Function at 0x47add9
Capabilities:
Accept command line arguments
Create thread
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
xor eax, eax
mov dword [ebp - 0x60], ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x5c], edx
inc edi
mov dword [ebp - 0x18], eax
jmp 0x47ae08
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1a0], 0x5baf43b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x47adf7
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x47ae4d
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47ae37
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47ae48
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x47ae1b
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47ae64
push 0x18f1
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], 0xe44fa3fd
mov dword [ebp - 0x14], 0x5405ea3
mov dword [ebp - 0x18], eax
jmp 0x47ae96
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xc0], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x47ae85
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47aeb0
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
mov edx, eax
cmp dword [ebp - 8], eax
je 0x47aeb9
mov edx, edi
cmp dword [ebp - 8], 0xa53061ec
sbb ecx, ecx
inc ecx
cmp ecx, edx
jl 0x47aed6
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp edx, ecx
push 0
pop ecx
setle cl
push 8
pop esi
cmp esi, ecx
push 0
sbb ecx, ecx
inc ecx
imul edx, ecx, 0xafbf
mov ecx, dword [ebp - 8]
cmp edx, ecx
pop ecx
setge cl
xor edx, edx
sub ecx, 0x723af636
test ecx, ecx
mov ecx, dword [ebp - 0x24]
push 0
setle dl
cmp edx, ecx
mov ecx, dword [ebp - 8]
pop edx
setne dl
cmp edx, ecx
push 0
pop ecx
setle cl
push 7
pop edx
cmp ecx, 0x5f19716e
je 0x47affe
mov dword [ebp - 0x20], 0xe12fd89d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
jmp 0x47af6a
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x220], 0x9e98c534
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x47af59
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x53c8
mov ecx, dword [ebp - 0x24]
setl dl
cmp edx, esi
push 0
sbb edx, edx
inc edx
cmp ecx, edx
pop ecx
setne cl
xor edx, edx
cmp ecx, 0x864adb5d
setne dl
mov dword [ebp - 0xc0], edx
mov ecx, dword [ebp - 0x1c]
sub edx, ecx
sub edx, 0xc0ae
je 0x47afc5
mov edx, edi
cmp dword [ebp - 0xc], eax
jne 0x47afc7
mov edx, eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov ecx, 0x94d85d5f
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
sbb edx, edx
inc edx
sub ecx, edx
jne 0x47afe5
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x47afe7
mov ecx, edi
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
jmp 0x47b157
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x20], 0x1d73cb4e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x47b13d
mov dword [ebp - 0x18], 0x9618de77
mov dword [ebp - 0x24], eax
jmp 0x47b03d
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47b03a
push 0x2499
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x47b024
mov dword [ebp - 0x24], eax
jmp 0x47b122
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0xc], eax
jmp 0x47b07f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x158], 0xd933b151
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x47b06e
mov dword [ebp - 0xc], eax
jmp 0x47b09b
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1f8], 0x39a040d4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x47b08a
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0xc0], eax
jne 0x47b10d
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0xc0], eax
jne 0x47b0c6
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x47b0c8
mov ecx, edi
mov dword [ebp - 0x20], ecx
xor edx, edx
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x158]
mov dword [ebp - 0x1f0], esi
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
sete dl
mov dword [ebp - 0x168], edx
mov edx, eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0xc0]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x18]
je 0x47b10f
mov edx, edi
mov ecx, dword [ebp - 0x18]
imul ecx, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xf2bfcff1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x47b04a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x47b018
push 8
pop esi
push 7
pop edx
mov dword [ebp - 0x24], 0xfffffffc
jmp 0x47b151
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jne 0x47b157
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 5
jge 0x47b146
mov ecx, dword [0xaaa230]
test cl, 1
jne 0x47b1da
push eax
or ecx, edi
mov dword [0xaaa210], eax
push eax
mov dword [0xaaa230], ecx
mov dword [0xaaa214], eax
call fcn.00403ec7
mov ecx, eax
mov dword [0xaaa22c], 0x3f800000
mov dword [0xaaa210], ecx
xor eax, eax
mov dword [ebp - 0xf0], ecx
lea ecx, [ebp - 0xf0]
push ecx
push 0x10
push eax
mov dword [0xaaa218], eax
mov ecx, 0xaaa218
mov dword [0xaaa220], eax
mov dword [0xaaa21c], eax
lea eax, [ebp - 0x18c]
push eax
call fcn.00403bfd
push 7
pop eax
push 0x4b064c
mov dword [0xaaa224], eax
mov dword [0xaaa228], esi
call fcn.0049a41f
pop ecx
xor eax, eax
mov dword [ebp - 0x1c], 0x3901
mov dword [ebp - 0x18], 0x9338886a
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x20], 0x4b3bebda
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x47b22b
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xa0], 0x1a6b719d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x47b21a
mov dword [ebp - 0xc], eax
jmp 0x47b247
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x148], 0xac8c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x47b236
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xfffb
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x94]
jne 0x47b273
mov ecx, eax
cmp dword [ebp - 0xa0], eax
je 0x47b275
mov ecx, edi
mov esi, dword [ebp - 0x1c]
add esi, ecx
sub esi, dword [ebp - 0x1c]
neg esi
push 0
sbb esi, esi
xor edx, edx
inc esi
imul esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, 0xf687
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xa0]
setne dl
mov dword [ebp - 0x14], edx
xor edx, edx
cmp dword [ebp - 0x14], ecx
setg dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0xffffffff
sbb edx, edx
neg edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
pop ecx
setge cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ecx
setge dl
sub edx, 0x32116b34
jne 0x47b301
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x144], ecx
test ecx, ecx
je 0x47b354
mov dword [ebp - 0x14], 0x9fa18394
mov dword [ebp - 0x20], 0xb6d700d1
mov dword [ebp - 0x18], eax
jmp 0x47b33e
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xf4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x47b32d
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x20], ecx
jmp 0x47b3fc
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0x12446b8c
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov esi, dword [ebp - 0x124]
push 0
pop ecx
setl cl
xor edx, edx
cmp ecx, 0xbcdcec45
mov ecx, dword [ebp - 0x94]
setne dl
imul esi, edx
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
sete dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
je 0x47b3ca
mov ecx, edi
cmp dword [ebp - 0x18], eax
jne 0x47b3cc
mov ecx, eax
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub ecx, 0x97ea
neg ecx
push 8
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
pop ecx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x1c]
cmp ecx, edx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
imul ecx, dword [ebp - 0x60], 0x2710
add ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x78], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], eax
jmp 0x47b41f
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x68], 0x4a8c6a53
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x47b411
mov dword [ebp - 8], eax
jmp 0x47b537
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x47b534
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x47b52b
mov dword [ebp - 0xc], 0x66c93ee
mov dword [ebp - 0x14], 0x23cea2ff
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x47b522
mov dword [ebp - 0x18], 0x13717be9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x47b519
mov dword [ebp - 0x1c], 0x62b000c
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
jmp 0x47b507
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0x58099740
mov ecx, dword [ebp - 0x24]
push 0
setne dl
cmp edx, ecx
pop ecx
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ecx
push 0
setl dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x68]
mov ecx, dword [ebp - 8]
imul esi, dword [ebp + ecx*4 - 0x68]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x68]
cmp ecx, esi
mov ecx, dword [ebp - 0x20]
setle dl
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
pop edx
setge dl
cmp edx, ecx
push 0
pop ecx
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x14], ecx
setge dl
cmp edx, 0xffff
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x47b48a
dec dword [ebp - 0x18]
jns 0x47b47b
dec dword [ebp - 0xc]
jns 0x47b468
dec dword [ebp - 0x24]
jns 0x47b44e
dec dword [ebp - 0x10]
jns 0x47b43f
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x47b42c
mov dword [ebp - 8], eax
jmp 0x47b556
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 5
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jge 0x47b545
lea eax, [ebp - 0x78]
push eax
call fcn.0047cbcd
mov edx, dword [eax]
xor eax, eax
test edx, edx
je 0x47b69a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
push 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
pop esi
jmp 0x47b593
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x22c], 0xf251d69f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47b582
inc dword [ebp - 0x20]
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x47b5ae
push 0x22a8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x2c], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x90f02349
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x5c], 0xe7bf
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xf5ef889a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x2189f42c
mov dword [ebp - 0x28], 0xa8cf1d65
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xb421dd2e
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x30], esi
mov dword [ecx], edx
mov dword [ebp - 0x10], eax
jmp 0x47b62d
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1ec], 0x64087a91
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47b61c
mov dword [ebp - 0x20], 0x7478144a
cmp dword [ebp - 0x20], eax
je 0x47b670
inc dword [ebp - 0x30]
xor edx, edx
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
setle dl
imul ecx, edx, 0xa6f4
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sub edx, ecx
neg edx
sbb edx, edx
add edx, 0xffff5452
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x30]
jne 0x47b672
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1e4], edi
mov esi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp esi, edx
setg cl
mov dword [ebp - 0x14], ecx
jmp 0x47cb58
push 2
mov dword [ebp - 8], 0x4b4e1265
mov dword [ebp - 0x10], eax
pop esi
jmp 0x47b6ba
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xb8], 0x67ee
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47b6a9
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
push 0
pop ecx
setl cl
xor edx, edx
cmp ecx, 0x4307
mov ecx, dword [ebp - 0xb4]
push 0
setge dl
cmp edx, 0xfffffffb
sbb edx, edx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0xb8]
pop edx
setg dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub dword [ebp - 8], edx
cmp dword [ebp - 8], edi
jbe 0x47b727
mov dword [ebp - 8], eax
jmp 0x47b71d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xb8], 0x3d0b
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x47b70c
jmp 0x47b7cd
mov dword [ebp - 0x188], edi
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x180], edi
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x10], 0xf26af903
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x47b7bc
mov dword [ebp - 0x30], eax
mov esi, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x184], 0x894ff545
mov dword [ebp - 0x30], 0x894ff545
cmp dword [ebp - 0x30], eax
je 0x47b76e
mov esi, edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
push 0
pop ecx
setge cl
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x10]
setg dl
sub edx, ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
xor edx, edx
cmp dword [ebp - 0x14], ecx
setg dl
mov dword [ebp - 0x10], edx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47b7b4
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
dec dword [ebp - 8]
jns 0x47b74e
push 2
pop esi
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47b7cd
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
mov ecx, dword [0xaaa230]
test cl, 2
jne 0x47b850
push eax
or ecx, esi
mov dword [0xaaa1f0], eax
push eax
mov dword [0xaaa230], ecx
mov dword [0xaaa1f4], eax
call fcn.00403ec7
mov ecx, eax
mov dword [0xaaa20c], 0x3f800000
mov dword [0xaaa1f0], ecx
xor eax, eax
mov dword [ebp - 0x118], ecx
lea ecx, [ebp - 0x118]
push ecx
push 0x10
push eax
mov dword [0xaaa1f8], eax
mov ecx, 0xaaa1f8
mov dword [0xaaa200], eax
mov dword [0xaaa1fc], eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00403bfd
push 7
pop eax
push 8
mov dword [0xaaa204], eax
pop eax
push 0x4b0647
mov dword [0xaaa208], eax
call fcn.0049a41f
pop ecx
xor eax, eax
mov dword [ebp - 0x14], 0x99ea7eb8
mov dword [ebp - 0xc], eax
jmp 0x47b86f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x150], 0xf9b3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47b85e
mov dword [ebp - 0xc], eax
jmp 0x47b887
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x34], 0x5c8094a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47b879
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x47b8c6
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x34]
dec ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp + ecx*4 - 0x150]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp + ecx*4 - 0x150]
mov dword [ebp - 0x14], edi
dec dword [ebp - 0x34]
jns 0x47b894
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0x1c], 0xe2799ac7
mov dword [ebp - 0x1c], 3
jmp 0x47b8ff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
jmp 0x47b8f1
cmp dword [ebp - 0x1c], eax
jne 0x47b8f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1d
jne 0x47b8e9
cmp dword [ebp - 0x18], eax
jne 0x47b905
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
jl 0x47b8e1
lea eax, [ebp - 0x60]
push eax
call fcn.0047cc2f
mov dl, byte [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
test dl, dl
jne 0x47b922
test eax, eax
jne 0x47bb61
mov dword [ebp - 0xc], 0x5a23e86f
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], 0x2da3c3d
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x17a68fab
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x47b963
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov dl, byte [ebp + 0xc]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x10], eax
jne 0x47b97d
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x4d1b
jge 0x47b98d
cmp dword [ebp - 0xc], eax
jne 0x47b98d
mov edi, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x248]
push eax
call fcn.00451f94
mov esi, eax
lea edi, [ebp - 0xd0]
pop ecx
xor eax, eax
push 4
movsd dword es:[edi], dword [esi]
pop edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 9
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x10], eax
jmp 0x47b9f7
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x208], 0x82062403
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x47b9e6
mov dword [ebp - 8], eax
jmp 0x47ba12
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x208], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x47ba01
cmp dword [ebp - 0x14], eax
je 0x47ba66
mov dword [ebp - 8], 3
cmp dword [ebp - 8], eax
jl 0x47ba44
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47ba3f
push eax
push 0x170f
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
xor eax, eax
dec dword [ebp - 8]
jns 0x47ba28
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47babb
push 0x25ea
push 0x2033
push eax
push eax
push 0x8fc
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x47babb
mov dword [ebp - 8], eax
jmp 0x47bab5
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47bab2
push 0x1d31
push 0x1ff1
push 0xbb1
push 0x250c
push 0x1268
push 0x14ed
push 0x1375
push 0x180f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x12
jne 0x47ba6b
xor eax, eax
push 2
pop esi
cmp byte [ebp + 0xc], al
je 0x47bb65
cmp dword [ebp - 0xc8], eax
je 0x47bb65
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x10], eax
jmp 0x47bb03
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x114], 0xf0ea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47baf2
xor edi, edi
inc edi
mov dword [ebp - 0xa4], edi
cmp dword [ebp - 0xa4], eax
jl 0x47bb4a
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp + ecx*4 - 0x114]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp + ecx*4 - 0x114], edx
mov ecx, dword [ebp - 0xa4]
cmp dword [ebp + ecx*4 - 0x114], eax
jne 0x47bb4a
dec dword [ebp - 0xa4]
jns 0x47bb19
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc4]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0xc8]
mov dword [edx + 8], ecx
jmp 0x47bb68
xor eax, eax
jmp 0x47bb68
xor edi, edi
inc edi
mov dword [ebp - 0x10], 0x682c5a4e
mov dword [ebp - 0x2c], 0x9673c824
mov dword [ebp - 0x28], 0xd9aad11c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], eax
jmp 0x47bb93
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x58], 0x102071b1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47bb85
mov dword [ebp - 0xc], eax
jmp 0x47bbab
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x80], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47bb9d
cmp dword [ebp - 0x58], eax
je 0x47bda6
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], 0xa421e0b
mov dword [ebp - 0x10], eax
jmp 0x47bbd6
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x3c], 0x1013923c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47bbc8
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x38]
push 0
pop edx
setge dl
cmp edx, ecx
push 0
pop ecx
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x54]
setle dl
mov dword [ebp - 0x14], edx
xor edx, edx
cmp dword [ebp - 0x14], ecx
push 0
setle dl
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x58]
cmp edx, ecx
pop ecx
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
setle dl
mov dword [ebp - 0x80], edx
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
sub edx, ecx
jne 0x47bc4d
mov esi, eax
cmp dword [ebp - 0x38], eax
je 0x47bc4f
mov esi, edi
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ecx, esi
setl dl
neg edx
jne 0x47bc64
mov ecx, edi
cmp dword [ebp - 0x58], eax
jne 0x47bc66
mov ecx, eax
cmp ecx, dword [ebp - 0x7c]
jne 0x47bc72
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x47bc74
mov ecx, edi
cmp ecx, 0xc5c2f002
push 0
sbb ecx, ecx
neg ecx
cmp edi, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xfffffff6
setne dl
xor ecx, ecx
cmp edx, 0xffff
setne cl
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x14]
add edx, ecx
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
mov edx, 0xa335c22c
pop ecx
setg cl
cmp edx, ecx
mov ecx, dword [ebp - 0x54]
push 0
sbb edx, edx
inc edx
cmp edx, ecx
pop ecx
setge cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x14], ecx
push 0
sete dl
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x38]
add edx, ecx
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
pop ecx
setl cl
cmp ecx, dword [ebp - 8]
jle 0x47bd88
mov dword [ebp - 0x20], 0x67f3e8e0
mov dword [ebp - 0x2c], 0xa919e541
mov dword [ebp - 8], eax
jmp 0x47bd7d
mov edx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
cmp edx, ecx
push 0
pop ecx
setge cl
add ecx, 0xfffe
cmp ecx, 0xac9fd407
je 0x47bd20
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0x20]
cmp ecx, 2
mov ecx, dword [ebp - 0x20]
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
cmp dword [ebp - 0x14], ecx
setle dl
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x3c], eax
jne 0x47bd65
mov ecx, dword [ebp - 0x38]
neg dword [ebp - 0x10]
je 0x47bd75
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x3c], eax
mov ecx, edi
jne 0x47bd77
mov ecx, eax
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x47bd01
jmp 0x47bdc7
mov dword [ebp - 0x20], 0x95504247
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
jmp 0x47bdc7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
jmp 0x47bdbf
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x210], 0x9dab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47bdae
dec dword [ebp - 0x20]
mov esi, dword [ebp - 0x30]
test esi, esi
jne 0x47c469
cmp dword [ebp - 0xd0], esi
jle 0x47c469
mov dword [ebp - 0x28], 0x261f9c28
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], 0x5b0e446d
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], 0x12f3
mov dword [ebp - 0xc], eax
jmp 0x47be1a
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1a4], 0xb34e6d4f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47be09
mov dword [ebp - 0xc], eax
jmp 0x47be31
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x238], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x47be24
dec dword [ebp - 0x20]
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47be60
push 0x9da
push 0x26a3
push 0x59d
push 0x2372
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor eax, eax
mov dword [ebp - 0x18], 0x7eed
mov dword [ebp - 0x10], 0x74dd0324
mov dword [ebp - 0x14], 0xf191
mov dword [ebp - 0x1c], 0x39ee491
mov dword [ebp - 0x20], 0xfffffffb
push 2
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
pop esi
jmp 0x47be9f
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x10c], 0x9598aaf0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x47be8e
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jne 0x47bf0a
dec dword [ebp - 0x1c]
mov edx, 0xdd93ba6a
mov ecx, dword [ebp - 0x1c]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp edx, ecx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x18]
je 0x47bed1
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x108]
push 7
pop edx
push 0
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
sbb edx, edx
neg edx
cmp edx, ecx
pop ecx
sete cl
mov dword [ebp - 0x108], ecx
test ecx, ecx
je 0x47bf02
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x108], eax
je 0x47bf11
mov ecx, edi
cmp dword [ebp - 0x18], eax
jne 0x47bf13
mov ecx, eax
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47bf40
push eax
push 0xb0f
push 0x19b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
mov dword [ebp - 8], 0x446df37d
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0x493e623b
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x24], 0x64bda99d
mov dword [ebp - 0x28], edi
push 9
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x955e
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], eax
jmp 0x47bfaa
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xe8], 0x646b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x47bf99
mov dword [ebp - 0xc], eax
jmp 0x47bfc5
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1c8], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x47bfb4
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0x6c2e
setle dl
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
jmp 0x47c0c2
mov dword [ebp - 0x28], 0xfd43
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], 0x30c4e2bf
mov dword [ebp - 0x18], 0x4f69a750
mov dword [ebp - 0x28], 0xd3d8
mov dword [ebp - 0x20], 0x860c01ef
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x10], eax
jmp 0x47c038
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1b0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x47c02b
dec dword [ebp - 0x18]
inc dword [ebp - 0x1c8]
mov dword [ebp - 0x1c], eax
jmp 0x47c0ba
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp + ecx*4 - 0xe8], eax
je 0x47c090
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x178], ecx
cmp dword [ebp - 0x14], eax
jne 0x47c06c
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp - 0x10], edi
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0xe8]
cmp ecx, 0xffffffff
setle dl
mov dword [ebp - 0x1a8], edx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
push 4
mov esi, dword [ebp + ecx*4 - 0xe8]
mov ecx, dword [ebp - 0x24]
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, esi
setle cl
mov dword [ebp - 0x10], ecx
pop ecx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x47c04c
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x47bff9
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0xa5273358
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
jmp 0x47c0fb
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x64], 0x1245
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47c0ed
mov dword [ebp - 0xc], eax
jmp 0x47c113
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x6c], 0x13d0bb94
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47c105
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x80c3
setl cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
setle dl
imul edx, dword [ebp - 0x64]
cmp edx, 0x647dc4b4
jge 0x47c15a
mov ecx, edi
cmp dword [ebp - 0x20], eax
jne 0x47c15c
mov ecx, eax
imul ecx, ecx, 0x4a90
test ecx, ecx
je 0x47c18d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x47c287
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x64]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x64], edx
mov dword [ebp - 0x6c], edx
dec dword [ebp - 8]
jns 0x47c172
jmp 0x47c287
mov dword [ebp - 0x20], 0x9a13
mov dword [ebp - 0x14], 0xb91ee4c
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], 0xb8cff26a
mov dword [ebp - 0x28], 0xa0627e80
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0xd0bd2f23
push 3
mov dword [ebp - 0x28], 0xa1d2daff
mov dword [ebp - 0xc], eax
pop edx
jmp 0x47c1e4
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x198], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x47c1d7
mov dword [ebp - 0xc], eax
jmp 0x47c1fb
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x140], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x47c1ee
mov dword [ebp - 0x1c], eax
jmp 0x47c21f
cmp dword [ebp - 0xcc], 0
je 0x47c469
cmp dword [ebp - 0xd0], 0
je 0x47c469
mov dword [ebp - 0x30], 0xba09
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0x4f57b17b
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x20], 0x21f997ec
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x47c2e1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x40], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x47c2d3
mov dword [ebp - 0xc], eax
jmp 0x47c2f8
mov dword [ebp - 0x10], 0xcfe0
mov ecx, 0x662a
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0x14], 0x90515466
mov dword [ebp - 0x28], edi
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47c4b4
push eax
push 0x23df
push eax
push eax
push 0x613
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xf8]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x100]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x10]
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
setl dl
add ecx, edx
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xd0]
setne dl
xor eax, eax
inc edx
cmp edx, 0xb0f7
setg al
mov dword [ebp - 0x14], eax
call fcn.004535fd
mov dword [ebp - 8], 0xffffffff
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x4126315b
mov dword [ebp - 0x20], 0x4ff24264
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0xfffffff1
cmp dword [ebp - 8], 0xffffffe5
jge 0x47c75c
xor eax, eax
mov dword [ebp - 0xc], edi
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0x6d9e96b
mov dword [ebp - 0x2c], 0x7972e7eb
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0x97a1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
jmp 0x47c585
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x47c577
mov edx, dword [ebp - 0x1c]
mov esi, edi
mov ecx, dword [ebp - 0x44]
cmp ecx, edx
push 0
pop ecx
setg cl
neg ecx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
inc dword [ebp - 0xc]
cmp edx, ecx
mov ecx, dword [ebp - 8]
mov edx, edi
mov ecx, dword [ebp - 0x48]
cmovne esi, eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 8], eax
jne 0x47c5c6
mov edx, eax
mov ecx, dword [ebp - 0x44]
sub edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 8]
setne dl
cmp edx, ecx
mov ecx, dword [ebp - 8]
push 0
pop edx
setne dl
cmp edx, ecx
push 0
pop ecx
setl cl
sub ecx, dword [ebp - 0x44]
neg ecx
push 0
sbb ecx, ecx
inc ecx
imul ecx, ecx, 0xbbe2
sub esi, ecx
mov ecx, dword [ebp - 8]
sub esi, 0xfffffff8
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 8]
setge dl
cmp ecx, edx
pop ecx
setle cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x2c], ecx
setne dl
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x10], eax
je 0x47c657
mov ecx, dword [ebp - 0x1c]
mov esi, edi
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jne 0x47c659
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x44]
setle dl
imul edx, ecx
mov ecx, dword [ebp - 0xc]
sub edx, ecx
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x20], eax
jne 0x47c682
cmp dword [ebp - 0x44], eax
jne 0x47c682
mov esi, edi
cmp dword [ebp - 0x18], eax
je 0x47c684
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
neg esi
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7338d581
setl cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x48]
setle dl
mov dword [ebp - 0x10], edx
xor edx, edx
cmp dword [ebp - 0x10], ecx
setle dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x44]
jle 0x47c6f0
mov esi, edi
cmp dword [ebp - 0x14], eax
jne 0x47c6f2
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
mov byte [ebp - 1], al
setne dl
cmp edx, edi
jle 0x47c729
cmp byte [ebp - 1], 0
je 0x47c74f
push 0x14a4
push 0x8f2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x47c74d
cmp byte [ebp - 1], 0
je 0x47c74f
push eax
push eax
push 0x1aca
push eax
push 0xf34
push eax
push 0x13a
push 0x1ecf
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe5
jl 0x47c54e
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x47c777
push edi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
cmp dword [ebp - 0x30], 0
je 0x47ca6a
mov dword [ebp - 8], 0xb56cef3
mov dword [ebp - 0x1c], 0x92079655
mov dword [ebp - 8], eax
jmp 0x47c7a2
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x50], 0xac204e2d
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x47c794
mov dword [ebp - 8], eax
jmp 0x47c7be
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x90], 0x29bf3901
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x47c7ad
mov dword [ebp - 8], eax
jmp 0x47c7da
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x134], 9
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x47c7c9
mov dword [ebp - 0x50], 0xb
jmp 0x47c90b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x94d0e83
mov dword [ebp - 0x14], 0x35db5a26
mov dword [ebp - 0x20], 0x3268dd2a
mov dword [ebp - 0x10], eax
jmp 0x47c816
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1b8], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x47c809
mov dword [ebp - 0x24], eax
jmp 0x47c84e
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47c84b
push eax
push 0x1419
push 0x1f6e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x47c821
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x84]
neg ecx
push 0
sbb ecx, ecx
add ecx, 0xa5b6
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x50]
cmp ecx, esi
mov ecx, dword [ebp - 0x24]
sbb edx, edx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 0x50]
pop edx
setl dl
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
push 0
pop edx
setle dl
add ecx, edx
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x4ccb090a
push 0
setne dl
cmp esi, edx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x12c], 0xfffffffb
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1b4], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x50]
cmp edx, ecx
pop ecx
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x50]
cmp dword [ebp - 0x28], ecx
setl dl
add edx, 0x356d9de3
jne 0x47c903
mov ecx, eax
cmp dword [ebp - 0x50], eax
je 0x47c905
mov ecx, edi
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xffffffe8
push 6
pop esi
jge 0x47c7ec
mov dword [ebp - 0x1c], 0x19
jmp 0x47ca18
mov dword [ebp - 0x14], 0x53d0c964
mov dword [ebp - 0x28], 0xa39b7b3f
mov dword [ebp - 8], 3
cmp dword [ebp - 8], eax
jl 0x47ca15
mov dword [ebp - 0x14], 0xf83f3a8a
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x90]
mov esi, dword [ebp - 0x12c]
sub esi, ecx
mov ecx, dword [ebp - 0x134]
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0xc458
setle cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x90]
sub esi, dword [ebp - 0x1c]
imul esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
sub esi, dword [ebp + ecx*4 - 0x90]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
inc esi
mov ecx, dword [ebp + ecx*4 - 0x90]
cmp ecx, esi
mov ecx, dword [ebp - 0x90]
setg dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], ecx
setne dl
mov dword [ebp - 0x14], edx
mov edx, 0x5271231b
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x90]
mov ecx, dword [ebp - 8]
add esi, dword [ebp + ecx*4 - 0x90]
mov ecx, dword [ebp - 0x14]
sub edx, ecx
add esi, edx
xor ecx, ecx
cmp esi, 0x24e19c78
setl cl
sub ecx, dword [ebp - 0x134]
cmp ecx, 6
mov ecx, dword [ebp - 8]
sbb esi, esi
xor edx, edx
inc esi
mov ecx, dword [ebp + ecx*4 - 0x90]
cmp esi, ecx
setl dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 8]
jns 0x47c942
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jne 0x47c924
push dword [ebp - 0x5c]
push dword [ebp - 0x30]
call fcn.00451e95
mov esi, dword [ebp + 8]
mov dword [ebp + 8], edi
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
pop ecx
pop ecx
mov dword [esi], eax
je 0x47ca49
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x47ca5b
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea eax, [ebp - 0x78]
push eax
call fcn.0047cbcd
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x47ca6d
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], 0x342eb90d
mov dword [ebp - 0x18], eax
jmp 0x47cb4c
mov dword [ebp - 0x10], 0x30722263
mov dword [ebp + 8], eax
jmp 0x47ca9b
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x1d4], 0xc69aed23
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x47ca8a
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x47cab2
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x47cb3f
mov dword [ebp + 8], eax
jmp 0x47cacd
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x74], 0xffffffff
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x47cabf
mov dword [ebp - 0x74], 2
cmp dword [ebp - 0x74], eax
jl 0x47cb3c
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x47cb2d
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x995
push 0x2629
push 0x931
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x3df
push 0x960
push 0x1ee
push 0x2415
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ebp + ecx*4 - 0x1d4]
dec dword [ebp - 0x74]
jns 0x47cadf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x47caba
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jge 0x47ca7e
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret