Function at 0x4725dc
Capabilities:
Create pipe
Delete registry value
Enumerate gui resources
Get graphical window text
Get memory capacity
Get session user name
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1520
call fcn.0049cd60
push esi
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x1430], 3
mov dword [ebp - 0x25c], 0
jmp 0x472617
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x472633
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x12dc], 0xb9102071
jmp 0x47260a
mov dword [ebp - 0x1a8], 0
jmp 0x47264c
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jg 0x472669
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp + eax*4 - 0x12dc], 0
je 0x472667
jmp 0x472669
jmp 0x47263f
mov dword [ebp - 0x344], 0x9b3198a8
mov dword [ebp - 0x344], 0xffffffeb
jmp 0x47268c
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0xfffffff5
je 0x4728ad
push 3
lea ecx, [ebp - 0x10d4]
call fcn.0043387f
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x268], 0
jmp 0x4726c9
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x4726eb
push dword [ebp - 0x268]
lea ecx, [ebp - 0x10d4]
call fcn.0043396d
mov dword [eax], 0x6e60b0c
jmp 0x4726bc
mov dword [ebp - 0x1ac], 0
jmp 0x472704
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jg 0x47289d
push 2
lea ecx, [ebp - 0xca8]
call fcn.0043387f
mov dword [ebp - 0x30c], 0
jmp 0x472737
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x472759
push dword [ebp - 0x30c]
lea ecx, [ebp - 0xca8]
call fcn.0043396d
mov dword [eax], 0x693e9323
jmp 0x47272a
push 0
lea ecx, [ebp - 0xca8]
call fcn.0043396d
mov dword [eax], 2
jmp 0x472792
push 0
lea ecx, [ebp - 0xca8]
call fcn.0043396d
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x8fc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8fc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xca8]
call fcn.0043396d
cmp dword [eax], 0
jl 0x47286e
mov dword [ebp - 0xd18], 0xab4456e3
mov dword [ebp - 0x270], 0
jmp 0x4727cb
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x4727e7
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xcd4], 0xf054a20a
jmp 0x4727be
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x472808
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcd4], 0
jmp 0x472836
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcd4], 2
jg 0x472869
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x10d4]
call fcn.0043396d
mov dword [eax], 0x37bb0086
mov dword [ebp - 0xd18], 0xffffffff
jmp 0x47281b
jmp 0x47276e
push 1
lea ecx, [ebp - 0xca8]
call fcn.0043396d
cmp dword [eax], 0
je 0x47288d
lea ecx, [ebp - 0xca8]
call fcn.00433951
jmp 0x47289d
lea ecx, [ebp - 0xca8]
call fcn.00433951
jmp 0x4726f7
lea ecx, [ebp - 0x10d4]
call fcn.00433951
jmp 0x47267f
push 4
lea ecx, [ebp - 0xed0]
call fcn.0043387f
mov dword [ebp - 0x108], 9
push 3
lea ecx, [ebp - 0x1104]
call fcn.0043387f
mov dword [ebp - 0xd68], 0xbeb96916
mov dword [ebp - 0x94], 0
jmp 0x4728f4
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x472916
push dword [ebp - 0x94]
lea ecx, [ebp - 0xed0]
call fcn.0043396d
mov dword [eax], 1
jmp 0x4728e7
mov dword [ebp - 0x94], 0
jmp 0x47292f
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x472951
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1104]
call fcn.0043396d
mov dword [eax], 0x5e1f6f08
jmp 0x472922
mov dword [ebp - 0x108], 3
jmp 0x47296a
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x4729a7
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x47298d
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x108]
lea ecx, [ebp - 0xed0]
call fcn.0043396d
cmp dword [eax], 0
je 0x4729a5
jmp 0x4729a7
jmp 0x47295d
mov dword [ebp - 0x108], 0xb60e704f
push 1
lea ecx, [ebp - 0x1104]
call fcn.0043396d
and dword [eax], 0
cmp dword [ebp - 0x108], 0
jg 0x4729d6
mov dword [ebp - 0xd60], 1
jmp 0x4729dd
and dword [ebp - 0xd60], 0
push 2
lea ecx, [ebp - 0xed0]
call fcn.0043396d
push 2
lea ecx, [ebp - 0xed0]
call fcn.0043396d
cmp dword [eax], 2
jle 0x472a08
mov dword [ebp - 0xbfc], 1
jmp 0x472a0f
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xd68], eax
lea ecx, [ebp - 0x1104]
call fcn.00433951
lea ecx, [ebp - 0xed0]
call fcn.00433951
mov dword [ebp - 0x21c], 0xffffffff
push 1
lea ecx, [ebp - 0x4c0]
call fcn.0043387f
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x1ec], 2
mov dword [ebp - 0x310], 0
jmp 0x472a79
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jge 0x472a9b
push dword [ebp - 0x310]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov dword [eax], 0x75dc
jmp 0x472a6c
mov dword [ebp - 0x30], 0
jmp 0x472aab
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x472dfd
mov dword [ebp - 0xd70], 0xfc75dfcc
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x472aef
mov dword [ebp - 0xc04], 1
jmp 0x472af6
and dword [ebp - 0xc04], 0
mov dword [ebp - 0x1ec], 0x67a4
push 0
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x12a8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1374], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x1ec], 0xfffffff1
jmp 0x472b71
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 4
je 0x472df8
mov dword [ebp - 0x448], 0xe40
push 2
lea ecx, [ebp - 0xee0]
call fcn.0043387f
mov dword [ebp - 0xd80], 0x187d7a76
mov dword [ebp - 0x278], 0
jmp 0x472bb8
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x472bda
push dword [ebp - 0x278]
lea ecx, [ebp - 0xee0]
call fcn.0043396d
mov dword [eax], 0x5aa9c4ad
jmp 0x472bab
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x472c05
push 0
push 0x12b
push 0
push 0x250e
push 0x138
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x74], 0x16
jmp 0x472c15
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jne 0x472de8
mov dword [ebp - 0x48c], 5
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c0]
call fcn.0043396d
mov eax, dword [eax]
sub eax, dword [ebp - 0x48c]
imul eax, eax, 0xfff9
test eax, eax
jne 0x472c5b
mov eax, 0x21ee
test eax, eax
jne 0x472c5b
and dword [ebp - 0xc0c], 0
jmp 0x472c65
mov dword [ebp - 0xc0c], 1
mov eax, dword [ebp - 0x448]
add eax, dword [ebp - 0xc0c]
add eax, dword [ebp - 0xd70]
imul esi, eax, 0x9170
push 1
lea ecx, [ebp - 0xee0]
call fcn.0043396d
cmp esi, dword [eax]
jne 0x472c9a
mov dword [ebp - 0xc14], 1
jmp 0x472ca1
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x48c]
add eax, dword [ebp - 0xc14]
cmp dword [ebp - 0x30], eax
jg 0x472cbe
mov dword [ebp - 0xd78], 1
jmp 0x472cc5
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x12b0], eax
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x448], eax
jne 0x472ceb
mov dword [ebp - 0xc28], 1
jmp 0x472cf2
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0xc28]
test eax, eax
jne 0x472d06
cmp dword [ebp - 0x74], 0
je 0x472d1b
mov eax, 0x34c9
test eax, eax
je 0x472d1b
mov dword [ebp - 0xc30], 1
jmp 0x472d22
and dword [ebp - 0xc30], 0
cmp dword [ebp - 0xc30], 0x7672
jg 0x472d3a
mov dword [ebp - 0xc38], 1
jmp 0x472d41
and dword [ebp - 0xc38], 0
mov esi, dword [ebp - 0xc38]
sub esi, 0x201e9fd6
push 1
lea ecx, [ebp - 0xee0]
call fcn.0043396d
cmp esi, dword [eax]
jle 0x472d6a
mov dword [ebp - 0xc40], 1
jmp 0x472d71
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0xc40]
jg 0x472d88
mov dword [ebp - 0xc48], 1
jmp 0x472d8f
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xc48], eax
je 0x472da6
mov dword [ebp - 0xc50], 1
jmp 0x472dad
and dword [ebp - 0xc50], 0
push 1
lea ecx, [ebp - 0xee0]
call fcn.0043396d
mov ecx, dword [ebp - 0xc50]
cmp ecx, dword [eax]
jg 0x472dd0
mov dword [ebp - 0xc58], 1
jmp 0x472dd7
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0xd80], eax
jmp 0x472c0e
lea ecx, [ebp - 0xee0]
call fcn.00433951
jmp 0x472b64
jmp 0x472aa4
lea ecx, [ebp - 0x4c0]
call fcn.00433951
mov dword [ebp - 0x1460], 3
mov dword [ebp - 0x1b4], 0xfffffffd
mov dword [ebp - 0x380], 0
jmp 0x472e35
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 3
jge 0x472e51
mov eax, dword [ebp - 0x380]
mov dword [ebp + eax*4 - 0xce0], 0xe3245f1d
jmp 0x472e28
mov dword [ebp - 0x1b4], 0
jmp 0x472e6a
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x17
jg 0x47305b
mov dword [ebp - 0xd88], 0x4495
mov dword [ebp - 0xe24], 7
mov dword [ebp - 0x280], 0
jmp 0x472ea4
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x472ec0
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x224], 0xd37ad43
jmp 0x472e97
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x224], 2
jmp 0x472eee
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x224], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x224], 0
jl 0x473044
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x224], 0
je 0x472f52
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov ecx, dword [ebp - 0xd88]
cmp dword [ebp + eax*4 - 0xce0], ecx
jl 0x472f3a
mov dword [ebp - 0xd90], 1
jmp 0x472f41
and dword [ebp - 0xd90], 0
or eax, 0xffffffff
je 0x472f52
mov dword [ebp - 0xa40], 1
jmp 0x472f59
and dword [ebp - 0xa40], 0
cmp dword [ebp - 0xa40], 0x6c37fc05
jge 0x472f71
mov dword [ebp - 0x4d0], 1
jmp 0x472f78
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
cmp eax, dword [ebp - 0x4d0]
jne 0x472f99
mov dword [ebp - 0xa48], 1
jmp 0x472fa0
and dword [ebp - 0xa48], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xce0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x224]
mov edx, dword [ebp - 0xa48]
sub edx, dword [ebp + ecx*4 - 0xce0]
push 4
pop ecx
imul ecx, ecx, 0
sub edx, dword [ebp + ecx - 0x224]
sub eax, edx
jne 0x472fe3
mov dword [ebp - 0x4d8], 1
jmp 0x472fea
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov eax, dword [ebp + eax*4 - 0xce0]
cmp eax, dword [ebp - 0x4d8]
je 0x473012
mov dword [ebp - 0x4ac], 1
jmp 0x473019
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp + eax*4 - 0xce0], ecx
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0xe24], eax
jmp 0x472ed3
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp + eax - 0xce0], ecx
jmp 0x472e5d
mov dword [ebp - 0x288], 0xce53
mov dword [ebp - 0x318], 0xc6fe
mov dword [ebp - 0x4e0], 0xc3203bd6
mov dword [ebp - 0xe2c], 0xfffffffb
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x4730ab
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, 0xaaed6b65
test eax, eax
je 0x4730bd
cmp dword [ebp - 0x318], 0
jne 0x4730cf
cmp dword [ebp - 0x288], 0
jne 0x4730cf
and dword [ebp - 0xa50], 0
jmp 0x4730d9
mov dword [ebp - 0xa50], 1
mov eax, dword [ebp - 0xa50]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
cmp dword [ebp - 0x288], eax
jl 0x4730ff
mov dword [ebp - 0xa58], 1
jmp 0x473106
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0xa58], eax
jl 0x473120
mov dword [ebp - 0x4e8], 1
jmp 0x473127
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x4e8], eax
jne 0x473141
mov dword [ebp - 0xa60], 1
jmp 0x473148
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0xa60], eax
jle 0x47316b
cmp dword [ebp - 0x318], 0
je 0x47316b
mov dword [ebp - 0x4f0], 1
jmp 0x473172
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0xc668cc88
jl 0x47318a
mov dword [ebp - 0xa68], 1
jmp 0x473191
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0xa68]
jg 0x4731ab
mov dword [ebp - 0x4f8], 1
jmp 0x4731b2
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xe2c], eax
mov dword [ebp - 0x360], 0
jmp 0x4731d7
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 2
jge 0x4731f3
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x117c], 0xb9102071
jmp 0x4731ca
mov dword [ebp - 0x21c], 0
jmp 0x47320c
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jg 0x47407e
mov dword [ebp - 0x110], 0x5720e83c
mov dword [ebp - 0x20c], 0xde9829cb
mov dword [ebp - 0x320], 0xfffffff6
push 3
lea ecx, [ebp - 0xc90]
call fcn.0043387f
mov dword [ebp - 0xe44], 1
mov dword [ebp - 0xe64], 1
mov dword [ebp - 0x84], 0
jmp 0x473271
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x47328d
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xef0], 0x31e4
jmp 0x473264
mov dword [ebp - 0x84], 0
jmp 0x4732a6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x4732c8
push dword [ebp - 0x84]
lea ecx, [ebp - 0xc90]
call fcn.0043396d
mov dword [eax], 1
jmp 0x473299
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x110], 0
jmp 0x4732ed
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jg 0x473919
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x540], 1
mov dword [ebp - 0x290], 1
push 1
lea ecx, [ebp - 0xcf8]
call fcn.0043387f
mov dword [ebp - 0x560], 1
mov dword [ebp - 0xc4], 0
jmp 0x473345
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x473361
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x118], 0xffffffff
jmp 0x473338
mov dword [ebp - 0xc4], 0
jmp 0x47337a
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x47339c
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xcf8]
call fcn.0043396d
mov dword [eax], 0xbc9fc22f
jmp 0x47336d
cmp dword [ebp - 0x48], 0xda2a
jge 0x4733b1
mov dword [ebp - 0xa70], 1
jmp 0x4733b8
and dword [ebp - 0xa70], 0
cmp dword [ebp - 0xa70], 0xffffffff
je 0x4733cd
mov dword [ebp - 0x500], 1
jmp 0x4733d4
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0x48]
je 0x4733fd
cmp dword [ebp - 0x48], 0
je 0x4733fd
mov dword [ebp - 0xa78], 1
jmp 0x473404
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa78], eax
jle 0x47341b
mov dword [ebp - 0xa80], 1
jmp 0x473422
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x508], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x508]
mov dword [ebp + eax - 0x118], ecx
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0xa80]
jle 0x473465
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x473465
and dword [ebp - 0xe34], 0
jmp 0x47346f
mov dword [ebp - 0xe34], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xef0]
mov dword [ebp - 0x12b8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xef0], 0x8ad64de8
jae 0x4734a1
mov dword [ebp - 0xe3c], 1
jmp 0x4734a8
and dword [ebp - 0xe3c], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x1384], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x12c0], eax
push 0
lea ecx, [ebp - 0xc90]
call fcn.0043396d
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xe44], eax
jge 0x4734eb
mov dword [ebp - 0x510], 1
jmp 0x4734f2
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x510]
je 0x473509
mov dword [ebp - 0xe4c], 1
jmp 0x473510
and dword [ebp - 0xe4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x1428], eax
mov eax, dword [ebp - 0x320]
sub eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jl 0x47353d
mov dword [ebp - 0xa88], 1
jmp 0x473544
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0xa88], eax
jl 0x47355e
mov dword [ebp - 0x518], 1
jmp 0x473565
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x290], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef0]
cmp eax, dword [ebp - 0x290]
jle 0x473593
mov dword [ebp - 0xa90], 1
jmp 0x47359a
and dword [ebp - 0xa90], 0
cmp dword [ebp - 0xa90], 8
jg 0x4735c9
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x4735c4
push 0
push 0xcf8
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
jmp 0x47378b
mov dword [ebp - 0xe5c], 0x72c95c8f
cmp dword [ebp - 0x110], 7
jbe 0x4735e8
mov dword [ebp - 0xe54], 1
jmp 0x4735ef
and dword [ebp - 0xe54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x12c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xef0]
mov dword [ebp - 0x1394], eax
xor eax, eax
inc eax
jne 0x473627
xor eax, eax
jne 0x473627
and dword [ebp - 0x520], 0
jmp 0x473631
mov dword [ebp - 0x520], 1
cmp dword [ebp - 0x520], 0x335a02a9
jle 0x473649
mov dword [ebp - 0xa98], 1
jmp 0x473650
and dword [ebp - 0xa98], 0
push 0
lea ecx, [ebp - 0xcf8]
call fcn.0043396d
mov ecx, dword [ebp - 0xa98]
mov dword [eax], ecx
cmp dword [ebp - 0xe5c], 0xd142
jg 0x47367d
mov dword [ebp - 0xaa8], 1
jmp 0x473684
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x290], eax
push 2
lea ecx, [ebp - 0xc90]
call fcn.0043396d
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [eax]
mov dword [ebp + ecx - 0x118], eax
xor eax, eax
add eax, 0xffffe0f1
cmp dword [ebp - 0x560], eax
jge 0x4736c4
mov dword [ebp - 0x528], 1
jmp 0x4736cb
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 1
jne 0x4736e0
mov dword [ebp - 0xaa0], 1
jmp 0x4736e7
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa0], 0xd1dc2cbf
je 0x4736ff
mov dword [ebp - 0x530], 1
jmp 0x473706
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 1
je 0x47371b
mov dword [ebp - 0x538], 1
jmp 0x473722
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0xaa8]
cmp eax, dword [ebp - 0x538]
jg 0x47373c
mov dword [ebp - 0xab0], 1
jmp 0x473743
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0x290], eax
jl 0x473769
mov dword [ebp - 0xab8], 1
jmp 0x473770
and dword [ebp - 0xab8], 0
push 0
lea ecx, [ebp - 0xcf8]
call fcn.0043396d
mov ecx, dword [ebp - 0xab8]
add ecx, dword [eax]
mov dword [ebp - 0xe64], ecx
mov eax, 0xfffdb83c
test eax, eax
je 0x4738d4
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0xe6c], 0xfffffffb
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x12d0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xef0]
mov dword [ebp - 0x1450], eax
push 0
lea ecx, [ebp - 0xcf8]
call fcn.0043396d
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x11bc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x118], 0x8626
mov esi, 0x8626
neg esi
push 2
lea ecx, [ebp - 0xc90]
call fcn.0043396d
add esi, dword [eax]
cmp esi, dword [ebp - 0xe6c]
jg 0x47381b
mov dword [ebp - 0x548], 1
jmp 0x473822
and dword [ebp - 0x548], 0
push 0
lea ecx, [ebp - 0xc90]
call fcn.0043396d
mov ecx, dword [ebp - 0x548]
cmp ecx, dword [eax]
jg 0x473845
mov dword [ebp - 0xac0], 1
jmp 0x47384c
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x5d954113
jle 0x47387c
mov dword [ebp - 0x550], 1
jmp 0x473883
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0x890b
jne 0x47389b
mov dword [ebp - 0xac8], 1
jmp 0x4738a2
and dword [ebp - 0xac8], 0
imul eax, dword [ebp - 0xac8], 0xffff
cmp eax, 0x49d5
je 0x4738bf
mov dword [ebp - 0x558], 1
jmp 0x4738c6
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xad0], eax
jmp 0x473909
mov dword [ebp - 0xe74], 0x2e326e24
cmp dword [ebp - 0x560], 0
je 0x4738f4
lea ecx, [ebp - 0xcf8]
call fcn.00433951
jmp 0x473919
push 0
lea ecx, [ebp - 0xc90]
call fcn.0043396d
mov eax, dword [eax]
mov dword [ebp - 0xe74], eax
lea ecx, [ebp - 0xcf8]
call fcn.00433951
jmp 0x4732e0
lea ecx, [ebp - 0xc90]
call fcn.00433951
mov dword [ebp - 0x1bc], 0xdb34
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x15c], 0x2f3ccd24
mov dword [ebp - 0x58], 0
mov dword [ebp - 0xe98], 6
mov dword [ebp - 0x480], 0xddbc75b1
mov dword [ebp - 0xb74], 0x9d90dc6c
mov dword [ebp - 0xeb8], 1
cmp dword [ebp - 0x1bc], 0
je 0x4739ae
cmp dword [ebp - 0x6c], 0xfffffffc
jne 0x473990
mov dword [ebp - 0xad8], 1
jmp 0x473997
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0xad8]
je 0x4739ae
mov dword [ebp - 0x568], 1
jmp 0x4739b5
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x568], eax
jge 0x4739cc
mov dword [ebp - 0xae0], 1
jmp 0x4739d3
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x1bc], 0
je 0x473a03
cmp dword [ebp - 0x15c], 0
je 0x473a03
mov dword [ebp - 0x570], 1
jmp 0x473a0a
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0xffff
jne 0x473a22
mov dword [ebp - 0xae8], 1
jmp 0x473a29
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
neg eax
jne 0x473a42
cmp dword [ebp - 0x28], 0
jne 0x473a42
and dword [ebp - 0xe7c], 0
jmp 0x473a4c
mov dword [ebp - 0xe7c], 1
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x11c4], eax
xor eax, eax
inc eax
je 0x473a72
mov eax, 0x14c5530c
test eax, eax
je 0x473a72
mov dword [ebp - 0x578], 1
jmp 0x473a79
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x578]
jne 0x473a93
mov dword [ebp - 0xe90], 1
jmp 0x473a9a
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x11cc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x6c], 5
jmp 0x473abc
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x1d
jg 0x474067
mov dword [ebp - 0x1f4], 0x3631af66
mov dword [ebp - 0xea0], 0
mov dword [ebp - 0xb4c], 0xfffc
mov dword [ebp - 0x5c0], 0xdd75
mov dword [ebp - 0x298], 0
jmp 0x473b07
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x473b23
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xdc], 0x54d8142c
jmp 0x473afa
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xdc], 0
mov dword [ebp - 0x58], 0
jmp 0x473b44
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x474062
mov dword [ebp - 0x1c4], 0xfffffffc
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0xdc], 0
je 0x473c01
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0xdc], 0xe4f
jg 0x473b85
mov dword [ebp - 0xaf0], 1
jmp 0x473b8c
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x1f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
cmp eax, dword [ebp - 0x1f4]
jl 0x473bb9
mov dword [ebp - 0x580], 1
jmp 0x473bc0
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0xaf0]
cmp eax, dword [ebp - 0x580]
jne 0x473bda
mov dword [ebp - 0xaf8], 1
jmp 0x473be1
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x6c], 0
jne 0x473bf5
or eax, 0xffffffff
je 0x473c01
mov dword [ebp - 0x588], 1
jmp 0x473c08
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x11d4], eax
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x11dc], eax
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x480]
cmp eax, 0xffff
je 0x473c4f
mov dword [ebp - 0xb3c], 1
jmp 0x473c56
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xb4c]
cmp dword [ebp - 0xb3c], eax
jge 0x473c70
mov dword [ebp - 0xea8], 1
jmp 0x473c77
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x6c], eax
jl 0x473c8e
mov dword [ebp - 0x590], 1
jmp 0x473c95
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xdc]
cmp dword [ebp - 0x590], eax
je 0x473cb3
mov dword [ebp - 0xb44], 1
jmp 0x473cba
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xdc]
imul eax, dword [ebp - 0xb44]
test eax, eax
je 0x473f1e
mov dword [ebp - 0xb64], 0xffffffff
mov dword [ebp - 0x3a0], 0
jmp 0x473cf6
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jge 0x473d12
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x5b0], 0xd5b1
jmp 0x473ce9
mov dword [ebp - 0x28], 0
jmp 0x473d22
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x473f09
push 4
lea ecx, [ebp - 0xf8c]
call fcn.0043387f
mov dword [ebp - 0x4b4], 0x11ee15d1
mov dword [ebp - 0x2a0], 0
jmp 0x473d5c
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x473d7e
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xf8c]
call fcn.0043396d
mov dword [eax], 0xfffffff9
jmp 0x473d4f
push 3
lea ecx, [ebp - 0xf8c]
call fcn.0043396d
cmp dword [ebp - 0x1f4], 0
je 0x473dbf
push 0
lea ecx, [ebp - 0xf8c]
call fcn.0043396d
cmp dword [eax], 0x3b28
jl 0x473db5
mov dword [ebp - 0x598], 1
jmp 0x473dbc
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xb4c], 0xb385fae1
jae 0x473dd7
mov dword [ebp - 0x5a0], 1
jmp 0x473dde
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xdc]
cmp eax, dword [ebp - 0x5a0]
jl 0x473dfc
mov dword [ebp - 0xb54], 1
jmp 0x473e03
and dword [ebp - 0xb54], 0
cmp dword [ebp - 0xb54], 3
ja 0x473e18
mov dword [ebp - 0xeb0], 1
jmp 0x473e1f
and dword [ebp - 0xeb0], 0
mov dword [ebp - 0x4b4], 1
cmp dword [ebp - 0x4b4], 0
je 0x473e47
cmp dword [ebp - 0x4b4], 0
je 0x473e47
mov dword [ebp - 0x5a8], 1
jmp 0x473e4e
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0xb74]
add eax, dword [ebp - 0x5a8]
cmp eax, 0xe412
jg 0x473e6d
mov dword [ebp - 0xb5c], 1
jmp 0x473e74
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x473ea0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5b0], 0
je 0x473ea0
cmp dword [ebp - 0x5c0], 0
cmp dword [ebp - 0xb64], 0xffffffff
je 0x473ec2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5b0], 0
jne 0x473ec2
and dword [ebp - 0x5b8], 0
jmp 0x473ecc
mov dword [ebp - 0x5b8], 1
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x5b8], eax
je 0x473ee6
mov dword [ebp - 0xb6c], 1
jmp 0x473eed
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x15c], eax
lea ecx, [ebp - 0xf8c]
call fcn.00433951
jmp 0x473d1b
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x480]
mov dword [ebp + eax*4 - 0xdc], ecx
jmp 0x47405d
mov dword [ebp - 0x5d0], 0xade0f7f7
push 1
lea ecx, [ebp - 0x1164]
call fcn.0043387f
mov dword [ebp - 0x328], 0
jmp 0x473f4e
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x473f70
push dword [ebp - 0x328]
lea ecx, [ebp - 0x1164]
call fcn.0043396d
mov dword [eax], 0xcf818a8d
jmp 0x473f41
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x11e4], eax
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x15c], eax
jne 0x473fb4
cmp dword [ebp - 0xb74], 0xe87ca618
jne 0x473fb4
mov dword [ebp - 0x5c8], 1
jmp 0x473fbb
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 1
jb 0x473fd0
mov dword [ebp - 0xb7c], 1
jmp 0x473fd7
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x1c4], eax
jg 0x473ffd
mov dword [ebp - 0x5d8], 1
jmp 0x474004
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0xb84], eax
push 0
lea ecx, [ebp - 0x1164]
call fcn.0043396d
mov ecx, dword [ebp - 0xb84]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb84]
cmp eax, dword [ebp - 0x5d8]
jne 0x47403f
mov dword [ebp - 0xb8c], 1
jmp 0x474046
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xeb8], eax
lea ecx, [ebp - 0x1164]
call fcn.00433951
jmp 0x473b3d
jmp 0x473ab5
mov eax, dword [ebp - 0x21c]
cmp dword [ebp + eax*4 - 0x117c], 0
je 0x474079
jmp 0x47407e
jmp 0x4731ff
mov dword [ebp - 0x50], 0x730f94f3
mov dword [ebp - 0x11ec], 0x71865425
mov dword [ebp - 0x11f4], 0
mov dword [ebp - 0x11fc], 0xffffffff
mov dword [ebp - 0x5e8], 0x3fa3a92b
mov dword [ebp - 0x1204], 0xda2ae7b7
mov dword [ebp - 0x120c], 0xffffffff
push 2
lea ecx, [ebp - 0x10c8]
call fcn.0043387f
mov dword [ebp - 0xb9c], 0xdbd3
mov dword [ebp - 0x3f0], 0xab1a
mov dword [ebp - 0x9c], 0
jmp 0x4740fb
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x474117
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xf00], 0xec2e0cf5
jmp 0x4740ee
mov dword [ebp - 0x9c], 0
jmp 0x474130
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x474152
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x10c8]
call fcn.0043396d
mov dword [eax], 6
jmp 0x474123
mov dword [ebp - 0x50], 2
jmp 0x474162
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x47428c
push 1
lea ecx, [ebp - 0x10bc]
call fcn.0043387f
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x2a8], 0
jmp 0x47419c
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jge 0x4741be
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x10bc]
call fcn.0043396d
mov dword [eax], 0xad86e52d
jmp 0x47418f
mov eax, dword [ebp - 0x3e8]
dec eax
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0xf00], 0
jne 0x474266
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf00]
mov dword [ebp - 0x1214], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x121c], eax
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x50], eax
jne 0x474218
push 2
pop eax
test eax, eax
je 0x474218
mov dword [ebp - 0x5e0], 1
jmp 0x47421f
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
neg eax
cmp eax, 4
ja 0x474238
mov dword [ebp - 0x450], 1
jmp 0x47423f
and dword [ebp - 0x450], 0
push 0
lea ecx, [ebp - 0x10bc]
call fcn.0043396d
mov ecx, dword [ebp - 0x450]
mov dword [eax], ecx
cmp dword [ebp - 0x450], 0
jne 0x474266
and dword [ebp - 0xb94], 0
jmp 0x474270
mov dword [ebp - 0xb94], 1
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0x5e8], eax
lea ecx, [ebp - 0x10bc]
call fcn.00433951
jmp 0x47415b
mov dword [ebp - 0x50], 2
jmp 0x47429c
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x474487
mov dword [ebp - 0x1224], 0xe075257
mov dword [ebp - 0x122c], 0xcbc21b07
mov dword [ebp - 0x5f8], 5
mov dword [ebp - 0x1234], 0xfffffffa
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x123c], 0x77dfcc86
mov dword [ebp - 0x1244], 0x4067bc62
mov dword [ebp - 0x124c], 0
mov dword [ebp - 0x1254], 0x4b71808a
mov dword [ebp - 0x125c], 0
mov dword [ebp - 0x1264], 0
mov dword [ebp - 0x126c], 8
mov dword [ebp - 0x1274], 0xf9af3922
mov dword [ebp - 0x368], 0
jmp 0x474341
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 3
jge 0x47435d
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x14ec], 0xf12afbc
jmp 0x474334
mov eax, dword [ebp - 0xb9c]
inc eax
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0x164], 0
jmp 0x474383
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jg 0x474482
mov dword [ebp - 0xf5c], 0
mov dword [ebp - 0x127c], 0xf3bc9fc2
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp + eax*4 - 0xf00]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0xf00], ecx
cmp dword [ebp - 0x5f0], 0
jne 0x4743e2
cmp dword [ebp - 0x5f8], 0
jne 0x4743e2
and dword [ebp - 0xba4], 0
jmp 0x4743ec
mov dword [ebp - 0xba4], 1
cmp dword [ebp - 0xba4], 0x2629
jl 0x474414
mov eax, dword [ebp - 0x164]
cmp dword [ebp + eax*4 - 0xf00], 0
je 0x474414
mov dword [ebp - 0xec0], 1
jmp 0x47441b
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
je 0x474461
cmp dword [ebp - 0x5f8], 0xfffd
jae 0x474442
mov dword [ebp - 0xbac], 1
jmp 0x474449
and dword [ebp - 0xbac], 0
cmp dword [ebp - 0xbac], 0xe8ee
jg 0x474461
mov dword [ebp - 0xf80], 1
jmp 0x474468
and dword [ebp - 0xf80], 0
mov esi, dword [ebp - 0xf5c]
push 0
lea ecx, [ebp - 0x10c8]
call fcn.0043396d
mov dword [eax], esi
jmp 0x474376
jmp 0x474295
lea ecx, [ebp - 0x10c8]
call fcn.00433951
call section..jpYQp
mov dword [ebp - 0x120], 6
push 2
lea ecx, [ebp - 0x10e0]
call fcn.0043387f
push 4
lea ecx, [ebp - 0xc9c]
call fcn.0043387f
push 2
lea ecx, [ebp - 0xfc8]
call fcn.0043387f
mov dword [ebp - 0xd24], 0x82f4e55
mov dword [ebp - 0x20], 0
jmp 0x4744e2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x4744fe
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10e0]
call fcn.0043396d
mov dword [eax], 0xa5f27a41
jmp 0x4744db
mov dword [ebp - 0x20], 0
jmp 0x47450e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x47452a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc9c]
call fcn.0043396d
mov dword [eax], 0x3997b09b
jmp 0x474507
mov dword [ebp - 0x20], 0
jmp 0x47453a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x474556
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfc8]
call fcn.0043396d
mov dword [eax], 0xfffffff6
jmp 0x474533
mov eax, 0x5352
test eax, eax
je 0x474639
cmp dword [ebp - 0x120], 0xa7b7e80d
jae 0x47457b
mov dword [ebp - 0x600], 1
jmp 0x474582
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0xab89bdd7
jae 0x4745a3
cmp dword [ebp - 0x120], 0
je 0x4745a3
mov dword [ebp - 0xbb4], 1
jmp 0x4745aa
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x120]
sub eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x608], eax
push 1
lea ecx, [ebp - 0x10e0]
call fcn.0043396d
mov ecx, dword [ebp - 0x608]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x608], eax
je 0x4745eb
mov dword [ebp - 0xbbc], 1
jmp 0x4745f2
and dword [ebp - 0xbbc], 0
push 2
lea ecx, [ebp - 0xc9c]
call fcn.0043396d
mov ecx, dword [ebp - 0xbbc]
cmp ecx, dword [eax]
je 0x474615
mov dword [ebp - 0x610], 1
jmp 0x47461c
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x120]
imul eax, dword [ebp - 0x610]
test eax, eax
je 0x474639
mov dword [ebp - 0xbc4], 1
jmp 0x474640
and dword [ebp - 0xbc4], 0
push 0
lea ecx, [ebp - 0xfc8]
call fcn.0043396d
mov ecx, dword [ebp - 0xbc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1284], eax
push 0
lea ecx, [ebp - 0xfc8]
call fcn.0043396d
mov esi, eax
push 2
lea ecx, [ebp - 0xc9c]
call fcn.0043396d
mov esi, dword [esi]
imul esi, dword [eax]
add esi, 0x44f4cc51
push 0
lea ecx, [ebp - 0xc9c]
call fcn.0043396d
cmp esi, dword [eax]
jl 0x4746a5
mov dword [ebp - 0xd58], 1
jmp 0x4746ac
and dword [ebp - 0xd58], 0
push 2
lea ecx, [ebp - 0xc9c]
call fcn.0043396d
push 2
lea ecx, [ebp - 0xc9c]
call fcn.0043396d
cmp dword [eax], 0xecf54c3c
je 0x4746da
mov dword [ebp - 0x618], 1
jmp 0x4746e1
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x618], eax
jg 0x4746fb
mov dword [ebp - 0xbcc], 1
jmp 0x474702
and dword [ebp - 0xbcc], 0
cmp dword [ebp - 0xbcc], 0
jb 0x474717
mov dword [ebp - 0x620], 1
jmp 0x47471e
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0xd24], eax
lea ecx, [ebp - 0xfc8]
call fcn.00433951
lea ecx, [ebp - 0xc9c]
call fcn.00433951
lea ecx, [ebp - 0x10e0]
call fcn.00433951
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x18c], 0x2fbb6bc3
mov dword [ebp - 0x40], 0xffffffff
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x128c], eax
cmp dword [ebp - 0x44], 0xd83d
jle 0x474781
mov dword [ebp - 0xbd4], 1
jmp 0x474788
and dword [ebp - 0xbd4], 0
cmp dword [ebp - 0xbd4], 0x9892
jle 0x4747a0
mov dword [ebp - 0x628], 1
jmp 0x4747a7
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x18c], eax
mov eax, 0x4e703026
test eax, eax
jne 0x4747ce
cmp dword [ebp - 0x44], 0
jne 0x4747ce
mov dword [ebp - 0xbdc], 1
jmp 0x4747d5
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xbdc]
je 0x4747ec
mov dword [ebp - 0x630], 1
jmp 0x4747f3
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x44], eax
jne 0x474810
mov dword [ebp - 0xbe4], 1
jmp 0x474817
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xbe4], eax
jne 0x47482e
mov dword [ebp - 0x638], 1
jmp 0x474835
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 4
jl 0x4748ec
mov dword [ebp - 0x2b0], 0
jmp 0x47485b
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x474877
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x1370], 1
jmp 0x47484e
mov dword [ebp - 0x40], 0
jmp 0x474887
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xb
je 0x4748c3
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x4748a7
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x1370]
mov dword [ebp + ecx - 0x1370], eax
jmp 0x474880
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x4748e7
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x474c1a
push 1
lea ecx, [ebp - 0xcb4]
call fcn.0043387f
mov dword [ebp - 0x330], 0
jmp 0x474912
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x474934
push dword [ebp - 0x330]
lea ecx, [ebp - 0xcb4]
call fcn.0043396d
mov dword [eax], 3
jmp 0x474905
mov dword [ebp - 0x44], 9
jmp 0x474944
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffea
jl 0x474c0f
mov dword [ebp - 0x654], 0x700c0d35
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x474974
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18c], 0
jmp 0x47498d
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jg 0x474c0a
mov dword [ebp - 0x4a8], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x4749b4
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x474c05
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xf14], 0xffffffff
mov dword [ebp - 0x4c], 0
jmp 0x4749df
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x474bda
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xcb4]
call fcn.0043396d
cmp dword [eax], 0
jne 0x474a36
mov esi, dword [ebp - 0xf14]
push 0
lea ecx, [ebp - 0xcb4]
call fcn.0043396d
cmp esi, dword [eax]
je 0x474a1f
mov dword [ebp - 0xbec], 1
jmp 0x474a26
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
add eax, 0x42b8
cmp eax, dword [ebp - 0x4c]
jg 0x474a48
cmp dword [ebp - 0x40], 0
je 0x474a48
mov dword [ebp - 0xbf4], 1
jmp 0x474a4f
and dword [ebp - 0xbf4], 0
imul esi, dword [ebp - 0xbf4], 0xfffffff8
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xcb4]
call fcn.0043396d
cmp esi, dword [eax]
jle 0x474a74
mov dword [ebp - 0x644], 1
jmp 0x474a7b
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x644], eax
jne 0x474a92
mov dword [ebp - 0x96c], 1
jmp 0x474a99
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x96c], eax
jle 0x474ab3
mov dword [ebp - 0x64c], 1
jmp 0x474aba
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
sub eax, dword [ebp - 0x44]
jne 0x474ad7
mov eax, 0x7f7f
test eax, eax
jne 0x474ad7
and dword [ebp - 0xd2c], 0
jmp 0x474ae1
mov dword [ebp - 0xd2c], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1294], eax
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0x4c], eax
jg 0x474b01
mov dword [ebp - 0xafc], 1
jmp 0x474b08
and dword [ebp - 0xafc], 0
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xcb4]
call fcn.0043396d
mov eax, dword [eax]
cmp eax, dword [ebp - 0xafc]
jne 0x474b2f
mov dword [ebp - 0x974], 1
jmp 0x474b36
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0x974], eax
jne 0x474b50
mov dword [ebp - 0x65c], 1
jmp 0x474b57
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0x349dda4a
jne 0x474b6f
mov dword [ebp - 0xb34], 1
jmp 0x474b76
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0xb34], eax
jge 0x474b90
mov dword [ebp - 0x664], 1
jmp 0x474b97
and dword [ebp - 0x664], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xcb4]
call fcn.0043396d
mov ecx, dword [ebp - 0x664]
imul ecx, dword [eax]
cmp ecx, 0xef33
jl 0x474bc2
mov dword [ebp - 0x97c], 1
jmp 0x474bc9
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x4a8], eax
jmp 0x4749d8
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x474c00
push 0x1c2a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4749ad
jmp 0x474980
jmp 0x47493d
lea ecx, [ebp - 0xcb4]
call fcn.00433951
mov dword [ebp - 0x1068], 0xb55bb2c2
mov dword [ebp - 0x1064], 0xb55bb2c2
mov dword [ebp - 0x1060], 0xb55bb2c2
mov dword [ebp - 0x105c], 0xb55bb2c2
lea ecx, [ebp - 0x4a1]
call fcn.0043397c
push eax
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x14b8]
call fcn.0043397f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x250]
call fcn.0043392b
mov dword [ebp - 0x16c], 0xb2b534de
mov dword [ebp - 0x66c], 0xea6edad9
mov dword [ebp - 0x2b8], 0
jmp 0x474ca4
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x474cbd
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 8], 0x689351f2
jmp 0x474c97
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 8], 3
jmp 0x474ce2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 8], 0
jl 0x4752df
mov dword [ebp - 0x70], 0x3ac9d73d
push 3
lea ecx, [ebp - 0xfe0]
call fcn.0043387f
mov dword [ebp - 0xd34], 0xfadbacd6
mov dword [ebp - 0xd0], 0
jmp 0x474d2a
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x474d4c
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xfe0]
call fcn.0043396d
mov dword [eax], 0x524be18a
jmp 0x474d1d
mov dword [ebp - 0xd0], 0
jmp 0x474d65
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x474d81
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1188], 0xfffffff9
jmp 0x474d58
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
cmp dword [eax], 0
jne 0x474e77
push 3
lea ecx, [ebp - 0x250]
call fcn.0043396d
mov eax, dword [eax]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x66c], eax
mov esi, dword [ebp - 0x66c]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
cmp dword [eax], esi
jl 0x474deb
mov dword [ebp - 0xb1c], 1
jmp 0x474df2
and dword [ebp - 0xb1c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb1c]
jge 0x474e1d
mov dword [ebp - 0x674], 1
jmp 0x474e24
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 1
jne 0x474e39
mov dword [ebp - 0x984], 1
jmp 0x474e40
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 8
je 0x474e55
mov dword [ebp - 0x67c], 1
jmp 0x474e5c
and dword [ebp - 0x67c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x67c], eax
jge 0x474e77
and dword [ebp - 0xc10], 0
jmp 0x474e81
mov dword [ebp - 0xc10], 1
cmp dword [ebp - 0xc10], 0x5f34
jg 0x474e99
mov dword [ebp - 0x684], 1
jmp 0x474ea0
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x684], eax
jne 0x474ebe
mov dword [ebp - 0x98c], 1
jmp 0x474ec5
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x70], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x70], eax
jg 0x474f09
mov dword [ebp - 0xe78], 0x266d8ff8
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
mov eax, dword [eax]
mov dword [ebp - 0xe78], eax
jmp 0x4752b2
mov dword [ebp - 0xcc4], 1
mov dword [ebp - 0xcc0], 1
mov dword [ebp - 0xcbc], 1
mov dword [ebp - 0xcb8], 1
mov dword [ebp - 0x70], 3
jmp 0x474f41
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x4752b2
mov dword [ebp - 0x994], 0x195c588c
mov dword [ebp - 0xf6c], 0xd282
mov dword [ebp - 0x388], 0
jmp 0x474f78
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x474f94
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0xd9c], 0
jmp 0x474f6b
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
cmp dword [eax], 0
je 0x475118
push dword [ebp - 0x70]
lea ecx, [ebp - 0x250]
call fcn.0043396d
cmp dword [eax], 0
je 0x4750c5
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
push dword [ebp - 0x70]
lea ecx, [ebp - 0x250]
call fcn.0043396d
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
mov esi, eax
push 1
lea ecx, [ebp - 0xfe0]
call fcn.0043396d
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x475022
mov dword [ebp - 0x68c], 1
jmp 0x475029
and dword [ebp - 0x68c], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x250]
call fcn.0043396d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x68c]
jne 0x47504d
mov dword [ebp - 0xb18], 1
jmp 0x475054
and dword [ebp - 0xb18], 0
mov esi, dword [ebp - 0x70]
imul esi, dword [ebp - 0xb18]
push 1
lea ecx, [ebp - 0x250]
call fcn.0043396d
cmp esi, dword [eax]
jge 0x47507b
mov dword [ebp - 0x694], 1
jmp 0x475082
and dword [ebp - 0x694], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x694]
sub ecx, dword [ebp + eax - 8]
mov dword [ebp - 0x994], ecx
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x16c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc4]
cmp dword [ebp - 0x16c], eax
jl 0x4750c5
mov dword [ebp - 0x69c], 1
jmp 0x4750cc
and dword [ebp - 0x69c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
mov ecx, dword [ebp - 0x69c]
cmp ecx, dword [eax]
jge 0x4750f7
mov dword [ebp - 0xbc0], 1
jmp 0x4750fe
and dword [ebp - 0xbc0], 0
imul eax, dword [ebp - 0xbc0], 0
cmp eax, 0x4e719ba7
jge 0x475118
mov dword [ebp - 0x6a4], 1
jmp 0x47511f
and dword [ebp - 0x6a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1188]
imul eax, dword [ebp - 0x6a4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 8]
je 0x47514b
mov dword [ebp - 0x99c], 1
jmp 0x475152
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xd34], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcc4], 0
je 0x475182
mov eax, 0xab59a67e
test eax, eax
je 0x475182
mov dword [ebp - 0x6ac], 1
jmp 0x475189
and dword [ebp - 0x6ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xd048
sub ecx, dword [ebp + eax - 0xcc4]
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp + eax - 0xd9c]
add ecx, dword [ebp - 0xf6c]
jne 0x4751c9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcc4], 0
jne 0x4751c9
and dword [ebp - 0xb20], 0
jmp 0x4751d3
mov dword [ebp - 0xb20], 1
mov eax, dword [ebp - 0x6ac]
cmp eax, dword [ebp - 0xb20]
jge 0x4751ed
mov dword [ebp - 0x6b4], 1
jmp 0x4751f4
and dword [ebp - 0x6b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd9c]
cmp dword [ebp - 0x6b4], eax
jg 0x475215
mov dword [ebp - 0x9a4], 1
jmp 0x47521c
and dword [ebp - 0x9a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc4]
cmp dword [ebp - 0x9a4], eax
jge 0x47523d
mov dword [ebp - 0x6bc], 1
jmp 0x475244
and dword [ebp - 0x6bc], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x250]
call fcn.0043396d
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 8]
add ecx, dword [ebp - 0x6bc]
mov eax, dword [eax]
sub eax, ecx
mov dword [ebp - 0x16c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcc4]
cmp dword [ebp - 0x16c], eax
je 0x475293
mov dword [ebp - 0xc54], 1
jmp 0x47529a
and dword [ebp - 0xc54], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc54]
mov dword [ebp + eax - 0xd9c], ecx
jmp 0x474f3a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 8], 0
je 0x4752cf
lea ecx, [ebp - 0xfe0]
call fcn.00433951
jmp 0x474ccd
lea ecx, [ebp - 0xfe0]
call fcn.00433951
jmp 0x474ccd
lea ecx, [ebp - 0x250]
call fcn.00433951
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0x128], 0x2dafbbd
mov dword [ebp - 0x2c0], 0
jmp 0x475317
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 3
jge 0x475333
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xc68], 0
jmp 0x47530a
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x475356
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc68]
mov dword [ebp - 0x129c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc68]
mov dword [ebp - 0x12a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc68]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x4753c0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc68]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc68]
test eax, eax
jne 0x4753c0
and dword [ebp - 0x6c4], 0
jmp 0x4753ca
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0xd3c]
cmp eax, dword [ebp - 0xdb0]
jl 0x475409
mov dword [ebp - 0x9ac], 1
jmp 0x475410
and dword [ebp - 0x9ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc68]
cmp dword [ebp - 0x9ac], eax
je 0x475431
mov dword [ebp - 0x6cc], 1
jmp 0x475438
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x6c218e99
jg 0x475450
mov dword [ebp - 0xb28], 1
jmp 0x475457
and dword [ebp - 0xb28], 0
cmp dword [ebp - 0xb28], 7
jge 0x47546c
mov dword [ebp - 0x458], 1
jmp 0x475473
and dword [ebp - 0x458], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x458]
mov dword [ebp + eax - 0xc68], ecx
cmp dword [ebp - 0x458], 0
je 0x4754c6
mov dword [ebp - 0x128], 2
jmp 0x4754a7
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x4754c4
mov eax, dword [ebp - 0x128]
cmp dword [ebp + eax*4 - 0xc68], 0
je 0x4754c2
jmp 0x4754c4
jmp 0x47549a
jmp 0x47550e
mov dword [ebp - 0xd44], 0xb89b
mov dword [ebp - 0xdb4], 5
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x475502
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xdb4], eax
mov dword [ebp - 0x60], 0x730f94f3
mov dword [ebp - 0x24], 0xbacd7953
push 2
lea ecx, [ebp - 0xcec]
call fcn.0043387f
mov dword [ebp - 0x1cc], 0xfffffffa
mov dword [ebp - 0x184], 0xc017f215
mov dword [ebp - 0x2d0], 0xffffffff
push 3
lea ecx, [ebp - 0xc78]
call fcn.0043387f
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x2c8], 0xe9e5a939
mov dword [ebp - 0x9c4], 0x314d41bd
mov dword [ebp - 0xd54], 1
mov dword [ebp - 0x408], 0xfffffff8
mov dword [ebp - 0x410], 1
mov dword [ebp - 0xdcc], 0xfffffffd
push 1
lea ecx, [ebp - 0x10f8]
call fcn.0043387f
mov dword [ebp - 0xc], 0
jmp 0x4755b4
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x4755cd
push dword [ebp - 0xc]
lea ecx, [ebp - 0xcec]
call fcn.0043396d
and dword [eax], 0
jmp 0x4755ad
mov dword [ebp - 0xc], 0
jmp 0x4755dd
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x4755f6
push dword [ebp - 0xc]
lea ecx, [ebp - 0xc78]
call fcn.0043396d
and dword [eax], 0
jmp 0x4755d6
mov dword [ebp - 0xc], 0
jmp 0x475606
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x47561c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc20], 0xffffffff
jmp 0x4755ff
mov dword [ebp - 0xc], 0
jmp 0x47562c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x475648
push dword [ebp - 0xc]
lea ecx, [ebp - 0x10f8]
call fcn.0043396d
mov dword [eax], 8
jmp 0x475625
mov eax, dword [ebp - 0x24]
sub eax, 0x64f9
cmp eax, 0x7136
jne 0x475663
mov dword [ebp - 0x6d4], 1
jmp 0x47566a
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x6d4], eax
jg 0x475681
mov dword [ebp - 0x9b4], 1
jmp 0x475688
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x24]
add eax, 0x2891ba80
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jl 0x4756bd
mov dword [ebp - 0x400], 1
jmp 0x4756c4
and dword [ebp - 0x400], 0
push 0
lea ecx, [ebp - 0xc78]
call fcn.0043396d
mov ecx, dword [ebp - 0x400]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x400], eax
jne 0x4756f0
mov dword [ebp - 0x6dc], 1
jmp 0x4756f7
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x475713
push 0
lea ecx, [ebp - 0xc78]
call fcn.0043396d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x3c]
sub eax, 0x765e4b
cmp eax, dword [ebp - 0x24]
jl 0x475735
mov dword [ebp - 0xbc8], 1
jmp 0x47573c
and dword [ebp - 0xbc8], 0
cmp dword [ebp - 0xbc8], 0
jne 0x475751
mov dword [ebp - 0x6e4], 1
jmp 0x475758
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x6e4], eax
jg 0x47576f
mov dword [ebp - 0xd4c], 1
jmp 0x475776
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x12ac], eax
push 1
lea ecx, [ebp - 0xcec]
call fcn.0043396d
mov dword [eax], 0xffff
mov dword [ebp - 0x1cc], 0xffff
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1cc], eax
jl 0x4757b6
mov dword [ebp - 0xdbc], 1
jmp 0x4757bd
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x12b4], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
je 0x4757da
mov dword [ebp - 0x9bc], 1
jmp 0x4757e1
and dword [ebp - 0x9bc], 0
cmp dword [ebp - 0x9bc], 0x1378
je 0x4757f9
mov dword [ebp - 0x6ec], 1
jmp 0x475800
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x9c4], eax
push 0
lea ecx, [ebp - 0xcec]
call fcn.0043396d
cmp dword [eax], 0
jne 0x47582a
mov dword [ebp - 0xb30], 1
jmp 0x475831
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0xb30], eax
jg 0x475854
cmp dword [ebp - 0x184], 0
je 0x475854
mov dword [ebp - 0x6f4], 1
jmp 0x47585b
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
sub eax, dword [ebp - 0x24]
cmp eax, 0x7709c180
jge 0x475877
mov dword [ebp - 0x6fc], 1
jmp 0x47587e
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x9c4]
cmp eax, dword [ebp - 0x6fc]
jl 0x475898
mov dword [ebp - 0xc18], 1
jmp 0x47589f
and dword [ebp - 0xc18], 0
cmp dword [ebp - 0xc18], 0xfffffff9
jbe 0x4758b4
mov dword [ebp - 0x704], 1
jmp 0x4758bb
and dword [ebp - 0x704], 0
push 0
lea ecx, [ebp - 0xc78]
call fcn.0043396d
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax]
jge 0x4758de
mov dword [ebp - 0x9cc], 1
jmp 0x4758e5
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x9cc], eax
jne 0x475902
cmp dword [ebp - 0xd54], 0
jne 0x475902
and dword [ebp - 0x70c], 0
jmp 0x47590c
mov dword [ebp - 0x70c], 1
cmp dword [ebp - 0x70c], 4
jbe 0x47592a
mov eax, 0x8275baed
test eax, eax
je 0x47592a
mov dword [ebp - 0xdc4], 1
jmp 0x475931
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x12bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc20]
cmp dword [ebp - 0x24], eax
jg 0x47595b
mov dword [ebp - 0xb38], 1
jmp 0x475962
and dword [ebp - 0xb38], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc20]
cmp dword [ebp - 0xb38], eax
jg 0x475983
mov dword [ebp - 0x714], 1
jmp 0x47598a
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x714]
dec eax
mov dword [ebp - 0x408], eax
je 0x4759a9
xor eax, eax
je 0x4759a9
mov dword [ebp - 0x9d4], 1
jmp 0x4759b0
and dword [ebp - 0x9d4], 0
push 2
lea ecx, [ebp - 0xc78]
call fcn.0043396d
mov ecx, dword [ebp - 0x9d4]
cmp ecx, dword [eax]
jg 0x4759d3
mov dword [ebp - 0x71c], 1
jmp 0x4759da
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jne 0x475a01
cmp dword [ebp - 0x410], 0
jne 0x475a01
and dword [ebp - 0xbd0], 0
jmp 0x475a0b
mov dword [ebp - 0xbd0], 1
cmp dword [ebp - 0xbd0], 0x332e
jl 0x475a23
mov dword [ebp - 0x724], 1
jmp 0x475a2a
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
inc eax
cmp eax, dword [ebp - 0x184]
jle 0x475a45
mov dword [ebp - 0xd5c], 1
jmp 0x475a4c
and dword [ebp - 0xd5c], 0
mov eax, 0xa6e4
cmp eax, 0xffffffff
jne 0x475a62
mov dword [ebp - 0x488], 1
jmp 0x475a69
and dword [ebp - 0x488], 0
push 2
lea ecx, [ebp - 0xc78]
call fcn.0043396d
mov ecx, dword [ebp - 0x488]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xcec]
call fcn.0043396d
mov eax, dword [eax]
sub eax, dword [ebp - 0x488]
cmp eax, 0xccf04a32
ja 0x475aa6
mov dword [ebp - 0x9dc], 1
jmp 0x475aad
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x9dc]
jge 0x475ac4
mov dword [ebp - 0x72c], 1
jmp 0x475acb
and dword [ebp - 0x72c], 0
imul eax, dword [ebp - 0x72c], 0xd617
cmp dword [ebp - 0x2c8], eax
je 0x475aea
mov eax, 0x58950224
test eax, eax
je 0x475c82
mov dword [ebp - 0x338], 1
mov dword [ebp - 0xd64], 0xac52cf4
mov dword [ebp - 0x3c], 0xfffffff4
jmp 0x475b0e
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe5
je 0x475c7d
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0x460], 0x33c814b4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x12c4], eax
push 1
lea ecx, [ebp - 0xc78]
call fcn.0043396d
mov dword [eax], 0xe69a7eec
mov dword [ebp - 0xb40], 0xe69a7eec
mov eax, dword [ebp - 0xb40]
sub eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x408]
add eax, dword [ebp - 0xdcc]
cmp eax, 0x6d4b
jl 0x475b7d
mov dword [ebp - 0x734], 1
jmp 0x475b84
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x734]
jl 0x475b9e
mov dword [ebp - 0x9e4], 1
jmp 0x475ba5
and dword [ebp - 0x9e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc20]
cmp eax, dword [ebp - 0x9e4]
jge 0x475bc6
mov dword [ebp - 0x73c], 1
jmp 0x475bcd
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 0
jle 0x475be2
mov dword [ebp - 0xc44], 1
jmp 0x475be9
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0xc44], eax
je 0x475c0c
cmp dword [ebp - 0x460], 0
je 0x475c0c
mov dword [ebp - 0x744], 1
jmp 0x475c13
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x744]
je 0x475c2d
mov dword [ebp - 0x9ec], 1
jmp 0x475c34
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x9ec], eax
jle 0x475c54
cmp dword [ebp - 0x410], 0
jne 0x475c54
and dword [ebp - 0x74c], 0
jmp 0x475c5e
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0xd64], eax
cmp dword [ebp - 0x460], 0
je 0x475c78
jmp 0x475b07
jmp 0x475b07
jmp 0x475dc8
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x9fc], 0xfffffffb
cmp dword [ebp - 0x370], 0
jne 0x475d03
cmp dword [ebp - 0x370], 0
je 0x475cfb
cmp dword [ebp - 0x184], 0x14209850
jl 0x475cc0
mov dword [ebp - 0xb48], 1
jmp 0x475cc7
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
inc eax
je 0x475cee
push 1
lea ecx, [ebp - 0xcec]
call fcn.0043396d
cmp dword [eax], 0
je 0x475cee
mov dword [ebp - 0x754], 1
jmp 0x475cf5
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x410]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x24]
je 0x475d18
cmp dword [ebp - 0x370], 0
je 0x475d18
mov dword [ebp - 0x9f4], 1
jmp 0x475d1f
and dword [ebp - 0x9f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc20]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x9f4]
jge 0x475d4c
mov dword [ebp - 0x75c], 1
jmp 0x475d53
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x370]
add eax, dword [ebp - 0x75c]
cmp eax, 0x9b40cd91
jb 0x475d72
mov dword [ebp - 0xbd8], 1
jmp 0x475d79
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0xbd8]
jge 0x475d93
mov dword [ebp - 0x764], 1
jmp 0x475d9a
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x9fc], eax
mov esi, dword [ebp - 0x9fc]
push 4
pop eax
imul eax, eax, 0
sub esi, dword [ebp + eax - 0xc20]
push 0
lea ecx, [ebp - 0x10f8]
call fcn.0043396d
mov dword [eax], esi
lea ecx, [ebp - 0x10f8]
call fcn.00433951
lea ecx, [ebp - 0xc78]
call fcn.00433951
lea ecx, [ebp - 0xcec]
call fcn.00433951
mov dword [ebp - 0x12cc], 0x71865425
mov dword [ebp - 0x12d4], 0
mov dword [ebp - 0xec], 8
mov dword [ebp - 0xec], 0
jmp 0x475e20
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x17
jl 0x475ed4
mov dword [ebp - 0x340], 0xa3df603f
mov dword [ebp - 0x340], 0
jmp 0x475e50
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xfffffff9
je 0x475ea8
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d8], 0xc
jmp 0x475e7c
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xfffffff1
jge 0x475ea6
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x475ea4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x475e6f
jmp 0x475e43
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x475ecf
push 0
push 0
push 0x12fa
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x475e13
mov dword [ebp - 0xec], 0xffffffe3
jmp 0x475eed
cmp dword [ebp - 0xec], 0xfffffffe
jg 0x475f6f
mov dword [ebp - 0x1fc], 0xfffffffe
mov dword [ebp - 0x398], 0
jmp 0x475f19
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 3
jge 0x475f35
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x1480], 0xffffffff
jmp 0x475f0c
mov dword [ebp - 0x1fc], 0
jmp 0x475f4e
cmp dword [ebp - 0x1fc], 3
jge 0x475f6a
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x1480], 0x83d7
jmp 0x475f41
jmp 0x475ee0
mov dword [ebp - 0x12e0], 0xffffffff
mov dword [ebp - 0x174], 0xffffffff
mov dword [ebp - 0x88], 0
jmp 0x475f9c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x475fb8
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xda8], 1
jmp 0x475f8f
mov dword [ebp - 0x88], 0
jmp 0x475fd1
cmp dword [ebp - 0x88], 1
jge 0x475fed
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xdd4], 0
jmp 0x475fc4
mov dword [ebp - 0x174], 0
jmp 0x476006