Function at 0x474eb8
Capabilities:
Allocate thread local storage
Contain obfuscated stackstrings
Enumerate gui resources
Get common file path
Get geographical location
Get graphical window text
Hide graphical window
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x33c4
call fcn.004a08a0
push esi
push edi
mov dword [ebp - 0x870], 1
mov dword [ebp - 0x2f28], 0xfffffff7
mov dword [ebp - 0x1cb8], 1
mov dword [ebp - 0x2a94], 0xffffffff
mov dword [ebp - 0x2a9c], 2
mov dword [ebp - 0x21d8], 0xfffffff8
mov dword [ebp - 0x1cc0], 3
mov dword [ebp - 0x8d8], 0xfffffff7
mov dword [ebp - 0x868], 0
jmp 0x474f30
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 4
jge 0x474f4c
mov eax, dword [ebp - 0x868]
mov dword [ebp + eax*4 - 0x3384], 0x4ac0198a
jmp 0x474f23
mov dword [ebp - 0x870], 0x18
jmp 0x474f65
mov eax, dword [ebp - 0x870]
dec eax
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 0xc
jl 0x4751ac
mov dword [ebp - 0x1cd0], 0xfffd
mov dword [ebp - 0x2aa4], 0x7dcd66a0
mov dword [ebp - 0x2208], 0x7207182b
mov dword [ebp - 0x2aac], 1
mov dword [ebp - 0x2ab4], 0x82aa9dad
mov dword [ebp - 0x2210], 0xc9fa8bc0
mov dword [ebp - 0x2abc], 1
mov dword [ebp - 0x21f8], 0x1720d700
mov dword [ebp - 0x2ac4], 0xbae8b012
mov dword [ebp - 0x21e8], 0xffffffff
mov dword [ebp - 0x1eb8], 0xfffffff8
mov dword [ebp - 0x2acc], 0xabac89d7
mov dword [ebp - 0x1cc8], 1
mov dword [ebp - 0x1ce8], 0xfffffffc
mov dword [ebp - 0x878], 0
jmp 0x475017
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 2
jge 0x475033
mov eax, dword [ebp - 0x878]
mov dword [ebp + eax*4 - 0x31c8], 0x377d6446
jmp 0x47500a
mov eax, dword [ebp - 0x1eb8]
inc eax
jne 0x47504e
cmp dword [ebp - 0x1cb8], 0
jne 0x47504e
and dword [ebp - 0xe84], 0
jmp 0x475058
mov dword [ebp - 0xe84], 1
mov eax, dword [ebp - 0x1cc0]
add eax, dword [ebp - 0xe84]
cmp eax, dword [ebp - 0x21d8]
jg 0x475078
mov dword [ebp - 0x1cb0], 1
jmp 0x47507f
and dword [ebp - 0x1cb0], 0
mov eax, dword [ebp - 0x8d8]
dec eax
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x1cb0]
jle 0x4750a6
mov dword [ebp - 0x21e0], 1
jmp 0x4750ad
and dword [ebp - 0x21e0], 0
mov eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0x2ad4], eax
mov eax, dword [ebp - 0x1cc8]
mov dword [ebp - 0x2adc], eax
cmp dword [ebp - 0x21e8], 0
jne 0x4750de
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x4750de
and dword [ebp - 0x21f0], 0
jmp 0x4750e8
mov dword [ebp - 0x21f0], 1
mov eax, dword [ebp - 0x1cd0]
mov dword [ebp - 0x2ae4], eax
mov eax, dword [ebp - 0x1cc0]
sub eax, dword [ebp - 0x1cc8]
cmp dword [ebp - 0x1cd0], eax
jl 0x475114
mov dword [ebp - 0x1cd8], 1
jmp 0x47511b
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x21f8]
cmp dword [ebp - 0x1cd8], eax
jge 0x475145
mov byte [ebp - 0x392], 0
movzx eax, byte [ebp - 0x392]
test eax, eax
je 0x475143
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x4751a7
mov dword [ebp - 0x2200], 1
cmp dword [ebp - 0x2200], 0x3ecb
jne 0x475167
mov dword [ebp - 0x1ce0], 1
jmp 0x47516e
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x1ce0]
mov dword [ebp - 0x1ce8], eax
mov eax, dword [ebp - 0x2208]
cmp dword [ebp - 0x1ce8], eax
jg 0x475194
mov dword [ebp - 0x1cf0], 1
jmp 0x47519b
and dword [ebp - 0x1cf0], 0
mov eax, dword [ebp - 0x1cf0]
mov dword [ebp - 0x2210], eax
jmp 0x474f58
mov dword [ebp - 0x40], 0x6568
mov dword [ebp - 0x4f8], 0xb5725d36
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2aec], eax
cmp dword [ebp - 0x40], 0
je 0x4751fe
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jne 0x4751e0
mov dword [ebp - 0x1cf8], 1
jmp 0x4751e7
and dword [ebp - 0x1cf8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1cf8], eax
jne 0x4751fe
mov dword [ebp - 0x1d60], 1
jmp 0x475205
and dword [ebp - 0x1d60], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d60], eax
jge 0x47521c
mov dword [ebp - 0x1d68], 1
jmp 0x475223
and dword [ebp - 0x1d68], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d68], eax
jge 0x47523a
mov dword [ebp - 0x1d70], 1
jmp 0x475241
and dword [ebp - 0x1d70], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d70], eax
jl 0x475258
mov dword [ebp - 0x1d78], 1
jmp 0x47525f
and dword [ebp - 0x1d78], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d78], eax
jge 0x475276
mov dword [ebp - 0x1d80], 1
jmp 0x47527d
and dword [ebp - 0x1d80], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d80], eax
je 0x475294
mov dword [ebp - 0x2218], 1
jmp 0x47529b
and dword [ebp - 0x2218], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2af4], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
cmp eax, 0xfff6
jne 0x4752bd
mov dword [ebp - 0x195c], 1
jmp 0x4752c4
and dword [ebp - 0x195c], 0
mov eax, dword [ebp - 0x195c]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x40], 0xfffffff8
jmp 0x4752e0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x2a
jne 0x475321
mov dword [ebp - 0x2220], 1
mov dword [ebp - 0x4f8], 0x1b
jmp 0x475309
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0x1d
jle 0x47531f
cmp dword [ebp - 0x2220], 0
je 0x47531d
jmp 0x47531f
jmp 0x4752fc
jmp 0x4752d9
mov dword [ebp - 0x880], 0
jmp 0x47533a
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 3
jge 0x475356
mov eax, dword [ebp - 0x880]
mov dword [ebp + eax*4 - 0x3308], 0xfffffffd
jmp 0x47532d
mov byte [ebp - 0x2e7], 0
movzx eax, byte [ebp - 0x2e7]
test eax, eax
je 0x475378
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x475394
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [ebp - 0x71c], 1
mov dword [ebp - 0x228], 0x19d29be1
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0xa30], 0x22f50fad
mov dword [ebp - 0x514], 0
jmp 0x4753d2
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 2
jge 0x4753ee
mov eax, dword [ebp - 0x514]
mov dword [ebp + eax*4 - 0x280], 0x6482
jmp 0x4753c5
mov dword [ebp - 0x228], 0
jmp 0x475407
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jg 0x475a9b
mov dword [ebp - 0x10], 0x4e6d4f28
mov dword [ebp - 0x64], 0x5e3d1aa1
mov dword [ebp - 0x1b00], 0x927db404
mov dword [ebp - 0x2248], 0x85c7
mov dword [ebp - 0x10], 1
jmp 0x475446
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x475623
mov dword [ebp - 0x2230], 0xae9f
mov dword [ebp - 0x6dc], 0
jmp 0x475473
mov eax, dword [ebp - 0x6dc]
inc eax
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 4
jge 0x47548f
mov eax, dword [ebp - 0x6dc]
mov dword [ebp + eax*4 - 0x254c], 4
jmp 0x475466
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x254c], 0
jmp 0x4754ba
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x254c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x254c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x254c], 1
jg 0x47561e
mov dword [ebp - 0x2238], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x280], 0
je 0x47558f
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x280], 0
jne 0x47554c
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x2afc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x254c]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x475522
mov dword [ebp - 0x1ab8], 1
jmp 0x475529
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x1ab8]
add eax, 0xc4e2
je 0x475543
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x280], 0
jne 0x47554c
and dword [ebp - 0xac0], 0
jmp 0x475556
mov dword [ebp - 0xac0], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xac0]
jg 0x47556d
mov dword [ebp - 0x1ac0], 1
jmp 0x475574
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x47558f
mov dword [ebp - 0xac8], 1
jmp 0x475596
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0xac8]
neg eax
je 0x4755b0
xor eax, eax
je 0x4755b0
mov dword [ebp - 0x1ac8], 1
jmp 0x4755b7
and dword [ebp - 0x1ac8], 0
mov eax, dword [ebp - 0x1ac8]
mov dword [ebp - 0x54], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x254c]
cmp dword [ebp - 0x54], eax
jge 0x4755dd
mov dword [ebp - 0xad0], 1
jmp 0x4755e4
and dword [ebp - 0xad0], 0
cmp dword [ebp - 0xad0], 0xcb6d
je 0x4755fc
mov dword [ebp - 0x2228], 1
jmp 0x475603
and dword [ebp - 0x2228], 0
mov eax, dword [ebp - 0x2230]
mov dword [ebp - 0x2b04], eax
mov dword [ebp - 0x2238], 0xe1054d81
jmp 0x4754a1
jmp 0x47543f
mov dword [ebp - 0x10], 0
jmp 0x475633
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x475658
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp + eax*4 - 0x280]
mov dword [ebp + ecx*4 - 0x280], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
jmp 0x47562c
mov dword [ebp - 0x64], 1
jmp 0x475668
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x475a96
mov dword [ebp - 0x250], 4
mov dword [ebp - 0x2250], 0x64f81aa3
mov dword [ebp - 0x51c], 0
jmp 0x47569f
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 2
jge 0x4756bb
mov eax, dword [ebp - 0x51c]
mov dword [ebp + eax*4 - 0x22b4], 1
jmp 0x475692
mov dword [ebp - 0x54], 1
jmp 0x4756cb
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x475a91
mov dword [ebp - 0x1ae8], 0x3b5251bb
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x280]
mov dword [ebp - 0x2b0c], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x280]
mov dword [ebp - 0x2b14], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
sub eax, dword [ebp + ecx*4 - 0x280]
cmp eax, dword [ebp - 0x54]
jle 0x47571d
mov dword [ebp - 0x1ad0], 1
jmp 0x475724
and dword [ebp - 0x1ad0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1ad0], eax
jl 0x47573b
mov dword [ebp - 0xad8], 1
jmp 0x475742
and dword [ebp - 0xad8], 0
cmp dword [ebp - 0xad8], 0xd127
jge 0x475757
mov eax, 0xf0bde8af
test eax, eax
je 0x47575e
cmp dword [ebp - 0x1b00], 0
mov eax, 0x7d8169b4
cmp eax, 0xffffffff
jne 0x475774
mov dword [ebp - 0x1ad8], 1
jmp 0x47577b
and dword [ebp - 0x1ad8], 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x1ad8]
lea eax, [ecx + eax - 0xb999]
test eax, eax
je 0x4757a7
cmp dword [ebp - 0x250], 0
je 0x4757a7
mov dword [ebp - 0x2240], 1
jmp 0x4757ae
and dword [ebp - 0x2240], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2b1c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2b24], eax
cmp dword [ebp - 0x64], 0xffffffff
jne 0x4757d2
mov dword [ebp - 0xae0], 1
jmp 0x4757d9
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2b2c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x280], 0
jg 0x475807
mov dword [ebp - 0x1ae0], 1
jmp 0x47580e
and dword [ebp - 0x1ae0], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x1ae0], eax
je 0x475828
mov dword [ebp - 0xae8], 1
jmp 0x47582f
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0x1ae8], eax
mov eax, dword [ebp - 0x1ae8]
neg eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jae 0x475850
cmp dword [ebp - 0x10], 0
cmp dword [ebp - 0x2248], 0
cmp dword [ebp - 0x10], 0
je 0x475877
cmp dword [ebp - 0x250], 0
je 0x475877
xor eax, eax
inc eax
je 0x475877
mov dword [ebp - 0xaf0], 1
jmp 0x47587e
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x2250]
imul eax, dword [ebp - 0xaf0]
test eax, eax
je 0x4758ab
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x280], 0
je 0x4758ab
mov dword [ebp - 0x1af0], 1
jmp 0x4758b2
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0x1af0]
mov dword [ebp - 0xa30], eax
cmp dword [ebp - 0xa30], 0xfffffffb
jge 0x4758d9
mov dword [ebp - 0x2258], 1
jmp 0x4758e0
and dword [ebp - 0x2258], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x228]
cmp dword [ebp + eax*4 - 0x280], ecx
jle 0x4758fe
mov dword [ebp - 0xaf8], 1
jmp 0x475905
and dword [ebp - 0xaf8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xaf8]
sub ecx, dword [ebp + eax - 0x22b4]
mov eax, dword [ebp - 0x64]
add ecx, dword [ebp + eax*4 - 0x280]
cmp ecx, dword [ebp - 0x54]
jne 0x475933
mov dword [ebp - 0x1af8], 1
jmp 0x47593a
and dword [ebp - 0x1af8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1af8], eax
jg 0x475951
mov dword [ebp - 0xb00], 1
jmp 0x475958
and dword [ebp - 0xb00], 0
cmp dword [ebp - 0xb00], 0x1eb7
jg 0x475970
mov dword [ebp - 0xb08], 1
jmp 0x475977
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0x1b00]
cmp dword [ebp - 0xb08], eax
jg 0x47599e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x280], 0
jne 0x47599e
and dword [ebp - 0x1b08], 0
jmp 0x4759a8
mov dword [ebp - 0x1b08], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1b08], eax
jle 0x4759bf
mov dword [ebp - 0x2260], 1
jmp 0x4759c6
and dword [ebp - 0x2260], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x2b34], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x2b3c], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x2b44], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x280]
mov dword [ebp - 0x2b4c], eax
cmp dword [ebp - 0x10], 0xcdf3
je 0x475a0f
mov dword [ebp - 0xb10], 1
jmp 0x475a16
and dword [ebp - 0xb10], 0
cmp dword [ebp - 0xb10], 0xffffffff
jne 0x475a2b
mov dword [ebp - 0x1b10], 1
jmp 0x475a32
and dword [ebp - 0x1b10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22b4]
cmp dword [ebp - 0x1b10], eax
jge 0x475a53
mov dword [ebp - 0xb18], 1
jmp 0x475a5a
and dword [ebp - 0xb18], 0
cmp dword [ebp - 0xb18], 0x1051
jge 0x475a72
mov dword [ebp - 0x1b18], 1
jmp 0x475a79
and dword [ebp - 0x1b18], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b18]
mov dword [ebp + eax - 0x22b4], ecx
jmp 0x4756c4
jmp 0x475661
jmp 0x4753fa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x280], 0
je 0x475abb
xor eax, eax
je 0x475abb
mov dword [ebp - 0x2268], 1
jmp 0x475ac2
and dword [ebp - 0x2268], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x280]
mov dword [ebp - 0x2b54], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x2b5c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa30]
cmp dword [ebp + eax - 0x280], ecx
jl 0x475b02
mov dword [ebp - 0xb20], 1
jmp 0x475b09
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2b64], 0xfffffff7
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x1b20], 0xfffffffa
mov byte [ebp - 0x2eb], 0
movzx eax, byte [ebp - 0x2eb]
test eax, eax
je 0x475b4f
push 0x2121
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x6e4], 0
jmp 0x475b68
mov eax, dword [ebp - 0x6e4]
dec eax
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 0xfffffff7
jne 0x475b7f
mov eax, dword [ebp - 0x1b20]
mov dword [ebp - 0x1b20], eax
jmp 0x475b5b
mov dword [ebp - 0x1c74], 1
mov dword [ebp - 0x2b6c], 0xb13eca4f
mov dword [ebp - 0x2b74], 0xfda0e60f
mov dword [ebp - 0x2b7c], 0xfffffffc
mov dword [ebp - 0xb28], 0xb14f4e79
mov dword [ebp - 0x524], 0
jmp 0x475bca
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 3
jge 0x475be6
mov eax, dword [ebp - 0x524]
mov dword [ebp + eax*4 - 0x3314], 3
jmp 0x475bbd
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x475c11
push 0xaa7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [ebp - 0xb28]
dec eax
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0x2b84], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x2270], 0xfffffffe
mov dword [ebp - 0x6ec], 0
jmp 0x475c52
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 4
jge 0x475c6e
mov eax, dword [ebp - 0x6ec]
mov dword [ebp + eax*4 - 0x1e34], 0xa8eac8b
jmp 0x475c45
mov dword [ebp - 0x20], 3
jmp 0x475c7e
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x475d2a
mov dword [ebp - 0x6f4], 0x7dd68876
mov dword [ebp - 0x52c], 0
jmp 0x475cab
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 2
jge 0x475cc7
mov eax, dword [ebp - 0x52c]
mov dword [ebp + eax*4 - 0x31d0], 0
jmp 0x475c9e
mov dword [ebp - 0x6f4], 0
jmp 0x475ce0
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 3
jg 0x475d25
mov dword [ebp - 0x1b28], 0xd297
mov eax, dword [ebp - 0x1b28]
dec eax
mov dword [ebp - 0x1b28], eax
mov byte [ebp - 0x2ef], 0
movzx eax, byte [ebp - 0x2ef]
test eax, eax
je 0x475d23
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x475cd3
jmp 0x475c77
mov dword [ebp - 0x20], 3
jmp 0x475d3a
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x475efa
mov dword [ebp - 0xb38], 0x8648
mov dword [ebp - 0x1b30], 0xfffffff9
mov dword [ebp - 0xb38], 0xfffffffd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e34]
mov dword [ebp - 0x2b8c], eax
cmp dword [ebp - 0x20], 0
jne 0x475e36
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1e34], 0xa4d9a54e
jb 0x475da5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e34], 0
jne 0x475da5
and dword [ebp - 0xb30], 0
jmp 0x475daf
mov dword [ebp - 0xb30], 1
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x1b30], eax
cmp dword [ebp - 0x1b30], 0
je 0x475dcb
cmp dword [ebp - 0xb38], 0
mov eax, 0xd683
test eax, eax
je 0x475de0
mov dword [ebp - 0x1b38], 1
jmp 0x475de7
and dword [ebp - 0x1b38], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e34]
imul eax, dword [ebp - 0x1b38]
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ebp + ecx*4 - 0x1e34]
jne 0x475e10
mov dword [ebp - 0xb40], 1
jmp 0x475e17
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e34]
cmp dword [ebp - 0xb40], eax
jle 0x475e36
xor eax, eax
jne 0x475e36
and dword [ebp - 0x1b40], 0
jmp 0x475e40
mov dword [ebp - 0x1b40], 1
cmp dword [ebp - 0x1b40], 1
jb 0x475e5b
mov eax, 0xf22a1efe
test eax, eax
jne 0x475e5b
and dword [ebp - 0xb48], 0
jmp 0x475e65
mov dword [ebp - 0xb48], 1
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0xb48]
cmp eax, dword [ebp - 0x20]
jne 0x475e80
mov dword [ebp - 0x1b48], 1
jmp 0x475e87
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e34]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x1e34]
sub ecx, dword [ebp - 0x1b48]
sub eax, ecx
cmp eax, dword [ebp - 0x20]
jne 0x475eba
mov eax, 0x2869
test eax, eax
jne 0x475eba
and dword [ebp - 0xb50], 0
jmp 0x475ec4
mov dword [ebp - 0xb50], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e34]
cmp dword [ebp - 0xb50], eax
jne 0x475ee2
mov dword [ebp - 0x1b50], 1
jmp 0x475ee9
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x1b50]
mov dword [ebp - 0x2270], eax
jmp 0x475d33
mov dword [ebp - 0x2b94], 2
mov dword [ebp - 0x2b9c], 1
mov dword [ebp - 0x2ba4], 5
mov dword [ebp - 0x2bac], 0x1551da62
mov dword [ebp - 0x2bb4], 1
mov dword [ebp - 0x1f0], 0
jmp 0x475f45
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x475f61
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x3344], 0x7633efc0
jmp 0x475f38
mov dword [ebp - 0x1f0], 0
jmp 0x475f7a
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x475f96
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x25ec], 9
jmp 0x475f6d
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x475fbd
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25ec]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x25ec], eax
mov dword [ebp - 0x231c], 0xfffffff8
mov dword [ebp - 0x124], 0
jmp 0x475ffb
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x476017
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0xb58], 0xffffffff
jmp 0x475fee
mov dword [ebp - 0x124], 0
jmp 0x476030
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x47604c
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x1e64], 8
jmp 0x476023
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1e64], 0
jmp 0x476077
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e64]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1e64], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e64], 0
jl 0x476130
mov dword [ebp - 0x534], 0
jmp 0x4760a3
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 4
jge 0x4760bf
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x3210], 8
jmp 0x476096
mov byte [ebp - 0x2f3], 0
movzx eax, byte [ebp - 0x2f3]
test eax, eax
je 0x4760d9
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e64]
cmp dword [ebp + eax*4 - 0xb58], 0
jne 0x47610e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e64]
cmp dword [ebp + eax*4 - 0xb58], 0
jne 0x47610e
and dword [ebp - 0x1b58], 0
jmp 0x476118
mov dword [ebp - 0x1b58], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b58]
mov dword [ebp + eax - 0x3210], ecx
jmp 0x47605e
mov dword [ebp - 0xdb8], 3
mov dword [ebp - 0xa48], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x47615d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x476179
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x890], 0xffffffff
jmp 0x476150
mov dword [ebp - 0x1d0], 0
jmp 0x476192
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x4761ae
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x53c], 0x74e8
jmp 0x476185
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x890], 0xffffffe2
jmp 0x4761d9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x890]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x890], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x890], 0xfffffff1
jl 0x476212
mov byte [ebp - 0x2f5], 0
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x476210
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
jmp 0x4761c0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x890]
mov dword [ebp - 0x2bbc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x890]
mov dword [ebp - 0x2bc4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x53c], 0
jne 0x476253
mov dword [ebp - 0xb60], 1
jmp 0x47625a
and dword [ebp - 0xb60], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb60]
sub ecx, dword [ebp + eax - 0x53c]
cmp ecx, 1
jge 0x47627e
mov dword [ebp - 0x1b60], 1
jmp 0x476285
and dword [ebp - 0x1b60], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x890]
sub eax, dword [ebp - 0x1b60]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x890]
jl 0x4762b2
mov dword [ebp - 0xb68], 1
jmp 0x4762b9
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0xa48]
add eax, dword [ebp - 0xb68]
jne 0x4762ce
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x4762e3
cmp dword [ebp - 0xa48], 0
je 0x4762e3
mov dword [ebp - 0x1b68], 1
jmp 0x4762ea
and dword [ebp - 0x1b68], 0
cmp dword [ebp - 0x1b68], 0x3d1f
jne 0x476312
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x890], 0
je 0x476312
mov dword [ebp - 0xb70], 1
jmp 0x476319
and dword [ebp - 0xb70], 0
cmp dword [ebp - 0xb70], 0
jl 0x47632e
mov dword [ebp - 0x1b70], 1
jmp 0x476335
and dword [ebp - 0x1b70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x890]
add eax, dword [ebp - 0x1b70]
cmp eax, 0x4e5878ed
jg 0x47635b
mov dword [ebp - 0xa38], 1
jmp 0x476362
and dword [ebp - 0xa38], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa38]
mov dword [ebp + eax - 0x890], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x53c]
cmp dword [ebp - 0xa38], eax
jne 0x476395
mov dword [ebp - 0xb78], 1
jmp 0x47639c
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0xb78]
neg eax
je 0x47654a
mov dword [ebp - 0x1b88], 0xffffffff
mov dword [ebp - 0x1b80], 0
mov dword [ebp - 0x6fc], 0
jmp 0x4763d7
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 1
jge 0x4763f3
mov eax, dword [ebp - 0x6fc]
mov dword [ebp + eax*4 - 0xa40], 0xad21dd8e
jmp 0x4763ca
mov byte [ebp - 0x2f7], 0
movzx eax, byte [ebp - 0x2f7]
test eax, eax
je 0x47641e
push 0x2408
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
inc eax
je 0x4764cc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa40], 1
je 0x476443
mov dword [ebp - 0x1b78], 1
jmp 0x47644a
and dword [ebp - 0x1b78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
cmp dword [ebp - 0x1b78], eax
jle 0x47646b
mov dword [ebp - 0xb80], 1
jmp 0x476472
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x1b80], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x890]
cmp eax, dword [ebp - 0x1b80]
jl 0x47649e
mov dword [ebp - 0xb88], 1
jmp 0x4764a5
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x1b88]
sub eax, dword [ebp - 0xb88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x890]
jl 0x4764cc
mov dword [ebp - 0x2278], 1
jmp 0x4764d3
and dword [ebp - 0x2278], 0
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x2bcc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
mov dword [ebp - 0x2bd4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x53c]
cmp dword [ebp - 0xa48], eax
jg 0x476513
mov dword [ebp - 0xb90], 1
jmp 0x47651a
and dword [ebp - 0xb90], 0
cmp dword [ebp - 0xb90], 0
ja 0x47652f
mov dword [ebp - 0x1b90], 1
jmp 0x476536
and dword [ebp - 0x1b90], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b90]
mov dword [ebp + eax - 0x890], ecx
jmp 0x476567
mov byte [ebp - 0x2f9], 0
movzx eax, byte [ebp - 0x2f9]
test eax, eax
je 0x476567
push 0xbb3
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x12c], 0x477862f
mov dword [ebp - 0xa50], 0x6335c0de
mov dword [ebp - 0x1ba8], 7
mov dword [ebp - 0x2288], 5
mov dword [ebp - 0x12c], 0
jmp 0x4765a8
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x1a
je 0x476798
mov dword [ebp - 0x544], 0xba09
mov dword [ebp - 0x27c8], 7
mov dword [ebp - 0x27c4], 7
mov dword [ebp - 0x27c0], 7
mov dword [ebp - 0x27bc], 7
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x1bb0], 0xffffffff
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xb98], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb98]
mov dword [ebp + eax - 0x27c8], ecx
cmp dword [ebp - 0xb98], 0
jne 0x476635
mov eax, 0x3a06
test eax, eax
jne 0x476635
and dword [ebp - 0x2280], 0
jmp 0x47663f
mov dword [ebp - 0x2280], 1
cmp dword [ebp - 0x12c], 0
je 0x47665d
cmp dword [ebp - 0x12c], 0
je 0x47665d
mov dword [ebp - 0x1b98], 1
jmp 0x476664
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x1b98], eax
jne 0x47667e
mov dword [ebp - 0xba0], 1
jmp 0x476685
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0xba0]
jl 0x47669f
mov dword [ebp - 0x1ba0], 1
jmp 0x4766a6
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x1ba0], eax
je 0x4766c0
mov dword [ebp - 0xba8], 1
jmp 0x4766c7
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x2bdc], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x2be4], eax
mov eax, dword [ebp - 0xa50]
mov dword [ebp - 0x1ba8], eax
cmp dword [ebp - 0x1ba8], 0
je 0x476715
cmp dword [ebp - 0xa50], 0
je 0x476715
mov dword [ebp - 0xbb0], 1
jmp 0x47671c
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0xbb0]
jge 0x476731
cmp dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x704]
add eax, 0x6d490438
sub eax, dword [ebp - 0x544]
mov dword [ebp - 0x1bb0], eax
jne 0x47675c
cmp dword [ebp - 0xa50], 0
jne 0x47675c
and dword [ebp - 0xbb8], 0
jmp 0x476766
mov dword [ebp - 0xbb8], 1
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0x2288], eax
mov byte [ebp - 0x2fb], 0
movzx eax, byte [ebp - 0x2fb]
test eax, eax
je 0x476793
push 0x23dd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x47659b
mov dword [ebp - 0x9d4], 0xfffffff7
mov dword [ebp - 0x418], 0xd23b6182
mov dword [ebp - 0x2290], 0x84cb8f6c
mov dword [ebp - 0x23bc], 0xebc5f93b
mov dword [ebp - 0x2bec], 0x23917005
mov dword [ebp - 0x2bf4], 0x276463a4
mov dword [ebp - 0x22a8], 0xbbe0e206
mov dword [ebp - 0x1bd0], 0xfffc
mov dword [ebp - 0x210], 0
jmp 0x476801
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x47681d
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x30fc], 0x934b0b4e
jmp 0x4767f4
mov dword [ebp - 0x210], 0
jmp 0x476836
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x476852
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x23c4], 2
jmp 0x476829
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2bfc], eax
cmp dword [ebp - 0x418], 0x38ec
jne 0x476876
mov dword [ebp - 0x1bb8], 1
jmp 0x47687d
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0x418]
imul eax, dword [ebp - 0x1bb8]
test eax, eax
je 0x476b96
mov dword [ebp - 0x2c04], 0xa7b7e80d
mov dword [ebp - 0x2d2c], 9
mov dword [ebp - 0x23a4], 0x7770b168
mov dword [ebp - 0xa80], 0xa4129b85
mov dword [ebp - 0x2d34], 0xc8af9534
mov dword [ebp - 0x2d3c], 0x30477ae2
mov dword [ebp - 0x23b4], 0x82f4e55b
mov dword [ebp - 0x2d44], 0x5a7ab5bf
mov dword [ebp - 0x2d4c], 0
mov dword [ebp - 0x2d54], 1
mov dword [ebp - 0x2d5c], 0xce7aebb1
mov dword [ebp - 0x2d64], 0xffffffff
mov dword [ebp - 0x2d6c], 0
mov dword [ebp - 0x2d74], 0xffffffff
mov dword [ebp - 0x2298], 0xfffffffc
mov dword [ebp - 0x2d7c], 0xffffffff
mov dword [ebp - 0x2d84], 0x3a81f6ed
mov dword [ebp - 0x2d8c], 1
mov dword [ebp - 0x22a0], 0xfe96f77d
mov dword [ebp - 0x2d94], 0
mov dword [ebp - 0x2d9c], 0x6dae1dc6
mov dword [ebp - 0x2da4], 3
mov dword [ebp - 0x2dac], 0
mov dword [ebp - 0x2db4], 0xfffffff8
mov dword [ebp - 0xa58], 4
mov dword [ebp - 0x2384], 0xcf5e
mov dword [ebp - 0x23cc], 0
mov dword [ebp - 0x70c], 0
jmp 0x4769b9
mov eax, dword [ebp - 0x70c]
inc eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 4
jge 0x4769d5
mov eax, dword [ebp - 0x70c]
mov dword [ebp + eax*4 - 0x3228], 0xed5ebae8
jmp 0x4769ac
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2dbc], eax
mov eax, dword [ebp - 0x1bd0]
cmp dword [ebp - 0x2290], eax
jle 0x476a04
cmp dword [ebp - 0x2298], 0
je 0x476a04
mov dword [ebp - 0xbc0], 1
jmp 0x476a0b
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x22a0]
cmp dword [ebp - 0xbc0], eax
jle 0x476a25
mov dword [ebp - 0x1bc0], 1
jmp 0x476a2c
and dword [ebp - 0x1bc0], 0
imul eax, dword [ebp - 0x1bc0], 0xaa6b
imul eax, dword [ebp - 0x22a8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3228]
je 0x476a58
mov dword [ebp - 0xbc8], 1
jmp 0x476a5f
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xa58]
imul eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x238c], eax
mov eax, dword [ebp - 0x2384]
mov dword [ebp - 0x2394], eax
mov eax, dword [ebp - 0xa58]
dec eax
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0x238c]
cmp eax, dword [ebp - 0x2394]
jle 0x476aa5
mov dword [ebp - 0x1bc8], 1
jmp 0x476aac
and dword [ebp - 0x1bc8], 0
cmp dword [ebp - 0x1bc8], 5
jle 0x476ac1
mov dword [ebp - 0xbd0], 1
jmp 0x476ac8
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0xbd0]
jne 0x476ae2
mov dword [ebp - 0x239c], 1
jmp 0x476ae9
and dword [ebp - 0x239c], 0
mov eax, dword [ebp - 0xa80]
dec eax
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x2dc4], eax
mov eax, dword [ebp - 0x1bd0]
cmp dword [ebp - 0x23a4], eax
jl 0x476b1c
mov dword [ebp - 0x23ac], 1
jmp 0x476b23
and dword [ebp - 0x23ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x30fc]
mov dword [ebp - 0x2dcc], eax
mov eax, dword [ebp - 0x23b4]
cmp dword [ebp - 0x23bc], eax
jge 0x476b5d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23c4], 0
jne 0x476b5d
and dword [ebp - 0xbd8], 0
jmp 0x476b67
mov dword [ebp - 0xbd8], 1
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0xbd8], eax
jge 0x476b81
mov dword [ebp - 0x1bd8], 1
jmp 0x476b88
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0x1bd8]
mov dword [ebp - 0x23cc], eax
jmp 0x476bc1
mov byte [ebp - 0x394], 0
movzx eax, byte [ebp - 0x394]
test eax, eax
je 0x476bc1
push 0
push 0x1839
push 0
push 0x306
push 0x1d1a
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x134], 0
jmp 0x476bda
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x476bf6
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x33a4], 0x9b55
jmp 0x476bcd
mov dword [ebp - 0x134], 0
jmp 0x476c0f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x476c2b
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x2788], 0x32fe2236
jmp 0x476c02
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2788], 3
jmp 0x476c56
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2788]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2788], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2788], 0
jl 0x476d48
mov dword [ebp - 0x54c], 0
jmp 0x476c82
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jge 0x476c9e
mov eax, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x1e1c], 0x7be18795
jmp 0x476c75
mov byte [ebp - 0x311], 0
movzx eax, byte [ebp - 0x311]
test eax, eax
je 0x476cd9
push 0x1765
push 0
push 0
push 0x1527
push 0x7b1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1e1c], 3
jmp 0x476d07
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e1c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1e1c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e1c], 0
jl 0x476d43
mov byte [ebp - 0x283], 0
movzx eax, byte [ebp - 0x283]
test eax, eax
je 0x476d41
push 0x9be
push 0
push 0
push 0
push 0xdbb
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x476cec
jmp 0x476c3d
mov dword [ebp - 0x714], 0
jmp 0x476d61
mov eax, dword [ebp - 0x714]
inc eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 4
jge 0x476d7d
mov eax, dword [ebp - 0x714]
mov dword [ebp + eax*4 - 0x33c4], 0x4ac0198a
jmp 0x476d54
mov dword [ebp - 0x23d4], 0
mov dword [ebp - 0x23dc], 0x94964a53
mov dword [ebp - 0x2dd4], 0x4822b16
mov dword [ebp - 0x2ddc], 0x3b7beded
mov dword [ebp - 0x2de4], 0xc657e3b6
mov dword [ebp - 0x270c], 0xdad816f9
mov dword [ebp - 0x2708], 0xdad816f9
mov dword [ebp - 0x2704], 0xdad816f9
mov dword [ebp - 0x2700], 0xdad816f9
mov dword [ebp - 0x554], 0
jmp 0x476df0
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 2
jge 0x476e0c
mov eax, dword [ebp - 0x554]
mov dword [ebp + eax*4 - 0x31d8], 0xffffffff
jmp 0x476de3
mov eax, dword [ebp - 0x23d4]
mov dword [ebp - 0x23dc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x270c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x270c], eax
mov dword [ebp - 0x71c], 0x18
jmp 0x476e4a
cmp dword [ebp - 0x71c], 0xc
jl 0x47aa83
mov dword [ebp - 0x268], 0xf5a9
mov dword [ebp - 0x500], 0x3c891c55
mov dword [ebp - 0x724], 0x17f4039e
mov dword [ebp - 0x1bf8], 0x120dd93b
mov dword [ebp - 0xbf8], 1
mov dword [ebp - 0x508], 0xffffffff
mov dword [ebp - 0x230], 0xc5674fa7
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa88], 0x7c242ea6
mov dword [ebp - 0x2494], 0
mov dword [ebp - 0x249c], 0xbecc425f
mov dword [ebp - 0x24a4], 0xcc5119b5
mov dword [ebp - 0x55c], 0
jmp 0x476ee8
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 2
jge 0x476f04
mov eax, dword [ebp - 0x55c]
mov dword [ebp + eax*4 - 0x1dec], 0xad5befa1
jmp 0x476edb
mov eax, 0xe6f7fbf2
test eax, eax
je 0x476f22
cmp dword [ebp - 0x268], 0
je 0x476f22
mov dword [ebp - 0xbe0], 1
jmp 0x476f29
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0xbe0]
jge 0x476f4f
mov dword [ebp - 0x23e4], 1
jmp 0x476f56
and dword [ebp - 0x23e4], 0
cmp dword [ebp - 0x268], 0
je 0x476fda
cmp dword [ebp - 0x268], 0xd14c
je 0x476f77
mov dword [ebp - 0x1be0], 1
jmp 0x476f7e
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x1be0], eax
jl 0x476f98
mov dword [ebp - 0xbe8], 1
jmp 0x476f9f
and dword [ebp - 0xbe8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbe8]
mov dword [ebp + eax - 0x1dec], ecx
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x2dec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dec]
mov dword [ebp - 0x2df4], eax
cmp dword [ebp - 0x268], 0
jne 0x476ff3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1dec], 0
jne 0x476ff3
and dword [ebp - 0x1be8], 0
jmp 0x476ffd
mov dword [ebp - 0x1be8], 1
mov eax, dword [ebp - 0x1be8]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x724], eax
jl 0x477023
mov dword [ebp - 0xbf0], 1
jmp 0x47702a
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0xbf0], 0xfffffff7
jb 0x47703f
mov dword [ebp - 0x1bf0], 1
jmp 0x477046
and dword [ebp - 0x1bf0], 0
cmp dword [ebp - 0x1bf0], 0xffffffff
jae 0x47705b
mov dword [ebp - 0x23ec], 1
jmp 0x477062
and dword [ebp - 0x23ec], 0
mov eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0x2dfc], eax
mov dword [ebp - 0xbf8], 8
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0x2e04], eax
cmp dword [ebp - 0x230], 0
jne 0x4770b2
mov dword [ebp - 0x1c10], 1
jmp 0x4770b9
and dword [ebp - 0x1c10], 0
cmp dword [ebp - 0x500], 0
je 0x477109
cmp dword [ebp - 0x230], 0xf6f6
jg 0x4770da
mov dword [ebp - 0xc00], 1
jmp 0x4770e1
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xc00]
neg eax
imul eax, dword [ebp - 0x508]
test eax, eax
jne 0x4770fd
cmp dword [ebp - 0xa90], 0
je 0x477109
mov dword [ebp - 0x23f4], 1
jmp 0x477110
and dword [ebp - 0x23f4], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2edc], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x2ee4], eax
mov eax, dword [ebp - 0x508]
sub eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x230]
jg 0x477148
mov dword [ebp - 0x1c00], 1
jmp 0x47714f
and dword [ebp - 0x1c00], 0
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0x1c00], eax
jg 0x477172
cmp dword [ebp - 0x230], 0
je 0x477172
mov dword [ebp - 0xc08], 1
jmp 0x477179
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x2484], eax
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0x248c], eax
mov eax, dword [ebp - 0xa88]
dec eax
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0x2484]
cmp eax, dword [ebp - 0x248c]
jge 0x4771b8
mov dword [ebp - 0x1c08], 1
jmp 0x4771bf
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x2494]
add eax, dword [ebp - 0x1c08]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1dec]
jge 0x4771e6
mov dword [ebp - 0xc10], 1
jmp 0x4771ed
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 0xfffd
je 0x477205
mov dword [ebp - 0xc18], 1
jmp 0x47720c
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x1c10]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
cmp eax, dword [ebp - 0xc18]
jle 0x477232
mov dword [ebp - 0x1c18], 1
jmp 0x477239
and dword [ebp - 0x1c18], 0
cmp dword [ebp - 0x1c18], 0x1bf5
je 0x477251
mov dword [ebp - 0xc20], 1
jmp 0x477258
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0xc20], eax
jge 0x477272
mov dword [ebp - 0x1c20], 1
jmp 0x477279
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0x1c20]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x249c]
cmp dword [ebp - 0x508], eax
je 0x4772a5
cmp dword [ebp - 0x230], 0
jne 0x4772a5
and dword [ebp - 0xc28], 0
jmp 0x4772af
mov dword [ebp - 0xc28], 1
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x24a4], eax
mov dword [ebp - 0xdc0], 0xfffd
mov dword [ebp - 0x24ac], 0xffffffff
mov dword [ebp - 0x2eec], 0x506e
mov dword [ebp - 0x2ef4], 0
mov dword [ebp - 0x2efc], 0x693e93
mov dword [ebp - 0x2f04], 1
mov dword [ebp - 0x1c28], 3
mov dword [ebp - 0x564], 0
jmp 0x47731a
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 1
jge 0x477336
mov eax, dword [ebp - 0x564]
mov dword [ebp + eax*4 - 0x24b4], 0xffffffff
jmp 0x47730d
cmp dword [ebp - 0x24ac], 0
je 0x4773f1
mov dword [ebp - 0x2f0c], 0x94a1888
mov dword [ebp - 0x2f14], 0xafd94fe5
mov dword [ebp - 0x2f1c], 0xd6923607
mov dword [ebp - 0x4a4], 0xa20a2982
mov dword [ebp - 0x2f24], 0
mov eax, dword [ebp - 0x1c28]
inc eax
mov dword [ebp - 0x1c28], eax
mov dword [ebp - 0x4a4], 0
jmp 0x47739b
mov eax, dword [ebp - 0x4a4]
dec eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0
jl 0x4773ef
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x4773db
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x27d
push 0xe1f
push 0x13cc
push 0x949
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp + eax*4 - 0x24b4], 0
je 0x4773ed
jmp 0x4773ef
jmp 0x47738e
jmp 0x477412
mov byte [ebp - 0x285], 0
movzx eax, byte [ebp - 0x285]
test eax, eax
je 0x477412
push 0x6cd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x2f2c], 0x7dcd66a0
mov dword [ebp - 0x72c], 0x97f6af11
mov dword [ebp - 0x734], 9
mov dword [ebp - 0x72c], 0
jmp 0x477449
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 6
jl 0x47756d
mov dword [ebp - 0x56c], 0
jmp 0x47746f
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 2
jge 0x47748b
mov eax, dword [ebp - 0x56c]
mov dword [ebp + eax*4 - 0x268c], 0xffffffff
jmp 0x477462
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x268c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x268c], eax
mov dword [ebp - 0x734], 0xfffffff4
jmp 0x4774bf
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0x17
jne 0x477568
mov dword [ebp - 0x574], 0xfa72c25f
mov dword [ebp - 0x574], 1
jmp 0x4774ef
mov eax, dword [ebp - 0x574]
dec eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0
jl 0x477533
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x477517
push 0
push 0xb20
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [ebp - 0x287], 0
movzx eax, byte [ebp - 0x287]
test eax, eax
je 0x477531
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
jmp 0x4774e2
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x477563
push 0x1862
push 0x4ab
push 0xa08
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x4774b2
jmp 0x47743c
mov dword [ebp - 0x1f9c], 0x7207182b
mov dword [ebp - 0x73c], 0x22124f84
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x2f34], 0x7647f1a
mov dword [ebp - 0x258c], 0x25db
mov dword [ebp - 0x2588], 0x25db
mov dword [ebp - 0x2584], 0x25db
mov dword [ebp - 0x2580], 0x25db
mov dword [ebp - 0x1d8], 0
jmp 0x4775d6
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x4775f2
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x1c38], 0x158018d9
jmp 0x4775c9
mov dword [ebp - 0x1d8], 0
jmp 0x47760b
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x477627
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x2714], 0xcaa5d732
jmp 0x4775fe
cmp dword [ebp - 0x73c], 0
je 0x477645
cmp dword [ebp - 0x73c], 0
je 0x477645
mov dword [ebp - 0xc30], 1
jmp 0x47764c
and dword [ebp - 0xc30], 0
cmp dword [ebp - 0x73c], 0
jne 0x477661
mov dword [ebp - 0x1c30], 1
jmp 0x477668
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0xc30]
cmp eax, dword [ebp - 0x1c30]
jl 0x47773c
mov dword [ebp - 0x2f3c], 9
mov dword [ebp - 0x5c], 0
jmp 0x477694
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x4776aa
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2f44], 0x9978f3c
jmp 0x47768d
mov dword [ebp - 0x5c], 0
jmp 0x4776ba
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x4776d0
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x31e8], 0
jmp 0x4776b3
mov dword [ebp - 0x5c], 0
jmp 0x4776e0
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x4776f6
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x31f8], 0x42760385
jmp 0x4776d9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2714]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2714], eax
mov byte [ebp - 0x289], 0
movzx eax, byte [ebp - 0x289]
test eax, eax
je 0x477737
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x4778be
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0xa84], 0xcfebdab6
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x4f0]
cmp dword [ebp + eax - 0x258c], ecx
je 0x477771
mov dword [ebp - 0x24bc], 1
jmp 0x477778
and dword [ebp - 0x24bc], 0
cmp dword [ebp - 0x4f0], 0x450c
jle 0x477790
mov dword [ebp - 0xc38], 1
jmp 0x477797
and dword [ebp - 0xc38], 0
cmp dword [ebp - 0xc38], 0x5674
jle 0x4777af
mov dword [ebp - 0x21d0], 1
jmp 0x4777b6
and dword [ebp - 0x21d0], 0
mov eax, 0xa64e
cmp eax, 0xfffd
jbe 0x4777ce
mov dword [ebp - 0xa98], 1
jmp 0x4777d5
and dword [ebp - 0xa98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa98]
mov dword [ebp + eax - 0x1c38], ecx
mov eax, dword [ebp - 0x4f0]
cmp eax, dword [ebp - 0xa98]
jge 0x477802
mov dword [ebp - 0x1ec4], 1
jmp 0x477809
and dword [ebp - 0x1ec4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f0]
cmp dword [ebp + eax - 0x1c38], ecx
jne 0x47782a
mov dword [ebp - 0xc40], 1
jmp 0x477831
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0xa84], eax
cmp dword [ebp - 0xa84], 0x34bd
jl 0x477855
mov dword [ebp - 0x1c40], 1
jmp 0x47785c
and dword [ebp - 0x1c40], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x258c]
mov dword [ebp - 0x2f4c], eax
mov eax, dword [ebp - 0xa84]
cmp dword [ebp - 0x4f0], eax
jne 0x477889
mov dword [ebp - 0xc48], 1
jmp 0x477890
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x1c40]
cmp eax, dword [ebp - 0xc48]
jne 0x4778aa
mov dword [ebp - 0x1c48], 1
jmp 0x4778b1
and dword [ebp - 0x1c48], 0
imul eax, dword [ebp - 0x1c48], 0
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x444], 0
jmp 0x4778d7
cmp dword [ebp - 0x444], 4
jge 0x4778f3
mov eax, dword [ebp - 0x444]
mov dword [ebp + eax*4 - 0x258c], 0x90ce
jmp 0x4778ca
mov dword [ebp - 0x2f54], 1
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x13c], 0
jmp 0x477920
mov dword [ebp - 0x238], 0x3fcb50bf
mov dword [ebp - 0xee0], 2
mov dword [ebp - 0x7b0], 0x6e6c8cac
mov dword [ebp - 0x235c], 0xffff
mov dword [ebp - 0x2f10], 0xffffffff
mov dword [ebp - 0x7a8], 0
jmp 0x47aace
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 4
jge 0x47aaea
mov eax, dword [ebp - 0x7a8]
mov dword [ebp + eax*4 - 0x263c], 0xa8eac8b
jmp 0x47aac1
mov dword [ebp - 0x238], 0
jmp 0x47ab03
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jg 0x47ad55
mov dword [ebp - 0x3a4], 0xf6b8f3d4
mov dword [ebp - 0x3080], 0x9729cf30
mov dword [ebp - 0x307c], 0x9729cf30
mov dword [ebp - 0x3078], 0x9729cf30
mov dword [ebp - 0x3074], 0x9729cf30
mov dword [ebp - 0x1fa4], 0xfffffff8
mov dword [ebp - 0x5d4], 0
jmp 0x47ab65
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 2
jge 0x47ab81
mov eax, dword [ebp - 0x5d4]
mov dword [ebp + eax*4 - 0x271c], 0xe5b14f4e
jmp 0x47ab58
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x271c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x271c], eax
mov dword [ebp - 0x3a4], 3
jmp 0x47abb5
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
jl 0x47ad50
mov dword [ebp - 0x934], 0xfffffffa
mov dword [ebp - 0xa44], 0x878e
mov dword [ebp - 0x1fb4], 0xbf5e
mov dword [ebp - 0xee0], 1
cmp dword [ebp - 0xee0], 0
je 0x47ac71
mov eax, dword [ebp - 0x238]
mov eax, dword [ebp + eax*4 - 0x263c]
mov ecx, dword [ebp - 0x238]
imul eax, dword [ebp + ecx*4 - 0x263c]
cmp eax, dword [ebp - 0x1fa4]
jl 0x47ac22
mov dword [ebp - 0x19e4], 1
jmp 0x47ac29
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0x19e4]
jg 0x47ac4f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x263c], 0
jne 0x47ac4f
and dword [ebp - 0xee8], 0
jmp 0x47ac59
mov dword [ebp - 0xee8], 1
cmp dword [ebp - 0xee8], 0xffff
ja 0x47ac71
mov dword [ebp - 0x1658], 1
jmp 0x47ac78
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0xa44]
imul eax, dword [ebp - 0x1658]
add eax, dword [ebp - 0x238]
mov dword [ebp - 0x22a4], eax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x1fac], eax
mov eax, dword [ebp - 0xa44]
dec eax
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp - 0x22a4]
cmp eax, dword [ebp - 0x1fac]
je 0x47acc4
mov dword [ebp - 0xef0], 1
jmp 0x47accb
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0xef0]
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x235c]
cmp dword [ebp - 0x934], eax
jge 0x47acf1
mov dword [ebp - 0x1d6c], 1
jmp 0x47acf8
and dword [ebp - 0x1d6c], 0
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x1d6c]
dec ecx
cmp dword [ebp + eax*4 - 0x263c], ecx
jl 0x47ad1a
mov dword [ebp - 0xef8], 1
jmp 0x47ad21
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xef8]
mov dword [ebp - 0x1fb4], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x263c], 0x6a9cbde6
cmp dword [ebp - 0x3a4], 0
je 0x47ad4b
jmp 0x47aba8
jmp 0x47aba8
jmp 0x47aaf6
mov dword [ebp - 0x7b0], 0
jmp 0x47ad6e
mov eax, dword [ebp - 0x7b0]
dec eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 0xffffffee
jg 0x47ada8
mov byte [ebp - 0x2e2], 0
movzx eax, byte [ebp - 0x2e2]
test eax, eax
je 0x47ada6
push 0
push 0x1617
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x47ad61
cmp dword [ebp + 8], 2
jl 0x483e9b
mov dword [ebp - 0x98], 0x74b1b055
mov dword [ebp - 0x9ec], 0xfeaf86f2
mov dword [ebp - 0xf20], 9
mov dword [ebp - 0x1fbc], 0x4951
mov dword [ebp - 0x2364], 1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x28e8], eax
cmp dword [ebp - 0x98], 0x509e
jl 0x47ae08
mov dword [ebp - 0x1660], 1
jmp 0x47ae0f
and dword [ebp - 0x1660], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1660], eax
jg 0x47ae29
mov dword [ebp - 0xf00], 1
jmp 0x47ae30
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0xf00]
jge 0x47ae4a
mov dword [ebp - 0x19ec], 1
jmp 0x47ae51
and dword [ebp - 0x19ec], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x19ec], eax
jne 0x47ae6b
mov dword [ebp - 0xf08], 1
jmp 0x47ae72
and dword [ebp - 0xf08], 0
cmp dword [ebp - 0xf08], 0
jl 0x47ae87
mov dword [ebp - 0x22ac], 1
jmp 0x47ae8e
and dword [ebp - 0x22ac], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2d20], eax
cmp dword [ebp - 0x98], 0
jb 0x47aeaf
mov dword [ebp - 0x1668], 1
jmp 0x47aeb6
and dword [ebp - 0x1668], 0
mov eax, dword [ebp - 0x1668]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
add eax, 0xfffd
jne 0x47aee1
cmp dword [ebp - 0x9ec], 0
jne 0x47aee1
and dword [ebp - 0xf10], 0
jmp 0x47aeeb
mov dword [ebp - 0xf10], 1
cmp dword [ebp - 0xf10], 0x76038591
jge 0x47af03
mov dword [ebp - 0x1bac], 1
jmp 0x47af0a
and dword [ebp - 0x1bac], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1bac], eax
jne 0x47af24
mov dword [ebp - 0xf18], 1
jmp 0x47af2b
and dword [ebp - 0xf18], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xf18], eax
je 0x47af45
mov dword [ebp - 0x1670], 1
jmp 0x47af4c
and dword [ebp - 0x1670], 0
mov eax, dword [ebp - 0x1670]
inc eax
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xf20], eax
je 0x47af73
mov dword [ebp - 0x19f4], 1
jmp 0x47af7a
and dword [ebp - 0x19f4], 0
cmp dword [ebp - 0x19f4], 0x4caa5d73
jge 0x47af92
mov dword [ebp - 0xf28], 1
jmp 0x47af99
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xf28], eax
jne 0x47afae
cmp dword [ebp - 0x1fbc], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2364], eax
mov byte [ebp - 0x2a0], 0
movzx eax, byte [ebp - 0x2a0]
test eax, eax
je 0x47afd9
push 0x831
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x1c4], 0
jmp 0x47aff2
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x47b00e
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x28f0], 0x35568345
jmp 0x47afe5
mov dword [ebp - 0x1c4], 0
jmp 0x47b027
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x47b043
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x1df4], 0
jmp 0x47b01a
mov byte [ebp - 0x319], 0
movzx eax, byte [ebp - 0x319]
test eax, eax
je 0x47b069
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1df4], 0
jmp 0x47b097
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1df4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1df4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1df4], 0
jl 0x47b0cb
mov byte [ebp - 0x2a2], 0
movzx eax, byte [ebp - 0x2a2]
test eax, eax
je 0x47b0c9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x47b07c
mov dword [ebp - 0x2fd4], 0x9fe387fb
mov byte [ebp - 0x2e4], 0
movzx eax, byte [ebp - 0x2e4]
test eax, eax
je 0x47b0ef
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0x2ea], 0
movzx eax, byte [ebp - 0x2ea]
test eax, eax
je 0x47b11a
push 0x1ae5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [ebp - 0x220], 0x3fcb50bf
mov dword [ebp - 0x5dc], 0
jmp 0x47b13d
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 3
jge 0x47b159
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x25a8], 0xf5540d7f
jmp 0x47b130
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x25a8], 0
jmp 0x47b187
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x25a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x25a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25a8], 0xfffffff4
jle 0x47b1b5
mov byte [ebp - 0x2a4], 0
movzx eax, byte [ebp - 0x2a4]
test eax, eax
je 0x47b1b3
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x47b16c
mov dword [ebp - 0x1248], 2
mov dword [ebp - 0x1ea4], 1
mov dword [ebp - 0x1ea0], 1
mov dword [ebp - 0x1e9c], 1
mov dword [ebp - 0x1e98], 1
mov dword [ebp - 0x7b8], 0
jmp 0x47b200
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 1
jge 0x47b21c
mov eax, dword [ebp - 0x7b8]
mov dword [ebp + eax*4 - 0x28f8], 0xffffffff
jmp 0x47b1f3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1ea4], 0xfffffffd
jmp 0x47b24a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ea4], 0xffffffe4
jne 0x47b3ad
mov dword [ebp - 0x5e4], 0
jmp 0x47b277
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 2
jge 0x47b293
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x1e14], 1
jmp 0x47b26a
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1ea4]
cmp dword [ebp + eax - 0x1e14], ecx
jle 0x47b2bb
mov dword [ebp - 0x1678], 1
jmp 0x47b2c2
and dword [ebp - 0x1678], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e14]
cmp dword [ebp - 0x1678], eax
jle 0x47b323
mov dword [ebp - 0x7c0], 0
jmp 0x47b2f0
cmp dword [ebp - 0x7c0], 2
jge 0x47b30c
mov eax, dword [ebp - 0x7c0]
mov dword [ebp + eax*4 - 0x2c1c], 0xa6957688
jmp 0x47b2e3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c1c], 0
je 0x47b321
mov dword [ebp - 0x1fc4], 0x3e34b64b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e14], 0xfffffffd
jne 0x47b349
mov dword [ebp - 0xf30], 1
jmp 0x47b350
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0x1fc4]
cmp eax, dword [ebp - 0xf30]
jne 0x47b36a
mov dword [ebp - 0x1c8c], 1
jmp 0x47b371
and dword [ebp - 0x1c8c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c8c]
mov dword [ebp + eax - 0x1e14], ecx
mov byte [ebp - 0x393], 0
movzx eax, byte [ebp - 0x393]
test eax, eax
je 0x47b3a8
mov dword [ebp - 0x664], 0x6e6c8cac
mov dword [ebp - 0x5ec], 0
jmp 0x47b3d0
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 2
jge 0x47b3ec
mov eax, dword [ebp - 0x5ec]
mov dword [ebp + eax*4 - 0x1d1c], 0xfffffff8
jmp 0x47b3c3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d1c], 0
jmp 0x47b41a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d1c], 0xb
jl 0x47b462
mov byte [ebp - 0x2a6], 0
movzx eax, byte [ebp - 0x2a6]
test eax, eax
je 0x47b44e
push 0xfb8
push 0x2382
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d1c], 0
je 0x47b460
jmp 0x47b462
jmp 0x47b3ff
mov dword [ebp - 0x2084], 0xffff
mov dword [ebp - 0x7c8], 1
mov dword [ebp - 0x7c8], 0
jmp 0x47b48f
cmp dword [ebp - 0x7c8], 0x15
jg 0x47b4ce
mov dword [ebp - 0x22b8], 0xe5ccc90a
cmp dword [ebp - 0x22b8], 0
je 0x47b4ad
mov dword [ebp - 0x2d28], 0xffffffff
mov dword [ebp - 0x7d0], 0x5c8094a
mov dword [ebp - 0x5f4], 0
jmp 0x47b4fb
cmp dword [ebp + 8], 1
jne 0x48bd62
mov dword [ebp - 0xfc], 7
mov dword [ebp - 0x21bc], 0x684a08de
mov dword [ebp - 0x8f0], 0x332a5b4d
mov dword [ebp - 0x720], 0xffffffff
mov dword [ebp - 0xfc], 0
jmp 0x483ee6
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffffa
jle 0x4844bd
mov dword [ebp - 0xe0], 0xfffffff6
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x10b4], 1
mov dword [ebp - 0x2798], 0x46587a76
mov dword [ebp - 0x2794], 0x46587a76
mov dword [ebp - 0x2790], 0x46587a76
mov dword [ebp - 0x278c], 0x46587a76
mov dword [ebp - 0x21d4], 0x79c14114
mov dword [ebp - 0xe0], 0
jmp 0x483f59
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffea
je 0x48427f
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x7e4], 0
jmp 0x483f89
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 2
jge 0x483fa5
mov eax, dword [ebp - 0x7e4]
mov dword [ebp + eax*4 - 0x1e04], 0x87a7525d
jmp 0x483f7c
cmp dword [ebp - 0xe0], 0x2a14
jle 0x483fbd
mov dword [ebp - 0x1034], 1
jmp 0x483fc4
and dword [ebp - 0x1034], 0
cmp dword [ebp - 0x1034], 0xec79e672
je 0x483fdc
mov dword [ebp - 0x103c], 1
jmp 0x483fe3
and dword [ebp - 0x103c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfc]
cmp dword [ebp + eax - 0x1e04], ecx
jle 0x484004
mov dword [ebp - 0x24e8], 1
jmp 0x48400b
and dword [ebp - 0x24e8], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2ea8], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2b80], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x3014], eax
xor eax, eax
jne 0x484051
cmp dword [ebp - 0xe0], 0
jne 0x484051
and dword [ebp - 0x1044], 0
jmp 0x48405b
mov dword [ebp - 0x1044], 1
mov eax, dword [ebp - 0x103c]
cmp eax, dword [ebp - 0x1044]
jl 0x484075
mov dword [ebp - 0x104c], 1
jmp 0x48407c
and dword [ebp - 0x104c], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x104c], eax
jle 0x484096
mov dword [ebp - 0x1054], 1
jmp 0x48409d
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 1
jmp 0x4840b6
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x48427a
mov dword [ebp - 0x109c], 4
cmp dword [ebp - 0x21bc], 0xffffffff
jge 0x4840df
mov dword [ebp - 0x105c], 1
jmp 0x4840e6
and dword [ebp - 0x105c], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x105c]
cmp eax, 0x56cd219f
jle 0x484102
mov dword [ebp - 0x1064], 1
jmp 0x484109
and dword [ebp - 0x1064], 0
mov eax, dword [ebp - 0x1064]
add eax, 0xa603
je 0x484128
cmp dword [ebp - 0x48], 0
je 0x484128
mov dword [ebp - 0x106c], 1
jmp 0x48412f
and dword [ebp - 0x106c], 0
cmp dword [ebp - 0x106c], 0x34071e99
jl 0x48414d
cmp dword [ebp - 0xfc], 0
jne 0x48414d
and dword [ebp - 0x23b8], 0
jmp 0x484157
mov dword [ebp - 0x23b8], 1
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x1e04]
mov dword [ebp - 0x21c4], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x21c4]
mov dword [ebp + eax*4 - 0x1e04], ecx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2b88], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11c]
cmp dword [ebp + eax - 0x1e04], ecx
jge 0x4841a4
mov dword [ebp - 0x1074], 1
jmp 0x4841ab
and dword [ebp - 0x1074], 0
imul eax, dword [ebp - 0x1074], 0xffff
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x8f0]
add eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x11c]
jl 0x4841e1
cmp dword [ebp - 0x48], 0
je 0x4841e1
mov dword [ebp - 0x107c], 1
jmp 0x4841e8
and dword [ebp - 0x107c], 0
mov eax, dword [ebp - 0x107c]
sub eax, dword [ebp - 0x109c]
jne 0x484208
cmp dword [ebp - 0x11c], 0
jne 0x484208
and dword [ebp - 0x1084], 0
jmp 0x484212
mov dword [ebp - 0x1084], 1
mov eax, dword [ebp - 0x1084]
mov dword [ebp - 0x720], eax
imul eax, dword [ebp - 0x720], 0xfffffff8
cmp eax, dword [ebp - 0x11c]
jge 0x484239
mov dword [ebp - 0x108c], 1
jmp 0x484240
and dword [ebp - 0x108c], 0
cmp dword [ebp - 0x108c], 0xff51
jg 0x484258
mov dword [ebp - 0x1094], 1
jmp 0x48425f
and dword [ebp - 0x1094], 0
mov eax, dword [ebp - 0x1094]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x109c], 0xfffffff6
jmp 0x4840af
jmp 0x483f4c
mov dword [ebp - 0x48], 0xffffffe5
jmp 0x48428f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff5
jne 0x4844b8
mov dword [ebp - 0x10dc], 0xfffffff7
mov dword [ebp - 0x2480], 9
mov dword [ebp - 0x23c0], 0x7339
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x720], eax
je 0x4842d1
mov dword [ebp - 0x10e4], 1
jmp 0x4842d8
and dword [ebp - 0x10e4], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x3d47
jg 0x4842fc
mov dword [ebp - 0x10a4], 1
jmp 0x484303
and dword [ebp - 0x10a4], 0
mov eax, dword [ebp - 0x10a4]
neg eax
cmp eax, dword [ebp - 0xfc]
jg 0x48431f
mov dword [ebp - 0x10ac], 1
jmp 0x484326
and dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x10ac]
neg eax
mov dword [ebp - 0x10b4], eax
mov eax, dword [ebp - 0x10b4]
cmp dword [ebp - 0x720], eax
jge 0x48434e
mov dword [ebp - 0x10bc], 1
jmp 0x484355
and dword [ebp - 0x10bc], 0
cmp dword [ebp - 0x10bc], 0x12cb5dcf
je 0x48436d
mov dword [ebp - 0x10c4], 1
jmp 0x484374
and dword [ebp - 0x10c4], 0
mov eax, dword [ebp - 0x10dc]
cmp dword [ebp - 0x10c4], eax
jne 0x48438e
mov dword [ebp - 0x10cc], 1
jmp 0x484395
and dword [ebp - 0x10cc], 0
mov eax, dword [ebp - 0x2480]
cmp dword [ebp - 0x10cc], eax
jl 0x4843af
mov dword [ebp - 0x10d4], 1
jmp 0x4843b6
and dword [ebp - 0x10d4], 0
mov eax, dword [ebp - 0x10d4]
sub eax, 0xb686
je 0x4843d8
cmp dword [ebp - 0x10dc], 0
je 0x4843d8
mov dword [ebp - 0x10ec], 1
jmp 0x4843df
and dword [ebp - 0x10ec], 0
mov eax, dword [ebp - 0x10e4]
cmp eax, dword [ebp - 0x10ec]
jge 0x4843f9
mov dword [ebp - 0x10f4], 1
jmp 0x484400
and dword [ebp - 0x10f4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x10f4], eax
jne 0x484417
mov dword [ebp - 0x21cc], 1
jmp 0x48441e
and dword [ebp - 0x21cc], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x2eb0], eax
xor eax, eax
inc eax
je 0x484441
cmp dword [ebp - 0x48], 0
je 0x484441
mov dword [ebp - 0x8f8], 1
jmp 0x484448
and dword [ebp - 0x8f8], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x8f8]
mov dword [ebp + eax - 0x2798], ecx
mov eax, dword [ebp - 0x23c0]
cmp dword [ebp - 0x8f8], eax
jg 0x484475
mov dword [ebp - 0x10fc], 1
jmp 0x48447c
and dword [ebp - 0x10fc], 0
mov eax, dword [ebp - 0x10fc]
sub eax, 0xab9c
mov dword [ebp - 0x21d4], eax
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x4844b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x484288
jmp 0x483ed9
mov dword [ebp - 0x2b90], 0x1f9c28ad
mov byte [ebp - 0x2ce], 0
movzx eax, byte [ebp - 0x2ce]
test eax, eax
je 0x4844e9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov byte [ebp - 0x2fa], 0
movzx eax, byte [ebp - 0x2fa]
test eax, eax
je 0x48451b
push 0
push 0x1d5
push 0x15b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov dword [ebp - 0x2fa4], 1
mov dword [ebp - 0x2b98], 0xbd035c5
mov dword [ebp - 0x2eb8], 0x3053
mov dword [ebp - 0x2ba0], 0x3a151cd2
mov dword [ebp - 0x120], 0
jmp 0x48455c
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x484578
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x3084], 0xffffffff
jmp 0x48454f
mov dword [ebp - 0x120], 0
jmp 0x484591
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x4845ad
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x1104], 1
jmp 0x484584
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1104]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1104], eax
mov dword [ebp - 0x7f4], 0
mov dword [ebp - 0x414], 0x5baf43b
mov byte [ebp - 0x2d0], 0
movzx eax, byte [ebp - 0x2d0]
test eax, eax
je 0x48460e
push 0
push 0xe29
push 0x22d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
cmp dword [ebp - 0x414], 0
je 0x48464d
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x484631
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [ebp - 0x2d2], 0
movzx eax, byte [ebp - 0x2d2]
test eax, eax
je 0x48464b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x4846b8
mov dword [ebp - 0x83c], 0
jmp 0x484666
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 1
jge 0x484682
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x24b0], 0xa8e97eed
jmp 0x484659
mov dword [ebp - 0x414], 0
jmp 0x48469b
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jg 0x4846b8
mov eax, dword [ebp - 0x414]
cmp dword [ebp + eax*4 - 0x24b0], 0
je 0x4846b6
jmp 0x4846b8
jmp 0x48468e
mov dword [ebp - 0x1254], 0xfffffffa
mov dword [ebp - 0x900], 0x4f823aaf
mov dword [ebp - 0x1124], 0xffffffff
mov dword [ebp - 0x728], 4
mov dword [ebp - 0x23c8], 0x9cdf9c77
mov dword [ebp - 0x114c], 1
mov dword [ebp - 0x251c], 1
mov dword [ebp - 0x2518], 1
mov dword [ebp - 0x2514], 1
mov dword [ebp - 0x2510], 1
mov dword [ebp - 0x7ec], 1
mov dword [ebp - 0x128], 0
jmp 0x48473f
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x48475b
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x1d90], 0xffffffff
jmp 0x484732
mov dword [ebp - 0x128], 0
jmp 0x484774
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x484790
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x2748], 1
jmp 0x484767
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2748]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2748], eax
mov eax, dword [ebp - 0x7ec]
dec eax
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x7ec]
inc eax
inc eax
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x114c], eax
cmp dword [ebp - 0x1124], 0x3a4c6382
jne 0x4847ea
mov dword [ebp - 0x110c], 1
jmp 0x4847f1
and dword [ebp - 0x110c], 0
mov eax, dword [ebp - 0x110c]
neg eax
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x1d90]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1d90]
jne 0x484820
mov dword [ebp - 0x1114], 1
jmp 0x484827
and dword [ebp - 0x1114], 0
imul eax, dword [ebp - 0x1114], 0xffffffff
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1d90]
jge 0x484852
mov eax, 0xebef9f3b
test eax, eax
je 0x484852
mov dword [ebp - 0x21dc], 1
jmp 0x484859
and dword [ebp - 0x21dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d90]
mov dword [ebp - 0x2ba8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d90], 1
jge 0x484888
mov dword [ebp - 0x111c], 1
jmp 0x48488f
and dword [ebp - 0x111c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d90]
cmp eax, dword [ebp - 0x111c]
jge 0x4848b0
mov dword [ebp - 0x112c], 1
jmp 0x4848b7
and dword [ebp - 0x112c], 0
mov eax, dword [ebp - 0x1124]
imul eax, dword [ebp - 0x112c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x1d90]
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x251c], 6
jge 0x4848ec
mov dword [ebp - 0x1134], 1
jmp 0x4848f3
and dword [ebp - 0x1134], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x1134], eax
jl 0x48490d
mov dword [ebp - 0x113c], 1
jmp 0x484914
and dword [ebp - 0x113c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d90]
cmp dword [ebp - 0x113c], eax
jne 0x484935
mov dword [ebp - 0x1144], 1
jmp 0x48493c
and dword [ebp - 0x1144], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1144]
mov dword [ebp + eax - 0x251c], ecx
mov eax, 0x21b7
test eax, eax
je 0x484989
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x2c78], eax
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x114c]
sub eax, dword [ebp - 0x900]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x2748], eax
cmp dword [ebp - 0x7ec], 0xec6c
jne 0x4849a1
mov dword [ebp - 0x1154], 1
jmp 0x4849a8
and dword [ebp - 0x1154], 0
mov eax, dword [ebp - 0x23c8]
cmp dword [ebp - 0x1154], eax
jl 0x4849c2
mov dword [ebp - 0x115c], 1
jmp 0x4849c9
and dword [ebp - 0x115c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x115c]
mov dword [ebp + eax - 0x251c], ecx
mov byte [ebp - 0x2d4], 0
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x11cc], 0xfffffff9
mov dword [ebp - 0x11ac], 0
mov dword [ebp - 0x138], 0
jmp 0x484a1a
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xd
jl 0x484ecc
mov dword [ebp - 0xa8], 0xf9b2cfb6
mov byte [ebp - 0x2fc], 0
movzx eax, byte [ebp - 0x2fc]
test eax, eax
je 0x484a5a
push 0x2564
push 0x1a06
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [ebp - 0xa8], 3
jmp 0x484a73
cmp dword [ebp - 0xa8], 0xffffffe2
jg 0x484ec7
mov dword [ebp - 0x3dc], 0xd4826422
mov dword [ebp - 0x130], 0
jmp 0x484aa3
cmp dword [ebp - 0x130], 2
jge 0x484abf
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x8d4], 1
jmp 0x484a96
mov dword [ebp - 0x130], 0
jmp 0x484ad8
jmp 0x484a0d
movzx eax, byte [ebp - 0x2d4]
test eax, eax
je 0x484ee4
push 0x2121
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x87c], 0
jmp 0x484efd
mov eax, dword [ebp - 0x87c]
inc eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 1
jge 0x484f19
mov eax, dword [ebp - 0x87c]
mov dword [ebp + eax*4 - 0x234], 1
jmp 0x484ef0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x234], 3
jmp 0x484f47
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 0xfffffff1
jl 0x48529f
mov dword [ebp - 0x1da0], 0x25b0e446
mov dword [ebp - 0x1d9c], 0x25b0e446
mov dword [ebp - 0x1d98], 0x25b0e446
mov dword [ebp - 0x1d94], 0x25b0e446
mov dword [ebp - 0x8c], 0x6d4f2887
mov dword [ebp - 0x918], 0x9cdc345f
mov dword [ebp - 0x23d0], 0xf69a7501
mov dword [ebp - 0x8c], 3
jmp 0x484fba
mov byte [ebp - 0x2d6], 0
movzx eax, byte [ebp - 0x2d6]
test eax, eax
je 0x4852c0
mov dword [ebp - 0x26c], 0xf5a9
mov dword [ebp - 0x4e0], 0x3c891c55
mov dword [ebp - 0x678], 0x17f4039e
mov dword [ebp - 0xc44], 0x120dd93b
mov dword [ebp - 0xc3c], 1
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x274], 0xc5674fa7
mov dword [ebp - 0xa20], 0
mov dword [ebp - 0xa18], 0x7c242ea6
mov dword [ebp - 0x21b8], 0
mov dword [ebp - 0x21c0], 0xbecc425f
mov dword [ebp - 0x21c8], 0xcc5119b5
mov dword [ebp - 0x670], 0
jmp 0x48bdf3
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 2
jge 0x48be0f
mov eax, dword [ebp - 0x670]
mov dword [ebp + eax*4 - 0x1e0c], 0xad5befa1
jmp 0x48bde6
mov eax, 0xe6f7fbf2
test eax, eax
je 0x48be2d
cmp dword [ebp - 0x26c], 0
je 0x48be2d
mov dword [ebp - 0xc0c], 1
jmp 0x48be34
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0xc0c]
jge 0x48be5a
mov dword [ebp - 0x2190], 1
jmp 0x48be61
and dword [ebp - 0x2190], 0
cmp dword [ebp - 0x26c], 0
je 0x48bee5
cmp dword [ebp - 0x26c], 0xd14c
je 0x48be82
mov dword [ebp - 0xc14], 1
jmp 0x48be89
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0xc14], eax
jl 0x48bea3
mov dword [ebp - 0xc1c], 1
jmp 0x48beaa
and dword [ebp - 0xc1c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc1c]
mov dword [ebp + eax - 0x1e0c], ecx
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x2a64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0c]
mov dword [ebp - 0x2a6c], eax
cmp dword [ebp - 0x26c], 0
jne 0x48befe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e0c], 0
jne 0x48befe
and dword [ebp - 0xc24], 0
jmp 0x48bf08
mov dword [ebp - 0xc24], 1
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x678], eax
jl 0x48bf2e
mov dword [ebp - 0xc2c], 1
jmp 0x48bf35
and dword [ebp - 0xc2c], 0
cmp dword [ebp - 0xc2c], 0xfffffff7
jb 0x48bf4a
mov dword [ebp - 0xc34], 1
jmp 0x48bf51
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 0xffffffff
jae 0x48bf66
mov dword [ebp - 0x2198], 1
jmp 0x48bf6d
and dword [ebp - 0x2198], 0
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0x2a74], eax
mov dword [ebp - 0xc3c], 8
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0x2a7c], eax
cmp dword [ebp - 0x274], 0
jne 0x48bfbd
mov dword [ebp - 0xc74], 1
jmp 0x48bfc4
and dword [ebp - 0xc74], 0
cmp dword [ebp - 0x4e0], 0
je 0x48c014
cmp dword [ebp - 0x274], 0xf6f6
jg 0x48bfe5
mov dword [ebp - 0xc4c], 1
jmp 0x48bfec
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xc4c]
neg eax
imul eax, dword [ebp - 0x4e8]
test eax, eax
jne 0x48c008
cmp dword [ebp - 0xa20], 0
je 0x48c014
mov dword [ebp - 0x21a0], 1
jmp 0x48c01b
and dword [ebp - 0x21a0], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2a84], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x2a8c], eax
mov eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x274]
jg 0x48c053
mov dword [ebp - 0xc54], 1
jmp 0x48c05a
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xa20]
cmp dword [ebp - 0xc54], eax
jg 0x48c07d
cmp dword [ebp - 0x274], 0
je 0x48c07d
mov dword [ebp - 0xc5c], 1
jmp 0x48c084
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0x21a8], eax
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0x21b0], eax
mov eax, dword [ebp - 0xa18]
dec eax
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x21a8]
cmp eax, dword [ebp - 0x21b0]
jge 0x48c0c3
mov dword [ebp - 0xc64], 1
jmp 0x48c0ca
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0x21b8]
add eax, dword [ebp - 0xc64]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1e0c]
jge 0x48c0f1
mov dword [ebp - 0xc6c], 1
jmp 0x48c0f8
and dword [ebp - 0xc6c], 0
cmp dword [ebp - 0xc6c], 0xfffd
je 0x48c110
mov dword [ebp - 0xc7c], 1
jmp 0x48c117
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp - 0x678]
cmp eax, dword [ebp - 0xc7c]
jle 0x48c13d
mov dword [ebp - 0xc84], 1
jmp 0x48c144
and dword [ebp - 0xc84], 0
cmp dword [ebp - 0xc84], 0x1bf5
je 0x48c15c
mov dword [ebp - 0xc8c], 1
jmp 0x48c163
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0xa20]
cmp dword [ebp - 0xc8c], eax
jge 0x48c17d
mov dword [ebp - 0xc94], 1
jmp 0x48c184
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x21c0]
cmp dword [ebp - 0x4e8], eax
je 0x48c1b0
cmp dword [ebp - 0x274], 0
jne 0x48c1b0
and dword [ebp - 0xc9c], 0
jmp 0x48c1ba
mov dword [ebp - 0xc9c], 1
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0x21c8], eax
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.00474eb8
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret