0d3
mov dword [ebp - 0x12c8], 1
jmp 0x47e0da
and dword [ebp - 0x12c8], 0
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp + eax*4 - 0x30c4]
cmp eax, dword [ebp - 0x12c8]
jg 0x47e0fb
mov dword [ebp - 0x2dd8], 1
jmp 0x47e102
and dword [ebp - 0x2dd8], 0
mov eax, dword [ebp - 0x2158]
mov dword [ebp - 0x353c], eax
mov eax, dword [ebp - 0x59c]
sub eax, dword [ebp - 0x59c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x34ec]
jg 0x47e135
mov dword [ebp - 0x12d0], 1
jmp 0x47e13c
and dword [ebp - 0x12d0], 0
mov eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0x12d0], eax
je 0x47e163
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3ce8], 0
jne 0x47e163
and dword [ebp - 0x2160], 0
jmp 0x47e16d
mov dword [ebp - 0x2160], 1
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp + eax*4 - 0x30c4]
cmp dword [ebp - 0x2160], eax
jne 0x47e18e
mov dword [ebp - 0x2de0], 1
jmp 0x47e195
and dword [ebp - 0x2de0], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp + eax*4 - 0x30c4], 1
jne 0x47e1b1
mov dword [ebp - 0x12d8], 1
jmp 0x47e1b8
and dword [ebp - 0x12d8], 0
cmp dword [ebp - 0x12d8], 0xffff
ja 0x47e1d0
mov dword [ebp - 0x2168], 1
jmp 0x47e1d7
and dword [ebp - 0x2168], 0
mov eax, dword [ebp - 0x2168]
mov dword [ebp - 0x2de8], eax
jmp 0x47e098
jmp 0x47de7d
or eax, 0xffffffff
je 0x47e228
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x47e209
mov dword [ebp - 0x12e0], 1
jmp 0x47e210
and dword [ebp - 0x12e0], 0
cmp dword [ebp - 0x12e0], 0x44ad72d7
jg 0x47e228
mov dword [ebp - 0x2170], 1
jmp 0x47e22f
and dword [ebp - 0x2170], 0
mov eax, dword [ebp - 0x2170]
add eax, 0x5dce
je 0x47e8f0
mov dword [ebp - 0x3544], 0xa8ea
mov byte [ebp - 0x330], 0
movzx eax, byte [ebp - 0x330]
test eax, eax
je 0x47e272
push 0
push 0
push 0x200e
push 0x16a5
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x47e28c
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [ebp - 0x30], 0
jmp 0x47e29c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xe
jg 0x47e8eb
mov dword [ebp - 0x2e8], 0xe0648261
mov dword [ebp - 0x7dc], 1
mov dword [ebp - 0x534], 0x466e9f08
mov dword [ebp - 0x2df0], 0x600d5493
mov dword [ebp - 0x2e48], 0x16e074f0
mov dword [ebp - 0x2e8], 0xffffffff
jmp 0x47e2f1
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0xfffffffa
jge 0x47e489
mov dword [ebp - 0x648], 0
push 3
lea ecx, [ebp - 0x318c]
call fcn.00438263
mov dword [ebp - 0xaec], 0
jmp 0x47e32e
mov eax, dword [ebp - 0xaec]
inc eax
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0xaec], 3
jge 0x47e350
push dword [ebp - 0xaec]
lea ecx, [ebp - 0x318c]
call fcn.00438351
mov dword [eax], 8
jmp 0x47e321
cmp dword [ebp - 0x2e8], 0
je 0x47e3fa
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x354c], eax
xor eax, eax
sub eax, dword [ebp - 0x648]
add eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x2e8]
jge 0x47e38b
mov dword [ebp - 0xcb4], 1
jmp 0x47e392
and dword [ebp - 0xcb4], 0
push 0
lea ecx, [ebp - 0x318c]
call fcn.00438351
mov ecx, dword [ebp - 0xcb4]
mov dword [eax], ecx
cmp dword [ebp - 0xcb4], 0xfffb
je 0x47e3bf
mov dword [ebp - 0x12e8], 1
jmp 0x47e3c6
and dword [ebp - 0x12e8], 0
cmp dword [ebp - 0x12e8], 0
jb 0x47e3db
mov dword [ebp - 0x2178], 1
jmp 0x47e3e2
and dword [ebp - 0x2178], 0
mov eax, dword [ebp - 0x2178]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x648]
cmp dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x648]
je 0x47e426
push 0
lea ecx, [ebp - 0x318c]
call fcn.00438351
cmp dword [eax], 0
je 0x47e426
mov dword [ebp - 0x12f0], 1
jmp 0x47e42d
and dword [ebp - 0x12f0], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x12f0], eax
jl 0x47e447
mov dword [ebp - 0x2180], 1
jmp 0x47e44e
and dword [ebp - 0x2180], 0
mov eax, dword [ebp - 0x2180]
mov dword [ebp - 0x2df0], eax
mov byte [ebp - 0x332], 0
movzx eax, byte [ebp - 0x332]
test eax, eax
je 0x47e479
push 0x187b
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea ecx, [ebp - 0x318c]
call fcn.00438335
jmp 0x47e2e4
mov dword [ebp - 0x534], 0
jmp 0x47e4a2
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 4
jge 0x47e5bf
mov dword [ebp - 0x6e8], 0xfffffff6
mov dword [ebp - 0x2e58], 0x31af6658
mov eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x6e8], eax
jl 0x47e4e3
mov eax, 0xa0122d80
test eax, eax
jne 0x47e4e3
and dword [ebp - 0x12f8], 0
jmp 0x47e4ed
mov dword [ebp - 0x12f8], 1
cmp dword [ebp - 0x12f8], 0xfffffff9
jl 0x47e502
mov dword [ebp - 0x2188], 1
jmp 0x47e509
and dword [ebp - 0x2188], 0
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [ebp - 0x7dc]
add ecx, dword [ebp - 0x2188]
sub eax, ecx
je 0x47e534
cmp dword [ebp - 0x2e48], 0
je 0x47e534
mov dword [ebp - 0x1300], 1
jmp 0x47e53b
and dword [ebp - 0x1300], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x1300], eax
je 0x47e55b
cmp dword [ebp - 0x7dc], 0
jne 0x47e55b
and dword [ebp - 0x2190], 0
jmp 0x47e565
mov dword [ebp - 0x2190], 1
mov eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x2190], eax
jge 0x47e57f
mov dword [ebp - 0x1308], 1
jmp 0x47e586
and dword [ebp - 0x1308], 0
cmp dword [ebp - 0x1308], 1
jge 0x47e59b
mov dword [ebp - 0x2e50], 1
jmp 0x47e5a2
and dword [ebp - 0x2e50], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x3554], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2e58], eax
jmp 0x47e495
mov dword [ebp - 0x9f4], 1
mov dword [ebp - 0x13c], 0x324ec2e0
mov dword [ebp - 0xdc4], 0
mov dword [ebp - 0x2e60], 0xffffffff
mov dword [ebp - 0x13c], 0xffffffe9
jmp 0x47e600
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jg 0x47e631
mov byte [ebp - 0x36f], 0
movzx eax, byte [ebp - 0x36f]
test eax, eax
je 0x47e62f
push 0
push 0x1416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x47e5f3
cmp dword [ebp - 0x13c], 7
jle 0x47e646
mov dword [ebp - 0x2198], 1
jmp 0x47e64d
and dword [ebp - 0x2198], 0
mov eax, dword [ebp - 0x2198]
sub eax, dword [ebp - 0xdc4]
cmp eax, 0xc099
jle 0x47e66c
mov dword [ebp - 0x1310], 1
jmp 0x47e673
and dword [ebp - 0x1310], 0
cmp dword [ebp - 0x1310], 1
jne 0x47e688
mov dword [ebp - 0x21a0], 1
jmp 0x47e68f
and dword [ebp - 0x21a0], 0
cmp dword [ebp - 0x21a0], 0x718e
jne 0x47e6ad
cmp dword [ebp - 0xdc4], 0
jne 0x47e6ad
and dword [ebp - 0x1318], 0
jmp 0x47e6b7
mov dword [ebp - 0x1318], 1
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x1318]
cmp eax, 4
jne 0x47e6d4
mov dword [ebp - 0x21a8], 1
jmp 0x47e6db
and dword [ebp - 0x21a8], 0
mov eax, dword [ebp - 0x21a8]
sub eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0xdc4]
jl 0x47e701
mov dword [ebp - 0x1320], 1
jmp 0x47e708
and dword [ebp - 0x1320], 0
imul eax, dword [ebp - 0x1320], 0x5425
test eax, eax
jne 0x47e729
push 9
pop eax
test eax, eax
je 0x47e729
mov dword [ebp - 0x21b0], 1
jmp 0x47e730
and dword [ebp - 0x21b0], 0
mov eax, dword [ebp - 0x21b0]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x2e60], eax
mov dword [ebp - 0x9f4], 0xffffffe2
jmp 0x47e761
mov eax, dword [ebp - 0x9f4]
inc eax
mov dword [ebp - 0x9f4], eax
cmp dword [ebp - 0x9f4], 0xffffffe5
jle 0x47e8e6
mov dword [ebp - 0x355c], 0xffffffff
mov dword [ebp - 0x3564], 0xffffffff
mov dword [ebp - 0x356c], 0x3245f1db
mov dword [ebp - 0x3574], 0x2c0d37ad
mov dword [ebp - 0x357c], 0xffffffff
push 1
lea ecx, [ebp - 0x3994]
call fcn.00438263
mov dword [ebp - 0x3584], 1
mov dword [ebp - 0x358c], 0x231fbf68
mov dword [ebp - 0x1328], 0xfffffffd
mov dword [ebp - 0x7e4], 0
jmp 0x47e7e4
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 1
jge 0x47e806
push dword [ebp - 0x7e4]
lea ecx, [ebp - 0x3994]
call fcn.00438351
mov dword [eax], 0x3e64f147
jmp 0x47e7d7
mov eax, dword [ebp - 0x1328]
dec eax
mov dword [ebp - 0x1328], eax
lea ecx, [ebp - 0x3994]
call fcn.00438335
mov byte [ebp - 0x334], 0
movzx eax, byte [ebp - 0x334]
test eax, eax
je 0x47e8e1
push 2
lea ecx, [ebp - 0x39a4]
call fcn.00438263
mov dword [ebp - 0x7ec], 5
mov dword [ebp - 0xba4], 0
jmp 0x47e864
mov eax, dword [ebp - 0xba4]
inc eax
mov dword [ebp - 0xba4], eax
cmp dword [ebp - 0xba4], 2
jge 0x47e886
push dword [ebp - 0xba4]
lea ecx, [ebp - 0x39a4]
call fcn.00438351
mov dword [eax], 3
jmp 0x47e857
mov dword [ebp - 0x7ec], 1
jmp 0x47e89f
mov eax, dword [ebp - 0x7ec]
dec eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 0
jl 0x47e8c7
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x47e8c5
push 0x262
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x47e892
lea ecx, [ebp - 0x39a4]
call fcn.00438335
push 0
push 0
push 0x22f1
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x47e754
jmp 0x47e295
jmp 0x480c77
mov dword [ebp - 0x5d4], 0x60b4ffb8
mov dword [ebp - 0x7f4], 0x26f3f17e
mov dword [ebp - 0xcbc], 0xc039ecf4
mov dword [ebp - 0x2e68], 0
mov dword [ebp - 0xde8], 0xfffffff7
mov dword [ebp - 0x2e70], 0
mov dword [ebp - 0x21d8], 0x935ff574
mov dword [ebp - 0x2e78], 0xbac8ef34
mov dword [ebp - 0x9fc], 0
jmp 0x47e959
mov eax, dword [ebp - 0x9fc]
inc eax
mov dword [ebp - 0x9fc], eax
cmp dword [ebp - 0x9fc], 3
jge 0x47e975
mov eax, dword [ebp - 0x9fc]
mov dword [ebp + eax*4 - 0x2994], 0xfffffff6
jmp 0x47e94c
mov dword [ebp - 0x5d4], 2
jmp 0x47e98e
mov eax, dword [ebp - 0x5d4]
dec eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0
jl 0x47e9b3
mov byte [ebp - 0x336], 0
movzx eax, byte [ebp - 0x336]
test eax, eax
je 0x47e9b1
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x47e981
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2994]
mov dword [ebp - 0x3594], eax
mov eax, dword [ebp - 0xcbc]
dec eax
mov dword [ebp - 0xcbc], eax
jne 0x47e9e1
mov dword [ebp - 0x21c8], 1
jmp 0x47e9e8
and dword [ebp - 0x21c8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2994], 0xfffffff8
je 0x47ea03
mov dword [ebp - 0x21b8], 1
jmp 0x47ea0a
and dword [ebp - 0x21b8], 0
mov eax, dword [ebp - 0x7f4]
cmp dword [ebp - 0x21b8], eax
je 0x47ea24
mov dword [ebp - 0x1330], 1
jmp 0x47ea2b
and dword [ebp - 0x1330], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2994]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x7f4]
sub eax, dword [ebp - 0x1330]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x2994]
cmp dword [ebp - 0x5d4], eax
jl 0x47ea67
cmp dword [ebp - 0x2e68], 0
jne 0x47ea74
xor eax, eax
jne 0x47ea74
and dword [ebp - 0x21c0], 0
jmp 0x47ea7e
mov dword [ebp - 0x21c0], 1
mov eax, dword [ebp - 0x21c0]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0x7f4], eax
jl 0x47eaa4
mov dword [ebp - 0x1338], 1
jmp 0x47eaab
and dword [ebp - 0x1338], 0
mov eax, dword [ebp - 0x1338]
mov dword [ebp - 0x2e70], eax
cmp dword [ebp - 0xde8], 0xf63abefa
ja 0x47eacf
mov dword [ebp - 0x1340], 1
jmp 0x47ead6
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0x21c8]
neg eax
mov ecx, dword [ebp - 0xde8]
add ecx, dword [ebp - 0x1340]
cmp eax, ecx
jl 0x47eafa
mov dword [ebp - 0x21d0], 1
jmp 0x47eb01
and dword [ebp - 0x21d0], 0
imul eax, dword [ebp - 0x21d0], 0xbd0d
test eax, eax
jne 0x47eb28
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2994], 0
jne 0x47eb28
and dword [ebp - 0x1348], 0
jmp 0x47eb32
mov dword [ebp - 0x1348], 1
mov eax, dword [ebp - 0x1348]
mov dword [ebp - 0x21d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2994]
cmp eax, dword [ebp - 0x21d8]
jne 0x47eb5f
mov dword [ebp - 0x1350], 1
jmp 0x47eb66
and dword [ebp - 0x1350], 0
cmp dword [ebp - 0x1350], 0x708b
jge 0x47eb7e
mov dword [ebp - 0x21e0], 1
jmp 0x47eb85
and dword [ebp - 0x21e0], 0
mov eax, dword [ebp - 0x21e0]
mov dword [ebp - 0x2e78], eax
mov dword [ebp - 0x824], 0xa8cf1d65
mov dword [ebp - 0xaf4], 0xa5d6c05b
mov dword [ebp - 0xaf4], 0
jmp 0x47ebbe
mov eax, dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xaf4], eax
cmp dword [ebp - 0xaf4], 0x19
jle 0x47ec18
mov dword [ebp - 0x7fc], 8
mov dword [ebp - 0x359c], 0xd3c891c5
mov dword [ebp - 0x7fc], 0xffffffec
jmp 0x47ebf4
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0xa
jl 0x47ec16
mov dword [ebp - 0x1358], 1
mov eax, dword [ebp - 0x1358]
dec eax
mov dword [ebp - 0x1358], eax
jmp 0x47ebe7
jmp 0x47ebb1
mov dword [ebp - 0x658], 0xd7c1543f
mov dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d4], 0
jmp 0x47ec52
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x3a
jle 0x47ed41
mov dword [ebp - 0x53c], 0x288a137b
mov dword [ebp - 0x53c], 0
jmp 0x47ec82
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0xfffffffe
je 0x47ed2e
mov dword [ebp - 0x650], 0x10d21dfe
mov dword [ebp - 0x2e80], 0xcd9d7
mov dword [ebp - 0x650], 0
jmp 0x47ecbc
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0x11
jne 0x47ed29
mov dword [ebp - 0x21e8], 0x9f5fa318
mov dword [ebp - 0x2e90], 0xfecbe92e
mov dword [ebp - 0x2e80], 8
mov eax, dword [ebp - 0x3d4]
imul eax, dword [ebp - 0x21e8]
cmp eax, 1
jne 0x47ed10
cmp dword [ebp - 0x21e8], 0
jne 0x47ed10
cmp dword [ebp - 0x53c], 0
jne 0x47ed10
and dword [ebp - 0x2e88], 0
jmp 0x47ed1a
mov dword [ebp - 0x2e88], 1
imul eax, dword [ebp - 0x650], 7
mov dword [ebp - 0x2e90], eax
jmp 0x47ecaf
jmp 0x47ec75
cmp dword [ebp - 0x53c], 0
je 0x47ed3c
jmp 0x47ec45
jmp 0x47ec45
mov dword [ebp - 0x1430], 0xffffffff
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x804], 8
mov dword [ebp - 0xb6c], 6
mov dword [ebp - 0x6b8], 0xa64
mov dword [ebp - 0x2ea0], 3
mov dword [ebp - 0x2ea8], 0xffffffff
mov dword [ebp - 0x35a4], 0x6a25
mov dword [ebp - 0xa04], 0
jmp 0x47edaa
mov eax, dword [ebp - 0xa04]
inc eax
mov dword [ebp - 0xa04], eax
cmp dword [ebp - 0xa04], 2
jge 0x47edc6
mov eax, dword [ebp - 0xa04]
mov dword [ebp + eax*4 - 0x3250], 0xa812c005
jmp 0x47ed9d
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x35ac], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x35b4], eax
cmp dword [ebp - 0x114], 0
je 0x47ee4a
cmp dword [ebp - 0x114], 0xeb59008c
je 0x47edff
mov dword [ebp - 0x1360], 1
jmp 0x47ee06
and dword [ebp - 0x1360], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1360], eax
je 0x47ee20
mov dword [ebp - 0x21f0], 1
jmp 0x47ee27
and dword [ebp - 0x21f0], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x21f0]
je 0x47ee4a
mov eax, 0xd2f38d92
test eax, eax
je 0x47ee4a
mov dword [ebp - 0x1368], 1
jmp 0x47ee51
and dword [ebp - 0x1368], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1368], eax
jg 0x47ee6b
mov dword [ebp - 0x21f8], 1
jmp 0x47ee72
and dword [ebp - 0x21f8], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x21f8], eax
je 0x47ee95
cmp dword [ebp - 0x804], 0
je 0x47ee95
mov dword [ebp - 0x1370], 1
jmp 0x47ee9c
and dword [ebp - 0x1370], 0
mov eax, dword [ebp - 0x804]
cmp dword [ebp - 0x1370], eax
jl 0x47eeb6
mov dword [ebp - 0x2200], 1
jmp 0x47eebd
and dword [ebp - 0x2200], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x2200], eax
jne 0x47eed7
mov dword [ebp - 0x1378], 1
jmp 0x47eede
and dword [ebp - 0x1378], 0
cmp dword [ebp - 0x1378], 0xfffa
jne 0x47eef6
mov dword [ebp - 0x2208], 1
jmp 0x47eefd
and dword [ebp - 0x2208], 0
cmp dword [ebp - 0x2208], 0x8a277ebd
jne 0x47ef15
mov dword [ebp - 0x1380], 1
jmp 0x47ef1c
and dword [ebp - 0x1380], 0
mov eax, dword [ebp - 0x804]
cmp dword [ebp - 0x1380], eax
je 0x47ef36
mov dword [ebp - 0x2210], 1
jmp 0x47ef3d
and dword [ebp - 0x2210], 0
mov eax, dword [ebp - 0x2210]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x35bc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3250], 0xfffffff8
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x35c4], eax
mov eax, dword [ebp - 0x6b8]
add eax, 0xaa29
cmp dword [ebp - 0xb6c], eax
jle 0x47ef91
mov dword [ebp - 0x2e98], 1
jmp 0x47ef98
and dword [ebp - 0x2e98], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x35cc], eax
cmp dword [ebp - 0x804], 0xa0e1
je 0x47efbc
mov dword [ebp - 0x1388], 1
jmp 0x47efc3
and dword [ebp - 0x1388], 0
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0x1388], eax
jg 0x47efdd
mov dword [ebp - 0x2218], 1
jmp 0x47efe4
and dword [ebp - 0x2218], 0
mov eax, dword [ebp - 0xb6c]
add eax, dword [ebp - 0x2218]
je 0x47f000
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3250], 0
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0x6b8], eax
jg 0x47f01a
mov dword [ebp - 0x1390], 1
jmp 0x47f021
and dword [ebp - 0x1390], 0
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0x1390], eax
jge 0x47f03b
mov dword [ebp - 0x23a0], 0x9cfe
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x2368], 0xfffffffe
mov dword [ebp - 0x3094], 2
mov dword [ebp - 0x60c], 0xfffa
mov dword [ebp - 0xcdc], 0x3b6f9b69
mov dword [ebp - 0x2398], 0
mov dword [ebp - 0x1520], 0xfffffff7
mov dword [ebp - 0x288], 0xffffffff
push 4
lea ecx, [ebp - 0x2f80]
call fcn.00438263
mov dword [ebp - 0x84], 0
jmp 0x480cf4
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x480d10
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x2854], 1
jmp 0x480ce7
mov dword [ebp - 0x84], 0
jmp 0x480d29
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x480d45
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x3e4], 0x63718bd8
jmp 0x480d1c
mov dword [ebp - 0x84], 0
jmp 0x480d5e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x480d80
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2f80]
call fcn.00438351
mov dword [eax], 0x8161
jmp 0x480d51
cmp dword [ebp - 0x3094], 0xfffffffa
jg 0x480d95
mov dword [ebp - 0x14d8], 1
jmp 0x480d9c
and dword [ebp - 0x14d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2854]
cmp dword [ebp - 0x14d8], eax
jge 0x480dbd
mov dword [ebp - 0x14e0], 1
jmp 0x480dc4
and dword [ebp - 0x14e0], 0
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x2368], eax
mov eax, dword [ebp - 0x2368]
imul eax, dword [ebp - 0x14e0]
test eax, eax
jne 0x480eff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e4]
mov dword [ebp - 0x367c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e4]
mov dword [ebp - 0x3684], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c]
cmp dword [ebp + eax - 0x3e4], ecx
jle 0x480e36
mov dword [ebp - 0x2370], 1
jmp 0x480e3d
and dword [ebp - 0x2370], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2370]
sub ecx, dword [ebp + eax - 0x2854]
sub ecx, dword [ebp - 0x1520]
cmp ecx, 0xfffffff9
jne 0x480e67
mov dword [ebp - 0x14e8], 1
jmp 0x480e6e
and dword [ebp - 0x14e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2854]
cmp dword [ebp - 0x14e8], eax
jg 0x480e95
cmp dword [ebp - 0x5c], 0
je 0x480e95
mov dword [ebp - 0x2378], 1
jmp 0x480e9c
and dword [ebp - 0x2378], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2854]
add eax, dword [ebp - 0x2378]
imul eax, eax, 0x9deb
cmp eax, dword [ebp - 0x5c]
jg 0x480ec5
mov dword [ebp - 0x14f0], 1
jmp 0x480ecc
and dword [ebp - 0x14f0], 0
mov eax, dword [ebp - 0xcdc]
cmp dword [ebp - 0x14f0], eax
jg 0x480ee6
mov dword [ebp - 0x2380], 1
jmp 0x480eed
and dword [ebp - 0x2380], 0
cmp dword [ebp - 0x2380], 0
jne 0x480eff
and dword [ebp - 0x309c], 0
jmp 0x480f09
mov dword [ebp - 0x309c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e4]
cmp dword [ebp - 0x5c], eax
jge 0x480f27
mov dword [ebp - 0x14f8], 1
jmp 0x480f2e
and dword [ebp - 0x14f8], 0
mov eax, dword [ebp - 0x60c]
imul eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x2a7c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2854]
mov dword [ebp - 0x29e8], eax
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x2a7c]
cmp eax, dword [ebp - 0x29e8]
jg 0x480f7b
mov dword [ebp - 0x2dac], 1
jmp 0x480f82
and dword [ebp - 0x2dac], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x368c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2854], 0
je 0x480fff
mov dword [ebp - 0x288], 0
jmp 0x480fb4
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jg 0x480ffd
mov dword [ebp - 0x5c], 0
jmp 0x480fcd
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x480ffb
mov byte [ebp - 0x381], 0
movzx eax, byte [ebp - 0x381]
test eax, eax
je 0x480ff9
push 0x664
push 0
push 0x1ab2
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x480fc6
jmp 0x480fa7
jmp 0x481017
mov byte [ebp - 0x383], 0
movzx eax, byte [ebp - 0x383]
test eax, eax
je 0x481017
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 3
pop eax
test eax, eax
je 0x4811cc
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2398]
cmp dword [ebp + eax - 0x3e4], ecx
jle 0x481043
mov dword [ebp - 0x2388], 1
jmp 0x48104a
and dword [ebp - 0x2388], 0
push 2
lea ecx, [ebp - 0x2f80]
call fcn.00438351
mov eax, dword [eax]
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0xcdc]
cmp eax, dword [ebp - 0x2388]
jle 0x481079
mov dword [ebp - 0x1500], 1
jmp 0x481080
and dword [ebp - 0x1500], 0
push 1
lea ecx, [ebp - 0x2f80]
call fcn.00438351
mov ecx, dword [ebp - 0x1500]
cmp ecx, dword [eax]
je 0x4810a3
mov dword [ebp - 0x2390], 1
jmp 0x4810aa
and dword [ebp - 0x2390], 0
push 2
lea ecx, [ebp - 0x2f80]
call fcn.00438351
mov ecx, dword [ebp - 0x2390]
sub ecx, dword [eax]
cmp ecx, 1
jbe 0x4810d6
cmp dword [ebp - 0x60c], 0
jne 0x4810d6
and dword [ebp - 0x1508], 0
jmp 0x4810e0
mov dword [ebp - 0x1508], 1
mov eax, dword [ebp - 0x23a0]
mov ecx, dword [ebp - 0x1508]
sub ecx, dword [ebp - 0x2398]
imul eax, ecx
cmp eax, dword [ebp - 0x288]
jle 0x481109
mov dword [ebp - 0x1510], 1
jmp 0x481110
and dword [ebp - 0x1510], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1510]
mov dword [ebp + eax - 0x2854], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e4]
mov dword [ebp - 0x3694], eax
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x5c], eax
jl 0x48114d
mov dword [ebp - 0x1518], 1
jmp 0x481154
and dword [ebp - 0x1518], 0
mov eax, dword [ebp - 0x23a0]
cmp dword [ebp - 0x1518], eax
je 0x48116e
mov dword [ebp - 0x23a8], 1
jmp 0x481175
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x23a8], eax
jl 0x48118c
mov dword [ebp - 0x29f0], 1
jmp 0x481193
and dword [ebp - 0x29f0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x369c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x36a4], eax
mov eax, dword [ebp - 0x1520]
cmp dword [ebp - 0x5c], eax
jle 0x4811cc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3e4], 0
je 0x4811cc
mov dword [ebp - 0x23b0], 1
jmp 0x4811d3
and dword [ebp - 0x23b0], 0
mov eax, dword [ebp - 0x23b0]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x2f80]
call fcn.00438335
cmp dword [ebp - 0x1994], 0x31f2
jle 0x4866a0
mov dword [ebp - 0x544], 0xb50bf34f
mov dword [ebp - 0x23b8], 0xa3735b26
mov dword [ebp - 0x36ac], 0xe85a7b05
mov dword [ebp - 0xa34], 0
jmp 0x48122e
mov eax, dword [ebp - 0xa34]
inc eax
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 3
jge 0x48124a
mov eax, dword [ebp - 0xa34]
mov dword [ebp + eax*4 - 0x39b4], 0xeac8b13e
jmp 0x481221
mov dword [ebp - 0x544], 2
jmp 0x481263
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
jl 0x48131b
mov dword [ebp - 0x5fc], 0x8876942a
mov dword [ebp - 0x5fc], 0
jmp 0x481293
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 2
jg 0x4812cd
mov byte [ebp - 0x348], 0
movzx eax, byte [ebp - 0x348]
test eax, eax
je 0x4812cb
push 0
push 0x126e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x481286
mov eax, dword [ebp - 0x544]
cmp dword [ebp + eax*4 - 0x39b4], 0
jne 0x481300
mov eax, dword [ebp - 0x544]
mov dword [ebp + eax*4 - 0x39b4], 0
cmp dword [ebp - 0x5fc], 0
jne 0x481300
and dword [ebp - 0x1528], 0
jmp 0x48130a
mov dword [ebp - 0x1528], 1
mov eax, dword [ebp - 0x1528]
mov dword [ebp - 0x5fc], eax
jmp 0x481256
mov eax, dword [ebp - 0x23b8]
inc eax
mov dword [ebp - 0x23b8], eax
mov dword [ebp - 0x3ec], 0xb3e90a62
push 2
lea ecx, [ebp - 0x2740]
call fcn.00438263
mov dword [ebp - 0x23c0], 0
push 2
lea ecx, [ebp - 0x2934]
call fcn.00438263
mov dword [ebp - 0x258], 0
jmp 0x48136f
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x481391
push dword [ebp - 0x258]
lea ecx, [ebp - 0x2740]
call fcn.00438351
mov dword [eax], 0xb58e17c1
jmp 0x481362
mov dword [ebp - 0x258], 0
jmp 0x4813aa
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x4813cc
push dword [ebp - 0x258]
lea ecx, [ebp - 0x2934]
call fcn.00438351
mov dword [eax], 0x6085e071
jmp 0x48139d
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x36b4], eax
mov esi, dword [ebp - 0x3ec]
push 0
lea ecx, [ebp - 0x2740]
call fcn.00438351
cmp esi, dword [eax]
je 0x4813fb
mov dword [ebp - 0x1530], 1
jmp 0x481402
and dword [ebp - 0x1530], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x1530], eax
jle 0x48141c
mov dword [ebp - 0x2df8], 1
jmp 0x481423
and dword [ebp - 0x2df8], 0
push 1
lea ecx, [ebp - 0x2740]
call fcn.00438351
mov esi, dword [ebp - 0x3ec]
push 0
lea ecx, [ebp - 0x2740]
call fcn.00438351
add esi, dword [eax]
mov dword [ebp - 0x23c0], esi
mov eax, dword [ebp - 0x23c0]
mov dword [ebp - 0x1538], eax
push 1
lea ecx, [ebp - 0x2934]
call fcn.00438351
mov ecx, dword [ebp - 0x1538]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2740]
call fcn.00438351
mov ecx, dword [ebp - 0x1538]
cmp ecx, dword [eax]
jne 0x48148f
mov dword [ebp - 0x23c8], 1
jmp 0x481496
and dword [ebp - 0x23c8], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x23c8], eax
jge 0x4814e6
mov byte [ebp - 0x3a5], 0
movzx eax, byte [ebp - 0x3a5]
test eax, eax
je 0x4814c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov byte [ebp - 0x34a], 0
movzx eax, byte [ebp - 0x34a]
test eax, eax
je 0x4814e1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x481707
mov dword [ebp - 0xbac], 0xfffb
mov dword [ebp - 0x54c], 0xfffa
mov dword [ebp - 0x86c], 1
cmp dword [ebp - 0xbac], 0
je 0x481586
cmp dword [ebp - 0x54c], 0
je 0x481586
mov dword [ebp - 0x54c], 0
jmp 0x48152f
mov dword [ebp - 0xdf8], 1
mov dword [ebp - 0x2db4], 1
cmp dword [ebp - 0xdf8], 0
jne 0x4816d6
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0x36bc], eax
cmp dword [ebp - 0xbac], 8
jbe 0x481628
mov dword [ebp - 0x23e0], 1
push 1
lea ecx, [ebp - 0x2934]
call fcn.00438351
mov ecx, dword [ebp - 0x23e0]
add ecx, dword [eax]
mov dword [ebp - 0x86c], ecx
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x2db4], eax
lea ecx, [ebp - 0x2934]
call fcn.00438335
lea ecx, [ebp - 0x2740]
call fcn.00438335
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0xa3c], 0
jmp 0x481740
push 3
lea ecx, [ebp - 0x2788]
call fcn.00438263
mov dword [ebp - 0x21c], 0
jmp 0x4866c6
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x4866e8
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x2788]
call fcn.00438351
mov dword [eax], 0xb110c93b
jmp 0x4866b9
mov dword [ebp - 0x21c], 0
jmp 0x486701
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x48671d
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xe8c], 0
jmp 0x4866f4
push 0
lea ecx, [ebp - 0x2788]
call fcn.00438351
and dword [eax], 0
jmp 0x486753
push 0
lea ecx, [ebp - 0x2788]
call fcn.00438351
mov dword [ebp - 0x18dc], eax
mov eax, dword [ebp - 0x18dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2788]
call fcn.00438351
cmp dword [eax], 0
jle 0x486b2b
mov dword [ebp - 0xa9c], 0
jmp 0x486782
mov eax, dword [ebp - 0xa9c]
inc eax
mov dword [ebp - 0xa9c], eax
cmp dword [ebp - 0xa9c], 2
jge 0x48679e
mov eax, dword [ebp - 0xa9c]
mov dword [ebp + eax*4 - 0xc40], 5
jmp 0x486775
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc40], 0
jmp 0x4867cc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc40], 0
jl 0x486b26
mov dword [ebp - 0x2e0], 0xadb2bc40
mov dword [ebp - 0x934], 0
jmp 0x486803
mov eax, dword [ebp - 0x934]
inc eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 1
jge 0x48681f
mov eax, dword [ebp - 0x934]
mov dword [ebp + eax*4 - 0x43c], 0xda622a14
jmp 0x4867f6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x43c], 0
jmp 0x48684d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x43c], 0
jg 0x48687d
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x48687b
mov dword [ebp - 0x2e0], 0
jmp 0x486896
jmp 0x48672f
lea ecx, [ebp - 0x2788]
call fcn.00438335
mov dword [ebp - 0x2d8c], str.pqsxsoq_oxthobcg_snv_ckjssqx_jfccvdi_eihrgqeon_wjvm
mov dword [ebp - 0x5c4], 4
mov dword [ebp - 0xdfc], 0
mov dword [ebp - 0x5c4], 0x10
jmp 0x486b6d
cmp dword [ebp - 0x5c4], 0xe
jne 0x486cb6
mov dword [ebp - 0xd24], 1
mov dword [ebp - 0x2ab0], 0x487223b1
mov dword [ebp - 0x93c], 0
jmp 0x486ba7
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 3
jge 0x486bc3
mov eax, dword [ebp - 0x93c]
mov dword [ebp + eax*4 - 0x3a04], 1
jmp 0x486b9a
cmp dword [ebp - 0xd24], 0
je 0x486bde
mov eax, 0x23fa3a92
test eax, eax
jne 0x486bde
and dword [ebp - 0x1904], 0
jmp 0x486be8
mov dword [ebp - 0x1904], 1
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x3914], eax
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0x391c], eax
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x3924], eax
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x392c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a04]
mov dword [ebp - 0x3934], eax
mov eax, dword [ebp - 0x5c4]
add eax, dword [ebp - 0x1904]
jne 0x486c3d
or eax, 0xffffffff
je 0x486c52
cmp dword [ebp - 0xdfc], 0
je 0x486c52
mov dword [ebp - 0x206c], 1
jmp 0x486c59
and dword [ebp - 0x206c], 0
mov eax, dword [ebp - 0xdfc]
cmp eax, dword [ebp - 0x206c]
je 0x486c73
mov dword [ebp - 0x190c], 1
jmp 0x486c7a
and dword [ebp - 0x190c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a04]
cmp dword [ebp - 0x190c], eax
jl 0x486c9a
mov byte [ebp - 0x47d], 0
movzx eax, byte [ebp - 0x47d]
test eax, eax
je 0x486cce
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x242c], 0x9cfe
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x2074], 0xfffffffe
mov dword [ebp - 0x2bb0], 2
mov dword [ebp - 0x6f8], 0xfffa
mov dword [ebp - 0xd2c], 0x3b6f9b69
mov dword [ebp - 0x208c], 0
mov dword [ebp - 0x195c], 0xfffffff7
mov dword [ebp - 0x2b8], 0xffffffff
push 4
lea ecx, [ebp - 0x2fa0]
call fcn.00438263
mov dword [ebp - 0xbc], 0
jmp 0x486d4b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x486d67
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x2848], 1
jmp 0x486d3e
mov dword [ebp - 0xbc], 0
jmp 0x486d80
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x486d9c
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x444], 0x63718bd8
jmp 0x486d73
mov dword [ebp - 0xbc], 0
jmp 0x486db5
cmp dword [ebp - 0xbc], 4
jge 0x486dd7