Function at 0x470d19
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push esi
mov dword [ebp - 0x54], 0x76820624
mov dword [ebp - 0x54], 0xfffffff9
jmp 0x470d3a
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe3
je 0x470d62
mov dword [ebp - 0x158], 0xfe1ca2
mov dword [ebp - 0x194], 9
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x194], eax
jmp 0x470d33
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x470d7d
push 0x218b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x470f14
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x4c], 0x4e064826
mov dword [ebp - 0x4c], 0
jmp 0x470da9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1d
jg 0x470ee3
mov dword [ebp - 0x1f0], 0x25b0e446
mov dword [ebp - 0x1ec], 0x25b0e446
mov dword [ebp - 0x1e8], 0x25b0e446
mov dword [ebp - 0x1e4], 0x25b0e446
lea ecx, [ebp - 0x6d]
call fcn.004014f9
push eax
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004014fc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x270]
call fcn.004014a8
mov dword [ebp - 0x5c], 0x6d4f2887
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x5c], 3
jmp 0x470e35
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x470ed3
mov dword [ebp - 0xb8], 0x245f
mov dword [ebp - 0x40], 0x4fc2285f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0x148]
cmp eax, 0x6b8d
jg 0x470e81
mov dword [ebp - 0x8c], 1
jmp 0x470e88
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x8c], eax
jge 0x470ea2
mov dword [ebp - 0x138], 1
jmp 0x470ea9
and dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 1
jne 0x470ebe
mov dword [ebp - 0x114], 1
jmp 0x470ec5
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x40], eax
jmp 0x470e2e
lea ecx, [ebp - 0x270]
call fcn.004014ce
jmp 0x470da2
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x470ef5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x5606
push dword [ebp - 0x18c]
push 0x1954
push 0
call fcn.00471cfe
add esp, 0x10
jmp 0x471bf6
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x16c], 0
push 3
lea ecx, [ebp - 0x208]
call fcn.004013fc
mov dword [ebp - 0xc], 0
jmp 0x470f42
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x470f58
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x144], 0xfffd
jmp 0x470f3b
mov dword [ebp - 0xc], 0
jmp 0x470f68
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x470f81
push dword [ebp - 0xc]
lea ecx, [ebp - 0x208]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x470f61
mov dword [ebp - 0x48], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp eax, dword [ebp - 0x48]
jl 0x470fa6
mov dword [ebp - 0x94], 1
jmp 0x470fad
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0xcec7
jne 0x471065
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x254], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x144], 0xfbce008f
jbe 0x470fe8
mov dword [ebp - 0xec], 1
jmp 0x470fef
and dword [ebp - 0xec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0xec], eax
jle 0x471010
mov dword [ebp - 0x15c], 1
jmp 0x471017
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x48], 0xffff
jne 0x471035
mov dword [ebp - 0x9c], 1
jmp 0x47103c
and dword [ebp - 0x9c], 0
cmp dword [ebp - 0x9c], 0xfffffff6
jae 0x471053
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x144], 0
mov eax, 0x28405cef
test eax, eax
jne 0x471065
and dword [ebp - 0x12c], 0
jmp 0x47106f
mov dword [ebp - 0x12c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x12c], eax
je 0x471090
mov dword [ebp - 0xa4], 1
jmp 0x471097
and dword [ebp - 0xa4], 0
push 1
lea ecx, [ebp - 0x208]
call fcn.004014ea
mov ecx, dword [ebp - 0xa4]
mov dword [eax], ecx
lea ecx, [ebp - 0x208]
call fcn.004014ce
mov eax, dword [ebp + 8]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x18], 0xd29be1d9
mov dword [ebp - 0x1dc], 0x1af6658d
mov dword [ebp - 0x1d8], 0x1af6658d
mov dword [ebp - 0x1d4], 0x1af6658d
mov dword [ebp - 0x1d0], 0x1af6658d
lea ecx, [ebp - 0x61]
call fcn.004014f9
push eax
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1dc]
push eax
lea ecx, [ebp - 0x280]
call fcn.004014fc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x230]
call fcn.004014a8
mov dword [ebp - 0x168], 5
mov dword [ebp - 0x10], 0
jmp 0x47113b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x47114e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80], 0x648261f9
jmp 0x471134
mov dword [ebp - 0x10], 0
jmp 0x47115e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x471174
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1fc], 9
jmp 0x471157
mov dword [ebp - 0x18], 0
jmp 0x471184
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x47127e
mov dword [ebp - 0x24], 0xf2887cf2
mov dword [ebp - 0x178], 0x7d8cf4c5
mov dword [ebp - 0x24], 0
jmp 0x4711af
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x471279
push 1
lea ecx, [ebp - 0x1ac]
call fcn.004013fc
mov dword [ebp - 0x3c], 0
jmp 0x4711d6
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x4711f2
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1ac]
call fcn.004014ea
mov dword [eax], 0x46c2e7cc
jmp 0x4711cf
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x24], eax
jge 0x471209
mov dword [ebp - 0xf4], 1
jmp 0x471210
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x80]
cmp eax, dword [ebp - 0xf4]
je 0x47122e
cmp dword [ebp - 0x24], 0
jne 0x47122e
and dword [ebp - 0xac], 0
jmp 0x471238
mov dword [ebp - 0xac], 1
push 0
lea ecx, [ebp - 0x1ac]
call fcn.004014ea
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x80], 0
je 0x471269
lea ecx, [ebp - 0x1ac]
call fcn.004014ce
jmp 0x4711a8
lea ecx, [ebp - 0x1ac]
call fcn.004014ce
jmp 0x4711a8
jmp 0x47117d
cmp dword [ebp - 0x18], 0
jne 0x471294
mov eax, dword [ebp - 0x18]
neg eax
jne 0x471294
and dword [ebp - 0x11c], 0
jmp 0x47129e
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x11c]
jg 0x4712b5
mov dword [ebp - 0x160], 1
jmp 0x4712bc
and dword [ebp - 0x160], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x80]
mov dword [ebp - 0xb4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb4]
mov dword [ebp + eax - 0x1fc], ecx
cmp dword [ebp - 0xb4], 0
jne 0x4712fa
mov eax, 0xad0d
test eax, eax
jne 0x4712fa
and dword [ebp - 0xfc], 0
jmp 0x471304
mov dword [ebp - 0xfc], 1
mov eax, dword [ebp - 0xfc]
add eax, 0xcc72
jne 0x47131d
mov dword [ebp - 0x188], 1
jmp 0x471324
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x210], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1fc]
cmp dword [ebp + eax - 0x80], ecx
jle 0x471361
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x471361
mov dword [ebp - 0xbc], 1
jmp 0x471368
and dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0x4e20
jl 0x471380
mov dword [ebp - 0x13c], 1
jmp 0x471387
and dword [ebp - 0x13c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
cmp dword [ebp - 0x13c], eax
jne 0x4713a5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x80], 0
je 0x4713b5
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x4713b5
and dword [ebp - 0xc4], 0
jmp 0x4713bf
mov dword [ebp - 0xc4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x80]
cmp dword [ebp - 0xc4], eax
jg 0x4713dd
mov dword [ebp - 0x104], 1
jmp 0x4713e4
and dword [ebp - 0x104], 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004014ea
mov ecx, dword [ebp - 0x104]
cmp ecx, dword [eax]
jge 0x471407
mov dword [ebp - 0xcc], 1
jmp 0x47140e
and dword [ebp - 0xcc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
cmp dword [ebp - 0xcc], eax
jle 0x47142c
mov dword [ebp - 0x124], 1
jmp 0x471433
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0xffffffff
jg 0x471448
mov dword [ebp - 0xd4], 1
jmp 0x47144f
and dword [ebp - 0xd4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd4]
sub ecx, dword [ebp + eax - 0x80]
mov dword [ebp - 0x168], ecx
lea ecx, [ebp - 0x230]
call fcn.004014ce
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x58], 0xb32a
mov dword [ebp - 0x6c], 0xfffffff6
mov dword [ebp - 0x60], 0x779c
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 0x2c], 0x7f39
mov dword [ebp - 0x1c], 0x36ae3d47
mov dword [ebp - 0x50], 0
jmp 0x4714b2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x4714c8
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x180], 0x1b5f7a0d
jmp 0x4714ab
cmp dword [ebp - 8], 0
jne 0x4714ec
cmp dword [ebp - 8], 0
ja 0x4714dd
mov eax, 0xbd4856cd
test eax, eax
jne 0x4714ec
cmp dword [ebp - 0x58], 0
jne 0x4714ec
and dword [ebp - 0x10c], 0
jmp 0x4714f6
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x10c], eax
je 0x47150d
mov dword [ebp - 0xdc], 1
jmp 0x471514
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jl 0x471531
mov dword [ebp - 0x134], 1
jmp 0x471538
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x134], eax
je 0x47154f
mov dword [ebp - 0xe4], 1
jmp 0x471556
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
sub eax, 0xa
cmp eax, dword [ebp - 0x58]
jle 0x471570
mov dword [ebp - 0x88], 1
jmp 0x471577
and dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 0x4fd5
jne 0x47158f
mov dword [ebp - 0x90], 1
jmp 0x471596
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x90]
cmp eax, ecx
jne 0x4715bc
mov dword [ebp - 0x98], 1
jmp 0x4715c3
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x98]
cmp eax, 0x1f0ef2f3
jg 0x4715e0
mov dword [ebp - 0xa0], 1
jmp 0x4715e7
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x20c], eax
mov eax, 0x9e14
cmp eax, 1
jne 0x471618
mov dword [ebp - 0xa8], 1
jmp 0x47161f
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xa8], eax
jg 0x471636
mov dword [ebp - 0xb0], 1
jmp 0x47163d
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 8
je 0x471672
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x60]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x180], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], eax
jmp 0x4716f9
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x47169a
push 0x1e6
push 0x6d8
push 0x90c
push 0x2576
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 8], 0
jmp 0x4716aa
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3b
jge 0x4716f9
mov dword [ebp - 0x2c], 0
jmp 0x4716c0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0x4716f7
mov dword [ebp - 0x84], 0xb3395cc9
mov dword [ebp - 0x1c], 0
jmp 0x4716e0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x4716f5
