Function at 0x473a00
Capabilities:
Check for time delay via gettickcount
Compare security identifiers
Contain obfuscated stackstrings
Get graphical window text
Get keyboard layout
Get session user name
Hide graphical window
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3968
call fcn.004aceb0
push esi
push edi
mov dword [ebp - 0xa10], 1
mov dword [ebp - 0xa08], 0
jmp 0x473a32
mov eax, dword [ebp - 0xa08]
inc eax
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 3
jge 0x473a4e
mov eax, dword [ebp - 0xa08]
mov dword [ebp + eax*4 - 0x37e0], 0x3b4e
jmp 0x473a25
mov dword [ebp - 0xa10], 0
jmp 0x473a67
mov eax, dword [ebp - 0xa10]
inc eax
mov dword [ebp - 0xa10], eax
cmp dword [ebp - 0xa10], 2
jg 0x473ae5
mov byte [ebp - 0x472], 0
movzx eax, byte [ebp - 0x472]
test eax, eax
je 0x473aaa
push 0x118
push 0x1c30
push 0x1c43
push 0x1bf0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov byte [ebp - 0x34e], 0
movzx eax, byte [ebp - 0x34e]
test eax, eax
je 0x473ae0
push pe_nt_image_headers32
push 0
push 0
push 0
push 0
push 0x248e
push 0x1c85
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
jmp 0x473a5a
mov byte [ebp - 0x350], 0
movzx eax, byte [ebp - 0x350]
test eax, eax
je 0x473b0d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x9c], 0xce57bf5c
mov dword [ebp - 0x100], 0x521f
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0x2258], 0x907f7a79
mov dword [ebp - 0xa18], 0
jmp 0x473b4e
mov eax, dword [ebp - 0xa18]
inc eax
mov dword [ebp - 0xa18], eax
cmp dword [ebp - 0xa18], 1
jge 0x473b6a
mov eax, dword [ebp - 0xa18]
mov dword [ebp + eax*4 - 0x608], 0x73ed1322
jmp 0x473b41
cmp dword [ebp - 0x9c], 0
je 0x473b91
cmp dword [ebp - 0x9c], 0
je 0x473b91
cmp dword [ebp - 0x9c], 0
je 0x473b91
mov dword [ebp - 0x23f8], 1
jmp 0x473b98
and dword [ebp - 0x23f8], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x3254], eax
cmp dword [ebp - 0x9c], 0
jg 0x473bb9
mov dword [ebp - 0x18cc], 1
jmp 0x473bc0
and dword [ebp - 0x18cc], 0
mov eax, dword [ebp - 0x18cc]
sub eax, dword [ebp - 0x9c]
add eax, 0x7c71
cmp eax, dword [ebp - 0x9c]
jg 0x473be5
mov dword [ebp - 0x2200], 1
jmp 0x473bec
and dword [ebp - 0x2200], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2200], eax
jl 0x473c06
mov dword [ebp - 0x2208], 1
jmp 0x473c0d
and dword [ebp - 0x2208], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2208], eax
jne 0x473c27
mov dword [ebp - 0x2210], 1
jmp 0x473c2e
and dword [ebp - 0x2210], 0
cmp dword [ebp - 0x2210], 0x18bc
jge 0x473c4c
cmp dword [ebp - 0x100], 0
je 0x473c4c
and dword [ebp - 0x2218], 0
jmp 0x473c56
mov dword [ebp - 0x2218], 1
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2218], eax
jle 0x473c70
mov dword [ebp - 0x2220], 1
jmp 0x473c77
and dword [ebp - 0x2220], 0
cmp dword [ebp - 0x2220], 0xffff
ja 0x473c8f
mov dword [ebp - 0x2228], 1
jmp 0x473c96
and dword [ebp - 0x2228], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x2228], eax
jl 0x473cb0
mov dword [ebp - 0x2230], 1
jmp 0x473cb7
and dword [ebp - 0x2230], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2230], eax
jne 0x473cd1
mov dword [ebp - 0x2238], 1
jmp 0x473cd8
and dword [ebp - 0x2238], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2238], eax
jg 0x473cf2
mov dword [ebp - 0x2240], 1
jmp 0x473cf9
and dword [ebp - 0x2240], 0
mov eax, dword [ebp - 0x2240]
inc eax
cmp eax, dword [ebp - 0x100]
jne 0x473d14
mov dword [ebp - 0x26b0], 1
jmp 0x473d1b
and dword [ebp - 0x26b0], 0
push 4
pop eax
add eax, 0x9aa50887
cmp eax, 5
jl 0x473d34
mov dword [ebp - 0x2248], 1
jmp 0x473d3b
and dword [ebp - 0x2248], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x2248]
jne 0x473d55
mov dword [ebp - 0x2250], 1
jmp 0x473d5c
and dword [ebp - 0x2250], 0
imul eax, dword [ebp - 0x2250], 0
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xdc], 0
jmp 0x473d82
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jg 0x473fad
mov dword [ebp - 0x26b8], 0x6f5737fb
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x608], 0
je 0x473dae
jmp 0x473fad
mov dword [ebp - 0x9c], 0
jmp 0x473dc7
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x473fa8
mov dword [ebp - 0x528], 1
mov dword [ebp - 0x100], 0
jmp 0x473df7
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jg 0x473fa3
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x608], 0
je 0x473f7d
cmp dword [ebp - 0xdc], 0
jne 0x473e3d
mov dword [ebp - 0x2258], 0
mov eax, dword [ebp - 0x2258]
add eax, 0x6c717898
imul eax, dword [ebp - 0x528]
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x528], eax
jne 0x473e57
mov dword [ebp - 0x2260], 1
jmp 0x473e5e
and dword [ebp - 0x2260], 0
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x608]
cmp dword [ebp - 0x2260], eax
jne 0x473e7f
mov dword [ebp - 0x2268], 1
jmp 0x473e86
and dword [ebp - 0x2268], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x2268], eax
jle 0x473ea0
mov dword [ebp - 0x2270], 1
jmp 0x473ea7
and dword [ebp - 0x2270], 0
cmp dword [ebp - 0x2270], 0xa1bd053a
je 0x473ebf
mov dword [ebp - 0x22e4], 1
jmp 0x473ec6
and dword [ebp - 0x22e4], 0
cmp dword [ebp - 0x22e4], 0xe0ad5834
jae 0x473ede
mov dword [ebp - 0x22ec], 1
jmp 0x473ee5
and dword [ebp - 0x22ec], 0
mov eax, dword [ebp - 0x528]
imul eax, dword [ebp - 0x22ec]
mov ecx, dword [ebp - 0xdc]
cmp eax, dword [ebp + ecx*4 - 0x608]
jle 0x473f0d
mov dword [ebp - 0x22f4], 1
jmp 0x473f14
and dword [ebp - 0x22f4], 0
mov eax, dword [ebp - 0x22f4]
add eax, 7
cmp eax, dword [ebp - 0x528]
jne 0x473f31
mov dword [ebp - 0x231c], 1
jmp 0x473f38
and dword [ebp - 0x231c], 0
mov eax, dword [ebp - 0x528]
add eax, dword [ebp - 0x231c]
mov ecx, dword [ebp - 0xdc]
cmp eax, dword [ebp + ecx*4 - 0x608]
jg 0x473f5f
mov dword [ebp - 0x2324], 1
jmp 0x473f66
and dword [ebp - 0x2324], 0
imul eax, dword [ebp - 0x2324], 0
test eax, eax
je 0x473f7d
mov dword [ebp - 0x232c], 1
jmp 0x473f84
and dword [ebp - 0x232c], 0
mov eax, dword [ebp - 0x232c]
mov dword [ebp - 0x26b8], eax
cmp dword [ebp - 0x528], 0
je 0x473f9e
jmp 0x473dea
jmp 0x473dea
jmp 0x473dba
jmp 0x473d75
mov dword [ebp - 0x38], 1
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0xa28], 0
mov dword [ebp - 0xbec], 1
mov dword [ebp - 0xd34], 0x4d7a
mov dword [ebp - 0xa20], 0
jmp 0x473ff5
mov eax, dword [ebp - 0xa20]
inc eax
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0xa20], 1
jge 0x474011
mov eax, dword [ebp - 0xa20]
mov dword [ebp + eax*4 - 0x1ec], 0xfffffffa
jmp 0x473fe8
xor eax, eax
jne 0x47402d
mov eax, dword [ebp - 0x38]
sub eax, 0xb0a6
cmp eax, 0x1fc80ae7
je 0x47402d
and dword [ebp - 0x2334], 0
jmp 0x474037
mov dword [ebp - 0x2334], 1
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x2334]
jge 0x47404e
mov dword [ebp - 0x233c], 1
jmp 0x474055
and dword [ebp - 0x233c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x233c], eax
je 0x47406f
cmp dword [ebp - 0x38], 0
jne 0x47406f
and dword [ebp - 0x26c0], 0
jmp 0x474079
mov dword [ebp - 0x26c0], 1
mov eax, 0x8886
cmp eax, 1
jne 0x47408f
mov dword [ebp - 0x1efc], 1
jmp 0x474096
and dword [ebp - 0x1efc], 0
mov eax, dword [ebp - 0x1efc]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0xa28], 0
jne 0x4740cc
or eax, 0xffffffff
jne 0x4740cc
and dword [ebp - 0xcf4], 0
jmp 0x4740d6
mov dword [ebp - 0xcf4], 1
imul eax, dword [ebp - 0xcf4], 0xffff
cmp eax, 5
jge 0x4740f1
mov dword [ebp - 0x1c50], 1
jmp 0x4740f8
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c50], eax
jl 0x47410f
mov dword [ebp - 0xcfc], 1
jmp 0x474116
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0x9f36
jl 0x47412e
mov dword [ebp - 0x1c58], 1
jmp 0x474135
and dword [ebp - 0x1c58], 0
mov eax, dword [ebp - 0x1c58]
sub eax, 0x731e
je 0x474155
push 2
pop eax
test eax, eax
je 0x474155
mov dword [ebp - 0x26c8], 1
jmp 0x47415c
and dword [ebp - 0x26c8], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2e28], eax
cmp dword [ebp - 0xa28], 0
jne 0x474180
cmp dword [ebp - 0xfc], 0
jne 0x474180
and dword [ebp - 0xd04], 0
jmp 0x47418a
mov dword [ebp - 0xd04], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xd04], eax
jl 0x4741a1
mov dword [ebp - 0x26d0], 1
jmp 0x4741a8
and dword [ebp - 0x26d0], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2e30], eax
cmp dword [ebp - 0xa28], 0xab72
jge 0x4741c9
mov dword [ebp - 0x1c60], 1
jmp 0x4741d0
and dword [ebp - 0x1c60], 0
mov eax, dword [ebp - 0x1c60]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0xd0c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0c]
mov dword [ebp + eax - 0x1ec], ecx
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0xbec], eax
mov dword [ebp - 0xfc], 0
jmp 0x474217
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x474557
mov dword [ebp - 0x610], 0xffffffff
mov dword [ebp - 0xd2c], 0xdcec458a
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x1ec]
mov dword [ebp - 0x1c68], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c68]
mov dword [ebp + eax - 0x1ec], ecx
cmp dword [ebp - 0x1c68], 0
je 0x4743c5
mov eax, dword [ebp - 0xfc]
mov ecx, 0x218ad385
sub ecx, dword [ebp + eax*4 - 0x1ec]
je 0x474323
cmp dword [ebp - 0xfc], 0xfffffffa
jle 0x474298
mov dword [ebp - 0xd14], 1
jmp 0x47429f
and dword [ebp - 0xd14], 0
cmp dword [ebp - 0xd14], 0xe88fefd6
jae 0x4742b7
mov dword [ebp - 0xa9c], 1
jmp 0x4742be
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xa9c]
mov dword [ebp + eax*4 - 0x1ec], ecx
cmp dword [ebp - 0xa9c], 0xfffffffb
jb 0x4742e6
mov dword [ebp - 0x1c70], 1
jmp 0x4742ed
and dword [ebp - 0x1c70], 0
cmp dword [ebp - 0x1c70], 0xfffffffd
jg 0x474302
mov dword [ebp - 0xd1c], 1
jmp 0x474309
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0xd1c]
test eax, eax
je 0x474323
mov dword [ebp - 0x1c78], 1
jmp 0x47432a
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0x610]
imul eax, dword [ebp - 0x1c78]
cmp eax, 0xd4b
jle 0x47434a
mov dword [ebp - 0xd24], 1
jmp 0x474351
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0xd24], eax
jne 0x47436b
mov dword [ebp - 0x1c80], 1
jmp 0x474372
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0x1c80]
mov dword [ebp - 0xd2c], eax
cmp dword [ebp - 0xd2c], 3
je 0x474393
mov dword [ebp - 0x1c88], 1
jmp 0x47439a
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x1c88]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0xd34]
sub eax, dword [ebp - 0xbec]
cmp eax, 0x3a8a1d58
jl 0x4743c5
mov dword [ebp - 0x1c90], 1
jmp 0x4743cc
and dword [ebp - 0x1c90], 0
cmp dword [ebp - 0x1c90], 0
je 0x4743f0
mov dword [ebp - 0x26d8], 0xad8e
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x26d8], eax
jmp 0x474552
mov dword [ebp - 0x618], 0x9aeb8efb
mov dword [ebp - 0x38], 0
jmp 0x47440a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x2c
jg 0x47453f
mov dword [ebp - 0x1c98], 4
mov dword [ebp - 0x26e0], 8
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x2e38], eax
push 8
pop eax
test eax, eax
je 0x474453
cmp dword [ebp - 0x610], 0xd9b76fc4
jne 0x474453
mov dword [ebp - 0xd3c], 1
jmp 0x47445a
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0x1c98], eax
mov eax, dword [ebp - 0x1c98]
mov dword [ebp - 0x2e40], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x2e48], eax
cmp dword [ebp - 0x610], 0x3af7
je 0x474496
mov dword [ebp - 0xd44], 1
jmp 0x47449d
and dword [ebp - 0xd44], 0
cmp dword [ebp - 0xd44], 0xf595
jle 0x4744b5
mov dword [ebp - 0x1ca0], 1
jmp 0x4744bc
and dword [ebp - 0x1ca0], 0
mov eax, dword [ebp - 0x618]
sub eax, dword [ebp - 0x1ca0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1ec]
jne 0x4744e9
cmp dword [ebp - 0x618], 0
jne 0x4744e9
and dword [ebp - 0xd4c], 0
jmp 0x4744f3
mov dword [ebp - 0xd4c], 1
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x1ec]
cmp dword [ebp - 0xd4c], eax
jg 0x474514
mov dword [ebp - 0x1ca8], 1
jmp 0x47451b
and dword [ebp - 0x1ca8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ca8]
mov dword [ebp + eax - 0x1ec], ecx
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x26e0], eax
jmp 0x474403
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
mov dword [ebp - 0x618], eax
jmp 0x47420a
mov dword [ebp - 0x1cb8], 0x41a80d1c
mov dword [ebp - 0x2e50], 0xfffffff9
mov dword [ebp - 0x194], 0
jmp 0x474584
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x4745a0
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x237c], 0xffffffff
jmp 0x474577
mov dword [ebp - 0x194], 0
jmp 0x4745b9
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x4745d5
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x530], 0
jmp 0x4745ac
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x530], 0
jmp 0x474603
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x530]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x530], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x530], 1
jg 0x474937
mov dword [ebp - 0x538], 0xfffffffa
mov dword [ebp - 0xa30], 0
jmp 0x47463a
mov eax, dword [ebp - 0xa30]
inc eax
mov dword [ebp - 0xa30], eax
cmp dword [ebp - 0xa30], 1
jge 0x474656
mov eax, dword [ebp - 0xa30]
mov dword [ebp + eax*4 - 0x3a8], 0xfffffff9
jmp 0x47462d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a8], 0
jmp 0x474684
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 1
jg 0x4748c5
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0xd64], 0x9683648b
mov dword [ebp - 0x1cb0], 0x11c3fc02
mov dword [ebp - 0x1cc8], 6
mov dword [ebp - 0x24c], 1
jmp 0x4746d9
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jl 0x4748a6
mov dword [ebp - 0x26e8], 0xdbaf9eb1
mov byte [ebp - 0x352], 0
movzx eax, byte [ebp - 0x352]
test eax, eax
je 0x47470a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 0xdc99
test eax, eax
je 0x47472f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x237c], 0
je 0x47472f
mov dword [ebp - 0xd54], 1
jmp 0x474736
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0x1cb0], eax
cmp dword [ebp - 0x1cb0], 0
je 0x474767
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x474767
mov dword [ebp - 0xd5c], 1
jmp 0x47476e
and dword [ebp - 0xd5c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd5c]
sub ecx, dword [ebp + eax - 0x530]
mov dword [ebp - 0x1cb8], ecx
mov eax, dword [ebp - 0x1cb8]
sub eax, dword [ebp - 0x24c]
cmp eax, 0xd55fd0a3
jb 0x4747a6
mov dword [ebp - 0x1cc0], 1
jmp 0x4747ad
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0x24c]
mov eax, dword [ebp + eax*4 - 0x237c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x530]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0xd64]
neg eax
cmp eax, dword [ebp - 0x1cc0]
jge 0x4747e9
mov dword [ebp - 0xd6c], 1
jmp 0x4747f0
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x1cc8], eax
mov eax, dword [ebp - 0x1cc8]
sub eax, 0x8a92
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3a8]
jne 0x47482e
mov dword [ebp - 0xd74], 1
jmp 0x474835
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x24c]
mov eax, dword [ebp + eax*4 - 0x237c]
cmp eax, dword [ebp - 0xd74]
jle 0x474863
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
jne 0x474863
and dword [ebp - 0x1cd0], 0
jmp 0x47486d
mov dword [ebp - 0x1cd0], 1
mov eax, dword [ebp - 0x24c]
mov eax, dword [ebp + eax*4 - 0x237c]
cmp eax, dword [ebp - 0x1cd0]
jne 0x47488e
mov dword [ebp - 0xd7c], 1
jmp 0x474895
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x26e8], eax
jmp 0x4746cc
mov byte [ebp - 0x354], 0
movzx eax, byte [ebp - 0x354]
test eax, eax
je 0x4748c0
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x474669
mov dword [ebp - 0x538], 1
jmp 0x4748de
mov eax, dword [ebp - 0x538]
dec eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
jl 0x474932
mov dword [ebp - 0x1cd8], 0xffffffff
mov byte [ebp - 0x356], 0
movzx eax, byte [ebp - 0x356]
test eax, eax
je 0x474923
push 0
push 0xae5
push 0x1f0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov eax, dword [ebp - 0x1cd8]
dec eax
mov dword [ebp - 0x1cd8], eax
jmp 0x4748d1
jmp 0x4745e8
mov dword [ebp - 0x64c], 1
mov dword [ebp - 0x3b0], 1
mov dword [ebp - 0x26f0], 0x76e5b14f
mov dword [ebp - 0x3508], 0xffffffff
mov dword [ebp - 0x3504], 0xffffffff
mov dword [ebp - 0x3500], 0xffffffff
mov dword [ebp - 0x34fc], 0xffffffff
mov dword [ebp - 0xa38], 0
jmp 0x474996
mov eax, dword [ebp - 0xa38]
inc eax
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0xa38], 4
jge 0x4749b2
mov eax, dword [ebp - 0xa38]
mov dword [ebp + eax*4 - 0x351c], 0xfffd
jmp 0x474989
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x351c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x351c], eax
mov dword [ebp - 0x3b0], 3
jmp 0x4749e4
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
jl 0x474b39
mov dword [ebp - 0x620], 0x210e164c
mov eax, dword [ebp - 0x3b0]
mov eax, dword [ebp + eax*4 - 0x351c]
mov dword [ebp - 0x2e58], eax
cmp dword [ebp - 0x3b0], 0
je 0x474a6c
mov dword [ebp - 0xa40], 0
jmp 0x474a30
mov eax, dword [ebp - 0xa40]
inc eax
mov dword [ebp - 0xa40], eax
cmp dword [ebp - 0xa40], 1
jge 0x474a4c
mov eax, dword [ebp - 0xa40]
mov dword [ebp + eax*4 - 0xd84], 4
jmp 0x474a23
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd84]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd84], eax
jmp 0x474b04
mov dword [ebp - 0x2ccc], 1
mov dword [ebp - 0x2cc8], 1
mov dword [ebp - 0x2cc4], 1
mov dword [ebp - 0x2cc0], 1
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2ccc], 0xe864
jne 0x474ad2
mov byte [ebp - 0x358], 0
movzx eax, byte [ebp - 0x358]
test eax, eax
je 0x474ad0
push 0x11f2
push 0xb89
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x474af6
mov byte [ebp - 0x35a], 0
movzx eax, byte [ebp - 0x35a]
test eax, eax
je 0x474af6
push 0xc72
push 0x1e4d
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
cmp dword [ebp - 0x620], 0
je 0x474b04
jmp 0x4749d7
mov dword [ebp - 0x620], 0
jmp 0x474b1d
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 3
jg 0x474b34
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x26f0], eax
jmp 0x474b10
jmp 0x4749d7
mov dword [ebp - 0x644], 0
jmp 0x474b52
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 3
jge 0x474b6e
mov eax, dword [ebp - 0x644]
mov dword [ebp + eax*4 - 0x38dc], 0x3b4e
jmp 0x474b45
mov dword [ebp - 0xc4], 0x89351f20
mov dword [ebp - 0x1d10], 0xbb24adc9
mov dword [ebp - 0xdc4], 0x28ffea05
mov dword [ebp - 0xbfc], 0xffffffff
mov dword [ebp - 0x2708], 0xffffffff
mov dword [ebp - 0x838], 0
jmp 0x474bb9
mov eax, dword [ebp - 0x838]
inc eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 4
jge 0x474bd5
mov eax, dword [ebp - 0x838]
mov dword [ebp + eax*4 - 0x23e4], 0x13532fe2
jmp 0x474bac
mov dword [ebp - 0xc4], 0
jmp 0x474bee
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x474eae
mov dword [ebp - 0xbf4], 0xd672
mov dword [ebp - 0x2c4c], 0
mov dword [ebp - 0x2c48], 0
mov dword [ebp - 0x2c44], 0
mov dword [ebp - 0x2c40], 0
mov dword [ebp - 0x21c], 0
jmp 0x474c46
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x474c62
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xdb4], 0
jmp 0x474c39
mov dword [ebp - 0x21c], 0
jmp 0x474c7b
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x474c97
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x2fe4], 0xffffffff
jmp 0x474c6e
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x23e4]
mov dword [ebp - 0x1ce0], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1ce0]
mov dword [ebp + eax*4 - 0x23e4], ecx
mov eax, dword [ebp - 0x1ce0]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x23e4]
add eax, 0xbebf0a0c
mov dword [ebp - 0x26f8], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x26f8]
mov dword [ebp + eax - 0x2c4c], ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x2e60], eax
cmp dword [ebp - 0x1d10], 0
jne 0x474d15
mov dword [ebp - 0xd8c], 1
jmp 0x474d1c
and dword [ebp - 0xd8c], 0
cmp dword [ebp - 0xd8c], 0
je 0x474d31
mov dword [ebp - 0x1ce8], 1
jmp 0x474d38
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xd94], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd94]
mov dword [ebp + eax - 0xdb4], ecx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1ce8]
sub ecx, dword [ebp + eax*4 - 0x23e4]
push 4
pop eax
imul eax, eax, 0
add ecx, dword [ebp + eax - 0x23e4]
cmp dword [ebp - 0xd94], ecx
je 0x474d8b
mov dword [ebp - 0x1cf0], 1
jmp 0x474d92
and dword [ebp - 0x1cf0], 0
cmp dword [ebp - 0x1cf0], 0xffffffff
jl 0x474da7
mov dword [ebp - 0xd9c], 1
jmp 0x474dae
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
add eax, 0x18f4c6f4
cmp eax, 0x8fe7
jge 0x474dcc
mov dword [ebp - 0x1cf8], 1
jmp 0x474dd3
and dword [ebp - 0x1cf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x23e4]
add eax, dword [ebp - 0x1cf8]
cmp eax, 0x3352
jle 0x474df9
mov dword [ebp - 0xda4], 1
jmp 0x474e00
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0xbf4]
imul eax, dword [ebp - 0xda4]
cmp eax, 0xffffffff
je 0x474e1e
mov dword [ebp - 0x1d00], 1
jmp 0x474e25
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1d00], eax
jl 0x474e3f
mov dword [ebp - 0xdac], 1
jmp 0x474e46
and dword [ebp - 0xdac], 0
imul eax, dword [ebp - 0xdac], 0xfffe
cmp eax, 0xd790f958
ja 0x474e63
mov dword [ebp - 0x1d08], 1
jmp 0x474e6a
and dword [ebp - 0x1d08], 0
cmp dword [ebp - 0x1d08], 0xffffffff
jle 0x474e88
cmp dword [ebp - 0xc4], 0
je 0x474e88
mov dword [ebp - 0x2700], 1
jmp 0x474e8f
and dword [ebp - 0x2700], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xdb4]
mov dword [ebp + ecx - 0x2fe4], eax
jmp 0x474be1
mov dword [ebp - 0xc4], 1
cmp dword [ebp - 0xc4], 0
je 0x474ed6
cmp dword [ebp - 0x1d10], 0
je 0x474ed6
mov dword [ebp - 0xdbc], 1
jmp 0x474edd
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 6
jb 0x474ef2
mov dword [ebp - 0x1d18], 1
jmp 0x474ef9
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0x1d18]
neg eax
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0xbfc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x23e4]
cmp dword [ebp - 0xbfc], eax
jne 0x474f33
mov dword [ebp - 0x1d20], 1
jmp 0x474f3a
and dword [ebp - 0x1d20], 0
cmp dword [ebp - 0x1d20], 0xffffffff
jl 0x474f55
cmp dword [ebp - 0xbfc], 0
jne 0x474f55
and dword [ebp - 0xdcc], 0
jmp 0x474f5f
mov dword [ebp - 0xdcc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23e4]
cmp dword [ebp - 0xdcc], eax
jne 0x474f80
mov dword [ebp - 0x1d28], 1
jmp 0x474f87
and dword [ebp - 0x1d28], 0
mov eax, dword [ebp - 0x1d28]
mov dword [ebp - 0x2708], eax
mov dword [ebp - 0x64c], 0
jmp 0x474fac
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 2
jg 0x476640
mov dword [ebp - 0x140], 0xfff8
mov dword [ebp - 0xc04], 0x3c576436
mov dword [ebp - 0x2710], 0xffffffff
mov dword [ebp - 0x840], 0
jmp 0x474ff0
mov eax, dword [ebp - 0x840]
inc eax
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 2
jge 0x47500c
mov eax, dword [ebp - 0x840]
mov dword [ebp + eax*4 - 0x3694], 0x4a520274
jmp 0x474fe3
mov byte [ebp - 0x35c], 0
movzx eax, byte [ebp - 0x35c]
test eax, eax
je 0x475046
push 0x1830
push 0xfa1
push 0x12d
push 0x2315
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
cmp dword [ebp - 0x140], 0
jne 0x475061
cmp dword [ebp - 0x140], 0
jne 0x475061
and dword [ebp - 0x1d40], 0
jmp 0x47506b
mov dword [ebp - 0x1d40], 1
mov eax, dword [ebp - 0x140]
add eax, 6
cmp eax, dword [ebp - 0x140]
jne 0x475088
mov dword [ebp - 0xdd4], 1
jmp 0x47508f
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xdd4]
inc eax
cmp eax, dword [ebp - 0x140]
je 0x4750b3
cmp dword [ebp - 0x140], 0
je 0x4750b3
mov dword [ebp - 0x1d30], 1
jmp 0x4750ba
and dword [ebp - 0x1d30], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x1d30], eax
jne 0x4750d4
mov dword [ebp - 0xddc], 1
jmp 0x4750db
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xddc], eax
jle 0x4750fa
xor eax, eax
inc eax
je 0x4750fa
mov dword [ebp - 0x1d38], 1
jmp 0x475101
and dword [ebp - 0x1d38], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x1d38], eax
je 0x47511b
mov dword [ebp - 0xde4], 1
jmp 0x475122
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xc04]
imul eax, dword [ebp - 0x1d40]
test eax, eax
jne 0x475151
cmp dword [ebp - 0xc04], 0
jne 0x475151
and dword [ebp - 0xdec], 0
jmp 0x47515b
mov dword [ebp - 0xdec], 1
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xdec], eax
jge 0x475175
mov dword [ebp - 0x1d48], 1
jmp 0x47517c
and dword [ebp - 0x1d48], 0
mov eax, dword [ebp - 0x1d48]
mov dword [ebp - 0x2710], eax
mov dword [ebp - 0x254], 0x7ddc85f7
mov dword [ebp - 0x1d58], 0xa33a4d1b
mov dword [ebp - 0x654], 0
jmp 0x4751b5
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 2
jge 0x4751d1
mov eax, dword [ebp - 0x654]
mov dword [ebp + eax*4 - 0x2ff0], 0xf0442e11
jmp 0x4751a8
mov dword [ebp - 0x254], 0
jmp 0x4751ea
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jg 0x47537a
mov dword [ebp - 0xc0c], 0x858905b8
mov dword [ebp - 0x2720], 0x2e712c51
mov dword [ebp - 0x848], 0
jmp 0x475224
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 3
jge 0x475240
mov eax, dword [ebp - 0x848]
mov dword [ebp + eax*4 - 0x2a54], 0x9e84
jmp 0x475217
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2a54], 0
jne 0x4752ae
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2a54]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0xc0c], 0
jne 0x4752ae
mov eax, dword [ebp - 0xc0c]
cmp dword [ebp - 0x254], eax
jge 0x475284
mov dword [ebp - 0xdf4], 1
jmp 0x47528b
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0x254]
imul eax, dword [ebp - 0xdf4]
sub eax, dword [ebp - 0x254]
add eax, 0x20b2
jne 0x4752ae
and dword [ebp - 0x1d50], 0
jmp 0x4752b8
mov dword [ebp - 0x1d50], 1
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x1d50]
jle 0x4752d2
mov dword [ebp - 0xdfc], 1
jmp 0x4752d9
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0x1d58], eax
cmp dword [ebp - 0x1d58], 0x2da
jl 0x4752fd
mov dword [ebp - 0x2718], 1
jmp 0x475304
and dword [ebp - 0x2718], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a54]
mov dword [ebp - 0x2e68], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2ff0], 0
xor eax, eax
cmp eax, 0xffffffff
jae 0x47533b
mov dword [ebp - 0xe04], 1
jmp 0x475342
and dword [ebp - 0xe04], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2a54]
cmp dword [ebp - 0xe04], eax
jg 0x475362
mov dword [ebp - 0x1d60], 1
jmp 0x475369
and dword [ebp - 0x1d60], 0
mov eax, dword [ebp - 0x1d60]
mov dword [ebp - 0x2720], eax
jmp 0x4751dd
mov byte [ebp - 0x35e], 0
mov dword [ebp - 0x1f4], 0xa9d19ac1
mov dword [ebp - 0xac], 7
mov dword [ebp - 0xc14], 0x5b0
mov dword [ebp - 0x2740], 0
mov dword [ebp - 0x19c], 0
jmp 0x4753c2
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x4753de
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2b9c], 0x5ec7e011
jmp 0x4753b5
mov dword [ebp - 0x19c], 0
jmp 0x4753f7
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x475413
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2b1c], 4
jmp 0x4753ea
cmp dword [ebp - 0x1f4], 0
je 0x4754a2
cmp dword [ebp - 0x1f4], 0x19570a50
jge 0x475438
mov dword [ebp - 0xe0c], 1
jmp 0x47543f
and dword [ebp - 0xe0c], 0
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0xe0c]
jg 0x475459
mov dword [ebp - 0x1d68], 1
jmp 0x475460
and dword [ebp - 0x1d68], 0
cmp dword [ebp - 0x1d68], 1
jle 0x475475
mov dword [ebp - 0xe14], 1
jmp 0x47547c
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0xc14]
je 0x4754a2
mov dword [ebp - 0x1d70], 1
jmp 0x4754a9
and dword [ebp - 0x1d70], 0
cmp dword [ebp - 0x1d70], 0xfffffff9
jle 0x4754be
mov dword [ebp - 0x2728], 1
jmp 0x4754c5
and dword [ebp - 0x2728], 0
mov eax, 0x6eed1e12
cmp eax, 0x3f0d3ecf
jle 0x4755b2
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x1d78], 1
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2e70], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2e78], eax
cmp dword [ebp - 0x628], 0
je 0x47552b
cmp dword [ebp - 0x628], 0
je 0x47552b
mov dword [ebp - 0xe1c], 1
jmp 0x475532
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x1d78], eax
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0xe1c]
imul eax, dword [ebp - 0x628]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1d78], eax
jge 0x475572
mov dword [ebp - 0xe24], 1
jmp 0x475579
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xc14]
cmp dword [ebp - 0xe24], eax
jne 0x475593
mov dword [ebp - 0x1d80], 1
jmp 0x47559a
and dword [ebp - 0x1d80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d80]
mov dword [ebp + eax - 0x2b9c], ecx
jmp 0x47575e
mov dword [ebp - 0xe44], 0xffffffff
mov dword [ebp - 0x65c], 0
jmp 0x4755d5
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 4
jge 0x4755f1
mov eax, dword [ebp - 0x65c]
mov dword [ebp + eax*4 - 0x36cc], 0x9b8a5142
jmp 0x4755c8
mov dword [ebp - 0xac], 0x1d
jmp 0x47560a
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffb
jne 0x475743
mov dword [ebp - 0x2730], 0xbf09457
mov dword [ebp - 0x2738], 0xffffffff
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x2e80], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b9c]
mov dword [ebp - 0xe2c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe2c]
mov dword [ebp + eax - 0x36cc], ecx
imul eax, dword [ebp - 0xe2c], 3
test eax, eax
je 0x47567d
cmp dword [ebp - 0x2730], 0
je 0x47567d
mov dword [ebp - 0x1d88], 1
jmp 0x475684
and dword [ebp - 0x1d88], 0
cmp dword [ebp - 0x1d88], 0xf84b0f4
jne 0x47569c
mov dword [ebp - 0xe34], 1
jmp 0x4756a3
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0xe44]
imul eax, dword [ebp - 0xe34]
cmp eax, dword [ebp - 0x1f4]
jge 0x4756c4
mov dword [ebp - 0x1d90], 1
jmp 0x4756cb
and dword [ebp - 0x1d90], 0
cmp dword [ebp - 0x1d90], 0x420e
jle 0x4756e3
mov dword [ebp - 0xe3c], 1
jmp 0x4756ea
and dword [ebp - 0xe3c], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0xe3c], eax
je 0x475704
mov dword [ebp - 0x1d98], 1
jmp 0x47570b
and dword [ebp - 0x1d98], 0
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x1d98]
jge 0x475725
mov dword [ebp - 0x1da0], 1
jmp 0x47572c
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0xe44]
add eax, dword [ebp - 0x1da0]
mov dword [ebp - 0x2738], eax
jmp 0x4755fd
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2b1c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2b1c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2b1c], 0
je 0x47577a
mov eax, dword [ebp - 0x1f4]
imul eax, dword [ebp - 0xac]
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2b1c]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x2b1c]
test eax, eax
jne 0x4757ab
cmp dword [ebp - 0x1f4], 0
jne 0x4757ab
and dword [ebp - 0xe4c], 0
jmp 0x4757b5
mov dword [ebp - 0xe4c], 1
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xe4c]
cmp eax, 1
jb 0x4757d2
mov dword [ebp - 0x1da8], 1
jmp 0x4757d9
and dword [ebp - 0x1da8], 0
mov eax, dword [ebp - 0x1da8]
mov dword [ebp - 0x2740], eax
movzx eax, byte [ebp - 0x35e]
test eax, eax
je 0x4758f6
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x850], 0
jmp 0x475817
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 0x19
je 0x4758ce
mov dword [ebp - 0x858], 0xea983111
mov dword [ebp - 0x664], 0
jmp 0x475847
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 3
jge 0x475863
mov eax, dword [ebp - 0x664]
mov dword [ebp + eax*4 - 0x3798], 0x3a47
jmp 0x47583a
mov dword [ebp - 0x858], 0
jmp 0x47587c
mov eax, dword [ebp - 0x858]
inc eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 2
jg 0x4758a1
mov byte [ebp - 0x360], 0
movzx eax, byte [ebp - 0x360]
test eax, eax
je 0x47589f
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x47586f
mov byte [ebp - 0x32e], 0
movzx eax, byte [ebp - 0x32e]
test eax, eax
je 0x4758c9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
jmp 0x47580a
push 0x118
push 0x1c30
push 0x1c43
push 0x1bf0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x64], 0x5043c4ab
mov dword [ebp - 0x160], 1
cmp dword [ebp - 0x64], 0xfffffffe
jne 0x475919
mov dword [ebp - 0xe54], 1
jmp 0x475920
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xe54], eax
jge 0x475937
mov dword [ebp - 0x1db0], 1
jmp 0x47593e
and dword [ebp - 0x1db0], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jg 0x475952
mov dword [ebp - 0x2748], 1
jmp 0x475959
and dword [ebp - 0x2748], 0
mov dword [ebp - 0x160], 0xaab7
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2e88], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jge 0x475983
mov dword [ebp - 0x2750], 1
jmp 0x47598a
and dword [ebp - 0x2750], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2e90], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x1db0], eax
jg 0x4759ad
mov dword [ebp - 0xe5c], 1
jmp 0x4759b4
and dword [ebp - 0xe5c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xe5c], eax
jl 0x4759cb
mov dword [ebp - 0x1db8], 1
jmp 0x4759d2
and dword [ebp - 0x1db8], 0
cmp dword [ebp - 0x1db8], 0xfd5d7051
jae 0x475bb5
mov dword [ebp - 0x2bc], 2
mov dword [ebp - 0x1dd0], 0x254f8d36
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2e98], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2ea0], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x2bc], eax
jle 0x475a25
mov dword [ebp - 0xe64], 1
jmp 0x475a2c
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0xe64]
jl 0x475a46
mov dword [ebp - 0x1dc0], 1
jmp 0x475a4d
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0x1dc0]
jle 0x475a67
mov dword [ebp - 0xe6c], 1
jmp 0x475a6e
and dword [ebp - 0xe6c], 0
cmp dword [ebp - 0xe6c], 0x4a87fce6
jl 0x475b8a
mov dword [ebp - 0x66c], 0xffffffff
mov dword [ebp - 0x1dc8], 0xd994ad4d
mov dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2ea8], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x2eb0], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x1dd0], 0
je 0x475acd
cmp dword [ebp - 0x66c], 0
mov dword [ebp - 0x1dc8], 0x7342
cmp dword [ebp - 0x1dc8], 1
je 0x475af0
xor eax, eax
je 0x475af0
mov dword [ebp - 0xe74], 1
jmp 0x475af7
and dword [ebp - 0xe74], 0
imul eax, dword [ebp - 0xe74], 0x2b9c
cmp eax, dword [ebp - 0x66c]
jge 0x475b15
mov dword [ebp - 0xe7c], 1
jmp 0x475b1c
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0x1dd0]
imul eax, dword [ebp - 0xe7c]
test eax, eax
jne 0x475b3f
cmp dword [ebp - 0x2bc], 0
jne 0x475b3f
and dword [ebp - 0x1dd8], 0
jmp 0x475b49
mov dword [ebp - 0x1dd8], 1
mov eax, dword [ebp - 0x1dd8]
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0x66c]
cmp dword [ebp - 0xe84], eax
jl 0x475b6f
mov dword [ebp - 0x1de0], 1
jmp 0x475b76
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x1de0]
mov dword [ebp - 0x160], eax
jmp 0x475bb3
mov byte [ebp - 0x32f], 0
movzx eax, byte [ebp - 0x32f]
test eax, eax
je 0x475bb3
push 0x217b
push 0
push 0x1642
push 0x139d
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x475bf9
mov dword [ebp - 0x282c], 0x85ef
mov dword [ebp - 0x160], 0xffffffed
jmp 0x475bd8
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x10
jl 0x475bf9
mov dword [ebp - 0x2824], 0xe0cd5c0f
mov eax, dword [ebp - 0x2824]
mov dword [ebp - 0x282c], eax
jmp 0x475bcb
mov dword [ebp - 0x64], 0
jmp 0x475c09
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x1c
jg 0x475c27
mov dword [ebp - 0x2834], 0x4aa7fcf6
mov eax, dword [ebp - 0x2834]
mov dword [ebp - 0x160], eax
jmp 0x475c02
mov dword [ebp - 0x860], 0xf57a7c20
mov dword [ebp - 0x2eb8], 0x3c27f355
mov dword [ebp - 0x684], 0xd1883800
mov dword [ebp - 0x2ec0], 0x2510
mov dword [ebp - 0x2ec8], 0xfffffff8
mov dword [ebp - 0x868], 0x4560
mov dword [ebp - 0x2ed0], 0x54824ff2
mov dword [ebp - 0x2ed8], 0x3a6950e6
mov dword [ebp - 0x5c], 0
jmp 0x475c87
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x475c9d
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x3764], 0x7862fd41
jmp 0x475c80
mov dword [ebp - 0x5c], 0
jmp 0x475cad
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x475cc3
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x38a0], 0x66a7
jmp 0x475ca6
mov dword [ebp - 0x5c], 0
jmp 0x475cd3
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x475ce9
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x38ec], 0x5c7e4ddb
jmp 0x475ccc
mov dword [ebp - 0x860], 0
jmp 0x475d02
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 1
jg 0x475e31
mov dword [ebp - 0x2ee0], 0x9a924c00
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0xe8c], 0xeaf79217
mov dword [ebp - 0x674], 0
jmp 0x475d46
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 1
jge 0x475d62
mov eax, dword [ebp - 0x674]
mov dword [ebp + eax*4 - 0x2ee8], 0x49f6d4a0
jmp 0x475d39
mov eax, dword [ebp - 0xe8c]
dec eax
mov dword [ebp - 0xe8c], eax
mov dword [ebp - 0x868], 0x11
jmp 0x475d88
mov eax, dword [ebp - 0x868]
dec eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 0xffffffe5
jne 0x475e2c
mov dword [ebp - 0x67c], 0xfffffff7
jmp 0x475dae
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0xf
je 0x475e09
mov dword [ebp - 0x870], 0
jmp 0x475dd0
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 2
jge 0x475dec
mov eax, dword [ebp - 0x870]
mov dword [ebp + eax*4 - 0x2b54], 0xffff
jmp 0x475dc3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b54]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2b54], eax
jmp 0x475da1
mov byte [ebp - 0x331], 0
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x475e27
push 0
push 0x4e
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
jmp 0x475d7b
jmp 0x475cf5
mov dword [ebp - 0x684], 0
jmp 0x475e4a
mov eax, dword [ebp - 0x684]
dec eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0xffffffec
jg 0x475eac
mov dword [ebp - 0x283c], 0
mov dword [ebp - 0x2844], 0xffffffff
cmp dword [ebp - 0x283c], 0xfff7
ja 0x475e7f
mov dword [ebp - 0x1de8], 1
jmp 0x475e86
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0x1de8]
mov dword [ebp - 0x2844], eax
mov byte [ebp - 0x333], 0
movzx eax, byte [ebp - 0x333]
test eax, eax
je 0x475eaa
call dword [sym.imp.GDI32.dll_GdiFlush]
jmp 0x475e3d
mov byte [ebp - 0x376], 0
mov dword [ebp - 0x540], 0xfffffff6
mov dword [ebp - 0x284c], 0
mov dword [ebp - 0x878], 0
jmp 0x475ee0
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 3
jge 0x475efc
mov eax, dword [ebp - 0x878]
mov dword [ebp + eax*4 - 0x3810], 0x5fb26c4f
jmp 0x475ed3
cmp dword [ebp - 0x540], 0
je 0x475f55
mov byte [ebp - 0x335], 0
movzx eax, byte [ebp - 0x335]
test eax, eax
je 0x475f37
push 0
push 0x2035
push 0x15a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov byte [ebp - 0x337], 0
movzx eax, byte [ebp - 0x337]
test eax, eax
je 0x475f53
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x475f74
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x475f74
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x540], 0xfffffff5
jmp 0x475f8d
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0xfffffff8
jle 0x4761a4
mov dword [ebp - 0x264], 0x816210b9
mov dword [ebp - 0x630], 0x28c7fffa
mov dword [ebp - 0x264], 0
jmp 0x475fc7
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xffffffe7
je 0x47610a
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x180], 0xffffffec
jmp 0x475ff7
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffec
jle 0x476028
mov byte [ebp - 0x33b], 0
movzx eax, byte [ebp - 0x33b]
test eax, eax
je 0x476026
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x475fea
cmp dword [ebp - 0x284c], 0
jne 0x4760c9
cmp dword [ebp - 0x180], 0xffffffff
jne 0x476050
cmp dword [ebp - 0x180], 0
jne 0x476050
and dword [ebp - 0xe94], 0
jmp 0x47605a
mov dword [ebp - 0xe94], 1
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0xe94], eax
jge 0x476074
mov dword [ebp - 0x1df0], 1
jmp 0x47607b
and dword [ebp - 0x1df0], 0
cmp dword [ebp - 0x1df0], 1
jbe 0x476090
mov dword [ebp - 0xe9c], 1
jmp 0x476097
and dword [ebp - 0xe9c], 0
mov eax, dword [ebp - 0x540]
add eax, dword [ebp - 0xe9c]
mov ecx, 0xe9d60a22
sub ecx, eax
cmp ecx, 1
je 0x4760b6
cmp dword [ebp - 0x180], 0
mov eax, 0x9a9b8fa4
cmp eax, 0xfffffffa
jb 0x4760c9
mov dword [ebp - 0x1df8], 1
mov eax, dword [ebp - 0x1df8]
add eax, 0xf54c
cmp eax, dword [ebp - 0x180]
jge 0x4760f2
mov dword [ebp - 0xea4], 1
jmp 0x4760f9
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x630], eax
jmp 0x475fba
mov dword [ebp - 0x264], 0
jmp 0x476123
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jg 0x47619f
mov dword [ebp - 0x630], 2
jmp 0x476145
mov eax, dword [ebp - 0x630]
dec eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
jl 0x476168
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x476166
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x476138
mov byte [ebp - 0x374], 0
movzx eax, byte [ebp - 0x374]
test eax, eax
je 0x47619a
push 0
push 0x2035
push 0x15a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x476116
jmp 0x475f80
movzx eax, byte [ebp - 0x376]
test eax, eax
je 0x47663b
mov dword [ebp - 0x234], 0xa9d19ac1
mov dword [ebp - 0xbc], 7
mov dword [ebp - 0xc1c], 0x5b0
mov dword [ebp - 0x286c], 0
mov dword [ebp - 0x1a4], 0
jmp 0x4761f4
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x476210
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x2bcc], 0x5ec7e011
jmp 0x4761e7
mov dword [ebp - 0x1a4], 0
jmp 0x476229
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 4
jge 0x476245
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x2b34], 4
jmp 0x47621c
cmp dword [ebp - 0x234], 0
je 0x4762d4
cmp dword [ebp - 0x234], 0x19570a50
jge 0x47626a
mov dword [ebp - 0x1e00], 1
jmp 0x476271
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x1e00]
jg 0x47628b
mov dword [ebp - 0xeac], 1
jmp 0x476292
and dword [ebp - 0xeac], 0
cmp dword [ebp - 0xeac], 1
jle 0x4762a7
mov dword [ebp - 0x1e08], 1
jmp 0x4762ae
and dword [ebp - 0x1e08], 0
mov eax, dword [ebp - 0x1e08]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc1c]
je 0x4762d4
and dword [ebp - 0xeb4], 0
cmp dword [ebp - 0xeb4], 0xfffffff9
jle 0x4762f0
mov dword [ebp - 0x2854], 1
jmp 0x4762f7
and dword [ebp - 0x2854], 0
mov eax, 0x6eed1e12
cmp eax, 0x3f0d3ecf
jle 0x4763e4
mov dword [ebp - 0x638], 1
mov dword [ebp - 0xebc], 1
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x2ef0], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x2ef8], eax
cmp dword [ebp - 0x638], 0
je 0x47635d
cmp dword [ebp - 0x638], 0
je 0x47635d
and dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0xebc], eax
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x1e10]
imul eax, dword [ebp - 0x638]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xebc], eax
jge 0x4763a4
mov dword [ebp - 0x1e38], 0xffffffff
mov dword [ebp - 0x68c], 0
jmp 0x476407
cmp dword [ebp - 0x68c], 4
jge 0x476423
jmp 0x474f9f
mov dword [ebp - 0x2f08], 0x3eca
mov byte [ebp - 0x378], 0
movzx eax, byte [ebp - 0x378]
test eax, eax
je 0x476664
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp - 0x37a], 0
movzx eax, byte [ebp - 0x37a]
test eax, eax
je 0x47669e
push 0x118
push 0x1c30
push 0x1c43
push 0x1bf0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0xefc], 0x90350d8a
mov dword [ebp - 0x1e58], 0x5b3847d2
mov dword [ebp - 0x3b8], 0xd7feae21
mov dword [ebp - 0x2ec], 0x5d732ada
mov dword [ebp - 0x880], 0
jmp 0x4766e6
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 3
jge 0x476702
mov eax, dword [ebp - 0x880]
mov dword [ebp + eax*4 - 0x2a9c], 0
jmp 0x4766d9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2f10], eax
cmp dword [ebp - 0x30], 4
jg 0x47671d
mov dword [ebp - 0x1e48], 1
jmp 0x476724
and dword [ebp - 0x1e48], 0
cmp dword [ebp - 0x1e48], 7
jb 0x476739
mov dword [ebp - 0xef4], 1
jmp 0x476740
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0xef4]
sub eax, 0x1adaf619
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x47675f
mov dword [ebp - 0x1e50], 1
jmp 0x476766
and dword [ebp - 0x1e50], 0
mov eax, dword [ebp - 0x1e50]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0xefc]
mov dword [ebp - 0x1e58], eax
mov eax, dword [ebp - 0x1e58]
cmp dword [ebp - 0x30], eax
jle 0x476795
mov dword [ebp - 0xf04], 1
jmp 0x47679c
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xf04], eax
jne 0x4767b3
mov dword [ebp - 0x1e60], 1
jmp 0x4767ba
and dword [ebp - 0x1e60], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1e60], eax
jle 0x4767d1
mov dword [ebp - 0xf0c], 1
jmp 0x4767d8
and dword [ebp - 0xf0c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xf0c], eax
jl 0x4767ef
mov dword [ebp - 0x1e68], 1
jmp 0x4767f6
and dword [ebp - 0x1e68], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1e68], eax
jge 0x47680d
mov dword [ebp - 0xf14], 1
jmp 0x476814
and dword [ebp - 0xf14], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0xf14]
cmp dword [ebp - 0x30], eax
jge 0x47682e
mov dword [ebp - 0x1e70], 1
jmp 0x476835
and dword [ebp - 0x1e70], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1e70], eax
jle 0x47684c
mov dword [ebp - 0xf1c], 1
jmp 0x476853
and dword [ebp - 0xf1c], 0
mov eax, dword [ebp - 0xf1c]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3b8], eax
jl 0x476876
mov dword [ebp - 0x1e78], 1
jmp 0x47687d
and dword [ebp - 0x1e78], 0
mov eax, dword [ebp - 0x1e78]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2ec], 2
jmp 0x4768a2
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jl 0x476a23
mov dword [ebp - 0xf24], 0xe10ef7d5
mov dword [ebp - 0x28d4], 0xfffffff6
mov dword [ebp - 0x28dc], 1
mov dword [ebp - 0x694], 0
jmp 0x4768e6
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 3
jge 0x476902
mov eax, dword [ebp - 0x694]
mov dword [ebp + eax*4 - 0x35e4], 0x63cfebda
jmp 0x4768d9
mov dword [ebp - 0x30], 0
jmp 0x476912
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x476950
mov dword [ebp - 0x3b8], 2
jmp 0x476931
mov eax, dword [ebp - 0x3b8]
dec eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
jl 0x47694e
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp + eax*4 - 0x2a9c], 0
je 0x47694c
jmp 0x47694e
jmp 0x476924
jmp 0x47690b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2a9c]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0xf24]
cmp dword [ebp - 0x2ec], eax
jne 0x47697c
mov dword [ebp - 0x1e80], 1
jmp 0x476983
and dword [ebp - 0x1e80], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x35e4], 0xffff
cmp dword [ebp - 0x1e80], 0xffff
jne 0x4769ab
mov dword [ebp - 0xf2c], 1
jmp 0x4769b2
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp + eax*4 - 0x2a9c]
sub eax, dword [ebp - 0xf2c]
add eax, 0xf544
mov ecx, dword [ebp - 0x2ec]
cmp eax, dword [ebp + ecx*4 - 0x2a9c]
je 0x4769e5
mov dword [ebp - 0x1e88], 1
jmp 0x4769ec
and dword [ebp - 0x1e88], 0
cmp dword [ebp - 0x1e88], 0xffffffff
jge 0x476a01
mov dword [ebp - 0xf34], 1
jmp 0x476a08
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0xf34]
mov dword [ebp - 0x28d4], eax
mov dword [ebp - 0x28dc], 0xf3734bd4
jmp 0x476895
mov byte [ebp - 0x380], 0
mov dword [ebp - 0xc], 0xb7c7ce53
mov dword [ebp - 0x1ea0], 0xc6fe23a2
mov dword [ebp - 0x69c], 0xfffffffe
mov dword [ebp - 0x3c8], 0xa3d7f191
mov dword [ebp - 0xf5c], 0x7f4039ee
mov dword [ebp - 0x888], 0
jmp 0x476a72
mov eax, dword [ebp - 0x888]
inc eax
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 1
jge 0x476a8b
mov eax, dword [ebp - 0x888]
mov dword [ebp + eax*4 - 0x6c], 0xfffb
jmp 0x476a65
mov dword [ebp - 0xc], 0
jmp 0x476a9b
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x476e74
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x1ea0], eax
jge 0x476acd
mov dword [ebp - 0x1e90], 1
jmp 0x476ad4
and dword [ebp - 0x1e90], 0
cmp dword [ebp - 0x1e90], 0xfffffffe
jg 0x476ae9
mov dword [ebp - 0xf3c], 1
jmp 0x476af0
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0xf3c], eax
jg 0x476b0a
mov dword [ebp - 0x1e98], 1
jmp 0x476b11
and dword [ebp - 0x1e98], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x1e98], eax
jg 0x476b2c
mov dword [ebp - 0xf44], 1
jmp 0x476b33
and dword [ebp - 0xf44], 0
mov eax, dword [ebp - 0xf44]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x1ea0]
cmp dword [ebp - 0x69c], eax
jl 0x476b59
mov dword [ebp - 0x28e4], 1
jmp 0x476b60
and dword [ebp - 0x28e4], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f20], eax
mov eax, dword [ebp - 0xc]
mov ecx, 0xe6f7
sub ecx, dword [ebp + eax*4 - 0x6c]
cmp ecx, dword [ebp - 0x3c8]
je 0x476b8d
mov dword [ebp - 0xf4c], 1
jmp 0x476b94
and dword [ebp - 0xf4c], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0xf4c], eax
jg 0x476bae
mov dword [ebp - 0x1ea8], 1
jmp 0x476bb5
and dword [ebp - 0x1ea8], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x1ea8], eax
jle 0x476bd0
mov dword [ebp - 0xf54], 1
jmp 0x476bd7
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 0xf54]
mov dword [ebp - 0xf5c], eax
mov dword [ebp - 0x3c8], 0
jmp 0x476bfc
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
jg 0x476e6f
mov dword [ebp - 0x3c0], 7
mov dword [ebp - 0xc24], 0xb6f2ba10
mov dword [ebp - 0x28f4], 0x1fa46b4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0x6c]
cmp dword [ebp + eax*4 - 0x6c], ecx
jle 0x476c43
mov dword [ebp - 0x1eb0], 1
jmp 0x476c4a
and dword [ebp - 0x1eb0], 0
cmp dword [ebp - 0x1eb0], 1
jne 0x476c5f
mov dword [ebp - 0x1eb8], 1
jmp 0x476c66
and dword [ebp - 0x1eb8], 0
mov eax, dword [ebp - 0xf5c]
cmp eax, dword [ebp - 0x1eb8]
jle 0x476c80
mov dword [ebp - 0x1ec0], 1
jmp 0x476c87
and dword [ebp - 0x1ec0], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x3c0]
cmp dword [ebp + eax*4 - 0x6c], ecx
je 0x476ca2
mov dword [ebp - 0xf64], 1
jmp 0x476ca9
and dword [ebp - 0xf64], 0
imul eax, dword [ebp - 0xf64], 0xffffffff
cmp dword [ebp - 0x1ec0], eax
jle 0x476cd4
mov byte [ebp - 0x37c], 0
movzx eax, byte [ebp - 0x37c]
test eax, eax
je 0x476cd2
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x476d12
mov dword [ebp - 0x3c0], 0
jmp 0x476ced
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jl 0x476d12
mov byte [ebp - 0x37e], 0
movzx eax, byte [ebp - 0x37e]
test eax, eax
je 0x476d10
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x476ce0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f28], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f30], eax
cmp dword [ebp - 0x69c], 0
jle 0x476d41
mov dword [ebp - 0x28ec], 1
jmp 0x476d48
and dword [ebp - 0x28ec], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f38], eax
cmp dword [ebp - 0xc24], 0
je 0x476d73
mov eax, 0xbf6
test eax, eax
je 0x476d73
mov dword [ebp - 0xf6c], 1
jmp 0x476d7a
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0xf6c]
cmp eax, 0xd497
jge 0x476d97
mov dword [ebp - 0x1ec8], 1
jmp 0x476d9e
and dword [ebp - 0x1ec8], 0
mov eax, dword [ebp - 0x1ec8]
sub eax, dword [ebp - 0x3c0]
jne 0x476db5
mov eax, 0x97eedf66
test eax, eax
je 0x476dcb
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x6c], 0
je 0x476dcb
mov dword [ebp - 0xf74], 1
jmp 0x476dd2
and dword [ebp - 0xf74], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x3c0]
imul ecx, dword [ebp - 0xf74]
sub ecx, 7
cmp dword [ebp + eax*4 - 0x6c], ecx
je 0x476df7
mov dword [ebp - 0x1ed0], 1
jmp 0x476dfe
and dword [ebp - 0x1ed0], 0
mov eax, dword [ebp - 0xc24]
cmp dword [ebp - 0x1ed0], eax
jle 0x476e18
mov dword [ebp - 0xf7c], 1
jmp 0x476e1f
and dword [ebp - 0xf7c], 0
mov eax, dword [ebp - 0x28f4]
cmp dword [ebp - 0xf7c], eax
jl 0x476e39
mov dword [ebp - 0x1ed8], 1
jmp 0x476e40
and dword [ebp - 0x1ed8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1ed8], eax
jl 0x476e57
mov dword [ebp - 0xf84], 1
jmp 0x476e5e
and dword [ebp - 0xf84], 0
mov eax, dword [ebp - 0xf84]
mov dword [ebp - 0xc24], eax
jmp 0x476bef
jmp 0x476a94
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 0x380]
test eax, eax
je 0x476f4f
mov dword [ebp - 0x26c], 0x60477862
mov dword [ebp - 0x890], 0
jmp 0x476eaf
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 3
jge 0x476ecb
mov eax, dword [ebp - 0x890]
mov dword [ebp + eax*4 - 0x35fc], 5
jmp 0x476ea2
mov dword [ebp - 0x26c], 0
jmp 0x476ee4
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xb
jle 0x476f04
mov dword [ebp - 0x28fc], 1
cmp dword [ebp - 0x28fc], 0
je 0x476f02
jmp 0x476f04
jmp 0x476ed7
mov dword [ebp - 0x26c], 0xfffffff2
jmp 0x476f1d
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 4
jg 0x476f39
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x35fc], 0xfffffff8
jmp 0x476f10
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [ebp + 8], 2
jl 0x488325
mov dword [ebp - 0x2c4], 0x1e559696
mov dword [ebp - 0x6a4], 0
jmp 0x476f7c
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 1
jge 0x476f98
mov eax, dword [ebp - 0x6a4]
mov dword [ebp + eax*4 - 0x2f40], 1
jmp 0x476f6f
mov dword [ebp - 0x2c4], 0
jmp 0x476fb1
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jg 0x476fe7
mov byte [ebp - 0x382], 0
movzx eax, byte [ebp - 0x382]
test eax, eax
je 0x476fe5
push 0x1e84
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x476fa4
mov dword [ebp - 0x2c4], 0
jmp 0x477000
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jg 0x47702f
mov byte [ebp - 0x384], 0
movzx eax, byte [ebp - 0x384]
test eax, eax
je 0x47702d
push 0
push 0x1bed
push 0xf1f
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x476ff3
mov dword [ebp - 0x564], 0x9c4c
mov dword [ebp - 0x274], 0xffffffff
mov dword [ebp - 0x1f00], 0xffffffff
mov dword [ebp - 0x290c], 0x35dd253d
mov dword [ebp - 0x1ac], 0
jmp 0x477070
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x47708c
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xa80], 1
jmp 0x477063
mov dword [ebp - 0x1ac], 0
jmp 0x4770a5
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x4770c1
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x3614], 0xfffe
jmp 0x477098
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x1ee0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1ee0]
mov dword [ebp + eax - 0xa80], ecx
cmp dword [ebp - 0x1ee0], 0
je 0x477111
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xa80]
cmp dword [ebp + eax - 0xa80], ecx
jg 0x477111
mov dword [ebp - 0xf8c], 1
jmp 0x477118
and dword [ebp - 0xf8c], 0
cmp dword [ebp - 0x564], 0x8e17
jle 0x477130
mov dword [ebp - 0x1ee8], 1
jmp 0x477137
and dword [ebp - 0x1ee8], 0
mov eax, dword [ebp - 0xf8c]
cmp eax, dword [ebp - 0x1ee8]
jl 0x477151
mov dword [ebp - 0xf94], 1
jmp 0x477158
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0xf94]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xd7249aae
je 0x477189
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa80], 0
jne 0x477189
and dword [ebp - 0x1ef0], 0
jmp 0x477193
mov dword [ebp - 0x1ef0], 1
cmp dword [ebp - 0x1ef0], 0xffffffff
jge 0x4771b5
mov dword [ebp - 0xf9c], 0x4cd49598
mov eax, dword [ebp - 0xf9c]
dec eax
mov dword [ebp - 0xf9c], eax
jmp 0x47720e
mov dword [ebp - 0x2904], 0x912530a9
mov dword [ebp - 0x2904], 0xa3dfad5b
mov dword [ebp - 0x274], 0
jmp 0x4771e2
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xfffffff1
jl 0x47720e
mov byte [ebp - 0x386], 0
movzx eax, byte [ebp - 0x386]
test eax, eax
je 0x47720c
push 0
push 0
push 0x561
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x4771d5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa80]
mov dword [ebp - 0x2f48], eax
xor eax, eax
inc eax
je 0x47723b
cmp dword [ebp - 0x564], 0
je 0x47723b
mov dword [ebp - 0x1ef8], 1
jmp 0x477242
and dword [ebp - 0x1ef8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa80]
mov dword [ebp - 0x2f50], eax
mov eax, dword [ebp - 0x1ef8]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2f58], eax
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2f60], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3614], 0x8fad7494
jbe 0x477298
mov dword [ebp - 0xfa4], 1
jmp 0x47729f
and dword [ebp - 0xfa4], 0
mov eax, dword [ebp - 0xfa4]
mov dword [ebp - 0x1f00], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa80]
cmp dword [ebp - 0x1f00], eax
jg 0x4772cc
mov dword [ebp - 0xc2c], 1
jmp 0x4772d3
and dword [ebp - 0xc2c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp + eax - 0xa80], ecx
mov eax, dword [ebp - 0xc2c]
sub eax, dword [ebp - 0x564]
jne 0x477300
mov dword [ebp - 0xfac], 1
jmp 0x477307
and dword [ebp - 0xfac], 0
cmp dword [ebp - 0xfac], 0xffffffff
jle 0x47731c
mov dword [ebp - 0x1f08], 1
jmp 0x477323
and dword [ebp - 0x1f08], 0
cmp dword [ebp - 0x1f08], 0xffffffff
jg 0x477338
mov dword [ebp - 0xfb4], 1
jmp 0x47733f
and dword [ebp - 0xfb4], 0
mov eax, dword [ebp - 0xfb4]
mov dword [ebp - 0x290c], eax
mov dword [ebp - 0x148], 0xfffffffe
mov dword [ebp - 0x548], 2
mov dword [ebp - 0x898], 0xa5d840df
mov dword [ebp - 0xfe4], 0xfffffffe
mov dword [ebp - 0xc5c], 0x1defcecb
mov dword [ebp - 0xc54], 3
mov dword [ebp - 0xb9c], 0x55db
mov dword [ebp - 0xaac], 0x7c2657a7
mov dword [ebp - 0x2968], 0x6dcb0c7b
mov dword [ebp - 0x604], 0xfffffff6
mov dword [ebp - 0xaa4], 0xa2ca01dc
mov dword [ebp - 0xc64], 1
mov dword [ebp - 0x18], 0
jmp 0x4773d3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x4773e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x238c], 0xffffffff
jmp 0x4773cc
mov dword [ebp - 0x18], 0
jmp 0x4773f9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x47740f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2884], 0xcb64b693
jmp 0x4773f2
mov dword [ebp - 0x18], 0
jmp 0x47741f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x477435
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x600], 7
jmp 0x477418
mov dword [ebp - 0x18], 0
jmp 0x477445
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x47745b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2878], 0xfffffffc
jmp 0x47743e
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x148]
jmp 0x477475
and dword [ebp - 0x1f10], 0
cmp dword [ebp - 0x1f10], 0xe7ad53a3
jae 0x477494
mov dword [ebp - 0xfbc], 1
jmp 0x47749b
and dword [ebp - 0xfbc], 0
mov eax, dword [ebp - 0x548]
add eax, dword [ebp - 0xfbc]
cmp eax, dword [ebp - 0x548]
jne 0x4774bb
mov dword [ebp - 0x1f18], 1
jmp 0x4774c2
and dword [ebp - 0x1f18], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x1f18], eax
jge 0x4774dc
mov dword [ebp - 0xfc4], 1
jmp 0x4774e3
and dword [ebp - 0xfc4], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0xfc4], eax
jge 0x4774fd
mov dword [ebp - 0x1f20], 1
jmp 0x477504
and dword [ebp - 0x1f20], 0
mov eax, dword [ebp - 0x1f20]
sub eax, dword [ebp - 0x548]
je 0x477527
mov eax, 0x281c
test eax, eax
je 0x477527
mov dword [ebp - 0xfcc], 1
jmp 0x47752e
and dword [ebp - 0xfcc], 0
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x148], 0
jne 0x47754f
mov dword [ebp - 0x1f28], 1
jmp 0x477556
and dword [ebp - 0x1f28], 0
cmp dword [ebp - 0x1f28], 8
jl 0x47756b
mov dword [ebp - 0xfd4], 1
jmp 0x477572
and dword [ebp - 0xfd4], 0
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0xfd4]
jge 0x47758c
mov dword [ebp - 0x1f30], 1
jmp 0x477593
and dword [ebp - 0x1f30], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xfdc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfdc]
mov dword [ebp + eax - 0x238c], ecx
imul eax, dword [ebp - 0x1f30], 0x14b8
sub eax, dword [ebp - 0x548]
mov dword [ebp - 0x1f38], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f38]
mov dword [ebp + eax - 0x2884], ecx
mov eax, dword [ebp - 0xfdc]
add eax, dword [ebp - 0x1f38]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0xfe4]
mov dword [ebp - 0x1f40], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f40]
mov dword [ebp + eax - 0x600], ecx
cmp dword [ebp - 0x1f40], 0xffffffff
jle 0x477621
mov dword [ebp - 0xfec], 1
jmp 0x477628
and dword [ebp - 0xfec], 0
cmp dword [ebp - 0xfec], 0xfecafe8
jle 0x477640
mov dword [ebp - 0x1f48], 1
jmp 0x477647
and dword [ebp - 0x1f48], 0
mov eax, dword [ebp - 0x1f48]
sub eax, 0x27b6e0e7
mov dword [ebp - 0xc5c], eax
je 0x477676
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x600], 0
je 0x477676
and dword [ebp - 0xff4], 0
cmp dword [ebp - 0xff4], 0
jge 0x477692
cmp dword [ebp + 8], 1
jne 0x48c683
mov dword [ebp - 0x448], 0x81de9829
mov dword [ebp - 0x208], 0
jmp 0x488352
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x48836e
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x1830], 0xffffffff
jmp 0x488345
mov dword [ebp - 0x208], 0
jmp 0x488387
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x4883a3
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xc84], 0x5223fa3a
jmp 0x48837a
mov byte [ebp - 0x3b9], 0
movzx eax, byte [ebp - 0x3b9]
test eax, eax
je 0x4883c4
push 0x17de
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc84], 0xc447
jne 0x4883e2
mov dword [ebp - 0x1808], 1
jmp 0x4883e9
and dword [ebp - 0x1808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc84]
cmp dword [ebp - 0x1808], eax
je 0x48840a
mov dword [ebp - 0x1810], 1
jmp 0x488411
and dword [ebp - 0x1810], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x1810]
sub edx, dword [ebp + ecx - 0xc84]
cmp dword [ebp + eax - 0xc84], edx
jle 0x48843e
mov dword [ebp - 0x272c], 1
jmp 0x488445
and dword [ebp - 0x272c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc84]
mov dword [ebp - 0x3208], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc84]
add eax, 0x4055
cmp eax, 0x15cc48b1
jne 0x48847d
mov dword [ebp - 0x1818], 1
jmp 0x488484
and dword [ebp - 0x1818], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc84]
cmp dword [ebp - 0x1818], eax
je 0x4884a4
mov dword [ebp - 0x27f4], 1
jmp 0x4884ab
and dword [ebp - 0x27f4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc84]
mov dword [ebp - 0x3120], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc84]
mov dword [ebp - 0x30dc], eax
mov eax, dword [ebp - 0x448]
inc eax
inc eax
jne 0x4884eb
cmp dword [ebp - 0x448], 0
jne 0x4884eb
and dword [ebp - 0x1820], 0
jmp 0x4884f5
mov dword [ebp - 0x1820], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc84]
imul eax, dword [ebp - 0x1820]
test eax, eax
je 0x488527
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc84], 0
je 0x488527
mov dword [ebp - 0x1828], 1
jmp 0x48852e
and dword [ebp - 0x1828], 0
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x1828], eax
jg 0x488548
mov dword [ebp - 0x1840], 1
jmp 0x48854f
and dword [ebp - 0x1840], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1830]
inc eax
mov dword [ebp - 0x1838], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1838]
mov dword [ebp + eax - 0x1830], ecx
mov eax, dword [ebp - 0x1838]
cmp eax, dword [ebp - 0x1840]
jg 0x4885ae
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x4885ac
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4885ec
mov dword [ebp - 0x448], 0
jmp 0x4885c7
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0x17
jle 0x4885ec
mov byte [ebp - 0x429], 0
movzx eax, byte [ebp - 0x429]
test eax, eax
je 0x4885ea
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x4885ba
call fcn.004739fb
mov dword [ebp - 0xb18], 0x82104667
mov dword [ebp - 0x1888], 0x39150040
mov dword [ebp - 0x830], 0
jmp 0x48861e
mov eax, dword [ebp - 0x830]
inc eax
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 1
jge 0x48863a
mov eax, dword [ebp - 0x830]
mov dword [ebp + eax*4 - 0xd0], 0x5d6c05ba
jmp 0x488611
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd0], 2
jmp 0x488668
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0x1d
jge 0x488943
mov dword [ebp - 0x5c0], 0xa6e6
mov dword [ebp - 0x210], 0
jmp 0x48869f
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x4886bb
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x2afc], 0xca8c98aa
jmp 0x488692
mov dword [ebp - 0x210], 0
jmp 0x4886d4
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x4886f0
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x308c], 0x54ab1007
jmp 0x4886c7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
jne 0x4887c4
mov dword [ebp - 0xb18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0xb18], eax
jne 0x48872f
mov dword [ebp - 0x1848], 1
jmp 0x488736
and dword [ebp - 0x1848], 0
cmp dword [ebp - 0x1848], 0x6619
jge 0x48874e
mov dword [ebp - 0x1850], 1
jmp 0x488755
and dword [ebp - 0x1850], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x1850], eax
jge 0x48877f
mov eax, 0x51dd2e9
test eax, eax
je 0x48877f
mov dword [ebp - 0x1858], 1
jmp 0x488786
and dword [ebp - 0x1858], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1858]
sub ecx, dword [ebp + eax - 0xd0]
mov dword [ebp - 0x1860], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1860]
mov dword [ebp + eax - 0x2afc], ecx
cmp dword [ebp - 0x1860], 6
ja 0x4887c4
and dword [ebp - 0x2734], 0
jmp 0x4887ce
mov dword [ebp - 0x2734], 1
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x3584], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x2afc]
imul eax, eax, 9
cmp eax, 0x4b05ef13
jge 0x48880b
mov dword [ebp - 0x1868], 1
jmp 0x488812
and dword [ebp - 0x1868], 0
cmp dword [ebp - 0x1868], 0xfffffff7
jg 0x488827
mov dword [ebp - 0x1870], 1
jmp 0x48882e
and dword [ebp - 0x1870], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp eax, dword [ebp - 0x1870]
jg 0x48884f
mov dword [ebp - 0x1878], 1
jmp 0x488856
and dword [ebp - 0x1878], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x1878], eax
jg 0x488877
mov dword [ebp - 0x27fc], 1
jmp 0x48887e
and dword [ebp - 0x27fc], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x30e4], eax
cmp dword [ebp - 0x5c0], 0
jge 0x48889f
mov dword [ebp - 0x1880], 1
jmp 0x4888a6
and dword [ebp - 0x1880], 0
mov eax, dword [ebp - 0x1880]
mov dword [ebp - 0x1888], eax
cmp dword [ebp - 0x1888], 0
jne 0x4888c7
mov dword [ebp - 0x1890], 1
jmp 0x4888ce
and dword [ebp - 0x1890], 0
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x1890]
jge 0x4888e8
mov dword [ebp - 0x1898], 1
jmp 0x4888ef
and dword [ebp - 0x1898], 0
mov eax, dword [ebp - 0x5c0]
cmp dword [ebp - 0x1898], eax
jle 0x48890f
cmp dword [ebp - 0xb18], 0
jne 0x48890f
and dword [ebp - 0x18a0], 0
jmp 0x488919
mov dword [ebp - 0x18a0], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x18a0]
mov dword [ebp + eax - 0x308c], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
je 0x48893e
jmp 0x488943
jmp 0x48864d
mov byte [ebp - 0x373], 0
movzx eax, byte [ebp - 0x373]
test eax, eax
je 0x488964
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [ebp - 0xb30], 0xc90a35f3
mov dword [ebp - 0xb28], 1
mov dword [ebp - 0x18d0], 7
mov dword [ebp - 0x2400], 0xffffffff
mov dword [ebp - 0x648], 0x16ffa942
mov dword [ebp - 0xb20], 1
mov dword [ebp - 0x18f0], 0x9bf4
mov dword [ebp - 0x2814], 0xfff6
mov dword [ebp - 0x1900], 0xfffffff9
mov dword [ebp - 0x640], 0
jmp 0x4889d7
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 2
jge 0x4889f3
mov eax, dword [ebp - 0x640]
mov dword [ebp + eax*4 - 0xa88], 1
jmp 0x4889ca
cmp dword [ebp - 0xb28], 0
jne 0x488b4e
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x3318], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa88]
inc eax
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xa88]
cmp eax, dword [ebp - 0xb20]
jge 0x488a3b
mov dword [ebp - 0x18a8], 1
jmp 0x488a42
and dword [ebp - 0x18a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa88]
cmp dword [ebp - 0x18a8], eax
jge 0x488a63
mov dword [ebp - 0x273c], 1
jmp 0x488a6a
and dword [ebp - 0x273c], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x2804], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa88]
inc eax
mov dword [ebp - 0x2744], eax
mov eax, dword [ebp - 0x648]
inc eax
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x2804]
cmp eax, dword [ebp - 0x2744]
jl 0x488ab1
mov dword [ebp - 0x18b0], 1
jmp 0x488ab8
and dword [ebp - 0x18b0], 0
cmp dword [ebp - 0x18b0], 1
jge 0x488ad3
cmp dword [ebp - 0x648], 0
jne 0x488ad3
and dword [ebp - 0x280c], 0
jmp 0x488add
mov dword [ebp - 0x280c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa88]
mov dword [ebp - 0x30ec], eax
cmp dword [ebp - 0x18d0], 0
jne 0x488b05
mov dword [ebp - 0x18b8], 1
jmp 0x488b0c
and dword [ebp - 0x18b8], 0
mov eax, dword [ebp - 0x18b8]
mov dword [ebp - 0xb20], eax
cmp dword [ebp - 0xb20], 0
jne 0x488b31
push 9
pop eax
test eax, eax
jne 0x488b31
and dword [ebp - 0x18c0], 0
jmp 0x488b3b
mov dword [ebp - 0x18c0], 1
mov eax, dword [ebp - 0x18c0]
neg eax
jne 0x488b4e
and dword [ebp - 0x18c8], 0
jmp 0x488b58
mov dword [ebp - 0x18c8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa88]
cmp dword [ebp - 0x18c8], eax
jl 0x488b79
mov dword [ebp - 0x274c], 1
jmp 0x488b80
and dword [ebp - 0x274c], 0
mov eax, dword [ebp - 0x18d0]
mov dword [ebp - 0x3438], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa88], 0x241d88c9
jg 0x488bab
mov dword [ebp - 0x18d8], 1
jmp 0x488bb2
and dword [ebp - 0x18d8], 0
mov eax, dword [ebp - 0x18d8]
add eax, 0xfff9
jne 0x488bc8
cmp dword [ebp - 0x18f0], 0
je 0x488bdd
cmp dword [ebp - 0xb28], 0
je 0x488bdd
mov dword [ebp - 0x18e0], 1
jmp 0x488be4
and dword [ebp - 0x18e0], 0
cmp dword [ebp - 0x18e0], 0
je 0x488c02
cmp dword [ebp - 0x2814], 0
je 0x488c02
mov dword [ebp - 0x18e8], 1
jmp 0x488c09
and dword [ebp - 0x18e8], 0
cmp dword [ebp - 0x18e8], 0x29a01eed
jne 0x488c21
mov dword [ebp - 0x18f8], 1
jmp 0x488c28
and dword [ebp - 0x18f8], 0
mov eax, dword [ebp - 0x18f0]
cmp dword [ebp - 0x18f8], eax
jge 0x488c42
mov dword [ebp - 0x23fc], 1
jmp 0x488c49
and dword [ebp - 0x23fc], 0
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x30f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa88]
mov dword [ebp - 0x3328], eax
mov eax, dword [ebp - 0x1900]
mov dword [ebp - 0x30fc], eax
mov eax, dword [ebp - 0xb30]
inc eax
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x1900]
mov dword [ebp - 0x2400], eax
mov dword [ebp - 0xc8], 0x89351f20
mov dword [ebp - 0x4b8], 0x19d29be1
mov dword [ebp - 0xb38], 0xfffffffd
mov dword [ebp - 0x2418], 1
mov dword [ebp - 0x34b8], 0x6c2e
mov dword [ebp - 0x650], 0
jmp 0x488cd8
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 1
jge 0x488cf4
mov eax, dword [ebp - 0x650]
mov dword [ebp + eax*4 - 0x2408], 0xd9ba07e4
jmp 0x488ccb
mov dword [ebp - 0x4b8], 0x648261f
mov dword [ebp - 0x4b8], 0
jmp 0x488d17
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 8
je 0x488d63
mov dword [ebp - 0x2410], 0xf3d37a5b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2408]
mov dword [ebp - 0x3104], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x2410]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0x2418], eax
jmp 0x488d0a
mov dword [ebp - 0xf20], 0xbb24adc9
mov dword [ebp - 0xcc], 0xfffffffd
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x4c0], 0xd0ce47ce
mov dword [ebp - 0xcc], 0
jmp 0x488da4
cmp dword [ebp - 0xcc], 0x17
je 0x489307
mov dword [ebp - 0x1970], 0x833e6fcb
mov dword [ebp - 0x218], 0
jmp 0x488dd4
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x488df0
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x324], 0x6432a276
jmp 0x488dc7
mov dword [ebp - 0x218], 0
jmp 0x488e09
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x488e25
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x3098], 0
jmp 0x488dfc
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x324], 0xffffffe4
jmp 0x488e53
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x324], 0xffffffee
jne 0x489017
mov eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x4c0]
jge 0x489327
mov dword [ebp - 0x1988], 1
jmp 0x48932e
and dword [ebp - 0x1988], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x1988]
neg eax
jne 0x489350
cmp dword [ebp - 0xb8], 0
jne 0x489350
and dword [ebp - 0x1990], 0
jmp 0x48935a
mov dword [ebp - 0x1990], 1
mov eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 0x1990]
cmp eax, dword [ebp - 0xb8]
jle 0x489375
cmp dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x4c0], eax
jne 0x48938f
mov dword [ebp - 0x1998], 1
jmp 0x489396
and dword [ebp - 0x1998], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x1998]
jge 0x4893b0
mov dword [ebp - 0x19a0], 1
jmp 0x4893b7
and dword [ebp - 0x19a0], 0
mov eax, dword [ebp - 0x19a0]
inc eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xf38], 0x28ffea05
mov dword [ebp - 0xba8], 0xffffffff
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x668], 0
jmp 0x4893fb
mov dword [ebp - 0x2d68], 0x3eca
mov byte [ebp - 0x385], 0
movzx eax, byte [ebp - 0x385]
test eax, eax
je 0x48c6a7
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp - 0x469], 0
movzx eax, byte [ebp - 0x469]
test eax, eax
je 0x48c6e1
push 0x118
push 0x1c30
push 0x1c43
push 0x1bf0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor ecx, ecx
call fcn.0044cd50
push eax
call fcn.004917b2
pop ecx
mov dword [ebp - 0x17c], 0xfff8
mov dword [ebp - 0xbb0], 0x3c576436
mov dword [ebp - 0x2600], 0xffffffff
mov dword [ebp - 0x750], 0
jmp 0x48c726
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 2
jge 0x48c742
mov eax, dword [ebp - 0x750]
mov dword [ebp + eax*4 - 0x3734], 0x4a520274
jmp 0x48c719
mov byte [ebp - 0x387], 0
movzx eax, byte [ebp - 0x387]
test eax, eax
je 0x48c77c
push 0x1830
push 0xfa1
push 0x12d
push 0x2315
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
cmp dword [ebp - 0x17c], 0
jne 0x48c797
cmp dword [ebp - 0x17c], 0
jne 0x48c797
and dword [ebp - 0xfe8], 0
jmp 0x48c7a1
mov dword [ebp - 0xfe8], 1
mov eax, dword [ebp - 0x17c]
add eax, 6
cmp eax, dword [ebp - 0x17c]
jne 0x48c7be
mov dword [ebp - 0xfc0], 1
jmp 0x48c7c5
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0xfc0]
inc eax
cmp eax, dword [ebp - 0x17c]
je 0x48c7e9
cmp dword [ebp - 0x17c], 0
je 0x48c7e9
mov dword [ebp - 0xfc8], 1
jmp 0x48c7f0
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0xfc8], eax
jne 0x48c80a
mov dword [ebp - 0xfd0], 1
jmp 0x48c811
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0xfd0], eax
jle 0x48c830
xor eax, eax
inc eax
je 0x48c830
mov dword [ebp - 0xfd8], 1
jmp 0x48c837
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0xfd8], eax
je 0x48c851
mov dword [ebp - 0xfe0], 1
jmp 0x48c858
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0xfe0]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xbb0]
imul eax, dword [ebp - 0xfe8]
test eax, eax
jne 0x48c887
cmp dword [ebp - 0xbb0], 0
jne 0x48c887
and dword [ebp - 0xff0], 0
jmp 0x48c891
mov dword [ebp - 0xff0], 1
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0xff0], eax
jge 0x48c8ab
mov dword [ebp - 0xff8], 1
jmp 0x48c8b2
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x2600], eax
mov dword [ebp - 0x60], 0x5043c4ab
mov dword [ebp - 0x178], 1
cmp dword [ebp - 0x60], 0xfffffffe
jne 0x48c8e1
mov dword [ebp - 0x1000], 1
jmp 0x48c8e8
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x1000], eax
jge 0x48c8ff
mov dword [ebp - 0x1008], 1
jmp 0x48c906
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jg 0x48c91a
mov dword [ebp - 0x2608], 1
jmp 0x48c921
and dword [ebp - 0x2608], 0
mov dword [ebp - 0x178], 0xaab7
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x2d70], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jge 0x48c94b
mov dword [ebp - 0x2610], 1
jmp 0x48c952
and dword [ebp - 0x2610], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x2d78], eax
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x1008], eax
jg 0x48c975
mov dword [ebp - 0x1010], 1
jmp 0x48c97c
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x1010], eax
jl 0x48c993
mov dword [ebp - 0x1018], 1
jmp 0x48c99a
and dword [ebp - 0x1018], 0
cmp dword [ebp - 0x1018], 0xfd5d7051
jae 0x48cb7d
mov dword [ebp - 0x2e8], 2
mov dword [ebp - 0x1048], 0x254f8d36
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2d80], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2d88], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2e8], eax
jle 0x48c9ed
mov dword [ebp - 0x1020], 1
jmp 0x48c9f4
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x1020]
jl 0x48ca0e
mov dword [ebp - 0x1028], 1
jmp 0x48ca15
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x1028]
jle 0x48ca2f
mov dword [ebp - 0x1030], 1
jmp 0x48ca36
and dword [ebp - 0x1030], 0
cmp dword [ebp - 0x1030], 0x4a87fce6
jl 0x48cb52
mov dword [ebp - 0x758], 0xffffffff
mov dword [ebp - 0x1038], 0xd994ad4d
mov dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x2d90], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x2d98], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x1048], 0
je 0x48ca95
cmp dword [ebp - 0x758], 0
mov dword [ebp - 0x1038], 0x7342
cmp dword [ebp - 0x1038], 1
je 0x48cab8
xor eax, eax
je 0x48cab8
mov dword [ebp - 0x1040], 1
jmp 0x48cabf
and dword [ebp - 0x1040], 0
imul eax, dword [ebp - 0x1040], 0x2b9c
cmp eax, dword [ebp - 0x758]
jge 0x48cadd
mov dword [ebp - 0x1050], 1
jmp 0x48cae4
and dword [ebp - 0x1050], 0
mov eax, dword [ebp - 0x1048]
imul eax, dword [ebp - 0x1050]
test eax, eax
jne 0x48cb07
cmp dword [ebp - 0x2e8], 0
jne 0x48cb07
and dword [ebp - 0x1058], 0
jmp 0x48cb11
mov dword [ebp - 0x1058], 1
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x758]
cmp dword [ebp - 0x1060], eax
jl 0x48cb37
mov dword [ebp - 0x1068], 1
jmp 0x48cb3e
and dword [ebp - 0x1068], 0
mov eax, dword [ebp - 0x2e8]
add eax, dword [ebp - 0x1068]
mov dword [ebp - 0x178], eax
jmp 0x48cb7b
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x48cb7b
push 0x217b
push 0
push 0x1642
push 0x139d
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x48cbc1
mov dword [ebp - 0x2620], 0x85ef
mov dword [ebp - 0x178], 0xffffffed
jmp 0x48cba0
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x10
jl 0x48cbc1
mov dword [ebp - 0x2618], 0xe0cd5c0f
mov eax, dword [ebp - 0x2618]
mov dword [ebp - 0x2620], eax
jmp 0x48cb93
mov dword [ebp - 0x60], 0
jmp 0x48cbd1
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x1c
jg 0x48cbef
mov dword [ebp - 0x2628], 0x4aa7fcf6
mov eax, dword [ebp - 0x2628]
mov dword [ebp - 0x178], eax
jmp 0x48cbca
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xab68d8
push 0xab68d8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0x2f0], 0x7ddc85f7
mov dword [ebp - 0x1088], 0xa33a4d1b
mov dword [ebp - 0x760], 0
jmp 0x48cc4f
mov eax, dword [ebp - 0x760]
inc eax
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 2
jge 0x48cc6b
mov eax, dword [ebp - 0x760]
mov dword [ebp + eax*4 - 0x30c8], 0xf0442e11
jmp 0x48cc42
mov dword [ebp - 0x2f0], 0
jmp 0x48cc84
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jg 0x48ce14
mov dword [ebp - 0xbb8], 0x858905b8
mov dword [ebp - 0x2638], 0x2e712c51
mov dword [ebp - 0x768], 0
jmp 0x48ccbe
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 3
jge 0x48ccda
mov eax, dword [ebp - 0x768]
mov dword [ebp + eax*4 - 0x2a6c], 0x9e84
jmp 0x48ccb1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2a6c], 0
jne 0x48cd48
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2a6c]
mov dword [ebp - 0xbb8], eax
cmp dword [ebp - 0xbb8], 0
jne 0x48cd48
mov eax, dword [ebp - 0xbb8]
cmp dword [ebp - 0x2f0], eax
jge 0x48cd1e
mov dword [ebp - 0x1070], 1
jmp 0x48cd25
and dword [ebp - 0x1070], 0
mov eax, dword [ebp - 0x2f0]
imul eax, dword [ebp - 0x1070]
sub eax, dword [ebp - 0x2f0]
add eax, 0x20b2
jne 0x48cd48
and dword [ebp - 0x1078], 0
jmp 0x48cd52
mov dword [ebp - 0x1078], 1
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x1078]
jle 0x48cd6c
mov dword [ebp - 0x1080], 1
jmp 0x48cd73
and dword [ebp - 0x1080], 0
mov eax, dword [ebp - 0x1080]
mov dword [ebp - 0x1088], eax
cmp dword [ebp - 0x1088], 0x2da
jl 0x48cd97
mov dword [ebp - 0x2630], 1
jmp 0x48cd9e
and dword [ebp - 0x2630], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a6c]
mov dword [ebp - 0x2da0], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x30c8], 0
xor eax, eax
cmp eax, 0xffffffff
jae 0x48cdd5
mov dword [ebp - 0x1090], 1
jmp 0x48cddc
and dword [ebp - 0x1090], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2a6c]
cmp dword [ebp - 0x1090], eax
jg 0x48cdfc
mov dword [ebp - 0x1098], 1
jmp 0x48ce03
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x1098]
mov dword [ebp - 0x2638], eax
jmp 0x48cc77
push 5
push dword [ebp - 0xbc8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x248], 0xa9d19ac1
mov dword [ebp - 0xa4], 7
mov dword [ebp - 0xbc0], 0x5b0
mov dword [ebp - 0x2658], 0
mov dword [ebp - 0x240], 0
jmp 0x48ce63
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x48ce7f
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x2b24], 0x5ec7e011
jmp 0x48ce56
mov dword [ebp - 0x240], 0
jmp 0x48ce98
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x48ceb4
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x2ac4], 4
jmp 0x48ce8b
cmp dword [ebp - 0x248], 0
je 0x48cf43
cmp dword [ebp - 0x248], 0x19570a50
jge 0x48ced9
mov dword [ebp - 0x10a0], 1
jmp 0x48cee0
and dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x10a0]
jg 0x48cefa
mov dword [ebp - 0x10a8], 1
jmp 0x48cf01
and dword [ebp - 0x10a8], 0
cmp dword [ebp - 0x10a8], 1
jle 0x48cf16
mov dword [ebp - 0x10b0], 1
jmp 0x48cf1d
and dword [ebp - 0x10b0], 0
mov eax, dword [ebp - 0x10b0]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xbc0]
je 0x48cf43
mov dword [ebp - 0x10b8], 1
jmp 0x48cf4a
and dword [ebp - 0x10b8], 0
cmp dword [ebp - 0x10b8], 0xfffffff9
jle 0x48cf5f
mov dword [ebp - 0x2640], 1
jmp 0x48cf66
and dword [ebp - 0x2640], 0
mov eax, 0x6eed1e12
cmp eax, 0x3f0d3ecf
jle 0x48d053
mov dword [ebp - 0x5e8], 1
mov dword [ebp - 0x10c8], 1
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2da8], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x2db0], eax
cmp dword [ebp - 0x5e8], 0
je 0x48cfcc
cmp dword [ebp - 0x5e8], 0
je 0x48cfcc
mov dword [ebp - 0x10c0], 1
jmp 0x48cfd3
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x10c8], eax
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x10c0]
imul eax, dword [ebp - 0x5e8]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x10c8], eax
jge 0x48d013
mov dword [ebp - 0x10d0], 1
jmp 0x48d01a
and dword [ebp - 0x10d0], 0
mov eax, dword [ebp - 0xbc0]
cmp dword [ebp - 0x10d0], eax
jne 0x48d034
mov dword [ebp - 0x10d8], 1
jmp 0x48d03b
and dword [ebp - 0x10d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x10d8]
mov dword [ebp + eax - 0x2b24], ecx
jmp 0x48d1ff
mov dword [ebp - 0x1110], 0xffffffff
mov dword [ebp - 0x770], 0
jmp 0x48d076
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 4
jge 0x48d092
mov eax, dword [ebp - 0x770]
mov dword [ebp + eax*4 - 0x36ac], 0x9b8a5142
jmp 0x48d069
mov dword [ebp - 0xa4], 0x1d
jmp 0x48d0ab
cmp dword [ebp - 0xa4], 0xfffffffb
jne 0x48d1e4
mov dword [ebp - 0x2648], 0xbf09457
mov dword [ebp - 0x2650], 0xffffffff
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x2db8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b24]
mov dword [ebp - 0x10e0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10e0]
mov dword [ebp + eax - 0x36ac], ecx
imul eax, dword [ebp - 0x10e0], 3
test eax, eax
je 0x48d11e
cmp dword [ebp - 0x2648], 0
je 0x48d11e
mov dword [ebp - 0x10e8], 1
jmp 0x48d125
and dword [ebp - 0x10e8], 0
cmp dword [ebp - 0x10e8], 0xf84b0f4
jne 0x48d13d
mov dword [ebp - 0x10f0], 1
jmp 0x48d144
and dword [ebp - 0x10f0], 0
mov eax, dword [ebp - 0x1110]
imul eax, dword [ebp - 0x10f0]
cmp eax, dword [ebp - 0x248]
jge 0x48d165
mov dword [ebp - 0x10f8], 1
jmp 0x48d16c
and dword [ebp - 0x10f8], 0
cmp dword [ebp - 0x10f8], 0x420e
jle 0x48d184
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2ac4]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2ac4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2ac4], 0
je 0x48d21b
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0xa4]
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2ac4]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x2ac4]
test eax, eax
jne 0x48d24c
cmp dword [ebp - 0x248], 0
jne 0x48d24c
and dword [ebp - 0x1120], 0
jmp 0x48d256
mov dword [ebp - 0x1120], 1
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x1120]
cmp eax, 1
jb 0x48d273
mov dword [ebp - 0x1128], 1
jmp 0x48d27a
and dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0x1128]
mov dword [ebp - 0x2658], eax
push dword [ebp - 0xbc8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x778], 0
mov dword [ebp - 0x778], 0
jmp 0x48d2b5