Function at 0x461e96
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Enumerate gui resources
Get common file path
Get file attributes
Get geographical location
Get keyboard layout
Get memory capacity
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34a8
call fcn.00497f70
push esi
push edi
mov dword [ebp - 0x98], 0x91a049fe
mov dword [ebp - 0x1c08], 0xa094
mov dword [ebp - 0x2174], 1
mov byte [ebp - 0x3e2], 0
movzx eax, byte [ebp - 0x3e2]
test eax, eax
je 0x461eec
push 0x2046
push 0
push 0x1cf9
push 0x1af7
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x98], 2
jmp 0x461f05
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 5
jl 0x4621c7
mov dword [ebp - 0xc0], 0xaa39ed08
mov dword [ebp - 0x104], 0
jmp 0x461f35
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x461f51
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0xb48], 0x124f84b8
jmp 0x461f28
mov dword [ebp - 0x104], 0
jmp 0x461f6a
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x461f86
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x3200], 0xfffffffd
jmp 0x461f5d
mov dword [ebp - 0xc0], 0
jmp 0x461f9f
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x4621c2
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x98]
cmp dword [ebp + eax - 0xb48], ecx
jle 0x461fcd
mov dword [ebp - 0x1f28], 1
jmp 0x461fd4
and dword [ebp - 0x1f28], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x30e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb48], 0
je 0x461ffc
mov dword [ebp - 0x1bb8], 1
jmp 0x462003
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb48]
cmp dword [ebp - 0x1bb8], eax
jge 0x462024
mov dword [ebp - 0x1bd0], 1
jmp 0x46202b
and dword [ebp - 0x1bd0], 0
cmp dword [ebp - 0x1bd0], 0x7f51
jg 0x462043
mov dword [ebp - 0x1bd8], 1
jmp 0x46204a
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1bd8], eax
jge 0x462064
mov dword [ebp - 0x1be0], 1
jmp 0x46206b
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x1be0]
cmp eax, dword [ebp - 0x98]
jle 0x46208c
mov dword [ebp - 0x1be8], 1
jmp 0x462093
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1be8], eax
jl 0x4620ad
mov dword [ebp - 0x1bf0], 1
jmp 0x4620b4
and dword [ebp - 0x1bf0], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x1bf0]
jne 0x4620ce
mov dword [ebp - 0xa54], 1
jmp 0x4620d5
and dword [ebp - 0xa54], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa54]
mov dword [ebp + eax - 0x3200], ecx
cmp dword [ebp - 0xa54], 0
jne 0x462103
cmp dword [ebp - 0x98], 0
jne 0x462103
and dword [ebp - 0x1bf8], 0
jmp 0x46210d
mov dword [ebp - 0x1bf8], 1
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1bf8], eax
jg 0x462127
mov dword [ebp - 0x1c00], 1
jmp 0x46212e
and dword [ebp - 0x1c00], 0
mov eax, dword [ebp - 0x1c00]
mov dword [ebp - 0x1c08], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xb48]
cmp eax, dword [ebp - 0x1c08]
je 0x46215b
mov dword [ebp - 0x1c10], 1
jmp 0x462162
and dword [ebp - 0x1c10], 0
mov eax, dword [ebp - 0x1c10]
sub eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
imul eax, dword [ebp + ecx*4 - 0xb48]
test eax, eax
je 0x462193
push 7
pop eax
test eax, eax
je 0x462193
mov dword [ebp - 0x1c18], 1
jmp 0x46219a
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x1c18]
add eax, 0x5243b9c3
mov dword [ebp - 0x2174], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0xb48], 0
je 0x4621bd
jmp 0x4621c2
jmp 0x461f92
jmp 0x461ef8
mov dword [ebp - 0xc], 0x4d63
mov dword [ebp - 0x1cb8], 0xffffffff
mov dword [ebp - 0xb14], 0x23205e60
mov dword [ebp - 0x218c], 0x8302cca7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3098], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
jne 0x462209
mov dword [ebp - 0x217c], 1
jmp 0x462210
and dword [ebp - 0x217c], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d40], eax
cmp dword [ebp - 0xc], 0
je 0x46222b
mov dword [ebp - 0x1c20], 1
jmp 0x462232
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1c20], eax
jl 0x462249
mov dword [ebp - 0x1c28], 1
jmp 0x462250
and dword [ebp - 0x1c28], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c28]
jge 0x462267
mov dword [ebp - 0x1c80], 1
jmp 0x46226e
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x1c80]
sub eax, 0x193208af
cmp eax, dword [ebp - 0xc]
jge 0x462294
cmp dword [ebp - 0xc], 0
je 0x462294
mov dword [ebp - 0x1c88], 1
jmp 0x46229b
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1c88], eax
jle 0x4622b5
cmp dword [ebp - 0xc], 0
jne 0x4622b5
and dword [ebp - 0x1c90], 0
jmp 0x4622bf
mov dword [ebp - 0x1c90], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c90]
je 0x4622d6
mov dword [ebp - 0x2184], 1
jmp 0x4622dd
and dword [ebp - 0x2184], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3010], eax
mov eax, 0x547507af
test eax, eax
jne 0x4622fe
cmp dword [ebp - 0xc], 0
jne 0x4622fe
and dword [ebp - 0x1c98], 0
jmp 0x462308
mov dword [ebp - 0x1c98], 1
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c98]
cmp eax, dword [ebp - 0xc]
jl 0x46232b
cmp dword [ebp - 0xc], 0
jne 0x46232b
cmp dword [ebp - 0xc], 0
jne 0x46232b
and dword [ebp - 0x1ca0], 0
jmp 0x462335
mov dword [ebp - 0x1ca0], 1
cmp dword [ebp - 0x1ca0], 0x7497f3c8
jne 0x46234d
mov dword [ebp - 0x1ca8], 1
jmp 0x462354
and dword [ebp - 0x1ca8], 0
mov eax, dword [ebp - 0x1ca8]
neg eax
jne 0x462368
cmp dword [ebp - 0xc], 0
je 0x4623f3
mov dword [ebp - 0x984], 0x9ff9e6b9
cmp dword [ebp - 0x984], 0
jne 0x4623cf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d48], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30a0], eax
cmp dword [ebp - 0x984], 0
jg 0x4623a2
mov dword [ebp - 0x1cb0], 1
jmp 0x4623a9
and dword [ebp - 0x1cb0], 0
mov eax, dword [ebp - 0x1cb0]
mov dword [ebp - 0x1cb8], eax
mov eax, dword [ebp - 0x1cb8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xb14], eax
jne 0x4623cf
and dword [ebp - 0x1cc0], 0
jmp 0x4623d9
mov dword [ebp - 0x1cc0], 1
mov eax, dword [ebp - 0x984]
imul eax, dword [ebp - 0x1cc0]
dec eax
dec eax
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x218c], eax
jmp 0x4623fd
mov dword [ebp - 0xb14], 0xb872a60d
push 2
lea ecx, [ebp - 0x2850]
call fcn.0042bc99
mov dword [ebp - 0x440], 0xfffffff9
mov dword [ebp - 0x98c], 0xffffffff
mov dword [ebp - 0x2d50], 0x51bb35b6
mov dword [ebp - 0x564], 0
jmp 0x462441
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 2
jge 0x462463
push dword [ebp - 0x564]
lea ecx, [ebp - 0x2850]
call fcn.0042bd87
mov dword [eax], 0xfffffff7
jmp 0x462434
mov dword [ebp - 0x440], 1
jmp 0x46247c
mov eax, dword [ebp - 0x440]
dec eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jl 0x46271e
mov dword [ebp - 0x4ec], 8
mov dword [ebp - 0x4ec], 1
jmp 0x4624ac
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0
jl 0x462719
mov dword [ebp - 0x3f8], 0xcdcb363f
mov byte [ebp - 0x3d1], 0
movzx eax, byte [ebp - 0x3d1]
test eax, eax
je 0x4624dd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x3f8], 1
jmp 0x4624f6
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
jl 0x462714
push 3
lea ecx, [ebp - 0x25a8]
call fcn.0042bc99
mov dword [ebp - 0x19d8], 0
mov dword [ebp - 0x568], 0
jmp 0x462533
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 3
jge 0x462555
push dword [ebp - 0x568]
lea ecx, [ebp - 0x25a8]
call fcn.0042bd87
mov dword [eax], 0x840eb449
jmp 0x462526
cmp dword [ebp - 0x3f8], 0xe468a07c
jb 0x46256d
mov dword [ebp - 0x1cc8], 1
jmp 0x462574
and dword [ebp - 0x1cc8], 0
mov eax, 0x441a62a9
sub eax, dword [ebp - 0x1cc8]
mov dword [ebp - 0x1cd0], eax
push 1
lea ecx, [ebp - 0x25a8]
call fcn.0042bd87
mov ecx, dword [ebp - 0x1cd0]
mov dword [eax], ecx
cmp dword [ebp - 0x1cd0], 0
je 0x4625b8
cmp dword [ebp - 0x440], 0
je 0x4625b8
mov dword [ebp - 0x1cd8], 1
jmp 0x4625bf
and dword [ebp - 0x1cd8], 0
imul eax, dword [ebp - 0x3f8], 0x7979
cmp eax, dword [ebp - 0x1cd8]
jl 0x4625dd
mov dword [ebp - 0x19d0], 1
jmp 0x4625e4
and dword [ebp - 0x19d0], 0
cmp dword [ebp - 0x19d0], 0xffffffff
ja 0x4625f9
mov dword [ebp - 0xb80], 1
jmp 0x462600
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x19d8], eax
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0x98c], eax
mov esi, dword [ebp - 0x98c]
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x2850]
call fcn.0042bd87
cmp dword [eax], esi
je 0x46263f
mov dword [ebp - 0xb88], 1
jmp 0x462646
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0xb88], eax
jl 0x462680
mov byte [ebp - 0x274], 0
movzx eax, byte [ebp - 0x274]
test eax, eax
je 0x46267b
push 0
push 0
push 0x1a5c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x462704
mov dword [ebp - 0x2194], 0x9d2e
push 4
lea ecx, [ebp - 0x2940]
call fcn.0042bc99
mov dword [ebp - 0x750], 0
jmp 0x4626b0
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 4
jge 0x4626cf
push dword [ebp - 0x750]
lea ecx, [ebp - 0x2940]
call fcn.0042bd87
and dword [eax], 0
jmp 0x4626a3
push 1
lea ecx, [ebp - 0x25a8]
call fcn.0042bd87
mov eax, dword [eax]
mov dword [ebp - 0x2194], eax
mov esi, dword [ebp - 0x98c]
push 3
lea ecx, [ebp - 0x2940]
call fcn.0042bd87
mov dword [eax], esi
lea ecx, [ebp - 0x2940]
call fcn.0042bd6b
lea ecx, [ebp - 0x25a8]
call fcn.0042bd6b
jmp 0x4624e9
jmp 0x46249f
jmp 0x46246f
lea ecx, [ebp - 0x2850]
call fcn.0042bd6b
mov dword [ebp - 0xa0], 0x91a049fe
mov dword [ebp - 0xcd0], 0xa094
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x19f8], 6
mov dword [ebp - 0x219c], 1
mov dword [ebp - 0x21a4], 0xfffffff6
mov dword [ebp - 0x570], 0
jmp 0x46277e
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 2
jge 0x46279a
mov eax, dword [ebp - 0x570]
mov dword [ebp + eax*4 - 0x29fc], 0xfffffff9
jmp 0x462771
cmp dword [ebp - 0xcc], 0xd7c1188e
jae 0x4627b2
mov dword [ebp - 0xb98], 1
jmp 0x4627b9
and dword [ebp - 0xb98], 0
cmp dword [ebp - 0xcc], 1
je 0x4627ce
mov dword [ebp - 0x19e0], 1
jmp 0x4627d5
and dword [ebp - 0x19e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19e0]
mov dword [ebp + eax - 0x29fc], ecx
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0xcc]
jne 0x462809
mov dword [ebp - 0xb90], 1
jmp 0x462810
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xb90], eax
jge 0x46282a
mov dword [ebp - 0x19e8], 1
jmp 0x462831
and dword [ebp - 0x19e8], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x19e8], eax
je 0x46284b
mov dword [ebp - 0x19f0], 1
jmp 0x462852
and dword [ebp - 0x19f0], 0
mov eax, dword [ebp - 0xb98]
cmp eax, dword [ebp - 0x19f0]
jne 0x46286c
mov dword [ebp - 0xba0], 1
jmp 0x462873
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0xba0]
jl 0x46288d
mov dword [ebp - 0xba8], 1
jmp 0x462894
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x19f8], eax
mov eax, dword [ebp - 0x19f8]
add eax, dword [ebp - 0xba8]
mov dword [ebp - 0x219c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x21a4], eax
mov byte [ebp - 0x2cc], 0
movzx eax, byte [ebp - 0x2cc]
test eax, eax
je 0x4628dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x227c], 1
push 2
lea ecx, [ebp - 0xb00]
call fcn.0042bc99
mov dword [ebp - 0x5c], 3
mov dword [ebp - 0x758], 0xfffffffa
mov dword [ebp - 0x400], 1
mov dword [ebp - 0xa5c], 0x4677319
mov dword [ebp - 0x844], 0
jmp 0x462932
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 2
jge 0x462954
push dword [ebp - 0x844]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov dword [eax], 1
jmp 0x462925
mov dword [ebp - 0x5c], 0
jmp 0x462964
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jg 0x462c44
push 1
lea ecx, [ebp - 0x237c]
call fcn.0042bc99
mov dword [ebp - 0x1a08], 0xdd66408
mov dword [ebp - 0x578], 0
jmp 0x46299e
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 1
jge 0x4629c0
push dword [ebp - 0x578]
lea ecx, [ebp - 0x237c]
call fcn.0042bd87
mov dword [eax], 0xfffffff8
jmp 0x462991
push 0
lea ecx, [ebp - 0x237c]
call fcn.0042bd87
and dword [eax], 0
jmp 0x4629f6
push 0
lea ecx, [ebp - 0x237c]
call fcn.0042bd87
mov dword [ebp - 0x1a00], eax
mov eax, dword [ebp - 0x1a00]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a00]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x237c]
call fcn.0042bd87
cmp dword [eax], 1
jg 0x462c34
mov dword [ebp - 0x1a18], 0xffffffff
mov dword [ebp - 0x494], 0x3d2f5512
push 0
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov eax, dword [eax]
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0
jne 0x462a87
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov ecx, dword [ebp - 0x758]
cmp dword [eax], ecx
jne 0x462a62
mov dword [ebp - 0xbb0], 1
jmp 0x462a69
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0x1a08], eax
cmp dword [ebp - 0x1a08], 0
jne 0x462a87
and dword [ebp - 0xbb8], 0
jmp 0x462a91
mov dword [ebp - 0xbb8], 1
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
jne 0x462ace
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
cmp dword [eax], 0
jne 0x462ace
and dword [ebp - 0x21ac], 0
jmp 0x462ad8
mov dword [ebp - 0x21ac], 1
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov esi, dword [ebp - 0x5c]
imul esi, dword [ebp - 0x758]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
cmp esi, dword [eax]
jge 0x462b0e
mov dword [ebp - 0x1a10], 1
jmp 0x462b15
and dword [ebp - 0x1a10], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1a10]
jne 0x462b39
mov dword [ebp - 0xbc0], 1
jmp 0x462b40
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x1a18], eax
mov eax, dword [ebp - 0x1a18]
mov dword [ebp - 0x3020], eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov esi, dword [ebp - 0x5c]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
cmp esi, dword [eax]
jle 0x462b87
mov dword [ebp - 0xbc8], 1
jmp 0x462b8e
and dword [ebp - 0xbc8], 0
push 1
lea ecx, [ebp - 0xb00]
call fcn.0042bd87
mov ecx, dword [ebp - 0xbc8]
imul ecx, dword [eax]
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x400], 0x1a
jmp 0x462bc3
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x1d
jle 0x462c2f
mov dword [ebp - 0x1a20], 0xffff
mov dword [ebp - 0x494], 1
jmp 0x462bef
mov eax, dword [ebp - 0x494]
dec eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
jl 0x462c2d
mov dword [ebp - 0x1a20], 0xfffffff6
mov eax, dword [ebp - 0x1a20]
mov dword [ebp - 0xa5c], eax
mov byte [ebp - 0x276], 0
movzx eax, byte [ebp - 0x276]
test eax, eax
je 0x462c2b
push 0xb61
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x462be2
jmp 0x462bb6
jmp 0x4629d2
lea ecx, [ebp - 0x237c]
call fcn.0042bd6b
jmp 0x46295d
lea ecx, [ebp - 0xb00]
call fcn.0042bd6b
mov byte [ebp - 0x27a], 0
mov dword [ebp - 0x2e0], 0xffff
mov dword [ebp - 0x580], 0
jmp 0x462c79
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 2
jge 0x462c95
mov eax, dword [ebp - 0x580]
mov dword [ebp + eax*4 - 0x244], 0xe8cff0ea
jmp 0x462c6c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x244], 0x13
jmp 0x462cc3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x244], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x244], 0x1b
jge 0x462d24
mov dword [ebp - 0x848], 3
mov dword [ebp - 0x848], 0
jmp 0x462cf6
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 0xd
jg 0x462d22
mov byte [ebp - 0x351], 0
movzx eax, byte [ebp - 0x351]
test eax, eax
je 0x462d20
push 0
push 0x1e41
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x462ce9
jmp 0x462ca8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x2d58], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 0xfffffffffffffffd
pop edx
sub edx, dword [ebp + ecx - 0x244]
push 4
pop ecx
imul ecx, ecx, 0
add edx, dword [ebp + ecx - 0x244]
cmp dword [ebp + eax - 0x244], edx
jle 0x462d6f
mov dword [ebp - 0xbd0], 1
jmp 0x462d76
and dword [ebp - 0xbd0], 0
cmp dword [ebp - 0xbd0], 0xc924
jle 0x462d94
mov eax, 0x1145
test eax, eax
jne 0x462d94
and dword [ebp - 0x1a28], 0
jmp 0x462d9e
mov dword [ebp - 0x1a28], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
cmp eax, dword [ebp - 0x1a28]
jne 0x462dbf
mov dword [ebp - 0x21b4], 1
jmp 0x462dc6
and dword [ebp - 0x21b4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x244], 9
jbe 0x462de2
mov dword [ebp - 0x21bc], 1
jmp 0x462de9
and dword [ebp - 0x21bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x30a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x244], 0
je 0x462f54
mov dword [ebp - 0x588], 0xe2db80eb
mov dword [ebp - 0x2d60], 0
mov byte [ebp - 0x278], 0
movzx eax, byte [ebp - 0x278]
test eax, eax
je 0x462e7b
push 0x24df
push 0x988
push 0xb2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x363
push 0xc47
push 0x15bb
push 0x25b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x588], 0xffffffff
jmp 0x462e94
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0x16
jne 0x462f4f
mov dword [ebp - 0x760], 0x5537c57f
mov dword [ebp - 0x3030], 0x335900b0
mov dword [ebp - 0x760], 0x13
jmp 0x462ece
mov eax, dword [ebp - 0x760]
dec eax
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 0x12
jle 0x462f4a
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
mov byte [ebp - 0x2ce], 0
movzx eax, byte [ebp - 0x2ce]
test eax, eax
je 0x462f45
push 0x26db
push 0x856
push 0x1152
push 0x1d83
push 0x300
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1363
push 0xa2
push 0x1120
push 0x9fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x462ec1
jmp 0x462e87
jmp 0x4630d0
mov dword [ebp - 0x4f4], 0x1636
mov dword [ebp - 0x2e0], 0xfffffff9
jmp 0x462f77
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x28
jle 0x4630d0
mov dword [ebp - 0xbe0], 1
mov dword [ebp - 0x21cc], 0x3af8ef5d
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x2d68], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x30b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x2d70], eax
cmp dword [ebp - 0x4f4], 0x49d9
jl 0x462fdb
mov dword [ebp - 0xbd8], 1
jmp 0x462fe2
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0xbd8]
jne 0x462ffc
mov dword [ebp - 0x1a30], 1
jmp 0x463003
and dword [ebp - 0x1a30], 0
mov eax, dword [ebp - 0x1a30]
add eax, 8
cmp eax, dword [ebp - 0xbe0]
jg 0x463020
mov dword [ebp - 0x1a38], 1
jmp 0x463027
and dword [ebp - 0x1a38], 0
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x1a38], eax
jg 0x463041
mov dword [ebp - 0xbe8], 1
jmp 0x463048
and dword [ebp - 0xbe8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
cmp dword [ebp - 0xbe8], eax
jl 0x463069
mov dword [ebp - 0x21c4], 1
jmp 0x463070
and dword [ebp - 0x21c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x3040], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x2d78], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x30b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x2d80], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x3050], eax
mov dword [ebp - 0x21cc], 0
jmp 0x462f6a
movzx eax, byte [ebp - 0x27a]
test eax, eax
je 0x4630f2
push 0x2046
push 0
push 0x1cf9
push 0x1af7
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x2d88], 0xffffffff
mov byte [ebp - 0x3a9], 0
movzx eax, byte [ebp - 0x3a9]
test eax, eax
je 0x463118
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov byte [ebp - 0x27c], 0
movzx eax, byte [ebp - 0x27c]
test eax, eax
je 0x463130
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0xa0], 2
jmp 0x463149
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 5
jl 0x464a9a
mov dword [ebp - 0x590], 0xb26bdde0
mov dword [ebp - 0x590], 0
jmp 0x463179
mov eax, dword [ebp - 0x590]
dec eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0xfffffffa
jg 0x46330f
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x200], 0
jmp 0x4631a9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 9
jle 0x4632be
mov dword [ebp - 0x918], 0
jmp 0x4631cf
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 1
jge 0x4631eb
mov eax, dword [ebp - 0x918]
mov dword [ebp + eax*4 - 0x598], 0
jmp 0x4631c2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x598], 0
jmp 0x463219
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x598]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x598], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x598], 0xffffffeb
jl 0x463279
mov byte [ebp - 0x2d0], 0
movzx eax, byte [ebp - 0x2d0]
test eax, eax
je 0x463254
push 0xa35
push 0xf18
push 1
push 0
push 0x1869
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov byte [ebp - 0x27e], 0
movzx eax, byte [ebp - 0x27e]
test eax, eax
je 0x463277
push 0x1575
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4631fe
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x4632b9
push 0
push 0x7e9
push 0
push 0
push 0x77d
push 0xe4f
push 0x268c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x46319c
mov dword [ebp - 0x200], 0
jmp 0x4632d7
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfffffff6
je 0x46330a
mov byte [ebp - 0x280], 0
movzx eax, byte [ebp - 0x280]
test eax, eax
je 0x463308
push 0
push 0
push 0x2456
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4632ca
jmp 0x46316c
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x480], 0xfffffff7
mov dword [ebp - 0x2224], 1
mov dword [ebp - 0x768], 0
jmp 0x463343
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 2
jge 0x46335f
mov eax, dword [ebp - 0x768]
mov dword [ebp + eax*4 - 0xb70], 0x63588c55
jmp 0x463336
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29cc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29d0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29d8], eax
mov eax, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x1880
imul eax, ecx
cmp eax, dword [ebp - 0x10]
jg 0x46339e
cmp dword [ebp - 0x10], 0
je 0x46339e
mov dword [ebp - 0x21d4], 1
jmp 0x4633a5
and dword [ebp - 0x21d4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29e0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29e8], eax
mov eax, 0x9fe57f6c
cmp eax, 0x4956e74e
jb 0x4633cf
mov dword [ebp - 0x1a40], 1
jmp 0x4633d6
and dword [ebp - 0x1a40], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1a40], eax
jl 0x4633ed
mov dword [ebp - 0x21dc], 1
jmp 0x4633f4
and dword [ebp - 0x21dc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x29f0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp + eax - 0xb70], ecx
cmp dword [ebp - 0xbf0], 0
je 0x463507
mov dword [ebp - 0x2a84], 0
mov dword [ebp - 0x2a8c], 0x283d1f0d
mov dword [ebp - 0x2a94], 1
mov dword [ebp - 0x2a9c], 7
push 3
lea ecx, [ebp - 0x28e0]
call fcn.0042bc99
mov dword [ebp - 0x44], 0
jmp 0x46346b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x463481
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x342c], 0xfffffff7
jmp 0x463464
mov dword [ebp - 0x44], 0
jmp 0x463491
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x4634a7
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x3388], 0xca4d9a54
jmp 0x46348a
mov dword [ebp - 0x44], 0
jmp 0x4634b7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x4634d3
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28e0]
call fcn.0042bd87
mov dword [eax], 0x842b4cf2
jmp 0x4634b0
push 1
lea ecx, [ebp - 0x28e0]
call fcn.0042bd87
mov dword [ebp - 0x1a48], eax
mov eax, dword [ebp - 0x1a48]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1a48]
mov dword [ecx], eax
lea ecx, [ebp - 0x28e0]
call fcn.0042bd6b
jmp 0x46375f
mov dword [ebp - 0x850], 0x510b2d4a
mov dword [ebp - 0x222c], 3
mov dword [ebp - 0x10], 1
jmp 0x46352b
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x463730
mov dword [ebp - 0x5a0], 0
jmp 0x46354e
mov eax, dword [ebp - 0x5a0]
inc eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 3
jge 0x46356a
mov eax, dword [ebp - 0x5a0]
mov dword [ebp + eax*4 - 0x2e5c], 0x6367afff
jmp 0x463541
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xb70], 0xffffffff
jg 0x4635f5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x850]
cmp dword [ebp + eax*4 - 0xb70], ecx
jg 0x463595
mov dword [ebp - 0xbf8], 1
jmp 0x46359c
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0xbf8]
add eax, 0x4630
cmp eax, dword [ebp - 0x850]
jge 0x4635bb
mov dword [ebp - 0x1a50], 1
jmp 0x4635c2
and dword [ebp - 0x1a50], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1a50], eax
jge 0x4635d9
mov dword [ebp - 0xc00], 1
jmp 0x4635e0
and dword [ebp - 0xc00], 0
cmp dword [ebp - 0xc00], 1
jle 0x4635f5
mov dword [ebp - 0x1a58], 1
jmp 0x4635fc
and dword [ebp - 0x1a58], 0
cmp dword [ebp - 0x1a58], 1
jl 0x463611
mov dword [ebp - 0x994], 1
jmp 0x463618
and dword [ebp - 0x994], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x994]
mov dword [ebp + eax - 0x2e5c], ecx
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x994], eax
jle 0x463645
mov dword [ebp - 0x21e4], 1
jmp 0x46364c
and dword [ebp - 0x21e4], 0
xor eax, eax
cmp eax, 0x3da7
ja 0x463661
mov dword [ebp - 0x221c], 1
jmp 0x463668
and dword [ebp - 0x221c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb70]
mov dword [ebp - 0x2aa4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e5c]
mov dword [ebp - 0x2224], eax
mov eax, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x850], 7
cmp dword [ebp + eax*4 - 0xb70], ecx
jg 0x4636ad
mov dword [ebp - 0xc08], 1
jmp 0x4636b4
and dword [ebp - 0xc08], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc08]
sub ecx, dword [ebp + eax - 0xb70]
cmp ecx, dword [ebp - 0x480]
jne 0x4636db
mov dword [ebp - 0x1a60], 1
jmp 0x4636e2
and dword [ebp - 0x1a60], 0
mov eax, dword [ebp - 0x850]
cmp dword [ebp - 0x1a60], eax
jne 0x4636fc
mov dword [ebp - 0xc10], 1
jmp 0x463703
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 3
jne 0x463718
mov dword [ebp - 0x1a68], 1
jmp 0x46371f
and dword [ebp - 0x1a68], 0
mov eax, dword [ebp - 0x1a68]
mov dword [ebp - 0x222c], eax
jmp 0x463524
mov byte [ebp - 0x2d2], 0
movzx eax, byte [ebp - 0x2d2]
test eax, eax
je 0x46375f
push 0x1ea4
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov dword [ebp - 0x480], 0
jmp 0x463778
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0xa
je 0x4637b3
mov byte [ebp - 0x282], 0
movzx eax, byte [ebp - 0x282]
test eax, eax
je 0x4637b1
push 0x7c7
push 0x2088
push 0x20a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x46376b
mov dword [ebp - 0xc8], 0xaa39ed08
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x2974], 2
mov dword [ebp - 0x2970], 2
mov dword [ebp - 0x296c], 2
mov dword [ebp - 0x2968], 2
mov dword [ebp - 0x5a8], 0
jmp 0x463808
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 4
jge 0x463824
mov eax, dword [ebp - 0x5a8]
mov dword [ebp + eax*4 - 0x344c], 0xffffffff
jmp 0x4637fb
mov dword [ebp - 0x49c], 0
jmp 0x46383d
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 3
jg 0x463afd
mov dword [ebp - 0x248], 9
mov dword [ebp - 0x248], 0
jmp 0x46386d
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jg 0x463a64
mov dword [ebp - 0x770], 0xb8ce3e63
mov dword [ebp - 0x770], 3
jmp 0x46389d
mov eax, dword [ebp - 0x770]
dec eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0
jl 0x463a5f
push 1
lea ecx, [ebp - 0x239c]
call fcn.0042bc99
mov dword [ebp - 0x5b0], 0
jmp 0x4638d0
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 1
jge 0x4638f2
push dword [ebp - 0x5b0]
lea ecx, [ebp - 0x239c]
call fcn.0042bd87
mov dword [eax], 0x9e672ca3
jmp 0x4638c3
push 0
lea ecx, [ebp - 0x239c]
call fcn.0042bd87
and dword [eax], 0
jmp 0x463928
push 0
lea ecx, [ebp - 0x239c]
call fcn.0042bd87
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0xc18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc18]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x239c]
call fcn.0042bd87
cmp dword [eax], 3
jg 0x463a4f
push 2
lea ecx, [ebp - 0x238c]
call fcn.0042bc99
mov dword [ebp - 0x8c8], 0
jmp 0x463964
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 2
jge 0x463986
push dword [ebp - 0x8c8]
lea ecx, [ebp - 0x238c]
call fcn.0042bd87
mov dword [eax], 6
jmp 0x463957
mov byte [ebp - 0x3e3], 0
movzx eax, byte [ebp - 0x3e3]
test eax, eax
je 0x4639aa
push 0x943
push 0x120b
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 1
lea ecx, [ebp - 0x238c]
call fcn.0042bd87
mov dword [eax], 3
jmp 0x4639e3
push 1
lea ecx, [ebp - 0x238c]
call fcn.0042bd87
mov dword [ebp - 0x1a70], eax
mov eax, dword [ebp - 0x1a70]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1a70]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x238c]
call fcn.0042bd87
cmp dword [eax], 0
jl 0x463a3f
mov dword [ebp - 0x5b8], 0xfffffff6
mov dword [ebp - 0x5b8], 3
jmp 0x463a18
mov eax, dword [ebp - 0x5b8]
dec eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0
jl 0x463a3d
mov byte [ebp - 0x284], 0
movzx eax, byte [ebp - 0x284]
test eax, eax
je 0x463a3b
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x463a0b
jmp 0x4639bf
lea ecx, [ebp - 0x238c]
call fcn.0042bd6b
jmp 0x463904
lea ecx, [ebp - 0x239c]
call fcn.0042bd6b
jmp 0x463890
jmp 0x463860
mov dword [ebp - 0x248], 0
jmp 0x463a7d
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jg 0x463af8
mov dword [ebp - 0x2234], 0x56540f21
mov byte [ebp - 0x2d4], 0
movzx eax, byte [ebp - 0x2d4]
test eax, eax
je 0x463aaf
push 0x5b5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x2aac], eax
xor eax, eax
inc eax
jne 0x463acc
mov dword [ebp - 0xacc], 1
jmp 0x463ad3
and dword [ebp - 0xacc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xacc]
mov dword [ebp + eax - 0x2974], ecx
mov eax, dword [ebp - 0xacc]
inc eax
inc eax
mov dword [ebp - 0x2234], eax
jmp 0x463a70
jmp 0x463830
mov dword [ebp - 0x208], 1
mov dword [ebp - 0xd8], 7
push 1
lea ecx, [ebp - 0x23ac]
call fcn.0042bc99
mov dword [ebp - 0x778], 0
jmp 0x463b37
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 1
jge 0x463b59
push dword [ebp - 0x778]
lea ecx, [ebp - 0x23ac]
call fcn.0042bd87
mov dword [eax], 0x74c7af5a
jmp 0x463b2a
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jg 0x463b7a
mov dword [ebp - 0x223c], 1
jmp 0x463b81
and dword [ebp - 0x223c], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x2ab4], eax
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0xd8], eax
je 0x463ba7
mov dword [ebp - 0xc20], 1
jmp 0x463bae
and dword [ebp - 0xc20], 0
push 0
lea ecx, [ebp - 0x23ac]
call fcn.0042bd87
mov ecx, dword [ebp - 0xc20]
mov dword [eax], ecx
mov dword [ebp - 0xd8], 0
jmp 0x463bdc
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x463e7c
mov dword [ebp - 0x224c], 0xc25c5395
mov dword [ebp - 0x208], 0
jmp 0x463c0c
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jg 0x463e6c
mov dword [ebp - 0x5c0], 0
jmp 0x463c32
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 4
jge 0x463c4e
mov eax, dword [ebp - 0x5c0]
mov dword [ebp + eax*4 - 0x1d90], 5
jmp 0x463c25
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1d90], 0
jmp 0x463c7c
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1d90]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1d90], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1d90], 0
jl 0x463e67
mov dword [ebp - 0x488], 0xb372ba29
mov dword [ebp - 0x488], 0
jmp 0x463cb3
mov eax, dword [ebp - 0x488]
dec eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
jl 0x463e62
push 8
pop eax
test eax, eax
je 0x463d37
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x23ac]
call fcn.0042bd87
cmp dword [eax], 0
jne 0x463cf6
xor eax, eax
inc eax
sub eax, dword [ebp - 0xd8]
cmp eax, 0x8adc705
jge 0x463cf6
and dword [ebp - 0x1a78], 0
jmp 0x463d00
mov dword [ebp - 0x1a78], 1
cmp dword [ebp - 0x1a78], 0x9829
je 0x463d18
mov dword [ebp - 0xc28], 1
jmp 0x463d1f
and dword [ebp - 0xc28], 0
cmp dword [ebp - 0xc28], 0xffff
ja 0x463d37
mov dword [ebp - 0x2244], 1
jmp 0x463d3e
and dword [ebp - 0x2244], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1d90]
mov dword [ebp - 0x2abc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d90]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x1d90]
cmp eax, 0xffffffff
jg 0x463d8c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1d90], 0
je 0x463d8c
mov dword [ebp - 0x1a80], 1
jmp 0x463d93
and dword [ebp - 0x1a80], 0
cmp dword [ebp - 0x1a80], 0xfffffffb
jne 0x463da8
mov dword [ebp - 0xc30], 1
jmp 0x463daf
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0xc30], eax
je 0x463dc9
mov dword [ebp - 0x1a88], 1
jmp 0x463dd0
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x224c]
cmp dword [ebp - 0x1a88], eax
jge 0x463dea
mov dword [ebp - 0xc38], 1
jmp 0x463df1
and dword [ebp - 0xc38], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1d90]
cmp dword [ebp - 0xc38], eax
jg 0x463e12
mov dword [ebp - 0x1a90], 1
jmp 0x463e19
and dword [ebp - 0x1a90], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1d90]
cmp dword [ebp - 0x1a90], eax
jle 0x463e3a
mov dword [ebp - 0xc40], 1
jmp 0x463e41
and dword [ebp - 0xc40], 0
mov esi, dword [ebp - 0xc40]
sub esi, 0xa
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x23ac]
call fcn.0042bd87
mov dword [eax], esi
jmp 0x463ca6
jmp 0x463c61
jmp 0x463bff
cmp dword [ebp - 0x208], 0
je 0x463e77
jmp 0x463e7c
jmp 0x463bcf
lea ecx, [ebp - 0x23ac]
call fcn.0042bd6b
mov dword [ebp - 0x858], 2
mov dword [ebp - 0x858], 0x15
jmp 0x463eaa
mov eax, dword [ebp - 0x858]
dec eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 0xffffffe2
jle 0x463ff7
mov dword [ebp - 0x5c8], 0
mov byte [ebp - 0x286], 0
movzx eax, byte [ebp - 0x286]
test eax, eax
je 0x463ef3
push 0
push 0x771
push 0x1a73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x5c8], 0x15
jmp 0x463f0c
mov eax, dword [ebp - 0x5c8]
dec eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 0x12
jge 0x463ff2
push 3
lea ecx, [ebp - 0x2e6c]
call fcn.0042bc99
mov dword [ebp - 0x2ac4], 0xfffffffb
push 2
lea ecx, [ebp - 0x2868]
call fcn.0042bc99
mov dword [ebp - 0x14c], 0
jmp 0x463f56
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x463f78
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x2e6c]
call fcn.0042bd87
mov dword [eax], 0xc4530722
jmp 0x463f49
mov dword [ebp - 0x14c], 0
jmp 0x463f91
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x463fb3
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x2868]
call fcn.0042bd87
mov dword [eax], 0xffff
jmp 0x463f84
push 0
lea ecx, [ebp - 0x2868]
call fcn.0042bd87
mov dword [ebp - 0x1a98], eax
mov eax, dword [ebp - 0x1a98]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1a98]
mov dword [ecx], eax
lea ecx, [ebp - 0x2868]
call fcn.0042bd6b
lea ecx, [ebp - 0x2e6c]
call fcn.0042bd6b
jmp 0x463eff
jmp 0x463e9d
mov dword [ebp - 0x10c], 0
jmp 0x464010
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x46402c
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0xb58], 0x124f84b8
jmp 0x464003
mov dword [ebp - 0x4a4], 1
mov dword [ebp - 0x4a4], 0xffffffe3
jmp 0x46404f
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x15
je 0x4640bc
mov dword [ebp - 0x780], 0
jmp 0x464071
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 3
jge 0x46408d
mov eax, dword [ebp - 0x780]
mov dword [ebp + eax*4 - 0x326c], 0x1dbeccce
jmp 0x464064
mov byte [ebp - 0x361], 0
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x4640a7
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp + eax - 0x326c], ecx
jmp 0x464042
mov dword [ebp - 0x10c], 0
jmp 0x4640d5
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x4640f1
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x320c], 0xfffffffd
jmp 0x4640c8
mov dword [ebp - 0x154], 0xac204e2d
mov dword [ebp - 0x5d8], 0xfffffff7
mov dword [ebp - 0x5d0], 0
jmp 0x46411e
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 4
jge 0x46413a
mov eax, dword [ebp - 0x5d0]
mov dword [ebp + eax*4 - 0x2984], 0xfffffffa
jmp 0x464111
mov dword [ebp - 0x154], 0xffffffe3
jmp 0x464153
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffea
jne 0x464300
mov dword [ebp - 0x4f8], 6
mov dword [ebp - 0x1ab0], 4
mov dword [ebp - 0x900], 0
jmp 0x46418d
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 3
jge 0x4641a9
mov eax, dword [ebp - 0x900]
mov dword [ebp + eax*4 - 0x32b4], 0
jmp 0x464180
cmp dword [ebp - 0x4f8], 0
je 0x4641b7
jmp 0x464300
cmp dword [ebp - 0x4f8], 0
jne 0x4641e3
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x2984]
cmp dword [ebp + eax - 0x2984], ecx
jne 0x4641e3
and dword [ebp - 0xc48], 0
jmp 0x4641ed
mov dword [ebp - 0xc48], 1
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0xc48]
jg 0x464207
mov dword [ebp - 0xc50], 1
jmp 0x46420e
and dword [ebp - 0xc50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2984]
cmp dword [ebp - 0x4f8], eax
jle 0x46422f
mov dword [ebp - 0x99c], 1
jmp 0x464236
and dword [ebp - 0x99c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x99c]
mov dword [ebp + eax - 0x32b4], ecx
cmp dword [ebp - 0x99c], 4
jne 0x46425d
mov dword [ebp - 0x2254], 1
jmp 0x464264
and dword [ebp - 0x2254], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2984], 0x6dd2cc91
jg 0x464283
mov dword [ebp - 0x1aa0], 1
jmp 0x46428a
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0x1aa0]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0xc50], eax
je 0x4642b9
cmp dword [ebp - 0x5d8], 0
je 0x4642b9
mov dword [ebp - 0x1aa8], 1
jmp 0x4642c0
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0x1aa8]
neg eax
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x1ab0]
cmp dword [ebp - 0x4f8], eax
jle 0x4642e8
mov dword [ebp - 0xc58], 1
jmp 0x4642ef
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0x1ab0], eax
jmp 0x464146
mov dword [ebp - 0x154], 0x19
jmp 0x464319
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x1d
jl 0x46432e
mov dword [ebp - 0x5d8], 4
jmp 0x46430c
mov dword [ebp - 0xc8], 0
jmp 0x464347
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jg 0x464a95
push 2
lea ecx, [ebp - 0x1dac]
call fcn.0042bc99
mov dword [ebp - 0xe8], 0x13532fe2
mov dword [ebp - 0x225c], 0x4c266d8f
mov dword [ebp - 0x788], 0
jmp 0x46438e
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 2
jge 0x4643b0
push dword [ebp - 0x788]
lea ecx, [ebp - 0x1dac]
call fcn.0042bd87
mov dword [eax], 0xfffffff7
jmp 0x464381
mov dword [ebp - 0xe8], 1
jmp 0x4643c9
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x4644fb
mov dword [ebp - 0x5e0], 0x252604
mov dword [ebp - 0x5e0], 0
jmp 0x4643f9
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 1
jg 0x4644f6
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1dac]
call fcn.0042bd87
imul eax, dword [eax], 0xb534
mov esi, 0xda22
sub esi, eax
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1dac]
call fcn.0042bd87
imul esi, dword [eax]
sub esi, 0xdad9
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1dac]
call fcn.0042bd87
cmp esi, dword [eax]
je 0x46445f
mov dword [ebp - 0xc60], 1
jmp 0x464466
and dword [ebp - 0xc60], 0
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1dac]
call fcn.0042bd87
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc60]
jl 0x46448d
mov dword [ebp - 0x1ab8], 1
jmp 0x464494
and dword [ebp - 0x1ab8], 0
push 1
lea ecx, [ebp - 0x1dac]
call fcn.0042bd87
mov ecx, dword [ebp - 0x1ab8]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xe8]
jne 0x4644bd
mov dword [ebp - 0xc68], 1
jmp 0x4644c4
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xc68], eax
jl 0x4644de
mov dword [ebp - 0x1ac0], 1
jmp 0x4644e5
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0x225c], eax
jmp 0x4643ec
jmp 0x4643bc
lea ecx, [ebp - 0x1dac]
call fcn.0042bd6b
mov dword [ebp - 0x5e8], 0xe6e83846
mov dword [ebp - 0x2264], 0xa421e0be
mov dword [ebp - 0xc80], 0xbf35dd75
mov dword [ebp - 0x226c], 0x1b05
mov dword [ebp - 0x2acc], 0xd3b51a
cmp dword [ebp - 0x5e8], 0
jne 0x464572
cmp dword [ebp - 0x5e8], 0xfffffffc
jne 0x464556
mov dword [ebp - 0xc70], 1
jmp 0x46455d
and dword [ebp - 0xc70], 0
cmp dword [ebp - 0xc70], 0x8f21
jle 0x464572
and dword [ebp - 0x1ac8], 0
jmp 0x46457c
mov dword [ebp - 0x1ac8], 1
mov eax, dword [ebp - 0x1ac8]
inc eax
je 0x4645af
mov byte [ebp - 0x288], 0
movzx eax, byte [ebp - 0x288]
test eax, eax
je 0x4645aa
push 0
push 0
push 0x1da8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4647b7
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0xca8], 0xb6cd04cd
mov dword [ebp - 0x860], 0
jmp 0x4645dc
mov eax, dword [ebp - 0x860]
inc eax
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 3
jge 0x4645f8
mov eax, dword [ebp - 0x860]
mov dword [ebp + eax*4 - 0x2e7c], 0xfffffff6
jmp 0x4645cf
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x2e8], eax
jle 0x464612
mov dword [ebp - 0xc78], 1
jmp 0x464619
and dword [ebp - 0xc78], 0
cmp dword [ebp - 0xc78], 1
je 0x46462e
mov dword [ebp - 0x1ad0], 1
jmp 0x464635
and dword [ebp - 0x1ad0], 0
imul eax, dword [ebp - 0x1ad0], 0xfffe
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0xca8]
cmp dword [ebp - 0xc80], eax
jge 0x46465f
mov dword [ebp - 0x1ad8], 1
jmp 0x464666
and dword [ebp - 0x1ad8], 0
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x1ad8]
jne 0x464680
mov dword [ebp - 0x1ae0], 1
jmp 0x464687
and dword [ebp - 0x1ae0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2e7c]
dec eax
mov dword [ebp - 0xc88], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc88]
mov dword [ebp + eax - 0x2e7c], ecx
mov eax, dword [ebp - 0xc88]
cmp eax, dword [ebp - 0x1ae0]
jne 0x4646c8
mov dword [ebp - 0xc90], 1
jmp 0x4646cf
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0x5e8]
cmp eax, dword [ebp - 0xc90]
jg 0x4646e9
mov dword [ebp - 0x1ae8], 1
jmp 0x4646f0
and dword [ebp - 0x1ae8], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x1ae8], eax
jle 0x464710
mov eax, 0xfd47
test eax, eax
jne 0x464710
and dword [ebp - 0xc98], 0
jmp 0x46471a
mov dword [ebp - 0xc98], 1
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0xc98], eax
jle 0x464734
mov dword [ebp - 0x1af0], 1
jmp 0x46473b
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x1af0], eax
jg 0x464755
mov dword [ebp - 0xca0], 1
jmp 0x46475c
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0xca0]
inc eax
cmp eax, dword [ebp - 0x2e8]
jg 0x464777
mov dword [ebp - 0x1af8], 1
jmp 0x46477e
and dword [ebp - 0x1af8], 0
mov eax, dword [ebp - 0x1af8]
mov dword [ebp - 0x2264], eax
mov eax, dword [ebp - 0xca8]
cmp dword [ebp - 0x226c], eax
jg 0x4647a4
mov dword [ebp - 0x1b00], 1
jmp 0x4647ab
and dword [ebp - 0x1b00], 0
mov eax, dword [ebp - 0x1b00]
mov dword [ebp - 0x2e8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa0]
cmp dword [ebp + eax - 0xb58], ecx
jle 0x4647d8
mov dword [ebp - 0x2274], 1
jmp 0x4647df
and dword [ebp - 0x2274], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2ad4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb58], 0
je 0x464807
mov dword [ebp - 0xcb0], 1
jmp 0x46480e
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0xb58]
cmp dword [ebp - 0xcb0], eax
jge 0x46482f
mov dword [ebp - 0x1b08], 1
jmp 0x464836
and dword [ebp - 0x1b08], 0
cmp dword [ebp - 0x1b08], 0x7f51
jg 0x46484e
mov dword [ebp - 0xcb8], 1
jmp 0x464855
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xcb8], eax
jge 0x46486f
mov dword [ebp - 0x1b10], 1
jmp 0x464876
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x1b10]
cmp eax, dword [ebp - 0xa0]
jle 0x464897
mov dword [ebp - 0xcc0], 1
jmp 0x46489e
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xcc0], eax
jl 0x4648b8
mov dword [ebp - 0x1b18], 1
jmp 0x4648bf
and dword [ebp - 0x1b18], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x1b18]
jne 0x4648d9
mov dword [ebp - 0xa64], 1
jmp 0x4648e0
and dword [ebp - 0xa64], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa64]
mov dword [ebp + eax - 0x320c], ecx
cmp dword [ebp - 0xa64], 0
jne 0x46490e
cmp dword [ebp - 0xa0], 0
jne 0x46490e
and dword [ebp - 0xcc8], 0
jmp 0x464918
mov dword [ebp - 0xcc8], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xcc8], eax
jg 0x464932
mov dword [ebp - 0x1b20], 1
jmp 0x464939
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0x1b20]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0xb58]
cmp eax, dword [ebp - 0xcd0]
je 0x464966
mov dword [ebp - 0x1b28], 1
jmp 0x46496d
and dword [ebp - 0x1b28], 0
mov eax, dword [ebp - 0x1b28]
sub eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
imul eax, dword [ebp + ecx*4 - 0xb58]
test eax, eax
je 0x46499e
push 7
pop eax
test eax, eax
je 0x46499e
mov dword [ebp - 0xcd8], 1
jmp 0x4649a5
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0xcd8]
add eax, 0x5243b9c3
mov dword [ebp - 0x227c], eax
mov dword [ebp - 0x114], 0x9c28ade1
mov dword [ebp - 0x790], 0
jmp 0x4649d9
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 1
jge 0x4649f5
mov eax, dword [ebp - 0x790]
mov dword [ebp + eax*4 - 0x2284], 0
jmp 0x4649cc
mov dword [ebp - 0x114], 0
jmp 0x464a0e
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x464a2a
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x2284], 0x29be
jmp 0x464a01
mov dword [ebp - 0x114], 0
jmp 0x464a43
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x464a7e
mov byte [ebp - 0x2d6], 0
movzx eax, byte [ebp - 0x2d6]
test eax, eax
je 0x464a7c
push 0x1c40
push 0x17c2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x464a36
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0xb58], 0
je 0x464a90
jmp 0x464a95
jmp 0x46433a
jmp 0x46313c
mov dword [ebp - 0x4ac], 0xd29be1d9
mov dword [ebp - 0x5f0], 0
jmp 0x464abd
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 1
jge 0x464ad9
mov eax, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0x228c], 0x648261f
jmp 0x464ab0
mov dword [ebp - 0x4ac], 0
jmp 0x464af2
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jg 0x464b0f
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp + eax*4 - 0x228c], 0
je 0x464b0d
jmp 0x464b0f
jmp 0x464ae5
mov byte [ebp - 0x28a], 0
movzx eax, byte [ebp - 0x28a]
test eax, eax
je 0x464b6a
push 0
push 0x218d
push 0xeb0
push 0x16c3
push 0x23cc
push 0x1588
push 0x407
push 0x1095
push 0x1826
push 0x22cb
push 0x251e
push 0x83b
push 0x1a9e
push 0x124d
call dword [sym.imp.GDI32.dll_CreateFontA]
cmp dword [ebp + 8], 2
jl 0x473683
mov dword [ebp - 0x2adc], 2
mov byte [ebp - 0x3b1], 0
movzx eax, byte [ebp - 0x3b1]
test eax, eax
je 0x464b9a
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [ebp - 0x28c], 0
movzx eax, byte [ebp - 0x28c]
test eax, eax
je 0x464bc8
push 0x194a
push 0x1e5
push 0x219
push 0x242
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x798], 0x2f520a04
mov dword [ebp - 0x4fc], 0x4c5f6b4a
mov dword [ebp - 0x5f8], 0x35d7d231
mov dword [ebp - 0xd38], 0x9f019d5c
mov dword [ebp - 0x22b4], 3
mov dword [ebp - 0x22bc], 0x6a1ea569
mov dword [ebp - 0x22c4], 0xf1cc5ca3
mov dword [ebp - 0x8d0], 0
jmp 0x464c2e
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 1
jge 0x464c4a
mov eax, dword [ebp - 0x8d0]
mov dword [ebp + eax*4 - 0x1b80], 0x6f6324b7
jmp 0x464c21
mov dword [ebp - 0x18], 0
jmp 0x464c5a
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff5
jg 0x464f29
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0x2d8], 0
movzx eax, byte [ebp - 0x2d8]
test eax, eax
je 0x464c96
push 0
push 0
push 0x2456
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x18], eax
je 0x464cad
mov dword [ebp - 0x1b30], 1
jmp 0x464cb4
and dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1b30], eax
jne 0x464ccb
mov dword [ebp - 0xce0], 1
jmp 0x464cd2
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xce0], eax
jge 0x464cec
mov dword [ebp - 0x1b38], 1
jmp 0x464cf3
and dword [ebp - 0x1b38], 0
cmp dword [ebp - 0x1b38], 0xe58ed0bd
ja 0x464d15
xor eax, eax
jne 0x464d15
mov eax, 0xfa89
test eax, eax
jne 0x464d15
and dword [ebp - 0xce8], 0
jmp 0x464d1f
mov dword [ebp - 0xce8], 1
cmp dword [ebp - 0xce8], 0xdb62
jle 0x464d38
xor eax, eax
jne 0x464d38
and dword [ebp - 0x1b40], 0
jmp 0x464d42
mov dword [ebp - 0x1b40], 1
mov eax, dword [ebp - 0x1b40]
dec eax
sub eax, dword [ebp - 0x18]
cmp eax, 0xfffffffe
jle 0x464d5d
mov dword [ebp - 0xcf0], 1
jmp 0x464d64
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xcf0], eax
jge 0x464d7e
mov dword [ebp - 0x2294], 1
jmp 0x464d85
and dword [ebp - 0x2294], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xa8]
cmp eax, 0xf8de905f
jae 0x464daa
cmp dword [ebp - 0xa8], 0
je 0x464daa
mov dword [ebp - 0x1b48], 1
jmp 0x464db1
and dword [ebp - 0x1b48], 0
cmp dword [ebp - 0x1b48], 1
jle 0x464dc6
mov dword [ebp - 0xcf8], 1
jmp 0x464dcd
and dword [ebp - 0xcf8], 0
mov eax, 0x4f23
sub eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0xcf8]
jne 0x464dec
mov dword [ebp - 0x229c], 1
jmp 0x464df3
and dword [ebp - 0x229c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x18], eax
jg 0x464e10
cmp dword [ebp - 0xa8], 0
jne 0x464e10
and dword [ebp - 0x1b50], 0
jmp 0x464e1a
mov dword [ebp - 0x1b50], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1b50], eax
je 0x464e31
mov dword [ebp - 0xd00], 1
jmp 0x464e38
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0xd00]
cmp eax, dword [ebp - 0x18]
je 0x464e56
mov dword [ebp - 0x1b58], 1
jmp 0x464e5d
and dword [ebp - 0x1b58], 0
mov eax, dword [ebp - 0x798]
imul eax, dword [ebp - 0x1b58]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xa8]
jle 0x464e81
mov dword [ebp - 0xd08], 1
jmp 0x464e88
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0xd08]
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0
je 0x464eb2
mov eax, 0xfffe
test eax, eax
je 0x464eb2
mov dword [ebp - 0x1b60], 1
jmp 0x464eb9
and dword [ebp - 0x1b60], 0
mov eax, dword [ebp - 0x1b60]
sub eax, 0x5d63
cmp eax, dword [ebp - 0x18]
je 0x464ed5
mov dword [ebp - 0xd10], 1
jmp 0x464edc
and dword [ebp - 0xd10], 0
cmp dword [ebp - 0xd10], 0xab3921de
ja 0x464ef4
mov dword [ebp - 0x1b68], 1
jmp 0x464efb
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1b68], eax
jne 0x464f10
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x464f14
cmp dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x798]
mov dword [ebp - 0x5f8], eax
jmp 0x464c53
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2ae4], eax
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x465080
mov eax, 0x36c2
test eax, eax
je 0x465049
mov eax, dword [ebp - 0x4fc]
imul eax, dword [ebp - 0x4fc]
test eax, eax
jne 0x464f6d
cmp dword [ebp - 0x5f8], 0
jne 0x464f6d
and dword [ebp - 0xd18], 0
jmp 0x464f77
mov dword [ebp - 0xd18], 1
mov eax, dword [ebp - 0x5f8]
cmp dword [ebp - 0xd18], eax
jl 0x464f91
mov dword [ebp - 0x1b70], 1
jmp 0x464f98
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0xd38]
cmp dword [ebp - 0x1b70], eax
jge 0x464fb2
mov dword [ebp - 0xd20], 1
jmp 0x464fb9
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp - 0xd20], eax
jge 0x464fd3
mov dword [ebp - 0x1b78], 1
jmp 0x464fda
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x798]
cmp dword [ebp - 0x1b78], eax
jle 0x464ff4
mov dword [ebp - 0xd28], 1
jmp 0x464ffb
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1b80]
je 0x46501d
mov dword [ebp - 0x22a4], 1
jmp 0x465024
and dword [ebp - 0x22a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + eax - 0x1b80], ecx
jge 0x465042
mov dword [ebp - 0xd30], 1
jmp 0x465049
and dword [ebp - 0xd30], 0
cmp dword [ebp - 0x5f8], 0xfffffffc
je 0x46505e
mov dword [ebp - 0x1b88], 1
jmp 0x465065
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jb 0x465080
mov dword [ebp - 0x1b90], 1
jmp 0x465087
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0xd38]
cmp dword [ebp - 0x1b90], eax
jg 0x4650a1
mov dword [ebp - 0xd40], 1
jmp 0x4650a8
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
inc eax
inc eax
je 0x4650c7
cmp dword [ebp - 0x798], 0
je 0x4650c7
mov dword [ebp - 0x22ac], 1
jmp 0x4650ce
and dword [ebp - 0x22ac], 0
mov eax, dword [ebp - 0x22b4]
mov dword [ebp - 0x2aec], eax
xor eax, eax
inc eax
jne 0x4650f1
cmp dword [ebp - 0x22bc], 0
jne 0x4650f1
and dword [ebp - 0x1b98], 0
jmp 0x4650fb
mov dword [ebp - 0x1b98], 1
mov eax, dword [ebp - 0x1b98]
mov dword [ebp - 0x22c4], eax
mov dword [ebp - 0x278c], 0xf9b3198a
mov dword [ebp - 0x2788], 0xf9b3198a
mov dword [ebp - 0x2784], 0xf9b3198a
mov dword [ebp - 0x2780], 0xf9b3198a
lea ecx, [ebp - 0xaed]
call fcn.0042bd96
push eax
lea eax, [ebp - 0x277c]
push eax
lea eax, [ebp - 0x278c]
push eax
lea ecx, [ebp - 0x3378]
call fcn.0042bd99
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1e90]
call fcn.0042bd45
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x22cc], 0xbd4aa41a
mov dword [ebp - 0x600], 0
jmp 0x465191
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 2
jge 0x4651ad
mov eax, dword [ebp - 0x600]
mov dword [ebp + eax*4 - 0x2698], 6
jmp 0x465184
mov dword [ebp - 0x15c], 3
jmp 0x4651c6
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x465390
mov eax, 0x54a20a29
test eax, eax
je 0x4651fe
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x1e90]
call fcn.0042bd87
cmp dword [eax], 0
je 0x4651fe
mov dword [ebp - 0xd48], 1
jmp 0x465205
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xd48]
add eax, 0x4c5c03b5
cmp eax, 0xfffffcb3
jl 0x46526b
mov dword [ebp - 0x868], 0x69393dda
mov dword [ebp - 0x868], 0
jmp 0x46523a
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 3
jg 0x465266
mov byte [ebp - 0x28e], 0
movzx eax, byte [ebp - 0x28e]
test eax, eax
je 0x465264
push 0x1d54
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x46522d
jmp 0x46538b
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x1e90]
call fcn.0042bd87
cmp dword [eax], 0
ja 0x46528d
mov dword [ebp - 0x1ba0], 1
jmp 0x465294
and dword [ebp - 0x1ba0], 0
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x1e90]
call fcn.0042bd87
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1ba0]
jg 0x4652bb
mov dword [ebp - 0xd50], 1
jmp 0x4652c2
and dword [ebp - 0xd50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2698]
mov dword [ebp - 0x2af4], eax
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x1e90]
call fcn.0042bd87
mov esi, eax
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x1e90]
call fcn.0042bd87
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x46530b
mov dword [ebp - 0x1ba8], 1
jmp 0x465312
and dword [ebp - 0x1ba8], 0
mov eax, dword [ebp - 0xd50]
cmp eax, dword [ebp - 0x1ba8]
je 0x46532c
mov dword [ebp - 0xd58], 1
jmp 0x465333
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2698]
jl 0x465355
mov dword [ebp - 0x1bb0], 1
jmp 0x46535c
and dword [ebp - 0x1bb0], 0
mov eax, dword [ebp - 0x1bb0]
mov dword [ebp - 0x22cc], eax
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x46538b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x4651b9
lea ecx, [ebp - 0x1e90]
call fcn.0042bd6b
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x1bc8], 4
mov dword [ebp - 0x9a4], 0x5725d367
mov dword [ebp - 0x159c], 0x821342f3
mov dword [ebp - 0x22d4], 0xe3ca3691
mov dword [ebp - 0x22dc], 0xfffffff9
mov dword [ebp - 0x1bc8], 0xffffffff
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x1bc8], eax
jg 0x465405
mov dword [ebp - 0x1594], 1
jmp 0x46540c
and dword [ebp - 0x1594], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], eax
je 0x465426
mov dword [ebp - 0xd64], 1
jmp 0x46542d
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xd64], eax
jl 0x465447
mov dword [ebp - 0xd6c], 1
jmp 0x46544e
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x1594]
cmp eax, dword [ebp - 0xd6c]
jge 0x465468
mov dword [ebp - 0x19ac], 1
jmp 0x46546f
and dword [ebp - 0x19ac], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x19ac], eax
jg 0x465489
mov dword [ebp - 0xd74], 1
jmp 0x465490
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0xd74]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x9a4]
sub eax, 0x694d2b5f
mov dword [ebp - 0x159c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x159c], eax
jg 0x4654ce
mov dword [ebp - 0xd7c], 1
jmp 0x4654d5
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0xd7c]
cmp eax, dword [ebp - 0x22d4]
jle 0x465501
cmp dword [ebp - 0x9a4], 0
jne 0x465501
or eax, 0xffffffff
jne 0x465501
and dword [ebp - 0x1bc0], 0
jmp 0x46550b
mov dword [ebp - 0x1bc0], 1
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x1bc0], eax
jne 0x465525
mov dword [ebp - 0xd84], 1
jmp 0x46552c
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x22dc], eax
mov byte [ebp - 0x290], 0
movzx eax, byte [ebp - 0x290]
test eax, eax
je 0x465572
push 0x1fa0
push 0x10dc
push 0x193f
push 0x2561
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [ebp - 0x4cc], 0x5c7a00f4
mov dword [ebp - 0x7a0], 0xfffffff7
mov dword [ebp - 0x608], 0
jmp 0x46559f
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 3
jge 0x4655bb
mov eax, dword [ebp - 0x608]
mov dword [ebp + eax*4 - 0x3218], 0xfffffff9
jmp 0x465592
mov dword [ebp - 0x7a0], 2
jmp 0x4655d4
mov eax, dword [ebp - 0x7a0]
dec eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 0
jl 0x4656a3
mov dword [ebp - 0x610], 0xfffffff7
mov dword [ebp - 0x610], 0
jmp 0x465604
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 2
jg 0x46569e
mov dword [ebp - 0x928], 0
jmp 0x46562a
mov eax, dword [ebp - 0x928]
inc eax
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 3
jge 0x465646
mov eax, dword [ebp - 0x928]
mov dword [ebp + eax*4 - 0x23bc], 1
jmp 0x46561d
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x23bc], 0
jmp 0x465671
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x23bc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x23bc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x23bc], 3
jge 0x465699
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x23bc]
mov dword [ebp + eax*4 - 0x3218], 0
jmp 0x465658
jmp 0x4655f7
jmp 0x4655c7
mov dword [ebp - 0x140], 0xffffffff
push 2
lea ecx, [ebp - 0x1e18]
call fcn.0042bc99
mov dword [ebp - 0xe0], 0x13532fe2
mov dword [ebp - 0x22e4], 0x4c266d8f
mov dword [ebp - 0x618], 0
jmp 0x4656e7
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 2
jge 0x465709
push dword [ebp - 0x618]
lea ecx, [ebp - 0x1e18]
call fcn.0042bd87
mov dword [eax], 0xfffffff7
jmp 0x4656da
mov dword [ebp - 0xe0], 1
jmp 0x465722
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x465854
mov dword [ebp - 0x7a8], 0x252604
mov dword [ebp - 0x7a8], 0
jmp 0x465752
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 1
jg 0x46584f
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1e18]
call fcn.0042bd87
imul eax, dword [eax], 0xb534
mov esi, 0xda22
sub esi, eax
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1e18]
call fcn.0042bd87
imul esi, dword [eax]
sub esi, 0xdad9
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1e18]
call fcn.0042bd87
cmp esi, dword [eax]
je 0x4657b8
mov dword [ebp - 0x15a4], 1
jmp 0x4657bf
and dword [ebp - 0x15a4], 0
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1e18]
call fcn.0042bd87
mov eax, dword [eax]
cmp eax, dword [ebp - 0x15a4]
jl 0x4657e6
mov dword [ebp - 0xd8c], 1
jmp 0x4657ed
and dword [ebp - 0xd8c], 0
push 1
lea ecx, [ebp - 0x1e18]
call fcn.0042bd87
mov ecx, dword [ebp - 0xd8c]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xe0]
jne 0x465816
mov dword [ebp - 0x19b4], 1
jmp 0x46581d
and dword [ebp - 0x19b4], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x19b4], eax
jl 0x465837
mov dword [ebp - 0xd94], 1
jmp 0x46583e
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0x22e4], eax
jmp 0x465745
jmp 0x465715
lea ecx, [ebp - 0x1e18]
call fcn.0042bd6b
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x88], 0xd4e06482
mov dword [ebp - 0x164], 0
jmp 0x465889
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x4658a5
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x1ce8], 0x887cf2e5
jmp 0x46587c
mov dword [ebp - 0x164], 0
jmp 0x4658be
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x4658da
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x3230], 0xbd791f9e
jmp 0x4658b1
mov dword [ebp - 0x88], 0xb
jmp 0x4658f3
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x11
jg 0x46590e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1ce8], 0x82ba24cf
jmp 0x4658e6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ce8]
mov dword [ebp - 0x2afc], eax
xor eax, eax
jne 0x465993
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1ce8], 0x7289fff1
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x1ce8], 0x5f40
test eax, eax
je 0x465963
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ce8], 0
je 0x465963
mov dword [ebp - 0x15ac], 1
jmp 0x46596a
and dword [ebp - 0x15ac], 0
mov eax, dword [ebp - 0x88]
imul ecx, dword [ebp - 0x15ac], 0xffff
add eax, ecx
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x1ce8]
jne 0x465993
and dword [ebp - 0xd9c], 0
jmp 0x46599d
mov dword [ebp - 0xd9c], 1
cmp dword [ebp - 0xd9c], 0xfff8
ja 0x4659b5
mov dword [ebp - 0x22ec], 1
jmp 0x4659bc
and dword [ebp - 0x22ec], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ce8]
mov dword [ebp - 0x2b04], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ce8], 0x9da97273
jne 0x4659f5
mov eax, 0xe9f9
test eax, eax
je 0x4659f5
mov dword [ebp - 0x1bbc], 1
jmp 0x4659fc
and dword [ebp - 0x1bbc], 0
cmp dword [ebp - 0x1bbc], 0xe105
je 0x465a14
mov dword [ebp - 0xda4], 1
jmp 0x465a1b
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xda4], eax
je 0x465a35
mov dword [ebp - 0x22f4], 1
jmp 0x465a3c
and dword [ebp - 0x22f4], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2b0c], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2b14], eax
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3230]
jne 0x465a7b
mov dword [ebp - 0x15b4], 1
jmp 0x465a82
and dword [ebp - 0x15b4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x15b4], eax
jge 0x465a9c
mov dword [ebp - 0xdac], 1
jmp 0x465aa3
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x504], 1
push 1
lea ecx, [ebp - 0x2e8c]
call fcn.0042bc99
mov dword [ebp - 0x620], 0
jmp 0x465adf
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 1
jge 0x465b01
push dword [ebp - 0x620]
lea ecx, [ebp - 0x2e8c]
call fcn.0042bd87
mov dword [eax], 0x9b64
jmp 0x465ad2
mov byte [ebp - 0x2da], 0
movzx eax, byte [ebp - 0x2da]
test eax, eax
je 0x465b2a
push 0x2046
push 0
push 0x1cf9
push 0x1af7
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov byte [ebp - 0x292], 0
movzx eax, byte [ebp - 0x292]
test eax, eax
je 0x465b52
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
lea ecx, [ebp - 0x2e8c]
call fcn.0042bd6b
push 1
lea ecx, [ebp - 0x1ecc]
call fcn.0042bc99
mov dword [ebp - 0xf8], 9
mov dword [ebp - 0xaf4], 0xffffffff
mov dword [ebp - 0x2314], 1
mov byte [ebp - 0x3d9], 0
movzx eax, byte [ebp - 0x3d9]
test eax, eax
je 0x465ba9
push 0x5f6
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov dword [ebp - 0xf8], 0xf
jmp 0x465bc2
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 4
jne 0x465e5b
mov dword [ebp - 0x2f0], 0xfffffffd
mov dword [ebp - 0x9ac], 0xfffffff9
mov dword [ebp - 0x2f0], 0xffffffe5
jmp 0x465bfc
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0xfffffff8
jne 0x465d7c
mov dword [ebp - 0x2b1c], 0x744d0289
mov dword [ebp - 0x2b24], 7
mov dword [ebp - 0x19bc], 0xfffffff9
mov dword [ebp - 0x22fc], 0xc0e2632c
mov dword [ebp - 0x230c], 0
mov dword [ebp - 0x870], 0
jmp 0x465c54
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 3
jge 0x465c70
mov eax, dword [ebp - 0x870]
mov dword [ebp + eax*4 - 0x2e9c], 0xb5f0b10
jmp 0x465c47
mov eax, dword [ebp - 0x19bc]
inc eax
mov dword [ebp - 0x19bc], eax
cmp dword [ebp - 0x22fc], 0xffffffff
je 0x465c92
mov dword [ebp - 0xdb4], 1
jmp 0x465c99
and dword [ebp - 0xdb4], 0
cmp dword [ebp - 0xdb4], 1
jae 0x465cbe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e9c], 0
je 0x465cbe
mov dword [ebp - 0x2304], 1
jmp 0x465cc5
and dword [ebp - 0x2304], 0
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x2b2c], eax
cmp dword [ebp - 0xaf4], 0xfffffff6
jae 0x465ce6
mov dword [ebp - 0x15bc], 1
jmp 0x465ced
and dword [ebp - 0x15bc], 0
mov eax, dword [ebp - 0x15bc]
mov dword [ebp - 0x9ac], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e9c]
cmp dword [ebp - 0x9ac], eax
jne 0x465d1f
cmp dword [ebp - 0x2f0], 0
jne 0x465d1f
and dword [ebp - 0xdbc], 0
jmp 0x465d29
mov dword [ebp - 0xdbc], 1
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0xdbc]
jl 0x465d43
mov dword [ebp - 0x1d4c], 1
jmp 0x465d4a
and dword [ebp - 0x1d4c], 0
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x1d4c], eax
jne 0x465d64
mov dword [ebp - 0xdc4], 1
jmp 0x465d6b
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x230c], eax
jmp 0x465bef
mov eax, dword [ebp - 0xf8]
inc eax
je 0x465d9a
cmp dword [ebp - 0xaf4], 0
je 0x465d9a
mov dword [ebp - 0x15c4], 1
jmp 0x465da1
and dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x9ac]
cmp dword [ebp - 0x15c4], eax
jne 0x465dbb
mov dword [ebp - 0xdcc], 1
jmp 0x465dc2
and dword [ebp - 0xdcc], 0
cmp dword [ebp - 0xdcc], 0x1904e20e
jge 0x465dda
mov dword [ebp - 0x19c4], 1
jmp 0x465de1
and dword [ebp - 0x19c4], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x19c4]
cmp eax, dword [ebp - 0xf8]
jge 0x465e01
mov dword [ebp - 0xdd4], 1
jmp 0x465e08
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xdd4], eax
jne 0x465e22
mov dword [ebp - 0x15cc], 1
jmp 0x465e29
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x15cc]
jg 0x465e43
mov dword [ebp - 0xddc], 1
jmp 0x465e4a
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0xddc]
mov dword [ebp - 0x2314], eax
jmp 0x465bb5
push 3
lea ecx, [ebp - 0x2608]
call fcn.0042bc99
mov dword [ebp - 0x7b0], 0x31713b91
mov dword [ebp - 0xe04], 0x3ccde6bc
mov dword [ebp - 0x2b34], 1
mov dword [ebp - 0x2334], 2
mov dword [ebp - 0x2b3c], 0
mov dword [ebp - 0x2b44], 1
mov dword [ebp - 0x9b4], 0xffff
mov dword [ebp - 0x628], 0
jmp 0x465ec7
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 1
jge 0x465ee3
mov eax, dword [ebp - 0x628]
mov dword [ebp + eax*4 - 0x15d4], 0x651162f6
jmp 0x465eba
mov dword [ebp - 0x7b0], 0
jmp 0x465efc
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 4
jle 0x4662e4
mov dword [ebp - 0x273c], 1
mov dword [ebp - 0x2738], 1
mov dword [ebp - 0x2734], 1
mov dword [ebp - 0x2730], 1
lea ecx, [ebp - 0xac1]
call fcn.0042bd96
push eax
lea eax, [ebp - 0x272c]
push eax
lea eax, [ebp - 0x273c]
push eax
lea ecx, [ebp - 0x32f8]
call fcn.0042bd99
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x25c0]
call fcn.0042bd45
mov dword [ebp - 0xa6c], 6
mov dword [ebp - 0x233c], 0x1915e308
mov dword [ebp - 0x630], 0
jmp 0x465f93
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 2
jge 0x465faf
mov eax, dword [ebp - 0x630]
mov dword [ebp + eax*4 - 0x26a0], 0x1aa84cbe
jmp 0x465f86
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x465fcc
push 0x19aa
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
lea ecx, [ebp - 0x25c0]
call fcn.0042bd87
and dword [eax], 0
jmp 0x466002
push 2
lea ecx, [ebp - 0x25c0]
call fcn.0042bd87
mov dword [ebp - 0x1bc4], eax
mov eax, dword [ebp - 0x1bc4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1bc4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x25c0]
call fcn.0042bd87
cmp dword [eax], 0xffffffef
jl 0x4662d4
mov dword [ebp - 0x1cbc], 0xffffffff
mov dword [ebp - 0x2344], 0x26a056eb
mov dword [ebp - 0x2b4c], 6
mov dword [ebp - 0x2324], 2
mov dword [ebp - 0x2b54], 0x4cd021aa
mov dword [ebp - 0x2b5c], 0xfffffffb
mov dword [ebp - 0x231c], 0xeea3821c
mov dword [ebp - 0x8d8], 0
jmp 0x466077
mov eax, dword [ebp - 0x8d8]
inc eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 3
jge 0x466093
mov eax, dword [ebp - 0x8d8]
mov dword [ebp + eax*4 - 0x2eac], 0xda2ca335
jmp 0x46606a
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x4660b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword [ebp - 0x1cbc]
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0xa6c], 0
jne 0x4662b2
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x231c]
cmp dword [ebp + eax - 0x15d4], ecx
jg 0x4660ec
mov dword [ebp - 0x19cc], 1
jmp 0x4660f3
and dword [ebp - 0x19cc], 0
cmp dword [ebp - 0xa6c], 0
jne 0x466115
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2eac], 0
jne 0x466115
and dword [ebp - 0xde4], 0
jmp 0x46611f
mov dword [ebp - 0xde4], 1
cmp dword [ebp - 0xde4], 1
jbe 0x466151
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26a0], 0
jne 0x466151
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15d4], 0
jne 0x466151
and dword [ebp - 0xdec], 0
jmp 0x46615b
mov dword [ebp - 0xdec], 1
imul eax, dword [ebp - 0xdec], 0xffffffff
inc eax
cmp dword [ebp - 0x19cc], eax
jg 0x466177
mov dword [ebp - 0xdf4], 1
jmp 0x46617e
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0xe04]
cmp dword [ebp - 0xdf4], eax
jne 0x46619e
cmp dword [ebp - 0x2324], 0
jne 0x46619e
and dword [ebp - 0x15dc], 0
jmp 0x4661a8
mov dword [ebp - 0x15dc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2eac]
cmp dword [ebp - 0x15dc], eax
jge 0x4661cd
xor eax, eax
je 0x4661cd
mov dword [ebp - 0xdfc], 1
jmp 0x4661d4
and dword [ebp - 0xdfc], 0
cmp dword [ebp - 0xdfc], 0xb18
jle 0x4661ec
mov dword [ebp - 0x232c], 1
jmp 0x4661f3
and dword [ebp - 0x232c], 0
mov eax, dword [ebp - 0x1cbc]
mov dword [ebp - 0x2b64], eax
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x2b6c], eax
mov eax, dword [ebp - 0x9b4]
inc eax
mov dword [ebp - 0x9b4], eax
cmp dword [ebp - 0x2334], 0xffffffff
jne 0x46622d
mov dword [ebp - 0x15e4], 1
jmp 0x466234
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0xe04]
cmp dword [ebp - 0x15e4], eax
je 0x46624e
mov dword [ebp - 0xe14], 1
mov eax, dword [ebp - 0x233c]
imul eax, dword [ebp - 0xe14]
mov dword [ebp - 0x2344], eax
jmp 0x465fde
lea ecx, [ebp - 0x25c0]
call fcn.0042bd6b
jmp 0x465eef
mov dword [ebp - 0x2b74], 0xb3c6
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x466320
push 0x1cc
push 0x1730
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x46634e
push 0
push 0x172d
push 0x1717
push 0x104d
push 0xc4f
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x16c], 0
jmp 0x466367
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x466386
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x1ecc]
call fcn.0042bd87
and dword [eax], 0
jmp 0x46635a
mov dword [ebp - 0x234c], 0xfffffff8
mov dword [ebp - 0x638], 0
jmp 0x4663a9
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 3
jge 0x4663c5
mov eax, dword [ebp - 0x638]
mov dword [ebp + eax*4 - 0x3248], 0xfffffff7
jmp 0x46639c
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x4663e4
push 0x110c
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3248]
mov dword [ebp - 0x234c], eax
mov dword [ebp - 0x16c], 0
jmp 0x466410
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x466432
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x2608]
call fcn.0042bd87
mov dword [eax], 1
jmp 0x466403
push 1
lea ecx, [ebp - 0x2ebc]
call fcn.0042bc99
mov dword [ebp - 0x7b8], 0
jmp 0x466458
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 1
jge 0x46647a
push dword [ebp - 0x7b8]
lea ecx, [ebp - 0x2ebc]
call fcn.0042bd87
mov dword [eax], 0x6bdd
jmp 0x46644b
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x466494
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x4664b5
push 0
push 0x1e6b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
lea ecx, [ebp - 0x2ebc]
call fcn.0042bd6b
mov dword [ebp - 0xbc], 0x91a049fe
mov dword [ebp - 0x15fc], 0xa094
mov dword [ebp - 0x235c], 1
mov byte [ebp - 0x3b9], 0
movzx eax, byte [ebp - 0x3b9]
test eax, eax
je 0x466507
push 0x2046
push 0
push 0x1cf9
push 0x1af7
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0xbc], 2
jmp 0x466520
cmp dword [ebp - 0xbc], 5
jl 0x4667e2
mov dword [ebp - 0x90], 0xaa39ed08
mov dword [ebp - 0x1e0], 0
jmp 0x466550
cmp dword [ebp - 0x1e0], 2
jge 0x46656c
mov byte [ebp - 0x29e], 0
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x408], 0x7a8c
mov dword [ebp - 0x2f8], 3
mov dword [ebp - 0x1614], 0xfffffffc
mov dword [ebp - 0x9c4], 7
push 3
lea ecx, [ebp - 0x2ecc]
call fcn.0042bc99
mov dword [ebp - 0x640], 0
jmp 0x46683e
cmp dword [ebp - 0x640], 3
jge 0x466860
cmp dword [ebp + 8], 1
jne 0x475b7e
mov dword [ebp - 0x6c], 0xf5720e83
push 3
lea ecx, [ebp - 0x24ac]
call fcn.0042bc99
mov dword [ebp - 0x2690], 8
mov dword [ebp - 0x268c], 8
mov dword [ebp - 0x2688], 8
mov dword [ebp - 0x2684], 8
mov dword [ebp - 0x2778], 0xcb2
mov dword [ebp - 0x2774], 0xcb2
mov dword [ebp - 0x2770], 0xcb2
mov dword [ebp - 0x276c], 0xcb2
lea ecx, [ebp - 0xa85]
call fcn.0042bd96
push eax
lea eax, [ebp - 0x2768]
push eax
lea eax, [ebp - 0x2778]
push eax
lea ecx, [ebp - 0x3338]
call fcn.0042bd99
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x32e4]
call fcn.0042bd45
mov dword [ebp - 0x72c], 0
jmp 0x47373f
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 3
jge 0x473761
push dword [ebp - 0x72c]
lea ecx, [ebp - 0x24ac]
call fcn.0042bd87
mov dword [eax], 0xde9829cb
jmp 0x473732
cmp dword [ebp - 0x6c], 0
je 0x4738fa
mov dword [ebp - 0x9b0], 0xfffffffd
mov dword [ebp - 0x11f8], 0xfffffffb
mov dword [ebp - 0x1230], 1
or eax, 0xffffffff
je 0x473845
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x30dc], eax
cmp dword [ebp - 0x9b0], 0
jne 0x4737b0
mov dword [ebp - 0x11e8], 1
jmp 0x4737b7
and dword [ebp - 0x11e8], 0
cmp dword [ebp - 0x11e8], 0x3b37
jl 0x4737d2
cmp dword [ebp - 0x6c], 0
jne 0x4737d2
and dword [ebp - 0x11f0], 0
jmp 0x4737dc
mov dword [ebp - 0x11f0], 1
mov eax, dword [ebp - 0x11f0]
mov dword [ebp - 0x11f8], eax
imul eax, dword [ebp - 0x11f8], 0x75d5
cmp eax, 0x9a2b
jg 0x473805
mov dword [ebp - 0x1200], 1
jmp 0x47380c
and dword [ebp - 0x1200], 0
cmp dword [ebp - 0x1200], 0xfff6
je 0x473824
mov dword [ebp - 0x1208], 1
jmp 0x47382b
and dword [ebp - 0x1208], 0
mov eax, dword [ebp - 0x9b0]
cmp eax, dword [ebp - 0x1208]
jne 0x473845
mov dword [ebp - 0x1210], 1
jmp 0x47384c
and dword [ebp - 0x1210], 0
mov eax, dword [ebp - 0x1210]
add eax, 0xf746
cmp eax, dword [ebp - 0x9b0]
jl 0x47386b
mov dword [ebp - 0x1218], 1
jmp 0x473872
and dword [ebp - 0x1218], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1218], eax
je 0x47388f
mov eax, 0x59bb7a14
test eax, eax
jne 0x47388f
and dword [ebp - 0x1220], 0
jmp 0x473899
mov dword [ebp - 0x1220], 1
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1220], eax
jle 0x4738b0
mov dword [ebp - 0x1228], 1
jmp 0x4738b7
and dword [ebp - 0x1228], 0
mov eax, dword [ebp - 0x1228]
mov dword [ebp - 0x1230], eax
cmp dword [ebp - 0x1230], 0x5352
jge 0x4738db
mov dword [ebp - 0x21a8], 1
jmp 0x4738e2
and dword [ebp - 0x21a8], 0
push 1
lea ecx, [ebp - 0x24ac]
call fcn.0042bd87
mov dword [eax], 0xa0c0e075
jmp 0x473afb
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x6c], 0xfffffff7
jmp 0x473914
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffff
jge 0x473ae1
mov dword [ebp - 0x444], 6
mov dword [ebp - 0x444], 3
jmp 0x473941
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0xc
jge 0x473957
cmp dword [ebp - 0x43c], 0
je 0x473955
jmp 0x473957
jmp 0x473934
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x473970
cmp dword [ebp - 0x6c], 0
je 0x473970
mov dword [ebp - 0x1238], 1
jmp 0x473977
and dword [ebp - 0x1238], 0
push 2
lea ecx, [ebp - 0x24ac]
call fcn.0042bd87
mov ecx, dword [ebp - 0x1238]
cmp ecx, dword [eax]
jg 0x47399a
mov dword [ebp - 0x1240], 1
jmp 0x4739a1
and dword [ebp - 0x1240], 0
cmp dword [ebp - 0x1240], 0x502e
jge 0x4739cb
push 1
lea ecx, [ebp - 0x24ac]
call fcn.0042bd87
cmp dword [eax], 0
je 0x4739cb
mov dword [ebp - 0x1248], 1
jmp 0x4739d2
and dword [ebp - 0x1248], 0
mov eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x1248], eax
jge 0x4739ec
mov dword [ebp - 0x1250], 1
jmp 0x4739f3
and dword [ebp - 0x1250], 0
imul eax, dword [ebp - 0x1250], 0x2629
cmp eax, dword [ebp - 0x43c]
jl 0x473a11
mov dword [ebp - 0x1258], 1
jmp 0x473a18
and dword [ebp - 0x1258], 0
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x43c]
add ecx, dword [ebp - 0x1258]
imul eax, ecx
cmp dword [ebp - 0x6c], eax
jle 0x473a3e
mov dword [ebp - 0x1260], 1
jmp 0x473a45
and dword [ebp - 0x1260], 0
cmp dword [ebp - 0x1260], 0xc20b
je 0x473a5d
mov dword [ebp - 0x1268], 1
jmp 0x473a64
and dword [ebp - 0x1268], 0
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0x1268]
jge 0x473a84
mov eax, 0xe69c
test eax, eax
jne 0x473a84
and dword [ebp - 0x1270], 0
jmp 0x473a8e
mov dword [ebp - 0x1270], 1
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1270], eax
jne 0x473aa5
mov dword [ebp - 0x2328], 1
jmp 0x473aac
and dword [ebp - 0x2328], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2690]
mov dword [ebp - 0x2ba0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2690]
mov dword [ebp - 0x2e70], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x444], eax
jmp 0x47390d
mov byte [ebp - 0x2c7], 0
movzx eax, byte [ebp - 0x2c7]
test eax, eax
je 0x473afb
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 0x2c9], 0
movzx eax, byte [ebp - 0x2c9]
test eax, eax
je 0x473b18
push 0xf46
call dword [sym.imp.KERNEL32.dll_TlsFree]
lea ecx, [ebp - 0x32e4]
call fcn.0042bd6b
lea ecx, [ebp - 0x24ac]
call fcn.0042bd6b
mov dword [ebp - 0x44c], 0xc03342eb
push 3
lea ecx, [ebp - 0x24bc]
call fcn.0042bc99
push 3
lea ecx, [ebp - 0x2964]
call fcn.0042bc99
mov dword [ebp - 0x184], 0
jmp 0x473b6b
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x473b8d
push dword [ebp - 0x184]
lea ecx, [ebp - 0x24bc]
call fcn.0042bd87
mov dword [eax], 0x8af95342
jmp 0x473b5e
mov dword [ebp - 0x184], 0
jmp 0x473ba6
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x473bc8
push dword [ebp - 0x184]
lea ecx, [ebp - 0x2964]
call fcn.0042bd87
mov dword [eax], 0xa3a7
jmp 0x473b99
mov dword [ebp - 0x44c], 0x1a
jmp 0x473be1
mov eax, dword [ebp - 0x44c]
dec eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0xfffffff3
jle 0x473ef2
mov dword [ebp - 0x1280], 0x3997b09b
mov dword [ebp - 0x21b0], 6
mov dword [ebp - 0x12b0], 0xc295a527
mov dword [ebp - 0x21b8], 0xbe41b0ce
mov dword [ebp - 0x734], 0
jmp 0x473c2f
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 2
jge 0x473c4b
mov eax, dword [ebp - 0x734]
mov dword [ebp + eax*4 - 0x548], 0x54c3c69a
jmp 0x473c22
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x548], 0
jmp 0x473c79
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x548]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x548], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x548], 7
jge 0x473d51
mov dword [ebp - 0x1f48], 0xcccddd1d
mov dword [ebp - 0x1f44], 0xcccddd1d
mov dword [ebp - 0x1f40], 0xcccddd1d
mov dword [ebp - 0x1f3c], 0xcccddd1d
mov dword [ebp - 0x73c], 0
jmp 0x473cce
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 2
jge 0x473cea
mov eax, dword [ebp - 0x73c]
mov dword [ebp + eax*4 - 0x3330], 1
jmp 0x473cc1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f48], 1
jmp 0x473d18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f48]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f48], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f48], 0
jl 0x473d4c
mov byte [ebp - 0x2cb], 0
movzx eax, byte [ebp - 0x2cb]
test eax, eax
je 0x473d4a
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x473cfd
jmp 0x473c5e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x548], 0xa7b7e80d
jae 0x473d70
mov dword [ebp - 0x1278], 1
jmp 0x473d77
and dword [ebp - 0x1278], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 0x1278], eax
jl 0x473d98
mov dword [ebp - 0x1298], 1
jmp 0x473d9f
and dword [ebp - 0x1298], 0
mov eax, dword [ebp - 0x1280]
cmp dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x1280]
mov dword [ebp - 0x2ba8], eax
mov eax, dword [ebp - 0x21b0]
cmp dword [ebp - 0x44c], eax
jle 0x473dd1
mov dword [ebp - 0x1288], 1
jmp 0x473dd8
and dword [ebp - 0x1288], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
add eax, dword [ebp - 0x1288]
je 0x473e0b
push 2
lea ecx, [ebp - 0x24bc]
call fcn.0042bd87
cmp dword [eax], 0
je 0x473e0b
mov dword [ebp - 0x1290], 1
jmp 0x473e12
and dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x1290]
add eax, 0xae27
je 0x473e3b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x548], 0
je 0x473e3b
mov dword [ebp - 0x12a0], 1
jmp 0x473e42
and dword [ebp - 0x12a0], 0
mov eax, dword [ebp - 0x1298]
cmp eax, dword [ebp - 0x12a0]
jge 0x473e5c
mov dword [ebp - 0x2450], 1
jmp 0x473e63
and dword [ebp - 0x2450], 0
push 1
lea ecx, [ebp - 0x24bc]
call fcn.0042bd87
push 4
pop eax
shl eax, 0
mov ecx, 0x5b65
sub ecx, dword [ebp + eax - 0x548]
mov dword [ebp - 0x12a8], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x12a8]
mov dword [ebp + eax - 0x548], ecx
push 2
lea ecx, [ebp - 0x24bc]
call fcn.0042bd87
mov ecx, dword [ebp - 0x12a8]
imul ecx, dword [eax]
mov dword [ebp - 0x12b0], ecx
mov esi, dword [ebp - 0x12b0]
push 1
lea ecx, [ebp - 0x2964]
call fcn.0042bd87
cmp esi, dword [eax]
jle 0x473eda
mov dword [ebp - 0x12b8], 1
jmp 0x473ee1
and dword [ebp - 0x12b8], 0
mov eax, dword [ebp - 0x12b8]
mov dword [ebp - 0x21b8], eax
jmp 0x473bd4
lea ecx, [ebp - 0x2964]
call fcn.0042bd6b
lea ecx, [ebp - 0x24bc]
call fcn.0042bd6b
mov dword [ebp - 0x18c], 0x115252cb
mov dword [ebp - 0x370], 0x18c9a01c
mov dword [ebp - 0x1350], 0xfffffffe
mov dword [ebp - 0x754], 0x65835a7a
mov dword [ebp - 0x9c8], 0x5ab9
mov dword [ebp - 0x1330], 2
mov dword [ebp - 0x3164], 1
mov dword [ebp - 0x744], 0
jmp 0x473f67
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 3
jge 0x473f83
mov eax, dword [ebp - 0x744]
mov dword [ebp + eax*4 - 0x2910], 5
jmp 0x473f5a
mov dword [ebp - 0x18c], 2
jmp 0x473f9c
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x4744a8
mov dword [ebp - 0x378], 0xfffffffe
mov dword [ebp - 0x454], 1
mov dword [ebp - 0x368], 0xfffffffc
mov dword [ebp - 0x380], 0xfffffff6
mov dword [ebp - 0x9c0], 6
mov dword [ebp - 0x1338], 0xffffffff
xor eax, eax
jne 0x474023
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x2bb0], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x2e80], eax
cmp dword [ebp - 0x378], 0
je 0x47401a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2910], 0
jne 0x474023
and dword [ebp - 0x12c0], 0
jmp 0x47402d
mov dword [ebp - 0x12c0], 1
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x12c0], eax
jg 0x474047
mov dword [ebp - 0x12c8], 1
jmp 0x47404e
and dword [ebp - 0x12c8], 0
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x12c8], eax
jl 0x474068
mov dword [ebp - 0x12d0], 1
jmp 0x47406f
and dword [ebp - 0x12d0], 0
cmp dword [ebp - 0x12d0], 0x9bdd
jne 0x474087
mov dword [ebp - 0x12d8], 1
jmp 0x47408e
and dword [ebp - 0x12d8], 0
imul eax, dword [ebp - 0x12d8], 0x8f92
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x380], eax
jge 0x4740c4
mov dword [ebp - 0x12e0], 1
jmp 0x4740cb
and dword [ebp - 0x12e0], 0
mov eax, dword [ebp - 0x12e0]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x378], eax
jge 0x4740f1
mov dword [ebp - 0x12e8], 1
jmp 0x4740f8
and dword [ebp - 0x12e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2910]
cmp dword [ebp - 0x12e8], eax
jge 0x474119
mov dword [ebp - 0x12f0], 1
jmp 0x474120
and dword [ebp - 0x12f0], 0
mov eax, dword [ebp - 0x454]
mov ecx, dword [ebp - 0x12f0]
lea eax, [ecx + eax + 7]
test eax, eax
je 0x474228
mov dword [ebp - 0x2330], 5
mov dword [ebp - 0x368], 2
jmp 0x47415b
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jl 0x4741fb
mov dword [ebp - 0x12f8], 0x95a52772
mov dword [ebp - 0x370], 2
jmp 0x47418b
mov eax, dword [ebp - 0x370]
dec eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
jl 0x4741f6
push 2
lea ecx, [ebp - 0x301c]
call fcn.0042bc99
mov dword [ebp - 0x74c], 0
jmp 0x4741ba
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 2
jge 0x4741dc
push dword [ebp - 0x74c]
lea ecx, [ebp - 0x301c]
call fcn.0042bd87
mov dword [eax], 2
jmp 0x4741ad
mov eax, dword [ebp - 0x12f8]
inc eax
mov dword [ebp - 0x12f8], eax
lea ecx, [ebp - 0x301c]
call fcn.0042bd6b
jmp 0x47417e
jmp 0x47414e
cmp dword [ebp - 0x2330], 0
jne 0x474210
mov dword [ebp - 0x1300], 1
jmp 0x474217
and dword [ebp - 0x1300], 0
mov eax, dword [ebp - 0x1300]
mov dword [ebp - 0x368], eax
jmp 0x474373
mov dword [ebp - 0x9b8], 0xfffffff9
mov dword [ebp - 0x21c8], 0x5ab8bf51
cmp dword [ebp - 0x18c], 0xfffffff7
jne 0x474251
mov dword [ebp - 0x1308], 1
jmp 0x474258
and dword [ebp - 0x1308], 0
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x1308]
jne 0x474272
mov dword [ebp - 0x21c0], 1
jmp 0x474279
and dword [ebp - 0x21c0], 0
cmp dword [ebp - 0x18c], 0
jne 0x474294
cmp dword [ebp - 0x380], 0
jne 0x474294
and dword [ebp - 0x1310], 0
jmp 0x47429e
mov dword [ebp - 0x1310], 1
cmp dword [ebp - 0x1310], 0xdc63
je 0x4742b6
mov dword [ebp - 0x2548], 1
jmp 0x4742bd
and dword [ebp - 0x2548], 0
mov eax, dword [ebp - 0x380]
sub eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x9c0]
add eax, dword [ebp - 0x370]
je 0x474315
mov eax, dword [ebp - 0x1350]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x9c8], eax
jge 0x474309
cmp dword [ebp - 0x9b8], 0
jne 0x474309
cmp dword [ebp - 0x9b8], 0
je 0x474315
mov dword [ebp - 0x1318], 1
jmp 0x47431c
and dword [ebp - 0x1318], 0
imul eax, dword [ebp - 0x1318], 0xffffffff
cmp eax, 0xe20
jne 0x47433f
cmp dword [ebp - 0x9b8], 0
je 0x47433f
mov dword [ebp - 0x1320], 1
jmp 0x474346
and dword [ebp - 0x1320], 0
mov eax, dword [ebp - 0x1338]
cmp dword [ebp - 0x1320], eax
jg 0x474360
mov dword [ebp - 0x1328], 1
jmp 0x474367
and dword [ebp - 0x1328], 0
mov eax, dword [ebp - 0x1328]
mov dword [ebp - 0x21c8], eax
mov eax, dword [ebp - 0x1330]
mov dword [ebp - 0x2bb8], eax
mov eax, dword [ebp - 0x1330]
cmp dword [ebp - 0x454], eax
jne 0x474399
mov dword [ebp - 0x1340], 1
jmp 0x4743a0
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0x1338]
cmp dword [ebp - 0x378], 0x8f1d
jge 0x4743be
mov dword [ebp - 0x1348], 1
jmp 0x4743c5
and dword [ebp - 0x1348], 0
mov eax, dword [ebp - 0x454]
imul eax, dword [ebp - 0x1348]
cmp eax, dword [ebp - 0x370]
jle 0x4743ef
cmp dword [ebp - 0x1350], 0
je 0x4743ef
mov dword [ebp - 0x1358], 1
jmp 0x4743f6
and dword [ebp - 0x1358], 0
mov eax, dword [ebp - 0x9c8]
cmp dword [ebp - 0x1358], eax
jne 0x474410
mov dword [ebp - 0x1360], 1
jmp 0x474417
and dword [ebp - 0x1360], 0
cmp dword [ebp - 0x1360], 0xb2dc5075
je 0x47442f
mov dword [ebp - 0x2338], 1
jmp 0x474436
and dword [ebp - 0x2338], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x30e4], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x2910], 5
mov eax, dword [ebp - 0x9c0]
add eax, 3
imul eax, eax, 5
add eax, 0x16b3
cmp eax, dword [ebp - 0x9c8]
jle 0x474478
mov dword [ebp - 0x21d0], 1
jmp 0x47447f
and dword [ebp - 0x21d0], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x2bc0], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x380], eax
jmp 0x473f8f
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x4744c0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0xec], 0xffffffff
push 2
lea ecx, [ebp - 0x265c]
call fcn.0042bc99
mov dword [ebp - 0x45c], 0x9b2cfb63
mov dword [ebp - 0x75c], 0
jmp 0x4744fa
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 2
jge 0x47451c
push dword [ebp - 0x75c]
lea ecx, [ebp - 0x265c]
call fcn.0042bd87
mov dword [eax], 0xbcd8c45
jmp 0x4744ed
mov dword [ebp - 0x45c], 0
jmp 0x474535
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 1
jg 0x474568
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x265c]
call fcn.0042bd87
mov esi, eax
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x265c]
call fcn.0042bd87
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x474528
mov byte [ebp - 0x2cf], 0
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x47458e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [ebp - 0x265c]
call fcn.0042bd6b
mov dword [ebp - 0x1468], 6
or dword [ebp - 0x27a0], 0xffffffff
or dword [ebp - 0x279c], 0xffffffff
or dword [ebp - 0x2798], 0xffffffff
or dword [ebp - 0x2794], 0xffffffff
lea ecx, [ebp - 0xa8d]
call fcn.0042bd96
push eax
lea eax, [ebp - 0x2790]
push eax
lea eax, [ebp - 0x27a0]
push eax
lea ecx, [ebp - 0x3340]
call fcn.0042bd99
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd45
mov dword [ebp - 0x74], 0xffffffff
push 2
lea ecx, [ebp - 0x25fc]
call fcn.0042bc99
mov dword [ebp - 0x388], 5
mov dword [ebp - 0x9d0], 0xbf2465c
mov dword [ebp - 0x764], 0
jmp 0x474635
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 2
jge 0x474654
push dword [ebp - 0x764]
lea ecx, [ebp - 0x25fc]
call fcn.0042bd87
and dword [eax], 0
jmp 0x474628
mov dword [ebp - 0x74], 3
jmp 0x474664
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x474a27
mov dword [ebp - 0x13c8], 1
mov dword [ebp - 0x13d8], 1
push 1
lea ecx, [ebp - 0x25fc]
call fcn.0042bd87
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x9d0], eax
mov esi, dword [ebp - 0x9d0]
push 2
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
cmp esi, dword [eax]
jle 0x4746c7
mov dword [ebp - 0x1368], 1
jmp 0x4746ce
and dword [ebp - 0x1368], 0
cmp dword [ebp - 0x1368], 0xfffffff8
jg 0x4746e3
mov dword [ebp - 0x1370], 1
jmp 0x4746ea
and dword [ebp - 0x1370], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
mov esi, dword [eax]
imul esi, dword [ebp - 0x1370]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x25fc]
call fcn.0042bd87
cmp esi, dword [eax]
jl 0x47472e
mov dword [ebp - 0x1378], 1
jmp 0x474735
and dword [ebp - 0x1378], 0
cmp dword [ebp - 0x1378], 0xffffffff
jne 0x47474a
mov dword [ebp - 0x1380], 1
jmp 0x474751
and dword [ebp - 0x1380], 0
cmp dword [ebp - 0x1380], 0xfff7
jb 0x474769
mov dword [ebp - 0x1388], 1
jmp 0x474770
and dword [ebp - 0x1388], 0
mov esi, dword [ebp - 0x1388]
neg esi
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
add esi, dword [eax]
je 0x47493a
mov dword [ebp - 0x464], 0xe5411aa8
mov dword [ebp - 0x388], 0
jmp 0x4747b1
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 1
jl 0x474906
mov dword [ebp - 0x2460], 0x91300d3b
cmp dword [ebp - 0x464], 0
je 0x4747d6
jmp 0x474906
cmp dword [ebp - 0x9d0], 0
je 0x4747f4
cmp dword [ebp - 0x464], 0
je 0x4747f4
mov dword [ebp - 0x1390], 1
jmp 0x4747fb
and dword [ebp - 0x1390], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x1390], eax
je 0x474815
mov dword [ebp - 0x1398], 1
jmp 0x47481c
and dword [ebp - 0x1398], 0
mov eax, dword [ebp - 0x464]
add eax, 0x7163
cmp eax, dword [ebp - 0x1398]
jne 0x47483b
mov dword [ebp - 0x13a0], 1
jmp 0x474842
and dword [ebp - 0x13a0], 0
cmp dword [ebp - 0x13a0], 0xfffffffa
jne 0x474857
mov dword [ebp - 0x13a8], 1
jmp 0x47485e
and dword [ebp - 0x13a8], 0
cmp dword [ebp - 0x13a8], 0x64d91b05
jg 0x474876
mov dword [ebp - 0x13b0], 1
jmp 0x47487d
and dword [ebp - 0x13b0], 0
mov eax, dword [ebp - 0x2460]
cmp dword [ebp - 0x13b0], eax
jne 0x474897
mov dword [ebp - 0x13b8], 1
jmp 0x47489e
and dword [ebp - 0x13b8], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x13b8], eax
jge 0x4748b8
mov dword [ebp - 0x13c0], 1
jmp 0x4748bf
and dword [ebp - 0x13c0], 0
mov eax, 0x92085949
sub eax, dword [ebp - 0x13c0]
sub eax, dword [ebp - 0x464]
mov dword [ebp - 0x13c8], eax
jne 0x4748e4
mov dword [ebp - 0x13d0], 1
jmp 0x4748eb
and dword [ebp - 0x13d0], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
mov ecx, dword [ebp - 0x13d0]
mov dword [eax], ecx
jmp 0x4747a4
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x474938
push 0
push 0x43c
push 0x7ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x47498e
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x47495c
push 0x1af8
push 0x1170
call dword [sym.imp.KERNEL32.dll_Beep]
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x47498e
push 0
push 0xfa4
push 0x1c52
push 0
push 0x1d7c
push 0x213f
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 0x13d8], 0
je 0x4749a3
mov dword [ebp - 0x13e8], 1
jmp 0x4749aa
and dword [ebp - 0x13e8], 0
cmp dword [ebp - 0x13d8], 0
je 0x4749f9
imul eax, dword [ebp - 0x388], 0
cmp eax, 0x52196db
jg 0x4749c8
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x4749d7
cmp dword [ebp - 0x74], 0
jne 0x4749d7
and dword [ebp - 0x13e0], 0
jmp 0x4749e1
mov dword [ebp - 0x13e0], 1
cmp dword [ebp - 0x13e0], 0x6c1f
jg 0x4749f9
mov dword [ebp - 0x13f0], 1
jmp 0x474a00
and dword [ebp - 0x13f0], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
mov esi, eax
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1d48]
call fcn.0042bd87
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x47465d
lea ecx, [ebp - 0x25fc]
call fcn.0042bd6b
lea ecx, [ebp - 0x1d48]
call fcn.0042bd6b
mov dword [ebp - 0x1f38], 1
mov dword [ebp - 0x76c], 0x477862f
mov dword [ebp - 0x76c], 0
jmp 0x474a6a
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 2
jg 0x474ab4
mov dword [ebp - 0x13f8], 3
mov byte [ebp - 0x2d7], 0
movzx eax, byte [ebp - 0x2d7]
test eax, eax
je 0x474aa5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x13f8]
dec eax
mov dword [ebp - 0x13f8], eax
jmp 0x474a5d
mov dword [ebp - 0x1f4c], 0xfffffff6
mov dword [ebp - 0x194], 0
jmp 0x474ad7
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x474af3
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0xab4], 0xffffffff
jmp 0x474aca
mov dword [ebp - 0x194], 0
jmp 0x474b0c
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x474b28
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x24cc], 0
jmp 0x474aff
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xab4], 6
jmp 0x474b53
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xab4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xab4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xab4], 0xffffffed
jg 0x474d48
mov dword [ebp - 0x7c], 0x6da5043c
mov dword [ebp - 0x7c], 2
jmp 0x474b7d
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x474d43
mov dword [ebp - 0x21e0], 0x42ad015b
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x24cc]
mov dword [ebp - 0x2e90], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x24cc], 0
je 0x474bca
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xab4], 0
je 0x474bca
mov dword [ebp - 0x1400], 1
jmp 0x474bd1
and dword [ebp - 0x1400], 0
cmp dword [ebp - 0x1400], 0xffff
jne 0x474be9
mov dword [ebp - 0x21d8], 1
jmp 0x474bf0
and dword [ebp - 0x21d8], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x24cc]
mov dword [ebp - 0x2bc8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xab4]
mov dword [ebp - 0x31f0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ebp + ecx*4 - 0x24cc]
cmp dword [ebp + eax - 0xab4], ecx
jle 0x474c38
mov dword [ebp - 0x1408], 1
jmp 0x474c3f
and dword [ebp - 0x1408], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xab4]
add eax, dword [ebp - 0x1408]
cmp eax, dword [ebp - 0x7c]
jg 0x474c62
mov dword [ebp - 0x2340], 1
jmp 0x474c69
and dword [ebp - 0x2340], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xab4]
mov dword [ebp - 0x2bd0], eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x24cc], ecx
jne 0x474c96
mov dword [ebp - 0x1410], 1
jmp 0x474c9d
and dword [ebp - 0x1410], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1410]
sub ecx, dword [ebp + eax - 0xab4]
neg ecx
je 0x474cc9
mov eax, 0x938f
test eax, eax
je 0x474cc9
mov dword [ebp - 0x1418], 1
jmp 0x474cd0
and dword [ebp - 0x1418], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1418], eax
jge 0x474ce7
mov dword [ebp - 0x1420], 1
jmp 0x474cee
and dword [ebp - 0x1420], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xab4]
cmp dword [ebp - 0x1420], eax
jne 0x474d0f
mov dword [ebp - 0x1428], 1
jmp 0x474d16
and dword [ebp - 0x1428], 0
cmp dword [ebp - 0x1428], 1
jl 0x474d2b
mov dword [ebp - 0x1430], 1
jmp 0x474d32
and dword [ebp - 0x1430], 0
mov eax, dword [ebp - 0x1430]
mov dword [ebp - 0x21e0], eax
jmp 0x474b76
jmp 0x474b3a
mov byte [ebp - 0x2d9], 0
movzx eax, byte [ebp - 0x2d9]
test eax, eax
je 0x474d6d
push 0
push 0
push 0x1da8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x19c], 0x9c28ade1
mov dword [ebp - 0x774], 0
jmp 0x474d90
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 1
jge 0x474dac
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x2510], 0
jmp 0x474d83
mov dword [ebp - 0x19c], 0
jmp 0x474dc5
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x474de1
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2510], 0x29be
jmp 0x474db8
mov dword [ebp - 0x19c], 0
jmp 0x474dfa
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x474e35
mov byte [ebp - 0x3e4], 0
movzx eax, byte [ebp - 0x3e4]
test eax, eax
je 0x474e33
push 0x1c40
push 0x17c2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x474ded
mov dword [ebp - 0x77c], 0
jmp 0x474e4e
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 2
jge 0x474e6a
mov eax, dword [ebp - 0x77c]
mov dword [ebp + eax*4 - 0x2a50], 0xfffffff9
jmp 0x474e41
mov dword [ebp - 0x2ea0], 0x24f01c08
mov byte [ebp - 0x3e6], 0
movzx eax, byte [ebp - 0x3e6]
test eax, eax
je 0x474eb4
push 0
push 0x7e9
push 0
push 0
push 0x77d
push 0xe4f
push 0x268c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov byte [ebp - 0x3e8], 0
movzx eax, byte [ebp - 0x3e8]
test eax, eax
je 0x474ecc
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
cmp dword [ebp - 0xec], 0xd7c1188e
jae 0x474ee4
mov dword [ebp - 0x1450], 1
jmp 0x474eeb
and dword [ebp - 0x1450], 0
cmp dword [ebp - 0xec], 1
je 0x474f00
mov dword [ebp - 0x1438], 1
jmp 0x474f07
and dword [ebp - 0x1438], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1438]
mov dword [ebp + eax - 0x2a50], ecx
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xec]
jne 0x474f3b
mov dword [ebp - 0x1440], 1
jmp 0x474f42
and dword [ebp - 0x1440], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1440], eax
jge 0x474f5c
mov dword [ebp - 0x1448], 1
jmp 0x474f63
and dword [ebp - 0x1448], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1448], eax
je 0x474f7d
mov dword [ebp - 0x1458], 1
jmp 0x474f84
and dword [ebp - 0x1458], 0
mov eax, dword [ebp - 0x1450]
cmp eax, dword [ebp - 0x1458]
jne 0x474f9e
mov dword [ebp - 0x1460], 1
jmp 0x474fa5
and dword [ebp - 0x1460], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x1460]
jl 0x474fbf
mov dword [ebp - 0x1470], 1
jmp 0x474fc6
and dword [ebp - 0x1470], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1468], eax
mov eax, dword [ebp - 0x1468]
add eax, dword [ebp - 0x1470]
mov dword [ebp - 0x1f38], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1f4c], eax
mov byte [ebp - 0x3c9], 0
mov dword [ebp - 0x390], 0x2c03342e
mov dword [ebp - 0x214], 0x34b0b4ef
mov dword [ebp - 0x46c], 0x5755261f
mov dword [ebp - 0x794], 0x8e3bf118
mov dword [ebp - 0x78c], 0xfff7
push 1
lea ecx, [ebp - 0x1e6c]
call fcn.0042bc99
mov dword [ebp - 0x14c0], 0x3be41b0c
mov dword [ebp - 0x1518], 0xb172abf7
mov dword [ebp - 0x784], 0
jmp 0x475063
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 1
jge 0x475085
push dword [ebp - 0x784]
lea ecx, [ebp - 0x1e6c]
call fcn.0042bd87
mov dword [eax], 0x5ab4d258
jmp 0x475056
mov dword [ebp - 0x390], 0
jmp 0x47509e
mov eax, dword [ebp - 0x390]
dec eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0xffffffef
jne 0x4750be
mov dword [ebp - 0x1f54], 0xffffffff
cmp dword [ebp - 0x1f54], 0
je 0x4750bc
jmp 0x4750be
jmp 0x475091
mov eax, 0xd069
test eax, eax
je 0x475192
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x2bd8], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x30ec], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x2be0], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x2eb0], eax
cmp dword [ebp - 0x794], 0x3997
jge 0x47511c
mov eax, 0x3196
test eax, eax
je 0x47511c
mov dword [ebp - 0x1478], 1
jmp 0x475123
and dword [ebp - 0x1478], 0
mov eax, dword [ebp - 0x78c]
imul eax, dword [ebp - 0x1478]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x794]
cmp dword [ebp - 0x214], eax
jge 0x475150
mov dword [ebp - 0x1480], 1
jmp 0x475157
and dword [ebp - 0x1480], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x1480], eax
jne 0x475171
mov dword [ebp - 0x1488], 1
jmp 0x475178
and dword [ebp - 0x1488], 0
mov eax, dword [ebp - 0x46c]
add eax, dword [ebp - 0x1488]
je 0x475192
mov dword [ebp - 0x1490], 1
jmp 0x475199
and dword [ebp - 0x1490], 0
mov eax, dword [ebp - 0x1490]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xae2718b9
ja 0x4751bd
mov dword [ebp - 0x1498], 1
jmp 0x4751c4
and dword [ebp - 0x1498], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
cmp eax, dword [ebp - 0x1498]
jle 0x4751ea
mov dword [ebp - 0x14a0], 1
jmp 0x4751f1
and dword [ebp - 0x14a0], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x14a0], eax
jl 0x47520b
mov dword [ebp - 0x14a8], 1
jmp 0x475212
and dword [ebp - 0x14a8], 0
push 0
lea ecx, [ebp - 0x1e6c]
call fcn.0042bd87
mov ecx, dword [ebp - 0x14a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x2be8], eax
mov eax, 0x77201043
test eax, eax
jne 0x475248
mov dword [ebp - 0x14b0], 1
jmp 0x47524f
and dword [ebp - 0x14b0], 0
mov eax, dword [ebp - 0x78c]
imul eax, dword [ebp - 0x14b0]
cmp eax, dword [ebp - 0x78c]
jl 0x475270
mov dword [ebp - 0x14b8], 1
jmp 0x475277
and dword [ebp - 0x14b8], 0
mov eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x14c0], eax
cmp dword [ebp - 0x14c0], 0
je 0x475422
mov dword [ebp - 0x4c8], 0xd65fe96f
mov dword [ebp - 0x14d0], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x316c], eax
cmp dword [ebp - 0x4c8], 0x4b79
jne 0x4752c8
mov dword [ebp - 0x1f5c], 1
jmp 0x4752cf
and dword [ebp - 0x1f5c], 0
cmp dword [ebp - 0x4c8], 0xb3f54c3d
je 0x4752e7
mov dword [ebp - 0x14c8], 1
jmp 0x4752ee
and dword [ebp - 0x14c8], 0
mov eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x14d0], eax
mov esi, dword [ebp - 0x14d0]
push 0
lea ecx, [ebp - 0x1e6c]
call fcn.0042bd87
cmp esi, dword [eax]
jle 0x47531d
mov dword [ebp - 0x14d8], 1
jmp 0x475324
and dword [ebp - 0x14d8], 0
push 0
lea ecx, [ebp - 0x1e6c]
call fcn.0042bd87
mov ecx, dword [ebp - 0x14d8]
cmp ecx, dword [eax]
jg 0x475347
mov dword [ebp - 0x14e0], 1
jmp 0x47534e
and dword [ebp - 0x14e0], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x14e0], eax
jge 0x475368
mov dword [ebp - 0x14e8], 1
jmp 0x47536f
and dword [ebp - 0x14e8], 0
mov eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0x14e8]
cmp eax, dword [ebp - 0x4c8]
jge 0x47538f
mov dword [ebp - 0x14f0], 1
jmp 0x475396
and dword [ebp - 0x14f0], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x14f0], eax
jle 0x4753b0
mov dword [ebp - 0x14f8], 1
jmp 0x4753b7
and dword [ebp - 0x14f8], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x14f8], eax
jne 0x4753e3
mov dword [ebp - 0x1510], 0xfffffffa
mov dword [ebp - 0x2bf0], 0xd45c545f
mov dword [ebp - 0x2ec0], 1
mov dword [ebp - 0x27c8], 1
mov dword [ebp - 0x27c4], 1
mov dword [ebp - 0x27c0], 1
mov dword [ebp - 0x27bc], 1
lea ecx, [ebp - 0xadd]
call fcn.0042bd96
push eax
lea eax, [ebp - 0x27b8]
push eax
lea eax, [ebp - 0x27c8]
push eax
lea ecx, [ebp - 0x3350]
call fcn.0042bd99
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x323c]
call fcn.0042bd45
mov eax, dword [ebp - 0x1510]
inc eax
mov dword [ebp - 0x1510], eax
mov eax, dword [ebp - 0x1518]
inc eax
mov dword [ebp - 0x1518], eax
lea ecx, [ebp - 0x323c]
call fcn.0042bd6b
lea ecx, [ebp - 0x1e6c]
call fcn.0042bd6b
movzx eax, byte [ebp - 0x3c9]
test eax, eax
je 0x475993
mov dword [ebp - 0x84], 0xfb871c7b
push 3
lea ecx, [ebp - 0x1e84]
call fcn.0042bc99
push 2
lea ecx, [ebp - 0x1dd0]
call fcn.0042bc99
mov dword [ebp - 0x2bf8], 4
mov dword [ebp - 0x9d8], 0x93ce85dc
mov dword [ebp - 0x1a4], 0
jmp 0x47552d
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x47554f
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x1e84]
call fcn.0042bd87
mov dword [eax], 0xa41637c1
jmp 0x475520
mov dword [ebp - 0x1a4], 0
jmp 0x475568
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x47558a
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x1dd0]
call fcn.0042bd87
mov dword [eax], 1
jmp 0x47555b
mov byte [ebp - 0x254], 0
movzx eax, byte [ebp - 0x254]
test eax, eax
je 0x4755a9
push 0x2225
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x84], 0
jne 0x4756ee
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x30f4], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x1520], eax
push 2
lea ecx, [ebp - 0x1e84]
call fcn.0042bd87
mov ecx, dword [ebp - 0x1520]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1520]
sub eax, dword [ebp - 0x84]
jne 0x475608
mov eax, 0xaab39e22
test eax, eax
je 0x475839
mov dword [ebp - 0x398], 0x24a8c6a5
mov dword [ebp - 0x1f84], 0
mov dword [ebp - 0x398], 0
jmp 0x4759c0
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 7
jle 0x4759f1
mov byte [ebp - 0x256], 0
movzx eax, byte [ebp - 0x256]
test eax, eax
je 0x4759ef
push 0x87b
push 0
push 0x1a79
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x4759b3
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x1f84], eax
call fcn.0045eb2a
mov dword [ebp - 0x7a4], 0xffffffff
mov dword [ebp - 0x1598], 0x8afc1da7
mov dword [ebp - 0x15a8], 0xfffffffa
mov dword [ebp - 0x1f9c], 0x4caa8e55
mov dword [ebp - 0x31b8], 0x92e3f915
push 1
lea ecx, [ebp - 0x302c]
call fcn.0042bc99
mov dword [ebp - 0x15b0], 0xae45661c
mov dword [ebp - 0x79c], 0
jmp 0x475a70
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 1
jge 0x475a8f
push dword [ebp - 0x79c]
lea ecx, [ebp - 0x302c]
call fcn.0042bd87
or dword [eax], 0xffffffff
jmp 0x475a63
cmp dword [ebp - 0x7a4], 4
jg 0x475aa4
mov dword [ebp - 0x1f8c], 1
jmp 0x475aab
and dword [ebp - 0x1f8c], 0
xor eax, eax
jne 0x475ac1
cmp dword [ebp - 0x7a4], 0
jne 0x475ac1
mov dword [ebp - 0x1590], 1
mov eax, dword [ebp - 0x1590]
add eax, 0x2aa6
mov dword [ebp - 0x1598], eax
cmp dword [ebp - 0x1598], 0x99958900
jbe 0x475af4
mov dword [ebp - 0x3a0], 0xffff
mov dword [ebp - 0x7ac], 0
jmp 0x475ba1
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 2
jge 0x475bbd
mov eax, dword [ebp - 0x7ac]
mov dword [ebp + eax*4 - 0x1f4], 0xe8cff0ea
jmp 0x475b94
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f4], 0x13
jmp 0x475beb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f4], 0x1b
jge 0x475c4c
mov dword [ebp - 0x7b4], 3
mov dword [ebp - 0x7b4], 0
jmp 0x475c1e
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 0xd
jg 0x475c4a
mov byte [ebp - 0x331], 0
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x475c48
push 0
push 0x1e41
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x475c11
jmp 0x475bd0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2c10], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 0xfffffffffffffffd
pop edx
sub edx, dword [ebp + ecx - 0x1f4]
push 4
pop ecx
imul ecx, ecx, 0
add edx, dword [ebp + ecx - 0x1f4]
cmp dword [ebp + eax - 0x1f4], edx
jle 0x475c97
mov dword [ebp - 0x15b8], 1
jmp 0x475c9e
and dword [ebp - 0x15b8], 0
cmp dword [ebp - 0x15b8], 0xc924
jle 0x475cbc
mov eax, 0x1145
test eax, eax
jne 0x475cbc
and dword [ebp - 0x15c0], 0
jmp 0x475cc6
mov dword [ebp - 0x15c0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp eax, dword [ebp - 0x15c0]
jne 0x475ce7
mov dword [ebp - 0x1fa4], 1
jmp 0x475cee
and dword [ebp - 0x1fa4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f4], 9
jbe 0x475d0a
mov dword [ebp - 0x1fac], 1
jmp 0x475d11
and dword [ebp - 0x1fac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2ee0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f4], 0
je 0x475e7c
mov dword [ebp - 0x7bc], 0xe2db80eb
mov dword [ebp - 0x2c18], 0
mov byte [ebp - 0x258], 0
movzx eax, byte [ebp - 0x258]
test eax, eax
je 0x475da3
push 0x24df
push 0x988
push 0xb2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x363
push 0xc47
push 0x15bb
push 0x25b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x7bc], 0xffffffff
jmp 0x475dbc
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 0x16
jne 0x475e77
mov dword [ebp - 0x7c4], 0x5537c57f
mov dword [ebp - 0x30fc], 0x335900b0
mov dword [ebp - 0x7c4], 0x13
jmp 0x475df6
mov eax, dword [ebp - 0x7c4]
dec eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0x12
jle 0x475e72
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
mov byte [ebp - 0x2be], 0
movzx eax, byte [ebp - 0x2be]
test eax, eax
je 0x475e6d
push 0x26db
push 0x856
push 0x1152
push 0x1d83
push 0x300
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1363
push 0xa2
push 0x1120
push 0x9fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x475de9
jmp 0x475daf
jmp 0x475ff8
mov dword [ebp - 0x4d8], 0x1636
mov dword [ebp - 0x3a0], 0xfffffff9
jmp 0x475e9f
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x28
jle 0x475ff8
mov dword [ebp - 0x15d8], 1
mov dword [ebp - 0x1fbc], 0x3af8ef5d
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2c20], eax
mov eax, dword [ebp - 0x15d8]
mov dword [ebp - 0x2ef0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2c28], eax
cmp dword [ebp - 0x4d8], 0x49d9
jl 0x475f03
mov dword [ebp - 0x15c8], 1
jmp 0x475f0a
and dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x15c8]
jne 0x475f24
mov dword [ebp - 0x15d0], 1
jmp 0x475f2b
and dword [ebp - 0x15d0], 0
mov eax, dword [ebp - 0x15d0]
add eax, 8
cmp eax, dword [ebp - 0x15d8]
jg 0x475f48
mov dword [ebp - 0x15e0], 1
jmp 0x475f4f
and dword [ebp - 0x15e0], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x15e0], eax
jg 0x475f69
mov dword [ebp - 0x15e8], 1
jmp 0x475f70
and dword [ebp - 0x15e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0x15e8], eax
jl 0x475f91
mov dword [ebp - 0x1f30], 1
jmp 0x475f98
and dword [ebp - 0x1f30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x3174], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2c30], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2f00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2c38], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x3104], eax
mov dword [ebp - 0x1fbc], 0
jmp 0x475e92
mov dword [ebp - 0x2c40], 0xffffffff
mov byte [ebp - 0x25a], 0
movzx eax, byte [ebp - 0x25a]
test eax, eax
je 0x47601e
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov byte [ebp - 0x399], 0
movzx eax, byte [ebp - 0x399]
test eax, eax
je 0x476036
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x474], 0xffffffff
mov dword [ebp - 0x1fd4], 2
mov byte [ebp - 0x25c], 0
movzx eax, byte [ebp - 0x25c]
test eax, eax
je 0x47606d
push 0
push 0
push 0x1201
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [ebp - 0x474], 0
jmp 0x476086
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xfffffffa
jle 0x476263
mov dword [ebp - 0x7cc], 0
jmp 0x4760ac
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 1
jge 0x4760c8
mov eax, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0x3a8], 0xfffffffb
jmp 0x47609f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a8], 0xfffffff5
jmp 0x4760f6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0xffffffe3
je 0x47625e
mov dword [ebp - 0x15f8], 0x956e74e8
cmp dword [ebp - 0x474], 0x7597
jl 0x47612c
mov dword [ebp - 0x1600], 1
jmp 0x476133
and dword [ebp - 0x1600], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 3
jne 0x47614f
mov dword [ebp - 0x15f0], 1
jmp 0x476156
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x15f8]
cmp dword [ebp - 0x15f0], eax
jl 0x476170
mov dword [ebp - 0x1fc4], 1
jmp 0x476177
and dword [ebp - 0x1fc4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0x31aa08ec
je 0x476196
mov dword [ebp - 0x1fcc], 1
jmp 0x47619d
and dword [ebp - 0x1fcc], 0
mov eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x2f10], eax
push 9
pop eax
cmp eax, 1
jge 0x4761bd
mov dword [ebp - 0x1608], 1
jmp 0x4761c4
and dword [ebp - 0x1608], 0
mov eax, dword [ebp - 0x1600]
cmp eax, dword [ebp - 0x1608]
jge 0x4761de
mov dword [ebp - 0x1610], 1
jmp 0x4761e5
and dword [ebp - 0x1610], 0
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x1610], eax
jge 0x4761ff
mov dword [ebp - 0x1618], 1
jmp 0x476206
and dword [ebp - 0x1618], 0
cmp dword [ebp - 0x1618], 0xcaf1
jne 0x47621e
mov dword [ebp - 0x1620], 1
jmp 0x476225
and dword [ebp - 0x1620], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp eax, dword [ebp - 0x1620]
je 0x476246
mov dword [ebp - 0x1628], 1
jmp 0x47624d
and dword [ebp - 0x1628], 0
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x1fd4], eax
jmp 0x4760db
jmp 0x476079
xor ecx, ecx
call fcn.0042c004
push eax
call fcn.0047c763
pop ecx
mov dword [ebp - 0x7dc], 0x31713b91
mov dword [ebp - 0x1678], 0x3ccde6bc
mov dword [ebp - 0x2c48], 1
mov dword [ebp - 0x1ff4], 2
mov dword [ebp - 0x31d8], 0
mov dword [ebp - 0x2c50], 1
mov dword [ebp - 0x9e8], 0xffff
mov dword [ebp - 0x7d4], 0
jmp 0x4762d0
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 1
jge 0x4762ec
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0x1640], 0x651162f6
jmp 0x4762c3
mov dword [ebp - 0x7dc], 0
jmp 0x476305
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 4
jle 0x4766ed
mov dword [ebp - 0x27f0], 1
mov dword [ebp - 0x27ec], 1
mov dword [ebp - 0x27e8], 1
mov dword [ebp - 0x27e4], 1
lea ecx, [ebp - 0xa95]
call fcn.0042bd96
push eax
lea eax, [ebp - 0x27e0]
push eax
lea eax, [ebp - 0x27f0]
push eax
lea ecx, [ebp - 0x3348]
call fcn.0042bd99
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2644]
call fcn.0042bd45
mov dword [ebp - 0x9e0], 6
mov dword [ebp - 0x1ffc], 0x1915e308
mov dword [ebp - 0x7e4], 0
jmp 0x47639c
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 2
jge 0x4763b8
mov eax, dword [ebp - 0x7e4]
mov dword [ebp + eax*4 - 0x26a8], 0x1aa84cbe
jmp 0x47638f
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x4763d5
push 0x19aa
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
lea ecx, [ebp - 0x2644]
call fcn.0042bd87
and dword [eax], 0
jmp 0x47640b
push 2
lea ecx, [ebp - 0x2644]
call fcn.0042bd87
mov dword [ebp - 0x1630], eax
mov eax, dword [ebp - 0x1630]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1630]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2644]
call fcn.0042bd87
cmp dword [eax], 0xffffffef
jl 0x4766dd
mov dword [ebp - 0x1670], 0xffffffff
mov dword [ebp - 0x2004], 0x26a056eb
mov dword [ebp - 0x2f20], 6
mov dword [ebp - 0x1fe4], 2
mov dword [ebp - 0x2c58], 0x4cd021aa
mov dword [ebp - 0x310c], 0xfffffffb
mov dword [ebp - 0x1fdc], 0xeea3821c
mov dword [ebp - 0x7ec], 0
jmp 0x476480
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 3
jge 0x47649c
mov eax, dword [ebp - 0x7ec]
mov dword [ebp + eax*4 - 0x303c], 0xda2ca335
jmp 0x476473
mov byte [ebp - 0x25e], 0
movzx eax, byte [ebp - 0x25e]
test eax, eax
je 0x4764bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword [ebp - 0x1670]
mov dword [ebp - 0x9e0], eax
cmp dword [ebp - 0x9e0], 0
jne 0x4766bb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fdc]
cmp dword [ebp + eax - 0x1640], ecx
jg 0x4764f5
mov dword [ebp - 0x1650], 1
jmp 0x4764fc
and dword [ebp - 0x1650], 0
cmp dword [ebp - 0x9e0], 0
jne 0x47651e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x303c], 0
jne 0x47651e
and dword [ebp - 0x1638], 0
jmp 0x476528
mov dword [ebp - 0x1638], 1
cmp dword [ebp - 0x1638], 1
jbe 0x47655a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26a8], 0
jne 0x47655a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1640], 0
jne 0x47655a
and dword [ebp - 0x1648], 0
jmp 0x476564
mov dword [ebp - 0x1648], 1
imul eax, dword [ebp - 0x1648], 0xffffffff
inc eax
cmp dword [ebp - 0x1650], eax
jg 0x476580
mov dword [ebp - 0x1658], 1
jmp 0x476587
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x1678]
cmp dword [ebp - 0x1658], eax
jne 0x4765a7
cmp dword [ebp - 0x1fe4], 0
jne 0x4765a7
and dword [ebp - 0x1660], 0
jmp 0x4765b1
mov dword [ebp - 0x1660], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x303c]
cmp dword [ebp - 0x1660], eax
jge 0x4765d6
xor eax, eax
je 0x4765d6
mov dword [ebp - 0x1668], 1
jmp 0x4765dd
and dword [ebp - 0x1668], 0
cmp dword [ebp - 0x1668], 0xb18
jle 0x4765f5
mov dword [ebp - 0x1fec], 1
jmp 0x4765fc
and dword [ebp - 0x1fec], 0
mov eax, dword [ebp - 0x1670]
mov dword [ebp - 0x2c60], eax
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x2f30], eax
mov eax, dword [ebp - 0x9e8]
inc eax
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x1ff4], 0xffffffff
jne 0x476636
mov dword [ebp - 0x1680], 1
jmp 0x47663d
and dword [ebp - 0x1680], 0
mov eax, dword [ebp - 0x1678]
cmp dword [ebp - 0x1680], eax
je 0x476657
mov dword [ebp - 0x1688], 1
jmp 0x47665e
and dword [ebp - 0x1688], 0
cmp dword [ebp - 0x1688], 1
jg 0x476673
mov dword [ebp - 0x1690], 1
jmp 0x47667a
and dword [ebp - 0x1690], 0
cmp dword [ebp - 0x1690], 0xffffffff
jae 0x47668f
mov dword [ebp - 0x9f0], 1
jmp 0x476696
and dword [ebp - 0x9f0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9f0]
mov dword [ebp + eax - 0x26a8], ecx
cmp dword [ebp - 0x9f0], 0
jne 0x4766bb
and dword [ebp - 0x1698], 0
jmp 0x4766c5
mov dword [ebp - 0x1698], 1
mov eax, dword [ebp - 0x1ffc]
imul eax, dword [ebp - 0x1698]
mov dword [ebp - 0x2004], eax
jmp 0x4763e7
lea ecx, [ebp - 0x2644]
call fcn.0042bd6b
jmp 0x4762f8
push 2
lea ecx, [ebp - 0x97c]
call fcn.0042bc99
mov dword [ebp - 0x58], 3
mov dword [ebp - 0x804], 0xfffffffa
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x9f8], 0x4677319
mov dword [ebp - 0x7f4], 0
jmp 0x476738
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 2
jge 0x47675a
push dword [ebp - 0x7f4]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov dword [eax], 1
jmp 0x47672b
mov dword [ebp - 0x58], 0
jmp 0x47676a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jg 0x476a4a
push 1
lea ecx, [ebp - 0x24dc]
call fcn.0042bc99
mov dword [ebp - 0x16b0], 0xdd66408
mov dword [ebp - 0x7fc], 0
jmp 0x4767a4
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 1
jge 0x4767c6
push dword [ebp - 0x7fc]
lea ecx, [ebp - 0x24dc]
call fcn.0042bd87
mov dword [eax], 0xfffffff8
jmp 0x476797
push 0
lea ecx, [ebp - 0x24dc]
call fcn.0042bd87
and dword [eax], 0
jmp 0x4767fc
push 0
lea ecx, [ebp - 0x24dc]
call fcn.0042bd87
mov dword [ebp - 0x16a0], eax
mov eax, dword [ebp - 0x16a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x16a0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x24dc]
call fcn.0042bd87
cmp dword [eax], 1
jg 0x476a3a
mov dword [ebp - 0x16d0], 0xffffffff
mov dword [ebp - 0x4e0], 0x3d2f5512
push 0
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov eax, dword [eax]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0
jne 0x47688d
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov ecx, dword [ebp - 0x804]
cmp dword [eax], ecx
jne 0x476868
mov dword [ebp - 0x16a8], 1
jmp 0x47686f
and dword [ebp - 0x16a8], 0
mov eax, dword [ebp - 0x16a8]
mov dword [ebp - 0x16b0], eax
cmp dword [ebp - 0x16b0], 0
jne 0x47688d
and dword [ebp - 0x16b8], 0
jmp 0x476897
mov dword [ebp - 0x16b8], 1
mov eax, dword [ebp - 0x16b8]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x9f8], eax
cmp dword [ebp - 0x9f8], 0
jne 0x4768d4
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
cmp dword [eax], 0
jne 0x4768d4
and dword [ebp - 0x200c], 0
jmp 0x4768de
mov dword [ebp - 0x200c], 1
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov esi, dword [ebp - 0x58]
imul esi, dword [ebp - 0x804]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
cmp esi, dword [eax]
jge 0x476914
mov dword [ebp - 0x16c0], 1
jmp 0x47691b
and dword [ebp - 0x16c0], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov eax, dword [eax]
cmp eax, dword [ebp - 0x16c0]
jne 0x47693f
mov dword [ebp - 0x16c8], 1
jmp 0x476946
and dword [ebp - 0x16c8], 0
mov eax, dword [ebp - 0x16c8]
mov dword [ebp - 0x16d0], eax
mov eax, dword [ebp - 0x16d0]
mov dword [ebp - 0x2c68], eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov esi, dword [ebp - 0x58]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
cmp esi, dword [eax]
jle 0x47698d
mov dword [ebp - 0x16d8], 1
jmp 0x476994
and dword [ebp - 0x16d8], 0
push 1
lea ecx, [ebp - 0x97c]
call fcn.0042bd87
mov ecx, dword [ebp - 0x16d8]
imul ecx, dword [eax]
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 0x47c], 0x1a
jmp 0x4769c9
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0x1d
jle 0x476a35
mov dword [ebp - 0x16e0], 0xffff
mov dword [ebp - 0x4e0], 1
jmp 0x4769f5
mov eax, dword [ebp - 0x4e0]
dec eax
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0
jl 0x476a33
mov dword [ebp - 0x16e0], 0xfffffff6
mov eax, dword [ebp - 0x16e0]
mov dword [ebp - 0x9f8], eax
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x476a31
push 0xb61
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x4769e8
jmp 0x4769bc
jmp 0x4767d8
lea ecx, [ebp - 0x24dc]
call fcn.0042bd6b
jmp 0x476763
lea ecx, [ebp - 0x97c]
call fcn.0042bd6b
mov dword [ebp - 0x20], 0x3fcb50bf
mov dword [ebp - 0x484], 0xfffffffb
mov dword [ebp - 0xa00], 0xfffffffa
mov dword [ebp - 0x80c], 0
jmp 0x476a89
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 1
jge 0x476aa5
mov eax, dword [ebp - 0x80c]
mov dword [ebp + eax*4 - 0x1b4], 0x8eac8b13
jmp 0x476a7c
mov byte [ebp - 0x260], 0
movzx eax, byte [ebp - 0x260]
test eax, eax
je 0x476ac1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x20], 0
jmp 0x476ad1
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x476e12
mov dword [ebp - 0x1bc], 0x8876942a
mov dword [ebp - 0x1748], 1
mov dword [ebp - 0x1bc], 0
jmp 0x476b08
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x476ca6
mov dword [ebp - 0x16f0], 0xffffffff
mov dword [ebp - 0x1700], 0x451f1e28
mov dword [ebp - 0x1718], 0xa4d9a54e
mov dword [ebp - 0x814], 0
jmp 0x476b4c
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 1
jge 0x476b68
mov eax, dword [ebp - 0x814]
mov dword [ebp + eax*4 - 0x2014], 0x514faf14
jmp 0x476b3f
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov dword [ebp - 0x317c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1bc], eax
jl 0x476b92
mov dword [ebp - 0x16e8], 1
jmp 0x476b99
and dword [ebp - 0x16e8], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov dword [ebp - 0x484], eax
imul eax, dword [ebp - 0x16e8], 0x8ec
mov dword [ebp - 0x16f0], eax
mov eax, dword [ebp - 0x16f0]
cmp dword [ebp - 0x484], eax
jg 0x476bd3
mov dword [ebp - 0x16f8], 1
jmp 0x476bda
and dword [ebp - 0x16f8], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b4]
imul eax, dword [ebp - 0x16f8]
mov dword [ebp - 0x1700], eax
mov eax, dword [ebp - 0x1700]
add eax, dword [ebp - 0x1bc]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0xa00]
add eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp + ecx*4 - 0x1b4], eax
jl 0x476c27
mov dword [ebp - 0x1708], 1
jmp 0x476c2e
and dword [ebp - 0x1708], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1708], eax
jge 0x476c45
mov dword [ebp - 0x1710], 1
jmp 0x476c4c
and dword [ebp - 0x1710], 0
mov eax, dword [ebp - 0x1710]
mov dword [ebp - 0x1718], eax
mov eax, dword [ebp - 0x1718]
imul eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
lea eax, [eax + ecx - 0xffff]
cmp eax, dword [ebp - 0x20]
jge 0x476c7d
mov dword [ebp - 0x1720], 1
jmp 0x476c84
and dword [ebp - 0x1720], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1720]
sub ecx, dword [ebp + eax*4 - 0x1b4]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2014], ecx
jmp 0x476afb
mov dword [ebp - 0x484], 0
jmp 0x476cbf
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
jg 0x476e0d
mov dword [ebp - 0x1738], 0xc98072f2
mov dword [ebp - 0x81c], 0
jmp 0x476cef
mov eax, dword [ebp - 0x81c]
inc eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 1
jge 0x476d0b
mov eax, dword [ebp - 0x81c]
mov dword [ebp + eax*4 - 0x201c], 0x262b0969
jmp 0x476ce2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b4]
cmp dword [ebp - 0x20], eax
jge 0x476d26
mov dword [ebp - 0x1728], 1
jmp 0x476d2d
and dword [ebp - 0x1728], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1728]
lea eax, [ecx + eax - 0x373c]
cmp eax, dword [ebp - 0x1748]
jl 0x476d51
mov dword [ebp - 0x1730], 1
jmp 0x476d58
and dword [ebp - 0x1730], 0
cmp dword [ebp - 0x1730], 0xffffffff
jae 0x476d6d
mov dword [ebp - 0x1740], 1
jmp 0x476d74
and dword [ebp - 0x1740], 0
mov dword [ebp - 0x1738], 1
mov eax, dword [ebp - 0x1738]
cmp eax, dword [ebp - 0x1740]
jge 0x476d97
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1b4], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xa00]
sub ecx, dword [ebp - 0x1748]
cmp dword [ebp + eax*4 - 0x1b4], ecx
jg 0x476dbb
mov dword [ebp - 0x1750], 1
jmp 0x476dc2
and dword [ebp - 0x1750], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
cmp dword [ebp - 0x1750], eax
jl 0x476de3
mov dword [ebp - 0x1758], 1
jmp 0x476dea
and dword [ebp - 0x1758], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1758]
mov dword [ebp + eax - 0x201c], ecx
cmp dword [ebp - 0x1bc], 0
je 0x476e08
jmp 0x476e0d
jmp 0x476cb2
jmp 0x476aca
mov dword [ebp - 0x2024], 9
mov dword [ebp - 0x824], 0
jmp 0x476e35
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 2
jge 0x476e51
mov eax, dword [ebp - 0x824]
mov dword [ebp + eax*4 - 0x2a74], 0x394643cd
jmp 0x476e28
mov byte [ebp - 0x2c2], 0
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x476e69
call dword [sym.imp.USER32.dll_GetCapture]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2024]
mov dword [ebp + eax - 0x2a74], ecx
mov dword [ebp - 0x3b0], 0xffff
mov dword [ebp - 0x82c], 0
jmp 0x476e9f
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 2
jge 0x476ebb
mov eax, dword [ebp - 0x82c]
mov dword [ebp + eax*4 - 0x224], 0xe8cff0ea
jmp 0x476e92
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x224], 0x13
jmp 0x476ee9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x224], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x224], 0x1b
jge 0x476f4a
mov dword [ebp - 0x834], 3
mov dword [ebp - 0x834], 0
jmp 0x476f1c
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0xd
jg 0x476f48
mov byte [ebp - 0x262], 0
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x476f46
push 0
push 0x1e41
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x476f0f
jmp 0x476ece
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0x2c70], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 0xfffffffffffffffd
pop edx
sub edx, dword [ebp + ecx - 0x224]
push 4
pop ecx
imul ecx, ecx, 0
add edx, dword [ebp + ecx - 0x224]
cmp dword [ebp + eax - 0x224], edx
jle 0x476f95
mov dword [ebp - 0x1760], 1
jmp 0x476f9c
and dword [ebp - 0x1760], 0
cmp dword [ebp - 0x1760], 0xc924
jle 0x476fba
mov eax, 0x1145
test eax, eax
jne 0x476fba
and dword [ebp - 0x1768], 0
jmp 0x476fc4
mov dword [ebp - 0x1768], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
cmp eax, dword [ebp - 0x1768]
jne 0x476fe5
mov dword [ebp - 0x202c], 1
jmp 0x476fec
and dword [ebp - 0x202c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x224], 9
jbe 0x477008
mov dword [ebp - 0x2034], 1
jmp 0x47700f
and dword [ebp - 0x2034], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0x2f40], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x224], 0
je 0x47717a
mov dword [ebp - 0x83c], 0xe2db80eb
mov dword [ebp - 0x2c78], 0
mov byte [ebp - 0x3e5], 0
movzx eax, byte [ebp - 0x3e5]
test eax, eax
je 0x4770a1
push 0x24df
push 0x988
push 0xb2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x363
push 0xc47
push 0x15bb
push 0x25b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x83c], 0xffffffff
jmp 0x4770ba
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 0x16
jne 0x477175
mov dword [ebp - 0x84c], 0x5537c57f
mov dword [ebp - 0x3114], 0x335900b0
mov dword [ebp - 0x84c], 0x13
jmp 0x4770f4
mov eax, dword [ebp - 0x84c]
dec eax
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0x12
jle 0x477170
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 0x264], 0
movzx eax, byte [ebp - 0x264]
test eax, eax
je 0x47716b
push 0x26db
push 0x856
push 0x1152
push 0x1d83
push 0x300
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1363
push 0xa2
push 0x1120
push 0x9fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x4770e7
jmp 0x4770ad
jmp 0x4772f6
mov dword [ebp - 0x4e8], 0x1636
mov dword [ebp - 0x3b0], 0xfffffff9
jmp 0x47719d
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x28
jle 0x4772f6
mov dword [ebp - 0x1780], 1
mov dword [ebp - 0x2044], 0x3af8ef5d
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x2c80], eax
mov eax, dword [ebp - 0x1780]
mov dword [ebp - 0x2f50], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0x2c88], eax
cmp dword [ebp - 0x4e8], 0x49d9
jl 0x477201
mov dword [ebp - 0x1770], 1
jmp 0x477208
and dword [ebp - 0x1770], 0
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x1770]
jne 0x477222
mov dword [ebp - 0x1778], 1
jmp 0x477229
and dword [ebp - 0x1778], 0
mov eax, dword [ebp - 0x1778]
add eax, 8
cmp eax, dword [ebp - 0x1780]
jg 0x477246
mov dword [ebp - 0x1788], 1
jmp 0x47724d
and dword [ebp - 0x1788], 0
mov eax, dword [ebp - 0x4e8]
cmp dword [ebp - 0x1788], eax
jg 0x477267
mov dword [ebp - 0x1790], 1
jmp 0x47726e
and dword [ebp - 0x1790], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
cmp dword [ebp - 0x1790], eax
jl 0x47728f
mov dword [ebp - 0x203c], 1
jmp 0x477296
and dword [ebp - 0x203c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0x31c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0x2c90], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x2f60], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
mov dword [ebp - 0x2c98], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x311c], eax
mov dword [ebp - 0x2044], 0
jmp 0x477190
mov dword [ebp - 0x8c], 0xd4e06482
mov dword [ebp - 0x1c4], 0
jmp 0x477319
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x477335
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x1d58], 0x887cf2e5
jmp 0x47730c
mov dword [ebp - 0x1c4], 0
jmp 0x47734e
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x47736a
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x329c], 0xbd791f9e
jmp 0x477341
mov dword [ebp - 0x8c], 0xb
jmp 0x477383
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x11
jg 0x47739e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1d58], 0x82ba24cf
jmp 0x477376
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d58]
mov dword [ebp - 0x2ca0], eax
xor eax, eax
jne 0x477423
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1d58], 0x7289fff1
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x1d58], 0x5f40
test eax, eax
je 0x4773f3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d58], 0
je 0x4773f3
mov dword [ebp - 0x1798], 1
jmp 0x4773fa
and dword [ebp - 0x1798], 0
mov eax, dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x1798], 0xffff
add eax, ecx
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x1d58]
jne 0x477423
and dword [ebp - 0x17a0], 0
jmp 0x47742d
mov dword [ebp - 0x17a0], 1
cmp dword [ebp - 0x17a0], 0xfff8
ja 0x477445
mov dword [ebp - 0x204c], 1
jmp 0x47744c
and dword [ebp - 0x204c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d58]
mov dword [ebp - 0x2f70], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d58], 0x9da97273
jne 0x477485
mov eax, 0xe9f9
test eax, eax
je 0x477485
mov dword [ebp - 0x17a8], 1
jmp 0x47748c
and dword [ebp - 0x17a8], 0
cmp dword [ebp - 0x17a8], 0xe105
je 0x4774a4
mov dword [ebp - 0x17b0], 1
jmp 0x4774ab
and dword [ebp - 0x17b0], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x17b0], eax
je 0x4774c5
mov dword [ebp - 0x2054], 1
jmp 0x4774cc
and dword [ebp - 0x2054], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2ca8], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x3184], eax
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x8c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x329c]
jne 0x47750b
mov dword [ebp - 0x17b8], 1
jmp 0x477512
and dword [ebp - 0x17b8], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x17b8], eax
jge 0x47752c
mov dword [ebp - 0x17c0], 1
jmp 0x477533
and dword [ebp - 0x17c0], 0
mov eax, dword [ebp - 0x17c0]
mov dword [ebp - 0x8c], eax
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xa92e3c
push 0xa92e3c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xa38], eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0x3c8], 0xa945cb81
mov dword [ebp - 0x3ec], 1
mov dword [ebp - 0x1cc], 0
jmp 0x4775b0
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x4775cc
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x8c0], 0xd7f825e
jmp 0x4775a3
mov dword [ebp - 0x1cc], 0
jmp 0x4775e5
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x477601
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xb50], 0x4902314a
jmp 0x4775d8
mov dword [ebp - 0x24], 0
jmp 0x477611
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x477be3
mov dword [ebp - 0x3c0], 0xfffffff8
mov dword [ebp - 0x1850], 5
mov dword [ebp - 0x206c], 0xfffffffd
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
cmp dword [ebp - 0x3b8], eax
je 0x477671
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x8c0], 0
jne 0x477671
and dword [ebp - 0x17c8], 0
jmp 0x47767b
mov dword [ebp - 0x17c8], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
cmp eax, dword [ebp - 0x17c8]
jne 0x477699
mov dword [ebp - 0x17d0], 1
jmp 0x4776a0
and dword [ebp - 0x17d0], 0
mov eax, dword [ebp - 0x17d0]
add eax, 0x3f0
neg eax
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebp + ecx*4 - 0x8c0]
jge 0x4776c5
mov dword [ebp - 0x17d8], 1
jmp 0x4776cc
and dword [ebp - 0x17d8], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8c0]
cmp dword [ebp - 0x17d8], eax
jne 0x4776ea
mov dword [ebp - 0x17e0], 1
jmp 0x4776f1
and dword [ebp - 0x17e0], 0
mov eax, dword [ebp - 0x24]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x8c0]
imul ecx, dword [ebp - 0x17e0]
cmp dword [ebp + eax*4 - 0x8c0], ecx
jl 0x47771d
mov dword [ebp - 0x17e8], 1
jmp 0x477724
and dword [ebp - 0x17e8], 0
mov eax, dword [ebp - 0x17e8]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x17f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17f0]
mov dword [ebp + eax - 0xb50], ecx
mov eax, dword [ebp - 0x17f0]
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3b8], 2
jmp 0x477774
cmp dword [ebp - 0x3b8], 0xfffffff8
jne 0x477bde
mov dword [ebp - 0x4f0], 0xe784b52d
mov dword [ebp - 0x508], 8
mov dword [ebp - 0x500], 0xfffffffb
mov eax, dword [ebp - 0x3ec]
imul eax, dword [ebp - 0x4f0]
neg eax
jne 0x4777c5
mov eax, 0x6903
test eax, eax
jne 0x4777c5
mov dword [ebp - 0x17f8], 1
jmp 0x4777cc
and dword [ebp - 0x17f8], 0
mov eax, dword [ebp - 0x4f0]
cmp eax, dword [ebp - 0x17f8]
jg 0x4777e6
mov dword [ebp - 0x1800], 1
jmp 0x4777ed
and dword [ebp - 0x1800], 0
xor eax, eax
sub eax, dword [ebp - 0x1800]
cmp eax, 0xffffffff
jne 0x477806
jmp 0x47760a
mov dword [ebp - 0x3ec], 0xffffffe4
jmp 0x477bfc
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x18
jl 0x477c32
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x477c1f
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8c0], 0
je 0x477c30
jmp 0x477c32
jmp 0x477bef
push 5
push dword [ebp - 0xa38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x21c], 0xfffffffc
push 3
lea ecx, [ebp - 0x2844]
call fcn.0042bc99
mov dword [ebp - 0x854], 0
jmp 0x477c70
mov eax, dword [ebp - 0x854]
inc eax
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 3
jge 0x477c92
push dword [ebp - 0x854]
lea ecx, [ebp - 0x2844]
call fcn.0042bd87
mov dword [eax], 9
jmp 0x477c63
mov dword [ebp - 0x21c], 0
jmp 0x477cab
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xfffffff7
jl 0x477cfc
mov dword [ebp - 0x85c], 0x22124f84
mov dword [ebp - 0x85c], 0
jmp 0x477cd7
cmp dword [ebp - 0x85c], 0xfffffffe
jg 0x477cfa
mov byte [ebp - 0x266], 0
movzx eax, byte [ebp - 0x266]
test eax, eax
je 0x477cf8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x477cca
jmp 0x477c9e
mov dword [ebp - 0x21c], 0xf
jmp 0x477d15
cmp dword [ebp - 0x21c], 0xffffffe5
jne 0x477d65
mov dword [ebp - 0x510], 0x42374b1b
mov dword [ebp - 0x510], 0
jmp 0x477d41
cmp dword [ebp - 0x510], 3
jge 0x477d63
lea ecx, [ebp - 0x2844]
call fcn.0042bd6b
mov dword [ebp - 0x864], 0xb26bdde0
mov dword [ebp - 0x864], 0
jmp 0x477d93
cmp dword [ebp - 0x864], 0xfffffffa
jg 0x477f29