Function at 0x473177
Capabilities:
Accept command line arguments
Compare security identifiers
Contain obfuscated stackstrings
Create pipe
Delete file
Delete registry key
Enumerate gui resources
Get common file path
Get graphical window text
Get thread local storage value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3eec
call fcn.004ae630
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x47c347
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x188], 3
mov dword [ebp - 0xcb8], 0x64b9
mov dword [ebp - 0xcc0], 0xffffffff
mov dword [ebp - 0x25e8], 0x2dc6606a
mov dword [ebp - 0x2a88], 0xe45104f3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x36c0], eax
cmp dword [ebp - 0x34], 0
jl 0x4731e4
mov dword [ebp - 0x2590], 1
jmp 0x4731eb
and dword [ebp - 0x2590], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2590]
je 0x473202
mov dword [ebp - 0x24b0], 1
jmp 0x473209
and dword [ebp - 0x24b0], 0
mov eax, dword [ebp - 0x24b0]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x188], eax
jne 0x47322c
mov dword [ebp - 0x24b8], 1
jmp 0x473233
and dword [ebp - 0x24b8], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x24b8]
jne 0x47324a
mov dword [ebp - 0x24c0], 1
jmp 0x473251
and dword [ebp - 0x24c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24c0], eax
jne 0x473268
mov dword [ebp - 0x24c8], 1
jmp 0x47326f
and dword [ebp - 0x24c8], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x24c8]
jle 0x473286
mov dword [ebp - 0x24d0], 1
jmp 0x47328d
and dword [ebp - 0x24d0], 0
cmp dword [ebp - 0x24d0], 0x5a9c4c8d
jl 0x4732a5
mov dword [ebp - 0x24d8], 1
jmp 0x4732ac
and dword [ebp - 0x24d8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24d8], eax
jl 0x4732c9
mov eax, 0xbefa1e1c
test eax, eax
jne 0x4732c9
and dword [ebp - 0x24e0], 0
jmp 0x4732d3
mov dword [ebp - 0x24e0], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24e0], eax
je 0x4732f0
cmp dword [ebp - 0x188], 0
jne 0x4732f0
and dword [ebp - 0x24e8], 0
jmp 0x4732fa
mov dword [ebp - 0x24e8], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24e8], eax
je 0x47354b
mov dword [ebp - 0x160], 1
mov dword [ebp - 0xb64], 0xfffffffa
mov dword [ebp - 0x258c], 5
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x3264], eax
cmp dword [ebp - 0x160], 0xfffd
jb 0x47334b
mov dword [ebp - 0x24f0], 1
jmp 0x473352
and dword [ebp - 0x24f0], 0
cmp dword [ebp - 0x24f0], 0xfffffffe
jle 0x473375
xor eax, eax
inc eax
je 0x473375
cmp dword [ebp - 0x160], 0
je 0x473375
mov dword [ebp - 0x24f8], 1
jmp 0x47337c
and dword [ebp - 0x24f8], 0
mov eax, dword [ebp - 0x160]
imul eax, dword [ebp - 0x24f8]
cmp eax, 0xdd25
jg 0x47339c
mov dword [ebp - 0x2500], 1
jmp 0x4733a3
and dword [ebp - 0x2500], 0
mov eax, dword [ebp - 0x160]
sub eax, dword [ebp - 0x2500]
cmp eax, 5
jne 0x4733c0
mov dword [ebp - 0x2508], 1
jmp 0x4733c7
and dword [ebp - 0x2508], 0
cmp dword [ebp - 0x2508], 1
jge 0x4733dc
mov dword [ebp - 0x2510], 1
jmp 0x4733e3
and dword [ebp - 0x2510], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x2510]
je 0x4733fd
mov dword [ebp - 0x2518], 1
jmp 0x473404
and dword [ebp - 0x2518], 0
mov eax, dword [ebp - 0x2518]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x160]
jle 0x473421
mov dword [ebp - 0x2520], 1
jmp 0x473428
and dword [ebp - 0x2520], 0
mov eax, dword [ebp - 0x2520]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jg 0x473449
mov dword [ebp - 0x2528], 1
jmp 0x473450
and dword [ebp - 0x2528], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x2528], eax
jle 0x47346a
mov dword [ebp - 0x2530], 1
jmp 0x473471
and dword [ebp - 0x2530], 0
cmp dword [ebp - 0x2530], 0xfeed
jne 0x473489
mov dword [ebp - 0x2538], 1
jmp 0x473490
and dword [ebp - 0x2538], 0
cmp dword [ebp - 0x2538], 0x4b1c2fbf
jg 0x4734a8
mov dword [ebp - 0x2540], 1
jmp 0x4734af
and dword [ebp - 0x2540], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x2540], eax
jl 0x4734c9
mov dword [ebp - 0x2548], 1
jmp 0x4734d0
and dword [ebp - 0x2548], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x2548], eax
jl 0x4734ea
mov dword [ebp - 0x2550], 1
jmp 0x4734f1
and dword [ebp - 0x2550], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x2550], eax
je 0x47350b
mov dword [ebp - 0x257c], 1
jmp 0x473512
and dword [ebp - 0x257c], 0
cmp dword [ebp - 0x257c], 0x6a9
jne 0x47352a
mov dword [ebp - 0x2584], 1
jmp 0x473531
and dword [ebp - 0x2584], 0
mov eax, dword [ebp - 0x2584]
mov dword [ebp - 0x258c], eax
mov eax, dword [ebp - 0x258c]
mov dword [ebp - 0x160], eax
jmp 0x4735b7
mov dword [ebp - 0x27ac], 0x2f725dc8
mov dword [ebp - 0xa4c], 0
jmp 0x47356e
mov eax, dword [ebp - 0xa4c]
inc eax
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 3
jge 0x47358a
mov eax, dword [ebp - 0xa4c]
mov dword [ebp + eax*4 - 0x2f64], 0x42ea6ae2
jmp 0x473561
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f64]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f64], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f64]
mov dword [ebp - 0x27ac], eax
cmp dword [ebp - 0x188], 1
jb 0x4735cc
mov dword [ebp - 0x2594], 1
jmp 0x4735d3
and dword [ebp - 0x2594], 0
imul eax, dword [ebp - 0x34], 0
cmp eax, dword [ebp - 0xcb8]
jl 0x4735eb
mov dword [ebp - 0x259c], 1
jmp 0x4735f2
and dword [ebp - 0x259c], 0
mov eax, dword [ebp - 0x2594]
add eax, dword [ebp - 0x259c]
cmp eax, dword [ebp - 0xcb8]
jg 0x473612
mov dword [ebp - 0x25a4], 1
jmp 0x473619
and dword [ebp - 0x25a4], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x25a4], eax
jle 0x473630
mov dword [ebp - 0x2a78], 1
jmp 0x473637
and dword [ebp - 0x2a78], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x326c], eax
mov eax, dword [ebp - 0x188]
sub eax, dword [ebp - 0x34]
jne 0x473657
mov dword [ebp - 0x25d8], 1
jmp 0x47365e
and dword [ebp - 0x25d8], 0
mov eax, dword [ebp - 0xcb8]
cmp dword [ebp - 0x25d8], eax
jl 0x473681
cmp dword [ebp - 0x188], 0
je 0x473681
mov dword [ebp - 0x25e0], 1
jmp 0x473688
and dword [ebp - 0x25e0], 0
mov eax, dword [ebp - 0x25e0]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xcc0], eax
cmp dword [ebp - 0xcc0], 0
jge 0x4736b5
mov dword [ebp - 0x2a80], 1
jmp 0x4736bc
and dword [ebp - 0x2a80], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3274], eax
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x25e8], eax
mov eax, dword [ebp - 0x25e8]
mov dword [ebp - 0x2a88], eax
mov dword [ebp - 0xa54], 1
mov dword [ebp - 0x327c], 0xd162c5d1
mov dword [ebp - 0x9c], 0
jmp 0x47370a
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x473726
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x3c34], 0xb9b5
jmp 0x4736fd
mov dword [ebp - 0x9c], 0
jmp 0x47373f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x47375b
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x3734], 0x72c34ccb
jmp 0x473732
mov dword [ebp - 0x9c], 0
jmp 0x473774
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x473790
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x3e60], 0x86cae8ef
jmp 0x473767
mov dword [ebp - 0xa54], 0
jmp 0x4737a9
mov eax, dword [ebp - 0xa54]
inc eax
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0xa54], 3
jg 0x473a3e
mov dword [ebp - 0x608], 0xf2000252
mov dword [ebp - 0x2608], 0xf0a0cd95
mov dword [ebp - 0x608], 3
jmp 0x4737e3
mov eax, dword [ebp - 0x608]
dec eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jl 0x473a39
mov dword [ebp - 0x204], 0
jmp 0x473809
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x473825
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x2784], 0x7a73d2d6
jmp 0x4737fc
mov dword [ebp - 0x204], 0
jmp 0x47383e
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x47385a
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x276c], 0xa7ecc244
jmp 0x473831
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2784], 0
jmp 0x473888
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2784]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2784], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2784], 3
jg 0x4738b9
mov byte [ebp - 0x45e], 0
movzx eax, byte [ebp - 0x45e]
test eax, eax
je 0x4738b7
push 0x14f1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x47386d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x276c], 0
jmp 0x4738e7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x276c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x276c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x276c], 2
jg 0x473a34
mov dword [ebp - 0x3284], 0xfffffffb
mov dword [ebp - 0x2a90], 0xc266d8ff
mov dword [ebp - 0x328c], 0xd764ce34
mov dword [ebp - 0x3294], 0x4a797449
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x276c]
cmp dword [ebp + eax*4 - 0x2784], 0x885ea6ed
jne 0x473949
mov dword [ebp - 0x25f0], 1
jmp 0x473950
and dword [ebp - 0x25f0], 0
xor eax, eax
inc eax
je 0x473970
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x276c], 0
je 0x473970
mov dword [ebp - 0x25f8], 1
jmp 0x473977
and dword [ebp - 0x25f8], 0
mov eax, dword [ebp - 0x25f0]
cmp eax, dword [ebp - 0x25f8]
jl 0x473991
mov dword [ebp - 0x2600], 1
jmp 0x473998
and dword [ebp - 0x2600], 0
mov eax, dword [ebp - 0x608]
mov eax, dword [ebp + eax*4 - 0x3c34]
cmp eax, dword [ebp - 0x2600]
jle 0x4739f8
mov byte [ebp - 0x44d], 0
movzx eax, byte [ebp - 0x44d]
test eax, eax
je 0x4739db
push 0x15b6
push 0xb34
push 0x11e9
push 0x1def
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3734]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3734], eax
jmp 0x473a2f
mov dword [ebp - 0x2a98], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2784]
mov dword [ebp - 0x2608], eax
mov eax, dword [ebp - 0x2608]
mov dword [ebp - 0x2a90], eax
cmp dword [ebp - 0x2a98], 0
je 0x473a2f
jmp 0x4738cc
jmp 0x4738cc
jmp 0x4737d6
jmp 0x47379c
mov dword [ebp - 0xaf0], 0xf99ff606
mov dword [ebp - 0xaec], 0xf99ff606
mov dword [ebp - 0xae8], 0xf99ff606
mov dword [ebp - 0xae4], 0xf99ff606
mov dword [ebp - 0xa64], 1
mov dword [ebp - 0x329c], 0xfffffff8
mov dword [ebp - 0x32a4], 1
mov dword [ebp - 0x32ac], 0x3fda37b1
mov dword [ebp - 0x2610], 0x13222c7e
mov dword [ebp - 0x2618], 2
mov dword [ebp - 0xa5c], 0
jmp 0x473abb
mov eax, dword [ebp - 0xa5c]
inc eax
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 2
jge 0x473ad7
mov eax, dword [ebp - 0xa5c]
mov dword [ebp + eax*4 - 0x3c24], 0xb6eab3cf
jmp 0x473aae
mov dword [ebp - 0xa64], 0
jmp 0x473af0
mov eax, dword [ebp - 0xa64]
inc eax
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0xa64], 0x14
jle 0x473ca1
mov dword [ebp - 0xa74], 3
mov dword [ebp - 0x32b4], 0xfffffff6
mov dword [ebp - 0x32bc], 0
mov dword [ebp - 0x32c4], 1
mov dword [ebp - 0x32cc], 0x7d393e75
mov dword [ebp - 0x32d4], 0xfffffffd
mov dword [ebp - 0x32dc], 0x5ec35211
mov dword [ebp - 0xa6c], 0
jmp 0x473b5c
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0xa6c], 3
jge 0x473b78
mov eax, dword [ebp - 0xa6c]
mov dword [ebp + eax*4 - 0x3e44], 0x9a7b445a
jmp 0x473b4f
mov dword [ebp - 0xa74], 0xffffffe3
jmp 0x473b91
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa74], 9
jle 0x473c9c
mov dword [ebp - 0x600], 1
mov dword [ebp - 0x32e4], 0x6b87d0fa
mov dword [ebp - 0x32ec], 5
mov dword [ebp - 0x32f4], 0xfffffffd
mov dword [ebp - 0x32fc], 0x76eea530
mov dword [ebp - 0x210], 0
jmp 0x473be9
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x473c05
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x3ab4], 1
jmp 0x473bdc
mov dword [ebp - 0x210], 0
jmp 0x473c1e
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x473c3a
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x3304], 0xfffffffe
jmp 0x473c11
mov dword [ebp - 0x600], 2
jmp 0x473c53
mov eax, dword [ebp - 0x600]
dec eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0
jl 0x473c8a
mov byte [ebp - 0x3e1], 0
movzx eax, byte [ebp - 0x3e1]
test eax, eax
je 0x473c76
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x600]
cmp dword [ebp + eax*4 - 0x3ab4], 0
je 0x473c88
jmp 0x473c8a
jmp 0x473c46
mov eax, dword [ebp - 0x2610]
inc eax
mov dword [ebp - 0x2610], eax
jmp 0x473b84
jmp 0x473ae3
mov eax, dword [ebp - 0x2618]
dec eax
mov dword [ebp - 0x2618], eax
mov dword [ebp - 0x90], 0xcd795364
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1a0], 3
mov dword [ebp - 0xcd0], 0x64b9
mov dword [ebp - 0xcd8], 0xffffffff
mov dword [ebp - 0xec0], 0x2dc6606a
mov dword [ebp - 0x2ab8], 0xe45104f3
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x330c], eax
cmp dword [ebp - 0x28], 0
jl 0x473d0c
mov dword [ebp - 0x2620], 1
jmp 0x473d13
and dword [ebp - 0x2620], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2620]
je 0x473d2a
mov dword [ebp - 0x2628], 1
jmp 0x473d31
and dword [ebp - 0x2628], 0
mov eax, dword [ebp - 0x2628]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1a0], eax
jne 0x473d54
mov dword [ebp - 0x2630], 1
jmp 0x473d5b
and dword [ebp - 0x2630], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2630]
jne 0x473d72
mov dword [ebp - 0x2638], 1
jmp 0x473d79
and dword [ebp - 0x2638], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2638], eax
jne 0x473d90
mov dword [ebp - 0xe58], 1
jmp 0x473d97
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xe58]
jle 0x473dae
mov dword [ebp - 0x2028], 1
jmp 0x473db5
and dword [ebp - 0x2028], 0
cmp dword [ebp - 0x2028], 0x5a9c4c8d
jl 0x473dcd
mov dword [ebp - 0xe60], 1
jmp 0x473dd4
and dword [ebp - 0xe60], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xe60], eax
jl 0x473df1
mov eax, 0xbefa1e1c
test eax, eax
jne 0x473df1
and dword [ebp - 0x2030], 0
jmp 0x473dfb
mov dword [ebp - 0x2030], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2030], eax
je 0x473e18
cmp dword [ebp - 0x1a0], 0
jne 0x473e18
and dword [ebp - 0xe68], 0
jmp 0x473e22
mov dword [ebp - 0xe68], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xe68], eax
je 0x474073
mov dword [ebp - 0x140], 1
mov dword [ebp - 0xcc8], 0xfffffffa
mov dword [ebp - 0xea8], 5
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x3314], eax
cmp dword [ebp - 0x140], 0xfffd
jb 0x473e73
mov dword [ebp - 0x2038], 1
jmp 0x473e7a
and dword [ebp - 0x2038], 0
cmp dword [ebp - 0x2038], 0xfffffffe
jle 0x473e9d
xor eax, eax
inc eax
je 0x473e9d
cmp dword [ebp - 0x140], 0
je 0x473e9d
mov dword [ebp - 0xe70], 1
jmp 0x473ea4
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0xe70]
cmp eax, 0xdd25
jg 0x473ec4
mov dword [ebp - 0x2040], 1
jmp 0x473ecb
and dword [ebp - 0x2040], 0
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x2040]
cmp eax, 5
jne 0x473ee8
mov dword [ebp - 0xe78], 1
jmp 0x473eef
and dword [ebp - 0xe78], 0
cmp dword [ebp - 0xe78], 1
jge 0x473f04
mov dword [ebp - 0x2048], 1
jmp 0x473f0b
and dword [ebp - 0x2048], 0
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x2048]
je 0x473f25
mov dword [ebp - 0xe80], 1
jmp 0x473f2c
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0xe80]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x140]
jle 0x473f49
mov dword [ebp - 0x2050], 1
jmp 0x473f50
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0x2050]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jg 0x473f71
mov dword [ebp - 0xe88], 1
jmp 0x473f78
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0xcc8]
cmp dword [ebp - 0xe88], eax
jle 0x473f92
mov dword [ebp - 0x2058], 1
jmp 0x473f99
and dword [ebp - 0x2058], 0
cmp dword [ebp - 0x2058], 0xfeed
jne 0x473fb1
mov dword [ebp - 0xe90], 1
jmp 0x473fb8
and dword [ebp - 0xe90], 0
cmp dword [ebp - 0xe90], 0x4b1c2fbf
jg 0x473fd0
mov dword [ebp - 0x2060], 1
jmp 0x473fd7
and dword [ebp - 0x2060], 0
mov eax, dword [ebp - 0xcc8]
cmp dword [ebp - 0x2060], eax
jl 0x473ff1
mov dword [ebp - 0xe98], 1
jmp 0x473ff8
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0xcc8]
cmp dword [ebp - 0xe98], eax
jl 0x474012
mov dword [ebp - 0x2068], 1
jmp 0x474019
and dword [ebp - 0x2068], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x2068], eax
je 0x474033
mov dword [ebp - 0xea0], 1
jmp 0x47403a
and dword [ebp - 0xea0], 0
cmp dword [ebp - 0xea0], 0x6a9
jne 0x474052
mov dword [ebp - 0x2070], 1
jmp 0x474059
and dword [ebp - 0x2070], 0
mov eax, dword [ebp - 0x2070]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0xea8]
mov dword [ebp - 0x140], eax
jmp 0x4740df
mov dword [ebp - 0x2aa0], 0x2f725dc8
mov dword [ebp - 0xa7c], 0
jmp 0x474096
mov eax, dword [ebp - 0xa7c]
inc eax
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 3
jge 0x4740b2
mov eax, dword [ebp - 0xa7c]
mov dword [ebp + eax*4 - 0x2f34], 0x42ea6ae2
jmp 0x474089
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f34]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f34], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f34]
mov dword [ebp - 0x2aa0], eax
cmp dword [ebp - 0x1a0], 1
jb 0x4740f4
mov dword [ebp - 0x2078], 1
jmp 0x4740fb
and dword [ebp - 0x2078], 0
imul eax, dword [ebp - 0x28], 0
cmp eax, dword [ebp - 0xcd0]
jl 0x474113
mov dword [ebp - 0xeb0], 1
jmp 0x47411a
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x2078]
add eax, dword [ebp - 0xeb0]
cmp eax, dword [ebp - 0xcd0]
jg 0x47413a
mov dword [ebp - 0x2080], 1
jmp 0x474141
and dword [ebp - 0x2080], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2080], eax
jle 0x474158
mov dword [ebp - 0x2aa8], 1
jmp 0x47415f
and dword [ebp - 0x2aa8], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x331c], eax
mov eax, dword [ebp - 0x1a0]
sub eax, dword [ebp - 0x28]
jne 0x47417f
mov dword [ebp - 0xeb8], 1
jmp 0x474186
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0xcd0]
cmp dword [ebp - 0xeb8], eax
jl 0x4741a9
cmp dword [ebp - 0x1a0], 0
je 0x4741a9
mov dword [ebp - 0x2088], 1
jmp 0x4741b0
and dword [ebp - 0x2088], 0
mov eax, dword [ebp - 0x2088]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xcd8], eax
cmp dword [ebp - 0xcd8], 0
jge 0x4741dd
mov dword [ebp - 0x2ab0], 1
jmp 0x4741e4
and dword [ebp - 0x2ab0], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3324], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0xec0], eax
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0x2ab8], eax
mov dword [ebp - 0xd40], 0x6e311378
mov dword [ebp - 0xaa0], 0xe8588d0d
mov dword [ebp - 0xa98], 0x47bb7ab6
mov dword [ebp - 0xce0], 0xfffffffb
mov dword [ebp - 0x2ad8], 1
mov dword [ebp - 0xef0], 0xffffffff
mov dword [ebp - 0xa90], 0x2e2cc7bc
mov dword [ebp - 0x20b0], 0x11e8
mov dword [ebp - 0xa88], 0
jmp 0x47426e
mov eax, dword [ebp - 0xa88]
inc eax
mov dword [ebp - 0xa88], eax
cmp dword [ebp - 0xa88], 2
jge 0x47428a
mov eax, dword [ebp - 0xa88]
mov dword [ebp + eax*4 - 0x33e8], 0xe3e7631
jmp 0x474261
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x2ac0], eax
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x2ac8], eax
mov eax, dword [ebp - 0xa90]
dec eax
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xce0]
dec eax
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x2ac0]
cmp eax, dword [ebp - 0x2ac8]
je 0x4742d6
mov dword [ebp - 0xec8], 1
jmp 0x4742dd
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0xa98]
cmp dword [ebp - 0xa98], eax
jg 0x4742f7
mov dword [ebp - 0x2090], 1
jmp 0x4742fe
and dword [ebp - 0x2090], 0
mov eax, dword [ebp - 0xef0]
imul eax, dword [ebp - 0x2090]
cmp dword [ebp - 0xec8], eax
jge 0x47431f
mov dword [ebp - 0x2098], 1
jmp 0x474326
and dword [ebp - 0x2098], 0
mov eax, dword [ebp - 0xa98]
cmp dword [ebp - 0x2098], eax
je 0x474346
cmp dword [ebp - 0xa90], 0
jne 0x474346
and dword [ebp - 0xed0], 0
jmp 0x474350
mov dword [ebp - 0xed0], 1
mov eax, dword [ebp - 0xaa0]
cmp eax, dword [ebp - 0xed0]
jg 0x47436a
mov dword [ebp - 0x20a0], 1
jmp 0x474371
and dword [ebp - 0x20a0], 0
mov eax, dword [ebp - 0x20a0]
sub eax, dword [ebp - 0xa98]
cmp eax, dword [ebp - 0xaa0]
jne 0x474391
mov dword [ebp - 0x2ad0], 1
jmp 0x474398
and dword [ebp - 0x2ad0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x33e8]
mov dword [ebp - 0x332c], eax
cmp dword [ebp - 0xaa0], 0x4041
jl 0x4743c3
mov dword [ebp - 0xed8], 1
jmp 0x4743ca
and dword [ebp - 0xed8], 0
cmp dword [ebp - 0xed8], 1
je 0x4743df
mov dword [ebp - 0x20a8], 1
jmp 0x4743e6
and dword [ebp - 0x20a8], 0
mov eax, dword [ebp - 0x2ad8]
cmp dword [ebp - 0x20a8], eax
jl 0x474400
mov dword [ebp - 0xee0], 1
jmp 0x474407
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0xee0]
mov dword [ebp - 0x20b0], eax
mov eax, dword [ebp - 0x20b0]
imul eax, dword [ebp - 0xaa0]
test eax, eax
jne 0x474436
mov eax, 0xffff
test eax, eax
jne 0x474436
and dword [ebp - 0xee8], 0
jmp 0x474440
mov dword [ebp - 0xee8], 1
cmp dword [ebp - 0xee8], 0x5e13
jg 0x474458
mov dword [ebp - 0x20b8], 1
jmp 0x47445f
and dword [ebp - 0x20b8], 0
mov eax, dword [ebp - 0x20b8]
mov dword [ebp - 0xef0], eax
mov dword [ebp - 0x114], 0xd43d
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0x268], 0
jmp 0x474498
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x4744b4
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x2668], 0
jmp 0x47448b
mov dword [ebp - 0x268], 0
jmp 0x4744cd
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x4744e9
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x3d84], 0xfffffff7
jmp 0x4744c0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2668], 0
jmp 0x474517
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2668]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2668], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2668], 0x1a
je 0x4746df
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 0
je 0x474693
mov dword [ebp - 0x468], 9
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x468], 0
jmp 0x474572
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 8
jle 0x474691
mov byte [ebp - 0x44f], 0
movzx eax, byte [ebp - 0x44f]
test eax, eax
je 0x47459b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x8d0], 0xfffffff7
jmp 0x4745b4
mov eax, dword [ebp - 0x8d0]
dec eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 0xffffffe9
jge 0x47468c
mov dword [ebp - 0x568], 0x12
jmp 0x4745da
mov eax, dword [ebp - 0x568]
dec eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0xc
je 0x474687
mov dword [ebp - 0x670], 0
jmp 0x474600
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 2
jge 0x47461c
mov eax, dword [ebp - 0x670]
mov dword [ebp + eax*4 - 0x2670], 0xffffffff
jmp 0x4745f3
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2670], 0xffffffe6
jmp 0x47464a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2670]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2670], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2670], 0xfffffffd
jg 0x474682
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x474680
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x47462f
jmp 0x4745cd
jmp 0x4745a7
jmp 0x474565
jmp 0x4746b2
mov byte [ebp - 0x451], 0
movzx eax, byte [ebp - 0x451]
test eax, eax
je 0x4746b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebp - 0x3f1], 0
movzx eax, byte [ebp - 0x3f1]
test eax, eax
je 0x4746da
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x4744fc
mov dword [ebp - 0xce8], 0x703c5764
mov dword [ebp - 0x64], 0
jmp 0x4746f9
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x47470f
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x658], 0xd59e57ad
jmp 0x4746f2
mov dword [ebp - 0x64], 0
jmp 0x47471f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x474735
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3c44], 1
jmp 0x474718
mov dword [ebp - 0x64], 0
jmp 0x474745
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x47475b
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3744], 0x2a5bc422
jmp 0x47473e
mov eax, 0xb143e95a
test eax, eax
je 0x474845
mov eax, 0xc5bb9e18
test eax, eax
je 0x47478d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x658], 0
je 0x47478d
mov dword [ebp - 0x20c0], 1
jmp 0x474794
and dword [ebp - 0x20c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0x20c0], eax
jle 0x4747b5
mov dword [ebp - 0x8d8], 1
jmp 0x4747bc
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x8d8]
mov dword [ebp + eax - 0x3c44], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8d8]
mov dword [ebp + eax - 0x3744], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0x8d8], eax
jne 0x474803
mov dword [ebp - 0xef8], 1
jmp 0x47480a
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xef8]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x3334], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
mov dword [ebp - 0x333c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x658], 0
jne 0x47485e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3744], 0
jne 0x47485e
and dword [ebp - 0x20c8], 0
jmp 0x474868
mov dword [ebp - 0x20c8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0x20c8], eax
jne 0x474889
mov dword [ebp - 0xf00], 1
jmp 0x474890
and dword [ebp - 0xf00], 0
cmp dword [ebp - 0xf00], 0xfffffff8
jl 0x4748a5
mov dword [ebp - 0x20d0], 1
jmp 0x4748ac
and dword [ebp - 0x20d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp dword [ebp - 0x20d0], eax
jle 0x4748cd
mov dword [ebp - 0xf08], 1
jmp 0x4748d4
and dword [ebp - 0xf08], 0
cmp dword [ebp - 0xf08], 0x3888
je 0x4748ec
mov dword [ebp - 0x20d8], 1
jmp 0x4748f3
and dword [ebp - 0x20d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
cmp eax, dword [ebp - 0x20d8]
je 0x474914
mov dword [ebp - 0xf10], 1
jmp 0x47491b
and dword [ebp - 0xf10], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf10]
mov dword [ebp + eax - 0x658], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x658], 0xffff0001
jle 0x47494d
mov dword [ebp - 0x20e0], 1
jmp 0x474954
and dword [ebp - 0x20e0], 0
mov eax, dword [ebp - 0x20e0]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0x90], 3
jmp 0x474979
cmp dword [ebp - 0x90], 0
jl 0x4799bd
mov dword [ebp - 0x18], 0xede0
mov dword [ebp - 0xd00], 0xfffffffe
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x678], 0
jmp 0x4749ba
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 3
jge 0x4749d6
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0x3b50], 3
jmp 0x4749ad
cmp dword [ebp - 0x18], 0
je 0x4749ee
cmp dword [ebp - 0x18], 0
je 0x4749ee
mov dword [ebp - 0xf28], 1
jmp 0x4749f5
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3344], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x474a12
mov dword [ebp - 0xf18], 1
jmp 0x474a19
and dword [ebp - 0xf18], 0
cmp dword [ebp - 0xf18], 0x20e3
jl 0x474a31
mov dword [ebp - 0x20e8], 1
jmp 0x474a38
and dword [ebp - 0x20e8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20e8], eax
jl 0x474a58
cmp dword [ebp - 0xd00], 0
je 0x474a58
mov dword [ebp - 0xf20], 1
jmp 0x474a5f
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0xf20]
neg eax
sub eax, 0x3bd6525
cmp eax, dword [ebp - 0x18]
jne 0x474a7d
mov dword [ebp - 0x20f0], 1
jmp 0x474a84
and dword [ebp - 0x20f0], 0
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, dword [ebp - 0x20f0]
je 0x474a9d
mov dword [ebp - 0x20f8], 1
jmp 0x474aa4
and dword [ebp - 0x20f8], 0
mov eax, dword [ebp - 0xf28]
add eax, dword [ebp - 0x20f8]
je 0x474ae8
mov dword [ebp - 0x2ae0], 0x5befa1e1
mov dword [ebp - 0x2ae0], 1
mov byte [ebp - 0x453], 0
movzx eax, byte [ebp - 0x453]
test eax, eax
je 0x474ae3
push 0x1b42
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x474e8a
mov dword [ebp - 0xcf0], 1
mov dword [ebp - 0x1a8], 0
jmp 0x474b0b
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x474b27
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x2ce8], 0x1253
jmp 0x474afe
mov dword [ebp - 0x1a8], 0
jmp 0x474b40
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x474b5c
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x2ec0], 1
jmp 0x474b33
mov dword [ebp - 0x18], 0
jmp 0x474b6c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x474e69
mov dword [ebp - 0x8e0], 0x268f57f5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2ce8]
mov dword [ebp - 0x334c], eax
mov eax, dword [ebp - 0xcf0]
inc eax
mov dword [ebp - 0xcf0], eax
je 0x474bbb
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x2ce8], 0xba10f40b
jb 0x474bbb
mov dword [ebp - 0xf30], 1
jmp 0x474bc2
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2ce8]
cmp dword [ebp - 0xf30], eax
jge 0x474be0
mov dword [ebp - 0x2100], 1
jmp 0x474be7
and dword [ebp - 0x2100], 0
mov eax, 0x620a3418
sub eax, dword [ebp - 0x2100]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx - 0xfff6]
cmp eax, 0x7eed
jne 0x474c0f
mov dword [ebp - 0xf38], 1
jmp 0x474c16
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0x5c4]
cmp dword [ebp - 0xf38], eax
jge 0x474c30
mov dword [ebp - 0x2ae8], 1
jmp 0x474c37
and dword [ebp - 0x2ae8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec0]
mov dword [ebp - 0x3354], eax
mov eax, 0x7f0a
add eax, 0xffff
cmp eax, 0x46b4
jl 0x474c67
mov dword [ebp - 0x2108], 1
jmp 0x474c6e
and dword [ebp - 0x2108], 0
mov eax, dword [ebp - 0x2108]
sub eax, dword [ebp - 0x8e0]
je 0x474c97
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2ec0], 0
je 0x474c97
mov dword [ebp - 0xf40], 1
jmp 0x474c9e
and dword [ebp - 0xf40], 0
cmp dword [ebp - 0xf40], 0x5461
jge 0x474cb6
mov dword [ebp - 0x2110], 1
jmp 0x474cbd
and dword [ebp - 0x2110], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ec0]
cmp dword [ebp - 0x2110], eax
jge 0x474cde
mov dword [ebp - 0xcf8], 1
jmp 0x474ce5
and dword [ebp - 0xcf8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcf8]
mov dword [ebp + eax - 0x2ec0], ecx
cmp dword [ebp - 0xcf8], 0
jne 0x474d0d
mov dword [ebp - 0xf48], 1
jmp 0x474d14
and dword [ebp - 0xf48], 0
mov eax, dword [ebp - 0x8e0]
cmp dword [ebp - 0xf48], eax
jne 0x474d2e
mov dword [ebp - 0x2118], 1
jmp 0x474d35
and dword [ebp - 0x2118], 0
imul eax, dword [ebp - 0x2118], 0x18ce
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x2ce8]
mov dword [ebp - 0xf50], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xf50]
mov dword [ebp + eax - 0x3b50], ecx
cmp dword [ebp - 0xf50], 0
jne 0x474d7f
mov eax, 0xfff7
test eax, eax
jne 0x474d7f
and dword [ebp - 0x2120], 0
jmp 0x474d89
mov dword [ebp - 0x2120], 1
mov eax, dword [ebp - 0x2120]
mov dword [ebp - 0xd00], eax
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0x335c], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x3364], eax
mov eax, 0xb551
cmp eax, 0x28c4
jg 0x474dc5
mov dword [ebp - 0xf58], 1
jmp 0x474dcc
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xf58], eax
jg 0x474de3
mov dword [ebp - 0x2128], 1
jmp 0x474dea
and dword [ebp - 0x2128], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2128]
sub ecx, dword [ebp + eax*4 - 0x2ce8]
je 0x474e11
mov eax, 0x988e
test eax, eax
je 0x474e11
mov dword [ebp - 0xf60], 1
jmp 0x474e18
and dword [ebp - 0xf60], 0
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x8e0], eax
mov dword [ebp - 0x5c4], 0
jmp 0x474e3d
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0x2b
je 0x474e64
mov byte [ebp - 0x3f9], 0
movzx eax, byte [ebp - 0x3f9]
test eax, eax
je 0x474e62
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x474e30
jmp 0x474b65
mov byte [ebp - 0x455], 0
movzx eax, byte [ebp - 0x455]
test eax, eax
je 0x474e8a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov byte [ebp - 0x401], 0
movzx eax, byte [ebp - 0x401]
test eax, eax
je 0x474eb5
push 0x12f2
push 0x23b8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
mov dword [ebp - 0xb90], 1
mov dword [ebp - 0x2140], 1
mov dword [ebp - 0xf70], 0xf5f49900
mov dword [ebp - 0x8e8], 0xcc2fdcba
mov dword [ebp - 0xd08], 0xfffffffd
mov dword [ebp - 0x2b6c], 1
mov dword [ebp - 0x2b74], 6
mov dword [ebp - 0x680], 0
jmp 0x474f14
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 3
jge 0x474f30
mov eax, dword [ebp - 0x680]
mov dword [ebp + eax*4 - 0x2cf8], 0x7c9d5fac
jmp 0x474f07
cmp dword [ebp - 0x2140], 0
jne 0x474f4b
mov eax, 0xc405
test eax, eax
jne 0x474f4b
and dword [ebp - 0x2af0], 0
jmp 0x474f55
mov dword [ebp - 0x2af0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2cf8]
sub eax, 0x1ce3
cmp eax, 5
ja 0x474f78
mov dword [ebp - 0x2130], 1
jmp 0x474f7f
and dword [ebp - 0x2130], 0
mov eax, dword [ebp - 0x8e8]
cmp dword [ebp - 0x2130], eax
je 0x474f99
mov dword [ebp - 0xf68], 1
jmp 0x474fa0
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0xf68]
mov dword [ebp - 0x8e8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2cf8]
cmp dword [ebp - 0x8e8], eax
jg 0x474fcc
mov dword [ebp - 0x2138], 1
jmp 0x474fd3
and dword [ebp - 0x2138], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cf8]
cmp eax, dword [ebp - 0x2138]
jne 0x474ff4
mov dword [ebp - 0x2b5c], 1
jmp 0x474ffb
and dword [ebp - 0x2b5c], 0
mov eax, dword [ebp - 0xd08]
mov dword [ebp - 0x336c], eax
mov eax, dword [ebp - 0xf70]
mov dword [ebp - 0x3374], eax
mov eax, dword [ebp - 0xd08]
inc eax
mov dword [ebp - 0xd08], eax
mov eax, dword [ebp - 0xf70]
cmp dword [ebp - 0x8e8], eax
jg 0x47503a
mov dword [ebp - 0xf78], 1
jmp 0x475041
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0x2140]
cmp eax, dword [ebp - 0xf78]
jle 0x47505b
mov dword [ebp - 0x2b64], 1
jmp 0x475062
and dword [ebp - 0x2b64], 0
mov eax, dword [ebp - 0x2b6c]
mov dword [ebp - 0x337c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2cf8]
cmp dword [ebp + eax - 0x2cf8], ecx
jle 0x475096
mov dword [ebp - 0x2148], 1
jmp 0x47509d
and dword [ebp - 0x2148], 0
mov eax, dword [ebp - 0x2148]
mov dword [ebp - 0x2b74], eax
mov byte [ebp - 0x457], 0
movzx eax, byte [ebp - 0x457]
test eax, eax
je 0x4750ca
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov dword [ebp - 0x2184], 7
mov dword [ebp - 0x4dc], 1
mov dword [ebp - 0xf80], 0xedc0223d
mov dword [ebp - 0x688], 0
jmp 0x475101
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 2
jge 0x47511d
mov eax, dword [ebp - 0x688]
mov dword [ebp + eax*4 - 0xdc8], 0xd76270e7
jmp 0x4750f4
mov dword [ebp - 0x4dc], 0
jmp 0x475136
cmp dword [ebp - 0x4dc], 0xfffffff2
je 0x4753eb
mov dword [ebp - 0x474], 0x917ab6da
mov dword [ebp - 0xd10], 0xfffffffc
mov dword [ebp - 0x2b84], 0xfffffff9
mov dword [ebp - 0x8f0], 0
jmp 0x47517a
mov eax, dword [ebp - 0x8f0]
inc eax
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 3
jge 0x475196
mov eax, dword [ebp - 0x8f0]
mov dword [ebp + eax*4 - 0x273c], 0xffffffff
jmp 0x47516d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc8]
mov dword [ebp - 0xf80], eax
cmp dword [ebp - 0xf80], 0
jne 0x4751c4
cmp dword [ebp - 0x474], 0
jne 0x4751c4
and dword [ebp - 0x2150], 0
jmp 0x4751ce
mov dword [ebp - 0x2150], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc8]
imul eax, dword [ebp - 0x2150]
cmp eax, 0x626a
jg 0x4751f5
mov dword [ebp - 0xf88], 1
jmp 0x4751fc
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0xf88], eax
je 0x475216
mov dword [ebp - 0x2158], 1
jmp 0x47521d
and dword [ebp - 0x2158], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x3384], eax
mov eax, dword [ebp - 0x2158]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0x338c], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x3394], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x273c]
cmp dword [ebp - 0xd10], eax
jl 0x47526e
mov dword [ebp - 0xf90], 1
jmp 0x475275
and dword [ebp - 0xf90], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc8]
cmp dword [ebp - 0xf90], eax
jle 0x475296
mov dword [ebp - 0x2160], 1
jmp 0x47529d
and dword [ebp - 0x2160], 0
mov eax, dword [ebp - 0x2160]
mov dword [ebp - 0x474], eax
imul eax, dword [ebp - 0x474], 0x230b
test eax, eax
jge 0x4752c3
mov dword [ebp - 0x2b7c], 1
jmp 0x4752ca
and dword [ebp - 0x2b7c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x273c]
mov dword [ebp - 0x339c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdc8], 0x520f
je 0x4752fc
mov dword [ebp - 0xf98], 1
jmp 0x475303
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0x4dc]
cmp eax, dword [ebp - 0xf98]
jge 0x475333
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc8], 0
jne 0x475333
mov dword [ebp - 0x2168], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc8]
cmp dword [ebp - 0x2168], eax
jle 0x47535e
mov dword [ebp - 0x1cec], 0x5e148cb4
mov dword [ebp - 0x338], 2
mov dword [ebp - 0x690], 0
jmp 0x475418
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 1
jge 0x475434
mov eax, dword [ebp - 0x690]
mov dword [ebp + eax*4 - 0x2c4], 3
jmp 0x47540b
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x33a4], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x33ac], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c4], 0xfffffffa
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x475471
mov eax, dword [ebp - 0x338]
add eax, 0xf7cd
jne 0x47548a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
jne 0x47548a
and dword [ebp - 0x2178], 0
jmp 0x475494
mov dword [ebp - 0x2178], 1
mov eax, dword [ebp - 0x338]
imul eax, dword [ebp - 0x2178]
mov ecx, 0xffff
sub ecx, eax
je 0x4754c6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
je 0x4754c6
mov dword [ebp - 0xfb0], 1
jmp 0x4754cd
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0xfb0], eax
jle 0x4754e7
mov dword [ebp - 0x2180], 1
jmp 0x4754ee
and dword [ebp - 0x2180], 0
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x2180]
add eax, dword [ebp - 0x338]
cmp eax, 0xffff
jae 0x475513
mov dword [ebp - 0xfb8], 1
jmp 0x47551a
and dword [ebp - 0xfb8], 0
cmp dword [ebp - 0xfb8], 0xa5f3
jne 0x475687
mov dword [ebp - 0xd20], 0xd73d
mov dword [ebp - 0xd18], 0
mov dword [ebp - 0xfc8], 0xfffffffa
mov dword [ebp - 0x2b94], 0x52fb29d9
xor eax, eax
sub eax, dword [ebp - 0xd20]
je 0x475578
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
je 0x475578
mov dword [ebp - 0x2188], 1
jmp 0x47557f
and dword [ebp - 0x2188], 0
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xd18], eax
cmp dword [ebp - 0xd18], 0x3d0e72ee
jne 0x4755a3
mov dword [ebp - 0xfc0], 1
jmp 0x4755aa
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x2188]
imul eax, dword [ebp - 0xfc0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2c4]
jne 0x4755d2
mov byte [ebp - 0x409], 0
movzx eax, byte [ebp - 0x409]
test eax, eax
je 0x4756b6
push 0
push 0x104d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov dword [ebp - 0x11c], 2
mov dword [ebp - 0x6a0], 0xfffffff8
mov dword [ebp - 0x8f8], 0
jmp 0x4756e3
cmp dword [ebp - 0x8f8], 2
jge 0x4756ff
push 1
lea eax, [ebp - 0x3d9c]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.004729da
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3b2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3b2c]
lea edi, [ebp - 0x2ecc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb00], 0xffffffff
mov dword [ebp - 0xafc], 0xffffffff
mov dword [ebp - 0xaf8], 0xffffffff
mov dword [ebp - 0xaf4], 0xffffffff
mov dword [ebp - 0x48], 0x29000d4e
mov dword [ebp - 0xc8], 9
mov dword [ebp - 0x48], 0
jmp 0x479a35
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x479ce0
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xb00], 0
jne 0x479a6e
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp + ecx*4 - 0xb00]
cmp dword [ebp + eax - 0xb00], ecx
jne 0x479a6e
and dword [ebp - 0x1cf4], 0
jmp 0x479a78
mov dword [ebp - 0x1cf4], 1
cmp dword [ebp - 0x1cf4], 0x27359b50
jg 0x479a90
mov dword [ebp - 0x27bc], 1
jmp 0x479a97
and dword [ebp - 0x27bc], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb00]
mov dword [ebp - 0x39cc], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xb00], ecx
jg 0x479ac2
mov dword [ebp - 0x1344], 1
jmp 0x479ac9
and dword [ebp - 0x1344], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb00]
cmp dword [ebp - 0x1344], eax
je 0x479ae7
mov dword [ebp - 0x218c], 1
jmp 0x479aee
and dword [ebp - 0x218c], 0
mov eax, dword [ebp - 0x218c]
sub eax, 0x4cbe8151
xor ecx, ecx
inc ecx
sub ecx, eax
cmp ecx, 0xa2ca335c
je 0x479b12
mov dword [ebp - 0x2b54], 1
jmp 0x479b19
and dword [ebp - 0x2b54], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb00]
mov dword [ebp - 0x39d4], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0xb00], ecx
jge 0x479b4a
mov dword [ebp - 0x134c], 1
jmp 0x479b51
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x134c]
sub eax, 6
cmp eax, 0x21aa2910
je 0x479b6d
mov dword [ebp - 0x27c4], 1
jmp 0x479b74
and dword [ebp - 0x27c4], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb00], 0
je 0x479bd1
mov dword [ebp - 0xc8], 0
jmp 0x479b9d
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x479bcc
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0xb00], 0
je 0x479bb8
jmp 0x479bcc
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0xb00], 0
je 0x479bca
jmp 0x479b90
jmp 0x479b90
jmp 0x479cdb
mov dword [ebp - 0x1354], 0xfffffffb
mov dword [ebp - 0xc8], 0
jmp 0x479bf4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x479cdb
mov dword [ebp - 0x2b1c], 1
mov eax, dword [ebp - 0x2b1c]
mov dword [ebp - 0x39dc], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x1354]
cmp dword [ebp + eax*4 - 0xb00], ecx
jne 0x479c35
mov dword [ebp - 0x1cfc], 1
jmp 0x479c3c
and dword [ebp - 0x1cfc], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb00]
imul eax, dword [ebp - 0x1cfc]
cmp eax, dword [ebp - 0x1354]
jl 0x479c61
mov dword [ebp - 0x24fc], 1
jmp 0x479c68
and dword [ebp - 0x24fc], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x24fc], eax
jle 0x479c7f
mov dword [ebp - 0x135c], 1
jmp 0x479c86
and dword [ebp - 0x135c], 0
cmp dword [ebp - 0x135c], 0xfc5c
jle 0x479c9e
mov dword [ebp - 0x1d04], 1
jmp 0x479ca5
and dword [ebp - 0x1d04], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x1d04], eax
je 0x479cbf
mov dword [ebp - 0x1364], 1
jmp 0x479cc6
and dword [ebp - 0x1364], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x1364]
mov dword [ebp + eax*4 - 0xb00], ecx
jmp 0x479be7
jmp 0x479a2e
cmp dword [ebp - 0x2ecc], 0
je 0x479cfd
push 0
push dword [ebp - 0x2ec4]
push dword [ebp - 0x2ec8]
call dword [ebp - 0x2ecc]
mov dword [ebp - 0x27cc], 0x20e83c77
mov dword [ebp - 0x9c4], 0
jmp 0x479d20
mov eax, dword [ebp - 0x9c4]
inc eax
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0x9c4], 1
jge 0x479d3c
mov eax, dword [ebp - 0x9c4]
mov dword [ebp + eax*4 - 0x2b00], 0xfffffff9
jmp 0x479d13
mov byte [ebp - 0x319], 0
movzx eax, byte [ebp - 0x319]
test eax, eax
je 0x479d61
push 0
push 0
push 0x156b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x27cc]
mov dword [ebp + eax - 0x2b00], ecx
call fcn.00492f2b
mov dword [ebp - 0x584], 0xfffffffd
mov dword [ebp - 0x730], 0
jmp 0x479d9c
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 3
jge 0x479db8
mov eax, dword [ebp - 0x730]
mov dword [ebp + eax*4 - 0x3b44], 0x20624039
jmp 0x479d8f
mov byte [ebp - 0x31b], 0
movzx eax, byte [ebp - 0x31b]
test eax, eax
je 0x479ddb
push 0x163c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x584], 0
jmp 0x479df4
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 2
jg 0x479e59
mov dword [ebp - 0x9cc], 0xff55e00f
mov dword [ebp - 0x9cc], 2
jmp 0x479e20
mov eax, dword [ebp - 0x9cc]
dec eax
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 0
jl 0x479e57
mov byte [ebp - 0x31d], 0
movzx eax, byte [ebp - 0x31d]
test eax, eax
je 0x479e43
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov eax, dword [ebp - 0x584]
cmp dword [ebp + eax*4 - 0x3b44], 0
je 0x479e55
jmp 0x479e57
jmp 0x479e13
jmp 0x479de7
mov dword [ebp - 0xb18], 0xffffffff
mov dword [ebp - 0xb14], 0xffffffff
mov dword [ebp - 0xb10], 0xffffffff
mov dword [ebp - 0xb0c], 0xffffffff
mov dword [ebp - 0x4a4], 1
mov dword [ebp - 0x23dc], 0xe637c5b1
mov dword [ebp - 0x2194], 0x8a922a19
mov dword [ebp - 0x4a4], 0
jmp 0x479eb8
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 7
jl 0x47a13f
mov dword [ebp - 0x2a4], 0x85c6f1bf
mov dword [ebp - 0xcb4], 6
mov dword [ebp - 0x2a4], 0
jmp 0x479ef2
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xffffffe6
jle 0x47a13a
mov dword [ebp - 0x358], 7
mov dword [ebp - 0x1d0c], 0xfffffffa
mov dword [ebp - 0x738], 0
jmp 0x479f2c
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 1
jge 0x479f48
mov eax, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0x740], 0x8d13034d
jmp 0x479f1f
mov byte [ebp - 0x31f], 0
movzx eax, byte [ebp - 0x31f]
test eax, eax
je 0x479f70
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
mov dword [ebp - 0x358], 0
jmp 0x479f89
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jg 0x47a135
mov dword [ebp - 0x9d4], 0
jmp 0x479faf
mov eax, dword [ebp - 0x9d4]
inc eax
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 3
jge 0x479fcb
mov eax, dword [ebp - 0x9d4]
mov dword [ebp + eax*4 - 0x3b5c], 0x25d3c095
jmp 0x479fa2
xor eax, eax
sub eax, dword [ebp - 0x2a4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x740]
mov dword [ebp - 0xcb4], eax
cmp dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp + eax*4 - 0x740]
mov dword [ebp - 0x2194], eax
cmp dword [ebp - 0x2194], 0x75cf8b87
je 0x47a019
mov dword [ebp - 0x27d4], 1
jmp 0x47a020
and dword [ebp - 0x27d4], 0
mov eax, dword [ebp - 0x23dc]
mov dword [ebp - 0x39e4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x39ec], eax
imul eax, dword [ebp - 0x2a4], 3
test eax, eax
jne 0x47a05c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x740], 0
jne 0x47a05c
and dword [ebp - 0x136c], 0
jmp 0x47a066
mov dword [ebp - 0x136c], 1
mov eax, dword [ebp - 0x136c]
mov dword [ebp - 0x1d0c], eax
mov eax, dword [ebp - 0x1d0c]
cmp dword [ebp - 0x358], eax
jg 0x47a08c
mov dword [ebp - 0x1374], 1
jmp 0x47a093
and dword [ebp - 0x1374], 0
imul eax, dword [ebp - 0x1374], 0x5193
sub eax, dword [ebp - 0x23dc]
cmp dword [ebp - 0x2a4], eax
je 0x47a0bd
cmp dword [ebp - 0x4a4], 0
jne 0x47a0bd
and dword [ebp - 0x137c], 0
jmp 0x47a0c7
mov dword [ebp - 0x137c], 1
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x137c], eax
je 0x47a0e1
mov dword [ebp - 0x1d14], 1
jmp 0x47a0e8
and dword [ebp - 0x1d14], 0
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp + eax*4 - 0x740]
cmp eax, dword [ebp - 0x1d14]
jne 0x47a109
mov dword [ebp - 0x1384], 1
jmp 0x47a110
and dword [ebp - 0x1384], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1384]
mov dword [ebp + eax - 0x3b5c], ecx
cmp dword [ebp - 0xcb4], 0
je 0x47a130
jmp 0x479f7c
jmp 0x479f7c
jmp 0x479ee5
jmp 0x479eab
mov dword [ebp - 0x50], 0x29000d4e
mov dword [ebp - 0x9dc], 0
mov dword [ebp - 0x9dc], 0xfffffff3
jmp 0x47a169
mov eax, dword [ebp - 0x9dc]
inc eax
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 0
jne 0x47a219
mov dword [ebp - 0x748], 0
jmp 0x47a18f
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 1
jge 0x47a1ab
mov eax, dword [ebp - 0x748]
mov dword [ebp + eax*4 - 0x9e4], 0x97eede0b
jmp 0x47a182
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9e4], 0xffffffef
jmp 0x47a1d9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9e4], 0xffffffee
jl 0x47a214
mov byte [ebp - 0x321], 0
movzx eax, byte [ebp - 0x321]
test eax, eax
je 0x47a212
push 0xd13
push 0
push 0x115c
push 0x11aa
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x47a1be
jmp 0x47a15c
mov dword [ebp - 0xec], 9
mov dword [ebp - 0x1d24], 1
mov dword [ebp - 0x139c], 0xfffffff8
mov dword [ebp - 0x39f4], 0xd72276b8
mov dword [ebp - 0x2b08], 0
mov dword [ebp - 0x27e4], 0xc9a57b5b
mov dword [ebp - 0x39fc], 0x47c4d14
mov dword [ebp - 0x3a04], 0xa6f44401
mov dword [ebp - 0x3a0c], 0x49b76eea
mov dword [ebp - 0x1d1c], 0xece3051e
mov dword [ebp - 0x27dc], 0xfffffffa
mov dword [ebp - 0x3a14], 0xffffffff
mov dword [ebp - 0x3a1c], 0
mov dword [ebp - 0x3a24], 0xfffffff8
mov dword [ebp - 0x388c], 1
mov dword [ebp - 0xb98], 0xffffffff
mov dword [ebp - 0x2c7c], 0xe633
mov dword [ebp - 0x750], 0
jmp 0x47a2dc
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 1
jge 0x47a2f8
mov eax, dword [ebp - 0x750]
mov dword [ebp + eax*4 - 0x3018], 0x5acee617
jmp 0x47a2cf
mov eax, dword [ebp - 0xb98]
dec eax
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0xb98]
cmp dword [ebp - 0x1d24], eax
jge 0x47a31f
mov dword [ebp - 0x13a4], 1
jmp 0x47a326
and dword [ebp - 0x13a4], 0
mov eax, 0x1522
sub eax, dword [ebp - 0x1d1c]
je 0x47a33c
mov eax, 0x698d
test eax, eax
jne 0x47a34e
cmp dword [ebp - 0x2c7c], 0
jne 0x47a34e
and dword [ebp - 0x219c], 0
jmp 0x47a358
mov dword [ebp - 0x219c], 1
cmp dword [ebp - 0x219c], 0x9a27
je 0x47a370
mov dword [ebp - 0x138c], 1
jmp 0x47a377
and dword [ebp - 0x138c], 0
mov eax, dword [ebp - 0x138c]
sub eax, dword [ebp - 0x27dc]
cmp eax, dword [ebp - 0x1d1c]
jge 0x47a397
mov dword [ebp - 0x1394], 1
jmp 0x47a39e
and dword [ebp - 0x1394], 0
cmp dword [ebp - 0x1394], 8
jbe 0x47a3b3
mov dword [ebp - 0x2634], 1
jmp 0x47a3ba
and dword [ebp - 0x2634], 0
mov eax, dword [ebp - 0x2634]
mov dword [ebp - 0x139c], eax
cmp dword [ebp - 0x139c], 0xffffffff
jne 0x47a3e4
cmp dword [ebp - 0x2b08], 0
je 0x47a3e4
mov dword [ebp - 0x21a4], 1
jmp 0x47a3eb
and dword [ebp - 0x21a4], 0
mov eax, dword [ebp - 0x1d24]
imul eax, dword [ebp - 0x13a4]
cmp eax, dword [ebp - 0x21a4]
jl 0x47a40c
mov dword [ebp - 0x13ac], 1
jmp 0x47a413
and dword [ebp - 0x13ac], 0
mov eax, dword [ebp - 0x13ac]
inc eax
cmp eax, 0x5088
jle 0x47a42d
mov dword [ebp - 0x1d2c], 1
jmp 0x47a434
and dword [ebp - 0x1d2c], 0
mov eax, dword [ebp - 0x1d2c]
mov dword [ebp - 0x27e4], eax
mov byte [ebp - 0x323], 0
movzx eax, byte [ebp - 0x323]
test eax, eax
je 0x47a472
push 0
push 0x11ed
push 0x1c12
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x50], 0
jmp 0x47a482
cmp dword [ebp - 0x50], 3
jg 0x47c0b1
mov dword [ebp - 0x168], 0xfffffffe
mov dword [ebp - 0x2df0], 0x243a5d8d
mov dword [ebp - 0x9ec], 0
jmp 0x47a4b9
mov eax, dword [ebp - 0x9ec]
inc eax
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x9ec], 4
jge 0x47a4d5
mov eax, dword [ebp - 0x9ec]
mov dword [ebp + eax*4 - 0x3a4c], 0x2f38d927
jmp 0x47a4ac
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x35c8], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x3020], eax
xor eax, eax
sub eax, dword [ebp - 0x168]
jne 0x47a503
mov dword [ebp - 0x13b4], 1
jmp 0x47a50a
and dword [ebp - 0x13b4], 0
mov eax, dword [ebp - 0x168]
imul eax, dword [ebp - 0x13b4]
cmp eax, 0xe2bf
je 0x47a52a
mov dword [ebp - 0x23e4], 1
jmp 0x47a531
and dword [ebp - 0x23e4], 0
cmp dword [ebp - 0x23e4], 0xb590
je 0x47a549
mov dword [ebp - 0x13bc], 1
jmp 0x47a550
and dword [ebp - 0x13bc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3a4c]
imul eax, dword [ebp - 0x13bc]
test eax, eax
je 0x47a832
mov dword [ebp - 0x534], 0xdc6d0f06
mov dword [ebp - 0x27ec], 0
mov dword [ebp - 0x2b10], 7
mov dword [ebp - 0x168], 0
jmp 0x47a5a3
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jle 0x47a830
mov dword [ebp - 0x2c84], 3
mov dword [ebp - 0x758], 0
jmp 0x47a5d3
mov eax, dword [ebp - 0x758]
inc eax
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 3
jge 0x47a5ef
mov eax, dword [ebp - 0x758]
mov dword [ebp + eax*4 - 0xdfc], 7
jmp 0x47a5c6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdfc], 3
jmp 0x47a61d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdfc], 0
jl 0x47a82b
mov dword [ebp - 0x618], 8
xor eax, eax
inc eax
je 0x47a812
cmp dword [ebp - 0x534], 0
jne 0x47a788
and dword [ebp - 0x1d44], 0
imul eax, dword [ebp - 0x1d44], 5
mov dword [ebp - 0x2c84], eax
jmp 0x47a602
jmp 0x47a596
jmp 0x47a869
mov byte [ebp - 0x325], 0
movzx eax, byte [ebp - 0x325]
test eax, eax
je 0x47a869
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x9b
push 0x23b1
push 0x1f1d
push 0x206e
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov byte [ebp - 0x327], 0
movzx eax, byte [ebp - 0x327]
test eax, eax
je 0x47a897
push 0x1cf8
push 0x189d
push 0x147c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov dword [ebp - 0xc0], 0x83c7730f
mov dword [ebp - 0xd3c], 0x14055248
mov dword [ebp - 0x2e4], 0xfffffffa
mov dword [ebp - 0x760], 0xffffffff
mov dword [ebp - 0x2b18], 0xfffffff8
mov dword [ebp - 0x2804], 1
mov dword [ebp - 0x9f4], 0
jmp 0x47a8ec
mov eax, dword [ebp - 0x9f4]
inc eax
mov dword [ebp - 0x9f4], eax
cmp dword [ebp - 0x9f4], 1
jge 0x47a908
mov eax, dword [ebp - 0x9f4]
mov dword [ebp + eax*4 - 0xba0], 0xfffffffd
jmp 0x47a8df
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
je 0x47a922
mov dword [ebp - 0x1d4c], 1
jmp 0x47a929
and dword [ebp - 0x1d4c], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
jle 0x47a943
mov dword [ebp - 0x13e4], 1
jmp 0x47a94a
and dword [ebp - 0x13e4], 0
mov eax, dword [ebp - 0x13e4]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0xd3c]
imul eax, dword [ebp - 0xc0]
add eax, 0x6aac
je 0x47a97f
cmp dword [ebp - 0xd3c], 0
je 0x47a97f
and dword [ebp - 0x27fc], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x3894], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
jl 0x47a9ac
mov dword [ebp - 0x1c], 0x3f4f46db
mov dword [ebp - 0xd50], 0xcb5af9f7
mov dword [ebp - 0xa34], 0
jmp 0x47c0db
mov eax, dword [ebp - 0xa34]
inc eax
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 3
jge 0x47c0f7
mov eax, dword [ebp - 0xa34]
mov dword [ebp + eax*4 - 0xdb4], 0xfffffffb
jmp 0x47c0ce
mov dword [ebp - 0x1c], 2
jmp 0x47c107
cmp dword [ebp - 0x1c], 0
jl 0x47c321
mov dword [ebp - 0xa3c], 4
mov dword [ebp - 0x7a0], 0
jmp 0x47c134
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 3
jge 0x47c150
mov eax, dword [ebp - 0x7a0]
mov dword [ebp + eax*4 - 0x3b8c], 0xfffffff9
jmp 0x47c127
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xdb4], 0
jne 0x47c1b0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30b0], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xdb4]
mov dword [ebp - 0x38c0], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xdb4]
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jbe 0x47c1b0
mov eax, 0xb395
test eax, eax
jne 0x47c1b0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xdb4], 0
jne 0x47c1b0
and dword [ebp - 0x21f4], 0
jmp 0x47c1ba
mov dword [ebp - 0x21f4], 1
cmp dword [ebp - 0x21f4], 0x2aee5a98
je 0x47c1d2
mov dword [ebp - 0x14ec], 1
jmp 0x47c1d9
and dword [ebp - 0x14ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdb4]
cmp dword [ebp - 0x14ec], eax
jg 0x47c204
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xdb4], 0
jne 0x47c204
and dword [ebp - 0xbb8], 0
jmp 0x47c20e
mov dword [ebp - 0xbb8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb8]
mov dword [ebp + eax - 0x3b8c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xdb4]
cmp dword [ebp - 0xbb8], eax
jne 0x47c23f
mov dword [ebp - 0x1dcc], 1
jmp 0x47c246
and dword [ebp - 0x1dcc], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xdb4]
cmp dword [ebp - 0x1dcc], eax
jne 0x47c264
mov dword [ebp - 0x14f4], 1
jmp 0x47c26b
and dword [ebp - 0x14f4], 0
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x14f4], 0xfffffff7
cmp dword [ebp + eax*4 - 0xdb4], ecx
jl 0x47c28a
mov dword [ebp - 0x240c], 1
jmp 0x47c291
and dword [ebp - 0x240c], 0
mov eax, dword [ebp - 0xa3c]
cmp dword [ebp - 0x240c], eax
jg 0x47c2ab
mov dword [ebp - 0x14fc], 1
jmp 0x47c2b2
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0xa3c]
cmp dword [ebp - 0x14fc], eax
jl 0x47c2cc
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdb4]
mov dword [ebp - 0xd50], eax
jmp 0x48f607
cmp dword [ebp + 8], 1
jne 0x482251
mov dword [ebp - 0xa44], 1
mov dword [ebp - 0xa44], 0
jmp 0x47c374
mov eax, dword [ebp - 0xa44]
dec eax
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 0xfffffff1
jg 0x47c40c
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x59c], 0
jmp 0x47c3ae
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0x1d
jne 0x47c407
mov byte [ebp - 0x461], 0
movzx eax, byte [ebp - 0x461]
test eax, eax
je 0x47c3db
push 0x2198
push 0x989
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov byte [ebp - 0x302], 0
movzx eax, byte [ebp - 0x302]
test eax, eax
je 0x47c405
push 0x130
push 0
push 0
push 0
push 0x8ab
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x47c3a1
jmp 0x47c367
mov dword [ebp - 0x178], 0x4800fa72
mov dword [ebp - 0x1514], 2
mov dword [ebp - 0x1de4], 0xcc25
mov dword [ebp - 0x153c], 0
mov dword [ebp - 0x2864], 0x13cef339
mov dword [ebp - 0x230], 0
jmp 0x47c457
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x47c473
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x3ba4], 0xef068cd5
jmp 0x47c44a
mov dword [ebp - 0x230], 0
jmp 0x47c48c
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x47c4a8
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x3dcc], 0x9e56
jmp 0x47c47f
mov byte [ebp - 0x446], 0
movzx eax, byte [ebp - 0x446]
test eax, eax
je 0x47c4d0
push 0
push 0x1159
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x30b8], eax
cmp dword [ebp - 0x178], 0x6874be76
jge 0x47c4fd
cmp dword [ebp - 0x178], 0
je 0x47c4fd
mov dword [ebp - 0x150c], 1
jmp 0x47c504
and dword [ebp - 0x150c], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x150c], eax
jge 0x47c51e
mov dword [ebp - 0x1ddc], 1
jmp 0x47c525
and dword [ebp - 0x1ddc], 0
cmp dword [ebp - 0x1ddc], 1
jbe 0x47c53a
mov dword [ebp - 0x25a8], 1
jmp 0x47c541
and dword [ebp - 0x25a8], 0
mov dword [ebp - 0x1514], 1
mov eax, dword [ebp - 0x1514]
cmp eax, dword [ebp - 0x25a8]
je 0x47c565
mov dword [ebp - 0x151c], 1
jmp 0x47c56c
and dword [ebp - 0x151c], 0
mov eax, dword [ebp - 0x151c]
mov dword [ebp - 0x1de4], eax
mov eax, dword [ebp - 0x1de4]
imul eax, dword [ebp - 0x178]
mov dword [ebp - 0x1524], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1524]
mov dword [ebp + eax - 0x3ba4], ecx
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x1524], eax
jl 0x47c5b7
mov dword [ebp - 0x2204], 1
jmp 0x47c5be
and dword [ebp - 0x2204], 0
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x2204]
cmp eax, 0x3876
je 0x47c5de
mov dword [ebp - 0x152c], 1
jmp 0x47c5e5
and dword [ebp - 0x152c], 0
cmp dword [ebp - 0x152c], 0xffffffff
je 0x47c5fa
mov dword [ebp - 0x1dec], 1
jmp 0x47c601
and dword [ebp - 0x1dec], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x1dec], eax
je 0x47c61b
mov dword [ebp - 0x1534], 1
jmp 0x47c622
and dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x1534], eax
jle 0x47c63c
mov dword [ebp - 0x2414], 1
jmp 0x47c643
and dword [ebp - 0x2414], 0
mov eax, dword [ebp - 0x2414]
mov dword [ebp - 0x153c], eax
cmp dword [ebp - 0x153c], 4
ja 0x47c664
mov dword [ebp - 0x1df4], 1
jmp 0x47c66b
and dword [ebp - 0x1df4], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x1df4], eax
jge 0x47c685
mov dword [ebp - 0x1544], 1
jmp 0x47c68c
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x1544]
sub eax, 0x6a08376f
mov dword [ebp - 0x2864], eax
mov dword [ebp - 0x156c], 0xd0d658ed
mov dword [ebp - 0x155c], 0x95dbc2a4
mov dword [ebp - 0x1574], 0xfffa
mov dword [ebp - 0x7ac], 0
jmp 0x47c6d4
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 3
jge 0x47c6f0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp + eax*4 - 0xad0], 0xb110c93b
jmp 0x47c6c7
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xad0], 0xc
jmp 0x47c71b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xad0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad0], 0xffffffe4
je 0x47c9f1
mov dword [ebp - 0xbc0], 0xffff
mov dword [ebp - 0x974], 0
jmp 0x47c751
mov eax, dword [ebp - 0x974]
inc eax
mov dword [ebp - 0x974], eax
cmp dword [ebp - 0x974], 3
jge 0x47c76d
mov eax, dword [ebp - 0x974]
mov dword [ebp + eax*4 - 0x2760], 0
jmp 0x47c744
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xad0]
mov dword [ebp - 0x3618], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xad0], 0
jne 0x47c7a2
mov eax, 0x3488
test eax, eax
jne 0x47c7a2
and dword [ebp - 0x220c], 0
jmp 0x47c7ac
mov dword [ebp - 0x220c], 1
cmp dword [ebp - 0x220c], 0x90
jg 0x47c7c4
mov dword [ebp - 0x154c], 1
jmp 0x47c7cb
and dword [ebp - 0x154c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2760]
cmp eax, dword [ebp - 0x154c]
jge 0x47c7eb
mov dword [ebp - 0x1dfc], 1
jmp 0x47c7f2
and dword [ebp - 0x1dfc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2760]
add eax, dword [ebp - 0x1dfc]
cmp eax, 0xffffffff
jb 0x47c815
mov dword [ebp - 0x1554], 1
jmp 0x47c81c
and dword [ebp - 0x1554], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2760]
cmp dword [ebp - 0x1554], eax
je 0x47c83c
mov dword [ebp - 0x251c], 1
jmp 0x47c843
and dword [ebp - 0x251c], 0
mov eax, dword [ebp - 0x251c]
mov dword [ebp - 0x155c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad0]
cmp dword [ebp - 0x155c], eax
jle 0x47c87b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2760], 0
jne 0x47c87b
and dword [ebp - 0x1e04], 0
jmp 0x47c885
mov dword [ebp - 0x1e04], 1
mov eax, dword [ebp - 0x1e04]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x2760]
jl 0x47c8a7
mov dword [ebp - 0x1564], 1
jmp 0x47c8ae
and dword [ebp - 0x1564], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad0]
cmp eax, dword [ebp - 0x1564]
jl 0x47c8da
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad0], 0
jne 0x47c8da
and dword [ebp - 0x2214], 0
jmp 0x47c8e4
mov dword [ebp - 0x2214], 1
mov eax, dword [ebp - 0x2214]
sub eax, 0x4153c104
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xad0]
je 0x47c909
mov dword [ebp - 0x2e20], 1
jmp 0x47c910
and dword [ebp - 0x2e20], 0
mov dword [ebp - 0x156c], 0xc40e
mov eax, dword [ebp - 0x156c]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x30c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad0]
cmp dword [ebp - 0xbc0], eax
je 0x47c953
mov dword [ebp - 0x1e0c], 1
jmp 0x47c95a
and dword [ebp - 0x1e0c], 0
imul eax, dword [ebp - 0x1e0c], 0xfffffff9
imul eax, eax, 0x3c3
mov dword [ebp - 0x1574], eax
cmp dword [ebp - 0x1574], 0xff84
jl 0x47c985
mov dword [ebp - 0x241c], 1
jmp 0x47c98c
and dword [ebp - 0x241c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad0]
cmp dword [ebp - 0x241c], eax
jg 0x47c9ac
mov dword [ebp - 0x157c], 1
jmp 0x47c9b3
and dword [ebp - 0x157c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad0]
cmp dword [ebp - 0x157c], eax
jl 0x47c9d3
mov dword [ebp - 0x1e14], 1
jmp 0x47c9da
and dword [ebp - 0x1e14], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1e14]
mov dword [ebp + eax - 0x2760], ecx
jmp 0x47c702
mov dword [ebp - 0x524], 0x47df
mov dword [ebp - 0x3988], 0x92443250
mov dword [ebp - 0x30c8], 1
mov dword [ebp - 0x3620], 0xffffffff
mov dword [ebp - 0x30d0], 0xfffffffd
mov dword [ebp - 0x38c8], 0xfffffffb
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x524], 0
jmp 0x47ca53
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 5
je 0x47cb01
mov dword [ebp - 0x30d8], 0xfffffff7
mov dword [ebp - 0x3a60], 0xf27d
mov dword [ebp - 0x3a5c], 0xf27d
mov dword [ebp - 0x3a58], 0xf27d
mov dword [ebp - 0x3a54], 0xf27d
mov dword [ebp - 0x3628], 0xffffffff
mov dword [ebp - 0x30e0], 1
mov dword [ebp - 0x3a64], 0x1637c1d6
mov dword [ebp - 0x1584], 0xb0a3531f
mov dword [ebp - 0x7b4], 0
jmp 0x47cad3
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 3
jge 0x47caef
mov eax, dword [ebp - 0x7b4]
mov dword [ebp + eax*4 - 0x3d78], 0x90ed
jmp 0x47cac6
mov eax, dword [ebp - 0x1584]
dec eax
mov dword [ebp - 0x1584], eax
jmp 0x47ca46
mov dword [ebp - 0x5b4], 0xfffffffd
mov dword [ebp - 0x2d4], 6
mov dword [ebp - 0x159c], 0xd7540573
mov dword [ebp - 0x5e4], 0x8900
mov dword [ebp - 0x2d4], 0
jmp 0x47cb42
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xfffffff2
jge 0x47cc57
mov dword [ebp - 0x286c], 0xfffffff7
mov dword [ebp - 0x94c], 0
jmp 0x47cb72
mov eax, dword [ebp - 0x94c]
inc eax
mov dword [ebp - 0x94c], eax
cmp dword [ebp - 0x94c], 3
jge 0x47cb8e
mov eax, dword [ebp - 0x94c]
mov dword [ebp + eax*4 - 0x3bbc], 1
jmp 0x47cb65
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x286c], eax
jge 0x47cba8
mov dword [ebp - 0x221c], 1
jmp 0x47cbaf
and dword [ebp - 0x221c], 0
mov eax, dword [ebp - 0x2d4]
add eax, dword [ebp - 0x221c]
add eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x2d4]
jl 0x47cbd5
mov dword [ebp - 0x158c], 1
jmp 0x47cbdc
and dword [ebp - 0x158c], 0
cmp dword [ebp - 0x158c], 1
jg 0x47cbf1
mov dword [ebp - 0x1e1c], 1
jmp 0x47cbf8
and dword [ebp - 0x1e1c], 0
cmp dword [ebp - 0x1e1c], 0x62b0
jne 0x47cc10
mov dword [ebp - 0x1594], 1
jmp 0x47cc17
and dword [ebp - 0x1594], 0
cmp dword [ebp - 0x1594], 0xfffffff8
jg 0x47cc2c
mov dword [ebp - 0x261c], 1
jmp 0x47cc33
and dword [ebp - 0x261c], 0
mov eax, dword [ebp - 0x261c]
mov dword [ebp - 0x159c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x159c]
mov dword [ebp + eax - 0x3bbc], ecx
jmp 0x47cb35
cmp dword [ebp - 0x5e4], 0
je 0x47ccb7
mov byte [ebp - 0x304], 0
movzx eax, byte [ebp - 0x304]
test eax, eax
je 0x47cc88
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov byte [ebp - 0x42c], 0
movzx eax, byte [ebp - 0x42c]
test eax, eax
je 0x47ccb5
push 0
push 0
push 0x1611
push 0xad2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x47cd00
mov dword [ebp - 0x5e4], 0
jmp 0x47ccd0
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0x22
jg 0x47cd00
mov byte [ebp - 0x306], 0
movzx eax, byte [ebp - 0x306]
test eax, eax
je 0x47ccfe
push 0
push 0
push 0x156b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x47ccc3
mov dword [ebp - 0x3a74], 2
mov dword [ebp - 0x3a70], 2
mov dword [ebp - 0x3a6c], 2
mov dword [ebp - 0x3a68], 2
mov dword [ebp - 0x30e8], 0xfffffff9
mov dword [ebp - 0x3630], 0x1d976ff5
mov dword [ebp - 0x30f0], 0
mov dword [ebp - 0x38d0], 0xf8067e30
mov dword [ebp - 0x30f8], 0xffffffff
mov dword [ebp - 0x3638], 0
mov dword [ebp - 0x3100], 6
mov dword [ebp - 0x2874], 0x5751cfd1
mov dword [ebp - 0x3990], 0xf1fdbd01
mov dword [ebp - 0x3108], 0x93c1de6f
mov dword [ebp - 0x2b50], 0x3c47aa29
mov dword [ebp - 0xccc], 0x26a25a95
mov dword [ebp - 0x2ca4], 0xfffffff9
mov dword [ebp - 0x7bc], 0
jmp 0x47cdc3
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 2
jge 0x47cddf
mov eax, dword [ebp - 0x7bc]
mov dword [ebp + eax*4 - 0x2568], 0
jmp 0x47cdb6
mov eax, dword [ebp - 0xccc]
inc eax
mov dword [ebp - 0xccc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2568], 0
jne 0x47ce09
cmp dword [ebp - 0x2b50], 0
je 0x47ce94
push 5
pop eax
test eax, eax
je 0x47ce94
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2568]
cmp dword [ebp - 0xccc], eax
jge 0x47ce35
mov dword [ebp - 0x1e24], 1
jmp 0x47ce3c
and dword [ebp - 0x1e24], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2568]
cmp dword [ebp - 0x1e24], eax
jl 0x47ce63
cmp dword [ebp - 0x2874], 0
jne 0x47ce63
and dword [ebp - 0x15a4], 0
jmp 0x47ce6d
mov dword [ebp - 0x15a4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2568]
mov ecx, dword [ebp - 0x15a4]
lea eax, [ecx + eax - 2]
test eax, eax
je 0x47ce94
mov dword [ebp - 0xbc8], 1
jmp 0x47ce9b
and dword [ebp - 0xbc8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbc8]
mov dword [ebp + eax - 0x2568], ecx
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x2ca4], eax
mov dword [ebp - 0x950], 0
jmp 0x47ced3
mov eax, dword [ebp - 0x950]
inc eax
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x950], 3
jge 0x47ceef
mov eax, dword [ebp - 0x950]
mov dword [ebp + eax*4 - 0x3bd4], 0x20624039
jmp 0x47cec6
mov dword [ebp - 0xbd0], 0xffffffff
mov dword [ebp - 0x2b4], 0x6942a1e9
mov dword [ebp - 0x5a4], 0x6b8f3d42
mov dword [ebp - 0x370], 0xcaf14c90
mov dword [ebp - 0x7c4], 0xf30836b1
mov dword [ebp - 0xd78], 0xfd947597
mov dword [ebp - 0x2884], 0xffffffff
mov dword [ebp - 0x2d80], 0
mov dword [ebp - 0x288c], 4
mov dword [ebp - 0x222c], 0x4463028e
cmp dword [ebp - 0x7c4], 0
jne 0x47cf61
xor eax, eax
inc eax
je 0x47cf76
cmp dword [ebp - 0xbd0], 0
je 0x47cf76
mov dword [ebp - 0x2224], 1
jmp 0x47cf7d
and dword [ebp - 0x2224], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x2224], eax
jle 0x47cf97
mov dword [ebp - 0x15ac], 1
jmp 0x47cf9e
and dword [ebp - 0x15ac], 0
mov eax, dword [ebp - 0x5a4]
imul eax, dword [ebp - 0x15ac]
test eax, eax
je 0x47cfc4
cmp dword [ebp - 0x2b4], 0
je 0x47cfc4
mov dword [ebp - 0x287c], 1
jmp 0x47cfcb
and dword [ebp - 0x287c], 0
imul eax, dword [ebp - 0x5a4], 0
add eax, dword [ebp - 0xbd0]
je 0x47cfef
cmp dword [ebp - 0x5a4], 0
je 0x47cfef
mov dword [ebp - 0x1e2c], 1
jmp 0x47cff6
and dword [ebp - 0x1e2c], 0
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0x1e2c]
sub ecx, dword [ebp - 0x5a4]
sub ecx, dword [ebp - 0x2b4]
sub eax, ecx
jne 0x47d024
mov eax, 0xfff8
test eax, eax
jne 0x47d024
and dword [ebp - 0x15b4], 0
jmp 0x47d02e
mov dword [ebp - 0x15b4], 1
mov eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x7c4]
imul eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x370]
jge 0x47d067
mov dword [ebp - 0x2424], 1
jmp 0x47d06e
and dword [ebp - 0x2424], 0
cmp dword [ebp - 0x2424], 0x6bf5
jne 0x47d086
mov dword [ebp - 0x15bc], 1
jmp 0x47d08d
and dword [ebp - 0x15bc], 0
mov eax, dword [ebp - 0x15bc]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x3640], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x3110], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x38d8], eax
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x2b4], eax
jg 0x47d0d7
mov dword [ebp - 0x2b58], 1
jmp 0x47d0de
and dword [ebp - 0x2b58], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x3118], eax
mov eax, dword [ebp - 0x2884]
sub eax, 8
cmp eax, dword [ebp - 0x2d80]
jne 0x47d110
cmp dword [ebp - 0x2b4], 0
je 0x47d110
mov dword [ebp - 0x1e34], 1
jmp 0x47d117
and dword [ebp - 0x1e34], 0
mov eax, dword [ebp - 0xd78]
dec eax
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0xd78]
sub eax, dword [ebp - 0x1e34]
cmp dword [ebp - 0xbd0], eax
jg 0x47d144
mov dword [ebp - 0x15c4], 1
jmp 0x47d14b
and dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x288c], eax
mov dword [ebp - 0x2b4], 0x702c9107
mov eax, dword [ebp - 0x222c]
dec eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x158], 0xb9f9b31
mov dword [ebp - 0xcc], 0x33fd52a4
mov dword [ebp - 0x1e5c], 0xbb8686b4
mov dword [ebp - 0x158], 0
jmp 0x47d1a5
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 6
jge 0x47d752
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x2234], 8
mov dword [ebp - 0x289c], 0xfffffff7
mov dword [ebp - 0xd0], 0
jmp 0x47d1e9
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffef
jg 0x47d74d
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xcd4], 0x20c4365d
mov dword [ebp - 0x378], 0xdfa81871
mov dword [ebp - 0xa00], 0
jmp 0x47d22d
mov eax, dword [ebp - 0xa00]
inc eax
mov dword [ebp - 0xa00], eax
cmp dword [ebp - 0xa00], 1
jge 0x47d249
mov eax, dword [ebp - 0xa00]
mov dword [ebp + eax*4 - 0x1e54], 0xffffffff
jmp 0x47d220
mov dword [ebp - 0xb4], 0xd
jmp 0x47d262
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffff8
jl 0x47d3d4
mov dword [ebp - 0x2524], 0xd99e
mov dword [ebp - 0x7cc], 0
jmp 0x47d292
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 2
jge 0x47d2ae
mov eax, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0x3430], 1
jmp 0x47d285
cmp dword [ebp - 0x158], 0
jne 0x47d38e
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x3648], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x3120], eax
cmp dword [ebp - 0xb4], 1
jle 0x47d2f1
mov eax, 0xe637
test eax, eax
je 0x47d2f1
mov dword [ebp - 0x15cc], 1
jmp 0x47d2f8
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x15cc]
je 0x47d312
mov dword [ebp - 0x1e3c], 1
jmp 0x47d319
and dword [ebp - 0x1e3c], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1e3c], eax
jle 0x47d333
mov dword [ebp - 0x15d4], 1
jmp 0x47d33a
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x15d4], eax
jne 0x47d354
mov dword [ebp - 0x2b60], 1
jmp 0x47d35b
and dword [ebp - 0x2b60], 0
mov eax, dword [ebp - 0x2524]
mov dword [ebp - 0x39f0], eax
mov eax, dword [ebp - 0x2524]
cmp dword [ebp - 0xcd4], eax
je 0x47d381
mov dword [ebp - 0x15dc], 1
jmp 0x47d388
and dword [ebp - 0x15dc], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xcc], 0
jmp 0x47d3b3
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x47d3cf
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x3430], 0
jmp 0x47d3a6
jmp 0x47d255
mov dword [ebp - 0xcc], 0
jmp 0x47d3ed
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1d
je 0x47d748
mov dword [ebp - 0x2894], 0x7675daaf
mov dword [ebp - 0x2cac], 0xfffffff7
mov dword [ebp - 0x1e0], 0
jmp 0x47d427
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x47d443
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x2c1c], 0xfffffff9
jmp 0x47d41a
mov dword [ebp - 0x1e0], 0
jmp 0x47d45c
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x47d478
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x343c], 0xffffffff
jmp 0x47d44f
mov dword [ebp - 0xb4], 0
jmp 0x47d491
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x47d6da
mov dword [ebp - 0x958], 0
jmp 0x47d4b7
mov eax, dword [ebp - 0x958]
inc eax
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x958], 3
jge 0x47d4d3
mov eax, dword [ebp - 0x958]
mov dword [ebp + eax*4 - 0x37a4], 0xaf9eb11d
jmp 0x47d4aa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37a4]
mov dword [ebp - 0x3128], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x3650], eax
mov eax, dword [ebp - 0x2894]
mov dword [ebp - 0x3130], eax
or eax, 0xffffffff
jae 0x47d50f
mov dword [ebp - 0x1e44], 1
jmp 0x47d516
and dword [ebp - 0x1e44], 0
mov eax, dword [ebp - 0xcd4]
cmp dword [ebp - 0x1e44], eax
jge 0x47d530
mov dword [ebp - 0x15e4], 1
jmp 0x47d537
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0x15e4]
mov dword [ebp - 0x2234], eax
cmp dword [ebp - 0x2234], 0xc535718a
je 0x47d55b
mov dword [ebp - 0x15ec], 1
jmp 0x47d562
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x15ec], eax
jg 0x47d57c
mov dword [ebp - 0x1e4c], 1
jmp 0x47d583
and dword [ebp - 0x1e4c], 0
cmp dword [ebp - 0x1e4c], 0xc077
jle 0x47d59b
mov dword [ebp - 0x15f4], 1
jmp 0x47d5a2
and dword [ebp - 0x15f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x37a4]
cmp eax, dword [ebp - 0x15f4]
jge 0x47d5c9
cmp dword [ebp - 0xd0], 0
jne 0x47d5c9
and dword [ebp - 0x242c], 0
jmp 0x47d5d3
mov dword [ebp - 0x242c], 1
mov eax, dword [ebp - 0x242c]
sub eax, 0x6e629480
jne 0x47d5f9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c1c], 0
jne 0x47d5f9
and dword [ebp - 0x15fc], 0
jmp 0x47d603
mov dword [ebp - 0x15fc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x15fc]
sub ecx, dword [ebp + eax - 0x1e54]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x1e54]
cmp ecx, 0x746b
jg 0x47d638
mov dword [ebp - 0x1604], 1
jmp 0x47d63f
and dword [ebp - 0x1604], 0
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x1604]
sub ecx, dword [ebp - 0xd0]
imul ecx, dword [ebp - 0xcd4]
imul ecx, dword [ebp - 0xd0]
sub eax, ecx
dec eax
cmp eax, 0x6cda
jl 0x47d675
mov dword [ebp - 0x223c], 1
jmp 0x47d67c
and dword [ebp - 0x223c], 0
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x223c]
sub ecx, dword [ebp - 0xd0]
imul eax, ecx
cmp eax, dword [ebp - 0xcc]
jge 0x47d6a5
mov dword [ebp - 0x160c], 1
jmp 0x47d6ac
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 0x160c]
mov dword [ebp - 0x2cac], eax
mov eax, 0xd29d3eaf
sub eax, dword [ebp - 0x289c]
mov dword [ebp - 0x1e5c], eax
mov eax, dword [ebp - 0x1e5c]
mov dword [ebp - 0x378], eax
jmp 0x47d484
mov dword [ebp - 0x378], 1
jmp 0x47d6f3
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0
jl 0x47d743
mov eax, dword [ebp - 0x378]
mov eax, dword [ebp + eax*4 - 0x2c1c]
mov dword [ebp - 0x38e0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x3138], eax
mov eax, dword [ebp - 0x378]
mov eax, dword [ebp + eax*4 - 0x2c1c]
mov dword [ebp - 0xb4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb4]
mov dword [ebp + eax - 0x343c], ecx
jmp 0x47d6e6
jmp 0x47d3e0
jmp 0x47d1dc
jmp 0x47d198
mov byte [ebp - 0x454], 0
movzx eax, byte [ebp - 0x454]
test eax, eax
je 0x47d775
push 0x163c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x2ea8], 0xd386cce5
mov dword [ebp - 0x2ea4], 0xd386cce5
mov dword [ebp - 0x2ea0], 0xd386cce5
mov dword [ebp - 0x2e9c], 0xd386cce5
mov dword [ebp - 0x630], 0xffffffff
mov dword [ebp - 0xbd8], 0xf6c74aa0
mov dword [ebp - 0xa58], 0x6b87d0fa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ea8]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0xbd8], eax
jne 0x47d7e9
mov dword [ebp - 0x1614], 1
jmp 0x47d7f0
and dword [ebp - 0x1614], 0
mov eax, dword [ebp - 0x1614]
mov dword [ebp - 0xa58], eax
cmp dword [ebp - 0xbd8], 0
je 0x47d821
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ea8], 0
je 0x47d821
mov dword [ebp - 0x25b8], 1
jmp 0x47d828
and dword [ebp - 0x25b8], 0
mov eax, dword [ebp - 0xa58]
cmp dword [ebp - 0x25b8], eax
jne 0x47d98f
mov dword [ebp - 0x2b68], 0xfffffffd
mov dword [ebp - 0x7d4], 0
jmp 0x47d85d
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 1
jge 0x47d879
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0x2dd0], 0xeea53061
jmp 0x47d850
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ea8], 1
jg 0x47d895
mov dword [ebp - 0x161c], 1
jmp 0x47d89c
and dword [ebp - 0x161c], 0
mov eax, dword [ebp - 0x2b68]
sub eax, dword [ebp - 0xa58]
cmp eax, dword [ebp - 0x161c]
jne 0x47d8bc
mov dword [ebp - 0x1e64], 1
jmp 0x47d8c3
and dword [ebp - 0x1e64], 0
mov eax, dword [ebp - 0xa58]
cmp dword [ebp - 0x1e64], eax
jg 0x47d8dd
mov dword [ebp - 0x1624], 1
jmp 0x47d8e4
and dword [ebp - 0x1624], 0
cmp dword [ebp - 0x1624], 0xabf8
jg 0x47d8fc
mov dword [ebp - 0x28a4], 1
jmp 0x47d903
and dword [ebp - 0x28a4], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x3658], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2dd0]
shl eax, 1
je 0x47d94f
mov byte [ebp - 0x308], 0
movzx eax, byte [ebp - 0x308]
test eax, eax
je 0x47d94d
push 0
push 0
push 0x1611
push 0xad2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x47d971
mov byte [ebp - 0x42e], 0
movzx eax, byte [ebp - 0x42e]
test eax, eax
je 0x47d971
push 0x1234
push 0x1ca4
call dword [sym.imp.USER32.dll_SetCaretPos]
mov byte [ebp - 0x30a], 0
movzx eax, byte [ebp - 0x30a]
test eax, eax
je 0x47d98d
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x47d99b
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x5b4], 0
jmp 0x47d9b4
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 2
jg 0x47f46b
mov dword [ebp - 8], 8
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0x225c], 0x25383eb3
mov dword [ebp - 0x1694], 0xffffffff
mov dword [ebp - 0x25bc], 8
mov dword [ebp - 0x2cb4], 0x718d2738
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
je 0x47da0e
mov dword [ebp - 0x2244], 1
jmp 0x47da15
and dword [ebp - 0x2244], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2244], eax
jl 0x47dbec
mov dword [ebp - 0x4bc], 0xb363f9e9
mov dword [ebp - 0x164c], 0x63530054
mov dword [ebp - 0x224c], 0xfffffff9
mov dword [ebp - 0x28ac], 0
mov dword [ebp - 0x4bc], 0xe2c0d37a
cmp dword [ebp - 8], 0
jne 0x47da68
mov dword [ebp - 0x162c], 1
jmp 0x47da6f
and dword [ebp - 0x162c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x162c], eax
jl 0x47da86
mov dword [ebp - 0x1e6c], 1
jmp 0x47da8d
and dword [ebp - 0x1e6c], 0
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x1e6c], eax
jle 0x47daa7
mov dword [ebp - 0x1634], 1
jmp 0x47daae
and dword [ebp - 0x1634], 0
mov eax, dword [ebp - 0x164c]
cmp dword [ebp - 0x1634], eax
jg 0x47dac8
mov dword [ebp - 0x2434], 1
jmp 0x47dacf
and dword [ebp - 0x2434], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x2434]
cmp eax, 6
ja 0x47dae9
mov dword [ebp - 0x163c], 1
jmp 0x47daf0
and dword [ebp - 0x163c], 0
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x163c], eax
jle 0x47db0d
cmp dword [ebp - 8], 0
jne 0x47db0d
and dword [ebp - 0x1e74], 0
jmp 0x47db17
mov dword [ebp - 0x1e74], 1
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x1e74], eax
jne 0x47db31
mov dword [ebp - 0x1644], 1
jmp 0x47db38
and dword [ebp - 0x1644], 0
mov eax, dword [ebp - 0x1644]
mov dword [ebp - 0x224c], eax
cmp dword [ebp - 0x224c], 0
jne 0x47db5f
cmp dword [ebp - 0x164c], 0
jne 0x47db5f
and dword [ebp - 0x1e7c], 0
jmp 0x47db69
mov dword [ebp - 0x1e7c], 1
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0x1e7c]
sub ecx, dword [ebp - 0x4bc]
cmp eax, ecx
je 0x47db94
cmp dword [ebp - 8], 0
je 0x47db94
mov dword [ebp - 0x1654], 1
jmp 0x47db9b
and dword [ebp - 0x1654], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1654], eax
jne 0x47dbb2
mov dword [ebp - 0x252c], 1
jmp 0x47dbb9
and dword [ebp - 0x252c], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x252c]
cmp eax, dword [ebp - 8]
je 0x47dbd4
mov dword [ebp - 0x165c], 1
jmp 0x47dbdb
and dword [ebp - 0x165c], 0
mov eax, dword [ebp - 0x165c]
mov dword [ebp - 0x28ac], eax
jmp 0x47dea9
mov dword [ebp - 0x28b4], 5
mov dword [ebp - 0x7dc], 0
jmp 0x47dc0f
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 2
jge 0x47dc2b
mov eax, dword [ebp - 0x7dc]
mov dword [ebp + eax*4 - 0x620], 0x67b9c5c9
jmp 0x47dc02
mov dword [ebp - 8], 0
jmp 0x47dc3b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jg 0x47dc95
mov dword [ebp - 0x960], 0xd55be984
mov dword [ebp - 0x960], 0
jmp 0x47dc64
mov eax, dword [ebp - 0x960]
inc eax
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x960], 1
jg 0x47dc93
mov byte [ebp - 0x32e], 0
movzx eax, byte [ebp - 0x32e]
test eax, eax
je 0x47dc91
push 0x1441
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x47dc57
jmp 0x47dc34
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x620]
mov dword [ebp - 0x3140], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x620], 0
jne 0x47dd47
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x620], 0
je 0x47dcde
cmp dword [ebp - 8], 0
je 0x47dcde
mov dword [ebp - 0x1e84], 1
jmp 0x47dce5
and dword [ebp - 0x1e84], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x620]
cmp dword [ebp - 0x1e84], eax
jg 0x47dd10
cmp dword [ebp - 8], 0
je 0x47dd10
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x620], 0
jne 0x47dd1f
cmp dword [ebp - 8], 0
jne 0x47dd1f
and dword [ebp - 0x1664], 0
jmp 0x47dd29
mov dword [ebp - 0x1664], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x620]
cmp dword [ebp - 0x1664], eax
jge 0x47dd47
and dword [ebp - 0x2254], 0
jmp 0x47dd51
mov dword [ebp - 0x2254], 1
cmp dword [ebp - 0x2254], 0x7156
jne 0x47dd7f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x620], 0
je 0x47dd7f
cmp dword [ebp - 8], 0
je 0x47dd7f
mov dword [ebp - 0x166c], 1
jmp 0x47dd86
and dword [ebp - 0x166c], 0
cmp dword [ebp - 0x166c], 0xffffffff
je 0x47dd9b
mov dword [ebp - 0x1e8c], 1
jmp 0x47dda2
and dword [ebp - 0x1e8c], 0
cmp dword [ebp - 0x1e8c], 0
jne 0x47ddc7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x620], 0
je 0x47ddc7
mov dword [ebp - 0x1674], 1
jmp 0x47ddce
and dword [ebp - 0x1674], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1674], eax
jle 0x47ddee
mov eax, 0x7e6d
test eax, eax
je 0x47ddee
mov dword [ebp - 0x243c], 1
jmp 0x47ddf5
and dword [ebp - 0x243c], 0
cmp dword [ebp - 0x243c], 0xd69c043c
jb 0x47de05
cmp dword [ebp - 8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x620], 0
je 0x47de63
mov dword [ebp - 8], 0
jmp 0x47de25
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x47de3b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x620], 0x4ffa2b87
jmp 0x47de1e
mov byte [ebp - 0x448], 0
movzx eax, byte [ebp - 0x448]
test eax, eax
je 0x47de61
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x47dea9
mov dword [ebp - 0x2b70], 8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x620]
sub eax, dword [ebp - 8]
cmp eax, 0x572dbe42
jge 0x47de90
mov dword [ebp - 0x167c], 1
jmp 0x47de97
and dword [ebp - 0x167c], 0
mov eax, dword [ebp - 0x2b70]
sub eax, dword [ebp - 0x167c]
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3998], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x7e4]
test eax, eax
jne 0x47ded8
cmp dword [ebp - 8], 0
jne 0x47ded8
and dword [ebp - 0x1e94], 0
jmp 0x47dee2
mov dword [ebp - 0x1e94], 1
cmp dword [ebp - 0x1e94], 0x2848aa25
jle 0x47defa
mov dword [ebp - 0x1684], 1
jmp 0x47df01
and dword [ebp - 0x1684], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1684]
mov dword [ebp - 0x225c], eax
cmp dword [ebp - 0x225c], 0
mov eax, dword [ebp - 0x7e4]
sub eax, 0xbc07
cmp eax, dword [ebp - 8]
jg 0x47df2e
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x47df43
cmp dword [ebp - 0x7e4], 0
je 0x47df43
mov dword [ebp - 0x168c], 1
jmp 0x47df4a
and dword [ebp - 0x168c], 0
cmp dword [ebp - 0x168c], 1
jle 0x47df5f
mov dword [ebp - 0x1e9c], 1
jmp 0x47df66
and dword [ebp - 0x1e9c], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1e9c]
mov dword [ebp - 0x1694], eax
mov eax, dword [ebp - 0x1694]
mov dword [ebp - 0x25bc], eax
cmp dword [ebp - 0x25bc], 0xfffffff9
jl 0x47df96
mov dword [ebp - 0x169c], 1
jmp 0x47df9d
and dword [ebp - 0x169c], 0
mov eax, dword [ebp - 0x169c]
mov dword [ebp - 0x2cb4], eax
mov dword [ebp - 0x7f4], 0xff55e00f
mov dword [ebp - 0xa08], 0x42eb90da
mov dword [ebp - 0xa08], 0x1b
jmp 0x47dfd6
mov eax, dword [ebp - 0xa08]
dec eax
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 0xffffffeb
jle 0x47e07d
mov dword [ebp - 0x7ec], 0xed23b618
mov dword [ebp - 0x7ec], 0
jmp 0x47e006
mov eax, dword [ebp - 0x7ec]
dec eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 0xfffffff0
jle 0x47e078
mov dword [ebp - 0x968], 8
mov dword [ebp - 0x968], 0x19
jmp 0x47e032
mov eax, dword [ebp - 0x968]
dec eax
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x968], 0x17
jle 0x47e076
mov byte [ebp - 0x30c], 0
movzx eax, byte [ebp - 0x30c]
test eax, eax
je 0x47e053
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [ebp - 0x430], 0
movzx eax, byte [ebp - 0x430]
test eax, eax
je 0x47e074
push 0x6d6
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x47e025
jmp 0x47dff9
jmp 0x47dfc9
mov dword [ebp - 0x7f4], 2
jmp 0x47e096
mov eax, dword [ebp - 0x7f4]
dec eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0
jl 0x47f466
mov dword [ebp - 0xb30], 0xf99ff606
mov dword [ebp - 0xb2c], 0xf99ff606
mov dword [ebp - 0xb28], 0xf99ff606
mov dword [ebp - 0xb24], 0xf99ff606
mov dword [ebp - 0x78], 0xcd795364
mov dword [ebp - 0xd4c], 0x6e311378
mov dword [ebp - 0xfc], 0xd43d
mov dword [ebp - 0x78], 3
jmp 0x47e0f6
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x47e582
mov dword [ebp - 0xbe0], 1
mov dword [ebp - 0x16dc], 7
mov dword [ebp - 0x16e4], 0x5e148cb4
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0xb30], 0
je 0x47e148
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xb30]
add eax, 0xf6b9af9
je 0x47e148
mov dword [ebp - 0x1ea4], 1
jmp 0x47e14f
and dword [ebp - 0x1ea4], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xb30]
cmp dword [ebp - 0x1ea4], eax
jle 0x47e224
mov dword [ebp - 0xa9c], 0x5eb20068
mov byte [ebp - 0x30e], 0
movzx eax, byte [ebp - 0x30e]
test eax, eax
je 0x47e1a9
push 0xd8c
push 0x16b4
push 0x26c7
push 0x1a63
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [ebp - 0xa9c], 3
jmp 0x47e1c2
mov eax, dword [ebp - 0xa9c]
dec eax
mov dword [ebp - 0xa9c], eax
cmp dword [ebp - 0xa9c], 0
jl 0x47e21f
mov dword [ebp - 0x7fc], 0xf1f13b01
mov dword [ebp - 0x7fc], 3
jmp 0x47e1ee
mov eax, dword [ebp - 0x7fc]
dec eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0
jl 0x47e21d
mov byte [ebp - 0x310], 0
movzx eax, byte [ebp - 0x310]
test eax, eax
je 0x47e21b
push 0xf4f
push 0x1b9
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x47e1e1
jmp 0x47e1b5
jmp 0x47e3f4
mov dword [ebp - 0x16cc], 0x3888
mov dword [ebp - 0x28bc], 0xe5c48968
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xb30]
sub eax, dword [ebp - 0x78]
jmp 0x47e253
and dword [ebp - 0x16a4], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xb30]
cmp eax, dword [ebp - 0x16a4]
jle 0x47e278
mov dword [ebp - 0x2264], 1
jmp 0x47e27f
and dword [ebp - 0x2264], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x2264]
test eax, eax
jne 0x47e29d
push 0x76
pop eax
test eax, eax
jne 0x47e29d
and dword [ebp - 0x16ac], 0
jmp 0x47e2a7
mov dword [ebp - 0x16ac], 1
mov eax, dword [ebp - 0x16cc]
add eax, dword [ebp - 0x16ac]
cmp eax, 0x33c017f2
jl 0x47e2c6
mov dword [ebp - 0x1eac], 1
jmp 0x47e2cd
and dword [ebp - 0x1eac], 0
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x1eac]
sub ecx, dword [ebp + eax*4 - 0xb30]
jne 0x47e2e4
xor eax, eax
inc eax
je 0x47e2f9
cmp dword [ebp - 0xd4c], 0
je 0x47e2f9
mov dword [ebp - 0x16b4], 1
jmp 0x47e300
and dword [ebp - 0x16b4], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x16b4], eax
jle 0x47e31a
mov dword [ebp - 0x2444], 1
jmp 0x47e321
and dword [ebp - 0x2444], 0
cmp dword [ebp - 0x2444], 0xc74c3eec
jae 0x47e339
mov dword [ebp - 0x16bc], 1
jmp 0x47e340
and dword [ebp - 0x16bc], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x16bc], eax
jg 0x47e357
mov dword [ebp - 0x1eb4], 1
jmp 0x47e35e
and dword [ebp - 0x1eb4], 0
mov eax, dword [ebp - 0xd4c]
cmp dword [ebp - 0x1eb4], eax
je 0x47e378
mov dword [ebp - 0x16c4], 1
jmp 0x47e37f
and dword [ebp - 0x16c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb30]
add eax, dword [ebp - 0x16c4]
je 0x47e39f
mov dword [ebp - 0x226c], 1
jmp 0x47e3a6
and dword [ebp - 0x226c], 0
mov eax, dword [ebp - 0x226c]
mov dword [ebp - 0x28bc], eax
cmp dword [ebp - 0x16cc], 0
je 0x47e3d4
mov dword [ebp - 0x1ebc], 0x9cc0f90
mov eax, dword [ebp - 0x1ebc]
dec eax
mov dword [ebp - 0x1ebc], eax
jmp 0x47e3f4
mov byte [ebp - 0x432], 0
movzx eax, byte [ebp - 0x432]
test eax, eax
je 0x47e3f4
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0xfc], 0
jmp 0x47e40d
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x47e57d
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0xb30]
add eax, 0xab2d
mov ecx, dword [ebp - 0xfc]
cmp eax, dword [ebp + ecx*4 - 0xb30]
jne 0x47e447
mov dword [ebp - 0x16d4], 1
jmp 0x47e44e
and dword [ebp - 0x16d4], 0
cmp dword [ebp - 0x16d4], 0xfffffffd
jne 0x47e463
mov dword [ebp - 0x2534], 1
jmp 0x47e46a
and dword [ebp - 0x2534], 0
mov eax, dword [ebp - 0x2534]
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 0xffff
jne 0x47e48e
mov dword [ebp - 0x1ec4], 1
jmp 0x47e495
and dword [ebp - 0x1ec4], 0
mov eax, dword [ebp - 0x1ec4]
mov dword [ebp - 0x16e4], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0xb30]
cmp dword [ebp - 0x16e4], eax
jle 0x47e4c2
mov dword [ebp - 0x2274], 1
jmp 0x47e4c9
and dword [ebp - 0x2274], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0xb30]
imul eax, dword [ebp - 0x2274]
mov ecx, dword [ebp - 0xfc]
cmp eax, dword [ebp + ecx*4 - 0xb30]
jne 0x47e4f8
mov dword [ebp - 0x16ec], 1
jmp 0x47e4ff
and dword [ebp - 0x16ec], 0
mov eax, dword [ebp - 0xbe0]
cmp eax, dword [ebp - 0x16ec]
jge 0x47e519
mov dword [ebp - 0x2b78], 1
jmp 0x47e520
and dword [ebp - 0x2b78], 0
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0x3148], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x3660], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0xb30]
mov dword [ebp - 0x3150], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0xb30], 5
jle 0x47e564
mov dword [ebp - 0x1ecc], 1
jmp 0x47e56b
and dword [ebp - 0x1ecc], 0
imul eax, dword [ebp - 0x1ecc], 0
mov dword [ebp - 0xbe0], eax
jmp 0x47e400
jmp 0x47e0ef
mov dword [ebp - 0xe1c], 0xb57fd546
mov dword [ebp - 0xe18], 0xb57fd546
mov dword [ebp - 0xe14], 0xb57fd546
mov dword [ebp - 0xe10], 0xb57fd546
mov dword [ebp - 0x504], 1
mov dword [ebp - 0x804], 0x911b9c6f
mov dword [ebp - 0x28cc], 0xec6b039b
mov dword [ebp - 0x504], 3
jmp 0x47e5e1
mov eax, dword [ebp - 0x504]
dec eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0
jl 0x47ea61
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x38e8], 3
mov dword [ebp - 0xa0], 9
mov dword [ebp - 0x970], 0
jmp 0x47e625
mov eax, dword [ebp - 0x970]
inc eax
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 2
jge 0x47e641
mov eax, dword [ebp - 0x970]
mov dword [ebp + eax*4 - 0x62c], 0xe65c3421
jmp 0x47e618
mov dword [ebp - 0x124], 3
jmp 0x47e65a
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x47ea5c
mov dword [ebp - 0xa10], 0x96add890
mov dword [ebp - 0xcdc], 0xffffffff
mov dword [ebp - 0x172c], 0x260ec62d
mov eax, dword [ebp - 0x124]
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax*4 - 0xe1c]
cmp ecx, 3
jg 0x47e6b2
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xe1c], 0
jne 0x47e6b2
and dword [ebp - 0x16f4], 0
jmp 0x47e6bc
mov dword [ebp - 0x16f4], 1
imul eax, dword [ebp - 0x16f4], 0xe87f
mov ecx, dword [ebp - 0x124]
cmp eax, dword [ebp + ecx*4 - 0xe1c]
jle 0x47e6e1
mov dword [ebp - 0x28c4], 1
jmp 0x47e6e8
and dword [ebp - 0x28c4], 0
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp + eax*4 - 0xe1c]
mov dword [ebp - 0x3158], eax
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x804]
cmp dword [ebp + eax*4 - 0xe1c], ecx
jg 0x47e71c
mov dword [ebp - 0x244c], 1
jmp 0x47e723
and dword [ebp - 0x244c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x244c]
mov dword [ebp + eax - 0x62c], ecx
mov dword [ebp - 0xa0], 1
jmp 0x47e74f
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x47ea57
mov dword [ebp - 0x2b80], 0xffff
mov byte [ebp - 0x312], 0
movzx eax, byte [ebp - 0x312]
test eax, eax
je 0x47e78c
push 0x1534
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x62c], 0
je 0x47ea3d
mov dword [ebp - 0x1724], 0xb42d225d
mov dword [ebp - 0x1edc], 8
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x62c]
mov ecx, dword [ebp - 0xa0]
add eax, dword [ebp + ecx*4 - 0x62c]
je 0x47e7e2
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xa10]
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0xcdc], eax
cmp dword [ebp - 0xcdc], 0
jne 0x47e810
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x62c], 0
jne 0x47e810
and dword [ebp - 0x16fc], 0
jmp 0x47e81a
mov dword [ebp - 0x16fc], 1
mov eax, dword [ebp - 0x16fc]
add eax, 7
mov ecx, dword [ebp - 0xa0]
cmp eax, dword [ebp + ecx*4 - 0x62c]
jl 0x47e83e
mov dword [ebp - 0x1ed4], 1
jmp 0x47e845
and dword [ebp - 0x1ed4], 0
mov eax, dword [ebp - 0x1724]
cmp dword [ebp - 0x1ed4], eax
jl 0x47e85f
mov dword [ebp - 0x2d88], 1
jmp 0x47e866
and dword [ebp - 0x2d88], 0
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp + eax*4 - 0xe1c]
mov dword [ebp - 0x3668], eax
mov eax, dword [ebp - 0x28cc]
mov dword [ebp - 0x3160], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x62c], 0x889e59fa
je 0x47e8a4
mov dword [ebp - 0x1704], 1
jmp 0x47e8ab
and dword [ebp - 0x1704], 0
cmp dword [ebp - 0x1704], 3
jge 0x47e8c0
mov dword [ebp - 0x227c], 1
jmp 0x47e8c7
and dword [ebp - 0x227c], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x62c]
cmp eax, dword [ebp - 0x227c]
jg 0x47e8e8
mov dword [ebp - 0x170c], 1
jmp 0x47e8ef
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x170c]
mov dword [ebp - 0x1edc], eax
mov eax, dword [ebp - 0x1edc]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0xe1c]
mov ecx, dword [ebp - 0x124]
imul eax, dword [ebp + ecx*4 - 0xe1c]
test eax, eax
je 0x47e93a
xor eax, eax
je 0x47e93a
cmp dword [ebp - 0x804], 0
je 0x47e93a
mov dword [ebp - 0x1714], 1
jmp 0x47e941
and dword [ebp - 0x1714], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x62c]
cmp eax, dword [ebp - 0x1714]
jne 0x47e962
mov dword [ebp - 0x25d0], 1
jmp 0x47e969
and dword [ebp - 0x25d0], 0
mov eax, dword [ebp - 0x25d0]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0
je 0x47e993
cmp dword [ebp - 0x504], 0
je 0x47e993
mov dword [ebp - 0x171c], 1
jmp 0x47e99a
and dword [ebp - 0x171c], 0
cmp dword [ebp - 0x171c], 0x17b1
jg 0x47e9b2
mov dword [ebp - 0x1ee4], 1
jmp 0x47e9b9
and dword [ebp - 0x1ee4], 0
mov eax, dword [ebp - 0x2b80]
cmp dword [ebp - 0x1ee4], eax
jle 0x47e9d3
mov dword [ebp - 0x28d4], 1
jmp 0x47e9da
and dword [ebp - 0x28d4], 0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0xe1c]
imul eax, dword [ebp + ecx*4 - 0x62c]
mov dword [ebp - 0x2284], eax
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x2284]
mov dword [ebp + eax*4 - 0x62c], ecx
mov eax, dword [ebp - 0x1724]
cmp dword [ebp - 0x2284], eax
jle 0x47ea28
mov dword [ebp - 0x2cbc], 1
jmp 0x47ea2f
and dword [ebp - 0x2cbc], 0
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x172c], eax
jmp 0x47ea52
mov dword [ebp - 0x172c], 0
cmp dword [ebp - 0xcdc], 0
je 0x47ea52
jmp 0x47ea57
jmp 0x47e742
jmp 0x47e64d
jmp 0x47e5d4
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x80c], 0
jmp 0x47ea84
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 1
jge 0x47eaa0
mov eax, dword [ebp - 0x80c]
mov dword [ebp + eax*4 - 0x1eec], 0x5f5b1b6f
jmp 0x47ea77
mov dword [ebp - 0x138], 0xffffffea
jmp 0x47eab9
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x12
jle 0x47ec72
mov dword [ebp - 0x170], 0x37d45db3
mov dword [ebp - 0x978], 0
jmp 0x47eae9
mov eax, dword [ebp - 0x978]
inc eax
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 4
jge 0x47eb05
mov eax, dword [ebp - 0x978]
mov dword [ebp + eax*4 - 0x3aa8], 0x1d92
jmp 0x47eadc
mov dword [ebp - 0x170], 3
jmp 0x47eb1e
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x47eb57
mov byte [ebp - 0x44a], 0
movzx eax, byte [ebp - 0x44a]
test eax, eax
je 0x47eb55
push 0x1cf8
push 0x189d
push 0x147c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x47eb11
mov dword [ebp - 0x170], 0
jmp 0x47eb70
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x47ec6d
mov dword [ebp - 0x5ac], 0xafe30f58
mov dword [ebp - 0x5ac], 3
jmp 0x47eba0
mov eax, dword [ebp - 0x5ac]
dec eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0
jl 0x47ec68
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x814], 3
jmp 0x47ebd0
mov eax, dword [ebp - 0x814]
dec eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
jl 0x47ec63
mov dword [ebp - 0xa60], 0
mov dword [ebp - 0xa60], 0
jmp 0x47ec00
mov eax, dword [ebp - 0xa60]
inc eax
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0xa60], 3
jg 0x47ec5e
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x81c], 3
jmp 0x47ec2c
mov eax, dword [ebp - 0x81c]
dec eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jl 0x47ec5c
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp + eax*4 - 0x3aa8]
mov dword [ebp + ecx*4 - 0x3aa8], eax
cmp dword [ebp - 0x5ac], 0
je 0x47ec5a
jmp 0x47ec5c
jmp 0x47ec1f
jmp 0x47ebf3
jmp 0x47ebc3
jmp 0x47eb93
jmp 0x47eb63
jmp 0x47eaac
mov dword [ebp - 0x138], 0
jmp 0x47ec8b
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x47ecdc
mov eax, dword [ebp - 0x138]
cmp dword [ebp + eax*4 - 0x1eec], 0
je 0x47ecc8
mov byte [ebp - 0x314], 0
movzx eax, byte [ebp - 0x314]
test eax, eax
je 0x47ecc6
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x47ecda
mov eax, dword [ebp - 0x138]
cmp dword [ebp + eax*4 - 0x1eec], 0
je 0x47ecda
jmp 0x47ecdc
jmp 0x47ec7e
mov byte [ebp - 0x456], 0
mov dword [ebp - 0xbc], 0x1f94964a
mov dword [ebp - 0x380], 0xad374006
mov dword [ebp - 0x2b88], 0xfffe
mov dword [ebp - 0x270], 0
jmp 0x47ed1a
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x47ed36
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x13c], 0x1928c176
jmp 0x47ed0d
mov dword [ebp - 0x270], 0
jmp 0x47ed4f
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x47ed6b
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x824], 1
jmp 0x47ed42
mov dword [ebp - 0xbc], 0
jmp 0x47ed84
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x47eee9
mov dword [ebp - 0x2fc8], 0x3e0566a9
mov dword [ebp - 0x2fc4], 0x3e0566a9
mov dword [ebp - 0x2fc0], 0x3e0566a9
mov dword [ebp - 0x2fbc], 0x3e0566a9
mov dword [ebp - 0x173c], 0xb63
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x1734], eax
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x1734]
mov dword [ebp + eax*4 - 0x13c], ecx
cmp dword [ebp - 0x1734], 0
je 0x47ee69
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0x13c]
neg eax
cmp eax, dword [ebp - 0x380]
jle 0x47ee15
mov dword [ebp - 0xbe8], 1
jmp 0x47ee1c
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbe8]
mov dword [ebp + eax*4 - 0x13c], ecx
cmp dword [ebp - 0xbe8], 0
jne 0x47ee4a
cmp dword [ebp - 0x380], 0
jne 0x47ee4a
and dword [ebp - 0x2454], 0
jmp 0x47ee54
mov dword [ebp - 0x2454], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2454]
mov dword [ebp + eax - 0x2fc8], ecx
jmp 0x47eee4
mov dword [ebp - 0x28dc], 0x41fd
mov dword [ebp - 0x3a20], 0
mov dword [ebp - 0x3168], 0xad816f93
mov dword [ebp - 0x980], 0
jmp 0x47eea0
mov eax, dword [ebp - 0x980]
inc eax
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 2
jge 0x47eebc
mov eax, dword [ebp - 0x980]
mov dword [ebp + eax*4 - 0x3c7c], 0
jmp 0x47ee93
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x824], 0x2baef6e2
mov dword [ebp - 0x28dc], 0x2baef6e2
mov eax, dword [ebp - 0x173c]
inc eax
mov dword [ebp - 0x173c], eax
jmp 0x47ed77
mov dword [ebp - 0xbc], 0
jmp 0x47ef02
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x47f1b5
mov dword [ebp - 0xd98], 5
mov byte [ebp - 0x434], 0
movzx eax, byte [ebp - 0x434]
test eax, eax
je 0x47ef33
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x380], 0
jmp 0x47ef4c
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jg 0x47f1b0
mov dword [ebp - 0xd8], 0xe2cd8491
mov dword [ebp - 0xd8], 0
jmp 0x47ef7c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jg 0x47f191
mov dword [ebp - 0x5ec], 0x2ec6f0d4
mov dword [ebp - 0x5ec], 0
jmp 0x47efac
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 1
jge 0x47efc8
mov eax, dword [ebp - 0x5ec]
mov dword [ebp + eax*4 - 0x13c], 0xffffffff
jmp 0x47ef9f
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x3670], eax
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov ecx, dword [ebp + ecx*4 - 0x824]
cmp dword [ebp + eax*4 - 0x13c], ecx
jg 0x47f009
mov eax, 0xffff
test eax, eax
jne 0x47f009
and dword [ebp - 0x1ef4], 0
jmp 0x47f013
mov dword [ebp - 0x1ef4], 1
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0x13c]
cmp dword [ebp - 0x1ef4], eax
jne 0x47f034
mov dword [ebp - 0x1744], 1
jmp 0x47f03b
and dword [ebp - 0x1744], 0
cmp dword [ebp - 0x1744], 0x6e97
jl 0x47f053
mov dword [ebp - 0x228c], 1
jmp 0x47f05a
and dword [ebp - 0x228c], 0
mov eax, dword [ebp - 0xd98]
add eax, dword [ebp - 0x228c]
cmp eax, 0xd48a24e2
jae 0x47f079
mov dword [ebp - 0x174c], 1
jmp 0x47f080
and dword [ebp - 0x174c], 0
mov eax, dword [ebp - 0xd98]
cmp dword [ebp - 0x174c], eax
jl 0x47f0a7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
jne 0x47f0a7
and dword [ebp - 0x1efc], 0
jmp 0x47f0b1
mov dword [ebp - 0x1efc], 1
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x1efc], eax
jle 0x47f0db
mov eax, dword [ebp - 0xd8]
cmp dword [ebp + eax*4 - 0x824], 0
je 0x47f0db
mov dword [ebp - 0x1754], 1
jmp 0x47f0e2
and dword [ebp - 0x1754], 0
mov eax, dword [ebp - 0x2b88]
imul eax, dword [ebp - 0x1754]
cmp eax, dword [ebp - 0xd8]
jle 0x47f103
mov dword [ebp - 0x253c], 1
jmp 0x47f10a
and dword [ebp - 0x253c], 0
mov eax, dword [ebp - 0x253c]
add eax, 0x161d
cmp eax, dword [ebp - 0xd8]
jne 0x47f129
mov dword [ebp - 0x175c], 1
jmp 0x47f130
and dword [ebp - 0x175c], 0
mov eax, dword [ebp - 0xd98]
cmp dword [ebp - 0x175c], eax
jne 0x47f14a
mov dword [ebp - 0x1f04], 1
jmp 0x47f151
and dword [ebp - 0x1f04], 0
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0x824]
cmp dword [ebp - 0x1f04], eax
jl 0x47f172
mov dword [ebp - 0x1764], 1
jmp 0x47f179
and dword [ebp - 0x1764], 0
mov eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x1764]
mov dword [ebp + eax*4 - 0x13c], ecx
jmp 0x47ef6f
mov byte [ebp - 0x316], 0
movzx eax, byte [ebp - 0x316]
test eax, eax
je 0x47f1ab
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x47ef3f
jmp 0x47eef5
movzx eax, byte [ebp - 0x456]
test eax, eax
je 0x47f2aa
mov dword [ebp - 0x3170], 1
mov dword [ebp - 0x38f0], 0xca4f833f
mov dword [ebp - 0x3178], 0x4fda0e60
mov dword [ebp - 0x3678], 0xffffffff
mov dword [ebp - 0x3180], 0
mov dword [ebp - 0x2294], 0xfffffffa
mov dword [ebp - 0x39a0], 0x59f451db
mov dword [ebp - 0x58], 0
jmp 0x47f21a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x47f230
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x3d90], 0xfffffffe
jmp 0x47f213
mov dword [ebp - 0x58], 0
jmp 0x47f240
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x47f256
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x3188], 0x88047d20
jmp 0x47f239
mov dword [ebp - 0x58], 0
jmp 0x47f266
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x47f27c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x37b4], 0x2a1e
jmp 0x47f25f
mov eax, dword [ebp - 0x2294]
inc eax
mov dword [ebp - 0x2294], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x37b4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x37b4], eax
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 0x4c4], 0xbe4438be
mov dword [ebp - 0xce4], 0xffff
mov dword [ebp - 0x2fe8], 0x20274952
mov dword [ebp - 0x2fe4], 0x20274952
mov dword [ebp - 0x2fe0], 0x20274952
mov dword [ebp - 0x2fdc], 0x20274952
mov dword [ebp - 0xbf8], 0x6e3e45bb
mov dword [ebp - 0x28e4], 0xfa2ef703
cmp dword [ebp - 0x4c4], 0
je 0x47f3c9
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x3680], eax
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0x4c4], eax
jne 0x47f32d
mov dword [ebp - 0xbf0], 1
jmp 0x47f334
and dword [ebp - 0xbf0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp + eax - 0x2fe8], ecx
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0xbf0]
jle 0x47f361
mov dword [ebp - 0x176c], 1
jmp 0x47f368
and dword [ebp - 0x176c], 0
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0x176c], eax
jge 0x47f382
mov dword [ebp - 0x1f0c], 1
jmp 0x47f389
and dword [ebp - 0x1f0c], 0
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0x1f0c], eax
jge 0x47f3a3
mov dword [ebp - 0x1774], 1
jmp 0x47f3aa
and dword [ebp - 0x1774], 0
mov eax, dword [ebp - 0x1774]
add eax, 0x4e828d47
cmp dword [ebp - 0x4c4], eax
jne 0x47f3c9
mov dword [ebp - 0x245c], 1
jmp 0x47f3d0
and dword [ebp - 0x245c], 0
mov eax, dword [ebp - 0x245c]
mov dword [ebp - 0xbf8], eax
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0x3190], eax
mov eax, dword [ebp - 0x4c4]
sub eax, 0x22a5bc4
jne 0x47f407
cmp dword [ebp - 0xbf8], 0
jne 0x47f407
and dword [ebp - 0x177c], 0
jmp 0x47f411
mov dword [ebp - 0x177c], 1
mov eax, dword [ebp - 0x177c]
mov dword [ebp - 0x28e4], eax
mov byte [ebp - 0x318], 0
movzx eax, byte [ebp - 0x318]
test eax, eax
je 0x47f44f
push 0x57c
push 0x2703
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [ebp - 0x5b4]
cmp dword [ebp + eax*4 - 0x3bd4], 0
je 0x47f461
jmp 0x47f466
jmp 0x47e089
jmp 0x47d9a7
mov dword [ebp - 0xe0], 0x3837aced
mov dword [ebp - 0x388], 0xde2a9078
mov dword [ebp - 0xd54], 0x3c095b67
mov dword [ebp - 0xc00], 0xffffffff
mov dword [ebp - 0x22ac], 1
mov dword [ebp - 0x1e8], 0
jmp 0x47f4b6
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jge 0x47f4d2
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x37c4], 0x5ffff323
jmp 0x47f4a9
mov dword [ebp - 0x1e8], 0
jmp 0x47f4eb
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jge 0x47f507
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x3bec], 1
jmp 0x47f4de
cmp dword [ebp - 0xe0], 0
je 0x47f6b3
cmp dword [ebp - 0xe0], 0
jne 0x47f52b
or eax, 0xffffffff
jne 0x47f52b
and dword [ebp - 0x1f14], 0
jmp 0x47f535
mov dword [ebp - 0x1f14], 1
mov eax, dword [ebp - 0x388]
add eax, dword [ebp - 0x1f14]
cmp eax, 0xe1bfedaa
jbe 0x47f55a
cmp dword [ebp - 0xe0], 0
jne 0x47f55a
and dword [ebp - 0x1784], 0
jmp 0x47f564
mov dword [ebp - 0x1784], 1
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x1784], eax
jne 0x47f57e
mov dword [ebp - 0x229c], 1
jmp 0x47f585
and dword [ebp - 0x229c], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x229c], eax
jge 0x47f59f
mov dword [ebp - 0x178c], 1
jmp 0x47f5a6
and dword [ebp - 0x178c], 0
mov eax, dword [ebp - 0x178c]
sub eax, dword [ebp - 0x388]
cmp eax, 0xfffd
ja 0x47f5c5
mov dword [ebp - 0x1f1c], 1
jmp 0x47f5cc
and dword [ebp - 0x1f1c], 0
cmp dword [ebp - 0x1f1c], 0xfd52a42b
jbe 0x47f5e4
mov dword [ebp - 0x1794], 1
jmp 0x47f5eb
and dword [ebp - 0x1794], 0
mov eax, dword [ebp - 0x1794]
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0xd54]
neg eax
cmp dword [ebp - 0xe0], eax
jge 0x47f613
mov dword [ebp - 0x2df8], 1
jmp 0x47f61a
and dword [ebp - 0x2df8], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x38f8], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x3198], eax
cmp dword [ebp - 0x388], 0
je 0x47f650
cmp dword [ebp - 0xd54], 0
je 0x47f650
mov dword [ebp - 0x2604], 1
jmp 0x47f657
and dword [ebp - 0x2604], 0
mov eax, dword [ebp - 0x2604]
neg eax
cmp eax, dword [ebp - 0xe0]
jne 0x47f673
mov dword [ebp - 0x179c], 1
jmp 0x47f67a
and dword [ebp - 0x179c], 0
cmp dword [ebp - 0x179c], 0xffff
je 0x47f692
mov dword [ebp - 0x1f24], 1
jmp 0x47f699
and dword [ebp - 0x1f24], 0
imul eax, dword [ebp - 0x1f24], 0xa94f
test eax, eax
je 0x47f6b3
mov dword [ebp - 0x17a4], 1
jmp 0x47f6ba
and dword [ebp - 0x17a4], 0
mov eax, dword [ebp - 0x17a4]
neg eax
jne 0x47f6d2
xor eax, eax
inc eax
jne 0x47f6d2
and dword [ebp - 0x22a4], 0
jmp 0x47f6dc
mov dword [ebp - 0x22a4], 1
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x22a4], eax
jle 0x47f6f6
mov dword [ebp - 0x17ac], 1
jmp 0x47f6fd
and dword [ebp - 0x17ac], 0
mov eax, dword [ebp - 0x17ac]
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0x1f2c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1f2c]
mov dword [ebp + eax - 0x37c4], ecx
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x1f2c]
test eax, eax
jne 0x47f750
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x37c4], 0
jne 0x47f750
and dword [ebp - 0x17b4], 0
jmp 0x47f75a
mov dword [ebp - 0x17b4], 1
mov eax, dword [ebp - 0x17b4]
imul eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2464], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2464]
mov dword [ebp + eax - 0x3bec], ecx
cmp dword [ebp - 0x2464], 0
jne 0x47f79b
cmp dword [ebp - 0xc00], 0
jne 0x47f79b
and dword [ebp - 0x17bc], 0
jmp 0x47f7a5
mov dword [ebp - 0x17bc], 1
mov eax, dword [ebp - 0x388]
add eax, dword [ebp - 0x17bc]
imul eax, eax, 0x9323
cmp eax, dword [ebp - 0x22ac]
jl 0x47f7cb
mov dword [ebp - 0x1f34], 1
jmp 0x47f7d2
and dword [ebp - 0x1f34], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x1f34], eax
jle 0x47f7ec
mov dword [ebp - 0x17c4], 1
jmp 0x47f7f3
and dword [ebp - 0x17c4], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x17c4], eax
jg 0x47f80d
mov dword [ebp - 0x28ec], 1
jmp 0x47f814
and dword [ebp - 0x28ec], 0
push 0xfffffffffffffff7
pop eax
cmp eax, 4
je 0x47f828
mov dword [ebp - 0x17cc], 1
jmp 0x47f82f
and dword [ebp - 0x17cc], 0
mov eax, dword [ebp - 0x22ac]
cmp dword [ebp - 0x17cc], eax
jge 0x47f849
mov dword [ebp - 0x1f3c], 1
jmp 0x47f850
and dword [ebp - 0x1f3c], 0
cmp dword [ebp - 0x1f3c], 0xf4b
jge 0x47f868
mov dword [ebp - 0x17d4], 1
jmp 0x47f86f
and dword [ebp - 0x17d4], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x17d4], eax
je 0x47f8a3
mov byte [ebp - 0x436], 0
movzx eax, byte [ebp - 0x436]
test eax, eax
je 0x47f8a1
push 0x1916
push 0xa55
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x47f8e9
mov byte [ebp - 0x31a], 0
movzx eax, byte [ebp - 0x31a]
test eax, eax
je 0x47f8e9
push 0
push 0x2584
push 0x11e5
push 0x897
push 0x624
push 0x36a
push 0x869
push 0x4c9
push 0x199e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call fcn.00473172
mov dword [ebp - 0x544], 0x571177e8
mov dword [ebp - 0x4cc], 9
mov dword [ebp - 0x544], 0x13
jmp 0x47f91b
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0xfffffff1
jl 0x47fb32
mov dword [ebp - 0x17e4], 0xcce1
mov dword [ebp - 0x17dc], 0
mov eax, dword [ebp - 0x17e4]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0
je 0x47faf7
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0x2cc4], 0
mov dword [ebp - 0xa18], 0
jmp 0x47f982
mov eax, dword [ebp - 0xa18]
inc eax
mov dword [ebp - 0xa18], eax
cmp dword [ebp - 0xa18], 3
jge 0x47f99e
mov eax, dword [ebp - 0xa18]
mov dword [ebp + eax*4 - 0x3c04], 0
jmp 0x47f975
cmp dword [ebp - 0x544], 0
je 0x47f9bc
mov eax, 0xffff
test eax, eax
je 0x47f9bc
mov dword [ebp - 0x2544], 1
jmp 0x47f9c3
and dword [ebp - 0x2544], 0
mov eax, dword [ebp - 0x2544]
mov dword [ebp - 0x17dc], eax
mov eax, dword [ebp - 0x4cc]
imul eax, dword [ebp - 0x17dc]
cmp eax, dword [ebp - 0x60c]
jge 0x47f9f0
mov dword [ebp - 0x1f44], 1
jmp 0x47f9f7
and dword [ebp - 0x1f44], 0
cmp dword [ebp - 0x1f44], 0xffffffff
jbe 0x47fa0c
mov dword [ebp - 0xcec], 1
jmp 0x47fa13
and dword [ebp - 0xcec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xcec]
mov dword [ebp + eax - 0x3c04], ecx
mov eax, dword [ebp - 0x17e4]
cmp dword [ebp - 0xcec], eax
jle 0x47fa3f
mov dword [ebp - 0x2b90], 1
jmp 0x47fa46
and dword [ebp - 0x2b90], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3688], eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x31a0], eax
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x544], eax
je 0x47fa78
mov dword [ebp - 0x28f4], 1
jmp 0x47fa7f
and dword [ebp - 0x28f4], 0
imul eax, dword [ebp - 0x4cc], 0xffffffff
cmp eax, 0x5475
jne 0x47fa99
mov dword [ebp - 0x22b4], 1
jmp 0x47faa0
and dword [ebp - 0x22b4], 0
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x22b4], eax
jl 0x47faba
mov dword [ebp - 0x17ec], 1
jmp 0x47fac1
and dword [ebp - 0x17ec], 0
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x17ec], eax
jl 0x47fadb
mov dword [ebp - 0x1f4c], 1
jmp 0x47fae2
and dword [ebp - 0x1f4c], 0
mov eax, dword [ebp - 0x60c]
imul eax, dword [ebp - 0x1f4c]
mov dword [ebp - 0x2cc4], eax
jmp 0x47fb2d
mov dword [ebp - 0x17f4], 0x497f3c88
mov byte [ebp - 0x44c], 0
movzx eax, byte [ebp - 0x44c]
test eax, eax
je 0x47fb20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [ebp - 0x17f4]
inc eax
mov dword [ebp - 0x17f4], eax
jmp 0x47f90e
mov dword [ebp - 0x50c], 1
mov dword [ebp - 0x22bc], 0xe637c5b1
mov dword [ebp - 0x246c], 0x8a922a19
mov dword [ebp - 0x50c], 0
jmp 0x47fb69
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 7
jl 0x47fdf0
mov dword [ebp - 0x2f4], 0x85c6f1bf
mov dword [ebp - 0xc08], 6
mov dword [ebp - 0x2f4], 0
jmp 0x47fba3
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xffffffe6
jle 0x47fdeb
mov dword [ebp - 0x390], 7
mov dword [ebp - 0x1f54], 0xfffffffa
mov dword [ebp - 0x82c], 0
jmp 0x47fbdd
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 1
jge 0x47fbf9
mov eax, dword [ebp - 0x82c]
mov dword [ebp + eax*4 - 0x834], 0x8d13034d
jmp 0x47fbd0
mov byte [ebp - 0x31c], 0
movzx eax, byte [ebp - 0x31c]
test eax, eax
je 0x47fc21
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
mov dword [ebp - 0x390], 0
jmp 0x47fc3a
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0
jg 0x47fde6
mov dword [ebp - 0x988], 0
jmp 0x47fc60
mov eax, dword [ebp - 0x988]
inc eax
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x988], 3
jge 0x47fc7c
mov eax, dword [ebp - 0x988]
mov dword [ebp + eax*4 - 0x3c1c], 0x25d3c095
jmp 0x47fc53
xor eax, eax
sub eax, dword [ebp - 0x2f4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x834]
mov dword [ebp - 0xc08], eax
cmp dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x390]
mov eax, dword [ebp + eax*4 - 0x834]
mov dword [ebp - 0x246c], eax
cmp dword [ebp - 0x246c], 0x75cf8b87
je 0x47fcca
mov dword [ebp - 0x28fc], 1
jmp 0x47fcd1
and dword [ebp - 0x28fc], 0
mov eax, dword [ebp - 0x22bc]
mov dword [ebp - 0x39f8], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x31a8], eax
imul eax, dword [ebp - 0x2f4], 3
test eax, eax
jne 0x47fd0d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x834], 0
jne 0x47fd0d
and dword [ebp - 0x17fc], 0
jmp 0x47fd17
mov dword [ebp - 0x17fc], 1
mov eax, dword [ebp - 0x17fc]
mov dword [ebp - 0x1f54], eax
mov eax, dword [ebp - 0x1f54]
cmp dword [ebp - 0x390], eax
jg 0x47fd3d
mov dword [ebp - 0x1804], 1
jmp 0x47fd44
and dword [ebp - 0x1804], 0
imul eax, dword [ebp - 0x1804], 0x5193
sub eax, dword [ebp - 0x22bc]
cmp dword [ebp - 0x2f4], eax
je 0x47fd6e
cmp dword [ebp - 0x50c], 0
jne 0x47fd6e
and dword [ebp - 0x180c], 0
jmp 0x47fd78
mov dword [ebp - 0x180c], 1
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x180c], eax
je 0x47fd92
mov dword [ebp - 0x1f5c], 1
jmp 0x47fd99
and dword [ebp - 0x1f5c], 0
mov eax, dword [ebp - 0x390]
mov eax, dword [ebp + eax*4 - 0x834]
cmp eax, dword [ebp - 0x1f5c]
jne 0x47fdba
mov dword [ebp - 0x1814], 1
jmp 0x47fdc1
and dword [ebp - 0x1814], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1814]
mov dword [ebp + eax - 0x3c1c], ecx
cmp dword [ebp - 0xc08], 0
je 0x47fde1
jmp 0x47fc2d
jmp 0x47fc2d
jmp 0x47fb96
jmp 0x47fb5c
mov dword [ebp - 0x1f0], 0xfffffff6
mov dword [ebp - 0x2904], 0xfffffff8
mov dword [ebp - 0x2d90], 0xfa90ef87
mov dword [ebp - 0x238], 0
jmp 0x47fe27
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 4
jge 0x47fe43
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x2e30], 0xc85f70ad
jmp 0x47fe1a
mov dword [ebp - 0x238], 0
jmp 0x47fe5c
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x47fe75
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x80], 0
jmp 0x47fe4f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x80], 0
jmp 0x47fe9a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x80], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x80], 3
jg 0x48026e
mov dword [ebp - 0x398], 0xffffffff
mov dword [ebp - 0x3a0], 0xa90c6d21
mov dword [ebp - 0x5bc], 0x9a20b287
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
mov eax, dword [ebp + eax*4 - 0x2e30]
mov dword [ebp - 0x3690], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
mov eax, dword [ebp + eax*4 - 0x2e30]
mov dword [ebp - 0x25d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
mov ecx, dword [ebp - 0x25d4]
mov dword [ebp + eax*4 - 0x2e30], ecx
cmp dword [ebp - 0x25d4], 0
jne 0x47ff70
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
cmp dword [ebp + eax*4 - 0x2e30], 1
jge 0x47ff37
mov dword [ebp - 0x181c], 1
jmp 0x47ff3e
and dword [ebp - 0x181c], 0
mov eax, dword [ebp - 0x181c]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jbe 0x47ff67
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
cmp dword [ebp + eax*4 - 0x2e30], 0
jne 0x47ff70
and dword [ebp - 0x2b98], 0
jmp 0x47ff7a
mov dword [ebp - 0x2b98], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
mov dword [ebp - 0x31b0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x80]
cmp dword [ebp + eax - 0x80], ecx
jg 0x47ffac
mov dword [ebp - 0x1f64], 1
jmp 0x47ffb3
and dword [ebp - 0x1f64], 0
mov eax, dword [ebp - 0x1f64]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x5bc]
cmp dword [ebp - 0x1f0], eax
jl 0x47ffe5
mov dword [ebp - 0x1824], 1
jmp 0x47ffec
and dword [ebp - 0x1824], 0
mov eax, dword [ebp - 0x1824]
sub eax, 4
mov dword [ebp - 0x2904], eax
mov dword [ebp - 0x5bc], 0x19
jmp 0x480014
mov eax, dword [ebp - 0x5bc]
dec eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0xffffffee
jge 0x480269
mov dword [ebp - 0xd80], 0xab8d2321
mov dword [ebp - 0xa8c], 0
jmp 0x480044
mov eax, dword [ebp - 0xa8c]
inc eax
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 4
jge 0x480060
mov eax, dword [ebp - 0xa8c]
mov dword [ebp + eax*4 - 0x3c74], 0xa06c
jmp 0x480037
cmp dword [ebp - 0x1f0], 0
je 0x48014d
mov dword [ebp - 0x83c], 0
jmp 0x480086
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 3
jge 0x4800a2
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x3bc8], 0xffffffff
jmp 0x480079
mov dword [ebp - 0x3a0], 0xffffffe8
jmp 0x4800bb
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
jge 0x4800d8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3bc8], 0
je 0x4800d6
jmp 0x4800d8
jmp 0x4800ae
mov dword [ebp - 0x398], 0
jmp 0x4800f1
mov eax, dword [ebp - 0x398]
dec eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0xfffffffa
jge 0x480148
mov dword [ebp - 0x1f0], 0
jmp 0x480113
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jg 0x480134
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80]
cmp dword [ebp + eax*4 - 0x2e30], 0
je 0x480132
jmp 0x480134
jmp 0x480106
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e30], 0
je 0x480146
jmp 0x4800e4
jmp 0x4800e4
jmp 0x480264
mov dword [ebp - 0x1834], 0x9e8b
mov eax, dword [ebp - 0xd80]
mov dword [ebp - 0x2d90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x80], 0x7cf8
jne 0x48017f
mov dword [ebp - 0x183c], 1
jmp 0x480186
and dword [ebp - 0x183c], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0xd80], eax
jge 0x4801a0
mov dword [ebp - 0x22c4], 1
jmp 0x4801a7
and dword [ebp - 0x22c4], 0
mov eax, dword [ebp - 0x1834]
cmp dword [ebp - 0x22c4], eax
je 0x4801c1
mov dword [ebp - 0x182c], 1
jmp 0x4801c8
and dword [ebp - 0x182c], 0
mov eax, dword [ebp - 0x398]
add eax, dword [ebp - 0x182c]
cmp dword [ebp - 0x3a0], eax
jle 0x4801e8
mov dword [ebp - 0x1f6c], 1
jmp 0x4801ef
and dword [ebp - 0x1f6c], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x1f6c], eax
jle 0x480209
mov dword [ebp - 0x2474], 1
jmp 0x480210
and dword [ebp - 0x2474], 0
mov eax, dword [ebp - 0x1834]
cmp dword [ebp - 0x2474], eax
jne 0x48022a
mov dword [ebp - 0x1844], 1
jmp 0x480231
and dword [ebp - 0x1844], 0
mov eax, dword [ebp - 0x183c]
neg eax
mov dword [ebp - 0x1f74], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f74]
mov dword [ebp + eax - 0x3c74], ecx
mov eax, dword [ebp - 0x1f74]
sub eax, dword [ebp - 0x1844]
mov dword [ebp - 0xd80], eax
jmp 0x480007
jmp 0x47fe85
mov byte [ebp - 0x438], 0
movzx eax, byte [ebp - 0x438]
test eax, eax
je 0x480292
push 0x136f
push 0x1d79
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 0x38], 0x3f4f46db
mov dword [ebp - 0x100], 0xf89b5461
mov dword [ebp - 0xc10], 0
mov dword [ebp - 0x2bc], 0xb28787d
mov dword [ebp - 0x184c], 1
mov dword [ebp - 0xcf4], 3
mov dword [ebp - 0x990], 0
jmp 0x4802e4
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 4
jge 0x480300
mov eax, dword [ebp - 0x990]
mov dword [ebp + eax*4 - 0x3c8c], 3
jmp 0x4802d7
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x3900], eax
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x31b8], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x100], eax
jne 0x480332
mov dword [ebp - 0x290c], 1
jmp 0x480339
and dword [ebp - 0x290c], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x3698], eax
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0xc10]
imul eax, eax, 0xfff6
imul eax, dword [ebp - 0x100]
test eax, eax
jl 0x48036f
mov dword [ebp - 0x2ba0], 1
jmp 0x480376
and dword [ebp - 0x2ba0], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x2bc], eax
je 0x480390
mov dword [ebp - 0x22cc], 1
jmp 0x480397
and dword [ebp - 0x22cc], 0
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x22cc]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2914], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2914]
mov dword [ebp + eax - 0x3c8c], ecx
mov dword [ebp - 0x184c], 0xffff
mov eax, dword [ebp - 0x184c]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0xcf4], eax
jle 0x480650
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x844], 0
jmp 0x480413
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 2
jge 0x48042f
mov eax, dword [ebp - 0x844]
mov dword [ebp + eax*4 - 0x2f14], 0
jmp 0x480406
mov dword [ebp - 0x100], 0
jmp 0x480448
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jne 0x480623
mov dword [ebp - 0x254c], 0xfffffff9
mov dword [ebp - 0xa20], 0
jmp 0x480478
mov eax, dword [ebp - 0xa20]
inc eax
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0xa20], 2
jge 0x480494
mov eax, dword [ebp - 0xa20]
mov dword [ebp + eax*4 - 0x2c28], 6
jmp 0x48046b
mov dword [ebp - 0x2bc], 0
jmp 0x4804ad
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xf
jg 0x48061e
mov dword [ebp - 0x84c], 0
jmp 0x4804d3
mov eax, dword [ebp - 0x84c]
inc eax
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 4
jge 0x4804ef
mov eax, dword [ebp - 0x84c]
mov dword [ebp + eax*4 - 0x3ca4], 0xfffffff6
jmp 0x4804c6
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3ca4]
cmp dword [ebp + eax - 0x2f14], ecx
je 0x480517
mov dword [ebp - 0x1f7c], 1
jmp 0x48051e
and dword [ebp - 0x1f7c], 0
cmp dword [ebp - 0x1f7c], 0x84cb
jge 0x480536
mov dword [ebp - 0x1854], 1
jmp 0x48053d
and dword [ebp - 0x1854], 0
mov eax, dword [ebp - 0x254c]
add eax, dword [ebp - 0x1854]
add eax, dword [ebp - 0x254c]
cmp eax, 0x197c
jl 0x480562
mov dword [ebp - 0x185c], 1
jmp 0x480569
and dword [ebp - 0x185c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c28]
mov ecx, dword [ebp - 0xc18]
add ecx, dword [ebp - 0x185c]
sub eax, ecx
mov dword [ebp - 0x2ccc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c28]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2c28], eax
cmp dword [ebp - 0x2ccc], 0xce695ef2
je 0x4805bd
mov dword [ebp - 0x1f84], 1
jmp 0x4805c4
and dword [ebp - 0x1f84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f14]
cmp eax, dword [ebp - 0x1f84]
jg 0x4805e5
mov dword [ebp - 0x1864], 1
jmp 0x4805ec
and dword [ebp - 0x1864], 0
mov eax, dword [ebp - 0x1864]
mov dword [ebp - 0xc18], eax
mov byte [ebp - 0x31e], 0
movzx eax, byte [ebp - 0x31e]
test eax, eax
je 0x480619
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x4804a0
jmp 0x48043b
cmp dword [ebp - 0xcf4], 0xe617092f
je 0x48063b
mov dword [ebp - 0x22d4], 1
jmp 0x480642
and dword [ebp - 0x22d4], 0
mov eax, dword [ebp - 0x22d4]
mov dword [ebp - 0xc18], eax
jmp 0x480674
mov byte [ebp - 0x45c], 0
movzx eax, byte [ebp - 0x45c]
test eax, eax
je 0x480674
push 0x22b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0xd0c], 0xcb5af9f7
mov dword [ebp - 0x998], 3
mov dword [ebp - 0x2ba8], 0
mov dword [ebp - 0x31c0], 4
mov dword [ebp - 0x998], 0
jmp 0x4806b5
mov eax, dword [ebp - 0x998]
dec eax
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x998], 0xfffffff6
jne 0x480708
mov dword [ebp - 0x291c], 0xffffffff
mov eax, dword [ebp - 0x291c]
mov dword [ebp - 0x39a8], eax
mov dword [ebp - 0x2ba8], 0xffab8c3a
mov byte [ebp - 0x320], 0
movzx eax, byte [ebp - 0x320]
test eax, eax
je 0x480706
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
jmp 0x4806a8
mov dword [ebp - 0x854], 1
mov dword [ebp - 0x1f94], 0xd4a0d461
mov dword [ebp - 0x85c], 0xeb4c8f0d
mov dword [ebp - 0xa68], 0x996a5308
mov dword [ebp - 0xc20], 0xb64d07dd
mov dword [ebp - 0x2cd4], 0xb270
mov dword [ebp - 0x98], 0
jmp 0x48075d
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x480779
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x4d4], 0
jmp 0x480750
mov dword [ebp - 0x98], 0
jmp 0x480792
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x4807ae
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x3008], 0x84dcc80f
jmp 0x480785
mov dword [ebp - 0x98], 0
jmp 0x4807c7
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x4807e3
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x2eb4], 1
jmp 0x4807ba
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x2eb4], 0x8380
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x3008]
mov dword [ebp - 0x2924], eax
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x2dd8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2eb4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2eb4], eax
mov eax, dword [ebp - 0x2924]
cmp eax, dword [ebp - 0x2dd8]
jle 0x480848
mov dword [ebp - 0xd5c], 1
jmp 0x48084f
and dword [ebp - 0xd5c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xd5c]
mov dword [ebp + eax - 0x3008], ecx
cmp dword [ebp - 0xd5c], 9
jge 0x480877
mov dword [ebp - 0x186c], 1
jmp 0x48087e
and dword [ebp - 0x186c], 0
mov eax, dword [ebp - 0x854]
add eax, dword [ebp - 0x186c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x4d4]
jne 0x4808a5
mov dword [ebp - 0x1f8c], 1
jmp 0x4808ac
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x854]
cmp eax, dword [ebp - 0x1f8c]
jg 0x4808c6
mov dword [ebp - 0x1874], 1
jmp 0x4808cd
and dword [ebp - 0x1874], 0
mov eax, dword [ebp - 0x854]
cmp eax, dword [ebp - 0x1874]
jl 0x4808e7
mov dword [ebp - 0x247c], 1
jmp 0x4808ee
and dword [ebp - 0x247c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d4]
imul eax, dword [ebp - 0x247c]
cmp eax, 6
jl 0x480913
mov dword [ebp - 0x187c], 1
jmp 0x48091a
and dword [ebp - 0x187c], 0
mov eax, dword [ebp - 0x187c]
mov dword [ebp - 0x854], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4d4], 0x8fbd
jle 0x480949
xor eax, eax
je 0x480949
mov dword [ebp - 0x292c], 1
jmp 0x480950
and dword [ebp - 0x292c], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x4d4], 3
cmp eax, dword [ebp - 0xa68]
je 0x480972
mov dword [ebp - 0x2bb0], 1
jmp 0x480979
and dword [ebp - 0x2bb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d4]
mov dword [ebp - 0x31c8], eax
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x2934], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2934]
mov dword [ebp + eax - 0x3008], ecx
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x36a0], eax
mov eax, dword [ebp - 0x2cd4]
add eax, dword [ebp - 0x85c]
jne 0x4809cb
cmp dword [ebp - 0x85c], 0
cmp dword [ebp - 0x1f94], 0xf58d
jge 0x4809de
cmp dword [ebp - 0x1f94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d4]
imul eax, dword [ebp - 0xa68]
test eax, eax
je 0x480a06
xor eax, eax
je 0x480a06
mov dword [ebp - 0x1884], 1
jmp 0x480a0d
and dword [ebp - 0x1884], 0
mov eax, dword [ebp - 0xc20]
cmp dword [ebp - 0x1884], eax
jl 0x480a27
mov dword [ebp - 0x293c], 1
jmp 0x480a2e
and dword [ebp - 0x293c], 0
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0x31d0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3008]
mov dword [ebp - 0x3908], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2eb4]
mov dword [ebp - 0x31d8], eax
cmp dword [ebp - 0xa68], 0
jne 0x480a75
xor eax, eax
jne 0x480a75
and dword [ebp - 0x22dc], 0
jmp 0x480a7f
mov dword [ebp - 0x22dc], 1
mov eax, dword [ebp - 0x22dc]
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x9a0], 0
jmp 0x480aa4
mov eax, dword [ebp - 0x9a0]
inc eax
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 3
jge 0x480ac0
mov eax, dword [ebp - 0x9a0]
mov dword [ebp + eax*4 - 0xdc0], 0xfffffffb
jmp 0x480a97
mov dword [ebp - 0x3a8], 0x2e91a04
mov dword [ebp - 0xcfc], 0xc25b
mov dword [ebp - 0x2bb8], 0x97515801
mov dword [ebp - 0x3a8], 0
jmp 0x480af7
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0xd
jge 0x480b51
mov dword [ebp - 0x864], 0xffffffff
mov dword [ebp - 0x864], 0
jmp 0x480b23
mov eax, dword [ebp - 0x864]
dec eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0xfffffff4
jle 0x480b4f
mov byte [ebp - 0x43a], 0
movzx eax, byte [ebp - 0x43a]
test eax, eax
je 0x480b4d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
jmp 0x480b16
jmp 0x480aea
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0xcfc], eax
jle 0x480b6b
mov dword [ebp - 0x188c], 1
jmp 0x480b72
and dword [ebp - 0x188c], 0
cmp dword [ebp - 0x188c], 0x2a3b3f36
jge 0x480b8a
mov dword [ebp - 0x189c], 1
jmp 0x480b91
and dword [ebp - 0x189c], 0
cmp dword [ebp - 0x3a8], 0x16542076
jle 0x480ba9
mov dword [ebp - 0x1f9c], 1
jmp 0x480bb0
and dword [ebp - 0x1f9c], 0
mov eax, dword [ebp - 0x2bb8]
cmp dword [ebp - 0x1f9c], eax
jge 0x480bca
mov dword [ebp - 0x1894], 1
jmp 0x480bd1
and dword [ebp - 0x1894], 0
cmp dword [ebp - 0x1894], 0
jle 0x480be6
mov dword [ebp - 0x262c], 1
jmp 0x480bed
and dword [ebp - 0x262c], 0
mov eax, dword [ebp - 0xcfc]
cmp eax, dword [ebp - 0x262c]
jge 0x480c0d
cmp dword [ebp - 0xcfc], 0
jne 0x480c0d
and dword [ebp - 0x1fa4], 0
jmp 0x480c17
mov dword [ebp - 0x1fa4], 1
mov eax, dword [ebp - 0x189c]
cmp eax, dword [ebp - 0x1fa4]
jne 0x480c31
mov dword [ebp - 0x18a4], 1
jmp 0x480c38
and dword [ebp - 0x18a4], 0
mov eax, dword [ebp - 0x18a4]
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x38], 2
jmp 0x480c54
cmp dword [ebp - 0x38], 0
jl 0x481a42
mov dword [ebp - 0x18cc], 0xd0d658ed
mov dword [ebp - 0x18bc], 0x95dbc2a4
mov dword [ebp - 0x18d4], 0xfffa
mov dword [ebp - 0xa28], 0
jmp 0x480c95
mov eax, dword [ebp - 0xa28]
inc eax
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0xa28], 3
jge 0x480cb1
mov eax, dword [ebp - 0xa28]
mov dword [ebp + eax*4 - 0xac4], 0xb110c93b
jmp 0x480c88
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xac4], 0xc
jmp 0x480cdc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xac4], 0xffffffe4
je 0x480fb2
mov dword [ebp - 0xe2c], 0xb57fd546
mov dword [ebp - 0xe28], 0xb57fd546
mov dword [ebp - 0xe24], 0xb57fd546
mov dword [ebp - 0xe20], 0xb57fd546
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0xa70], 0x911b9c6f
mov dword [ebp - 0x2974], 0xec6b039b
mov dword [ebp - 0x52c], 3
jmp 0x481aa1
cmp dword [ebp - 0x52c], 0
jl 0x481f21
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x36b8], 3
mov dword [ebp - 0x88], 9
mov dword [ebp - 0x894], 0
jmp 0x481ae5
cmp dword [ebp - 0x894], 2
jge 0x481b01
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0x38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc0]
mov dword [ebp - 0xd0c], eax
mov dword [ebp - 0xb48], 0xffffffff
mov dword [ebp - 0xb44], 0xffffffff
mov dword [ebp - 0xb40], 0xffffffff
mov dword [ebp - 0xb3c], 0xffffffff
mov dword [ebp - 0x44], 0x29000d4e
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0x44], 0
jmp 0x481f86
cmp dword [ebp - 0x44], 3
jg 0x482231
mov dword [ebp - 0xf0], 6
mov dword [ebp - 0x2034], 0
mov dword [ebp - 0x2cfc], 0x5e314a5e
mov dword [ebp - 0x9c0], 0
jmp 0x482288
mov eax, dword [ebp - 0x9c0]
inc eax
mov dword [ebp - 0x9c0], eax
cmp dword [ebp - 0x9c0], 3
jge 0x4822a4
mov eax, dword [ebp - 0x9c0]
mov dword [ebp + eax*4 - 0x2644], 0xdc85f70a
jmp 0x48227b
mov dword [ebp - 0xf0], 0
jmp 0x4822bd
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x4823e8
mov byte [ebp - 0x326], 0
movzx eax, byte [ebp - 0x326]
test eax, eax
je 0x4822fc
push 0
push 0x2515
push 0x12d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0x2644], 0
je 0x4823bf
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x2644]
mov dword [ebp - 0x3218], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0x2644], 0
je 0x4823bf
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp + eax*4 - 0x2644], 0xbacd
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2644]
cmp eax, dword [ebp - 0xf0]
jg 0x48236a
mov dword [ebp - 0x19bc], 1
jmp 0x482371
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x19bc]
mov dword [ebp - 0x2034], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x2644]
cmp dword [ebp - 0x2034], eax
jl 0x48239e
mov dword [ebp - 0x19c4], 1
jmp 0x4823a5
and dword [ebp - 0x19c4], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x19c4]
je 0x4823bf
mov dword [ebp - 0x2994], 1
jmp 0x4823c6
and dword [ebp - 0x2994], 0
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x2644]
mov dword [ebp - 0x36c8], eax
mov dword [ebp - 0x2cfc], 1
jmp 0x4822b0
mov dword [ebp - 0xe4c], 0
mov dword [ebp - 0xe48], 0
mov dword [ebp - 0xe44], 0
mov dword [ebp - 0xe40], 0
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x8a4], 0
jmp 0x482430
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 1
jge 0x48244c
mov eax, dword [ebp - 0x8a4]
mov dword [ebp + eax*4 - 0x2be8], 0xffffffff
jmp 0x482423
mov dword [ebp - 0x30], 0
jmp 0x48245c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x48265f
mov dword [ebp - 0x204c], 0x3650dfa0
mov dword [ebp - 0x19d4], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xe4c], 0
jne 0x48250e
mov eax, dword [ebp - 0x204c]
mov dword [ebp - 0x3220], eax
mov eax, dword [ebp - 0x30]
or ecx, 0xffffffff
sub ecx, dword [ebp + eax*4 - 0xe4c]
cmp ecx, 0xc80f
je 0x4824c2
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xe4c], 0
jne 0x4824c2
and dword [ebp - 0x299c], 0
jmp 0x4824cc
mov dword [ebp - 0x299c], 1
mov eax, dword [ebp - 0x19d4]
mov dword [ebp - 0x3a00], eax
cmp dword [ebp - 0x30], 0
je 0x4824fa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe4c], 0
je 0x4824fa
mov dword [ebp - 0x232c], 1
jmp 0x482501
and dword [ebp - 0x232c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xe4c]
mov dword [ebp - 0x3228], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x19cc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19cc]
mov dword [ebp + eax - 0x2be8], ecx
cmp dword [ebp - 0x19cc], 0x5e19f8c5
je 0x48255b
mov eax, 0x23279329
test eax, eax
je 0x48255b
mov dword [ebp - 0x203c], 1
jmp 0x482562
and dword [ebp - 0x203c], 0
mov eax, dword [ebp - 0x203c]
sub eax, 0x152ddeb4
cmp eax, 0x5c12
jne 0x482586
cmp dword [ebp - 0x19d4], 0
jne 0x482586
and dword [ebp - 0x256c], 0
jmp 0x482590
mov dword [ebp - 0x256c], 1
imul eax, dword [ebp - 0x256c], 0xf996
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0xe4c]
cmp eax, dword [ebp - 0x30]
jge 0x4825b9
mov dword [ebp - 0x19dc], 1
jmp 0x4825c0
and dword [ebp - 0x19dc], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x19dc]
cmp eax, dword [ebp - 0x30]
jl 0x4825db
mov dword [ebp - 0x2044], 1
jmp 0x4825e2
and dword [ebp - 0x2044], 0
cmp dword [ebp - 0x2044], 0xfffe
jne 0x4825fa
mov dword [ebp - 0x19e4], 1
jmp 0x482601
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x19e4]
sub ecx, dword [ebp + eax*4 - 0xe4c]
mov eax, dword [ebp - 0x30]
cmp ecx, dword [ebp + eax*4 - 0xe4c]
je 0x482629
mov dword [ebp - 0x2334], 1
jmp 0x482630
and dword [ebp - 0x2334], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2334], eax
jg 0x482647
mov dword [ebp - 0x19ec], 1
jmp 0x48264e
and dword [ebp - 0x19ec], 0
mov eax, dword [ebp - 0x19ec]
mov dword [ebp - 0x204c], eax
jmp 0x482455
mov dword [ebp - 0x28c], 0x1928c176
mov dword [ebp - 0x1a04], 0xffff
mov dword [ebp - 0x28c], 0xffffffee
jmp 0x48268c
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xfffffffd
jg 0x482949
mov dword [ebp - 0xd6c], 0xffffffff
mov dword [ebp - 0xc48], 0x105807c
mov dword [ebp - 0xa38], 0
jmp 0x4826c6
mov eax, dword [ebp - 0xa38]
inc eax
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0xa38], 1
jge 0x4826e2
mov eax, dword [ebp - 0xa38]
mov dword [ebp + eax*4 - 0xf8], 0xaa9ac70c
jmp 0x4826b9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf8], 0xffffffe5
jmp 0x482710
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0xfffffff0
jne 0x482944
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xf8]
cmp dword [ebp + eax - 0xf8], ecx
jne 0x48274c
mov dword [ebp - 0x19f4], 1
jmp 0x482753
and dword [ebp - 0x19f4], 0
cmp dword [ebp - 0x19f4], 0xf7d9
jne 0x482774
mov eax, 0x11db
test eax, eax
je 0x482774
mov dword [ebp - 0x24ac], 1
jmp 0x48277b
and dword [ebp - 0x24ac], 0
cmp dword [ebp - 0x24ac], 0xedc0
jle 0x482793
mov dword [ebp - 0x29a4], 1
jmp 0x48279a
and dword [ebp - 0x29a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x36d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x3230], eax
mov eax, 0x5fba
cmp eax, 1
jb 0x4827d6
mov dword [ebp - 0x19fc], 1
jmp 0x4827dd
and dword [ebp - 0x19fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x19fc], eax
jg 0x4827fe
mov dword [ebp - 0x2054], 1
jmp 0x482805
and dword [ebp - 0x2054], 0
mov eax, dword [ebp - 0x2054]
mov dword [ebp - 0x1a04], eax
mov eax, dword [ebp - 0x1a04]
cmp dword [ebp - 0x28c], eax
jl 0x48282b
mov dword [ebp - 0x233c], 1
jmp 0x482832
and dword [ebp - 0x233c], 0
mov eax, dword [ebp - 0xd6c]
cmp dword [ebp - 0x233c], eax
jge 0x48284c
mov dword [ebp - 0x1a0c], 1
jmp 0x482853
and dword [ebp - 0x1a0c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28c]
add ecx, dword [ebp - 0x1a0c]
cmp dword [ebp + eax - 0xf8], ecx
jle 0x48287a
mov dword [ebp - 0x205c], 1
jmp 0x482881
and dword [ebp - 0x205c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
add eax, dword [ebp - 0x205c]
cmp eax, 0xfffffff9
jg 0x4828ab
cmp dword [ebp - 0x28c], 0
jne 0x4828ab
and dword [ebp - 0x1a14], 0
jmp 0x4828b5
mov dword [ebp - 0x1a14], 1
mov eax, dword [ebp - 0xd6c]
imul eax, dword [ebp - 0x1a14]
cmp eax, dword [ebp - 0x28c]
je 0x4828d6
mov dword [ebp - 0x25e4], 1
jmp 0x4828dd
and dword [ebp - 0x25e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x25e4]
dec ecx
cmp dword [ebp + eax - 0xf8], ecx
jge 0x4828ff
mov dword [ebp - 0x1a1c], 1
jmp 0x482906
and dword [ebp - 0x1a1c], 0
mov eax, dword [ebp - 0xc48]
cmp dword [ebp - 0x1a1c], eax
jle 0x482920
mov dword [ebp - 0x2064], 1
jmp 0x482927
and dword [ebp - 0x2064], 0
mov eax, dword [ebp - 0x2064]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xd6c], eax
jmp 0x4826f5
jmp 0x48267f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0x3920], 0x1eb32a83
mov dword [ebp - 0x2de0], 1
mov dword [ebp - 0x3238], 0xce96b779
mov dword [ebp - 0x36d8], 1
mov dword [ebp - 0x3240], 0x1e2db80e
mov dword [ebp - 0x39b8], 0xffffffff
mov dword [ebp - 0x29b4], 0xfffffff7
mov dword [ebp - 0xc50], 0xb38e5161
mov dword [ebp - 0x240], 0
jmp 0x4829c3
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x4829df
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x3a98], 1
jmp 0x4829b6
mov dword [ebp - 0x240], 0
jmp 0x4829f8
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x482a14
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x3cf4], 0x48407374
jmp 0x4829eb
mov dword [ebp - 0x144], 0
jmp 0x482a2d
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jge 0x482a49
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x3a98], 0xd1e1e87d
jmp 0x482a20
mov dword [ebp - 0x144], 3
jmp 0x482a62
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x482bf5
mov dword [ebp - 0x8ac], 0x21ac4888
mov dword [ebp - 0x3248], 0x4b4b1328
mov dword [ebp - 0x36e0], 0x74579933
mov dword [ebp - 0x3250], 0x5e495761
mov dword [ebp - 0x2d0c], 0xffffffff
mov dword [ebp - 0x3928], 0x4b2e809b
mov dword [ebp - 0x3258], 0xda8db884
mov dword [ebp - 0x36e8], 0xb0a11721
mov dword [ebp - 0x3260], 8
mov dword [ebp - 0x2de0], 0
mov dword [ebp - 0x8ac], 0
jmp 0x482aec
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 3
jg 0x482bf0
mov dword [ebp - 0x3a28], 0xfffffffe
mov dword [ebp - 0x3268], 0xffffffff
mov dword [ebp - 0x36f0], 0xef2f37f
mov dword [ebp - 0x9c8], 0
jmp 0x482b30
mov eax, dword [ebp - 0x9c8]
inc eax
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 1
jge 0x482b4c
mov eax, dword [ebp - 0x9c8]
mov dword [ebp + eax*4 - 0x3270], 0xae3d4752
jmp 0x482b23
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp + eax*4 - 0x3a98]
mov dword [ebp - 0x29ac], eax
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0x2bf0], eax
mov eax, dword [ebp - 0xc50]
inc eax
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0x29ac]
cmp eax, dword [ebp - 0x2bf0]
jne 0x482b92
mov dword [ebp - 0x1a24], 1
jmp 0x482b99
and dword [ebp - 0x1a24], 0
cmp dword [ebp - 0x29b4], 0
je 0x482bb7
mov eax, 0xda781b5f
test eax, eax
je 0x482bb7
mov dword [ebp - 0x2344], 1
jmp 0x482bbe
and dword [ebp - 0x2344], 0
mov eax, dword [ebp - 0x1a24]
cmp eax, dword [ebp - 0x2344]
je 0x482bd8
mov dword [ebp - 0x1a2c], 1
jmp 0x482bdf
and dword [ebp - 0x1a2c], 0
mov eax, dword [ebp - 0x1a2c]
mov dword [ebp - 0x2d0c], eax
jmp 0x482adf
jmp 0x482a55
mov dword [ebp - 0x1cc], 3
mov dword [ebp - 0x3930], 0x5a136951
mov dword [ebp - 0x3278], 0x57bf5cd5
mov dword [ebp - 0x36f8], 5
mov dword [ebp - 0x2bf8], 0xeec54165
mov dword [ebp - 0x3280], 0xfffffffe
mov dword [ebp - 0x39c0], 0xfffffffc
mov dword [ebp - 0x29bc], 0x166941fc
mov dword [ebp - 0x3288], 0x2d3f5047
mov dword [ebp - 0x3700], 0xbcd76ce4
mov dword [ebp - 0x3290], 0x1d1b984
mov dword [ebp - 0x3938], 0xa53061ec
mov dword [ebp - 0x3298], 0
mov dword [ebp - 0x206c], 0
mov dword [ebp - 0xc], 0
jmp 0x482c91
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x482ca7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3e90], 0
jmp 0x482c8a
mov dword [ebp - 0xc], 0
jmp 0x482cb7
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x482ccd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3dfc], 1
jmp 0x482cb0
mov dword [ebp - 0xc], 0
jmp 0x482cdd
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x482cf3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3da8], 0xe75cb554
jmp 0x482cd6
mov dword [ebp - 0xc], 0
jmp 0x482d03
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x482d19
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3de4], 1
jmp 0x482cfc
mov eax, dword [ebp - 0x206c]
inc eax
mov dword [ebp - 0x206c], eax
mov eax, dword [ebp - 0x29bc]
mov dword [ebp - 0x2bf8], eax
mov dword [ebp - 0xc98], 0x64b9
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x46c], 0x6ab2aee5
mov dword [ebp - 0xd74], 0x2a7f
mov dword [ebp - 0x8b4], 0
jmp 0x482d7d
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 3
jge 0x482d99
mov eax, dword [ebp - 0x8b4]
mov dword [ebp + eax*4 - 0x2ee4], 0
jmp 0x482d70
mov dword [ebp - 0x290], 0xfffffff7
jmp 0x482db2
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xffffffec
jne 0x4832be
mov dword [ebp - 0x1a64], 0xe26a8acd
mov dword [ebp - 0x1a7c], 1
mov dword [ebp - 0x200], 0
jmp 0x482dec
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x482e08
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x3c0], 1
jmp 0x482ddf
mov dword [ebp - 0x200], 0
jmp 0x482e21
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x482e3d
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xd14], 0
jmp 0x482e14
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
mov dword [ebp - 0x3708], eax
mov eax, dword [ebp - 0x290]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x3c0]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
shl eax, 1
cmp eax, 0x6e7f737a
jne 0x482e84
mov dword [ebp - 0x1a34], 1
jmp 0x482e8b
and dword [ebp - 0x1a34], 0
mov eax, dword [ebp - 0x1a34]
sub eax, 0x7ce14dc7
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x46c], eax
jne 0x48328f
mov dword [ebp - 0x2354], 8
mov dword [ebp - 0x3b8], 7
mov dword [ebp - 0x2084], 1
mov dword [ebp - 0x280], 0
jmp 0x482ee5
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x482f01
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x3bf8], 4
jmp 0x482ed8
mov dword [ebp - 0x280], 0
jmp 0x482f1a
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x482f36
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x3454], 7
jmp 0x482f0d
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x32a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x2354]
cmp dword [ebp - 0x3b8], eax
jle 0x482f80
or eax, 0xffffffff
je 0x482f80
mov dword [ebp - 0x24b4], 1
jmp 0x482f87
and dword [ebp - 0x24b4], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x24b4], eax
jle 0x482fa1
mov dword [ebp - 0x1a3c], 1
jmp 0x482fa8
and dword [ebp - 0x1a3c], 0
imul eax, dword [ebp - 0x1a3c], 5
test eax, eax
jne 0x482fc5
mov eax, 0x1197
test eax, eax
jne 0x482fc5
and dword [ebp - 0x2074], 0
jmp 0x482fcf
mov dword [ebp - 0x2074], 1
cmp dword [ebp - 0x2074], 9
jg 0x482fe4
mov dword [ebp - 0x1a44], 1
jmp 0x482feb
and dword [ebp - 0x1a44], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1a44]
sub ecx, dword [ebp + eax - 0xd14]
mov dword [ebp - 0x46c], ecx
mov eax, dword [ebp - 0x560]
cmp dword [ebp - 0x46c], eax
jl 0x483027
cmp dword [ebp - 0x1a64], 0
je 0x483027
mov dword [ebp - 0x234c], 1
jmp 0x48302e
and dword [ebp - 0x234c], 0
mov eax, dword [ebp - 0x234c]
sub eax, dword [ebp - 0x290]
je 0x483045
cmp dword [ebp - 0xd74], 0
jne 0x483057
cmp dword [ebp - 0x3b8], 0
jne 0x483057
and dword [ebp - 0x1a4c], 0
jmp 0x483061
mov dword [ebp - 0x1a4c], 1
mov eax, dword [ebp - 0x1a4c]
neg eax
cmp eax, 0xffffffff
jle 0x48307a
mov dword [ebp - 0x207c], 1
jmp 0x483081
and dword [ebp - 0x207c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0x207c], eax
jge 0x4830ab
cmp dword [ebp - 0x3b8], 0
je 0x4830ab
mov dword [ebp - 0x1a54], 1
jmp 0x4830b2
and dword [ebp - 0x1a54], 0
cmp dword [ebp - 0x1a54], 2
jl 0x4830cd
cmp dword [ebp - 0x560], 0
jne 0x4830cd
and dword [ebp - 0x2578], 0
jmp 0x4830d7
mov dword [ebp - 0x2578], 1
mov eax, dword [ebp - 0x2578]
add eax, 0x5c318dc
cmp eax, 0x57e7
jge 0x4830f5
mov dword [ebp - 0x1a5c], 1
jmp 0x4830fc
and dword [ebp - 0x1a5c], 0
mov eax, dword [ebp - 0x1a5c]
mov dword [ebp - 0x2084], eax
mov eax, dword [ebp - 0x2084]
mov dword [ebp - 0x1a64], eax
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x2354], eax
jne 0x48312e
mov dword [ebp - 0x1a6c], 1
jmp 0x483135
and dword [ebp - 0x1a6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd14]
cmp dword [ebp - 0x1a6c], eax
jne 0x483156
mov dword [ebp - 0x208c], 1
jmp 0x48315d
and dword [ebp - 0x208c], 0
mov eax, dword [ebp - 0xd74]
cmp dword [ebp - 0x208c], eax
jg 0x483197
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd14], 0
je 0x483197
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c0], 0
je 0x483197
mov dword [ebp - 0xc58], 1
jmp 0x48319e
and dword [ebp - 0xc58], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc58]
mov dword [ebp + eax - 0x2ee4], ecx
cmp dword [ebp - 0xc58], 0
je 0x4831ce
cmp dword [ebp - 0x3b8], 0
je 0x4831ce
mov dword [ebp - 0x1a74], 1
jmp 0x4831d5
and dword [ebp - 0x1a74], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3bf8]
cmp dword [ebp - 0x1a74], eax
jl 0x4831f6
mov dword [ebp - 0x24bc], 1
jmp 0x4831fd
and dword [ebp - 0x24bc], 0
mov eax, dword [ebp - 0xd74]
imul eax, dword [ebp - 0x24bc]
test eax, eax
je 0x48321c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c0], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x3a08], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ee4]
mov dword [ebp - 0x32a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
mov dword [ebp - 0x1a7c], eax
cmp dword [ebp - 0x1a7c], 0
jne 0x483270
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ee4], 0
jne 0x483270
and dword [ebp - 0x2094], 0
jmp 0x48327a
mov dword [ebp - 0x2094], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2094]
mov dword [ebp + eax - 0x3454], ecx
jmp 0x4832b9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2ee4], 0
mov byte [ebp - 0x458], 0
movzx eax, byte [ebp - 0x458]
test eax, eax
je 0x4832b9
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x482da5
mov dword [ebp - 0xca8], 0xffffffff
mov dword [ebp - 0xa94], 0xd4e06482
mov dword [ebp - 0xa94], 0xffffffe3
jmp 0x4832eb
mov eax, dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 5
je 0x483310
mov byte [ebp - 0x328], 0
movzx eax, byte [ebp - 0x328]
test eax, eax
je 0x48330e
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x4832de
mov byte [ebp - 0x43e], 0
movzx eax, byte [ebp - 0x43e]
test eax, eax
je 0x48332f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1390], 0x2dc6606a
mov dword [ebp - 0x298], 0x5e48d327
mov dword [ebp - 0x1a84], 0xba47c9d5
mov dword [ebp - 0x470], 0x5e3edfa8
mov dword [ebp - 0x298], 0x1d
jmp 0x483370
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x11
jl 0x483599
mov dword [ebp - 0xc60], 0xfffd
mov dword [ebp - 0x478], 0xfffffff8
mov dword [ebp - 0x480], 0x720725fc
mov dword [ebp - 0x8bc], 0
jmp 0x4833b4
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 2
jge 0x4833d0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp + eax*4 - 0x3460], 1
jmp 0x4833a7
or eax, 0xffffffff
je 0x483403
mov eax, dword [ebp - 0xc60]
dec eax
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0x1a84], eax
cmp dword [ebp - 0x1a84], 0
je 0x483403
mov dword [ebp - 0x29c4], 1
jmp 0x48340a
and dword [ebp - 0x29c4], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x3710], eax
cmp dword [ebp - 0x470], 0
je 0x483426
cmp dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x32b0], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x3940], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x478], eax
je 0x483458
mov dword [ebp - 0x235c], 1
jmp 0x48345f
and dword [ebp - 0x235c], 0
cmp dword [ebp - 0x235c], 0x551b
jge 0x483477
mov dword [ebp - 0x1a8c], 1
jmp 0x48347e
and dword [ebp - 0x1a8c], 0
mov eax, dword [ebp - 0x478]
cmp dword [ebp - 0x1a8c], eax
je 0x48349e
cmp dword [ebp - 0x470], 0
jne 0x48349e
and dword [ebp - 0x209c], 0
jmp 0x4834a8
mov dword [ebp - 0x209c], 1
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x209c], eax
je 0x4834c2
mov dword [ebp - 0x1a94], 1
jmp 0x4834c9
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0x1a94]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x470], eax
je 0x4834ef
mov dword [ebp - 0x2624], 1
jmp 0x4834f6
and dword [ebp - 0x2624], 0
mov eax, dword [ebp - 0x2624]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0x2249687
jl 0x48351a
mov dword [ebp - 0x2da8], 1
jmp 0x483521
and dword [ebp - 0x2da8], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x32b8], eax
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x480], eax
jg 0x483547
mov dword [ebp - 0x1a9c], 1
jmp 0x48354e
and dword [ebp - 0x1a9c], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x1a9c], eax
je 0x483568
mov dword [ebp - 0x20a4], 1
jmp 0x48356f
and dword [ebp - 0x20a4], 0
mov eax, dword [ebp - 0x20a4]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
add eax, dword [ebp - 0x298]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3460], eax
jmp 0x483363
mov dword [ebp - 0x2a8c], 0xe45104f3
mov dword [ebp - 0x29cc], 0x2971c1e
mov dword [ebp - 0x488], 0xc0aa39ed
cmp dword [ebp - 0x29cc], 0x49f
jl 0x4835e1
mov byte [ebp - 0x32a], 0
movzx eax, byte [ebp - 0x32a]
test eax, eax
je 0x4835df
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x483616
mov dword [ebp - 0x488], 0xfffffff6
mov byte [ebp - 0x450], 0
movzx eax, byte [ebp - 0x450]
test eax, eax
je 0x483616
push 0x206f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
mov dword [ebp - 0x488], 0xfffffff6
jmp 0x48362f
mov eax, dword [ebp - 0x488]
dec eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0xffffffee
jg 0x4836dc
mov dword [ebp - 0x29d4], 0x13e19f23
mov dword [ebp - 0x9d0], 0
jmp 0x48365f
mov eax, dword [ebp - 0x9d0]
inc eax
mov dword [ebp - 0x9d0], eax
cmp dword [ebp - 0x9d0], 3
jge 0x48367b
mov eax, dword [ebp - 0x9d0]
mov dword [ebp + eax*4 - 0x2f70], 0
jmp 0x483652
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f70]
mov dword [ebp - 0x3718], eax
cmp dword [ebp - 0x488], 0
jne 0x4836a7
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x4836a7
and dword [ebp - 0x2c00], 0
jmp 0x4836b1
mov dword [ebp - 0x2c00], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f70]
mov dword [ebp - 0x32c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f70]
mov dword [ebp - 0x29d4], eax
jmp 0x483622
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x39c8], eax
cmp dword [ebp - 0x20], 0
jl 0x4836f7
mov dword [ebp - 0x1aa4], 1
jmp 0x4836fe
and dword [ebp - 0x1aa4], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1aa4]
je 0x483715
mov dword [ebp - 0x2364], 1
jmp 0x48371c
and dword [ebp - 0x2364], 0
mov eax, dword [ebp - 0x2364]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1cc], eax
jne 0x48373f
mov dword [ebp - 0x1aac], 1
jmp 0x483746
and dword [ebp - 0x1aac], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1aac]
jne 0x48375d
mov dword [ebp - 0x20ac], 1
jmp 0x483764
and dword [ebp - 0x20ac], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20ac], eax
jne 0x48377b
mov dword [ebp - 0x1ab4], 1
jmp 0x483782
and dword [ebp - 0x1ab4], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1ab4]
jle 0x483799
mov dword [ebp - 0x24c4], 1
jmp 0x4837a0
and dword [ebp - 0x24c4], 0
cmp dword [ebp - 0x24c4], 0x5a9c4c8d
jl 0x4837b8
mov dword [ebp - 0x1abc], 1
jmp 0x4837bf
and dword [ebp - 0x1abc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1abc], eax
jl 0x4837dc
mov eax, 0xbefa1e1c
test eax, eax
jne 0x4837dc
and dword [ebp - 0x20b4], 0
jmp 0x4837e6
mov dword [ebp - 0x20b4], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20b4], eax
je 0x483803
cmp dword [ebp - 0x1cc], 0
jne 0x483803
and dword [ebp - 0x1ac4], 0
jmp 0x48380d
mov dword [ebp - 0x1ac4], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1ac4], eax
je 0x484baa
mov dword [ebp - 0x248], 0xecf54c3c
mov dword [ebp - 0x29dc], 0x165352f7
mov dword [ebp - 0xd1c], 0
mov dword [ebp - 0x2a0], 0xffff
mov dword [ebp - 0x2e0c], 0x8eaf535
mov dword [ebp - 0x208], 0
jmp 0x483867
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x483883
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x25b4], 0x2906c902
jmp 0x48385a
mov dword [ebp - 0x208], 0
jmp 0x48389c
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x4838b8
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x2c08], 0x4779d44f
jmp 0x48388f
cmp dword [ebp - 0x248], 0
jne 0x4839e3
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x25b4]
cmp dword [ebp + eax - 0x25b4], ecx
jl 0x4838ed
mov dword [ebp - 0x236c], 1
jmp 0x4838f4
and dword [ebp - 0x236c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25b4]
cmp dword [ebp - 0x236c], eax
je 0x483915
mov dword [ebp - 0x2d1c], 1
jmp 0x48391c
and dword [ebp - 0x2d1c], 0
mov eax, dword [ebp - 0x29dc]
mov dword [ebp - 0x32c8], eax
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0x3720], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2c08]
cmp dword [ebp + eax - 0x25b4], ecx
jle 0x48395c
mov dword [ebp - 0x1acc], 1
jmp 0x483963
and dword [ebp - 0x1acc], 0
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1acc]
sub ecx, dword [ebp + eax - 0x25b4]
cmp dword [ebp - 0x2a0], ecx
jle 0x483997
mov dword [ebp - 0x20bc], 1
jmp 0x48399e
and dword [ebp - 0x20bc], 0
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x20bc]
jne 0x4839b8
mov dword [ebp - 0x1ad4], 1
jmp 0x4839bf
and dword [ebp - 0x1ad4], 0
mov eax, dword [ebp - 0x1ad4]
sub eax, dword [ebp - 0xd1c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x25b4]
je 0x4839e3
and dword [ebp - 0x2580], 0
jmp 0x4839ed
mov dword [ebp - 0x2580], 1
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x2580]
mov dword [ebp - 0xd1c], eax
mov dword [ebp - 0x248], 0xffffffe8
jmp 0x483a19
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x1c
jne 0x483d6f
mov dword [ebp - 0x3c8], 0xfffe
mov dword [ebp - 0x29e4], 0x5ab95dfe
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x2a0], 0xfffffff0
jmp 0x483a60
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x20
jge 0x483d6a
mov dword [ebp - 0x20c4], 0
mov dword [ebp - 0x2a8], 0x30de2fd1
mov dword [ebp - 0x8c4], 0
jmp 0x483a9a
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 1
jge 0x483ab6
mov eax, dword [ebp - 0x8c4]
mov dword [ebp + eax*4 - 0xa40], 0
jmp 0x483a8d
cmp dword [ebp - 0x248], 0
je 0x483ac4
jmp 0x483d6a
mov dword [ebp - 0x3c8], 0x11
jmp 0x483add
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x1f
jge 0x483d65
mov dword [ebp - 0x550], 0x18d7
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x32d0], eax
cmp dword [ebp - 0x550], 0
jne 0x483b47
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x2a8], eax
jle 0x483b30
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa40], 0
jne 0x483b30
and dword [ebp - 0x1adc], 0
jmp 0x483b3a
mov dword [ebp - 0x1adc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25b4]
mov dword [ebp - 0x3948], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x20c4], eax
mov eax, dword [ebp - 0x20c4]
mov dword [ebp - 0x32d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
mov dword [ebp - 0x3728], eax
mov dword [ebp - 0x2a8], 0xd02c
cmp dword [ebp - 0x2a8], 0
je 0x483bad
cmp dword [ebp - 0x550], 0
je 0x483bad
mov dword [ebp - 0x1ae4], 1
jmp 0x483bb4
and dword [ebp - 0x1ae4], 0
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x1ae4], eax
jl 0x483bce
mov dword [ebp - 0x2374], 1
jmp 0x483bd5
and dword [ebp - 0x2374], 0
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x2374], eax
jg 0x483bef
mov dword [ebp - 0x1aec], 1
jmp 0x483bf6
and dword [ebp - 0x1aec], 0
mov eax, dword [ebp - 0x1aec]
mov dword [ebp - 0x29e4], eax
mov dword [ebp - 0x2a8], 0x1a
jmp 0x483c1b
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0xffffffea
jge 0x483d60
mov dword [ebp - 0x2e44], 8
mov dword [ebp - 0x2e40], 8
mov dword [ebp - 0x2e3c], 8
mov dword [ebp - 0x2e38], 8
mov dword [ebp - 0x24cc], 7
mov dword [ebp - 0x29ec], 0xe5709715
mov byte [ebp - 0x32c], 0
movzx eax, byte [ebp - 0x32c]
test eax, eax
je 0x483c87
push 0
push 0
push 0x1dab
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
cmp dword [ebp - 0x248], 0
je 0x483ce1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e44]
mov dword [ebp - 0x32e0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e44]
mov dword [ebp - 0x3a78], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa40]
mov dword [ebp - 0x32e8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2e44]
cmp dword [ebp + eax - 0x2e44], ecx
mov eax, dword [ebp - 0x550]
push 4
pop ecx
imul ecx, ecx, 0
imul ecx, dword [ebp + ecx - 0x25b4], 0xfff8
imul eax, ecx
test eax, eax
jne 0x483d11
cmp dword [ebp - 0x2e0c], 0
jne 0x483d11
and dword [ebp - 0x20cc], 0
jmp 0x483d1b
mov dword [ebp - 0x20cc], 1
mov eax, dword [ebp - 0x20cc]
sub eax, 5
mov ecx, 0x6f6ec374
sub ecx, eax
cmp ecx, 0xfffffffc
jl 0x483d3c
mov dword [ebp - 0x1af4], 1
jmp 0x483d43
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x1af4]
mov dword [ebp - 0x24cc], eax
mov eax, dword [ebp - 0x24cc]
mov dword [ebp - 0x29ec], eax
jmp 0x483c0e
jmp 0x483ad0
jmp 0x483a53
jmp 0x483a0c
mov dword [ebp - 0x154], 1
mov dword [ebp - 0xc68], 0xfffffffa
mov dword [ebp - 0x1afc], 3
mov dword [ebp - 0x29fc], 0x4c8d3c89
mov dword [ebp - 0x490], 0
mov dword [ebp - 0xf4], 0x7543
mov dword [ebp - 0x3738], 0
mov dword [ebp - 0x8cc], 0
jmp 0x483dce
mov eax, dword [ebp - 0x8cc]
inc eax
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 2
jge 0x483dea
mov eax, dword [ebp - 0x8cc]
mov dword [ebp + eax*4 - 0xa84], 0x6e6f7fbf
jmp 0x483dc1
mov eax, dword [ebp - 0x1afc]
mov dword [ebp - 0x32f0], eax
mov eax, dword [ebp - 0x1afc]
mov dword [ebp - 0x3950], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x2c14], eax
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0x2c14], 0xcf415d72
je 0x483e33
mov dword [ebp - 0x20d4], 1
jmp 0x483e3a
and dword [ebp - 0x20d4], 0
cmp dword [ebp - 0x20d4], 0xfffffffc
jle 0x483e4f
mov dword [ebp - 0x1b04], 1
jmp 0x483e56
and dword [ebp - 0x1b04], 0
mov eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x490], 0xfffffff9
jmp 0x483e7b
mov eax, dword [ebp - 0x490]
dec eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0xffffffe3
jle 0x48440f
mov dword [ebp - 0x14c], 1
mov dword [ebp - 0x1b44], 0xfffffffa
mov dword [ebp - 0x32f8], 0x14d19633
mov dword [ebp - 0x2104], 0xfffffffa
mov dword [ebp - 0x3748], 1
mov dword [ebp - 0x3300], 0xfffffff6
mov dword [ebp - 0x9d8], 0
jmp 0x483edd
mov eax, dword [ebp - 0x9d8]
inc eax
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 2
jge 0x483ef9
mov eax, dword [ebp - 0x9d8]
mov dword [ebp + eax*4 - 0x3c94], 0xffffffff
jmp 0x483ed0
mov dword [ebp - 0xf4], 0
jmp 0x483f12
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jg 0x48440a
mov dword [ebp - 0x1b0c], 0x4549
mov dword [ebp - 0xa78], 0x18eb0bad
mov dword [ebp - 0x570], 0x7f54ab10
mov dword [ebp - 0x39d0], 6
xor eax, eax
inc eax
je 0x4841d2
mov dword [ebp - 0x2c20], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0xa84], 0
jne 0x483f83
mov eax, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0xa84], 0
jne 0x483f83
and dword [ebp - 0x29f4], 0
jmp 0x483f8d
mov dword [ebp - 0x29f4], 1
mov eax, 0x6437
test eax, eax
je 0x483fb2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa84], 0
je 0x483fb2
mov dword [ebp - 0x237c], 1
jmp 0x483fb9
and dword [ebp - 0x237c], 0
mov eax, dword [ebp - 0x237c]
mov dword [ebp - 0x1b0c], eax
mov eax, dword [ebp - 0x1b0c]
mov dword [ebp - 0x3308], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0xa84]
mov dword [ebp - 0x3758], eax
cmp dword [ebp - 0x14c], 0x3020
je 0x483ffc
mov dword [ebp - 0x20dc], 1
jmp 0x484003
and dword [ebp - 0x20dc], 0
mov eax, dword [ebp - 0x20dc]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0xf4]
imul eax, dword [ebp + ecx*4 - 0xa84]
cmp eax, dword [ebp - 0x14c]
jl 0x484037
mov dword [ebp - 0x1b14], 1
jmp 0x48403e
and dword [ebp - 0x1b14], 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0xa84]
cmp dword [ebp - 0x1b14], eax
je 0x48405f
mov dword [ebp - 0x25ec], 1
jmp 0x484066
and dword [ebp - 0x25ec], 0
cmp dword [ebp - 0x25ec], 0x6ef3b063
jg 0x48407e
mov dword [ebp - 0x1b1c], 1
jmp 0x484085
and dword [ebp - 0x1b1c], 0
cmp dword [ebp - 0x1b1c], 0xd12f8ba7
jne 0x48409d
mov dword [ebp - 0x20e4], 1
jmp 0x4840a4
and dword [ebp - 0x20e4], 0
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x20e4], eax
je 0x4840be
mov dword [ebp - 0x1b24], 1
jmp 0x4840c5
and dword [ebp - 0x1b24], 0
cmp dword [ebp - 0x1b24], 0xfeed
jge 0x4840dd
mov dword [ebp - 0x2d2c], 1
jmp 0x4840e4
and dword [ebp - 0x2d2c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa84]
mov dword [ebp - 0x3310], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa84]
mov dword [ebp - 0x384c], eax
mov eax, dword [ebp - 0x29fc]
mov dword [ebp - 0x3318], eax
mov eax, 0xfff7
test eax, eax
je 0x48412b
mov dword [ebp - 0x2384], 1
jmp 0x484132
and dword [ebp - 0x2384], 0
mov eax, dword [ebp - 0x2384]
sub eax, dword [ebp - 0x570]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa84]
jl 0x484159
mov dword [ebp - 0x1b2c], 1
jmp 0x484160
and dword [ebp - 0x1b2c], 0
mov eax, dword [ebp - 0x2c20]
cmp dword [ebp - 0x1b2c], eax
je 0x48417a
mov dword [ebp - 0x20ec], 1
jmp 0x484181
and dword [ebp - 0x20ec], 0
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x20ec], eax
jle 0x48419b
mov dword [ebp - 0x1b34], 1
jmp 0x4841a2
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0x1b34]
sub eax, 0x6679
mov dword [ebp - 0x14c], eax
mov byte [ebp - 0x440], 0
movzx eax, byte [ebp - 0x440]
test eax, eax
je 0x4841cd
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x484405
mov dword [ebp - 0x2a04], 0x1fa46b4c
mov dword [ebp - 0x2e98], 1
mov dword [ebp - 0x2e94], 1
mov dword [ebp - 0x2e90], 1
mov dword [ebp - 0x2e8c], 1
mov dword [ebp - 0x8d4], 0
jmp 0x48421d
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 3
jge 0x484239
mov eax, dword [ebp - 0x8d4]
mov dword [ebp + eax*4 - 0x37d4], 0xf74b
jmp 0x484210
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x2a04], eax
jge 0x484253
mov dword [ebp - 0x238c], 1
jmp 0x48425a
and dword [ebp - 0x238c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x3768], eax
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x3320], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x490]
cmp dword [ebp + eax - 0x37d4], ecx
jg 0x484293
mov dword [ebp - 0x24d4], 1
jmp 0x48429a
and dword [ebp - 0x24d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x37d4]
cmp dword [ebp - 0x24d4], eax
jne 0x4842bb
mov dword [ebp - 0x1b3c], 1
jmp 0x4842c2
and dword [ebp - 0x1b3c], 0
mov eax, dword [ebp - 0x1b3c]
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x14c], 0
je 0x4842ec
cmp dword [ebp - 0x14c], 0
je 0x4842ec
mov dword [ebp - 0x20f4], 1
jmp 0x4842f3
and dword [ebp - 0x20f4], 0
mov eax, dword [ebp - 0x20f4]
mov dword [ebp - 0x1b44], eax
cmp dword [ebp - 0x1b44], 0
je 0x48431d
cmp dword [ebp - 0xa78], 0
je 0x48431d
mov dword [ebp - 0x1b4c], 1
jmp 0x484324
and dword [ebp - 0x1b4c], 0
mov eax, dword [ebp - 0x238c]
add eax, dword [ebp - 0x1b4c]
mov dword [ebp - 0x14c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e98]
mov dword [ebp - 0x2db0], eax
mov eax, dword [ebp - 0x2104]
mov dword [ebp - 0x2a0c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e98]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2e98], eax
mov eax, dword [ebp - 0x2db0]
cmp eax, dword [ebp - 0x2a0c]
jge 0x484387
mov dword [ebp - 0x20fc], 1
jmp 0x48438e
and dword [ebp - 0x20fc], 0
cmp dword [ebp - 0x20fc], 0x9721cb4f
jne 0x4843a6
mov dword [ebp - 0x1b54], 1
jmp 0x4843ad
and dword [ebp - 0x1b54], 0
mov eax, dword [ebp - 0x570]
cmp eax, dword [ebp - 0x1b54]
jne 0x4843c7
mov dword [ebp - 0x2588], 1
jmp 0x4843ce
and dword [ebp - 0x2588], 0
mov eax, dword [ebp - 0x2588]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x1e22
jl 0x4843f2
mov dword [ebp - 0x1b5c], 1
jmp 0x4843f9
and dword [ebp - 0x1b5c], 0
mov eax, dword [ebp - 0x1b5c]
mov dword [ebp - 0x2104], eax
jmp 0x483f05
jmp 0x483e6e
mov dword [ebp - 0x1bd4], 5
mov dword [ebp - 0x9e0], 8
mov dword [ebp - 0x3850], 0xdada439b
mov dword [ebp - 0x3328], 0
mov dword [ebp - 0x3778], 0x3e90a624
mov dword [ebp - 0x8e4], 0xdfe4d9ed
mov dword [ebp - 0x1b64], 0x8e17c109
mov dword [ebp - 0x8dc], 0
jmp 0x48446e
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 4
jge 0x48448a
mov eax, dword [ebp - 0x8dc]
mov dword [ebp + eax*4 - 0x3ed0], 0
jmp 0x484461
mov eax, dword [ebp - 0x1b64]
dec eax
mov dword [ebp - 0x1b64], eax
mov dword [ebp - 0x9e0], 0
jmp 0x4844b0
mov eax, dword [ebp - 0x9e0]
dec eax
mov dword [ebp - 0x9e0], eax
cmp dword [ebp - 0x9e0], 0xfffffff7
jle 0x484534
mov dword [ebp - 0x8e4], 0xfffffffd
jmp 0x4844d2
mov eax, dword [ebp - 0x8e4]
inc eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 6
jg 0x484508
mov byte [ebp - 0x2f9], 0
movzx eax, byte [ebp - 0x2f9]
test eax, eax
je 0x484506
push 0x1930
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x4844c5
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x48452f
push 0
push 0
push 0x17d6
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x4844a3
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x3330], eax
cmp dword [ebp - 0x154], 0xfffd
jb 0x484558
mov dword [ebp - 0x2394], 1
jmp 0x48455f
and dword [ebp - 0x2394], 0
cmp dword [ebp - 0x2394], 0xfffffffe
jle 0x484582
xor eax, eax
inc eax
je 0x484582
cmp dword [ebp - 0x154], 0
je 0x484582
mov dword [ebp - 0x1b6c], 1
jmp 0x484589
and dword [ebp - 0x1b6c], 0
mov eax, dword [ebp - 0x154]
imul eax, dword [ebp - 0x1b6c]
cmp eax, 0xdd25
jg 0x4845a9
mov dword [ebp - 0x210c], 1
jmp 0x4845b0
and dword [ebp - 0x210c], 0
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x210c]
cmp eax, 5
jne 0x4845cd
mov dword [ebp - 0x1b74], 1
jmp 0x4845d4
and dword [ebp - 0x1b74], 0
cmp dword [ebp - 0x1b74], 1
jge 0x4845e9
mov dword [ebp - 0x24dc], 1
jmp 0x4845f0
and dword [ebp - 0x24dc], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x24dc]
je 0x48460a
mov dword [ebp - 0x1b7c], 1
jmp 0x484611
and dword [ebp - 0x1b7c], 0
mov eax, dword [ebp - 0x1b7c]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x154]
jle 0x48462e
mov dword [ebp - 0x2114], 1
jmp 0x484635
and dword [ebp - 0x2114], 0
mov eax, dword [ebp - 0x2114]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jg 0x484656
mov dword [ebp - 0x1b84], 1
jmp 0x48465d
and dword [ebp - 0x1b84], 0
mov eax, dword [ebp - 0xc68]
cmp dword [ebp - 0x1b84], eax
jle 0x484677
mov dword [ebp - 0x239c], 1
jmp 0x48467e
and dword [ebp - 0x239c], 0
cmp dword [ebp - 0x239c], 0xfeed
jne 0x484696
mov dword [ebp - 0x1b8c], 1
jmp 0x48469d
and dword [ebp - 0x1b8c], 0
cmp dword [ebp - 0x1b8c], 0x4b1c2fbf
jg 0x4846b5
mov dword [ebp - 0x211c], 1
jmp 0x4846bc
and dword [ebp - 0x211c], 0
mov eax, dword [ebp - 0xc68]
cmp dword [ebp - 0x211c], eax
jl 0x4846d6
mov dword [ebp - 0x1b94], 1
jmp 0x4846dd
and dword [ebp - 0x1b94], 0
mov eax, dword [ebp - 0xc68]
cmp dword [ebp - 0x1b94], eax
jl 0x4846f7
mov dword [ebp - 0x2614], 1
jmp 0x4846fe
and dword [ebp - 0x2614], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x2614], eax
je 0x484718
mov dword [ebp - 0x1b9c], 1
jmp 0x48471f
and dword [ebp - 0x1b9c], 0
cmp dword [ebp - 0x1b9c], 0x6a9
jne 0x484737
mov dword [ebp - 0x2124], 1
jmp 0x48473e
and dword [ebp - 0x2124], 0
mov eax, dword [ebp - 0x2124]
mov dword [ebp - 0x1bd4], eax
mov dword [ebp - 0xd70], 0xfffffff9
mov dword [ebp - 0x3d0], 0x449c9fb3
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x2b0], 0x26d8
mov dword [ebp - 0x578], 1
mov dword [ebp - 0xa48], 0
jmp 0x484795
mov eax, dword [ebp - 0xa48]
inc eax
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0xa48], 4
jge 0x4847b1
mov eax, dword [ebp - 0xa48]
mov dword [ebp + eax*4 - 0x26f8], 0xfa72c2
jmp 0x484788
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x26f8], 0
jne 0x4847cc
mov dword [ebp - 0x1ba4], 1
jmp 0x4847d3
and dword [ebp - 0x1ba4], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2c2c], eax
mov eax, dword [ebp - 0x1ba4]
mov dword [ebp - 0x2a14], eax
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2c2c]
cmp eax, dword [ebp - 0x2a14]
jle 0x484812
mov dword [ebp - 0x23a4], 1
jmp 0x484819
and dword [ebp - 0x23a4], 0
cmp dword [ebp - 0x23a4], 1
jne 0x48482e
mov dword [ebp - 0x1bac], 1
jmp 0x484835
and dword [ebp - 0x1bac], 0
mov eax, dword [ebp - 0xd70]
cmp eax, dword [ebp - 0x1bac]
jle 0x48484f
mov dword [ebp - 0x212c], 1
jmp 0x484856
and dword [ebp - 0x212c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3858], eax
cmp dword [ebp - 0x118], 0xa4d3ec93
jae 0x48487a
mov dword [ebp - 0x1bb4], 1
jmp 0x484881
and dword [ebp - 0x1bb4], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26f8], 0
je 0x4849ee
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x26f8], 0
je 0x4849ee
mov dword [ebp - 0x2b0], 0
jmp 0x4848c1
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jg 0x48493c
mov dword [ebp - 0x118], 3
jmp 0x4848e3
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x484937
mov byte [ebp - 0x460], 0
movzx eax, byte [ebp - 0x460]
test eax, eax
je 0x484914
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov byte [ebp - 0x330], 0
movzx eax, byte [ebp - 0x330]
test eax, eax
je 0x484935
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x4848d6
jmp 0x4848b4
cmp dword [ebp - 0xd70], 0
jne 0x4849a9
cmp dword [ebp - 0x578], 0xb26d
jl 0x48495d
mov dword [ebp - 0x24e4], 1
jmp 0x484964
and dword [ebp - 0x24e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26f8]
cmp eax, dword [ebp - 0x24e4]
jle 0x484985
mov dword [ebp - 0x1bbc], 1
jmp 0x48498c
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0x1bbc]
cmp eax, 0xef33
jg 0x4849a9
and dword [ebp - 0x2134], 0
jmp 0x4849b3
mov dword [ebp - 0x2134], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26f8]
cmp dword [ebp - 0x2134], eax
jne 0x4849d4
mov dword [ebp - 0x1bc4], 1
jmp 0x4849db
and dword [ebp - 0x1bc4], 0
mov eax, dword [ebp - 0x1bc4]
dec eax
dec eax
mov dword [ebp - 0x578], eax
jmp 0x484aa7
mov dword [ebp - 0x3d0], 0
jmp 0x484a07
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jg 0x484a86
mov dword [ebp - 0x118], 3
jmp 0x484a29
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x484a67
mov dword [ebp - 0x2d3c], 1
mov byte [ebp - 0x442], 0
movzx eax, byte [ebp - 0x442]
test eax, eax
je 0x484a5a
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
cmp dword [ebp - 0x2d3c], 0
je 0x484a65
jmp 0x484a67
jmp 0x484a1c
mov byte [ebp - 0x332], 0
movzx eax, byte [ebp - 0x332]
test eax, eax
je 0x484a81
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x4849fa
mov byte [ebp - 0x452], 0
movzx eax, byte [ebp - 0x452]
test eax, eax
je 0x484aa7
push 0
push 0x791
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x3d0], 0xfffffffa
cmp dword [ebp - 0x3d0], 0
jne 0x484ac7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x26f8], 0
cmp dword [ebp - 0x3d0], 0xffa8
jle 0x484adf
mov dword [ebp - 0x23ac], 1
jmp 0x484ae6
and dword [ebp - 0x23ac], 0
mov eax, dword [ebp - 0x578]
cmp dword [ebp - 0x23ac], eax
jle 0x484b06
mov eax, 0x9124c6e1
test eax, eax
jne 0x484b06
and dword [ebp - 0x1bcc], 0
jmp 0x484b10
mov dword [ebp - 0x1bcc], 1
mov eax, dword [ebp - 0x1bcc]
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 0xfff9752e
ja 0x484b34
mov dword [ebp - 0x2a1c], 1
jmp 0x484b3b
and dword [ebp - 0x2a1c], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x3338], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x26f8]
mov dword [ebp - 0x3788], eax
cmp dword [ebp - 0xd70], 0
jne 0x484b7c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26f8], 0
jne 0x484b7c
and dword [ebp - 0x213c], 0
jmp 0x484b86
mov dword [ebp - 0x213c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x213c]
mov dword [ebp + eax - 0x26f8], ecx
mov eax, dword [ebp - 0x1bd4]
mov dword [ebp - 0x154], eax
jmp 0x485ed0
mov dword [ebp - 0xc4], 0x2667
mov dword [ebp - 0xd24], 0xff68e10d
mov dword [ebp - 0xc70], 0xf7b4
mov dword [ebp - 0x2a24], 1
mov dword [ebp - 0x498], 0xfffffff6
mov dword [ebp - 0x194], 0
jmp 0x484bf5
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x484c11
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x3a88], 0xffffffff
jmp 0x484be8
mov dword [ebp - 0x194], 0
jmp 0x484c2a
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x484c46
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x2690], 0x963f6d1d
jmp 0x484c1d
cmp dword [ebp - 0xc4], 0
je 0x484e29
cmp dword [ebp - 0xc4], 0
je 0x484c90
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xe50], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xe50]
mov dword [ebp + eax - 0x3a88], ecx
cmp dword [ebp - 0xe50], 0
je 0x484c90
mov dword [ebp - 0x1bdc], 1
jmp 0x484c97
and dword [ebp - 0x1bdc], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1bdc], eax
jne 0x484cb1
mov dword [ebp - 0x2144], 1
jmp 0x484cb8
and dword [ebp - 0x2144], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x2144], eax
jg 0x484cd2
mov dword [ebp - 0x1be4], 1
jmp 0x484cd9
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0x1be4]
sub eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc4]
jg 0x484cff
mov dword [ebp - 0x23b4], 1
jmp 0x484d06
and dword [ebp - 0x23b4], 0
cmp dword [ebp - 0x23b4], 1
je 0x484d1b
mov dword [ebp - 0x1bec], 1
jmp 0x484d22
and dword [ebp - 0x1bec], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1bec], eax
je 0x484d3c
mov dword [ebp - 0x214c], 1
jmp 0x484d43
and dword [ebp - 0x214c], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x214c]
je 0x484d6d
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3a88], 0
je 0x484d6d
mov dword [ebp - 0x1bf4], 1
jmp 0x484d74
and dword [ebp - 0x1bf4], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1bf4], eax
jle 0x484d8e
mov dword [ebp - 0x24ec], 1
jmp 0x484d95
and dword [ebp - 0x24ec], 0
mov eax, dword [ebp - 0xd24]
imul eax, dword [ebp - 0x24ec]
cmp dword [ebp - 0xc4], eax
je 0x484db6
mov dword [ebp - 0x1bfc], 1
jmp 0x484dbd
and dword [ebp - 0x1bfc], 0
mov eax, dword [ebp - 0xd24]
cmp dword [ebp - 0x1bfc], eax
je 0x484dd7
mov dword [ebp - 0x2154], 1
jmp 0x484dde
and dword [ebp - 0x2154], 0
mov eax, dword [ebp - 0xc70]
cmp dword [ebp - 0x2154], eax
jne 0x484df8
mov dword [ebp - 0x1c04], 1
jmp 0x484dff
and dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0xc70]
cmp dword [ebp - 0x1c04], eax
jge 0x484e1d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a88], 0
je 0x484e29
mov dword [ebp - 0x23bc], 1
jmp 0x484e30
and dword [ebp - 0x23bc], 0
mov eax, dword [ebp - 0x23bc]
add eax, 0xd88ca0e2
mov dword [ebp - 0x1c0c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c0c]
mov dword [ebp + eax - 0x2690], ecx
mov eax, dword [ebp - 0xc70]
cmp dword [ebp - 0x1c0c], eax
jle 0x484e6e
mov dword [ebp - 0x215c], 1
jmp 0x484e75
and dword [ebp - 0x215c], 0
mov eax, dword [ebp - 0xd24]
cmp dword [ebp - 0x215c], eax
je 0x484e8f
mov dword [ebp - 0x2c38], 1
jmp 0x484e96
and dword [ebp - 0x2c38], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x3340], eax
mov eax, dword [ebp - 0x2a24]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
je 0x484f5d
mov dword [ebp - 0x2de8], 0xffffffff
mov dword [ebp - 0x580], 0x10cb4e34
mov eax, dword [ebp - 0x2de8]
mov dword [ebp - 0x580], eax
mov dword [ebp - 0x580], 0xfffffffc
jmp 0x484ef4
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 3
jle 0x484f58
mov dword [ebp - 0x2a2c], 0xb89
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a2c]
mov dword [ebp + eax - 0x2690], ecx
mov dword [ebp - 0x498], 1
jmp 0x484f33
mov eax, dword [ebp - 0x498]
dec eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jl 0x484f56
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x484f54
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x484f26
jmp 0x484ee7
jmp 0x48500c
mov dword [ebp - 0x2c44], 6
mov dword [ebp - 0x25f4], 0xeb077cb1
mov dword [ebp - 0x8ec], 0
jmp 0x484f8a
mov eax, dword [ebp - 0x8ec]
inc eax
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x8ec], 2
jge 0x484fa6
mov eax, dword [ebp - 0x8ec]
mov dword [ebp + eax*4 - 0x346c], 0
jmp 0x484f7d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c44]
cmp dword [ebp + eax - 0x2690], ecx
je 0x484fc7
mov dword [ebp - 0x1c14], 1
jmp 0x484fce
and dword [ebp - 0x1c14], 0
mov eax, dword [ebp - 0x1c14]
mov dword [ebp - 0x25f4], eax
mov eax, dword [ebp - 0x25f4]
mov dword [ebp - 0x1c1c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c1c]
mov dword [ebp + eax - 0x346c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c1c]
mov dword [ebp + eax - 0x2690], ecx
mov dword [ebp - 0x3d8], 0x2e91a04
mov dword [ebp - 0xc78], 0xc25b
mov dword [ebp - 0x2a34], 0x97515801
mov dword [ebp - 0x3d8], 0
jmp 0x485043
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xd
jge 0x48509d
mov dword [ebp - 0x9e8], 0xffffffff
mov dword [ebp - 0x9e8], 0
jmp 0x48506f
mov eax, dword [ebp - 0x9e8]
dec eax
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x9e8], 0xfffffff4
jle 0x48509b
mov byte [ebp - 0x444], 0
movzx eax, byte [ebp - 0x444]
test eax, eax
je 0x485099
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
jmp 0x485062
jmp 0x485036
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0xc78], eax
jle 0x4850b7
mov dword [ebp - 0x2164], 1
jmp 0x4850be
and dword [ebp - 0x2164], 0
cmp dword [ebp - 0x2164], 0x2a3b3f36
jge 0x4850d6
mov dword [ebp - 0x216c], 1
jmp 0x4850dd
and dword [ebp - 0x216c], 0
cmp dword [ebp - 0x3d8], 0x16542076
jle 0x4850f5
mov dword [ebp - 0x1c24], 1
jmp 0x4850fc
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0x2a34]
cmp dword [ebp - 0x1c24], eax
jge 0x485116
mov dword [ebp - 0x23c4], 1
jmp 0x48511d
and dword [ebp - 0x23c4], 0
cmp dword [ebp - 0x23c4], 0
jle 0x485132
mov dword [ebp - 0x1c2c], 1
jmp 0x485139
and dword [ebp - 0x1c2c], 0
mov eax, dword [ebp - 0xc78]
cmp eax, dword [ebp - 0x1c2c]
jge 0x485159
cmp dword [ebp - 0xc78], 0
jne 0x485159
and dword [ebp - 0x1c34], 0
jmp 0x485163
mov dword [ebp - 0x1c34], 1
mov eax, dword [ebp - 0x216c]
cmp eax, dword [ebp - 0x1c34]
jne 0x48517d
mov dword [ebp - 0x24f4], 1
jmp 0x485184
and dword [ebp - 0x24f4], 0
mov eax, dword [ebp - 0x24f4]
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x2e34], 0x2f725dc8
mov dword [ebp - 0xb8], 0x83c7730f
mov dword [ebp - 0xd88], 0x14055248
mov dword [ebp - 0x2b8], 0xfffffffa
mov dword [ebp - 0xaa4], 0xffffffff
mov dword [ebp - 0x2a3c], 0xfffffff8
mov dword [ebp - 0x2c4c], 1
mov dword [ebp - 0x8f4], 0
jmp 0x4851ef
mov eax, dword [ebp - 0x8f4]
inc eax
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 1
jge 0x48520b
mov eax, dword [ebp - 0x8f4]
mov dword [ebp + eax*4 - 0xc80], 0xfffffffd
jmp 0x4851e2
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
je 0x485225
mov dword [ebp - 0x1cc8], 1
jmp 0x48522c
and dword [ebp - 0x1cc8], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jle 0x485246
mov dword [ebp - 0x1c3c], 1
jmp 0x48524d
and dword [ebp - 0x1c3c], 0
mov eax, dword [ebp - 0x1c3c]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0xd88]
imul eax, dword [ebp - 0xb8]
add eax, 0x6aac
je 0x485282
cmp dword [ebp - 0xd88], 0
je 0x485282
mov dword [ebp - 0x2d44], 1
jmp 0x485289
and dword [ebp - 0x2d44], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x3860], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jl 0x4852af
mov dword [ebp - 0x1cb4], 1
jmp 0x4852b6
and dword [ebp - 0x1cb4], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc80], 0xe3b3
cmp dword [ebp - 0x1cb4], 0xe3b3
jg 0x4852df
mov dword [ebp - 0x1c44], 1
jmp 0x4852e6
and dword [ebp - 0x1c44], 0
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x1cc8], eax
jle 0x48530c
mov dword [ebp - 0x1c4c], 1
jmp 0x485313
and dword [ebp - 0x1c4c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x1c4c], eax
jne 0x485346
cmp dword [ebp - 0x2b8], 0
je 0x485346
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc80], 0
je 0x485346
mov dword [ebp - 0x1cd0], 1
jmp 0x48534d
and dword [ebp - 0x1cd0], 0
cmp dword [ebp - 0x1cd0], 0
je 0x485362
mov dword [ebp - 0x1c54], 1
jmp 0x485369
and dword [ebp - 0x1c54], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x1c54]
add eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
jle 0x48538d
mov eax, 0x728ad64d
test eax, eax
je 0x4853a2
cmp dword [ebp - 0xaa4], 0
je 0x4853a2
mov dword [ebp - 0x1cd8], 1
jmp 0x4853a9
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x1cd8]
sub eax, dword [ebp - 0xaa4]
imul eax, dword [ebp - 0xaa4]
test eax, eax
je 0x4853d5
cmp dword [ebp - 0x2a3c], 0
je 0x4853d5
mov dword [ebp - 0x1c5c], 1
jmp 0x4853dc
and dword [ebp - 0x1c5c], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x1c5c]
je 0x4853f6
mov dword [ebp - 0x1ce0], 1
jmp 0x4853fd
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x1ce0]
mov dword [ebp - 0x2c4c], eax
mov dword [ebp - 0x2b8], 0
jmp 0x485422
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x48544a
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp + eax*4 - 0xc80], 0
je 0x48543d
jmp 0x48544a
cmp dword [ebp - 0xaa4], 0
je 0x485448
jmp 0x48544a
jmp 0x485415
mov dword [ebp - 0x1a4], 0x6960f57a
mov dword [ebp - 0x1c74], 0x35c0de45
mov dword [ebp - 0x2a44], 0xfff8
mov dword [ebp - 0x1cf0], 0x638299fa
mov dword [ebp - 0x1c7c], 0xebef9f3b
mov dword [ebp - 0x1c94], 0x78cd908f
mov dword [ebp - 0x19c], 0
jmp 0x48549f
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x4854bb
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2e68], 8
jmp 0x485492
mov dword [ebp - 0x19c], 0
jmp 0x4854d4
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x4854f0
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x2f0c], 0xffff
jmp 0x4854c7
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x48550f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x1a4], 0
jmp 0x485528
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x485852
mov dword [ebp - 0x2a4c], 0xd01cd43a
mov dword [ebp - 0x8fc], 0
jmp 0x485558
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 2
jge 0x485574
mov eax, dword [ebp - 0x8fc]
mov dword [ebp + eax*4 - 0x650], 0xe936be85
jmp 0x48554b
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp + eax*4 - 0x2e68], 0
je 0x485644
cmp dword [ebp - 0x1a4], 0xfffffff6
jg 0x48559d
mov dword [ebp - 0x1c64], 1
jmp 0x4855a4
and dword [ebp - 0x1c64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x650]
add eax, dword [ebp - 0x1c64]
jne 0x4855c5
mov dword [ebp - 0x1ce8], 1
jmp 0x4855cc
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0x2a44]
cmp dword [ebp - 0x1ce8], eax
jg 0x4855e6
mov dword [ebp - 0x1c6c], 1
jmp 0x4855ed
and dword [ebp - 0x1c6c], 0
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x650], 0x96a5
mov dword [ebp - 0x1c74], eax
mov eax, dword [ebp - 0x1c6c]
mov dword [ebp - 0x1cf0], eax
mov eax, dword [ebp - 0x1a4]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x1cf0]
sub edx, dword [ebp + ecx - 0x2e68]
imul edx, dword [ebp + eax*4 - 0x2e68]
cmp dword [ebp - 0x1c74], edx
jle 0x485644
mov dword [ebp - 0x1cf8], 1
jmp 0x48564b
and dword [ebp - 0x1cf8], 0
mov eax, dword [ebp - 0x1cf8]
mov dword [ebp - 0x1c7c], eax
mov eax, dword [ebp - 0x1c7c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x650]
jge 0x485679
mov dword [ebp - 0x1d00], 1
jmp 0x485680
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x1d00], eax
je 0x48569a
mov dword [ebp - 0x2db8], 1
jmp 0x4856a1
and dword [ebp - 0x2db8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f0c]
mov dword [ebp - 0x3348], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x650]
cmp dword [ebp + eax - 0x650], ecx
jge 0x4856dc
mov dword [ebp - 0x1c84], 1
jmp 0x4856e3
and dword [ebp - 0x1c84], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x650]
add eax, dword [ebp - 0x1c84]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2f0c]
jne 0x48571e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x650], 0
jne 0x48571e
and dword [ebp - 0x1d08], 0
jmp 0x485728
mov dword [ebp - 0x1d08], 1
cmp dword [ebp - 0x1d08], 0xa5c1b09c
jbe 0x485740
mov dword [ebp - 0x1c8c], 1
jmp 0x485747
and dword [ebp - 0x1c8c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x650]
cmp dword [ebp - 0x1c8c], eax
jne 0x485768
mov dword [ebp - 0x1d10], 1
jmp 0x48576f
and dword [ebp - 0x1d10], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d10]
sub ecx, dword [ebp + eax - 0x2e68]
mov dword [ebp - 0x1c94], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2e68]
cmp dword [ebp - 0x1c94], eax
je 0x4857a9
mov dword [ebp - 0xd2c], 1
jmp 0x4857b0
and dword [ebp - 0xd2c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd2c]
mov dword [ebp + eax - 0x650], ecx
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x2e68]
cmp eax, dword [ebp - 0xd2c]
jle 0x4857e4
mov dword [ebp - 0x1d18], 1
jmp 0x4857eb
and dword [ebp - 0x1d18], 0
imul eax, dword [ebp - 0x1d18], 0xffffffff
test eax, eax
jne 0x48580f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x650], 0
jne 0x48580f
and dword [ebp - 0x1c9c], 0
jmp 0x485819
mov dword [ebp - 0x1c9c], 1
mov eax, dword [ebp - 0x1c9c]
mov dword [ebp - 0x2a4c], eax
mov byte [ebp - 0x45a], 0
movzx eax, byte [ebp - 0x45a]
test eax, eax
je 0x48584d
push 0
push 0
push 0xaa1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x48551b
mov dword [ebp - 0x9f0], 0
jmp 0x48586b
mov eax, dword [ebp - 0x9f0]
inc eax
mov dword [ebp - 0x9f0], eax
cmp dword [ebp - 0x9f0], 3
jge 0x485887
mov eax, dword [ebp - 0x9f0]
mov dword [ebp + eax*4 - 0x2f28], 0x42ea6ae2
jmp 0x48585e
mov dword [ebp - 0x2c0], 0x5e48d327
mov dword [ebp - 0x1d20], 0xba47c9d5
mov dword [ebp - 0x4a0], 0x5e3edfa8
mov dword [ebp - 0x2c0], 0x1d
jmp 0x4858be
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x11
jl 0x485ae7
mov dword [ebp - 0xc88], 0xfffd
mov dword [ebp - 0x4a8], 0xfffffff8
mov dword [ebp - 0x4b0], 0x720725fc
mov dword [ebp - 0x904], 0
jmp 0x485902
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 2
jge 0x48591e
mov eax, dword [ebp - 0x904]
mov dword [ebp + eax*4 - 0x3478], 1
jmp 0x4858f5
or eax, 0xffffffff
je 0x485951
mov eax, dword [ebp - 0xc88]
dec eax
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0x1d20], eax
cmp dword [ebp - 0x1d20], 0
je 0x485951
mov dword [ebp - 0x2c54], 1
jmp 0x485958
and dword [ebp - 0x2c54], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x3798], eax
cmp dword [ebp - 0x4a0], 0
je 0x485974
cmp dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x3350], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x3868], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x4a8], eax
je 0x4859a6
mov dword [ebp - 0x1ca4], 1
jmp 0x4859ad
and dword [ebp - 0x1ca4], 0
cmp dword [ebp - 0x1ca4], 0x551b
jge 0x4859c5
mov dword [ebp - 0x1d28], 1
jmp 0x4859cc
and dword [ebp - 0x1d28], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x1d28], eax
je 0x4859ec
cmp dword [ebp - 0x4a0], 0
jne 0x4859ec
and dword [ebp - 0x1cac], 0
jmp 0x4859f6
mov dword [ebp - 0x1cac], 1
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x1cac], eax
je 0x485a10
mov dword [ebp - 0x1d30], 1
jmp 0x485a17
and dword [ebp - 0x1d30], 0
mov eax, dword [ebp - 0x1d30]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x4a0], eax
je 0x485a3d
mov dword [ebp - 0x12d4], 1
jmp 0x485a44
and dword [ebp - 0x12d4], 0
mov eax, dword [ebp - 0x12d4]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0x2249687
jl 0x485a68
mov dword [ebp - 0x2a54], 1
jmp 0x485a6f
and dword [ebp - 0x2a54], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x3358], eax
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x4b0], eax
jg 0x485a95
mov dword [ebp - 0x12d8], 1
jmp 0x485a9c
and dword [ebp - 0x12d8], 0
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x12d8], eax
je 0x485ab6
mov dword [ebp - 0x12e0], 1
jmp 0x485abd
and dword [ebp - 0x12e0], 0
mov eax, dword [ebp - 0x12e0]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
add eax, dword [ebp - 0x2c0]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3478], eax
jmp 0x4858b1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f28]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f28], eax
mov dword [ebp - 0x588], 0xfffffffd
mov dword [ebp - 0xa50], 0x21462ccd
mov dword [ebp - 0x1ac], 0
jmp 0x485b2f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x485b4b
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x2f88], 0x85f70ad6
jmp 0x485b22
mov dword [ebp - 0x1ac], 0
jmp 0x485b64
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x485b80
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xb50], 0xf89b546
jmp 0x485b57
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x485ba6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb50], 0
jmp 0x485bd4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb50], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb50], 2
jg 0x485ebe
mov dword [ebp - 0x1330], 0x4ca72cb5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
cmp dword [ebp + eax*4 - 0x2f88], 1
jle 0x485c15
mov dword [ebp - 0x12e8], 1
jmp 0x485c1c
and dword [ebp - 0x12e8], 0
mov eax, dword [ebp - 0x12e8]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x588], 0
jmp 0x485c41
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 2
jg 0x485eb9
mov dword [ebp - 0x2c5c], 0x3a4d1b40
mov dword [ebp - 0x12f8], 0xc5c6a3f1
mov dword [ebp - 0x1b4], 0
jmp 0x485c7b
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x485c97
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x26a0], 0
jmp 0x485c6e
mov dword [ebp - 0x1b4], 0
jmp 0x485cb0
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x485ccc
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x2a64], 0xffffffff
jmp 0x485ca3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x26a0], 0
jmp 0x485cfa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26a0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x26a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26a0], 2
jg 0x485e91
mov dword [ebp - 0xc9c], 0xfffffff7
mov dword [ebp - 0xc90], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
cmp dword [ebp + eax*4 - 0x2f88], 0
je 0x485e21
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0x2d4c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
mov dword [ebp - 0x2a5c], eax
mov eax, dword [ebp - 0xc9c]
dec eax
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0x2d4c]
cmp eax, dword [ebp - 0x2a5c]
jge 0x485d83
mov dword [ebp - 0x12f0], 1
jmp 0x485d8a
and dword [ebp - 0x12f0], 0
mov eax, dword [ebp - 0x12f0]
mov dword [ebp - 0x12f8], eax
cmp dword [ebp - 0x12f8], 0
jbe 0x485dab
mov dword [ebp - 0x1300], 1
jmp 0x485db2
and dword [ebp - 0x1300], 0
mov eax, dword [ebp - 0x1300]
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0xa50], 0xffffffff
jae 0x485dd3
mov dword [ebp - 0x1308], 1
jmp 0x485dda
and dword [ebp - 0x1308], 0
cmp dword [ebp - 0x1308], 0xffffffff
jle 0x485def
mov dword [ebp - 0x1310], 1
jmp 0x485df6
and dword [ebp - 0x1310], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
mov eax, dword [ebp + eax*4 - 0x2f88]
imul eax, dword [ebp - 0x1310]
test eax, eax
je 0x485e21
mov dword [ebp - 0x1318], 1
jmp 0x485e28
and dword [ebp - 0x1318], 0
mov eax, dword [ebp - 0xc90]
cmp dword [ebp - 0x1318], eax
jle 0x485e48
cmp dword [ebp - 0xc90], 0
jne 0x485e48
and dword [ebp - 0x1320], 0
jmp 0x485e52
mov dword [ebp - 0x1320], 1
mov eax, dword [ebp - 0x1320]
sub eax, dword [ebp - 0xc90]
cmp eax, dword [ebp - 0x2c5c]
jne 0x485e72
mov dword [ebp - 0x1328], 1
jmp 0x485e79
and dword [ebp - 0x1328], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1328]
mov dword [ebp + eax - 0x2a64], ecx
jmp 0x485cdf
mov eax, dword [ebp - 0x1330]
mov dword [ebp - 0x37a8], eax
imul eax, dword [ebp - 0xa50], 0xfffe
imul eax, dword [ebp - 0x1330]
mov dword [ebp - 0xa50], eax
jmp 0x485c34
jmp 0x485bb9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f28]
mov dword [ebp - 0x2e34], eax
mov dword [ebp - 0x1c4], 0x77862fd4
mov dword [ebp - 0x120], 0x7ddbf4d
mov dword [ebp - 0x2c6c], 0xf285f402
mov dword [ebp - 0x90c], 0
jmp 0x485f07
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 3
jge 0x485f23
mov eax, dword [ebp - 0x90c]
mov dword [ebp + eax*4 - 0x3e2c], 1
jmp 0x485efa
mov dword [ebp - 0x1c4], 0
jmp 0x485f3c
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xc
jg 0x4861b0
mov dword [ebp - 0x1bc], 0x98070ade
mov dword [ebp - 0x9f8], 0
jmp 0x485f6c
mov eax, dword [ebp - 0x9f8]
inc eax
mov dword [ebp - 0x9f8], eax
cmp dword [ebp - 0x9f8], 2
jge 0x485f88
mov eax, dword [ebp - 0x9f8]
mov dword [ebp + eax*4 - 0x3484], 0
jmp 0x485f5f
mov dword [ebp - 0x1bc], 0xffffffef
jmp 0x485fa1
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x1c
je 0x486176
mov dword [ebp - 0xca0], 0xfcdf
mov dword [ebp - 0x2d54], 0xfffffffd
mov dword [ebp - 0x2a7c], 0xf9f3b06d
mov eax, 0x856dfc9b
test eax, eax
je 0x486020
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x485ffc
cmp dword [ebp - 0x120], 0
jne 0x485ffc
and dword [ebp - 0x1338], 0
jmp 0x486006
mov dword [ebp - 0x1338], 1
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x1338], eax
jg 0x486020
mov dword [ebp - 0x1340], 1
jmp 0x486027
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x2a6c], eax
imul eax, dword [ebp - 0x1340], 0xbfc7
mov dword [ebp - 0x2c64], eax
mov eax, dword [ebp - 0xca0]
inc eax
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0x2a6c]
cmp eax, dword [ebp - 0x2c64]
jg 0x48606a
mov dword [ebp - 0x1348], 1
jmp 0x486071
and dword [ebp - 0x1348], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x1348]
jg 0x486091
mov eax, 0x8bbd188
test eax, eax
jne 0x486091
and dword [ebp - 0x1350], 0
jmp 0x48609b
mov dword [ebp - 0x1350], 1
mov eax, dword [ebp - 0x1350]
sub eax, 8
je 0x4860c4
cmp dword [ebp - 0x1bc], 0
je 0x4860c4
mov eax, 0xbe26
test eax, eax
je 0x4860c4
mov dword [ebp - 0x1358], 1
jmp 0x4860cb
and dword [ebp - 0x1358], 0
cmp dword [ebp - 0x1358], 0xcfda
jge 0x4860e3
mov dword [ebp - 0x2a74], 1
jmp 0x4860ea
and dword [ebp - 0x2a74], 0
mov eax, dword [ebp - 0x2d54]
mov dword [ebp - 0x3360], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x3870], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x3368], eax
cmp dword [ebp - 0x120], 0
je 0x48612c
cmp dword [ebp - 0x120], 0
je 0x48612c
mov dword [ebp - 0x1360], 1
jmp 0x486133
and dword [ebp - 0x1360], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x1360], eax
jle 0x486148
cmp dword [ebp - 0x2a7c], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x37b8], eax
mov eax, dword [ebp - 0x1c4]
add eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x2c6c], eax
cmp dword [ebp - 0x1c4], 0
je 0x486171
jmp 0x486176
jmp 0x485f94
mov dword [ebp - 0x120], 0
jmp 0x48618f
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x4861ab
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x3484], 0xc298c245
jmp 0x486182
jmp 0x485f2f
mov byte [ebp - 0x42a], 0
movzx eax, byte [ebp - 0x42a]
test eax, eax
je 0x4861d4
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x1cc], 1
jb 0x4861e9
mov dword [ebp - 0x1368], 1
jmp 0x4861f0
and dword [ebp - 0x1368], 0
imul eax, dword [ebp - 0x20], 0
cmp eax, dword [ebp - 0xc98]
jl 0x486208
mov dword [ebp - 0x1370], 1
jmp 0x48620f
and dword [ebp - 0x1370], 0
mov eax, dword [ebp - 0x1368]
add eax, dword [ebp - 0x1370]
cmp eax, dword [ebp - 0xc98]
jg 0x48622f
mov dword [ebp - 0x1378], 1
jmp 0x486236
and dword [ebp - 0x1378], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1378], eax
jle 0x48624d
mov dword [ebp - 0x2a84], 1
jmp 0x486254
and dword [ebp - 0x2a84], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3370], eax
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x20]
jne 0x486274
mov dword [ebp - 0x1380], 1
jmp 0x48627b
and dword [ebp - 0x1380], 0
mov eax, dword [ebp - 0xc98]
cmp dword [ebp - 0x1380], eax
jl 0x48629e
cmp dword [ebp - 0x1cc], 0
je 0x48629e
mov dword [ebp - 0x1388], 1
jmp 0x4862a5
and dword [ebp - 0x1388], 0
mov eax, dword [ebp - 0x1388]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xca8], eax
cmp dword [ebp - 0xca8], 0
jge 0x4862d2
mov dword [ebp - 0x2dc0], 1
jmp 0x4862d9
and dword [ebp - 0x2dc0], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3878], eax
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0x1390], eax
mov eax, dword [ebp - 0x1390]
mov dword [ebp - 0x2a8c], eax
mov dword [ebp - 0xa8], 0xcea5d6c0
mov dword [ebp - 0x1cc4], 0
mov dword [ebp - 0x1cc0], 0
mov dword [ebp - 0x1cbc], 0
mov dword [ebp - 0x1cb8], 0
mov dword [ebp - 0x13d8], 0xd9e8
mov dword [ebp - 0x2af8], 0x5f8e
mov dword [ebp - 0x1410], 0
mov dword [ebp - 0x914], 0
jmp 0x486363
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 3
jge 0x48637f
mov eax, dword [ebp - 0x914]
mov dword [ebp + eax*4 - 0x37f4], 0x9de
jmp 0x486356
mov dword [ebp - 0xa8], 0xfffffff1
jmp 0x486398
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x1c
jl 0x48660c
mov dword [ebp - 0x2c8], 0x3248c66
mov dword [ebp - 0x2c74], 0x747c914a
mov dword [ebp - 0x948], 0
jmp 0x4863d2
mov eax, dword [ebp - 0x948]
inc eax
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 1
jge 0x4863ee
mov eax, dword [ebp - 0x948]
mov dword [ebp + eax*4 - 0x944], 2
jmp 0x4863c5
mov dword [ebp - 0x2c8], 0
jmp 0x486407
cmp dword [ebp - 0x2c8], 0
jg 0x486607
mov dword [ebp - 0x91c], 0
jmp 0x48642d
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 2
jge 0x486449
mov eax, dword [ebp - 0x91c]
mov dword [ebp + eax*4 - 0x3490], 0x53b1dab5
jmp 0x486420
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2c8]
mov ecx, dword [ebp + ecx*4 - 0x944]
cmp dword [ebp + eax*4 - 0x944], ecx
jne 0x486471
mov dword [ebp - 0x1398], 1
jmp 0x486478
and dword [ebp - 0x1398], 0
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp + eax*4 - 0x944]
imul eax, dword [ebp - 0x1398]
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + ecx*4 - 0x944], eax
cmp dword [ebp - 0xa8], 0
je 0x4865e1
jmp 0x48638b
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + eax - 0x1cc4], ecx
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1cc4], 0
je 0x48681d
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1cc4]
mov dword [ebp - 0x37c8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cc4]
cmp dword [ebp - 0xa8], eax
jle 0x486665
mov dword [ebp - 0x13a8], 1
jmp 0x48666c
and dword [ebp - 0x13a8], 0
imul eax, dword [ebp - 0x13a8], 0x74d3
test eax, eax
je 0x48668f
cmp dword [ebp - 0xa8], 0
je 0x48668f
mov dword [ebp - 0x13b0], 1
jmp 0x486696
and dword [ebp - 0x13b0], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x13b0], eax
jg 0x4866b0
mov dword [ebp - 0x13b8], 1
jmp 0x4866b7
and dword [ebp - 0x13b8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1cc4]
cmp dword [ebp - 0x13b8], eax
je 0x4866d8
mov dword [ebp - 0x13c0], 1
jmp 0x4866df
and dword [ebp - 0x13c0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1cc4]
add eax, dword [ebp - 0x13c0]
add eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0xa8]
jl 0x48670c
mov dword [ebp - 0x13c8], 1
jmp 0x486713
and dword [ebp - 0x13c8], 0
cmp dword [ebp - 0x13c8], 1
jae 0x486728
mov dword [ebp - 0x2a94], 1
jmp 0x48672f
and dword [ebp - 0x2a94], 0
mov eax, dword [ebp - 0x13d8]
mov dword [ebp - 0x3380], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1cc4], 0xffff
jb 0x48675a
and dword [ebp - 0x1400], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x37f4]
cmp dword [ebp - 0x1400], eax
je 0x486844
mov dword [ebp - 0x1408], 1
jmp 0x48684b
and dword [ebp - 0x1408], 0
mov eax, dword [ebp - 0x1408]
sub eax, dword [ebp - 0x1410]
cmp eax, 0xffff
jne 0x48686a
mov dword [ebp - 0x1418], 1
jmp 0x486871
and dword [ebp - 0x1418], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x1418]
jne 0x48688b
mov dword [ebp - 0x1420], 1
jmp 0x486892
and dword [ebp - 0x1420], 0
mov eax, dword [ebp - 0x1420]
mov dword [ebp - 0xa8], eax
xor ecx, ecx
call fcn.0044b02c
push eax
call fcn.00492e92
pop ecx
mov dword [ebp - 0xb60], 0xf99ff606
mov dword [ebp - 0xb5c], 0xf99ff606
mov dword [ebp - 0xb58], 0xf99ff606
mov dword [ebp - 0xb54], 0xf99ff606
mov dword [ebp - 0x70], 0xcd795364
mov dword [ebp - 0xb68], 0x6e311378
mov dword [ebp - 0x128], 0xd43d
mov dword [ebp - 0x70], 3
jmp 0x4868ff
cmp dword [ebp - 0x70], 0
jl 0x486d8b
mov dword [ebp - 0xb6c], 1
mov dword [ebp - 0x14a0], 7
mov dword [ebp - 0x14b0], 0x5e148cb4
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0xb60], 0
je 0x486951
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0xb60]
add eax, 0xf6b9af9
je 0x486951
and dword [ebp - 0x1428], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0xb60]
cmp dword [ebp - 0x1428], eax
jle 0x486a2d
mov dword [ebp - 0x2aa4], 1
mov dword [ebp - 0xb74], 0xd1b9849b
mov dword [ebp - 0xb7c], 1
mov dword [ebp - 0x2710], 1
mov dword [ebp - 0x270c], 1
mov dword [ebp - 0x2708], 1
mov dword [ebp - 0x2704], 1
mov dword [ebp - 0x2b04], 2
mov dword [ebp - 0x2b0c], 0xd7c869b7
mov dword [ebp - 0x3390], 0xfffffff9
mov dword [ebp - 0x3888], 0xbf8b243e
mov dword [ebp - 0x3398], 0xfffffff7
mov dword [ebp - 0x37e8], 0x261718bc
mov dword [ebp - 0x33a0], 0x9ca4f06
mov dword [ebp - 0x3890], 0
mov dword [ebp - 0x33a8], 0
mov dword [ebp - 0x37f8], 1
mov dword [ebp - 0x14e8], 1
mov dword [ebp - 0x74], 0
jmp 0x486e4f
cmp dword [ebp - 0x74], 2
jge 0x486e65
pop edi
pop esi
mov esp, ebp
pop ebp
ret