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
jmp 0x4716d9
jmp 0x4716b9
jmp 0x4716a3
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x47170b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x38], 0x7ab3921d
mov dword [ebp - 0x34], 0x44455595
push 1
lea ecx, [ebp - 0x1a0]
call fcn.004013fc
mov dword [ebp - 0x154], 0xfffffff8
mov dword [ebp - 0x224], 0xa05132d7
mov dword [ebp - 4], 0
jmp 0x47175d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x471773
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1b4], 0xa631
jmp 0x471756
mov dword [ebp - 4], 0
jmp 0x471783
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x471799
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x240], 6
jmp 0x47177c
mov dword [ebp - 4], 0
jmp 0x4717a9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4717c5
push dword [ebp - 4]
lea ecx, [ebp - 0x1a0]
call fcn.004014ea
mov dword [eax], 7
jmp 0x4717a2
mov dword [ebp - 4], 0
jmp 0x4717d5
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4717eb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], 0xffffffff
jmp 0x4717ce
mov dword [ebp - 0x30], 0
jmp 0x4717fb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x471866
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x240], 0xfffffffe
mov dword [ebp - 0x38], 0xfffffffe
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0
jmp 0x47182e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x471864
mov dword [ebp - 0x190], 0x9e2a8d3a
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x471857
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [ebp - 0x190], 0
je 0x471862
jmp 0x471827
jmp 0x471827
jmp 0x4717f4
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1b4]
cmp dword [ebp + eax - 0x1b4], ecx
jle 0x47188e
mov dword [ebp - 0xd0], 1
jmp 0x471895
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x264], eax
mov eax, 0x31ea062
test eax, eax
je 0x4718c5
push 0
lea ecx, [ebp - 0x1a0]
call fcn.004014ea
cmp dword [eax], 0
je 0x4718c5
mov dword [ebp - 0xc0], 1
jmp 0x4718cc
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0xfffffffd
jne 0x4718e1
mov dword [ebp - 0xc8], 1
jmp 0x4718e8
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0xc8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xd0], eax
jge 0x47190b
mov dword [ebp - 0xd8], 1
jmp 0x471912
and dword [ebp - 0xd8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x240]
cmp dword [ebp - 0xd8], eax
jne 0x471933
mov dword [ebp - 0xe8], 1
jmp 0x47193a
and dword [ebp - 0xe8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
dec eax
mov dword [ebp - 0xf0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf0]
mov dword [ebp + eax - 0xe0], ecx
mov eax, dword [ebp - 0xe8]
add eax, 7
sub eax, dword [ebp - 0x154]
cmp dword [ebp - 0xf0], eax
jg 0x471984
mov dword [ebp - 0x150], 1
jmp 0x47198b
and dword [ebp - 0x150], 0
mov esi, dword [ebp - 0x38]
push 0
lea ecx, [ebp - 0x1a0]
call fcn.004014ea
imul esi, dword [eax]
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x1a0]
call fcn.004014ce
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x44], 0x9d2e
mov dword [ebp - 0x110], 5
mov dword [ebp - 0x120], 0x616d21b1
mov dword [ebp - 0x1c8], 0x7e595016
mov dword [ebp - 0x1c4], 0x7e595016
mov dword [ebp - 0x1c0], 0x7e595016
mov dword [ebp - 0x1bc], 0x7e595016
lea ecx, [ebp - 0x6e]
call fcn.004014f9
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x288]
call fcn.004014fc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x250]
call fcn.004014a8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x471a5e
mov eax, 0xa07c694a
test eax, eax
jne 0x471a5e
and dword [ebp - 0xf8], 0
jmp 0x471a68
mov dword [ebp - 0xf8], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xf8], eax
jle 0x471a7f
mov dword [ebp - 0x14c], 1
jmp 0x471a86
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x14], eax
jg 0x471aa3
mov eax, 0xb1d6
test eax, eax
je 0x471aa3
mov dword [ebp - 0x100], 1
jmp 0x471aaa
and dword [ebp - 0x100], 0
imul eax, dword [ebp - 0x100], 0x7fc0
test eax, eax
je 0x471aca
cmp dword [ebp - 0x14], 0
je 0x471aca
mov dword [ebp - 0x108], 1
jmp 0x471ad1
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x108], eax
jge 0x471ae8
mov dword [ebp - 0x174], 1
jmp 0x471aef
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x110], eax
jge 0x471b2a
mov dword [ebp - 0x118], 1
jmp 0x471b31
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x128], eax
push 1
lea ecx, [ebp - 0x250]
call fcn.004014ea
mov ecx, dword [ebp - 0x128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x74]
je 0x471bb0
mov dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x471bae
push 0
push 0
push 0x174b
push 0
push 0x169c
push 0
push 0xf1a
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x471bc9
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x471bc9
push 0x1e7
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x250]
call fcn.004014ce
call fcn.004774f7
mov esi, eax
mov ecx, dword [ebp - 0x17c]
call fcn.004218f3
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x184]
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret