Function at 0x4763ee
Capabilities:
Check os version
Delete directory
Get disk information
Hide graphical window
Query service status
Read .ini file
Resume thread
Set registry value
Start service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x45c0
call fcn.004b3740
push esi
push 1
lea ecx, [ebp - 0x3e30]
call fcn.00434e60
mov dword [ebp - 0x74c], 0
jmp 0x476422
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 1
jge 0x476444
push dword [ebp - 0x74c]
lea ecx, [ebp - 0x3e30]
call fcn.00434f4e
mov dword [eax], 0xa8ea
jmp 0x476415
mov byte [ebp - 0x4ef], 0
movzx eax, byte [ebp - 0x4ef]
test eax, eax
je 0x476467
push 0
push 1
push 0x1ed8
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 0x374], 0
movzx eax, byte [ebp - 0x374]
test eax, eax
je 0x47648f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
lea ecx, [ebp - 0x3e30]
call fcn.00434f32
mov dword [ebp - 0x610], 0
mov dword [ebp - 0xe5c], 0x7858f9c2
mov dword [ebp - 0x3d1c], 0xb4af
mov dword [ebp - 0x9a8], 0
jmp 0x4764d1
mov eax, dword [ebp - 0x9a8]
inc eax
mov dword [ebp - 0x9a8], eax
cmp dword [ebp - 0x9a8], 3
jge 0x4764ed
mov eax, dword [ebp - 0x9a8]
mov dword [ebp + eax*4 - 0x44e4], 0xfff9
jmp 0x4764c4
mov dword [ebp - 0x610], 0
jmp 0x476506
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 2
jg 0x476650
mov dword [ebp - 0xe8], 0x5ce96b77
mov dword [ebp - 0x2ac4], 0
mov eax, 0x1f1e
test eax, eax
je 0x4765c8
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0xe5c], 0
jne 0x4765c8
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x3720], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x3728], eax
cmp dword [ebp - 0xe8], 0x27d373ee
je 0x476579
mov dword [ebp - 0x1d8c], 1
jmp 0x476580
and dword [ebp - 0x1d8c], 0
mov eax, dword [ebp - 0xe5c]
cmp dword [ebp - 0x1d8c], eax
je 0x47659a
mov dword [ebp - 0x26a8], 1
jmp 0x4765a1
and dword [ebp - 0x26a8], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x26a8], eax
je 0x4765bb
mov dword [ebp - 0x26b0], 1
jmp 0x4765c2
and dword [ebp - 0x26b0], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0xe8], 0
jne 0x4765e3
cmp dword [ebp - 0xe8], 0
jne 0x4765e3
and dword [ebp - 0x26b8], 0
jmp 0x4765ed
mov dword [ebp - 0x26b8], 1
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x26b8], eax
je 0x47660d
cmp dword [ebp - 0xe8], 0
jne 0x47660d
and dword [ebp - 0x29b4], 0
jmp 0x476617
mov dword [ebp - 0x29b4], 1
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x3730], eax
cmp dword [ebp - 0xe8], 0xffffffff
jg 0x476638
mov dword [ebp - 0x26c0], 1
jmp 0x47663f
and dword [ebp - 0x26c0], 0
mov eax, dword [ebp - 0x26c0]
mov dword [ebp - 0x2ac4], eax
jmp 0x4764f9
mov dword [ebp - 0x274c], 1
mov dword [ebp - 0xc8], 0x8c66
mov dword [ebp - 0x26d0], 0xfe23a266
mov dword [ebp - 0x75c], 1
mov dword [ebp - 0x998], 0x7fa3dfad
mov dword [ebp - 0x272c], 0x9ee491ba
mov dword [ebp - 0x3738], 0xd8284a89
mov dword [ebp - 0x754], 0
jmp 0x4766af
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 3
jge 0x4766cb
mov eax, dword [ebp - 0x754]
mov dword [ebp + eax*4 - 0x455c], 0x6ef3b063
jmp 0x4766a2
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x3740], eax
cmp dword [ebp - 0x998], 0
je 0x4766f5
cmp dword [ebp - 0x274c], 0
je 0x4766f5
mov dword [ebp - 0x26c8], 1
jmp 0x4766fc
and dword [ebp - 0x26c8], 0
mov eax, dword [ebp - 0x26d0]
cmp dword [ebp - 0x26c8], eax
jne 0x47671f
cmp dword [ebp - 0x998], 0
je 0x47671f
mov dword [ebp - 0x26d8], 1
jmp 0x476726
and dword [ebp - 0x26d8], 0
mov eax, dword [ebp - 0x26d0]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x75c]
cmp eax, dword [ebp - 0x26d8]
jg 0x47674c
mov dword [ebp - 0x271c], 1
jmp 0x476753
and dword [ebp - 0x271c], 0
cmp dword [ebp - 0x271c], 0x946b43d2
jne 0x47676b
mov dword [ebp - 0x2724], 1
jmp 0x476772
and dword [ebp - 0x2724], 0
mov eax, dword [ebp - 0x2724]
mov dword [ebp - 0x272c], eax
cmp dword [ebp - 0x272c], 0
je 0x47679c
cmp dword [ebp - 0x75c], 0
je 0x47679c
mov dword [ebp - 0x2734], 1
jmp 0x4767a3
and dword [ebp - 0x2734], 0
mov eax, dword [ebp - 0x2734]
add eax, 0x14ab653b
je 0x4767c5
mov eax, 0x1046
test eax, eax
je 0x4767c5
mov dword [ebp - 0x273c], 1
jmp 0x4767cc
and dword [ebp - 0x273c], 0
mov eax, dword [ebp - 0x998]
cmp dword [ebp - 0x273c], eax
jle 0x4767e6
mov dword [ebp - 0x2744], 1
jmp 0x4767ed
and dword [ebp - 0x2744], 0
cmp dword [ebp - 0x2744], 4
jg 0x476802
mov dword [ebp - 0x2754], 1
jmp 0x476809
and dword [ebp - 0x2754], 0
mov eax, dword [ebp - 0x274c]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x2754]
add eax, 7
cmp dword [ebp - 0xc8], eax
jl 0x476832
mov dword [ebp - 0x2acc], 1
jmp 0x476839
and dword [ebp - 0x2acc], 0
mov eax, 0xd25bb086
test eax, eax
je 0x47686b
mov byte [ebp - 0x376], 0
movzx eax, byte [ebp - 0x376]
test eax, eax
je 0x476866
push 0xf7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x476a8d
mov dword [ebp - 0x275c], 0x38991f3
mov dword [ebp - 0xb4c], 0x2ea6ae20
mov dword [ebp - 0xc8], 2
jmp 0x476898
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x4768c9
mov byte [ebp - 0x378], 0
movzx eax, byte [ebp - 0x378]
test eax, eax
je 0x4768c7
push 0
push 0x1941
push 0x294
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp 0x47688b
mov dword [ebp - 0xc8], 0
jmp 0x4768e2
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfffffff0
je 0x476a8d
mov dword [ebp - 0x276c], 0x2601c8d5
mov dword [ebp - 0x2a4], 0xf620a341
mov dword [ebp - 0x3718], 0x89afff74
mov dword [ebp - 0x3714], 0x89afff74
mov dword [ebp - 0x3710], 0x89afff74
mov dword [ebp - 0x370c], 0x89afff74
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x275c], eax
cmp dword [ebp - 0x275c], 9
jle 0x47694c
mov dword [ebp - 0x2764], 1
jmp 0x476953
and dword [ebp - 0x2764], 0
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x3748], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x3750], eax
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x3758], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x3760], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x2764], eax
jg 0x47699d
mov dword [ebp - 0x2ad4], 1
jmp 0x4769a4
and dword [ebp - 0x2ad4], 0
cmp dword [ebp - 0x2a4], 0x1f903a79
jle 0x4769bc
mov dword [ebp - 0x2adc], 1
jmp 0x4769c3
and dword [ebp - 0x2adc], 0
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x3768], eax
mov eax, dword [ebp - 0x75c]
cmp dword [ebp - 0x2a4], eax
jl 0x4769e9
mov dword [ebp - 0x2774], 1
jmp 0x4769f0
and dword [ebp - 0x2774], 0
mov dword [ebp - 0x276c], 0xffff
mov eax, dword [ebp - 0x276c]
add eax, dword [ebp - 0x2774]
cmp eax, 0xffffffff
jbe 0x476a20
mov eax, 0x4d37718c
test eax, eax
je 0x476a20
mov dword [ebp - 0x277c], 1
jmp 0x476a27
and dword [ebp - 0x277c], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x277c], eax
je 0x476a41
mov dword [ebp - 0x2784], 1
jmp 0x476a48
and dword [ebp - 0x2784], 0
mov eax, dword [ebp - 0x2784]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3718]
cmp dword [ebp - 0x2a4], eax
jg 0x476a75
mov dword [ebp - 0x278c], 1
jmp 0x476a7c
and dword [ebp - 0x278c], 0
mov eax, dword [ebp - 0x278c]
mov dword [ebp - 0xb4c], eax
jmp 0x4768d5
push 1
lea ecx, [ebp - 0x3e60]
call fcn.00434e60
mov dword [ebp - 0x3c0], 0xfffffffe
mov dword [ebp - 0x764], 0
mov dword [ebp - 0x4f8], 0x1151c3c3
mov dword [ebp - 0x76c], 0xfff7
mov dword [ebp - 0x3c0], 0
jmp 0x476adb
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0xffffffed
jne 0x4772d3
mov dword [ebp - 0x2ac], 0xfffffff7
mov dword [ebp - 0x220], 0x99cdf9c7
mov dword [ebp - 0x158], 0x1bbb4f5a
mov dword [ebp - 0x360], 0x36be856d
mov dword [ebp - 0xe0], 0x96a53086
mov dword [ebp - 0x368], 0xffffffff
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
jne 0x476c0d
cmp dword [ebp - 0x3c0], 0xb66f
jl 0x476b4f
mov dword [ebp - 0x2794], 1
jmp 0x476b56
and dword [ebp - 0x2794], 0
mov eax, dword [ebp - 0x2794]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x476b89
cmp dword [ebp - 0x3c0], 0
jne 0x476b89
and dword [ebp - 0x279c], 0
jmp 0x476b93
mov dword [ebp - 0x279c], 1
mov eax, dword [ebp - 0x279c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x2ac], eax
jl 0x476bb9
mov dword [ebp - 0x27a4], 1
jmp 0x476bc0
and dword [ebp - 0x27a4], 0
mov eax, dword [ebp - 0x27a4]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x764]
cmp dword [ebp - 0xe0], eax
je 0x476be6
mov dword [ebp - 0x27ac], 1
jmp 0x476bed
and dword [ebp - 0x27ac], 0
mov eax, dword [ebp - 0x764]
sub eax, dword [ebp - 0x27ac]
imul eax, dword [ebp - 0x2ac]
test eax, eax
jne 0x476c0d
and dword [ebp - 0x2ae4], 0
jmp 0x476c17
mov dword [ebp - 0x2ae4], 1
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x3770], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x3778], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x3780], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x360], 0xfffffff4
jmp 0x476c60
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 2
jne 0x4772ce
mov dword [ebp - 0x9ac], 0xf093
mov dword [ebp - 0xc50], 0x98934eca
mov dword [ebp - 0xf88], 0x9226
mov dword [ebp - 0x2298], 0xfffffff7
mov dword [ebp - 0x158], 0x1a
jmp 0x476cae
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xfffffff1
je 0x4772be
mov dword [ebp - 0x604], 0x1cd43a1e
or dword [ebp - 0x33f8], 0xffffffff
or dword [ebp - 0x33f4], 0xffffffff
or dword [ebp - 0x33f0], 0xffffffff
or dword [ebp - 0x33ec], 0xffffffff
lea ecx, [ebp - 0xda1]
call fcn.00434f5d
push eax
lea eax, [ebp - 0x33e8]
push eax
lea eax, [ebp - 0x33f8]
push eax
lea ecx, [ebp - 0x4360]
call fcn.00434f60
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2994]
call fcn.00434f0c
mov byte [ebp - 0x37a], 0
movzx eax, byte [ebp - 0x37a]
test eax, eax
je 0x476d39
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x9ac], 0xda3b
jg 0x476d51
mov dword [ebp - 0x27b4], 1
jmp 0x476d58
and dword [ebp - 0x27b4], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x27b4], eax
jl 0x476d72
mov dword [ebp - 0x27bc], 1
jmp 0x476d79
and dword [ebp - 0x27bc], 0
mov eax, dword [ebp - 0x604]
cmp dword [ebp - 0x27bc], eax
jge 0x476d93
mov dword [ebp - 0x27c4], 1
jmp 0x476d9a
and dword [ebp - 0x27c4], 0
cmp dword [ebp - 0x27c4], 0x10a7
jne 0x476dad
cmp dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x220], 0
je 0x476dbd
cmp dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x3788], eax
push 6
pop eax
cmp eax, 0xfffa
jae 0x476ddf
mov dword [ebp - 0x2aec], 1
jmp 0x476de6
and dword [ebp - 0x2aec], 0
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x3790], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x3798], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xe0], eax
jle 0x476e24
mov dword [ebp - 0x27cc], 1
jmp 0x476e2b
and dword [ebp - 0x27cc], 0
mov eax, dword [ebp - 0x9ac]
imul eax, dword [ebp - 0x27cc]
test eax, eax
je 0x476e51
cmp dword [ebp - 0x604], 0
je 0x476e51
mov dword [ebp - 0xc48], 1
jmp 0x476e58
and dword [ebp - 0xc48], 0
push 2
lea ecx, [ebp - 0x2994]
call fcn.00434f4e
mov ecx, dword [ebp - 0xc48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9ac]
cmp dword [ebp - 0xc48], eax
je 0x476e87
mov dword [ebp - 0x27d4], 1
jmp 0x476e8e
and dword [ebp - 0x27d4], 0
mov eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x27d4]
cmp eax, 1
jae 0x476eac
mov dword [ebp - 0x27dc], 1
jmp 0x476eb3
and dword [ebp - 0x27dc], 0
mov eax, dword [ebp - 0x27dc]
sub eax, 0xa3c9
mov dword [ebp - 0xc50], eax
mov eax, 0xb5cfda6c
sub eax, dword [ebp - 0xc50]
js 0x477110
mov dword [ebp - 0xd80], 0xb579ab67
mov dword [ebp - 0x2b04], 0x6125f897
cmp dword [ebp - 0x3c0], 0xfffffffa
je 0x476efe
mov dword [ebp - 0x2af4], 1
jmp 0x476f05
and dword [ebp - 0x2af4], 0
mov eax, dword [ebp - 0xd80]
mov dword [ebp - 0x37a0], eax
mov dword [ebp - 0xe0], 0xffffffff
mov esi, dword [ebp - 0xe0]
push 2
lea ecx, [ebp - 0x2994]
call fcn.00434f4e
cmp dword [eax], esi
jge 0x476f3e
mov dword [ebp - 0x27e4], 1
jmp 0x476f45
and dword [ebp - 0x27e4], 0
cmp dword [ebp - 0x27e4], 0
jae 0x476f5a
mov dword [ebp - 0x27ec], 1
jmp 0x476f61
and dword [ebp - 0x27ec], 0
mov eax, dword [ebp - 0xd80]
cmp dword [ebp - 0x27ec], eax
jl 0x476f7b
mov dword [ebp - 0x27f4], 1
jmp 0x476f82
and dword [ebp - 0x27f4], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x27f4], eax
je 0x476f9c
mov dword [ebp - 0x287c], 1
jmp 0x476fa3
and dword [ebp - 0x287c], 0
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x287c], eax
jg 0x476fbd
mov dword [ebp - 0x2afc], 1
jmp 0x476fc4
and dword [ebp - 0x2afc], 0
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0xf88]
mov dword [ebp - 0x37a8], eax
cmp dword [ebp - 0x158], 0xac3517d3
jbe 0x476fee
mov dword [ebp - 0x2860], 1
jmp 0x476ff5
and dword [ebp - 0x2860], 0
cmp dword [ebp - 0x2860], 0x28f8f04b
jne 0x477013
mov eax, 0xdd146f18
test eax, eax
jne 0x477013
and dword [ebp - 0x25fc], 0
jmp 0x47701d
mov dword [ebp - 0x25fc], 1
cmp dword [ebp - 0x25fc], 0xb00f6109
je 0x477035
mov dword [ebp - 0x2288], 1
jmp 0x47703c
and dword [ebp - 0x2288], 0
mov eax, dword [ebp - 0x2288]
mov dword [ebp - 0xd80], eax
mov dword [ebp - 0xe0], 0
jmp 0x477061
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x47710b
mov dword [ebp - 0x220], 0xfffffffb
jmp 0x477087
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x18
jle 0x47709d
cmp dword [ebp - 0x2b04], 0
je 0x47709b
jmp 0x47709d
jmp 0x47707a
mov dword [ebp - 0x368], 3
jmp 0x4770b6
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jl 0x477106
push dword [ebp - 0x368]
lea ecx, [ebp - 0x2994]
call fcn.00434f4e
cmp dword [eax], 0xfffc
jl 0x4770e4
mov dword [ebp - 0xf80], 1
jmp 0x4770eb
and dword [ebp - 0xf80], 0
push dword [ebp - 0x368]
lea ecx, [ebp - 0x2994]
call fcn.00434f4e
mov ecx, dword [ebp - 0xf80]
mov dword [eax], ecx
jmp 0x4770a9
jmp 0x477054
jmp 0x4772ae
mov dword [ebp - 0x22b8], 0x6586993e
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x37b0], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x37b8], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x37c0], eax
cmp dword [ebp - 0x368], 0
je 0x477158
or eax, 0xffffffff
je 0x477158
mov dword [ebp - 0x2290], 1
jmp 0x47715f
and dword [ebp - 0x2290], 0
mov eax, dword [ebp - 0x2290]
mov dword [ebp - 0x2298], eax
mov eax, dword [ebp - 0xf88]
imul eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x2298]
jne 0x47718c
mov dword [ebp - 0xf90], 1
jmp 0x477193
and dword [ebp - 0xf90], 0
cmp dword [ebp - 0xf90], 0x7198f9f0
jg 0x4771ab
mov dword [ebp - 0x22a0], 1
jmp 0x4771b2
and dword [ebp - 0x22a0], 0
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x22a0], eax
jle 0x4771ce
xor eax, eax
inc eax
jne 0x4771ce
and dword [ebp - 0xf98], 0
jmp 0x4771d8
mov dword [ebp - 0xf98], 1
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xf98], eax
jle 0x4771f2
mov dword [ebp - 0x22a8], 1
jmp 0x4771f9
and dword [ebp - 0x22a8], 0
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x22a8], eax
jle 0x477213
mov dword [ebp - 0xfa0], 1
jmp 0x47721a
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0xc50]
cmp dword [ebp - 0xfa0], eax
jg 0x477234
mov dword [ebp - 0x22b0], 1
jmp 0x47723b
and dword [ebp - 0x22b0], 0
mov eax, dword [ebp - 0x604]
cmp dword [ebp - 0x22b0], eax
jg 0x477255
mov dword [ebp - 0xe1c], 1
jmp 0x47725c
and dword [ebp - 0xe1c], 0
push 2
lea ecx, [ebp - 0x2994]
call fcn.00434f4e
mov ecx, dword [ebp - 0xe1c]
mov dword [eax], ecx
cmp dword [ebp - 0xe1c], 0
jl 0x47728f
mov eax, 0x5587
test eax, eax
je 0x47728f
mov dword [ebp - 0xfa8], 1
jmp 0x477296
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0xfa8]
mov dword [ebp - 0x22b8], eax
mov eax, dword [ebp - 0x22b8]
mov dword [ebp - 0xe0], eax
lea ecx, [ebp - 0x2994]
call fcn.00434f32
jmp 0x476ca1
cmp dword [ebp - 0x220], 0
je 0x4772c9
jmp 0x4772ce
jmp 0x476c53
jmp 0x476ace
push 3
lea ecx, [ebp - 0xbec]
call fcn.00434e60
mov dword [ebp - 0x88], 0x5252cb13
mov dword [ebp - 0x22c0], 0x934b0b4e
mov dword [ebp - 0x2308], 0x4f4cc511
mov dword [ebp - 0x160], 0
jmp 0x477317
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x477339
push dword [ebp - 0x160]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov dword [eax], 0xfffffff6
jmp 0x47730a
mov dword [ebp - 0x160], 0
jmp 0x477352
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x47736e
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x3534], 2
jmp 0x477345
mov byte [ebp - 0x37c], 0
movzx eax, byte [ebp - 0x37c]
test eax, eax
je 0x477396
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x88], 0
jmp 0x4773af
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x4778a7
mov dword [ebp - 0x3c8], 0x68f928d9
mov dword [ebp - 0xac4], 0
jmp 0x4773df
mov eax, dword [ebp - 0xac4]
inc eax
mov dword [ebp - 0xac4], eax
cmp dword [ebp - 0xac4], 3
jge 0x4773fb
mov eax, dword [ebp - 0xac4]
mov dword [ebp + eax*4 - 0x35dc], 0
jmp 0x4773d2
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
imul eax, dword [eax], 0xffffffff
test eax, eax
jne 0x477425
cmp dword [ebp - 0x88], 0
jne 0x477425
and dword [ebp - 0xfb0], 0
jmp 0x47742f
mov dword [ebp - 0xfb0], 1
mov eax, dword [ebp - 0xfb0]
mov dword [ebp - 0x22c0], eax
mov esi, dword [ebp - 0x22c0]
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
cmp dword [eax], esi
jg 0x477462
mov dword [ebp - 0xfb8], 1
jmp 0x477469
and dword [ebp - 0xfb8], 0
push 0
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfb8]
jge 0x47748c
mov dword [ebp - 0x22c8], 1
jmp 0x477493
and dword [ebp - 0x22c8], 0
cmp dword [ebp - 0x22c8], 0xb7e8
jne 0x4774ab
mov dword [ebp - 0xfc0], 1
jmp 0x4774b2
and dword [ebp - 0xfc0], 0
push 1
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov ecx, dword [ebp - 0xfc0]
cmp ecx, dword [eax]
jle 0x4774d5
mov dword [ebp - 0x22d0], 1
jmp 0x4774dc
and dword [ebp - 0x22d0], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov ecx, dword [ebp - 0x22d0]
cmp ecx, dword [eax]
je 0x477503
mov dword [ebp - 0x2b0c], 1
jmp 0x47750a
and dword [ebp - 0x2b0c], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
cmp dword [eax], 0x7ab8
je 0x477540
mov dword [ebp - 0xfc8], 1
jmp 0x477547
and dword [ebp - 0xfc8], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xfc8]
jg 0x47756e
mov dword [ebp - 0x22d8], 1
jmp 0x477575
and dword [ebp - 0x22d8], 0
mov eax, dword [ebp - 0x22d8]
mov dword [ebp - 0x3c8], eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
cmp dword [eax], 0
je 0x4775f4
mov dword [ebp - 0x3c8], 2
jmp 0x4775b0
mov eax, dword [ebp - 0x3c8]
dec eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
jl 0x4775ef
mov byte [ebp - 0x37e], 0
movzx eax, byte [ebp - 0x37e]
test eax, eax
je 0x4775d3
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov byte [ebp - 0x380], 0
movzx eax, byte [ebp - 0x380]
test eax, eax
je 0x4775ed
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x4775a3
jmp 0x4778a2
mov dword [ebp - 0x2300], 0xffffffff
mov dword [ebp - 0x9b4], 0
mov dword [ebp - 0x774], 0
jmp 0x477621
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 2
jge 0x47763d
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x322c], 0xfffffff9
jmp 0x477614
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3c8]
cmp dword [ebp + eax - 0x3534], ecx
jl 0x47765d
mov dword [ebp - 0xff0], 1
jmp 0x477664
and dword [ebp - 0xff0], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov dword [ebp - 0xfd0], eax
push 1
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
mov ecx, dword [ebp - 0xfd0]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3534]
mov ecx, dword [ebp - 0xfd0]
cmp dword [ecx], eax
jg 0x4776b5
mov dword [ebp - 0x1000], 1
jmp 0x4776bc
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x22e0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x22e0]
mov dword [ebp + eax - 0x35dc], ecx
mov eax, dword [ebp - 0x3c8]
imul eax, dword [ebp - 0x22e0]
cmp eax, 0xc4b79a97
je 0x4776fa
mov dword [ebp - 0xfd8], 1
jmp 0x477701
and dword [ebp - 0xfd8], 0
cmp dword [ebp - 0xfd8], 0
jne 0x47772c
mov eax, 0x6f77
test eax, eax
jne 0x47772c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x35dc], 0
jne 0x47772c
and dword [ebp - 0x22e8], 0
jmp 0x477736
mov dword [ebp - 0x22e8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3534]
cmp dword [ebp - 0x22e8], eax
jne 0x477756
mov dword [ebp - 0xfe0], 1
jmp 0x47775d
and dword [ebp - 0xfe0], 0
cmp dword [ebp - 0xfe0], 0xf6d
jg 0x47777b
mov eax, 0x30de2fd1
test eax, eax
jne 0x47777b
and dword [ebp - 0x22f0], 0
jmp 0x477785
mov dword [ebp - 0x22f0], 1
mov eax, dword [ebp - 0x9b4]
cmp dword [ebp - 0x22f0], eax
jl 0x47779f
mov dword [ebp - 0xfe8], 1
jmp 0x4777a6
and dword [ebp - 0xfe8], 0
cmp dword [ebp - 0xfe8], 0xc8e82b3
jg 0x4777bb
cmp dword [ebp - 0x9b4], 0
jne 0x4777d3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x35dc], 0
jne 0x4777d3
and dword [ebp - 0x22f8], 0
jmp 0x4777dd
mov dword [ebp - 0x22f8], 1
cmp dword [ebp - 0x22f8], 1
jge 0x4777f2
mov dword [ebp - 0x2310], 1
jmp 0x4777f9
and dword [ebp - 0x2310], 0
mov eax, dword [ebp - 0xff0]
mov dword [ebp - 0x2300], eax
mov eax, dword [ebp - 0x2300]
mov dword [ebp - 0xff8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xff8]
mov dword [ebp + eax - 0x322c], ecx
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x2308], eax
mov eax, dword [ebp - 0x2308]
mov ecx, dword [ebp - 0x1000]
imul ecx, dword [ebp - 0x2310]
imul eax, ecx
test eax, eax
je 0x477861
mov dword [ebp - 0x2b14], 5
cmp dword [ebp - 0x2b14], 0
je 0x47785f
jmp 0x4778a7
jmp 0x4778a2
push 1
lea ecx, [ebp - 0xbec]
call fcn.00434f4e
cmp dword [eax], 0
je 0x477888
cmp dword [ebp - 0x9b4], 0
je 0x477888
mov dword [ebp - 0x1008], 1
jmp 0x47788f
and dword [ebp - 0x1008], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1008]
mov dword [ebp + eax - 0x322c], ecx
jmp 0x4773a2
lea ecx, [ebp - 0xbec]
call fcn.00434f32
mov dword [ebp - 0x77c], 0
jmp 0x4778cb
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 1
jge 0x4778ed
push dword [ebp - 0x77c]
lea ecx, [ebp - 0x3e60]
call fcn.00434f4e
mov dword [eax], 0xa8ea
jmp 0x4778be
push 3
lea ecx, [ebp - 0xe70]
call fcn.00434e60
mov dword [ebp - 0xb94], 7
mov dword [ebp - 0x228], 0
jmp 0x47791d
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x477939
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb4], 0xbad86e52
jmp 0x477910
mov dword [ebp - 0x228], 0
jmp 0x477952
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x477974
push dword [ebp - 0x228]
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
mov dword [eax], 0xfffffff9
jmp 0x477945
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
mov dword [ebp - 0x2318], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2318]
mov dword [ebp + eax - 0xb4], ecx
cmp dword [ebp - 0x2318], 0
jne 0x477a59
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
mov dword [ebp - 0x37c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 1
je 0x4779d6
mov dword [ebp - 0x1010], 1
jmp 0x4779dd
and dword [ebp - 0x1010], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp eax, dword [ebp - 0x1010]
je 0x4779fe
mov dword [ebp - 0x2320], 1
jmp 0x477a05
and dword [ebp - 0x2320], 0
mov eax, dword [ebp - 0x2320]
add eax, 0x1647
mov dword [ebp - 0x1018], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1018]
mov dword [ebp + eax - 0xb4], ecx
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
mov ecx, dword [ebp - 0x1018]
add ecx, dword [eax]
jne 0x477a59
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
jne 0x477a59
and dword [ebp - 0x2328], 0
jmp 0x477a63
mov dword [ebp - 0x2328], 1
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
mov esi, dword [ebp - 0x2328]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
cmp esi, dword [eax]
jg 0x477a96
mov dword [ebp - 0x1020], 1
jmp 0x477a9d
and dword [ebp - 0x1020], 0
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
mov ecx, dword [ebp - 0x1020]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xb4]
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
cmp esi, dword [eax]
jg 0x477af9
mov dword [ebp - 0x2330], 1
jmp 0x477b00
and dword [ebp - 0x2330], 0
push 0
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2330]
je 0x477b23
mov dword [ebp - 0x1028], 1
jmp 0x477b2a
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0xb94]
cmp dword [ebp - 0x1028], eax
jg 0x477b44
mov dword [ebp - 0x2338], 1
jmp 0x477b4b
and dword [ebp - 0x2338], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x2338], eax
jl 0x477b75
mov eax, 0x3e3585ca
test eax, eax
je 0x477b75
mov dword [ebp - 0x1030], 1
jmp 0x477b7c
and dword [ebp - 0x1030], 0
cmp dword [ebp - 0x1030], 0x38951fe5
jne 0x477b94
mov dword [ebp - 0x2b1c], 1
jmp 0x477b9b
and dword [ebp - 0x2b1c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb4]
cmp dword [ebp + eax - 0xb4], ecx
jl 0x477bc3
mov dword [ebp - 0x2340], 1
jmp 0x477bca
and dword [ebp - 0x2340], 0
mov eax, dword [ebp - 0xb94]
imul eax, dword [ebp - 0x2340]
mov dword [ebp - 0xb94], eax
cmp dword [ebp - 0xb94], 0xfff6
jae 0x477bf5
mov dword [ebp - 0xc58], 1
jmp 0x477bfc
and dword [ebp - 0xc58], 0
push 1
lea ecx, [ebp - 0xe70]
call fcn.00434f4e
mov ecx, dword [ebp - 0xc58]
mov dword [eax], ecx
cmp dword [ebp - 0xc58], 0x8ad
jne 0x477c29
mov dword [ebp - 0x1038], 1
jmp 0x477c30
and dword [ebp - 0x1038], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1038]
mov dword [ebp + eax - 0xb4], ecx
lea ecx, [ebp - 0xe70]
call fcn.00434f32
mov dword [ebp - 0x32e0], 3
mov dword [ebp - 0x32dc], 3
mov dword [ebp - 0x32d8], 3
mov dword [ebp - 0x32d4], 3
lea ecx, [ebp - 0xda9]
call fcn.00434f5d
push eax
lea eax, [ebp - 0x32d0]
push eax
lea eax, [ebp - 0x32e0]
push eax
lea ecx, [ebp - 0x44a0]
call fcn.00434f60
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x354c]
call fcn.00434f0c
mov dword [ebp - 0x140], 0xc4d8e5c
mov dword [ebp - 0x2368], 0xfabaf1ba
mov dword [ebp - 0x140], 3
jmp 0x477cd8
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x478016
mov dword [ebp - 0x168], 0x31d83293
mov dword [ebp - 0xc60], 2
mov dword [ebp - 0x784], 0
jmp 0x477d12
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 4
jge 0x477d2e
mov eax, dword [ebp - 0x784]
mov dword [ebp + eax*4 - 0x42a0], 0xb085bb31
jmp 0x477d05
mov dword [ebp - 0x168], 3
jmp 0x477d47
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x478011
mov dword [ebp - 0x698], 0x6715f0ed
mov dword [ebp - 0xd88], 0xffffffff
mov dword [ebp - 0x698], 0
jmp 0x477d81
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 3
jg 0x47800c
mov dword [ebp - 0x30c], 0xffffffff
mov eax, dword [ebp - 0x30c]
imul eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x140]
jl 0x477db9
mov dword [ebp - 0x2348], 1
jmp 0x477dc0
and dword [ebp - 0x2348], 0
mov eax, dword [ebp - 0x698]
cmp dword [ebp - 0x2348], eax
je 0x477dda
mov dword [ebp - 0x1040], 1
jmp 0x477de1
and dword [ebp - 0x1040], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x1040], eax
jle 0x477dfb
mov dword [ebp - 0x2350], 1
jmp 0x477e02
and dword [ebp - 0x2350], 0
cmp dword [ebp - 0x2350], 0xf6b903cf
ja 0x477e1a
mov dword [ebp - 0x2b24], 1
jmp 0x477e21
and dword [ebp - 0x2b24], 0
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0x37d0], eax
mov eax, dword [ebp - 0xd88]
cmp dword [ebp - 0xd88], eax
je 0x477e47
mov dword [ebp - 0x1048], 1
jmp 0x477e4e
and dword [ebp - 0x1048], 0
mov eax, dword [ebp - 0x1048]
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xc60]
cmp dword [ebp - 0x168], eax
je 0x477e74
mov dword [ebp - 0x2358], 1
jmp 0x477e7b
and dword [ebp - 0x2358], 0
mov eax, dword [ebp - 0x2358]
sub eax, 6
jne 0x477e98
cmp dword [ebp - 0xc60], 0
jne 0x477e98
and dword [ebp - 0x1050], 0
jmp 0x477ea2
mov dword [ebp - 0x1050], 1
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x1050]
cmp eax, dword [ebp - 0x168]
jge 0x477ec3
mov dword [ebp - 0x2360], 1
jmp 0x477eca
and dword [ebp - 0x2360], 0
cmp dword [ebp - 0x2360], 0xffffffff
jg 0x477edf
mov dword [ebp - 0x1058], 1
jmp 0x477ee6
and dword [ebp - 0x1058], 0
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x2368], eax
mov eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x2368]
cmp dword [ebp - 0x168], eax
jge 0x477f12
mov dword [ebp - 0x2370], 1
jmp 0x477f19
and dword [ebp - 0x2370], 0
push dword [ebp - 0x140]
lea ecx, [ebp - 0x354c]
call fcn.00434f4e
mov dword [ebp - 0x1060], eax
push dword [ebp - 0x140]
lea ecx, [ebp - 0x354c]
call fcn.00434f4e
mov ecx, dword [ebp - 0x1060]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1060]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2370]
jl 0x477f67
mov dword [ebp - 0x1068], 1
jmp 0x477f6e
and dword [ebp - 0x1068], 0
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
imul eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x140]
jg 0x477f9b
mov dword [ebp - 0x2378], 1
jmp 0x477fa2
and dword [ebp - 0x2378], 0
cmp dword [ebp - 0x2378], 7
je 0x477fb7
mov dword [ebp - 0x1070], 1
jmp 0x477fbe
and dword [ebp - 0x1070], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1070]
mov dword [ebp + eax - 0x42a0], ecx
mov dword [ebp - 0x30c], 0
jmp 0x477fea
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x18
jg 0x478007
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x42a0], 0
je 0x478005
jmp 0x478007
jmp 0x477fdd
jmp 0x477d74
jmp 0x477d3a
jmp 0x477ccb
lea ecx, [ebp - 0x354c]
call fcn.00434f32
mov byte [ebp - 0x382], 0
movzx eax, byte [ebp - 0x382]
test eax, eax
je 0x478131
push 1
lea ecx, [ebp - 0x3e40]
call fcn.00434e60
mov dword [ebp - 0x2380], 0x6de713a4
mov dword [ebp - 0x2b2c], 0xffffffff
mov dword [ebp - 0x230], 0
jmp 0x478071
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x478093
push dword [ebp - 0x230]
lea ecx, [ebp - 0x3e40]
call fcn.00434f4e
mov dword [eax], 0x5568
jmp 0x478064
mov dword [ebp - 0x230], 0
jmp 0x4780ac
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 4
jge 0x4780c8
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x3698], 0xffffffff
jmp 0x47809f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3698]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x3698], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3698]
mov dword [ebp - 0x37d8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3698]
mov dword [ebp - 0x2380], eax
mov eax, dword [ebp - 0x2380]
mov dword [ebp - 0x2b2c], eax
lea ecx, [ebp - 0x3e40]
call fcn.00434f32
push 0
push 1
push 0x1ed8
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 3
lea ecx, [ebp - 0xe98]
call fcn.00434e60
mov dword [ebp - 0x5e8], 1
mov dword [ebp - 0x2390], 0xffffffff
mov dword [ebp - 0x2d74], 0x13c27f35
mov dword [ebp - 0x9bc], 0
jmp 0x478175
mov eax, dword [ebp - 0x9bc]
inc eax
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x9bc], 3
jge 0x478197
push dword [ebp - 0x9bc]
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
mov dword [eax], 0x4b666a75
jmp 0x478168
mov byte [ebp - 0x384], 0
movzx eax, byte [ebp - 0x384]
test eax, eax
je 0x4781c4
push 0x7b5
push 0
push 0x649
push 0xf41
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
mov eax, dword [eax]
inc eax
je 0x4781eb
cmp dword [ebp - 0x5e8], 0
je 0x4781eb
mov dword [ebp - 0x2b34], 1
jmp 0x4781f2
and dword [ebp - 0x2b34], 0
push 2
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
push 0
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
cmp dword [eax], 0xaf5bfb66
jne 0x478220
mov dword [ebp - 0x2b3c], 1
jmp 0x478227
and dword [ebp - 0x2b3c], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x37e0], eax
push 1
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
cmp dword [eax], 0xb0be
jl 0x478254
mov dword [ebp - 0x1078], 1
jmp 0x47825b
and dword [ebp - 0x1078], 0
push 0
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
mov ecx, dword [ebp - 0x1078]
imul ecx, dword [eax]
mov dword [ebp - 0x2388], ecx
push 0
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
mov ecx, dword [ebp - 0x2388]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x2388], eax
jne 0x4782b5
push 0
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
cmp dword [eax], 0
jne 0x4782b5
and dword [ebp - 0x1080], 0
jmp 0x4782bf
mov dword [ebp - 0x1080], 1
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x1080], eax
jl 0x4782d9
mov dword [ebp - 0x2b44], 1
jmp 0x4782e0
and dword [ebp - 0x2b44], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x37e8], eax
push 0
lea ecx, [ebp - 0xe98]
call fcn.00434f4e
mov eax, dword [eax]
mov dword [ebp - 0x2390], eax
mov eax, dword [ebp - 0x2390]
add eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x2d74], eax
lea ecx, [ebp - 0xe98]
call fcn.00434f32
mov byte [ebp - 0x386], 0
mov dword [ebp - 0x37f0], 0xfffffff9
mov dword [ebp - 0x37f8], 0x5816210b
mov dword [ebp - 0x3800], 0x23ed15de
mov dword [ebp - 0x3808], 0x60d00585
push 1
lea ecx, [ebp - 0x3e50]
call fcn.00434e60
mov dword [ebp - 0x3998], 8
mov dword [ebp - 0x1088], 1
mov dword [ebp - 0x170], 0
jmp 0x478387
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x4783a3
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x39a0], 0xbcd
jmp 0x47837a
mov dword [ebp - 0x170], 0
jmp 0x4783bc
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x4783de
push dword [ebp - 0x170]
lea ecx, [ebp - 0x3e50]
call fcn.00434f4e
mov dword [eax], 1
jmp 0x4783af
mov eax, dword [ebp - 0x1088]
dec eax
mov dword [ebp - 0x1088], eax
lea ecx, [ebp - 0x3e50]
call fcn.00434f32
movzx eax, byte [ebp - 0x386]
test eax, eax
je 0x47846d
mov dword [ebp - 0x39a8], 0xfff6
mov byte [ebp - 0x388], 0
movzx eax, byte [ebp - 0x388]
test eax, eax
je 0x478425
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x391], 0
movzx eax, byte [ebp - 0x391]
test eax, eax
je 0x478457
push 0
push 0x2001
push 0x35e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
lea ecx, [ebp - 0x3e60]
call fcn.00434f32
mov dword [ebp - 0x78c], 0xfffffffc
mov byte [ebp - 0x393], 0
movzx eax, byte [ebp - 0x393]
test eax, eax
je 0x47849e
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x78c], 0
jmp 0x4784b7
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 0x10
jle 0x4784d7
mov dword [ebp - 0x2d7c], 0xfffffff7
cmp dword [ebp - 0x2d7c], 0
je 0x4784d5
jmp 0x4784d7
jmp 0x4784aa
xor ecx, ecx
call fcn.004351cb
push eax
call fcn.00497e63
pop ecx
mov dword [ebp - 0x68], 0x5596960f
mov dword [ebp - 0x794], 0x96a53086
mov dword [ebp - 0x10a0], 0xf7b1466a
mov dword [ebp - 0x39b0], 0x7d5b
mov dword [ebp - 0xacc], 0
jmp 0x478523
mov eax, dword [ebp - 0xacc]
inc eax
mov dword [ebp - 0xacc], eax
cmp dword [ebp - 0xacc], 3
jge 0x47853f
mov eax, dword [ebp - 0xacc]
mov dword [ebp + eax*4 - 0x314c], 1
jmp 0x478516
mov dword [ebp - 0x68], 2
jmp 0x47854f
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x4786b0
mov dword [ebp - 0x2b4], 0xfffffff7
mov dword [ebp - 0x2d8c], 0x867a7bf7
mov dword [ebp - 0x2d94], 0xfda6c2e3
cmp dword [ebp - 0x2b4], 1
jle 0x47858c
mov dword [ebp - 0x2d84], 1
jmp 0x478593
and dword [ebp - 0x2d84], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x39b8], eax
cmp dword [ebp - 0x2b4], 0xf5ac3d6c
jbe 0x4785b7
mov dword [ebp - 0x2398], 1
jmp 0x4785be
and dword [ebp - 0x2398], 0
mov eax, dword [ebp - 0x2398]
sub eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x1090]
mov dword [ebp + eax*4 - 0x314c], ecx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1090], eax
jle 0x4785f4
cmp dword [ebp - 0x794], 0
jne 0x478603
cmp dword [ebp - 0x68], 0
jne 0x478603
and dword [ebp - 0x23a0], 0
jmp 0x47860d
mov dword [ebp - 0x23a0], 1
mov eax, dword [ebp - 0x2b4]
imul eax, dword [ebp - 0x23a0]
cmp eax, dword [ebp - 0x10a0]
jg 0x47862e
mov dword [ebp - 0x1098], 1
jmp 0x478635
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x1098], eax
je 0x47864f
mov dword [ebp - 0x23a8], 1
jmp 0x478656
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0x2b4]
add eax, dword [ebp - 0x23a8]
imul eax, dword [ebp - 0x10a0]
cmp eax, dword [ebp - 0x2b4]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x68]
cmp dword [ebp + eax - 0x314c], ecx
jge 0x47868d
mov dword [ebp - 0x23b0], 1
jmp 0x478694
and dword [ebp - 0x23b0], 0
mov eax, dword [ebp - 0x23b0]
mov dword [ebp - 0x2d8c], eax
cmp dword [ebp - 0x2d94], 0
je 0x4786ab
jmp 0x4786b0
jmp 0x478548
mov dword [ebp - 0x68], 0
jmp 0x4786c0
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffe6
jge 0x478845
mov dword [ebp - 0x5f0], 3
mov dword [ebp - 0x2da4], 0xffffffff
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x39c0], eax
cmp dword [ebp - 0x5f0], 0x8fbd
jge 0x478702
mov dword [ebp - 0x10a8], 1
jmp 0x478709
and dword [ebp - 0x10a8], 0
cmp dword [ebp - 0x10a8], 0x151d
jl 0x478721
mov dword [ebp - 0x23b8], 1
jmp 0x478728
and dword [ebp - 0x23b8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x23b8], eax
jle 0x47873f
mov dword [ebp - 0x10b0], 1
jmp 0x478746
and dword [ebp - 0x10b0], 0
mov eax, dword [ebp - 0x5f0]
add eax, dword [ebp - 0x10b0]
cmp dword [ebp - 0x5f0], eax
je 0x478766
mov dword [ebp - 0x23c0], 1
jmp 0x47876d
and dword [ebp - 0x23c0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x314c]
cmp dword [ebp - 0x23c0], eax
jge 0x47878d
mov dword [ebp - 0xe44], 1
jmp 0x478794
and dword [ebp - 0xe44], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe44]
mov dword [ebp + eax - 0x314c], ecx
mov eax, dword [ebp - 0x794]
cmp dword [ebp - 0xe44], eax
jl 0x4787c1
mov dword [ebp - 0x10b8], 1
jmp 0x4787c8
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x10b8], eax
jle 0x4787df
mov dword [ebp - 0x23c8], 1
jmp 0x4787e6
and dword [ebp - 0x23c8], 0
mov eax, dword [ebp - 0x5f0]
cmp dword [ebp - 0x23c8], eax
jle 0x478800
mov dword [ebp - 0x2d9c], 1
jmp 0x478807
and dword [ebp - 0x2d9c], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x39c8], eax
mov eax, dword [ebp - 0x794]
cmp dword [ebp - 0x5f0], eax
jle 0x47882d
mov dword [ebp - 0x10c0], 1
jmp 0x478834
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0x2da4], eax
jmp 0x4786b9
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 0x6d8], 0x2d1a4e66
push 3
lea ecx, [ebp - 0x2804]
call fcn.00434e60
mov dword [ebp - 0x10f8], 7
mov dword [ebp - 0x9c4], 0
jmp 0x478889
mov eax, dword [ebp - 0x9c4]
inc eax
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0x9c4], 3
jge 0x4788ab
push dword [ebp - 0x9c4]
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
mov dword [eax], 0x27
jmp 0x47887c
mov dword [ebp - 0x108], 0xffffffe5
jmp 0x4788c4
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jl 0x478c6e
mov dword [ebp - 0xd90], 0xd4e7
mov dword [ebp - 0x618], 3
mov dword [ebp - 0xbc], 0xfffffff7
mov dword [ebp - 0xc68], 0x7cdedfc3
mov dword [ebp - 0x2dac], 0x21589afc
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x6d8]
dec eax
cmp eax, 0x38ec
jg 0x478929
mov dword [ebp - 0x23d0], 1
jmp 0x478930
and dword [ebp - 0x23d0], 0
mov eax, dword [ebp - 0xd90]
add eax, dword [ebp - 0x23d0]
cmp eax, dword [ebp - 0x108]
jne 0x478950
mov dword [ebp - 0x10c8], 1
jmp 0x478957
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x10c8]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
imul eax, dword [ebp - 0x108]
cmp eax, 0xc254
jl 0x478983
mov dword [ebp - 0x23d8], 1
jmp 0x47898a
and dword [ebp - 0x23d8], 0
cmp dword [ebp - 0x23d8], 0x978d
jle 0x4789a2
mov dword [ebp - 0x10d0], 1
jmp 0x4789a9
and dword [ebp - 0x10d0], 0
cmp dword [ebp - 0x10d0], 0xffffffff
jne 0x4789be
mov dword [ebp - 0x23e0], 1
jmp 0x4789c5
and dword [ebp - 0x23e0], 0
cmp dword [ebp - 0x23e0], 0
jb 0x4789e3
cmp dword [ebp - 0xbc], 0
je 0x4789e3
mov dword [ebp - 0x10d8], 1
jmp 0x4789ea
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x10d8]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0x39d0], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x39d8], eax
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x618]
sub ecx, 0x553f
sub eax, ecx
mov dword [ebp - 0xbc], eax
mov esi, dword [ebp - 0x108]
push 0
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
cmp esi, dword [eax]
jge 0x478a4b
mov dword [ebp - 0x10e0], 1
jmp 0x478a52
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
cmp dword [ebp - 0xc68], eax
jle 0x478a78
mov dword [ebp - 0x23e8], 1
jmp 0x478a7f
and dword [ebp - 0x23e8], 0
mov eax, dword [ebp - 0x23e8]
mov dword [ebp - 0xbc], eax
mov esi, dword [ebp - 0xbc]
push 0
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
cmp esi, dword [eax]
jl 0x478aae
mov dword [ebp - 0x23f0], 1
jmp 0x478ab5
and dword [ebp - 0x23f0], 0
mov eax, dword [ebp - 0x10e0]
cmp eax, dword [ebp - 0x23f0]
jge 0x478acf
mov dword [ebp - 0x10e8], 1
jmp 0x478ad6
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x2dac]
cmp dword [ebp - 0x10e8], eax
je 0x478c27
mov dword [ebp - 0xbc], 2
jmp 0x478b01
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x478c25
mov dword [ebp - 0x2db4], 0xfffffff6
imul eax, dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d8], eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
mov ecx, dword [ebp - 0xd90]
cmp dword [eax], ecx
je 0x478b4c
mov dword [ebp - 0x23f8], 1
jmp 0x478b53
and dword [ebp - 0x23f8], 0
cmp dword [ebp - 0x23f8], 0xe3a113d
jg 0x478b6b
mov dword [ebp - 0x10f0], 1
jmp 0x478b72
and dword [ebp - 0x10f0], 0
imul esi, dword [ebp - 0x10f0], 5
push 0
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
cmp esi, dword [eax]
jg 0x478b96
mov dword [ebp - 0x2400], 1
jmp 0x478b9d
and dword [ebp - 0x2400], 0
mov eax, dword [ebp - 0x2400]
sub eax, 0xa2cc
imul eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x108]
mov dword [ebp - 0x10f8], eax
mov esi, dword [ebp - 0x10f8]
push 0
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
cmp esi, dword [eax]
jl 0x478bdf
mov dword [ebp - 0x2408], 1
jmp 0x478be6
and dword [ebp - 0x2408], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x2804]
call fcn.00434f4e
mov ecx, dword [ebp - 0x2408]
cmp ecx, dword [eax]
jge 0x478c0d
mov dword [ebp - 0x1100], 1
jmp 0x478c14
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x2db4], eax
jmp 0x478af4
jmp 0x478c69
mov byte [ebp - 0x395], 0
movzx eax, byte [ebp - 0x395]
test eax, eax
je 0x478c41
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov byte [ebp - 0x397], 0
movzx eax, byte [ebp - 0x397]
test eax, eax
je 0x478c69
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x4788b7
lea ecx, [ebp - 0x2804]
call fcn.00434f32
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x5f8], 0xfffffff6
mov dword [ebp - 0x600], 0x5b3d925d
mov dword [ebp - 0x79c], 0
jmp 0x478cad
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 2
jge 0x478cc9
mov eax, dword [ebp - 0x79c]
mov dword [ebp + eax*4 - 0x2a0], 0xfffffffd
jmp 0x478ca0
mov dword [ebp - 0x10], 1
jmp 0x478cd9
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x4790ea
mov dword [ebp - 0x3d0], 0xffffffff
mov dword [ebp - 0xb54], 1
mov dword [ebp - 0x33c], 0x662b
cmp dword [ebp - 0x10], 0
jne 0x478d75
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x2a0]
cmp dword [ebp + eax*4 - 0x2a0], ecx
jle 0x478d29
mov dword [ebp - 0x2dbc], 1
jmp 0x478d30
and dword [ebp - 0x2dbc], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x39e0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x39e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a0]
mov dword [ebp - 0x39f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a0]
add eax, 0x683648bd
jne 0x478d75
and dword [ebp - 0x2410], 0
jmp 0x478d7f
mov dword [ebp - 0x2410], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x2a0]
add ecx, dword [ebp - 0x2410]
cmp dword [ebp + eax*4 - 0x2a0], ecx
jne 0x478da7
mov dword [ebp - 0x1108], 1
jmp 0x478dae
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2a0]
imul eax, dword [ebp - 0x1108]
cmp eax, dword [ebp - 0x5f8]
jle 0x478dd3
mov dword [ebp - 0x2418], 1
jmp 0x478dda
and dword [ebp - 0x2418], 0
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x2418], eax
jg 0x478f13
mov dword [ebp - 0x2dc4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a0]
mov ecx, dword [ebp - 0x10]
imul eax, dword [ebp + ecx*4 - 0x2a0]
neg eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2a0], eax
mov dword [ebp - 0xb54], 0x55fd0a32
cmp dword [ebp - 0xb54], 0
je 0x478ebe
imul eax, dword [ebp - 0x3d0], 0xffff
cmp dword [ebp - 0xb54], eax
jle 0x478e4f
mov dword [ebp - 0x1110], 1
jmp 0x478e56
and dword [ebp - 0x1110], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2a0]
cmp dword [ebp - 0x1110], eax
jge 0x478e74
mov dword [ebp - 0x2420], 1
jmp 0x478e7b
and dword [ebp - 0x2420], 0
mov eax, dword [ebp - 0x2420]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x39f8], eax
mov eax, dword [ebp - 0x2dc4]
sub eax, 3
mov ecx, dword [ebp - 0x10]
imul eax, dword [ebp + ecx*4 - 0x2a0]
test eax, eax
je 0x478ebe
mov dword [ebp - 0x1118], 1
jmp 0x478ec5
and dword [ebp - 0x1118], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1118], eax
je 0x478edc
mov dword [ebp - 0x2428], 1
jmp 0x478ee3
and dword [ebp - 0x2428], 0
cmp dword [ebp - 0x2428], 0xe0d6
je 0x478efb
mov dword [ebp - 0x1120], 1
jmp 0x478f02
and dword [ebp - 0x1120], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x1120]
mov dword [ebp - 0x33c], eax
jmp 0x478f2d
mov byte [ebp - 0x399], 0
movzx eax, byte [ebp - 0x399]
test eax, eax
je 0x478f2d
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [ebp - 0x3d0], 1
jmp 0x478f46
mov eax, dword [ebp - 0x3d0]
dec eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jl 0x4790e5
mov dword [ebp - 0x7a4], 0x5dae11cd
mov dword [ebp - 0x2ddc], 0xffffffff
mov dword [ebp - 0x33c], 1
jmp 0x478f80
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jl 0x4790e0
mov eax, dword [ebp - 0x33c]
mov eax, dword [ebp + eax*4 - 0x2a0]
mov dword [ebp - 0x3a00], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x3a08], eax
cmp dword [ebp - 0x10], 0
jne 0x478fc7
cmp dword [ebp - 0x600], 0
je 0x478fc7
mov dword [ebp - 0x2430], 1
jmp 0x478fce
and dword [ebp - 0x2430], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2a0]
cmp dword [ebp - 0x2430], eax
jl 0x478fec
mov dword [ebp - 0x2dcc], 1
jmp 0x478ff3
and dword [ebp - 0x2dcc], 0
mov eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x7a4]
cmp dword [ebp + eax*4 - 0x2a0], ecx
jl 0x479014
mov dword [ebp - 0x1128], 1
jmp 0x47901b
and dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0x1128]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x7a4]
cmp dword [ebp - 0x7a4], eax
jl 0x479041
mov dword [ebp - 0x2dd4], 1
jmp 0x479048
and dword [ebp - 0x2dd4], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x3a10], eax
mov eax, 0x3ce99c24
test eax, eax
jne 0x479064
cmp dword [ebp - 0x2ddc], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp + eax*4 - 0x2a0], 0xa1e0
mov ecx, dword [ebp - 0x33c]
add eax, dword [ebp + ecx*4 - 0x2a0]
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + ecx*4 - 0x2a0], eax
mov dword [ebp - 0x5f8], 0
jmp 0x4790a5
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 1
jg 0x4790db
mov byte [ebp - 0x39b], 0
movzx eax, byte [ebp - 0x39b]
test eax, eax
je 0x4790d9
push 0x4b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x479098
jmp 0x478f73
jmp 0x478f39
jmp 0x478cd2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x7c4], 0xfffffffc
mov dword [ebp - 0x9cc], 0x3b4e1a36
mov dword [ebp - 0x3a18], 0x7e17f759
mov dword [ebp - 0x2438], 0xb0cb8ce3
mov dword [ebp - 0x9cc], 0x18
jmp 0x479134
mov eax, dword [ebp - 0x9cc]
dec eax
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 9
jle 0x479183
mov byte [ebp - 0x39d], 0
movzx eax, byte [ebp - 0x39d]
test eax, eax
je 0x479181
push 0x2129
push 0xfda
push 0x809
push 0x5e2
push 0x26ae
push 0xa4a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x479127
mov eax, dword [ebp - 0x2438]
dec eax
mov dword [ebp - 0x2438], eax
mov byte [ebp - 0x3a1], 0
mov dword [ebp - 0x2458], 1
mov dword [ebp - 0x2dec], 0xf48c443e
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0x7b4], 0x2513244d
mov dword [ebp - 0x2450], 0xfffffff9
mov dword [ebp - 0x2440], 0
mov dword [ebp - 0xe24], 9
push 1
lea ecx, [ebp - 0x3164]
call fcn.00434e60
mov dword [ebp - 0x30c0], 1
mov dword [ebp - 0x30bc], 1
mov dword [ebp - 0x30b8], 1
mov dword [ebp - 0x30b4], 1
mov dword [ebp - 0xc70], 0xfa8bc07c
mov dword [ebp - 0x2e04], 0x7228
mov dword [ebp - 0x7ac], 0
jmp 0x47923f
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 1
jge 0x479261
push dword [ebp - 0x7ac]
lea ecx, [ebp - 0x3164]
call fcn.00434f4e
mov dword [eax], 0x82b4746a
jmp 0x479232
cmp dword [ebp - 0xe24], 0
je 0x479374
mov eax, 0xbae8
test eax, eax
je 0x47934a
cmp dword [ebp - 0x2440], 0
jne 0x479296
cmp dword [ebp - 0xad4], 0
jne 0x479296
and dword [ebp - 0x1130], 0
jmp 0x4792a0
mov dword [ebp - 0x1130], 1
cmp dword [ebp - 0x1130], 1
jne 0x4792b5
mov dword [ebp - 0x2de4], 1
jmp 0x4792bc
and dword [ebp - 0x2de4], 0
push 0
lea ecx, [ebp - 0x3164]
call fcn.00434f4e
cmp dword [ebp - 0x2440], 0x138b
jle 0x4792e1
mov dword [ebp - 0x1138], 1
jmp 0x4792e8
and dword [ebp - 0x1138], 0
mov eax, dword [ebp - 0x7b4]
imul eax, dword [ebp - 0x1138]
cmp eax, dword [ebp - 0x2dec]
je 0x479309
mov dword [ebp - 0x2448], 1
jmp 0x479310
and dword [ebp - 0x2448], 0
cmp dword [ebp - 0x2448], 0x4f77722
jle 0x479323
cmp dword [ebp - 0x7b4], 0
cmp dword [ebp - 0xe24], 0
jne 0x47933e
cmp dword [ebp - 0xad4], 0
jne 0x47933e
cmp dword [ebp - 0xad4], 0
je 0x47934a
mov dword [ebp - 0x1140], 1
jmp 0x479351
and dword [ebp - 0x1140], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30c0]
imul eax, dword [ebp - 0x1140]
test eax, eax
je 0x479374
mov dword [ebp - 0x2df4], 1
jmp 0x47937b
and dword [ebp - 0x2df4], 0
push 0
lea ecx, [ebp - 0x3164]
call fcn.00434f4e
mov dword [eax], 0xfffffff9
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x4793ad
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x30c0], 0
jne 0x4793ad
and dword [ebp - 0x2dfc], 0
jmp 0x4793b7
mov dword [ebp - 0x2dfc], 1
mov eax, dword [ebp - 0x2e04]
mov dword [ebp - 0x3a20], eax
imul eax, dword [ebp - 0xc70], 0x5452
mov dword [ebp - 0x2450], eax
mov eax, dword [ebp - 0x2450]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x30c0]
imul eax, dword [ebp - 0x2458]
mov dword [ebp - 0x2e0c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30c0]
mov dword [ebp - 0x2e14], eax
mov eax, dword [ebp - 0xc70]
dec eax
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0x2e0c]
cmp eax, dword [ebp - 0x2e14]
jl 0x47942d
mov dword [ebp - 0x1148], 1
jmp 0x479434
and dword [ebp - 0x1148], 0
mov eax, dword [ebp - 0xad4]
add eax, dword [ebp - 0x1148]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
cmp dword [ebp - 0x2458], eax
jle 0x479460
mov dword [ebp - 0x1150], 1
jmp 0x479467
and dword [ebp - 0x1150], 0
mov eax, dword [ebp - 0x1150]
mov dword [ebp - 0xe24], eax
mov byte [ebp - 0x39f], 0
movzx eax, byte [ebp - 0x39f]
test eax, eax
je 0x479499
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
lea ecx, [ebp - 0x3164]
call fcn.00434f32
movzx eax, byte [ebp - 0x3a1]
test eax, eax
je 0x479620
mov dword [ebp - 0x2bc], 0xfffffffa
push 1
lea ecx, [ebp - 0x3654]
call fcn.00434e60
mov dword [ebp - 0x9d4], 0
jmp 0x4794e3
mov eax, dword [ebp - 0x9d4]
inc eax
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 1
jge 0x479505
push dword [ebp - 0x9d4]
lea ecx, [ebp - 0x3654]
call fcn.00434f4e
mov dword [eax], 0x6dd2cc9
jmp 0x4794d6
mov dword [ebp - 0x2bc], 0xe
jmp 0x47951e
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xfffffff2
jle 0x4795f1
mov dword [ebp - 0x2460], 0x28ea3888
mov byte [ebp - 0x3a3], 0
movzx eax, byte [ebp - 0x3a3]
test eax, eax
je 0x479559
push 0x1ef8
push 0xb22
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [ebp - 0x2460]
mov dword [ebp - 0x3a28], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x3a30], eax
mov eax, dword [ebp - 0x2460]
mov dword [ebp - 0x3a38], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x3a40], eax
cmp dword [ebp - 0x2bc], 0x3e45bbbd
jge 0x4795a1
mov dword [ebp - 0x1158], 1
jmp 0x4795a8
and dword [ebp - 0x1158], 0
mov eax, dword [ebp - 0x2bc]
imul eax, dword [ebp - 0x1158]
xor ecx, ecx
sub ecx, eax
je 0x4795d0
mov eax, 0x889e022a
test eax, eax
je 0x4795d0
mov dword [ebp - 0x2468], 1
jmp 0x4795d7
and dword [ebp - 0x2468], 0
push 0
lea ecx, [ebp - 0x3654]
call fcn.00434f4e
mov ecx, dword [ebp - 0x2468]
mov dword [eax], ecx
jmp 0x479511
mov byte [ebp - 0x3a5], 0
movzx eax, byte [ebp - 0x3a5]
test eax, eax
je 0x47960b
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0x3654]
call fcn.00434f32
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x7bc], 0xfffffffa
mov dword [ebp - 0xbe0], 0x84cb8f6c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3a48], eax
cmp dword [ebp - 0x30], 0x165352f7
je 0x479659
mov dword [ebp - 0x1160], 1
jmp 0x479660
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x1160]
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x7bc]
cmp dword [ebp - 0x30], eax
jne 0x479683
mov dword [ebp - 0x2470], 1
jmp 0x47968a
and dword [ebp - 0x2470], 0
cmp dword [ebp - 0x2470], 1
je 0x47969f
mov dword [ebp - 0x1168], 1
jmp 0x4796a6
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x1168]
cmp eax, dword [ebp - 0x30]
jge 0x4796c1
mov dword [ebp - 0x2478], 1
jmp 0x4796c8
and dword [ebp - 0x2478], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2478], eax
jle 0x4796df
mov dword [ebp - 0x1170], 1
jmp 0x4796e6
and dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x1170]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x479701
mov dword [ebp - 0x2480], 1
jmp 0x479708
and dword [ebp - 0x2480], 0
cmp dword [ebp - 0x2480], 0xfffffffe
jg 0x47971d
mov dword [ebp - 0x1178], 1
jmp 0x479724
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x1178]
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0x7bc], 0x1c58
cmp dword [ebp - 0x7bc], 0xfffffff9
jg 0x47974f
mov dword [ebp - 0x2488], 1
jmp 0x479756
and dword [ebp - 0x2488], 0
mov eax, dword [ebp - 0xbe0]
cmp dword [ebp - 0x2488], eax
jge 0x479770
mov dword [ebp - 0x2e1c], 1
jmp 0x479777
and dword [ebp - 0x2e1c], 0
mov dword [ebp - 0x30], 0x2ff18c9a
cmp dword [ebp - 0x30], 0xcda7209c
jbe 0x479793
mov dword [ebp - 0x1180], 1
jmp 0x47979a
and dword [ebp - 0x1180], 0
cmp dword [ebp - 0x1180], 0xb09b
jge 0x4797b2
mov dword [ebp - 0x2e24], 1
jmp 0x4797b9
and dword [ebp - 0x2e24], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x3a50], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3a58], eax
xor eax, eax
jne 0x4797db
cmp dword [ebp - 0xbe0], 0
je 0x47981d
mov dword [ebp - 0x30], 0xfffffff4
jmp 0x4797eb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xc
jle 0x47981b
mov byte [ebp - 0x3a7], 0
movzx eax, byte [ebp - 0x3a7]
test eax, eax
je 0x479819
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x4797e4
jmp 0x47984e
mov dword [ebp - 0x2490], 0x3637b304
mov eax, dword [ebp - 0x2490]
dec eax
mov dword [ebp - 0x2490], eax
mov byte [ebp - 0x3a9], 0
movzx eax, byte [ebp - 0x3a9]
test eax, eax
je 0x47984e
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x7c4], 0
jmp 0x479867
cmp dword [ebp - 0x7c4], 0x10
jle 0x479d61
mov dword [ebp - 0x1190], 1
mov dword [ebp - 0xc78], 0x8591b68d
mov dword [ebp - 0xd98], 3
mov dword [ebp - 0x2498], 4
mov dword [ebp - 0x2e34], 0
mov dword [ebp - 0x9dc], 0
jmp 0x4798bf
mov eax, dword [ebp - 0x9dc]
inc eax
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 1
jge 0x4798db
mov eax, dword [ebp - 0x9dc]
mov dword [ebp + eax*4 - 0x2e2c], 0x55cc25bf
jmp 0x4798b2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e2c], 1
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0xc78], eax
cmp dword [ebp - 0xc78], 1
jge 0x479916
cmp dword [ebp - 0xd98], 0
je 0x479916
mov dword [ebp - 0x1188], 1
jmp 0x47991d
and dword [ebp - 0x1188], 0
mov eax, dword [ebp - 0x1188]
mov dword [ebp - 0x2498], eax
mov eax, dword [ebp - 0x2498]
shl eax, 3
imul eax, dword [ebp - 0x1190]
cmp dword [ebp - 0x1190], eax
jge 0x47994d
mov dword [ebp - 0x24a0], 1
jmp 0x479954
and dword [ebp - 0x24a0], 0
mov eax, dword [ebp - 0xd98]
cmp dword [ebp - 0x24a0], eax
jge 0x47996e
mov dword [ebp - 0x1198], 1
jmp 0x479975
and dword [ebp - 0x1198], 0
mov eax, dword [ebp - 0xd98]
imul eax, dword [ebp - 0x1198]
mov dword [ebp - 0x2e34], eax
mov dword [ebp - 0x2e4c], 0xfffffff7
mov dword [ebp - 0x3d8], 0xe0648261
mov dword [ebp - 0x11d0], 0xa27289ff
mov dword [ebp - 0x3a60], 0xffffffff
mov dword [ebp - 0x11c8], 5
mov dword [ebp - 0x3a68], 7
mov dword [ebp - 0x2e3c], 0
push 2
lea ecx, [ebp - 0x2f14]
call fcn.00434e60
mov dword [ebp - 0x11c0], 0
mov dword [ebp - 0x620], 0xc72b
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x24d8], 0x3164c116
mov dword [ebp - 0x7cc], 0
jmp 0x479a1c
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 2
jge 0x479a3b
push dword [ebp - 0x7cc]
lea ecx, [ebp - 0x2f14]
call fcn.00434f4e
or dword [eax], 0xffffffff
jmp 0x479a0f
mov dword [ebp - 0x3d8], 0
jmp 0x479a54
mov eax, dword [ebp - 0x3d8]
dec eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xffffffe7
jge 0x479b2d
mov dword [ebp - 0xadc], 0xd925b0e4
mov dword [ebp - 0xadc], 0xffffffec
jmp 0x479a84
mov eax, dword [ebp - 0xadc]
inc eax
mov dword [ebp - 0xadc], eax
cmp dword [ebp - 0xadc], 0xfffffff3
jl 0x479b28
mov dword [ebp - 0x7d4], 0
jmp 0x479aaa
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 3
jge 0x479ac6
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0x317c], 0x887cf2e5
jmp 0x479a9d
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x317c], 0
jmp 0x479af1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x317c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x317c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x317c], 0xfffffff4
je 0x479b23
mov byte [ebp - 0x3ab], 0
movzx eax, byte [ebp - 0x3ab]
test eax, eax
je 0x479b21
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x479ad8
jmp 0x479a77
jmp 0x479a47
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3a70], eax
mov eax, dword [ebp - 0x6a0]
mov ecx, dword [ebp - 0x6a0]
dec ecx
mov dword [ebp - 0x6a0], ecx
test eax, eax
je 0x479b65
cmp dword [ebp - 0x6a0], 0
je 0x479b65
mov dword [ebp - 0x11b0], 1
jmp 0x479b6c
and dword [ebp - 0x11b0], 0
cmp dword [ebp - 0x620], 0
je 0x479b93
push 0
lea ecx, [ebp - 0x2f14]
call fcn.00434f4e
cmp dword [eax], 0
je 0x479b93
mov dword [ebp - 0x24a8], 1
jmp 0x479b9a
and dword [ebp - 0x24a8], 0
cmp dword [ebp - 0x24a8], 0x67d3d8e1
je 0x479bb8
cmp dword [ebp - 0x2e3c], 0
jne 0x479bb8
and dword [ebp - 0x11a0], 0
jmp 0x479bc2
mov dword [ebp - 0x11a0], 1
mov eax, dword [ebp - 0x11c0]
imul eax, dword [ebp - 0x11a0]
cmp eax, dword [ebp - 0x620]
jl 0x479be3
mov dword [ebp - 0x24b0], 1
jmp 0x479bea
and dword [ebp - 0x24b0], 0
push 0
lea ecx, [ebp - 0x2f14]
call fcn.00434f4e
mov ecx, dword [ebp - 0x24b0]
neg ecx
cmp dword [eax], ecx
jg 0x479c0f
mov dword [ebp - 0x11a8], 1
jmp 0x479c16
and dword [ebp - 0x11a8], 0
mov eax, dword [ebp - 0x620]
imul eax, dword [ebp - 0x11a8]
cmp eax, 0xffffffff
ja 0x479c34
mov dword [ebp - 0x24b8], 1
jmp 0x479c3b
and dword [ebp - 0x24b8], 0
mov eax, dword [ebp - 0x620]
cmp dword [ebp - 0x24b8], eax
je 0x479c55
mov dword [ebp - 0x24c0], 1
jmp 0x479c5c
and dword [ebp - 0x24c0], 0
mov eax, dword [ebp - 0x11b0]
cmp eax, dword [ebp - 0x24c0]
jle 0x479c76
mov dword [ebp - 0x11b8], 1
jmp 0x479c7d
and dword [ebp - 0x11b8], 0
cmp dword [ebp - 0x11b8], 5
je 0x479c92
mov dword [ebp - 0x24c8], 1
jmp 0x479c99
and dword [ebp - 0x24c8], 0
push 0
lea ecx, [ebp - 0x2f14]
call fcn.00434f4e
mov ecx, dword [ebp - 0x24c8]
cmp ecx, dword [eax]
jge 0x479cc5
cmp dword [ebp - 0x11c0], 0
je 0x479cc5
and dword [ebp - 0x24d0], 0
mov eax, dword [ebp - 0x24d0]
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x11c8]
sub eax, 0x3dac2a55
cmp eax, dword [ebp - 0x620]
je 0x479cf7
mov dword [ebp - 0xda0], 1
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x238], 0
jmp 0x479d8e
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x479daa
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xc90], 0x13b9
jmp 0x479d81
mov dword [ebp - 0x238], 0
jmp 0x479dc3
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x479ddf
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x628], 0x8d4081c2
jmp 0x479db6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x628], 0
jmp 0x479e0d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x628]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x628], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x628], 0
jl 0x47a325
mov dword [ebp - 0x3c], 0x751c76d7
mov dword [ebp - 0x5fc], 0xa7e9f21c
mov dword [ebp - 0x6e0], 0x1a1f
mov dword [ebp - 0x9e4], 0
jmp 0x479e55
mov eax, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x9e4], 3
jge 0x479e71
mov eax, dword [ebp - 0x9e4]
mov dword [ebp + eax*4 - 0x3e70], 0xfff6
jmp 0x479e48
mov dword [ebp - 0x3c], 0
jmp 0x479e81
cmp dword [ebp - 0x3c], 0
jl 0x47a2a8
push 3
lea ecx, [ebp - 0x2940]
call fcn.00434e60
mov dword [ebp - 0xc88], 0x21aa2910
mov dword [ebp - 0x7dc], 0
jmp 0x479ebb
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 3
jge 0x479eda
push dword [ebp - 0x7dc]
lea ecx, [ebp - 0x2940]
call fcn.00434f4e
or dword [eax], 0xffffffff
jmp 0x479eae
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x628]
mov dword [ebp - 0x3aa0], eax
cmp dword [ebp - 0x3c], 0x84cb
jg 0x479f02
mov dword [ebp - 0xc80], 1
jmp 0x479f09
and dword [ebp - 0xc80], 0
push 0
lea ecx, [ebp - 0x2940]
call fcn.00434f4e
mov ecx, dword [ebp - 0xc80]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc80]
sub eax, 0x5cca3dd4
cmp eax, 0x9495e0e2
jae 0x479f3c
mov dword [ebp - 0x24e0], 1
jmp 0x479f43
and dword [ebp - 0x24e0], 0
cmp dword [ebp - 0x24e0], 0xfffffffb
jge 0x479f58
mov dword [ebp - 0x11d8], 1
jmp 0x479f5f
and dword [ebp - 0x11d8], 0
mov eax, dword [ebp - 0x11d8]
sub eax, dword [ebp - 0x5fc]
jmp 0x479f79
and dword [ebp - 0x24e8], 0
mov eax, dword [ebp - 0x24e8]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp - 0xc88]
add eax, 0x502b8fd0
cmp eax, 0xffffffff
jne 0x479fa8
mov dword [ebp - 0x11e0], 1
jmp 0x479faf
and dword [ebp - 0x11e0], 0
mov dword [ebp - 0x7e4], 0x52bf3388
mov eax, dword [ebp - 0x5fc]
mov ecx, dword [ebp - 0x11e0]
lea eax, [ecx + eax - 4]
cmp dword [ebp - 0x7e4], eax
jg 0x479fdd
mov dword [ebp - 0x2e54], 1
jmp 0x479fe4
and dword [ebp - 0x2e54], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xc90]
mov dword [ebp - 0x24f0], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x24f0]
mov dword [ebp + eax*4 - 0xc90], ecx
mov eax, dword [ebp - 0x24f0]
sub eax, 0x723d57d6
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0x3aa8], eax
mov eax, 0x93765224
test eax, eax
je 0x47a20d
push 3
lea ecx, [ebp - 0x2f24]
call fcn.00434e60
mov dword [ebp - 0xb5c], 0
jmp 0x47a054
mov dword [ebp - 0x2e5c], 0x3ea6de45
cmp dword [ebp - 0xda0], 0
je 0x47a285
mov dword [ebp - 0x3c], 0
jmp 0x47a2b8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x47a320
mov dword [ebp - 0x6e0], 0
jmp 0x47a2d7
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
jg 0x47a31e
mov dword [ebp - 0x5fc], 0
jmp 0x47a2f9
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
jg 0x47a31c
mov byte [ebp - 0x3ad], 0
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x47a31a
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x47a2ec
jmp 0x47a2ca
jmp 0x47a2b1
jmp 0x479df2
mov dword [ebp - 0x128], 0xf0aa6e6f
mov dword [ebp - 0xc98], 2
mov dword [ebp - 0x504], 0x2530a9bc
push 2
lea ecx, [ebp - 0xf2c]
call fcn.00434e60
mov dword [ebp - 0x7ec], 0x667120dd
mov dword [ebp - 0x2550], 0x6a4137d6
mov dword [ebp - 0x2540], 0
mov dword [ebp - 0x1230], 0xc2fb
mov dword [ebp - 0x1248], 0xa2f725dc
mov dword [ebp - 0x9ec], 0
jmp 0x47a39b
mov eax, dword [ebp - 0x9ec]
inc eax
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x9ec], 2
jge 0x47a3bd
push dword [ebp - 0x9ec]
lea ecx, [ebp - 0xf2c]
call fcn.00434f4e
mov dword [eax], 0x7f4039ee
jmp 0x47a38e
mov dword [ebp - 0x128], 0x91c5
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x3ab0], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x3ab8], eax
cmp dword [ebp - 0x128], 5
jne 0x47a3f4
mov dword [ebp - 0x2520], 1
jmp 0x47a3fb
and dword [ebp - 0x2520], 0
imul eax, dword [ebp - 0x2520], 0xffff
sub eax, dword [ebp - 0x128]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x504], eax
je 0x47a42b
mov dword [ebp - 0xe2c], 1
jmp 0x47a432
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xc98], eax
push 0
lea ecx, [ebp - 0xf2c]
call fcn.00434f4e
mov ecx, dword [ebp - 0xe2c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc98]
cmp eax, dword [ebp - 0xe2c]
je 0x47a47c
push 0
lea ecx, [ebp - 0xf2c]
call fcn.00434f4e
cmp dword [eax], 0
jne 0x47a47c
and dword [ebp - 0x1218], 0
jmp 0x47a486
mov dword [ebp - 0x1218], 1
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x1218], eax
jge 0x47a4a0
mov dword [ebp - 0x2528], 1
jmp 0x47a4a7
and dword [ebp - 0x2528], 0
mov eax, dword [ebp - 0x7ec]
cmp dword [ebp - 0x2528], eax
jg 0x47a4c1
mov dword [ebp - 0x1220], 1
jmp 0x47a4c8
and dword [ebp - 0x1220], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x1220], eax
jle 0x47a4e2
mov dword [ebp - 0x2530], 1
jmp 0x47a4e9
and dword [ebp - 0x2530], 0
mov eax, dword [ebp - 0x2530]
neg eax
cmp eax, dword [ebp - 0x7ec]
jg 0x47a505
mov dword [ebp - 0x1228], 1
jmp 0x47a50c
and dword [ebp - 0x1228], 0
mov eax, dword [ebp - 0x7ec]
cmp dword [ebp - 0x1228], eax
jg 0x47a526
mov dword [ebp - 0x2538], 1
jmp 0x47a52d
and dword [ebp - 0x2538], 0
mov eax, dword [ebp - 0x7ec]
cmp dword [ebp - 0x2538], eax
jge 0x47a547
mov dword [ebp - 0x2e64], 1
jmp 0x47a54e
and dword [ebp - 0x2e64], 0
mov eax, dword [ebp - 0x2550]
mov dword [ebp - 0x3ac0], eax
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x2540], eax
push 1
lea ecx, [ebp - 0xf2c]
call fcn.00434f4e
push 6
pop ecx
sub ecx, dword [eax]
mov dword [ebp - 0x1230], ecx
mov eax, dword [ebp - 0x1230]
cmp dword [ebp - 0x2540], eax
jle 0x47a598
mov dword [ebp - 0x2e6c], 1
jmp 0x47a59f
and dword [ebp - 0x2e6c], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x3ac8], eax
push 0
lea ecx, [ebp - 0xf2c]
call fcn.00434f4e
push 0
lea ecx, [ebp - 0xf2c]
call fcn.00434f4e
cmp dword [ebp - 0x504], 0
jbe 0x47a5da
mov dword [ebp - 0x1238], 1
jmp 0x47a5e1
and dword [ebp - 0x1238], 0
mov eax, dword [ebp - 0x504]
cmp dword [ebp - 0x1238], eax
jge 0x47a5fb