Function at 0x4709fe
Capabilities:
Accept command line arguments
Check os version
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get graphical window text
Get system information on windows
Hide graphical window
Log keystrokes via polling
Modify service
Read .ini file
Start service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3260
call fcn.004a68e0
push esi
push edi
mov dword [ebp - 0x2b8], 0x60477862
mov dword [ebp - 0x130], 0
jmp 0x470a30
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x470a4c
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x21e4], 0x11151c3c
jmp 0x470a23
mov dword [ebp - 0x130], 0
jmp 0x470a65
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x470a81
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x2400], 0xfffffff9
jmp 0x470a58
mov dword [ebp - 0x2b8], 0
jmp 0x470a9a
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 7
jne 0x470abb
mov dword [ebp - 0x1eb8], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x1eb8], eax
jmp 0x470a8d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b8]
cmp dword [ebp + eax - 0x21e4], ecx
jl 0x470aec
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21e4], 0
je 0x470aec
mov dword [ebp - 0x1c78], 1
jmp 0x470af3
and dword [ebp - 0x1c78], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21e4], 0
jne 0x470b1c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2400], 0
jne 0x470b1c
and dword [ebp - 0x19cc], 0
jmp 0x470b26
mov dword [ebp - 0x19cc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2400]
imul eax, dword [ebp - 0x19cc]
test eax, eax
jne 0x470b50
mov eax, 0xfffa
test eax, eax
jne 0x470b50
and dword [ebp - 0x1c80], 0
jmp 0x470b5a
mov dword [ebp - 0x1c80], 1
mov eax, dword [ebp - 0x1c78]
sub eax, dword [ebp - 0x1c80]
cmp eax, 5
ja 0x470b77
mov dword [ebp - 0x1c88], 1
jmp 0x470b7e
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x1c88]
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x18], 0xfa5c62e0
mov dword [ebp - 0x5ec], 0xc1dfe936
mov dword [ebp - 0x2108], 4
mov dword [ebp - 0x2110], 0x5d01cd4
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x470cb1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x470bd2
mov dword [ebp - 0x1c90], 1
jmp 0x470bd9
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c90]
cmp eax, dword [ebp - 0x18]
jg 0x470bfa
cmp dword [ebp - 0x18], 0
je 0x470bfa
mov dword [ebp - 0x1c98], 1
jmp 0x470c01
and dword [ebp - 0x1c98], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1c98], eax
jne 0x470c18
mov dword [ebp - 0x1ca0], 1
jmp 0x470c1f
and dword [ebp - 0x1ca0], 0
cmp dword [ebp - 0x1ca0], 0xbb4f
jne 0x470c37
mov dword [ebp - 0x1ca8], 1
jmp 0x470c3e
and dword [ebp - 0x1ca8], 0
mov eax, dword [ebp - 0x1ca8]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x27c8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x282c], eax
cmp dword [ebp - 0x18], 0
jne 0x470c74
cmp dword [ebp - 0x18], 0
jne 0x470c74
and dword [ebp - 0x1cb0], 0
jmp 0x470c7e
mov dword [ebp - 0x1cb0], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1cb0]
test eax, eax
jne 0x470c9b
cmp dword [ebp - 0x18], 0
jne 0x470c9b
and dword [ebp - 0x1cb8], 0
jmp 0x470ca5
mov dword [ebp - 0x1cb8], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1cb8]
cmp dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xdbf4df7b
ja 0x470cd2
mov dword [ebp - 0x20f8], 0xc0c8fbfc
mov eax, dword [ebp - 0x20f8]
mov dword [ebp - 0x18], eax
jmp 0x470da9
mov dword [ebp - 0x1cd8], 1
mov dword [ebp - 0x5f4], 0x55bb5fb4
cmp dword [ebp - 0x5f4], 1
jne 0x470d04
cmp dword [ebp - 0x5ec], 0
je 0x470d04
mov dword [ebp - 0x1cc0], 1
jmp 0x470d0b
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0x1cc0], eax
jl 0x470d25
mov dword [ebp - 0x1cc8], 1
jmp 0x470d2c
and dword [ebp - 0x1cc8], 0
cmp dword [ebp - 0x1cc8], 5
jbe 0x470d41
mov dword [ebp - 0x1cd0], 1
jmp 0x470d48
and dword [ebp - 0x1cd0], 0
cmp dword [ebp - 0x1cd0], 7
jne 0x470d5d
mov dword [ebp - 0x2100], 1
jmp 0x470d64
and dword [ebp - 0x2100], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1cd8], eax
imul eax, dword [ebp - 0x5f4], 0xfffffff9
sub eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0x1cd8], eax
jne 0x470d9b
cmp dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x2108]
inc eax
inc eax
mov dword [ebp - 0x2110], eax
mov dword [ebp - 0x5f0], 0x2667a876
mov dword [ebp - 0x91c], 0
jmp 0x470dcc
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 3
jge 0x470de8
mov eax, dword [ebp - 0x91c]
mov dword [ebp + eax*4 - 0x2ff4], 0xfdf99ff6
jmp 0x470dbf
mov dword [ebp - 0x5f0], 0
jmp 0x470e01
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 2
jg 0x470e4e
mov dword [ebp - 0x25fc], 3
mov dword [ebp - 0x25f8], 3
mov dword [ebp - 0x25f4], 3
mov dword [ebp - 0x25f0], 3
mov eax, dword [ebp - 0x5f0]
push 4
pop ecx
imul ecx, ecx, 3
mov eax, dword [ebp + eax*4 - 0x2ff4]
mov dword [ebp + ecx - 0x25fc], eax
jmp 0x470df4
mov dword [ebp - 0x2d8], 0x60477862
mov dword [ebp - 0x924], 0
jmp 0x470e71
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 4
jge 0x470e8d
mov eax, dword [ebp - 0x924]
mov dword [ebp + eax*4 - 0x257c], 2
jmp 0x470e64
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x257c], 0
jmp 0x470eb8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x257c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x257c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x257c], 0xb
jge 0x470f40
mov dword [ebp - 0x5e4], 0
mov dword [ebp - 0x92c], 0
jmp 0x470eea
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 2
jge 0x470f06
mov eax, dword [ebp - 0x92c]
mov dword [ebp + eax*4 - 0x29d0], 0xffffffff
jmp 0x470edd
mov dword [ebp - 0x5e4], 0
jmp 0x470f1f
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 2
jge 0x470f3b
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x29d0], 1
jmp 0x470f12
jmp 0x470e9f
mov dword [ebp - 0xae8], 0x25d1
mov dword [ebp - 0x2c8], 0x33356370
mov dword [ebp - 0x2120], 0x2d34caa8
mov eax, dword [ebp - 0xae8]
add eax, dword [ebp - 0xae8]
je 0x47108a
mov dword [ebp - 0x2c0], 0x8306
mov dword [ebp - 0x934], 0
jmp 0x470f93
mov eax, dword [ebp - 0x934]
inc eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 1
jge 0x470faf
mov eax, dword [ebp - 0x934]
mov dword [ebp + eax*4 - 0x2118], 0xfffffffb
jmp 0x470f86
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2834], eax
cmp dword [ebp - 0x2c0], 0
jne 0x471048
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x2c0], eax
jge 0x470fe2
mov dword [ebp - 0x1d10], 1
jmp 0x470fe9
and dword [ebp - 0x1d10], 0
cmp dword [ebp - 0x1d10], 0x61fc2da8
jle 0x471001
mov dword [ebp - 0x1d18], 1
jmp 0x471008
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0x2c0]
imul eax, dword [ebp - 0x1d18]
cmp eax, 0x717be9fb
jg 0x471028
mov dword [ebp - 0x97c], 1
jmp 0x47102f
and dword [ebp - 0x97c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x97c]
mov dword [ebp + eax - 0x2118], ecx
mov eax, dword [ebp - 0x2c0]
mov eax, 0xdb69
test eax, eax
je 0x471066
cmp dword [ebp - 0x2c0], 0
je 0x471066
mov dword [ebp - 0x1d20], 1
jmp 0x47106d
and dword [ebp - 0x1d20], 0
mov eax, dword [ebp - 0x1d20]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2120], eax
jmp 0x471215
mov dword [ebp - 0x8c0], 0
jmp 0x4710a3
mov eax, dword [ebp - 0x8c0]
inc eax
mov dword [ebp - 0x8c0], eax
cmp dword [ebp - 0x8c0], 3
jge 0x4710bf
mov eax, dword [ebp - 0x8c0]
mov dword [ebp + eax*4 - 0x24dc], 0xd1ed
jmp 0x471096
mov dword [ebp - 0x2c8], 0x16
jmp 0x4710d8
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xfffffffe
je 0x471215
mov dword [ebp - 0x1d94], 0xfffffff7
mov dword [ebp - 0x618], 0
jmp 0x471108
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 1
jge 0x471124
mov eax, dword [ebp - 0x618]
mov dword [ebp + eax*4 - 0x2128], 0x818264d9
jmp 0x4710fb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24dc]
mov dword [ebp - 0x283c], eax
mov eax, dword [ebp - 0x1d94]
mov dword [ebp - 0x2844], eax
mov eax, dword [ebp - 0x1d94]
sub eax, 7
cmp eax, dword [ebp - 0xae8]
jne 0x471160
mov dword [ebp - 0x1d9c], 1
jmp 0x471167
and dword [ebp - 0x1d9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24dc]
cmp dword [ebp - 0x1d9c], eax
jge 0x471188
mov dword [ebp - 0x1d78], 1
jmp 0x47118f
and dword [ebp - 0x1d78], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x1d78], eax
jg 0x4711a9
mov dword [ebp - 0x1a10], 1
jmp 0x4711b0
and dword [ebp - 0x1a10], 0
cmp dword [ebp - 0x1a10], 0xffffffff
jg 0x4711c5
mov dword [ebp - 0xbb0], 1
jmp 0x4711cc
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0xbb0], 0
jne 0x4711e1
mov dword [ebp - 0x1a18], 1
jmp 0x4711e8
and dword [ebp - 0x1a18], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1a18]
mov dword [ebp + eax - 0x2128], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24dc], 0
je 0x471210
jmp 0x4710cb
jmp 0x4710cb
mov byte [ebp - 0x408], 0
movzx eax, byte [ebp - 0x408]
test eax, eax
je 0x471238
push 0xfda
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [ebp - 0x814], 9
mov dword [ebp - 0x254c], 0xfe6e324
mov dword [ebp - 0x2548], 0xfe6e324
mov dword [ebp - 0x2544], 0xfe6e324
mov dword [ebp - 0x2540], 0xfe6e324
mov dword [ebp - 0x814], 0
jmp 0x471283
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0x1d
jl 0x4712ef
mov dword [ebp - 0x1f4], 0x1e2c0d37
mov dword [ebp - 0x2130], 0x9b7928fb
mov dword [ebp - 0x1f4], 0
jmp 0x4712b9
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 4
jge 0x4712d5
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x254c], 5
jmp 0x4712ac
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2130], eax
jmp 0x471276
mov dword [ebp - 0xf0], 0x82062403
mov dword [ebp - 0xf0], 0x1d
jmp 0x471312
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffec
jge 0x471513
mov dword [ebp - 0xaf0], 0x88b9228
mov dword [ebp - 0x2140], 0x4cb44179
mov dword [ebp - 0x1c0], 0
jmp 0x47134c
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x471368
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x4f4], 0x6f18
jmp 0x47133f
mov dword [ebp - 0x1c0], 0
jmp 0x471381
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x47139d
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x2150], 0xfffffff6
jmp 0x471374
cmp dword [ebp - 0xf0], 0
je 0x471482
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
mov dword [ebp - 0x284c], eax
cmp dword [ebp - 0xf0], 0
jne 0x4713d2
mov dword [ebp - 0xbb8], 1
jmp 0x4713d9
and dword [ebp - 0xbb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xaf0]
cmp eax, dword [ebp - 0xbb8]
jle 0x47140f
cmp dword [ebp - 0xaf0], 0
je 0x47140f
mov dword [ebp - 0x2138], 1
jmp 0x471416
and dword [ebp - 0x2138], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x2854], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x285c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
add eax, 0x667f5aee
sub eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x2140]
jge 0x47145a
mov dword [ebp - 0x1a20], 1
jmp 0x471461
and dword [ebp - 0x1a20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
cmp dword [ebp - 0x1a20], eax
jne 0x471482
mov dword [ebp - 0xbc0], 1
jmp 0x471489
and dword [ebp - 0xbc0], 0
cmp dword [ebp - 0xbc0], 0x12dc6d0f
je 0x4714a1
mov dword [ebp - 0x1a28], 1
jmp 0x4714a8
and dword [ebp - 0x1a28], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x1a28], eax
je 0x4714c2
mov dword [ebp - 0xbc8], 1
jmp 0x4714c9
and dword [ebp - 0xbc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
cmp dword [ebp - 0xbc8], eax
jne 0x4714ea
mov dword [ebp - 0x2148], 1
jmp 0x4714f1
and dword [ebp - 0x2148], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x2864], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2150], 0xfffffff9
jmp 0x471305
mov byte [ebp - 0x292], 0
movzx eax, byte [ebp - 0x292]
test eax, eax
je 0x47152f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x138], 0
jmp 0x471548
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x471564
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x21f0], 0x11151c3c
jmp 0x47153b
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x628], 0x7b831966
mov dword [ebp - 0x620], 0
jmp 0x471591
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 3
jge 0x4715ad
mov eax, dword [ebp - 0x620]
mov dword [ebp + eax*4 - 0x1e04], 6
jmp 0x471584
mov dword [ebp - 0xd0], 0
jmp 0x4715c6
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jg 0x4718f7
mov dword [ebp - 0x1fc], 0xc69aed23
mov dword [ebp - 0xbe0], 0xfffffffb
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x47161e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x13f5
push 0x14b2
push 0xe93
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x1fc], 2
jmp 0x471637
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x4718f2
mov dword [ebp - 0x2158], 0xffffffff
mov dword [ebp - 0x81c], 0
jmp 0x471667
mov eax, dword [ebp - 0x81c]
inc eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 1
jge 0x471683
mov eax, dword [ebp - 0x81c]
mov dword [ebp + eax*4 - 0xbe8], 0xc77dcda7
jmp 0x47165a
mov eax, dword [ebp - 0x1fc]
mov eax, dword [ebp + eax*4 - 0x1e04]
mov dword [ebp - 0x286c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp + eax*4 - 0x1e04]
mov dword [ebp - 0x2874], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x2158], eax
jle 0x4716c3
mov dword [ebp - 0x1a30], 1
jmp 0x4716ca
and dword [ebp - 0x1a30], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x1a30]
add eax, 0xf928
mov ecx, dword [ebp - 0xd0]
cmp eax, dword [ebp + ecx*4 - 0x1e04]
jg 0x4716f7
mov dword [ebp - 0xbd0], 1
jmp 0x4716fe
and dword [ebp - 0xbd0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e04]
cmp dword [ebp - 0xbd0], eax
jne 0x47171e
mov dword [ebp - 0x2160], 1
jmp 0x471725
and dword [ebp - 0x2160], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x287c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbe8]
mov dword [ebp - 0x2884], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1fc], eax
je 0x47175e
mov dword [ebp - 0xaf8], 1
jmp 0x471765
and dword [ebp - 0xaf8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp + eax - 0x1e04], ecx
cmp dword [ebp - 0xaf8], 0x1d8f
jl 0x471790
mov dword [ebp - 0x1a38], 1
jmp 0x471797
and dword [ebp - 0x1a38], 0
cmp dword [ebp - 0x1a38], 0xbf11
jl 0x4717af
mov dword [ebp - 0xbd8], 1
jmp 0x4717b6
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
je 0x4718d8
mov dword [ebp - 0x2170], 0xdc630de2
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x288c], eax
mov eax, 0x353e
test eax, eax
je 0x47183d
mov eax, 0xe183a099
test eax, eax
je 0x47180c
cmp dword [ebp - 0x1fc], 0
je 0x47180c
mov dword [ebp - 0x1a40], 1
jmp 0x471813
and dword [ebp - 0x1a40], 0
mov eax, 0xd370
sub eax, dword [ebp - 0x1a40]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbe0]
sub eax, 0x4edbde96
je 0x47183d
mov dword [ebp - 0x1a48], 1
jmp 0x471844
and dword [ebp - 0x1a48], 0
mov eax, dword [ebp - 0x1a48]
inc eax
mov ecx, 0x5835
sub ecx, eax
mov eax, dword [ebp - 0xd0]
cmp ecx, dword [ebp + eax*4 - 0x1e04]
jg 0x47186a
cmp dword [ebp - 0xd0], 0
je 0x47187f
cmp dword [ebp - 0x628], 0
je 0x47187f
mov dword [ebp - 0x2168], 1
jmp 0x471886
and dword [ebp - 0x2168], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x2894], eax
mov eax, dword [ebp - 0x2170]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xbe8]
jne 0x4718b9
cmp dword [ebp - 0xd0], 0
jne 0x4718b9
and dword [ebp - 0x1a50], 0
jmp 0x4718c3
mov dword [ebp - 0x1a50], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a50]
mov dword [ebp + eax - 0x1e04], ecx
jmp 0x4718ed
mov dword [ebp - 0x2178], 0x3dc4d7e3
cmp dword [ebp - 0x2178], 0
je 0x4718ed
jmp 0x4718f2
jmp 0x47162a
jmp 0x4715b9
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x47192d
push 0
push 0x26c7
push 0
push 0x975
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
mov dword [ebp - 0x138], 0
jmp 0x471946
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x471962
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x2468], 0xfffffff9
jmp 0x471939
mov dword [ebp - 0xa0], 0xee1c
mov dword [ebp - 0x2d0], 0xf5b1b6fd
mov dword [ebp - 0x27c], 0xcccaea0a
mov dword [ebp - 0x40c], 0xb6d6
mov dword [ebp - 0xe8], 0xd7276cc
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x289c], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x28a4], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x28ac], eax
cmp dword [ebp - 0xa0], 1
ja 0x4719cd
mov dword [ebp - 0xbf0], 1
jmp 0x4719d4
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0xbf0]
je 0x4719fa
mov dword [ebp - 0x1a58], 1
jmp 0x471a01
and dword [ebp - 0x1a58], 0
cmp dword [ebp - 0x1a58], 0
jne 0x471a16
mov dword [ebp - 0xbf8], 1
jmp 0x471a1d
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xbf8], eax
je 0x471a37
mov dword [ebp - 0x1a60], 1
jmp 0x471a3e
and dword [ebp - 0x1a60], 0
cmp dword [ebp - 0x1a60], 1
jae 0x471a53
mov dword [ebp - 0x2180], 1
jmp 0x471a5a
and dword [ebp - 0x2180], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x2d0], eax
jne 0x471a74
mov dword [ebp - 0xc00], 1
jmp 0x471a7b
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xc00], eax
jge 0x471a95
mov dword [ebp - 0x1a68], 1
jmp 0x471a9c
and dword [ebp - 0x1a68], 0
cmp dword [ebp - 0x1a68], 1
jb 0x471ab1
mov dword [ebp - 0xc08], 1
jmp 0x471ab8
and dword [ebp - 0xc08], 0
cmp dword [ebp - 0xc08], 0x664dc9ed
jl 0x471ad0
mov dword [ebp - 0x1a70], 1
jmp 0x471ad7
and dword [ebp - 0x1a70], 0
mov eax, dword [ebp - 0x1a70]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x27c]
sub eax, 0x72737ae9
cmp eax, dword [ebp - 0xa0]
jge 0x471b0e
cmp dword [ebp - 0xa0], 0
jne 0x471b0e
and dword [ebp - 0xc10], 0
jmp 0x471b18
mov dword [ebp - 0xc10], 1
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0xc10]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x2d0], 0xfffffff9
jmp 0x471b4f
mov eax, dword [ebp - 0x2d0]
dec eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0xffffffe7
jne 0x471cd5
mov dword [ebp - 0x27c], 0xfffffff4
jmp 0x471b75
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0xfffffff8
jne 0x471c76
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0xe8], 0
jmp 0x471ba5
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x10
jle 0x471c71
mov dword [ebp - 0x28b4], 1
mov dword [ebp - 0x824], 0
jmp 0x471bd5
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 1
jge 0x471bf1
mov eax, dword [ebp - 0x824]
mov dword [ebp + eax*4 - 0x1a78], 4
jmp 0x471bc8
mov dword [ebp - 0x40c], 0
jmp 0x471c0a
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 1
jne 0x471c3b
cmp dword [ebp - 0xe8], 0
je 0x471c1e
jmp 0x471c3b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a78]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a78], eax
jmp 0x471bfd
mov dword [ebp - 0xa0], 0
jmp 0x471c54
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jg 0x471c6c
mov eax, dword [ebp - 0xc18]
dec eax
mov dword [ebp - 0xc18], eax
jmp 0x471c47
jmp 0x471b98
jmp 0x471b68
mov dword [ebp - 0xe8], 0
jmp 0x471c8f
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x16
jg 0x471cd0
cmp dword [ebp - 0xe8], 0
je 0x471ca3
jmp 0x471cd0
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x471cce
push 0x23c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x471c82
jmp 0x471b42
mov dword [ebp - 0x2d8], 0
jmp 0x471cee
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 7
jne 0x4722c5
mov dword [ebp - 0x82c], 0xa9576c3a
mov dword [ebp - 0x1a98], 1
mov dword [ebp - 0xb00], 0x7263b0a6
mov dword [ebp - 0xb08], 0x87292079
mov dword [ebp - 0x21a8], 0x6a5b5cf0
mov dword [ebp - 0xb10], 1
mov dword [ebp - 0x630], 0
jmp 0x471d50
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 2
jge 0x471d6c
mov eax, dword [ebp - 0x630]
mov dword [ebp + eax*4 - 0xb80], 0x90ac204e
jmp 0x471d43
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb80], 0
jmp 0x471d9a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb80]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb80], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb80], 0xfffffffa
jne 0x471e74
mov dword [ebp - 0x4f8], 0x7ca0029b
mov dword [ebp - 0xc20], 3
mov dword [ebp - 0x2188], 0x4a520274
mov dword [ebp - 0x4f8], 0
jmp 0x471de5
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 9
jg 0x471e07
mov dword [ebp - 0x1a80], 0x6baf
mov eax, dword [ebp - 0x1a80]
inc eax
mov dword [ebp - 0x1a80], eax
jmp 0x471dd8
cmp dword [ebp - 0x4f8], 0
je 0x471e3b
mov dword [ebp - 0xc20], 0x15cc138
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x471e3b
mov dword [ebp - 0x1a88], 1
jmp 0x471e42
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x2188]
cmp dword [ebp - 0x1a88], eax
jl 0x471e5c
mov dword [ebp - 0xc28], 1
jmp 0x471e63
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x1a98], eax
jmp 0x471d7f
cmp dword [ebp - 0x82c], 0xf703
jl 0x471e8c
mov dword [ebp - 0x1a90], 1
jmp 0x471e93
and dword [ebp - 0x1a90], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb80], 1
mov dword [ebp - 0xb08], 0xfffffffc
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x2190], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x2198], eax
mov eax, dword [ebp - 0xb00]
dec eax
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x2190]
cmp eax, dword [ebp - 0x2198]
jg 0x471eed
mov dword [ebp - 0xc30], 1
jmp 0x471ef4
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x1a90]
cmp eax, dword [ebp - 0xc30]
jge 0x471f0e
mov dword [ebp - 0x21a0], 1
jmp 0x471f15
and dword [ebp - 0x21a0], 0
mov eax, dword [ebp - 0x21a8]
mov dword [ebp - 0x28bc], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x28c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb10]
cmp dword [ebp + eax - 0xb80], ecx
jl 0x471f4e
mov dword [ebp - 0x21b0], 1
jmp 0x471f55
and dword [ebp - 0x21b0], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0x28cc], eax
mov eax, dword [ebp - 0x1a98]
cmp dword [ebp - 0xb10], eax
jle 0x471f7b
mov dword [ebp - 0xc38], 1
jmp 0x471f82
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0xc38]
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x21d0], 0
mov dword [ebp - 0xb18], 0xffffffff
mov dword [ebp - 0x28d4], 0xc9d7
mov dword [ebp - 0x21c0], 0xf51ae9a0
mov dword [ebp - 0x28dc], 0x20b50f6b
mov dword [ebp - 0x50], 0
jmp 0x471fd0
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x471fe6
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x24e8], 0xb9b55bb2
jmp 0x471fc9
mov dword [ebp - 0x50], 0
jmp 0x471ff6
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x47200c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1e10], 0xe2236432
jmp 0x471fef
mov dword [ebp - 0x50], 0
jmp 0x47201c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x472032
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x31d4], 0xffffffff
jmp 0x472015
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1e10], 0
jmp 0x47205d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e10]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1e10], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e10], 2
jg 0x4722b4
mov dword [ebp - 0x4d8], 0x5010f7a7
mov dword [ebp - 0x28e4], 0xfffffffc
mov dword [ebp - 0xb6c], 1
mov dword [ebp - 0x28ec], 0x2c5d177c
mov dword [ebp - 0x4d8], 0
jmp 0x4720b1
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 2
jg 0x4722af
mov dword [ebp - 0x1aa0], 0x9b2b534
mov dword [ebp - 0xb78], 6
mov dword [ebp - 0xc50], 0xdb370cc3
mov dword [ebp - 0x21c8], 0x2fb29d94
mov dword [ebp - 0x638], 0
jmp 0x4720ff
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 2
jge 0x47211b
mov eax, dword [ebp - 0x638]
mov dword [ebp + eax*4 - 0x29dc], 0xfffffffd
jmp 0x4720f2
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x1aa0], eax
mov eax, dword [ebp - 0x1aa0]
mov dword [ebp - 0xb18], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24e8]
cmp dword [ebp - 0xb18], eax
jne 0x472154
mov dword [ebp - 0x21b8], 1
jmp 0x47215b
and dword [ebp - 0x21b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e10]
mov dword [ebp - 0x28f4], eax
cmp dword [ebp - 0xb18], 0x3d0e
je 0x47218f
cmp dword [ebp - 0x4d8], 0
je 0x47218f
mov dword [ebp - 0xc40], 1
jmp 0x472196
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0xc40], eax
jle 0x4721b0
mov dword [ebp - 0x1aa8], 1
jmp 0x4721b7
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0xb78]
inc eax
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb78]
cmp eax, dword [ebp - 0x1aa8]
jge 0x4721de
mov dword [ebp - 0xc48], 1
jmp 0x4721e5
and dword [ebp - 0xc48], 0
cmp dword [ebp - 0xc48], 0xfe9a5a16
je 0x4721fd
mov dword [ebp - 0x1ab0], 1
jmp 0x472204
and dword [ebp - 0x1ab0], 0
mov eax, dword [ebp - 0x1ab0]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0x1ab8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ab8]
mov dword [ebp + eax - 0x29dc], ecx
mov eax, dword [ebp - 0x21c0]
cmp dword [ebp - 0x1ab8], eax
je 0x472249
mov dword [ebp - 0xc58], 1
jmp 0x472250
and dword [ebp - 0xc58], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e10]
mov eax, dword [ebp + eax*4 - 0x24e8]
cmp eax, dword [ebp - 0xc58]
jge 0x472277
mov dword [ebp - 0x1ac0], 1
jmp 0x47227e
and dword [ebp - 0x1ac0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e10]
mov eax, dword [ebp + eax*4 - 0x24e8]
imul eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x21c8], eax
jmp 0x4720a4
jmp 0x472044
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x21d0], eax
jmp 0x471ce1
mov dword [ebp - 0x88], 0x82eac453
mov dword [ebp - 0x1af8], 0xcddd1d8f
mov dword [ebp - 0x984], 0x8f62c4df
mov dword [ebp - 0x1ac8], 9
mov dword [ebp - 0xc78], 4
mov dword [ebp - 0x1af0], 0xfffffff7
mov dword [ebp - 0x21d8], 5
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x472338
push 0
push 0x1680
push 0x1208
push 0x357
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x88], eax
jge 0x472352
mov dword [ebp - 0xc98], 1
jmp 0x472359
and dword [ebp - 0xc98], 0
mov dword [ebp - 0x984], 1
cmp dword [ebp - 0x984], 1
jae 0x472381
cmp dword [ebp - 0x88], 0
je 0x472381
mov dword [ebp - 0xc60], 1
jmp 0x472388
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0x1ac8], eax
cmp dword [ebp - 0x1ac8], 0
jne 0x4723ab
xor eax, eax
inc eax
jne 0x4723ab
and dword [ebp - 0xc68], 0
jmp 0x4723b5
mov dword [ebp - 0xc68], 1
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xc68], eax
jle 0x4723e1
cmp dword [ebp - 0x984], 0
je 0x4723e1
cmp dword [ebp - 0x88], 0
je 0x4723e1
mov dword [ebp - 0x1ad0], 1
jmp 0x4723e8
and dword [ebp - 0x1ad0], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x1ad0], eax
jne 0x472402
mov dword [ebp - 0xc70], 1
jmp 0x472409
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xc70], eax
jg 0x472423
mov dword [ebp - 0x1ad8], 1
jmp 0x47242a
and dword [ebp - 0x1ad8], 0
mov eax, dword [ebp - 0x1ad8]
add eax, 8
imul eax, eax, 0x477
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0xc78]
add eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x88]
je 0x47245f
mov dword [ebp - 0x1ae0], 1
jmp 0x472466
and dword [ebp - 0x1ae0], 0
imul eax, dword [ebp - 0x1ae0], 0x65ab
sub eax, 0xffff
cmp eax, dword [ebp - 0x88]
jl 0x472489
mov dword [ebp - 0xc80], 1
jmp 0x472490
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xc80], eax
jle 0x4724aa
mov dword [ebp - 0x1ae8], 1
jmp 0x4724b1
and dword [ebp - 0x1ae8], 0
mov eax, dword [ebp - 0x1ae8]
sub eax, 0x5854a409
jns 0x4724ca
mov dword [ebp - 0xc88], 1
jmp 0x4724d1
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0x1af0], eax
cmp dword [ebp - 0x1af0], 0x53ea3a72
jne 0x4724f5
mov dword [ebp - 0xc90], 1
jmp 0x4724fc
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1af8], eax
mov eax, dword [ebp - 0xc90]
sub eax, dword [ebp - 0x88]
cmp dword [ebp - 0x1af8], eax
jge 0x472528
mov dword [ebp - 0x1b00], 1
jmp 0x47252f
and dword [ebp - 0x1b00], 0
mov eax, dword [ebp - 0xc98]
add eax, dword [ebp - 0x1b00]
sub eax, dword [ebp - 0x88]
mov dword [ebp - 0x21d8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d8]
cmp dword [ebp + eax - 0x21f0], ecx
jl 0x472578
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21f0], 0
je 0x472578
mov dword [ebp - 0x1b08], 1
jmp 0x47257f
and dword [ebp - 0x1b08], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21f0], 0
jne 0x4725a8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2468], 0
jne 0x4725a8
and dword [ebp - 0xca0], 0
jmp 0x4725b2
mov dword [ebp - 0xca0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2468]
imul eax, dword [ebp - 0xca0]
test eax, eax
jne 0x4725dc
mov eax, 0xfffa
test eax, eax
jne 0x4725dc
and dword [ebp - 0xca8], 0
jmp 0x4725e6
mov dword [ebp - 0xca8], 1
mov eax, dword [ebp - 0x1b08]
sub eax, dword [ebp - 0xca8]
cmp eax, 5
ja 0x472603
mov dword [ebp - 0x1b10], 1
jmp 0x47260a
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x1b10]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2e0], 0xfffffffe
mov dword [ebp - 0x578], 0xea5223fa
mov dword [ebp - 0x28fc], 0x3b372ba2
mov dword [ebp - 0x2904], 0x5d5f8d9a
mov dword [ebp - 0x290c], 0x475ee4c2
mov dword [ebp - 0x2914], 0x8e503485
mov dword [ebp - 0x291c], 0
mov dword [ebp - 0x2924], 0xaac89535
mov dword [ebp - 0x1b28], 0xffffffff
mov dword [ebp - 0x1c8], 0
jmp 0x472689
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x4726a5
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x292c], 0xffffffff
jmp 0x47267c
mov dword [ebp - 0x1c8], 0
jmp 0x4726be
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x4726da
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x3140], 0xffffffff
jmp 0x4726b1
cmp dword [ebp - 0x2e0], 0xfffffffc
jne 0x4726ef
mov dword [ebp - 0xcb0], 1
jmp 0x4726f6
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0xcb0], eax
jg 0x472710
mov dword [ebp - 0xcb8], 1
jmp 0x472717
and dword [ebp - 0xcb8], 0
cmp dword [ebp - 0x2e0], 0xaf5a
jg 0x47272f
mov dword [ebp - 0x1b18], 1
jmp 0x472736
and dword [ebp - 0x1b18], 0
cmp dword [ebp - 0x1b18], 0xffffffff
jge 0x47274b
mov dword [ebp - 0x1b20], 1
jmp 0x472752
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0xcb8]
cmp eax, dword [ebp - 0x1b20]
jg 0x47276c
mov dword [ebp - 0xcc0], 1
jmp 0x472773
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcc0]
sub eax, 0xa8df17d
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x2e0], 0
jmp 0x47279d
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jg 0x47288c
mov dword [ebp - 0x2934], 0xcc09
mov dword [ebp - 0x2e38], 0x7d0d1d8
mov dword [ebp - 0x2e34], 0x7d0d1d8
mov dword [ebp - 0x2e30], 0x7d0d1d8
mov dword [ebp - 0x2e2c], 0x7d0d1d8
mov dword [ebp - 0x578], 0
jmp 0x4727f5
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 0
jg 0x47286d
mov dword [ebp - 0x293c], 1
mov dword [ebp - 0x2944], 0xfffffff9
mov dword [ebp - 0x294c], 0x3413f087
mov dword [ebp - 0x2954], 0x2a0c0e07
mov dword [ebp - 0x834], 0
jmp 0x47283f
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 2
jge 0x47285b
mov eax, dword [ebp - 0x834]
mov dword [ebp + eax*4 - 0x308c], 0x585ca258
jmp 0x472832
mov eax, dword [ebp - 0x1b28]
dec eax
mov dword [ebp - 0x1b28], eax
jmp 0x4727e8
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x472887
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x472790
cmp dword [ebp + 8], 2
jl 0x47cce2
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x640], 0
jmp 0x4728b9
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 3
jge 0x4728d5
mov eax, dword [ebp - 0x640]
mov dword [ebp + eax*4 - 0x300c], 0xfffffffd
jmp 0x4728ac
mov dword [ebp - 0x204], 0
jmp 0x4728ee
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x1d
je 0x4729fb
mov dword [ebp - 0x22cc], 9
mov dword [ebp - 0xcc8], 0xffffffff
mov dword [ebp - 0x414], 0
cmp dword [ebp - 0x22cc], 0xefc07e17
jbe 0x472988
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x295c], eax
cmp dword [ebp - 0x204], 0
jne 0x472943
cmp dword [ebp - 0xcc8], 0
je 0x472958
cmp dword [ebp - 0x204], 0
je 0x472958
mov dword [ebp - 0x1b30], 1
jmp 0x47295f
and dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x204]
add eax, dword [ebp - 0x1b30]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x204], eax
jle 0x472988
and dword [ebp - 0xcd0], 0
jmp 0x472992
mov dword [ebp - 0xcd0], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xcd0]
mov dword [ebp + eax - 0x300c], ecx
mov dword [ebp - 0x414], 0
jmp 0x4729bd
mov eax, dword [ebp - 0x414]
dec eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffe3
jle 0x4729f6
mov byte [ebp - 0x29e], 0
movzx eax, byte [ebp - 0x29e]
test eax, eax
je 0x4729f4
push 0x8e4
push 0x1747
push 0x5b5
push 0x1143
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x4729b0
jmp 0x4728e1
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x83c], 0
jmp 0x472a1e
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 3
jge 0x472a3a
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x3024], 0xfffffffd
jmp 0x472a11
mov dword [ebp - 0x244], 0
jmp 0x472a53
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x1d
je 0x472b60
mov dword [ebp - 0x22d4], 9
mov dword [ebp - 0x1b38], 0xffffffff
mov dword [ebp - 0x47c], 0
cmp dword [ebp - 0x22d4], 0xefc07e17
jbe 0x472aed
mov eax, dword [ebp - 0x1b38]
mov dword [ebp - 0x2964], eax
cmp dword [ebp - 0x244], 0
jne 0x472aa8
cmp dword [ebp - 0x1b38], 0
je 0x472abd
cmp dword [ebp - 0x244], 0
je 0x472abd
mov dword [ebp - 0xcd8], 1
jmp 0x472ac4
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0xcd8]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0x244], eax
jle 0x472aed
and dword [ebp - 0x1b40], 0
jmp 0x472af7
mov dword [ebp - 0x1b40], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b40]
mov dword [ebp + eax - 0x3024], ecx
mov dword [ebp - 0x47c], 0
jmp 0x472b22
mov eax, dword [ebp - 0x47c]
dec eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xffffffe3
jle 0x472b5b
mov byte [ebp - 0x2a0], 0
movzx eax, byte [ebp - 0x2a0]
test eax, eax
je 0x472b59
push 0x8e4
push 0x1747
push 0x5b5
push 0x1143
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x472b15
jmp 0x472a46
mov dword [ebp - 0xcf8], 0x84868fda
mov dword [ebp - 0xafc], 0xf34e
mov dword [ebp - 0x58], 0
jmp 0x472b84
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x472b9a
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x140], 0x4432
jmp 0x472b7d
mov dword [ebp - 0x58], 0
jmp 0x472baa
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x472bc0
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1e50], 0xf27d2703
jmp 0x472ba3
mov dword [ebp - 0x58], 0
jmp 0x472bd0
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x472be6
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1d54], 5
jmp 0x472bc9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0xfffffffc
jl 0x472c02
mov dword [ebp - 0xce0], 1
jmp 0x472c09
and dword [ebp - 0xce0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x140]
cmp eax, dword [ebp - 0xce0]
jle 0x472c37
mov dword [ebp - 0x22dc], 1
jmp 0x472c3e
and dword [ebp - 0x22dc], 0
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x472c5e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jne 0x472c5e
and dword [ebp - 0x1b48], 0
jmp 0x472c68
mov dword [ebp - 0x1b48], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b48]
mov dword [ebp + eax - 0x1e50], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1d54]
cmp dword [ebp + eax - 0x1d54], ecx
jg 0x472ca2
mov dword [ebp - 0xce8], 1
jmp 0x472ca9
and dword [ebp - 0xce8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
cmp dword [ebp - 0xce8], eax
jle 0x472cca
mov dword [ebp - 0x1b50], 1
jmp 0x472cd1
and dword [ebp - 0x1b50], 0
cmp dword [ebp - 0x1b50], 0xf3b1
jg 0x472d00
push 5
pop eax
test eax, eax
je 0x472d00
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d54], 0
je 0x472d00
mov dword [ebp - 0xcf0], 1
jmp 0x472d07
and dword [ebp - 0xcf0], 0
cmp dword [ebp - 0xcf0], 0x5b5b06a8
jne 0x472d1f
mov dword [ebp - 0x22e4], 1
jmp 0x472d26
and dword [ebp - 0x22e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
mov dword [ebp - 0x296c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d54], 0xfffffffb
jb 0x472d54
mov dword [ebp - 0x1b58], 1
jmp 0x472d5b
and dword [ebp - 0x1b58], 0
mov eax, dword [ebp - 0x1b58]
mov dword [ebp - 0xcf8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e50]
neg eax
cmp eax, dword [ebp - 0xcf8]
jle 0x472d8a
mov dword [ebp - 0x1b60], 1
jmp 0x472d91
and dword [ebp - 0x1b60], 0
mov eax, dword [ebp - 0xafc]
inc eax
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xafc]
imul eax, dword [ebp - 0x1b60]
cmp eax, 1
jbe 0x472dbc
mov dword [ebp - 0xd00], 1
jmp 0x472dc3
and dword [ebp - 0xd00], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d54]
cmp dword [ebp - 0xd00], eax
jg 0x472df3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
je 0x472df3
mov dword [ebp - 0x1b68], 1
jmp 0x472dfa
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
inc eax
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x1d54]
cmp eax, 0x839bb816
jae 0x472e20
mov dword [ebp - 0xd08], 1
jmp 0x472e27
and dword [ebp - 0xd08], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d54]
cmp dword [ebp - 0xd08], eax
jle 0x472e47
mov dword [ebp - 0x1b70], 1
jmp 0x472e4e
and dword [ebp - 0x1b70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
sub eax, dword [ebp - 0x1b70]
je 0x472e7f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
je 0x472e7f
mov dword [ebp - 0xd10], 1
jmp 0x472e86
and dword [ebp - 0xd10], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e50]
cmp dword [ebp - 0xd10], eax
jge 0x472ea7
mov dword [ebp - 0x1b78], 1
jmp 0x472eae
and dword [ebp - 0x1b78], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d54]
cmp dword [ebp - 0x1b78], eax
jge 0x472ece
mov dword [ebp - 0xd18], 1
jmp 0x472ed5
and dword [ebp - 0xd18], 0
cmp dword [ebp - 0xd18], 5
jae 0x472eea
mov dword [ebp - 0x1b80], 1
jmp 0x472ef1
and dword [ebp - 0x1b80], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b80]
mov dword [ebp + eax - 0x1e50], ecx
mov dword [ebp - 0xa8], 0x7084bc9c
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x648], 0
jmp 0x472f31
mov eax, dword [ebp - 0x648]
inc eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 3
jge 0x472f4d
mov eax, dword [ebp - 0x648]
mov dword [ebp + eax*4 - 0x303c], 0xfffffffd
jmp 0x472f24
mov dword [ebp - 0x20c], 0
jmp 0x472f66
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x1d
je 0x473073
mov dword [ebp - 0x22ec], 9
mov dword [ebp - 0xd20], 0xffffffff
mov dword [ebp - 0x41c], 0
cmp dword [ebp - 0x22ec], 0xefc07e17
jbe 0x473000
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x2974], eax
cmp dword [ebp - 0x20c], 0
jne 0x472fbb
cmp dword [ebp - 0xd20], 0
je 0x472fd0
cmp dword [ebp - 0x20c], 0
je 0x472fd0
mov dword [ebp - 0x1b88], 1
jmp 0x472fd7
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x20c], eax
jle 0x473000
and dword [ebp - 0xd28], 0
jmp 0x47300a
mov dword [ebp - 0xd28], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd28]
mov dword [ebp + eax - 0x303c], ecx
mov dword [ebp - 0x41c], 0
jmp 0x473035
mov eax, dword [ebp - 0x41c]
dec eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0xffffffe3
jle 0x47306e
mov byte [ebp - 0x2a2], 0
movzx eax, byte [ebp - 0x2a2]
test eax, eax
je 0x47306c
push 0x8e4
push 0x1747
push 0x5b5
push 0x1143
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x473028
jmp 0x472f59
mov dword [ebp - 0x98c], 0x2937a3a1
mov dword [ebp - 0xd48], 1
mov dword [ebp - 8], 0
jmp 0x473097
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x4730ad
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3054], 0x478144ad
jmp 0x473090
mov dword [ebp - 8], 0
jmp 0x4730bd
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x4730d3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x500], 0xdcc5
jmp 0x4730b6
mov dword [ebp - 8], 0
jmp 0x4730e3
cmp dword [ebp - 8], 4
jge 0x4730f9
cmp dword [ebp + 8], 1
jne 0x481bbc
mov dword [ebp - 0x2384], 0xbfb3a4df
mov dword [ebp - 0x2380], 0xbfb3a4df
mov dword [ebp - 0x237c], 0xbfb3a4df
mov dword [ebp - 0x2378], 0xbfb3a4df
mov dword [ebp - 0xb34], 0x15a60915
mov dword [ebp - 0x1574], 0xfe01
mov dword [ebp - 0xa4c], 0x19944761
mov dword [ebp - 0x778], 0
jmp 0x47cd4b
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 2
jge 0x47cd67
mov eax, dword [ebp - 0x778]
mov dword [ebp + eax*4 - 0x60c], 0xdf99ff60
jmp 0x47cd3e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x60c], 5
jmp 0x47cd95
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x60c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x60c], 0xffffffe8
jge 0x47d170
mov dword [ebp - 0x1c4], 0x95364446
mov dword [ebp - 0x50c], 1
mov dword [ebp - 0xae4], 7
mov dword [ebp - 0x1c4], 0xffffffec
jmp 0x47cde0
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xffffffec
jle 0x47cf63
mov dword [ebp - 0x207c], 0x8dc1
mov dword [ebp - 0xa44], 0xffffffff
mov dword [ebp - 0x2084], 0x142b622b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60c]
mov dword [ebp - 0x2810], eax
mov dword [ebp - 0xa44], 1
cmp dword [ebp - 0xa44], 1
jg 0x47ce3d
mov dword [ebp - 0x1534], 1
jmp 0x47ce44
and dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x1534]
mov dword [ebp - 0xb34], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60c]
add eax, dword [ebp - 0xb34]
cmp eax, dword [ebp - 0x1c4]
jle 0x47ce80
cmp dword [ebp - 0x1c4], 0
je 0x47ce80
mov dword [ebp - 0x153c], 1
jmp 0x47ce87
and dword [ebp - 0x153c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60c]
mov dword [ebp - 0x198c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x198c]
mov dword [ebp + eax - 0x2384], ecx
mov eax, dword [ebp - 0x198c]
sub eax, dword [ebp - 0x153c]
cmp eax, dword [ebp - 0x207c]
jle 0x47cecc
mov dword [ebp - 0x1bb4], 1
jmp 0x47ced3
and dword [ebp - 0x1bb4], 0
mov eax, dword [ebp - 0x1bb4]
mov dword [ebp - 0x50c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60c]
cmp dword [ebp - 0x50c], eax
jle 0x47cf00
mov dword [ebp - 0x1544], 1
jmp 0x47cf07
and dword [ebp - 0x1544], 0
cmp dword [ebp - 0x1544], 6
ja 0x47cf1c
mov dword [ebp - 0x2278], 1
jmp 0x47cf23
and dword [ebp - 0x2278], 0
mov eax, dword [ebp - 0x2084]
mov dword [ebp - 0x2bf0], eax
mov eax, dword [ebp - 0x1c4]
neg eax
cmp eax, dword [ebp - 0xa44]
jle 0x47cf4b
mov dword [ebp - 0x1994], 1
jmp 0x47cf52
and dword [ebp - 0x1994], 0
mov eax, dword [ebp - 0x1994]
mov dword [ebp - 0xae4], eax
jmp 0x47cdd3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2384]
cmp dword [ebp - 0xb34], eax
jle 0x47cf83
mov dword [ebp - 0x1bbc], 1
jmp 0x47cf8a
and dword [ebp - 0x1bbc], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x60c], 0
je 0x47cfac
mov eax, 0xdfeb
test eax, eax
je 0x47cfac
and dword [ebp - 0x154c], 0
jmp 0x47cfb6
mov dword [ebp - 0x154c], 1
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x154c], eax
je 0x47cfd0
mov dword [ebp - 0x1cf0], 1
jmp 0x47cfd7
and dword [ebp - 0x1cf0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2384]
cmp dword [ebp - 0x1cf0], eax
jne 0x47cff7
mov dword [ebp - 0x1554], 1
jmp 0x47cffe
and dword [ebp - 0x1554], 0
cmp dword [ebp - 0x1554], 1
je 0x47d013
mov dword [ebp - 0x199c], 1
jmp 0x47d01a
and dword [ebp - 0x199c], 0
mov eax, dword [ebp - 0x1574]
cmp dword [ebp - 0x199c], eax
jg 0x47d034
mov dword [ebp - 0x155c], 1
jmp 0x47d03b
and dword [ebp - 0x155c], 0
mov eax, dword [ebp - 0x155c]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
jne 0x47d062
cmp dword [ebp - 0xa4c], 0
jne 0x47d062
and dword [ebp - 0x1564], 0
jmp 0x47d06c
mov dword [ebp - 0x1564], 1
mov eax, dword [ebp - 0x1bbc]
cmp eax, dword [ebp - 0x1564]
je 0x47d086
mov dword [ebp - 0x19a4], 1
jmp 0x47d08d
and dword [ebp - 0x19a4], 0
cmp dword [ebp - 0x19a4], 0xe230
jl 0x47d0be
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60c], 0
je 0x47d0be
mov eax, 0xc7f2bac
test eax, eax
je 0x47d0be
mov dword [ebp - 0x156c], 1
jmp 0x47d0c5
and dword [ebp - 0x156c], 0
mov eax, dword [ebp - 0x156c]
add eax, 0xffff
je 0x47d0e7
mov eax, 0xda9a
test eax, eax
je 0x47d0e7
mov dword [ebp - 0x1ccc], 1
jmp 0x47d0ee
and dword [ebp - 0x1ccc], 0
mov eax, dword [ebp - 0x1ccc]
sub eax, dword [ebp - 0x50c]
add eax, dword [ebp - 0x1574]
cmp eax, dword [ebp - 0x50c]
jne 0x47d114
mov dword [ebp - 0x19ac], 1
jmp 0x47d11b
and dword [ebp - 0x19ac], 0
mov eax, dword [ebp - 0x19ac]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x47d145
mov eax, 0xfffa
test eax, eax
je 0x47d145
mov dword [ebp - 0x157c], 1
jmp 0x47d14c
and dword [ebp - 0x157c], 0
mov eax, dword [ebp - 0x157c]
mov dword [ebp - 0xae4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xae4]
mov dword [ebp + eax - 0x2384], ecx
jmp 0x47cd7a
mov dword [ebp - 0x8d8], 0xc93b4e1
mov dword [ebp - 0x8d8], 0
jmp 0x47d193
mov eax, dword [ebp - 0x8d8]
inc eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 0x11
jge 0x47d1cd
mov dword [ebp - 0x2318], 0
mov byte [ebp - 0x3f5], 0
movzx eax, byte [ebp - 0x3f5]
test eax, eax
je 0x47d1c0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x2318], 0
je 0x47d1cb
jmp 0x47d1cd
jmp 0x47d186
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x208c], 0xfffffff7
mov dword [ebp - 0x780], 0
jmp 0x47d1fa
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 1
jge 0x47d216
mov eax, dword [ebp - 0x780]
mov dword [ebp + eax*4 - 0x2818], 0x8eac8b13
jmp 0x47d1ed
mov byte [ebp - 0x2b3], 0
movzx eax, byte [ebp - 0x2b3]
test eax, eax
je 0x47d230
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x868], 0
jmp 0x47d249
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 0
jg 0x47d28c
mov dword [ebp - 0x788], 0xffffffff
mov dword [ebp - 0x788], 0
jmp 0x47d275
mov eax, dword [ebp - 0x788]
dec eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 0
jl 0x47d28a
mov dword [ebp - 0x208c], 0xffffffff
jmp 0x47d268
jmp 0x47d23c
mov dword [ebp - 0x9b0], 0x25d1
mov dword [ebp - 0x1cf8], 0xffffffff
mov dword [ebp - 0xa54], 0x78ed7c3b
mov dword [ebp - 0x2280], 0x3132d683
mov dword [ebp - 0x209c], 0x6a9cbde6
mov dword [ebp - 0x54], 0
jmp 0x47d2ce
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x47d2e1
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x3c], 0xfffffff8
jmp 0x47d2c7
mov dword [ebp - 0x54], 0
jmp 0x47d2f1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x47d307
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x2428], 0x59f451db
jmp 0x47d2ea
mov dword [ebp - 0x54], 0
jmp 0x47d317
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x47d32d
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x2a60], 1
jmp 0x47d310
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x2d48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x2820], eax
push 5
pop eax
test eax, eax
jne 0x47d36a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x47d36a
and dword [ebp - 0x1bc4], 0
jmp 0x47d374
mov dword [ebp - 0x1bc4], 1
cmp dword [ebp - 0x1bc4], 0x1f1e283d
je 0x47d38c
mov dword [ebp - 0x1584], 1
jmp 0x47d393
and dword [ebp - 0x1584], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp eax, dword [ebp - 0x1584]
jg 0x47d3b1
mov dword [ebp - 0x19b4], 1
jmp 0x47d3b8
and dword [ebp - 0x19b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
add eax, dword [ebp - 0x19b4]
jne 0x47d3e0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x47d3e0
and dword [ebp - 0x158c], 0
jmp 0x47d3ea
mov dword [ebp - 0x158c], 1
mov eax, dword [ebp - 0x158c]
mov dword [ebp - 0x1cf8], eax
mov eax, dword [ebp - 0x1cf8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x3c]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0x2280]
cmp dword [ebp - 0xa54], eax
jle 0x47d426
mov dword [ebp - 0x1594], 1
jmp 0x47d42d
and dword [ebp - 0x1594], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1594]
sub ecx, dword [ebp + eax - 0x3c]
jne 0x47d44a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2428], 1
jbe 0x47d466
mov dword [ebp - 0x19bc], 1
jmp 0x47d46d
and dword [ebp - 0x19bc], 0
cmp dword [ebp - 0x19bc], 0xffff
jbe 0x47d485
mov dword [ebp - 0x2094], 1
jmp 0x47d48c
and dword [ebp - 0x2094], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x2bf8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x47d4bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x47d4bf
and dword [ebp - 0x159c], 0
jmp 0x47d4c9
mov dword [ebp - 0x159c], 1
cmp dword [ebp - 0x159c], 0x63b8
jle 0x47d4ee
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x47d4ee
mov dword [ebp - 0x1bcc], 1
jmp 0x47d4f5
and dword [ebp - 0x1bcc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
add eax, 4
sub eax, dword [ebp - 0x1bcc]
cmp eax, 0xfffffffe
je 0x47d519
mov dword [ebp - 0x15a4], 1
jmp 0x47d520
and dword [ebp - 0x15a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2428]
cmp dword [ebp - 0x15a4], eax
jge 0x47d541
mov dword [ebp - 0x2398], 1
jmp 0x47d548
and dword [ebp - 0x2398], 0
cmp dword [ebp - 0xa54], 0
je 0x47d55e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x47d577
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2a60], 0
jne 0x47d577
and dword [ebp - 0x19c4], 0
jmp 0x47d581
mov dword [ebp - 0x19c4], 1
mov eax, dword [ebp - 0x19c4]
add eax, 0xf5ee
mov dword [ebp - 0x209c], eax
mov byte [ebp - 0x3e3], 0
movzx eax, byte [ebp - 0x3e3]
test eax, eax
je 0x47d5ac
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x348], 0x33356370
mov dword [ebp - 0xb74], 0xffffffff
mov dword [ebp - 0x2828], 0xc9d7
mov dword [ebp - 0x20a4], 0xf51ae9a0
mov dword [ebp - 0x2de0], 0x20b50f6b
mov dword [ebp - 0x5c], 0
jmp 0x47d5ee
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x47d604
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2530], 0xb9b55bb2
jmp 0x47d5e7
mov dword [ebp - 0x5c], 0
jmp 0x47d614
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x47d62a
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1df8], 0xe2236432
jmp 0x47d60d
mov dword [ebp - 0x5c], 0
jmp 0x47d63a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x47d650
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x3244], 0xffffffff
jmp 0x47d633
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1df8], 0
jmp 0x47d67b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1df8], 2
jg 0x47d8d2
mov dword [ebp - 0x258], 0xfff9
mov dword [ebp - 0x57c], 0x41fc9a57
mov dword [ebp - 0x71c], 0xffffffff
mov dword [ebp - 0x1400], 0x3ed13222
mov dword [ebp - 0x18c], 0
jmp 0x481bfd
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x481c19
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x370], 0xad38
jmp 0x481bf0
mov dword [ebp - 0x18c], 0
jmp 0x481c32
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x481c4e
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x1d44], 0xfffffffe
jmp 0x481c25
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x370], 0
jne 0x481c77
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x370], 0
jne 0x481c77
and dword [ebp - 0x13e0], 0
jmp 0x481c81
mov dword [ebp - 0x13e0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0x2da0], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x71c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x71c]
imul ecx, dword [ebp + eax - 0x370]
mov eax, dword [ebp - 0x57c]
sub eax, ecx
cmp eax, dword [ebp - 0x258]
jg 0x481cdc
mov dword [ebp - 0x13d8], 1
jmp 0x481ce3
and dword [ebp - 0x13d8], 0
xor eax, eax
sub eax, dword [ebp - 0x13d8]
cmp eax, 0x51ebf0dd
jne 0x481cfe
mov dword [ebp - 0x13e8], 1
jmp 0x481d05
and dword [ebp - 0x13e8], 0
mov eax, dword [ebp - 0x13e0]
add eax, dword [ebp - 0x13e8]
add eax, dword [ebp - 0x258]
je 0x481d31
mov dword [ebp - 0x2184], 0x75cb5542
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x2184], eax
jmp 0x481d59
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x481d59
push 0
push 0
push 0x1100
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x258], 0
je 0x481eca
cmp dword [ebp - 0x71c], 0
jne 0x481d88
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x370], 0
jne 0x481d88
and dword [ebp - 0x1408], 0
jmp 0x481d92
mov dword [ebp - 0x1408], 1
xor eax, eax
jne 0x481db8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d44], 0
jne 0x481db8
cmp dword [ebp - 0x258], 0
jne 0x481db8
and dword [ebp - 0x13f0], 0
jmp 0x481dc2
mov dword [ebp - 0x13f0], 1
mov eax, dword [ebp - 0x13f0]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x57c]
add eax, 0xfc78
cmp eax, dword [ebp - 0x258]
jge 0x481ded
mov dword [ebp - 0x13f8], 1
jmp 0x481df4
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0x13f8]
mov dword [ebp - 0x1400], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d44]
cmp dword [ebp - 0x1400], eax
jl 0x481e21
mov dword [ebp - 0x1410], 1
jmp 0x481e28
and dword [ebp - 0x1410], 0
mov eax, dword [ebp - 0x1408]
cmp eax, dword [ebp - 0x1410]
jle 0x481e52
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x370], 0
je 0x481e52
mov dword [ebp - 0x1418], 1
jmp 0x481e59
and dword [ebp - 0x1418], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x370]
cmp dword [ebp - 0x1418], eax
je 0x481e7a
mov dword [ebp - 0x1420], 1
jmp 0x481e81
and dword [ebp - 0x1420], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d44]
cmp dword [ebp - 0x1420], eax
jge 0x481ea2
mov dword [ebp - 0x1428], 1
jmp 0x481ea9
and dword [ebp - 0x1428], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d44]
add eax, dword [ebp - 0x1428]
je 0x481eca
mov dword [ebp - 0x1430], 1
jmp 0x481ed1
and dword [ebp - 0x1430], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d44]
cmp dword [ebp - 0x1430], eax
je 0x481ef2
mov dword [ebp - 0x1438], 1
jmp 0x481ef9
and dword [ebp - 0x1438], 0
cmp dword [ebp - 0x1438], 0x299e885d
jge 0x481f11
mov dword [ebp - 0x1440], 1
jmp 0x481f18
and dword [ebp - 0x1440], 0
mov eax, dword [ebp - 0x1440]
sub eax, dword [ebp - 0x258]
mov dword [ebp - 0x71c], eax
mov dword [ebp - 0x1450], 4
mov dword [ebp - 0x724], 0
jmp 0x481f4d
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 2
jge 0x481f69
mov eax, dword [ebp - 0x724]
mov dword [ebp + eax*4 - 0x2a90], 0
jmp 0x481f40
cmp dword [ebp - 0x1450], 0
je 0x481f8b
mov dword [ebp - 0x1448], 0x7a876e6b
mov eax, dword [ebp - 0x1448]
dec eax
mov dword [ebp - 0x1448], eax
jmp 0x481fb2
mov dword [ebp - 0x1ebc], 0x79cf1813
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1450]
mov dword [ebp + eax - 0x2a90], ecx
mov dword [ebp - 0x1ebc], 0xffffffff
mov dword [ebp - 0x1478], 0xffffffff
mov dword [ebp - 0xa00], 0x78ed7c3b
mov dword [ebp - 0x1ec0], 0x3132d683
mov dword [ebp - 0x1ed8], 0x6a9cbde6
mov dword [ebp - 0x8c], 0
jmp 0x481ff3
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x48200c
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x40], 0xfffffff8
jmp 0x481fe6
mov dword [ebp - 0x8c], 0
jmp 0x482025
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x482041
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x2438], 0x59f451db
jmp 0x482018
mov dword [ebp - 0x8c], 0
jmp 0x48205a
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x482076
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x2a9c], 1
jmp 0x48204d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0x2980], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0x2af0], eax
push 5
pop eax
test eax, eax
jne 0x4820b3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x4820b3
and dword [ebp - 0x1458], 0
jmp 0x4820bd
mov dword [ebp - 0x1458], 1
cmp dword [ebp - 0x1458], 0x1f1e283d
je 0x4820d5
mov dword [ebp - 0x1460], 1
jmp 0x4820dc
and dword [ebp - 0x1460], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp eax, dword [ebp - 0x1460]
jg 0x4820fa
mov dword [ebp - 0x1468], 1
jmp 0x482101
and dword [ebp - 0x1468], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
add eax, dword [ebp - 0x1468]
jne 0x482129
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x482129
and dword [ebp - 0x1470], 0
jmp 0x482133
mov dword [ebp - 0x1470], 1
mov eax, dword [ebp - 0x1470]
mov dword [ebp - 0x1478], eax
mov eax, dword [ebp - 0x1478]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x40]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0x1ec0]
cmp dword [ebp - 0xa00], eax
jle 0x48216f
mov dword [ebp - 0x1480], 1
jmp 0x482176
and dword [ebp - 0x1480], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1480]
sub ecx, dword [ebp + eax - 0x40]
jne 0x482193
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2438], 1
jbe 0x4821af
mov dword [ebp - 0x1488], 1
jmp 0x4821b6
and dword [ebp - 0x1488], 0
cmp dword [ebp - 0x1488], 0xffff
jbe 0x4821ce
mov dword [ebp - 0x1ec8], 1
jmp 0x4821d5
and dword [ebp - 0x1ec8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0x2988], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x482208
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x482208
and dword [ebp - 0x1490], 0
jmp 0x482212
mov dword [ebp - 0x1490], 1
cmp dword [ebp - 0x1490], 0x63b8
jle 0x482237
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
je 0x482237
mov dword [ebp - 0x1498], 1
jmp 0x48223e
and dword [ebp - 0x1498], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
add eax, 4
sub eax, dword [ebp - 0x1498]
cmp eax, 0xfffffffe
je 0x482262
mov dword [ebp - 0x14a0], 1
jmp 0x482269
and dword [ebp - 0x14a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2438]
cmp dword [ebp - 0x14a0], eax
jge 0x48228a
mov dword [ebp - 0x1ed0], 1
jmp 0x482291
and dword [ebp - 0x1ed0], 0
cmp dword [ebp - 0xa00], 0
je 0x4822a7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x4822c0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2a9c], 0
jne 0x4822c0
and dword [ebp - 0x14a8], 0
jmp 0x4822ca
mov dword [ebp - 0x14a8], 1
mov eax, dword [ebp - 0x14a8]
add eax, 0xf5ee
mov dword [ebp - 0x1ed8], eax
mov byte [ebp - 0x3de], 0
movzx eax, byte [ebp - 0x3de]
test eax, eax
je 0x4822f5
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x104], 0x82062403
mov dword [ebp - 0x2b04], 0xffffffff
mov dword [ebp - 0x734], 0xffffffff
mov dword [ebp - 0x2990], 0x3acdd711
mov dword [ebp - 0x2b0c], 0x3d07
mov dword [ebp - 0xa08], 7
mov dword [ebp - 0xa10], 0xf5291260
mov dword [ebp - 0x1ee8], 0xffff
mov dword [ebp - 0x72c], 0
jmp 0x48235e
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 3
jge 0x48237a
mov eax, dword [ebp - 0x72c]
mov dword [ebp + eax*4 - 0x2fc4], 0x213072c0
jmp 0x482351
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x2998], eax
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x2b14], eax
mov eax, dword [ebp - 0xa08]
cmp dword [ebp - 0xa10], eax
jg 0x4823ac
mov dword [ebp - 0x14b0], 1
jmp 0x4823b3
and dword [ebp - 0x14b0], 0
mov eax, dword [ebp - 0x14b0]
mov dword [ebp - 0xa08], eax
mov dword [ebp - 0x734], 0xfffffff2
jmp 0x4823d8