Function at 0x4666dd
Capabilities:
Check os version
Compare security identifiers
Extract resource via kernel32 functions
Get common file path
Hide graphical window
Query or enumerate registry key
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x35f4
call fcn.0049c550
push esi
push edi
push 3
lea ecx, [ebp - 0x23f0]
call fcn.00431bf0
push 1
lea ecx, [ebp - 0x2a00]
call fcn.00431bf0
mov dword [ebp - 0x60], 0
jmp 0x466716
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x466732
push dword [ebp - 0x60]
lea ecx, [ebp - 0x23f0]
call fcn.00431cde
mov dword [eax], 1
jmp 0x46670f
mov dword [ebp - 0x60], 0
jmp 0x466742
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x466758
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x2adc], 0x5252cb13
jmp 0x46673b
mov dword [ebp - 0x60], 0
jmp 0x466768
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x466784
push dword [ebp - 0x60]
lea ecx, [ebp - 0x2a00]
call fcn.00431cde
mov dword [eax], 0xf985589b
jmp 0x466761
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2adc], 0
jmp 0x4667b2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2adc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2adc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2adc], 2
jg 0x46693b
mov dword [ebp - 0x238], 0x2263
mov dword [ebp - 0x2278], 0xfffffffd
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x238], 0
jmp 0x4667fd
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jg 0x466936
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x218], 2
jmp 0x46682d
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x466931
push dword [ebp - 0x218]
lea ecx, [ebp - 0x23f0]
call fcn.00431cde
cmp dword [ebp - 0x218], 0xa7b7
jne 0x466863
mov dword [ebp - 0xbac], 1
jmp 0x46686a
and dword [ebp - 0xbac], 0
push 0
lea ecx, [ebp - 0x2a00]
call fcn.00431cde
mov ecx, dword [ebp - 0xbac]
mov dword [eax], ecx
cmp dword [ebp - 0xbac], 0x4cb8
jge 0x466897
mov dword [ebp - 0x1f8c], 1
jmp 0x46689e
and dword [ebp - 0x1f8c], 0
push dword [ebp - 0x238]
lea ecx, [ebp - 0x23f0]
call fcn.00431cde
imul eax, dword [ebp - 0x238], 6
cmp eax, dword [ebp - 0x218]
jne 0x4668ca
mov dword [ebp - 0x162c], 1
jmp 0x4668d1
and dword [ebp - 0x162c], 0
push dword [ebp - 0x238]
lea ecx, [ebp - 0x23f0]
call fcn.00431cde
mov eax, dword [eax]
cmp eax, dword [ebp - 0x162c]
jne 0x4668f8
mov dword [ebp - 0x1d80], 1
jmp 0x4668ff
and dword [ebp - 0x1d80], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x1d80], eax
je 0x466919
mov dword [ebp - 0x1d88], 1
jmp 0x466920
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x1d88]
mov dword [ebp - 0x2278], eax
jmp 0x466820
jmp 0x4667f0
jmp 0x466797
lea ecx, [ebp - 0x2a00]
call fcn.00431cc2
lea ecx, [ebp - 0x23f0]
call fcn.00431cc2
mov dword [ebp - 0x5c4], 1
mov dword [ebp - 0x22a0], 0xfffffff9
mov dword [ebp - 0x32e4], 1
mov dword [ebp - 0x1dcc], 0x5799333c
mov dword [ebp - 0x2e00], 0xe495761b
mov dword [ebp - 0x31ec], 1
mov dword [ebp - 0x1dd4], 0xffffffff
mov dword [ebp - 0x22d0], 0
mov dword [ebp - 0x2e08], 0x7bdd4840
push 1
lea ecx, [ebp - 0x2ebc]
call fcn.00431bf0
push 2
lea ecx, [ebp - 0x2940]
call fcn.00431bf0
mov dword [ebp - 0x22b8], 0x77fc
mov dword [ebp - 0xd8], 0
jmp 0x4669e8
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x466a07
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2ebc]
call fcn.00431cde
or dword [eax], 0xffffffff
jmp 0x4669db
mov dword [ebp - 0xd8], 0
jmp 0x466a20
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x466a42
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x2940]
call fcn.00431cde
mov dword [eax], 0x4eb0
jmp 0x466a13
mov dword [ebp - 0x5c4], 0xffffffe7
jmp 0x466a5b
mov eax, dword [ebp - 0x5c4]
dec eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0xffffffe2
je 0x466c5d
mov dword [ebp - 0x2280], 0xfffffffe
mov dword [ebp - 0x3120], 5
mov dword [ebp - 0x22c0], 0xffffffff
mov dword [ebp - 0x22a8], 0x4ffd8143
mov dword [ebp - 0x2e10], 0x61e33ecd
mov dword [ebp - 0xb38], 0xdad4f6c5
mov dword [ebp - 0x1e8], 0
jmp 0x466abd
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x466ad9
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x22c8], 0xfffffff7
jmp 0x466ab0
mov dword [ebp - 0x1e8], 0
jmp 0x466af2
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x466b0e
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x22b0], 0x57f3
jmp 0x466ae5
cmp dword [ebp - 0x2280], 0xfffa
jbe 0x466b26
mov dword [ebp - 0x1d98], 1
jmp 0x466b2d
and dword [ebp - 0x1d98], 0
mov eax, dword [ebp - 0x22a0]
mov ecx, dword [ebp - 0xb38]
mov edx, dword [ebp - 0xb38]
inc edx
mov dword [ebp - 0xb38], edx
cmp ecx, eax
jne 0x466b53
cmp dword [ebp - 0x22a8], 0
je 0x466b5a
cmp dword [ebp - 0x1dcc], 0
mov eax, 0x9381
cmp eax, 7
jge 0x466b70
mov dword [ebp - 0x1d90], 1
jmp 0x466b77
and dword [ebp - 0x1d90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22b0]
cmp dword [ebp - 0x1d90], eax
jne 0x466b98
mov dword [ebp - 0x1da0], 1
jmp 0x466b9f
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x1d98]
cmp eax, dword [ebp - 0x1da0]
je 0x466bb9
mov dword [ebp - 0x1da8], 1
jmp 0x466bc0
and dword [ebp - 0x1da8], 0
cmp dword [ebp - 0x1da8], 1
jg 0x466bd5
mov dword [ebp - 0x1db0], 1
jmp 0x466bdc
and dword [ebp - 0x1db0], 0
push 0
lea ecx, [ebp - 0x2940]
call fcn.00431cde
mov ecx, dword [ebp - 0x1db0]
cmp ecx, dword [eax]
jl 0x466bff
mov dword [ebp - 0x1dc4], 1
jmp 0x466c06
and dword [ebp - 0x1dc4], 0
mov eax, dword [ebp - 0x22b8]
add eax, dword [ebp - 0x1dc4]
mov dword [ebp - 0x1dd4], eax
mov eax, dword [ebp - 0x1dcc]
cmp dword [ebp - 0x1dd4], eax
jge 0x466c32
mov dword [ebp - 0x1ddc], 1
jmp 0x466c39
and dword [ebp - 0x1ddc], 0
mov eax, dword [ebp - 0x1ddc]
mov dword [ebp - 0x22c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22c8]
mov dword [ebp - 0x22d0], eax
jmp 0x466a4e
lea ecx, [ebp - 0x2940]
call fcn.00431cc2
lea ecx, [ebp - 0x2ebc]
call fcn.00431cc2
mov dword [ebp - 0x5cc], 0x256915a
mov dword [ebp - 0x768], 0
jmp 0x466c96
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 3
jge 0x466cb2
mov eax, dword [ebp - 0x768]
mov dword [ebp + eax*4 - 0x3548], 0xfffffffe
jmp 0x466c89
mov dword [ebp - 0x5cc], 2
jmp 0x466ccb
mov eax, dword [ebp - 0x5cc]
dec eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0
jl 0x466ceb
mov dword [ebp - 0x22d8], 0xfffffffa
cmp dword [ebp - 0x22d8], 0
je 0x466ce9
jmp 0x466ceb
jmp 0x466cbe
mov byte [ebp - 0x3ad], 0
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x466d25
push 0xc97
push 0x1bbf
push 0xb4
push 0x139b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 3
lea ecx, [ebp - 0x2410]
call fcn.00431bf0
push 2
lea ecx, [ebp - 0x97c]
call fcn.00431bf0
mov dword [ebp - 0x2a4], 0xace4b0ad
mov dword [ebp - 0xe0], 0
jmp 0x466d62
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x466d84
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x97c]
call fcn.00431cde
mov dword [eax], 3
jmp 0x466d55
mov dword [ebp - 0xe0], 0
jmp 0x466d9d
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 4
jge 0x466db9
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x3534], 0xe34aafbe
jmp 0x466d90
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
and dword [eax], 0
jmp 0x466def
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
mov dword [ebp - 0x1de4], eax
mov eax, dword [ebp - 0x1de4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1de4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
cmp dword [eax], 0xfffffffa
jge 0x466fd3
mov dword [ebp - 0x1e1c], 0x72a8358b
mov dword [ebp - 0x76c], 0x7b7f609b
mov dword [ebp - 0x98c], 0x51ae9a07
push 0
lea ecx, [ebp - 0x97c]
call fcn.00431cde
cmp dword [ebp - 0x76c], 0
je 0x466e67
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x2a4], eax
jne 0x466e53
mov dword [ebp - 0x1dec], 1
jmp 0x466e5a
and dword [ebp - 0x1dec], 0
push 0
lea ecx, [ebp - 0x97c]
call fcn.00431cde
mov dword [ebp - 0x76c], 0xffff
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x76c], eax
jle 0x466e9d
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
cmp dword [eax], 0
je 0x466e9d
mov dword [ebp - 0x1df4], 1
jmp 0x466ea4
and dword [ebp - 0x1df4], 0
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x1df4], eax
jg 0x466ebe
mov dword [ebp - 0x1dfc], 1
jmp 0x466ec5
and dword [ebp - 0x1dfc], 0
cmp dword [ebp - 0x1dfc], 0xecc2
jge 0x466edd
mov dword [ebp - 0x1e04], 1
jmp 0x466ee4
and dword [ebp - 0x1e04], 0
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x1e04], eax
je 0x466efe
mov dword [ebp - 0x1e0c], 1
jmp 0x466f05
and dword [ebp - 0x1e0c], 0
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
mov ecx, dword [ebp - 0x1e0c]
cmp ecx, dword [eax]
je 0x466f28
mov dword [ebp - 0x1e14], 1
jmp 0x466f2f
and dword [ebp - 0x1e14], 0
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
mov eax, dword [eax]
mov dword [ebp - 0x1e1c], eax
mov eax, dword [ebp - 0x1e14]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x1e1c], eax
jle 0x466f79
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
cmp dword [eax], 0
jne 0x466f79
and dword [ebp - 0x1e24], 0
jmp 0x466f83
mov dword [ebp - 0x1e24], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e24]
mov dword [ebp + eax - 0x3534], ecx
mov dword [ebp - 0x2a4], 3
jmp 0x466faf
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jl 0x466fce
push 1
lea ecx, [ebp - 0x97c]
call fcn.00431cde
cmp dword [eax], 0
je 0x466fcc
jmp 0x466fce
jmp 0x466fa2
jmp 0x466dcb
lea ecx, [ebp - 0x97c]
call fcn.00431cc2
mov dword [ebp - 0x4c0], 8
push 3
lea ecx, [ebp - 0x2ac0]
call fcn.00431bf0
mov dword [ebp - 0x1d4], 0
jmp 0x46700e
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x46702a
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x320c], 0xfff7
jmp 0x467001
mov dword [ebp - 0x1d4], 0
jmp 0x467043
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x467062
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x2ac0]
call fcn.00431cde
and dword [eax], 0
jmp 0x467036
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x320c]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4c0], 0xfffffff7
jmp 0x46708e
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0x1c
jl 0x4670a9
push 1
lea ecx, [ebp - 0x2ac0]
call fcn.00431cde
or dword [eax], 0xffffffff
jmp 0x467081
lea ecx, [ebp - 0x2ac0]
call fcn.00431cc2
push 1
lea ecx, [ebp - 0x2988]
call fcn.00431bf0
push 1
lea ecx, [ebp - 0x928]
call fcn.00431bf0
mov dword [ebp - 0x58c], 0x2e755073
mov dword [ebp - 0x994], 0xfffffff7
mov dword [ebp - 0x1aa8], 0x8d6db9
mov dword [ebp - 0xe8], 0
jmp 0x467105
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x467121
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0xb1c], 0xfffffff9
jmp 0x4670f8
mov dword [ebp - 0xe8], 0
jmp 0x46713a
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x46715c
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov dword [eax], 0xfffffffa
jmp 0x46712d
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov dword [eax], 1
jmp 0x467195
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov dword [ebp - 0x1e2c], eax
mov eax, dword [ebp - 0x1e2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1e2c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
cmp dword [eax], 0
jl 0x46730a
mov dword [ebp - 0xaa4], 0xc60e
mov dword [ebp - 0x2300], 6
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xb1c]
mov dword [ebp - 0x32b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb1c]
cmp dword [ebp - 0xaa4], eax
jle 0x4671fc
mov dword [ebp - 0x1e34], 1
jmp 0x467203
and dword [ebp - 0x1e34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb1c]
cmp dword [ebp - 0x1e34], eax
je 0x467224
mov dword [ebp - 0x1e3c], 1
jmp 0x46722b
and dword [ebp - 0x1e3c], 0
cmp dword [ebp - 0x1e3c], 6
je 0x467240
mov dword [ebp - 0x22e0], 1
jmp 0x467247
and dword [ebp - 0x22e0], 0
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xb1c]
mov dword [ebp - 0x2e18], eax
cmp dword [ebp - 0xaa4], 0xb2fc257a
je 0x46727b
mov dword [ebp - 0x1e54], 1
jmp 0x467282
and dword [ebp - 0x1e54], 0
cmp dword [ebp - 0x1e54], 1
jbe 0x467297
mov dword [ebp - 0x1e48], 1
jmp 0x46729e
and dword [ebp - 0x1e48], 0
mov eax, dword [ebp - 0x1e48]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x3128], eax
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov eax, dword [eax]
mov ecx, dword [ebp - 0xaa4]
cmp dword [ebp + eax*4 - 0xb1c], ecx
jg 0x4672ef
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
cmp dword [eax], 0
jne 0x4672ef
and dword [ebp - 0xefc], 0
jmp 0x4672f9
mov dword [ebp - 0xefc], 1
mov eax, dword [ebp - 0xefc]
mov dword [ebp - 0x2300], eax
jmp 0x467171
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
cmp dword [eax], 0
je 0x46738a
cmp dword [ebp - 0x58c], 0x10b8a
jg 0x467341
mov dword [ebp - 0x1a90], 1
jmp 0x467348
and dword [ebp - 0x1a90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb1c]
cmp dword [ebp - 0x1a90], eax
jne 0x467369
mov dword [ebp - 0xc14], 1
jmp 0x467370
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x994]
cmp dword [ebp - 0xc14], eax
je 0x46738a
mov dword [ebp - 0x1a98], 1
jmp 0x467391
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0x58c]
imul eax, dword [ebp - 0x1a98]
cmp eax, dword [ebp - 0x994]
jl 0x4673b2
mov dword [ebp - 0xc1c], 1
jmp 0x4673b9
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0x1aa8]
cmp dword [ebp - 0xc1c], eax
jle 0x4673d3
mov dword [ebp - 0x1aa0], 1
jmp 0x4673da
and dword [ebp - 0x1aa0], 0
imul eax, dword [ebp - 0x1aa0], 0x4e81
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0xb1c]
cmp eax, dword [ebp - 0x994]
jle 0x467406
mov dword [ebp - 0xc24], 1
jmp 0x46740d
and dword [ebp - 0xc24], 0
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov esi, eax
push 0
lea ecx, [ebp - 0x928]
call fcn.00431cde
mov ecx, dword [ebp - 0xc24]
imul ecx, dword [eax]
cmp dword [esi], ecx
je 0x467442
mov dword [ebp - 0xc2c], 1
jmp 0x467449
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0x1aa8]
cmp dword [ebp - 0xc2c], eax
jg 0x467463
mov dword [ebp - 0x1ab0], 1
jmp 0x46746a
and dword [ebp - 0x1ab0], 0
cmp dword [ebp - 0x1ab0], 0x328db1ae
jl 0x467482
mov dword [ebp - 0xc34], 1
jmp 0x467489
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 0xfffffffc
jge 0x46749e
mov dword [ebp - 0x1ab8], 1
jmp 0x4674a5
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x1ab8]
mov dword [ebp - 0x58c], eax
lea ecx, [ebp - 0x928]
call fcn.00431cc2
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x3e0], 0xfffb
mov dword [ebp - 0x4c8], 0x8f87662b
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
cmp eax, 0x9b1ab445
jne 0x4674f1
mov dword [ebp - 0x2308], 1
jmp 0x4674f8
and dword [ebp - 0x2308], 0
cmp dword [ebp - 0x18], 0x82ca9683
je 0x46750d
mov dword [ebp - 0x2310], 1
jmp 0x467514
and dword [ebp - 0x2310], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp eax, 1
je 0x46752b
mov dword [ebp - 0x2318], 1
jmp 0x467532
and dword [ebp - 0x2318], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2e20], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x46754f
mov dword [ebp - 0xc3c], 1
jmp 0x467556
and dword [ebp - 0xc3c], 0
cmp dword [ebp - 0xc3c], 0xc4365dea
jne 0x46756e
mov dword [ebp - 0x1ac0], 1
jmp 0x467575
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x1ac0]
sub eax, dword [ebp - 0x18]
cmp eax, 0xffff
je 0x467591
mov dword [ebp - 0xc44], 1
jmp 0x467598
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3e0], eax
je 0x4675bb
mov dword [ebp - 0x1ac8], 1
jmp 0x4675c2
and dword [ebp - 0x1ac8], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1ac8]
jle 0x4675df
mov eax, 0x686a37bd
test eax, eax
jne 0x4675df
and dword [ebp - 0xc4c], 0
jmp 0x4675e9
mov dword [ebp - 0xc4c], 1
imul eax, dword [ebp - 0xc4c], 3
cmp eax, dword [ebp - 0x18]
jne 0x46776c
mov dword [ebp - 0x2330], 0
mov dword [ebp - 0x1ad0], 8
mov dword [ebp - 0x18], 0xffffffe2
jmp 0x46761d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x35
jle 0x467661
mov dword [ebp - 0x2320], 0x8b874bdb
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x467654
push 0x1b47
push 0x1469
push 0xaab
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp dword [ebp - 0x2320], 0
je 0x46765f
jmp 0x467616
jmp 0x467616
mov dword [ebp - 0x3e0], 0
jmp 0x46767a
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0xf
je 0x46776a
mov dword [ebp - 0x2328], 1
mov eax, dword [ebp - 0x2328]
mov dword [ebp - 0x31f4], eax
mov eax, dword [ebp - 0x2330]
neg eax
mov dword [ebp - 0x1ad0], eax
mov eax, dword [ebp - 0x1ad0]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c8], 0xe
jmp 0x4676d0
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0x11
jle 0x467765
mov dword [ebp - 0x5d4], 0
jmp 0x4676f6
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 1
jge 0x467712
mov eax, dword [ebp - 0x5d4]
mov dword [ebp + eax*4 - 0x2e28], 0x50eb
jmp 0x4676e9
mov dword [ebp - 0x18], 0
jmp 0x467722
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x467760
mov dword [ebp - 0xc54], 0x4929
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x467751
push 0xcc2
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0xc54]
inc eax
mov dword [ebp - 0xc54], eax
jmp 0x46771b
jmp 0x4676c3
jmp 0x46766d
jmp 0x46779b
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x46779b
push 0
push 0x440
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov dword [ebp - 0x3c], 0
jmp 0x4677ab
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x4677c7
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2410]
call fcn.00431cde
mov dword [eax], 1
jmp 0x4677a4
mov dword [ebp - 0x2744], 0xf9b3198a
mov dword [ebp - 0x2740], 0xf9b3198a
mov dword [ebp - 0x273c], 0xf9b3198a
mov dword [ebp - 0x2738], 0xf9b3198a
lea ecx, [ebp - 0xb05]
call fcn.00431ced
push eax
lea eax, [ebp - 0x2734]
push eax
lea eax, [ebp - 0x2744]
push eax
lea ecx, [ebp - 0x342c]
call fcn.00431cf0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3358]
call fcn.00431c9c
mov dword [ebp - 0x8a4], 0xfffffffe
mov dword [ebp - 0x8a4], 0
jmp 0x467847
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 3
jg 0x46786a
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x467868
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46783a
lea ecx, [ebp - 0x3358]
call fcn.00431cc2
mov dword [ebp - 0x3c], 0
jmp 0x467885
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x46789b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2b4c], 0x5252cb13
jmp 0x46787e
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x5dc], 0
jmp 0x4678be
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 4
jge 0x4678da
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x25e4], 1
jmp 0x4678b1
mov dword [ebp - 0x1a4], 0
jmp 0x4678f3
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x467a91
push 3
lea ecx, [ebp - 0x2958]
call fcn.00431bf0
mov dword [ebp - 0x2338], 0
mov dword [ebp - 0x774], 0
jmp 0x467930
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 3
jge 0x467952
push dword [ebp - 0x774]
lea ecx, [ebp - 0x2958]
call fcn.00431cde
mov dword [eax], 3
jmp 0x467923
push 1
lea ecx, [ebp - 0x2958]
call fcn.00431cde
mov dword [eax], 0xb792
imul eax, dword [ebp - 0x1a4], 0xb792
mov ecx, dword [ebp - 0x1a4]
cmp dword [ebp + ecx*4 - 0x25e4], eax
jge 0x46798a
mov dword [ebp - 0x1ae8], 1
jmp 0x467991
and dword [ebp - 0x1ae8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1a4]
mov ecx, dword [ebp + ecx*4 - 0x25e4]
cmp dword [ebp + eax - 0x25e4], ecx
jle 0x4679b8
mov dword [ebp - 0x1ad8], 1
jmp 0x4679bf
and dword [ebp - 0x1ad8], 0
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x25e4]
cmp dword [ebp - 0x1ad8], eax
jle 0x4679e0
mov dword [ebp - 0xc5c], 1
jmp 0x4679e7
and dword [ebp - 0xc5c], 0
cmp dword [ebp - 0xc5c], 1
jbe 0x4679fc
mov dword [ebp - 0x1ae0], 1
jmp 0x467a03
and dword [ebp - 0x1ae0], 0
cmp dword [ebp - 0x1ae0], 4
je 0x467a18
mov dword [ebp - 0xc64], 1
jmp 0x467a1f
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x25e4]
cmp dword [ebp - 0xc64], eax
jg 0x467a40
mov dword [ebp - 0xc6c], 1
jmp 0x467a47
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0x1ae8]
sub eax, dword [ebp - 0xc6c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x25e4]
jg 0x467a6e
mov dword [ebp - 0x1af0], 1
jmp 0x467a75
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x1af0]
mov dword [ebp - 0x2338], eax
lea ecx, [ebp - 0x2958]
call fcn.00431cc2
jmp 0x4678e6
mov dword [ebp - 0x3c], 0
jmp 0x467aa1
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x467abd
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2988]
call fcn.00431cde
mov dword [eax], 0xf985589b
jmp 0x467a9a
mov dword [ebp - 0x844], 0xffffffff
mov dword [ebp - 0x3130], 6
mov dword [ebp - 0x2e30], 0xa3a92bd4
mov dword [ebp - 0x32f8], 0xa2ae7b79
mov dword [ebp - 0x5e4], 0
jmp 0x467afe
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 3
jge 0x467b1a
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x356c], 0x95e3b372
jmp 0x467af1
mov dword [ebp - 0x844], 0xffffffe8
jmp 0x467b33
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0xa
jge 0x467bb5
mov dword [ebp - 0x2e38], 0x1accbad8
mov dword [ebp - 0x3138], 4
mov dword [ebp - 0x2e40], 0xfffffff7
mov dword [ebp - 0x32c0], 0x223b16aa
mov dword [ebp - 0xc74], 0
mov dword [ebp - 0x5ec], 0
jmp 0x467b87
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 1
jge 0x467ba3
mov eax, dword [ebp - 0x5ec]
mov dword [ebp + eax*4 - 0x2e98], 1
jmp 0x467b7a
mov eax, dword [ebp - 0xc74]
inc eax
mov dword [ebp - 0xc74], eax
jmp 0x467b26
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2b4c], 0
jmp 0x467be3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b4c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2b4c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b4c], 2
jg 0x468d34
mov dword [ebp - 0x53c], 0xfffffffc
mov dword [ebp - 0x2348], 0
mov dword [ebp - 0x314c], 0xc9ebf495
mov dword [ebp - 0x5f4], 0xc4475ee4
push 4
lea ecx, [ebp - 0x2a18]
call fcn.00431bf0
mov dword [ebp - 0x77c], 0
jmp 0x467c45
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 4
jge 0x467c64
push dword [ebp - 0x77c]
lea ecx, [ebp - 0x2a18]
call fcn.00431cde
and dword [eax], 0
jmp 0x467c38
xor eax, eax
inc eax
je 0x467c7e
cmp dword [ebp - 0x53c], 0
je 0x467c7e
mov dword [ebp - 0x1af8], 1
jmp 0x467c85
and dword [ebp - 0x1af8], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x2ea4], eax
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0x1af8], eax
jne 0x467cab
mov dword [ebp - 0x2340], 1
jmp 0x467cb2
and dword [ebp - 0x2340], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x3220], eax
cmp dword [ebp - 0x53c], 0
je 0x467d40
mov dword [ebp - 0xc7c], 0xffffffff
mov dword [ebp - 0x2eb0], 0x42ca8cda
mov dword [ebp - 0x3154], 0xffffffff
mov dword [ebp - 0x2ec0], 0x29f58382
mov dword [ebp - 0x32e8], 1
mov dword [ebp - 0x2ed0], 2
mov dword [ebp - 0x315c], 1
mov eax, dword [ebp - 0xc7c]
inc eax
mov dword [ebp - 0xc7c], eax
push 0
lea ecx, [ebp - 0x2a18]
call fcn.00431cde
mov dword [ebp - 0x1b00], eax
mov eax, dword [ebp - 0x1b00]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b00]
mov dword [ecx], eax
jmp 0x467d6d
mov byte [ebp - 0x29e], 0
movzx eax, byte [ebp - 0x29e]
test eax, eax
je 0x467d63
push 0
push 0
push 0x603
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [ebp - 0x2348], 1
mov dword [ebp - 0x5f4], 0
jmp 0x467d86
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0x1b
jge 0x467db0
mov byte [ebp - 0x25f], 0
movzx eax, byte [ebp - 0x25f]
test eax, eax
je 0x467dae
push 0x25f1
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x467d79
lea ecx, [ebp - 0x2a18]
call fcn.00431cc2
mov dword [ebp - 0x258], 0x2263
mov dword [ebp - 0xf0], 0
jmp 0x467dde
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x467dfa
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0xc84], 1
jmp 0x467dd1
mov dword [ebp - 0xf0], 0
jmp 0x467e13
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x467e2f
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x1f78], 0xfffffffd
jmp 0x467e06
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f78], 0
jmp 0x467e5d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f78]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1f78], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f78], 0
jg 0x467e97
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f78]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1f78]
mov eax, dword [ebp + eax*4 - 0xc84]
mov dword [ebp + ecx*4 - 0xc84], eax
jmp 0x467e42
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x1f78]
mov dword [ebp + ecx - 0x1f78], eax
mov dword [ebp - 0x23b8], 0xfffffffd
mov dword [ebp - 0x8fc], 0xfffffff7
mov dword [ebp - 0x8fc], 0xffffffe3
jmp 0x467ede
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 0xfffffff9
jl 0x46802f
mov dword [ebp - 0x5fc], 0x9000d4e7
mov dword [ebp - 0x5fc], 0
jmp 0x467f0e
mov eax, dword [ebp - 0x5fc]
dec eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0xfffffff5
jl 0x46802a
mov dword [ebp - 0x2b6c], 0x7e55059b
mov dword [ebp - 0x2b68], 0x7e55059b
mov dword [ebp - 0x2b64], 0x7e55059b
mov dword [ebp - 0x2b60], 0x7e55059b
push 2
lea ecx, [ebp - 0x1ee4]
call fcn.00431bf0
mov dword [ebp - 0x784], 0
jmp 0x467f69
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 2
jge 0x467f8b
push dword [ebp - 0x784]
lea ecx, [ebp - 0x1ee4]
call fcn.00431cde
mov dword [eax], 0x1bab5934
jmp 0x467f5c
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.00431cde
and dword [eax], 0
jmp 0x467fc1
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.00431cde
mov dword [ebp - 0x1b08], eax
mov eax, dword [ebp - 0x1b08]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b08]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.00431cde
cmp dword [eax], 4
jge 0x467fef
push 1
lea ecx, [ebp - 0x1ee4]
call fcn.00431cde
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x2b6c], 0xfffffffa
jmp 0x467f9d
mov byte [ebp - 0x365], 0
movzx eax, byte [ebp - 0x365]
test eax, eax
je 0x46801a
push 0x99a
push 0
push 0x65e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
lea ecx, [ebp - 0x1ee4]
call fcn.00431cc2
jmp 0x467f01
jmp 0x467ed1
mov dword [ebp - 0x258], 0xffffffff
push 2
lea ecx, [ebp - 0x2400]
call fcn.00431bf0
mov dword [ebp - 0x46c], 0xfffffff8
mov dword [ebp - 0x4d0], 0xd402da3c
push 1
lea ecx, [ebp - 0x282c]
call fcn.00431bf0
mov dword [ebp - 0x1fc], 0
jmp 0x468080
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x46809f
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2400]
call fcn.00431cde
or dword [eax], 0xffffffff
jmp 0x468073
mov dword [ebp - 0x1fc], 0
jmp 0x4680b8
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x4680da
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x282c]
call fcn.00431cde
mov dword [eax], 0xfffffffc
jmp 0x4680ab
mov dword [ebp - 0x46c], 1
jmp 0x4680f3
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jl 0x4684db
mov dword [ebp - 0xca4], 0
mov dword [ebp - 0x84c], 1
mov dword [ebp - 0x604], 0x7b5c6eff
push 2
lea ecx, [ebp - 0x2ecc]
call fcn.00431bf0
mov dword [ebp - 0x2ee0], 0xffffffff
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0xcb4], 1
push 2
lea ecx, [ebp - 0x2970]
call fcn.00431bf0
mov dword [ebp - 0x2370], 0x20b2de47
mov dword [ebp - 0xf8], 0
jmp 0x468179
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x46819b
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x2ecc]
call fcn.00431cde
mov dword [eax], 0x780ca9f8
jmp 0x46816c
mov dword [ebp - 0xf8], 0
jmp 0x4681b4
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x4681d6
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x2970]
call fcn.00431cde
mov dword [eax], 8
jmp 0x4681a7
cmp dword [ebp - 0xcb4], 0xffffffff
jbe 0x4681eb
mov dword [ebp - 0xc8c], 1
jmp 0x4681f2
and dword [ebp - 0xc8c], 0
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x2400]
call fcn.00431cde
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc8c]
jle 0x468219
mov dword [ebp - 0x1b10], 1
jmp 0x468220
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x1b10]
je 0x468247
mov dword [ebp - 0xb88], 1
jmp 0x46824e
and dword [ebp - 0xb88], 0
push 1
lea ecx, [ebp - 0x2400]
call fcn.00431cde
mov ecx, dword [ebp - 0xb88]
mov dword [eax], ecx
cmp dword [ebp - 0xb88], 0xd64ea33a
jne 0x46827b
mov dword [ebp - 0xc94], 1
jmp 0x468282
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x4d0]
cmp dword [ebp - 0xc94], eax
jne 0x46829c
mov dword [ebp - 0x1b18], 1
jmp 0x4682a3
and dword [ebp - 0x1b18], 0
mov esi, dword [ebp - 0x1b18]
neg esi
push 0
lea ecx, [ebp - 0x282c]
call fcn.00431cde
mov dword [eax], esi
mov dword [ebp - 0x604], 0
jmp 0x4682d3
mov eax, dword [ebp - 0x604]
dec eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0xffffffed
je 0x4684c0
mov dword [ebp - 0xaac], 1
mov dword [ebp - 0x2360], 0xe0512ed4
mov dword [ebp - 0x84c], 3
jmp 0x46830d
mov eax, dword [ebp - 0x84c]
inc eax
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0xe
jge 0x4684bb
mov dword [ebp - 0x2378], 0xceaa
mov dword [ebp - 0x4d0], 0
jmp 0x46833d
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0x26
jg 0x4684b6
mov dword [ebp - 0xc9c], 0x50e8f7cf
mov dword [ebp - 0x2ac], 0
jmp 0x46836d
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
je 0x4684a6
mov dword [ebp - 0x99c], 0x17a68fa
cmp dword [ebp - 0x99c], 0
je 0x468392
jmp 0x4684a6
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x2350], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0x2358], eax
mov eax, dword [ebp - 0xaac]
inc eax
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x2350]
cmp eax, dword [ebp - 0x2358]
jle 0x4683dd
mov dword [ebp - 0x1b20], 1
jmp 0x4683e4
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0xc9c]
cmp eax, dword [ebp - 0x1b20]
je 0x4683fe
mov dword [ebp - 0xcac], 1
jmp 0x468405
and dword [ebp - 0xcac], 0
mov dword [ebp - 0xca4], 0xffffffff
cmp dword [ebp - 0xca4], 0x615
jl 0x468427
mov dword [ebp - 0x1b28], 1
jmp 0x46842e
and dword [ebp - 0x1b28], 0
mov eax, dword [ebp - 0x2360]
imul eax, dword [ebp - 0x1b28]
cmp eax, 7
jge 0x46844c
mov dword [ebp - 0x2368], 1
jmp 0x468453
and dword [ebp - 0x2368], 0
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x2400]
call fcn.00431cde
push 0
lea ecx, [ebp - 0x2970]
call fcn.00431cde
mov ecx, dword [ebp - 0xcac]
cmp ecx, dword [eax]
je 0x468487
mov dword [ebp - 0x1b30], 1
jmp 0x46848e
and dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x2370]
imul eax, dword [ebp - 0x1b30]
mov dword [ebp - 0xcb4], eax
jmp 0x468360
cmp dword [ebp - 0x2378], 0
je 0x4684b1
jmp 0x4684b6
jmp 0x468330
jmp 0x468300
jmp 0x4682c6
lea ecx, [ebp - 0x2970]
call fcn.00431cc2
lea ecx, [ebp - 0x2ecc]
call fcn.00431cc2
jmp 0x4680e6
lea ecx, [ebp - 0x282c]
call fcn.00431cc2
lea ecx, [ebp - 0x2400]
call fcn.00431cc2
mov dword [ebp - 0x258], 0
jmp 0x46850a
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jg 0x468d2f
push 2
lea ecx, [ebp - 0x964]
call fcn.00431bf0
mov dword [ebp - 0x60c], 0x8cf5a8b0
mov dword [ebp - 0xcd4], 0xfffffff6
mov dword [ebp - 0x2380], 0xffffffff
mov dword [ebp - 0x3234], 0xb2f67ab6
mov dword [ebp - 0x2ef0], 0x2c005d9c
push 3
lea ecx, [ebp - 0x2edc]
call fcn.00431bf0
mov dword [ebp - 0x5c], 0
jmp 0x468573
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x46858f
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x964]
call fcn.00431cde
mov dword [eax], 0x39e3cf95
jmp 0x46856c
mov dword [ebp - 0x5c], 0
jmp 0x46859f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x4685bb
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2edc]
call fcn.00431cde
mov dword [eax], 0xcd17cd95
jmp 0x468598
mov dword [ebp - 0x5c], 0
jmp 0x4685cb
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x4685e1
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1b58], 0
jmp 0x4685c4
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
cmp dword [eax], 0
jne 0x468695
mov dword [ebp - 0x60c], 0xe2bfbd3a
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x3164], eax
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
cmp dword [eax], 0
jne 0x468647
push 0
lea ecx, [ebp - 0x964]
call fcn.00431cde
cmp dword [eax], 0
jne 0x468647
and dword [ebp - 0x1b38], 0
jmp 0x468651
mov dword [ebp - 0x1b38], 1
mov esi, dword [ebp - 0x1b38]
neg esi
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
sub esi, dword [eax]
je 0x468671
cmp dword [ebp - 0x60c], 0
mov eax, 0xe9ab
test eax, eax
je 0x468695
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
cmp dword [eax], 0
jne 0x468695
and dword [ebp - 0xcbc], 0
jmp 0x46869f
mov dword [ebp - 0xcbc], 1
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
mov ecx, dword [ebp - 0xcbc]
cmp ecx, dword [eax]
jl 0x4686c2
mov dword [ebp - 0x1b40], 1
jmp 0x4686c9
and dword [ebp - 0x1b40], 0
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
mov ecx, dword [ebp - 0x1b40]
cmp ecx, dword [eax]
jl 0x4686f2
cmp dword [ebp - 0x60c], 0
jne 0x4686f2
and dword [ebp - 0xcc4], 0
jmp 0x4686fc
mov dword [ebp - 0xcc4], 1
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
mov ecx, dword [ebp - 0xcc4]
cmp ecx, dword [eax]
jg 0x46871f
mov dword [ebp - 0x1b48], 1
jmp 0x468726
and dword [ebp - 0x1b48], 0
cmp dword [ebp - 0x1b48], 0xe871d976
je 0x46873e
mov dword [ebp - 0xccc], 1
jmp 0x468745
and dword [ebp - 0xccc], 0
cmp dword [ebp - 0xccc], 0xffffffff
jle 0x468769
push 1
lea ecx, [ebp - 0x964]
call fcn.00431cde
cmp dword [eax], 0
jne 0x468769
and dword [ebp - 0x1b50], 0
jmp 0x468773
mov dword [ebp - 0x1b50], 1
mov eax, dword [ebp - 0x1b50]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0x2380], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b58]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b58], eax
lea ecx, [ebp - 0x2edc]
call fcn.00431cc2
lea ecx, [ebp - 0x964]
call fcn.00431cc2
mov dword [ebp - 0x220], 7
and dword [ebp - 0x27bc], 0
and dword [ebp - 0x27b8], 0
and dword [ebp - 0x27b4], 0
and dword [ebp - 0x27b0], 0
lea ecx, [ebp - 0xb0d]
call fcn.00431ced
push eax
lea eax, [ebp - 0x27ac]
push eax
lea eax, [ebp - 0x27bc]
push eax
lea ecx, [ebp - 0x3474]
call fcn.00431cf0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2600]
call fcn.00431c9c
push 0
lea ecx, [ebp - 0x2600]
call fcn.00431cde
and dword [eax], 0
jmp 0x46884d
push 0
lea ecx, [ebp - 0x2600]
call fcn.00431cde
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0xcdc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xcdc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2600]
call fcn.00431cde
cmp dword [eax], 0xfffffff9
jge 0x46887b
mov byte [ebp - 0x261], 0
movzx eax, byte [ebp - 0x261]
test eax, eax
je 0x468879
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x468829
lea ecx, [ebp - 0x2600]
call fcn.00431cc2
mov dword [ebp - 0x220], 2
jmp 0x46889f
cmp dword [ebp - 0x220], 0
jl 0x468d2a
mov dword [ebp - 0x1ac], 0xc5b1510a
mov dword [ebp - 0x2f00], 0x9220c436
mov dword [ebp - 0x2b8c], 5
mov dword [ebp - 0x2b88], 5
mov dword [ebp - 0x2b84], 5
mov dword [ebp - 0x2b80], 5
mov dword [ebp - 0x2390], 0x687c4177
mov dword [ebp - 0x32c8], 0x74d4
mov dword [ebp - 0x78c], 0
jmp 0x468915
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 3
jge 0x468931
mov eax, dword [ebp - 0x78c]
mov dword [ebp + eax*4 - 0x3364], 0xd6158f87
jmp 0x468908
cmp dword [ebp - 0x1ac], 1
jl 0x468946
mov dword [ebp - 0x1b60], 1
jmp 0x46894d
and dword [ebp - 0x1b60], 0
mov eax, dword [ebp - 0x1ac]
imul eax, dword [ebp - 0x1b60]
cmp eax, dword [ebp - 0x1ac]
jl 0x46896e
mov dword [ebp - 0x2388], 1
jmp 0x468975
and dword [ebp - 0x2388], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x2f10], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x316c], eax
mov eax, dword [ebp - 0x1ac]
imul eax, dword [ebp - 0x1ac]
cmp eax, 0xffffffff
jbe 0x4689ab
mov dword [ebp - 0xce4], 1
jmp 0x4689b2
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xce4]
add eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b68], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b68]
mov dword [ebp + eax - 0x2b8c], ecx
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x1b68], eax
je 0x4689f1
mov dword [ebp - 0xcec], 1
jmp 0x4689f8
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0xcec]
add eax, 0x1665
cmp eax, dword [ebp - 0x2390]
jne 0x468a17
mov dword [ebp - 0x1b70], 1
jmp 0x468a1e
and dword [ebp - 0x1b70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b70]
mov dword [ebp + eax - 0x3364], ecx
mov dword [ebp - 0xa8], 0xe1c97412
mov dword [ebp - 0x1b90], 1
mov dword [ebp - 0x1b88], 0
mov dword [ebp - 0xd0c], 0x1054d814
mov dword [ebp - 0x614], 0xfad0d727
mov dword [ebp - 0xa8], 0x5faafe30
cmp dword [ebp - 0xa8], 0
je 0x468b81
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x2f20], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
jle 0x468aa0
mov dword [ebp - 0xcf4], 1
jmp 0x468aa7
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xcf4], eax
jne 0x468ac1
mov dword [ebp - 0x1b78], 1
jmp 0x468ac8
and dword [ebp - 0x1b78], 0
cmp dword [ebp - 0x1b78], 0xeafb
je 0x468ae0
mov dword [ebp - 0xcfc], 1
jmp 0x468ae7
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0xcfc]
jne 0x468b0a
mov eax, 0x6a7f
test eax, eax
je 0x468b0a
mov dword [ebp - 0x1b80], 1
jmp 0x468b11
and dword [ebp - 0x1b80], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1b80], eax
jl 0x468b2b
mov dword [ebp - 0x2398], 1
jmp 0x468b32
and dword [ebp - 0x2398], 0
mov eax, 0xfd77
imul eax, eax, 0xd1aa
cmp eax, dword [ebp - 0xa8]
jge 0x468b51
mov dword [ebp - 0x23a0], 1
jmp 0x468b58
and dword [ebp - 0x23a0], 0
mov eax, dword [ebp - 0x1b90]
mov dword [ebp - 0x3248], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x2f30], eax
xor eax, eax
inc eax
je 0x468b81
mov dword [ebp - 0xd04], 1
jmp 0x468b88
and dword [ebp - 0xd04], 0
imul eax, dword [ebp - 0xd04], 0x99da
mov dword [ebp - 0x1b88], eax
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0xd0c], eax
jl 0x468bbe
mov dword [ebp - 0x23a8], 1
jmp 0x468bc5
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x3174], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x2b94], eax
cmp dword [ebp - 0x1b90], 0
jae 0x468bf2
mov dword [ebp - 0xd14], 1
jmp 0x468bf9
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0x614], eax
mov byte [ebp - 0x3c9], 0
movzx eax, byte [ebp - 0x3c9]
test eax, eax
je 0x468c33
push 0x64b
push 0xd07
push 0x1d17
push 0x2283
push 0
call dword [sym.imp.USER32.dll_SetRect]
push dword [ebp - 0x220]
lea ecx, [ebp - 0x2410]
call fcn.00431cde
cmp dword [ebp - 0x220], 0xa7b7
jne 0x468c5c
mov dword [ebp - 0x9a4], 1
jmp 0x468c63
and dword [ebp - 0x9a4], 0
push 0
lea ecx, [ebp - 0x2988]
call fcn.00431cde
mov ecx, dword [ebp - 0x9a4]
mov dword [eax], ecx
cmp dword [ebp - 0x9a4], 0x4cb8
jge 0x468c90
mov dword [ebp - 0x23b0], 1
jmp 0x468c97
and dword [ebp - 0x23b0], 0
push dword [ebp - 0x258]
lea ecx, [ebp - 0x2410]
call fcn.00431cde
imul eax, dword [ebp - 0x258], 6
cmp eax, dword [ebp - 0x220]
jne 0x468cc3
mov dword [ebp - 0x1b98], 1
jmp 0x468cca
and dword [ebp - 0x1b98], 0
push dword [ebp - 0x258]
lea ecx, [ebp - 0x2410]
call fcn.00431cde
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1b98]
jne 0x468cf1
mov dword [ebp - 0xd1c], 1
jmp 0x468cf8
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0xd1c], eax
je 0x468d12
jmp 0x4684fd
jmp 0x467bc8
lea ecx, [ebp - 0x2988]
call fcn.00431cc2
lea ecx, [ebp - 0x2410]
call fcn.00431cc2
mov dword [ebp - 0xb40], 0xe17c
mov dword [ebp - 0x1ba8], 7
mov dword [ebp - 0x1bb0], 0x6173948b
mov dword [ebp - 0x23c0], 4
mov dword [ebp - 0x23c8], 0x22e974a5
mov byte [ebp - 0x263], 0
movzx eax, byte [ebp - 0x263]
test eax, eax
je 0x468d98
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
cmp dword [ebp - 0xb40], 0xffffffff
jl 0x468dad
mov dword [ebp - 0xd24], 1
jmp 0x468db4
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xb40]
cmp eax, dword [ebp - 0xd24]
jge 0x468dce
mov dword [ebp - 0xd34], 1
jmp 0x468dd5
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x1ba8]
cmp dword [ebp - 0x1ba8], eax
jle 0x468def
mov dword [ebp - 0xd2c], 1
jmp 0x468df6
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0x1bb0], eax
mov eax, dword [ebp - 0x23c0]
cmp dword [ebp - 0x1bb0], eax
jg 0x468e27
cmp dword [ebp - 0xb40], 0
jne 0x468e27
or eax, 0xffffffff
jne 0x468e27
and dword [ebp - 0x1bb8], 0
jmp 0x468e31
mov dword [ebp - 0x1bb8], 1
mov eax, dword [ebp - 0xd34]
add eax, dword [ebp - 0x1bb8]
mov dword [ebp - 0x23c8], eax
cmp dword [ebp + 8], 2
jl 0x477d81
mov dword [ebp - 0x574], 0xffffffff
mov dword [ebp - 0x574], 0xffffffe6
jmp 0x468e70
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0xffffffe6
je 0x468eab
mov dword [ebp - 0x23d0], 0xd05b
mov byte [ebp - 0x36d], 0
movzx eax, byte [ebp - 0x36d]
test eax, eax
je 0x468e9d
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x23d0], eax
jmp 0x468e63
mov dword [ebp - 0x44], 0x74dd0324
mov dword [ebp - 0x8ac], 0
jmp 0x468ecb
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 2
jge 0x468ee7
mov eax, dword [ebp - 0x8ac]
mov dword [ebp + eax*4 - 0x22ec], 0xad5befa1
jmp 0x468ebe
cmp dword [ebp - 0x44], 0x66d210ec
jle 0x468efc
mov dword [ebp - 0xd3c], 1
jmp 0x468f03
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xd3c], eax
jle 0x468f1a
mov dword [ebp - 0x1bc0], 1
jmp 0x468f21
and dword [ebp - 0x1bc0], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x1bc0]
jge 0x468f3b
cmp dword [ebp - 0x44], 0
jne 0x468f3b
and dword [ebp - 0x23d8], 0
jmp 0x468f45
mov dword [ebp - 0x23d8], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2b9c], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jl 0x468f68
cmp dword [ebp - 0x44], 0
je 0x468f68
mov dword [ebp - 0x23e0], 1
jmp 0x468f6f
and dword [ebp - 0x23e0], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2ba4], eax
mov eax, 0x98aa
test eax, eax
jne 0x468f90
cmp dword [ebp - 0x44], 0
jne 0x468f90
and dword [ebp - 0x9ac], 0
jmp 0x468f9a
mov dword [ebp - 0x9ac], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9ac]
mov dword [ebp + eax - 0x22ec], ecx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x9ac]
je 0x468fc4
mov dword [ebp - 0xd44], 1
jmp 0x468fcb
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xd44], eax
jg 0x468fe2
mov dword [ebp - 0x1bc8], 1
jmp 0x468fe9
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0x1bc8]
neg eax
jne 0x469000
mov eax, 0x30a9bca7
test eax, eax
je 0x469124
mov dword [ebp - 0x61c], 0xfffffffe
mov dword [ebp - 0xab4], 0x4fa72d50
mov dword [ebp - 0xd5c], 0x94dfd996
mov dword [ebp - 0x2510], 0xc4b05ef1
mov dword [ebp - 0x2518], 0x35dd253d
mov eax, dword [ebp - 0x61c]
cmp dword [ebp - 0x61c], eax
jle 0x46904c
mov dword [ebp - 0xd4c], 1
jmp 0x469053
and dword [ebp - 0xd4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22ec]
mov dword [ebp - 0x2bac], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd4c]
sub ecx, dword [ebp + eax - 0x22ec]
cmp ecx, dword [ebp - 0x44]
jl 0x46908a
mov dword [ebp - 0x1bd0], 1
jmp 0x469091
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0x61c]
cmp dword [ebp - 0x1bd0], eax
jle 0x4690ab
mov dword [ebp - 0xd54], 1
jmp 0x4690b2
and dword [ebp - 0xd54], 0
cmp dword [ebp - 0xd54], 0xa6b4
jge 0x4690ca
mov dword [ebp - 0x1bd8], 1
jmp 0x4690d1
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0x1bd8]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0x61c]
cmp dword [ebp - 0xd5c], eax
jge 0x469103
mov dword [ebp - 0x1be0], 1
jmp 0x46910a
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x1be0]
mov dword [ebp - 0x2510], eax
mov eax, dword [ebp - 0x2518]
mov dword [ebp - 0xab4], eax
jmp 0x469137
mov dword [ebp - 0x2520], 0xbad
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2520], eax
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x2580], 0x33fcb50b
mov dword [ebp - 0x257c], 0x33fcb50b
mov dword [ebp - 0x2578], 0x33fcb50b
mov dword [ebp - 0x2574], 0x33fcb50b
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x469181
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
cmp dword [ebp - 0x88], 0
je 0x4692dd
mov dword [ebp - 0x2afc], 0x7b051af7
mov dword [ebp - 0x2af8], 0x7b051af7
mov dword [ebp - 0x2af4], 0x7b051af7
mov dword [ebp - 0x2af0], 0x7b051af7
mov dword [ebp - 0x88], 0
jmp 0x4691cf
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jg 0x4692bf
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x2580], 0
je 0x4691f1
jmp 0x4692bf
cmp dword [ebp - 0x88], 0
je 0x46920f
mov eax, 0x3735b263
test eax, eax
je 0x46920f
mov dword [ebp - 0xd64], 1
jmp 0x469216
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0xd64]
jg 0x469230
mov dword [ebp - 0x1be8], 1
jmp 0x469237
and dword [ebp - 0x1be8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2afc]
cmp dword [ebp - 0x1be8], eax
jle 0x469258
mov dword [ebp - 0x2528], 1
jmp 0x46925f
and dword [ebp - 0x2528], 0
mov eax, dword [ebp - 0x88]
imul ecx, dword [ebp - 0x88], 0x729c
cmp dword [ebp + eax*4 - 0x2580], ecx
jne 0x469284
mov dword [ebp - 0xd6c], 1
jmp 0x46928b
and dword [ebp - 0xd6c], 0
cmp dword [ebp - 0xd6c], 1
jbe 0x4692a0
mov dword [ebp - 0x1bf0], 1
jmp 0x4692a7
and dword [ebp - 0x1bf0], 0
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x1bf0]
mov dword [ebp + eax*4 - 0x2580], ecx
jmp 0x4691c2
mov byte [ebp - 0x3cb], 0
movzx eax, byte [ebp - 0x3cb]
test eax, eax
je 0x4692db
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x4692ed
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2580], 0xb17ffce6
mov dword [ebp - 0x2fc], 0x469ad59e
mov dword [ebp - 0x4d8], 0xf939
mov dword [ebp - 0xd74], 0xffffffff
mov dword [ebp - 0x2bb4], 0
mov dword [ebp - 0x2bbc], 0x89b1ab44
mov dword [ebp - 0x2bc4], 0x7aced45b
mov dword [ebp - 0x2bcc], 0x9683648b
mov dword [ebp - 0x2bd4], 0x5b1510af
mov dword [ebp - 0x1bf8], 0xe136dc99
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0xd74], eax
cmp dword [ebp - 0xd74], 0
je 0x46939a
mov dword [ebp - 0x2530], 1
mov dword [ebp - 0x4d8], 0xfffffff6
jmp 0x46937f
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0xb
jl 0x469395
cmp dword [ebp - 0x2530], 0
je 0x469393
jmp 0x469395
jmp 0x469372
jmp 0x469457
mov dword [ebp - 0x3204], 0xffffffff
mov dword [ebp - 0x3200], 0xffffffff
mov dword [ebp - 0x31fc], 0xffffffff
mov dword [ebp - 0x31f8], 0xffffffff
mov dword [ebp - 0x2bdc], 0x23607a98
mov dword [ebp - 0x2be4], 0xef054a20
mov dword [ebp - 0x2bec], 1
mov dword [ebp - 0x100], 0
jmp 0x4693f9
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x469415
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x2bf4], 1
jmp 0x4693ec
mov dword [ebp - 0x100], 0
jmp 0x46942e
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x46944a
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x35b8], 0x5378
jmp 0x469421
mov eax, dword [ebp - 0x1bf8]
dec eax
mov dword [ebp - 0x1bf8], eax
mov dword [ebp - 0x1eb4], 1
mov dword [ebp - 0x1eb0], 1
mov dword [ebp - 0x1eac], 1
mov dword [ebp - 0x1ea8], 1
push 1
lea ecx, [ebp - 0xb84]
call fcn.00431bf0
mov dword [ebp - 0xdac], 1
mov dword [ebp - 0x1c38], 1
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x1dc], 0
jmp 0x4694c3
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x4694e5
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xb84]
call fcn.00431cde
mov dword [eax], 0x53b26bdd
jmp 0x4694b6
mov dword [ebp - 0x1dc], 0
jmp 0x4694fe
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x46951a
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x3ec], 0x2b7b88cd
jmp 0x4694f1
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
and dword [eax], 0
jmp 0x469550
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
cmp dword [eax], 0xffffffea
jne 0x469a42
push 2
lea ecx, [ebp - 0xbbc]
call fcn.00431bf0
mov dword [ebp - 0x854], 0xfffffff6
mov dword [ebp - 0x624], 0x4383
mov dword [ebp - 0x794], 0
jmp 0x4695a0
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 2
jge 0x4695c2
push dword [ebp - 0x794]
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
mov dword [eax], 8
jmp 0x469593
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
mov eax, dword [eax]
sub eax, 0x30645d80
je 0x4695f6
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
cmp dword [eax], 0
je 0x4695f6
mov dword [ebp - 0x1c00], 1
jmp 0x4695fd
and dword [ebp - 0x1c00], 0
push 1
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c00]
jne 0x469620
mov dword [ebp - 0xd84], 1
jmp 0x469627
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x854], eax
mov esi, dword [ebp - 0x854]
push 1
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
cmp esi, dword [eax]
jge 0x46965c
mov eax, 0xf4326038
test eax, eax
jne 0x46965c
and dword [ebp - 0x1c08], 0
jmp 0x469666
mov dword [ebp - 0x1c08], 1
cmp dword [ebp - 0x1c08], 0x8fa48a2b
je 0x46967e
mov dword [ebp - 0xd8c], 1
jmp 0x469685
and dword [ebp - 0xd8c], 0
push 1
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
mov ecx, dword [ebp - 0xd8c]
cmp ecx, dword [eax]
jl 0x4696a8
mov dword [ebp - 0x1c10], 1
jmp 0x4696af
and dword [ebp - 0x1c10], 0
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
mov ecx, dword [ebp - 0x1c10]
cmp ecx, dword [eax]
jne 0x4696d2
mov dword [ebp - 0xd94], 1
jmp 0x4696d9
and dword [ebp - 0xd94], 0
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
mov ecx, dword [ebp - 0xd94]
cmp ecx, dword [eax]
jg 0x4696fc
mov dword [ebp - 0x1c18], 1
jmp 0x469703
and dword [ebp - 0x1c18], 0
push 1
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
mov ecx, dword [ebp - 0x1c18]
cmp ecx, dword [eax]
je 0x469726
mov dword [ebp - 0x9b4], 1
jmp 0x46972d
and dword [ebp - 0x9b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b4]
mov dword [ebp + eax - 0x3ec], ecx
push 0
lea ecx, [ebp - 0xb84]
call fcn.00431cde
mov ecx, dword [ebp - 0x9b4]
cmp ecx, dword [eax]
jge 0x469763
mov dword [ebp - 0x2538], 1
jmp 0x46976a
and dword [ebp - 0x2538], 0
or esi, 0xffffffff
inc esi
push 1
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
cmp esi, dword [eax]
jg 0x46978b
mov dword [ebp - 0xd9c], 1
jmp 0x469792
and dword [ebp - 0xd9c], 0
push 0
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
mov ecx, dword [ebp - 0xd9c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
mov dword [ebp - 0x2bfc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x624]
cmp dword [ebp + eax - 0x3ec], ecx
jge 0x4697db
mov dword [ebp - 0x1c20], 1
jmp 0x4697e2
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0x624]
cmp eax, dword [ebp - 0x1c20]
jg 0x4697fc
mov dword [ebp - 0xba0], 1
jmp 0x469803
and dword [ebp - 0xba0], 0
push 0
lea ecx, [ebp - 0xbbc]
call fcn.00431cde
mov ecx, dword [ebp - 0xba0]
mov dword [eax], ecx
cmp dword [ebp - 0xba0], 0
jne 0x469833
mov eax, 0x3ecf
test eax, eax
jne 0x469833
and dword [ebp - 0xda4], 0
jmp 0x46983d
mov dword [ebp - 0xda4], 1
mov eax, dword [ebp - 0xda4]
sub eax, dword [ebp - 0x854]
je 0x46985b
xor eax, eax
je 0x46985b
mov dword [ebp - 0x1c28], 1
jmp 0x469862
and dword [ebp - 0x1c28], 0
mov eax, dword [ebp - 0x1c28]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x624]
cmp dword [ebp - 0xdac], eax
je 0x469888
mov dword [ebp - 0x1c30], 1
jmp 0x46988f
and dword [ebp - 0x1c30], 0
cmp dword [ebp - 0x1c30], 0xfffe
jb 0x4698a7
mov dword [ebp - 0xdb4], 1
jmp 0x4698ae
and dword [ebp - 0xdb4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
imul eax, dword [ebp - 0xdb4]
mov dword [ebp - 0x1c38], eax
mov eax, dword [ebp - 0x1c38]
mov dword [ebp - 0x2c04], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
dec eax
jne 0x4698f6
lea ecx, [ebp - 0xb84]
call fcn.00431cc2
mov dword [ebp - 0x127c], 0
mov dword [ebp - 0x2554], 0xfffffff7
mov dword [ebp - 0x2564], 8
mov dword [ebp - 0x108], 0
jmp 0x469a84
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x469aa0
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x2a30], 0xfffffffb
jmp 0x469a77
mov dword [ebp - 0x108], 0
jmp 0x469ab9
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x469ad5
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x1f58], 0
jmp 0x469aac
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f58], 0
jmp 0x469b03
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f58]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1f58], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f58], 2
jg 0x469c6a
mov dword [ebp - 0x240], 0xfc558bac
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x240], 0
jmp 0x469b44
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x469c20
mov byte [ebp - 0x3cd], 0
movzx eax, byte [ebp - 0x3cd]
test eax, eax
je 0x469b70
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f58]
cmp dword [ebp + eax*4 - 0x2a30], 0xaee5a986
je 0x469b96
mov dword [ebp - 0x2540], 1
jmp 0x469b9d
and dword [ebp - 0x2540], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x2c0c], eax
mov eax, dword [ebp - 0x2554]
mov dword [ebp - 0x2c14], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x2c1c], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x2c24], eax
xor eax, eax
add eax, 0x725d
cmp eax, 0x94d2
jl 0x469be7
mov dword [ebp - 0x255c], 1
jmp 0x469bee
and dword [ebp - 0x255c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f58]
mov eax, dword [ebp + eax*4 - 0x2a30]
mov dword [ebp - 0x2c2c], eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x544]
mov dword [ebp + eax*4 - 0x2a30], ecx
jmp 0x469b37
mov dword [ebp - 0x544], 0
jmp 0x469c39
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 2
jg 0x469c65
mov byte [ebp - 0x26b], 0
movzx eax, byte [ebp - 0x26b]
test eax, eax
je 0x469c63
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x469c2c
jmp 0x469ae8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f58]
mov dword [ebp - 0xdcc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdcc]
mov dword [ebp + eax - 0x1f58], ecx
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0x2564], eax
mov dword [ebp - 0x948], 0xfffffff6
mov dword [ebp - 0x944], 0xfffffff6
mov dword [ebp - 0x940], 0xfffffff6
mov dword [ebp - 0x93c], 0xfffffff6
mov dword [ebp - 0x9bc], 0xfffe
push 2
lea ecx, [ebp - 0x266c]
call fcn.00431bf0
mov dword [ebp - 0x444], 0xfd06bde6
mov dword [ebp - 0xabc], 0xfffffff9
mov dword [ebp - 0x9c4], 0xb56095db
mov dword [ebp - 0x2298], 0x846c8c5c
mov dword [ebp - 0x62c], 0
jmp 0x469d1c
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 2
jge 0x469d3e
push dword [ebp - 0x62c]
lea ecx, [ebp - 0x266c]
call fcn.00431cde
mov dword [eax], 0xbc40ed3c
jmp 0x469d0f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x948]
mov dword [ebp - 0x256c], eax
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x2270], eax
mov eax, dword [ebp - 0x9bc]
inc eax
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x256c]
cmp eax, dword [ebp - 0x2270]
jne 0x469d84
mov dword [ebp - 0x20e0], 1
jmp 0x469d8b
and dword [ebp - 0x20e0], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x948]
cmp dword [ebp + eax - 0x948], ecx
jg 0x469db2
mov dword [ebp - 0x1c50], 1
jmp 0x469db9
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0x1c50]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x948]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x948]
jg 0x469df3
mov dword [ebp - 0xdd4], 1
jmp 0x469dfa
and dword [ebp - 0xdd4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x948]
imul eax, dword [ebp - 0xdd4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x948]
jl 0x469e29
mov dword [ebp - 0x1c58], 1
jmp 0x469e30
and dword [ebp - 0x1c58], 0
cmp dword [ebp - 0x1c58], 0xa184
jne 0x469e48
mov dword [ebp - 0xddc], 1
jmp 0x469e4f
and dword [ebp - 0xddc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0xddc], eax
jle 0x469e7d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x948], 0
jne 0x469e7d
and dword [ebp - 0x1c60], 0
jmp 0x469e87
mov dword [ebp - 0x1c60], 1
cmp dword [ebp - 0x1c60], 1
je 0x469e9c
mov dword [ebp - 0xde4], 1
jmp 0x469ea3
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xabc]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x948]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x948]
jl 0x469edd
mov dword [ebp - 0x1f9c], 1
jmp 0x469ee4
and dword [ebp - 0x1f9c], 0
mov eax, dword [ebp - 0xabc]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x948]
mov dword [ebp - 0x9c4], eax
push 1
lea ecx, [ebp - 0x266c]
call fcn.00431cde
mov eax, dword [eax]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
cmp dword [ebp - 0x444], eax
jle 0x469f2c
mov dword [ebp - 0x1c68], 1
jmp 0x469f33
and dword [ebp - 0x1c68], 0
push 1
lea ecx, [ebp - 0x266c]
call fcn.00431cde
mov ecx, dword [ebp - 0x1c68]
cmp ecx, dword [eax]
jg 0x469f56
mov dword [ebp - 0xdec], 1
jmp 0x469f5d
and dword [ebp - 0xdec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x948]
mov dword [ebp - 0x2298], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x2c34], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0xdec], eax
jle 0x469f9d
cmp dword [ebp + 8], 1
jne 0x47cd37
mov dword [ebp - 0x420], 0xdb3ae355
mov dword [ebp - 0x9f0], 1
mov dword [ebp - 0x420], 0xfffffffa
jmp 0x477db8
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xfffffff1
jge 0x478121
mov dword [ebp - 0x124], 1
push 3
lea ecx, [ebp - 0x2868]
call fcn.00431bf0
mov dword [ebp - 0x114], 0
jmp 0x477df5
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x477e11
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0xb28], 0
jmp 0x477de8
mov dword [ebp - 0x114], 0
jmp 0x477e2a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x477e4c
push dword [ebp - 0x114]
lea ecx, [ebp - 0x2868]
call fcn.00431cde
mov dword [eax], 0x7772
jmp 0x477e1d
mov dword [ebp - 0x124], 0
jmp 0x477e65
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jg 0x477eaa
mov byte [ebp - 0x3bd], 0
movzx eax, byte [ebp - 0x3bd]
test eax, eax
je 0x477e96
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb28], 0
je 0x477ea8
jmp 0x477eaa
jmp 0x477e58
mov dword [ebp - 0x124], 0x18
jmp 0x477ec3
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffffe
jg 0x478111
mov dword [ebp - 0x1fd0], 0xab79ae4f
push 3
lea ecx, [ebp - 0x2470]
call fcn.00431bf0
mov dword [ebp - 0x11c], 0
jmp 0x477f00
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x477f1c
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x3504], 0x7f6a191a
jmp 0x477ef3
mov dword [ebp - 0x11c], 0
jmp 0x477f35
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x477f57
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x2470]
call fcn.00431cde
mov dword [eax], 6
jmp 0x477f28
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x3094], eax
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x2c78], eax
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x1fd0], eax
jg 0x477f89
mov dword [ebp - 0x13b8], 1
jmp 0x477f90
and dword [ebp - 0x13b8], 0
mov eax, dword [ebp - 0x9f0]
cmp dword [ebp - 0x13b8], eax
jge 0x477faa
mov dword [ebp - 0x13c0], 1
jmp 0x477fb1
and dword [ebp - 0x13c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
cmp dword [ebp - 0x13c0], eax
je 0x477fd2
mov dword [ebp - 0x9e8], 1
jmp 0x477fd9
and dword [ebp - 0x9e8], 0
push 1
lea ecx, [ebp - 0x2868]
call fcn.00431cde
mov ecx, dword [ebp - 0x9e8]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
cmp eax, dword [ebp - 0x9e8]
jg 0x47800f
mov dword [ebp - 0x13c8], 1
jmp 0x478016
and dword [ebp - 0x13c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
cmp dword [ebp - 0x13c8], eax
je 0x478037
mov dword [ebp - 0x1fd8], 1
jmp 0x47803e
and dword [ebp - 0x1fd8], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x3020], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3504], 0x3fde
jge 0x478069
mov dword [ebp - 0x13d0], 1
jmp 0x478070
and dword [ebp - 0x13d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb28]
cmp dword [ebp - 0x13d0], eax
jge 0x478091
mov dword [ebp - 0x1fe0], 1
jmp 0x478098
and dword [ebp - 0x1fe0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x2c80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x309c], eax
mov eax, 0xc545
sub eax, 0x8b36
je 0x4780e1
mov esi, dword [ebp - 0x124]
push 1
lea ecx, [ebp - 0x2470]
call fcn.00431cde
mov dword [eax], esi
jmp 0x478101
push 1
lea ecx, [ebp - 0x2470]
call fcn.00431cde
mov esi, eax
push 0
lea ecx, [ebp - 0x2470]
call fcn.00431cde
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x2470]
call fcn.00431cc2
jmp 0x477eb6
lea ecx, [ebp - 0x2868]
call fcn.00431cc2
jmp 0x477dab
push 4
lea ecx, [ebp - 0xbe0]
call fcn.00431bf0
mov dword [ebp - 0x51c], 0xfffb
mov dword [ebp - 0x514], 0xfffffff9
mov dword [ebp - 0x700], 0xd7af2c9a
mov dword [ebp - 0x430], 5
mov dword [ebp - 0x2c88], 0xfffffffa
mov dword [ebp - 0x6f8], 0
jmp 0x478179
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 4
jge 0x47819b
push dword [ebp - 0x6f8]
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
mov dword [eax], 0x439beb06
jmp 0x47816c
push 3
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
cmp dword [eax], 0
jne 0x4781cd
mov esi, dword [ebp - 0x514]
push 3
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
add esi, dword [eax]
jne 0x4781cd
and dword [ebp - 0x13e0], 0
jmp 0x4781d7
mov dword [ebp - 0x13e0], 1
mov eax, dword [ebp - 0x700]
cmp dword [ebp - 0x700], eax
jle 0x4781f1
mov dword [ebp - 0x13d8], 1
jmp 0x4781f8
and dword [ebp - 0x13d8], 0
push 0
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
mov ecx, dword [ebp - 0x13d8]
cmp ecx, dword [eax]
jg 0x47821b
mov dword [ebp - 0x13e8], 1
jmp 0x478222
and dword [ebp - 0x13e8], 0
mov eax, dword [ebp - 0x13e0]
mov dword [ebp - 0x514], eax
push 0
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
mov ecx, dword [ebp - 0x13e8]
imul ecx, dword [eax]
mov dword [ebp - 0x430], ecx
mov esi, dword [ebp - 0x514]
sub esi, dword [ebp - 0x430]
add esi, 0xa4c5
push 0
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
mov eax, dword [eax]
sub eax, esi
jne 0x478281
cmp dword [ebp - 0x514], 0
jne 0x478281
and dword [ebp - 0x13f0], 0
jmp 0x47828b
mov dword [ebp - 0x13f0], 1
mov eax, dword [ebp - 0x700]
cmp dword [ebp - 0x13f0], eax
jge 0x4782a5
mov dword [ebp - 0x13f8], 1
jmp 0x4782ac
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0x51c]
dec eax
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
imul eax, dword [ebp - 0x13f8]
test eax, eax
je 0x478405
mov dword [ebp - 0x428], 0x3846
push 3
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
mov dword [eax], 0xea06
push 0
lea ecx, [ebp - 0xbe0]
call fcn.00431cde
cmp dword [eax], 0
je 0x478312
cmp dword [ebp - 0x428], 0
je 0x478312
mov dword [ebp - 0x1400], 1
jmp 0x478319
and dword [ebp - 0x1400], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x1400], eax
jle 0x478333
mov dword [ebp - 0x1408], 1
jmp 0x47833a
and dword [ebp - 0x1408], 0
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x1408]
cmp eax, 0xed0bd2f2
ja 0x478359
mov dword [ebp - 0x1fe8], 1
jmp 0x478360
and dword [ebp - 0x1fe8], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x3030], eax
cmp dword [ebp - 0x428], 1
jge 0x478381
mov dword [ebp - 0x1410], 1
jmp 0x478388
and dword [ebp - 0x1410], 0
mov eax, dword [ebp - 0x514]
cmp dword [ebp - 0x1410], eax
jge 0x4783a8
cmp dword [ebp - 0x51c], 0
jne 0x4783a8
and dword [ebp - 0x1418], 0
jmp 0x4783b2
mov dword [ebp - 0x1418], 1
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x1418], eax
jle 0x4783cc
mov dword [ebp - 0x1420], 1
jmp 0x4783d3
and dword [ebp - 0x1420], 0
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x1420]
je 0x4783ed
mov dword [ebp - 0x1428], 1
jmp 0x4783f4
and dword [ebp - 0x1428], 0
mov eax, dword [ebp - 0x1428]
mov dword [ebp - 0x430], eax
jmp 0x4784ff
mov dword [ebp - 0x708], 0xb856a759
mov eax, dword [ebp - 0x708]
cmp dword [ebp - 0x51c], eax
jne 0x478429
mov dword [ebp - 0x1430], 1
jmp 0x478430
and dword [ebp - 0x1430], 0
mov eax, dword [ebp - 0x708]
cmp eax, dword [ebp - 0x1430]
jle 0x47844a
mov dword [ebp - 0x1438], 1
jmp 0x478451
and dword [ebp - 0x1438], 0
cmp dword [ebp - 0x700], 0x9c1d
jne 0x47846f
mov eax, 0xf58a
test eax, eax
jne 0x47846f
and dword [ebp - 0x1ff0], 0
jmp 0x478479
mov dword [ebp - 0x1ff0], 1
mov eax, dword [ebp - 0x1438]
neg eax
sub eax, dword [ebp - 0x708]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x2c90], eax
mov eax, 0xe7dfe98d
cmp eax, 0x942fafec
jb 0x4784b1
mov dword [ebp - 0x1440], 1
jmp 0x4784b8
and dword [ebp - 0x1440], 0
cmp dword [ebp - 0x1440], 0x2cfb
jge 0x4784d0
mov dword [ebp - 0x1448], 1
jmp 0x4784d7
and dword [ebp - 0x1448], 0
cmp dword [ebp - 0x1448], 1
jne 0x4784ec
mov dword [ebp - 0x1450], 1
jmp 0x4784f3
and dword [ebp - 0x1450], 0
mov eax, dword [ebp - 0x1450]
mov dword [ebp - 0x708], eax
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x47851c
push 0x1154
call dword [sym.imp.KERNEL32.dll_ExitThread]
lea ecx, [ebp - 0xbe0]
call fcn.00431cc2
mov dword [ebp - 0xb4], 0xfffffff8
mov dword [ebp - 0x438], 0x1f199e1f
mov dword [ebp - 0x710], 0
jmp 0x478554
mov eax, dword [ebp - 0x710]
inc eax
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 3
jge 0x478570
mov eax, dword [ebp - 0x710]
mov dword [ebp + eax*4 - 0x3400], 0xffffffff
jmp 0x478547
mov byte [ebp - 0x3bf], 0
movzx eax, byte [ebp - 0x3bf]
test eax, eax
je 0x47858a
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [ebp - 0xb4], 0xfffffff7
jmp 0x4785a3
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffff8
jne 0x47895d
mov dword [ebp - 0x524], 1
push 4
lea ecx, [ebp - 0x29e8]
call fcn.00431bf0
mov dword [ebp - 0x52c], 9
mov dword [ebp - 0x718], 0
jmp 0x4785ea
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 4
jge 0x47860c
push dword [ebp - 0x718]
lea ecx, [ebp - 0x29e8]
call fcn.00431cde
mov dword [eax], 0xedca8fec
jmp 0x4785dd
mov dword [ebp - 0x524], 4
jmp 0x478625
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0x17
jne 0x47894d
mov dword [ebp - 0x440], 7
mov dword [ebp - 0x12c], 0
jmp 0x478655
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x478671
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x3388], 0xb6084edc
jmp 0x478648
mov dword [ebp - 0x12c], 0
jmp 0x47868a
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x4786a6
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x304c], 0xffffffff
jmp 0x47867d
push 1
lea ecx, [ebp - 0x29e8]
call fcn.00431cde
mov dword [eax], 1
mov dword [ebp - 0x440], 1
cmp dword [ebp - 0x440], 0
je 0x4786d8
mov dword [ebp - 0x1478], 1
jmp 0x4786df
and dword [ebp - 0x1478], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x1458], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1458]
mov dword [ebp + eax - 0x3388], ecx
cmp dword [ebp - 0x1458], 8
jb 0x478712
mov dword [ebp - 0x1460], 1
jmp 0x478719
and dword [ebp - 0x1460], 0
cmp dword [ebp - 0x1460], 2
ja 0x47872e
mov dword [ebp - 0x1ff8], 1
jmp 0x478735
and dword [ebp - 0x1ff8], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x30a4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x304c]
mov dword [ebp - 0x2c98], eax
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], eax
jle 0x47876d
mov dword [ebp - 0x1468], 1
jmp 0x478774
and dword [ebp - 0x1468], 0
mov eax, dword [ebp - 0x1468]
mov dword [ebp - 0x52c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x304c]
cmp dword [ebp - 0xb4], eax
jge 0x4787a0
mov dword [ebp - 0x1470], 1
jmp 0x4787a7
and dword [ebp - 0x1470], 0
mov eax, dword [ebp - 0x1470]
sub eax, 0x30b63e91
cmp eax, dword [ebp - 0xb4]
jne 0x4787c6
mov dword [ebp - 0x1480], 1
jmp 0x4787cd
and dword [ebp - 0x1480], 0
mov eax, dword [ebp - 0x1478]
cmp eax, dword [ebp - 0x1480]
jne 0x4787e7
mov dword [ebp - 0x1488], 1
jmp 0x4787ee
and dword [ebp - 0x1488], 0
cmp dword [ebp - 0x1488], 0x509b955
jg 0x478806
mov dword [ebp - 0x1490], 1
jmp 0x47880d
and dword [ebp - 0x1490], 0
cmp dword [ebp - 0x1490], 8
jb 0x478822
mov dword [ebp - 0x1498], 1
jmp 0x478829
and dword [ebp - 0x1498], 0
mov eax, dword [ebp - 0x1498]
inc eax
neg eax
je 0x478849
mov eax, 0xf11c
test eax, eax
je 0x478849
mov dword [ebp - 0x14a0], 1
jmp 0x478850
and dword [ebp - 0x14a0], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x14a0]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x14a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14a8]
mov dword [ebp + eax - 0x3400], ecx
mov eax, dword [ebp - 0x14a8]
sub eax, 3
je 0x478908
mov dword [ebp - 0x438], 0
jmp 0x4788a6
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0xffffffe5
jne 0x478906
mov dword [ebp - 0x440], 0
jmp 0x4788c8
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 4
jl 0x478904
mov byte [ebp - 0x345], 0
movzx eax, byte [ebp - 0x345]
test eax, eax
je 0x478902
push 0
push 0
push 0x1454
push 0
push 0x30d
push 0
push 0xe19
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x4788bb
jmp 0x478899
jmp 0x478948
mov dword [ebp - 0x52c], 2
jmp 0x478921
mov eax, dword [ebp - 0x52c]
dec eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
jl 0x478948
mov byte [ebp - 0x3c1], 0
movzx eax, byte [ebp - 0x3c1]
test eax, eax
je 0x478946
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x478914
jmp 0x478618
lea ecx, [ebp - 0x29e8]
call fcn.00431cc2
jmp 0x478596
mov dword [ebp - 0x548], 8
mov dword [ebp - 0x364], 0xb110c93b
mov dword [ebp - 0x3040], 0x8405cefd
mov dword [ebp - 0x2ca0], 0xffffffff
mov dword [ebp - 0x30ac], 0x82e77e81
mov dword [ebp - 0x2ca8], 0x55ebda18
mov dword [ebp - 0x748], 0xfffffffb
push 3
lea ecx, [ebp - 0x2904]
call fcn.00431bf0
mov dword [ebp - 0x36c], 0x9e62
mov dword [ebp - 0x720], 0
jmp 0x4789d3
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 3
jge 0x4789f5
push dword [ebp - 0x720]
lea ecx, [ebp - 0x2904]
call fcn.00431cde
mov dword [eax], 6
jmp 0x4789c6
mov dword [ebp - 0x364], 0
jmp 0x478a0e
mov eax, dword [ebp - 0x364]
dec eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xfffffff8
jg 0x478d12
mov dword [ebp - 0x730], 5
mov dword [ebp - 0x728], 0
jmp 0x478a3e
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 4
jge 0x478a5a
mov eax, dword [ebp - 0x728]
mov dword [ebp + eax*4 - 0x344c], 2
jmp 0x478a31
mov dword [ebp - 0x730], 0xfffffff6
jmp 0x478a73
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0xfffffff8
jg 0x478d0d
mov dword [ebp - 0x134], 4
mov dword [ebp - 0x750], 0xa8ed40a1
mov dword [ebp - 0x538], 0xffffffff
mov dword [ebp - 0x738], 0
jmp 0x478ab7
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 2
jge 0x478ad3
mov eax, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0x349c], 0xffffffff
jmp 0x478aaa
mov dword [ebp - 0x134], 0
jmp 0x478aec
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffe7
jle 0x478c06
push 2
lea ecx, [ebp - 0x2880]
call fcn.00431bf0
mov dword [ebp - 0x740], 0
jmp 0x478b1f
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 2
jge 0x478b41
push dword [ebp - 0x740]
lea ecx, [ebp - 0x2880]
call fcn.00431cde
mov dword [eax], 0x2d91509c
jmp 0x478b12
cmp dword [ebp - 0x364], 0
jne 0x478bc0
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
jne 0x478b72
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x344c], 0
jne 0x478b72
and dword [ebp - 0x14b0], 0
jmp 0x478b7c
mov dword [ebp - 0x14b0], 1
cmp dword [ebp - 0x14b0], 0xc2a41b87
jb 0x478b94
mov dword [ebp - 0x14b8], 1
jmp 0x478b9b
and dword [ebp - 0x14b8], 0
mov eax, dword [ebp - 0x364]
add eax, dword [ebp - 0x14b8]
je 0x478bb9
xor eax, eax
je 0x478bb9
mov dword [ebp - 0x14c0], 1
jmp 0x478bc0
and dword [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x364], eax
jl 0x478bda
mov dword [ebp - 0x14c8], 1
jmp 0x478be1
and dword [ebp - 0x14c8], 0
push 0
lea ecx, [ebp - 0x2880]
call fcn.00431cde
mov ecx, dword [ebp - 0x14c8]
mov dword [eax], ecx
lea ecx, [ebp - 0x2880]
call fcn.00431cc2
jmp 0x478adf
mov dword [ebp - 0x134], 2
jmp 0x478c1f
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x478d08
mov dword [ebp - 0x748], 2
jmp 0x478c45
mov eax, dword [ebp - 0x748]
dec eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0
jl 0x478caf
mov dword [ebp - 0x36c], 0
jmp 0x478c67
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 2
jg 0x478cad
mov dword [ebp - 0x750], 2
jmp 0x478c89
mov eax, dword [ebp - 0x750]
dec eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0
jl 0x478cab
push dword [ebp - 0x134]
lea ecx, [ebp - 0x2904]
call fcn.00431cde
mov dword [eax], 0x1361131e
jmp 0x478c7c
jmp 0x478c5a
jmp 0x478c38
mov dword [ebp - 0x538], 0
jmp 0x478cc8
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 2
jg 0x478d03
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x478d01
push 0x1269
push 0x15f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x478cbb
jmp 0x478c12
jmp 0x478a66
jmp 0x478a01
lea ecx, [ebp - 0x2904]
call fcn.00431cc2
push 3
lea ecx, [ebp - 0x291c]
call fcn.00431bf0
mov dword [ebp - 0x24c], 0xe387fb0b
mov dword [ebp - 0x1530], 0xec3e1b8d
cmp dword [ebp - 0x24c], 0
je 0x478d56
mov dword [ebp - 0x24c], 0xffffffff
jmp 0x479006
mov dword [ebp - 0x14e8], 0xfffffffe
push 2
lea ecx, [ebp - 0x260c]
call fcn.00431bf0
mov dword [ebp - 0x1508], 0
push 4
lea ecx, [ebp - 0x2660]
call fcn.00431bf0
mov dword [ebp - 0x9f8], 0xc857617c
mov dword [ebp - 0x58], 0
jmp 0x478d9e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x478dba
push dword [ebp - 0x58]
lea ecx, [ebp - 0x260c]
call fcn.00431cde
mov dword [eax], 3
jmp 0x478d97
mov dword [ebp - 0x58], 0
jmp 0x478dca
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x478de0
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x343c], 0xae215169
jmp 0x478dc3
mov dword [ebp - 0x58], 0
jmp 0x478df0
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x478e0c
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2660]
call fcn.00431cde
mov dword [eax], 7
jmp 0x478de9
cmp dword [ebp - 0x24c], 7
jbe 0x478e21
mov dword [ebp - 0x14e0], 1
jmp 0x478e28
and dword [ebp - 0x14e0], 0
cmp dword [ebp - 0x24c], 0
je 0x478e42
or eax, 0xffffffff
je 0x478e42
mov dword [ebp - 0x14d8], 1
jmp 0x478e49
and dword [ebp - 0x14d8], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x14d0], eax
push 0
lea ecx, [ebp - 0x260c]
call fcn.00431cde
mov ecx, dword [ebp - 0x14d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14d0]
cmp eax, dword [ebp - 0x14d8]
je 0x478e93
push 0
lea ecx, [ebp - 0x260c]
call fcn.00431cde
cmp dword [eax], 0
jne 0x478e93
and dword [ebp - 0x14f0], 0
jmp 0x478e9d
mov dword [ebp - 0x14f0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x14e8]
cmp eax, dword [ebp - 0x14f0]
je 0x478ec3
mov dword [ebp - 0x14f8], 1
jmp 0x478eca
and dword [ebp - 0x14f8], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x14f8], eax
jl 0x478ee4
mov dword [ebp - 0x1500], 1
jmp 0x478eeb
and dword [ebp - 0x1500], 0
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x1508], eax
mov eax, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1510]
mov dword [ebp + eax - 0x343c], ecx
imul esi, dword [ebp - 0x1510], 5
push 0
lea ecx, [ebp - 0x2660]
call fcn.00431cde
cmp esi, dword [eax]
jge 0x478f39
mov dword [ebp - 0x1518], 1
jmp 0x478f40
and dword [ebp - 0x1518], 0
mov eax, dword [ebp - 0x9f8]
imul eax, dword [ebp - 0x1518]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x1530]
cmp dword [ebp - 0x24c], eax
jl 0x478f6d
mov dword [ebp - 0x1520], 1
jmp 0x478f74
and dword [ebp - 0x1520], 0
cmp dword [ebp - 0x1520], 1
jbe 0x478f89
mov dword [ebp - 0x1528], 1
jmp 0x478f90
and dword [ebp - 0x1528], 0
cmp dword [ebp - 0x1528], 0xd58e7ea1
ja 0x478fa8
mov dword [ebp - 0x2000], 1
jmp 0x478faf
and dword [ebp - 0x2000], 0
push 1
lea ecx, [ebp - 0x2660]
call fcn.00431cde
cmp dword [ebp - 0x9f8], 0xffff
jbe 0x478fda
cmp dword [ebp - 0x1530], 0
jne 0x478fda
and dword [ebp - 0x1538], 0
jmp 0x478fe4
mov dword [ebp - 0x1538], 1
mov eax, dword [ebp - 0x1538]
mov dword [ebp - 0x9f8], eax
lea ecx, [ebp - 0x2660]
call fcn.00431cc2
lea ecx, [ebp - 0x260c]
call fcn.00431cc2
mov byte [ebp - 0x3c3], 0
movzx eax, byte [ebp - 0x3c3]
test eax, eax
je 0x479020
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 0x144], 0
jmp 0x479039
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x479055
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x2e7c], 0xfff7
jmp 0x47902c
mov dword [ebp - 0x70], 0x6e6f
mov dword [ebp - 0x448], 0xfffffff6
mov dword [ebp - 0xa00], 3
push 3
lea ecx, [ebp - 0x2898]
call fcn.00431bf0
mov dword [ebp - 0x2010], 0x7120dd93
mov dword [ebp - 0x374], 0x3b0639e6
mov dword [ebp - 0x1560], 0x2d38ca8c
mov dword [ebp - 0x2018], 0x1e0f758f
mov dword [ebp - 0x3050], 0xffff
mov dword [ebp - 0x13c], 0
jmp 0x4790c8
cmp dword [ebp - 0x13c], 3
jge 0x4790ea
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x2898]
call fcn.00431cde
mov dword [eax], 0x6b42be19
jmp 0x4790bb
mov dword [ebp - 0x13c], 0
jmp 0x479103
mov dword [ebp - 0x184], 0
jmp 0x47cd50
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x47cd6c
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xd18], 1
jmp 0x47cd43
mov dword [ebp - 0x184], 0
jmp 0x47cd85
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x47cda1
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x1f88], 0xfffffffd
jmp 0x47cd78
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f88], 0
jmp 0x47cdcf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f88]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1f88], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f88], 0
jg 0x47ce09
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f88]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1f88]
mov eax, dword [ebp + eax*4 - 0xd18]
mov dword [ebp + ecx*4 - 0xd18], eax
jmp 0x47cdb4
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x1f88]
mov dword [ebp + ecx - 0x1f88], eax
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x490], 0xfffb
mov dword [ebp - 0x588], 0x8f87662b
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp eax, 0x9b1ab445
jne 0x47ce58
mov dword [ebp - 0x21c0], 1
jmp 0x47ce5f
and dword [ebp - 0x21c0], 0
cmp dword [ebp - 0x14], 0x82ca9683
je 0x47ce74
mov dword [ebp - 0x21c8], 1
jmp 0x47ce7b
and dword [ebp - 0x21c8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp eax, 1
je 0x47ce92
mov dword [ebp - 0x21d0], 1
jmp 0x47ce99
and dword [ebp - 0x21d0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2d58], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x47ceb6
mov dword [ebp - 0xd20], 1
jmp 0x47cebd
and dword [ebp - 0xd20], 0
cmp dword [ebp - 0xd20], 0xc4365dea
jne 0x47ced5
mov dword [ebp - 0xd28], 1
jmp 0x47cedc
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
sub eax, dword [ebp - 0x14]
cmp eax, 0xffff
je 0x47cef8
mov dword [ebp - 0xd30], 1
jmp 0x47ceff
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x490], eax
je 0x47cf22
mov dword [ebp - 0xd38], 1
jmp 0x47cf29
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xd38]
jle 0x47cf46
mov eax, 0x686a37bd
test eax, eax
jne 0x47cf46
and dword [ebp - 0xd40], 0
jmp 0x47cf50
mov dword [ebp - 0xd40], 1
imul eax, dword [ebp - 0xd40], 3
cmp eax, dword [ebp - 0x14]
jne 0x47d0d3
mov dword [ebp - 0x21e8], 0
mov dword [ebp - 0xd48], 8
mov dword [ebp - 0x14], 0xffffffe2
jmp 0x47cf84
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x35
jle 0x47cfc8
mov dword [ebp - 0x21d8], 0x8b874bdb
mov byte [ebp - 0x276], 0
movzx eax, byte [ebp - 0x276]
test eax, eax
je 0x47cfbb
push 0x1b47
push 0x1469
push 0xaab
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp dword [ebp - 0x21d8], 0
je 0x47cfc6
jmp 0x47cf7d
jmp 0x47cf7d
mov dword [ebp - 0x490], 0
jmp 0x47cfe1
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0xf
je 0x47d0d1
mov dword [ebp - 0x21e0], 1
mov eax, dword [ebp - 0x21e0]
mov dword [ebp - 0x30c8], eax
mov eax, dword [ebp - 0x21e8]
neg eax
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x588], 0xe
jmp 0x47d037
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0x11
jle 0x47d0cc
mov dword [ebp - 0x850], 0
jmp 0x47d05d
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 1
jge 0x47d079
mov eax, dword [ebp - 0x850]
mov dword [ebp + eax*4 - 0x2d60], 0x50eb
jmp 0x47d050
mov dword [ebp - 0x14], 0
jmp 0x47d089
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x47d0c7
mov dword [ebp - 0xd50], 0x4929
mov byte [ebp - 0x278], 0
movzx eax, byte [ebp - 0x278]
test eax, eax
je 0x47d0b8
push 0xcc2
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0xd50]
inc eax
mov dword [ebp - 0xd50], eax
jmp 0x47d082
jmp 0x47d02a
jmp 0x47cfd4
jmp 0x47d102
mov byte [ebp - 0x27a], 0
movzx eax, byte [ebp - 0x27a]
test eax, eax
je 0x47d102
push 0
push 0x440
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 2
lea ecx, [ebp - 0x2964]
call fcn.00431bf0
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x31c4], 8
mov dword [ebp - 0x2d68], 1
mov dword [ebp - 0x30d0], 0xe6dc660f
mov dword [ebp - 0x2d70], 0xf44cacff
mov dword [ebp - 0x32d8], 2
mov dword [ebp - 0x2d78], 0xe02189f4
mov dword [ebp - 0x30d8], 0x12a7b09f
mov dword [ebp - 0x2d80], 0xf1571c09
mov dword [ebp - 0x31cc], 0x773196e8
mov dword [ebp - 0x2d88], 0x4939e63a
mov dword [ebp - 0xd58], 0xffff
mov dword [ebp - 0x18c], 0
jmp 0x47d1a0
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x47d1c2
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x2964]
call fcn.00431cde
mov dword [eax], 0xd3df
jmp 0x47d193
mov dword [ebp - 0x18c], 0
jmp 0x47d1db
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x47d1f7
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x3554], 0xffffffff
jmp 0x47d1ce
mov dword [ebp - 0x858], 1
jmp 0x47d210
mov eax, dword [ebp - 0x858]
dec eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 0
jl 0x47d325
mov dword [ebp - 0x590], 0xa2a4f402
mov dword [ebp - 0x30e0], 0x78144ad7
mov dword [ebp - 0x2d90], 1
mov dword [ebp - 0x860], 0
jmp 0x47d254
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 2
jge 0x47d270
mov eax, dword [ebp - 0x860]
mov dword [ebp + eax*4 - 0x34cc], 2
jmp 0x47d247
mov dword [ebp - 0x590], 0
jmp 0x47d289
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 1
jg 0x47d320
mov dword [ebp - 0x32a8], 0x727cad7d
mov dword [ebp - 0x2d98], 0xac7a8cf1
mov dword [ebp - 0x30e8], 0xdd2eb2fc
mov dword [ebp - 0x2da0], 1
mov dword [ebp - 0x868], 0
jmp 0x47d2d7
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 3
jge 0x47d2f3
mov eax, dword [ebp - 0x868]
mov dword [ebp + eax*4 - 0x3560], 0
jmp 0x47d2ca
mov eax, dword [ebp - 0xd58]
inc eax
mov dword [ebp - 0xd58], eax
push dword [ebp - 0x590]
lea ecx, [ebp - 0x2964]
call fcn.00431cde
cmp dword [eax], 0
je 0x47d31b
jmp 0x47d27c
jmp 0x47d27c
jmp 0x47d203
lea ecx, [ebp - 0x2964]
call fcn.00431cc2
xor ecx, ecx
call fcn.00431f5b
push eax
call fcn.00480d43
pop ecx
mov dword [ebp - 0x31d4], 0
mov byte [ebp - 0x27c], 0
movzx eax, byte [ebp - 0x27c]
test eax, eax
je 0x47d369
push 0
push 0x236b
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [ebp - 0x27e], 0
movzx eax, byte [ebp - 0x27e]
test eax, eax
je 0x47d383
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 0x27e4], 0xf9b3198a
mov dword [ebp - 0x27e0], 0xf9b3198a
mov dword [ebp - 0x27dc], 0xf9b3198a
mov dword [ebp - 0x27d8], 0xf9b3198a
lea ecx, [ebp - 0xb69]
call fcn.00431ced
push eax
lea eax, [ebp - 0x27d4]
push eax
lea eax, [ebp - 0x27e4]
push eax
lea ecx, [ebp - 0x34dc]
call fcn.00431cf0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x33b8]
call fcn.00431c9c
mov dword [ebp - 0x870], 0xfffffffe
mov dword [ebp - 0x870], 0
jmp 0x47d403
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 3
jg 0x47d426
mov byte [ebp - 0x280], 0
movzx eax, byte [ebp - 0x280]
test eax, eax
je 0x47d424
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47d3f6
lea ecx, [ebp - 0x33b8]
call fcn.00431cc2
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x878], 0
jmp 0x47d454
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 4
jge 0x47d470
mov eax, dword [ebp - 0x878]
mov dword [ebp + eax*4 - 0x25a4], 1
jmp 0x47d447
mov dword [ebp - 0x194], 0
jmp 0x47d489
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jg 0x47d627
push 3
lea ecx, [ebp - 0x28f8]
call fcn.00431bf0
mov dword [ebp - 0x21f0], 0
mov dword [ebp - 0x880], 0
jmp 0x47d4c6
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 3
jge 0x47d4e8
push dword [ebp - 0x880]
lea ecx, [ebp - 0x28f8]
call fcn.00431cde
mov dword [eax], 3
jmp 0x47d4b9
push 1
lea ecx, [ebp - 0x28f8]
call fcn.00431cde
mov dword [eax], 0xb792
imul eax, dword [ebp - 0x194], 0xb792
mov ecx, dword [ebp - 0x194]
cmp dword [ebp + ecx*4 - 0x25a4], eax
jge 0x47d520
mov dword [ebp - 0xd80], 1
jmp 0x47d527
and dword [ebp - 0xd80], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x194]
mov ecx, dword [ebp + ecx*4 - 0x25a4]
cmp dword [ebp + eax - 0x25a4], ecx
jle 0x47d54e
mov dword [ebp - 0xd60], 1
jmp 0x47d555
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp + eax*4 - 0x25a4]
cmp dword [ebp - 0xd60], eax
jle 0x47d576
mov dword [ebp - 0xd68], 1
jmp 0x47d57d
and dword [ebp - 0xd68], 0
cmp dword [ebp - 0xd68], 1
jbe 0x47d592
mov dword [ebp - 0xd70], 1
jmp 0x47d599
and dword [ebp - 0xd70], 0
cmp dword [ebp - 0xd70], 4
je 0x47d5ae
mov dword [ebp - 0xd78], 1
jmp 0x47d5b5
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp + eax*4 - 0x25a4]
cmp dword [ebp - 0xd78], eax
jg 0x47d5d6
mov dword [ebp - 0xd88], 1
jmp 0x47d5dd
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0xd80]
sub eax, dword [ebp - 0xd88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x25a4]
jg 0x47d604
mov dword [ebp - 0xd90], 1
jmp 0x47d60b
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x21f0], eax
lea ecx, [ebp - 0x28f8]
call fcn.00431cc2
jmp 0x47d47c
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xa982dc
push 0xa982dc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0x890], 0xffffffff
mov dword [ebp - 0x2da8], 6
mov dword [ebp - 0x30f0], 0xa3a92bd4
mov dword [ebp - 0x2db0], 0xa2ae7b79
mov dword [ebp - 0x888], 0
jmp 0x47d69b
mov eax, dword [ebp - 0x888]
inc eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 3
jge 0x47d6b7
mov eax, dword [ebp - 0x888]
mov dword [ebp + eax*4 - 0x3578], 0x95e3b372
jmp 0x47d68e
mov dword [ebp - 0x890], 0xffffffe8
jmp 0x47d6d0
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 0xa
jge 0x47d752
mov dword [ebp - 0x3300], 0x1accbad8
mov dword [ebp - 0x2db8], 4
mov dword [ebp - 0x30f8], 0xfffffff7
mov dword [ebp - 0x2dc0], 0x223b16aa
mov dword [ebp - 0xd98], 0
mov dword [ebp - 0x898], 0
jmp 0x47d724
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 1
jge 0x47d740
mov eax, dword [ebp - 0x898]
mov dword [ebp + eax*4 - 0x31dc], 1
jmp 0x47d717
mov eax, dword [ebp - 0xd98]
inc eax
mov dword [ebp - 0xd98], eax
jmp 0x47d6c3
push 5
push dword [ebp - 0xac0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x598], 0xfffffffc
mov dword [ebp - 0x2200], 0
mov dword [ebp - 0x2dc8], 0xc9ebf495
mov dword [ebp - 0x8a8], 0xc4475ee4
push 4
lea ecx, [ebp - 0x297c]
call fcn.00431bf0
mov dword [ebp - 0x8a0], 0
jmp 0x47d7ae
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 4
jge 0x47d7cd
push dword [ebp - 0x8a0]
lea ecx, [ebp - 0x297c]
call fcn.00431cde
and dword [eax], 0
jmp 0x47d7a1
xor eax, eax
inc eax
je 0x47d7e7
cmp dword [ebp - 0x598], 0
je 0x47d7e7
mov dword [ebp - 0xda0], 1
jmp 0x47d7ee
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x3100], eax
mov eax, dword [ebp - 0x598]
cmp dword [ebp - 0xda0], eax
jne 0x47d814
mov dword [ebp - 0x21f8], 1
jmp 0x47d81b
and dword [ebp - 0x21f8], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x2dd0], eax
cmp dword [ebp - 0x598], 0
je 0x47d8a9
mov dword [ebp - 0xda8], 0xffffffff
mov dword [ebp - 0x32b0], 0x42ca8cda
mov dword [ebp - 0x2dd8], 0xffffffff
mov dword [ebp - 0x3108], 0x29f58382
mov dword [ebp - 0x2de0], 1
mov dword [ebp - 0x31e4], 2
mov dword [ebp - 0x2de8], 1
mov eax, dword [ebp - 0xda8]
inc eax
mov dword [ebp - 0xda8], eax
push 0
lea ecx, [ebp - 0x297c]
call fcn.00431cde
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0xdb0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdb0]
mov dword [ecx], eax
jmp 0x47d8d6
mov byte [ebp - 0x282], 0
movzx eax, byte [ebp - 0x282]
test eax, eax
je 0x47d8cc
push 0
push 0
push 0x603
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [ebp - 0x2200], 1
mov dword [ebp - 0x8a8], 0
jmp 0x47d8ef
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 0x1b
jge 0x47d919
mov byte [ebp - 0x284], 0
movzx eax, byte [ebp - 0x284]
test eax, eax
je 0x47d917
push 0x25f1
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x47d8e2
lea ecx, [ebp - 0x297c]
call fcn.00431cc2
push dword [ebp - 0xac0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x1f0], 0
jmp 0x47d949
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x47d965
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xdb8], 1
jmp 0x47d93c
mov dword [ebp - 0x1f0], 0
jmp 0x47d97e
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 4
jge 0x47d99a
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x1f48], 0xfffffffd
jmp 0x47d971
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f48], 0
jmp 0x47d9c8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f48], 0
jg 0x47da02
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f48]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1f48]
mov eax, dword [ebp + eax*4 - 0xdb8]
mov dword [ebp + ecx*4 - 0xdb8], eax
jmp 0x47d9ad
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x1f48]
mov dword [ebp + ecx - 0x1f48], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x2208], eax
lea eax, [ebp - 0x2208]
push eax
push fcn.004666dd
lea ecx, [ebp - 0x26e4]
call fcn.0047ec97
mov dword [ebp - 0x8b0], 0xfffffff7
mov dword [ebp - 0x8b0], 0xffffffe3
jmp 0x47da60