Function at 0x479b3c
Capabilities:
Accept command line arguments
Check os version
Create directory
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Get disk information
Get geographical location
Get graphical window text
Get system information on windows
Identify system language via api
Modify service
Query environment variable
Query or enumerate registry key
Read .ini file
Set environment variable
Set registry value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12a8
call fcn.004c8a80
push ebx
push esi
push edi
mov edi, 0xada439be
mov dword [ebp - 0x54], ecx
xor eax, eax
mov dword [ebp - 0x20], edi
push 4
mov dword [ebp - 4], eax
pop ecx
mov byte [ebp - 0x65], dl
cmp dword [ebp - 4], ecx
jge 0x479b7b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa14], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x479b67
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x20], esi
mov ecx, 0x33582f80
cmp dword [ebp - 0x20], eax
jl 0x479c2e
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x930], ecx
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 0x928], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x479bc7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x474], 0x4cdb8faa
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x479baf
xor eax, eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], esi
jg 0x479c09
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xa14], ebx
je 0x479be9
mov eax, dword [ebp - 0xa0c]
mov eax, dword [ebp - 0x470]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x934], eax
inc dword [ebp - 0x474]
cmp dword [ebp - 0x474], esi
jle 0x479bd7
mov eax, dword [ebp - 0x20]
push 0
mov ecx, dword [ebp + eax*4 - 0xa14]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa14], ecx
mov ecx, 0x33582f80
dec dword [ebp - 0x20]
pop eax
jns 0x479b8f
mov ecx, 0xf112
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], ecx
mov dword [ebp - 0x8cc], ecx
mov dword [ebp - 0x8c8], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jg 0x479c80
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x479c6b
push 0x9d2
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
push 0
mov eax, dword [ebp + eax*4 - 0x8d4]
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], esi
jle 0x479c56
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x479c9f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor eax, eax
mov dword [ebp - 0x3c], 0x3f4f46db
mov dword [ebp - 4], 7
mov dword [ebp - 0x10], 0xefc72fa5
mov dword [ebp - 0x18], 0xc012777f
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
pop edx
cmp dword [ebp - 0x14], esi
jge 0x479cda
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x174], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x479cc6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x479cfa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6b4], 0x7b38eb16
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x479ce2
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x479d1a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xef8], 0xc5bff904
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x479d02
xor eax, eax
mov dword [ebp - 0x3c], 2
push 1
pop esi
cmp dword [ebp - 0x3c], eax
jl 0x479dc8
xor ebx, ebx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], 0x1ce3cb5a
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x174]
mov dword [ebp - 0x40], 0xde0980db
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x174], ebx
jne 0x479d59
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x174]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setg dl
push 0xffffffffffffffff
mov eax, dword [ebp + eax*4 - 0x174]
sub edx, eax
xor eax, eax
cmp edx, esi
pop edx
setle al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x174], ecx
mov ecx, 0x380ee91b
mov dword [ebp - 0x6b4], ecx
mov dword [ebp - 4], ecx
dec dword [ebp - 0x3c]
jns 0x479d2f
xor eax, eax
cmp dword [ebp - 0x6b0], eax
je 0x479e59
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x5af849fb
setne al
cmp dword [ebp - 0x10], eax
jne 0x479dfa
cmp dword [ebp - 0x6b4], 0
je 0x479dfa
mov eax, esi
jmp 0x479dfc
xor eax, eax
cmp eax, 2
mov eax, dword [ebp - 0x16c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
xor ebx, ebx
test edx, edx
mov dword [ebp - 0x6b4], edx
mov eax, dword [ebp - 0x10]
setne bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor eax, eax
cmp ecx, 0x5407
sete al
add eax, dword [ebp - 0x174]
mov dword [ebp - 0x3c], eax
je 0x479e49
cmp dword [ebp - 0x16c], 0
je 0x479e49
mov eax, esi
jmp 0x479e4b
xor eax, eax
cmp eax, dword [ebp - 0x16c]
jl 0x479e57
mov eax, esi
jmp 0x479e59
xor eax, eax
imul eax, eax, 0xfffffff9
test eax, eax
jne 0x479e67
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x479e69
mov edx, esi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
push 6
setge cl
xor eax, eax
cmp ecx, 0xfffffff9
setge al
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xef8], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x479edf
or edx, 0xffffffff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcd8], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x479ecc
mov eax, dword [ebp - 0x194]
xor ecx, ecx
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
test eax, eax
mov eax, dword [ebp - 0x18c]
setg cl
imul eax, ecx
test eax, eax
jne 0x479f11
cmp dword [ebp - 0x194], eax
jne 0x479f13
mov ecx, eax
jmp 0x479f15
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xcd0], eax
mov dword [ebp - 0x38], eax
xor eax, eax
push 0xfffffffffffffffd
pop edx
cmp ecx, edx
sete al
xor edx, edx
imul ecx, eax, 0xcf7d
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x18c]
setg dl
sub edx, eax
mov eax, dword [ebp - 0x18c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x194]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xde81
jle 0x479f7a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x479f7c
mov edx, esi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x194]
je 0x479f94
mov eax, dword [ebp - 0xcd0]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
push 3
mov dword [ebp - 0x40], esi
xor eax, eax
pop ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x479fce
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x479fc9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x479fb6
mov dword [ebp - 0x20], edi
mov edi, dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0xc], 0xa2fafd11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffe
push 0xfffffffffffffff6
pop ecx
je 0x47a10d
mov dword [ebp - 0x18], 0x6158d32f
mov dword [ebp - 0x28], 0xad3b3152
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47a026
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa9c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47a010
push 3
pop ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x47a09d
mov dword [ebp - 4], 0xa9f8d19c
mov dword [ebp - 0x10], 0xfffffff7
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47a05a
push eax
push 0x2529
push eax
call edi
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x47a062
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jle 0x47a079
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0xa9c], edx
jmp 0x47a0fa
mov dword [ebp - 0x28], 0xffffffe7
cmp dword [ebp - 0x28], 0x11
jne 0x47a0fd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x47a0c9
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa9c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x47a0b5
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a0f1
push eax
push 0x1207
push 0x7b8
push eax
push 0x466
push 0x1d8a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
je 0x47a0aa
push 0xfffffffffffffff6
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffe
push 0
pop eax
jne 0x479ff5
mov dword [ebp - 0xc], eax
jmp 0x47a11a
cmp dword [ebp - 0x20], eax
jne 0x47a120
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffed
jg 0x47a112
mov dword [ebp - 0x14], 0xe76f5020
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x47a156
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x400], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x47a13d
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x47a178
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3d8], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x47a15f
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x47a259
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x38], 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47a1ae
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x624], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47a196
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a1be
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x400], ebx
je 0x47a1e8
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x48], eax
jge 0x47a1e8
xor esi, esi
mov eax, dword [ebp - 0x14]
xor edx, edx
push 3
pop ebx
push 0
mov ecx, dword [ebp + eax*4 - 0x400]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
dec edx
cmp edx, 0xcc4b
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x400]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp esi, ecx
mov eax, dword [ebp + eax*4 - 0x400]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x624], ecx
inc dword [ebp - 0x14]
push 1
pop esi
cmp dword [ebp - 0x14], ebx
jle 0x47a184
or ecx, 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xb
jge 0x47a31d
mov dword [ebp - 0x10], 0x3c3d2146
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x10]
neg eax
je 0x47a29c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
sub eax, 0x2ddfdaf1
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x400]
je 0x47a29c
mov eax, esi
jmp 0x47a29e
xor eax, eax
add eax, 0x4595a2e7
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
sub eax, 0xe128
je 0x47a2ba
cmp dword [ebp - 0x10], 0
je 0x47a2ba
mov ecx, esi
jmp 0x47a2bc
xor ecx, ecx
mov eax, dword [ebp - 0x400]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x3d8], ecx
test ecx, ecx
jne 0x47a2f1
cmp dword [ebp - 0x3d8], eax
jne 0x47a2f1
mov ecx, eax
cmp dword [ebp - 0x400], eax
je 0x47a2f3
mov ecx, esi
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x14], esi
jle 0x47a303
cmp dword [ebp - 0x3d8], eax
je 0x47a305
mov eax, esi
mov dword [ebp - 0x3d8], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
push 0xffffffffffffffff
pop ecx
jl 0x47a266
xor eax, eax
push 4
mov dword [ebp - 4], eax
pop edx
cmp dword [ebp - 4], edx
jge 0x47a33c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x9f4], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x47a328
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jge 0x47a35f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd78], 0x29b
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x47a347
xor eax, eax
mov dword [ebp - 0x20], 0x4e2db58e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x47a3ec
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x47a3e4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jge 0x47a39c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x994], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x47a384
xor eax, eax
mov dword [ebp - 0x988], ebx
cmp dword [ebp - 0x988], eax
jl 0x47a3dc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xd78]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd78], ecx
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47a3cf
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
dec dword [ebp - 0x988]
jns 0x47a3aa
push 4
xor eax, eax
pop edx
dec dword [ebp - 0x10]
jns 0x47a37c
or ecx, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x47a371
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x47a91a
mov dword [ebp - 0x28], 0xb9f9b31
or edx, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xd6158f87
mov dword [ebp - 0x1c], 0x94fe874d
mov dword [ebp - 0x28], 0xffffffee
cmp dword [ebp - 0x28], 0xffffffec
jle 0x47a4be
mov dword [ebp - 0xc], 0xf1bf506e
mov dword [ebp - 0x38], edx
mov dword [ebp - 0xc], 0xffffffe6
cmp dword [ebp - 0xc], 9
jne 0x47a45a
mov dword [ebp - 0x40], 0xe932
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 9
je 0x47a43b
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x47a462
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x28], eax
jne 0x47a47f
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x47a47f
cmp dword [ebp - 0x28], eax
jne 0x47a47f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
test eax, eax
push 0
setns cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, esi
pop eax
setg cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffec
jg 0x47a424
mov dword [ebp - 0x10], 0x68ec0ae9
mov dword [ebp - 0x30], esi
push 2
mov dword [ebp - 4], eax
pop ecx
cmp dword [ebp - 4], ecx
jge 0x47a4eb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x650], 0x41fc9a57
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x47a4d3
xor eax, eax
mov dword [ebp - 0x10], 0xffffffef
jmp 0x47a5d0
mov dword [ebp - 0x24], 0xf5cd53bc
mov dword [ebp - 0x40], 0x431fadac
mov dword [ebp - 0x18], 0x29a275ff
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x47a52c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xab0], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x47a514
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x47a54c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc48], 0x4a6f4440
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47a534
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x47a586
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], 0x276b87d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ecx
jge 0x47a57e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x102c], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x47a56a
xor eax, eax
inc dword [ebp - 0x40]
dec dword [ebp - 0x24]
jns 0x47a554
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xab0]
mov eax, dword [ebp - 0x650]
push 0xfffffffffffffffe
pop ecx
sub ecx, eax
je 0x47a59f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x64c]
cmp ecx, eax
push 2
pop ecx
push 0
setge dl
pop eax
mov dword [ebp - 0xc44], edx
inc dword [ebp - 0x10]
push 0xffffffffffffffff
pop edx
cmp dword [ebp - 0x10], ecx
jl 0x47a4f7
mov dword [ebp - 0x30], esi
xor eax, eax
cmp dword [ebp - 0x30], eax
jl 0x47a5fa
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a5f5
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x47a5e3
mov ecx, 0x33582f80
mov dword [ebp - 0x8f4], ecx
mov dword [ebp - 0x8f0], ecx
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 0x8e8], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47a637
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x4bc], 0x4cdb8faa
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47a61f
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], 0xb7d8cf4c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47a65f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10bc], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47a64a
xor eax, eax
dec dword [ebp - 0x38]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a67a
push 0x2402
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], ebx
jg 0x47a83c
or edx, 0xffffffff
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x1c], 0xa7525d2d
mov dword [ebp - 0x1c], edx
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x47a6bf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4f8], 0xc93b4e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x47a6a7
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x47a6db
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5e0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x47a6c7
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x47a6fb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1258], 0xc9cd49fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x47a6e3
xor eax, eax
mov dword [ebp - 0x4f0], eax
jmp 0x47a78d
mov dword [ebp - 0x10], 0xf759609c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47a72d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1194], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47a715
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x47a787
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], 0x6bde64f6
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 4], eax
cmp dword [ebp - 4], eax
jl 0x47a77f
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a777
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
dec dword [ebp - 4]
jns 0x47a765
or edx, 0xffffffff
inc dword [ebp - 0x38]
dec dword [ebp - 0x10]
jns 0x47a735
inc dword [ebp - 0x4f0]
cmp dword [ebp - 0x4f0], 0x14
jge 0x47a706
mov eax, dword [ebp - 0x4f0]
xor ecx, ecx
mov eax, dword [ebp - 0x5e0]
mov eax, dword [ebp - 0x48]
test eax, eax
mov eax, dword [ebp - 0x4f0]
setg cl
add eax, ecx
mov ecx, dword [ebp - 0x48]
add ecx, eax
xor eax, eax
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0xbd7b1c2a
mov dword [ebp - 0x1c], 0x6b950ba1
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], eax
jmp 0x47a7f5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1044], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47a7e8
inc dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x9f4], ebx
je 0x47a812
mov eax, dword [ebp - 0x9ec]
mov eax, dword [ebp - 0x4b8]
neg eax
push 3
sbb eax, eax
neg eax
pop ebx
mov dword [ebp - 0x8f4], eax
inc dword [ebp - 0x4bc]
push 0
pop eax
cmp dword [ebp - 0x4bc], ebx
jle 0x47a68f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x47a85e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x328], 0x24a8c6a5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x47a845
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x47a87e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe80], 0xdfe4b283
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x47a866
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a896
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
mov dword [ebp - 0x328], eax
jmp 0x47a8f1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47a8c1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x578], 0x137b
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47a8a9
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x47a8e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x578], 0x836c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47a8c9
xor eax, eax
mov dword [ebp - 0xe78], 8
dec dword [ebp - 0x328]
cmp dword [ebp - 0x328], 0xffffffef
jg 0x47a89e
mov eax, dword [ebp - 0x20]
push 0
mov ecx, dword [ebp + eax*4 - 0x9f4]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9f4], ecx
dec dword [ebp - 0x20]
pop eax
jns 0x47a3f8
mov dword [ebp - 0xc], 0x7fe64fd9
mov dword [ebp - 0x18], 0xc10977a1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47a94b
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1278], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47a933
push 3
xor eax, eax
pop ebx
cmp dword [ebp - 0xc], eax
je 0x47a952
mov eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov eax, 0x185299da
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x47a9f3
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffffe
cmp dword [ebp - 0x20], eax
je 0x47a9a8
mov dword [ebp - 0x20], eax
jmp 0x47a9a1
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47a99e
push 0x2248
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x47a985
jmp 0x47aa0e
mov dword [ebp - 0x18], 0xdfddae9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47a9d1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa90], 5
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47a9b8
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47a9ec
mov dword [ebp - 0x38], 0x12894ff5
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x38]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jne 0x47a9d6
jmp 0x47aa0e
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47aa10
push 0x1ae5
push 0x2488
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
jmp 0x47aa60
mov dword [ebp - 0x18], 0xfff9
cmp dword [ebp - 0x10], eax
je 0x47aa39
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x47aa5d
jmp 0x47aa4b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47aa4b
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47aa5d
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
jg 0x47aa1b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47aa7d
push eax
push 0x1670
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
mov dword [ebp - 0x1c], 0x5d6c05ba
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47aa99
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47aab7
push 0x244a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
xor eax, eax
mov dword [ebp - 0x38], 0xe55459ee
mov dword [ebp - 0x38], 0x5357f451
mov dword [ebp - 0x18], 0x5fec46bc
push 2
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x47aaef
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x100], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47aad7
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47ab05
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8c], 0x28f3b8c1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47aaf4
mov dword [ebp - 0x100], 0x10
jmp 0x47ab83
mov dword [ebp - 0x20], 0x8a94b2ab
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x47ab37
mov ecx, esi
cmp dword [ebp - 0x100], eax
jne 0x47ab39
mov ecx, eax
mov eax, dword [ebp - 0x100]
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0xb88], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x100]
cmp dword [ebp - 0x100], 0x1b
jne 0x47ab16
mov dword [ebp - 0x10], 0xea5d6c05
xor eax, eax
mov dword [ebp - 0x1c], 0xb4074dd
mov dword [ebp - 0x1c], 0x6f5a9c4c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47abb4
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff8
jmp 0x47abe4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47abdb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcf8], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47abc6
xor eax, eax
dec dword [ebp - 0xcec]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jg 0x47abbd
mov dword [ebp - 0x3c], 0x714a0256
mov dword [ebp - 0x20], 0x3ae35568
mov dword [ebp - 0x18], 0x8d7cbae8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff2
jg 0x47ac86
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47ac30
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x79c], 0x73eb905d
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47ac17
xor eax, eax
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x47ac74
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x30], eax
jne 0x47ac66
cmp dword [ebp - 0x79c], eax
jne 0x47ac51
cmp dword [ebp - 0x10], eax
je 0x47ac54
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x79c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x30]
push 0
pop eax
jns 0x47ac38
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
push 0
pop eax
jle 0x47ac08
mov dword [ebp - 0x10], 0x43e2f7c6
or ecx, 0xffffffff
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0x67fa5c62
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0xcc80fc3a
mov dword [ebp - 0x1c], 0xbfb66feb
mov dword [ebp - 0x48], 2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47acd4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x550], 0x7862
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47acbb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jg 0x47acf3
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x550]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x47acdc
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jl 0x47ad99
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xdc5336de
mov dword [ebp - 0x18], 0xdd78f4f8
mov dword [ebp - 0x44], 0xdf9c7750
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0x4f5ac3d6
mov dword [ebp - 0x38], 0x36be856d
cmp dword [ebp - 0x54c], eax
je 0x47ad74
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xc], 0x6b5cfda6
jne 0x47ad43
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x550]
cmp ecx, eax
setge dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
or ecx, 0xffffffff
cmp edx, dword [ebp - 4]
je 0x47ad74
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
push 0
pop eax
jge 0x47ad00
mov dword [ebp - 0x4c], 0x4f06702e
mov dword [ebp - 0x38], 0x6f9b2cfb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0xa3cfce2
mov dword [ebp - 0x20], 0x24307a32
mov dword [ebp - 0xc], 0x3494abc2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x48], 0x585f
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x47af9d
mov dword [ebp - 0x24], 0xf0e77da1
mov dword [ebp - 4], 0xbb643c8f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jg 0x47aee4
mov dword [ebp - 0x10], 0x58a13c4
cmp dword [ebp - 0x10], eax
jne 0x47ae5a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + eax*4 - 0x418]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x418], esi
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x61c]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
test eax, eax
setle cl
xor eax, eax
cmp edx, ecx
setne al
xor edx, edx
cmp esi, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x24]
je 0x47aeb6
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x418]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x61c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], 0xb1f05996
inc dword [ebp - 0xc]
push 0
pop eax
cmp dword [ebp - 0xc], ebx
jle 0x47ae4b
xor esi, esi
inc esi
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x47af8e
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47af13
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf40], 0xfff8
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47aefb
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47af2a
push eax
push 0x8bb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov eax, dword [ebp - 0x28]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x418], ebx
jne 0x47af6d
mov eax, dword [ebp - 0x61c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf40], eax
mov dword [ebp - 0x48], 0x35f01d5c
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x418]
mov eax, dword [ebp - 0x61c]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
jne 0x47af6f
mov ecx, esi
mov eax, dword [ebp - 0x28]
push 0
mov eax, dword [ebp + eax*4 - 0x418]
imul eax, ecx
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x28]
pop eax
push 3
pop ebx
jns 0x47aef0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x47ae31
or ecx, 0xffffffff
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47afb6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47afa5
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x47b0cd
mov dword [ebp - 0x14], 0x4801897a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47afe7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x110], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47afd2
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x47b047
jmp 0x47aff3
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0xa50b5f0b
mov dword [ebp - 0x18], 0x9c710427
cmp dword [ebp - 4], eax
je 0x47b00c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 4]
cmp eax, 0x9576
setle cl
xor edx, edx
imul ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
imul ecx, ecx, 0xfffffff9
cmp eax, ecx
setle dl
mov dword [ebp - 4], edx
cmp dword [ebp - 0x18], 0
jne 0x47b047
inc dword [ebp - 0x14]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x14], esi
jle 0x47aff1
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x14]
cmp eax, 0xfffffffb
setg cl
xor eax, eax
cmp ecx, 0xc5c3
setle al
cmp eax, dword [ebp - 0x14]
jle 0x47b083
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x26232c2a
setge cl
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x3c]
push ebx
mov dword [ebp + eax*4 - 0x74], ebx
inc dword [ebp - 0x3c]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x3c], esi
jl 0x47afc2
push 3
xor eax, eax
pop ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x47c3b4
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x38], 0x80254f8d
mov dword [ebp - 0x38], 0xfffffffc
cmp dword [ebp - 0x10], eax
je 0x47b10e
mov dword [ebp - 0x38], 5
dec dword [ebp - 0x38]
jmp 0x47b1a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47b130
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd58], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47b117
xor eax, eax
mov dword [ebp - 0x10], 0x10
cmp dword [ebp - 0x10], 0x2d
jl 0x47b1a0
jmp 0x47b141
xor eax, eax
mov dword [ebp - 0x1c], 0x8bc0
mov dword [ebp - 0x38], 0x82f744ed
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47b16f
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47b159
push 3
pop ebx
mov eax, dword [ebp - 0xd50]
mov ecx, 0x1d97
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd50]
sub ecx, eax
push 0
pop eax
setne al
mov dword [ebp - 0xdbc], ecx
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x2d
jge 0x47b13f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0xe5c7a00f
mov dword [ebp - 0x14], 0x8c3ad3b3
mov dword [ebp - 4], 0
cmp dword [ebp - 4], ebx
jge 0x47b1db
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdb4], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47b1c8
or eax, 0xffffffff
cmp dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, 8
sbb edx, edx
xor ecx, ecx
add edx, 0xc8748afb
cmp eax, edx
mov eax, dword [ebp - 0x14]
setge cl
xor ebx, ebx
xor edx, edx
inc ebx
cmp ecx, ebx
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0x1a
jmp 0x47b2b1
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x47b254
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac4], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47b23f
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x47b271
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47b26e
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x47b259
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
mov eax, dword [ebp - 0xabc]
mov edx, dword [ebp - 0x14]
sbb ecx, ecx
neg ecx
add ecx, eax
mov eax, dword [ebp - 0x14]
add eax, ecx
add edx, eax
jne 0x47b2a2
mov eax, dword [ebp - 0xabc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xdb0], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jge 0x47b22e
mov dword [ebp - 0xc], 0xfcb50bf3
xor eax, eax
mov dword [ebp - 0x38], 0xa219909d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x47b2ef
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc8], ebx
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x47b2d5
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x47b311
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa60], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x47b2f8
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47b323
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x47b42f
mov dword [ebp - 0x38], 0x3782ecc9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x47b358
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2f0], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47b33f
xor eax, eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], eax
jl 0x47b380
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47b378
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
dec dword [ebp - 0x2ec]
jns 0x47b366
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0xc]
cmp eax, 0x39c9
mov eax, dword [ebp - 0xa60]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2f0], ecx
mov eax, dword [ebp - 0xa58]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc8], ecx
test ecx, ecx
je 0x47b401
cmp dword [ebp - 0x2ec], 0
je 0x47b401
mov eax, ebx
jmp 0x47b403
xor eax, eax
xor edx, edx
cmp eax, 0x2b4cf22a
push 0
sete dl
xor ecx, ecx
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], ebx
dec dword [ebp - 0xc]
pop eax
jns 0x47b32f
mov byte [ebp - 0x29], al
mov dword [ebp - 0x28], 0xb9f9b31
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xd6158f87
mov dword [ebp - 0x1c], 0x94fe874d
mov dword [ebp - 0x28], 0xffffffee
cmp dword [ebp - 0x28], 0xffffffec
jle 0x47b4f8
mov dword [ebp - 0xc], 0xf1bf506e
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], 0xffffffe6
cmp dword [ebp - 0xc], 9
jne 0x47b494
mov dword [ebp - 0x40], 0xe932
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 9
je 0x47b475
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x47b49c
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x28], eax
jne 0x47b4b9
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x47b4b9
cmp dword [ebp - 0x28], eax
jne 0x47b4b9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
test eax, eax
push 0
setns cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
pop eax
setg cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffec
jg 0x47b45b
cmp byte [ebp - 0x29], 0
je 0x47b7c1
push 2
mov dword [ebp - 0x28], 0x4ddbc370
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x47b52f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa4], 0x8bac
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x47b517
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47b545
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x7dc], 0x257e7e5f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47b534
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xfffffff7
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xa4]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, 0xd327cb3f
je 0x47b593
mov dword [ebp - 0x38], 0xd5fa
dec dword [ebp - 0x38]
jmp 0x47b7ad
xor eax, eax
mov dword [ebp - 4], 0x9ab8a87e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x47b7af
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x47b5d0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x250], 0x4e76ab2a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x47b5b7
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x47b5f0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x334], 0x821342f3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x47b5d8
xor eax, eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], eax
jl 0x47b727
push 2
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x47b623
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x704], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47b60f
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47b639
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xaa4], 0xe2c9bf5e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47b628
mov eax, dword [ebp - 0x250]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x47b691
mov eax, dword [ebp - 0x28]
inc ebx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x334], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xa4]
cmp eax, ebx
mov eax, dword [ebp - 0x24c]
setge dl
xor ecx, ecx
cmp eax, 0xfffe
setge cl
sub edx, ecx
je 0x47b691
mov ecx, ebx
xor eax, eax
jmp 0x47b695
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x700], ecx
cmp ecx, dword [ebp - 0xaa0]
je 0x47b6d0
mov dword [ebp - 0x20], 8
inc dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x47b6ef
mov eax, dword [ebp - 0x250]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0xa4], ebx
jne 0x47b6ed
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x47b6b5
jmp 0x47b6ed
mov dword [ebp - 0x18], 0x11ecbfcf
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x700]
cmp eax, ecx
setge dl
mov dword [ebp - 0x38], edx
dec dword [ebp - 4]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47b715
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x740
push 0x22c5
push 0x194d
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
dec dword [ebp - 0x250]
push 0
pop eax
jns 0x47b602
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x28], eax
je 0x47b756
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa4]
imul ecx, eax
mov dword [ebp - 0x334], ecx
test ecx, ecx
jne 0x47b760
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x7d8], eax
je 0x47b762
mov ecx, ebx
xor eax, eax
cmp ecx, 0x6e0aee48
push 0
sete al
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
sub ecx, 0x2777
cmp eax, ecx
mov eax, dword [ebp - 0x250]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, ebx
setl al
mov dword [ebp - 0x7d8], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
pop eax
jle 0x47b5a8
xor eax, eax
push 0x2048
push eax
push 0x959
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x40], 0x7a0d
xor eax, eax
mov dword [ebp - 0x10], 0x77fc7df3
mov dword [ebp - 0x34], 0x395cc9e5
mov dword [ebp - 0x7bc], ebx
mov dword [ebp - 0x7b8], ebx
mov dword [ebp - 0x7b4], ebx
mov dword [ebp - 0x7b0], ebx
mov dword [ebp - 0x38], 0xfffa
mov dword [ebp - 0x38], 0xf6a91a76
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47b81a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47b809
xor eax, eax
cmp dword [ebp - 0x5c], eax
jne 0x47b871
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
cmp eax, ecx
mov eax, dword [ebp - 0x5c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x12d49381
setne al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47b871
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
dec eax
jne 0x47b885
cmp dword [ebp - 0x34], eax
je 0x47b887
mov eax, ebx
imul eax, eax, 5
mov dword [ebp - 0x7b8], eax
test eax, eax
je 0x47b89e
cmp dword [ebp - 0x5c], 0
je 0x47b89e
mov eax, ebx
jmp 0x47b8a0
xor eax, eax
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
or edx, 0xffffffff
add eax, dword [ebp - 0x5c]
cmp eax, edx
mov eax, dword [ebp - 0x5c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x47c3a2
mov dword [ebp - 0xc], 0xfadacd7d
mov dword [ebp - 0x14], 0x714a0256
mov dword [ebp - 0x20], 0x43e2f7c6
mov dword [ebp - 0x18], 0x4f06702e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47b91f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x84], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47b90b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x47b943
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], ebx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x47b929
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x47ba8d
mov dword [ebp - 0xc], 0xe5c7a00f
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47b973
push 0x2048
push eax
push 0x959
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x47ba84
mov dword [ebp - 0x28], 0xfadacd7d
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x84]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x84]
imul eax, dword [ebp - 0xc]
imul eax, eax, 0x79a7
cmp ecx, eax
jle 0x47b9ba
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x84]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
add edx, dword [ebp + eax*4 - 0x84]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, ebx
setge cl
imul eax, ecx, 0xb84c
test eax, eax
je 0x47ba70
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x47ba79
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
cmp dword [ebp - 0x28], eax
jne 0x47ba26
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47ba21
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc dword [ebp - 0x28]
je 0x47ba0f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x47ba65
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x84], ecx
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47ba5b
push eax
push 0x237b
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x47ba2e
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
je 0x47ba03
jmp 0x47ba79
cmp dword [ebp - 0x14], 0
jne 0x47ba82
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0xc]
jns 0x47b97f
xor eax, eax
dec dword [ebp - 0x14]
jns 0x47b94f
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x74]
sub ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x74]
imul eax, dword [ebp - 0x24]
imul eax, eax, 0x79a7
cmp ecx, eax
jle 0x47bab5
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x74]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
add edx, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
setge cl
imul eax, ecx, 0xb84c
test eax, eax
je 0x47c2ea
xor eax, eax
mov dword [ebp - 0xc], 0x7e2799ac
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffe2
jl 0x47bb4d
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
neg edx
sbb edx, edx
neg edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, ecx
mov edx, dword [ebp - 0xc]
setl al
xor ecx, ecx
sub edx, eax
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47bb42
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe2
jge 0x47baff
xor eax, eax
mov dword [ebp - 0x10], 0x1b
jmp 0x47c2db
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x534], ebx
mov dword [ebp - 0x530], ebx
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x534], eax
jmp 0x47bbd9
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x47bb9e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe50], 0x6e60b0c
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47bb85
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x47bbd3
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47bbbd
push 0x195a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x30]
push 0
mov eax, dword [ebp + eax*4 - 0xe50]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
pop eax
jle 0x47bba7
inc dword [ebp - 0x534]
cmp dword [ebp - 0x534], 0x17
jg 0x47bb79
mov dword [ebp - 0xc], 0xfffffffb
cmp dword [ebp - 0xc], eax
jne 0x47bf44
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x38], 0x80254f8d
mov dword [ebp - 0x38], 0xfffffffc
cmp dword [ebp - 0x30], eax
je 0x47bc25
mov dword [ebp - 0x38], 5
dec dword [ebp - 0x38]
jmp 0x47bcb8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47bc47
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd18], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47bc2e
xor eax, eax
mov dword [ebp - 0x30], 0x10
cmp dword [ebp - 0x30], 0x2d
jl 0x47bcb8
jmp 0x47bc58
xor eax, eax
mov dword [ebp - 0x1c], 0x8bc0
mov dword [ebp - 0x38], 0x82f744ed
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x47bc84
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe44], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47bc71
mov eax, dword [ebp - 0xd10]
mov ecx, 0x1d97
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd10]
sub ecx, eax
push 0
pop eax
setne al
mov dword [ebp - 0xe40], ecx
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x2d
jge 0x47bc56
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 5], al
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x28], 0xa2fafd11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffe
je 0x47be08
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x18], 0x6158d32f
mov dword [ebp - 0x30], 0xad3b3152
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x47bd16
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xae4], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x47bd03
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x47bd93
mov dword [ebp - 4], 0xa9f8d19c
mov dword [ebp - 0x34], 0xfffffff7
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x47bd4a
push eax
push 0x2529
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x47bd52
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov eax, dword [ebp - 0x30]
inc ebx
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x28]
jle 0x47bd6c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
push 0xfffffffffffffff6
setl dl
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0xae4], edx
pop ecx
jmp 0x47bdf8
mov dword [ebp - 0x30], 0xffffffe7
cmp dword [ebp - 0x30], 0x11
jne 0x47bdf5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x47bdc1
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xae4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x47bdac
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x47bde9
push eax
push 0x1207
push 0x7b8
push eax
push 0x466
push 0x1d8a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x11
je 0x47bda0
push 0xfffffffffffffff6
pop ecx
xor ebx, ebx
inc ebx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffe
push 0
pop eax
jne 0x47bce7
mov dword [ebp - 0x28], eax
jmp 0x47be15
cmp dword [ebp - 0x20], eax
jne 0x47be1b
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jg 0x47be0d
cmp byte [ebp - 5], 0
je 0x47bf38
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0x67fa5c62
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0xcc80fc3a
mov dword [ebp - 0x1c], 0xbfb66feb
mov dword [ebp - 0x48], 2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47be6c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x574], 0x7862
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47be53
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x47be8b
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x574]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x47be74
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jl 0x47bf31
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xdc5336de
mov dword [ebp - 0x18], 0xdd78f4f8
mov dword [ebp - 0x44], 0xdf9c7750
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x4f5ac3d6
mov dword [ebp - 0x38], 0x36be856d
cmp dword [ebp - 0x570], eax
je 0x47bf0c
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], 0x6b5cfda6
jne 0x47bedb
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x574]
cmp ecx, eax
setge dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
or ecx, 0xffffffff
cmp edx, dword [ebp - 4]
je 0x47bf0c
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
push 0
pop eax
jge 0x47be98
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp - 0xc]
push 0
pop eax
je 0x47bbf2
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jg 0x47c2d8
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x28], ecx
or edx, 0xffffffff
mov dword [ebp - 4], edx
mov dword [ebp - 4], eax
jmp 0x47bf6e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11f8], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47bf61
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 4], eax
jl 0x47bfb8
mov dword [ebp - 0x38], 0xfffffff9
dec dword [ebp - 0x38]
dec dword [ebp - 4]
jns 0x47bfa9
mov eax, dword [ebp - 0x3c]
push 2
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x74], ecx
xor eax, eax
mov byte [ebp - 0x29], al
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], 0x5809
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x47c009
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x580], 0x8a746c20
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x47bff1
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x47c01b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x378], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x47c00e
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x14], 0x1d8b
jg 0x47c049
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x14]
jg 0x47c1ac
mov dword [ebp - 0x1c], 0x34e2e0f6
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x47c08d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x58c], 0xfff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x47c075
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x47c0a9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1c4], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x47c095
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe6
jg 0x47c234
mov dword [ebp - 0x38], 0x7592e0c8
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x48], 0xfffffff8
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47c0d9
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x47c147
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x580], eax
jne 0x47c0fb
xor eax, eax
cmp dword [ebp - 0x1c0], eax
jne 0x47c0fb
cmp dword [ebp - 0x580], eax
je 0x47c0fd
mov eax, ebx
imul eax, eax, 0xf3
cmp eax, dword [ebp - 0x1c0]
jl 0x47c114
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x47c116
mov edx, ebx
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x14]
jg 0x47c12e
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x1c0], eax
je 0x47c149
mov eax, ebx
mov dword [ebp - 0x1c0], eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
push 0
setle dl
sub edx, dword [ebp - 0x57c]
mov eax, dword [ebp - 0x588]
neg edx
sbb edx, edx
inc edx
imul eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x588]
mov eax, dword [ebp - 0x1c0]
add eax, 0x6833
mov dword [ebp - 0x378], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
pop eax
push 0xffffffffffffffff
pop edx
jle 0x47c0b6
jmp 0x47c232
xor ecx, ecx
mov dword [ebp - 0x30], 0x1f10
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x48], 0x77dc9657
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x378], eax
push 0xfffffffffffffffd
pop edx
cmp eax, edx
setge cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0xb45d
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x30]
setle cl
add edx, ecx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
sub eax, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0x46159332
xor eax, eax
cmp byte [ebp - 0x29], 0
je 0x47c2c8
mov dword [ebp - 4], 0x2e91a04
mov dword [ebp - 4], eax
jmp 0x47c299
cmp byte [ebp - 5], 0
je 0x47c296
push 0x2406
push 0x3da
push eax
push eax
push 0x5d0
push 0x1940
push 0x1e47
push 0x1c5d
push 0x26ee
push 0x1b52
push 0x13d2
push 0x548
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 9
mov byte [ebp - 5], al
je 0x47c24a
cmp byte [ebp - 5], 0
je 0x47c2bb
push 0x5e6
push 0x23e5
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
push eax
push 0x237b
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
push 0
pop eax
jle 0x47bf50
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
je 0x47bb59
jmp 0x47c396
mov dword [ebp - 4], 0
jmp 0x47c301
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x70], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47c2f3
mov dword [ebp - 0x70], 0x17
jmp 0x47c382
mov dword [ebp - 0xc], ebx
or ecx, 0xffffffff
mov dword [ebp - 4], 0
cmp dword [ebp - 4], ebx
jge 0x47c330
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x140], ecx
inc dword [ebp - 4]
jmp 0x47c31c
mov dword [ebp - 0xc], 0
jmp 0x47c379
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0xc]
push 0xffffffffffffffff
mov dword [ebp + eax*4 - 0x140], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0xc]
pop ecx
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x18], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jle 0x47c339
dec dword [ebp - 0x70]
cmp dword [ebp - 0x70], ebx
jne 0x47c30f
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x3c], 0
jne 0x47c3a2
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x47b8e7
dec dword [ebp - 0x3c]
push 0
pop eax
push 3
pop ebx
jns 0x47b0df
xor esi, esi
inc esi
mov dword [ebp - 0x34], 0x1ad386cc
xor edx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 0xb87d0fa5
mov dword [ebp - 0x10], 0xeab3cf81
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], 0xffff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
setl dl
add edx, 0xfffffe88
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setle cl
xor eax, eax
cmp ecx, 0x780e
setl al
imul eax, eax, 0x9e88
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 7
cmp dword [ebp - 0x10], 0xffffffe8
jne 0x47c44f
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47c446
push 0x112f
push eax
push 0x26a6
push 0x4cf
push eax
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
je 0x47c427
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], 0x62d
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47c482
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x75c], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47c46d
xor eax, eax
mov dword [ebp - 0x30], esi
mov edi, 0xa4bc4433
cmp dword [ebp - 0x30], eax
jl 0x47c52b
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
jmp 0x47c4a8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfb4], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47c49b
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x758]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x758]
push 0xfffffffffffffffd
pop eax
sub ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0x51d77f18
cmp ecx, eax
setl dl
cmp edx, 0x1031
jne 0x47c4f4
cmp dword [ebp - 0x38], 0
je 0x47c4f4
mov eax, esi
jmp 0x47c4f6
xor eax, eax
cmp edi, eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff7
jle 0x47c503
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x10]
push 0
mov dword [ebp - 0xfa8], eax
dec dword [ebp - 0x30]
pop eax
push 0xffffffffffffffff
pop ecx
jns 0x47c493
mov dword [ebp - 0x34], 0x1ad386cc
xor edx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 0xb87d0fa5
mov dword [ebp - 0x10], 0xeab3cf81
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], 0xffff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setl dl
add edx, 0xfffffe88
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setle cl
xor eax, eax
cmp ecx, 0x780e
setl al
imul eax, eax, 0x9e88
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 7
cmp dword [ebp - 0x10], 0xffffffe8
jne 0x47c5c0
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47c5b7
push 0x112f
push eax
push 0x26a6
push 0x4cf
push eax
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
je 0x47c598
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47c5e5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x348], 4
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47c5cd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x47c625
mov dword [ebp - 4], 0x8a137b18
xor ebx, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], eax
jl 0x47c60f
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x348], ebx
jne 0x47c60f
dec dword [ebp - 4]
jns 0x47c5fe
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x348], ebx
jne 0x47c623
dec dword [ebp - 0x10]
push 0
pop eax
jns 0x47c5ed
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47c640
push eax
push 0x2358
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x30], 0xe1757117
push 3
mov dword [ebp - 0x30], 0x9f9b3198
mov dword [ebp - 0x30], 0x12
pop edi
cmp dword [ebp - 0x30], 0xffffffed
jl 0x47c6d1
mov dword [ebp - 0x10], 0xceafd94f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jge 0x47c683
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe5c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47c66f
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47c6ac
push eax
push eax
push 0xade
push eax
push 0x12a1
push eax
push 0xb56
push 0x22b4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x47c6cc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe5c], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x47c6b4
xor eax, eax
dec dword [ebp - 0x30]
jmp 0x47c658
mov dword [ebp - 0x3c], eax
mov ecx, 0x928c176b
mov dword [ebp - 0x914], ecx
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x90c], ecx
mov dword [ebp - 0x908], ecx
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x47c750
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47c71e
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47c70a
xor eax, eax
mov dword [ebp - 0xe8], eax
jmp 0x47c743
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47c73d
push 0x200a
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], edi
jle 0x47c726
dec dword [ebp - 0x34]
jns 0x47c700
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x30], 0x14
cmp dword [ebp - 0x30], 0xffffffee
jne 0x47cfab
jmp 0x47c76b
xor eax, eax
mov dword [ebp - 0x24], 0x399841b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47c794
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc6c], 0x102d149f
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47c77b
xor eax, eax
push 7
mov dword [ebp - 0x24], 0xffffffe4
pop ecx
jmp 0x47c81d
mov dword [ebp - 0x20], 0xf7fd1e81
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47c7c7
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc10], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47c7b2
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x47c81a
mov dword [ebp - 0x10], 0xaa29c146
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xc6c], ebx
jne 0x47c818
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x47c813
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xc6c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc64]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc0c], eax
dec dword [ebp - 0x10]
jns 0x47c7ec
dec dword [ebp - 0x20]
jns 0x47c7cf
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jg 0x47c7a0
mov dword [ebp - 0x28], 0xfffffff8
or ebx, 0xffffffff
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x568be135
mov dword [ebp - 0x1c], 0x7059141a
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0x61d594d0
mov dword [ebp - 0x48], 0x9035a60c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x4cdc86d9
mov dword [ebp - 4], eax
jmp 0x47c87e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47c871
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push 0xfffffffffffffff6
pop eax
cmp dword [ebp - 0x34], eax
sbb eax, eax
inc eax
imul eax, eax, 0xbc25
test eax, eax
jne 0x47c89f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd4]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
je 0x47ca52
mov dword [ebp - 0x10], 0xefc6e20b
mov dword [ebp - 0x40], 0x2a55b90c
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x34], 0x454d
mov dword [ebp - 4], 0
jmp 0x47c916
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x888], 0x462d17f4
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47c905
cmp dword [ebp - 0x48], 0
je 0x47c964
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xc], 0
je 0x47c942
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
inc eax
je 0x47c964
mov eax, esi
jmp 0x47c966
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x47c980
cmp dword [ebp - 0x10], eax
je 0x47c980
mov eax, esi
imul eax, eax, 0x37bb
test eax, eax
je 0x47c9b8
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x47ca6a
push 0
push 0
push 0x21a9
push 0x15ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x47ca6a
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0x5ba845d
mov dword [ebp - 0x4c], ebx
xor ebx, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47c9e1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c0], ebx
inc dword [ebp - 4]
jmp 0x47c9cc
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x20]
test eax, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
cmp dword [ebp - 0x48], ecx
jg 0x47ca26
cmp dword [ebp - 0x2c0], ebx
jne 0x47ca2c
mov eax, dword [ebp - 0x888]
mov eax, dword [ebp - 0x14]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c0], eax
jmp 0x47ca6a
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x47ca6a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x40], 0xeab1d6a5
mov dword [ebp - 0x38], ebx
push 0xfffffffffffffffd
mov dword [ebp - 0x38], 0x9dade661
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc], 0
jmp 0x47ca97
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x124], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47ca8a
mov dword [ebp - 0xc], 0
jmp 0x47cab6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xcc], 0xb61b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47caa5
cmp dword [ebp - 0x124], 0
je 0x47cae3
mov dword [ebp - 0x38], 0x7182b474
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x38], eax
jne 0x47cae3
cmp dword [ebp - 0xcc], 0
je 0x47cae3
mov edx, esi
jmp 0x47cae5
xor edx, edx
mov eax, dword [ebp - 0x124]
xor ecx, ecx
mov eax, dword [ebp - 0x124]
cmp edx, eax
sete cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x124]
cmp eax, 0x8f2b
setle cl
sub ecx, 0x1720d700
je 0x47cb2f
cmp dword [ebp - 0xcc], 0
je 0x47cb2f
mov eax, esi
jmp 0x47cb31
xor eax, eax
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0xcc]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x28], 0xffffffe8
jmp 0x47cd7f
mov dword [ebp - 0x518], esi
xor eax, eax
mov dword [ebp - 0x514], esi
mov dword [ebp - 0x510], esi
mov dword [ebp - 0x50c], esi
mov dword [ebp - 0x514], eax
jmp 0x47cbd4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jge 0x47cb99
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe74], 0x6e60b0c
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47cb81
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x47cbce
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47cbb8
push 0x195a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x10]
push 0
mov eax, dword [ebp + eax*4 - 0xe74]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
pop eax
jle 0x47cba2
inc dword [ebp - 0x514]
cmp dword [ebp - 0x514], 0x17
jg 0x47cb76
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x836b16b
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], 0xfb6f65e7
mov dword [ebp - 0x24], 9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47cc16
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfc4], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47cc03
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x10], esi
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x47cc2a
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, esi
setg cl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x47cc6a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xfb8], eax
add eax, 0xffff6363
je 0x47cc91
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x47cc93
mov ecx, esi
jmp 0x47cc95
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, 0x48d327cb
mov byte [ebp - 0x29], al
mov dword [ebp - 0x9b4], ecx
mov dword [ebp - 0x9b0], ecx
mov dword [ebp - 0x9ac], ecx
mov dword [ebp - 0x9a8], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 4], edi
cmp dword [ebp - 4], eax
jl 0x47ccd8
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x9b4], ebx
jne 0x47ccd6
dec dword [ebp - 4]
jns 0x47ccc5
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47ccea
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
or ebx, 0xffffffff
cmp byte [ebp - 0x29], 0
je 0x47cd7c
mov dword [ebp - 0x10], 0xa3df603f
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x47cd23
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1104], 0x124f01c0
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x47cd0a
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47cd34
call dword [sym.imp.KERNEL32.dll_GetACP]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jg 0x47cd75
mov dword [ebp - 0x38], 0xa41449c9
mov dword [ebp - 4], eax
jmp 0x47cd55
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x584], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47cd48
mov dword [ebp - 0x38], 0x67215912
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x584], eax
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], esi
jle 0x47cd3c
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xe
jle 0x47cb54
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x18], 0x35a60c4
mov dword [ebp - 0xc], 0
jmp 0x47cdb0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1d0], 0x540d7f82
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47cd9f
push 2
mov dword [ebp - 0xc], 0
pop ecx
jmp 0x47cdd2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x558], 0xa6c8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47cdc1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x47cf05
mov dword [ebp - 0x10], 0x593c8699
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x1d0], 0xfffffffb
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov eax, dword [ebp + eax*4 - 0x1d0]
imul eax, dword [ebp - 0x1d0]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp ebx, eax
mov eax, dword [ebp - 0xc]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp edx, eax
mov eax, dword [ebp - 0x1c8]
setle cl
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, eax
mov eax, dword [ebp - 0x554]
cmp edx, eax
mov eax, dword [ebp - 0xc]
setle cl
mov eax, dword [ebp + eax*4 - 0x1d0]
imul eax, ecx
neg eax
je 0x47ce72
cmp dword [ebp - 0x554], 0
je 0x47ce72
mov eax, esi
jmp 0x47ce74
xor eax, eax
xor ecx, ecx
cmp eax, 0xf5eb
mov eax, dword [ebp - 0xc]
sete cl
mov dword [ebp + eax*4 - 0x1d0], ecx
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], 0
jl 0x47cefc
xor ebx, ebx
mov dword [ebp - 0x38], 7
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x1d0], ebx
jne 0x47ceed
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x554]
mov eax, dword [ebp - 0x38]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
jne 0x47ced2
xor ebx, ebx
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x47ced4
mov ecx, esi
mov eax, dword [ebp - 0xc]
mov edx, 0x86695cd1
mov dword [ebp + eax*4 - 0x1d0], edx
cmp ecx, edx
je 0x47ceed
xor eax, eax
xor ebx, ebx
jmp 0x47ceef
mov eax, esi
inc eax
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x10]
jns 0x47ce97
dec dword [ebp - 0xc]
jns 0x47cde4
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg esi
mov dword [ebp - 0x40], eax
sbb esi, esi
neg esi
cmp dword [ebp - 0x40], 0
jne 0x47cf26
cmp dword [ebp - 0x30], 0xcb27
jg 0x47cf26
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
xor ecx, ecx
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
push 0xfffffffffffffffd
setle cl
imul eax, ecx, 0x507a
xor ecx, ecx
cmp eax, 0xca3e
setl cl
or eax, 0xffffffff
cmp ecx, eax
pop ecx
sbb eax, eax
neg eax
cmp eax, ecx
push 1
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, dword [ebp - 0x28]
cmp esi, eax
pop esi
setne cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
or eax, 0xffffffff
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffee
je 0x47c769
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x30]
push 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0xc
pop ebx
cmp dword [ebp - 0x30], 0x30
je 0x47d034
mov dword [ebp - 0xc], 0
jmp 0x47cfe4
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xaf8], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47cfd7
mov dword [ebp - 0xc], 0
jmp 0x47d003
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x610], 0x45625132
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47cff2
mov dword [ebp - 0x10], 0
jmp 0x47d02a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xaf8]
sub eax, dword [ebp - 0xaf8]
mov dword [ebp - 0x610], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x47d011
inc dword [ebp - 0x30]
jmp 0x47cfc8
mov dword [ebp - 0x48], 0xf75d
xor eax, eax
mov dword [ebp - 0x4c], 0x23498e64
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], 0xc7a8cf1d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47d070
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfdc], 0x7d711e7b
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47d057
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x47d10b
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], 0xfff6
mov dword [ebp - 4], eax
jmp 0x47d09c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x834], 0xd1ad67a4
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47d08b
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0
je 0x47d0ad
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x40]
xor ecx, ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x830]
imul edx, eax
mov eax, dword [ebp - 0x34]
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x34]
cmp dword [ebp - 0x40], ecx
jg 0x47d0da
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xfdc], eax
je 0x47d0dc
mov ecx, esi
mov eax, dword [ebp - 0x830]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x5dc6
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x830], ecx
jmp 0x47d11a
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d11c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
mov dword [ebp - 0x24], 0x2ba39464
push 5
pop ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], ecx
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47d15c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c8], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47d147
xor eax, eax
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x47d1b6
mov dword [ebp - 0x10], 0xe63e
dec dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x47d1a9
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d1a6
push 0x5ee
push 0x1a2d
push 0x97a
push 0x545
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x47d173
dec dword [ebp - 0x24]
jns 0x47d164
push 5
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xb
jne 0x47d1ef
mov dword [ebp - 4], eax
jmp 0x47d1d1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd98], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47d1c4
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xd94], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xb
push 0
pop eax
je 0x47d1bf
mov dword [ebp - 0x1c], 0x62fd41e5
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x8070ade2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x4b666a75
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x4c000111
mov dword [ebp - 0x1c], 0x14eb4c8f
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x47d245
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x105c], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x47d22d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x47d265
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10d4], 0x20b95ae6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x47d24d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x47d281
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7ac], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x47d26d
xor eax, eax
dec dword [ebp - 0x7ac]
mov dword [ebp - 0x3c], 0x3342eb9
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], 0x12
jmp 0x47d315
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0xc9a57b5b
mov dword [ebp - 0x1c], 0x47c4d14
mov dword [ebp - 0x38], 0xfffc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x47d2d7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1218], 0x951a
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x47d2be
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x47d30a
mov dword [ebp - 0x34], 0xa6deec54
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x47d307
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d302
push eax
push 0x154f
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x47d2eb
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x47d2dc
dec dword [ebp - 0x38]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
jl 0x47d29d
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x50], 0x9acd4098
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x47d357
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1ec], 0x342eb90d
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47d33f
xor eax, eax
mov dword [ebp - 0x1ec], 0xfffffff8
jmp 0x47d3c9
mov dword [ebp - 0x10], 0x9aed23b6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xa
jne 0x47d3c3
mov dword [ebp - 4], eax
jmp 0x47d389
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x76c], 0xc902dafb
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x47d378
mov eax, dword [ebp - 0x1e8]
dec eax
je 0x47d39a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x768]
xor eax, eax
cmp dword [ebp - 0x1ec], eax
jne 0x47d3b2
cmp dword [ebp - 0x768], eax
je 0x47d3b4
mov eax, esi
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
push 0
pop eax
je 0x47d373
inc dword [ebp - 0x1ec]
cmp dword [ebp - 0x1ec], 0x16
jle 0x47d363
mov ecx, 0xb4ffb871
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c8], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47d425
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x39c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47d411
xor eax, eax
mov dword [ebp - 0x434], eax
jmp 0x47d47a
mov dword [ebp - 0x20], 0x4ab2
dec dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x47d474
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d44f
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [ebp - 0x434]
xor ebx, ebx
push ebx
mov ecx, dword [ebp + eax*4 - 0x39c]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x39c], ecx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x47d43f
xor eax, eax
inc dword [ebp - 0x434]
cmp dword [ebp - 0x434], eax
jle 0x47d42d
dec dword [ebp - 0x7d4]
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x18], 0x48e01afe
mov dword [ebp - 0x1c], 0xe0bcd8c4
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d4b0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d4cd
push eax
push eax
push eax
push eax
push eax
push eax
push 0x5db
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jge 0x47d4f3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48c], 0xe6a3735b
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47d4db
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d507
push 0x119d
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x484]
mov eax, dword [ebp - 0x10]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sete dl
xor ebx, ebx
cmp edx, 0xfffffff9
setl bl
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x484]
mov eax, dword [ebp - 0x484]
mov eax, dword [ebp - 0x484]
cmp ecx, eax
mov eax, dword [ebp - 0x48c]
sbb edx, edx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xfffffff8
setg al
or ecx, 0xffffffff
mov dword [ebp - 0x48c], eax
xor eax, eax
mov dword [ebp - 0x24], 0xdc630de2
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x4c], 0x7a772be7
mov dword [ebp - 0x3c], 0xb
cmp dword [ebp - 0x3c], 7
jle 0x47d5af
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d5a3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jg 0x47d592
or ecx, 0xffffffff
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff3
je 0x47d6c4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], 0xe177c422
mov dword [ebp - 4], ecx
mov dword [ebp - 0x38], 0xdf11caf1
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x2522abf7
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xd06721f8
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x3c]
jge 0x47d607
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x47d607
mov esi, eax
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ebx, ebx
cmp edx, esi
setne bl
xor ecx, ecx
add ebx, 4
cmp ebx, eax
mov eax, dword [ebp - 4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x34]
cmp ecx, 0xfecafe8
je 0x47d67d
cmp dword [ebp - 0x34], 0
je 0x47d67d
xor esi, esi
inc esi
mov edx, esi
jmp 0x47d682
xor esi, esi
xor edx, edx
inc esi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
push 0
sete cl
sub ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, 0x5dbf
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff3
pop eax
push 0xffffffffffffffff
pop ecx
jne 0x47d5bc
mov dword [ebp - 0x64], 0x1495dd68
push 4
pop ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x38], 0x60813c27
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x4c], 0x4a9c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x47d71d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5a0], 0x7862
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x47d704
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x47d73d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5d4], 0x95520530
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47d725
xor eax, eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], esi
jg 0x47d836
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47d76f
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x350], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47d75d
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp + eax*4 - 0x5a0]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x220]
jne 0x47d78e
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x47d790
mov edx, esi
mov esi, dword [ebp - 0x5a0]
xor ecx, ecx
mov eax, dword [ebp - 0x21c]
xor ebx, ebx
push 0xfffffffffffffff6
mov dword [ebp + eax*4 - 0x5a0], esi
mov dword [ebp - 0x350], ebx
mov eax, dword [ebp - 0x21c]
cmp edx, eax
mov eax, dword [ebp - 0x10]
sete cl
xor edx, edx
add ecx, 4
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0xf7b1
pop ecx
push ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
add eax, 2
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp eax, 0xa9ef
setg cl
xor esi, esi
mov dword [ebp - 0x10], ecx
inc esi
mov eax, dword [ebp - 0x350]
inc dword [ebp - 0x21c]
pop eax
cmp dword [ebp - 0x21c], esi
jle 0x47d74f
push 4
xor eax, eax
pop ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x38], 0x60813c27
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x4c], 0x4a9c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x47d888
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5ac], 0x7862
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x47d86f
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x47d8a8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x55c], 0x95520530
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47d890
xor eax, eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], esi
jg 0x47d9a1
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47d8da
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x384], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47d8c8
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp + eax*4 - 0x5ac]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x240]
jne 0x47d8f9
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x47d8fb
mov edx, esi
mov esi, dword [ebp - 0x5ac]
xor ecx, ecx
mov eax, dword [ebp - 0x23c]
xor ebx, ebx
push 0xfffffffffffffff6
mov dword [ebp + eax*4 - 0x5ac], esi
mov dword [ebp - 0x384], ebx
mov eax, dword [ebp - 0x23c]
cmp edx, eax
mov eax, dword [ebp - 0x10]
sete cl
xor edx, edx
add ecx, 4
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0xf7b1
pop ecx
push ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
add eax, 2
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp eax, 0xa9ef
setg cl
xor esi, esi
mov dword [ebp - 0x10], ecx
inc esi
mov eax, dword [ebp - 0x384]
inc dword [ebp - 0x23c]
pop eax
cmp dword [ebp - 0x23c], esi
jle 0x47d8ba
push 4
xor eax, eax
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x47d9c1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xcb8], 0x7b7e80d6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x47d9a9
xor eax, eax
mov dword [ebp - 0x1c], 0x5d6c05ba
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d9dd
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47d9fb
push 0x244a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x47da1b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1f8], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47da03
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 0x4ddc8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x47da45
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x120], 0x3cdf98a5
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x47da2d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x47dbec
mov dword [ebp - 0x14], 0xefc07e17
mov dword [ebp - 0x34], 0x87a7525d
mov dword [ebp - 4], 0x9cf13e13
mov dword [ebp - 0x4c], 0xfff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x47db38
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x47db29
mov dword [ebp - 4], eax
jmp 0x47da9e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8c], 0x67656540
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47da8d
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x120], ebx
jne 0x47db29
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push ebx
mov eax, dword [ebp + eax*4 - 0x120]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x120]
cmp eax, edx
mov eax, dword [ebp - 4]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
imul ecx, dword [ebp - 0x30]
cmp ecx, 5
setne al
mov dword [ebp - 0xe84], eax
dec dword [ebp - 0x30]
pop eax
jns 0x47da88
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x47da75
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x47dbe9
mov dword [ebp - 4], eax
jmp 0x47db5a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb0c], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x47db49
mov eax, dword [ebp - 0xb08]
xor ecx, ecx
cmp eax, 0xc66883ce
setne cl
xor edx, edx
cmp ecx, 0x9919
setle dl
xor eax, eax
cmp edx, 0x14a5
setne al
xor edx, edx
imul ecx, eax, 0x9562
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb08]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x10]
add ecx, 6
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 4]
sub ecx, eax
je 0x47dbd0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
push 0
mov dword [ebp + eax*4 - 0x120], ecx
dec dword [ebp - 0x14]
pop eax
jns 0x47db44
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x47da4d
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x13
jne 0x47eecf
mov dword [ebp - 0x30], 0x4a0d
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], 0xfffc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x47dc38
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x8c], 0x3dc99cdf
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47dc20
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47dc4e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6c0], 0x6d9e96b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47dc3d
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
neg eax
je 0x47dc8b
mov eax, dword [ebp - 0x8c]
neg eax
cmp eax, dword [ebp - 0x8c]
jge 0x47dc7d
xor eax, eax
cmp eax, dword [ebp - 0x8c]
je 0x47dc87
mov eax, esi
cmp eax, dword [ebp - 0x8c]
jne 0x47dc8b
xor edx, edx
mov dword [ebp - 0x30], 0xb95
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c0]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x6b8], 0x2ff5
jg 0x47dcea
cmp dword [ebp - 0x8c], 0
je 0x47dcea
xor ecx, ecx
mov eax, dword [ebp - 0x6c0]
imul eax, ecx
cmp eax, dword [ebp - 0x6c0]
je 0x47dde2
mov dword [ebp - 4], 8
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x34], 0x4543beb7
mov dword [ebp - 0x40], 0xec79cf18
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x10], 0x1d89e177
mov dword [ebp - 0x1c], 0xf314d41b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x47ef22
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x77c], 0x734f094
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x47ef09
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x47ef42
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xeec], 0x1d91
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x47ef2a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x47ef58
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf04], 0x48968f25
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x47ef47
dec dword [ebp - 0x44]
jne 0x47ef72
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x778], eax
test eax, eax
je 0x47ef82
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x47ef82