Function at 0x47d0d6
Capabilities:
Accept command line arguments
Capture screenshot
Connect pipe
Create pipe
Create thread
Enumerate gui resources
Get common file path
Get geographical location
Get graphical window text
Get thread local storage value
Hide graphical window
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3aec
call fcn.004ac770
push esi
push edi
mov dword [ebp - 0x9c4], 0
mov dword [ebp - 0x9bc], 0
jmp 0x47d108
mov eax, dword [ebp - 0x9bc]
inc eax
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x9bc], 1
jge 0x47d124
mov eax, dword [ebp - 0x9bc]
mov dword [ebp + eax*4 - 0x3784], 0x5baf43b
jmp 0x47d0fb
mov dword [ebp - 0x9c4], 0
jmp 0x47d13d
mov eax, dword [ebp - 0x9c4]
dec eax
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0x9c4], 0
jl 0x47d188
mov byte [ebp - 0x441], 0
movzx eax, byte [ebp - 0x441]
test eax, eax
je 0x47d16e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x47d186
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x47d130
mov byte [ebp - 0x435], 0
movzx eax, byte [ebp - 0x435]
test eax, eax
je 0x47d1a7
push 0x18f1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 0x168], 0x3901
mov dword [ebp - 0x448], 0x9338886a
mov dword [ebp - 0xa48], 5
mov dword [ebp - 0x2b7c], 0
mov dword [ebp - 0x2b78], 0
mov dword [ebp - 0x2b74], 0
mov dword [ebp - 0x2b70], 0
mov dword [ebp - 0x2850], 0x4b3bebda
mov dword [ebp - 0x3138], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x47d21a
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 4
jge 0x47d236
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x2534], 0x1a6b719d
jmp 0x47d20d
mov dword [ebp - 0x178], 0
jmp 0x47d24f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x47d26b
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x2c70], 0xac8c
jmp 0x47d242
cmp dword [ebp - 0x168], 0
jne 0x47d27f
push 4
pop eax
test eax, eax
je 0x47d340
cmp dword [ebp - 0x168], 0xfffb
jne 0x47d297
mov dword [ebp - 0x19e8], 1
jmp 0x47d29e
and dword [ebp - 0x19e8], 0
mov eax, dword [ebp - 0x19e8]
sub eax, dword [ebp - 0x168]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x2534]
jne 0x47d2d2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2534], 0
jne 0x47d2d2
and dword [ebp - 0x2394], 0
jmp 0x47d2dc
mov dword [ebp - 0x2394], 1
mov eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x2394]
cmp eax, dword [ebp - 0x168]
jne 0x47d2fc
mov dword [ebp - 0x239c], 1
jmp 0x47d303
and dword [ebp - 0x239c], 0
mov eax, dword [ebp - 0x448]
imul eax, dword [ebp - 0x239c]
cmp eax, dword [ebp - 0x168]
jl 0x47d324
mov dword [ebp - 0x23a4], 1
jmp 0x47d32b
and dword [ebp - 0x23a4], 0
cmp dword [ebp - 0x23a4], 0
je 0x47d340
mov dword [ebp - 0x23ac], 1
jmp 0x47d347
and dword [ebp - 0x23ac], 0
cmp dword [ebp - 0x23ac], 0xf687
jg 0x47d35f
mov dword [ebp - 0x23b4], 1
jmp 0x47d366
and dword [ebp - 0x23b4], 0
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x23b4], eax
je 0x47d380
mov dword [ebp - 0x23bc], 1
jmp 0x47d387
and dword [ebp - 0x23bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2534]
cmp dword [ebp - 0x23bc], eax
jle 0x47d3a8
mov dword [ebp - 0x23c4], 1
jmp 0x47d3af
and dword [ebp - 0x23c4], 0
mov eax, dword [ebp - 0x23c4]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x47d3d0
mov dword [ebp - 0x2648], 1
jmp 0x47d3d7
and dword [ebp - 0x2648], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2534]
mov dword [ebp - 0x3140], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2534]
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0xa48], 0xffffffff
jae 0x47d411
mov dword [ebp - 0x23cc], 1
jmp 0x47d418
and dword [ebp - 0x23cc], 0
mov eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x23cc]
cmp dword [ebp - 0x168], eax
jl 0x47d438
mov dword [ebp - 0x23d4], 1
jmp 0x47d43f
and dword [ebp - 0x23d4], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x23d4], eax
jl 0x47d459
mov dword [ebp - 0x23dc], 1
jmp 0x47d460
and dword [ebp - 0x23dc], 0
mov eax, dword [ebp - 0x23dc]
sub eax, 0x32116b34
jne 0x47d47b
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2534], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x2b7c]
mov dword [ebp + ecx - 0x2b7c], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x23e4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x23e4]
mov dword [ebp + eax - 0x2c70], ecx
cmp dword [ebp - 0x23e4], 0
je 0x47d536
mov dword [ebp - 0x2830], 0x9fa18394
mov dword [ebp - 0x2840], 0xb6d700d1
mov dword [ebp - 0x9cc], 0
jmp 0x47d4ea
mov eax, dword [ebp - 0x9cc]
inc eax
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 1
jge 0x47d506
mov eax, dword [ebp - 0x9cc]
mov dword [ebp + eax*4 - 0x2838], 0xffffffff
jmp 0x47d4dd
mov eax, dword [ebp - 0x2830]
mov dword [ebp - 0x23ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x23ec]
mov dword [ebp + eax - 0x2838], ecx
mov eax, dword [ebp - 0x23ec]
mov dword [ebp - 0x2840], eax
jmp 0x47d745
mov dword [ebp - 0x630], 1
mov dword [ebp - 0xbf0], 2
mov dword [ebp - 0x2858], 0
mov dword [ebp - 0x2860], 0x12446b8c
or eax, 0xffffffff
je 0x47d64d
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xa48]
cmp dword [ebp + eax - 0x2534], ecx
jge 0x47d588
mov dword [ebp - 0x23f4], 1
jmp 0x47d58f
and dword [ebp - 0x23f4], 0
mov eax, dword [ebp - 0x630]
cmp dword [ebp - 0x23f4], eax
jge 0x47d5a9
mov dword [ebp - 0x2848], 1
jmp 0x47d5b0
and dword [ebp - 0x2848], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x3148], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2534]
mov dword [ebp - 0x3150], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2534]
mov dword [ebp - 0x3158], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c70]
cmp dword [ebp - 0x2850], eax
jge 0x47d603
mov dword [ebp - 0x2480], 1
jmp 0x47d60a
and dword [ebp - 0x2480], 0
cmp dword [ebp - 0x2480], 0xbcdcec45
je 0x47d622
mov dword [ebp - 0x2488], 1
jmp 0x47d629
and dword [ebp - 0x2488], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b7c]
imul eax, dword [ebp - 0x2488]
test eax, eax
je 0x47d64d
mov dword [ebp - 0x2490], 1
jmp 0x47d654
and dword [ebp - 0x2490], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2534]
cmp dword [ebp - 0x2490], eax
jne 0x47d675
mov dword [ebp - 0x2498], 1
jmp 0x47d67c
and dword [ebp - 0x2498], 0
mov eax, dword [ebp - 0x2498]
mov dword [ebp - 0xbf0], eax
cmp dword [ebp - 0xbf0], 0
jne 0x47d69a
cmp dword [ebp - 0xbf0], 0
je 0x47d6af
cmp dword [ebp - 0x448], 0
je 0x47d6af
mov dword [ebp - 0x24a0], 1
jmp 0x47d6b6
and dword [ebp - 0x24a0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24a0]
mov dword [ebp + eax - 0x2b7c], ecx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x3160], eax
cmp dword [ebp - 0x2858], 0x97ea
jne 0x47d6ed
mov dword [ebp - 0x24c8], 1
jmp 0x47d6f4
and dword [ebp - 0x24c8], 0
mov eax, dword [ebp - 0x630]
cmp eax, dword [ebp - 0x24c8]
jne 0x47d70e
mov dword [ebp - 0x24d0], 1
jmp 0x47d715
and dword [ebp - 0x24d0], 0
mov eax, dword [ebp - 0x24d0]
sub eax, dword [ebp - 0x630]
cmp eax, 8
jbe 0x47d732
mov dword [ebp - 0x24d8], 1
jmp 0x47d739
and dword [ebp - 0x24d8], 0
mov eax, dword [ebp - 0x24d8]
mov dword [ebp - 0x2860], eax
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x9d4], 0
jmp 0x47d768
mov eax, dword [ebp - 0x9d4]
inc eax
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 1
jge 0x47d784
mov eax, dword [ebp - 0x9d4]
mov dword [ebp + eax*4 - 0xbf8], 0x4a8c6a53
jmp 0x47d75b
mov dword [ebp - 0x118], 0
jmp 0x47d79d
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x47da0a
mov dword [ebp - 0x5c4], 5
mov dword [ebp - 0x5c4], 0
jmp 0x47d7cd
mov eax, dword [ebp - 0x5c4]
dec eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0
jl 0x47da05
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x638], 0
jmp 0x47d7fd
mov eax, dword [ebp - 0x638]
dec eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jl 0x47da00
mov dword [ebp - 0x648], 0x66c93ee
mov dword [ebp - 0x2868], 0x23cea2ff
mov dword [ebp - 0x648], 0
jmp 0x47d837
mov eax, dword [ebp - 0x648]
dec eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
jl 0x47d9fb
mov dword [ebp - 0x640], 0x13717be9
mov dword [ebp - 0x640], 0
jmp 0x47d867
mov eax, dword [ebp - 0x640]
dec eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jl 0x47d9f6
mov dword [ebp - 0x330], 0x62b000c
mov dword [ebp - 0x1c94], 1
mov dword [ebp - 0x330], 0
jmp 0x47d8a1
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jg 0x47d9f1
mov eax, dword [ebp - 0x330]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ebp + ecx*4 - 0xbf8]
mov edx, dword [ebp - 0x118]
imul ecx, dword [ebp + edx*4 - 0xbf8]
cmp dword [ebp + eax*4 - 0xbf8], ecx
jg 0x47d8e4
mov dword [ebp - 0xcec], 1
jmp 0x47d8eb
and dword [ebp - 0xcec], 0
cmp dword [ebp - 0x330], 0x58099740
je 0x47d903
mov dword [ebp - 0x24e0], 1
jmp 0x47d90a
and dword [ebp - 0x24e0], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x24e0], eax
jle 0x47d924
mov dword [ebp - 0x24e8], 1
jmp 0x47d92b
and dword [ebp - 0x24e8], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x24e8], eax
jge 0x47d945
mov dword [ebp - 0x24f0], 1
jmp 0x47d94c
and dword [ebp - 0x24f0], 0
mov eax, dword [ebp - 0x24f0]
mov dword [ebp - 0x1c94], eax
mov eax, dword [ebp - 0x1c94]
cmp dword [ebp - 0xcec], eax
jl 0x47d972
mov dword [ebp - 0x1c9c], 1
jmp 0x47d979
and dword [ebp - 0x1c9c], 0
mov eax, dword [ebp - 0x640]
cmp dword [ebp - 0x1c9c], eax
jle 0x47d993
mov dword [ebp - 0xcf4], 1
jmp 0x47d99a
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0x648]
cmp dword [ebp - 0xcf4], eax
jl 0x47d9b4
mov dword [ebp - 0x1ca4], 1
jmp 0x47d9bb
and dword [ebp - 0x1ca4], 0
cmp dword [ebp - 0x1ca4], 0xffff
jb 0x47d9d3
mov dword [ebp - 0xcfc], 1
jmp 0x47d9da
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0x5c4]
add eax, dword [ebp - 0xcfc]
mov dword [ebp - 0x2868], eax
jmp 0x47d894
jmp 0x47d85a
jmp 0x47d82a
jmp 0x47d7f0
jmp 0x47d7c0
jmp 0x47d790
mov dword [ebp - 0x118], 0
jmp 0x47da23
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
jl 0x47da42
mov dword [ebp - 0x2870], 0xffffffff
mov dword [ebp - 0x2870], 5
jmp 0x47da16
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x34], 0x4b4e1265
mov dword [ebp - 0x9dc], 0
jmp 0x47da6c
mov eax, dword [ebp - 0x9dc]
inc eax
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 2
jge 0x47da88
mov eax, dword [ebp - 0x9dc]
mov dword [ebp + eax*4 - 0x2598], 0x67ee
jmp 0x47da5f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3168], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jl 0x47daa8
mov dword [ebp - 0x1cac], 1
jmp 0x47daaf
and dword [ebp - 0x1cac], 0
cmp dword [ebp - 0x1cac], 1
je 0x47dac4
mov dword [ebp - 0xd04], 1
jmp 0x47dacb
and dword [ebp - 0xd04], 0
cmp dword [ebp - 0xd04], 0x4307
jl 0x47dae3
mov dword [ebp - 0x1cb4], 1
jmp 0x47daea
and dword [ebp - 0x1cb4], 0
cmp dword [ebp - 0x1cb4], 0xfffffffb
jb 0x47daff
mov dword [ebp - 0xd0c], 1
jmp 0x47db06
and dword [ebp - 0xd0c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2598]
cmp dword [ebp - 0xd0c], eax
jle 0x47db27
mov dword [ebp - 0x1cbc], 1
jmp 0x47db2e
and dword [ebp - 0x1cbc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1cbc]
sub ecx, dword [ebp + eax - 0x2598]
jne 0x47db4f
mov dword [ebp - 0xd14], 1
jmp 0x47db56
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0xd14]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jbe 0x47db93
mov dword [ebp - 0x34], 0
jmp 0x47db78
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x47db8e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x2598], 0x3d0b
jmp 0x47db71
jmp 0x47dcf5
mov dword [ebp - 0x2dac], 1
mov dword [ebp - 0x2da8], 1
mov dword [ebp - 0x2da4], 1
mov dword [ebp - 0x2da0], 1
mov dword [ebp - 0xc08], 0xf26af903
mov dword [ebp - 0x34], 1
jmp 0x47dbd5
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x47dcdd
mov dword [ebp - 0xc00], 0
mov dword [ebp - 0x2878], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2dac], 0x894ff545
mov dword [ebp - 0xc00], 0x894ff545
cmp dword [ebp - 0xc00], 0
jne 0x47dc29
cmp dword [ebp - 0xc00], 0
jne 0x47dc29
and dword [ebp - 0x1cc4], 0
jmp 0x47dc33
mov dword [ebp - 0x1cc4], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3170], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2598]
cmp dword [ebp - 0x2878], eax
jl 0x47dc5d
mov dword [ebp - 0xd1c], 1
jmp 0x47dc64
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x1cc4]
cmp eax, dword [ebp - 0xd1c]
jle 0x47dc7e
mov dword [ebp - 0x1ccc], 1
jmp 0x47dc85
and dword [ebp - 0x1ccc], 0
mov eax, dword [ebp - 0x1ccc]
sub eax, dword [ebp - 0xc08]
cmp eax, dword [ebp - 0xc08]
jle 0x47dca5
mov dword [ebp - 0xd24], 1
jmp 0x47dcac
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0xc08], eax
mov byte [ebp - 0x3f1], 0
movzx eax, byte [ebp - 0x3f1]
test eax, eax
je 0x47dcd8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x47dbce
mov byte [ebp - 0x437], 0
movzx eax, byte [ebp - 0x437]
test eax, eax
je 0x47dcf5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x2880], 0x99ea7eb8
mov dword [ebp - 0x230], 0
jmp 0x47dd18
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x47dd34
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x2cb8], 0xf9b3
jmp 0x47dd0b
mov dword [ebp - 0x230], 0
jmp 0x47dd4d
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x47dd69
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x140], 0x5c8094a
jmp 0x47dd40
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x140], 1
jmp 0x47dd97
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x140], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jl 0x47dedd
mov dword [ebp - 0x1cd4], 2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
dec eax
mov dword [ebp - 0x1cd4], eax
mov eax, dword [ebp - 0x1cd4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x140]
cmp eax, 0x69393dda
jge 0x47ddef
mov dword [ebp - 0xd2c], 1
jmp 0x47ddf6
and dword [ebp - 0xd2c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
cmp dword [ebp - 0xd2c], eax
je 0x47de17
mov dword [ebp - 0x1cdc], 1
jmp 0x47de1e
and dword [ebp - 0x1cdc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
mov eax, dword [ebp + eax*4 - 0x2cb8]
cmp eax, dword [ebp - 0x1cdc]
jle 0x47de46
mov dword [ebp - 0xd34], 1
jmp 0x47de4d
and dword [ebp - 0xd34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
imul eax, dword [ebp - 0xd34]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x140]
cmp eax, dword [ebp + ecx*4 - 0x2cb8]
jne 0x47de83
mov dword [ebp - 0x1ce4], 1
jmp 0x47de8a
and dword [ebp - 0x1ce4], 0
mov eax, dword [ebp - 0x1ce4]
dec eax
dec eax
jne 0x47dea6
mov eax, 0x8c53
test eax, eax
jne 0x47dea6
and dword [ebp - 0xd3c], 0
jmp 0x47deb0
mov dword [ebp - 0xd3c], 1
cmp dword [ebp - 0xd3c], 0xfffffff9
je 0x47dec5
mov dword [ebp - 0x1cec], 1
jmp 0x47decc
and dword [ebp - 0x1cec], 0
mov eax, dword [ebp - 0x1cec]
mov dword [ebp - 0x2880], eax
jmp 0x47dd7c
mov dword [ebp - 0x9e4], 0
jmp 0x47def6
mov eax, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x9e4], 1
jge 0x47df12
mov eax, dword [ebp - 0x9e4]
mov dword [ebp + eax*4 - 0x3178], 0x5baf43b
jmp 0x47dee9
mov dword [ebp - 0x628], 0xe2799ac7
mov dword [ebp - 0x628], 3
jmp 0x47df35
mov eax, dword [ebp - 0x628]
dec eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0xffffffe2
jge 0x47df84
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x540], 0
jmp 0x47df61
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0x1d
je 0x47df77
cmp dword [ebp - 0x628], 0
je 0x47df75
jmp 0x47df77
jmp 0x47df54
cmp dword [ebp - 0x540], 0
je 0x47df82
jmp 0x47df84
jmp 0x47df28
mov dword [ebp - 0x9ec], 0
jmp 0x47df9d
mov eax, dword [ebp - 0x9ec]
dec eax
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x9ec], 0
jl 0x47f679
mov dword [ebp - 0x544], 0x682c5a4e
mov dword [ebp - 0x1d74], 0x9673c824
mov dword [ebp - 0x3180], 0xd9aad11c
mov dword [ebp - 0xdcc], 0
mov dword [ebp - 0x180], 0
jmp 0x47dfeb
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x47e007
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x658], 0x102071b1
jmp 0x47dfde
mov dword [ebp - 0x180], 0
jmp 0x47e020
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x47e03c
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x2400], 5
jmp 0x47e013
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x658], 0
je 0x47e6d4
mov dword [ebp - 0xc10], 1
mov dword [ebp - 0x88], 0xa421e0b
mov dword [ebp - 0x8bc], 0
jmp 0x47e07d
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 2
jge 0x47e099
mov eax, dword [ebp - 0x8bc]
mov dword [ebp + eax*4 - 0x284], 0x1013923c
jmp 0x47e070
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x658]
mov dword [ebp - 0x3188], eax
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x3190], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x658]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x658]
jl 0x47e0e1
mov dword [ebp - 0xd44], 1
jmp 0x47e0e8
and dword [ebp - 0xd44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
cmp dword [ebp - 0xd44], eax
jg 0x47e109
mov dword [ebp - 0x1cf4], 1
jmp 0x47e110
and dword [ebp - 0x1cf4], 0
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0x1cf4], eax
jg 0x47e12a
mov dword [ebp - 0xd4c], 1
jmp 0x47e131
and dword [ebp - 0xd4c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0xd4c], eax
jg 0x47e152
mov dword [ebp - 0x1cfc], 1
jmp 0x47e159
and dword [ebp - 0x1cfc], 0
mov eax, dword [ebp - 0x1cfc]
mov dword [ebp - 0x88], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0x88], eax
jle 0x47e186
mov dword [ebp - 0xd54], 1
jmp 0x47e18d
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xc10]
cmp eax, dword [ebp - 0xd54]
jg 0x47e1a7
mov dword [ebp - 0x1d04], 1
jmp 0x47e1ae
and dword [ebp - 0x1d04], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d04]
mov dword [ebp + eax - 0x2400], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
mov dword [ebp - 0x3198], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x284]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x284]
jne 0x47e209
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x284], 0
jne 0x47e209
and dword [ebp - 0xd5c], 0
jmp 0x47e213
mov dword [ebp - 0xd5c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp eax, dword [ebp - 0xd5c]
jge 0x47e234
mov dword [ebp - 0x1d0c], 1
jmp 0x47e23b
and dword [ebp - 0x1d0c], 0
mov eax, dword [ebp - 0x1d0c]
neg eax
je 0x47e24e
mov eax, 0xd08e1597
test eax, eax
jne 0x47e26a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x658], 0
je 0x47e26a
mov dword [ebp - 0xd64], 1
jmp 0x47e271
and dword [ebp - 0xd64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2400]
cmp dword [ebp - 0xd64], eax
jne 0x47e29f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x284], 0
jne 0x47e29f
and dword [ebp - 0x1d14], 0
jmp 0x47e2a9
mov dword [ebp - 0x1d14], 1
cmp dword [ebp - 0x1d14], 0xc5c2f002
jae 0x47e2c1
mov dword [ebp - 0xd6c], 1
jmp 0x47e2c8
and dword [ebp - 0xd6c], 0
cmp dword [ebp - 0xd6c], 1
ja 0x47e2dd
mov dword [ebp - 0x1d1c], 1
jmp 0x47e2e4
and dword [ebp - 0x1d1c], 0
cmp dword [ebp - 0x1d1c], 0xfffffff6
je 0x47e2f9
mov dword [ebp - 0xd74], 1
jmp 0x47e300
and dword [ebp - 0xd74], 0
cmp dword [ebp - 0xd74], 0xffff
je 0x47e318
mov dword [ebp - 0x1d24], 1
jmp 0x47e31f
and dword [ebp - 0x1d24], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
add eax, dword [ebp - 0x1d24]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x284]
jle 0x47e34d
mov dword [ebp - 0xd7c], 1
jmp 0x47e354
and dword [ebp - 0xd7c], 0
cmp dword [ebp - 0xd7c], 0xa335c22c
ja 0x47e36c
mov dword [ebp - 0x1d2c], 1
jmp 0x47e373
and dword [ebp - 0x1d2c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0x1d2c], eax
jl 0x47e394
mov dword [ebp - 0xd84], 1
jmp 0x47e39b
and dword [ebp - 0xd84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0xd84], eax
jne 0x47e3bc
mov dword [ebp - 0x1d34], 1
jmp 0x47e3c3
and dword [ebp - 0x1d34], 0
mov eax, dword [ebp - 0x1d34]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x284]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x284]
jge 0x47e3fd
mov dword [ebp - 0xd8c], 1
jmp 0x47e404
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xd8c], eax
jle 0x47e66b
mov dword [ebp - 0xd94], 0x67f3e8e0
mov dword [ebp - 0x1d4c], 0xa919e541
mov dword [ebp - 0x88], 0
jmp 0x47e443
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x47e669
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp + ecx*4 - 0x284]
cmp dword [ebp + eax*4 - 0x284], ecx
jle 0x47e478
mov dword [ebp - 0xdac], 1
jmp 0x47e47f
and dword [ebp - 0xdac], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2400]
cmp dword [ebp + eax - 0x2400], ecx
jl 0x47e4a7
mov dword [ebp - 0x1d3c], 1
jmp 0x47e4ae
and dword [ebp - 0x1d3c], 0
mov eax, dword [ebp - 0x1d3c]
add eax, 0xfffe
cmp eax, 0xac9fd407
je 0x47e4ce
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x284], 0
cmp dword [ebp - 0xd94], 2
jle 0x47e4e3
mov dword [ebp - 0x1d44], 1
jmp 0x47e4ea
and dword [ebp - 0x1d44], 0
mov eax, dword [ebp - 0xd94]
cmp dword [ebp - 0x1d44], eax
jg 0x47e504
mov dword [ebp - 0xd9c], 1
jmp 0x47e50b
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0x1d4c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
cmp eax, dword [ebp - 0x1d4c]
jle 0x47e538
mov dword [ebp - 0xda4], 1
jmp 0x47e53f
and dword [ebp - 0xda4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2400]
cmp dword [ebp - 0xda4], eax
jne 0x47e560
mov dword [ebp - 0x1d54], 1
jmp 0x47e567
and dword [ebp - 0x1d54], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
cmp dword [ebp - 0x1d54], eax
je 0x47e588
mov dword [ebp - 0x1d5c], 1
jmp 0x47e58f
and dword [ebp - 0x1d5c], 0
mov eax, dword [ebp - 0xdac]
cmp eax, dword [ebp - 0x1d5c]
je 0x47e5a9
mov dword [ebp - 0xdb4], 1
jmp 0x47e5b0
and dword [ebp - 0xdb4], 0
cmp dword [ebp - 0xdb4], 0x242ec213
jne 0x47e5c8
mov dword [ebp - 0x2888], 1
jmp 0x47e5cf
and dword [ebp - 0x2888], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x31a0], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x284], 0
jne 0x47e5f9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x284], 0
mov eax, 0x4863
test eax, eax
jne 0x47e614
mov eax, 0xfffb
test eax, eax
jne 0x47e614
and dword [ebp - 0x1d64], 0
jmp 0x47e61e
mov dword [ebp - 0x1d64], 1
mov eax, dword [ebp - 0x544]
imul eax, dword [ebp - 0x1d64]
neg eax
mov dword [ebp - 0x544], eax
je 0x47e651
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x284], 0
je 0x47e651
mov dword [ebp - 0xdbc], 1
jmp 0x47e658
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0x1d74], eax
jmp 0x47e436
jmp 0x47e6d2
mov dword [ebp - 0x1d6c], 0x95504247
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
mov dword [ebp - 0x31a8], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x31b0], eax
mov eax, dword [ebp - 0x1d6c]
mov dword [ebp - 0x31b8], eax
mov eax, 0x526
cmp eax, 7
je 0x47e6bf
cmp dword [ebp - 0x1d6c], 0
je 0x47e6bf
mov dword [ebp - 0xdc4], 1
jmp 0x47e6c6
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x1d74], eax
jmp 0x47e720
mov dword [ebp - 0x31c0], 1
mov dword [ebp - 0x668], 0
jmp 0x47e6f7
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 2
jge 0x47e713
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0x3954], 0x9dab
jmp 0x47e6ea
mov eax, dword [ebp - 0xdcc]
dec eax
mov dword [ebp - 0xdcc], eax
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0x338], 0xfffffffa
mov dword [ebp - 0x510], 0x4126315b
mov dword [ebp - 0xc20], 0x4ff24264
mov dword [ebp - 0x1dcc], 0xfffffffa
mov dword [ebp - 0xa8], 0xfffffff1
jmp 0x47e76b
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe5
jge 0x47ed20
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x670], 0xfffffffe
mov dword [ebp - 0x644], 0x6d9e96b
mov dword [ebp - 0xc18], 0x7972e7eb
mov dword [ebp - 0x1dc4], 0xfffffffe
mov dword [ebp - 0x28a8], 0x97a1
mov dword [ebp - 0xe24], 0
mov dword [ebp - 0x8c4], 0
jmp 0x47e7d7
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 2
jge 0x47e7f3
mov eax, dword [ebp - 0x8c4]
mov dword [ebp + eax*4 - 0x528], 0xfffffff9
jmp 0x47e7ca
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x338]
cmp dword [ebp + eax - 0x528], ecx
jle 0x47e814
mov dword [ebp - 0x1d7c], 1
jmp 0x47e81b
and dword [ebp - 0x1d7c], 0
mov eax, dword [ebp - 0x1d7c]
neg eax
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2890], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x2898], eax
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x2890]
cmp eax, dword [ebp - 0x2898]
jne 0x47e868
mov dword [ebp - 0x1d94], 1
jmp 0x47e86f
and dword [ebp - 0x1d94], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x31c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x528]
mov dword [ebp - 0x31d0], eax
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x31d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
mov dword [ebp - 0x31e0], eax
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x31e8], eax
cmp dword [ebp - 0xa8], 0
je 0x47e8e0
mov eax, 0xbfc7
test eax, eax
je 0x47e8e0
cmp dword [ebp - 0xa8], 0
je 0x47e8e0
mov dword [ebp - 0xdd4], 1
jmp 0x47e8e7
and dword [ebp - 0xdd4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdd4]
sub ecx, dword [ebp + eax - 0x528]
cmp ecx, dword [ebp - 0xa8]
je 0x47e90e
mov dword [ebp - 0x1d84], 1
jmp 0x47e915
and dword [ebp - 0x1d84], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1d84], eax
je 0x47e92f
mov dword [ebp - 0xddc], 1
jmp 0x47e936
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xddc], eax
jge 0x47e950
mov dword [ebp - 0x1d8c], 1
jmp 0x47e957
and dword [ebp - 0x1d8c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0x1d8c], eax
jne 0x47e978
mov dword [ebp - 0xde4], 1
jmp 0x47e97f
and dword [ebp - 0xde4], 0
imul eax, dword [ebp - 0xde4], 0xbbe2
mov ecx, dword [ebp - 0x1d94]
sub ecx, eax
cmp ecx, 0xfffffff8
jne 0x47e9a2
mov dword [ebp - 0xdec], 1
jmp 0x47e9a9
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xdec], eax
jl 0x47e9c3
mov dword [ebp - 0x1d9c], 1
jmp 0x47e9ca
and dword [ebp - 0x1d9c], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x1d9c]
jg 0x47e9e4
mov dword [ebp - 0xdf4], 1
jmp 0x47e9eb
and dword [ebp - 0xdf4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0xdf4], eax
je 0x47ea0c
mov dword [ebp - 0x1da4], 1
jmp 0x47ea13
and dword [ebp - 0x1da4], 0
mov eax, dword [ebp - 0x1da4]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0xc18], eax
cmp dword [ebp - 0x644], 0
je 0x47ea95
mov eax, 0x8934
test eax, eax
je 0x47ea44
cmp dword [ebp - 0x338], 0
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x31f0], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x31f8], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x3200], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0xc18], eax
cmp dword [ebp - 0xc18], 0
je 0x47ea95
mov dword [ebp - 0xdfc], 1
jmp 0x47ea9c
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xc20]
cmp dword [ebp - 0xdfc], eax
jg 0x47eab6
mov dword [ebp - 0x1dac], 1
jmp 0x47eabd
and dword [ebp - 0x1dac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
imul eax, dword [ebp - 0x1dac]
sub eax, dword [ebp - 0x54c]
mov dword [ebp - 0x1dc4], eax
cmp dword [ebp - 0xc20], 0
jne 0x47eb12
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x528], 0
jne 0x47eb12
cmp dword [ebp - 0x510], 0
jne 0x47eb12
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x47eb12
mov dword [ebp - 0xe04], 1
jmp 0x47eb19
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0xe04]
neg eax
cmp eax, dword [ebp - 0x670]
jle 0x47eb35
mov dword [ebp - 0x1db4], 1
jmp 0x47eb3c
and dword [ebp - 0x1db4], 0
cmp dword [ebp - 0x1db4], 0x7338d581
jge 0x47eb5d
mov eax, 0x6df497a8
test eax, eax
je 0x47eb5d
mov dword [ebp - 0xe0c], 1
jmp 0x47eb64
and dword [ebp - 0xe0c], 0
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0xe0c]
jg 0x47eb7e
mov dword [ebp - 0x1dbc], 1
jmp 0x47eb85
and dword [ebp - 0x1dbc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0x1dbc], eax
jg 0x47eba6
mov dword [ebp - 0xe14], 1
jmp 0x47ebad
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x338], eax
jl 0x47ebd3
mov dword [ebp - 0x28a0], 1
jmp 0x47ebda
and dword [ebp - 0x28a0], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x3208], eax
mov eax, dword [ebp - 0x1dc4]
mov dword [ebp - 0x3210], eax
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x3218], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x3220], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
mov dword [ebp - 0x3228], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
add eax, dword [ebp - 0x28a8]
imul eax, eax, 0
cmp eax, dword [ebp - 0xe24]
je 0x47ec47
mov dword [ebp - 0xe1c], 1
jmp 0x47ec4e
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0x1dcc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0x1dcc], eax
jle 0x47ec84
cmp dword [ebp - 0xe24], 0
je 0x47ec84
mov dword [ebp - 0x1dd4], 1
jmp 0x47ec8b
and dword [ebp - 0x1dd4], 0
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x1dd4], eax
je 0x47eca5
mov dword [ebp - 0xe2c], 1
jmp 0x47ecac
and dword [ebp - 0xe2c], 0
cmp dword [ebp - 0xe2c], 1
jle 0x47ece7
mov byte [ebp - 0x3f9], 0
movzx eax, byte [ebp - 0x3f9]
test eax, eax
je 0x47ece5
push 0x14a4
push 0x8f2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x47ed1b
mov byte [ebp - 0x439], 0
movzx eax, byte [ebp - 0x439]
test eax, eax
je 0x47ed1b
push 0
push 0
push 0x1aca
push 0
push 0xf34
push 0
push 0x13a
push 0x1ecf
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x47e75e
mov byte [ebp - 0x2ee], 0
movzx eax, byte [ebp - 0x2ee]
test eax, eax
je 0x47ed43
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x2f4], 0
mov dword [ebp - 0x8cc], 0x342eb90d
mov dword [ebp - 0x8cc], 0
jmp 0x47ed6d
mov eax, dword [ebp - 0x8cc]
dec eax
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 0xfffffff7
jl 0x47eeec
mov dword [ebp - 0x8d4], 0x30722263
mov dword [ebp - 0x678], 0
jmp 0x47ed9d
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 3
jge 0x47edb9
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0x381c], 0xc69aed23
jmp 0x47ed90
mov byte [ebp - 0x2f0], 0
movzx eax, byte [ebp - 0x2f0]
test eax, eax
je 0x47edd1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x8d4], 0
jmp 0x47edea
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 2
jg 0x47eee7
mov dword [ebp - 0x680], 0
jmp 0x47ee10
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 2
jge 0x47ee2c
mov eax, dword [ebp - 0x680]
mov dword [ebp + eax*4 - 0x240c], 0xffffffff
jmp 0x47ee03
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x240c], 2
jmp 0x47ee5a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x240c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x240c], 0
jl 0x47eee2
mov byte [ebp - 0x2f2], 0
movzx eax, byte [ebp - 0x2f2]
test eax, eax
je 0x47eec1
push 0x995
push 0x2629
push 0x931
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x3df
push 0x960
push 0x1ee
push 0x2415
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240c]
cmp dword [ebp + eax*4 - 0x381c], 0
je 0x47eedd
jmp 0x47ee3f
jmp 0x47ee3f
jmp 0x47eddd
jmp 0x47ed60
movzx eax, byte [ebp - 0x2f4]
test eax, eax
je 0x47ef8e
mov dword [ebp - 0x3230], 0
mov dword [ebp - 0x3238], 0
mov dword [ebp - 0x1ddc], 0
mov dword [ebp - 0x8dc], 0
jmp 0x47ef32
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 3
jge 0x47ef4e
mov eax, dword [ebp - 0x8dc]
mov dword [ebp + eax*4 - 0x3a78], 0xf251d69f
jmp 0x47ef25
mov eax, dword [ebp - 0x1ddc]
inc eax
mov dword [ebp - 0x1ddc], eax
mov byte [ebp - 0x2f6], 0
movzx eax, byte [ebp - 0x2f6]
test eax, eax
je 0x47ef78
push 0x22a8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x688], 0xcfe0
mov dword [ebp - 0x2b90], 0x662a
mov dword [ebp - 0x2b8c], 0x662a
mov dword [ebp - 0x2b88], 0x662a
mov dword [ebp - 0x2b84], 0x662a
mov dword [ebp - 0x28b0], 0x90515466
mov dword [ebp - 0x3240], 1
mov byte [ebp - 0x2f8], 0
movzx eax, byte [ebp - 0x2f8]
test eax, eax
je 0x47effe
push 0
push 0x23df
push 0
push 0
push 0x613
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x3248], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x688]
cmp dword [ebp + eax - 0x2b90], ecx
jge 0x47f02b
mov dword [ebp - 0xe3c], 1
jmp 0x47f032
and dword [ebp - 0xe3c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x688]
cmp dword [ebp + eax - 0x2b90], ecx
jge 0x47f053
mov dword [ebp - 0xe34], 1
jmp 0x47f05a
and dword [ebp - 0xe34], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2b90]
cmp dword [ebp - 0xe34], eax
je 0x47f07b
mov dword [ebp - 0x1de4], 1
jmp 0x47f082
and dword [ebp - 0x1de4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b90]
cmp dword [ebp - 0x1de4], eax
jle 0x47f0a3
mov dword [ebp - 0x1dec], 1
jmp 0x47f0aa
and dword [ebp - 0x1dec], 0
mov eax, dword [ebp - 0xe3c]
add eax, dword [ebp - 0x1dec]
cmp eax, dword [ebp - 0x688]
je 0x47f0ca
mov dword [ebp - 0xe44], 1
jmp 0x47f0d1
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0xe44]
inc eax
cmp eax, 0xb0f7
jle 0x47f0eb
mov dword [ebp - 0x1df4], 1
jmp 0x47f0f2
and dword [ebp - 0x1df4], 0
mov eax, dword [ebp - 0x1df4]
mov dword [ebp - 0x28b0], eax
mov dword [ebp - 0xe64], 0xffffffff
mov dword [ebp - 0xe4c], 0
mov dword [ebp - 0xe54], 0x90f02349
mov dword [ebp - 0x3250], 0
mov dword [ebp - 0x3258], 0xfffffffd
mov dword [ebp - 0x3260], 1
mov dword [ebp - 0x28b8], 0xe7bf
mov dword [ebp - 0x3268], 0
mov dword [ebp - 0x3270], 0
mov dword [ebp - 0x3278], 0xf5ef889a
mov dword [ebp - 0x3280], 0
mov dword [ebp - 0x28c8], 0x2189f42c
mov dword [ebp - 0x3288], 0xa8cf1d65
mov dword [ebp - 0x28d0], 0
mov dword [ebp - 0x3290], 0xffffffff
mov dword [ebp - 0x28c0], 0
mov dword [ebp - 0x3298], 0xb421dd2e
mov dword [ebp - 0x32a0], 1
mov dword [ebp - 0x32a8], 9
mov dword [ebp - 0xc28], 3
mov dword [ebp - 0x8e4], 0
jmp 0x47f1df
mov eax, dword [ebp - 0x8e4]
inc eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 3
jge 0x47f1fb
mov eax, dword [ebp - 0x8e4]
mov dword [ebp + eax*4 - 0x38a0], 0x64087a91
jmp 0x47f1d2
mov dword [ebp - 0xe4c], 0x7478144a
cmp dword [ebp - 0xe4c], 0
je 0x47f2a5
cmp dword [ebp - 0x28b8], 0
jg 0x47f227
mov dword [ebp - 0x1dfc], 1
jmp 0x47f22e
and dword [ebp - 0x1dfc], 0
imul eax, dword [ebp - 0x1dfc], 0xa6f4
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp - 0x28c0]
cmp dword [ebp - 0xe54], eax
jne 0x47f258
mov dword [ebp - 0x1e04], 1
jmp 0x47f25f
and dword [ebp - 0x1e04], 0
cmp dword [ebp - 0x1e04], 0xabaf
jne 0x47f277
mov dword [ebp - 0xe5c], 1
jmp 0x47f27e
and dword [ebp - 0xe5c], 0
mov eax, dword [ebp - 0xc28]
inc eax
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0xc28]
add eax, dword [ebp - 0xe5c]
je 0x47f2a5
mov dword [ebp - 0xc60], 1
jmp 0x47f2ac
and dword [ebp - 0xc60], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc60]
mov dword [ebp + eax - 0x38a0], ecx
cmp dword [ebp - 0xc60], 0
jne 0x47f2d7
push 8
pop eax
test eax, eax
jne 0x47f2d7
and dword [ebp - 0x1e0c], 0
jmp 0x47f2e1
mov dword [ebp - 0x1e0c], 1
mov eax, dword [ebp - 0x28c8]
cmp dword [ebp - 0x1e0c], eax
jne 0x47f2fb
mov dword [ebp - 0x1e14], 1
jmp 0x47f302
and dword [ebp - 0x1e14], 0
mov eax, dword [ebp - 0xe64]
imul eax, dword [ebp - 0xe64]
cmp eax, dword [ebp - 0x1e14]
jle 0x47f323
mov dword [ebp - 0xe6c], 1
jmp 0x47f32a
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0xe6c]
mov dword [ebp - 0x28d0], eax
mov byte [ebp - 0x2fc], 0
mov dword [ebp - 0xb8], 0x5a23e86f
mov dword [ebp - 0x5cc], 1
mov dword [ebp - 0xe74], 0x2da3c3d
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0x28f0], 0
mov dword [ebp - 0x32b0], 0x17a68fab
mov byte [ebp - 0x2fa], 0
movzx eax, byte [ebp - 0x2fa]
test eax, eax
je 0x47f39f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x5cc], eax
jg 0x47f3c5
mov dword [ebp - 0x28d8], 1
jmp 0x47f3cc
and dword [ebp - 0x28d8], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jge 0x47f3e6
mov dword [ebp - 0x28e0], 1
jmp 0x47f3ed
and dword [ebp - 0x28e0], 0
cmp dword [ebp - 0x5cc], 0
jne 0x47f3fd
cmp dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0x4d1b
jge 0x47f41b
cmp dword [ebp - 0xb8], 0
jne 0x47f41b
and dword [ebp - 0x1e1c], 0
jmp 0x47f425
mov dword [ebp - 0x1e1c], 1
mov eax, dword [ebp - 0x1e1c]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0xe74]
sub eax, 0x462ccd20
cmp eax, 1
jl 0x47f44d
mov dword [ebp - 0x1e24], 1
jmp 0x47f454
and dword [ebp - 0x1e24], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x1e24]
cmp eax, dword [ebp - 0xb8]
jg 0x47f474
mov dword [ebp - 0xe7c], 1
jmp 0x47f47b
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xe7c]
cmp eax, dword [ebp - 0xb8]
jle 0x47f49b
mov dword [ebp - 0x1e2c], 1
jmp 0x47f4a2
and dword [ebp - 0x1e2c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x1e2c], eax
jle 0x47f4bc
mov dword [ebp - 0x28e8], 1
jmp 0x47f4c3
and dword [ebp - 0x28e8], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x32b8], eax
or eax, 0xffffffff
cmp eax, 0xe712
jle 0x47f4e0
cmp dword [ebp - 0xb8], 0
mov dword [ebp - 0xe84], 0xffffffff
mov eax, dword [ebp - 0xe84]
mov dword [ebp - 0x28f0], eax
movzx eax, byte [ebp - 0x2fc]
test eax, eax
je 0x47f674
mov dword [ebp - 0x90], 9
mov dword [ebp - 0x28f8], 0xfffffff7
mov dword [ebp - 0x690], 0
jmp 0x47f532
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 4
jge 0x47f54e
mov eax, dword [ebp - 0x690]
mov dword [ebp + eax*4 - 0x3964], 0x82062403
jmp 0x47f525
mov dword [ebp - 0x90], 0
jmp 0x47f567
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x47f583
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x3964], 0xfffffffd
jmp 0x47f55a
cmp dword [ebp - 0x28f8], 0
je 0x47f5fc
mov dword [ebp - 0x90], 3
jmp 0x47f5a5
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x47f5cf
mov byte [ebp - 0x2fe], 0
movzx eax, byte [ebp - 0x2fe]
test eax, eax
je 0x47f5cd
push 0
push 0x170f
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x47f598
mov byte [ebp - 0x300], 0
movzx eax, byte [ebp - 0x300]
test eax, eax
je 0x47f5fa
push 0x25ea
push 0x2033
push 0
push 0
push 0x8fc
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x47f66e
mov dword [ebp - 0x90], 0
jmp 0x47f615
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x12
je 0x47f66e
mov byte [ebp - 0x302], 0
movzx eax, byte [ebp - 0x302]
test eax, eax
je 0x47f66c
push 0x1d31
push 0x1ff1
push 0xbb1
push 0x250c
push 0x1268
push 0x14ed
push 0x1375
push 0x180f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x47f608
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x47df90
mov dword [ebp - 0x2564], 0
mov dword [ebp - 0x2560], 0
mov dword [ebp - 0x255c], 0
mov dword [ebp - 0x2558], 0
mov dword [ebp - 0x8ec], 0
jmp 0x47f6ba
mov eax, dword [ebp - 0x8ec]
inc eax
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x8ec], 2
jge 0x47f6d6
mov eax, dword [ebp - 0x8ec]
mov dword [ebp + eax*4 - 0x2934], 0xf0ea
jmp 0x47f6ad
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2564], 1
jmp 0x47f704
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2564]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2564], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2564], 0
jl 0x47f757
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2564]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x2564]
mov eax, dword [ebp + eax*4 - 0x2934]
mov dword [ebp + ecx*4 - 0x2934], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2564]
cmp dword [ebp + eax*4 - 0x2934], 0
je 0x47f755
jmp 0x47f757
jmp 0x47f6e9
mov byte [ebp - 0x304], 0
movzx eax, byte [ebp - 0x304]
test eax, eax
je 0x47f85b
mov dword [ebp - 0x32c0], 0x261f9c28
mov dword [ebp - 0x32c8], 0xfffffff7
mov dword [ebp - 0x32d0], 0x5b0e446d
mov dword [ebp - 0x32d8], 0xfffffff8
mov dword [ebp - 0x1e34], 1
mov dword [ebp - 0x32e0], 0x12f3
mov dword [ebp - 0x288], 0
jmp 0x47f7c2
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x47f7de
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x32e8], 0xb34e6d4f
jmp 0x47f7b5
mov dword [ebp - 0x288], 0
jmp 0x47f7f7
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x47f813
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x3ac0], 0
jmp 0x47f7ea
mov eax, dword [ebp - 0x1e34]
dec eax
mov dword [ebp - 0x1e34], eax
mov byte [ebp - 0x309], 0
movzx eax, byte [ebp - 0x309]
test eax, eax
je 0x47f84e
push 0x9da
push 0x26a3
push 0x59d
push 0x2372
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x18f1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 4], 0xe44fa3fd
mov dword [ebp - 0x2a5c], 0x5405ea3
mov dword [ebp - 0x698], 0
jmp 0x47f896
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 2
jge 0x47f8b2
mov eax, dword [ebp - 0x698]
mov dword [ebp + eax*4 - 0x25a8], 0xffff
jmp 0x47f889
mov byte [ebp - 0x30b], 0
movzx eax, byte [ebp - 0x30b]
test eax, eax
je 0x47f8d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [ebp - 0x1c], 0xa53061ec
jb 0x47f8e6
mov dword [ebp - 0xe8c], 1
jmp 0x47f8ed
and dword [ebp - 0xe8c], 0
cmp dword [ebp - 0x1c], 0
jne 0x47f902
cmp dword [ebp - 0x1c], 0
jne 0x47f902
and dword [ebp - 0x1e3c], 0
jmp 0x47f90c
mov dword [ebp - 0x1e3c], 1
mov eax, dword [ebp - 0xe8c]
cmp eax, dword [ebp - 0x1e3c]
jl 0x47f96a
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x47f92e
mov dword [ebp - 0xe94], 1
jmp 0x47f935
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xe94], eax
jg 0x47f94c
mov dword [ebp - 0x1e44], 1
jmp 0x47f953
and dword [ebp - 0x1e44], 0
mov eax, dword [ebp - 0x1e44]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jl 0x47f96a
and dword [ebp - 0xe9c], 0
jmp 0x47f974
mov dword [ebp - 0xe9c], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xe9c], eax
jg 0x47f98b
mov dword [ebp - 0x1e4c], 1
jmp 0x47f992
and dword [ebp - 0x1e4c], 0
cmp dword [ebp - 0x1e4c], 0
jbe 0x47f9a7
mov dword [ebp - 0xea4], 1
jmp 0x47f9ae
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xea4], eax
jne 0x47f9c5
mov dword [ebp - 0x1e54], 1
jmp 0x47f9cc
and dword [ebp - 0x1e54], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1e54], eax
jl 0x47f9e3
mov dword [ebp - 0x2900], 1
jmp 0x47f9ea
and dword [ebp - 0x2900], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x32f0], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x32f8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3300], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x188], eax
jg 0x47fa25
mov dword [ebp - 0xeac], 1
jmp 0x47fa2c
and dword [ebp - 0xeac], 0
cmp dword [ebp - 0xeac], 8
ja 0x47fa41
mov dword [ebp - 0x1e5c], 1
jmp 0x47fa48
and dword [ebp - 0x1e5c], 0
imul eax, dword [ebp - 0x1e5c], 0xafbf
cmp eax, dword [ebp - 0x1c]
jl 0x47fa63
mov dword [ebp - 0xeb4], 1
jmp 0x47fa6a
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0xeb4]
sub eax, 0x723af636
test eax, eax
jg 0x47fa85
mov dword [ebp - 0x1e64], 1
jmp 0x47fa8c
and dword [ebp - 0x1e64], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1e64], eax
je 0x47faa3
mov dword [ebp - 0xebc], 1
jmp 0x47faaa
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xebc], eax
jg 0x47fac1
mov dword [ebp - 0x1e6c], 1
jmp 0x47fac8
and dword [ebp - 0x1e6c], 0
cmp dword [ebp - 0x1e6c], 0x5f19716e
je 0x47fcb8
mov dword [ebp - 0xed4], 0xe12fd89d
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x2910], 0
mov dword [ebp - 0x8f4], 0
jmp 0x47fb0f
mov eax, dword [ebp - 0x8f4]
inc eax
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 4
jge 0x47fb2b
mov eax, dword [ebp - 0x8f4]
mov dword [ebp + eax*4 - 0x3a2c], 0x9e98c534
jmp 0x47fb02
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x3444], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x344c], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x518], eax
jl 0x47fb5a
mov dword [ebp - 0x2908], 1
jmp 0x47fb61
and dword [ebp - 0x2908], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x3454], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x345c], eax
cmp dword [ebp - 4], 0x53c8
jge 0x47fb8b
mov dword [ebp - 0xec4], 1
jmp 0x47fb92
and dword [ebp - 0xec4], 0
cmp dword [ebp - 0xec4], 8
jb 0x47fba7
mov dword [ebp - 0x1e74], 1
jmp 0x47fbae
and dword [ebp - 0x1e74], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1e74]
je 0x47fbc5
mov dword [ebp - 0xecc], 1
jmp 0x47fbcc
and dword [ebp - 0xecc], 0
cmp dword [ebp - 0xecc], 0x864adb5d
je 0x47fbe4
mov dword [ebp - 0xc78], 1
jmp 0x47fbeb
and dword [ebp - 0xc78], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc78]
mov dword [ebp + eax - 0x25a8], ecx
mov eax, dword [ebp - 0xc78]
sub eax, dword [ebp - 0x188]
sub eax, 0xc0ae
je 0x47fc26
cmp dword [ebp - 0x518], 0
je 0x47fc26
mov dword [ebp - 0x1e7c], 1
jmp 0x47fc2d
and dword [ebp - 0x1e7c], 0
cmp dword [ebp - 0x1e7c], 0x94d85d5f
ja 0x47fc45
mov dword [ebp - 0x1e84], 1
jmp 0x47fc4c
and dword [ebp - 0x1e84], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0xed4]
sub eax, dword [ebp - 0x1e84]
jne 0x47fc72
cmp dword [ebp - 4], 0
jne 0x47fc72
and dword [ebp - 0xedc], 0
jmp 0x47fc7c
mov dword [ebp - 0xedc], 1
mov eax, dword [ebp - 0xedc]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x3464], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a2c]
mov dword [ebp - 0x346c], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x2910], eax
jmp 0x47ffce
mov dword [ebp - 0xc80], 0xffffffff
mov dword [ebp - 0xee4], 0x1d73cb4e
mov dword [ebp - 0x188], 0
jmp 0x47fce5
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jg 0x47ffa1
mov dword [ebp - 0x4b4], 0x9618de77
mov dword [ebp - 4], 0
jmp 0x47fd0c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x47fd31
mov byte [ebp - 0x30d], 0
movzx eax, byte [ebp - 0x30d]
test eax, eax
je 0x47fd2f
push 0x2499
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x47fd05
mov dword [ebp - 4], 0
jmp 0x47fd41
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x47ff9c
mov dword [ebp - 0x2e4c], 1
mov dword [ebp - 0x2e48], 1
mov dword [ebp - 0x2e44], 1
mov dword [ebp - 0x2e40], 1
mov dword [ebp - 0x2928], 0xfffffffc
mov dword [ebp - 0x238], 0
jmp 0x47fd96
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x47fdb2
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x2cc8], 0xd933b151
jmp 0x47fd89
mov dword [ebp - 0x238], 0
jmp 0x47fdcb
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x47fde7
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x3918], 0x39a040d4
jmp 0x47fdbe
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x25a8], 0
jne 0x47ff5e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3474], eax
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x347c], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x25a8], 0
jne 0x47fe2c
cmp dword [ebp - 0xc80], 0
jne 0x47fe2c
and dword [ebp - 0x1e8c], 0
jmp 0x47fe36
mov dword [ebp - 0x1e8c], 1
mov eax, dword [ebp - 0x1e8c]
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0xee4]
add eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x2918], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2918]
mov dword [ebp + eax - 0x2cc8], ecx
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x3484], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x348c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cc8]
mov dword [ebp - 0x1e94], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1e94]
mov dword [ebp + eax - 0x3918], ecx
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x1e94], eax
jne 0x47febe
mov dword [ebp - 0xc88], 1
jmp 0x47fec5
and dword [ebp - 0xc88], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc88]
mov dword [ebp + eax - 0x2e4c], ecx
cmp dword [ebp - 0xc88], 0x4cde8b73
jge 0x47fef0
mov dword [ebp - 0xeec], 1
jmp 0x47fef7
and dword [ebp - 0xeec], 0
imul eax, dword [ebp - 0xeec], 0x7fb6
test eax, eax
jne 0x47ff11
mov dword [ebp - 0x1e9c], 1
jmp 0x47ff18
and dword [ebp - 0x1e9c], 0
cmp dword [ebp - 0x1e9c], 0x15db4c2
jl 0x47ff39
mov eax, 0x22e546ec
test eax, eax
je 0x47ff39
mov dword [ebp - 0x2920], 1
jmp 0x47ff40
and dword [ebp - 0x2920], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x25a8]
mov dword [ebp - 0x3494], eax
mov eax, dword [ebp - 0x4b4]
add eax, dword [ebp - 0x4b4]
je 0x47ff73
mov eax, 0x306
test eax, eax
je 0x47ff73
mov dword [ebp - 0xef4], 1
jmp 0x47ff7a
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0x4b4]
imul eax, dword [ebp - 0xef4]
mov dword [ebp - 0x2928], eax
mov dword [ebp - 0x2a5c], 0xf2bfcff1
jmp 0x47fd3a
jmp 0x47fcd8
mov dword [ebp - 4], 0xfffffffc
jmp 0x47ffb1
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jl 0x47ffce
mov dword [ebp - 0x2a64], 7
cmp dword [ebp - 0x2a64], 0
je 0x47ffcc
jmp 0x47ffce
jmp 0x47ffaa
cmp dword [ebp + 8], 2
jl 0x48e857
mov dword [ebp - 0xa0], 0xb56cef3
mov dword [ebp - 0x340], 0x92079655
mov dword [ebp - 0x50], 0
jmp 0x47fffc
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x480012
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x9f8], 0xac204e2d
jmp 0x47fff5
mov dword [ebp - 0x50], 0
jmp 0x480022
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x480038
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2524], 0x29bf3901
jmp 0x48001b
mov dword [ebp - 0x50], 0
jmp 0x480048
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x48005e
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2c38], 9
jmp 0x480041
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9f8], 0xb
jmp 0x48008c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9f8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9f8], 0xffffffe8
jl 0x4803ab
mov dword [ebp - 0x108], 0
mov dword [ebp - 0xefc], 0x94d0e83
mov dword [ebp - 0xf14], 0x35db5a26
mov dword [ebp - 0xc64], 0x3268dd2a
mov dword [ebp - 0x6a0], 0
jmp 0x4800e1
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 2
jge 0x4800fd
mov eax, dword [ebp - 0x6a0]
mov dword [ebp + eax*4 - 0x330c], 0
jmp 0x4800d4
mov dword [ebp - 0x108], 0
jmp 0x480116
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jg 0x480153
mov byte [ebp - 0x30f], 0
movzx eax, byte [ebp - 0x30f]
test eax, eax
je 0x480151
push 0
push 0x1419
push 0x1f6e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x480109
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9f8]
cmp dword [ebp - 0x108], eax
jle 0x480174
mov dword [ebp - 0xf1c], 1
jmp 0x48017b
and dword [ebp - 0xf1c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2524]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x340], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2524]
cmp dword [ebp - 0x340], eax
jne 0x4801ba
mov dword [ebp - 0x1ea4], 1
jmp 0x4801c1
and dword [ebp - 0x1ea4], 0
mov eax, dword [ebp - 0x1ea4]
add eax, 0xa5b5
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0xefc]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x9f8]
cmp eax, 6
jae 0x4801f6
mov dword [ebp - 0x1eac], 1
jmp 0x4801fd
and dword [ebp - 0x1eac], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x1eac], eax
jge 0x480217
mov dword [ebp - 0xf04], 1
jmp 0x48021e
and dword [ebp - 0xf04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9f8]
cmp eax, dword [ebp - 0xf04]
jg 0x48023f
mov dword [ebp - 0x1eb4], 1
jmp 0x480246
and dword [ebp - 0x1eb4], 0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x1eb4]
mov dword [ebp - 0xf14], eax
cmp dword [ebp - 0xc64], 0x4ccb090a
je 0x480270
mov dword [ebp - 0xf0c], 1
jmp 0x480277
and dword [ebp - 0xf0c], 0
cmp dword [ebp - 0xf0c], 6
ja 0x48028c
mov dword [ebp - 0x1ebc], 1
jmp 0x480293
and dword [ebp - 0x1ebc], 0
mov eax, dword [ebp - 0x1ebc]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0xc64], eax
jle 0x4802b9
mov dword [ebp - 0x2a6c], 1
jmp 0x4802c0
and dword [ebp - 0x2a6c], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x349c], eax
mov eax, dword [ebp - 0xf14]
mov dword [ebp - 0x34a4], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2c38], 0xfffffffb
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x108]
mov dword [ebp + eax - 0x330c], ecx
mov eax, 0x6d70
test eax, eax
jne 0x480316
mov eax, 0xc84
test eax, eax
jne 0x480316
and dword [ebp - 0x1ec4], 0
jmp 0x480320
mov dword [ebp - 0x1ec4], 1
cmp dword [ebp - 0x1ec4], 9
jne 0x480335
mov dword [ebp - 0x1ecc], 1
jmp 0x48033c
and dword [ebp - 0x1ecc], 0
mov eax, dword [ebp - 0xf1c]
sub eax, dword [ebp - 0x1ecc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x9f8]
jge 0x480363
mov dword [ebp - 0xf24], 1
jmp 0x48036a
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0xf24]
add eax, 0x356d9de3
jne 0x480390
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9f8], 0
jne 0x480390
and dword [ebp - 0x1ed4], 0
jmp 0x48039a
mov dword [ebp - 0x1ed4], 1
mov eax, dword [ebp - 0x1ed4]
mov dword [ebp - 0x108], eax
jmp 0x480071
mov dword [ebp - 0x340], 0x19
jmp 0x4803c4
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xfffffffb
je 0x4805bf
mov dword [ebp - 0xf44], 0x53d0c964
mov dword [ebp - 0x2a74], 0xa39b7b3f
mov dword [ebp - 0xa0], 3
jmp 0x4803fe
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x4805ba
mov dword [ebp - 0x1eec], 0xf83f3a8a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2c38]
mov ecx, dword [ebp - 0xa0]
sub eax, dword [ebp + ecx*4 - 0x2524]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2c38]
jne 0x480449
mov dword [ebp - 0xf2c], 1
jmp 0x480450
and dword [ebp - 0xf2c], 0
cmp dword [ebp - 0xf2c], 0xc458
jg 0x480468
mov dword [ebp - 0x1edc], 1
jmp 0x48046f
and dword [ebp - 0x1edc], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x2524]
sub eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x1edc]
mov ecx, dword [ebp - 0xa0]
cmp eax, dword [ebp + ecx*4 - 0x2524]
jne 0x4804a4
mov dword [ebp - 0xf34], 1
jmp 0x4804ab
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x2524]
cmp eax, dword [ebp - 0xf34]
jle 0x4804cc
mov dword [ebp - 0x1ee4], 1
jmp 0x4804d3
and dword [ebp - 0x1ee4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2524]
cmp dword [ebp - 0x1ee4], eax
je 0x4804f4
mov dword [ebp - 0xf3c], 1
jmp 0x4804fb
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0xf3c]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xf44]
neg eax
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ebp + ecx*4 - 0x2524]
lea eax, [eax + ecx + 0x5271231b]
mov ecx, dword [ebp - 0xa0]
add eax, dword [ebp + ecx*4 - 0x2524]
cmp eax, 0x24e19c78
jge 0x48054f
mov dword [ebp - 0x1ef4], 1
jmp 0x480556
and dword [ebp - 0x1ef4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ef4]
sub ecx, dword [ebp + eax - 0x2c38]
cmp ecx, 6
jb 0x48057a
mov dword [ebp - 0xf4c], 1
jmp 0x480581
and dword [ebp - 0xf4c], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x2524]
cmp dword [ebp - 0xf4c], eax
jge 0x4805a2
mov dword [ebp - 0x1efc], 1
jmp 0x4805a9
and dword [ebp - 0x1efc], 0
mov eax, dword [ebp - 0x1efc]
mov dword [ebp - 0x2a74], eax
jmp 0x4803f1
jmp 0x4803b7
mov dword [ebp - 0x34ac], 1
mov byte [ebp - 0x311], 0
movzx eax, byte [ebp - 0x311]
test eax, eax
je 0x4805e3
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov byte [ebp - 0x313], 0
movzx eax, byte [ebp - 0x313]
test eax, eax
je 0x4805fd
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x120], 0x5256ee97
mov dword [ebp - 0xa50], 0xffffffff
mov dword [ebp - 0x1f1c], 0xffffffff
mov dword [ebp - 0x2a84], 0x324015fb
mov dword [ebp - 0x34b4], 0
mov dword [ebp - 0x34bc], 0x6552
mov dword [ebp - 0x34c4], 0xda6a44f3
mov dword [ebp - 0x34cc], 0xfffffffd
mov dword [ebp - 0x8fc], 0
jmp 0x48066d
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 1
jge 0x480689
mov eax, dword [ebp - 0x8fc]
mov dword [ebp + eax*4 - 0x34d4], 0xfffffffd
jmp 0x480660
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x120], eax
jne 0x4806a3
mov dword [ebp - 0xf54], 1
jmp 0x4806aa
and dword [ebp - 0xf54], 0
cmp dword [ebp - 0xf54], 0x4307
jne 0x4806c2
mov dword [ebp - 0x1f04], 1
jmp 0x4806c9
and dword [ebp - 0x1f04], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x1f04], eax
jle 0x4806e3
mov dword [ebp - 0x2a7c], 1
jmp 0x4806ea
and dword [ebp - 0x2a7c], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x34dc], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x34e4], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x34ec], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x35e0], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0xa50], eax
jge 0x480746
cmp dword [ebp - 0xa50], 0
jne 0x480746
and dword [ebp - 0xf5c], 0
jmp 0x480750
mov dword [ebp - 0xf5c], 1
cmp dword [ebp - 0xf5c], 0xb8fa
jl 0x480768
mov dword [ebp - 0x1f0c], 1
jmp 0x48076f
and dword [ebp - 0x1f0c], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x1f0c], eax
je 0x480789
mov dword [ebp - 0xf64], 1
jmp 0x480790
and dword [ebp - 0xf64], 0
cmp dword [ebp - 0xf64], 0xea2c39d5
jne 0x4807a8
mov dword [ebp - 0x1f14], 1
jmp 0x4807af
and dword [ebp - 0x1f14], 0
cmp dword [ebp - 0x1f14], 0xffff
ja 0x4807c7
mov dword [ebp - 0xf6c], 1
jmp 0x4807ce
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0xf6c]
mov dword [ebp - 0x1f1c], eax
cmp dword [ebp - 0x1f1c], 0
je 0x4807f8
cmp dword [ebp - 0x2a84], 0
je 0x4807f8
mov dword [ebp - 0xf74], 1
jmp 0x4807ff
and dword [ebp - 0xf74], 0
cmp dword [ebp - 0xf74], 1
jne 0x48082c
mov byte [ebp - 0x315], 0
movzx eax, byte [ebp - 0x315]
test eax, eax
je 0x480827
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x4808f0
mov dword [ebp - 0x35e8], 0xf5ecce35
mov dword [ebp - 0x35f0], 0xb2455f9
mov dword [ebp - 0x35f8], 0xffffffff
mov dword [ebp - 0x3600], 0xffffffff
mov dword [ebp - 0x3608], 3
mov dword [ebp - 0x3610], 0xb8642e5f
mov dword [ebp - 0x3618], 0xe82a74db
mov dword [ebp - 0x3620], 0xfffffff7
mov dword [ebp - 0x3628], 0
mov dword [ebp - 0x3630], 0x6422f8dc
mov dword [ebp - 0x3638], 1
mov dword [ebp - 0x3640], 0x58a13c4
mov dword [ebp - 0x1f24], 0xb861a716
mov dword [ebp - 0x6a8], 0
jmp 0x4808c7
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 1
jge 0x4808e3
mov eax, dword [ebp - 0x6a8]
mov dword [ebp + eax*4 - 0x3648], 0xffffffff
jmp 0x4808ba
mov eax, dword [ebp - 0x1f24]
dec eax
mov dword [ebp - 0x1f24], eax
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x190], 0
mov dword [ebp - 0xf9c], 1
mov dword [ebp - 0x1f4c], 0x6836
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x1f44], 0xfffffff7
mov dword [ebp - 0x904], 0
jmp 0x480945
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 2
jge 0x480961
mov eax, dword [ebp - 0x904]
mov dword [ebp + eax*4 - 0x3a0c], 0xfffffffb
jmp 0x480938
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x190], eax
jle 0x48097b
mov dword [ebp - 0x1f3c], 1
jmp 0x480982
and dword [ebp - 0x1f3c], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x3650], eax
cmp dword [ebp - 0x190], 0
jl 0x4809a3
mov dword [ebp - 0xf7c], 1
jmp 0x4809aa
and dword [ebp - 0xf7c], 0
mov eax, dword [ebp - 0x1f4c]
add eax, dword [ebp - 0xf7c]
cmp eax, 8
jbe 0x4809c7
mov dword [ebp - 0x1f2c], 1
jmp 0x4809ce
and dword [ebp - 0x1f2c], 0
mov eax, dword [ebp - 0x1f2c]
sub eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x190]
jl 0x4809ee
mov dword [ebp - 0xf84], 1
jmp 0x4809f5
and dword [ebp - 0xf84], 0
cmp dword [ebp - 0xf84], 0x510afbd1
jg 0x480a13
mov eax, 0x8c537847
test eax, eax
jne 0x480a13
and dword [ebp - 0x1f34], 0
jmp 0x480a1d
mov dword [ebp - 0x1f34], 1
mov eax, dword [ebp - 0x1f34]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x454], eax
jle 0x480a43
mov dword [ebp - 0xf8c], 1
jmp 0x480a4a
and dword [ebp - 0xf8c], 0
cmp dword [ebp - 0xf8c], 1
jg 0x480a5f
mov dword [ebp - 0xf94], 1
jmp 0x480a66
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0x1f3c]
imul eax, dword [ebp - 0xf94]
imul eax, dword [ebp - 0x190]
mov dword [ebp - 0x1f44], eax
mov eax, dword [ebp - 0x1f44]
cmp dword [ebp - 0xf9c], eax
jle 0x480aa6
mov dword [ebp - 0xfa4], 1
jmp 0x480aad
and dword [ebp - 0xfa4], 0
mov eax, dword [ebp - 0x1f4c]
cmp dword [ebp - 0xfa4], eax
jne 0x480c28
mov dword [ebp - 0x3658], 0
mov dword [ebp - 0x3660], 0xffffffff
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x3668], 0xfffffffa
mov dword [ebp - 0x3670], 0xaacda2a4
mov dword [ebp - 0x3678], 0xfffffff7
mov dword [ebp - 0x3680], 0x676bd76d
mov dword [ebp - 0x1f54], 0x77fd8b26
mov dword [ebp - 0x6b0], 0
jmp 0x480b28
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 3
jge 0x480b44
mov eax, dword [ebp - 0x6b0]
mov dword [ebp + eax*4 - 0x3a90], 0xfffffffe
jmp 0x480b1b
mov dword [ebp - 0x454], 0xfffffff2
jmp 0x480b5d
cmp dword [ebp - 0x454], 0xffffffe8
jl 0x480bcb
mov byte [ebp - 0x31b], 0
movzx eax, byte [ebp - 0x31b]
test eax, eax
je 0x480c42
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 0x10], 0xe44fa3fd
mov dword [ebp - 8], 0xc70bb743
mov dword [ebp - 0x2a9c], 9
mov dword [ebp - 0x914], 0
jmp 0x480c73
cmp dword [ebp - 0x914], 3
jge 0x480c8f
mov eax, dword [ebp - 0x914]
mov dword [ebp + eax*4 - 0x24b0], 0xfffffffa
jmp 0x480c66
mov eax, 0x61c0f806
sub eax, dword [ebp - 8]
jne 0x480ca5
cmp dword [ebp + 8], 1
jne 0x497f14
mov dword [ebp - 0x18c], 0xfffffff9
mov dword [ebp - 0xa94], 0xf34bdac8
mov dword [ebp - 0x53c], 0xfffffffc
mov dword [ebp - 0x2a0], 3
mov dword [ebp - 0x18c], 0x1b
jmp 0x48e8a2
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x11
jg 0x48ef5b
mov dword [ebp - 0x114], 0xe6f885ea
mov dword [ebp - 0x194], 1
mov dword [ebp - 0xa84], 0xffff
mov dword [ebp - 0xa8c], 0xfffffffc
mov dword [ebp - 0x9e8], 0
jmp 0x48e8f0
mov eax, dword [ebp - 0x9e8]
inc eax
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x9e8], 2
jge 0x48e90c
mov eax, dword [ebp - 0x9e8]
mov dword [ebp + eax*4 - 0x2460], 0xffffffff
jmp 0x48e8e3
mov eax, dword [ebp - 0x18c]
sub eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x114], eax
jle 0x48e92c
mov dword [ebp - 0x2040], 1
jmp 0x48e933
and dword [ebp - 0x2040], 0
mov eax, dword [ebp - 0x2040]
mov dword [ebp - 0xa94], eax
mov eax, 0xa228
sub eax, dword [ebp - 0xa94]
je 0x48e961
cmp dword [ebp - 0x114], 0
je 0x48e961
mov dword [ebp - 0x1bb0], 1
jmp 0x48e968
and dword [ebp - 0x1bb0], 0
cmp dword [ebp - 0x1bb0], 0x53f3
jle 0x48e980
mov dword [ebp - 0x23a0], 1
jmp 0x48e987
and dword [ebp - 0x23a0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x23a0], eax
je 0x48e9a1
mov dword [ebp - 0x1bb8], 1
jmp 0x48e9a8
and dword [ebp - 0x1bb8], 0
cmp dword [ebp - 0x1bb8], 0xfffffff9
jg 0x48e9bd
mov dword [ebp - 0x2048], 1
jmp 0x48e9c4
and dword [ebp - 0x2048], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x2048], eax
jle 0x48e9e7
cmp dword [ebp - 0x114], 0
je 0x48e9e7
mov dword [ebp - 0x1bc0], 1
jmp 0x48e9ee
and dword [ebp - 0x1bc0], 0
imul eax, dword [ebp - 0x1bc0], 0
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x35bc], eax
push 7
pop eax
test eax, eax
jne 0x48ea26
mov dword [ebp - 0x2290], 1
jmp 0x48ea2d
and dword [ebp - 0x2290], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x2290], eax
jge 0x48ea47
mov dword [ebp - 0x1bc8], 1
jmp 0x48ea4e
and dword [ebp - 0x1bc8], 0
imul eax, dword [ebp - 0x1bc8], 0xffff
test eax, eax
je 0x48ebb7
mov dword [ebp - 0x878], 1
mov dword [ebp - 0x1bd0], 0xf03f
mov dword [ebp - 0x29c0], 1
cmp dword [ebp - 0x114], 0xc321
jl 0x48ea96
mov dword [ebp - 0x24a4], 1
jmp 0x48ea9d
and dword [ebp - 0x24a4], 0
cmp dword [ebp - 0x53c], 0
jne 0x48eb18
mov eax, dword [ebp - 0x878]
cmp dword [ebp - 0x878], eax
jl 0x48eac0
mov dword [ebp - 0x2050], 1
jmp 0x48eac7
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0x2050]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
inc eax
cmp eax, dword [ebp - 0x1bd0]
jne 0x48eaee
mov dword [ebp - 0x28c4], 1
jmp 0x48eaf5
and dword [ebp - 0x28c4], 0
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x326c], eax
mov eax, dword [ebp - 0x1bd0]
cmp dword [ebp - 0x53c], eax
jl 0x48eb18
and dword [ebp - 0x1bd8], 0
jmp 0x48eb22
mov dword [ebp - 0x1bd8], 1
mov eax, dword [ebp - 0x24a4]
add eax, dword [ebp - 0x1bd8]
jne 0x48eb42
mov eax, 0xffff
test eax, eax
jne 0x48eb42
and dword [ebp - 0x2058], 0
jmp 0x48eb4c
mov dword [ebp - 0x2058], 1
mov eax, dword [ebp - 0x2058]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xa84]
add eax, dword [ebp - 0x878]
cmp eax, 2
jae 0x48eb75
mov dword [ebp - 0x1be0], 1
jmp 0x48eb7c
and dword [ebp - 0x1be0], 0
cmp dword [ebp - 0x1be0], 0x4a797449
jge 0x48eb94
mov dword [ebp - 0x2298], 1
jmp 0x48eb9b
and dword [ebp - 0x2298], 0
imul eax, dword [ebp - 0x2298], 0xea41
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0x29c0], 0xbd8d46c6
jmp 0x48ebcf
mov dword [ebp - 0x28cc], 0xff4c
cmp dword [ebp - 0x28cc], 0
je 0x48ebcf
jmp 0x48ef5b
mov dword [ebp - 0x194], 1
jmp 0x48ebe8
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x48ef56
mov dword [ebp - 0x880], 0x9a030833
mov dword [ebp - 0x29c4], 0x56065d6f
mov dword [ebp - 0x2078], 0x8bdd0c5d
mov dword [ebp - 0x2a0], 1
jmp 0x48ec2c
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jl 0x48ee8a
mov dword [ebp - 0x29cc], 1
mov dword [ebp - 0x938], 0
jmp 0x48ec5c
mov eax, dword [ebp - 0x938]
inc eax
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 1
jge 0x48ec78
mov eax, dword [ebp - 0x938]
mov dword [ebp + eax*4 - 0x2068], 0x20a50d0c
jmp 0x48ec4f
mov dword [ebp - 0x114], 0
jmp 0x48ec91
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jg 0x48ee85
mov dword [ebp - 0x28d4], 0xffffffff
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp + eax*4 - 0x2460], 0
jne 0x48ee2a
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x2460]
mov dword [ebp - 0x36c4], eax
mov dword [ebp - 0x29c4], 0x4ccf97a2
cmp dword [ebp - 0x18c], 0xd2634d7
jg 0x48ecf1
mov dword [ebp - 0xa7c], 1
jmp 0x48ecf8
and dword [ebp - 0xa7c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa7c]
mov dword [ebp + eax - 0x2068], ecx
cmp dword [ebp - 0xa7c], 0
jne 0x48ed26
cmp dword [ebp - 0x28d4], 0
jne 0x48ed26
and dword [ebp - 0x1be8], 0
jmp 0x48ed30
mov dword [ebp - 0x1be8], 1
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x2460]
cmp dword [ebp - 0x1be8], eax
jl 0x48ed51
mov dword [ebp - 0x2060], 1
jmp 0x48ed58
and dword [ebp - 0x2060], 0
mov eax, dword [ebp - 0x880]
cmp dword [ebp - 0x2060], eax
jl 0x48ed72
mov dword [ebp - 0x1bf0], 1
jmp 0x48ed79
and dword [ebp - 0x1bf0], 0
cmp dword [ebp - 0x1bf0], 0x26eb
jl 0x48ed9a
cmp dword [ebp - 0x880], 0
je 0x48ed9a
mov dword [ebp - 0x23a8], 1
jmp 0x48eda1
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0xa84]
cmp dword [ebp - 0x23a8], eax
jge 0x48edbb
mov dword [ebp - 0x1bf8], 1
jmp 0x48edc2
and dword [ebp - 0x1bf8], 0
mov eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0x2078], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2068]
mov dword [ebp - 0x3274], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x35c4], eax
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x880], eax
jl 0x48ee07
mov dword [ebp - 0x1c00], 1
jmp 0x48ee0e
and dword [ebp - 0x1c00], 0
imul eax, dword [ebp - 0x1c00], 0xe226
test eax, eax
je 0x48ee21
xor eax, eax
inc eax
jne 0x48ee2a
and dword [ebp - 0x22a0], 0
jmp 0x48ee34
mov dword [ebp - 0x22a0], 1
cmp dword [ebp - 0x22a0], 0xf2c4
jl 0x48ee4c
mov dword [ebp - 0x1c08], 1
jmp 0x48ee53
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x1c08]
add eax, 0x2a80
mov dword [ebp - 0x29cc], eax
mov byte [ebp - 0x424], 0
movzx eax, byte [ebp - 0x424]
test eax, eax
je 0x48ee80
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x48ec84
jmp 0x48ec1f
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp + eax*4 - 0x2460]
mov dword [ebp - 0x327c], eax
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x53c]
cmp dword [ebp + eax*4 - 0x2460], ecx
je 0x48eebe
mov dword [ebp - 0x2070], 1
jmp 0x48eec5
and dword [ebp - 0x2070], 0
cmp dword [ebp - 0x2070], 0x789c297e
jle 0x48eedd
mov dword [ebp - 0x1c10], 1
jmp 0x48eee4
and dword [ebp - 0x1c10], 0
mov eax, dword [ebp - 0x1c10]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x378c], eax
xor eax, eax
sub eax, 0xc16b7c5e
cmp eax, 2
je 0x48ef14
mov dword [ebp - 0x2090], 1
jmp 0x48ef1b
and dword [ebp - 0x2090], 0
mov eax, dword [ebp - 0xa94]
mov ecx, dword [ebp - 0x2090]
lea eax, [ecx + eax + 1]
cmp eax, 0x766aa6f6
jg 0x48ef3e
mov dword [ebp - 0x1c18], 1
jmp 0x48ef45
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x1c18]
mov dword [ebp - 0x2078], eax
jmp 0x48ebdb
jmp 0x48e895
mov dword [ebp - 0x3284], 0xeac8b13e
mov dword [ebp - 0x888], 0xfcb50bf3
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x35cc], 0xb8f3d421
mov dword [ebp - 0x2bec], 0xb16b
mov dword [ebp - 0x2be8], 0xb16b
mov dword [ebp - 0x2be4], 0xb16b
mov dword [ebp - 0x2be0], 0xb16b
mov dword [ebp - 0x998], 0
jmp 0x48efc4
mov eax, dword [ebp - 0x998]
inc eax
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x998], 3
jge 0x48efe0
mov eax, dword [ebp - 0x998]
mov dword [ebp + eax*4 - 0x3a6c], 0xd6887694
jmp 0x48efb7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2bec]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2bec], eax
mov dword [ebp - 0x888], 0
jmp 0x48f014
mov eax, dword [ebp - 0x888]
dec eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0xfffffffc
jg 0x48f1ee
mov dword [ebp - 0x1c20], 0xfffffffe
mov dword [ebp - 0x940], 0
jmp 0x48f044
mov eax, dword [ebp - 0x940]
inc eax
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 4
jge 0x48f060
mov eax, dword [ebp - 0x940]
mov dword [ebp + eax*4 - 0x37ac], 0x191b4956
jmp 0x48f037
mov dword [ebp - 0x890], 0
jmp 0x48f079
mov eax, dword [ebp - 0x890]
dec eax
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 0xffffffe8
jle 0x48f1e9
mov dword [ebp - 0x538], 0xffffffff
mov dword [ebp - 0x9c8], 0
jmp 0x48f0a9
mov eax, dword [ebp - 0x9c8]
inc eax
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 1
jge 0x48f0c5
mov eax, dword [ebp - 0x9c8]
mov dword [ebp + eax*4 - 0x1c28], 5
jmp 0x48f09c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2bec]
mov dword [ebp - 0x328c], eax
mov dword [ebp - 0x1c20], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37ac]
cmp dword [ebp - 0x1c20], eax
jne 0x48f103
mov dword [ebp - 0x2094], 1
jmp 0x48f10a
and dword [ebp - 0x2094], 0
mov eax, dword [ebp - 0x2094]
sub eax, 0xffff
jne 0x48f17d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37ac]
cmp dword [ebp - 0x538], eax
jl 0x48f138
mov dword [ebp - 0x1c30], 1
jmp 0x48f13f
and dword [ebp - 0x1c30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c28]
inc eax
mov dword [ebp - 0x2080], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2080]
mov dword [ebp + eax - 0x1c28], ecx
mov eax, dword [ebp - 0x2080]
cmp eax, dword [ebp - 0x1c30]
jne 0x48f17d
and dword [ebp - 0x209c], 0
jmp 0x48f187
mov dword [ebp - 0x209c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x209c]
mov dword [ebp + eax - 0x37ac], ecx
mov dword [ebp - 0x538], 3
jmp 0x48f1b2
mov eax, dword [ebp - 0x538]
dec eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
jl 0x48f1e4
mov byte [ebp - 0x331], 0
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x48f1e2
push 0x5f4
push 0x235a
push 0xaee
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x48f1a5
jmp 0x48f06c
jmp 0x48f007
mov dword [ebp - 0xaa4], 1
mov dword [ebp - 0xaac], 0x2ee6d058
mov dword [ebp - 0x1c40], 0x86f8c7b5
mov dword [ebp - 0x13c4], 0
mov dword [ebp - 0xa9c], 0xc6d
mov dword [ebp - 0x36cc], 0xfffffffd
mov dword [ebp - 0x1c38], 0x4028
mov dword [ebp - 0x948], 0x14ca72cb
mov dword [ebp - 0x29d4], 0
mov dword [ebp - 0x898], 0
jmp 0x48f261
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 3
jge 0x48f27d
mov eax, dword [ebp - 0x898]
mov dword [ebp + eax*4 - 0x38b8], 0x3de0369b
jmp 0x48f254
cmp dword [ebp - 0xaa4], 0
jne 0x48f3b5
mov eax, dword [ebp - 0xa9c]
dec eax
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x1c38]
dec eax
mov dword [ebp - 0x1c38], eax
cmp dword [ebp - 0xaa4], 0
je 0x48f2e1
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x2088], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2088]
mov dword [ebp + eax - 0x38b8], ecx
cmp dword [ebp - 0x2088], 0
je 0x48f2e1
mov dword [ebp - 0x28dc], 1
jmp 0x48f2e8
and dword [ebp - 0x28dc], 0
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x1c40], eax
mov eax, dword [ebp - 0x1c40]
mov dword [ebp - 0x3294], eax
mov dword [ebp - 0xaac], 0xfffffff9
mov eax, 0xaf0b
sub eax, dword [ebp - 0xaac]
cmp eax, 0xde21
jge 0x48f328
mov dword [ebp - 0x20a4], 1
jmp 0x48f32f
and dword [ebp - 0x20a4], 0
mov eax, dword [ebp - 0x20a4]
dec eax
cmp eax, dword [ebp - 0x13c4]
je 0x48f34a
mov dword [ebp - 0x1c48], 1
jmp 0x48f351
and dword [ebp - 0x1c48], 0
cmp dword [ebp - 0x1c48], 0
ja 0x48f366
mov dword [ebp - 0x13c0], 1
jmp 0x48f36d
and dword [ebp - 0x13c0], 0
mov eax, dword [ebp - 0x13c0]
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 0
je 0x48f397
cmp dword [ebp - 0x948], 0
je 0x48f397
mov dword [ebp - 0x13cc], 1
jmp 0x48f39e
and dword [ebp - 0x13cc], 0
mov eax, dword [ebp - 0x13c4]
cmp dword [ebp - 0x13cc], eax
jge 0x48f3b5
and dword [ebp - 0x13d4], 0
jmp 0x48f3bf
mov dword [ebp - 0x13d4], 1
mov eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x13d4], eax
jl 0x48f3df
cmp dword [ebp - 0xaac], 0
jne 0x48f3df
and dword [ebp - 0x13dc], 0
jmp 0x48f3e9
mov dword [ebp - 0x13dc], 1
mov eax, dword [ebp - 0x13dc]
mov dword [ebp - 0x29d4], eax
mov dword [ebp - 0x2c], 0x4b4e1265
mov dword [ebp - 0x35d4], 0x37bc7528
mov dword [ebp - 0x13e4], 6
mov dword [ebp - 0x8a0], 0
jmp 0x48f429
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 1
jge 0x48f445
mov eax, dword [ebp - 0x8a0]
mov dword [ebp + eax*4 - 0x329c], 4
jmp 0x48f41c
mov eax, dword [ebp - 0x13e4]
dec eax
mov dword [ebp - 0x13e4], eax
mov byte [ebp - 0x43a], 0
movzx eax, byte [ebp - 0x43a]
test eax, eax
je 0x48f46c
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [ebp - 0x9a0], 0
jmp 0x48f485
mov eax, dword [ebp - 0x9a0]
inc eax
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 2
jge 0x48f4a1
mov eax, dword [ebp - 0x9a0]
mov dword [ebp + eax*4 - 0x25e0], 0x67ee
jmp 0x48f478
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x3d0], 0xaa96
mov dword [ebp - 0xabc], 0x1e1d82c3
mov dword [ebp - 0x3c8], 1
mov dword [ebp - 0x8a8], 0
jmp 0x48f4e2
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 3
jge 0x48f4fe
mov eax, dword [ebp - 0x8a8]
mov dword [ebp + eax*4 - 0x2d64], 0xb622
jmp 0x48f4d5
mov dword [ebp - 0xc4], 0
jmp 0x48f517
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1b
je 0x48f6fc
mov dword [ebp - 0xab4], 1
mov dword [ebp - 0x29dc], 0xffff
mov dword [ebp - 0x19c], 0
jmp 0x48f551
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x48f56d
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x548], 0xb01d91e6
jmp 0x48f544
mov dword [ebp - 0x19c], 0
jmp 0x48f586
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x48f5a2
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x3a04], 1
jmp 0x48f579
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x373c], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xab4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 0xab4], eax
jne 0x48f5db
mov dword [ebp - 0x13bc], 1
jmp 0x48f5e2
and dword [ebp - 0x13bc], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x548], 0xfffffffe
jne 0x48f5fe
mov dword [ebp - 0x13ec], 1
jmp 0x48f605
and dword [ebp - 0x13ec], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xabc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
add eax, dword [ebp - 0x13ec]
cmp dword [ebp - 0xabc], eax
jl 0x48f638
mov dword [ebp - 0x13b8], 1
jmp 0x48f63f
and dword [ebp - 0x13b8], 0
mov eax, dword [ebp - 0x13bc]
imul eax, dword [ebp - 0x13b8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x548]
je 0x48f662
cmp dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1404], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1404]
mov dword [ebp + eax - 0x548], ecx
mov eax, dword [ebp - 0x1404]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0xc33c017f
ja 0x48f6a5
mov dword [ebp - 0x28e4], 1
jmp 0x48f6ac
and dword [ebp - 0x28e4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x32a4], eax
or eax, 0xffffffff
jne 0x48f6cf
cmp dword [ebp - 0xc4], 0
jne 0x48f6cf
and dword [ebp - 0x140c], 0
jmp 0x48f6d9
mov dword [ebp - 0x140c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x140c]
mov dword [ebp + eax - 0x3a04], ecx
cmp dword [ebp - 0x29dc], 0
je 0x48f6f7
jmp 0x48f6fc
jmp 0x48f50a
mov dword [ebp - 0x3c8], 2
jmp 0x48f715
mov eax, dword [ebp - 0x3c8]
dec eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
jl 0x48f796
mov dword [ebp - 0xc4], 2
jmp 0x48f737
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x48f791
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x3c8]
mov eax, dword [ebp + eax*4 - 0x2d64]
mov dword [ebp + ecx*4 - 0x2d64], eax
mov dword [ebp - 0x3d0], 0
jmp 0x48f773
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x48f78f
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0x2d64], 0xffffffff
jmp 0x48f766
jmp 0x48f72a
jmp 0x48f708
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x35dc], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jl 0x48f7b6
mov dword [ebp - 0x1414], 1
jmp 0x48f7bd
and dword [ebp - 0x1414], 0
cmp dword [ebp - 0x1414], 1
je 0x48f7d2
mov dword [ebp - 0x141c], 1
jmp 0x48f7d9
and dword [ebp - 0x141c], 0
cmp dword [ebp - 0x141c], 0x4307
jl 0x48f7f1
mov dword [ebp - 0x1424], 1
jmp 0x48f7f8
and dword [ebp - 0x1424], 0
cmp dword [ebp - 0x1424], 0xfffffffb
jb 0x48f80d
mov dword [ebp - 0x142c], 1
jmp 0x48f814
and dword [ebp - 0x142c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25e0]
cmp dword [ebp - 0x142c], eax
jle 0x48f835
mov dword [ebp - 0x1434], 1
jmp 0x48f83c
and dword [ebp - 0x1434], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1434]
sub ecx, dword [ebp + eax - 0x25e0]
jne 0x48f85d
mov dword [ebp - 0x143c], 1
jmp 0x48f864
and dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x143c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jbe 0x48fdfe
mov dword [ebp - 0x550], 0xffffffff
mov dword [ebp - 0x950], 0
mov dword [ebp - 0x28ec], 0x9951ea66
mov dword [ebp - 0x32ac], 0xfffffff7
mov dword [ebp - 0x28f4], 0xffffffff
mov dword [ebp - 0x64], 0
jmp 0x48f8bc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x48f8d2
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2d08], 0xd7f8
jmp 0x48f8b5
mov dword [ebp - 0x64], 0
jmp 0x48f8e2
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x48f8f8
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3840], 3
jmp 0x48f8db
mov dword [ebp - 0x64], 0
jmp 0x48f908
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x48f91e
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3810], 0x1867
jmp 0x48f901
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x48f946
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov dword [ebp - 0x550], 1
jmp 0x48f95f
cmp dword [ebp - 0x550], 0
jl 0x48fbab
mov dword [ebp - 0x558], 1
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x36d4], 0x456160cb
mov dword [ebp - 0xac4], 3
mov dword [ebp - 0x32b4], 0xa83a0f0f
mov dword [ebp - 0x1484], 0x2c593c86
mov dword [ebp - 0x1444], 0xfff6
mov dword [ebp - 0x558], 1
jmp 0x48f9cb
cmp dword [ebp - 0x558], 0
jl 0x48fa2b
mov dword [ebp - 0x35e4], 0
mov dword [ebp - 0x32bc], 1
mov dword [ebp - 0x3774], 0xffffffff
mov dword [ebp - 0x32c4], 0x4f88039d
mov dword [ebp - 0x35ec], 0x84e5a945
mov dword [ebp - 0x950], 1
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x28ec], eax
mov eax, dword [ebp - 0x1444]
dec eax
mov dword [ebp - 0x1444], eax
jmp 0x48f9be
mov eax, dword [ebp - 0x550]
cmp dword [ebp + eax*4 - 0x2d08], 2
ja 0x48fa47
mov dword [ebp - 0x2c], 0
jmp 0x48fbbb
cmp dword [ebp - 0x2c], 2
jge 0x48fdf9
mov dword [ebp - 0xcc], 0x2c03342e
mov dword [ebp - 0x75c], 0
jmp 0x48fbe8
jmp 0x493428
mov dword [ebp - 0x36dc], 0xeac8b13e
mov dword [ebp - 0x77c], 0xfcb50bf3
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0x32d4], 0xb8f3d421
mov dword [ebp - 0x2bdc], 0xb16b
mov dword [ebp - 0x2bd8], 0xb16b
mov dword [ebp - 0x2bd4], 0xb16b
mov dword [ebp - 0x2bd0], 0xb16b
mov dword [ebp - 0x774], 0
jmp 0x48fe67
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 3
jge 0x48fe83
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x3a84], 0xd6887694
jmp 0x48fe5a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2bdc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2bdc], eax
mov dword [ebp - 0x77c], 0
jmp 0x48feb7
mov eax, dword [ebp - 0x77c]
dec eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0xfffffffc
jg 0x490091
mov dword [ebp - 0x14dc], 0xfffffffe
mov dword [ebp - 0x784], 0
jmp 0x48fee7
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 4
jge 0x48ff03
mov eax, dword [ebp - 0x784]
mov dword [ebp + eax*4 - 0x37c0], 0x191b4956
jmp 0x48feda
mov dword [ebp - 0x78c], 0
jmp 0x48ff1c
cmp dword [ebp - 0x78c], 0xffffffe8
jle 0x49008c
mov dword [ebp - 0x560], 0xffffffff
mov dword [ebp - 0x794], 0
jmp 0x48ff4c
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 1
jge 0x48ff68
mov eax, dword [ebp - 0x794]
mov dword [ebp + eax*4 - 0x14ec], 5
jmp 0x48ff3f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2bdc]
mov dword [ebp - 0x35f4], eax
mov dword [ebp - 0x14dc], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37c0]
cmp dword [ebp - 0x14dc], eax
jne 0x48ffa6
mov dword [ebp - 0x14e4], 1
jmp 0x48ffad
and dword [ebp - 0x14e4], 0
mov eax, dword [ebp - 0x14e4]
sub eax, 0xffff
jne 0x490020
jmp 0x48feaa
mov dword [ebp - 0x2d8c], 1
mov dword [ebp - 0x2d88], 1
mov dword [ebp - 0x2d84], 1
mov dword [ebp - 0x2d80], 1
mov dword [ebp - 0x79c], 0xe76f5020
mov dword [ebp - 0x1524], 0xfffffffc
mov dword [ebp - 0x2e7c], 0x347d
mov dword [ebp - 0x2e78], 0x347d
mov dword [ebp - 0x2e74], 0x347d
mov dword [ebp - 0x2e70], 0x347d
mov dword [ebp - 0x1a4], 0
jmp 0x49010e
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 4
jge 0x49012a
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x2d40], 0xdc85
jmp 0x490101
mov dword [ebp - 0x1a4], 0
jmp 0x490143
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x49015f
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x155c], 0x58905b8b
jmp 0x490136
mov dword [ebp - 0x79c], 0
jmp 0x490178
cmp dword [ebp - 0x79c], 3
jg 0x4903ed
mov dword [ebp - 0x11c], 0xd3b3152c
mov dword [ebp - 0x152c], 0x1540ee1d
mov dword [ebp - 0x65c], 0
jmp 0x4901b2
cmp dword [ebp - 0x65c], 1
jge 0x4901ce
mov dword [ebp - 0xb0c], 0xf26af903
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x7a4], 0
jmp 0x490417
cmp dword [ebp - 0x7a4], 3
jge 0x490433
mov dword [ebp - 0xe0], 0x5a23e86f
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x1390], 0x2da3c3d
mov dword [ebp - 0x13b0], 0
mov dword [ebp - 0x2820], 0
mov dword [ebp - 0x3128], 0x17a68fab
mov byte [ebp - 0x433], 0
movzx eax, byte [ebp - 0x433]
test eax, eax
je 0x497f76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x620], eax
jg 0x497f9c
mov dword [ebp - 0x2808], 1
jmp 0x497fa3
and dword [ebp - 0x2808], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], eax
jge 0x497fbd
mov dword [ebp - 0x2810], 1
jmp 0x497fc4
and dword [ebp - 0x2810], 0
cmp dword [ebp - 0x620], 0
jne 0x497fd4
cmp dword [ebp - 0x620], 0
cmp dword [ebp - 0x620], 0x4d1b
jge 0x497ff2
cmp dword [ebp - 0xe0], 0
jne 0x497ff2
and dword [ebp - 0x1388], 0
jmp 0x497ffc
mov dword [ebp - 0x1388], 1
mov eax, dword [ebp - 0x1388]
mov dword [ebp - 0x1390], eax
mov eax, dword [ebp - 0x1390]
sub eax, 0x462ccd20
cmp eax, 1
jl 0x498024
mov dword [ebp - 0x1398], 1
jmp 0x49802b
and dword [ebp - 0x1398], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x1398]
cmp eax, dword [ebp - 0xe0]
jg 0x49804b
mov dword [ebp - 0x13a0], 1
jmp 0x498052
and dword [ebp - 0x13a0], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x13a0]
cmp eax, dword [ebp - 0xe0]
jle 0x498072
mov dword [ebp - 0x13a8], 1
jmp 0x498079
and dword [ebp - 0x13a8], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x13a8], eax
jle 0x498093
mov dword [ebp - 0x2818], 1
jmp 0x49809a
and dword [ebp - 0x2818], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x3130], eax
or eax, 0xffffffff
cmp eax, 0xe712
jle 0x4980b7
cmp dword [ebp - 0xe0], 0
mov dword [ebp - 0x13b0], 0xffffffff
mov eax, dword [ebp - 0x13b0]
mov dword [ebp - 0x2820], eax
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0047d0d6
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret